diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 7f5566fb979..5d5454e97be 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:18-bullseye
+FROM node:24.16.0-bullseye
 
 RUN useradd -m -s /bin/bash vscode
 RUN mkdir -p /workspaces && chown -R vscode:vscode /workspaces
diff --git a/.do/gitnexus/Dockerfile b/.do/gitnexus/Dockerfile
index a1266d5a133..8b7e538726e 100644
--- a/.do/gitnexus/Dockerfile
+++ b/.do/gitnexus/Dockerfile
@@ -5,15 +5,20 @@
 # startup. A fresh index only requires rsync + container restart — no
 # image rebuild on every push.
 
-FROM node:24-slim
+FROM node:24.16.0-slim
 
-ARG GITNEXUS_VERSION=1.5.3
+ARG GITNEXUS_VERSION=1.6.7
+# Pin the native DB to match the index workflow; gitnexus's ^0.17.0 range
+# would otherwise let the served image drift from the CI-produced index.
+ARG LADYBUG_VERSION=0.17.1
 
 # 1. Build native addons with Bookworm toolchain, then remove build tools.
 #    curl stays for the docker healthcheck; Caddy lives in its own container.
+#    LadybugDB is pinned nested under gitnexus so step 3's require() resolves it.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends python3 make g++ curl \
     && npm install -g gitnexus@${GITNEXUS_VERSION} \
+    && npm install --no-save --prefix /usr/local/lib/node_modules/gitnexus "@ladybugdb/core@${LADYBUG_VERSION}" \
     && apt-get purge -y --auto-remove python3 make g++ \
     && rm -rf /var/lib/apt/lists/* /root/.npm
 
@@ -26,17 +31,13 @@ RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.
     && rm -rf /var/lib/apt/lists/*
 
 # 3. Pre-install LadybugDB FTS + vector extensions so ~/.kuzu/extension/
-#    is baked into the image. Workaround for upstream GitNexus 1.5.3 bug.
+#    is baked into the image. gitnexus serve loads extensions with a
+#    load-only policy and never installs them at runtime, so the cache
+#    must already exist. (GitNexus loads the vector extension itself
+#    via loadVectorExtension — no adapter patch needed.)
 COPY install-extensions.js /tmp/install-extensions.js
 RUN node /tmp/install-extensions.js && rm -rf /tmp/install-extensions.js /tmp/lbug-ext-install
 
-# 4. Patch lbug-adapter.js to also LOAD EXTENSION vector after FTS.
-RUN LBUG_ADAPTER=/usr/local/lib/node_modules/gitnexus/dist/mcp/core/lbug-adapter.js \
-    && grep -q "LOAD EXTENSION fts" "$LBUG_ADAPTER" \
-    && sed -i "s|await available\[0\]\.query('LOAD EXTENSION fts');|await available[0].query('LOAD EXTENSION fts'); try { await available[0].query('LOAD EXTENSION vector'); } catch (e) { /* vector extension may not be installed */ }|g" "$LBUG_ADAPTER" \
-    && grep -c "LOAD EXTENSION vector" "$LBUG_ADAPTER" \
-    && echo "lbug-adapter.js patched to load vector extension"
-
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
diff --git a/.env.example b/.env.example
index 5d7f69a9def..09749f7e05b 100644
--- a/.env.example
+++ b/.env.example
@@ -33,6 +33,22 @@ MONGO_AUTO_CREATE=
 DOMAIN_CLIENT=http://localhost:3080
 DOMAIN_SERVER=http://localhost:3080
 
+# External admin panel base URL used for admin OAuth/SSO redirects.
+# Required when the admin panel is hosted separately from LibreChat.
+# May include a path. Do not include a trailing slash.
+# Example: https://admin.example.com/admin
+ADMIN_PANEL_URL=
+
+# Session encryption key for the bundled admin panel (min 32 characters).
+# Required when using the bundled admin panel in docker-compose/deploy-compose.
+# Generate a unique value before starting the stack:
+#   openssl rand -hex 32
+ADMIN_PANEL_SESSION_SECRET=
+
+# Host port for the bundled admin panel (default docker-compose only).
+# In deploy-compose the panel is served at http://admin.localhost via nginx.
+# ADMIN_PANEL_PORT=3000
+
 NO_INDEX=true
 # Use the address that is at most n number of hops away from the Express application.
 # req.socket.remoteAddress is the first hop, and the rest are looked for in the X-Forwarded-For header from right to left.
@@ -68,6 +84,8 @@ CONSOLE_JSON=false
 
 DEBUG_LOGGING=true
 DEBUG_CONSOLE=false
+# Set to false to disable file-backed Winston transports.
+LOG_TO_FILE=true
 # Set to true to enable agent debug logging
 AGENT_DEBUG_LOGGING=false
 
@@ -100,6 +118,10 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 
 # CONFIG_PATH="/alternative/path/to/librechat.yaml"
 
+# Deployment skills are loaded read-only at startup and exposed to all users
+# with the Skills capability enabled. Defaults to project root ./skill.
+# DEPLOYMENT_SKILLS_DIR=./skill
+
 #==================#
 # Langfuse Tracing #
 #==================#
@@ -110,13 +132,72 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 # LANGFUSE_SECRET_KEY=
 # LANGFUSE_BASE_URL=
 
+#=======================#
+# OpenTelemetry Tracing #
+#=======================#
+
+# Enables backend OpenTelemetry tracing. General backend visibility only;
+# use Langfuse for GenAI-specific prompt/model observability.
+# OTEL_TRACING_ENABLED=false
+# OTEL_SERVICE_NAME=librechat
+# OTEL_SERVICE_VERSION=
+# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
+# OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=
+# OTEL_EXPORTER_OTLP_HEADERS=
+# OTEL_TRACES_EXPORTER=otlp
+# OTEL_TRACES_SAMPLER=parentbased_always_on
+# OTEL_LOG_LEVEL=INFO
+# OTEL_SDK_DISABLED=false
+# Enable Redis command-level spans. Disabled by default to keep backend traces high-level.
+# OTEL_IOREDIS_TRACING_ENABLED=false
+
+#===============================#
+# Real User Monitoring (Browser) #
+#===============================#
+
+# Enables browser Real User Monitoring. Disabled by default.
+# Currently supports HyperDX via the browser SDK.
+# RUM_ENABLED=false
+# RUM_PROVIDER=hyperdx
+# RUM_URL=http://localhost:4318
+# RUM_SERVICE_NAME=librechat-web
+# RUM_ENVIRONMENT=development
+
+# Public browser-token mode is suitable for OSS/self-hosted deployments.
+# Treat the token as public and restrict/rate-limit ingestion in your RUM backend.
+# RUM_AUTH_MODE=publicToken
+# RUM_PUBLIC_TOKEN=
+
+# Authenticated proxy mode sends browser telemetry to this LibreChat backend first.
+# The backend validates the LibreChat session, strips app auth, and forwards to the collector.
+# RUM_AUTH_MODE=proxy
+# RUM_PROXY_TARGET_URL=http://otel-collector:4318
+# RUM_PROXY_TIMEOUT_MS=10000
+
+# Optional comma-separated first-party HTTPS origins/URLs that should receive traceparent headers.
+# Wildcards and non-HTTPS targets are ignored.
+# RUM_TRACE_PROPAGATION_TARGETS=https://api.example.com
+
+# Privacy defaults: replay, console capture, and full network body capture stay off.
+# Console/network capture may collect sensitive browser logs, prompts, responses, or payloads.
+# RUM_DISABLE_REPLAY=true
+# RUM_CONSOLE_CAPTURE=false
+# RUM_ADVANCED_NETWORK_CAPTURE=false
+# RUM_SAMPLE_RATE=1
+
 #===================================================#
 #                     Endpoints                     #
 #===================================================#
 
 # ENDPOINTS=openAI,assistants,azureOpenAI,google,anthropic
 
+# Optional outbound proxy for server-side requests.
+# PROXY applies to both HTTP and HTTPS targets. When PROXY is unset, LibreChat honors
+# HTTP_PROXY, HTTPS_PROXY, and NO_PROXY/no_proxy for supported server-side clients.
 PROXY=
+# HTTP_PROXY=
+# HTTPS_PROXY=
+# NO_PROXY=
 
 #===================================#
 # Known Endpoints - librechat.yaml  #
@@ -144,7 +225,7 @@ PROXY=
 #============#
 
 ANTHROPIC_API_KEY=user_provided
-# ANTHROPIC_MODELS=claude-opus-4-7,claude-sonnet-4-6,claude-opus-4-6,claude-opus-4-20250514,claude-3-7-sonnet-20250219,claude-3-5-sonnet-20241022,claude-3-5-haiku-20241022,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307
+# ANTHROPIC_MODELS=claude-fable-5,claude-opus-4-8,claude-opus-4-7,claude-sonnet-4-6,claude-opus-4-6,claude-opus-4-20250514,claude-3-7-sonnet-20250219,claude-3-5-sonnet-20241022,claude-3-5-haiku-20241022,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307
 # ANTHROPIC_REVERSE_PROXY=
 
 # Set to true to use Anthropic models through Google Vertex AI instead of direct API
@@ -173,15 +254,45 @@ ANTHROPIC_API_KEY=user_provided
 #=================#
 #   AWS Bedrock   #
 #=================#
+# AWS Bedrock credentials
+#
+# Preferred for local development: configure an AWS profile in ~/.aws/config or
+# ~/.aws/credentials, then set BEDROCK_AWS_PROFILE. LibreChat passes this profile
+# to the AWS SDK for JavaScript credential provider chain.
+#
+# In deployed environments, prefer IAM roles or other short-term credentials
+# discoverable by the AWS SDK default credential provider chain. If neither
+# BEDROCK_AWS_PROFILE nor Bedrock-specific static credentials are set, the SDK
+# uses its default provider chain. AWS-standard environment variables still
+# follow AWS SDK precedence.
+#
+# Profiles can use IAM Identity Center, assume-role settings, or credential_process.
+# If you use credential_process, secure the config file and helper command, and do
+# not write secret material to stderr.
+#
+# AWS SDK credential chain:
+# https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html
+# Shared config/profile settings:
+# https://docs.aws.amazon.com/sdkref/latest/guide/settings-reference.html
+# credential_process security notes:
+# https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html
 
 # BEDROCK_AWS_DEFAULT_REGION=us-east-1 # A default region must be provided
+
+# AWS Profile
+# BEDROCK_AWS_PROFILE=your-profile-name
+
+# Static credentials (use only if profiles or IAM roles are not suitable)
 # BEDROCK_AWS_ACCESS_KEY_ID=someAccessKey
 # BEDROCK_AWS_SECRET_ACCESS_KEY=someSecretAccessKey
 # BEDROCK_AWS_SESSION_TOKEN=someSessionToken
 
+# Bedrock API key
+# BEDROCK_AWS_BEARER_TOKEN=yourBedrockApiKey
+
 # Note: This example list is not meant to be exhaustive. If omitted, all known, supported model IDs will be included for you.
-# BEDROCK_AWS_MODELS=anthropic.claude-opus-4-7,anthropic.claude-sonnet-4-6,anthropic.claude-opus-4-6-v1,anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
-# Cross-region inference model IDs: us.anthropic.claude-opus-4-7,us.anthropic.claude-sonnet-4-6,us.anthropic.claude-opus-4-6-v1,global.anthropic.claude-opus-4-6-v1
+# BEDROCK_AWS_MODELS=anthropic.claude-fable-5,anthropic.claude-opus-4-8,anthropic.claude-opus-4-7,anthropic.claude-sonnet-4-6,anthropic.claude-opus-4-6-v1,anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
+# Cross-region inference model IDs: us.anthropic.claude-fable-5,us.anthropic.claude-opus-4-8,us.anthropic.claude-opus-4-7,us.anthropic.claude-sonnet-4-6,us.anthropic.claude-opus-4-6-v1,global.anthropic.claude-opus-4-6-v1
 
 # See all Bedrock model IDs here: https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns
 
@@ -192,6 +303,10 @@ ANTHROPIC_API_KEY=user_provided
 # The following models are not support due to not supporting conversation history:
 # ai21.j2-ultra-v1, cohere.command-text-v14, cohere.command-light-text-v14
 
+# Claude Mythos-class models (anthropic.claude-fable-5, anthropic.claude-mythos-5) are inference-profile
+# only on Bedrock — use a profile ID (e.g. us.anthropic.claude-fable-5) — and require opting into Anthropic
+# data sharing via the Bedrock Data Retention API/console before they can be invoked.
+
 #============#
 # Google     #
 #============#
@@ -471,6 +586,10 @@ ALLOW_UNVERIFIED_EMAIL_LOGIN=true
 
 SESSION_EXPIRY=1000 * 60 * 15
 REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7
+# Overrides the Secure attribute for session/auth cookies when set to true or false;
+# leave unset to use the default NODE_ENV/DOMAIN_SERVER heuristic.
+# Set to false only for HTTP-only deployments where browsers drop Secure cookies.
+# SESSION_COOKIE_SECURE=false
 
 JWT_SECRET=16f8c0ef4a5d391b26034086c628469d3f9f497f08163ab9b40137092f2909ef
 JWT_REFRESH_SECRET=eaa5191f2914e30b9387fd84e254e4ba6fc51b4654968a9b0803b456a54b8418
@@ -512,12 +631,24 @@ OPENID_ISSUER=
 OPENID_SESSION_SECRET=
 OPENID_SCOPE="openid profile email"
 OPENID_CALLBACK_URL=/oauth/openid/callback
+# Admin panel SSO uses ${DOMAIN_SERVER}/api/admin/oauth/openid/callback as the
+# OpenID provider redirect URI.
 OPENID_REQUIRED_ROLE=
 OPENID_REQUIRED_ROLE_TOKEN_KIND=
 OPENID_REQUIRED_ROLE_PARAMETER_PATH=
 OPENID_ADMIN_ROLE=
 OPENID_ADMIN_ROLE_PARAMETER_PATH=
 OPENID_ADMIN_ROLE_TOKEN_KIND=
+# Generic OpenID role sync maps non-admin IdP roles/groups to one LibreChat role.
+# ADMIN cannot be assigned by generic role sync; use OPENID_ADMIN_ROLE for admin elevation.
+# Role priority is ordered from most important to least important.
+OPENID_ROLE_SYNC_ENABLED=false
+OPENID_ROLE_SYNC_API_ENABLED=false
+OPENID_ROLE_SYNC_SOURCE=id
+OPENID_ROLE_SYNC_CLAIM=
+OPENID_ROLE_SYNC_ROLE_PRIORITY=
+# Fallback is authoritative when configured: if no priority role matches, this role is assigned.
+OPENID_ROLE_SYNC_FALLBACK_ROLE=
 # Set to determine which user info property returned from OpenID Provider to store as the User's username
 OPENID_USERNAME_CLAIM=
 # Set to determine which user info property returned from OpenID Provider to store as the User's name
@@ -525,7 +656,9 @@ OPENID_NAME_CLAIM=
 # Set to determine which user info claim to use as the email/identifier for user matching (e.g., "upn" for Entra ID)
 # When not set, defaults to: email -> preferred_username -> upn
 OPENID_EMAIL_CLAIM=
-# Optional audience parameter for OpenID authorization requests
+# Optional audience parameter for OpenID authorization requests and JWT validation.
+# If comma-separated values are provided, JWT validation accepts all values and
+# authorization requests use the first non-empty value.
 OPENID_AUDIENCE=
 # Optional audience parameter for OpenID refresh token requests.
 # Some providers, such as Auth0 custom APIs, require this to preserve
@@ -537,10 +670,17 @@ OPENID_IMAGE_URL=
 # Set to true to automatically redirect to the OpenID provider when a user visits the login page
 # This will bypass the login form completely for users, only use this if OpenID is your only authentication method
 OPENID_AUTO_REDIRECT=false
-# Set to true to use PKCE (Proof Key for Code Exchange) for OpenID authentication
+# Set to true to use PKCE (Proof Key for Code Exchange) for OpenID authentication.
+# For public clients (no client secret), leave OPENID_CLIENT_SECRET empty and set this to true.
 OPENID_USE_PKCE=false
 #Set to true to reuse openid tokens for authentication management instead of using the mongodb session and the custom refresh token.
 OPENID_REUSE_TOKENS=
+#Max age a reused OpenID session token is served before LibreChat forces an IdP refresh. Default 900000 ms (15 min).
+#Accepts an arithmetic expression like SESSION_EXPIRY (e.g. 60 * 60 * 24 * 1000 for 24h).
+#Raise toward the IdP access-token lifetime when the IdP revokes the previous access token on refresh, so a still-valid token
+#is not rotated/revoked out from under downstream consumers (e.g. MCP servers that introspect the bearer).
+#When OPENID_REUSE_TOKENS=true, the OpenID session cookie maxAge is extended to at least this value.
+OPENID_REUSE_MAX_SESSION_AGE_MS=
 #By default, signing key verification results are cached in order to prevent excessive HTTP requests to the JWKS endpoint.
 #If a signing key matching the kid is found, this will be cached and the next time this kid is requested the signing key will be served from the cache.
 #Default is true.
@@ -679,6 +819,9 @@ AWS_BUCKET_NAME=
 # Required for path-style S3-compatible providers (MinIO, Hetzner, Backblaze B2, etc.)
 # that don't support virtual-hosted-style URLs (bucket.endpoint). Not needed for AWS S3.
 # AWS_FORCE_PATH_STYLE=false
+# Required for CloudFront signed cookies and signed download URLs
+# CLOUDFRONT_KEY_PAIR_ID=
+# CLOUDFRONT_PRIVATE_KEY=
 
 #========================#
 # Azure Blob Storage     #
@@ -695,6 +838,10 @@ AZURE_CONTAINER_NAME=files
 ALLOW_SHARED_LINKS=true
 # Allows unauthenticated access to shared links. Defaults to false (auth required) if not set.
 ALLOW_SHARED_LINKS_PUBLIC=false
+# Snapshot files referenced by a shared chat so viewers can preview/download them through
+# the shared link (instead of the owner's file ACL). Enabled by default; overrides the
+# `interface.sharedLinks.snapshotFiles` yaml setting when set.
+# SHARED_LINKS_SNAPSHOT_FILES=true
 
 #==============================#
 # Static File Cache Control    #
@@ -708,6 +855,9 @@ ALLOW_SHARED_LINKS_PUBLIC=false
 # If you have another service in front of your LibreChat doing compression, disable express based compression here
 # DISABLE_COMPRESSION=true
 
+# Serve precompressed Brotli versions of static app assets when available.
+# ENABLE_STATIC_ASSET_BROTLI=true
+
 # If you have gzipped version of uploaded image images in the same folder, this will enable gzip scan and serving of these images
 # Note: The images folder will be scanned on startup and a ma kept in memory. Be careful for large number of images.
 # ENABLE_IMAGE_OUTPUT_GZIP_SCAN=true
@@ -730,6 +880,11 @@ HELP_AND_FAQ_URL=https://librechat.ai
 # such as the below example of 250 mib
 # CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES=262144000
 
+# Max size (bytes) of a code-execution artifact (docx/xlsx/csv/pptx/text/pdf) rendered as an
+# inline preview. Larger files fall back to download-only. Default: 2 MB (2097152). Note the
+# rendered HTML is independently capped at 512 KB, so very rich files may still skip preview.
+# FILE_PREVIEW_MAX_EXTRACT_BYTES=2097152
+
 
 #===============#
 # REDIS Options #
@@ -746,6 +901,12 @@ HELP_AND_FAQ_URL=https://librechat.ai
 
 # Redis cluster (multiple nodes)
 # REDIS_URI=redis://127.0.0.1:7001,redis://127.0.0.1:7002,redis://127.0.0.1:7003
+# Enable Redis cluster mode when connecting to a cluster through a single URI
+# USE_REDIS_CLUSTER=true
+
+# Managed Redis services with a single endpoint may shard keys internally and reject multi-key DEL
+# Set to true to delete keys individually and avoid CROSSSLOT errors while keeping single-node mode
+# REDIS_CLUSTER_SAFE_DELETE=true
 
 # Redis with TLS/SSL encryption and CA certificate
 # REDIS_URI=rediss://127.0.0.1:6380
@@ -856,9 +1017,23 @@ OPENWEATHER_API_KEY=
 # Timeout for OAuth detection requests in milliseconds
 # MCP_OAUTH_DETECTION_TIMEOUT=5000
 
+# How long to wait (ms) for a user to complete the OAuth flow before timing out (default: 10 minutes)
+# MCP_OAUTH_HANDLING_TIMEOUT=600000
+
+# TTL (ms) for OAuth flow state; must outlive MCP_OAUTH_HANDLING_TIMEOUT (default: 15 minutes)
+# MCP_OAUTH_FLOW_TTL=900000
+
 # Cache connection status checks for this many milliseconds to avoid expensive verification
 # MCP_CONNECTION_CHECK_TTL=60000
 
+# Max bytes allowed in a non-GET streamable HTTP MCP response before rejecting it.
+# Set to 0 to disable. Default: 16777216 (16 MiB)
+# MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES=16777216
+
+# Max bytes allowed in a single SSE line for non-GET streamable HTTP MCP responses.
+# Set to 0 to disable. Default: 5242880 (5 MiB)
+# MCP_STREAMABLE_HTTP_MAX_LINE_BYTES=5242880
+
 # Skip code challenge method validation (e.g., for AWS Cognito that supports S256 but doesn't advertise it)
 # When set to true, forces S256 code challenge even if not advertised in .well-known/openid-configuration
 # MCP_SKIP_CODE_CHALLENGE_CHECK=false
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index ae9e6d8e4ba..6524947ba22 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -26,7 +26,7 @@ Project maintainers have the right and responsibility to remove, edit, or reject
 
 ## 1. Development Setup
 
-1. Use Node.js v20.19.0+ or ^22.12.0 or >= 23.0.0.
+1. Use Node.js v24.16.0.
 2. Run `npm run smart-reinstall` to install dependencies (uses Turborepo). Use `npm run reinstall` for a clean install, or `npm ci` for a fresh lockfile-based install.
 3. Build all compiled code: `npm run build`.
 4. Setup and run unit tests:
diff --git a/.github/ISSUE_TEMPLATE/BUG-REPORT.yml b/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
index 610396959fe..e7ef45f7c42 100644
--- a/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
+++ b/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
@@ -26,17 +26,14 @@ body:
     id: version-info
     attributes:
       label: Version Information
-      description: |
-        If using Docker, please run and provide the output of:
-        ```bash
-        docker images | grep librechat
-        ```
-        
-        If running from source, please run and provide the output of:
-        ```bash
-        git rev-parse HEAD
-        ```
-      placeholder: Paste the output here
+      description: |
+        In LibreChat, open **Settings → About** and click **Copy diagnostics**, then paste the result here.
+        This captures the exact version, commit, branch, and build date so maintainers can pinpoint the build you're running.
+
+        If the About panel is unavailable (older version / self-hosted with it disabled), please provide as much of the following as possible instead:
+        - Docker: `docker images | grep librechat` (image tag) and `docker inspect <image> | grep -i "\"Commit\\|BUILD_"` if build args were set
+        - Source: `git rev-parse HEAD` and `git rev-parse --abbrev-ref HEAD`
+      placeholder: Paste the diagnostics block here
     validations:
       required: true
   - type: textarea
@@ -93,4 +90,4 @@ body:
       description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/danny-avila/LibreChat/blob/main/.github/CODE_OF_CONDUCT.md)
       options:
         - label: I agree to follow this project's Code of Conduct
-          required: true
\ No newline at end of file
+          required: true
diff --git a/.github/playwright.yml b/.github/playwright.yml
index 28eca14d581..27f026a525b 100644
--- a/.github/playwright.yml
+++ b/.github/playwright.yml
@@ -39,7 +39,7 @@
 #       - uses: actions/checkout@v4
 #       - uses: actions/setup-node@v4
 #         with:
-#           node-version: 18
+#           node-version: 24.16.0
 #           cache: 'npm'
 
 #       - name: Install global dependencies
diff --git a/.github/scripts/sync-helm-chart-tags.sh b/.github/scripts/sync-helm-chart-tags.sh
new file mode 100755
index 00000000000..f54048a1ea9
--- /dev/null
+++ b/.github/scripts/sync-helm-chart-tags.sh
@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_PATH="${CHART_PATH:-helm/librechat/Chart.yaml}"
+DEFAULT_BRANCH="${DEFAULT_BRANCH:-main}"
+BASE_REF="${BASE_REF:-refs/remotes/origin/${DEFAULT_BRANCH}}"
+BACKFILL_FROM_VERSION="${BACKFILL_FROM_VERSION:-1.9.0}"
+PUSH_TAGS="${PUSH_TAGS:-false}"
+TAG_PREFIX="${TAG_PREFIX:-chart-}"
+GITHUB_SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"
+DISPATCH_WORKFLOW="${DISPATCH_WORKFLOW:-}"
+RELEASE_EXISTING_TAG="${RELEASE_EXISTING_TAG:-}"
+SEMVER_REGEX='^(0|[1-9][0-9]*)[.](0|[1-9][0-9]*)[.](0|[1-9][0-9]*)(-[0-9A-Za-z-]+([.][0-9A-Za-z-]+)*)?([+][0-9A-Za-z-]+([.][0-9A-Za-z-]+)*)?$'
+
+fail() {
+  printf '::error::%s\n' "$1" >&2
+  exit 1
+}
+
+git_auth_header() {
+  token="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
+  printf 'AUTHORIZATION: basic %s' "$token"
+}
+
+git_with_auth() {
+  if [ -n "${GITHUB_TOKEN:-}" ]; then
+    git -c "http.extraheader=$(git_auth_header)" "$@"
+    return
+  fi
+
+  git "$@"
+}
+
+dispatch_release() {
+  tag="$1"
+
+  if [ -z "$DISPATCH_WORKFLOW" ]; then
+    return
+  fi
+
+  if [ -z "${GITHUB_REPOSITORY:-}" ]; then
+    fail "GITHUB_REPOSITORY is required to dispatch ${DISPATCH_WORKFLOW}"
+  fi
+
+  if [[ ! "$GITHUB_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+    fail "Unexpected repository name: ${GITHUB_REPOSITORY}"
+  fi
+
+  if [[ ! "$DISPATCH_WORKFLOW" =~ ^[A-Za-z0-9_.-]+[.]ya?ml$ ]]; then
+    fail "Unexpected workflow file: ${DISPATCH_WORKFLOW}"
+  fi
+
+  token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  if [ -z "$token" ]; then
+    fail "GH_TOKEN or GITHUB_TOKEN is required to dispatch ${DISPATCH_WORKFLOW}"
+  fi
+
+  command -v gh >/dev/null ||
+    fail "GitHub CLI is required to dispatch ${DISPATCH_WORKFLOW}"
+
+  GH_TOKEN="$token" gh workflow run "$DISPATCH_WORKFLOW" \
+    --repo "$GITHUB_REPOSITORY" \
+    --ref "$DEFAULT_BRANCH" \
+    -f "chart_tag=${tag}"
+}
+
+version_less_than() {
+  left="${1%%[-+]*}"
+  right="${2%%[-+]*}"
+
+  IFS=. read -r left_major left_minor left_patch <<<"$left"
+  IFS=. read -r right_major right_minor right_patch <<<"$right"
+
+  if (( left_major != right_major )); then
+    (( left_major < right_major ))
+    return
+  fi
+
+  if (( left_minor != right_minor )); then
+    (( left_minor < right_minor ))
+    return
+  fi
+
+  (( left_patch < right_patch ))
+}
+
+validate_chart_tag() {
+  tag="$1"
+  version="${tag#${TAG_PREFIX}}"
+
+  git check-ref-format "refs/tags/${tag}" >/dev/null ||
+    fail "Refusing to use invalid tag ${tag}"
+
+  if [[ "$tag" != "${TAG_PREFIX}"* || ! "$version" =~ $SEMVER_REGEX ]]; then
+    fail "Chart tags must use the form ${TAG_PREFIX}<semver>, for example ${TAG_PREFIX}2.0.5"
+  fi
+}
+
+dispatch_existing_tag() {
+  tag="$1"
+
+  if [ -z "$tag" ]; then
+    return
+  fi
+
+  validate_chart_tag "$tag"
+
+  if [ "$PUSH_TAGS" != "true" ]; then
+    printf 'Would dispatch release workflow for existing %s.\n' "$tag"
+    return
+  fi
+
+  if ! git_with_auth ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+    fail "Remote tag ${tag} does not exist"
+  fi
+
+  printf 'Dispatching release workflow for existing %s.\n' "$tag"
+  dispatch_release "$tag"
+}
+
+chart_version_at() {
+  git show "${1}:${CHART_PATH}" 2>/dev/null | awk '
+    /^version:[[:space:]]*/ {
+      value = $0
+      sub(/^version:[[:space:]]*/, "", value)
+      sub(/[[:space:]]*#.*/, "", value)
+      gsub(/^[[:space:]"'\''"]+|[[:space:]"'\''"]+$/, "", value)
+      print value
+      exit
+    }
+  '
+}
+
+case "$PUSH_TAGS" in
+  true | false) ;;
+  *) fail "PUSH_TAGS must be true or false" ;;
+esac
+
+if [[ ! "$BACKFILL_FROM_VERSION" =~ $SEMVER_REGEX ]]; then
+  fail "BACKFILL_FROM_VERSION must be a valid SemVer value"
+fi
+
+git rev-parse --verify "${BASE_REF}^{commit}" >/dev/null ||
+  fail "Unable to resolve ${BASE_REF}; fetch ${DEFAULT_BRANCH} before running this script"
+
+history_file="$(mktemp)"
+versions_file="$(mktemp)"
+seen_file="$(mktemp)"
+missing_file="$(mktemp)"
+cleanup() {
+  rm -f "$history_file" "$versions_file" "$seen_file" "$missing_file"
+}
+trap cleanup EXIT
+
+git log --first-parent --reverse --format=%H "$BASE_REF" -- "$CHART_PATH" >"$history_file"
+
+if [ ! -s "$history_file" ]; then
+  fail "No history found for ${CHART_PATH} on ${BASE_REF}"
+fi
+
+while IFS= read -r commit; do
+  version="$(chart_version_at "$commit")"
+
+  if [ -z "$version" ]; then
+    continue
+  fi
+
+  if [[ ! "$version" =~ $SEMVER_REGEX ]]; then
+    fail "${CHART_PATH} has invalid SemVer '${version}' at ${commit}"
+  fi
+
+  if version_less_than "$version" "$BACKFILL_FROM_VERSION"; then
+    continue
+  fi
+
+  if grep -Fqx "$version" "$seen_file"; then
+    continue
+  fi
+
+  printf '%s\n' "$version" >>"$seen_file"
+  printf '%s\t%s\n' "$version" "$commit" >>"$versions_file"
+done <"$history_file"
+
+if [ ! -s "$versions_file" ]; then
+  fail "No chart versions found in ${CHART_PATH}"
+fi
+
+while IFS="$(printf '\t')" read -r version commit; do
+  tag="${TAG_PREFIX}${version}"
+
+  validate_chart_tag "$tag"
+
+  if git rev-parse --quiet --verify "refs/tags/${tag}" >/dev/null; then
+    continue
+  fi
+
+  printf '%s\t%s\n' "$tag" "$commit" >>"$missing_file"
+done <"$versions_file"
+
+if [ ! -s "$missing_file" ]; then
+  printf 'All chart versions on %s already have %s tags.\n' "$BASE_REF" "$TAG_PREFIX"
+  dispatch_existing_tag "$RELEASE_EXISTING_TAG"
+  exit 0
+fi
+
+while IFS="$(printf '\t')" read -r tag commit; do
+  short_commit="$(git rev-parse --short "$commit")"
+
+  if [ "$PUSH_TAGS" != "true" ]; then
+    printf 'Would create %s at %s.\n' "$tag" "$short_commit"
+    continue
+  fi
+
+  if git_with_auth ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+    printf 'Remote tag %s already exists; dispatching release workflow.\n' "$tag"
+    dispatch_release "$tag"
+    continue
+  fi
+
+  git tag "$tag" "$commit"
+
+  if git_with_auth push origin "refs/tags/${tag}"; then
+    printf 'Created %s at %s.\n' "$tag" "$short_commit"
+    dispatch_release "$tag"
+    continue
+  fi
+
+  if git_with_auth ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+    printf 'Remote tag %s was created concurrently; dispatching release workflow.\n' "$tag"
+    dispatch_release "$tag"
+    continue
+  fi
+
+  fail "Failed to push ${tag}"
+done <"$missing_file"
+
+dispatch_existing_tag "$RELEASE_EXISTING_TAG"
diff --git a/.github/workflows/a11y.yml b/.github/workflows/a11y.yml
index a7cfd08169b..344592cf3ed 100644
--- a/.github/workflows/a11y.yml
+++ b/.github/workflows/a11y.yml
@@ -11,6 +11,10 @@ on:
         required: true
         default: 'false'
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   axe-linter:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/backend-review.yml b/.github/workflows/backend-review.yml
index 03b7c135d2a..46a698cd5ac 100644
--- a/.github/workflows/backend-review.yml
+++ b/.github/workflows/backend-review.yml
@@ -5,6 +5,9 @@ on:
       - 'api/**'
       - 'packages/**'
 
+permissions:
+  contents: read
+
 env:
   NODE_ENV: CI
   NODE_OPTIONS: '--max-old-space-size=${{ secrets.NODE_MAX_OLD_SPACE_SIZE || 6144 }}'
@@ -17,10 +20,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -32,7 +35,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -43,7 +46,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-provider/dist
-          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-provider
         if: steps.cache-data-provider.outputs.cache-hit != 'true'
@@ -54,7 +57,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-schemas/dist
-          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-schemas
         if: steps.cache-data-schemas.outputs.cache-hit != 'true'
@@ -65,7 +68,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/api/dist
-          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/server-rollup.config.js', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json') }}
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
 
       - name: Build api
         if: steps.cache-api.outputs.cache-hit != 'true'
@@ -100,10 +103,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -115,7 +118,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -159,10 +162,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -174,7 +177,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -212,10 +215,14 @@ jobs:
           fi
 
   test-api:
-    name: 'Tests: api'
+    name: 'Tests: api (shard ${{ matrix.shard }}/3)'
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
     env:
       MONGO_URI: ${{ secrets.MONGO_URI }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -228,10 +235,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -243,7 +250,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -275,8 +282,8 @@ jobs:
       - name: Prepare .env.test file
         run: cp api/test/.env.test.example api/test/.env.test
 
-      - name: Run unit tests
-        run: cd api && npm run test:ci
+      - name: Run unit tests (shard ${{ matrix.shard }}/3)
+        run: cd api && npm run test:ci -- --shard=${{ matrix.shard }}/3
 
   test-data-provider:
     name: 'Tests: data-provider'
@@ -286,10 +293,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -301,7 +308,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -324,10 +331,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -339,7 +346,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -361,17 +368,25 @@ jobs:
         run: cd packages/data-schemas && npm run test:ci
 
   test-packages-api:
-    name: 'Tests: @librechat/api'
+    name: 'Tests: @librechat/api (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # Suite typically completes in ~5 min on a warm runner, but tail-latency
+    # cancellations have started showing up: tests are actively passing right
+    # up to the timeout, then the job is killed mid-suite. Sharding splits the
+    # suite across runners; per-shard headroom still absorbs runner variance.
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -383,7 +398,7 @@ jobs:
             packages/api/node_modules
             packages/data-provider/node_modules
             packages/data-schemas/node_modules
-          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -407,5 +422,5 @@ jobs:
           name: build-api
           path: packages/api/dist
 
-      - name: Run unit tests
-        run: cd packages/api && npm run test:ci
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: cd packages/api && npm run test:ci -- --shard=${{ matrix.shard }}/4
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a2131c4b985..9210b80a93d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,9 @@ name: Linux_Container_Workflow
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   RUNNER_VERSION: 2.293.0
 
@@ -12,26 +15,26 @@ jobs:
     steps:
       # checkout the repo
       - name: 'Checkout GitHub Action'
-        uses: actions/checkout@main
+        uses: actions/checkout@v4
 
       - name: 'Login via Azure CLI'
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
       - name: 'Build GitHub Runner container image'
-        uses: azure/docker-login@v1
+        uses: docker/login-action@v3
         with:
-          login-server: ${{ secrets.REGISTRY_LOGIN_SERVER }}
+          registry: ${{ secrets.REGISTRY_LOGIN_SERVER }}
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - run: |
           docker build --build-arg RUNNER_VERSION=${{ env.RUNNER_VERSION }} -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/pwd9000-github-runner-lin:${{ env.RUNNER_VERSION }} .
 
       - name: 'Push container image to ACR'
-        uses: azure/docker-login@v1
+        uses: docker/login-action@v3
         with:
-          login-server: ${{ secrets.REGISTRY_LOGIN_SERVER }}
+          registry: ${{ secrets.REGISTRY_LOGIN_SERVER }}
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - run: |
diff --git a/.github/workflows/cache-integration-tests.yml b/.github/workflows/cache-integration-tests.yml
index caebbfc4454..1a70e4b6b0e 100644
--- a/.github/workflows/cache-integration-tests.yml
+++ b/.github/workflows/cache-integration-tests.yml
@@ -15,6 +15,9 @@ on:
       - 'redis-config/**'
       - '.github/workflows/cache-integration-tests.yml'
 
+permissions:
+  contents: read
+
 jobs:
   cache_integration_tests:
     name: Integration Tests that use actual Redis Cache
@@ -25,11 +28,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: 20
-          cache: 'npm'
+          node-version: '24.16.0'
 
       - name: Install Redis tools
         run: |
@@ -54,14 +56,54 @@ jobs:
           redis-cli -p 7002 cluster info || exit 1
           redis-cli -p 7003 cluster info || exit 1
 
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            api/node_modules
+            packages/api/node_modules
+            packages/data-provider/node_modules
+            packages/data-schemas/node_modules
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
+
       - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
         run: npm ci
 
-      - name: Build packages
-        run: |
-          npm run build:data-provider
-          npm run build:data-schemas
-          npm run build:api
+      - name: Restore data-provider build cache
+        id: cache-data-provider
+        uses: actions/cache@v4
+        with:
+          path: packages/data-provider/dist
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-provider
+        if: steps.cache-data-provider.outputs.cache-hit != 'true'
+        run: npm run build:data-provider
+
+      - name: Restore data-schemas build cache
+        id: cache-data-schemas
+        uses: actions/cache@v4
+        with:
+          path: packages/data-schemas/dist
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-schemas
+        if: steps.cache-data-schemas.outputs.cache-hit != 'true'
+        run: npm run build:data-schemas
+
+      - name: Restore api build cache
+        id: cache-api
+        uses: actions/cache@v4
+        with:
+          path: packages/api/dist
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
+
+      - name: Build api
+        if: steps.cache-api.outputs.cache-hit != 'true'
+        run: npm run build:api
 
       - name: Run all cache integration tests (Single Redis Node)
         working-directory: packages/api
diff --git a/.github/workflows/client.yml b/.github/workflows/client.yml
index e3e3e445e46..e4dc8c56264 100644
--- a/.github/workflows/client.yml
+++ b/.github/workflows/client.yml
@@ -14,31 +14,27 @@ on:
         default: 'Manual publish requested'
 
 permissions:
-  id-token: write  # Required for OIDC trusted publishing
   contents: read
 
 jobs:
-  build-and-publish:
+  pack:
     runs-on: ubuntu-latest
-    environment: publish  # Must match npm trusted publisher config
+    outputs:
+      skip: ${{ steps.check.outputs.skip }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-      
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
-        
+          node-version: '24.16.0'
+
       - name: Install client dependencies
         run: cd packages/client && npm ci
-        
+
       - name: Build client
         run: cd packages/client && npm run build
-        
+
       - name: Check version change
         id: check
         working-directory: packages/client
@@ -52,13 +48,47 @@ jobs:
             echo "Version changed, proceeding with publish"
             echo "skip=false" >> $GITHUB_OUTPUT
           fi
-            
+
       - name: Pack package
         if: steps.check.outputs.skip != 'true'
         working-directory: packages/client
-        run: npm pack
-        
-      - name: Publish
+        run: |
+          mkdir -p "$GITHUB_WORKSPACE/npm-package"
+          npm pack --pack-destination "$GITHUB_WORKSPACE/npm-package"
+
+      - name: Upload package
         if: steps.check.outputs.skip != 'true'
-        working-directory: packages/client
+        uses: actions/upload-artifact@v4
+        with:
+          name: librechat-client-package
+          path: npm-package/*.tgz
+          if-no-files-found: error
+          retention-days: 2
+
+  publish-npm:
+    needs: pack
+    if: github.ref == 'refs/heads/main' && needs.pack.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC trusted publishing
+    steps:
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install npm with OIDC support
+        run: npm install -g npm@11.14.1 --ignore-scripts
+
+      - name: Download package
+        uses: actions/download-artifact@v4
+        with:
+          name: librechat-client-package
+          path: npm-package
+
+      - name: Publish
+        working-directory: npm-package
         run: npm publish *.tgz --access public --provenance
diff --git a/.github/workflows/config-review.yml b/.github/workflows/config-review.yml
new file mode 100644
index 00000000000..fc25989aa87
--- /dev/null
+++ b/.github/workflows/config-review.yml
@@ -0,0 +1,88 @@
+name: Config Migration Tests
+on:
+  pull_request:
+    paths:
+      - 'config/**'
+      - 'api/models/**'
+      - 'api/db/**'
+      - 'packages/data-schemas/src/**'
+      - 'packages/data-provider/src/**'
+      - 'packages/api/src/acl/**'
+      - 'packages/api/src/shared-links/**'
+
+env:
+  NODE_ENV: CI
+  NODE_OPTIONS: '--max-old-space-size=${{ secrets.NODE_MAX_OLD_SPACE_SIZE || 6144 }}'
+
+jobs:
+  test-config:
+    name: 'Tests: config migrations'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 24.16.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            api/node_modules
+            packages/api/node_modules
+            packages/data-provider/node_modules
+            packages/data-schemas/node_modules
+          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Restore data-provider build cache
+        id: cache-data-provider
+        uses: actions/cache@v4
+        with:
+          path: packages/data-provider/dist
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-provider
+        if: steps.cache-data-provider.outputs.cache-hit != 'true'
+        run: npm run build:data-provider
+
+      - name: Restore data-schemas build cache
+        id: cache-data-schemas
+        uses: actions/cache@v4
+        with:
+          path: packages/data-schemas/dist
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-schemas
+        if: steps.cache-data-schemas.outputs.cache-hit != 'true'
+        run: npm run build:data-schemas
+
+      - name: Restore api build cache
+        id: cache-api
+        uses: actions/cache@v4
+        with:
+          path: packages/api/dist
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
+
+      - name: Build api
+        if: steps.cache-api.outputs.cache-hit != 'true'
+        run: npm run build:api
+
+      - name: Create empty auth.json file
+        run: |
+          mkdir -p api/data
+          echo '{}' > api/data/auth.json
+
+      - name: Prepare .env.test file
+        run: cp api/test/.env.test.example api/test/.env.test
+
+      - name: Run config migration tests
+        run: npm run test:config
diff --git a/.github/workflows/data-provider.yml b/.github/workflows/data-provider.yml
index 9a514b00762..eae746ece94 100644
--- a/.github/workflows/data-provider.yml
+++ b/.github/workflows/data-provider.yml
@@ -14,34 +14,54 @@ on:
         default: 'Manual publish requested'
 
 permissions:
-  id-token: write  # Required for OIDC trusted publishing
   contents: read
 
 jobs:
-  build:
+  pack:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: '24.16.0'
       - run: cd packages/data-provider && npm ci
       - run: cd packages/data-provider && npm run build
+      - name: Pack package
+        run: |
+          mkdir -p npm-package
+          cd packages/data-provider
+          npm pack --pack-destination "$GITHUB_WORKSPACE/npm-package"
+      - name: Upload package
+        uses: actions/upload-artifact@v4
+        with:
+          name: librechat-data-provider-package
+          path: npm-package/*.tgz
+          if-no-files-found: error
+          retention-days: 2
 
   publish-npm:
-    needs: build
+    needs: pack
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: publish  # Must match npm trusted publisher config
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC trusted publishing
     steps:
-      - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: '24.16.0'
           registry-url: 'https://registry.npmjs.org'
-      
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
-      
-      - run: cd packages/data-provider && npm ci
-      - run: cd packages/data-provider && npm run build
-      - run: cd packages/data-provider && npm publish --provenance
+
+      - name: Install npm with OIDC support
+        run: npm install -g npm@11.14.1 --ignore-scripts
+
+      - name: Download package
+        uses: actions/download-artifact@v4
+        with:
+          name: librechat-data-provider-package
+          path: npm-package
+
+      - name: Publish package
+        working-directory: npm-package
+        run: npm publish *.tgz --provenance
diff --git a/.github/workflows/data-schemas.yml b/.github/workflows/data-schemas.yml
index 882dc4f4b69..bb8f90ea842 100644
--- a/.github/workflows/data-schemas.yml
+++ b/.github/workflows/data-schemas.yml
@@ -14,31 +14,27 @@ on:
         default: 'Manual publish requested'
 
 permissions:
-  id-token: write  # Required for OIDC trusted publishing
   contents: read
 
 jobs:
-  build-and-publish:
+  pack:
     runs-on: ubuntu-latest
-    environment: publish  # Must match npm trusted publisher config
+    outputs:
+      skip: ${{ steps.check.outputs.skip }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-      
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
-          
+          node-version: '24.16.0'
+
       - name: Install dependencies
         run: cd packages/data-schemas && npm ci
-        
+
       - name: Build
         run: cd packages/data-schemas && npm run build
-        
+
       - name: Check version change
         id: check
         working-directory: packages/data-schemas
@@ -52,13 +48,47 @@ jobs:
             echo "Version changed, proceeding with publish"
             echo "skip=false" >> $GITHUB_OUTPUT
           fi
-            
+
       - name: Pack package
         if: steps.check.outputs.skip != 'true'
         working-directory: packages/data-schemas
-        run: npm pack
-        
-      - name: Publish
+        run: |
+          mkdir -p "$GITHUB_WORKSPACE/npm-package"
+          npm pack --pack-destination "$GITHUB_WORKSPACE/npm-package"
+
+      - name: Upload package
         if: steps.check.outputs.skip != 'true'
-        working-directory: packages/data-schemas
+        uses: actions/upload-artifact@v4
+        with:
+          name: librechat-data-schemas-package
+          path: npm-package/*.tgz
+          if-no-files-found: error
+          retention-days: 2
+
+  publish-npm:
+    needs: pack
+    if: github.ref == 'refs/heads/main' && needs.pack.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC trusted publishing
+    steps:
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install npm with OIDC support
+        run: npm install -g npm@11.14.1 --ignore-scripts
+
+      - name: Download package
+        uses: actions/download-artifact@v4
+        with:
+          name: librechat-data-schemas-package
+          path: npm-package
+
+      - name: Publish
+        working-directory: npm-package
         run: npm publish *.tgz --access public --provenance
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index a255932e3e6..57875bc513e 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -7,6 +7,9 @@ on:
       - completed
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -29,7 +32,7 @@ jobs:
         DO_HOST: ${{ secrets.DO_HOST }}
         DO_USER: ${{ secrets.DO_USER }}
       run: |
-        ssh -o StrictHostKeyChecking=no ${DO_USER}@${DO_HOST} << EOF
+        ssh ${DO_USER}@${DO_HOST} << EOF
         sudo -i -u danny bash << 'EEOF'
         cd ~/LibreChat && \
         git fetch origin main && \
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5c143b45318..e4b73da617a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -3,6 +3,9 @@ name: Deploy_GHRunner_Linux_ACI
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   RUNNER_VERSION: 2.293.0
   ACI_RESOURCE_GROUP: 'Demo-ACI-GitHub-Runners-RG'
@@ -20,7 +23,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: 'Login via Azure CLI'
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
diff --git a/.github/workflows/dev-branch-images.yml b/.github/workflows/dev-branch-images.yml
index 9d40cd3fc41..f0e2ba54b57 100644
--- a/.github/workflows/dev-branch-images.yml
+++ b/.github/workflows/dev-branch-images.yml
@@ -9,6 +9,14 @@ on:
       - 'api/**'
       - 'client/**'
       - 'packages/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'Dockerfile'
+      - 'Dockerfile.multi'
+
+permissions:
+  contents: read
+  packages: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -43,7 +51,7 @@ jobs:
 
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -61,6 +69,12 @@ jobs:
         run: |
           cp .env.example .env
 
+      - name: Compute build metadata
+        run: |
+          echo "BUILD_COMMIT=${{ github.sha }}" >> $GITHUB_ENV
+          echo "BUILD_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
+
       # Build and push Docker images for each target
       - name: Build and push Docker images
         uses: docker/build-push-action@v5
@@ -75,3 +89,7 @@ jobs:
             ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
           platforms: linux/amd64,linux/arm64
           target: ${{ matrix.target }}
+          build-args: |
+            BUILD_COMMIT=${{ env.BUILD_COMMIT }}
+            BUILD_BRANCH=${{ env.BUILD_BRANCH }}
+            BUILD_DATE=${{ env.BUILD_DATE }}
diff --git a/.github/workflows/dev-images.yml b/.github/workflows/dev-images.yml
index a6417556aa6..efdd2027546 100644
--- a/.github/workflows/dev-images.yml
+++ b/.github/workflows/dev-images.yml
@@ -9,6 +9,14 @@ on:
       - 'api/**'
       - 'client/**'
       - 'packages/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'Dockerfile'
+      - 'Dockerfile.multi'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
@@ -39,7 +47,7 @@ jobs:
 
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -57,6 +65,12 @@ jobs:
         run: |
           cp .env.example .env
 
+      - name: Compute build metadata
+        run: |
+          echo "BUILD_COMMIT=${{ github.sha }}" >> $GITHUB_ENV
+          echo "BUILD_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
+
       # Build and push Docker images for each target
       - name: Build and push Docker images
         uses: docker/build-push-action@v5
@@ -71,3 +85,7 @@ jobs:
             ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
           platforms: linux/amd64,linux/arm64
           target: ${{ matrix.target }}
+          build-args: |
+            BUILD_COMMIT=${{ env.BUILD_COMMIT }}
+            BUILD_BRANCH=${{ env.BUILD_BRANCH }}
+            BUILD_DATE=${{ env.BUILD_DATE }}
diff --git a/.github/workflows/dev-staging-images.yml b/.github/workflows/dev-staging-images.yml
index e63dc5f0af0..6deb86205ca 100644
--- a/.github/workflows/dev-staging-images.yml
+++ b/.github/workflows/dev-staging-images.yml
@@ -3,6 +3,10 @@ name: Docker Dev Staging Images Build
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -31,7 +35,7 @@ jobs:
 
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -49,6 +53,12 @@ jobs:
         run: |
           cp .env.example .env
 
+      - name: Compute build metadata
+        run: |
+          echo "BUILD_COMMIT=${{ github.sha }}" >> $GITHUB_ENV
+          echo "BUILD_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
+
       # Build and push Docker images for each target
       - name: Build and push Docker images
         uses: docker/build-push-action@v5
@@ -63,4 +73,7 @@ jobs:
             ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
           platforms: linux/amd64,linux/arm64
           target: ${{ matrix.target }}
-
+          build-args: |
+            BUILD_COMMIT=${{ env.BUILD_COMMIT }}
+            BUILD_BRANCH=${{ env.BUILD_BRANCH }}
+            BUILD_DATE=${{ env.BUILD_DATE }}
diff --git a/.github/workflows/docker-smoke.yml b/.github/workflows/docker-smoke.yml
index d3f313b5716..3780959d8bf 100644
--- a/.github/workflows/docker-smoke.yml
+++ b/.github/workflows/docker-smoke.yml
@@ -9,12 +9,22 @@ on:
       - 'Dockerfile.multi'
       - 'package.json'
       - 'package-lock.json'
+      - 'api/**'
+      - 'client/**'
+      - 'config/**'
+      - 'skill/**'
+      - 'packages/api/**'
       - 'packages/client/**'
       - 'packages/data-provider/**'
+      - 'packages/data-schemas/**'
 
 permissions:
   contents: read
 
+concurrency:
+  group: docker-smoke-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   client-package-target:
     name: Build Docker client package target
@@ -34,3 +44,85 @@ jobs:
           platforms: linux/amd64
           push: false
           target: client-package-build
+
+  api-runtime-smoke:
+    name: API runtime smoke (production image boots)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Build the real production image (final `api-build` stage), which installs
+      # with `npm ci --omit=dev` — the same prune that, in prod, exposed runtime
+      # dependencies the tsdown bundle externalizes but were never declared.
+      - name: Build production image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.multi
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: librechat-api-smoke:ci
+          cache-from: type=gha,scope=docker-smoke-api
+          cache-to: type=gha,mode=max,scope=docker-smoke-api
+
+      # Loads the entire externalized require graph of the built @librechat/api
+      # bundle inside the pruned production image. A missing or ESM-incompatible
+      # runtime dependency (e.g. the `get-stream` regression) fails here with a
+      # non-zero exit — deterministically, with no database required.
+      - name: Verify production image resolves all runtime modules
+        run: |
+          docker run --rm librechat-api-smoke:ci \
+            node -e "require('@librechat/api'); require('@librechat/api/telemetry'); console.log('module resolution OK')"
+
+      # Boot the real entrypoint against a real MongoDB so the *entire* server
+      # require graph loads (api/db throws at module scope without MONGO_URI, and
+      # is imported before models/services/routes), then gate on /readyz AND the
+      # container staying alive. /readyz only returns 200 after the post-listen
+      # startup (initializeMCPs + checkMigrations) sets serverReady, and those
+      # steps process.exit(1) on failure — so ANY startup crash (missing module,
+      # ReferenceError, bad config, post-listen failure) fails the smoke.
+      - name: Boot production image against MongoDB and poll /readyz
+        run: |
+          set -u
+          docker network create lc-smoke
+          docker run -d --name lc-mongo --network lc-smoke mongo:8.0.20
+          docker run -d --name lc-api --network lc-smoke -p 3080:3080 \
+            -e HOST=0.0.0.0 -e PORT=3080 \
+            -e NODE_ENV=production \
+            -e MONGO_URI=mongodb://lc-mongo:27017/LibreChat \
+            -e CREDS_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
+            -e CREDS_IV=0123456789abcdef0123456789abcdef \
+            -e JWT_SECRET=docker-smoke-jwt-secret \
+            -e JWT_REFRESH_SECRET=docker-smoke-jwt-refresh-secret \
+            -e SEARCH=false \
+            librechat-api-smoke:ci
+
+          healthy=""
+          for i in $(seq 1 60); do
+            if [ "$(docker inspect -f '{{.State.Running}}' lc-api 2>/dev/null)" != "true" ]; then
+              echo "::error::API container exited during startup (exit code $(docker inspect -f '{{.State.ExitCode}}' lc-api 2>/dev/null))"
+              break
+            fi
+            if [ "$(curl -sS -o /dev/null -w '%{http_code}' http://localhost:3080/readyz 2>/dev/null || true)" = "200" ]; then
+              healthy="yes"
+              echo "/readyz returned 200 — server fully booted (post-listen startup complete)."
+              break
+            fi
+            sleep 2
+          done
+
+          echo "----- last 100 lines of api container logs -----"
+          docker logs lc-api 2>&1 | tail -100 || true
+          echo "------------------------------------------------"
+          docker rm -f lc-api lc-mongo >/dev/null 2>&1 || true
+          docker network rm lc-smoke >/dev/null 2>&1 || true
+
+          if [ -z "$healthy" ]; then
+            echo "::error::Production image failed to reach a ready /readyz within timeout"
+            exit 1
+          fi
diff --git a/.github/workflows/eslint-ci.yml b/.github/workflows/eslint-ci.yml
index 8203da4e8bf..3ab8528b042 100644
--- a/.github/workflows/eslint-ci.yml
+++ b/.github/workflows/eslint-ci.yml
@@ -10,6 +10,8 @@ on:
     paths:
       - 'api/**'
       - 'client/**'
+      - 'packages/**'
+      - '.github/workflows/eslint-ci.yml'
 
 jobs:
   eslint_checks:
@@ -25,31 +27,34 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Node.js 20.x
+      - name: Set up Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: '24.16.0'
           cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      # Run ESLint on changed files within the api/ and client/ directories.
+      # Run ESLint on changed files within the api/, client/, and packages/ directories.
       - name: Run ESLint on changed files
         run: |
           # Extract the base commit SHA from the pull_request event payload.
           BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
           echo "Base commit SHA: $BASE_SHA"
 
-          # Get changed files (only JS/TS files in api/ or client/)
-          CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD | grep -E '^(api|client)/.*\.(js|jsx|ts|tsx)$' || true)
+          # Get changed files (only JS/TS files in api/, client/, or packages/)
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
 
           # Debug output
           echo "Changed files:"
-          echo "$CHANGED_FILES"
+          printf '%s\n' "${CHANGED_FILES[@]}"
 
           # Ensure there are files to lint before running ESLint
-          if [[ -z "$CHANGED_FILES" ]]; then
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
             echo "No matching files changed. Skipping ESLint."
             exit 0
           fi
@@ -57,4 +62,67 @@ jobs:
           # Run ESLint
           npx eslint --no-error-on-unmatched-pattern \
             --config eslint.config.mjs \
-            $CHANGED_FILES
+            --max-warnings=0 \
+            -- "${CHANGED_FILES[@]}"
+
+      # Run Prettier --check on the same set of changed files to catch
+      # formatting drift in PRs that bypassed the local pre-commit hook
+      # (e.g. GitHub UI edit-and-merge, `git commit --no-verify`).
+      - name: Run Prettier --check on changed files
+        run: |
+          BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
+
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
+            echo "No matching files changed. Skipping Prettier."
+            exit 0
+          fi
+
+          echo "Files to check:"
+          printf '%s\n' "${CHANGED_FILES[@]}"
+
+          # `prettier --check` exits non-zero if any file would be reformatted.
+          # Suggest the local fix in the failure message so contributors aren't
+          # left guessing how to resolve.
+          if ! npx prettier --check --no-error-on-unmatched-pattern -- "${CHANGED_FILES[@]}"; then
+            echo ""
+            echo "::error::Prettier formatting drift detected. Fix locally with:"
+            echo "::error::  npx prettier --write <files>"
+            echo "::error::Or rely on the lint-staged pre-commit hook (do not bypass with --no-verify)."
+            exit 1
+          fi
+
+      # Verify import ordering on the same set of changed files. The script
+      # only sorts files under known source roots, so unrelated changed files
+      # (configs, etc.) are ignored. Matches the lint-staged pre-commit hook.
+      - name: Check import sorting on changed files
+        run: |
+          BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
+
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
+            echo "No matching files changed. Skipping import-sort check."
+            exit 0
+          fi
+
+          echo "Files to check:"
+          printf '%s\n' "${CHANGED_FILES[@]}"
+
+          # `--check` lists offending files and exits non-zero without writing.
+          if ! node scripts/sort-imports.mts --check "${CHANGED_FILES[@]}"; then
+            echo ""
+            echo "::error::Import order drift detected. Fix locally with:"
+            echo "::error::  npm run sort-imports"
+            echo "::error::For specific files:"
+            echo "::error::  npm run sort-imports -- packages/api/src/app/metrics.ts packages/api/src/rum/proxy.ts"
+            echo "::error::To check without writing files:"
+            echo "::error::  npm run sort-imports:check"
+            echo "::error::Or rely on the lint-staged pre-commit hook (do not bypass with --no-verify)."
+            exit 1
+          fi
diff --git a/.github/workflows/frontend-review.yml b/.github/workflows/frontend-review.yml
index 05b3f4154f4..a3f31efba63 100644
--- a/.github/workflows/frontend-review.yml
+++ b/.github/workflows/frontend-review.yml
@@ -4,7 +4,12 @@ on:
   pull_request:
     paths:
       - 'client/**'
+      - 'packages/client/**'
       - 'packages/data-provider/**'
+      - '.github/workflows/frontend-review.yml'
+
+permissions:
+  contents: read
 
 env:
   NODE_OPTIONS: '--max-old-space-size=${{ secrets.NODE_MAX_OLD_SPACE_SIZE || 6144 }}'
@@ -17,10 +22,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -31,7 +36,7 @@ jobs:
             client/node_modules
             packages/client/node_modules
             packages/data-provider/node_modules
-          key: node-modules-frontend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -42,7 +47,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-provider/dist
-          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-provider
         if: steps.cache-data-provider.outputs.cache-hit != 'true'
@@ -53,7 +58,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/client/dist
-          key: build-client-package-${{ runner.os }}-${{ hashFiles('packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/rollup.config.js', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-client-package-${{ runner.os }}-${{ hashFiles('packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build client-package
         if: steps.cache-client-package.outputs.cache-hit != 'true'
@@ -73,18 +78,66 @@ jobs:
           path: packages/client/dist
           retention-days: 2
 
+  typecheck:
+    name: TypeScript type checks (client)
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 24.16.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            client/node_modules
+            packages/client/node_modules
+            packages/data-provider/node_modules
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Download data-provider build
+        uses: actions/download-artifact@v4
+        with:
+          name: build-data-provider
+          path: packages/data-provider/dist
+
+      - name: Download client-package build
+        uses: actions/download-artifact@v4
+        with:
+          name: build-client-package
+          path: packages/client/dist
+
+      - name: Type check client
+        run: npm run typecheck
+        working-directory: client
+
   test-ubuntu:
-    name: 'Tests: Ubuntu'
+    name: 'Tests: Ubuntu (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -95,7 +148,7 @@ jobs:
             client/node_modules
             packages/client/node_modules
             packages/data-provider/node_modules
-          key: node-modules-frontend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -113,22 +166,26 @@ jobs:
           name: build-client-package
           path: packages/client/dist
 
-      - name: Run unit tests
-        run: npm run test:ci --verbose
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: npm run test:ci -- --shard=${{ matrix.shard }}/4
         working-directory: client
 
   test-windows:
-    name: 'Tests: Windows'
+    name: 'Tests: Windows (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: windows-latest
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -139,7 +196,7 @@ jobs:
             client/node_modules
             packages/client/node_modules
             packages/data-provider/node_modules
-          key: node-modules-frontend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
@@ -157,8 +214,8 @@ jobs:
           name: build-client-package
           path: packages/client/dist
 
-      - name: Run unit tests
-        run: npm run test:ci --verbose
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: npm run test:ci -- --shard=${{ matrix.shard }}/4
         working-directory: client
 
   build-verify:
@@ -169,10 +226,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.19
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: '20.19'
+          node-version: '24.16.0'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -183,7 +240,7 @@ jobs:
             client/node_modules
             packages/client/node_modules
             packages/data-provider/node_modules
-          key: node-modules-frontend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
 
       - name: Install dependencies
         if: steps.cache-node-modules.outputs.cache-hit != 'true'
diff --git a/.github/workflows/generate_embeddings.yml b/.github/workflows/generate_embeddings.yml
index c514f9c1d6b..3c6f2717c30 100644
--- a/.github/workflows/generate_embeddings.yml
+++ b/.github/workflows/generate_embeddings.yml
@@ -7,14 +7,17 @@ on:
     paths:
       - 'docs/**'
 
+permissions:
+  contents: read
+
 jobs:
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: supabase/embeddings-generator@v0.0.5
         with:
           supabase-url: ${{ secrets.SUPABASE_URL }}
           supabase-service-role-key: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
           openai-key: ${{ secrets.OPENAI_DOC_EMBEDDINGS_KEY }}
-          docs-root-path: 'docs'
\ No newline at end of file
+          docs-root-path: 'docs'
diff --git a/.github/workflows/gitnexus-deploy.yml b/.github/workflows/gitnexus-deploy.yml
index 203138c706a..dc62068a6ca 100644
--- a/.github/workflows/gitnexus-deploy.yml
+++ b/.github/workflows/gitnexus-deploy.yml
@@ -2,14 +2,10 @@
 #
 # Architecture:
 #   GitHub Actions (deploy)
-#     1. Resolves latest successful index runs for main, dev, and every
-#        open PR that already has an index artifact (contributor-gated
-#        upstream by the index workflow's author_association check)
+#     1. Resolves latest successful index runs for main and dev
 #     2. Downloads each matching .gitnexus/ artifact
 #     3. Rsyncs them into /opt/gitnexus/indexes/<name>/ on the droplet
-#     4. Removes any stale folders on the droplet for PRs that closed
-#        (even though gitnexus-cleanup-pr.yml also handles that path,
-#        this is a safety net in case the close event was missed)
+#     4. Removes any stale folders on the droplet that are not main/dev
 #     5. Pulls latest image, force-recreates gitnexus, reloads Caddy,
 #        and polls docker health until the container reports healthy
 #   The caddy container is untouched — no TLS churn.
@@ -58,14 +54,14 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'Optional PR number to post completion comment on (set by bot-triggered dispatches from gitnexus-index.yml)'
+        description: 'Optional PR number for status comments from bot-triggered dispatches'
         type: string
         default: ''
 
 permissions:
   actions: read
   contents: read
-  pull-requests: write # post completion comments on served PR indexes
+  pull-requests: write # post status comments on PR command dispatches
 
 # Global serialization. Earlier versions used per-ref concurrency with
 # cancel-in-progress so rapid pushes to the same ref coalesced but deploys
@@ -84,7 +80,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GITNEXUS_VERSION: '1.5.3'
+  GITNEXUS_VERSION: '1.6.7'
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/librechat-gitnexus
 
 jobs:
@@ -93,7 +89,12 @@ jobs:
   build-image:
     if: |
       github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
+      (
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        (github.event.workflow_run.head_branch == 'main' ||
+         github.event.workflow_run.head_branch == 'dev')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -158,7 +159,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-      pull-requests: write # post deploy-complete comments on served PR indexes
+      pull-requests: write # post deploy-complete comments on PR command dispatches
     steps:
       - name: Checkout deploy config
         uses: actions/checkout@v4
@@ -217,62 +218,7 @@ jobs:
               core.info(`${branch}: run ${fresh.workflow_run.id} -> ${name}`);
             }
 
-            // --- open PRs with at least one successful index run ---
-            // github.paginate handles the 100-per-page ceiling automatically
-            // so the resolution works on repos with 200+ concurrent open PRs.
-            const openPrs = await github.paginate(github.rest.pulls.list, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              per_page: 100,
-            });
-            core.info(`Found ${openPrs.length} open PRs`);
-
-            // Parallelize artifact lookups in fixed-size batches so the
-            // resolve step runs in seconds instead of minutes on big repos,
-            // without burning the GitHub API rate limit all at once.
-            const BATCH_SIZE = 10;
-            const prMatches = [];
-            for (let i = 0; i < openPrs.length; i += BATCH_SIZE) {
-              const batch = openPrs.slice(i, i + BATCH_SIZE);
-              const results = await Promise.all(
-                batch.map(async (pr) => {
-                  const artifactName = `gitnexus-index-pr-${pr.number}`;
-                  const fresh = await latestArtifact(artifactName);
-                  return fresh ? { pr, artifactName, fresh } : null;
-                }),
-              );
-              for (const hit of results) {
-                if (hit) prMatches.push(hit);
-              }
-            }
-
-            // Cap to the N most recent PR indexes by artifact creation time.
-            // On a 10GB droplet each index is ~130MB; 3 PRs + main + dev ≈
-            // 650MB of index data, leaving headroom for the ~700MB Docker image
-            // and OS. Older PR indexes are evicted by the prune step.
-            const MAX_PR_INDEXES = 3;
-            prMatches.sort(
-              (a, b) => new Date(b.fresh.created_at) - new Date(a.fresh.created_at),
-            );
-            const keptPrs = prMatches.slice(0, MAX_PR_INDEXES);
-            const evictedPrs = prMatches.slice(MAX_PR_INDEXES);
-
-            for (const { pr, artifactName, fresh } of keptPrs) {
-              serve.push({
-                name: `LibreChat-pr-${pr.number}`,
-                artifactName,
-                runId: fresh.workflow_run.id,
-              });
-              core.info(`PR #${pr.number}: run ${fresh.workflow_run.id} -> LibreChat-pr-${pr.number}`);
-            }
-            if (evictedPrs.length) {
-              core.info(
-                `Evicted ${evictedPrs.length} older PR indexes (cap=${MAX_PR_INDEXES}): ` +
-                  evictedPrs.map((e) => `#${e.pr.number}`).join(', '),
-              );
-            }
-            core.info(`Serving ${keptPrs.length} PR indexes out of ${prMatches.length} with artifacts (${openPrs.length} open PRs total)`);
+            core.info('PR index deploys are paused; serving main and dev only.');
 
             if (!serve.length) {
               core.setFailed('No indexes to serve');
@@ -387,7 +333,7 @@ jobs:
           # ── Step 1: prune FIRST ────────────────────────────────
           # Remove any folders on the droplet that aren't in the active set.
           # This frees disk BEFORE rsyncing new data, which matters on a
-          # 10GB disk where each index is ~130MB.
+          # 10GB disk where each current index is ~400MB.
           echo "Pruning stale indexes (keeping: $ACTIVE_NAMES)"
           ssh -i ~/.ssh/deploy_key "$SSH_USER@$SSH_HOST" \
             ACTIVE_NAMES="$ACTIVE_NAMES" bash <<'REMOTE'
@@ -415,8 +361,8 @@ jobs:
           # it into place. If rsync fails, the old index survives intact
           # and the partial temp dir is cleaned up — no production data
           # is lost. The brief period where both old + new exist costs
-          # ~130MB of extra disk, but the prune step already freed
-          # space from evicted PR indexes so this fits on a 10GB disk.
+          # ~400MB of extra disk, but the prune step already freed
+          # space from evicted indexes so this fits on a 10GB disk.
           for dir in staging/*/; do
             [ -d "$dir" ] || continue
             name=$(basename "$dir")
@@ -460,10 +406,11 @@ jobs:
 
             # ── Disk cleanup ──────────────────────────────────────
             # Docker accumulates old image layers, dangling images, and
-            # build cache across deploys. On a 60GB droplet with a 700MB+
-            # gitnexus image, this fills the disk after ~40 deploys.
-            # Prune everything not used by currently-running containers
-            # BEFORE pulling the new image so the extract has room.
+            # build cache across deploys. This droplet is only ~8.7GB
+            # usable with a 700MB+ gitnexus image, so disk pressure is
+            # constant. Prune everything not used by currently-running
+            # containers BEFORE pulling the new image so the extract has
+            # room; the post-recreate prune below reclaims the old image.
             echo "Disk before cleanup:"
             df -h / | tail -1
             # Omit --volumes: Caddy's caddy-data and caddy-config volumes
@@ -475,9 +422,13 @@ jobs:
             echo "Disk after cleanup:"
             df -h / | tail -1
 
-            # Fail fast if disk is critically low even after prune
+            # Fail fast if disk is critically low even after prune. The
+            # gitnexus image is ~700MB and shares most layers with the
+            # running one, so an incremental pull needs well under 1GB.
+            # 1536MB leaves headroom on this small droplet without the
+            # over-conservative 2GB guard aborting on a healthy box.
             AVAIL_MB=$(df --output=avail -m / | tail -1 | tr -d ' ')
-            if [ "$AVAIL_MB" -lt 2048 ]; then
+            if [ "$AVAIL_MB" -lt 1536 ]; then
               echo "::error::Disk critically low (${AVAIL_MB}MB free). Aborting deploy."
               exit 1
             fi
@@ -485,6 +436,13 @@ jobs:
             docker compose pull gitnexus
             docker compose up -d --force-recreate gitnexus
 
+            # The previous gitnexus image is now dangling (the running
+            # container was recreated onto the freshly pulled image). The
+            # pre-pull prune above couldn't touch it because it was still
+            # in use at that point. Reclaim it now so the old generation
+            # doesn't accumulate — critical on this 10GB droplet.
+            docker image prune -f 2>/dev/null || true
+
             # Reload Caddy in-place so a changed Caddyfile takes effect
             # without losing TLS certs or restarting connections. If caddy
             # isn't running yet (first-time bootstrap), bring it up.
@@ -555,15 +513,41 @@ jobs:
           DEPLOY_STATUS: ${{ job.status }}
         with:
           script: |
+            const deployUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const matrix = JSON.parse(process.env.MATRIX || '[]');
             let prNum = null;
 
             // Case 1: dispatched directly with pr_number (bot-fallback path)
             if (process.env.DISPATCH_PR_NUMBER && process.env.DISPATCH_PR_NUMBER !== '') {
-              prNum = parseInt(process.env.DISPATCH_PR_NUMBER, 10);
+              const dispatchPrRaw = process.env.DISPATCH_PR_NUMBER;
+              if (!/^\d+$/.test(dispatchPrRaw)) {
+                core.setFailed(`Invalid PR number: ${dispatchPrRaw}`);
+                return;
+              }
+
+              const dispatchPrNum = Number(dispatchPrRaw);
+              const servedPr = matrix.some((m) => m.name === `LibreChat-pr-${dispatchPrNum}`);
+
+              if (!servedPr) {
+                const body = [
+                  '### GitNexus: PR deploy skipped',
+                  '',
+                  'PR-specific deploys are paused; only `LibreChat` and `LibreChat-dev` are currently served.',
+                  `[Deploy run](${deployUrl})`,
+                ].join('\n');
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: dispatchPrNum,
+                  body,
+                });
+                return;
+              }
+
+              prNum = dispatchPrNum;
             }
             // Case 2: workflow_run trigger from a PR index run
             else if (context.eventName === 'workflow_run') {
-              const matrix = JSON.parse(process.env.MATRIX || '[]');
               const triggerRunId = Number(process.env.TRIGGER_RUN_ID);
               const match = matrix.find(
                 (m) => m.runId === triggerRunId && m.name.startsWith('LibreChat-pr-'),
@@ -578,7 +562,6 @@ jobs:
               return;
             }
 
-            const deployUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const ok = process.env.DEPLOY_STATUS === 'success';
             const body = [
               `### GitNexus: ${ok ? '🚀 deployed' : '❌ deploy failed'}`,
diff --git a/.github/workflows/gitnexus-index.yml b/.github/workflows/gitnexus-index.yml
index ac7de2973b4..89f906f38dd 100644
--- a/.github/workflows/gitnexus-index.yml
+++ b/.github/workflows/gitnexus-index.yml
@@ -1,12 +1,13 @@
 name: GitNexus Index
 
 on:
+  # PR branches are NOT auto-indexed — an embeddings run is too slow to
+  # spend on every PR push. Only main/dev are indexed automatically;
+  # individual PRs are indexed on demand via the /gitnexus command or a
+  # manual workflow_dispatch.
   push:
     branches: [main, dev]
     paths-ignore: ['**.md', 'docs/**', 'LICENSE', '.github/**']
-  pull_request:
-    branches: [main, dev]
-    paths-ignore: ['**.md', 'docs/**', 'LICENSE', '.github/**']
   workflow_dispatch:
     inputs:
       embeddings:
@@ -25,9 +26,13 @@ on:
         type: string
         default: ''
       pr_ref:
-        description: 'PR head SHA or ref to check out (set by /gitnexus command)'
+        description: 'Optional PR head ref to check out; defaults to refs/pull/<pr_number>/head when pr_number is set'
         type: string
         default: ''
+      deploy_after:
+        description: 'Dispatch GitNexus Deploy after a successful index run'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -39,32 +44,60 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GITNEXUS_VERSION: '1.5.3'
+  GITNEXUS_VERSION: '1.6.7'
 
 jobs:
   index:
     permissions:
       contents: read
       pull-requests: read # read changed files to decide whether embeddings are needed
-    # Push + dispatch run unconditionally. Native pull_request events
-    # are restricted to PRs authored by danny-avila only — this keeps
-    # automatic CI spend low on a repo with 200+ open PRs.
-    #
-    # Other contributors' PRs can still be indexed on demand:
+    # Push + dispatch run unconditionally. The pull_request trigger is
+    # disabled (see `on:` above), so this never runs automatically on a
+    # PR. PRs are indexed on demand instead:
     #   - /gitnexus index    (PR comment command, contributor-gated)
     #   - workflow_dispatch   (manual dispatch from Actions UI)
-    # Both bypass this filter because they arrive as workflow_dispatch,
-    # not pull_request.
+    # Both arrive as workflow_dispatch. The pull_request guard is kept as
+    # a safety net should the trigger ever be re-added.
     if: |
       github.event_name != 'pull_request' ||
       github.event.pull_request.user.login == 'danny-avila'
     runs-on: ubuntu-latest
-    timeout-minutes: 25
+    # Embedding generation dominates the budget: ~45 min worst case on
+    # standard runners since the 1.6.x graph (~23k nodes) doubled vs 1.5.x.
+    timeout-minutes: 60
+    # Best-effort index: a tool-internal crash must not block PRs. Fail soft on
+    # PR events; push/dispatch runs still fail loudly so regressions stay visible.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
     steps:
+      - name: Validate dispatch inputs
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+          PR_REF: ${{ inputs.pr_ref }}
+        run: |
+          set -euo pipefail
+          if [ -n "$PR_NUMBER" ]; then
+            if [[ ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+              echo "::error::pr_number must be numeric"
+              exit 1
+            fi
+            EXPECTED_REF="refs/pull/${PR_NUMBER}/head"
+            if [ -n "$PR_REF" ] && [ "$PR_REF" != "$EXPECTED_REF" ]; then
+              echo "::error::pr_ref must match ${EXPECTED_REF}"
+              exit 1
+            fi
+          elif [ -n "$PR_REF" ]; then
+            echo "::error::pr_ref requires pr_number"
+            exit 1
+          fi
+
       - name: Resolve GitNexus flags
         id: flags
         env:
+          EVENT_NAME: ${{ github.event_name }}
+          ENABLE_EMBEDDINGS_INPUT: ${{ inputs.embeddings }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUM: ${{ github.event.pull_request.number }}
         run: |
           set -euo pipefail
 
@@ -79,15 +112,14 @@ jobs:
           #                           (default false). This also covers the
           #                           /gitnexus index [embeddings] command.
           ENABLE_EMBEDDINGS=false
-          case "${{ github.event_name }}" in
+          case "$EVENT_NAME" in
             workflow_dispatch)
-              [ "${{ inputs.embeddings }}" = "true" ] && ENABLE_EMBEDDINGS=true
+              [ "$ENABLE_EMBEDDINGS_INPUT" = "true" ] && ENABLE_EMBEDDINGS=true
               ;;
             push)
               ENABLE_EMBEDDINGS=true
               ;;
             pull_request)
-              PR_NUM="${{ github.event.pull_request.number }}"
               CHANGED=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUM/files" \
                 --paginate --jq '.[].filename' 2>/dev/null || echo "")
               if printf '%s\n' "$CHANGED" | grep -qE '^(api/|client/|packages/)'; then
@@ -108,7 +140,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24.16.0'
 
       - name: Install GitNexus CLI
         working-directory: ${{ runner.temp }}
@@ -134,7 +166,7 @@ jobs:
             --no-save \
             --no-package-lock \
             "gitnexus@${{ env.GITNEXUS_VERSION }}" \
-            "@ladybugdb/core@0.15.2"
+            "@ladybugdb/core@0.17.1"
           test -x "$RUNNER_TEMP/gitnexus-cli/node_modules/.bin/gitnexus"
 
       - name: Checkout repository
@@ -145,14 +177,33 @@ jobs:
           # repo for every PR, so checkout works for fork PRs too. When
           # pr_ref is empty (native push/pull_request), fall back to the
           # default ref actions/checkout would use.
-          ref: ${{ inputs.pr_ref || '' }}
+          ref: ${{ inputs.pr_ref || (inputs.pr_number != '' && format('refs/pull/{0}/head', inputs.pr_number) || '') }}
           fetch-depth: 1
           persist-credentials: false
 
+      # HuggingFace throttles anonymous model downloads from shared GHA
+      # runner IPs (429s or stalled transfers). Cache the embedding model
+      # across runs so warm runs never touch HF at all.
+      - name: Cache HuggingFace embedding model
+        if: steps.flags.outputs.enable_embeddings == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/hf-cache
+          key: hf-model-snowflake-arctic-embed-xs-v1
+
       - name: Run GitNexus Analyze
         working-directory: ${{ runner.temp }}
         env:
+          ENABLE_EMBEDDINGS: ${{ steps.flags.outputs.enable_embeddings }}
+          FORCE: ${{ inputs.force }}
           GITNEXUS_BIN: ${{ runner.temp }}/gitnexus-cli/node_modules/.bin/gitnexus
+          # Fail soft in ~2 min on stalled downloads instead of eating the
+          # 25-min job budget; HF_TOKEN lifts the anonymous rate limit on
+          # cold-cache runs (empty when the secret is unset — safe no-op).
+          HF_DOWNLOAD_TIMEOUT_MS: '60000'
+          HF_HOME: ${{ runner.temp }}/hf-cache
+          HF_MAX_ATTEMPTS: '2'
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
           NPM_CONFIG_AUDIT: false
           NPM_CONFIG_CACHE: ${{ runner.temp }}/gitnexus-npm-cache
           NPM_CONFIG_FUND: false
@@ -163,10 +214,10 @@ jobs:
           set -euo pipefail
           FLAGS=(--skip-agents-md --verbose)
 
-          if [ "${{ steps.flags.outputs.enable_embeddings }}" = "true" ]; then
+          if [ "$ENABLE_EMBEDDINGS" = "true" ]; then
             FLAGS+=(--embeddings)
           fi
-          if [ "${{ inputs.force }}" = "true" ]; then
+          if [ "$FORCE" = "true" ]; then
             FLAGS+=(--force)
           fi
           "$GITNEXUS_BIN" analyze "$GITHUB_WORKSPACE" "${FLAGS[@]}"
@@ -206,63 +257,62 @@ jobs:
     if: |
       always() &&
       (inputs.pr_number != '' ||
-       (github.triggering_actor == 'github-actions[bot]' && needs.index.result == 'success'))
+       inputs.deploy_after)
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: read
-      actions: write # dispatch gitnexus-deploy.yml on bot-triggered runs
+      actions: write # dispatch gitnexus-deploy.yml when deploy_after is set
       pull-requests: write # post completion comments for /gitnexus command runs
     steps:
-      # GitHub suppresses workflow_run events for workflow runs whose
-      # triggering actor is GITHUB_TOKEN (to prevent recursive chaining).
-      # That means when this workflow is dispatched by gitnexus-pr-command
-      # via `gh api workflow_dispatch`, the deploy workflow's workflow_run
-      # trigger never fires. Manually dispatch the deploy here in that
-      # specific case — user-triggered runs continue to rely on the
-      # existing workflow_run trigger, so we don't double-deploy.
-      - name: Trigger deploy workflow for bot-triggered runs
-        if: github.triggering_actor == 'github-actions[bot]' && needs.index.result == 'success'
+      # GitHub suppresses workflow_run events for workflow runs triggered
+      # by GITHUB_TOKEN (to prevent recursive chaining). Dispatches without
+      # a PR number can still opt into a deploy by setting deploy_after=true.
+      - name: Trigger deploy workflow after non-PR dispatches
+        if: inputs.deploy_after && inputs.pr_number == '' && needs.index.result == 'success'
         uses: actions/github-script@v7
         with:
           script: |
-            core.info('Triggering actor is github-actions[bot]; workflow_run would not fire. Dispatching gitnexus-deploy.yml manually.');
-            // Pass pr_number through so the deploy workflow knows which
-            // PR to post its completion comment on (for /gitnexus
-            // command runs this will be set; for other bot dispatches
-            // it's empty and the deploy step falls back to matrix match).
+            core.info('deploy_after=true; dispatching gitnexus-deploy.yml manually.');
             await github.rest.actions.createWorkflowDispatch({
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'gitnexus-deploy.yml',
               ref: 'main',
               inputs: {
-                pr_number: '${{ inputs.pr_number }}',
+                pr_number: '',
               },
             });
 
       # Reply on the PR when the /gitnexus command path runs so the
       # requester knows the index step finished. This fires when
-      # inputs.pr_number is set and reports the index job result. A
-      # separate comment posts from the deploy workflow when the live
-      # server has the fresh index.
+      # inputs.pr_number is set and reports the index job result.
       - name: Comment on PR — index complete
         if: inputs.pr_number != ''
         uses: actions/github-script@v7
+        env:
+          EMBEDDINGS_INPUT: ${{ inputs.embeddings }}
+          INDEX_RESULT: ${{ needs.index.result }}
+          PR_NUMBER: ${{ inputs.pr_number }}
         with:
           script: |
-            const outcome = '${{ needs.index.result }}' === 'success' ? '✅ indexed' : '❌ index failed';
-            const prNum = parseInt('${{ inputs.pr_number }}', 10);
+            const indexSucceeded = process.env.INDEX_RESULT === 'success';
+            const outcome = indexSucceeded ? '✅ indexed' : '❌ index failed';
+            const prNum = parseInt(process.env.PR_NUMBER || '', 10);
+            if (!Number.isSafeInteger(prNum)) {
+              core.setFailed(`Invalid PR number: ${process.env.PR_NUMBER}`);
+              return;
+            }
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
-            const embeddingsFlag = '${{ inputs.embeddings }}' === 'true' ? 'with embeddings' : 'graph-only';
+            const embeddingsFlag = process.env.EMBEDDINGS_INPUT === 'true' ? 'with embeddings' : 'graph-only';
             const body = [
               `### GitNexus: ${outcome}`,
               ``,
               `PR #${prNum} was indexed ${embeddingsFlag}.`,
               `[Index run](${runUrl})`,
               '',
-              '${{ needs.index.result }}' === 'success'
-                ? '⏳ Waiting for deploy to serve the fresh index…'
+              indexSucceeded
+                ? 'PR-specific deploys are paused; only `LibreChat` and `LibreChat-dev` are currently served.'
                 : '_Index run failed — the previous index (if any) continues to be served._',
             ].join('\n');
             await github.rest.issues.createComment({
diff --git a/.github/workflows/gitnexus-pr-command.yml b/.github/workflows/gitnexus-pr-command.yml
index b299beb3b1b..214a526897f 100644
--- a/.github/workflows/gitnexus-pr-command.yml
+++ b/.github/workflows/gitnexus-pr-command.yml
@@ -94,18 +94,38 @@ jobs:
 
       - name: Dispatch gitnexus-index workflow
         uses: actions/github-script@v7
+        env:
+          EMBEDDINGS: ${{ steps.parse.outputs.embeddings }}
+          PR_NUMBER: ${{ steps.parse.outputs.pr_number }}
+          PR_REF: ${{ steps.parse.outputs.pr_ref }}
         with:
           script: |
+            const prNumber = process.env.PR_NUMBER || '';
+            const prRef = process.env.PR_REF || '';
+            const embeddings = process.env.EMBEDDINGS || 'false';
+            if (!/^[0-9]+$/.test(prNumber)) {
+              core.setFailed(`Invalid PR number: ${prNumber}`);
+              return;
+            }
+            if (prRef !== `refs/pull/${prNumber}/head`) {
+              core.setFailed(`Invalid PR ref: ${prRef}`);
+              return;
+            }
+            if (!['true', 'false'].includes(embeddings)) {
+              core.setFailed(`Invalid embeddings value: ${embeddings}`);
+              return;
+            }
             await github.rest.actions.createWorkflowDispatch({
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'gitnexus-index.yml',
               ref: 'main',
               inputs: {
-                pr_number: '${{ steps.parse.outputs.pr_number }}',
-                pr_ref: '${{ steps.parse.outputs.pr_ref }}',
-                embeddings: '${{ steps.parse.outputs.embeddings }}',
+                pr_number: prNumber,
+                pr_ref: prRef,
+                embeddings,
                 force: 'false',
+                deploy_after: 'true',
               },
             });
 
diff --git a/.github/workflows/helmcharts.yml b/.github/workflows/helmcharts.yml
index 2b9f7f45de6..9e0308ec727 100644
--- a/.github/workflows/helmcharts.yml
+++ b/.github/workflows/helmcharts.yml
@@ -5,18 +5,54 @@ on:
   push:
     tags:
       - "chart-*"
+  workflow_dispatch:
+    inputs:
+      chart_tag:
+        description: "Existing chart tag to release, for example chart-2.0.5"
+        required: true
+        type: string
 
 jobs:
   release:
     permissions:
-      contents: write
+      contents: read
       packages: write
     runs-on: ubuntu-latest
+    env:
+      CHART_REPOSITORY: ${{ github.repository_owner }}/librechat-chart
     steps:
+      - name: Resolve chart tag
+        id: chart-version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_CHART_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.chart_tag || '' }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          CHART_TAG="$REF_NAME"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            CHART_TAG="$INPUT_CHART_TAG"
+          fi
+
+          CHART_VERSION="${CHART_TAG#chart-}"
+          SEMVER_REGEX='^[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?([+][0-9A-Za-z.-]+)?$'
+          if [[ "$CHART_TAG" != chart-* || ! "$CHART_VERSION" =~ $SEMVER_REGEX ]]; then
+            echo "::error::Chart tags must use the form chart-<semver>, for example chart-2.0.3"
+            exit 1
+          fi
+
+          {
+            printf 'CHART_REF=refs/tags/%s\n' "$CHART_TAG"
+            printf 'CHART_TAG=%s\n' "$CHART_TAG"
+            printf 'CHART_VERSION=%s\n' "$CHART_VERSION"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ steps.chart-version.outputs.CHART_REF }}
 
       - name: Configure Git
         run: |
@@ -35,12 +71,6 @@ jobs:
           cd ../librechat-rag-api
           helm dependency build      
 
-      - name: Get Chart Version
-        id: chart-version
-        run: |
-          CHART_VERSION=$(echo "${{ github.ref_name }}" | cut -d'-' -f2)
-          echo "CHART_VERSION=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
-
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
@@ -55,7 +85,7 @@ jobs:
         uses: appany/helm-oci-chart-releaser@v0.4.2
         with:
           name: librechat
-          repository: ${{ github.actor }}/librechat-chart
+          repository: ${{ env.CHART_REPOSITORY }}
           tag: ${{ steps.chart-version.outputs.CHART_VERSION }}
           path: helm/librechat
           registry: ghcr.io
@@ -67,9 +97,9 @@ jobs:
         uses: appany/helm-oci-chart-releaser@v0.4.2
         with:
           name: librechat-rag-api
-          repository: ${{ github.actor }}/librechat-chart
+          repository: ${{ env.CHART_REPOSITORY }}
           tag: ${{ steps.chart-version.outputs.CHART_VERSION }}
           path: helm/librechat-rag-api
           registry: ghcr.io
           registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          registry_password: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/i18n-unused-keys.yml b/.github/workflows/i18n-unused-keys.yml
index 8f773532d33..6341c19d142 100644
--- a/.github/workflows/i18n-unused-keys.yml
+++ b/.github/workflows/i18n-unused-keys.yml
@@ -18,10 +18,11 @@ jobs:
   detect-unused-i18n-keys:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Find unused i18next keys
         id: find-unused
@@ -140,7 +141,7 @@ jobs:
 
           gh api "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
             -f body="$COMMENT_BODY" \
-            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+            -H "Authorization: token $GITHUB_TOKEN"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/locize-i18n-sync.yml b/.github/workflows/locize-i18n-sync.yml
index f34648dfd9d..c0b9af5a5f7 100644
--- a/.github/workflows/locize-i18n-sync.yml
+++ b/.github/workflows/locize-i18n-sync.yml
@@ -6,6 +6,9 @@ on:
   repository_dispatch:
     types: [locize/versionPublished]
 
+permissions:
+  contents: read
+
 jobs:
   sync-translations:
     name: Sync Translation Keys with Locize
@@ -13,21 +16,26 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set Up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: '24.16.0'
 
       - name: Install locize CLI
-        run: npm install -g locize-cli
+        run: npm install -g locize-cli@12.2.0 --ignore-scripts --no-audit --no-fund
 
       # Sync translations (Push missing keys & remove deleted ones)
       - name: Sync Locize with Repository
         if: ${{ github.event_name == 'push' }}
+        env:
+          LOCIZE_API_KEY: ${{ secrets.LOCIZE_API_KEY }}
+          LOCIZE_PROJECT_ID: ${{ secrets.LOCIZE_PROJECT_ID }}
         run: |
           cd client/src/locales
-          locize sync --api-key ${{ secrets.LOCIZE_API_KEY }} --project-id ${{ secrets.LOCIZE_PROJECT_ID }} --language en
+          locize sync --cdn-type pro --api-key "$LOCIZE_API_KEY" --project-id "$LOCIZE_PROJECT_ID" --language en
 
       # When triggered by repository_dispatch, skip sync step.
       - name: Skip sync step on non-push events
@@ -39,12 +47,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: sync-translations
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
       # 1. Check out the repository.
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       # 2. Download translation files from locize.
       - name: Download Translations from locize
@@ -53,20 +62,38 @@ jobs:
           project-id: ${{ secrets.LOCIZE_PROJECT_ID }}
           path: "client/src/locales"
 
-      # 3. Create a Pull Request using built-in functionality.
+      # 3. Create a Pull Request using a dedicated fine-grained PAT so this
+      # workflow does not depend on the global GITHUB_TOKEN PR-creation setting.
       - name: Create Pull Request
+        id: create-pull-request
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          sign-commits: true
+          token: ${{ secrets.LOCIZE_PR_TOKEN }}
+          add-paths: |
+            client/src/locales/**
           commit-message: "🌍 i18n: Update translation.json with latest translations"
           base: main
           branch: i18n/locize-translation-update
-          reviewers: danny-avila
           title: "🌍 i18n: Update translation.json with latest translations"
           body: |
             **Description**:
             - 🎯 **Objective**: Update `translation.json` with the latest translations from locize.
             - 🔍 **Details**: This PR is automatically generated upon receiving a versionPublished event with version "latest". It reflects the newest translations provided by locize.
             - ✅ **Status**: Ready for review.
-          labels: "🌍 i18n"
\ No newline at end of file
+          labels: "🌍 i18n"
+
+      - name: Request Reviewer
+        if: ${{ steps.create-pull-request.outputs.pull-request-number != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.LOCIZE_PR_TOKEN }}
+          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
+          REVIEWER: danny-avila
+        run: |
+          author="$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json author --jq '.author.login')"
+
+          if [ "$author" = "$REVIEWER" ]; then
+            echo "Skipping reviewer request because $REVIEWER authored PR #$PR_NUMBER."
+            exit 0
+          fi
+
+          gh pr edit "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --add-reviewer "$REVIEWER"
diff --git a/.github/workflows/main-image-workflow.yml b/.github/workflows/main-image-workflow.yml
index 43c9d957534..e5f76fe26ef 100644
--- a/.github/workflows/main-image-workflow.yml
+++ b/.github/workflows/main-image-workflow.yml
@@ -3,6 +3,10 @@ name: Docker Compose Build Latest Main Image Tag (Manual Dispatch)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -19,11 +23,26 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
 
       - name: Fetch tags and set the latest tag
         run: |
-          git fetch --tags
-          echo "LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)" >> $GITHUB_ENV
+          set -euo pipefail
+          git fetch --tags --force
+          LATEST_TAG=$(git tag --list 'v[0-9]*' --sort=-v:refname | grep -E '^v[0-9]+[.][0-9]+[.][0-9]+$' | head -n 1)
+          if [ -z "$LATEST_TAG" ]; then
+            echo "::error::No stable v<semver> tag found"
+            exit 1
+          fi
+          printf 'LATEST_TAG=%s\n' "$LATEST_TAG" >> "$GITHUB_ENV"
+
+      - name: Compute build metadata
+        run: |
+          printf 'BUILD_COMMIT=%s\n' "$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+          printf 'BUILD_BRANCH=main\n' >> "$GITHUB_ENV"
+          printf 'BUILD_DATE=%s\n' "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_ENV"
 
       # Set up QEMU
       - name: Set up QEMU
@@ -35,7 +54,7 @@ jobs:
 
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -67,3 +86,7 @@ jobs:
             ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
           platforms: linux/amd64,linux/arm64
           target: ${{ matrix.target }}
+          build-args: |
+            BUILD_COMMIT=${{ env.BUILD_COMMIT }}
+            BUILD_BRANCH=${{ env.BUILD_BRANCH }}
+            BUILD_DATE=${{ env.BUILD_DATE }}
diff --git a/.github/workflows/playwright-mock.yml b/.github/workflows/playwright-mock.yml
new file mode 100644
index 00000000000..fc94dc02d64
--- /dev/null
+++ b/.github/workflows/playwright-mock.yml
@@ -0,0 +1,137 @@
+name: Playwright E2E Tests
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Reason for manual trigger'
+        required: false
+        default: 'Manual e2e run'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: playwright-mock-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_OPTIONS: '--max-old-space-size=${{ secrets.NODE_MAX_OLD_SPACE_SIZE || 6144 }}'
+  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      E2E_CHROMIUM_CHANNEL: chrome
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 24.16.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            client/node_modules
+            packages/client/node_modules
+            packages/data-provider/node_modules
+            packages/data-schemas/node_modules
+            packages/api/node_modules
+            api/node_modules
+          key: node-modules-e2e-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Restore data-provider build cache
+        id: cache-data-provider
+        uses: actions/cache@v4
+        with:
+          path: packages/data-provider/dist
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-provider
+        if: steps.cache-data-provider.outputs.cache-hit != 'true'
+        run: npm run build:data-provider
+
+      - name: Restore data-schemas build cache
+        id: cache-data-schemas
+        uses: actions/cache@v4
+        with:
+          path: packages/data-schemas/dist
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-schemas
+        if: steps.cache-data-schemas.outputs.cache-hit != 'true'
+        run: npm run build:data-schemas
+
+      - name: Restore api build cache
+        id: cache-api
+        uses: actions/cache@v4
+        with:
+          path: packages/api/dist
+          key: build-api-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
+
+      - name: Build api
+        if: steps.cache-api.outputs.cache-hit != 'true'
+        run: npm run build:api
+
+      - name: Restore client-package build cache
+        id: cache-client-package
+        uses: actions/cache@v4
+        with:
+          path: packages/client/dist
+          key: build-client-package-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build client-package
+        if: steps.cache-client-package.outputs.cache-hit != 'true'
+        run: npm run build:client-package
+
+      - name: Restore client app build cache
+        id: cache-client-app
+        uses: actions/cache@v4
+        with:
+          path: client/dist
+          key: build-client-app-e2e-${{ runner.os }}-${{ hashFiles('package-lock.json', 'client/src/**', 'client/public/**', 'client/scripts/post-build.cjs', 'client/index.html', 'client/package.json', 'client/vite.config.*', 'client/tsconfig*.json', 'client/tailwind.config.*', 'client/postcss.config.*', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build client app
+        if: steps.cache-client-app.outputs.cache-hit != 'true'
+        run: npm run build:client
+
+      - name: Install Playwright runtime dependencies
+        timeout-minutes: 5
+        run: |
+          google-chrome --version
+          npx playwright install-deps chrome
+
+      - name: Run mock-LLM Tier-1 e2e
+        run: npx playwright test --config=e2e/playwright.config.mock.ts
+        env:
+          CI: 'true'
+
+      - name: Upload Playwright HTML report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: e2e/playwright-report/**
+          retention-days: 7
+          if-no-files-found: ignore
+
+      - name: Upload traces & screenshots
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-test-results
+          path: e2e/specs/.test-results/**
+          retention-days: 7
+          if-no-files-found: ignore
diff --git a/.github/workflows/retry-docker-builds.yml b/.github/workflows/retry-docker-builds.yml
new file mode 100644
index 00000000000..f4543977195
--- /dev/null
+++ b/.github/workflows/retry-docker-builds.yml
@@ -0,0 +1,136 @@
+name: Retry Failed Docker Builds
+
+on:
+  workflow_run:
+    workflows:
+      - Docker Build Smoke Tests
+      - Docker Compose Build Latest Main Image Tag (Manual Dispatch)
+      - Docker Dev Branch Images Build
+      - Docker Dev Images Build
+      - Docker Dev Staging Images Build
+      - Docker Images Build on Tag
+    types:
+      - completed
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  retry-failed-jobs:
+    name: Re-run failed jobs
+    if: >
+      (github.event.workflow_run.conclusion == 'failure' ||
+       github.event.workflow_run.conclusion == 'timed_out') &&
+      github.event.workflow_run.run_attempt < 3
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check failed run is still current
+        id: current-run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          RUN_EVENT: ${{ github.event.workflow_run.event }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          WORKFLOW_ID: ${{ github.event.workflow_run.workflow_id }}
+          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
+        run: |
+          set -euo pipefail
+
+          encode_uri() {
+            jq -nr --arg value "$1" '$value | @uri'
+          }
+
+          workflow_runs_path="repos/${GITHUB_REPOSITORY}/actions/workflows/${WORKFLOW_ID}/runs"
+          query="per_page=1&exclude_pull_requests=false"
+
+          if [ "$WORKFLOW_NAME" = "Docker Images Build on Tag" ]; then
+            if [ -z "$HEAD_BRANCH" ]; then
+              echo "No tag name found for ${WORKFLOW_NAME}; skipping retry."
+              echo "should_retry=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            if ! tag_ref=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/$(encode_uri "$HEAD_BRANCH")" --jq '.object'); then
+              echo "Tag ${HEAD_BRANCH} no longer exists; skipping retry."
+              echo "should_retry=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            tag_object_type=$(jq -r '.type' <<< "$tag_ref")
+            tag_object_sha=$(jq -r '.sha' <<< "$tag_ref")
+
+            if [ "$tag_object_type" = "tag" ]; then
+              tag_head_sha=$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object_sha}" --jq '.object.sha')
+            else
+              tag_head_sha="$tag_object_sha"
+            fi
+
+            if [ "$tag_head_sha" = "$HEAD_SHA" ]; then
+              echo "should_retry=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            echo "Skipping retry for stale ${WORKFLOW_NAME} run ${RUN_ID}; tag ${HEAD_BRANCH} now points to ${tag_head_sha}."
+            echo "should_retry=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -n "$RUN_EVENT" ]; then
+            query="${query}&event=$(encode_uri "$RUN_EVENT")"
+          fi
+
+          if [ -n "$HEAD_BRANCH" ]; then
+            query_with_ref="${query}&branch=$(encode_uri "$HEAD_BRANCH")"
+            latest_run=$(gh api "${workflow_runs_path}?${query_with_ref}" --jq '.workflow_runs[0] // empty')
+          else
+            latest_run=""
+          fi
+
+          if [ -z "$latest_run" ]; then
+            latest_run=$(gh api "${workflow_runs_path}?${query}" --jq '.workflow_runs[0] // empty')
+          fi
+
+          if [ -z "$latest_run" ]; then
+            echo "No matching workflow runs found for ${WORKFLOW_NAME}; skipping retry."
+            echo "should_retry=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          latest_run_id=$(jq -r '.id' <<< "$latest_run")
+          latest_head_sha=$(jq -r '.head_sha' <<< "$latest_run")
+
+          if [ "$latest_run_id" = "$RUN_ID" ] || [ "$latest_head_sha" = "$HEAD_SHA" ]; then
+            echo "should_retry=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Skipping retry for stale ${WORKFLOW_NAME} run ${RUN_ID}; newer run ${latest_run_id} is at ${latest_head_sha}."
+          echo "should_retry=false" >> "$GITHUB_OUTPUT"
+
+      - name: Re-run failed Docker jobs
+        if: steps.current-run.outputs.should_retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
+        run: |
+          set -euo pipefail
+
+          cancelled_jobs=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
+            | jq -s '[.[].jobs[]? | select(.conclusion == "cancelled")] | length')
+
+          if [ "$cancelled_jobs" -gt 0 ]; then
+            endpoint="rerun"
+            echo "Found ${cancelled_jobs} cancelled job(s); re-running the full workflow run."
+          else
+            endpoint="rerun-failed-jobs"
+            echo "Re-running failed jobs only."
+          fi
+
+          echo "Retrying ${WORKFLOW_NAME} (run ${RUN_ID}, attempt ${RUN_ATTEMPT})."
+          gh api \
+            --method POST \
+            "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/${endpoint}"
diff --git a/.github/workflows/sync-helm-chart-tags.yml b/.github/workflows/sync-helm-chart-tags.yml
new file mode 100644
index 00000000000..bde4c2f49a1
--- /dev/null
+++ b/.github/workflows/sync-helm-chart-tags.yml
@@ -0,0 +1,85 @@
+name: Sync Helm Chart Tags
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      release_existing_tag:
+        description: "Existing chart-* tag to dispatch if tag creation succeeded but release dispatch failed"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-helm-chart-tags
+  cancel-in-progress: false
+
+jobs:
+  noop:
+    name: Ignore non-main push
+    if: github.event_name == 'push' && github.ref != 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Skip tag sync
+        run: echo "Helm chart tag sync only runs on main pushes or manual dispatch."
+
+  sync:
+    name: Sync chart tags
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: write
+      contents: write
+    env:
+      BASE_REF: refs/remotes/origin/main
+      BACKFILL_FROM_VERSION: 1.9.0
+      CHART_PATH: helm/librechat/Chart.yaml
+      DEFAULT_BRANCH: main
+      DISPATCH_WORKFLOW: helmcharts.yml
+      GITHUB_SERVER_URL: ${{ github.server_url }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GITHUB_REPOSITORY: ${{ github.repository }}
+      RELEASE_EXISTING_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_existing_tag || '' }}
+      REPO_DIR: /tmp/librechat-sync
+      TAG_PREFIX: chart-
+    steps:
+      - name: Fetch main and tags
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$GITHUB_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+            echo "::error::Unexpected repository name: $GITHUB_REPOSITORY"
+            exit 1
+          fi
+
+          if [[ "$GITHUB_SERVER_URL" != "https://github.com" ]]; then
+            echo "::error::Unexpected GitHub server URL: $GITHUB_SERVER_URL"
+            exit 1
+          fi
+
+          rm -rf "$REPO_DIR"
+          git init "$REPO_DIR"
+          cd "$REPO_DIR"
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          AUTH_HEADER="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
+          git -c "http.extraheader=AUTHORIZATION: basic ${AUTH_HEADER}" \
+            fetch --prune --force --tags origin \
+            "+refs/heads/${DEFAULT_BRANCH}:refs/remotes/origin/${DEFAULT_BRANCH}"
+          git checkout --detach "$BASE_REF"
+
+      - name: Create missing chart tags
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUSH_TAGS: "true"
+        run: |
+          set -euo pipefail
+          cd "$REPO_DIR"
+          .github/scripts/sync-helm-chart-tags.sh
diff --git a/.github/workflows/tag-images.yml b/.github/workflows/tag-images.yml
index e90f43978ab..3b4dfc0cd0b 100644
--- a/.github/workflows/tag-images.yml
+++ b/.github/workflows/tag-images.yml
@@ -3,7 +3,11 @@ name: Docker Images Build on Tag
 on:
   push:
     tags:
-      - '*'
+      - 'v*'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
@@ -23,6 +27,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate release tag
+        id: release-tag
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          TAG_REGEX='^v[0-9]+[.][0-9]+[.][0-9]+(-rc[0-9]+)?$'
+          STABLE_TAG_REGEX='^v[0-9]+[.][0-9]+[.][0-9]+$'
+          if [[ ! "$REF_NAME" =~ $TAG_REGEX ]]; then
+            echo "::error::Docker release tags must use v<semver> or v<semver>-rcN, for example v0.8.5 or v0.8.5-rc1"
+            exit 1
+          fi
+          printf 'image_tag=%s\n' "$REF_NAME" >> "$GITHUB_OUTPUT"
+          if [[ "$REF_NAME" =~ $STABLE_TAG_REGEX ]]; then
+            echo "is_stable=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_stable=false" >> "$GITHUB_OUTPUT"
+          fi
+
       # Set up QEMU
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -33,7 +56,7 @@ jobs:
 
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -51,6 +74,34 @@ jobs:
         run: |
           cp .env.example .env
 
+      - name: Compute build metadata
+        run: |
+          echo "BUILD_COMMIT=${{ github.sha }}" >> $GITHUB_ENV
+          echo "BUILD_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
+
+      - name: Resolve image tags
+        id: image-tags
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          IMAGE_NAME: ${{ matrix.image_name }}
+          IMAGE_TAG: ${{ steps.release-tag.outputs.image_tag }}
+          IS_STABLE: ${{ steps.release-tag.outputs.is_stable }}
+        run: |
+          set -euo pipefail
+          git fetch --tags --force
+          LATEST_STABLE_TAG=$(git tag --list 'v[0-9]*' --sort=-v:refname | grep -E '^v[0-9]+[.][0-9]+[.][0-9]+$' | head -n 1 || true)
+          {
+            echo 'tags<<EOF'
+            printf 'ghcr.io/%s/%s:%s\n' "$GITHUB_REPOSITORY_OWNER" "$IMAGE_NAME" "$IMAGE_TAG"
+            printf '%s/%s:%s\n' "$DOCKERHUB_USERNAME" "$IMAGE_NAME" "$IMAGE_TAG"
+            if [ "$IS_STABLE" = "true" ] && [ "$IMAGE_TAG" = "$LATEST_STABLE_TAG" ]; then
+              printf 'ghcr.io/%s/%s:latest\n' "$GITHUB_REPOSITORY_OWNER" "$IMAGE_NAME"
+              printf '%s/%s:latest\n' "$DOCKERHUB_USERNAME" "$IMAGE_NAME"
+            fi
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
       # Build and push Docker images for each target
       - name: Build and push Docker images
         uses: docker/build-push-action@v5
@@ -58,10 +109,10 @@ jobs:
           context: .
           file: ${{ matrix.file }}
           push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}:${{ github.ref_name }}
-            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}:latest
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:${{ github.ref_name }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
+          tags: ${{ steps.image-tags.outputs.tags }}
           platforms: linux/amd64,linux/arm64
           target: ${{ matrix.target }}
+          build-args: |
+            BUILD_COMMIT=${{ env.BUILD_COMMIT }}
+            BUILD_BRANCH=${{ env.BUILD_BRANCH }}
+            BUILD_DATE=${{ env.BUILD_DATE }}
diff --git a/.github/workflows/unused-packages.yml b/.github/workflows/unused-packages.yml
index f67c1d23be9..5401d37d5b5 100644
--- a/.github/workflows/unused-packages.yml
+++ b/.github/workflows/unused-packages.yml
@@ -14,15 +14,16 @@ jobs:
   detect-unused-packages:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 24.16.0
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: '24.16.0'
           cache: 'npm'
 
       - name: Install depcheck
@@ -272,7 +273,7 @@ jobs:
 
           gh api "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
             -f body="$COMMENT_BODY" \
-            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+            -H "Authorization: token $GITHUB_TOKEN"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.gitignore b/.gitignore
index d775e70a263..15aa483faab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,6 +88,7 @@ archive
 .vscode/settings.json
 src/style - official.css
 /e2e/specs/.test-results/
+/e2e/.generated/
 /e2e/playwright-report/
 /playwright/.cache/
 .DS_Store
@@ -178,3 +179,4 @@ claude-flow
 hive-mind-prompt-*.txt
 CLAUDE.md
 .gsd
+codedb.snapshot
diff --git a/.husky/lint-staged.config.js b/.husky/lint-staged.config.js
index 482e1f050e0..8aee5fba819 100644
--- a/.husky/lint-staged.config.js
+++ b/.husky/lint-staged.config.js
@@ -1,4 +1,9 @@
 module.exports = {
-  '*.{js,jsx,ts,tsx}': ['prettier --write', 'eslint --fix', 'eslint'],
+  '*.{js,jsx,ts,tsx}': [
+    'node scripts/sort-imports.mts',
+    'prettier --write',
+    'eslint --fix',
+    'eslint',
+  ],
   '*.json': ['prettier --write'],
 };
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000000..b832e4001db
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.16.0
diff --git a/CLAUDE.md b/CLAUDE.md
index 81362cfc570..8172a614056 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -143,7 +143,7 @@ Multi-line imports count total character length across all lines. Consolidate va
 | `npm run frontend:dev` | Start frontend dev server with HMR (port 3090, requires backend running) |
 | `npm run build:data-provider` | Rebuild `packages/data-provider` after changes |
 
-- Node.js: v20.19.0+ or ^22.12.0 or >= 23.0.0
+- Node.js: v24.16.0
 - Database: MongoDB
 - Backend runs on `http://localhost:3080/`; frontend dev server on `http://localhost:3090/`
 
diff --git a/Dockerfile b/Dockerfile
index 809f167413c..9e5d41b5d6c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
-# v0.8.6-rc1
+# v0.8.7
 
 # Base node image
-FROM node:20-alpine AS node
+FROM node:24.16.0-alpine AS node
 
 RUN apk upgrade --no-cache
 RUN apk add --no-cache jemalloc
@@ -35,7 +35,7 @@ RUN \
     # Allow mounting of these files, which have no default
     touch .env ; \
     # Create directories for the volumes to inherit the correct permissions
-    mkdir -p /app/client/public/images /app/logs /app/uploads ; \
+    mkdir -p /app/client/public/images /app/logs /app/uploads /app/skill ; \
     npm config set fetch-retry-maxtimeout 600000 ; \
     npm config set fetch-retries 5 ; \
     npm config set fetch-retry-mintimeout 15000 ; \
@@ -59,6 +59,18 @@ RUN \
     npm prune --production; \
     npm cache clean --force
 
+# Optional build metadata surfaced in Settings -> About for support triage.
+# Declared here (after the heavy install/build steps) so that commit/date
+# changing on every CI run does not bust the cache for dependency install
+# and frontend build layers. When unset, the backend falls back to local
+# git resolution (if .git is present), and finally to empty values.
+ARG BUILD_COMMIT=
+ARG BUILD_BRANCH=
+ARG BUILD_DATE=
+ENV BUILD_COMMIT=${BUILD_COMMIT}
+ENV BUILD_BRANCH=${BUILD_BRANCH}
+ENV BUILD_DATE=${BUILD_DATE}
+
 # Node API setup
 EXPOSE 3080
 ENV HOST=0.0.0.0
diff --git a/Dockerfile.multi b/Dockerfile.multi
index f392a51e405..ce429c02bb1 100644
--- a/Dockerfile.multi
+++ b/Dockerfile.multi
@@ -1,11 +1,16 @@
 # Dockerfile.multi
-# v0.8.6-rc1
+# v0.8.7
 
 # Set configurable max-old-space-size with default
 ARG NODE_MAX_OLD_SPACE_SIZE=6144
 
+# Optional build metadata surfaced in Settings -> About for support triage.
+ARG BUILD_COMMIT=
+ARG BUILD_BRANCH=
+ARG BUILD_DATE=
+
 # Base for all builds
-FROM node:20-alpine AS base-min
+FROM node:24.16.0-alpine AS base-min
 ARG NPM_CI_TIMEOUT_SECONDS=1500
 ARG NPM_CI_ATTEMPTS=2
 RUN apk upgrade --no-cache
@@ -104,10 +109,20 @@ RUN attempt=1; \
     done
 COPY api ./api
 COPY config ./config
+COPY skill ./skill
 COPY --from=data-provider-build /app/packages/data-provider/dist ./packages/data-provider/dist
 COPY --from=data-schemas-build /app/packages/data-schemas/dist ./packages/data-schemas/dist
 COPY --from=api-package-build /app/packages/api/dist ./packages/api/dist
 COPY --from=client-build /app/client/dist ./client/dist
+# Propagate build metadata into runtime env so /api/config can expose it.
+# Declared here (after the heavy install/copy steps) so that commit/date
+# changing on every CI run does not bust the cache for those layers.
+ARG BUILD_COMMIT
+ARG BUILD_BRANCH
+ARG BUILD_DATE
+ENV BUILD_COMMIT=${BUILD_COMMIT}
+ENV BUILD_BRANCH=${BUILD_BRANCH}
+ENV BUILD_DATE=${BUILD_DATE}
 WORKDIR /app/api
 EXPOSE 3080
 ENV HOST=0.0.0.0
diff --git a/README.md b/README.md
index a7f68d9a920..54bf286e853 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,7 @@
   - Secure, Sandboxed Execution in Python, Node.js (JS/TS), Go, C/C++, Java, PHP, Rust, and Fortran
   - Seamless File Handling: Upload, process, and download files directly
   - No Privacy Concerns: Fully isolated and secure execution
+  - Open-Source & Self-Hostable: powered by [ClickHouse/code-interpreter](https://github.com/ClickHouse/code-interpreter)
 
 - 🔦 **Agents & Tools Integration**:  
   - **[LibreChat Agents](https://www.librechat.ai/docs/features/agents)**:
@@ -74,6 +75,8 @@
     - Agent Marketplace: Discover and deploy community-built agents
     - Collaborative Sharing: Share agents with specific users and groups
     - Flexible & Extensible: Use MCP Servers, tools, file search, code execution, and more
+    - [Skills](https://www.librechat.ai/docs/features/skills): Create reusable `SKILL.md` instruction bundles for manual, automatic, or always-on agent workflows
+    - [Subagents](https://www.librechat.ai/docs/features/subagents): Delegate focused work to isolated child agent runs with their own context windows
     - Compatible with Custom Endpoints, OpenAI, Azure, Anthropic, AWS Bedrock, Google, Vertex AI, Responses API, and more
     - [Model Context Protocol (MCP) Support](https://modelcontextprotocol.io/clients#librechat) for Tools
 
@@ -135,8 +138,14 @@
   - Multi-User, Secure Authentication with OAuth2, LDAP, & Email Login Support
   - Built-in Moderation, and Token spend tools
 
+- 🎛️ **[Admin Panel](https://www.librechat.ai/docs/features/admin_panel)**:
+  - Browser-based UI to manage users, groups, roles, and configuration overrides
+  - Edit settings and per-role/group permissions live, without redeploying
+  - Bundled with the Docker Compose stacks for one-command setup
+
 - ⚙️ **Configuration & Deployment**:  
   - Configure Proxy, Reverse Proxy, Docker, & many Deployment options  
+  - Use [S3 with CloudFront](https://www.librechat.ai/docs/configuration/cdn/cloudfront) for stable media links, edge delivery, signed cookies, and secured downloads
   - Use completely local or deploy on the cloud
 
 - 📖 **Open-Source & Community**:  
diff --git a/README.zh.md b/README.zh.md
index 7f74057413c..61c6d589fa5 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -1,4 +1,4 @@
-<!-- Last synced with README.md: 2026-03-28 (cae3888) -->
+<!-- Last synced with README.md: 2026-05-12 (947bfa4c40) -->
 
 <p align="center">
   <a href="https://librechat.ai">
@@ -76,6 +76,8 @@
     - 智能体市场：发现并部署社区构建的智能体。
     - 协作共享：与特定用户和群组共享智能体。
     - 灵活且可扩展：支持 MCP 服务器、工具、文件搜索、代码执行等。
+    - [Skills](https://www.librechat.ai/docs/features/skills)：创建可复用的 `SKILL.md` 指令包，用于手动、自动或始终启用的智能体工作流。
+    - [Subagents](https://www.librechat.ai/docs/features/subagents)：将专门任务委派给拥有独立上下文窗口的隔离子智能体运行。
     - 兼容自定义端点、OpenAI, Azure, Anthropic, AWS Bedrock, Google, Vertex AI, Responses API 等。
     - [支持模型上下文协议 (MCP)](https://modelcontextprotocol.io/clients#librechat) 用于工具调用。
 
@@ -139,6 +141,7 @@
 
 - ⚙️ **配置与部署**：  
   - 支持代理、反向代理、Docker 及多种部署选项。  
+  - 使用 [S3 与 CloudFront](https://www.librechat.ai/docs/configuration/cdn/cloudfront) 获得稳定的媒体链接、边缘分发、签名 Cookie 和安全下载。
   - 可完全本地运行或部署在云端。
 
 - 📖 **开源与社区**：  
diff --git a/api/app/clients/BaseClient.js b/api/app/clients/BaseClient.js
index e641017c74f..b7c5a8ae59d 100644
--- a/api/app/clients/BaseClient.js
+++ b/api/app/clients/BaseClient.js
@@ -6,7 +6,9 @@ const {
   checkBalance,
   getBalanceConfig,
   buildMessageFiles,
+  sanitizeFileForTransmit,
   extractFileContext,
+  getReferencedQuotes,
   encodeAndFormatAudios,
   encodeAndFormatVideos,
   encodeAndFormatDocuments,
@@ -14,6 +16,7 @@ const {
 const {
   Constants,
   FileSources,
+  Tools,
   ContentTypes,
   excludedKeys,
   EModelEndpoint,
@@ -30,6 +33,115 @@ const { logViolation } = require('~/cache');
 const TextStream = require('./TextStream');
 const db = require('~/models');
 
+const collectHistoricalFileRefs = (message) => {
+  const refs = [];
+  if (Array.isArray(message.files)) {
+    refs.push(...message.files);
+  }
+  if (Array.isArray(message.attachments)) {
+    refs.push(...message.attachments);
+  }
+  return refs;
+};
+
+const collectHistoricalFileIds = (messages) => {
+  const fileIds = new Set();
+  for (const message of messages) {
+    for (const ref of collectHistoricalFileRefs(message)) {
+      if (ref?.file_id) {
+        fileIds.add(ref.file_id);
+      }
+    }
+  }
+  return Array.from(fileIds);
+};
+
+const buildOwnerFileFilter = (fileIds, user) => {
+  if (!user?.id || fileIds.length === 0) {
+    return null;
+  }
+
+  const filter = {
+    file_id: { $in: fileIds },
+    user: user.id,
+  };
+  if (user.tenantId) {
+    filter.tenantId = user.tenantId;
+  }
+  return filter;
+};
+
+const TOOL_ATTACHMENT_KEYS = [
+  Tools.file_search,
+  Tools.web_search,
+  Tools.ui_resources,
+  Tools.memory,
+];
+const DISPLAY_ATTACHMENT_FIELDS = [
+  'filename',
+  'filepath',
+  'expiresAt',
+  'conversationId',
+  'messageId',
+  'toolCallId',
+  'name',
+];
+const PER_MESSAGE_FILE_ATTACHMENT_FIELDS = ['messageId', 'toolCallId'];
+
+const pickFields = (source, fields) => {
+  const picked = {};
+  for (const field of fields) {
+    if (source?.[field] !== undefined) {
+      picked[field] = source[field];
+    }
+  }
+  return picked;
+};
+
+const sanitizeDisplayOnlyAttachment = (ref) => {
+  if (!ref || ref.file_id) {
+    return undefined;
+  }
+
+  const attachment = pickFields(ref, DISPLAY_ATTACHMENT_FIELDS);
+  if (TOOL_ATTACHMENT_KEYS.includes(ref.type)) {
+    attachment.type = ref.type;
+  }
+  for (const key of TOOL_ATTACHMENT_KEYS) {
+    if (ref[key] !== undefined) {
+      attachment[key] = ref[key];
+    }
+  }
+
+  return Object.keys(attachment).length > 0 ? attachment : undefined;
+};
+
+const rehydrateMessageFileRefs = (refs, filesById, { preserveDisplayOnly = false } = {}) => {
+  if (!Array.isArray(refs)) {
+    return undefined;
+  }
+
+  const files = [];
+  for (const ref of refs) {
+    const file = filesById.get(ref?.file_id);
+    if (file) {
+      files.push({
+        ...sanitizeFileForTransmit(file),
+        ...pickFields(ref, PER_MESSAGE_FILE_ATTACHMENT_FIELDS),
+      });
+      continue;
+    }
+
+    if (preserveDisplayOnly) {
+      const displayOnlyAttachment = sanitizeDisplayOnlyAttachment(ref);
+      if (displayOnlyAttachment) {
+        files.push(displayOnlyAttachment);
+      }
+    }
+  }
+  return files.length > 0 ? files : undefined;
+};
+
 class BaseClient {
   constructor(apiKey, options = {}) {
     this.apiKey = apiKey;
@@ -277,6 +389,21 @@ class BaseClient {
           text: message,
         });
 
+    /**
+     * Attach quoted excerpts (the "Add to chat" selections from `req.body.quotes`)
+     * before `getReqData`/`onStart` fire, so the optimistic bubble, resumable job
+     * metadata, and the saved row all carry them. Only on fresh turns — edits
+     * replay an existing message that already has its quotes. The excerpts are
+     * merged into the model-facing text later, per message, in `buildMessages`,
+     * keeping the stored `text` clean while the count stays consistent.
+     */
+    if (!opts.isEdited) {
+      const referencedQuotes = getReferencedQuotes(this.options.req?.body?.quotes);
+      if (referencedQuotes != null) {
+        userMessage.quotes = referencedQuotes;
+      }
+    }
+
     if (typeof opts?.getReqData === 'function') {
       opts.getReqData({
         userMessage,
@@ -700,14 +827,13 @@ class BaseClient {
       user,
     );
     this.savedMessageIds.add(responseMessage.messageId);
-    delete responseMessage.tokenCount;
     return responseMessage;
   }
 
   async loadHistory(conversationId, parentMessageId = null) {
     logger.debug('[BaseClient] Loading history:', { conversationId, parentMessageId });
 
-    const messages = (await db.getMessages({ conversationId })) ?? [];
+    const messages = (await db.getMessages({ conversationId, user: this.user })) ?? [];
 
     if (messages.length === 0) {
       return [];
@@ -1217,8 +1343,8 @@ class BaseClient {
     const provider = this.options.agent?.provider ?? this.options.endpoint;
     const isBedrock = provider === EModelEndpoint.bedrock;
 
-    if (!this._mergedFileConfig && this.options.req?.config?.fileConfig) {
-      this._mergedFileConfig = mergeFileConfig(this.options.req.config.fileConfig);
+    if (!this._mergedFileConfig) {
+      this._mergedFileConfig = mergeFileConfig(this.options.req?.config?.fileConfig);
       const endpoint = this.options.agent?.endpoint ?? this.options.endpoint;
       this._endpointFileConfig = getEndpointFileConfig({
         fileConfig: this._mergedFileConfig,
@@ -1309,12 +1435,26 @@ class BaseClient {
       return _messages;
     }
 
-    const seen = new Set();
+    const contextSeen = new Set();
     const attachmentsProcessed =
       this.options.attachments && !(this.options.attachments instanceof Promise);
     if (attachmentsProcessed) {
       for (const attachment of this.options.attachments) {
-        seen.add(attachment.file_id);
+        if (attachment?.file_id) {
+          contextSeen.add(attachment.file_id);
+        }
+      }
+    }
+
+    const historicalFileIds = collectHistoricalFileIds(_messages);
+    const fileFilter = buildOwnerFileFilter(historicalFileIds, this.options.req?.user);
+    const authorizedFilesById = new Map();
+    if (fileFilter) {
+      const files = (await db.getFiles(fileFilter, {}, {})) ?? [];
+      for (const file of files) {
+        if (file?.file_id) {
+          authorizedFilesById.set(file.file_id, file);
+        }
       }
     }
 
@@ -1328,38 +1468,57 @@ class BaseClient {
         this.message_file_map = {};
       }
 
-      const fileIds = [];
-      for (const file of message.files) {
-        if (seen.has(file.file_id)) {
-          continue;
+      delete message.fileContext;
+
+      const contextFiles = [];
+      if (Array.isArray(message.files)) {
+        for (const file of message.files) {
+          if (!file?.file_id || contextSeen.has(file.file_id)) {
+            continue;
+          }
+          const authorizedFile = authorizedFilesById.get(file.file_id);
+          if (authorizedFile) {
+            contextFiles.push(authorizedFile);
+            contextSeen.add(file.file_id);
+          }
         }
-        fileIds.push(file.file_id);
-        seen.add(file.file_id);
       }
 
-      if (fileIds.length === 0) {
-        return message;
+      const rehydratedFiles = rehydrateMessageFileRefs(message.files, authorizedFilesById);
+      if (rehydratedFiles) {
+        message.files = rehydratedFiles;
+      } else {
+        delete message.files;
       }
 
-      const files = await db.getFiles(
+      const rehydratedAttachments = rehydrateMessageFileRefs(
+        message.attachments,
+        authorizedFilesById,
         {
-          file_id: { $in: fileIds },
+          preserveDisplayOnly: true,
         },
-        {},
-        {},
       );
+      if (rehydratedAttachments) {
+        message.attachments = rehydratedAttachments;
+      } else {
+        delete message.attachments;
+      }
+
+      if (contextFiles.length === 0) {
+        return message;
+      }
 
-      await this.addFileContextToMessage(message, files);
-      await this.processAttachments(message, files);
+      await this.addFileContextToMessage(message, contextFiles);
+      await this.processAttachments(message, contextFiles);
 
-      this.message_file_map[message.messageId] = files;
+      this.message_file_map[message.messageId] = contextFiles;
       return message;
     };
 
     const promises = [];
 
     for (const message of _messages) {
-      if (!message.files) {
+      if (!message.files && !message.attachments) {
         promises.push(message);
         continue;
       }
diff --git a/api/app/clients/specs/BaseClient.test.js b/api/app/clients/specs/BaseClient.test.js
index eb6ae656e99..d565f870121 100644
--- a/api/app/clients/specs/BaseClient.test.js
+++ b/api/app/clients/specs/BaseClient.test.js
@@ -1,5 +1,5 @@
 const { Constants } = require('librechat-data-provider');
-const { initializeFakeClient } = require('./FakeClient');
+const { FakeClient, initializeFakeClient } = require('./FakeClient');
 
 jest.mock('~/db/connect');
 jest.mock('~/server/services/Config', () => ({
@@ -38,7 +38,7 @@ jest.mock('~/models', () => ({
   updateFileUsage: jest.fn(),
 }));
 
-const { getConvo, saveConvo, saveMessage } = require('~/models');
+const { getConvo, getFiles, getMessages, saveConvo, saveMessage } = require('~/models');
 
 jest.mock('@librechat/agents', () => {
   const actual = jest.requireActual('@librechat/agents');
@@ -622,6 +622,27 @@ describe('BaseClient', () => {
       expect(chatMessages2[chatMessages2.length - 1].text).toEqual("What's up");
     });
 
+    test('loadHistory should scope database reads to the current user', async () => {
+      const user = 'user-123';
+      TestClient = new FakeClient(apiKey, options);
+      TestClient.user = user;
+      getMessages.mockResolvedValueOnce([
+        {
+          role: 'user',
+          isCreatedByUser: true,
+          text: 'Hello',
+          messageId: '1',
+          conversationId,
+        },
+      ]);
+
+      const chatMessages = await TestClient.loadHistory(conversationId, '1');
+
+      expect(getMessages).toHaveBeenCalledWith({ conversationId, user });
+      expect(chatMessages).toHaveLength(1);
+      expect(chatMessages[0].text).toBe('Hello');
+    });
+
     /* Most of the new sendMessage logic revolving around edited/continued AI messages
      *  can be summarized by the following test. The condition will load the entire history up to
      *  the message that is being edited, which will trigger the AI API to 'continue' the response.
@@ -1295,4 +1316,296 @@ describe('BaseClient', () => {
       expect(userSave[0].files[0].file_id).toBe('file-abc');
     });
   });
+
+  describe('addPreviousAttachments authorization', () => {
+    const ownerFile = {
+      file_id: 'owner-file',
+      filename: 'owner.txt',
+      filepath: '/uploads/owner.txt',
+      source: 'local',
+      type: 'text/plain',
+      bytes: 100,
+      object: 'file',
+      user: 'user-1',
+      embedded: false,
+      usage: 0,
+      text: 'authorized owner text',
+      _id: 'owner-mongo-id',
+      metadata: {
+        codeEnvRef: {
+          kind: 'user',
+          id: 'user-1',
+          storage_session_id: 'owner-session',
+          file_id: 'owner-code-file',
+        },
+      },
+    };
+
+    beforeEach(() => {
+      getFiles.mockReset();
+      TestClient.options.resendFiles = true;
+      TestClient.options.attachments = undefined;
+      TestClient.options.req = {
+        user: {
+          id: 'user-1',
+          tenantId: 'tenant-a',
+        },
+      };
+      TestClient.addFileContextToMessage = jest.fn(async (message, files) => {
+        const text = files
+          .map((file) => file.text)
+          .filter(Boolean)
+          .join('\n');
+        if (text) {
+          message.fileContext = text;
+        }
+      });
+      TestClient.processAttachments = jest.fn(async (_message, files) => files);
+      TestClient.checkVisionRequest = jest.fn();
+    });
+
+    test('rehydrates historical file refs from owner-scoped DB rows only', async () => {
+      getFiles.mockResolvedValueOnce([ownerFile]);
+
+      const [message] = await TestClient.addPreviousAttachments([
+        {
+          messageId: 'msg-1',
+          text: 'Use the attachment',
+          files: [
+            {
+              file_id: 'owner-file',
+              filename: 'attacker-controlled-owner-name.txt',
+              filepath: '/forged/owner.txt',
+              text: 'forged owner text',
+            },
+            {
+              file_id: 'victim-file',
+              filename: 'victim.txt',
+              filepath: '/victim/private.txt',
+              text: 'victim private text',
+            },
+          ],
+          attachments: [
+            {
+              file_id: 'victim-file',
+              filename: 'victim-output.csv',
+              text: 'victim output text',
+            },
+          ],
+          fileContext: 'stale victim private text',
+        },
+      ]);
+
+      expect(getFiles).toHaveBeenCalledWith(
+        {
+          file_id: { $in: ['owner-file', 'victim-file'] },
+          user: 'user-1',
+          tenantId: 'tenant-a',
+        },
+        {},
+        {},
+      );
+      expect(TestClient.addFileContextToMessage).toHaveBeenCalledWith(message, [ownerFile]);
+      expect(TestClient.processAttachments).toHaveBeenCalledWith(message, [ownerFile]);
+      expect(message.fileContext).toBe('authorized owner text');
+      expect(message.files).toEqual([
+        expect.objectContaining({
+          file_id: 'owner-file',
+          filename: 'owner.txt',
+          filepath: '/uploads/owner.txt',
+          source: 'local',
+          metadata: ownerFile.metadata,
+        }),
+      ]);
+      expect(message.files[0].text).toBeUndefined();
+      expect(message.files[0]._id).toBeUndefined();
+      expect(message.attachments).toBeUndefined();
+      expect(JSON.stringify(message)).not.toContain('victim');
+      expect(JSON.stringify(message)).not.toContain('forged owner text');
+    });
+
+    test('strips historical file context when no authenticated owner scope is available', async () => {
+      TestClient.options.req = {};
+
+      const [message] = await TestClient.addPreviousAttachments([
+        {
+          messageId: 'msg-2',
+          files: [{ file_id: 'victim-file', filename: 'victim.txt' }],
+          fileContext: 'stale victim private text',
+        },
+      ]);
+
+      expect(getFiles).not.toHaveBeenCalled();
+      expect(message.files).toBeUndefined();
+      expect(message.fileContext).toBeUndefined();
+    });
+
+    test('preserves repeated owner-authorized historical file refs after the first context use', async () => {
+      getFiles.mockResolvedValueOnce([ownerFile]);
+
+      const [firstMessage, secondMessage] = await TestClient.addPreviousAttachments([
+        {
+          messageId: 'msg-repeat-1',
+          files: [{ file_id: 'owner-file', filename: 'first-forged.txt' }],
+        },
+        {
+          messageId: 'msg-repeat-2',
+          files: [{ file_id: 'owner-file', filename: 'second-forged.txt' }],
+        },
+      ]);
+
+      expect(getFiles).toHaveBeenCalledTimes(1);
+      expect(getFiles).toHaveBeenCalledWith(
+        {
+          file_id: { $in: ['owner-file'] },
+          user: 'user-1',
+          tenantId: 'tenant-a',
+        },
+        {},
+        {},
+      );
+      expect(TestClient.addFileContextToMessage).toHaveBeenCalledTimes(1);
+      expect(TestClient.addFileContextToMessage).toHaveBeenCalledWith(firstMessage, [ownerFile]);
+      expect(secondMessage.fileContext).toBeUndefined();
+      expect(firstMessage.files).toEqual([
+        expect.objectContaining({ file_id: 'owner-file', filename: 'owner.txt' }),
+      ]);
+      expect(secondMessage.files).toEqual([
+        expect.objectContaining({ file_id: 'owner-file', filename: 'owner.txt' }),
+      ]);
+      expect(JSON.stringify(secondMessage)).not.toContain('second-forged');
+    });
+
+    test('preserves download-only historical attachments without trusting file fields', async () => {
+      const [message] = await TestClient.addPreviousAttachments([
+        {
+          messageId: 'msg-download-only',
+          attachments: [
+            {
+              filename: 'report.csv',
+              filepath: '/api/files/code/download/session/file',
+              expiresAt: 123456,
+              conversationId: 'conversation-1',
+              messageId: 'assistant-message',
+              toolCallId: 'tool-call-1',
+              text: 'untrusted text should not survive',
+              source: 'forged-source',
+              metadata: { codeEnvRef: { id: 'victim' } },
+            },
+          ],
+          fileContext: 'stale context',
+        },
+      ]);
+
+      expect(getFiles).not.toHaveBeenCalled();
+      expect(message.fileContext).toBeUndefined();
+      expect(message.attachments).toEqual([
+        {
+          filename: 'report.csv',
+          filepath: '/api/files/code/download/session/file',
+          expiresAt: 123456,
+          conversationId: 'conversation-1',
+          messageId: 'assistant-message',
+          toolCallId: 'tool-call-1',
+        },
+      ]);
+      expect(JSON.stringify(message)).not.toContain('untrusted text');
+      expect(JSON.stringify(message)).not.toContain('forged-source');
+      expect(JSON.stringify(message)).not.toContain('victim');
+    });
+
+    test('merges safe per-message metadata onto authorized DB-backed attachments', async () => {
+      getFiles.mockResolvedValueOnce([ownerFile]);
+
+      const [message] = await TestClient.addPreviousAttachments([
+        {
+          messageId: 'msg-artifact',
+          attachments: [
+            {
+              file_id: 'owner-file',
+              filename: 'forged-artifact.csv',
+              filepath: '/forged/artifact.csv',
+              source: 'forged-source',
+              metadata: { codeEnvRef: { id: 'victim' } },
+              text: 'forged artifact text',
+              messageId: 'assistant-message',
+              toolCallId: 'tool-call-2',
+            },
+          ],
+        },
+      ]);
+
+      expect(message.attachments).toEqual([
+        expect.objectContaining({
+          file_id: 'owner-file',
+          filename: 'owner.txt',
+          filepath: '/uploads/owner.txt',
+          source: 'local',
+          metadata: ownerFile.metadata,
+          messageId: 'assistant-message',
+          toolCallId: 'tool-call-2',
+        }),
+      ]);
+      expect(message.attachments[0].text).toBeUndefined();
+      expect(message.attachments[0]._id).toBeUndefined();
+      expect(JSON.stringify(message)).not.toContain('forged-artifact');
+      expect(JSON.stringify(message)).not.toContain('forged artifact text');
+    });
+  });
+
+  describe('sendMessage quote references', () => {
+    // The blockquote merge itself lives in AgentClient.buildMessages / prependQuotes
+    // (covered by packages/api specs). BaseClient's job is to attach the normalized
+    // quotes onto the user message early and keep the stored text clean.
+    test('attaches normalized quotes before getReqData fires and keeps stored text clean', async () => {
+      TestClient.options.req = { body: { quotes: ['  the selected text  ', '', 42] } };
+      TestClient.saveMessageToDatabase = jest.fn().mockResolvedValue({ message: {} });
+      let captured;
+      await TestClient.sendMessage('What does this mean?', {
+        getReqData: (data) => {
+          if (data.userMessage) {
+            captured = { text: data.userMessage.text, quotes: data.userMessage.quotes };
+          }
+        },
+      });
+
+      // Quotes are present (trimmed, non-strings dropped) at getReqData time, and
+      // the user text is never mutated by the merge.
+      expect(captured).toBeDefined();
+      expect(captured.quotes).toEqual(['the selected text']);
+      expect(captured.text).toBe('What does this mean?');
+
+      const userSave = TestClient.saveMessageToDatabase.mock.calls.find(
+        ([msg]) => msg.isCreatedByUser,
+      );
+      expect(userSave[0].text).toBe('What does this mean?');
+      expect(userSave[0].quotes).toEqual(['the selected text']);
+    });
+
+    test('persists multiple quotes in order on the saved message', async () => {
+      TestClient.options.req = { body: { quotes: ['first excerpt', 'second excerpt'] } };
+      TestClient.saveMessageToDatabase = jest.fn().mockResolvedValue({ message: {} });
+
+      await TestClient.sendMessage('Compare these');
+
+      const userSave = TestClient.saveMessageToDatabase.mock.calls.find(
+        ([msg]) => msg.isCreatedByUser,
+      );
+      expect(userSave[0].text).toBe('Compare these');
+      expect(userSave[0].quotes).toEqual(['first excerpt', 'second excerpt']);
+    });
+
+    test('leaves the message untouched when no quotes are provided', async () => {
+      TestClient.options.req = { body: {} };
+      TestClient.saveMessageToDatabase = jest.fn().mockResolvedValue({ message: {} });
+
+      await TestClient.sendMessage('Just a question');
+
+      const userSave = TestClient.saveMessageToDatabase.mock.calls.find(
+        ([msg]) => msg.isCreatedByUser,
+      );
+      expect(userSave[0].text).toBe('Just a question');
+      expect(userSave[0].quotes).toBeUndefined();
+    });
+  });
 });
diff --git a/api/app/clients/tools/structured/DALLE3.js b/api/app/clients/tools/structured/DALLE3.js
index 8ce46323afd..5bcd87a0cee 100644
--- a/api/app/clients/tools/structured/DALLE3.js
+++ b/api/app/clients/tools/structured/DALLE3.js
@@ -1,10 +1,16 @@
 const path = require('path');
 const OpenAI = require('openai');
 const { v4: uuidv4 } = require('uuid');
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { logger } = require('@librechat/data-schemas');
 const { Tool } = require('@librechat/agents/langchain/tools');
-const { getImageBasename, extractBaseURL } = require('@librechat/api');
+const {
+  getImageBasename,
+  extractBaseURL,
+  getProxyDispatcher,
+  getEnvProxyDispatcher,
+  createMinimalRetentionRequest,
+} = require('@librechat/api');
 const { FileContext, ContentTypes } = require('librechat-data-provider');
 
 const dalle3JsonSchema = {
@@ -49,6 +55,7 @@ class DALLE3 extends Tool {
 
     this.userId = fields.userId;
     this.tenantId = fields.req?.user?.tenantId;
+    this.retentionRequest = createMinimalRetentionRequest(fields.req);
     this.fileStrategy = fields.fileStrategy;
     /** @type {boolean} */
     this.isAgent = fields.isAgent;
@@ -77,10 +84,10 @@ class DALLE3 extends Tool {
       config.apiKey = process.env.DALLE3_API_KEY;
     }
 
-    if (process.env.PROXY) {
-      const proxyAgent = new ProxyAgent(process.env.PROXY);
+    const proxyDispatcher = getProxyDispatcher();
+    if (proxyDispatcher) {
       config.fetchOptions = {
-        dispatcher: proxyAgent,
+        dispatcher: proxyDispatcher,
       };
     }
 
@@ -181,9 +188,9 @@ Error Message: ${error.message}`);
 
     if (this.isAgent) {
       let fetchOptions = {};
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
-        fetchOptions.dispatcher = proxyAgent;
+      const dispatcher = getEnvProxyDispatcher();
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
       }
       const imageResponse = await fetch(theImageUrl, fetchOptions);
       const arrayBuffer = await imageResponse.arrayBuffer();
@@ -230,6 +237,7 @@ Error Message: ${error.message}`);
         fileStrategy: this.fileStrategy,
         context: FileContext.image_generation,
         tenantId: this.tenantId,
+        req: this.retentionRequest,
       });
 
       if (this.returnMetadata) {
diff --git a/api/app/clients/tools/structured/FluxAPI.js b/api/app/clients/tools/structured/FluxAPI.js
index dc94a25e828..fd0464c34e9 100644
--- a/api/app/clients/tools/structured/FluxAPI.js
+++ b/api/app/clients/tools/structured/FluxAPI.js
@@ -2,8 +2,12 @@ const axios = require('axios');
 const fetch = require('node-fetch');
 const { v4: uuidv4 } = require('uuid');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
 const { Tool } = require('@librechat/agents/langchain/tools');
+const {
+  applyAxiosProxyConfig,
+  createMinimalRetentionRequest,
+  getHttpsProxyAgent,
+} = require('@librechat/api');
 const { FileContext, ContentTypes } = require('librechat-data-provider');
 
 const fluxApiJsonSchema = {
@@ -110,6 +114,7 @@ class FluxAPI extends Tool {
 
     this.userId = fields.userId;
     this.tenantId = fields.req?.user?.tenantId;
+    this.retentionRequest = createMinimalRetentionRequest(fields.req);
     this.fileStrategy = fields.fileStrategy;
 
     /** @type {boolean} **/
@@ -148,10 +153,7 @@ class FluxAPI extends Tool {
 
   getAxiosConfig() {
     const config = {};
-    if (process.env.PROXY) {
-      config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
-    return config;
+    return applyAxiosProxyConfig(config, this.baseUrl);
   }
 
   /** @param {Object|string} value */
@@ -305,8 +307,9 @@ class FluxAPI extends Tool {
       try {
         // Fetch the image and convert to base64
         const fetchOptions = {};
-        if (process.env.PROXY) {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const agent = getHttpsProxyAgent(imageUrl);
+        if (agent) {
+          fetchOptions.agent = agent;
         }
         const imageResponse = await fetch(imageUrl, fetchOptions);
         const arrayBuffer = await imageResponse.arrayBuffer();
@@ -343,6 +346,7 @@ class FluxAPI extends Tool {
         basePath: 'images',
         context: FileContext.image_generation,
         tenantId: this.tenantId,
+        req: this.retentionRequest,
       });
 
       logger.debug('[FluxAPI] Image saved to path:', result.filepath);
@@ -536,8 +540,9 @@ class FluxAPI extends Tool {
     if (this.isAgent) {
       try {
         const fetchOptions = {};
-        if (process.env.PROXY) {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const agent = getHttpsProxyAgent(imageUrl);
+        if (agent) {
+          fetchOptions.agent = agent;
         }
         const imageResponse = await fetch(imageUrl, fetchOptions);
         const arrayBuffer = await imageResponse.arrayBuffer();
@@ -574,6 +579,7 @@ class FluxAPI extends Tool {
         basePath: 'images',
         context: FileContext.image_generation,
         tenantId: this.tenantId,
+        req: this.retentionRequest,
       });
 
       logger.debug('[FluxAPI] Finetuned image saved to path:', result.filepath);
diff --git a/api/app/clients/tools/structured/GeminiImageGen.js b/api/app/clients/tools/structured/GeminiImageGen.js
index 49b9a63e0ed..04265bbba99 100644
--- a/api/app/clients/tools/structured/GeminiImageGen.js
+++ b/api/app/clients/tools/structured/GeminiImageGen.js
@@ -1,7 +1,6 @@
 const path = require('path');
 const sharp = require('sharp');
 const { v4 } = require('uuid');
-const { ProxyAgent } = require('undici');
 const { GoogleGenAI } = require('@google/genai');
 const { logger } = require('@librechat/data-schemas');
 const { tool } = require('@librechat/agents/langchain/tools');
@@ -10,6 +9,7 @@ const {
   geminiToolkit,
   loadServiceKey,
   getBalanceConfig,
+  getEnvProxyDispatcher,
   getTransactionsConfig,
 } = require('@librechat/api');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
@@ -20,14 +20,14 @@ const { spendTokens, getFiles } = require('~/models');
  * This wraps globalThis.fetch to add a proxy dispatcher only for googleapis.com URLs
  * This is necessary because @google/genai SDK doesn't support custom fetch or httpOptions.dispatcher
  */
-if (process.env.PROXY) {
+const googleApiProxyDispatcher = getEnvProxyDispatcher();
+if (googleApiProxyDispatcher) {
   const originalFetch = globalThis.fetch;
-  const proxyAgent = new ProxyAgent(process.env.PROXY);
 
   globalThis.fetch = function (url, options = {}) {
     const urlString = url.toString();
     if (urlString.includes('googleapis.com')) {
-      options = { ...options, dispatcher: proxyAgent };
+      options = { ...options, dispatcher: googleApiProxyDispatcher };
     }
     return originalFetch.call(this, url, options);
   };
@@ -119,7 +119,7 @@ async function initializeGeminiClient(options = {}) {
   return new GoogleGenAI({
     vertexai: true,
     project: serviceKey.project_id,
-    location: process.env.GOOGLE_LOC || process.env.GOOGLE_CLOUD_LOCATION || 'global',
+    location: process.env.GOOGLE_CLOUD_LOCATION || process.env.GOOGLE_LOC || 'global',
     googleAuthOptions: { credentials: serviceKey },
   });
 }
diff --git a/api/app/clients/tools/structured/OpenAIImageTools.js b/api/app/clients/tools/structured/OpenAIImageTools.js
index 0d7ee643e3f..d92d17b77e6 100644
--- a/api/app/clients/tools/structured/OpenAIImageTools.js
+++ b/api/app/clients/tools/structured/OpenAIImageTools.js
@@ -2,12 +2,16 @@ const axios = require('axios');
 const { v4 } = require('uuid');
 const OpenAI = require('openai');
 const FormData = require('form-data');
-const { ProxyAgent } = require('undici');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
 const { tool } = require('@librechat/agents/langchain/tools');
 const { ContentTypes, EImageOutputType } = require('librechat-data-provider');
-const { logAxiosError, oaiToolkit, extractBaseURL } = require('@librechat/api');
+const {
+  logAxiosError,
+  oaiToolkit,
+  extractBaseURL,
+  getProxyDispatcher,
+  applyAxiosProxyConfig,
+} = require('@librechat/api');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { getFiles } = require('~/models');
 
@@ -123,10 +127,10 @@ function createOpenAIImageTools(fields = {}) {
         throw new Error('Missing required field: prompt');
       }
       const clientConfig = { ...closureConfig };
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
+      const proxyDispatcher = getProxyDispatcher();
+      if (proxyDispatcher) {
         clientConfig.fetchOptions = {
-          dispatcher: proxyAgent,
+          dispatcher: proxyDispatcher,
         };
       }
 
@@ -233,10 +237,10 @@ Error Message: ${error.message}`);
       }
 
       const clientConfig = { ...closureConfig };
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
+      const proxyDispatcher = getProxyDispatcher();
+      if (proxyDispatcher) {
         clientConfig.fetchOptions = {
-          dispatcher: proxyAgent,
+          dispatcher: proxyDispatcher,
         };
       }
 
@@ -349,9 +353,7 @@ Error Message: ${error.message}`);
           baseURL,
         };
 
-        if (process.env.PROXY) {
-          axiosConfig.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-        }
+        applyAxiosProxyConfig(axiosConfig, baseURL);
 
         if (process.env.IMAGE_GEN_OAI_AZURE_API_VERSION && process.env.IMAGE_GEN_OAI_BASEURL) {
           axiosConfig.params = {
diff --git a/api/app/clients/tools/structured/TavilySearch.js b/api/app/clients/tools/structured/TavilySearch.js
index e45f6d2bf89..a90b75b9f8e 100644
--- a/api/app/clients/tools/structured/TavilySearch.js
+++ b/api/app/clients/tools/structured/TavilySearch.js
@@ -1,6 +1,7 @@
 const { z } = require('zod');
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { tool } = require('@librechat/agents/langchain/tools');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 const { getApiKey } = require('./credentials');
 
 function createTavilySearchTool(fields = {}) {
@@ -28,8 +29,9 @@ function createTavilySearchTool(fields = {}) {
         body: JSON.stringify(requestBody),
       };
 
-      if (process.env.PROXY) {
-        fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+      const dispatcher = getEnvProxyDispatcher();
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
       }
 
       const response = await fetch('https://api.tavily.com/search', fetchOptions);
diff --git a/api/app/clients/tools/structured/TavilySearchResults.js b/api/app/clients/tools/structured/TavilySearchResults.js
index 4d46402c992..9e9aa3d34c8 100644
--- a/api/app/clients/tools/structured/TavilySearchResults.js
+++ b/api/app/clients/tools/structured/TavilySearchResults.js
@@ -1,6 +1,7 @@
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { Tool } = require('@librechat/agents/langchain/tools');
 const { getEnvironmentVariable } = require('@librechat/agents/langchain/utils/env');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 
 const tavilySearchJsonSchema = {
   type: 'object',
@@ -120,8 +121,9 @@ class TavilySearchResults extends Tool {
       body: JSON.stringify(requestBody),
     };
 
-    if (process.env.PROXY) {
-      fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+    const dispatcher = getEnvProxyDispatcher();
+    if (dispatcher) {
+      fetchOptions.dispatcher = dispatcher;
     }
 
     const response = await fetch('https://api.tavily.com/search', fetchOptions);
diff --git a/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js b/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
index 262842b3c24..b958ed7b5b8 100644
--- a/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
+++ b/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
@@ -1,7 +1,20 @@
 const DALLE3 = require('../DALLE3');
-const { ProxyAgent } = require('undici');
 
 const processFileURL = jest.fn();
+const proxyEnvKeys = [
+  'PROXY',
+  'proxy',
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'NO_PROXY',
+  'http_proxy',
+  'https_proxy',
+  'no_proxy',
+];
+
+function clearProxyEnv() {
+  proxyEnvKeys.forEach((key) => delete process.env[key]);
+}
 
 describe('DALLE3 Proxy Configuration', () => {
   let originalEnv;
@@ -13,13 +26,14 @@ describe('DALLE3 Proxy Configuration', () => {
   beforeEach(() => {
     jest.resetModules();
     process.env = { ...originalEnv };
+    clearProxyEnv();
   });
 
   afterEach(() => {
     process.env = originalEnv;
   });
 
-  it('should configure ProxyAgent in fetchOptions.dispatcher when PROXY env is set', () => {
+  it('should configure fetchOptions.dispatcher when proxy env is set', () => {
     // Set proxy environment variable
     process.env.PROXY = 'http://proxy.example.com:8080';
     process.env.DALLE_API_KEY = 'test-api-key';
@@ -34,12 +48,10 @@ describe('DALLE3 Proxy Configuration', () => {
     expect(dalleWithProxy.openai._options).toBeDefined();
     expect(dalleWithProxy.openai._options.fetchOptions).toBeDefined();
     expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeDefined();
-    expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeDefined();
   });
 
-  it('should not configure ProxyAgent when PROXY env is not set', () => {
-    // Ensure PROXY is not set
-    delete process.env.PROXY;
+  it('should not configure a dispatcher when proxy env is not set', () => {
     process.env.DALLE_API_KEY = 'test-api-key';
 
     // Create instance
diff --git a/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js b/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
index 027d2659d68..dbdda6e454c 100644
--- a/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
+++ b/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
@@ -1,5 +1,3 @@
-const { ProxyAgent } = require('undici');
-
 /**
  * These tests verify the proxy wrapper behavior for GeminiImageGen.
  * Instead of loading the full module (which has many dependencies),
@@ -29,14 +27,14 @@ describe('GeminiImageGen Proxy Configuration', () => {
    * This is the same logic from GeminiImageGen.js lines 30-42.
    */
   function applyProxyWrapper() {
-    if (process.env.PROXY) {
+    const proxyDispatcher = process.env.PROXY ? { type: 'proxy-dispatcher' } : undefined;
+    if (proxyDispatcher) {
       const _originalFetch = globalThis.fetch;
-      const proxyAgent = new ProxyAgent(process.env.PROXY);
 
       globalThis.fetch = function (url, options = {}) {
         const urlString = url.toString();
         if (urlString.includes('googleapis.com')) {
-          options = { ...options, dispatcher: proxyAgent };
+          options = { ...options, dispatcher: proxyDispatcher };
         }
         return _originalFetch.call(this, url, options);
       };
@@ -78,7 +76,7 @@ describe('GeminiImageGen Proxy Configuration', () => {
     await globalThis.fetch('https://generativelanguage.googleapis.com/v1/models', {});
 
     expect(capturedOptions).toBeDefined();
-    expect(capturedOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(capturedOptions.dispatcher).toEqual({ type: 'proxy-dispatcher' });
   });
 
   it('should not add dispatcher to non-googleapis.com URLs', async () => {
@@ -118,7 +116,7 @@ describe('GeminiImageGen Proxy Configuration', () => {
     });
 
     expect(capturedOptions).toBeDefined();
-    expect(capturedOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(capturedOptions.dispatcher).toEqual({ type: 'proxy-dispatcher' });
     expect(capturedOptions.headers).toEqual(customHeaders);
     expect(capturedOptions.method).toBe('POST');
   });
diff --git a/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js b/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
index 891a8cdc192..7184e082041 100644
--- a/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
+++ b/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
@@ -1,7 +1,11 @@
-const { fetch, ProxyAgent } = require('undici');
+const { fetch } = require('undici');
 const TavilySearchResults = require('../TavilySearchResults');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 
 jest.mock('undici');
+jest.mock('@librechat/api', () => ({
+  getEnvProxyDispatcher: jest.fn(),
+}));
 
 describe('TavilySearchResults', () => {
   let originalEnv;
@@ -46,32 +50,29 @@ describe('TavilySearchResults', () => {
       fetch.mockResolvedValue(mockResponse);
     });
 
-    it('should use ProxyAgent when PROXY env var is set', async () => {
-      const proxyUrl = 'http://proxy.example.com:8080';
-      process.env.PROXY = proxyUrl;
-
-      const mockProxyAgent = { type: 'proxy-agent' };
-      ProxyAgent.mockImplementation(() => mockProxyAgent);
+    it('should use a shared proxy dispatcher when configured', async () => {
+      const mockProxyDispatcher = { type: 'proxy-dispatcher' };
+      getEnvProxyDispatcher.mockReturnValue(mockProxyDispatcher);
 
       const instance = new TavilySearchResults({ TAVILY_API_KEY: mockApiKey });
       await instance._call({ query: 'test query' });
 
-      expect(ProxyAgent).toHaveBeenCalledWith(proxyUrl);
+      expect(getEnvProxyDispatcher).toHaveBeenCalled();
       expect(fetch).toHaveBeenCalledWith(
         'https://api.tavily.com/search',
         expect.objectContaining({
-          dispatcher: mockProxyAgent,
+          dispatcher: mockProxyDispatcher,
         }),
       );
     });
 
-    it('should not use ProxyAgent when PROXY env var is not set', async () => {
-      delete process.env.PROXY;
+    it('should not attach a dispatcher when no proxy is configured', async () => {
+      getEnvProxyDispatcher.mockReturnValue(undefined);
 
       const instance = new TavilySearchResults({ TAVILY_API_KEY: mockApiKey });
       await instance._call({ query: 'test query' });
 
-      expect(ProxyAgent).not.toHaveBeenCalled();
+      expect(getEnvProxyDispatcher).toHaveBeenCalled();
       expect(fetch).toHaveBeenCalledWith(
         'https://api.tavily.com/search',
         expect.not.objectContaining({
diff --git a/api/app/clients/tools/structured/specs/imageTools-agent.spec.js b/api/app/clients/tools/structured/specs/imageTools-agent.spec.js
index f88b76a1166..2d36ad4b7fa 100644
--- a/api/app/clients/tools/structured/specs/imageTools-agent.spec.js
+++ b/api/app/clients/tools/structured/specs/imageTools-agent.spec.js
@@ -100,11 +100,21 @@ describe('image tools - agent mode ToolMessage format', () => {
     });
 
     it('keeps tenant context without retaining the request object', () => {
-      const req = { user: { tenantId: 'tenant-a' }, socket: {} };
+      const req = {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+        socket: {},
+      };
       const dalle = new DALLE3({ isAgent: false, processFileURL: jest.fn(), req });
 
       expect(dalle.tenantId).toBe('tenant-a');
       expect(dalle.req).toBeUndefined();
+      expect(dalle.retentionRequest).toEqual({
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+      });
     });
 
     it('invoke() returns ToolMessage with base64 in artifact, not serialized in content', async () => {
@@ -181,11 +191,90 @@ describe('image tools - agent mode ToolMessage format', () => {
     });
 
     it('keeps tenant context without retaining the request object', () => {
-      const req = { user: { tenantId: 'tenant-a' }, socket: {} };
+      const req = {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+        socket: {},
+      };
       const flux = new FluxAPI({ isAgent: false, processFileURL: jest.fn(), req });
 
       expect(flux.tenantId).toBe('tenant-a');
       expect(flux.req).toBeUndefined();
+      expect(flux.retentionRequest).toEqual({
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+      });
+    });
+
+    it('passes minimal retention context when saving generated images', async () => {
+      const processFileURL = jest.fn().mockResolvedValue({ filepath: '/images/generated.png' });
+      const req = {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+        socket: {},
+      };
+      const flux = new FluxAPI({
+        isAgent: false,
+        processFileURL,
+        req,
+        userId: 'user-1',
+        fileStrategy: 'local',
+      });
+      const invokePromise = flux.invoke(
+        makeToolCall('flux', { prompt: 'a box', endpoint: '/v1/flux-dev' }),
+      );
+      await jest.runAllTimersAsync();
+      await invokePromise;
+
+      expect(processFileURL).toHaveBeenCalledWith(
+        expect.objectContaining({
+          req: {
+            user: { id: 'user-1', tenantId: 'tenant-a' },
+            body: { conversationId: 'convo-1', isTemporary: 'true' },
+            config: { interfaceConfig: { retentionMode: 'all' } },
+          },
+        }),
+      );
+    });
+
+    it('passes minimal retention context when saving finetuned generated images', async () => {
+      const processFileURL = jest.fn().mockResolvedValue({ filepath: '/images/generated.png' });
+      const req = {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: 'all' } },
+        socket: {},
+      };
+      const flux = new FluxAPI({
+        isAgent: false,
+        processFileURL,
+        req,
+        userId: 'user-1',
+        fileStrategy: 'local',
+      });
+      const invokePromise = flux.invoke(
+        makeToolCall('flux', {
+          action: 'generate_finetuned',
+          prompt: 'a box',
+          finetune_id: 'ft-abc123',
+          endpoint: '/v1/flux-pro-finetuned',
+        }),
+      );
+      await jest.runAllTimersAsync();
+      await invokePromise;
+
+      expect(processFileURL).toHaveBeenCalledWith(
+        expect.objectContaining({
+          req: {
+            user: { id: 'user-1', tenantId: 'tenant-a' },
+            body: { conversationId: 'convo-1', isTemporary: 'true' },
+            config: { interfaceConfig: { retentionMode: 'all' } },
+          },
+        }),
+      );
     });
 
     it('invoke() returns ToolMessage with base64 in artifact, not serialized in content', async () => {
diff --git a/api/app/clients/tools/util/fileSearch.js b/api/app/clients/tools/util/fileSearch.js
index a9faf71c54f..be7589a8263 100644
--- a/api/app/clients/tools/util/fileSearch.js
+++ b/api/app/clients/tools/util/fileSearch.js
@@ -25,7 +25,7 @@ const fileSearchJsonSchema = {
  * @param {Agent['tool_resources']} options.tool_resources
  * @param {string} [options.agentId] - The agent ID for file access control
  * @returns {Promise<{
- *   files: Array<{ file_id: string; filename: string }>,
+ *   files: Array<{ file_id: string; filename: string; fromAgent: boolean }>,
  *   toolContext: string
  * }>}
  */
@@ -70,6 +70,7 @@ const primeFiles = async (options) => {
     files.push({
       file_id: file.file_id,
       filename: file.filename,
+      fromAgent: agentResourceIds.has(file.file_id),
     });
   }
 
@@ -80,7 +81,7 @@ const primeFiles = async (options) => {
  *
  * @param {Object} options
  * @param {string} options.userId
- * @param {Array<{ file_id: string; filename: string }>} options.files
+ * @param {Array<{ file_id: string; filename: string; fromAgent?: boolean }>} options.files
  * @param {string} [options.entity_id]
  * @param {boolean} [options.fileCitations=false] - Whether to include citation instructions
  * @returns
@@ -97,7 +98,7 @@ const createFileSearchTool = async ({ userId, files, entity_id, fileCitations =
       }
 
       /**
-       * @param {import('librechat-data-provider').TFile} file
+       * @param {import('librechat-data-provider').TFile & { fromAgent?: boolean }} file
        * @returns {{ file_id: string, query: string, k: number, entity_id?: string }}
        */
       const createQueryBody = (file) => {
@@ -106,7 +107,14 @@ const createFileSearchTool = async ({ userId, files, entity_id, fileCitations =
           query,
           k: 5,
         };
-        if (!entity_id) {
+        // User-attached files are embedded under the user id (no entity);
+        // only agent knowledge-base files carry the agent's entity_id.
+        // Sending entity_id for user attachments makes the RAG API's entity
+        // filter return no results for them. When files are provided by
+        // primeFiles, fromAgent is always set; for callers that pass files
+        // directly without the flag, the safe default is unscoped (no
+        // entity_id).
+        if (!entity_id || file.fromAgent !== true) {
           return body;
         }
         body.entity_id = entity_id;
diff --git a/api/app/clients/tools/util/handleTools.js b/api/app/clients/tools/util/handleTools.js
index 89a79f3cbd7..adeb9f7ca99 100644
--- a/api/app/clients/tools/util/handleTools.js
+++ b/api/app/clients/tools/util/handleTools.js
@@ -35,7 +35,13 @@ const {
   createGeminiImageTool,
   createOpenAIImageTools,
 } = require('../');
-const { createMCPTool, createMCPTools, resolveConfigServers } = require('~/server/services/MCP');
+const {
+  createMCPTool,
+  createMCPTools,
+  createMCPPermissionContext,
+  resolveConfigServers,
+} = require('~/server/services/MCP');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
 const { createFileSearchTool, primeFiles: primeSearchFiles } = require('./fileSearch');
 const { primeFiles: primeCodeFiles } = require('~/server/services/Files/Code/process');
 const { getUserPluginAuthValue } = require('~/server/services/PluginService');
@@ -227,6 +233,13 @@ const loadTools = async ({
   };
 
   const requestedTools = {};
+  const hasMCPTools = tools.some((toolName) => toolName && mcpToolPattern.test(toolName));
+  const mcpPermissionContext =
+    options.mcpPermissionContext ?? createMCPPermissionContext(options.req);
+  const canUseMCP = hasMCPTools
+    ? await mcpPermissionContext.canUseServers(options.req?.user)
+    : true;
+  let loggedMCPDenied = false;
 
   if (functions === true) {
     toolConstructors.dalle = DALLE3;
@@ -266,7 +279,7 @@ const loadTools = async ({
 
   /** Resolve config-source servers for the current user/tenant context */
   let configServers;
-  if (tools.some((tool) => tool && mcpToolPattern.test(tool))) {
+  if (hasMCPTools && canUseMCP) {
     configServers = await resolveConfigServers(options.req);
   }
 
@@ -345,6 +358,16 @@ const loadTools = async ({
       };
       continue;
     } else if (tool && mcpToolPattern.test(tool)) {
+      if (!canUseMCP) {
+        if (!loggedMCPDenied) {
+          logger.warn(
+            `[handleTools] User ${options.req?.user?.id} lacks MCP server use permission`,
+          );
+          loggedMCPDenied = true;
+        }
+        continue;
+      }
+
       const [toolName, serverName] = tool.split(Constants.mcp_delimiter);
       if (toolName === Constants.mcp_server) {
         /** Placeholder used for UI purposes */
@@ -429,22 +452,27 @@ const loadTools = async ({
   let index = -1;
   const failedMCPServers = new Set();
   const safeUser = createSafeUser(options.req?.user);
+  const requestScopedConnections =
+    options.requestScopedConnections ?? getMCPRequestContext(options.req, options.res);
 
   for (const [serverName, toolConfigs] of Object.entries(requestedMCPTools)) {
     index++;
     /** @type {LCAvailableTools} */
-    let availableTools;
+    let availableTools = options.mcpAvailableTools?.[serverName];
     for (const config of toolConfigs) {
       try {
         if (failedMCPServers.has(serverName)) {
           continue;
         }
         const mcpParams = {
+          mcpPermissionContext,
           index,
           signal,
           user: safeUser,
           userMCPAuthMap,
           configServers,
+          requestBody: options.req?.body,
+          requestScopedConnections,
           res: options.res,
           streamId: options.req?._resumableStreamId || null,
           model: agent?.model ?? model,
@@ -465,7 +493,7 @@ const loadTools = async ({
         }
         if (!availableTools) {
           try {
-            availableTools = await getMCPServerTools(safeUser.id, serverName);
+            availableTools = await getMCPServerTools(safeUser.id, serverName, config.config);
           } catch (error) {
             logger.error(`Error fetching available tools for MCP server ${serverName}:`, error);
           }
@@ -479,6 +507,9 @@ const loadTools = async ({
                 ...mcpParams,
                 availableTools,
                 toolKey: config.toolKey,
+                onAvailableTools: (tools) => {
+                  availableTools = tools;
+                },
               });
 
         if (Array.isArray(mcpTool)) {
diff --git a/api/app/clients/tools/util/handleTools.test.js b/api/app/clients/tools/util/handleTools.test.js
index 1adda45c35e..697649e3bde 100644
--- a/api/app/clients/tools/util/handleTools.test.js
+++ b/api/app/clients/tools/util/handleTools.test.js
@@ -6,6 +6,10 @@ const mockPluginService = {
   deleteUserPluginAuth: jest.fn(),
   getUserPluginAuthValue: jest.fn(),
 };
+const mockGetMCPServerTools = jest.fn();
+const mockCreateMCPTool = jest.fn();
+const mockCreateMCPTools = jest.fn();
+const mockGetServerConfig = jest.fn();
 
 jest.mock('~/server/services/PluginService', () => mockPluginService);
 
@@ -28,9 +32,26 @@ jest.mock('~/server/services/Config', () => ({
       },
     },
   }),
+  getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
+}));
+
+jest.mock('~/server/services/MCP', () => ({
+  createMCPTool: (...args) => mockCreateMCPTool(...args),
+  createMCPTools: (...args) => mockCreateMCPTools(...args),
+  createMCPPermissionContext: jest.fn(() => ({
+    canUseServers: jest.fn().mockResolvedValue(true),
+  })),
+  resolveConfigServers: jest.fn().mockResolvedValue({}),
+}));
+
+jest.mock('~/config', () => ({
+  getMCPServersRegistry: jest.fn(() => ({
+    getServerConfig: (...args) => mockGetServerConfig(...args),
+  })),
 }));
 
 const { Calculator } = require('@librechat/agents');
+const { Constants } = require('librechat-data-provider');
 
 const { User } = require('~/db/models');
 const PluginService = require('~/server/services/PluginService');
@@ -282,5 +303,152 @@ describe('Tool Handlers', () => {
       expect(structuredTool).toBeInstanceOf(StructuredSD);
       delete process.env.SD_WEBUI_URL;
     });
+
+    it('passes request body to chat MCP tool creation and skips stale cache for BODY-scoped servers', async () => {
+      const serverName = 'body-scoped';
+      const toolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool.mockResolvedValue({ name: 'loaded-mcp-tool' });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [toolKey],
+        options: {
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'loaded-mcp-tool' }]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        fakeUser._id.toString(),
+        serverName,
+        serverConfig,
+      );
+      expect(mockCreateMCPTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          requestBody,
+          toolKey,
+          config: serverConfig,
+        }),
+      );
+    });
+
+    it('uses run-scoped MCP tool definitions before cache lookup', async () => {
+      const serverName = 'body-scoped';
+      const toolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+      const runScopedTools = {
+        [toolKey]: {
+          function: {
+            name: toolKey,
+            description: 'Run-scoped search',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool.mockResolvedValue({ name: 'loaded-mcp-tool' });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [toolKey],
+        options: {
+          mcpAvailableTools: {
+            [serverName]: runScopedTools,
+          },
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'loaded-mcp-tool' }]);
+      expect(mockGetMCPServerTools).not.toHaveBeenCalled();
+      expect(mockCreateMCPTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          availableTools: runScopedTools,
+          requestBody,
+          toolKey,
+          config: serverConfig,
+        }),
+      );
+    });
+
+    it('reuses discovered request-scoped MCP tool definitions within a server loop', async () => {
+      const serverName = 'body-scoped';
+      const firstToolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const secondToolKey = `lookup${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+      const discoveredTools = {
+        [firstToolKey]: {
+          function: {
+            description: 'Search',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+        [secondToolKey]: {
+          function: {
+            description: 'Lookup',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool
+        .mockImplementationOnce(async ({ onAvailableTools }) => {
+          onAvailableTools(discoveredTools);
+          return { name: 'search-tool' };
+        })
+        .mockImplementationOnce(async ({ availableTools }) => {
+          expect(availableTools).toBe(discoveredTools);
+          return { name: 'lookup-tool' };
+        });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [firstToolKey, secondToolKey],
+        options: {
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'search-tool' }, { name: 'lookup-tool' }]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledTimes(1);
+      expect(mockCreateMCPTool).toHaveBeenCalledTimes(2);
+      expect(mockCreateMCPTool).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          availableTools: discoveredTools,
+          requestBody,
+          toolKey: secondToolKey,
+        }),
+      );
+    });
   });
 });
diff --git a/api/cache/getLogStores.js b/api/cache/getLogStores.js
index 70eb681e53a..45a6a699947 100644
--- a/api/cache/getLogStores.js
+++ b/api/cache/getLogStores.js
@@ -7,6 +7,7 @@ const {
   sessionCache,
   standardCache,
   violationCache,
+  registerShutdownTask,
 } = require('@librechat/api');
 
 const namespaces = {
@@ -195,23 +196,16 @@ if (!cacheConfig.USE_REDIS && !cacheConfig.CI) {
     cleanupIntervals.add(monitor);
   }
 
-  const dispose = () => {
+  // Register cleanup with the centralized graceful-shutdown coordinator
+  // (see packages/api/src/app/shutdown.ts) rather than attaching a direct
+  // signal handler — multiple competing handlers race the HTTP drain.
+  registerShutdownTask('cache cleanup', async () => {
     cacheConfig.DEBUG_MEMORY_CACHE && console.log('[Cache] Cleaning up and shutting down...');
     cleanupIntervals.forEach((interval) => clearInterval(interval));
     cleanupIntervals.clear();
-
-    // One final cleanup before exit
-    clearAllExpiredFromCache().then(() => {
-      cacheConfig.DEBUG_MEMORY_CACHE && console.log('[Cache] Final cleanup completed');
-      process.exit(0);
-    });
-  };
-
-  // Handle various termination signals
-  process.on('SIGTERM', dispose);
-  process.on('SIGINT', dispose);
-  process.on('SIGQUIT', dispose);
-  process.on('SIGHUP', dispose);
+    await clearAllExpiredFromCache();
+    cacheConfig.DEBUG_MEMORY_CACHE && console.log('[Cache] Final cleanup completed');
+  });
 }
 
 /**
diff --git a/api/config/__tests__/parsers.spec.js b/api/config/__tests__/parsers.spec.js
deleted file mode 100644
index f54675ce3ae..00000000000
--- a/api/config/__tests__/parsers.spec.js
+++ /dev/null
@@ -1,358 +0,0 @@
-jest.unmock('winston');
-
-const { formatConsoleMeta, redactMessage, redactFormat, debugTraverse } =
-  jest.requireActual('../parsers');
-const SPLAT_SYMBOL = Symbol.for('splat');
-
-describe('formatConsoleMeta', () => {
-  it('returns empty string when there is no user metadata', () => {
-    expect(
-      formatConsoleMeta({
-        level: 'error',
-        message: 'oops',
-        timestamp: '2026-04-18 02:25:22',
-      }),
-    ).toBe('');
-  });
-
-  it('serializes user-supplied metadata keys', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: '[agents:summarize] Summarization LLM call failed',
-      timestamp: '2026-04-18 02:25:22',
-      provider: 'azureOpenAI',
-      model: 'gpt-5.4-mini',
-      messagesToRefineCount: 42,
-    });
-
-    expect(meta).toContain('"provider":"azureOpenAI"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('"messagesToRefineCount":42');
-  });
-
-  it('ignores reserved winston keys but preserves legitimate fields like _id', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'boom',
-      timestamp: 'ts',
-      splat: [1, 2],
-      _id: '507f191e810c19729de860ea',
-      userField: 'keep',
-    });
-
-    expect(meta).toContain('"_id":"507f191e810c19729de860ea"');
-    expect(meta).toContain('"userField":"keep"');
-    expect(meta).not.toContain('"splat"');
-  });
-
-  it('drops numeric-index-like keys (splat artifacts from primitive args)', () => {
-    const meta = formatConsoleMeta({
-      level: 'warn',
-      message: 'Unhandled step:',
-      timestamp: 'ts',
-      0: 'f',
-      1: 'o',
-      2: 'o',
-      realField: 'real',
-    });
-
-    expect(meta).toBe('{"realField":"real"}');
-  });
-
-  it('drops empty, null, undefined, function, and symbol values', () => {
-    const meta = formatConsoleMeta({
-      level: 'warn',
-      message: 'noise',
-      timestamp: 'ts',
-      empty: '',
-      nullish: null,
-      undef: undefined,
-      fn: () => 1,
-      sym: Symbol('x'),
-      kept: 'yes',
-    });
-
-    expect(meta).toBe('{"kept":"yes"}');
-  });
-
-  it('truncates very long string values to avoid console spam', () => {
-    const longString = 'x'.repeat(5000);
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'long',
-      timestamp: 'ts',
-      errorStack: longString,
-    });
-
-    expect(meta.length).toBeLessThan(longString.length);
-    expect(meta).toContain('...');
-  });
-
-  it('preserves non-circular fields when one value is circular', () => {
-    const circular = {};
-    circular.self = circular;
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'circular',
-      timestamp: 'ts',
-      provider: 'openai',
-      model: 'gpt-5.4-mini',
-      circular,
-    });
-
-    expect(meta).toContain('"provider":"openai"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('[Circular]');
-  });
-
-  it('falls back to per-field serialization when a value toJSON throws', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'crash',
-      timestamp: 'ts',
-      provider: 'azure',
-      model: 'gpt-5.4-mini',
-      broken: {
-        toJSON() {
-          throw new Error('nope');
-        },
-      },
-    });
-
-    expect(meta).toContain('"provider":"azure"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('[Unserializable]');
-  });
-
-  it('redacts sensitive strings nested inside metadata objects', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'nested leak',
-      timestamp: 'ts',
-      config: {
-        headers: {
-          authorization: 'Bearer eyJhbGciOi.nestedTokenValue',
-        },
-        query: 'https://example.com/?key=AIzaNested',
-      },
-      openaiKey: 'sk-outerKey123',
-    });
-
-    expect(meta).not.toContain('eyJhbGciOi.nestedTokenValue');
-    expect(meta).not.toContain('AIzaNested');
-    expect(meta).not.toContain('sk-outerKey123');
-    expect(meta).toContain('Bearer [REDACTED]');
-    expect(meta).toContain('key=[REDACTED]');
-    expect(meta).toContain('sk-[REDACTED]');
-  });
-
-  it('redacts the Azure-style mixed-case Api-Key header', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'azure call',
-      timestamp: 'ts',
-      headers: 'Api-Key: 0123456789abcdef',
-    });
-
-    expect(meta).not.toContain('0123456789abcdef');
-    expect(meta).toContain('Api-Key: [REDACTED]');
-  });
-
-  it('redacts sensitive patterns inside string metadata values', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'leak test',
-      timestamp: 'ts',
-      openaiKey: 'sk-abc123def456',
-      auth: 'Bearer eyJhbGciOi...tokenvalue',
-      google: 'https://example.com/?key=AIzaSyXX',
-    });
-
-    expect(meta).not.toContain('sk-abc123def456');
-    expect(meta).not.toContain('eyJhbGciOi...tokenvalue');
-    expect(meta).not.toContain('AIzaSyXX');
-    expect(meta).toContain('sk-[REDACTED]');
-    expect(meta).toContain('Bearer [REDACTED]');
-    expect(meta).toContain('key=[REDACTED]');
-  });
-
-  it('redacts multiple occurrences of the same pattern in one value', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'two keys',
-      timestamp: 'ts',
-      combined: 'first sk-aaa and then sk-bbb',
-    });
-
-    expect(meta).not.toContain('sk-aaa');
-    expect(meta).not.toContain('sk-bbb');
-    expect(meta.match(/sk-\[REDACTED\]/g)?.length).toBe(2);
-  });
-});
-
-describe('redactMessage', () => {
-  it('redacts sk- keys that are not at line start (inside JSON-like text)', () => {
-    const input = '{"apiKey":"sk-abc123"}';
-    expect(redactMessage(input)).toBe('{"apiKey":"sk-[REDACTED]"}');
-  });
-
-  it('redacts all sk- occurrences in a single pass', () => {
-    const input = 'sk-one sk-two sk-three';
-    expect(redactMessage(input)).toBe('sk-[REDACTED] sk-[REDACTED] sk-[REDACTED]');
-  });
-
-  it('trims redacted output when trimLength is provided', () => {
-    const input = 'Bearer supersecretvalue';
-    expect(redactMessage(input, 10)).toBe('Bearer [RE...');
-  });
-
-  it('returns empty string for falsy input', () => {
-    expect(redactMessage('')).toBe('');
-    expect(redactMessage(undefined)).toBe('');
-  });
-
-  it('does not redact ordinary words that contain "sk-" inside them', () => {
-    expect(redactMessage('task-runner failed')).toBe('task-runner failed');
-    expect(redactMessage('mask-value computed')).toBe('mask-value computed');
-    expect(redactMessage('desk-lamp is on')).toBe('desk-lamp is on');
-  });
-
-  it('does not redact words that contain "key=" inside them', () => {
-    expect(redactMessage('monkey=10 bananas')).toBe('monkey=10 bananas');
-  });
-
-  it('still redacts standalone sk- keys at word boundaries', () => {
-    expect(redactMessage('token: sk-abc123def')).toBe('token: sk-[REDACTED]');
-    expect(redactMessage('"sk-abc123def"')).toBe('"sk-[REDACTED]"');
-  });
-});
-
-describe('redactFormat', () => {
-  const runFormat = (info) => redactFormat().transform(info) || info;
-
-  it('redacts info.message for error level before any colorize step runs', () => {
-    const info = runFormat({ level: 'error', message: 'Bearer secretvalue' });
-    expect(info.message).toBe('Bearer [REDACTED]');
-  });
-
-  it('redacts info.message for warn level too (avoids ANSI boundary issues later)', () => {
-    const info = runFormat({ level: 'warn', message: 'apiKey=sk-abc123def' });
-    expect(info.message).toContain('sk-[REDACTED]');
-  });
-
-  it('leaves info.message untouched for info and debug levels', () => {
-    const infoInfo = runFormat({ level: 'info', message: 'Bearer looksSensitive' });
-    expect(infoInfo.message).toBe('Bearer looksSensitive');
-
-    const infoDebug = runFormat({ level: 'debug', message: 'Bearer looksSensitive' });
-    expect(infoDebug.message).toBe('Bearer looksSensitive');
-  });
-});
-
-describe('debugTraverse', () => {
-  const runFormatter = (info) => {
-    const transformed = debugTraverse.transform(info);
-    const MESSAGE = Symbol.for('message');
-    if (transformed && typeof transformed === 'object') {
-      return transformed[MESSAGE] ?? String(transformed);
-    }
-    return String(transformed);
-  };
-
-  const buildInfo = (level, meta) => {
-    const info = {
-      level,
-      message: 'test',
-      timestamp: 'ts',
-      ...meta,
-    };
-    info[SPLAT_SYMBOL] = [meta];
-    return info;
-  };
-
-  it('redacts sensitive strings in metadata for error level', () => {
-    const out = runFormatter(buildInfo('error', { auth: 'Bearer eyJabc123', openai: 'sk-abc123' }));
-    expect(out).not.toContain('eyJabc123');
-    expect(out).not.toContain('sk-abc123');
-    expect(out).toContain('Bearer [REDACTED]');
-    expect(out).toContain('sk-[REDACTED]');
-  });
-
-  it('redacts sensitive strings in metadata for warn level', () => {
-    const out = runFormatter(buildInfo('warn', { header: 'Bearer supersecrettoken' }));
-    expect(out).not.toContain('supersecrettoken');
-    expect(out).toContain('Bearer [REDACTED]');
-  });
-
-  it('preserves debug-level metadata unmodified (existing behavior)', () => {
-    const out = runFormatter(buildInfo('debug', { someField: 'not-sensitive' }));
-    expect(out).toContain('not-sensitive');
-  });
-
-  it('prefers structured metadata over a consumed printf arg in SPLAT[0]', () => {
-    const info = {
-      level: 'warn',
-      message: 'failed for tenant-7',
-      timestamp: 'ts',
-      provider: 'openai',
-      [SPLAT_SYMBOL]: ['tenant-7', { provider: 'openai' }],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('openai');
-    const tenantMatches = out.match(/tenant-7/g) ?? [];
-    expect(tenantMatches.length).toBeLessThanOrEqual(1);
-  });
-
-  it('does not duplicate a consumed %s arg when there is no structured metadata', () => {
-    const info = {
-      level: 'warn',
-      message: 'failed for tenant-7',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: ['tenant-7'],
-    };
-    const out = runFormatter(info);
-    const tenantMatches = out.match(/tenant-7/g) ?? [];
-    expect(tenantMatches.length).toBe(1);
-  });
-
-  it('omits numeric splat-artifact keys from the traversed output', () => {
-    const info = {
-      level: 'error',
-      message: 'boom',
-      timestamp: 'ts',
-      0: 'x',
-      1: 'y',
-      realField: 'keep',
-      [SPLAT_SYMBOL]: [{ realField: 'keep' }],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('realField');
-    expect(out).toContain('keep');
-    expect(out).not.toMatch(/^\s*0:/m);
-    expect(out).not.toMatch(/^\s*1:/m);
-  });
-
-  it('surfaces unconsumed primitive SPLAT[0] (no %s in message) for debug level', () => {
-    const info = {
-      level: 'debug',
-      message: 'prefix:',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: ['detailValueXYZ'],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('detailValueXYZ');
-  });
-
-  it('still surfaces array metadata in SPLAT[0] when no object is extracted', () => {
-    const info = {
-      level: 'debug',
-      message: 'list',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: [['alpha', 'beta', 'gamma']],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('alpha');
-    expect(out).toContain('beta');
-    expect(out).toContain('gamma');
-  });
-});
diff --git a/api/config/index.js b/api/config/index.js
index 3b6d869332b..6d9f70ecbbe 100644
--- a/api/config/index.js
+++ b/api/config/index.js
@@ -1,38 +1,57 @@
 const { EventSource } = require('eventsource');
 const { Time } = require('librechat-data-provider');
 const {
+  mcpConfig,
   MCPManager,
   FlowStateManager,
   MCPServersRegistry,
   OAuthReconnectionManager,
 } = require('@librechat/api');
-const logger = require('./winston');
 
 global.EventSource = EventSource;
 
-/** @type {MCPManager} */
+/** @type {FlowStateManager} */
 let flowManager = null;
+/** @type {FlowStateManager} */
+let actionFlowManager = null;
 
 /**
+ * Flow manager for MCP OAuth flows. Uses the longer MCP OAuth TTL so the auth
+ * button and flow state outlive the user-completion window.
  * @param {Keyv} flowsCache
  * @returns {FlowStateManager}
  */
 function getFlowStateManager(flowsCache) {
   if (!flowManager) {
     flowManager = new FlowStateManager(flowsCache, {
-      ttl: Time.ONE_MINUTE * 3,
+      ttl: mcpConfig.OAUTH_FLOW_TTL,
     });
   }
   return flowManager;
 }
 
+/**
+ * Flow manager for Action (custom tool) OAuth flows. Kept on the shorter TTL so an
+ * unclicked action login does not leave the tool call waiting for the MCP OAuth window.
+ * @param {Keyv} flowsCache
+ * @returns {FlowStateManager}
+ */
+function getActionFlowStateManager(flowsCache) {
+  if (!actionFlowManager) {
+    actionFlowManager = new FlowStateManager(flowsCache, {
+      ttl: Time.ONE_MINUTE * 3,
+    });
+  }
+  return actionFlowManager;
+}
+
 module.exports = {
-  logger,
   createMCPServersRegistry: MCPServersRegistry.createInstance,
   getMCPServersRegistry: MCPServersRegistry.getInstance,
   createMCPManager: MCPManager.createInstance,
   getMCPManager: MCPManager.getInstance,
   getFlowStateManager,
+  getActionFlowStateManager,
   createOAuthReconnectionManager: OAuthReconnectionManager.createInstance,
   getOAuthReconnectionManager: OAuthReconnectionManager.getInstance,
 };
diff --git a/api/config/meiliLogger.js b/api/config/meiliLogger.js
index 398672da5c3..7eb6e3b9866 100644
--- a/api/config/meiliLogger.js
+++ b/api/config/meiliLogger.js
@@ -29,14 +29,16 @@ const getLogDir = () => {
   return path.join(__dirname, '..', 'logs');
 };
 
-const logDir = getLogDir();
-
-const { NODE_ENV, DEBUG_LOGGING = false } = process.env;
+const { NODE_ENV, DEBUG_LOGGING = false, LOG_TO_FILE = true } = process.env;
 
 const useDebugLogging =
   (typeof DEBUG_LOGGING === 'string' && DEBUG_LOGGING?.toLowerCase() === 'true') ||
   DEBUG_LOGGING === true;
 
+const useFileLogging =
+  (typeof LOG_TO_FILE === 'string' && LOG_TO_FILE?.toLowerCase() !== 'false') ||
+  LOG_TO_FILE === true;
+
 const levels = {
   error: 0,
   warn: 1,
@@ -68,17 +70,23 @@ const fileFormat = winston.format.combine(
 );
 
 const logLevel = useDebugLogging ? 'debug' : 'error';
-const transports = [
-  new winston.transports.DailyRotateFile({
-    level: logLevel,
-    filename: `${logDir}/meiliSync-%DATE%.log`,
-    datePattern: 'YYYY-MM-DD',
-    zippedArchive: true,
-    maxSize: '20m',
-    maxFiles: '14d',
-    format: fileFormat,
-  }),
-];
+const transports = [];
+
+if (useFileLogging) {
+  const logDir = getLogDir();
+
+  transports.push(
+    new winston.transports.DailyRotateFile({
+      level: logLevel,
+      filename: `${logDir}/meiliSync-%DATE%.log`,
+      datePattern: 'YYYY-MM-DD',
+      zippedArchive: true,
+      maxSize: '20m',
+      maxFiles: '14d',
+      format: fileFormat,
+    }),
+  );
+}
 
 const consoleFormat = winston.format.combine(
   winston.format.colorize({ all: true }),
diff --git a/api/db/connect.js b/api/db/connect.js
index 3534884b575..a63d3301b69 100644
--- a/api/db/connect.js
+++ b/api/db/connect.js
@@ -1,10 +1,12 @@
 require('dotenv').config();
-const { isEnabled } = require('@librechat/api');
+const { isEnabled, instrumentMongooseQueryMetrics } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 
 const mongoose = require('mongoose');
 const MONGO_URI = process.env.MONGO_URI;
 
+instrumentMongooseQueryMetrics(mongoose);
+
 if (!MONGO_URI) {
   throw new Error('Please define the MONGO_URI environment variable');
 }
diff --git a/api/db/utils.js b/api/db/utils.js
index 32051be78d1..f3302c92dac 100644
--- a/api/db/utils.js
+++ b/api/db/utils.js
@@ -1,4 +1,4 @@
-const { logger } = require('@librechat/data-schemas');
+const { logger, buildRetentionVisibilityFilter } = require('@librechat/data-schemas');
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
@@ -26,7 +26,10 @@ async function batchResetMeiliFlags(collection) {
   try {
     while (hasMore) {
       const docs = await collection
-        .find({ expiredAt: null, _meiliIndex: { $ne: false } }, { projection: { _id: 1 } })
+        .find(
+          { ...buildRetentionVisibilityFilter(), _meiliIndex: { $ne: false } },
+          { projection: { _id: 1 } },
+        )
         .limit(BATCH_SIZE)
         .toArray();
 
diff --git a/api/db/utils.spec.js b/api/db/utils.spec.js
index adf4f6cd86a..477bd70050d 100644
--- a/api/db/utils.spec.js
+++ b/api/db/utils.spec.js
@@ -83,6 +83,60 @@ describe('batchResetMeiliFlags', () => {
       expect(expiredDoc._meiliIndex).toBe(true);
     });
 
+    it('should reset active non-temporary documents with expiredAt set for all-data retention', async () => {
+      const retentionDate = new Date(Date.now() + 60 * 60 * 1000);
+      await testCollection.insertMany([
+        {
+          _id: new mongoose.Types.ObjectId(),
+          isTemporary: false,
+          expiredAt: retentionDate,
+          _meiliIndex: true,
+        },
+        {
+          _id: new mongoose.Types.ObjectId(),
+          isTemporary: true,
+          expiredAt: retentionDate,
+          _meiliIndex: true,
+        },
+      ]);
+
+      const result = await batchResetMeiliFlags(testCollection);
+
+      expect(result).toBe(1);
+
+      const retainedDoc = await testCollection.findOne({ isTemporary: false });
+      const temporaryDoc = await testCollection.findOne({ isTemporary: true });
+      expect(retainedDoc._meiliIndex).toBe(false);
+      expect(temporaryDoc._meiliIndex).toBe(true);
+    });
+
+    it('should not reset expired non-temporary documents with expiredAt set for all-data retention', async () => {
+      const retentionDate = new Date(Date.now() - 60 * 60 * 1000);
+      await testCollection.insertMany([
+        {
+          _id: new mongoose.Types.ObjectId(),
+          isTemporary: false,
+          expiredAt: retentionDate,
+          _meiliIndex: true,
+        },
+        {
+          _id: new mongoose.Types.ObjectId(),
+          isTemporary: false,
+          expiredAt: null,
+          _meiliIndex: true,
+        },
+      ]);
+
+      const result = await batchResetMeiliFlags(testCollection);
+
+      expect(result).toBe(1);
+
+      const expiredDoc = await testCollection.findOne({ expiredAt: retentionDate });
+      const permanentDoc = await testCollection.findOne({ expiredAt: null });
+      expect(expiredDoc._meiliIndex).toBe(true);
+      expect(permanentDoc._meiliIndex).toBe(false);
+    });
+
     it('should not modify documents with _meiliIndex: false', async () => {
       await testCollection.insertMany([
         { _id: new mongoose.Types.ObjectId(), expiredAt: null, _meiliIndex: false },
diff --git a/api/jest.config.js b/api/jest.config.js
index 47f8b7287bf..daa12004d67 100644
--- a/api/jest.config.js
+++ b/api/jest.config.js
@@ -1,3 +1,14 @@
+const esModules = [
+  'openid-client',
+  'oauth4webapi',
+  'jose',
+  '@langchain/langgraph',
+  '@langchain/langgraph-checkpoint',
+  '@langchain/langgraph-sdk',
+  '@mistralai/mistralai',
+  'uuid',
+].join('|');
+
 module.exports = {
   testEnvironment: 'node',
   clearMocks: true,
@@ -12,5 +23,13 @@ module.exports = {
     '^openid-client/passport$': '<rootDir>/test/__mocks__/openid-client-passport.js',
     '^openid-client$': '<rootDir>/test/__mocks__/openid-client.js',
   },
-  transformIgnorePatterns: ['/node_modules/(?!(openid-client|oauth4webapi|jose)/).*/'],
+  transform: {
+    '\\.[jt]sx?$': [
+      'babel-jest',
+      {
+        presets: [['@babel/preset-env', { targets: { node: 'current' } }]],
+      },
+    ],
+  },
+  transformIgnorePatterns: [`/node_modules/(?!(${esModules})/).*/`],
 };
diff --git a/api/package.json b/api/package.json
index eb4cf2a1917..9971d42119b 100644
--- a/api/package.json
+++ b/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/backend",
-  "version": "v0.8.6-rc1",
+  "version": "v0.8.7",
   "description": "",
   "scripts": {
     "start": "echo 'please run this from the root directory'",
@@ -39,18 +39,29 @@
     "@aws-sdk/client-cloudfront": "^3.1042.0",
     "@aws-sdk/client-s3": "^3.980.0",
     "@aws-sdk/cloudfront-signer": "^3.1036.0",
+    "@aws-sdk/credential-providers": "^3.1045.0",
     "@aws-sdk/s3-request-presigner": "^3.758.0",
     "@azure/identity": "^4.13.1",
     "@azure/search-documents": "^12.0.0",
     "@azure/storage-blob": "^12.30.0",
-    "@google/genai": "^2.0.1",
+    "@google/genai": "^2.8.0",
     "@keyv/redis": "^4.3.3",
-    "@librechat/agents": "^3.1.86",
+    "@librechat/agents": "^3.2.46",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@node-saml/passport-saml": "^5.1.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/instrumentation-express": "^0.56.0",
+    "@opentelemetry/instrumentation-http": "^0.207.0",
+    "@opentelemetry/instrumentation-ioredis": "^0.55.0",
+    "@opentelemetry/instrumentation-mongodb": "^0.60.0",
+    "@opentelemetry/instrumentation-mongoose": "^0.54.0",
+    "@opentelemetry/instrumentation-undici": "^0.18.0",
+    "@opentelemetry/resources": "^2.6.1",
+    "@opentelemetry/sdk-node": "^0.218.0",
+    "@opentelemetry/semantic-conventions": "^1.39.0",
     "@smithy/node-http-handler": "^4.4.5",
     "ai-tokenizer": "^1.0.6",
     "axios": "^1.16.0",
@@ -71,11 +82,13 @@
     "file-type": "^21.3.2",
     "firebase": "^11.0.2",
     "form-data": "^4.0.4",
+    "get-stream": "^6.0.1",
     "handlebars": "^4.7.9",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "jsonwebtoken": "^9.0.0",
+    "jszip": "^3.10.1",
     "jwks-rsa": "^3.2.0",
     "keyv": "^5.3.2",
     "keyv-file": "^5.1.2",
@@ -88,11 +101,12 @@
     "memorystore": "^1.6.7",
     "mime": "^3.0.0",
     "module-alias": "^2.2.3",
+    "mongodb": "^6.14.2",
     "mongoose": "^8.23.1",
-    "multer": "^2.1.1",
+    "multer": "^2.2.0",
     "nanoid": "^3.3.7",
     "node-fetch": "^2.7.0",
-    "nodemailer": "^8.0.5",
+    "nodemailer": "^9.0.1",
     "ollama": "^0.5.0",
     "openai": "5.8.2",
     "openid-client": "^6.5.0",
@@ -106,10 +120,10 @@
     "passport-ldapauth": "^3.0.1",
     "passport-local": "^1.0.0",
     "pdfjs-dist": "^5.4.624",
+    "prom-client": "^15.1.3",
     "rate-limit-redis": "^4.2.0",
     "sanitize-html": "^2.13.0",
     "sharp": "^0.33.5",
-    "traverse": "^0.6.7",
     "ua-parser-js": "^1.0.36",
     "undici": "^7.24.1",
     "winston": "^3.11.0",
@@ -119,6 +133,7 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
+    "@babel/preset-env": "^7.29.5",
     "@types/sanitize-html": "^2.13.0",
     "jest": "^30.2.0",
     "mongodb-memory-server": "^11.0.1",
diff --git a/api/server/controllers/AuthController.js b/api/server/controllers/AuthController.js
index 527728e98c0..b3743df8280 100644
--- a/api/server/controllers/AuthController.js
+++ b/api/server/controllers/AuthController.js
@@ -3,6 +3,7 @@ const jwt = require('jsonwebtoken');
 const openIdClient = require('openid-client');
 const { logger } = require('@librechat/data-schemas');
 const {
+  math,
   isEnabled,
   findOpenIDUser,
   getOpenIdIssuer,
@@ -28,8 +29,18 @@ const { getOpenIdConfig, getOpenIdEmail } = require('~/strategies');
 
 const AUTH_REFRESH_USER_PROJECTION = '-password -__v -totpSecret -backupCodes -federatedTokens';
 const OPENID_REUSE_EXPIRY_BUFFER_SECONDS = 30;
-/** Mirrors the default SESSION_EXPIRY to bound IdP revocation lag for session-token reuse. */
-const OPENID_REUSE_MAX_SESSION_AGE_MS = 15 * 60 * 1000;
+/**
+ * Max age (ms) LibreChat reuses a cached OpenID session token before forcing an IdP refresh.
+ * Env-overridable (accepts an arithmetic expression, e.g. `60 * 60 * 24 * 1000`, like
+ * `SESSION_EXPIRY`): deployments whose IdP revokes the previous access token on refresh can
+ * widen this to the access-token lifetime so a still-valid token is not rotated/revoked out
+ * from under downstream consumers (e.g. MCP servers that introspect the bearer). Defaults to
+ * 15 minutes.
+ */
+const OPENID_REUSE_MAX_SESSION_AGE_MS = math(
+  process.env.OPENID_REUSE_MAX_SESSION_AGE_MS,
+  15 * 60 * 1000,
+);
 
 const registrationController = async (req, res) => {
   try {
diff --git a/api/server/controllers/AuthController.spec.js b/api/server/controllers/AuthController.spec.js
index 7bed1da33bd..40c20bbbe18 100644
--- a/api/server/controllers/AuthController.spec.js
+++ b/api/server/controllers/AuthController.spec.js
@@ -22,6 +22,7 @@ jest.mock('~/models', () => ({
   findUser: jest.fn(),
 }));
 jest.mock('@librechat/api', () => ({
+  math: jest.fn((value, fallback) => fallback),
   isEnabled: jest.fn(),
   findOpenIDUser: jest.fn(),
   getOpenIdIssuer: jest.fn(() => 'https://issuer.example.com'),
diff --git a/api/server/controllers/Balance.js b/api/server/controllers/Balance.js
index fd9b32e74c2..8df579e5c6f 100644
--- a/api/server/controllers/Balance.js
+++ b/api/server/controllers/Balance.js
@@ -1,7 +1,13 @@
 const { findBalanceByUser } = require('~/models');
 
 async function balanceController(req, res) {
-  const balanceData = await findBalanceByUser(req.user.id);
+  const balanceLocals = res.locals || {};
+
+  if (balanceLocals.balanceConfigEnabled === false) {
+    return res.sendStatus(204);
+  }
+
+  const balanceData = balanceLocals.balanceData ?? (await findBalanceByUser(req.user.id));
 
   if (!balanceData) {
     return res.status(404).json({ error: 'Balance not found' });
diff --git a/api/server/controllers/Balance.spec.js b/api/server/controllers/Balance.spec.js
new file mode 100644
index 00000000000..833f2d8c549
--- /dev/null
+++ b/api/server/controllers/Balance.spec.js
@@ -0,0 +1,72 @@
+jest.mock('~/models', () => ({
+  findBalanceByUser: jest.fn(),
+}));
+
+const { findBalanceByUser } = require('~/models');
+const balanceController = require('./Balance');
+
+describe('balanceController', () => {
+  const createResponse = () => ({
+    locals: {},
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+    sendStatus: jest.fn().mockReturnThis(),
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns no content without reading balance when balance config is disabled', async () => {
+    const req = {
+      user: { id: 'user-1' },
+    };
+    const res = createResponse();
+    res.locals.balanceConfigEnabled = false;
+
+    await balanceController(req, res);
+
+    expect(findBalanceByUser).not.toHaveBeenCalled();
+    expect(res.sendStatus).toHaveBeenCalledWith(204);
+    expect(res.status).not.toHaveBeenCalled();
+  });
+
+  it('uses balance data attached by middleware without a second read', async () => {
+    const req = {
+      user: { id: 'user-1' },
+    };
+    const res = createResponse();
+    res.locals.balanceConfigEnabled = true;
+    res.locals.balanceData = {
+      _id: 'balance-1',
+      user: 'user-1',
+      tokenCredits: 100,
+      autoRefillEnabled: false,
+    };
+
+    await balanceController(req, res);
+
+    expect(findBalanceByUser).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(res.json).toHaveBeenCalledWith({
+      user: 'user-1',
+      tokenCredits: 100,
+      autoRefillEnabled: false,
+    });
+  });
+
+  it('returns not found when balance is enabled and no record exists', async () => {
+    findBalanceByUser.mockResolvedValue(null);
+    const req = {
+      user: { id: 'user-1' },
+    };
+    const res = createResponse();
+    res.locals.balanceConfigEnabled = true;
+
+    await balanceController(req, res);
+
+    expect(findBalanceByUser).toHaveBeenCalledWith('user-1');
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Balance not found' });
+  });
+});
diff --git a/api/server/controllers/ContextProjectionController.js b/api/server/controllers/ContextProjectionController.js
new file mode 100644
index 00000000000..9c56b2ae342
--- /dev/null
+++ b/api/server/controllers/ContextProjectionController.js
@@ -0,0 +1,35 @@
+const { logger } = require('@librechat/data-schemas');
+const { resolveContextProjection } = require('@librechat/api');
+const db = require('~/models');
+
+/**
+ * Returns a server-side context-usage projection for the viewed branch + config
+ * (agents SDK, no model call) — powers the gauge for snapshot-less branches and
+ * after a model/window switch. Resolution lives in `@librechat/api`; this
+ * controller only injects request-scoped model accessors.
+ * @param {ServerRequest} req
+ * @param {ServerResponse} res
+ */
+async function contextProjectionController(req, res) {
+  try {
+    const params = req.body ?? {};
+    if (!params.conversationId || !params.messageId) {
+      res.json(null);
+      return;
+    }
+    const projection = await resolveContextProjection(
+      {
+        userId: req.user?.id,
+        getMessages: db.getMessages,
+        getMessageTextStats: db.getMessageTextStats,
+      },
+      params,
+    );
+    res.json(projection ?? null);
+  } catch (error) {
+    logger.error('[contextProjectionController]', error);
+    res.status(500).json({ error: 'Failed to resolve context projection' });
+  }
+}
+
+module.exports = contextProjectionController;
diff --git a/api/server/controllers/PermissionsController.js b/api/server/controllers/PermissionsController.js
index 1f200fce83d..076de31cf33 100644
--- a/api/server/controllers/PermissionsController.js
+++ b/api/server/controllers/PermissionsController.js
@@ -3,7 +3,7 @@
  */
 
 const mongoose = require('mongoose');
-const { logger } = require('@librechat/data-schemas');
+const { logger, getTenantId, SYSTEM_TENANT_ID } = require('@librechat/data-schemas');
 const { ResourceType, PrincipalType, PermissionBits } = require('librechat-data-provider');
 const { enrichRemoteAgentPrincipals, backfillRemoteAgentPermissions } = require('@librechat/api');
 const {
@@ -21,6 +21,13 @@ const {
 } = require('~/server/services/GraphApiService');
 const db = require('~/models');
 
+const matchesCurrentTenant = (principal, tenantId) => {
+  if (!tenantId || tenantId === SYSTEM_TENANT_ID) {
+    return true;
+  }
+  return principal?.tenantId === tenantId;
+};
+
 /**
  * Generic controller for resource permission endpoints
  * Delegates validation and logic to PermissionService
@@ -134,8 +141,8 @@ const updateResourcePermissions = async (req, res) => {
       revokedPrincipals.push(...removed);
     }
 
-    // If public is disabled, add public to revoked list
-    if (!isPublic) {
+    // If public is explicitly disabled, add public to revoked list
+    if (isPublic === false) {
       revokedPrincipals.push({
         type: PrincipalType.PUBLIC,
         id: null,
@@ -167,7 +174,7 @@ const updateResourcePermissions = async (req, res) => {
       message: 'Permissions updated successfully',
       results: {
         principals: results.granted,
-        public: isPublic || false,
+        ...(isPublic !== undefined ? { public: isPublic } : {}),
         publicAccessRoleId: isPublic ? publicAccessRoleId : undefined,
       },
     };
@@ -191,6 +198,7 @@ const getResourcePermissions = async (req, res) => {
   try {
     const { resourceType, resourceId } = req.params;
     validateResourceType(resourceType);
+    const tenantId = getTenantId();
 
     const results = await db.aggregateAclEntries([
       // Match ACL entries for this resource
@@ -244,14 +252,17 @@ const getResourcePermissions = async (req, res) => {
     let principals = [];
     let publicPermission = null;
 
-    // Process aggregation results
     for (const result of results) {
       if (result.principalType === PrincipalType.PUBLIC) {
         publicPermission = {
           public: true,
           publicAccessRoleId: result.accessRoleId,
         };
-      } else if (result.principalType === PrincipalType.USER && result.userInfo) {
+      } else if (
+        result.principalType === PrincipalType.USER &&
+        result.userInfo &&
+        matchesCurrentTenant(result.userInfo, tenantId)
+      ) {
         principals.push({
           type: PrincipalType.USER,
           id: result.userInfo._id.toString(),
@@ -262,7 +273,11 @@ const getResourcePermissions = async (req, res) => {
           idOnTheSource: result.userInfo.idOnTheSource || result.userInfo._id.toString(),
           accessRoleId: result.accessRoleId,
         });
-      } else if (result.principalType === PrincipalType.GROUP && result.groupInfo) {
+      } else if (
+        result.principalType === PrincipalType.GROUP &&
+        result.groupInfo &&
+        matchesCurrentTenant(result.groupInfo, tenantId)
+      ) {
         principals.push({
           type: PrincipalType.GROUP,
           id: result.groupInfo._id.toString(),
@@ -385,15 +400,17 @@ const getUserEffectivePermissions = async (req, res) => {
  */
 const searchPrincipals = async (req, res) => {
   try {
-    const { q: query, limit = 20, types } = req.query;
+    const { q: rawQuery, limit = 20, types } = req.query;
 
-    if (!query || query.trim().length === 0) {
+    if (typeof rawQuery !== 'string' || rawQuery.trim().length === 0) {
       return res.status(400).json({
         error: 'Query parameter "q" is required and must not be empty',
       });
     }
 
-    if (query.trim().length < 2) {
+    const query = rawQuery.trim();
+
+    if (query.length < 2) {
       return res.status(400).json({
         error: 'Query must be at least 2 characters long',
       });
@@ -410,7 +427,7 @@ const searchPrincipals = async (req, res) => {
       typeFilters = validTypes.length > 0 ? validTypes : null;
     }
 
-    const localResults = await db.searchPrincipals(query.trim(), searchLimit, typeFilters);
+    const localResults = await db.searchPrincipals(query, searchLimit, typeFilters);
     let allPrincipals = [...localResults];
 
     const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
@@ -437,7 +454,7 @@ const searchPrincipals = async (req, res) => {
           const graphResults = await searchEntraIdPrincipals(
             accessToken,
             req.user.openidId,
-            query.trim(),
+            query,
             graphType,
             searchLimit - localResults.length,
           );
@@ -466,7 +483,7 @@ const searchPrincipals = async (req, res) => {
     }
     const scoredResults = allPrincipals.map((item) => ({
       ...item,
-      _searchScore: db.calculateRelevanceScore(item, query.trim()),
+      _searchScore: db.calculateRelevanceScore(item, query),
     }));
 
     const finalResults = db
@@ -478,7 +495,7 @@ const searchPrincipals = async (req, res) => {
       });
 
     res.status(200).json({
-      query: query.trim(),
+      query,
       limit: searchLimit,
       types: typeFilters,
       results: finalResults,
@@ -492,7 +509,6 @@ const searchPrincipals = async (req, res) => {
     logger.error('Error searching principals:', error);
     res.status(500).json({
       error: 'Failed to search principals',
-      details: error.message,
     });
   }
 };
diff --git a/api/server/controllers/PluginController.js b/api/server/controllers/PluginController.js
index c5d5c5b8880..7bb21a7c58f 100644
--- a/api/server/controllers/PluginController.js
+++ b/api/server/controllers/PluginController.js
@@ -6,7 +6,13 @@ const { getAppConfig } = require('~/server/services/Config');
 
 const getAvailablePluginsController = async (req, res) => {
   try {
-    const appConfig = await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId });
+    const appConfig =
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
     const { filteredTools = [], includedTools = [] } = appConfig;
 
     const uniquePlugins = filterUniquePlugins(availableTools);
@@ -41,7 +47,12 @@ const getAvailableTools = async (req, res) => {
     }
 
     const appConfig =
-      req.config ?? (await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId }));
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
 
     let toolDefinitions = await getCachedTools();
 
diff --git a/api/server/controllers/PluginController.spec.js b/api/server/controllers/PluginController.spec.js
index 9288680567d..b392ab575d6 100644
--- a/api/server/controllers/PluginController.spec.js
+++ b/api/server/controllers/PluginController.spec.js
@@ -98,10 +98,10 @@ describe('PluginController', () => {
 
       require('~/app/clients/tools').availableTools.push(...mockPlugins);
 
-      getAppConfig.mockResolvedValueOnce({
+      mockReq.config = {
         filteredTools: [],
         includedTools: ['key1'],
-      });
+      };
 
       await getAvailablePluginsController(mockReq, mockRes);
 
@@ -118,10 +118,10 @@ describe('PluginController', () => {
 
       require('~/app/clients/tools').availableTools.push(...mockPlugins);
 
-      getAppConfig.mockResolvedValueOnce({
+      mockReq.config = {
         filteredTools: ['key2'],
         includedTools: [],
-      });
+      };
 
       await getAvailablePluginsController(mockReq, mockRes);
 
@@ -139,10 +139,10 @@ describe('PluginController', () => {
 
       require('~/app/clients/tools').availableTools.push(...mockPlugins);
 
-      getAppConfig.mockResolvedValueOnce({
+      mockReq.config = {
         includedTools: ['key1', 'key2'],
         filteredTools: ['key2'],
-      });
+      };
 
       await getAvailablePluginsController(mockReq, mockRes);
 
diff --git a/api/server/controllers/SkillStatesController.js b/api/server/controllers/SkillStatesController.js
index 35679d2ac6d..1afeb271413 100644
--- a/api/server/controllers/SkillStatesController.js
+++ b/api/server/controllers/SkillStatesController.js
@@ -5,6 +5,8 @@ const {
   toSkillStatesRecord,
   validateSkillStatesPayload,
   pruneOrphanSkillStates,
+  getDeploymentSkillIds,
+  mergeDeploymentSkillIds,
 } = require('@librechat/api');
 const { ResourceType, PermissionBits } = require('librechat-data-provider');
 const { findAccessibleResources } = require('~/server/services/PermissionService');
@@ -21,15 +23,20 @@ function buildPruneDeps(user) {
       const existing = await Skill.find({ _id: { $in: validIds } })
         .select('_id')
         .lean();
-      return existing.map((doc) => doc._id.toString());
+      const deploymentIds = getDeploymentSkillIds()
+        .map((id) => id.toString())
+        .filter((id) => validIds.includes(id));
+      return [...existing.map((doc) => doc._id.toString()), ...deploymentIds];
     },
-    findAccessibleSkillIds: () =>
-      findAccessibleResources({
-        userId: user.id,
-        role: user.role,
-        resourceType: ResourceType.SKILL,
-        requiredPermissions: PermissionBits.VIEW,
-      }),
+    findAccessibleSkillIds: async () =>
+      mergeDeploymentSkillIds(
+        await findAccessibleResources({
+          userId: user.id,
+          role: user.role,
+          resourceType: ResourceType.SKILL,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+      ),
   };
 }
 
diff --git a/api/server/controllers/TokenConfigController.js b/api/server/controllers/TokenConfigController.js
new file mode 100644
index 00000000000..059f1447f28
--- /dev/null
+++ b/api/server/controllers/TokenConfigController.js
@@ -0,0 +1,32 @@
+const { logger } = require('@librechat/data-schemas');
+const { resolveTokenConfigMap } = require('@librechat/api');
+const { getModelsConfig } = require('~/server/controllers/ModelController');
+const { getValueKey, getMultiplier, getCacheMultiplier } = require('~/models');
+
+/**
+ * Returns server-resolved context windows (and pricing when
+ * `interface.contextCost` is enabled) for every configured model. Resolution
+ * lives in `@librechat/api`; this controller only supplies request-scoped deps.
+ * @param {ServerRequest} req
+ * @param {ServerResponse} res
+ */
+async function tokenConfigController(req, res) {
+  try {
+    const modelsConfig = await getModelsConfig(req);
+    const tokenConfigMap = await resolveTokenConfigMap(
+      {
+        appConfig: req.config,
+        modelsConfig,
+        userId: req.user.id,
+        tenantId: req.user.tenantId,
+      },
+      { getValueKey, getMultiplier, getCacheMultiplier },
+    );
+    res.json(tokenConfigMap);
+  } catch (error) {
+    logger.error('[tokenConfigController]', error);
+    res.status(500).json({ error: 'Failed to resolve token config' });
+  }
+}
+
+module.exports = tokenConfigController;
diff --git a/api/server/controllers/UserController.js b/api/server/controllers/UserController.js
index 5b38d6d5624..5fd43b66d1e 100644
--- a/api/server/controllers/UserController.js
+++ b/api/server/controllers/UserController.js
@@ -1,5 +1,5 @@
 const mongoose = require('mongoose');
-const { logger, webSearchKeys } = require('@librechat/data-schemas');
+const { logger, getTenantId, webSearchKeys } = require('@librechat/data-schemas');
 const {
   getNewS3URL,
   needsRefresh,
@@ -7,6 +7,7 @@ const {
   MCPTokenStorage,
   normalizeHttpError,
   extractWebSearchEnvVars,
+  deleteAllSharedLinksWithCleanup,
 } = require('@librechat/api');
 const {
   Tools,
@@ -25,17 +26,47 @@ const { getAppConfig } = require('~/server/services/Config');
 const { getLogStores } = require('~/cache');
 const db = require('~/models');
 
+const PUBLIC_USER_RESPONSE_FIELDS = [
+  '_id',
+  'id',
+  'name',
+  'username',
+  'email',
+  'emailVerified',
+  'avatar',
+  'provider',
+  'role',
+  'plugins',
+  'twoFactorEnabled',
+  'termsAccepted',
+  'personalization',
+  'favorites',
+  'skillStates',
+  'createdAt',
+  'updatedAt',
+  'tenantId',
+];
+
+const sanitizeUserForResponse = (user) => {
+  const source = user.toObject != null ? user.toObject() : user;
+  return PUBLIC_USER_RESPONSE_FIELDS.reduce((userData, field) => {
+    if (source[field] !== undefined) {
+      userData[field] = source[field];
+    }
+    return userData;
+  }, {});
+};
+
 const getUserController = async (req, res) => {
-  const appConfig = await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId });
+  const appConfig =
+    req.config ??
+    (await getAppConfig({
+      role: req.user?.role,
+      userId: req.user?.id,
+      tenantId: req.user?.tenantId,
+    }));
   /** @type {IUser} */
-  const userData = req.user.toObject != null ? req.user.toObject() : { ...req.user };
-  /**
-   * These fields should not exist due to secure field selection, but deletion
-   * is done in case of alternate database incompatibility with Mongo API
-   * */
-  delete userData.password;
-  delete userData.totpSecret;
-  delete userData.backupCodes;
+  const userData = sanitizeUserForResponse(req.user);
   if (appConfig.fileStrategy === FileSources.s3 && userData.avatar) {
     const avatarNeedsRefresh = needsRefresh(userData.avatar, 3600);
     if (!avatarNeedsRefresh) {
@@ -165,7 +196,13 @@ const deleteUserMcpServers = async (userId) => {
 };
 
 const updateUserPluginsController = async (req, res) => {
-  const appConfig = await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId });
+  const appConfig =
+    req.config ??
+    (await getAppConfig({
+      role: req.user?.role,
+      userId: req.user?.id,
+      tenantId: req.user?.tenantId,
+    }));
   const { user } = req;
   const { pluginKey, action, auth, isEntityTool } = req.body;
   try {
@@ -323,7 +360,7 @@ const deleteUserController = async (req, res) => {
     }
     await deleteUserPluginAuth(user.id, null, true);
     await db.deleteUserById(user.id);
-    await db.deleteAllSharedLinks(user.id);
+    await deleteAllSharedLinksWithCleanup(user.id);
     await deleteUserFiles(req);
     await db.deleteFiles(null, user.id);
     await db.deleteToolCalls(user.id);
@@ -351,7 +388,7 @@ const verifyEmailController = async (req, res) => {
   try {
     const verifyEmailService = await verifyEmail(req);
     if (verifyEmailService instanceof Error) {
-      return res.status(400).json(verifyEmailService);
+      return res.status(400).json({ message: verifyEmailService.message });
     } else {
       return res.status(200).json(verifyEmailService);
     }
@@ -365,9 +402,9 @@ const resendVerificationController = async (req, res) => {
   try {
     const result = await resendVerificationEmail(req);
     if (result instanceof Error) {
-      return res.status(400).json(result);
+      return res.status(400).json({ message: result.message });
     } else {
-      return res.status(200).json(result);
+      return res.status(result.status ?? 200).json({ message: result.message });
     }
   } catch (e) {
     logger.error('[verifyEmailController]', e);
@@ -395,11 +432,24 @@ const clearStoredMCPOAuthState = async (userId, serverName) => {
   try {
     const flowsCache = getLogStores(CacheKeys.FLOWS);
     const flowManager = getFlowStateManager(flowsCache);
-    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
-    const results = await Promise.allSettled([
-      flowManager.deleteFlow(flowId, 'mcp_get_tokens'),
-      flowManager.deleteFlow(flowId, 'mcp_oauth'),
-    ]);
+    const baseFlowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+    const tenantId = getTenantId();
+    const tokenFlowId = MCPOAuthHandler.generateTokenFlowId(userId, serverName, tenantId);
+    const oauthFlowId = MCPOAuthHandler.generateFlowId(userId, serverName, tenantId);
+    const flowDeletes = [
+      [tokenFlowId, 'mcp_get_tokens'],
+      [oauthFlowId, 'mcp_oauth'],
+      [baseFlowId, 'mcp_get_tokens'],
+      [baseFlowId, 'mcp_oauth'],
+    ].filter(
+      ([flowId, type], index, deletes) =>
+        deletes.findIndex(([candidateId, candidateType]) => {
+          return candidateId === flowId && candidateType === type;
+        }) === index,
+    );
+    const results = await Promise.allSettled(
+      flowDeletes.map(([flowId, type]) => flowManager.deleteFlow(flowId, type)),
+    );
     for (const result of results) {
       if (result.status === 'rejected') {
         logger.warn(
@@ -480,9 +530,10 @@ const maybeUninstallOAuthMCP = async (userId, pluginKey, appConfig) => {
     serverConfig.oauth?.revocation_endpoint_auth_methods_supported ??
     clientMetadata.revocation_endpoint_auth_methods_supported;
   const oauthHeaders = serverConfig.oauth_headers ?? {};
-  const registry = getMCPServersRegistry();
-  const allowedDomains = registry.getAllowedDomains();
-  const allowedAddresses = registry.getAllowedAddresses();
+  // Use the request's merged (tenant/principal-scoped) allowlists so admin-panel mcpSettings
+  // overrides are honored for OAuth revocation, consistent with inspection/connection.
+  const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
+  const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
 
   if (tokens?.access_token) {
     try {
diff --git a/api/server/controllers/UserController.spec.js b/api/server/controllers/UserController.spec.js
index 30e6190e286..6a165fe7182 100644
--- a/api/server/controllers/UserController.spec.js
+++ b/api/server/controllers/UserController.spec.js
@@ -75,7 +75,7 @@ jest.mock('@librechat/api', () => ({
 }));
 
 jest.mock('~/server/services/Files/process', () => ({
-  processDeleteRequest: jest.fn().mockResolvedValue(undefined),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
 }));
 
 jest.mock('~/server/services/Config', () => ({
@@ -108,9 +108,153 @@ afterEach(async () => {
   }
 });
 
-const { deleteUserController } = require('./UserController');
+const {
+  deleteUserController,
+  getUserController,
+  resendVerificationController,
+  verifyEmailController,
+} = require('./UserController');
 const { Group } = require('~/db/models');
 const { deleteConvos } = require('~/models');
+const { verifyEmail, resendVerificationEmail } = require('~/server/services/AuthService');
+
+describe('verifyEmailController', () => {
+  const mockRes = {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns the generic verification error message from service failures', async () => {
+    verifyEmail.mockResolvedValue(new Error('Invalid or expired email verification token'));
+
+    await verifyEmailController(
+      { body: { email: 'user%40example.com', token: 'not-the-token' } },
+      mockRes,
+    );
+
+    expect(mockRes.status).toHaveBeenCalledWith(400);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      message: 'Invalid or expired email verification token',
+    });
+  });
+
+  it('uses the service status for resend verification responses', async () => {
+    resendVerificationEmail.mockResolvedValue({ status: 500, message: 'Something went wrong.' });
+
+    await resendVerificationController({ body: { email: 'user@example.com' } }, mockRes);
+
+    expect(mockRes.status).toHaveBeenCalledWith(500);
+    expect(mockRes.json).toHaveBeenCalledWith({ message: 'Something went wrong.' });
+  });
+});
+
+describe('getUserController', () => {
+  const mockRes = {
+    status: jest.fn().mockReturnThis(),
+    send: jest.fn().mockReturnThis(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should only expose public user response fields from the request user', async () => {
+    const createdAt = new Date('2026-01-01T00:00:00.000Z');
+    const updatedAt = new Date('2026-01-02T00:00:00.000Z');
+    const req = {
+      config: {},
+      user: {
+        id: 'user-id',
+        _id: 'user-id',
+        name: 'OpenID User',
+        username: 'openid-user',
+        email: 'openid@test.com',
+        emailVerified: true,
+        avatar: '/avatars/user-id.png',
+        provider: 'openid',
+        role: 'USER',
+        plugins: ['web_search'],
+        twoFactorEnabled: true,
+        termsAccepted: true,
+        personalization: { memories: false },
+        favorites: [{ model: 'gpt-5', endpoint: 'openAI' }],
+        skillStates: { skill_one: true },
+        createdAt,
+        updatedAt,
+        tenantId: 'tenant-id',
+        password: 'hashed-password',
+        __v: 1,
+        totpSecret: 'totp-secret',
+        backupCodes: [{ codeHash: 'backup-code' }],
+        pendingTotpSecret: 'pending-totp-secret',
+        pendingBackupCodes: [{ codeHash: 'pending-backup-code' }],
+        refreshToken: [{ refreshToken: 'legacy-refresh-token' }],
+        googleId: 'google-id',
+        openidId: 'openid-id',
+        openidIssuer: 'openid-issuer',
+        idOnTheSource: 'external-source-id',
+        federatedTokens: {
+          access_token: 'access-token',
+          id_token: 'id-token',
+          refresh_token: 'refresh-token',
+        },
+        openidTokens: {
+          access_token: 'openid-access-token',
+          refresh_token: 'openid-refresh-token',
+        },
+        tokenset: {
+          access_token: 'tokenset-access-token',
+          refresh_token: 'tokenset-refresh-token',
+        },
+        safeLookingRuntimeField: 'internal-value',
+      },
+    };
+
+    await getUserController(req, mockRes);
+
+    expect(mockRes.status).toHaveBeenCalledWith(200);
+    const sentUser = mockRes.send.mock.calls[0][0];
+    expect(sentUser).toMatchObject({
+      id: 'user-id',
+      _id: 'user-id',
+      name: 'OpenID User',
+      username: 'openid-user',
+      email: 'openid@test.com',
+      emailVerified: true,
+      avatar: '/avatars/user-id.png',
+      provider: 'openid',
+      role: 'USER',
+      plugins: ['web_search'],
+      twoFactorEnabled: true,
+      termsAccepted: true,
+      personalization: { memories: false },
+      favorites: [{ model: 'gpt-5', endpoint: 'openAI' }],
+      skillStates: { skill_one: true },
+      createdAt,
+      updatedAt,
+      tenantId: 'tenant-id',
+    });
+    expect(sentUser).not.toHaveProperty('password');
+    expect(sentUser).not.toHaveProperty('__v');
+    expect(sentUser).not.toHaveProperty('totpSecret');
+    expect(sentUser).not.toHaveProperty('backupCodes');
+    expect(sentUser).not.toHaveProperty('pendingTotpSecret');
+    expect(sentUser).not.toHaveProperty('pendingBackupCodes');
+    expect(sentUser).not.toHaveProperty('refreshToken');
+    expect(sentUser).not.toHaveProperty('googleId');
+    expect(sentUser).not.toHaveProperty('openidId');
+    expect(sentUser).not.toHaveProperty('openidIssuer');
+    expect(sentUser).not.toHaveProperty('idOnTheSource');
+    expect(sentUser).not.toHaveProperty('federatedTokens');
+    expect(sentUser).not.toHaveProperty('openidTokens');
+    expect(sentUser).not.toHaveProperty('tokenset');
+    expect(sentUser).not.toHaveProperty('safeLookingRuntimeField');
+  });
+});
 
 describe('deleteUserController', () => {
   const mockRes = {
diff --git a/api/server/controllers/__tests__/PermissionsController.spec.js b/api/server/controllers/__tests__/PermissionsController.spec.js
index a8d95184550..5976f9b29a5 100644
--- a/api/server/controllers/__tests__/PermissionsController.spec.js
+++ b/api/server/controllers/__tests__/PermissionsController.spec.js
@@ -1,12 +1,16 @@
 const mongoose = require('mongoose');
 
 const mockLogger = { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() };
+const mockGetTenantId = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: mockLogger,
+  getTenantId: mockGetTenantId,
+  SYSTEM_TENANT_ID: '__SYSTEM__',
 }));
 
-const { ResourceType, PrincipalType } = jest.requireActual('librechat-data-provider');
+const { AccessRoleIds, ResourceType, PrincipalType } =
+  jest.requireActual('librechat-data-provider');
 
 jest.mock('librechat-data-provider', () => ({
   ...jest.requireActual('librechat-data-provider'),
@@ -32,6 +36,7 @@ jest.mock('~/server/services/PermissionService', () => ({
 const mockRemoveAgentFromUserFavorites = jest.fn();
 
 jest.mock('~/models', () => ({
+  aggregateAclEntries: jest.fn(),
   searchPrincipals: jest.fn(),
   sortPrincipalsByRelevance: jest.fn(),
   calculateRelevanceScore: jest.fn(),
@@ -43,7 +48,12 @@ jest.mock('~/server/services/GraphApiService', () => ({
   searchEntraIdPrincipals: jest.fn(),
 }));
 
-const { updateResourcePermissions } = require('../PermissionsController');
+const db = require('~/models');
+const {
+  updateResourcePermissions,
+  searchPrincipals,
+  getResourcePermissions,
+} = require('../PermissionsController');
 
 const createMockReq = (overrides = {}) => ({
   params: { resourceType: ResourceType.AGENT, resourceId: '507f1f77bcf86cd799439011' },
@@ -65,6 +75,180 @@ const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
 describe('PermissionsController', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
+  });
+
+  describe('searchPrincipals', () => {
+    beforeEach(() => {
+      db.searchPrincipals.mockResolvedValue([]);
+      db.calculateRelevanceScore.mockReturnValue(50);
+      db.sortPrincipalsByRelevance.mockImplementation((results) => results);
+    });
+
+    it('rejects non-string query parameters', async () => {
+      const req = createMockReq({
+        query: { q: ['alice'] },
+      });
+      const res = createMockRes();
+
+      await searchPrincipals(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(400);
+      expect(res.json).toHaveBeenCalledWith({
+        error: 'Query parameter "q" is required and must not be empty',
+      });
+      expect(db.searchPrincipals).not.toHaveBeenCalled();
+    });
+
+    it('searches with the trimmed literal query', async () => {
+      db.searchPrincipals.mockResolvedValue([
+        {
+          id: 'user-1',
+          type: PrincipalType.USER,
+          name: 'Regex [invalid User',
+          source: 'local',
+        },
+      ]);
+
+      const req = createMockReq({
+        query: { q: '  [invalid  ', limit: '5', types: PrincipalType.USER },
+      });
+      const res = createMockRes();
+
+      await searchPrincipals(req, res);
+
+      expect(db.searchPrincipals).toHaveBeenCalledWith('[invalid', 5, [PrincipalType.USER]);
+      expect(db.calculateRelevanceScore).toHaveBeenCalledWith(
+        expect.objectContaining({ name: 'Regex [invalid User' }),
+        '[invalid',
+      );
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: '[invalid',
+          limit: 5,
+          count: 1,
+        }),
+      );
+    });
+
+    it('does not expose internal error details on search failures', async () => {
+      db.searchPrincipals.mockRejectedValue(new Error('database failure with internal detail'));
+
+      const req = createMockReq({
+        query: { q: 'alice' },
+      });
+      const res = createMockRes();
+
+      await searchPrincipals(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(500);
+      expect(res.json).toHaveBeenCalledWith({
+        error: 'Failed to search principals',
+      });
+    });
+  });
+
+  describe('getResourcePermissions — principal details', () => {
+    const currentTenantId = 'tenant-a';
+    const otherTenantId = 'tenant-b';
+    const userId = new mongoose.Types.ObjectId();
+    const groupId = new mongoose.Types.ObjectId();
+
+    it('omits joined user and group details outside the current request context', async () => {
+      mockGetTenantId.mockReturnValue(currentTenantId);
+      db.aggregateAclEntries.mockResolvedValue([
+        {
+          principalType: PrincipalType.USER,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          userInfo: {
+            _id: userId,
+            tenantId: otherTenantId,
+            name: 'Outside User',
+            email: 'outside-user@example.com',
+            avatar: 'outside-user.png',
+          },
+        },
+        {
+          principalType: PrincipalType.GROUP,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          groupInfo: {
+            _id: groupId,
+            tenantId: otherTenantId,
+            name: 'Outside Group',
+            email: 'outside-group@example.com',
+            avatar: 'outside-group.png',
+          },
+        },
+        {
+          principalType: PrincipalType.PUBLIC,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+        },
+      ]);
+
+      const req = createMockReq();
+      const res = createMockRes();
+
+      await getResourcePermissions(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith({
+        resourceType: ResourceType.AGENT,
+        resourceId: req.params.resourceId,
+        principals: [],
+        public: true,
+        publicAccessRoleId: AccessRoleIds.AGENT_VIEWER,
+      });
+      expect(JSON.stringify(res.json.mock.calls[0][0])).not.toContain('outside-user@example.com');
+      expect(JSON.stringify(res.json.mock.calls[0][0])).not.toContain('outside-group@example.com');
+    });
+
+    it('includes joined user and group details in the current request context', async () => {
+      mockGetTenantId.mockReturnValue(currentTenantId);
+      db.aggregateAclEntries.mockResolvedValue([
+        {
+          principalType: PrincipalType.USER,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          userInfo: {
+            _id: userId,
+            tenantId: currentTenantId,
+            name: 'Current User',
+            email: 'current-user@example.com',
+            avatar: 'current-user.png',
+          },
+        },
+        {
+          principalType: PrincipalType.GROUP,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          groupInfo: {
+            _id: groupId,
+            tenantId: currentTenantId,
+            name: 'Current Group',
+            email: 'current-group@example.com',
+            avatar: 'current-group.png',
+          },
+        },
+      ]);
+
+      const req = createMockReq();
+      const res = createMockRes();
+
+      await getResourcePermissions(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json.mock.calls[0][0].principals).toEqual([
+        expect.objectContaining({
+          type: PrincipalType.USER,
+          id: userId.toString(),
+          email: 'current-user@example.com',
+        }),
+        expect.objectContaining({
+          type: PrincipalType.GROUP,
+          id: groupId.toString(),
+          email: 'current-group@example.com',
+        }),
+      ]);
+    });
   });
 
   describe('updateResourcePermissions — favorites cleanup', () => {
diff --git a/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js b/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
index 2d23b4b02c3..c5457d468c7 100644
--- a/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
+++ b/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
@@ -10,6 +10,7 @@ const mockGetMCPServersRegistry = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn() },
+  getTenantId: jest.fn(),
   webSearchKeys: [],
 }));
 
@@ -22,7 +23,14 @@ jest.mock('librechat-data-provider', () => ({
 
 jest.mock('@librechat/api', () => ({
   MCPOAuthHandler: {
-    generateFlowId: jest.fn(() => 'user-1:test-server'),
+    generateFlowId: jest.fn((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    }),
+    generateTokenFlowId: jest.fn((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    }),
     revokeOAuthToken: jest.fn(),
   },
   MCPTokenStorage: {
@@ -67,7 +75,7 @@ jest.mock('~/server/services/Config/getCachedTools', () => ({
 }));
 
 jest.mock('~/server/services/Files/process', () => ({
-  processDeleteRequest: jest.fn(),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
 }));
 
 jest.mock('~/server/services/Config', () => ({
@@ -78,7 +86,7 @@ jest.mock('~/cache', () => ({
   getLogStores: (...args) => mockGetLogStores(...args),
 }));
 
-const { logger } = require('@librechat/data-schemas');
+const { logger, getTenantId } = require('@librechat/data-schemas');
 const { MCPTokenStorage, MCPOAuthHandler } = require('@librechat/api');
 const { updateUserPluginsController } = require('~/server/controllers/UserController');
 
@@ -124,7 +132,10 @@ function setupMCPMocks() {
     getAllowedAddresses: jest.fn().mockReturnValue(null),
   };
 
-  mockGetAppConfig.mockResolvedValue({});
+  // Revocation reads the merged config's mcpSettings allowlists (not the registry getters).
+  mockGetAppConfig.mockResolvedValue({
+    mcpSettings: { allowedDomains: [], allowedAddresses: null },
+  });
   mockUpdateUserPlugins.mockResolvedValue();
   mockDeleteUserPluginAuth.mockResolvedValue();
   mockInvalidateCachedTools.mockResolvedValue();
@@ -138,6 +149,7 @@ function setupMCPMocks() {
 
 beforeEach(() => {
   jest.clearAllMocks();
+  getTenantId.mockReturnValue(undefined);
 });
 
 describe('updateUserPluginsController MCP OAuth cleanup', () => {
@@ -231,6 +243,27 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
     expect(MCPOAuthHandler.revokeOAuthToken).not.toHaveBeenCalled();
   });
 
+  it('clears tenant-scoped and legacy OAuth flow state when tenant context exists', async () => {
+    const { flowManager } = setupMCPMocks();
+    getTenantId.mockReturnValue('tenant-a');
+    MCPTokenStorage.getClientInfoAndMetadata.mockResolvedValue(null);
+
+    const res = createResponse();
+    await updateUserPluginsController(createRequest(), res);
+
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith(
+      'tenant:tenant-a:user-1:test-server',
+      'mcp_get_tokens',
+    );
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith(
+      'tenant:tenant-a:user-1:test-server',
+      'mcp_oauth',
+    );
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith('user-1:test-server', 'mcp_get_tokens');
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith('user-1:test-server', 'mcp_oauth');
+  });
+
   it('clears stored OAuth token state when server config is missing', async () => {
     const { flowManager, registry } = setupMCPMocks();
     registry.getServerConfig.mockResolvedValue(undefined);
diff --git a/api/server/controllers/__tests__/deleteUser.spec.js b/api/server/controllers/__tests__/deleteUser.spec.js
index bc6acde53d7..6198122bd05 100644
--- a/api/server/controllers/__tests__/deleteUser.spec.js
+++ b/api/server/controllers/__tests__/deleteUser.spec.js
@@ -3,6 +3,7 @@ const mockDeleteMessages = jest.fn();
 const mockDeleteAllUserSessions = jest.fn();
 const mockDeleteUserById = jest.fn();
 const mockDeleteAllSharedLinks = jest.fn();
+const mockDeleteAllSharedLinksWithCleanup = jest.fn();
 const mockDeletePresets = jest.fn();
 const mockDeleteUserKey = jest.fn();
 const mockDeleteConvos = jest.fn();
@@ -38,6 +39,7 @@ jest.mock('@librechat/api', () => ({
   extractWebSearchEnvVars: jest.fn(),
   needsRefresh: jest.fn(),
   getNewS3URL: jest.fn(),
+  deleteAllSharedLinksWithCleanup: (...args) => mockDeleteAllSharedLinksWithCleanup(...args),
 }));
 
 jest.mock('~/models', () => ({
@@ -126,8 +128,9 @@ function stubDeletionMocks() {
   mockDeleteUserPluginAuth.mockResolvedValue();
   mockDeleteUserById.mockResolvedValue();
   mockDeleteAllSharedLinks.mockResolvedValue();
+  mockDeleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 0 });
   mockGetFiles.mockResolvedValue([]);
-  mockProcessDeleteRequest.mockResolvedValue();
+  mockProcessDeleteRequest.mockResolvedValue({ deletedFileIds: [], failedFileIds: [] });
   mockDeleteFiles.mockResolvedValue();
   mockDeleteToolCalls.mockResolvedValue();
   mockDeleteUserAgents.mockResolvedValue();
diff --git a/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js b/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
index 78fcfa16b0b..1bd5b2efaa5 100644
--- a/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
+++ b/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
@@ -16,6 +16,7 @@ const HANDLED_RESOURCE_TYPES = {
   [ResourceType.PROMPTGROUP]: 'deleteUserPrompts',
   [ResourceType.MCPSERVER]: 'deleteUserMcpServers',
   [ResourceType.SKILL]: 'deleteUserSkills',
+  [ResourceType.SHARED_LINK]: 'deleteAllSharedLinksWithCleanup',
 };
 
 /**
diff --git a/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js b/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
index 65b9cf75b21..1b8436233a5 100644
--- a/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
+++ b/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
@@ -13,9 +13,11 @@ const mockDeleteTokens = jest.fn();
 const mockLoggerInfo = jest.fn();
 const mockLoggerWarn = jest.fn();
 const mockLoggerError = jest.fn();
+const mockGetTenantId = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: { info: mockLoggerInfo, warn: mockLoggerWarn, error: mockLoggerError },
+  getTenantId: (...args) => mockGetTenantId(...args),
   webSearchKeys: [],
 }));
 
@@ -23,7 +25,14 @@ jest.mock('@librechat/api', () => {
   return {
     MCPOAuthHandler: {
       revokeOAuthToken: (...args) => mockRevokeOAuthToken(...args),
-      generateFlowId: (userId, serverName) => `${userId}:${serverName}`,
+      generateFlowId: (userId, serverName, tenantId) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+      generateTokenFlowId: (userId, serverName, tenantId) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
     },
     MCPTokenStorage: {
       getTokens: (...args) => mockGetTokens(...args),
@@ -81,7 +90,7 @@ jest.mock('~/server/services/Config/getCachedTools', () => ({
 }));
 
 jest.mock('~/server/services/Files/process', () => ({
-  processDeleteRequest: jest.fn(),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
 }));
 
 jest.mock('~/server/services/Config', () => ({
@@ -151,6 +160,7 @@ function setupOAuthServerFound() {
 describe('maybeUninstallOAuthMCP', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
   });
 
   test('is a no-op when pluginKey is not an MCP key', async () => {
@@ -205,6 +215,20 @@ describe('maybeUninstallOAuthMCP', () => {
     );
   });
 
+  test('clears tenant-scoped and legacy flow state when tenant context exists', async () => {
+    setupOAuthServerFound();
+    mockGetTenantId.mockReturnValue('tenant-a');
+    mockGetClientInfoAndMetadata.mockResolvedValue(null);
+
+    await maybeUninstallOAuthMCP(userId, pluginKey, appConfig);
+
+    expect(mockDeleteFlow).toHaveBeenCalledTimes(4);
+    expect(mockDeleteFlow).toHaveBeenCalledWith('tenant:tenant-a:user-123:acme', 'mcp_get_tokens');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('tenant:tenant-a:user-123:acme', 'mcp_oauth');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('user-123:acme', 'mcp_get_tokens');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('user-123:acme', 'mcp_oauth');
+  });
+
   test('revokes both tokens and runs cleanup on happy path', async () => {
     setupOAuthServerFound();
     mockGetTokens.mockResolvedValue({
diff --git a/api/server/controllers/agents/__tests__/callbacks.spec.js b/api/server/controllers/agents/__tests__/callbacks.spec.js
index 0ba20d409cd..20fcf54a6cd 100644
--- a/api/server/controllers/agents/__tests__/callbacks.spec.js
+++ b/api/server/controllers/agents/__tests__/callbacks.spec.js
@@ -7,6 +7,10 @@ jest.mock('nanoid', () => ({
 
 jest.mock('@librechat/api', () => ({
   sendEvent: jest.fn(),
+  HOST_FILE_AUTHORING_ARTIFACT_KEY: '__librechat_file_authoring',
+  isCodeSessionToolName: jest.fn((name) =>
+    ['execute_code', 'bash_tool', 'read_file'].includes(name),
+  ),
 }));
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -364,12 +368,21 @@ describe('createToolEndCallback', () => {
 
     const { processCodeOutput } = require('~/server/services/Files/Code/process');
 
-    function makeCodeExecutionEvent({ runId, threadId, toolCallId, fileId, name }) {
+    function makeCodeExecutionEvent({
+      runId,
+      threadId,
+      toolCallId,
+      fileId,
+      name,
+      toolName = 'execute_code',
+      hostFileAuthoring = false,
+    }) {
       return {
         output: {
-          name: 'execute_code',
+          name: toolName,
           tool_call_id: toolCallId,
           artifact: {
+            ...(hostFileAuthoring ? { __librechat_file_authoring: true } : {}),
             session_id: 'sess-1',
             files: [{ id: fileId, name, session_id: 'sess-1' }],
           },
@@ -573,6 +586,65 @@ describe('createToolEndCallback', () => {
 
       expect(res.write).toHaveBeenCalledTimes(1);
     });
+
+    it('processes create_file sandbox artifacts like code execution outputs', async () => {
+      res.headersSent = true;
+      processCodeOutput.mockResolvedValue({
+        file: {
+          file_id: 'fid-created',
+          filename: 'created.txt',
+          filepath: '/uploads/created.txt',
+          type: 'text/plain',
+          conversationId: 'thread789',
+          messageId: 'run-create',
+          toolCallId: 'tool-create',
+          status: 'ready',
+        },
+      });
+
+      const toolEndCallback = createToolEndCallback({ req, res, artifactPromises });
+      const event = makeCodeExecutionEvent({
+        runId: 'run-create',
+        threadId: 'thread789',
+        toolCallId: 'tool-create',
+        fileId: 'fid-created',
+        name: 'created.txt',
+        toolName: 'create_file',
+        hostFileAuthoring: true,
+      });
+      await toolEndCallback({ output: event.output }, event.metadata);
+      await Promise.all(artifactPromises);
+
+      expect(processCodeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: 'fid-created',
+          name: 'created.txt',
+          messageId: 'run-create',
+          toolCallId: 'tool-create',
+          conversationId: 'thread789',
+        }),
+      );
+      expect(res.write).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not process arbitrary user tool artifacts named create_file as code outputs', async () => {
+      res.headersSent = true;
+      const toolEndCallback = createToolEndCallback({ req, res, artifactPromises });
+      const event = makeCodeExecutionEvent({
+        runId: 'run-user-create',
+        threadId: 'thread789',
+        toolCallId: 'tool-user-create',
+        fileId: 'fid-user-created',
+        name: 'created.txt',
+        toolName: 'create_file',
+      });
+
+      await toolEndCallback({ output: event.output }, event.metadata);
+      await Promise.all(artifactPromises);
+
+      expect(processCodeOutput).not.toHaveBeenCalled();
+      expect(res.write).not.toHaveBeenCalled();
+    });
   });
 });
 
diff --git a/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js b/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js
new file mode 100644
index 00000000000..6df38efb6c5
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js
@@ -0,0 +1,139 @@
+const AgentClient = require('../client');
+
+/** Minimal post-(maybe-)summary snapshot. baseUsed = maxContextTokens(1000) -
+ *  remainingContextTokens(700) = 300, so the marker (summaryUsedTokens) is 300. */
+const snapshot = (summaryTokens) => ({
+  runId: 'run-1',
+  agentId: 'agent-1',
+  breakdown: {
+    maxContextTokens: 1000,
+    instructionTokens: 50,
+    systemMessageTokens: 50,
+    dynamicInstructionTokens: 0,
+    toolSchemaTokens: 0,
+    summaryTokens,
+    toolCount: 0,
+    messageCount: 1,
+    messageTokens: 20,
+    availableForMessages: 900,
+  },
+  contextBudget: 1000,
+  remainingContextTokens: 700,
+  prePruneContextTokens: 300,
+  effectiveInstructionTokens: 50,
+  calibrationRatio: 1,
+});
+
+const primary = { input_tokens: 10, output_tokens: 5, total_tokens: 15 };
+const summarizationUsage = { ...primary, usage_type: 'summarization' };
+const primaryFor = (runId, output_tokens) => ({
+  input_tokens: 10,
+  output_tokens,
+  total_tokens: 10 + output_tokens,
+  provider: 'openAI',
+  runId,
+});
+
+function buildMeta({ snap, latestUsageIndex, usageEvents }) {
+  const self = {
+    collectedThoughtSignatures: null,
+    usageEmitSink: usageEvents,
+    contextUsageSink: snap
+      ? { latest: snap, count: 1, latestUsageIndex }
+      : { latest: null, count: 0 },
+  };
+  return AgentClient.prototype.buildResponseMetadata.call(self);
+}
+
+describe('AgentClient.buildResponseMetadata — snapshot persistence + summary marker', () => {
+  it('persists the snapshot when a primary usage follows it (normal turn)', () => {
+    const meta = buildMeta({ snap: snapshot(0), latestUsageIndex: 0, usageEvents: [primary] });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.summaryUsedTokens).toBeUndefined();
+  });
+
+  it('persists the post-summary snapshot when the only pre-primary usage is the summarization', () => {
+    /** A summarized turn: the summarization usage precedes the post-summary
+     *  snapshot (index 1), then the model's primary usage follows it. The old
+     *  count guard miscounted and dropped this; the new guard keeps it. The
+     *  marker subtracts the summarization output (5): the generated summary is in
+     *  the snapshot baseline (summaryTokens) AND the response tokenCount, so
+     *  300 − 5 = 295 keeps the client estimate from counting it twice. */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [summarizationUsage, primary],
+    });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.summaryUsedTokens).toBe(295);
+  });
+
+  it('still emits the summary marker when the final call emitted no usage', () => {
+    /** Interrupted summarized turn: no primary usage follows the latest snapshot,
+     *  so the snapshot is (correctly) not persisted — but the coarse marker
+     *  survives so the client estimate still caps the discarded history. The
+     *  summarization output (5) is subtracted (300 − 5 = 295). */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [summarizationUsage],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBe(295);
+  });
+
+  it('drops the snapshot and emits no marker when the final call had no usage and no summary', () => {
+    const meta = buildMeta({ snap: snapshot(0), latestUsageIndex: 1, usageEvents: [primary] });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBeUndefined();
+  });
+
+  it('does not persist the snapshot when only a parallel run produced post-snapshot usage', () => {
+    /** A snapshot (run-1) → B snapshot (run-1 is latest) but the only following
+     *  usage belongs to a sibling run (run-2). The guard must NOT persist run-1's
+     *  snapshot with run-2's output — it falls back to the per-message estimate. */
+    const meta = buildMeta({
+      snap: snapshot(0),
+      latestUsageIndex: 0,
+      usageEvents: [primaryFor('run-2', 99)],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+  });
+
+  it('persists with the snapshot run output when its own primary usage follows', () => {
+    const meta = buildMeta({
+      snap: snapshot(0),
+      latestUsageIndex: 0,
+      usageEvents: [primaryFor('run-2', 99), primaryFor('run-1', 7)],
+    });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.contextUsage.completedOutputTokens).toBe(7);
+  });
+
+  it('subtracts earlier tool-loop output from the summary marker (interrupted turn)', () => {
+    /** Multi-call summarized turn stopped before the final usage: the earlier
+     *  call (output 40) is baked into baseUsed (300), so the marker is 300 − 40 =
+     *  260. No primary follows the snapshot, so the full snapshot is not persisted
+     *  and the client uses this marker — which must not double-count the 40 that
+     *  the response tokenCount also carries. */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [primaryFor('run-1', 40)],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBe(260);
+  });
+
+  it('subtracts only this run’s earlier output, not a parallel run’s', () => {
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 2,
+      usageEvents: [primaryFor('run-2', 999), primaryFor('run-1', 40), primaryFor('run-1', 5)],
+    });
+    /** baseUsed 300 − run-1's earlier 40 = 260; run-2's 999 is ignored. */
+    expect(meta.summaryUsedTokens).toBe(260);
+    /** run-1's own primary follows the snapshot → snapshot persisted with output 5. */
+    expect(meta.contextUsage.completedOutputTokens).toBe(5);
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/jobReplacement.spec.js b/api/server/controllers/agents/__tests__/jobReplacement.spec.js
index efa79ca4ba2..7f7a775b75b 100644
--- a/api/server/controllers/agents/__tests__/jobReplacement.spec.js
+++ b/api/server/controllers/agents/__tests__/jobReplacement.spec.js
@@ -35,6 +35,15 @@ jest.mock('@librechat/data-schemas', () => ({
 jest.mock('@librechat/api', () => ({
   isEnabled: jest.fn().mockReturnValue(false),
   GenerationJobManager: mockGenerationJobManager,
+  getReferencedQuotes: jest.fn((quotes) => {
+    if (!Array.isArray(quotes)) {
+      return null;
+    }
+    const normalized = quotes
+      .filter((quote) => typeof quote === 'string' && quote.trim().length > 0)
+      .map((quote) => quote.trim());
+    return normalized.length > 0 ? normalized : null;
+  }),
   checkAndIncrementPendingRequest: jest.fn().mockResolvedValue({ allowed: true }),
   decrementPendingRequest: (...args) => mockDecrementPendingRequest(...args),
   getViolationInfo: jest.fn(),
diff --git a/api/server/controllers/agents/__tests__/modelEndHandler.spec.js b/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
index fdd2c88b6c8..07c55e7a547 100644
--- a/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
+++ b/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
@@ -150,6 +150,45 @@ describe('ModelEndHandler — Vertex thoughtSignature capture (issue #13006 foll
     expect(collectedThoughtSignatures).toEqual({});
   });
 
+  it('tags the producing agent on collected + emitted usage for per-endpoint pricing', async () => {
+    const collectedUsage = [];
+    const emitUsage = jest.fn();
+    const handler = new ModelEndHandler(collectedUsage, null, emitUsage);
+    const graph = {
+      getAgentContext: () => ({
+        provider: 'openai',
+        agentId: 'agent_sub',
+        clientOptions: { model: 'gpt-4' },
+      }),
+    };
+
+    await handler.handle(
+      'on_chat_model_end',
+      { output: { usage_metadata: { input_tokens: 10, output_tokens: 5, total_tokens: 15 } } },
+      { ls_model_name: 'gpt-4', run_id: 'r1', user_id: 'u1' },
+      graph,
+    );
+
+    expect(collectedUsage[0].agentId).toBe('agent_sub');
+    expect(emitUsage).toHaveBeenCalledWith(expect.objectContaining({ agentId: 'agent_sub' }));
+  });
+
+  it('leaves usage untagged when the graph context has no agentId (single-endpoint)', async () => {
+    const collectedUsage = [];
+    const emitUsage = jest.fn();
+    const handler = new ModelEndHandler(collectedUsage, null, emitUsage);
+
+    await handler.handle(
+      'on_chat_model_end',
+      { output: { usage_metadata: { input_tokens: 10, output_tokens: 5, total_tokens: 15 } } },
+      { ls_model_name: 'gemini-3.1-flash-lite-preview', run_id: 'r1', user_id: 'u1' },
+      buildGraph(),
+    );
+
+    expect(collectedUsage[0].agentId).toBeUndefined();
+    expect(emitUsage).toHaveBeenCalledWith(expect.objectContaining({ agentId: undefined }));
+  });
+
   it('throws when collectedUsage is not an array (existing contract)', () => {
     expect(() => new ModelEndHandler(null)).toThrow('collectedUsage must be an array');
   });
diff --git a/api/server/controllers/agents/__tests__/openai.spec.js b/api/server/controllers/agents/__tests__/openai.spec.js
index 7638fc2e35d..8b6910fe35b 100644
--- a/api/server/controllers/agents/__tests__/openai.spec.js
+++ b/api/server/controllers/agents/__tests__/openai.spec.js
@@ -11,6 +11,50 @@ const mockRecordCollectedUsage = jest
   .mockResolvedValue({ input_tokens: 100, output_tokens: 50 });
 const mockGetBalanceConfig = jest.fn().mockReturnValue({ enabled: true });
 const mockGetTransactionsConfig = jest.fn().mockReturnValue({ enabled: true });
+const mockBuildSkillPrimedIdsByName = jest.fn((manualSkillPrimes, alwaysApplySkillPrimes) => {
+  const primed = {};
+  for (const skill of alwaysApplySkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  for (const skill of manualSkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  return Object.keys(primed).length > 0 ? primed : undefined;
+});
+const mockEnrichWithSkillConfigurable = jest.fn((result) => result);
+const mockBuildAgentToolContext = jest.fn(({ agent, config }) => ({
+  agent,
+  toolRegistry: config.toolRegistry,
+  userMCPAuthMap: config.userMCPAuthMap,
+  tool_resources: config.tool_resources,
+  actionsEnabled: config.actionsEnabled,
+  accessibleSkillIds: config.accessibleSkillIds,
+  activeSkillNames: config.activeSkillNames,
+  codeEnvAvailable: config.codeEnvAvailable,
+  skillAuthoringAvailable: config.skillAuthoringAvailable,
+  fileAuthoringToolNames: config.fileAuthoringToolNames,
+  skillPrimedIdsByName:
+    mockBuildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+}));
+const mockEnrichLoadedToolsWithAgentContext = jest.fn(({ result, req, ctx }) =>
+  mockEnrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      accessibleSkillIds: ctx.accessibleSkillIds,
+      codeEnvAvailable: ctx.codeEnvAvailable === true,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames,
+      skillAuthoringAvailable: ctx.skillAuthoringAvailable === true,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames,
+    },
+  }),
+);
+const mockCanAuthorSkillFiles = jest.fn(
+  ({ scopedEditableSkillIds = [], skillCreateAllowed }) =>
+    scopedEditableSkillIds.length > 0 || skillCreateAllowed === true,
+);
+const mockGetSkillToolDeps = jest.fn(() => ({}));
 
 jest.mock('nanoid', () => ({
   nanoid: jest.fn(() => 'mock-nanoid-123'),
@@ -61,6 +105,7 @@ jest.mock('@librechat/api', () => ({
   createErrorResponse: jest.fn(),
   getTransactionsConfig: mockGetTransactionsConfig,
   recordCollectedUsage: mockRecordCollectedUsage,
+  createSubagentUsageSink: jest.fn().mockReturnValue(jest.fn()),
   extractManualSkills: jest.fn().mockReturnValue(undefined),
   injectSkillPrimes: jest.fn().mockReturnValue({
     initialMessages: [],
@@ -88,6 +133,7 @@ jest.mock('@librechat/api', () => ({
   resolveRecursionLimit: jest.fn().mockReturnValue(50),
   createToolExecuteHandler: jest.fn().mockReturnValue({ handle: jest.fn() }),
   isChatCompletionValidationFailure: jest.fn().mockReturnValue(false),
+  findPiiMatchInMessages: jest.fn().mockReturnValue(null),
   discoverConnectedAgents: jest.fn().mockResolvedValue({
     agentConfigs: new Map(),
     edges: [],
@@ -104,6 +150,17 @@ jest.mock('~/server/services/Files/permissions', () => ({
   filterFilesByAgentAccess: jest.fn(),
 }));
 
+jest.mock('~/server/services/Endpoints/agents/skillDeps', () => ({
+  getSkillToolDeps: mockGetSkillToolDeps,
+  getSkillDbMethods: jest.fn(() => ({})),
+  canAuthorSkillFiles: mockCanAuthorSkillFiles,
+  withDeploymentSkillIds: jest.fn((ids = []) => ids),
+  enrichWithSkillConfigurable: mockEnrichWithSkillConfigurable,
+  buildSkillPrimedIdsByName: mockBuildSkillPrimedIdsByName,
+  buildAgentToolContext: mockBuildAgentToolContext,
+  enrichLoadedToolsWithAgentContext: mockEnrichLoadedToolsWithAgentContext,
+}));
+
 jest.mock('~/cache', () => ({
   logViolation: jest.fn(),
 }));
@@ -368,4 +425,87 @@ describe('OpenAIChatCompletionController', () => {
       expect(resolveRecursionLimit).toHaveBeenCalledWith(req.config.endpoints.agents, mockAgent);
     });
   });
+
+  describe('sub-agent skill priming', () => {
+    it('passes the sub-agent primed skill IDs into tool execution', async () => {
+      const {
+        initializeAgent,
+        discoverConnectedAgents,
+        createToolExecuteHandler,
+      } = require('@librechat/api');
+      const { loadToolsForExecution } = require('~/server/services/ToolService');
+      const subAgent = { id: 'agent-sub', name: 'Sub Agent' };
+      const subConfig = {
+        id: 'agent-sub',
+        model: 'gpt-4',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        userMCPAuthMap: { sub: { token: 'sub-token' } },
+        tool_resources: { code_interpreter: { file_ids: ['sub-file'] } },
+        actionsEnabled: true,
+        accessibleSkillIds: ['sub-skill-id'],
+        activeSkillNames: ['sub-hidden-skill'],
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: ['create_file', 'edit_file'],
+        manualSkillPrimes: [{ name: 'sub-hidden-skill', _id: { toString: () => 'sub-manual-id' } }],
+        alwaysApplySkillPrimes: [
+          { name: 'sub-always-skill', _id: { toString: () => 'sub-always-id' } },
+        ],
+      };
+
+      initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'gpt-4',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        edges: [{ source: 'agent-123', target: 'agent-sub' }],
+        accessibleSkillIds: ['primary-skill-id'],
+        activeSkillNames: ['primary-skill'],
+        codeEnvAvailable: false,
+        skillAuthoringAvailable: false,
+        fileAuthoringToolNames: [],
+        manualSkillPrimes: [{ name: 'primary-skill', _id: { toString: () => 'primary-skill-id' } }],
+      });
+      discoverConnectedAgents.mockImplementationOnce(async (_params, deps) => {
+        deps.onAgentInitialized('agent-sub', subAgent, subConfig);
+        return {
+          agentConfigs: new Map([['agent-sub', subConfig]]),
+          edges: [],
+          skippedAgentIds: new Set(),
+          userMCPAuthMap: undefined,
+        };
+      });
+
+      await OpenAIChatCompletionController(req, res);
+
+      const toolExecuteOptions = createToolExecuteHandler.mock.calls.at(-1)[0];
+      await toolExecuteOptions.loadTools(['read_file'], 'agent-sub');
+
+      expect(loadToolsForExecution).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          agent: subAgent,
+          toolRegistry: subConfig.toolRegistry,
+          userMCPAuthMap: subConfig.userMCPAuthMap,
+          tool_resources: subConfig.tool_resources,
+          actionsEnabled: true,
+        }),
+      );
+      expect(mockEnrichWithSkillConfigurable).toHaveBeenLastCalledWith({
+        result: expect.anything(),
+        context: {
+          req,
+          accessibleSkillIds: ['sub-skill-id'],
+          codeEnvAvailable: true,
+          skillPrimedIdsByName: {
+            'sub-always-skill': 'sub-always-id',
+            'sub-hidden-skill': 'sub-manual-id',
+          },
+          activeSkillNames: ['sub-hidden-skill'],
+          skillAuthoringAvailable: true,
+          fileAuthoringToolNames: ['create_file', 'edit_file'],
+        },
+      });
+    });
+  });
 });
diff --git a/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js b/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js
new file mode 100644
index 00000000000..8024b8d4086
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js
@@ -0,0 +1,621 @@
+const { EventEmitter } = require('events');
+
+const mockLogger = {
+  debug: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  info: jest.fn(),
+};
+
+const mockGenerationJobManager = {
+  createJob: jest.fn(),
+  emitError: jest.fn(),
+  completeJob: jest.fn(),
+  getResumeState: jest.fn(),
+  updateMetadata: jest.fn(),
+};
+
+const mockCheckAndIncrementPendingRequest = jest.fn();
+const mockDecrementPendingRequest = jest.fn();
+const mockFilterPersistableAbortContent = jest.fn((content) =>
+  content.filter((part) => part?.type !== 'tool_call'),
+);
+const mockGetConvo = jest.fn();
+const mockGetMessages = jest.fn();
+const mockSaveMessage = jest.fn();
+let mockMCPContexts = new WeakMap();
+
+const mockCreateMCPRequestContext = jest.fn(() => ({
+  connections: new Map(),
+  pending: new Map(),
+  cleanupStarted: false,
+  cleanupOnResponse: false,
+  responseCleanupAttached: false,
+}));
+const mockGetMCPRequestContext = jest.fn((req) => {
+  if (!req) {
+    return undefined;
+  }
+
+  let context = mockMCPContexts.get(req);
+  if (!context) {
+    context = mockCreateMCPRequestContext();
+    mockMCPContexts.set(req, context);
+  }
+
+  return context.cleanupStarted ? undefined : context;
+});
+const mockCleanupMCPRequestContext = jest.fn(async (context) => {
+  if (!context || context.cleanupStarted) {
+    return;
+  }
+
+  context.cleanupStarted = true;
+  const connections = new Set(context.connections.values());
+  const settled = await Promise.allSettled(context.pending.values());
+  for (const result of settled) {
+    if (result.status === 'fulfilled' && result.value) {
+      connections.add(result.value);
+    }
+  }
+
+  await Promise.allSettled(Array.from(connections).map((connection) => connection.disconnect?.()));
+  context.connections.clear();
+  context.pending.clear();
+});
+const mockCleanupMCPRequestContextForReq = jest.fn(async (req) => {
+  const context = mockMCPContexts.get(req);
+  if (!context) {
+    return;
+  }
+
+  try {
+    await mockCleanupMCPRequestContext(context);
+  } finally {
+    mockMCPContexts.delete(req);
+  }
+});
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: mockLogger,
+}));
+
+jest.mock('@librechat/api', () => ({
+  sendEvent: jest.fn(),
+  getViolationInfo: jest.fn(),
+  buildMessageFiles: jest.fn(() => []),
+  resolveTitleTiming: jest.fn(() => 'immediate'),
+  GenerationJobManager: mockGenerationJobManager,
+  getReferencedQuotes: jest.fn((quotes) => {
+    if (!Array.isArray(quotes)) {
+      return null;
+    }
+    const normalized = quotes
+      .filter((quote) => typeof quote === 'string' && quote.trim().length > 0)
+      .map((quote) => quote.trim());
+    return normalized.length > 0 ? normalized : null;
+  }),
+  cleanupMCPRequestContext: (...args) => mockCleanupMCPRequestContext(...args),
+  createMCPRequestContext: (...args) => mockCreateMCPRequestContext(...args),
+  getMCPRequestContext: (...args) => mockGetMCPRequestContext(...args),
+  filterPersistableAbortContent: (...args) => mockFilterPersistableAbortContent(...args),
+  cleanupMCPRequestContextForReq: (...args) => mockCleanupMCPRequestContextForReq(...args),
+  decrementPendingRequest: (...args) => mockDecrementPendingRequest(...args),
+  sanitizeMessageForTransmit: jest.fn((message) => message),
+  checkAndIncrementPendingRequest: (...args) => mockCheckAndIncrementPendingRequest(...args),
+  isUnpersistedPreliminaryParent: async ({
+    userId,
+    conversationId,
+    parentMessageId,
+    getMessages,
+  }) => {
+    if (typeof parentMessageId !== 'string' || !parentMessageId.endsWith('_')) {
+      return false;
+    }
+
+    const filter = { user: userId, messageId: parentMessageId };
+    if (conversationId && conversationId !== 'new') {
+      filter.conversationId = conversationId;
+    }
+
+    const messages = await getMessages(filter, '_id');
+    return messages.length === 0;
+  },
+}));
+
+jest.mock('~/server/cleanup', () => ({
+  disposeClient: jest.fn(),
+  clientRegistry: null,
+  requestDataMap: {
+    set: jest.fn(),
+  },
+}));
+
+jest.mock('~/server/middleware', () => ({
+  handleAbortError: jest.fn(() => Promise.resolve()),
+}));
+
+jest.mock('~/cache', () => ({
+  logViolation: jest.fn(),
+}));
+
+jest.mock('~/models', () => ({
+  saveMessage: (...args) => mockSaveMessage(...args),
+  getMessages: (...args) => mockGetMessages(...args),
+  getConvo: (...args) => mockGetConvo(...args),
+}));
+
+const AgentController = require('../request');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
+
+function createResumableResponse() {
+  const res = new EventEmitter();
+  res.headersSent = false;
+  res.writableEnded = false;
+  res.finished = false;
+  res.destroyed = false;
+  res.json = jest.fn(() => {
+    res.headersSent = true;
+    res.writableEnded = true;
+    res.finished = true;
+    res.emit('finish');
+    return res;
+  });
+  res.status = jest.fn(() => res);
+  return res;
+}
+
+function nextTick() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('ResumableAgentController resume metadata', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockMCPContexts = new WeakMap();
+    mockCheckAndIncrementPendingRequest.mockResolvedValue({ allowed: true });
+    mockDecrementPendingRequest.mockResolvedValue(undefined);
+    mockGetConvo.mockResolvedValue({ createdAt: '2026-06-07T00:00:00.000Z' });
+    mockGetMessages.mockResolvedValue([]);
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: { on: jest.fn() },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue(null);
+    mockGenerationJobManager.updateMetadata.mockResolvedValue(undefined);
+    mockGenerationJobManager.emitError.mockResolvedValue(undefined);
+    mockSaveMessage.mockResolvedValue({});
+  });
+
+  it('rejects an underscore-suffixed parent that is not persisted', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn();
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Follow up too early.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'pending-response_',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      json: jest.fn(),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGetMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'pending-response_', conversationId },
+      '_id',
+    );
+    expect(res.status).toHaveBeenCalledWith(409);
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        error: expect.stringContaining('selected parent response is still being saved'),
+      }),
+    );
+    expect(mockCheckAndIncrementPendingRequest).not.toHaveBeenCalled();
+    expect(mockGenerationJobManager.createJob).not.toHaveBeenCalled();
+    expect(initializeClient).not.toHaveBeenCalled();
+  });
+
+  it('allows an underscore-suffixed parent when it is already persisted', async () => {
+    const conversationId = 'conversation-123';
+    mockGetMessages.mockResolvedValue([{ _id: 'persisted-parent' }]);
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Follow up to persisted underscore id.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'persisted-response_',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGetMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'persisted-response_', conversationId },
+      '_id',
+    );
+    expect(res.status).not.toHaveBeenCalledWith(409);
+    expect(mockCheckAndIncrementPendingRequest).toHaveBeenCalledWith('user-123');
+    expect(mockGenerationJobManager.createJob).toHaveBeenCalledWith(
+      conversationId,
+      'user-123',
+      conversationId,
+    );
+  });
+
+  it('stores the in-flight turn before MCP initialization can emit OAuth', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Check Google Workspace availability.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          iconURL: 'https://example.com/spec-icon.png',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        conversationId,
+        endpoint: 'agents',
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-3.5-turbo',
+        responseMessageId: 'follow-up-user_',
+        userMessage: {
+          messageId: 'follow-up-user',
+          parentMessageId: 'original-response',
+          conversationId,
+          text: 'Check Google Workspace availability.',
+        },
+      }),
+    );
+    expect(mockGenerationJobManager.updateMetadata.mock.invocationCallOrder[0]).toBeLessThan(
+      initializeClient.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('keeps request-scoped MCP connections until resumable initialization finishes', async () => {
+    const conversationId = 'conversation-123';
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const initializeClient = jest.fn(async ({ req, res }) => {
+      const context = getMCPRequestContext(req, res);
+      context.connections.set('mcp-server', { disconnect });
+
+      await nextTick();
+      expect(disconnect).not.toHaveBeenCalled();
+
+      throw new Error('stop after request-scoped MCP connection');
+    });
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use a BODY-scoped MCP server.',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-4.1' },
+        },
+      },
+      config: {},
+    };
+    const res = createResumableResponse();
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(res.json).toHaveBeenCalledWith({
+      streamId: conversationId,
+      conversationId,
+      status: 'started',
+    });
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(disconnect.mock.invocationCallOrder[0]).toBeLessThan(
+      mockDecrementPendingRequest.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('stores model spec icon fallbacks and agent ids in early resume metadata', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use the resume spec.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'agent-spec',
+          agent_id: 'agent_resume_spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'agent-spec',
+              preset: {
+                endpoint: 'openAI',
+                iconURL: 'https://example.com/preset-icon.png',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        iconURL: 'https://example.com/preset-icon.png',
+        model: 'agent_resume_spec',
+      }),
+    );
+  });
+
+  it('falls back to the model spec preset endpoint when no icon URL is configured', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use the endpoint icon.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'endpoint-icon-spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'endpoint-icon-spec',
+              preset: {
+                endpoint: 'anthropic',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        iconURL: 'anthropic',
+        model: 'gpt-4.1',
+      }),
+    );
+  });
+
+  it('filters OAuth prompts before saving partial responses on disconnect', async () => {
+    const conversationId = 'conversation-123';
+    let allSubscribersLeftHandler;
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: {
+        on: jest.fn((event, handler) => {
+          if (event === 'allSubscribersLeft') {
+            allSubscribersLeftHandler = handler;
+          }
+        }),
+      },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue({
+      conversationId,
+      responseMessageId: 'response-message',
+      iconURL: 'https://example.com/spec-icon.png',
+      model: 'gpt-4.1',
+      userMessage: {
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        text: 'Use Google Workspace',
+      },
+    });
+
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop after setup'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use Google Workspace',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          iconURL: 'https://example.com/fallback-icon.png',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+    expect(allSubscribersLeftHandler).toEqual(expect.any(Function));
+
+    const oauthPart = {
+      type: 'tool_call',
+      tool_call: {
+        name: 'oauth_mcp_Google-Workspace',
+        auth: 'https://auth.example.com/oauth',
+      },
+    };
+    const textPart = { type: 'text', text: 'Partial response...' };
+
+    await allSubscribersLeftHandler([oauthPart, textPart]);
+
+    expect(mockFilterPersistableAbortContent).toHaveBeenCalledWith([oauthPart, textPart]);
+    expect(mockSaveMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-123' }),
+      expect.objectContaining({
+        content: [textPart],
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+        messageId: 'response-message',
+        parentMessageId: 'user-message',
+      }),
+      expect.any(Object),
+    );
+  });
+
+  it('uses model spec and agent fallbacks when saving partial responses on disconnect', async () => {
+    const conversationId = 'conversation-123';
+    let allSubscribersLeftHandler;
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: {
+        on: jest.fn((event, handler) => {
+          if (event === 'allSubscribersLeft') {
+            allSubscribersLeftHandler = handler;
+          }
+        }),
+      },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue({
+      conversationId,
+      responseMessageId: 'response-message',
+      userMessage: {
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        text: 'Use fallback metadata',
+      },
+    });
+
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop after setup'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use fallback metadata',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'agent-spec',
+          agent_id: 'agent_resume_spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'agent-spec',
+              preset: {
+                endpoint: 'openAI',
+                iconURL: 'https://example.com/preset-icon.png',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+    expect(allSubscribersLeftHandler).toEqual(expect.any(Function));
+
+    const textPart = { type: 'text', text: 'Partial response...' };
+    await allSubscribersLeftHandler([textPart]);
+
+    expect(mockSaveMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-123' }),
+      expect.objectContaining({
+        content: [textPart],
+        iconURL: 'https://example.com/preset-icon.png',
+        model: 'agent_resume_spec',
+        messageId: 'response-message',
+        parentMessageId: 'user-message',
+      }),
+      expect.any(Object),
+    );
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/responses.unit.spec.js b/api/server/controllers/agents/__tests__/responses.unit.spec.js
index e5569fbbf57..4bc6d19e7e5 100644
--- a/api/server/controllers/agents/__tests__/responses.unit.spec.js
+++ b/api/server/controllers/agents/__tests__/responses.unit.spec.js
@@ -10,6 +10,53 @@ const mockRecordCollectedUsage = jest
   .mockResolvedValue({ input_tokens: 100, output_tokens: 50 });
 const mockGetBalanceConfig = jest.fn().mockReturnValue({ enabled: true });
 const mockGetTransactionsConfig = jest.fn().mockReturnValue({ enabled: true });
+const mockBuildSkillPrimedIdsByName = jest.fn((manualSkillPrimes, alwaysApplySkillPrimes) => {
+  const primed = {};
+  for (const skill of alwaysApplySkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  for (const skill of manualSkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  return Object.keys(primed).length > 0 ? primed : undefined;
+});
+const mockEnrichWithSkillConfigurable = jest.fn((result) => result);
+const mockBuildAgentToolContext = jest.fn(({ agent, config }) => ({
+  agent,
+  toolRegistry: config.toolRegistry,
+  userMCPAuthMap: config.userMCPAuthMap,
+  tool_resources: config.tool_resources,
+  actionsEnabled: config.actionsEnabled,
+  accessibleSkillIds: config.accessibleSkillIds,
+  activeSkillNames: config.activeSkillNames,
+  codeEnvAvailable: config.codeEnvAvailable,
+  skillAuthoringAvailable: config.skillAuthoringAvailable,
+  fileAuthoringToolNames: config.fileAuthoringToolNames,
+  skillPrimedIdsByName:
+    mockBuildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+}));
+const mockEnrichLoadedToolsWithAgentContext = jest.fn(({ result, req, ctx }) =>
+  mockEnrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      accessibleSkillIds: ctx.accessibleSkillIds,
+      codeEnvAvailable: ctx.codeEnvAvailable === true,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames,
+      skillAuthoringAvailable: ctx.skillAuthoringAvailable === true,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames,
+    },
+  }),
+);
+const mockCanAuthorSkillFiles = jest.fn(
+  ({ scopedEditableSkillIds = [], skillCreateAllowed }) =>
+    scopedEditableSkillIds.length > 0 || skillCreateAllowed === true,
+);
+const mockGetSkillToolDeps = jest.fn(() => ({}));
+const mockBuildAgentScopedContext = jest.fn().mockResolvedValue(new Map());
+const mockBuildAgentContextAttachmentsByAgentId = jest.fn().mockReturnValue(new Map());
+const mockApplyContextToAgent = jest.fn().mockResolvedValue(undefined);
 
 jest.mock('nanoid', () => ({
   nanoid: jest.fn(() => 'mock-nanoid-123'),
@@ -40,7 +87,11 @@ jest.mock('@librechat/api', () => ({
   createRun: jest.fn().mockResolvedValue({
     processStream: jest.fn().mockResolvedValue(undefined),
   }),
+  applyContextToAgent: (...args) => mockApplyContextToAgent(...args),
   buildToolSet: jest.fn().mockReturnValue(new Set()),
+  buildAgentScopedContext: (...args) => mockBuildAgentScopedContext(...args),
+  buildAgentContextAttachmentsByAgentId: (...args) =>
+    mockBuildAgentContextAttachmentsByAgentId(...args),
   scopeSkillIds: jest.fn().mockImplementation((ids) => ids),
   resolveAgentScopedSkillIds: jest
     .fn()
@@ -53,16 +104,26 @@ jest.mock('@librechat/api', () => ({
     model_parameters: {},
     toolRegistry: {},
     edges: [],
+    agentContextAttachments: [],
   }),
-  discoverConnectedAgents: jest.fn().mockResolvedValue({
-    agentConfigs: new Map(),
-    edges: [],
-    skippedAgentIds: new Set(),
-    userMCPAuthMap: undefined,
+  discoverConnectedAgents: jest.fn().mockImplementation(async (computedParams, deps) => {
+    // Call onAgentInitialized for each agent config if provided by the mock setup
+    if (deps?.onAgentInitialized && mockGlobalDiscoveredAgentConfigs) {
+      for (const [agentId, config] of mockGlobalDiscoveredAgentConfigs) {
+        deps.onAgentInitialized(agentId, config, config);
+      }
+    }
+    return {
+      agentConfigs: mockGlobalDiscoveredAgentConfigs ?? new Map(),
+      edges: [],
+      skippedAgentIds: new Set(),
+      userMCPAuthMap: undefined,
+    };
   }),
   getBalanceConfig: mockGetBalanceConfig,
   getTransactionsConfig: mockGetTransactionsConfig,
   recordCollectedUsage: mockRecordCollectedUsage,
+  createSubagentUsageSink: jest.fn().mockReturnValue(jest.fn()),
   extractManualSkills: jest.fn().mockReturnValue(undefined),
   injectSkillPrimes: jest.fn().mockReturnValue({
     initialMessages: [],
@@ -78,6 +139,7 @@ jest.mock('@librechat/api', () => ({
   buildResponse: jest.fn().mockReturnValue({ id: 'resp_123', output: [] }),
   generateResponseId: jest.fn().mockReturnValue('resp_mock-123'),
   isValidationFailure: jest.fn().mockReturnValue(false),
+  findPiiMatchInMessages: jest.fn().mockReturnValue(null),
   emitResponseCreated: jest.fn(),
   createResponseContext: jest.fn().mockReturnValue({ responseId: 'resp_123' }),
   createResponseTracker: jest.fn().mockReturnValue({
@@ -150,10 +212,29 @@ jest.mock('~/server/controllers/ModelController', () => ({
   getModelsConfig: jest.fn().mockResolvedValue({}),
 }));
 
+jest.mock('~/server/services/MCP', () => ({
+  resolveConfigServers: jest.fn().mockResolvedValue({}),
+}));
+
+jest.mock('~/config', () => ({
+  getMCPManager: jest.fn().mockReturnValue({}),
+}));
+
 jest.mock('~/server/services/Files/permissions', () => ({
   filterFilesByAgentAccess: jest.fn(),
 }));
 
+jest.mock('~/server/services/Endpoints/agents/skillDeps', () => ({
+  getSkillToolDeps: mockGetSkillToolDeps,
+  getSkillDbMethods: jest.fn(() => ({})),
+  canAuthorSkillFiles: mockCanAuthorSkillFiles,
+  withDeploymentSkillIds: jest.fn((ids = []) => ids),
+  enrichWithSkillConfigurable: mockEnrichWithSkillConfigurable,
+  buildSkillPrimedIdsByName: mockBuildSkillPrimedIdsByName,
+  buildAgentToolContext: mockBuildAgentToolContext,
+  enrichLoadedToolsWithAgentContext: mockEnrichLoadedToolsWithAgentContext,
+}));
+
 jest.mock('~/cache', () => ({
   logViolation: jest.fn(),
 }));
@@ -196,12 +277,15 @@ jest.mock('~/models', () => ({
   getConvo: jest.fn().mockResolvedValue(null),
 }));
 
+let mockGlobalDiscoveredAgentConfigs = null;
+
 describe('createResponse controller', () => {
   let createResponse;
   let req, res;
 
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGlobalDiscoveredAgentConfigs = null;
 
     const controller = require('../responses');
     createResponse = controller.createResponse;
@@ -392,6 +476,89 @@ describe('createResponse controller', () => {
     });
   });
 
+  describe('agent context parity with UI path', () => {
+    it('applies agent-scoped attachment context before createRun', async () => {
+      const api = require('@librechat/api');
+      api.initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: {},
+        edges: [],
+        agentContextAttachments: [{ file_id: 'file-1', filename: 'ocr_file.pdf' }],
+      });
+      mockBuildAgentContextAttachmentsByAgentId.mockReturnValueOnce(
+        new Map([['agent-123', [{ file_id: 'file-1', filename: 'ocr_file.pdf' }]]]),
+      );
+      mockBuildAgentScopedContext.mockResolvedValueOnce(
+        new Map([['agent-123', 'PDF context: ocr_file.pdf']]),
+      );
+
+      await createResponse(req, res);
+
+      expect(mockBuildAgentContextAttachmentsByAgentId).toHaveBeenCalledWith([
+        expect.objectContaining({ id: 'agent-123' }),
+      ]);
+      expect(mockBuildAgentScopedContext).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agentIds: ['agent-123'],
+          attachmentsByAgentId: expect.any(Map),
+          req,
+        }),
+      );
+      expect(mockApplyContextToAgent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent: expect.objectContaining({ id: 'agent-123' }),
+          agentId: 'agent-123',
+          sharedRunContext: 'PDF context: ocr_file.pdf',
+        }),
+      );
+    });
+
+    it('applies context to primary and discovered handoff agents', async () => {
+      const api = require('@librechat/api');
+      const handoffConfig = {
+        id: 'agent-handoff',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: {},
+        edges: [],
+        agentContextAttachments: [{ file_id: 'file-2', filename: 'handoff_context.pdf' }],
+      };
+
+      // Set primary agent to have edges pointing to handoff agent
+      api.initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: {},
+        edges: [{ source: 'agent-123', target: 'agent-handoff' }],
+        agentContextAttachments: [{ file_id: 'file-1', filename: 'primary_context.pdf' }],
+      });
+
+      // Set global config so discoverConnectedAgents mock can invoke onAgentInitialized
+      mockGlobalDiscoveredAgentConfigs = new Map([['agent-handoff', handoffConfig]]);
+
+      mockBuildAgentScopedContext.mockResolvedValueOnce(
+        new Map([
+          ['agent-123', 'Primary context'],
+          ['agent-handoff', 'Handoff context'],
+        ]),
+      );
+
+      await createResponse(req, res);
+
+      const appliedAgentIds = mockApplyContextToAgent.mock.calls.map((call) => call[0].agentId);
+      expect(appliedAgentIds).toEqual(expect.arrayContaining(['agent-123', 'agent-handoff']));
+      expect(mockApplyContextToAgent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agentId: 'agent-handoff',
+          sharedRunContext: 'Handoff context',
+        }),
+      );
+    });
+  });
+
   describe('token usage recording - streaming', () => {
     beforeEach(() => {
       req.body.stream = true;
@@ -458,4 +625,87 @@ describe('createResponse controller', () => {
       );
     });
   });
+
+  describe('sub-agent skill priming', () => {
+    it('passes the sub-agent primed skill IDs into non-streaming tool execution', async () => {
+      const {
+        initializeAgent,
+        discoverConnectedAgents,
+        createToolExecuteHandler,
+      } = require('@librechat/api');
+      const { loadToolsForExecution } = require('~/server/services/ToolService');
+      const subAgent = { id: 'agent-sub', name: 'Sub Agent' };
+      const subConfig = {
+        id: 'agent-sub',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        userMCPAuthMap: { sub: { token: 'sub-token' } },
+        tool_resources: { code_interpreter: { file_ids: ['sub-file'] } },
+        actionsEnabled: true,
+        accessibleSkillIds: ['sub-skill-id'],
+        activeSkillNames: ['sub-hidden-skill'],
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: ['create_file', 'edit_file'],
+        manualSkillPrimes: [{ name: 'sub-hidden-skill', _id: { toString: () => 'sub-manual-id' } }],
+        alwaysApplySkillPrimes: [
+          { name: 'sub-always-skill', _id: { toString: () => 'sub-always-id' } },
+        ],
+      };
+
+      initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        edges: [{ source: 'agent-123', target: 'agent-sub' }],
+        accessibleSkillIds: ['primary-skill-id'],
+        activeSkillNames: ['primary-skill'],
+        codeEnvAvailable: false,
+        skillAuthoringAvailable: false,
+        fileAuthoringToolNames: [],
+        manualSkillPrimes: [{ name: 'primary-skill', _id: { toString: () => 'primary-skill-id' } }],
+      });
+      discoverConnectedAgents.mockImplementationOnce(async (_params, deps) => {
+        deps.onAgentInitialized('agent-sub', subAgent, subConfig);
+        return {
+          agentConfigs: new Map([['agent-sub', subConfig]]),
+          edges: [],
+          skippedAgentIds: new Set(),
+          userMCPAuthMap: undefined,
+        };
+      });
+
+      await createResponse(req, res);
+
+      const toolExecuteOptions = createToolExecuteHandler.mock.calls.at(-1)[0];
+      await toolExecuteOptions.loadTools(['read_file'], 'agent-sub');
+
+      expect(loadToolsForExecution).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          agent: subAgent,
+          toolRegistry: subConfig.toolRegistry,
+          userMCPAuthMap: subConfig.userMCPAuthMap,
+          tool_resources: subConfig.tool_resources,
+          actionsEnabled: true,
+        }),
+      );
+      expect(mockEnrichWithSkillConfigurable).toHaveBeenLastCalledWith({
+        result: expect.anything(),
+        context: {
+          req,
+          accessibleSkillIds: ['sub-skill-id'],
+          codeEnvAvailable: true,
+          skillPrimedIdsByName: {
+            'sub-always-skill': 'sub-always-id',
+            'sub-hidden-skill': 'sub-manual-id',
+          },
+          activeSkillNames: ['sub-hidden-skill'],
+          skillAuthoringAvailable: true,
+          fileAuthoringToolNames: ['create_file', 'edit_file'],
+        },
+      });
+    });
+  });
 });
diff --git a/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js b/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js
new file mode 100644
index 00000000000..caa14f6ea70
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js
@@ -0,0 +1,477 @@
+const { z } = require('zod');
+const { tool } = require('@langchain/core/tools');
+const { ChatGenerationChunk } = require('@langchain/core/outputs');
+const { HumanMessage, AIMessage, AIMessageChunk } = require('@langchain/core/messages');
+const {
+  Run,
+  Providers,
+  GraphEvents,
+  FakeChatModel,
+  createContentAggregator,
+} = require('@librechat/agents');
+const {
+  GenerationJobManager,
+  aggregateEmittedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+} = require('@librechat/api');
+const { getDefaultHandlers } = require('~/server/controllers/agents/callbacks');
+
+jest.mock('nanoid', () => ({
+  nanoid: jest.fn(() => 'mock-nanoid'),
+}));
+
+jest.mock('~/server/services/Files/Citations', () => ({
+  processFileCitations: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  processCodeOutput: jest.fn(),
+  runPreviewFinalize: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/process', () => ({
+  saveBase64Image: jest.fn(),
+}));
+
+/** Real pipeline guard: published lib versions without the event skip its assertions */
+const hasContextUsageEvent = GraphEvents.ON_CONTEXT_USAGE != null;
+
+/**
+ * FakeChatModel that attaches provider-style usage_metadata on a final
+ * empty chunk (the OpenAI streaming pattern), so CHAT_MODEL_END carries
+ * aggregated usage through the real @librechat/agents pipeline.
+ */
+class UsageFakeModel extends FakeChatModel {
+  constructor(options, usagePerCall) {
+    super(options);
+    this.usagePerCall = usagePerCall;
+    this.usageCallIndex = 0;
+  }
+
+  async *_streamResponseChunks(messages, options, runManager) {
+    yield* super._streamResponseChunks(messages, options, runManager);
+    const index = Math.min(this.usageCallIndex, this.usagePerCall.length - 1);
+    this.usageCallIndex += 1;
+    yield new ChatGenerationChunk({
+      text: '',
+      message: new AIMessageChunk({ content: '', usage_metadata: this.usagePerCall[index] }),
+    });
+  }
+}
+
+const addTool = tool(async ({ a, b }) => String(a + b), {
+  name: 'add',
+  description: 'Add two numbers',
+  schema: z.object({ a: z.number(), b: z.number() }),
+});
+
+const charCounter = (msg) => {
+  const content = msg.content;
+  if (typeof content === 'string') {
+    return content.length + 3;
+  }
+  if (Array.isArray(content)) {
+    let length = 3;
+    for (const part of content) {
+      if (typeof part === 'string') {
+        length += part.length;
+      } else if (typeof part?.text === 'string') {
+        length += part.text.length;
+      }
+    }
+    return length;
+  }
+  return 3;
+};
+
+function createMockRes() {
+  const events = [];
+  return {
+    events,
+    headersSent: true,
+    writableEnded: false,
+    write(payload) {
+      for (const line of String(payload).split('\n')) {
+        if (line.startsWith('data: ')) {
+          events.push(JSON.parse(line.slice(6)));
+        }
+      }
+      return true;
+    },
+  };
+}
+
+const FIRST_CALL_USAGE = {
+  input_tokens: 100,
+  output_tokens: 20,
+  total_tokens: 120,
+};
+
+const SECOND_CALL_USAGE = {
+  input_tokens: 150,
+  output_tokens: 10,
+  total_tokens: 160,
+  input_token_details: { cache_creation: 30, cache_read: 50 },
+};
+
+const MAX_CONTEXT_TOKENS = 8000;
+
+async function runToolLoop({
+  res,
+  streamId = null,
+  collectedUsage,
+  contextUsageSink = null,
+  usageEmitSink = null,
+  usageCost = null,
+}) {
+  const { contentParts, aggregateContent } = createContentAggregator();
+  const handlers = getDefaultHandlers({
+    res,
+    aggregateContent,
+    toolEndCallback: () => {},
+    collectedUsage,
+    streamId,
+    contextUsageSink,
+    usageEmitSink,
+    usageCost,
+  });
+
+  const run = await Run.create({
+    runId: 'usage-e2e-response',
+    graphConfig: {
+      type: 'standard',
+      llmConfig: {
+        provider: Providers.OPENAI,
+        model: 'gpt-4o-mini',
+        streaming: true,
+        streamUsage: false,
+      },
+      instructions: 'You are a helpful assistant.',
+      maxContextTokens: MAX_CONTEXT_TOKENS,
+      tools: [addTool],
+    },
+    returnContent: true,
+    customHandlers: handlers,
+    tokenCounter: charCounter,
+    indexTokenCountMap: {},
+  });
+
+  run.Graph.overrideModel = new UsageFakeModel(
+    {
+      responses: ['Let me calculate that.', 'The answer is 4.'],
+      toolCalls: [{ name: 'add', args: { a: 2, b: 2 }, id: 'tc_1', type: 'tool_call' }],
+    },
+    [FIRST_CALL_USAGE, SECOND_CALL_USAGE],
+  );
+
+  await run.processStream(
+    { messages: [new HumanMessage('What is 2+2?')] },
+    {
+      configurable: { thread_id: 'usage-e2e-thread', user_id: 'user-1' },
+      streamMode: 'values',
+      version: 'v2',
+    },
+  );
+
+  return { run, contentParts };
+}
+
+describe('usage events through the real agents pipeline', () => {
+  jest.setTimeout(30000);
+
+  afterAll(async () => {
+    await GenerationJobManager.destroy();
+  });
+
+  test('emits on_token_usage per model call with collectedUsage parity', async () => {
+    const res = createMockRes();
+    const collectedUsage = [];
+    const { contentParts } = await runToolLoop({ res, collectedUsage });
+
+    const usageEvents = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(usageEvents).toHaveLength(2);
+
+    expect(usageEvents[0].data).toMatchObject(FIRST_CALL_USAGE);
+    expect(usageEvents[1].data).toMatchObject(SECOND_CALL_USAGE);
+    expect(usageEvents[0].data.provider).toBe(Providers.OPENAI);
+    expect(usageEvents[0].data.model).toBeTruthy();
+    expect(usageEvents[0].data.usage_type).toBeUndefined();
+
+    expect(collectedUsage).toHaveLength(2);
+    expect(collectedUsage[0]).toMatchObject(FIRST_CALL_USAGE);
+    expect(collectedUsage[1]).toMatchObject(SECOND_CALL_USAGE);
+
+    const text = contentParts
+      .filter((part) => part?.type === 'text')
+      .map((part) => part.text)
+      .join('');
+    expect(text).toContain('The answer is 4.');
+  });
+
+  test('emits a context snapshot before each model call', async () => {
+    if (!hasContextUsageEvent) {
+      console.warn('Skipping: installed @librechat/agents predates ON_CONTEXT_USAGE');
+      return;
+    }
+    const res = createMockRes();
+    const { run } = await runToolLoop({ res, collectedUsage: [] });
+    expect(run).toBeDefined();
+
+    const contextEvents = res.events.filter((e) => e.event === 'on_context_usage');
+    expect(contextEvents).toHaveLength(2);
+
+    for (const event of contextEvents) {
+      const { breakdown, contextBudget, remainingContextTokens, effectiveInstructionTokens } =
+        event.data;
+      expect(breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+      expect(contextBudget).toBeGreaterThan(0);
+      expect(contextBudget).toBeLessThanOrEqual(MAX_CONTEXT_TOKENS);
+      expect(effectiveInstructionTokens).toBeGreaterThan(0);
+      expect(remainingContextTokens).toBeGreaterThan(0);
+      expect(remainingContextTokens).toBeLessThan(contextBudget);
+      expect(breakdown.toolTokenCounts.add).toBeGreaterThan(0);
+    }
+
+    /** Tool loop grows the context between calls */
+    expect(contextEvents[1].data.prePruneContextTokens).toBeGreaterThan(
+      contextEvents[0].data.prePruneContextTokens,
+    );
+
+    /** Snapshot precedes the call's usage event */
+    const firstContextIndex = res.events.findIndex((e) => e.event === 'on_context_usage');
+    const firstUsageIndex = res.events.findIndex((e) => e.event === 'on_token_usage');
+    expect(firstContextIndex).toBeGreaterThanOrEqual(0);
+    expect(firstContextIndex).toBeLessThan(firstUsageIndex);
+  });
+
+  test('captures the usage rollup + latest context snapshot for message persistence', () => {
+    const res = createMockRes();
+    const contextUsageSink = { latest: null };
+    const usageEmitSink = [];
+    return runToolLoop({ res, collectedUsage: [], contextUsageSink, usageEmitSink }).then(() => {
+      /** Both model calls' emitted payloads are captured for the rollup */
+      expect(usageEmitSink).toHaveLength(2);
+
+      const usage = aggregateEmittedUsage(usageEmitSink);
+      /** Display units: openAI is cache-subset, so input excludes cache
+       *  (150−30−50=70); output is repaired completion */
+      expect(usage).toEqual({
+        input:
+          FIRST_CALL_USAGE.input_tokens +
+          (SECOND_CALL_USAGE.input_tokens -
+            SECOND_CALL_USAGE.input_token_details.cache_creation -
+            SECOND_CALL_USAGE.input_token_details.cache_read),
+        output: FIRST_CALL_USAGE.output_tokens + SECOND_CALL_USAGE.output_tokens,
+        cacheWrite: SECOND_CALL_USAGE.input_token_details.cache_creation,
+        cacheRead: SECOND_CALL_USAGE.input_token_details.cache_read,
+      });
+      /** contextCost off → no cost folded into the rollup */
+      expect(usage.cost).toBeUndefined();
+
+      if (hasContextUsageEvent) {
+        expect(contextUsageSink.latest).not.toBeNull();
+        const persisted = buildPersistedContextUsage(contextUsageSink.latest);
+        expect(persisted.breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+        /** Zero-valued tool counts are trimmed from the persisted blob */
+        for (const count of Object.values(persisted.breakdown.toolTokenCounts ?? {})) {
+          expect(count).toBeGreaterThan(0);
+        }
+      }
+    });
+  });
+
+  test('folds authoritative per-event cost into the rollup when contextCost is on', async () => {
+    const res = createMockRes();
+    const usageEmitSink = [];
+    /** Stub pricing mirroring getMultiplier/getCacheMultiplier shape */
+    const usageCost = {
+      enabled: true,
+      pricing: {
+        getMultiplier: ({ tokenType }) => (tokenType === 'completion' ? 15 : 3),
+        getCacheMultiplier: ({ cacheType }) => (cacheType === 'write' ? 3.75 : 0.3),
+      },
+    };
+    await runToolLoop({ res, collectedUsage: [], usageEmitSink, usageCost });
+
+    for (const event of usageEmitSink) {
+      expect(typeof event.cost).toBe('number');
+    }
+    const usage = aggregateEmittedUsage(usageEmitSink);
+    expect(usage.cost).toBeGreaterThan(0);
+    expect(usage.cost).toBeCloseTo(usageEmitSink.reduce((sum, e) => sum + e.cost, 0));
+  });
+
+  test('emit path prices each call by its producing agent and strips the agentId tag', () => {
+    const res = createMockRes();
+    const usageEmitSink = [];
+    /** Two endpoints share a model id but bill at different rates. */
+    const primaryConfig = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+    const subagentConfig = { 'gpt-4': { prompt: 0.05, completion: 0.15, context: 8192 } };
+    const byAgentId = new Map([
+      ['primary', primaryConfig],
+      ['sub', subagentConfig],
+    ]);
+    const usageCost = {
+      enabled: true,
+      endpointTokenConfig: primaryConfig,
+      pricing: {
+        getMultiplier: ({ tokenType, model, endpointTokenConfig }) =>
+          endpointTokenConfig?.[model]?.[tokenType] ?? 0,
+        getCacheMultiplier: () => 0,
+      },
+      resolveEndpointTokenConfig: (usage) =>
+        resolveAgentTokenConfig({ agentId: usage?.agentId, byAgentId, fallback: primaryConfig }),
+    };
+
+    const { aggregateContent } = createContentAggregator();
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent,
+      toolEndCallback: () => {},
+      collectedUsage: [],
+      usageEmitSink,
+      usageCost,
+    });
+    /** The CHAT_MODEL_END handler's emitUsage IS the real emitTokenUsage closure. */
+    const emitUsage = handlers[GraphEvents.CHAT_MODEL_END].emitUsage;
+    const call = { model: 'gpt-4', input_tokens: 100, output_tokens: 50, total_tokens: 150 };
+    emitUsage({ ...call, agentId: 'sub' });
+    emitUsage({ ...call, agentId: 'primary' });
+
+    const events = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(events).toHaveLength(2);
+    /** agentId is an internal pricing tag — never streamed to the client nor
+     *  folded into the persisted rollup. */
+    for (const e of events) {
+      expect(e.data.agentId).toBeUndefined();
+    }
+    for (const entry of usageEmitSink) {
+      expect(entry.agentId).toBeUndefined();
+    }
+    /** Same tokens + model id, but the subagent endpoint's higher rates price
+     *  its call above the primary — proving per-agent emit pricing. The 5× ratio
+     *  ((100·0.05+50·0.15)/(100·0.01+50·0.03)) is scale-independent of credit units. */
+    expect(events[1].data.cost).toBeGreaterThan(0);
+    expect(events[0].data.cost).toBeGreaterThan(events[1].data.cost);
+    expect(events[0].data.cost / events[1].data.cost).toBeCloseTo(5);
+  });
+
+  test('persists usage and context snapshot for resume via GenerationJobManager', async () => {
+    const streamId = `usage-e2e-stream-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1', 'convo-1');
+
+    const res = createMockRes();
+    await runToolLoop({ res, streamId, collectedUsage: [] });
+
+    const resumeState = await GenerationJobManager.getResumeState(streamId);
+    expect(resumeState).not.toBeNull();
+
+    expect(resumeState.collectedUsage).toHaveLength(2);
+    expect(resumeState.collectedUsage[0]).toMatchObject(FIRST_CALL_USAGE);
+    expect(resumeState.collectedUsage[1]).toMatchObject(SECOND_CALL_USAGE);
+
+    if (hasContextUsageEvent) {
+      expect(resumeState.contextUsage.breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+      /** Latest-wins: the persisted snapshot is the second call's */
+      expect(resumeState.contextUsage.prePruneContextTokens).toBeGreaterThan(0);
+      /** Reconciled to the final primary call's actual prompt: openAI folds cache
+       *  into input_tokens (150), so the resume snapshot's used = 150 — the real
+       *  context, not the calibrated estimate. */
+      const used =
+        resumeState.contextUsage.contextBudget - resumeState.contextUsage.remainingContextTokens;
+      expect(used).toBe(SECOND_CALL_USAGE.input_tokens);
+    }
+  });
+
+  /** Drives a real summarization (tight context + padded history); self-summarize
+   *  reuses the overridden fake model so no API key is needed. */
+  async function runSummarizationLoop({ res, collectedUsage, contextUsageSink, usageEmitSink }) {
+    const { aggregateContent } = createContentAggregator();
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent,
+      toolEndCallback: () => {},
+      collectedUsage,
+      contextUsageSink,
+      usageEmitSink,
+      summarizationOptions: { enabled: true },
+    });
+
+    const pad = 'context detail to overflow the tiny budget. '.repeat(40);
+    const history = [
+      new HumanMessage(`Turn 1 question. ${pad}`),
+      new AIMessage(`Turn 1 answer. ${pad}`),
+      new HumanMessage(`Turn 2 question. ${pad}`),
+      new AIMessage(`Turn 2 answer. ${pad}`),
+      new HumanMessage(`Final question after a lot of prior history. ${pad}`),
+    ];
+    const indexTokenCountMap = {};
+    history.forEach((message, i) => {
+      indexTokenCountMap[i] = charCounter(message);
+    });
+
+    const run = await Run.create({
+      runId: `summ-e2e-${Date.now()}`,
+      graphConfig: {
+        type: 'standard',
+        llmConfig: {
+          provider: Providers.OPENAI,
+          model: 'gpt-4o-mini',
+          streaming: true,
+          streamUsage: false,
+        },
+        instructions: 'You are a helpful assistant.',
+        maxContextTokens: 700,
+        summarizationEnabled: true,
+        summarizationConfig: { provider: Providers.OPENAI, model: 'gpt-4o-mini' },
+      },
+      returnContent: true,
+      customHandlers: handlers,
+      tokenCounter: charCounter,
+      indexTokenCountMap,
+    });
+
+    run.Graph.overrideModel = new UsageFakeModel(
+      { responses: ['## Summary\nPrior turns compacted.', 'Here is the final answer.'] },
+      [{ input_tokens: 40, output_tokens: 8, total_tokens: 48 }],
+    );
+
+    await run.processStream(
+      { messages: history },
+      {
+        configurable: { thread_id: 'summ-e2e-thread', user_id: 'user-1' },
+        streamMode: 'values',
+        version: 'v2',
+      },
+    );
+    return run;
+  }
+
+  /** A summarized turn compacts the context (summary tokens replace the older
+   *  turns) and the reduced snapshot is persisted — the latest snapshot is
+   *  followed by a primary usage, so the save guard keeps it and the client
+   *  uses the snapshot (not the inflated whole-history estimate). */
+  test('persists the reduced (compacted) snapshot after summarization', async () => {
+    if (!hasContextUsageEvent) {
+      return;
+    }
+    const res = createMockRes();
+    const contextUsageSink = { latest: null, count: 0 };
+    const usageEmitSink = [];
+    await runSummarizationLoop({ res, collectedUsage: [], contextUsageSink, usageEmitSink });
+
+    const snapshot = contextUsageSink.latest;
+    /** Summarization fired: a summary exists and the kept message tokens are
+     *  small (the compacted context, not the full history). */
+    expect(snapshot?.breakdown?.summaryTokens).toBeGreaterThan(0);
+    expect(snapshot?.breakdown?.messageTokens).toBeLessThan(snapshot?.breakdown?.summaryTokens);
+
+    /** The save guard keeps it: a primary usage follows the latest snapshot. */
+    const afterLatest = usageEmitSink.slice(contextUsageSink.latestUsageIndex ?? 0);
+    expect(afterLatest.some((e) => e.usage_type == null)).toBe(true);
+    expect(
+      buildPersistedContextUsage(snapshot, usageEmitSink).breakdown.summaryTokens,
+    ).toBeGreaterThan(0);
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/usageEvents.live.spec.js b/api/server/controllers/agents/__tests__/usageEvents.live.spec.js
new file mode 100644
index 00000000000..ff02c9325f6
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/usageEvents.live.spec.js
@@ -0,0 +1,161 @@
+/**
+ * Live host-layer verification: real Anthropic run through the actual
+ * getDefaultHandlers pipeline, asserting the SSE usage/context events the
+ * client consumes and their resume persistence.
+ *
+ * Run with:
+ * RUN_USAGE_LIVE_TESTS=1 ANTHROPIC_API_KEY=... npx jest usageEvents.live --runInBand
+ */
+const { HumanMessage } = require('@langchain/core/messages');
+const { Run, Providers, GraphEvents } = require('@librechat/agents');
+const { GenerationJobManager } = require('@librechat/api');
+const { getDefaultHandlers } = require('~/server/controllers/agents/callbacks');
+
+jest.mock('nanoid', () => ({
+  nanoid: jest.fn(() => 'mock-nanoid'),
+}));
+
+jest.mock('~/server/services/Files/Citations', () => ({
+  processFileCitations: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  processCodeOutput: jest.fn(),
+  runPreviewFinalize: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/process', () => ({
+  saveBase64Image: jest.fn(),
+}));
+
+const shouldRunLive =
+  process.env.RUN_USAGE_LIVE_TESTS === '1' &&
+  process.env.ANTHROPIC_API_KEY != null &&
+  process.env.ANTHROPIC_API_KEY !== '';
+
+const describeIfLive = shouldRunLive ? describe : describe.skip;
+const modelName = process.env.ANTHROPIC_USAGE_LIVE_MODEL ?? 'claude-haiku-4-5';
+const hasContextUsageEvent = GraphEvents.ON_CONTEXT_USAGE != null;
+
+const charCounter = (msg) => {
+  const content = msg.content;
+  if (typeof content === 'string') {
+    return Math.ceil(content.length / 4) + 3;
+  }
+  if (Array.isArray(content)) {
+    let length = 3;
+    for (const part of content) {
+      if (typeof part === 'string') {
+        length += Math.ceil(part.length / 4);
+      } else if (typeof part?.text === 'string') {
+        length += Math.ceil(part.text.length / 4);
+      }
+    }
+    return length;
+  }
+  return 3;
+};
+
+function createMockRes() {
+  const events = [];
+  return {
+    events,
+    headersSent: true,
+    writableEnded: false,
+    write(payload) {
+      for (const line of String(payload).split('\n')) {
+        if (line.startsWith('data: ')) {
+          events.push(JSON.parse(line.slice(6)));
+        }
+      }
+      return true;
+    },
+  };
+}
+
+describeIfLive('live usage events through the host pipeline', () => {
+  jest.setTimeout(120000);
+
+  afterAll(async () => {
+    await GenerationJobManager.destroy();
+  });
+
+  test('streams real provider usage and persists it for resume', async () => {
+    const streamId = `usage-live-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-live', 'convo-live');
+
+    /** streamId mode routes events through the job emitter — capture them
+     *  as a subscribed resumable client would, not via res.write */
+    const res = createMockRes();
+    await GenerationJobManager.subscribe(streamId, (event) => {
+      res.events.push(event);
+    });
+    const collectedUsage = [];
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent: () => {},
+      toolEndCallback: () => {},
+      collectedUsage,
+      streamId,
+    });
+
+    const run = await Run.create({
+      runId: 'usage-live-response',
+      graphConfig: {
+        type: 'standard',
+        llmConfig: {
+          provider: Providers.ANTHROPIC,
+          model: modelName,
+          apiKey: process.env.ANTHROPIC_API_KEY,
+          temperature: 0,
+          maxTokens: 64,
+          streaming: true,
+          streamUsage: true,
+        },
+        instructions: 'You are concise. Reply with one short sentence.',
+        maxContextTokens: 8000,
+      },
+      returnContent: true,
+      customHandlers: handlers,
+      tokenCounter: charCounter,
+      indexTokenCountMap: {},
+    });
+
+    await run.processStream(
+      { messages: [new HumanMessage('Say hello in five words or fewer.')] },
+      {
+        configurable: { thread_id: 'usage-live-thread', user_id: 'user-live' },
+        streamMode: 'values',
+        version: 'v2',
+      },
+    );
+
+    const usageEvents = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(usageEvents).toHaveLength(1);
+    const usage = usageEvents[0].data;
+    expect(usage.input_tokens).toBeGreaterThan(0);
+    expect(usage.output_tokens).toBeGreaterThan(0);
+    expect(usage.provider).toBe(Providers.ANTHROPIC);
+    expect(usage.model).toBe(modelName);
+    expect(collectedUsage).toHaveLength(1);
+    expect(usage.input_tokens).toBe(collectedUsage[0].input_tokens);
+
+    if (hasContextUsageEvent) {
+      const contextEvents = res.events.filter((e) => e.event === 'on_context_usage');
+      expect(contextEvents).toHaveLength(1);
+      const snapshot = contextEvents[0].data;
+      expect(snapshot.breakdown.maxContextTokens).toBe(8000);
+      const estimatedUsed = snapshot.contextBudget - snapshot.remainingContextTokens;
+      expect(estimatedUsed).toBeGreaterThan(0);
+      expect(estimatedUsed / usage.input_tokens).toBeGreaterThan(0.2);
+      expect(estimatedUsed / usage.input_tokens).toBeLessThan(5);
+    }
+
+    const resumeState = await GenerationJobManager.getResumeState(streamId);
+    expect(resumeState.collectedUsage).toHaveLength(1);
+    expect(resumeState.collectedUsage[0].input_tokens).toBe(usage.input_tokens);
+    if (hasContextUsageEvent) {
+      expect(resumeState.contextUsage.breakdown.maxContextTokens).toBe(8000);
+    }
+  });
+});
diff --git a/api/server/controllers/agents/callbacks.js b/api/server/controllers/agents/callbacks.js
index 314ee481a6c..d0b2ea4aaab 100644
--- a/api/server/controllers/agents/callbacks.js
+++ b/api/server/controllers/agents/callbacks.js
@@ -1,23 +1,39 @@
 const { nanoid } = require('nanoid');
 const { logger } = require('@librechat/data-schemas');
-const { Tools, StepTypes, FileContext, ErrorTypes } = require('librechat-data-provider');
+const {
+  Tools,
+  StepTypes,
+  FileContext,
+  ErrorTypes,
+  UsageEvents,
+} = require('librechat-data-provider');
 const {
   GraphEvents,
   GraphNodeKeys,
   ToolEndHandler,
-  CODE_EXECUTION_TOOLS,
   createContentAggregator,
 } = require('@librechat/agents');
 const {
   sendEvent,
+  computeUsageCostUSD,
   GenerationJobManager,
   writeAttachmentEvent,
   createToolExecuteHandler,
+  HOST_FILE_AUTHORING_ARTIFACT_KEY,
+  isCodeSessionToolName,
 } = require('@librechat/api');
 const { processFileCitations } = require('~/server/services/Files/Citations');
 const { processCodeOutput, runPreviewFinalize } = require('~/server/services/Files/Code/process');
 const { saveBase64Image } = require('~/server/services/Files/process');
 
+function isHostFileAuthoringArtifact(artifact) {
+  return artifact?.[HOST_FILE_AUTHORING_ARTIFACT_KEY] === true;
+}
+
+function isCodeArtifactToolOutput(output) {
+  return isCodeSessionToolName(output.name) || isHostFileAuthoringArtifact(output.artifact);
+}
+
 class ModelEndHandler {
   /**
    * @param {Array<UsageMetadata>} collectedUsage
@@ -32,13 +48,16 @@ class ModelEndHandler {
    *   Optional; when `null`, the handler is a no-op for signatures. Non-Vertex
    *   providers don't emit `additional_kwargs.signatures`, so capture is also
    *   a no-op for them even when the map is provided.
+   * @param {(data: Record<string, unknown>) => Promise<void> | void} [emitUsage] Optional
+   *   callback to stream per-call token usage to the client.
    */
-  constructor(collectedUsage, collectedThoughtSignatures = null) {
+  constructor(collectedUsage, collectedThoughtSignatures = null, emitUsage = null) {
     if (!Array.isArray(collectedUsage)) {
       throw new Error('collectedUsage must be an array');
     }
     this.collectedUsage = collectedUsage;
     this.collectedThoughtSignatures = collectedThoughtSignatures;
+    this.emitUsage = emitUsage;
   }
 
   finalize(errorMessage) {
@@ -90,11 +109,62 @@ class ModelEndHandler {
       if (agentContext.provider) {
         usage.provider = agentContext.provider;
       }
+      /** Tag the producing agent so multi-endpoint graphs can price each call
+       *  with its own endpoint token config (recordCollectedUsage resolver). */
+      if (agentContext.agentId) {
+        usage.agentId = agentContext.agentId;
+      }
 
-      const taggedUsage = markSummarizationUsage(usage, metadata);
+      let taggedUsage = markSummarizationUsage(usage, metadata);
+      /** Hidden intermediate sequential-agent calls are billed but never shown.
+       *  Tag them non-primary on the COLLECTED usage too (not just the emit) so
+       *  recordCollectedUsage excludes their output from the parent's tokenCount
+       *  and the client folds them into cost/totals only — not the live gauge. */
+      if (
+        taggedUsage.usage_type == null &&
+        !checkIfLastAgent(metadata?.last_agent_id, metadata?.langgraph_node) &&
+        metadata?.hide_sequential_outputs === true
+      ) {
+        taggedUsage = { ...taggedUsage, usage_type: 'sequential' };
+      }
 
       this.collectedUsage.push(taggedUsage);
 
+      if (this.emitUsage) {
+        /** Normalize Anthropic/Bedrock-style top-level cache fields into details */
+        const cache_creation =
+          taggedUsage.input_token_details?.cache_creation ??
+          taggedUsage.cache_creation_input_tokens;
+        const cache_read =
+          taggedUsage.input_token_details?.cache_read ?? taggedUsage.cache_read_input_tokens;
+        try {
+          await this.emitUsage({
+            input_tokens: taggedUsage.input_tokens,
+            output_tokens: taggedUsage.output_tokens,
+            total_tokens: taggedUsage.total_tokens,
+            input_token_details:
+              cache_creation != null || cache_read != null
+                ? { cache_creation, cache_read }
+                : undefined,
+            model: taggedUsage.model,
+            provider: taggedUsage.provider,
+            usage_type: taggedUsage.usage_type,
+            /** Producing agent for per-endpoint pricing; consumed by the emit
+             *  cost resolver and not included in the emitted/persisted payload. */
+            agentId: taggedUsage.agentId,
+            runId: metadata?.run_id,
+            /** Per-run sequence so identical payloads from distinct calls
+             *  stay distinguishable during resume dedupe */
+            seq: this.collectedUsage.length,
+          });
+        } catch (err) {
+          /** Best-effort telemetry: a failed emit (closed SSE, Redis publish
+           *  error) must not abort the handler before the thought-signature
+           *  capture below, or resumed tool-call requests lose that metadata */
+          logger.warn('[ModelEndHandler] Failed to emit token usage', err);
+        }
+      }
+
       /**
        * `additional_kwargs.signatures` is a flat array indexed by response
        * part position (text + functionCall interleaved). `tool_calls` is
@@ -211,6 +281,12 @@ function feedSubagentAggregator(aggregator, event) {
  * @param {Array<UsageMetadata>} options.collectedUsage - The list of collected usage metadata.
  * @param {string | null} [options.streamId] - The stream ID for resumable mode, or null for standard mode.
  * @param {ToolExecuteOptions} [options.toolExecuteOptions] - Options for event-driven tool execution.
+ * @param {UsageCostDeps} [options.usageCost] - Pricing context for authoritative per-event cost.
+ * @param {{ latest: TContextUsageEvent | null, count: number }} [options.contextUsageSink] - Mutable
+ *   holder for the latest visible context snapshot + a count of visible snapshots (model calls),
+ *   used to persist the breakdown only when the final call emitted usage.
+ * @param {Array<TTokenUsageEvent>} [options.usageEmitSink] - Array collecting each emitted
+ *   `on_token_usage` payload (incl. cost) so the response's usage rollup can be persisted.
  * @returns {Record<string, t.EventHandler>} The default handlers.
  * @throws {Error} If the request is not found.
  */
@@ -224,14 +300,53 @@ function getDefaultHandlers({
   toolExecuteOptions = null,
   summarizationOptions = null,
   subagentAggregatorsByToolCallId = null,
+  usageCost = null,
+  contextUsageSink = null,
+  usageEmitSink = null,
 }) {
   if (!res || !aggregateContent) {
     throw new Error(
       `[getDefaultHandlers] Missing required options: res: ${!res}, aggregateContent: ${!aggregateContent}`,
     );
   }
+  /**
+   * Emit a token-usage event, attaching the authoritative per-event USD cost
+   * when cost display is enabled. The backend is the single source of truth
+   * for pricing (premium tiers, cache rates) — the client sums these instead
+   * of re-deriving from base rates.
+   * @param {Record<string, unknown>} data
+   */
+  const emitTokenUsage = ({ agentId, ...data }) => {
+    let payload = data;
+    if (usageCost?.enabled === true && usageCost.pricing) {
+      try {
+        /** Price with the producing agent's config (multi-endpoint graphs) so
+         *  the streamed/persisted cost matches the per-agent balance transaction;
+         *  `agentId` is resolved here, not forwarded to the client or rollup. */
+        const endpointTokenConfig = usageCost.resolveEndpointTokenConfig
+          ? usageCost.resolveEndpointTokenConfig({ agentId })
+          : usageCost.endpointTokenConfig;
+        payload = {
+          ...data,
+          cost: computeUsageCostUSD(data, usageCost.pricing, endpointTokenConfig),
+        };
+      } catch (err) {
+        logger.warn('[getDefaultHandlers] Failed to compute usage cost', err);
+      }
+    }
+    /** Collect the same payload the client folds so the response's usage rollup
+     *  persisted on `metadata.usage` reproduces the live branch/total + cost. */
+    if (usageEmitSink) {
+      usageEmitSink.push(payload);
+    }
+    return emitEvent(res, streamId, { event: UsageEvents.ON_TOKEN_USAGE, data: payload });
+  };
   const handlers = {
-    [GraphEvents.CHAT_MODEL_END]: new ModelEndHandler(collectedUsage, collectedThoughtSignatures),
+    [GraphEvents.CHAT_MODEL_END]: new ModelEndHandler(
+      collectedUsage,
+      collectedThoughtSignatures,
+      emitTokenUsage,
+    ),
     [GraphEvents.TOOL_END]: new ToolEndHandler(toolEndCallback, logger),
     [GraphEvents.ON_RUN_STEP]: {
       /**
@@ -416,6 +531,43 @@ function getDefaultHandlers({
 
   handlers[GraphEvents.ON_AGENT_LOG] = { handle: agentLogHandler };
 
+  /** Guarded: no-op when the installed @librechat/agents predates the event */
+  if (GraphEvents.ON_CONTEXT_USAGE) {
+    handlers[GraphEvents.ON_CONTEXT_USAGE] = {
+      /**
+       * Forward per-model-call context usage snapshots to the client,
+       * honoring the same sequential-agent visibility gate as deltas.
+       * @param {string} event - The event name.
+       * @param {StreamEventData} data - The event data.
+       * @param {GraphRunnableConfig['configurable']} [metadata] The runnable metadata.
+       */
+      handle: async (event, data, metadata) => {
+        if (
+          checkIfLastAgent(metadata?.last_agent_id, metadata?.langgraph_node) ||
+          !metadata?.hide_sequential_outputs
+        ) {
+          /** Capture the latest visible snapshot (last-wins) and how many usage
+           *  events preceded it BEFORE awaiting the emit. `emitEvent` can yield
+           *  (resumable SSE / Redis publish); with parallel runs active this
+           *  call's own primary usage could land in `usageEmitSink` during that
+           *  yield, pushing `latestUsageIndex` past the very event that proves the
+           *  snapshot completed — the save path would then slice it away and drop
+           *  a valid breakdown. The recorded index lets the save path persist only
+           *  when a PRIMARY usage follows this snapshot (the snapshot's call
+           *  actually invoked the model); a summarization detour emits a snapshot
+           *  whose only following usage is tagged `summarization`, which a plain
+           *  snapshot-count would over-count and wrongly drop. */
+          if (contextUsageSink) {
+            contextUsageSink.latest = data;
+            contextUsageSink.count = (contextUsageSink.count ?? 0) + 1;
+            contextUsageSink.latestUsageIndex = usageEmitSink?.length ?? 0;
+          }
+          await emitEvent(res, streamId, { event, data });
+        }
+      },
+    };
+  }
+
   return handlers;
 }
 
@@ -623,7 +775,7 @@ function createToolEndCallback({ req, res, artifactPromises, streamId = null })
       return;
     }
 
-    if (!CODE_EXECUTION_TOOLS.has(output.name)) {
+    if (!isCodeArtifactToolOutput(output)) {
       return;
     }
 
@@ -890,7 +1042,7 @@ function createResponsesToolEndCallback({ req, res, tracker, artifactPromises })
       return;
     }
 
-    if (!CODE_EXECUTION_TOOLS.has(output.name)) {
+    if (!isCodeArtifactToolOutput(output)) {
       return;
     }
 
diff --git a/api/server/controllers/agents/client.js b/api/server/controllers/agents/client.js
index 0338918412c..e073c964d76 100644
--- a/api/server/controllers/agents/client.js
+++ b/api/server/controllers/agents/client.js
@@ -9,9 +9,10 @@ const {
   logToolError,
   sanitizeTitle,
   payloadParser,
-  resolveHeaders,
   createSafeUser,
   initializeAgent,
+  resolveConfigHeaders,
+  countTokens,
   getBalanceConfig,
   omitTitleOptions,
   getProviderConfig,
@@ -20,6 +21,15 @@ const {
   applyContextToAgent,
   isMemoryAgentEnabled,
   recordCollectedUsage,
+  sendEvent,
+  computeUsageCostUSD,
+  aggregateEmittedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+  computeSummaryUsedTokens,
+  priorRunOutputTokens,
+  createSubagentUsageSink,
+  anyAgentReplaysReasoningContent,
   GenerationJobManager,
   getTransactionsConfig,
   resolveRecursionLimit,
@@ -28,11 +38,20 @@ const {
   createMultiAgentMapper,
   filterMalformedContentParts,
   countFormattedMessageTokens,
+  prependFileContext,
+  prependQuotes,
   hydrateMissingIndexTokenCounts,
   injectSkillPrimes,
+  collectFreshSkillPrimeNames,
   isSkillPrimeMessage,
+  collectFileIds,
+  processTextWithTokenLimit,
+  buildAgentScopedContext,
   buildSkillPrimeContentParts,
   buildInitialToolSessions,
+  hasUrlContextTool,
+  appendYouTubeVideoParts,
+  resolveYouTubeInjectionConfig,
 } = require('@librechat/api');
 const {
   Callback,
@@ -44,6 +63,7 @@ const {
 } = require('@librechat/agents');
 const {
   Constants,
+  UsageEvents,
   Permissions,
   VisionModes,
   ContentTypes,
@@ -53,6 +73,7 @@ const {
   isAgentsEndpoint,
   isEphemeralAgentId,
   removeNullishValues,
+  DEFAULT_MEMORY_MAX_INPUT_TOKENS,
 } = require('librechat-data-provider');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { encodeAndFormat } = require('~/server/services/Files/images/encode');
@@ -65,6 +86,8 @@ const db = require('~/models');
 
 const loadAgent = (params) => loadAgentFn(params, { getAgent: db.getAgent, getMCPServerTools });
 
+const MEMORY_INPUT_CHARS_PER_TOKEN = 8;
+
 class AgentClient extends BaseClient {
   constructor(options = {}) {
     super(null, options);
@@ -78,6 +101,14 @@ class AgentClient extends BaseClient {
     /** @type {AgentRun} */
     this.run;
 
+    /** Resolves with the agent run once `chatCompletion` initializes it (or
+     *  `null` if initialization fails), letting immediate-mode title generation
+     *  await the run instead of throwing when fired before the run exists.
+     *  @type {Promise<AgentRun | null> | null} */
+    this._runReady = null;
+    /** @type {((run: AgentRun | null) => void) | null} */
+    this._resolveRun = null;
+
     const {
       agentConfigs,
       contentParts,
@@ -86,11 +117,22 @@ class AgentClient extends BaseClient {
       artifactPromises,
       maxContextTokens,
       subagentAggregatorsByToolCallId,
+      contextUsageSink,
+      usageEmitSink,
       ...clientOptions
     } = options;
 
     this.agentConfigs = agentConfigs;
     this.maxContextTokens = maxContextTokens;
+    /** Latest visible context snapshot for this response, captured live by the
+     *  ON_CONTEXT_USAGE handler; persisted on `metadata.contextUsage`.
+     *  @type {{ latest: import('librechat-data-provider').TContextUsageEvent | null } | undefined} */
+    this.contextUsageSink = contextUsageSink;
+    /** Every emitted `on_token_usage` payload for this response (primary,
+     *  summarization, sequential, and subagent); aggregated into the rollup
+     *  persisted on `metadata.usage`.
+     *  @type {Array<import('librechat-data-provider').TTokenUsageEvent> | undefined} */
+    this.usageEmitSink = usageEmitSink;
     /** @type {MessageContentComplex[]} */
     this.contentParts = contentParts;
     /** @type {Array<UsageMetadata>} */
@@ -109,6 +151,11 @@ class AgentClient extends BaseClient {
      *  harvests `contentParts` onto the matching `subagent` tool_call
      *  so the child's full activity survives a page refresh. */
     this.subagentAggregatorsByToolCallId = subagentAggregatorsByToolCallId ?? new Map();
+    /** In-flight `on_token_usage` emits from subagent child runs. The sink
+     *  fires the emitter without awaiting, so chatCompletion's finally flushes
+     *  these before returning — otherwise job cleanup can race the persist.
+     *  @type {Promise<void>[]} */
+    this.pendingSubagentEmits = [];
     /** @type {AgentClientOptions} */
     this.options = Object.assign({ endpoint: options.endpoint }, clientOptions);
     /** @type {string} */
@@ -123,6 +170,8 @@ class AgentClient extends BaseClient {
     this.usage;
     /** @type {Record<string, number>} */
     this.indexTokenCountMap = {};
+    /** @type {Array<Record<string, unknown>> | null} */
+    this.memoryPayload = null;
     /** @type {(messages: BaseMessage[]) => Promise<void>} */
     this.processMemory;
   }
@@ -197,6 +246,7 @@ class AgentClient extends BaseClient {
         {
           spec: this.options.spec,
           iconURL: this.options.iconURL,
+          chatProjectId: this.options.chatProjectId,
           endpoint: this.options.endpoint,
           agent_id: this.options.agent.id,
           modelLabel: this.options.modelLabel,
@@ -270,10 +320,15 @@ class AgentClient extends BaseClient {
           }))
         : []),
     ];
+    const sharedRunAttachmentIds = new Set();
     if (this.options.attachments) {
       const attachments = await this.options.attachments;
       const latestMessage = orderedMessages[orderedMessages.length - 1];
 
+      for (const fileId of collectFileIds(attachments)) {
+        sharedRunAttachmentIds.add(fileId);
+      }
+
       if (this.message_file_map) {
         this.message_file_map[latestMessage.messageId] = attachments;
       } else {
@@ -297,39 +352,71 @@ class AgentClient extends BaseClient {
     }
 
     /** @type {Record<number, number>} */
-    const canonicalTokenCountMap = {};
+    const indexTokenCountMap = {};
     /** @type {Record<string, number>} */
     const tokenCountMap = {};
+    const memoryPayload = [];
+    let hasFileContext = false;
     let promptTokenTotal = 0;
+    const encoding = this.getEncoding();
     const formattedMessages = orderedMessages.map((message, i) => {
       const formattedMessage = formatMessage({
         message,
         userName: this.options?.name,
         assistantName: this.options?.modelLabel,
       });
+      const memoryFormattedMessage = formatMessage({
+        message,
+        userName: this.options?.name,
+        assistantName: this.options?.modelLabel,
+      });
 
-      /** For non-latest messages, prepend file context directly to message content */
-      if (message.fileContext && i !== orderedMessages.length - 1) {
-        if (typeof formattedMessage.content === 'string') {
-          formattedMessage.content = message.fileContext + '\n' + formattedMessage.content;
-        } else {
-          const textPart = formattedMessage.content.find((part) => part.type === 'text');
-          textPart
-            ? (textPart.text = message.fileContext + '\n' + textPart.text)
-            : formattedMessage.content.unshift({ type: 'text', text: message.fileContext });
-        }
+      /**
+       * Bind file context to the message it belongs to. Historical attachments
+       * are resent inline, so the current turn's text attachment must be inline
+       * too instead of living only in the dynamic system tail.
+       */
+      if (message.fileContext) {
+        hasFileContext = true;
+        prependFileContext(formattedMessage, message.fileContext);
+      }
+
+      /**
+       * Durably re-merge quoted excerpts into every user turn that carries them
+       * (current and historical) so the model receives the referenced context on
+       * every prompt and the token count matches what was persisted. Applied to
+       * the memory copy too so the canonical per-message count includes them.
+       */
+      if (Array.isArray(message.quotes) && message.quotes.length > 0) {
+        prependQuotes(formattedMessage, message.quotes);
+        prependQuotes(memoryFormattedMessage, message.quotes);
       }
 
-      const dbTokenCount = orderedMessages[i].tokenCount;
-      const needsTokenCount = !dbTokenCount || message.fileContext;
+      memoryPayload.push(memoryFormattedMessage);
 
-      if (needsTokenCount || (this.isVisionModel && (message.image_urls || message.files))) {
-        orderedMessages[i].tokenCount = countFormattedMessageTokens(
-          formattedMessage,
-          this.getEncoding(),
-        );
+      const dbTokenCount = Number(orderedMessages[i].tokenCount);
+      const hasDbTokenCount = Number.isFinite(dbTokenCount) && dbTokenCount > 0;
+      /**
+       * Force a recount when the message carries quotes: a plain text-only
+       * "Save" edit recomputes `tokenCount` from `text` alone while leaving
+       * `message.quotes` persisted, so the stored count would undercount the
+       * quote block this turn prepends. Recounting from the quote-merged memory
+       * copy keeps context accounting accurate (and self-heals stale counts).
+       */
+      const needsCanonicalTokenCount =
+        !hasDbTokenCount ||
+        (this.isVisionModel && (message.image_urls || message.files)) ||
+        (Array.isArray(message.quotes) && message.quotes.length > 0);
+
+      let canonicalTokenCount = hasDbTokenCount ? dbTokenCount : 0;
+      if (needsCanonicalTokenCount) {
+        canonicalTokenCount = countFormattedMessageTokens(memoryFormattedMessage, encoding);
       }
 
+      const promptMessageTokenCount = message.fileContext
+        ? countFormattedMessageTokens(formattedMessage, encoding)
+        : canonicalTokenCount;
+
       /* If message has files, calculate image token cost */
       if (this.message_file_map && this.message_file_map[message.messageId]) {
         const attachments = this.message_file_map[message.messageId];
@@ -344,13 +431,19 @@ class AgentClient extends BaseClient {
         }
       }
 
-      const tokenCount = Number(orderedMessages[i].tokenCount);
-      const normalizedTokenCount = Number.isFinite(tokenCount) && tokenCount > 0 ? tokenCount : 0;
-      canonicalTokenCountMap[i] = normalizedTokenCount;
-      promptTokenTotal += normalizedTokenCount;
+      const normalizedCanonicalTokenCount =
+        Number.isFinite(canonicalTokenCount) && canonicalTokenCount > 0 ? canonicalTokenCount : 0;
+      const normalizedPromptTokenCount =
+        Number.isFinite(promptMessageTokenCount) && promptMessageTokenCount > 0
+          ? promptMessageTokenCount
+          : 0;
+
+      orderedMessages[i].tokenCount = normalizedCanonicalTokenCount;
+      indexTokenCountMap[i] = normalizedPromptTokenCount;
+      promptTokenTotal += normalizedPromptTokenCount;
 
       if (message.messageId) {
-        tokenCountMap[message.messageId] = normalizedTokenCount;
+        tokenCountMap[message.messageId] = normalizedCanonicalTokenCount;
       }
 
       if (isEnabled(process.env.AGENT_DEBUG_LOGGING)) {
@@ -359,32 +452,62 @@ class AgentClient extends BaseClient {
           Array.isArray(message.content) && message.content.some((p) => p && p.type === 'summary');
         const suffix = hasSummary ? '[S]' : '';
         const id = (message.messageId ?? message.id ?? '').slice(-8);
-        const recalced = needsTokenCount ? orderedMessages[i].tokenCount : null;
+        const recalced = needsCanonicalTokenCount ? normalizedCanonicalTokenCount : null;
+        const promptRecalced = message.fileContext ? normalizedPromptTokenCount : null;
         logger.debug(
-          `[AgentClient] msg[${i}] ${role}${suffix} id=…${id} db=${dbTokenCount} needsRecount=${needsTokenCount} recalced=${recalced} tokens=${normalizedTokenCount}`,
+          `[AgentClient] msg[${i}] ${role}${suffix} id=…${id} db=${dbTokenCount} needsRecount=${needsCanonicalTokenCount} recalced=${recalced} promptRecalced=${promptRecalced} tokens=${normalizedPromptTokenCount}`,
         );
       }
 
       return formattedMessage;
     });
 
+    /**
+     * Native YouTube -> video understanding: when Google `url_context` is enabled
+     * (resolved to the native `urlContext` provider tool), inject any YouTube URLs
+     * from the latest user turn as Gemini `fileData` video parts. The URL Context
+     * tool cannot read YouTube, so this routes those links through the video path
+     * while other URLs still flow through `urlContext`. Done after token counting
+     * (video tokens are reported by the provider) and only on the LLM payload, so
+     * the memory copy and persisted message are untouched.
+     */
+    const latestOrdered = orderedMessages[orderedMessages.length - 1];
+    const provider = this.options.agent?.provider;
+    if (
+      latestOrdered?.isCreatedByUser === true &&
+      (provider === Providers.GOOGLE || provider === Providers.VERTEXAI) &&
+      hasUrlContextTool(this.options.agent?.tools)
+    ) {
+      const latestFormatted = formattedMessages[formattedMessages.length - 1];
+      /** Use the resolved run model (model_parameters override) rather than the saved base model. */
+      const resolvedModel =
+        this.options.agent?.model_parameters?.model ?? this.options.agent?.model;
+      const { max, mimeType } = resolveYouTubeInjectionConfig({
+        provider,
+        model: resolvedModel,
+      });
+      latestFormatted.content = appendYouTubeVideoParts({
+        enabled: true,
+        text: latestOrdered.text,
+        content: latestFormatted.content,
+        max,
+        mimeType,
+      });
+    }
+
     payload = formattedMessages;
+    this.memoryPayload = hasFileContext ? memoryPayload : null;
     messages = orderedMessages;
     promptTokens = promptTokenTotal;
 
     /**
      * Build shared run context - applies to ALL agents in the run.
-     * This includes file context from the latest message and augmented prompt (RAG).
+     * Request attachment file context is already bound inline to the latest
+     * user message above; only side-channel context belongs here.
      * Memory context is handled separately and applied per-agent based on config.
      */
     const sharedRunContextParts = [];
 
-    /** File context from the latest message (attachments) */
-    const latestMessage = orderedMessages[orderedMessages.length - 1];
-    if (latestMessage?.fileContext) {
-      sharedRunContextParts.push(latestMessage.fileContext);
-    }
-
     /** Augmented prompt from RAG/context handlers */
     if (this.contextHandlers) {
       this.augmentedPrompt = await this.contextHandlers.createContext();
@@ -402,8 +525,16 @@ class AgentClient extends BaseClient {
     const sharedRunContext = sharedRunContextParts.join('\n\n');
     const memoryAgentEnabled = isMemoryAgentEnabled(this.options.req.config?.memory);
 
-    /** Preserve canonical pre-format token counts for all history entering graph formatting */
-    this.indexTokenCountMap = canonicalTokenCountMap;
+    const agentScopedContext = await buildAgentScopedContext({
+      agentIds: allAgents.map(({ agentId }) => agentId),
+      attachmentsByAgentId: this.options.agentContextAttachmentsByAgentId,
+      sharedRunAttachmentIds,
+      req: this.options.req,
+      tokenCountFn: (text) => countTokens(text),
+    });
+
+    /** Preserve prompt token counts for graph formatting and pruning. */
+    this.indexTokenCountMap = indexTokenCountMap;
 
     /** Extract contextMeta from the parent response (second-to-last in ordered chain;
      *  last is the current user message). Seeds the pruner's calibration EMA for this run. */
@@ -439,10 +570,14 @@ class AgentClient extends BaseClient {
 
     await Promise.all(
       allAgents.map(({ agent, agentId }) => {
-        const agentRunContext =
-          memoryContext && (agentId === this.options.agent.id || memoryAgentEnabled)
-            ? [sharedRunContext, memoryContext].filter(Boolean).join('\n\n')
-            : sharedRunContext;
+        const agentRunContextParts = [sharedRunContext];
+        if (memoryContext && (agentId === this.options.agent.id || memoryAgentEnabled)) {
+          agentRunContextParts.push(memoryContext);
+        }
+        const scopedContext = agentScopedContext.get(agentId);
+        if (scopedContext) {
+          agentRunContextParts.push(scopedContext);
+        }
 
         return applyContextToAgent({
           agent,
@@ -450,7 +585,7 @@ class AgentClient extends BaseClient {
           logger,
           mcpManager,
           configServers,
-          sharedRunContext: agentRunContext,
+          sharedRunContext: agentRunContextParts.filter(Boolean).join('\n\n'),
           ephemeralAgent: agentId === this.options.agent.id ? ephemeralAgent : undefined,
         });
       }),
@@ -712,7 +847,44 @@ class AgentClient extends BaseClient {
 
       const filteredMessages = messagesToProcess.map((msg) => this.filterImageUrls(msg));
       const bufferString = getBufferString(filteredMessages);
-      const bufferMessage = new HumanMessage(`# Current Chat:\n\n${bufferString}`);
+      const configuredMaxInputTokens = Number.isFinite(memoryConfig?.maxInputTokens)
+        ? Math.floor(memoryConfig.maxInputTokens)
+        : undefined;
+      const maxInputTokens =
+        configuredMaxInputTokens != null && configuredMaxInputTokens > 0
+          ? configuredMaxInputTokens
+          : DEFAULT_MEMORY_MAX_INPUT_TOKENS;
+      const maxInputChars = maxInputTokens * MEMORY_INPUT_CHARS_PER_TOKEN;
+      const isCharTruncated = bufferString.length > maxInputChars;
+      const memoryInput = `# Current Chat:\n\n${
+        isCharTruncated
+          ? `[Earlier chat content omitted due to memory input limit]\n\n${bufferString.slice(
+              -maxInputChars,
+            )}`
+          : bufferString
+      }`;
+      const {
+        text: limitedMemoryInput,
+        tokenCount,
+        wasTruncated,
+      } = await processTextWithTokenLimit({
+        text: memoryInput,
+        tokenLimit: maxInputTokens,
+        tokenCountFn: (text) => countTokens(text),
+        preserve: 'end',
+      });
+      if (isCharTruncated || wasTruncated) {
+        logger.warn('[MemoryAgent] Memory input truncated before processing', {
+          tokenCount,
+          messageId: this.responseMessageId,
+          conversationId: this.conversationId,
+          maxInputTokens,
+          wasTruncated,
+          maxInputChars,
+          originalLength: bufferString.length,
+        });
+      }
+      const bufferMessage = new HumanMessage(limitedMemoryInput);
       return await this.processMemory([bufferMessage]);
     } catch (error) {
       logger.error('Memory Agent failed to process memory', error);
@@ -729,11 +901,100 @@ class AgentClient extends BaseClient {
     });
 
     const completion = filterMalformedContentParts(this.contentParts);
+    const metadata = this.buildResponseMetadata();
+    return metadata ? { completion, metadata } : { completion };
+  }
+
+  /**
+   * Assembles the response message `metadata`: Vertex thought signatures plus
+   * the persisted context breakdown (Part A) and the usage/cost rollup (Part B),
+   * which rebuild the gauge breakdown and branch/total cost across reloads.
+   * Returns undefined when nothing was captured.
+   * @returns {{
+   *   thoughtSignatures?: Record<string, string>,
+   *   contextUsage?: import('librechat-data-provider').TContextUsageEvent,
+   *   usage?: import('librechat-data-provider').TResponseUsage,
+   * } | undefined}
+   */
+  buildResponseMetadata() {
+    /** @type {{
+     *   thoughtSignatures?: Record<string, string>,
+     *   contextUsage?: import('librechat-data-provider').TContextUsageEvent,
+     *   usage?: import('librechat-data-provider').TResponseUsage,
+     * }} */
+    const metadata = {};
     const signatures = this.collectedThoughtSignatures;
-    if (!signatures || Object.keys(signatures).length === 0) {
-      return { completion };
+    if (signatures && Object.keys(signatures).length > 0) {
+      metadata.thoughtSignatures = signatures;
+    }
+    const usageEvents = this.usageEmitSink ?? [];
+    /** Persist the breakdown only when the latest snapshot's OWN run completed —
+     *  i.e. a PRIMARY usage event (usage_type == null) from that run's id arrived
+     *  AFTER the snapshot. Matching by run id keeps `completedOutputTokens` a real
+     *  post-snapshot delta even when parallel/direct runs interleave (A snapshot →
+     *  B snapshot → A usage must NOT persist B's snapshot with A's output); an
+     *  interrupted final call that emits no usage falls back to the per-message
+     *  estimate. It still keeps the post-summary snapshot: the summarization detour
+     *  emits an extra snapshot whose following primary usage shares that run's id,
+     *  which the old snapshot-count guard miscounted and wrongly dropped. Events
+     *  without a run id (older lib / resume) match any snapshot for back-compat. */
+    const latestSnapshot = this.contextUsageSink?.latest;
+    const latestSnapshotUsageIndex = this.contextUsageSink?.latestUsageIndex ?? 0;
+    const latestSnapshotRunId = latestSnapshot?.runId;
+    const hasPrimaryAfterSnapshot = usageEvents
+      .slice(latestSnapshotUsageIndex)
+      .some(
+        (event) =>
+          event.usage_type == null &&
+          (latestSnapshotRunId == null ||
+            event.runId == null ||
+            event.runId === latestSnapshotRunId),
+      );
+    if (latestSnapshot && hasPrimaryAfterSnapshot) {
+      metadata.contextUsage = buildPersistedContextUsage(latestSnapshot, usageEvents);
+    }
+    /** Lightweight summarization marker — persisted whenever this turn compacted
+     *  the context, INDEPENDENT of the snapshot guard above. When the client has
+     *  no usable snapshot on the branch and falls back to the per-message
+     *  estimate, it caps the discarded pre-summary history at this baseline
+     *  instead of re-summing it (the gauge otherwise reads 100% forever). Shared
+     *  with the abort save path via `computeSummaryUsedTokens`. Subtract the
+     *  response's earlier tool-loop outputs (the primaries that preceded the
+     *  latest snapshot, same run): those tokens are inside the snapshot baseline
+     *  AND in the response `tokenCount` the client estimate adds on top, so
+     *  leaving them in the marker double-counts them on a multi-call turn. */
+    const priorOutputTokens = priorRunOutputTokens(
+      usageEvents,
+      latestSnapshotUsageIndex,
+      latestSnapshotRunId,
+    );
+    const summaryUsedTokens = computeSummaryUsedTokens(latestSnapshot, priorOutputTokens);
+    if (summaryUsedTokens != null) {
+      metadata.summaryUsedTokens = summaryUsedTokens;
+    }
+    const usage = aggregateEmittedUsage(usageEvents);
+    if (usage) {
+      metadata.usage = usage;
     }
-    return { completion, metadata: { thoughtSignatures: signatures } };
+    return Object.keys(metadata).length > 0 ? metadata : undefined;
+  }
+
+  /**
+   * Resolves the endpoint token config for a usage item by its producing agent
+   * (multi-endpoint graphs: connected agents + subagents). A known agent's
+   * config is authoritative — including `undefined`, which prices with built-in
+   * rates (e.g. a non-custom agent in a custom-primary graph). Only an
+   * untagged/unknown agent falls back to the primary config, so single-endpoint
+   * graphs are unchanged.
+   * @param {UsageMetadata} usage
+   * @returns {import('@librechat/api').EndpointTokenConfig | undefined}
+   */
+  resolveAgentEndpointTokenConfig(usage) {
+    return resolveAgentTokenConfig({
+      agentId: usage?.agentId,
+      byAgentId: this.options.endpointTokenConfigByAgentId,
+      fallback: this.options.endpointTokenConfig,
+    });
   }
 
   /**
@@ -768,6 +1029,7 @@ class AgentClient extends BaseClient {
         balance,
         transactions,
         endpointTokenConfig: this.options.endpointTokenConfig,
+        resolveEndpointTokenConfig: (usage) => this.resolveAgentEndpointTokenConfig(usage),
       },
     );
 
@@ -784,6 +1046,84 @@ class AgentClient extends BaseClient {
     return this.usage;
   }
 
+  /**
+   * Builds the subagent usage emitter for {@link createSubagentUsageSink}.
+   * Streams each billed child-run usage to the client as an `on_token_usage`
+   * event tagged `subagent` (folds into session cost/totals, not the live
+   * gauge), with the authoritative cost when `interface.contextCost` is on.
+   * Returns undefined when there's no stream to write to.
+   * @param {AppConfig} [appConfig]
+   * @returns {((usage: UsageMetadata) => void) | undefined}
+   */
+  buildSubagentUsageEmitter(appConfig) {
+    const res = this.options.res;
+    const streamId = this.options.req?._resumableStreamId || null;
+    if (!res && !streamId) {
+      return undefined;
+    }
+    const includeCost = appConfig?.interfaceConfig?.contextCost === true;
+    return (usage) => {
+      const data = {
+        input_tokens: usage.input_tokens,
+        output_tokens: usage.output_tokens,
+        total_tokens: usage.total_tokens,
+        input_token_details: this.subagentCacheDetails(usage),
+        model: usage.model,
+        provider: usage.provider,
+        usage_type: 'subagent',
+        runId: this.responseMessageId,
+        /** Unique per collected entry (post-push length) for resume dedupe */
+        seq: this.collectedUsage.length,
+        /** Price with the SUBAGENT's own endpoint token config (its endpoint may
+         *  differ from the parent's); `usage.agentId` is tagged by the sink. */
+        cost: includeCost
+          ? computeUsageCostUSD(
+              usage,
+              { getMultiplier: db.getMultiplier, getCacheMultiplier: db.getCacheMultiplier },
+              this.resolveAgentEndpointTokenConfig(usage),
+            )
+          : undefined,
+      };
+      /** Fold into the response's usage rollup (synchronously, regardless of
+       *  emit success) so the persisted total matches the live session, which
+       *  also folds subagent usage into its cost/totals. */
+      if (this.usageEmitSink) {
+        this.usageEmitSink.push(data);
+      }
+      /** The sink fires this without awaiting, so retain the promise and flush
+       *  it in chatCompletion's finally — emitChunk persists (HSET) before
+       *  publishing, and job cleanup must not race that persist or resumed
+       *  clients miss billed subagent usage. */
+      const emit = (async () => {
+        try {
+          if (streamId) {
+            await GenerationJobManager.emitChunk(streamId, {
+              event: UsageEvents.ON_TOKEN_USAGE,
+              data,
+            });
+          } else {
+            sendEvent(res, { event: UsageEvents.ON_TOKEN_USAGE, data });
+          }
+        } catch (err) {
+          logger.warn('[AgentClient] Failed to emit subagent usage', err);
+        }
+      })();
+      this.pendingSubagentEmits.push(emit);
+      return emit;
+    };
+  }
+
+  /** Normalizes a subagent usage event's cache token details for emission. */
+  subagentCacheDetails(usage) {
+    const cache_creation =
+      usage.input_token_details?.cache_creation ?? usage.cache_creation_input_tokens;
+    const cache_read = usage.input_token_details?.cache_read ?? usage.cache_read_input_tokens;
+    if (cache_creation == null && cache_read == null) {
+      return undefined;
+    }
+    return { cache_creation, cache_read };
+  }
+
   /**
    * @param {TMessage} responseMessage
    * @returns {number}
@@ -856,12 +1196,53 @@ class AgentClient extends BaseClient {
         agents: [this.options.agent, ...(this.agentConfigs ? this.agentConfigs.values() : [])],
       });
 
+      /**
+       * Reconstruct `reasoning_content` on prior tool-call turns: DeepSeek
+       * thinking-mode (#13366) or custom endpoints opting in via
+       * `customParams.includeReasoningHistory` (e.g. Xiaomi MiMo, Kimi).
+       * Walks subagents too — the opted-in endpoint may appear only as a
+       * nested subagent, not the primary or a top-level handoff agent.
+       */
+      const needsReasoningContentFormat = anyAgentReplaysReasoningContent([
+        this.options.agent,
+        ...(this.agentConfigs ? Array.from(this.agentConfigs.values()) : []),
+      ]);
+      /**
+       * Skills primed fresh this turn — manual ($ popover) and always-apply
+       * (frontmatter). `injectSkillPrimes` (below) splices their SKILL.md
+       * bodies in, so `formatAgentMessages` must NOT also reconstruct the
+       * same names from a historical `skill` tool_call — otherwise the body
+       * lands twice and a prompt-cache marker can pin to the duplicated
+       * synthetic prefix. Names NOT primed this turn still reconstruct from
+       * history, preserving sticky manual re-priming across turns.
+       */
+      const manualSkillPrimes = this.options.agent?.manualSkillPrimes;
+      const alwaysApplySkillPrimes = this.options.agent?.alwaysApplySkillPrimes;
+      const freshSkillPrimeNames = collectFreshSkillPrimeNames({
+        manualSkillPrimes,
+        alwaysApplySkillPrimes,
+      });
+      const formatOptions =
+        needsReasoningContentFormat || freshSkillPrimeNames.size > 0
+          ? {
+              ...(needsReasoningContentFormat ? { preserveReasoningContent: true } : {}),
+              ...(freshSkillPrimeNames.size > 0
+                ? { skipSkillBodyNames: freshSkillPrimeNames }
+                : {}),
+            }
+          : undefined;
       let {
         messages: initialMessages,
         indexTokenCountMap,
         summary: initialSummary,
         boundaryTokenAdjustment,
-      } = formatAgentMessages(payload, this.indexTokenCountMap, toolSet, skillPrimeResult?.skills);
+      } = formatAgentMessages(
+        payload,
+        this.indexTokenCountMap,
+        toolSet,
+        skillPrimeResult?.skills,
+        formatOptions,
+      );
       if (boundaryTokenAdjustment) {
         logger.debug(
           `[AgentClient] Boundary token adjustment: ${boundaryTokenAdjustment.original} → ${boundaryTokenAdjustment.adjusted} (${boundaryTokenAdjustment.remainingChars}/${boundaryTokenAdjustment.totalChars} chars)`,
@@ -880,9 +1261,11 @@ class AgentClient extends BaseClient {
        * agent and multi-agent runs; how primes interact with handoff /
        * added-convo agents' per-agent state is an agents-SDK concern,
        * not this layer's to gate.
+       *
+       * `manualSkillPrimes` / `alwaysApplySkillPrimes` are resolved above
+       * (used to build `freshSkillPrimeNames` for dedupe against historical
+       * skill reconstruction).
        */
-      const manualSkillPrimes = this.options.agent?.manualSkillPrimes;
-      const alwaysApplySkillPrimes = this.options.agent?.alwaysApplySkillPrimes;
       if (
         (manualSkillPrimes && manualSkillPrimes.length > 0) ||
         (alwaysApplySkillPrimes && alwaysApplySkillPrimes.length > 0)
@@ -925,6 +1308,17 @@ class AgentClient extends BaseClient {
         tokenCounter,
       });
 
+      const memoryMessages =
+        this.processMemory && this.memoryPayload
+          ? formatAgentMessages(
+              this.memoryPayload,
+              undefined,
+              toolSet,
+              skillPrimeResult?.skills,
+              formatOptions,
+            ).messages
+          : initialMessages;
+
       /**
        * @param {BaseMessage[]} messages
        */
@@ -965,7 +1359,7 @@ class AgentClient extends BaseClient {
         // }
 
         if (this.processMemory) {
-          memoryPromise = this.runMemory(messages);
+          memoryPromise = this.runMemory(memoryMessages);
         }
 
         /** Seed calibration state from previous run if encoding matches */
@@ -993,9 +1387,21 @@ class AgentClient extends BaseClient {
           customHandlers: this.options.eventHandlers,
           requestBody: config.configurable.requestBody,
           user: createSafeUser(this.options.req?.user),
+          tenantId: this.options.req?.user?.tenantId,
           summarizationConfig: appConfig?.summarization,
           appConfig,
           tokenCounter,
+          /** Bills subagent child-run model calls — child graphs execute
+           *  outside the streamEvents loop, so ModelEndHandler never sees
+           *  them. Entries land in collectedUsage tagged
+           *  `usage_type: 'subagent'` and are spent by recordCollectedUsage.
+           *  The sink also streams each as an `on_token_usage` event so the
+           *  gauge's session cost/totals include billed subagent usage (the
+           *  `subagent` tag keeps it out of the live context meter). */
+          subagentUsageSink: createSubagentUsageSink(
+            this.collectedUsage,
+            this.buildSubagentUsageEmitter(appConfig),
+          ),
         });
 
         if (!run) {
@@ -1003,6 +1409,10 @@ class AgentClient extends BaseClient {
         }
 
         this.run = run;
+        if (this._resolveRun) {
+          this._resolveRun(run);
+          this._resolveRun = null;
+        }
 
         const streamId = this.options.req?._resumableStreamId;
         if (streamId && run.Graph) {
@@ -1079,11 +1489,12 @@ class AgentClient extends BaseClient {
         });
       }
     } catch (err) {
-      logger.error(
-        '[api/server/controllers/agents/client.js #sendCompletion] Operation aborted',
-        err,
-      );
-      if (!abortController.signal.aborted) {
+      if (abortController.signal.aborted) {
+        logger.debug(
+          '[api/server/controllers/agents/client.js #sendCompletion] Operation aborted by user',
+          { conversationId: this.conversationId, name: err?.name, code: err?.code },
+        );
+      } else {
         logger.error(
           '[api/server/controllers/agents/client.js #sendCompletion] Unhandled error type',
           err,
@@ -1108,6 +1519,14 @@ class AgentClient extends BaseClient {
 
       this.finalizeSubagentContent();
 
+      /** Flush subagent usage emits the sink fired without awaiting, so their
+       *  persist/publish completes before we return and the job is cleaned up
+       *  (resumed clients read this persisted usage). */
+      if (this.pendingSubagentEmits.length > 0) {
+        await Promise.allSettled(this.pendingSubagentEmits);
+        this.pendingSubagentEmits = [];
+      }
+
       try {
         const attachments = await this.awaitMemoryWithTimeout(memoryPromise);
         if (attachments && attachments.length > 0) {
@@ -1134,6 +1553,10 @@ class AgentClient extends BaseClient {
           err,
         );
       }
+      if (this._resolveRun) {
+        this._resolveRun(this.run ?? null);
+        this._resolveRun = null;
+      }
       run = null;
       config = null;
       memoryPromise = null;
@@ -1141,14 +1564,58 @@ class AgentClient extends BaseClient {
   }
 
   /**
-   *
+   * Resolves with the agent run once it is initialized, or `null` if
+   * initialization fails. Lets immediate-mode title generation await the run
+   * instead of throwing when fired before `chatCompletion` assigns `this.run`.
+   * Rejects promptly if the provided signal aborts before the run is ready.
+   * @param {AbortSignal} [signal]
+   * @returns {Promise<AgentRun | null>}
+   */
+  _waitForRun(signal) {
+    if (this.run) {
+      return Promise.resolve(this.run);
+    }
+    if (!this._runReady) {
+      this._runReady = new Promise((resolve) => {
+        this._resolveRun = resolve;
+      });
+    }
+    if (!signal) {
+      return this._runReady;
+    }
+    if (signal.aborted) {
+      return Promise.reject(new Error('Aborted before run initialization'));
+    }
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(new Error('Aborted before run initialization'));
+      signal.addEventListener('abort', onAbort, { once: true });
+      this._runReady.then((run) => {
+        signal.removeEventListener('abort', onAbort);
+        resolve(run);
+      });
+    });
+  }
+
+  /**
    * @param {Object} params
    * @param {string} params.text
-   * @param {string} params.conversationId
+   * @param {AbortController} params.abortController
+   * @param {boolean} [params.immediate] When true, the title is generated as soon
+   *   as the request is made — the run is awaited (instead of throwing) and the
+   *   title derives from the user's input only (`contentParts` is empty).
    */
-  async titleConvo({ text, abortController }) {
+  async titleConvo({ text, abortController, immediate = false }) {
     if (!this.run) {
-      throw new Error('Run not initialized');
+      if (!immediate) {
+        throw new Error('Run not initialized');
+      }
+      await this._waitForRun(abortController?.signal);
+      if (!this.run) {
+        logger.debug(
+          '[api/server/controllers/agents/client.js #titleConvo] Run unavailable for immediate title generation',
+        );
+        return;
+      }
     }
     const { handleLLMEnd, collected: collectedMetadata } = createMetadataAggregator();
     const { req, agent } = this.options;
@@ -1254,12 +1721,25 @@ class AgentClient extends BaseClient {
       delete clientOptions.modelKwargs.max_output_tokens;
     }
 
+    /** `omitTitleOptions` drops the Anthropic `clientOptions` carrier (thinking,
+     *  streaming, etc.), which would also drop its `defaultHeaders` — preserve the
+     *  original `clientOptions` object so gateway/reverse-proxy metadata still
+     *  reaches title requests (the proxy may require it for auth/routing). Restore
+     *  the SAME object reference, not a copy: the Vertex `createClient` closure from
+     *  `getLLMConfig` closes over this object, so `resolveConfigHeaders` must mutate
+     *  the very object the client is built from. */
+    const anthropicClientOptions = clientOptions?.clientOptions;
+
     clientOptions = Object.assign(
       Object.fromEntries(
         Object.entries(clientOptions).filter(([key]) => !omitTitleOptions.has(key)),
       ),
     );
 
+    if (anthropicClientOptions?.defaultHeaders != null && clientOptions.clientOptions == null) {
+      clientOptions.clientOptions = anthropicClientOptions;
+    }
+
     if (
       provider === Providers.GOOGLE &&
       (endpointConfig?.titleMethod === TitleMethod.FUNCTIONS ||
@@ -1268,27 +1748,26 @@ class AgentClient extends BaseClient {
       clientOptions.json = true;
     }
 
-    /** Resolve request-based headers for Custom Endpoints. Note: if this is added to
-     *  non-custom endpoints, needs consideration of varying provider header configs.
+    /** Resolve request-based headers across provider-specific header locations:
+     *  OpenAI `configuration.defaultHeaders`, Anthropic `clientOptions.defaultHeaders`
+     *  (preserved above), and Google `customHeaders`.
      */
-    if (clientOptions?.configuration?.defaultHeaders != null) {
-      clientOptions.configuration.defaultHeaders = resolveHeaders({
-        headers: clientOptions.configuration.defaultHeaders,
-        user: createSafeUser(this.options.req?.user),
-        body: {
-          messageId: this.responseMessageId,
-          conversationId: this.conversationId,
-          parentMessageId: this.parentMessageId,
-        },
-      });
-    }
+    resolveConfigHeaders({
+      llmConfig: clientOptions,
+      user: createSafeUser(this.options.req?.user),
+      body: {
+        messageId: this.responseMessageId,
+        conversationId: this.conversationId,
+        parentMessageId: this.parentMessageId,
+      },
+    });
 
     try {
       const titleResult = await this.run.generateTitle({
         provider,
         clientOptions,
         inputText: text,
-        contentParts: this.contentParts,
+        contentParts: immediate ? [] : this.contentParts,
         titleMethod: endpointConfig?.titleMethod,
         titlePrompt: endpointConfig?.titlePrompt,
         titlePromptTemplate: endpointConfig?.titlePromptTemplate,
diff --git a/api/server/controllers/agents/client.test.js b/api/server/controllers/agents/client.test.js
index 31bd5227d5f..c71ede7b237 100644
--- a/api/server/controllers/agents/client.test.js
+++ b/api/server/controllers/agents/client.test.js
@@ -1,5 +1,5 @@
 const { Providers } = require('@librechat/agents');
-const { Constants, EModelEndpoint } = require('librechat-data-provider');
+const { Constants, ContentTypes, EModelEndpoint } = require('librechat-data-provider');
 const AgentClient = require('./client');
 
 jest.mock('@librechat/agents', () => ({
@@ -13,6 +13,8 @@ jest.mock('@librechat/agents', () => ({
 jest.mock('@librechat/api', () => ({
   ...jest.requireActual('@librechat/api'),
   checkAccess: jest.fn(),
+  countFormattedMessageTokens: jest.fn(() => 42),
+  countTokens: jest.fn((text) => Math.ceil(String(text ?? '').length / 4)),
   initializeAgent: jest.fn(),
   createMemoryProcessor: jest.fn(),
   isMemoryAgentEnabled: jest.fn((config) => {
@@ -126,6 +128,52 @@ describe('AgentClient - titleConvo', () => {
       ).rejects.toThrow('Run not initialized');
     });
 
+    it('waits for the run in immediate mode instead of throwing', async () => {
+      client.run = null;
+      const abortController = new AbortController();
+
+      const titlePromise = client.titleConvo({ text: 'Test', abortController, immediate: true });
+
+      // Simulate `chatCompletion` assigning the run (client.js: `this.run = run`).
+      client.run = mockRun;
+      client._resolveRun(mockRun);
+
+      await titlePromise;
+      expect(mockRun.generateTitle).toHaveBeenCalled();
+    });
+
+    it('passes empty contentParts in immediate mode (title from the user input only)', async () => {
+      client.contentParts = [{ type: 'text', text: 'Streaming response so far' }];
+      const abortController = new AbortController();
+
+      await client.titleConvo({ text: 'Hello there', abortController, immediate: true });
+
+      const call = mockRun.generateTitle.mock.calls[0][0];
+      expect(call.contentParts).toEqual([]);
+      expect(call.inputText).toBe('Hello there');
+    });
+
+    it('uses live contentParts in non-immediate (final) mode', async () => {
+      client.contentParts = [{ type: 'text', text: 'Full response' }];
+      const abortController = new AbortController();
+
+      await client.titleConvo({ text: 'Hello there', abortController });
+
+      const call = mockRun.generateTitle.mock.calls[0][0];
+      expect(call.contentParts).toEqual([{ type: 'text', text: 'Full response' }]);
+    });
+
+    it('rejects promptly when aborted before the run initializes in immediate mode', async () => {
+      client.run = null;
+      const abortController = new AbortController();
+      abortController.abort();
+
+      await expect(
+        client.titleConvo({ text: 'Test', abortController, immediate: true }),
+      ).rejects.toThrow('Aborted before run initialization');
+      expect(mockRun.generateTitle).not.toHaveBeenCalled();
+    });
+
     it('should use titlePrompt from endpoint config', async () => {
       const text = 'Test conversation text';
       const abortController = new AbortController();
@@ -177,6 +225,51 @@ describe('AgentClient - titleConvo', () => {
       expect(generateTitleCall.clientOptions.model).toBe('gpt-3.5-turbo');
     });
 
+    it('preserves Anthropic custom headers on title requests despite omitTitleOptions', async () => {
+      const prevKey = process.env.ANTHROPIC_API_KEY;
+      process.env.ANTHROPIC_API_KEY = 'sk-ant-test';
+      try {
+        const req = {
+          user: { id: 'user-123' },
+          body: { model: 'claude-sonnet-4-5', endpoint: EModelEndpoint.anthropic, key: null },
+          config: {
+            endpoints: {
+              [EModelEndpoint.anthropic]: {
+                headers: { 'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+              },
+            },
+          },
+        };
+        const agent = {
+          id: 'agent-anthropic',
+          endpoint: EModelEndpoint.anthropic,
+          provider: EModelEndpoint.anthropic,
+          model_parameters: { model: 'claude-sonnet-4-5' },
+        };
+        const anthropicClient = new AgentClient({ req, res: {}, agent, endpointTokenConfig: {} });
+        anthropicClient.run = mockRun;
+        anthropicClient.responseMessageId = 'response-123';
+        anthropicClient.conversationId = 'convo-123';
+        anthropicClient.contentParts = [{ type: 'text', text: 'Test content' }];
+        anthropicClient.recordCollectedUsage = jest.fn().mockResolvedValue();
+
+        await anthropicClient.titleConvo({ text: 'Hello', abortController: new AbortController() });
+
+        const defaultHeaders =
+          mockRun.generateTitle.mock.calls[0][0].clientOptions?.clientOptions?.defaultHeaders;
+        // Custom header survives the `omitTitleOptions` strip and resolves the conversationId
+        expect(defaultHeaders?.['X-Conversation-Id']).toBe('convo-123');
+        // Provider-managed beta header is preserved alongside it
+        expect(defaultHeaders?.['anthropic-beta']).toBeDefined();
+      } finally {
+        if (prevKey === undefined) {
+          delete process.env.ANTHROPIC_API_KEY;
+        } else {
+          process.env.ANTHROPIC_API_KEY = prevKey;
+        }
+      }
+    });
+
     it('should handle missing endpoint config gracefully', async () => {
       // Remove endpoint config
       mockReq.config = { endpoints: {} };
@@ -1429,6 +1522,323 @@ describe('AgentClient - titleConvo', () => {
     });
   });
 
+  describe('buildMessages with request and agent-scoped context attachments', () => {
+    let client;
+    let mockReq;
+    let mockRes;
+    let mockAgent;
+
+    const makeTextFile = (file_id, filename, text) => ({
+      user: 'user-123',
+      file_id,
+      filename,
+      filepath: `/uploads/${filename}`,
+      object: 'file',
+      type: 'text/plain',
+      bytes: text.length,
+      embedded: false,
+      usage: 0,
+      source: 'text',
+      text,
+    });
+
+    const makeUploadedFile = (file_id, filename, type) => ({
+      user: 'user-123',
+      file_id,
+      filename,
+      filepath: `/uploads/${filename}`,
+      object: 'file',
+      type,
+      bytes: 128,
+      embedded: false,
+      usage: 0,
+      source: 'local',
+    });
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockFormatInstructions.mockResolvedValue('');
+      require('@librechat/api').countFormattedMessageTokens.mockImplementation(() => 42);
+
+      mockAgent = {
+        id: 'primary-agent',
+        endpoint: EModelEndpoint.openAI,
+        provider: EModelEndpoint.openAI,
+        instructions: 'Primary instructions',
+        model_parameters: {
+          model: 'gpt-4',
+        },
+        tools: [],
+      };
+
+      mockReq = {
+        user: {
+          id: 'user-123',
+          personalization: {
+            memories: true,
+          },
+        },
+        body: {
+          endpoint: EModelEndpoint.openAI,
+          fileTokenLimit: 1000,
+        },
+        config: {
+          memory: {
+            disabled: true,
+          },
+        },
+      };
+      mockRes = {};
+
+      client = new AgentClient({
+        req: mockReq,
+        res: mockRes,
+        agent: mockAgent,
+        endpoint: EModelEndpoint.agents,
+      });
+      client.conversationId = 'convo-123';
+      client.responseMessageId = 'response-123';
+      client.shouldSummarize = false;
+      client.maxContextTokens = 4096;
+      client.useMemory = jest.fn().mockResolvedValue(undefined);
+    });
+
+    it.each([
+      ['CSV', 'csv-file', 'sample.csv', 'text/csv'],
+      [
+        'XLSX',
+        'xlsx-file',
+        'sample.xlsx',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+      ],
+    ])(
+      'routes default-supported provider uploads like %s as request documents without custom file config',
+      async (_label, file_id, filename, type) => {
+        const currentFile = makeUploadedFile(file_id, filename, type);
+        const message = {
+          messageId: 'msg-1',
+          parentMessageId: null,
+          sender: 'User',
+          text: `Read this ${filename}.`,
+          isCreatedByUser: true,
+        };
+
+        client.addDocuments = jest.fn(async (targetMessage, attachments) => {
+          targetMessage.documents = attachments.map((file) => ({
+            type: 'input_file',
+            filename: file.filename,
+            file_data: `data:${file.type};base64,Y29sMQox`,
+          }));
+          return attachments;
+        });
+
+        const files = await client.processAttachments(message, [currentFile]);
+
+        expect(client.addDocuments).toHaveBeenCalledWith(message, [currentFile]);
+        expect(message.documents).toEqual([
+          expect.objectContaining({
+            type: 'input_file',
+            filename,
+          }),
+        ]);
+        expect(files).toEqual([currentFile]);
+      },
+    );
+
+    it('places request context inline and applies each agent context doc only once', async () => {
+      const requestFile = makeTextFile('request-file', 'request.txt', 'Shared request context');
+      const primaryContext = makeTextFile(
+        'primary-context',
+        'primary.txt',
+        'Primary private context',
+      );
+      const handoffContext = makeTextFile(
+        'handoff-context',
+        'handoff.txt',
+        'Handoff private context',
+      );
+      const handoffAgent = {
+        id: 'handoff-agent',
+        endpoint: EModelEndpoint.openAI,
+        provider: EModelEndpoint.openAI,
+        instructions: 'Handoff instructions',
+        model_parameters: {
+          model: 'gpt-4',
+        },
+        tools: [],
+      };
+
+      client.options.attachments = [requestFile];
+      client.options.agentContextAttachmentsByAgentId = new Map([
+        ['primary-agent', [primaryContext]],
+        ['handoff-agent', [handoffContext]],
+      ]);
+      client.agentConfigs = new Map([['handoff-agent', handoffAgent]]);
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'Use the available context.',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-1',
+        {},
+      );
+
+      expect(result.prompt[0].content).toContain('Shared request context');
+
+      expect(mockAgent.additional_instructions).toContain('Primary private context');
+      expect(mockAgent.additional_instructions).not.toContain('Shared request context');
+      expect(mockAgent.additional_instructions).not.toContain('Handoff private context');
+
+      expect(handoffAgent.additional_instructions).toContain('Handoff private context');
+      expect(handoffAgent.additional_instructions).not.toContain('Shared request context');
+      expect(handoffAgent.additional_instructions).not.toContain('Primary private context');
+    });
+
+    it('places current request file context on the latest user message', async () => {
+      const currentFile = makeTextFile('current-file', 'current.txt', 'Current turn file body');
+      const previousFileContext =
+        'Attached document(s):\n```md\n# "previous.txt"\nPrevious turn file body\n```';
+
+      client.options.attachments = [currentFile];
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+            fileContext: previousFileContext,
+          },
+          {
+            messageId: 'msg-2',
+            parentMessageId: 'msg-1',
+            sender: 'Assistant',
+            text: 'It describes the previous file.',
+            isCreatedByUser: false,
+          },
+          {
+            messageId: 'msg-3',
+            parentMessageId: 'msg-2',
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-3',
+        {},
+      );
+
+      expect(result.prompt[0].content).toContain('Previous turn file body');
+      expect(result.prompt[2].content).toContain('Current turn file body');
+      expect(result.prompt[2].content).toContain('What is written here?');
+      expect(result.prompt[2].content).not.toContain('Previous turn file body');
+      expect(client.memoryPayload[2].content).toContain('What is written here?');
+      expect(client.memoryPayload[2].content).not.toContain('Current turn file body');
+      expect(mockAgent.additional_instructions ?? '').not.toContain('Current turn file body');
+      expect(result.prompt[2].content.indexOf('Current turn file body')).toBeLessThan(
+        result.prompt[2].content.indexOf('What is written here?'),
+      );
+    });
+
+    it('persists canonical token counts while counting request file context for the prompt', async () => {
+      const { countFormattedMessageTokens } = require('@librechat/api');
+      const currentFile = makeTextFile('current-file', 'current.txt', 'Current turn file body');
+
+      countFormattedMessageTokens.mockImplementation(({ content }) => {
+        const text = Array.isArray(content)
+          ? content.map((part) => part.text ?? part[ContentTypes.TEXT] ?? '').join('\n')
+          : String(content ?? '');
+        return text.includes('Current turn file body') ? 200 : 20;
+      });
+
+      client.options.attachments = [currentFile];
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-1',
+        {},
+      );
+
+      expect(result.prompt[0].content).toContain('Current turn file body');
+      expect(result.tokenCountMap['msg-1']).toBe(20);
+      expect(result.promptTokens).toBe(200);
+      expect(client.indexTokenCountMap[0]).toBe(200);
+      expect(client.memoryPayload[0].content).toBe('What is written here?');
+    });
+
+    it('does not duplicate a file that is both request context and scoped context', async () => {
+      const sharedFile = makeTextFile('shared-file', 'shared.txt', 'Shared duplicate context');
+
+      client.options.attachments = [sharedFile];
+      client.options.agentContextAttachmentsByAgentId = new Map([['primary-agent', [sharedFile]]]);
+      client.agentConfigs = new Map();
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'Use the available context.',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-1',
+        {},
+      );
+
+      const inlineOccurrences = (result.prompt[0].content.match(/Shared duplicate context/g) ?? [])
+        .length;
+      expect(inlineOccurrences).toBe(1);
+      expect(mockAgent.additional_instructions ?? '').not.toContain('Shared duplicate context');
+    });
+
+    it('keeps direct chats with context-doc agents working without request attachments', async () => {
+      const primaryContext = makeTextFile(
+        'primary-context',
+        'primary.txt',
+        'Direct primary context',
+      );
+
+      client.options.agentContextAttachmentsByAgentId = new Map([
+        ['primary-agent', [primaryContext]],
+      ]);
+      client.agentConfigs = new Map();
+
+      await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'Answer from your context.',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-1',
+        {},
+      );
+
+      expect(mockAgent.additional_instructions).toContain('Direct primary context');
+    });
+  });
+
   describe('runMemory method', () => {
     let client;
     let mockReq;
@@ -1645,6 +2055,25 @@ describe('AgentClient - titleConvo', () => {
       expect(processedMessage.content).not.toContain('Response 1');
     });
 
+    it('should cap memory input tokens and preserve recent content', async () => {
+      const { HumanMessage, AIMessage } = require('@librechat/agents/langchain/messages');
+      mockReq.config.memory.maxInputTokens = 12;
+      const messages = [
+        new HumanMessage(`OLDER_CONTENT ${'a'.repeat(600)}`),
+        new AIMessage('Intermediate response'),
+        new HumanMessage('Please remember LATEST_MEMORY_MARKER'),
+      ];
+
+      await client.runMemory(messages);
+
+      expect(mockProcessMemory).toHaveBeenCalledTimes(1);
+      const processedMessage = mockProcessMemory.mock.calls[0][0][0];
+
+      expect(processedMessage.content).toContain('LATEST_MEMORY_MARKER');
+      expect(processedMessage.content).not.toContain('OLDER_CONTENT');
+      expect(Math.ceil(processedMessage.content.length / 4)).toBeLessThanOrEqual(12);
+    });
+
     it('should return early if processMemory is not set', async () => {
       const { HumanMessage } = require('@librechat/agents/langchain/messages');
       client.processMemory = null;
diff --git a/api/server/controllers/agents/filterAuthorizedTools.spec.js b/api/server/controllers/agents/filterAuthorizedTools.spec.js
index e6b41aef161..89835fac069 100644
--- a/api/server/controllers/agents/filterAuthorizedTools.spec.js
+++ b/api/server/controllers/agents/filterAuthorizedTools.spec.js
@@ -1,12 +1,13 @@
 const mongoose = require('mongoose');
 const { v4: uuidv4 } = require('uuid');
-const { Constants } = require('librechat-data-provider');
+const { Constants, actionDelimiter } = require('librechat-data-provider');
 const { agentSchema } = require('@librechat/data-schemas');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
 const d = Constants.mcp_delimiter;
 
 const mockGetAllServerConfigs = jest.fn();
+const mockUserCanUseMCPServers = jest.fn();
 
 jest.mock('~/server/services/Config', () => ({
   getCachedTools: jest.fn().mockResolvedValue({
@@ -24,6 +25,10 @@ jest.mock('~/config', () => ({
 
 jest.mock('~/server/services/MCP', () => ({
   resolveConfigServers: jest.fn().mockResolvedValue({}),
+  createMCPPermissionContext: jest.fn((req) => ({
+    canUseServers: (user) => mockUserCanUseMCPServers(user, req),
+  })),
+  userCanUseMCPServers: (...args) => mockUserCanUseMCPServers(...args),
 }));
 
 jest.mock('~/server/services/Files/strategies', () => ({
@@ -106,6 +111,7 @@ describe('MCP Tool Authorization', () => {
       authorizedServer: { type: 'sse', url: 'https://authorized.example.com' },
       anotherServer: { type: 'sse', url: 'https://another.example.com' },
     });
+    mockUserCanUseMCPServers.mockResolvedValue(true);
 
     mockReq = {
       user: {
@@ -127,11 +133,13 @@ describe('MCP Tool Authorization', () => {
   describe('filterAuthorizedTools', () => {
     const availableTools = { web_search: true, custom_tool: true };
     const userId = 'test-user-123';
+    const testUser = { id: userId, role: 'USER' };
 
     test('should keep authorized MCP tools and strip unauthorized ones', async () => {
       const result = await filterAuthorizedTools({
         tools: [`toolA${d}authorizedServer`, `toolB${d}forbiddenServer`, 'web_search'],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -140,6 +148,39 @@ describe('MCP Tool Authorization', () => {
       expect(result).not.toContain(`toolB${d}forbiddenServer`);
     });
 
+    test('should strip MCP tools when user lacks MCP server use permission', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+
+      const result = await filterAuthorizedTools({
+        tools: [
+          `toolA${d}authorizedServer`,
+          `${Constants.mcp_all}${d}authorizedServer`,
+          'web_search',
+        ],
+        userId,
+        user: testUser,
+        availableTools,
+      });
+
+      expect(result).toEqual(['web_search']);
+      expect(mockUserCanUseMCPServers).toHaveBeenCalledWith({ id: userId, role: 'USER' });
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
+    test('should strip MCP tools when user context is missing', async () => {
+      mockUserCanUseMCPServers.mockResolvedValueOnce(false);
+
+      const result = await filterAuthorizedTools({
+        tools: [`toolA${d}authorizedServer`, 'web_search'],
+        userId,
+        availableTools,
+      });
+
+      expect(result).toEqual(['web_search']);
+      expect(mockUserCanUseMCPServers).toHaveBeenCalledWith(undefined);
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
     test('should keep system tools without querying MCP registry', async () => {
       const result = await filterAuthorizedTools({
         tools: ['execute_code', 'file_search', 'web_search'],
@@ -170,6 +211,7 @@ describe('MCP Tool Authorization', () => {
       const result = await filterAuthorizedTools({
         tools: [`toolA${d}someServer`, 'web_search'],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -188,6 +230,7 @@ describe('MCP Tool Authorization', () => {
           `steal${d}nonexistent`,
         ],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -224,6 +267,7 @@ describe('MCP Tool Authorization', () => {
       await filterAuthorizedTools({
         tools: [`tool${d}authorizedServer`],
         userId: 'specific-user-id',
+        user: { id: 'specific-user-id', role: 'USER' },
         availableTools,
       });
 
@@ -241,6 +285,7 @@ describe('MCP Tool Authorization', () => {
       const result = await filterAuthorizedTools({
         tools: [`tool${d}config-override-server`, `tool${d}unauthorizedServer`],
         userId,
+        user: testUser,
         availableTools,
         configServers,
       });
@@ -254,6 +299,7 @@ describe('MCP Tool Authorization', () => {
       await filterAuthorizedTools({
         tools: [`tool1${d}authorizedServer`, `tool2${d}anotherServer`, `tool3${d}unknownServer`],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -270,6 +316,7 @@ describe('MCP Tool Authorization', () => {
       const result = await filterAuthorizedTools({
         tools: [...existingTools, `newTool${d}unknownServer`, 'web_search'],
         userId,
+        user: testUser,
         availableTools,
         existingTools,
       });
@@ -288,6 +335,7 @@ describe('MCP Tool Authorization', () => {
       const result = await filterAuthorizedTools({
         tools: [`toolA${d}serverA`, 'web_search'],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -303,6 +351,7 @@ describe('MCP Tool Authorization', () => {
       const result = await filterAuthorizedTools({
         tools: [malformedTool, `legit${d}serverA`, 'web_search'],
         userId,
+        user: testUser,
         availableTools,
         existingTools: [malformedTool, `legit${d}serverA`],
       });
@@ -312,6 +361,43 @@ describe('MCP Tool Authorization', () => {
       expect(result).not.toContain(malformedTool);
     });
 
+    test('should gate app-level MCP tools present in the global tool cache', async () => {
+      const appMcpTool = `appTool${d}authorizedServer`;
+      const forbiddenAppMcpTool = `appTool${d}forbiddenServer`;
+      const cacheWithMCPTools = {
+        ...availableTools,
+        [appMcpTool]: true,
+        [forbiddenAppMcpTool]: true,
+      };
+
+      const result = await filterAuthorizedTools({
+        tools: [appMcpTool, forbiddenAppMcpTool, 'web_search'],
+        userId,
+        user: testUser,
+        availableTools: cacheWithMCPTools,
+      });
+
+      expect(result).toContain(appMcpTool);
+      expect(result).toContain('web_search');
+      expect(result).not.toContain(forbiddenAppMcpTool);
+    });
+
+    test('should strip app-level MCP tools from the cache when user lacks MCP server use permission', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      const appMcpTool = `appTool${d}authorizedServer`;
+      const cacheWithMCPTools = { ...availableTools, [appMcpTool]: true };
+
+      const result = await filterAuthorizedTools({
+        tools: [appMcpTool, 'web_search'],
+        userId,
+        user: testUser,
+        availableTools: cacheWithMCPTools,
+      });
+
+      expect(result).toEqual(['web_search']);
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
     test('should reject malformed MCP tool keys with multiple delimiters', async () => {
       const result = await filterAuthorizedTools({
         tools: [
@@ -321,6 +407,7 @@ describe('MCP Tool Authorization', () => {
           'web_search',
         ],
         userId,
+        user: testUser,
         availableTools,
       });
 
@@ -348,6 +435,27 @@ describe('MCP Tool Authorization', () => {
       expect(agent.tools).not.toContain(`attack${d}forbiddenServer`);
     });
 
+    test('should strip all MCP tools on create when user lacks MCP server use permission', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.body = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'MCP Denied Test Agent',
+        tools: [
+          'web_search',
+          `validTool${d}authorizedServer`,
+          `${Constants.mcp_all}${d}authorizedServer`,
+        ],
+      };
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+      const agent = mockRes.json.mock.calls[0][0];
+      expect(agent.tools).toEqual(['web_search']);
+      expect(agent.mcpServerNames).toEqual([]);
+    });
+
     test('should not 500 when MCP registry is uninitialized', async () => {
       getMCPServersRegistry.mockImplementation(() => {
         throw new Error('MCPServersRegistry has not been initialized.');
@@ -446,6 +554,129 @@ describe('MCP Tool Authorization', () => {
       expect(updatedAgent.tools).not.toContain(`attack${d}forbiddenServer`);
     });
 
+    test('should strip all MCP tools, including retained ones, when user lacks MCP server use permission', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        tools: ['web_search', `existingTool${d}authorizedServer`, `newTool${d}anotherServer`],
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      // Permission revoked: update must not preserve stale MCP bindings, matching
+      // the create/duplicate/revert paths.
+      expect(updatedAgent.tools).toEqual(['web_search']);
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
+    test('should strip retained MCP tools on an unrelated owner edit after permission revocation', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Renamed After Revocation',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.tools).toEqual(['web_search']);
+      expect(updatedAgent.name).toBe('Renamed After Revocation');
+    });
+
+    test('should not strip shared agent MCP tools on unrelated editor changes after revocation', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = new mongoose.Types.ObjectId().toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Shared Rename After Revocation',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(updatedAgent.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(updatedAgent.name).toBe('Shared Rename After Revocation');
+      expect(agentInDb.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(agentInDb.mcpServerNames).toEqual(['authorizedServer']);
+    });
+
+    test('should not strip shared agent MCP tools on frontend-style full tools save after revocation', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = new mongoose.Types.ObjectId().toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Shared Full Save After Revocation',
+        tools: ['web_search', `existingTool${d}authorizedServer`],
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(updatedAgent.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(updatedAgent.name).toBe('Shared Full Save After Revocation');
+      expect(agentInDb.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(agentInDb.mcpServerNames).toEqual(['authorizedServer']);
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
+    test('should reject new shared-agent MCP tools after revocation while retaining existing MCP tools', async () => {
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = new mongoose.Types.ObjectId().toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        tools: ['web_search', `existingTool${d}authorizedServer`, `newTool${d}anotherServer`],
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(updatedAgent.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(updatedAgent.tools).not.toContain(`newTool${d}anotherServer`);
+      expect(agentInDb.tools).toContain(`existingTool${d}authorizedServer`);
+      expect(agentInDb.tools).not.toContain(`newTool${d}anotherServer`);
+      expect(agentInDb.mcpServerNames).toEqual(['authorizedServer']);
+      expect(mockGetAllServerConfigs).not.toHaveBeenCalled();
+    });
+
+    test('should not strip action tools whose operationId contains the MCP delimiter on revocation', async () => {
+      // `sync_mcp_state_action_...` contains the `_mcp_` substring but is a
+      // genuine OpenAPI action tool (isActionTool === true). Losing
+      // MCP_SERVERS.USE must not drop it — action use is unrelated to MCP.
+      const actionTool = `sync_mcp_state${actionDelimiter}api---example---com`;
+      await Agent.updateOne(
+        { id: existingAgentId },
+        { $set: { tools: ['web_search', actionTool] } },
+      );
+
+      mockUserCanUseMCPServers.mockResolvedValue(false);
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Edited Without MCP Permission',
+        tools: ['web_search', actionTool],
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(updatedAgent.tools).toContain(actionTool);
+      expect(updatedAgent.tools).toContain('web_search');
+      expect(agentInDb.mcpServerNames).toEqual([]);
+    });
+
     test('should allow adding authorized MCP tools', async () => {
       mockReq.user.id = existingAgentAuthorId.toString();
       mockReq.params.id = existingAgentId;
diff --git a/api/server/controllers/agents/openai.js b/api/server/controllers/agents/openai.js
index 7d2395b09f1..9000c247087 100644
--- a/api/server/controllers/agents/openai.js
+++ b/api/server/controllers/agents/openai.js
@@ -23,8 +23,10 @@ const {
   extractManualSkills,
   createErrorResponse,
   recordCollectedUsage,
+  createSubagentUsageSink,
   getTransactionsConfig,
   resolveRecursionLimit,
+  findPiiMatchInMessages,
   discoverConnectedAgents,
   getRemoteAgentPermissions,
   createToolExecuteHandler,
@@ -47,8 +49,11 @@ const {
 } = require('~/server/services/PermissionService');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { logViolation } = require('~/cache');
@@ -174,6 +179,17 @@ const OpenAIChatCompletionController = async (req, res) => {
     );
   }
 
+  const piiHit = findPiiMatchInMessages(request.messages, appConfig?.messageFilter?.pii);
+  if (piiHit != null) {
+    return sendErrorResponse(
+      res,
+      400,
+      `Message contains a ${piiHit.label}. Remove it and try again.`,
+      'invalid_request_error',
+      'message_filter_pii_block',
+    );
+  }
+
   const responseId = `chatcmpl-${nanoid()}`;
   const created = Math.floor(Date.now() / 1000);
 
@@ -228,6 +244,7 @@ const OpenAIChatCompletionController = async (req, res) => {
       endpoint: agent.provider,
       model_parameters: agent.model_parameters ?? {},
     };
+    const skillDbMethods = getSkillDbMethods();
 
     // `filterFilesByAgentAccess` is intentionally omitted: it calls
     // `checkPermission` with `resourceType: AGENT`, but this route
@@ -245,22 +262,35 @@ const OpenAIChatCompletionController = async (req, res) => {
       getUserCodeFiles: db.getUserCodeFiles,
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     };
 
     const enabledCapabilities = new Set(agentsEConfig?.capabilities);
     const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
     const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
     const accessibleSkillIds = skillsCapabilityEnabled
+      ? withDeploymentSkillIds(
+          await findAccessibleResources({
+            userId: req.user.id,
+            role: req.user.role,
+            resourceType: ResourceType.SKILL,
+            requiredPermissions: PermissionBits.VIEW,
+          }),
+        )
+      : [];
+    const editableSkillIds = skillsCapabilityEnabled
       ? await findAccessibleResources({
           userId: req.user.id,
           role: req.user.role,
           resourceType: ResourceType.SKILL,
-          requiredPermissions: PermissionBits.VIEW,
+          requiredPermissions: PermissionBits.EDIT,
         })
       : [];
+    const skillCreateAllowed = skillsCapabilityEnabled
+      ? await getSkillToolDeps().canCreateSkill({ req })
+      : false;
 
     const { skillStates, defaultActiveOnShare } = await loadSkillStates({
       userId: req.user.id,
@@ -271,6 +301,19 @@ const OpenAIChatCompletionController = async (req, res) => {
 
     const manualSkills = extractManualSkills(req.body);
 
+    const primaryScopedSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const primaryConfig = await initializeAgent(
       {
         req,
@@ -283,9 +326,11 @@ const OpenAIChatCompletionController = async (req, res) => {
         endpointOption,
         allowedProviders,
         isInitialAgent: true,
-        accessibleSkillIds: resolveAgentScopedSkillIds({
+        accessibleSkillIds: primaryScopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
           agent,
-          accessibleSkillIds,
+          scopedEditableSkillIds: primaryScopedEditableSkillIds,
+          skillCreateAllowed,
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
@@ -304,20 +349,17 @@ const OpenAIChatCompletionController = async (req, res) => {
      * @type {Map<string, {
      *   agent: object,
      *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+     *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
      *   userMCPAuthMap?: Record<string, Record<string, string>>,
      *   tool_resources?: object,
      *   actionsEnabled?: boolean,
      * }>}
      */
     const agentToolContexts = new Map();
-    agentToolContexts.set(primaryConfig.id, {
-      agent,
-      toolRegistry: primaryConfig.toolRegistry,
-      userMCPAuthMap: primaryConfig.userMCPAuthMap,
-      tool_resources: primaryConfig.tool_resources,
-      actionsEnabled: primaryConfig.actionsEnabled,
-      codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    });
+    agentToolContexts.set(
+      primaryConfig.id,
+      buildAgentToolContext({ agent, config: primaryConfig }),
+    );
 
     // Only run BFS discovery (and pay `getModelsConfig` upfront) when the
     // primary has edges to follow — the common API case is single-agent.
@@ -346,6 +388,28 @@ const OpenAIChatCompletionController = async (req, res) => {
           // sub-agent must clear the same sharing boundary, not the looser
           // in-app AGENT one.
           resourceType: ResourceType.REMOTE_AGENT,
+          computeAccessibleSkillIds: (handoffAgent) =>
+            resolveAgentScopedSkillIds({
+              agent: handoffAgent,
+              accessibleSkillIds,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          computeSkillAuthoringAvailable: (handoffAgent) =>
+            canAuthorSkillFiles({
+              agent: handoffAgent,
+              scopedEditableSkillIds: resolveAgentScopedSkillIds({
+                agent: handoffAgent,
+                accessibleSkillIds: editableSkillIds,
+                skillsCapabilityEnabled,
+                ephemeralSkillsToggle,
+              }),
+              skillCreateAllowed,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          skillStates,
+          defaultActiveOnShare,
           /** @see DiscoverConnectedAgentsParams.codeEnvAvailable */
           codeEnvAvailable: enabledCapabilities.has(AgentCapabilities.execute_code),
         },
@@ -368,14 +432,7 @@ const OpenAIChatCompletionController = async (req, res) => {
           logViolation,
           db: dbMethods,
           onAgentInitialized: (agentId, handoffAgent, config) => {
-            agentToolContexts.set(agentId, {
-              agent: handoffAgent,
-              toolRegistry: config.toolRegistry,
-              userMCPAuthMap: config.userMCPAuthMap,
-              tool_resources: config.tool_resources,
-              actionsEnabled: config.actionsEnabled,
-              codeEnvAvailable: config.codeEnvAvailable,
-            });
+            agentToolContexts.set(agentId, buildAgentToolContext({ agent: handoffAgent, config }));
           },
           initializeAgent,
         },
@@ -420,18 +477,13 @@ const OpenAIChatCompletionController = async (req, res) => {
 
     const toolEndCallback = createToolEndCallback({ req, res, artifactPromises, streamId: null });
 
-    /* Stable for the turn: the prime lists are fixed once
-       `initializeAgent` resolves. Hoisted out of `loadTools` so tool
-       execution doesn't recompute them. `codeEnvAvailable` is read
+    /* Stable for the turn: the primary prime list is fixed once
+       `initializeAgent` resolves and is used as the fallback when a
+       specific agent context is unavailable. `codeEnvAvailable` is read
        per-agent from the stored tool context (admin cap AND that
        agent's `tools` list includes `execute_code`) — a skills-only
        agent never gains sandbox access even if the admin enabled the
        capability globally. */
-    const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-      primaryConfig.manualSkillPrimes,
-      primaryConfig.alwaysApplySkillPrimes,
-    );
-
     const toolExecuteOptions = {
       loadTools: async (toolNames, agentId) => {
         const ctx = agentToolContexts.get(agentId) ?? agentToolContexts.get(primaryConfig.id) ?? {};
@@ -442,17 +494,17 @@ const OpenAIChatCompletionController = async (req, res) => {
           agent: ctx.agent ?? agent,
           signal: abortController.signal,
           toolRegistry: ctx.toolRegistry,
+          mcpAvailableTools: ctx.mcpAvailableTools,
+          requestScopedConnections: ctx.requestScopedConnections,
           userMCPAuthMap: ctx.userMCPAuthMap,
           tool_resources: ctx.tool_resources,
           actionsEnabled: ctx.actionsEnabled,
         });
-        return enrichWithSkillConfigurable(
+        return enrichLoadedToolsWithAgentContext({
           result,
           req,
-          primaryConfig.accessibleSkillIds,
-          ctx.codeEnvAvailable === true,
-          skillPrimedIdsByName,
-        );
+          ctx,
+        });
       },
       toolEndCallback,
       ...getSkillToolDeps(),
@@ -691,6 +743,10 @@ const OpenAIChatCompletionController = async (req, res) => {
         conversationId,
       },
       user: { id: userId },
+      tenantId: req.user?.tenantId,
+      /** Bills subagent child-run model calls (reported outside the
+       *  streamEvents loop) into the same collectedUsage array. */
+      subagentUsageSink: createSubagentUsageSink(collectedUsage),
     });
 
     if (!run) {
diff --git a/api/server/controllers/agents/request.js b/api/server/controllers/agents/request.js
index 51ac9a4885c..0b8c0cee1ae 100644
--- a/api/server/controllers/agents/request.js
+++ b/api/server/controllers/agents/request.js
@@ -1,18 +1,26 @@
 const { logger } = require('@librechat/data-schemas');
-const { Constants, ViolationTypes } = require('librechat-data-provider');
+const { Constants, ViolationTypes, isEphemeralAgentId } = require('librechat-data-provider');
 const {
   sendEvent,
   getViolationInfo,
   buildMessageFiles,
+  getReferencedQuotes,
+  resolveTitleTiming,
   GenerationJobManager,
+  filterPersistableAbortContent,
   decrementPendingRequest,
   sanitizeMessageForTransmit,
   checkAndIncrementPendingRequest,
+  isUnpersistedPreliminaryParent,
 } = require('@librechat/api');
 const { disposeClient, clientRegistry, requestDataMap } = require('~/server/cleanup');
+const {
+  getMCPRequestContext,
+  cleanupMCPRequestContextForReq,
+} = require('~/server/services/MCPRequestContext');
 const { handleAbortError } = require('~/server/middleware');
 const { logViolation } = require('~/cache');
-const { saveMessage, getConvo } = require('~/models');
+const { saveMessage, getMessages, getConvo } = require('~/models');
 
 function createCloseHandler(abortController) {
   return function (manual) {
@@ -74,6 +82,92 @@ async function attachConversationCreatedAt(req, { userId, conversationId, isNewC
   }
 }
 
+function getPreliminaryResponseMessageId({ messageId, responseMessageId }) {
+  if (typeof responseMessageId === 'string' && responseMessageId.length > 0) {
+    return responseMessageId;
+  }
+
+  if (typeof messageId !== 'string' || messageId.length === 0) {
+    return null;
+  }
+
+  return `${messageId.replace(/_+$/, '')}_`;
+}
+
+function getPreliminaryUserMessage({ messageId, parentMessageId, text, quotes }, conversationId) {
+  if (typeof messageId !== 'string' || messageId.length === 0) {
+    return null;
+  }
+
+  /**
+   * Seed normalized quotes here too: if the user aborts before `sendMessage`
+   * reaches `onStart` (during init/tool loading), `abortMiddleware` falls back
+   * to this preliminary metadata, which must carry the excerpts so the stopped
+   * turn keeps its `MessageQuotes`.
+   */
+  const referencedQuotes = getReferencedQuotes(quotes);
+
+  return {
+    messageId,
+    parentMessageId,
+    conversationId,
+    text,
+    ...(referencedQuotes != null && { quotes: referencedQuotes }),
+  };
+}
+
+function getRequestModelSpec(req, endpointOption) {
+  const spec = endpointOption?.spec ?? req.body?.spec;
+  if (typeof spec !== 'string' || spec.length === 0) {
+    return;
+  }
+
+  const list = req.config?.modelSpecs?.list;
+  if (!Array.isArray(list)) {
+    return;
+  }
+
+  return list.find((modelSpec) => modelSpec?.name === spec);
+}
+
+function getModelSpecIconURL(modelSpec) {
+  return modelSpec?.iconURL ?? modelSpec?.preset?.iconURL ?? modelSpec?.preset?.endpoint ?? '';
+}
+
+function getEndpointIconURL(req, endpointOption) {
+  const iconURL =
+    endpointOption?.iconURL ?? getModelSpecIconURL(getRequestModelSpec(req, endpointOption));
+  return iconURL || undefined;
+}
+
+function getEndpointResponseModel(endpointOption) {
+  return endpointOption?.modelOptions?.model || endpointOption?.model_parameters?.model;
+}
+
+function getAgentResponseModel(req, endpointOption) {
+  const agentId = endpointOption?.agent_id || req.body?.agent_id;
+  if (typeof agentId === 'string' && agentId.length > 0 && !isEphemeralAgentId(agentId)) {
+    return agentId;
+  }
+
+  return getEndpointResponseModel(endpointOption);
+}
+
+async function finishResumableRequest(req, userId) {
+  try {
+    await cleanupMCPRequestContextForReq(req);
+  } finally {
+    await decrementPendingRequest(userId);
+  }
+}
+
+function rejectPreliminaryParentMessageId(res) {
+  return res.status(409).json({
+    error:
+      'Cannot submit a follow-up while the selected parent response is still being saved. Please wait and try again.',
+  });
+}
+
 /**
  * Resumable Agent Controller - Generation runs independently of HTTP connection.
  * Returns streamId immediately, client subscribes separately via SSE.
@@ -93,6 +187,23 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
   const userId = req.user.id;
 
+  if (
+    await isUnpersistedPreliminaryParent({
+      userId,
+      conversationId: reqConversationId,
+      parentMessageId,
+      getMessages,
+    })
+  ) {
+    return rejectPreliminaryParentMessageId(res);
+  }
+
+  /** When to generate the conversation title. `immediate` (default) fires title
+   *  generation in parallel with the response, from the user's first message;
+   *  `final` defers it until the full response completes (legacy behavior).
+   *  Resolved from the agent's actual endpoint once the client is initialized. */
+  let titleTiming = 'immediate';
+
   const { allowed, pendingRequests, limit } = await checkAndIncrementPendingRequest(userId);
   if (!allowed) {
     const violationInfo = getViolationInfo(pendingRequests, limit);
@@ -120,6 +231,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
     const job = await GenerationJobManager.createJob(streamId, userId, conversationId);
     const jobCreatedAt = job.createdAt; // Capture creation time to detect job replacement
     req._resumableStreamId = streamId;
+    getMCPRequestContext(req, undefined, { cleanupOnResponse: false });
 
     // Send JSON response IMMEDIATELY so client can connect to SSE stream
     // This is critical: tool loading (MCP OAuth) may emit events that the client needs to receive
@@ -127,6 +239,19 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
     await attachConversationCreatedAt(req, { userId, conversationId, isNewConvo });
 
+    const endpointIconURL = getEndpointIconURL(req, endpointOption);
+    const responseModel = getAgentResponseModel(req, endpointOption);
+    const preliminaryUserMessage = getPreliminaryUserMessage(req.body, conversationId);
+    const preliminaryResponseMessageId = getPreliminaryResponseMessageId(req.body);
+    await GenerationJobManager.updateMetadata(streamId, {
+      conversationId,
+      endpoint: endpointOption.endpoint,
+      iconURL: endpointIconURL,
+      model: responseModel,
+      responseMessageId: preliminaryResponseMessageId,
+      userMessage: preliminaryUserMessage,
+    });
+
     // Note: We no longer use res.on('close') to abort since we send JSON immediately.
     // The response closes normally after res.json(), which is not an abort condition.
     // Abort handling is done through GenerationJobManager via the SSE stream connection.
@@ -148,6 +273,12 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         return;
       }
 
+      const persistableContent = filterPersistableAbortContent(aggregatedContent);
+      if (persistableContent.length === 0) {
+        logger.debug('[ResumableAgentController] No persistable content to save partial response');
+        return;
+      }
+
       const resumeState = await GenerationJobManager.getResumeState(streamId);
       if (!resumeState?.userMessage) {
         logger.debug('[ResumableAgentController] No user message to save partial response for');
@@ -163,13 +294,14 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           conversationId: responseConversationId,
           parentMessageId: resumeState.userMessage.messageId,
           sender: client?.sender ?? 'AI',
-          content: aggregatedContent,
+          content: persistableContent,
           unfinished: true,
           error: false,
           isCreatedByUser: false,
           user: userId,
           endpoint: endpointOption.endpoint,
-          model: endpointOption.modelOptions?.model || endpointOption.model_parameters?.model,
+          iconURL: resumeState.iconURL || endpointIconURL,
+          model: resumeState.model || responseModel,
         };
 
         if (req.body?.agent_id) {
@@ -187,7 +319,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         );
 
         logger.debug(
-          `[ResumableAgentController] Saved partial response for ${streamId}, content parts: ${aggregatedContent.length}`,
+          `[ResumableAgentController] Saved partial response for ${streamId}, content parts: ${persistableContent.length}`,
         );
       } catch (error) {
         logger.error('[ResumableAgentController] Error saving partial response:', error);
@@ -207,12 +339,19 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
     if (job.abortController.signal.aborted) {
       GenerationJobManager.completeJob(streamId, 'Request aborted during initialization');
-      await decrementPendingRequest(userId);
+      await finishResumableRequest(req, userId);
       return;
     }
 
     client = result.client;
 
+    // Resolve title timing from the public agents endpoint first, then fall
+    // back to the agent's actual backing provider/custom endpoint.
+    titleTiming = resolveTitleTiming({
+      appConfig: req.config,
+      endpoint: [endpointOption?.endpoint, client?.options?.agent?.endpoint],
+    });
+
     if (client?.sender) {
       GenerationJobManager.updateMetadata(streamId, { sender: client.sender });
     }
@@ -243,6 +382,61 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         );
       }
 
+      /** Immediate-mode title generation runs in parallel with the response, so
+       *  the conversation row may not exist when the title resolves. `convoReady`
+       *  resolves once the response (and thus the conversation) has been saved,
+       *  gating the title's `saveConvo`. Declared here so both the success tail
+       *  and the catch block can settle it and gate `disposeClient` on the title. */
+      let immediateTitlePromise = null;
+      let titleEventPromise = null;
+      let acceptsTitleEvents = true;
+      let resolveConvoReady;
+      const convoReady = new Promise((resolve) => {
+        resolveConvoReady = resolve;
+      });
+      /** Dedicated controller so a user Stop (or a replaced stream) cancels the
+       *  in-flight title — kept separate from `job.abortController`, which
+       *  `completeJob` also aborts on *successful* completion and would otherwise
+       *  cancel a title that is merely slower than a short response. */
+      const titleAbortController = new AbortController();
+      /** Separate from `titleAbortController`: a user Stop cancels the in-flight
+       *  title model call but keeps a title that already finished generating.
+       *  Only a superseded/failed stream aborts this to discard such a title so it
+       *  cannot clobber the conversation now owned by the newer run. */
+      const titleDiscardController = new AbortController();
+      const abortTitleOnJobAbort = () => titleAbortController.abort();
+      if (job.abortController.signal.aborted) {
+        titleAbortController.abort();
+      } else {
+        job.abortController.signal.addEventListener('abort', abortTitleOnJobAbort, { once: true });
+      }
+      const titleEligible =
+        addTitle && parentMessageId === Constants.NO_PARENT && isNewConvo && !req.body?.isTemporary;
+      const emitTitleEvent = ({ conversationId: titleConversationId, title }) => {
+        titleEventPromise = (async () => {
+          if (!acceptsTitleEvents || titleAbortController.signal.aborted) {
+            return;
+          }
+          const currentJob = await GenerationJobManager.getJob(streamId);
+          if (!currentJob || currentJob.createdAt !== jobCreatedAt) {
+            return;
+          }
+          if (titleAbortController.signal.aborted) {
+            return;
+          }
+          await GenerationJobManager.emitChunk(streamId, {
+            event: 'title',
+            data: {
+              conversationId: titleConversationId,
+              title,
+            },
+          });
+        })().catch((err) => {
+          logger.error('[ResumableAgentController] Error emitting title event', err);
+        });
+        return titleEventPromise;
+      };
+
       try {
         const onStart = (userMsg, respMsgId, _isNewConvo) => {
           userMessage = userMsg;
@@ -255,6 +449,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
               parentMessageId: userMsg.parentMessageId,
               conversationId: userMsg.conversationId,
               text: userMsg.text,
+              quotes: userMsg.quotes,
             },
           });
 
@@ -289,7 +484,24 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           },
         };
 
-        const response = await client.sendMessage(text, messageOptions);
+        const sendPromise = client.sendMessage(text, messageOptions);
+
+        if (titleEligible && titleTiming === 'immediate') {
+          immediateTitlePromise = addTitle(req, {
+            text,
+            conversationId,
+            client,
+            immediate: true,
+            convoReady,
+            signal: titleAbortController.signal,
+            discardSignal: titleDiscardController.signal,
+            onTitleGenerated: emitTitleEvent,
+          }).catch((err) => {
+            logger.error('[ResumableAgentController] Error in immediate title generation', err);
+          });
+        }
+
+        const response = await sendPromise;
 
         const messageId = response.messageId;
         const endpoint = endpointOption.endpoint;
@@ -355,11 +567,46 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
             originalCreatedAt: jobCreatedAt,
             currentCreatedAt: currentJob?.createdAt,
           });
+          // Discard the stale title from this replaced stream: cancel it and
+          // unblock its persistence wait without letting it save (the newer job
+          // owns the conversation now).
+          titleAbortController.abort();
+          titleDiscardController.abort();
+          job.abortController.signal.removeEventListener('abort', abortTitleOnJobAbort);
+          acceptsTitleEvents = false;
+          resolveConvoReady();
           // Still decrement pending request since we incremented at start
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
+          if (immediateTitlePromise) {
+            immediateTitlePromise.finally(() => {
+              if (client) {
+                disposeClient(client);
+              }
+            });
+          } else if (client) {
+            disposeClient(client);
+          }
           return;
         }
 
+        // If the user stopped this turn, cancel the title BEFORE unblocking its
+        // persistence wait — otherwise resolving `convoReady` lets the title task
+        // resume and save before the later abort runs.
+        if (wasAbortedBeforeComplete) {
+          titleAbortController.abort();
+        } else {
+          job.abortController.signal.removeEventListener('abort', abortTitleOnJobAbort);
+        }
+
+        // The conversation row now exists and this stream is authoritative; allow
+        // any in-flight immediate title generation to persist (saveConvo uses noUpsert).
+        resolveConvoReady();
+        acceptsTitleEvents = false;
+
+        if (titleEventPromise) {
+          await titleEventPromise;
+        }
+
         if (!wasAbortedBeforeComplete) {
           const finalEvent = {
             final: true,
@@ -379,7 +626,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
           await GenerationJobManager.emitDone(streamId, finalEvent);
           GenerationJobManager.completeJob(streamId);
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
         } else {
           const finalEvent = {
             final: true,
@@ -399,10 +646,23 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
           await GenerationJobManager.emitDone(streamId, finalEvent);
           GenerationJobManager.completeJob(streamId, 'Request aborted');
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
         }
 
-        if (shouldGenerateTitle) {
+        if (titleTiming === 'immediate') {
+          // Title was fired in parallel above (if eligible); a stopped turn already
+          // aborted it before `resolveConvoReady`. Defer disposal until it settles
+          // so the run/req aren't torn down mid-generation.
+          if (immediateTitlePromise) {
+            immediateTitlePromise.finally(() => {
+              if (client) {
+                disposeClient(client);
+              }
+            });
+          } else if (client) {
+            disposeClient(client);
+          }
+        } else if (shouldGenerateTitle) {
           addTitle(req, {
             text,
             response: { ...response },
@@ -422,6 +682,16 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           }
         }
       } catch (error) {
+        // Any failure (user Stop, or a preflight/quota failure before the run is
+        // even created) must cancel the title and unblock its waits: the title's
+        // `_waitForRun` would otherwise never resolve, deferring client disposal
+        // until the 45s title timeout, and no title should persist for a failed turn.
+        titleAbortController.abort();
+        titleDiscardController.abort();
+        job.abortController.signal.removeEventListener('abort', abortTitleOnJobAbort);
+        acceptsTitleEvents = false;
+        resolveConvoReady();
+
         // Check if this was an abort (not a real error)
         const wasAborted = job.abortController.signal.aborted || error.message?.includes('abort');
 
@@ -434,9 +704,16 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           GenerationJobManager.completeJob(streamId, error.message);
         }
 
-        await decrementPendingRequest(userId);
+        await finishResumableRequest(req, userId);
 
-        if (client) {
+        // Defer disposal until any immediate title settles (it holds the run/req).
+        if (immediateTitlePromise) {
+          immediateTitlePromise.finally(() => {
+            if (client) {
+              disposeClient(client);
+            }
+          });
+        } else if (client) {
           disposeClient(client);
         }
 
@@ -451,7 +728,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         `[ResumableAgentController] Unhandled error in background generation: ${err.message}`,
       );
       GenerationJobManager.completeJob(streamId, err.message);
-      await decrementPendingRequest(userId);
+      await finishResumableRequest(req, userId);
     });
   } catch (error) {
     logger.error('[ResumableAgentController] Initialization error:', error);
@@ -462,7 +739,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
       await GenerationJobManager.emitError(streamId, error.message || 'Failed to start generation');
     }
     GenerationJobManager.completeJob(streamId, error.message);
-    await decrementPendingRequest(userId);
+    await finishResumableRequest(req, userId);
     if (client) {
       disposeClient(client);
     }
@@ -510,6 +787,17 @@ const _LegacyAgentController = async (req, res, next, initializeClient, addTitle
   // Match the same logic used for conversationId generation above
   const userId = req.user.id;
 
+  if (
+    await isUnpersistedPreliminaryParent({
+      userId,
+      conversationId: reqConversationId,
+      parentMessageId,
+      getMessages,
+    })
+  ) {
+    return rejectPreliminaryParentMessageId(res);
+  }
+
   await attachConversationCreatedAt(req, { userId, conversationId, isNewConvo });
 
   // Create handler to avoid capturing the entire parent scope
@@ -616,8 +904,8 @@ const _LegacyAgentController = async (req, res, next, initializeClient, addTitle
     // Store endpoint metadata for abort handling
     GenerationJobManager.updateMetadata(streamId, {
       endpoint: endpointOption.endpoint,
-      iconURL: endpointOption.iconURL,
-      model: endpointOption.modelOptions?.model || endpointOption.model_parameters?.model,
+      iconURL: getEndpointIconURL(req, endpointOption),
+      model: getAgentResponseModel(req, endpointOption),
       sender: client?.sender,
     });
 
@@ -653,6 +941,7 @@ const _LegacyAgentController = async (req, res, next, initializeClient, addTitle
           parentMessageId: userMsg.parentMessageId,
           conversationId,
           text: userMsg.text,
+          quotes: userMsg.quotes,
         },
       });
     };
diff --git a/api/server/controllers/agents/responses.js b/api/server/controllers/agents/responses.js
index b2805fc19fc..c88545c3e6b 100644
--- a/api/server/controllers/agents/responses.js
+++ b/api/server/controllers/agents/responses.js
@@ -11,19 +11,24 @@ const {
 } = require('librechat-data-provider');
 const {
   createRun,
+  applyContextToAgent,
   buildToolSet,
-  loadSkillStates,
-  resolveAgentScopedSkillIds,
+  buildAgentScopedContext,
+  buildAgentContextAttachmentsByAgentId,
   createSafeUser,
   initializeAgent,
+  loadSkillStates,
   getBalanceConfig,
+  injectSkillPrimes,
+  extractManualSkills,
   recordCollectedUsage,
+  createSubagentUsageSink,
   getTransactionsConfig,
-  extractManualSkills,
-  injectSkillPrimes,
-  createToolExecuteHandler,
+  findPiiMatchInMessages,
   discoverConnectedAgents,
+  createToolExecuteHandler,
   getRemoteAgentPermissions,
+  resolveAgentScopedSkillIds,
   // Responses API
   writeDone,
   buildResponse,
@@ -56,10 +61,15 @@ const {
 } = require('~/server/services/PermissionService');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
+const { resolveConfigServers } = require('~/server/services/MCP');
+const { getMCPManager } = require('~/config');
 const { logViolation } = require('~/cache');
 const db = require('~/models');
 
@@ -350,6 +360,7 @@ const createResponse = async (req, res) => {
 
     // Create tool loader
     const loadTools = createToolLoader(abortController.signal);
+    const skillDbMethods = getSkillDbMethods();
 
     // Initialize the agent first to check for disableStreaming
     const endpointOption = {
@@ -373,9 +384,9 @@ const createResponse = async (req, res) => {
       getUserCodeFiles: db.getUserCodeFiles,
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     };
 
     const enabledCapabilities = new Set(
@@ -384,13 +395,26 @@ const createResponse = async (req, res) => {
     const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
     const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
     const accessibleSkillIds = skillsCapabilityEnabled
+      ? withDeploymentSkillIds(
+          await findAccessibleResources({
+            userId: req.user.id,
+            role: req.user.role,
+            resourceType: ResourceType.SKILL,
+            requiredPermissions: PermissionBits.VIEW,
+          }),
+        )
+      : [];
+    const editableSkillIds = skillsCapabilityEnabled
       ? await findAccessibleResources({
           userId: req.user.id,
           role: req.user.role,
           resourceType: ResourceType.SKILL,
-          requiredPermissions: PermissionBits.VIEW,
+          requiredPermissions: PermissionBits.EDIT,
         })
       : [];
+    const skillCreateAllowed = skillsCapabilityEnabled
+      ? await getSkillToolDeps().canCreateSkill({ req })
+      : false;
 
     const { skillStates, defaultActiveOnShare } = await loadSkillStates({
       userId: req.user.id,
@@ -401,6 +425,19 @@ const createResponse = async (req, res) => {
 
     const manualSkills = extractManualSkills(req.body);
 
+    const primaryScopedSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const primaryConfig = await initializeAgent(
       {
         req,
@@ -413,9 +450,11 @@ const createResponse = async (req, res) => {
         endpointOption,
         allowedProviders,
         isInitialAgent: true,
-        accessibleSkillIds: resolveAgentScopedSkillIds({
+        accessibleSkillIds: primaryScopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
           agent,
-          accessibleSkillIds,
+          scopedEditableSkillIds: primaryScopedEditableSkillIds,
+          skillCreateAllowed,
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
@@ -434,20 +473,17 @@ const createResponse = async (req, res) => {
      * @type {Map<string, {
      *   agent: object,
      *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+     *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
      *   userMCPAuthMap?: Record<string, Record<string, string>>,
      *   tool_resources?: object,
      *   actionsEnabled?: boolean,
      * }>}
      */
     const agentToolContexts = new Map();
-    agentToolContexts.set(primaryConfig.id, {
-      agent,
-      toolRegistry: primaryConfig.toolRegistry,
-      userMCPAuthMap: primaryConfig.userMCPAuthMap,
-      tool_resources: primaryConfig.tool_resources,
-      actionsEnabled: primaryConfig.actionsEnabled,
-      codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    });
+    agentToolContexts.set(
+      primaryConfig.id,
+      buildAgentToolContext({ agent, config: primaryConfig }),
+    );
 
     // Only run BFS discovery (and pay `getModelsConfig` upfront) when the
     // primary has edges to follow — the common API case is single-agent.
@@ -476,6 +512,28 @@ const createResponse = async (req, res) => {
           // sub-agent must clear the same sharing boundary, not the looser
           // in-app AGENT one.
           resourceType: ResourceType.REMOTE_AGENT,
+          computeAccessibleSkillIds: (handoffAgent) =>
+            resolveAgentScopedSkillIds({
+              agent: handoffAgent,
+              accessibleSkillIds,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          computeSkillAuthoringAvailable: (handoffAgent) =>
+            canAuthorSkillFiles({
+              agent: handoffAgent,
+              scopedEditableSkillIds: resolveAgentScopedSkillIds({
+                agent: handoffAgent,
+                accessibleSkillIds: editableSkillIds,
+                skillsCapabilityEnabled,
+                ephemeralSkillsToggle,
+              }),
+              skillCreateAllowed,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          skillStates,
+          defaultActiveOnShare,
           /** @see DiscoverConnectedAgentsParams.codeEnvAvailable */
           codeEnvAvailable: enabledCapabilities.has(AgentCapabilities.execute_code),
         },
@@ -498,14 +556,7 @@ const createResponse = async (req, res) => {
           logViolation,
           db: dbMethods,
           onAgentInitialized: (agentId, handoffAgent, config) => {
-            agentToolContexts.set(agentId, {
-              agent: handoffAgent,
-              toolRegistry: config.toolRegistry,
-              userMCPAuthMap: config.userMCPAuthMap,
-              tool_resources: config.tool_resources,
-              actionsEnabled: config.actionsEnabled,
-              codeEnvAvailable: config.codeEnvAvailable,
-            });
+            agentToolContexts.set(agentId, buildAgentToolContext({ agent: handoffAgent, config }));
           },
           initializeAgent,
         },
@@ -516,6 +567,29 @@ const createResponse = async (req, res) => {
     const runAgents = [primaryConfig, ...handoffAgentConfigs.values()];
     const mergedMCPAuthMap = discoveredMCPAuthMap ?? primaryConfig.userMCPAuthMap;
 
+    const agentContextAttachmentsByAgentId = buildAgentContextAttachmentsByAgentId(runAgents);
+    const agentScopedContext = await buildAgentScopedContext({
+      agentIds: runAgents.map(({ id }) => id),
+      attachmentsByAgentId: agentContextAttachmentsByAgentId,
+      req,
+    });
+
+    const mcpManager = getMCPManager();
+    const configServers = await resolveConfigServers(req);
+
+    await Promise.all(
+      runAgents.map((runAgent) =>
+        applyContextToAgent({
+          agent: runAgent,
+          agentId: runAgent.id,
+          logger,
+          mcpManager,
+          configServers,
+          sharedRunContext: agentScopedContext.get(runAgent.id) ?? '',
+        }),
+      ),
+    );
+
     // Determine if streaming is enabled (check both request and agent config)
     const streamingDisabled = !!primaryConfig.model_parameters?.disableStreaming;
     const actuallyStreaming = isStreaming && !streamingDisabled;
@@ -532,6 +606,17 @@ const createResponse = async (req, res) => {
       typeof request.input === 'string' ? request.input : request.input,
     );
 
+    const piiHit = findPiiMatchInMessages(inputMessages, appConfig?.messageFilter?.pii);
+    if (piiHit != null) {
+      return sendResponsesErrorResponse(
+        res,
+        400,
+        `Message contains a ${piiHit.label}. Remove it and try again.`,
+        'invalid_request',
+        'message_filter_pii_block',
+      );
+    }
+
     // Merge previous messages with new input
     const allMessages = [...previousMessages, ...inputMessages];
 
@@ -573,19 +658,13 @@ const createResponse = async (req, res) => {
       }
     }
 
-    /* Stable for the turn: the prime lists are fixed once
-       `initializeAgent` resolves. Hoisted here so both the streaming
-       and non-streaming `loadTools` closures below reuse it without
-       recomputing per tool execution. `codeEnvAvailable` is read
+    /* Stable for the turn: the primary prime list is fixed once
+       `initializeAgent` resolves and is used as the fallback when a
+       specific agent context is unavailable. `codeEnvAvailable` is read
        per-agent from the stored tool context (admin cap AND that
        agent's `tools` list includes `execute_code`) — a skills-only
        agent never gains sandbox access even if the admin enabled the
        capability globally. */
-    const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-      manualSkillPrimes,
-      alwaysApplySkillPrimes,
-    );
-
     // Create tracker for streaming or aggregator for non-streaming
     const tracker = actuallyStreaming ? createResponseTracker() : null;
     const aggregator = actuallyStreaming ? null : createResponseAggregator();
@@ -635,17 +714,17 @@ const createResponse = async (req, res) => {
             agent: ctx.agent ?? agent,
             signal: abortController.signal,
             toolRegistry: ctx.toolRegistry,
+            mcpAvailableTools: ctx.mcpAvailableTools,
+            requestScopedConnections: ctx.requestScopedConnections,
             userMCPAuthMap: ctx.userMCPAuthMap,
             tool_resources: ctx.tool_resources,
             actionsEnabled: ctx.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(
+          return enrichLoadedToolsWithAgentContext({
             result,
             req,
-            primaryConfig.accessibleSkillIds,
-            ctx.codeEnvAvailable === true,
-            skillPrimedIdsByName,
-          );
+            ctx,
+          });
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -699,6 +778,10 @@ const createResponse = async (req, res) => {
           conversationId,
         },
         user: { id: userId },
+        tenantId: req.user?.tenantId,
+        /** Bills subagent child-run model calls (reported outside the
+         *  streamEvents loop) into the same collectedUsage array. */
+        subagentUsageSink: createSubagentUsageSink(collectedUsage),
       });
 
       if (!run) {
@@ -811,17 +894,17 @@ const createResponse = async (req, res) => {
             agent: ctx.agent ?? agent,
             signal: abortController.signal,
             toolRegistry: ctx.toolRegistry,
+            mcpAvailableTools: ctx.mcpAvailableTools,
+            requestScopedConnections: ctx.requestScopedConnections,
             userMCPAuthMap: ctx.userMCPAuthMap,
             tool_resources: ctx.tool_resources,
             actionsEnabled: ctx.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(
+          return enrichLoadedToolsWithAgentContext({
             result,
             req,
-            primaryConfig.accessibleSkillIds,
-            ctx.codeEnvAvailable === true,
-            skillPrimedIdsByName,
-          );
+            ctx,
+          });
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -873,6 +956,10 @@ const createResponse = async (req, res) => {
           conversationId,
         },
         user: { id: userId },
+        tenantId: req.user?.tenantId,
+        /** Bills subagent child-run model calls (reported outside the
+         *  streamEvents loop) into the same collectedUsage array. */
+        subagentUsageSink: createSubagentUsageSink(collectedUsage),
       });
 
       if (!run) {
diff --git a/api/server/controllers/agents/v1.js b/api/server/controllers/agents/v1.js
index 536044e5cce..ec1c6e62f2b 100644
--- a/api/server/controllers/agents/v1.js
+++ b/api/server/controllers/agents/v1.js
@@ -24,6 +24,7 @@ const {
   AccessRoleIds,
   PrincipalType,
   EToolResources,
+  isActionTool,
   PermissionBits,
   actionDelimiter,
   AgentCapabilities,
@@ -42,7 +43,11 @@ const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { getFileStrategy } = require('~/server/utils/getFileStrategy');
 const { filterFile } = require('~/server/services/Files/process');
 const { getCachedTools } = require('~/server/services/Config');
-const { resolveConfigServers } = require('~/server/services/MCP');
+const {
+  createMCPPermissionContext,
+  resolveConfigServers,
+  userCanUseMCPServers,
+} = require('~/server/services/MCP');
 const { getMCPServersRegistry } = require('~/config');
 const { getLogStores } = require('~/cache');
 const db = require('~/models');
@@ -59,6 +64,38 @@ const getSafeModelParameters = (modelParameters) => {
   const { useResponsesApi } = modelParameters ?? {};
   return typeof useResponsesApi === 'boolean' ? { useResponsesApi } : {};
 };
+const hasEditBit = (permission) => (permission & PermissionBits.EDIT) === PermissionBits.EDIT;
+
+const sanitizeViewerSkillScope = (agent, accessibleSkillSet) => {
+  const skillScopeEnabled = agent.skills_enabled === true;
+  delete agent.skills_enabled;
+
+  if (!skillScopeEnabled) {
+    delete agent.skills;
+    return agent;
+  }
+
+  const configuredSkills = Array.isArray(agent.skills) ? agent.skills : [];
+  if (configuredSkills.length === 0) {
+    // Empty allowlist means the viewer's full accessible catalog.
+    delete agent.skills;
+    agent.skills_enabled = true;
+    return agent;
+  }
+
+  const visibleSkills = configuredSkills
+    .map((skillId) => String(skillId))
+    .filter((skillId) => accessibleSkillSet.has(skillId));
+
+  if (visibleSkills.length === 0) {
+    delete agent.skills;
+    return agent;
+  }
+
+  agent.skills = visibleSkills;
+  agent.skills_enabled = true;
+  return agent;
+};
 
 /**
  * Looks up each referenced agent id in Mongo, splits them into three
@@ -156,6 +193,9 @@ const isSubagentsCapabilityEnabled = (req) => {
  * @param {object} params
  * @param {string[]} params.tools - Raw tool strings from the request
  * @param {string} params.userId - Requesting user ID for MCP server access check
+ * @param {string} [params.role] - Requesting user's role for ACL principal resolution
+ * @param {object} [params.user] - Requesting user for MCP server use permission checks
+ * @param {{ canUseServers: (user?: object) => Promise<boolean> }} [params.mcpPermissionContext] - Request-scoped MCP permission context
  * @param {Record<string, unknown>} params.availableTools - Global non-MCP tool cache
  * @param {string[]} [params.existingTools] - Tools already persisted on the agent document
  * @param {Record<string, unknown>} [params.configServers] - Config-source MCP servers resolved from appConfig overrides
@@ -164,6 +204,9 @@ const isSubagentsCapabilityEnabled = (req) => {
 const filterAuthorizedTools = async ({
   tools,
   userId,
+  role,
+  user,
+  mcpPermissionContext,
   availableTools,
   existingTools,
   configServers,
@@ -172,21 +215,39 @@ const filterAuthorizedTools = async ({
   let mcpServerConfigs;
   let registryUnavailable = false;
   const existingToolSet = existingTools?.length ? new Set(existingTools) : null;
+  const hasMCPTools = tools.some((tool) => tool?.includes(Constants.mcp_delimiter));
+  const canUseMCP = hasMCPTools
+    ? await (mcpPermissionContext
+        ? mcpPermissionContext.canUseServers(user)
+        : userCanUseMCPServers(user))
+    : true;
+  let loggedMCPDenied = false;
 
   for (const tool of tools) {
-    if (availableTools[tool] || systemTools[tool]) {
-      filteredTools.push(tool);
+    const isActionToolName = typeof tool === 'string' && isActionTool(tool);
+    const isMCPTool = tool?.includes(Constants.mcp_delimiter) && !isActionToolName;
+
+    if (!isMCPTool) {
+      if (availableTools[tool] || systemTools[tool] || isActionToolName) {
+        filteredTools.push(tool);
+      }
       continue;
     }
 
-    if (!tool?.includes(Constants.mcp_delimiter)) {
+    if (!canUseMCP) {
+      if (!loggedMCPDenied) {
+        logger.warn(`[filterAuthorizedTools] User ${userId} lacks MCP server use permission`);
+        loggedMCPDenied = true;
+      }
       continue;
     }
 
     if (mcpServerConfigs === undefined) {
       try {
         mcpServerConfigs =
-          (await getMCPServersRegistry().getAllServerConfigs(userId, configServers)) ?? {};
+          (role
+            ? await getMCPServersRegistry().getAllServerConfigs(userId, configServers, role)
+            : await getMCPServersRegistry().getAllServerConfigs(userId, configServers)) ?? {};
       } catch (e) {
         logger.warn(
           '[filterAuthorizedTools] MCP registry unavailable, filtering all MCP tools',
@@ -244,10 +305,14 @@ const pruneToolResourceFileIdsForOwner = async ({ tool_resources, ownerId, logPr
   const ownerIdStr = ownerId.toString();
 
   try {
-    const ownerFiles = await db.getFiles({ file_id: { $in: referencedFileIds } }, null, {
-      file_id: 1,
-      user: 1,
-    });
+    const ownerFiles = await db.getFiles(
+      { file_id: { $in: referencedFileIds }, user: ownerIdStr },
+      null,
+      {
+        file_id: 1,
+        user: 1,
+      },
+    );
     const allowedIds = new Set(
       (ownerFiles ?? [])
         .filter((file) => file.user && file.user.toString() === ownerIdStr)
@@ -351,9 +416,13 @@ const createAgentHandler = async (req, res) => {
       getCachedTools().then((t) => t ?? {}),
       hasMCPTools ? resolveConfigServers(req) : Promise.resolve(undefined),
     ]);
+    const mcpPermissionContext = createMCPPermissionContext(req);
     agentData.tools = await filterAuthorizedTools({
       tools,
       userId,
+      role: req.user.role,
+      user: req.user,
+      mcpPermissionContext,
       availableTools,
       configServers,
     });
@@ -573,26 +642,55 @@ const updateAgentHandler = async (req, res) => {
       });
     }
 
-    if (updateData.tools) {
-      const existingToolSet = new Set(existingAgent.tools ?? []);
-      const newMCPTools = updateData.tools.filter(
-        (t) => !existingToolSet.has(t) && t?.includes(Constants.mcp_delimiter),
-      );
-
-      if (newMCPTools.length > 0) {
-        const [availableTools, configServers] = await Promise.all([
-          getCachedTools().then((t) => t ?? {}),
-          resolveConfigServers(req),
-        ]);
-        const approvedNew = await filterAuthorizedTools({
-          tools: newMCPTools,
-          userId: req.user.id,
-          availableTools,
-          configServers,
-        });
-        const rejectedSet = new Set(newMCPTools.filter((t) => !approvedNew.includes(t)));
-        if (rejectedSet.size > 0) {
-          updateData.tools = updateData.tools.filter((t) => !rejectedSet.has(t));
+    const isMCPTool = (t) =>
+      typeof t === 'string' && t.includes(Constants.mcp_delimiter) && !isActionTool(t);
+    const hasToolUpdate = updateData.tools !== undefined;
+    const editingOwnAgent = existingAgent.author?.toString() === req.user.id;
+    const existingTools = existingAgent.tools ?? [];
+    const effectiveTools = (hasToolUpdate ? updateData.tools : existingAgent.tools) ?? [];
+    const requestedMCPTools = effectiveTools.filter(isMCPTool);
+    const existingMCPTools = existingTools.filter(isMCPTool);
+
+    if (requestedMCPTools.length > 0 || (hasToolUpdate && existingMCPTools.length > 0)) {
+      const mcpPermissionContext = createMCPPermissionContext(req);
+      if (!(await mcpPermissionContext.canUseServers(req.user))) {
+        if (editingOwnAgent) {
+          updateData.tools = effectiveTools.filter((t) => !isMCPTool(t));
+        } else if (hasToolUpdate) {
+          const existingMCPToolSet = new Set(existingMCPTools);
+          const nextTools = updateData.tools.filter(
+            (t) => !isMCPTool(t) || existingMCPToolSet.has(t),
+          );
+          const nextToolSet = new Set(nextTools);
+          for (const existingMCPTool of existingMCPTools) {
+            if (!nextToolSet.has(existingMCPTool)) {
+              nextTools.push(existingMCPTool);
+            }
+          }
+          updateData.tools = nextTools;
+        }
+      } else if (hasToolUpdate) {
+        const existingToolSet = new Set(existingTools);
+        const newMCPTools = requestedMCPTools.filter((t) => !existingToolSet.has(t));
+
+        if (newMCPTools.length > 0) {
+          const [availableTools, configServers] = await Promise.all([
+            getCachedTools().then((t) => t ?? {}),
+            resolveConfigServers(req),
+          ]);
+          const approvedNew = await filterAuthorizedTools({
+            tools: newMCPTools,
+            userId: req.user.id,
+            role: req.user.role,
+            user: req.user,
+            mcpPermissionContext,
+            availableTools,
+            configServers,
+          });
+          const rejectedSet = new Set(newMCPTools.filter((t) => !approvedNew.includes(t)));
+          if (rejectedSet.size > 0) {
+            updateData.tools = updateData.tools.filter((t) => !rejectedSet.has(t));
+          }
         }
       }
     }
@@ -745,9 +843,13 @@ const duplicateAgentHandler = async (req, res) => {
         getCachedTools().then((t) => t ?? {}),
         resolveConfigServers(req),
       ]);
+      const mcpPermissionContext = createMCPPermissionContext(req);
       newAgentData.tools = await filterAuthorizedTools({
         tools: newAgentData.tools,
         userId,
+        role: req.user.role,
+        user: req.user,
+        mcpPermissionContext,
         availableTools,
         existingTools: newAgentData.tools,
         configServers,
@@ -838,7 +940,7 @@ const deleteAgentHandler = async (req, res) => {
 const getListAgentsHandler = async (req, res) => {
   try {
     const userId = req.user.id;
-    const { category, search, limit, cursor, promoted } = req.query;
+    const { category, search, limit = 100, cursor, promoted } = req.query;
     let requiredPermission = req.query.requiredPermission;
     if (typeof requiredPermission === 'string') {
       requiredPermission = parseInt(requiredPermission, 10);
@@ -848,6 +950,7 @@ const getListAgentsHandler = async (req, res) => {
     } else if (typeof requiredPermission !== 'number') {
       requiredPermission = PermissionBits.VIEW;
     }
+    const canReturnSkillConfig = hasEditBit(requiredPermission);
     // Base filter
     const filter = {};
 
@@ -921,6 +1024,7 @@ const getListAgentsHandler = async (req, res) => {
       otherParams: filter,
       limit,
       after: cursor,
+      includeSkillConfig: true,
     });
 
     const agents = data?.data ?? [];
@@ -928,10 +1032,24 @@ const getListAgentsHandler = async (req, res) => {
       return res.json(data);
     }
 
+    let accessibleSkillSet = null;
+    if (!canReturnSkillConfig) {
+      const accessibleSkillIds = await findAccessibleResources({
+        userId,
+        role: req.user.role,
+        resourceType: ResourceType.SKILL,
+        requiredPermissions: PermissionBits.VIEW,
+      });
+      accessibleSkillSet = new Set(accessibleSkillIds.map((oid) => oid.toString()));
+    }
+
     const publicSet = new Set(publiclyAccessibleIds.map((oid) => oid.toString()));
 
     const urlCache = cachedRefresh?.urlCache;
     data.data = agents.map((agent) => {
+      if (accessibleSkillSet) {
+        sanitizeViewerSkillScope(agent, accessibleSkillSet);
+      }
       try {
         if (agent?._id && publicSet.has(agent._id.toString())) {
           agent.isPublic = true;
@@ -1103,9 +1221,13 @@ const revertAgentVersionHandler = async (req, res) => {
         getCachedTools().then((t) => t ?? {}),
         resolveConfigServers(req),
       ]);
+      const mcpPermissionContext = createMCPPermissionContext(req);
       const filteredTools = await filterAuthorizedTools({
         tools: updatedAgent.tools,
         userId: req.user.id,
+        role: req.user.role,
+        user: req.user,
+        mcpPermissionContext,
         availableTools,
         existingTools: updatedAgent.tools,
         configServers,
diff --git a/api/server/controllers/agents/v1.spec.js b/api/server/controllers/agents/v1.spec.js
index 17904ad3fd6..fda2bdd6167 100644
--- a/api/server/controllers/agents/v1.spec.js
+++ b/api/server/controllers/agents/v1.spec.js
@@ -2,7 +2,7 @@ const mongoose = require('mongoose');
 const { nanoid } = require('nanoid');
 const { v4: uuidv4 } = require('uuid');
 const { agentSchema, fileSchema } = require('@librechat/data-schemas');
-const { FileSources, PermissionBits } = require('librechat-data-provider');
+const { FileSources, PermissionBits, ResourceType } = require('librechat-data-provider');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
 // Only mock the dependencies that are not database-related
@@ -1303,6 +1303,68 @@ describe('Agent Controllers - Mass Assignment Protection', () => {
       expect(response.data[0].name).toBe('Agent A1');
     });
 
+    test('should return only expected safe list fields for VIEW callers', async () => {
+      const hiddenSkillId = new mongoose.Types.ObjectId();
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        avatar: { filepath: '/avatars/a1.png', source: FileSources.local },
+        category: 'general',
+        support_contact: { name: 'Support', email: 'support@example.com' },
+        is_promoted: true,
+        instructions: 'private system instructions',
+        tools: ['execute_code'],
+        actions: ['example.com::action'],
+        model_parameters: { temperature: 0.7 },
+        tool_resources: { file_search: { file_ids: ['file-1'] } },
+        tool_options: { execute_code: { defer_loading: true } },
+        subagents: { enabled: true, agent_ids: [agentA2.id] },
+        edges: [{ from: agentA1.id, to: agentA2.id }],
+        skills_enabled: true,
+        skills: [hiddenSkillId.toString()],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.VIEW);
+      findAccessibleResources.mockImplementation(({ resourceType }) => {
+        if (resourceType === ResourceType.AGENT) {
+          return Promise.resolve([agentA1._id]);
+        }
+        if (resourceType === ResourceType.SKILL) {
+          return Promise.resolve([]);
+        }
+        return Promise.resolve([]);
+      });
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      const agent = response.data[0];
+      expect(Object.keys(agent).sort()).toEqual(
+        [
+          '_id',
+          'author',
+          'avatar',
+          'category',
+          'description',
+          'id',
+          'is_promoted',
+          'name',
+          'support_contact',
+          'updatedAt',
+        ].sort(),
+      );
+      expect(agent).toEqual(
+        expect.objectContaining({
+          id: agentA1.id,
+          name: 'Agent A1',
+          description: 'User A agent 1',
+          author: userA.toString(),
+          category: 'general',
+          is_promoted: true,
+        }),
+      );
+    });
+
     test('should return multiple accessible agents', async () => {
       // User B has access to multiple agents
       mockReq.user.id = userB.toString();
@@ -1428,6 +1490,118 @@ describe('Agent Controllers - Mass Assignment Protection', () => {
       expect(response.data).toHaveLength(1);
     });
 
+    test('should return only viewer-accessible skill scope for VIEW list callers', async () => {
+      const visibleSkillId = new mongoose.Types.ObjectId();
+      const hiddenSkillId = new mongoose.Types.ObjectId();
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        skills_enabled: true,
+        skills: [visibleSkillId.toString(), hiddenSkillId.toString()],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.VIEW);
+      findAccessibleResources.mockImplementation(({ resourceType }) => {
+        if (resourceType === ResourceType.AGENT) {
+          return Promise.resolve([agentA1._id]);
+        }
+        if (resourceType === ResourceType.SKILL) {
+          return Promise.resolve([visibleSkillId]);
+        }
+        return Promise.resolve([]);
+      });
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      expect(response.data).toHaveLength(1);
+      expect(response.data[0].skills_enabled).toBe(true);
+      expect(response.data[0].skills).toEqual([visibleSkillId.toString()]);
+      expect(response.data[0].skills).not.toContain(hiddenSkillId.toString());
+    });
+
+    test('should omit skill scope for VIEW list callers with no accessible configured skills', async () => {
+      const hiddenSkillId = new mongoose.Types.ObjectId();
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        skills_enabled: true,
+        skills: [hiddenSkillId.toString()],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.VIEW);
+      findAccessibleResources.mockImplementation(({ resourceType }) => {
+        if (resourceType === ResourceType.AGENT) {
+          return Promise.resolve([agentA1._id]);
+        }
+        if (resourceType === ResourceType.SKILL) {
+          return Promise.resolve([]);
+        }
+        return Promise.resolve([]);
+      });
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      expect(response.data).toHaveLength(1);
+      expect(response.data[0].skills).toBeUndefined();
+      expect(response.data[0].skills_enabled).toBeUndefined();
+    });
+
+    test('should preserve enabled skill scope for VIEW list callers with an empty allowlist', async () => {
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        skills_enabled: true,
+        skills: [],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.VIEW);
+      findAccessibleResources.mockImplementation(({ resourceType }) => {
+        if (resourceType === ResourceType.AGENT) {
+          return Promise.resolve([agentA1._id]);
+        }
+        if (resourceType === ResourceType.SKILL) {
+          return Promise.resolve([]);
+        }
+        return Promise.resolve([]);
+      });
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      expect(response.data).toHaveLength(1);
+      expect(response.data[0].skills).toBeUndefined();
+      expect(response.data[0].skills_enabled).toBe(true);
+    });
+
+    test('should return raw skill configuration for EDIT list callers', async () => {
+      const visibleSkillId = new mongoose.Types.ObjectId();
+      const hiddenSkillId = new mongoose.Types.ObjectId();
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        skills_enabled: true,
+        skills: [visibleSkillId.toString(), hiddenSkillId.toString()],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.EDIT);
+      findAccessibleResources.mockResolvedValue([agentA1._id]);
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      expect(response.data).toHaveLength(1);
+      expect(response.data[0].skills_enabled).toBe(true);
+      expect(response.data[0].skills).toEqual([
+        visibleSkillId.toString(),
+        hiddenSkillId.toString(),
+      ]);
+      expect(findAccessibleResources).not.toHaveBeenCalledWith(
+        expect.objectContaining({ resourceType: ResourceType.SKILL }),
+      );
+    });
+
     test('should handle promoted filter with ACL', async () => {
       // Create a promoted agent
       const promotedAgent = await Agent.create({
diff --git a/api/server/controllers/auth/oauth.js b/api/server/controllers/auth/oauth.js
index 3502be8a4cb..ede02febb29 100644
--- a/api/server/controllers/auth/oauth.js
+++ b/api/server/controllers/auth/oauth.js
@@ -45,7 +45,9 @@ function createOAuthHandler(redirectUri = domains.client) {
 
         /** Get refresh token from tokenset for OpenID users */
         const refreshToken =
-          req.user.tokenset?.refresh_token || req.user.federatedTokens?.refresh_token;
+          req.user.provider === 'openid' && isEnabled(process.env.OPENID_REUSE_TOKENS) === true
+            ? req.user.tokenset?.refresh_token || req.user.federatedTokens?.refresh_token
+            : undefined;
         const expiresAt = Date.now() + sessionExpiry;
 
         const callbackUrl = new URL(redirectUri);
diff --git a/api/server/controllers/auth/oauth.spec.js b/api/server/controllers/auth/oauth.spec.js
new file mode 100644
index 00000000000..4a20442d4fc
--- /dev/null
+++ b/api/server/controllers/auth/oauth.spec.js
@@ -0,0 +1,151 @@
+const mockIsEnabled = jest.fn();
+const mockGetAdminPanelUrl = jest.fn();
+const mockIsAdminPanelRedirect = jest.fn();
+const mockGenerateAdminExchangeCode = jest.fn();
+const mockSyncUserEntraGroupMemberships = jest.fn();
+const mockSetAuthTokens = jest.fn();
+const mockSetOpenIDAuthTokens = jest.fn();
+const mockGetLogStores = jest.fn();
+const mockCheckBan = jest.fn();
+const mockGenerateToken = jest.fn();
+const mockLogger = { info: jest.fn(), error: jest.fn() };
+
+jest.mock('librechat-data-provider', () => ({
+  CacheKeys: { ADMIN_OAUTH_EXCHANGE: 'admin-oauth-exchange' },
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: mockLogger,
+  DEFAULT_SESSION_EXPIRY: 60000,
+}));
+
+jest.mock('@librechat/api', () => ({
+  isEnabled: (...args) => mockIsEnabled(...args),
+  getAdminPanelUrl: (...args) => mockGetAdminPanelUrl(...args),
+  isAdminPanelRedirect: (...args) => mockIsAdminPanelRedirect(...args),
+  generateAdminExchangeCode: (...args) => mockGenerateAdminExchangeCode(...args),
+}));
+
+jest.mock('~/server/services/PermissionService', () => ({
+  syncUserEntraGroupMemberships: (...args) => mockSyncUserEntraGroupMemberships(...args),
+}));
+
+jest.mock('~/server/services/AuthService', () => ({
+  setAuthTokens: (...args) => mockSetAuthTokens(...args),
+  setOpenIDAuthTokens: (...args) => mockSetOpenIDAuthTokens(...args),
+}));
+
+jest.mock(
+  '~/cache/getLogStores',
+  () =>
+    (...args) =>
+      mockGetLogStores(...args),
+);
+
+jest.mock('~/server/middleware', () => ({
+  checkBan: (...args) => mockCheckBan(...args),
+}));
+
+jest.mock('~/models', () => ({
+  generateToken: (...args) => mockGenerateToken(...args),
+}));
+
+const { createOAuthHandler } = require('./oauth');
+
+const ORIGINAL_ENV = process.env;
+
+function buildReq(overrides = {}) {
+  return {
+    user: {
+      _id: 'user-123',
+      email: 'admin@example.com',
+      provider: 'openid',
+      tokenset: { refresh_token: 'openid-refresh-token', access_token: 'openid-access-token' },
+      federatedTokens: { refresh_token: 'federated-refresh-token' },
+    },
+    pkceChallenge: 'pkce-challenge',
+    banned: false,
+    ...overrides,
+  };
+}
+
+function buildRes() {
+  return {
+    headersSent: false,
+    redirect: jest.fn(),
+  };
+}
+
+describe('createOAuthHandler', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = {
+      ...ORIGINAL_ENV,
+      DOMAIN_CLIENT: 'http://localhost:3080',
+      DOMAIN_SERVER: 'http://localhost:3080',
+      OPENID_REUSE_TOKENS: 'false',
+    };
+    mockIsEnabled.mockImplementation((value) => value === 'true' || value === true);
+    mockGetAdminPanelUrl.mockReturnValue('http://admin.example.com');
+    mockIsAdminPanelRedirect.mockReturnValue(true);
+    mockGetLogStores.mockReturnValue({});
+    mockCheckBan.mockResolvedValue(undefined);
+    mockGenerateToken.mockResolvedValue('jwt-token');
+    mockGenerateAdminExchangeCode.mockResolvedValue('exchange-code');
+  });
+
+  afterAll(() => {
+    process.env = ORIGINAL_ENV;
+  });
+
+  it('omits refresh token from admin exchange when OPENID_REUSE_TOKENS is disabled', async () => {
+    const handler = createOAuthHandler('http://admin.example.com/auth/openid/callback');
+    const req = buildReq();
+    const res = buildRes();
+    const next = jest.fn();
+
+    await handler(req, res, next);
+
+    expect(mockGenerateAdminExchangeCode).toHaveBeenCalledWith(
+      {},
+      req.user,
+      'jwt-token',
+      undefined,
+      'http://admin.example.com',
+      'pkce-challenge',
+      expect.any(Number),
+    );
+    expect(res.redirect).toHaveBeenCalledWith(
+      'http://admin.example.com/auth/openid/callback?code=exchange-code',
+    );
+    expect(mockSetOpenIDAuthTokens).not.toHaveBeenCalled();
+    expect(mockSetAuthTokens).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('includes refresh token in admin exchange when OPENID_REUSE_TOKENS is enabled', async () => {
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    const handler = createOAuthHandler('http://admin.example.com/auth/openid/callback');
+    const req = buildReq();
+    const res = buildRes();
+    const next = jest.fn();
+
+    await handler(req, res, next);
+
+    expect(mockGenerateAdminExchangeCode).toHaveBeenCalledWith(
+      {},
+      req.user,
+      'jwt-token',
+      'openid-refresh-token',
+      'http://admin.example.com',
+      'pkce-challenge',
+      expect.any(Number),
+    );
+    expect(res.redirect).toHaveBeenCalledWith(
+      'http://admin.example.com/auth/openid/callback?code=exchange-code',
+    );
+    expect(mockSetOpenIDAuthTokens).not.toHaveBeenCalled();
+    expect(mockSetAuthTokens).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/controllers/mcp.js b/api/server/controllers/mcp.js
index 8d20cbc82ca..85b840891dc 100644
--- a/api/server/controllers/mcp.js
+++ b/api/server/controllers/mcp.js
@@ -5,18 +5,35 @@
  * @import { MCPServerRegistry } from '@librechat/api'
  * @import { MCPServerDocument } from 'librechat-data-provider'
  */
-const { logger } = require('@librechat/data-schemas');
+const { logger, SystemCapabilities } = require('@librechat/data-schemas');
 const {
+  checkAccess,
+  isUserSourced,
   MCPErrorCodes,
   redactServerSecrets,
   redactAllServerSecrets,
   isMCPDomainNotAllowedError,
   isMCPInspectionFailedError,
 } = require('@librechat/api');
-const { Constants, MCPServerUserInputSchema } = require('librechat-data-provider');
-const { resolveConfigServers, resolveAllMcpConfigs } = require('~/server/services/MCP');
+const {
+  Constants,
+  Permissions,
+  ResourceType,
+  PermissionBits,
+  PermissionTypes,
+  MCP_USER_INPUT_FIELDS,
+  MCPServerUserInputSchema,
+} = require('librechat-data-provider');
+const {
+  resolveConfigServers,
+  resolveMcpConfigNames,
+  resolveAllMcpConfigs,
+} = require('~/server/services/MCP');
 const { cacheMCPServerTools, getMCPServerTools } = require('~/server/services/Config');
+const { getResourcePermissionsMap } = require('~/server/services/PermissionService');
+const { hasCapability } = require('~/server/middleware/roles/capabilities');
 const { getMCPManager, getMCPServersRegistry } = require('~/config');
+const db = require('~/models');
 
 /**
  * Handles MCP-specific errors and sends appropriate HTTP responses.
@@ -84,7 +101,7 @@ const getMCPTools = async (req, res) => {
         try {
           return {
             serverName,
-            tools: await getMCPServerTools(userId, serverName),
+            tools: await getMCPServerTools(userId, serverName, mcpConfig[serverName]),
           };
         } catch (error) {
           logger.error(`[getMCPTools] Error fetching cached tools for ${serverName}:`, error);
@@ -113,7 +130,12 @@ const getMCPTools = async (req, res) => {
 
       if (Object.keys(serverTools).length > 0) {
         // Cache asynchronously without blocking
-        cacheMCPServerTools({ userId, serverName, serverTools }).catch((err) =>
+        cacheMCPServerTools({
+          userId,
+          serverName,
+          serverTools,
+          serverConfig: mcpConfig[serverName],
+        }).catch((err) =>
           logger.error(`[getMCPTools] Failed to cache tools for ${serverName}:`, err),
         );
       }
@@ -142,6 +164,7 @@ const getMCPTools = async (req, res) => {
               authField: key,
               label: value.title || key,
               description: value.description || '',
+              sensitive: value.sensitive,
             }));
             server.authenticated = false;
           }
@@ -178,6 +201,55 @@ const getMCPTools = async (req, res) => {
     res.status(500).json({ message: error.message });
   }
 };
+/** Mirrors canAccessResource's capability bypass plus per-resource ACL EDIT check. */
+async function computeCanEditByServer(req, serverConfigs) {
+  const canEditByServer = new Map();
+  let bypass = false;
+  try {
+    bypass = await hasCapability(req.user, SystemCapabilities.MANAGE_MCP_SERVERS);
+  } catch (err) {
+    logger.warn(`[computeCanEditByServer] Capability bypass check failed: ${err.message}`);
+  }
+  if (bypass) {
+    for (const name of Object.keys(serverConfigs)) {
+      canEditByServer.set(name, true);
+    }
+    return canEditByServer;
+  }
+  const dbIdsToCheck = [];
+  const dbIdToServerName = new Map();
+  for (const [name, config] of Object.entries(serverConfigs)) {
+    if (config.dbId) {
+      dbIdsToCheck.push(config.dbId);
+      dbIdToServerName.set(String(config.dbId), name);
+      continue;
+    }
+    canEditByServer.set(name, isUserSourced(config));
+  }
+  if (dbIdsToCheck.length > 0) {
+    try {
+      const permsMap = await getResourcePermissionsMap({
+        userId: req.user.id,
+        role: req.user.role,
+        resourceType: ResourceType.MCPSERVER,
+        resourceIds: dbIdsToCheck,
+      });
+      for (const [dbIdStr, name] of dbIdToServerName) {
+        const bits = permsMap.get(dbIdStr) ?? 0;
+        canEditByServer.set(name, (bits & PermissionBits.EDIT) !== 0);
+      }
+    } catch (err) {
+      logger.warn(
+        `[computeCanEditByServer] ACL lookup failed, defaulting to no edit: ${err.message}`,
+      );
+      for (const name of dbIdToServerName.values()) {
+        canEditByServer.set(name, false);
+      }
+    }
+  }
+  return canEditByServer;
+}
+
 /**
  * Get all MCP servers with permissions
  * @route GET /api/mcp/servers
@@ -190,13 +262,71 @@ const getMCPServersList = async (req, res) => {
     }
 
     const serverConfigs = await resolveAllMcpConfigs(userId, req.user);
-    return res.json(redactAllServerSecrets(serverConfigs));
+    const canEditByServer = await computeCanEditByServer(req, serverConfigs);
+    return res.json(redactAllServerSecrets(serverConfigs, { canEditByServer }));
   } catch (error) {
     logger.error('[getMCPServersList]', error);
     res.status(500).json({ error: error.message });
   }
 };
 
+/**
+ * Returns true when the request body's parsed config configures OBO. We block
+ * non-permission holders from creating or updating any DB-stored MCP server
+ * that mints per-user delegated tokens.
+ */
+function configHasObo(parsedConfig) {
+  return (
+    !!parsedConfig &&
+    typeof parsedConfig === 'object' &&
+    'obo' in parsedConfig &&
+    parsedConfig.obo != null
+  );
+}
+
+/**
+ * Fields a user without `CONFIGURE_OBO` may modify on an OBO server (allowlist).
+ * Any field not on this list is locked: changes to it (add, modify, or remove)
+ * require the permission. Allowlisting is fail-closed — when upstream introduces
+ * a new MCP server config field, it lands in the locked set by default until
+ * explicitly opted in here. Anything that could redirect the OBO token flow
+ * (`url`, `proxy`, `headers`), change scopes (`obo`), or reroute auth (`oauth`,
+ * `apiKey`, `customUserVars`) MUST stay locked.
+ */
+const OBO_USER_EDITABLE_FIELDS = new Set(['title', 'description', 'iconPath']);
+
+/**
+ * Returns true when any non-allowlisted user-input field differs between the
+ * existing server config and the new payload. Treats add, remove, and modify
+ * as changes (stable JSON compare, with absence on either side counting as a
+ * change unless both sides are absent). The comparison surface is
+ * `MCP_USER_INPUT_FIELDS` (schema-derived from `MCPServerUserInputSchema`),
+ * so new fields on the schema are picked up automatically and stay locked
+ * by default until added to the allowlist above.
+ */
+function violatesOboLockdown(existingConfig, newConfig) {
+  for (const field of MCP_USER_INPUT_FIELDS) {
+    if (OBO_USER_EDITABLE_FIELDS.has(field)) continue;
+    const existing = existingConfig?.[field];
+    const next = newConfig?.[field];
+    if (existing === undefined && next === undefined) continue;
+    if (JSON.stringify(existing) !== JSON.stringify(next)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+async function callerCanConfigureObo(req) {
+  return checkAccess({
+    req,
+    user: req.user,
+    permissionType: PermissionTypes.MCP_SERVERS,
+    permissions: [Permissions.CONFIGURE_OBO],
+    getRoleByName: db.getRoleByName,
+  });
+}
+
 /**
  * Create MCP server
  * @route POST /api/mcp/servers
@@ -213,15 +343,25 @@ const createMCPServerController = async (req, res) => {
         errors: validation.error.errors,
       });
     }
+    if (configHasObo(validation.data) && !(await callerCanConfigureObo(req))) {
+      logger.warn(
+        `[createMCPServer] User ${userId} attempted to configure OBO without ${Permissions.CONFIGURE_OBO} permission`,
+      );
+      return res
+        .status(403)
+        .json({ message: 'Forbidden: Insufficient permissions to configure OBO' });
+    }
+    const reservedServerNames = await resolveMcpConfigNames(req);
     const result = await getMCPServersRegistry().addServer(
       'temp_server_name',
       validation.data,
       'DB',
       userId,
+      reservedServerNames,
     );
     res.status(201).json({
       serverName: result.serverName,
-      ...redactServerSecrets(result.config),
+      ...redactServerSecrets(result.config, { canEdit: true }),
     });
   } catch (error) {
     logger.error('[createMCPServer]', error);
@@ -254,7 +394,9 @@ const getMCPServerById = async (req, res) => {
       return res.status(404).json({ message: 'MCP server not found' });
     }
 
-    res.status(200).json(redactServerSecrets(parsedConfig));
+    const canEditMap = await computeCanEditByServer(req, { [serverName]: parsedConfig });
+    const canEdit = canEditMap.get(serverName) ?? false;
+    res.status(200).json(redactServerSecrets(parsedConfig, { canEdit }));
   } catch (error) {
     logger.error('[getMCPServerById]', error);
     res.status(500).json({ message: error.message });
@@ -278,6 +420,36 @@ const updateMCPServerController = async (req, res) => {
         errors: validation.error.errors,
       });
     }
+
+    /**
+     * On an existing OBO server, lock down every user-input field except the
+     * cosmetic allowlist (title, description, iconPath) for callers without
+     * CONFIGURE_OBO. This closes the OBO redirect vector — without it, a user
+     * with UPDATE could change `url` (or `proxy`/`headers`/`customUserVars`)
+     * to point OBO-minted tokens at an attacker-controlled endpoint. Adds,
+     * modifies, and removes are all caught.
+     */
+    const existingConfig = await getMCPServersRegistry().getServerConfig(serverName, userId);
+    if (configHasObo(existingConfig) && !(await callerCanConfigureObo(req))) {
+      if (violatesOboLockdown(existingConfig, validation.data)) {
+        logger.warn(
+          `[updateMCPServer] User ${userId} attempted to modify a locked field on OBO server '${serverName}' without ${Permissions.CONFIGURE_OBO} permission`,
+        );
+        return res
+          .status(403)
+          .json({ message: 'Forbidden: Insufficient permissions to configure OBO' });
+      }
+    } else if (configHasObo(validation.data) && !(await callerCanConfigureObo(req))) {
+      // Adding OBO to a non-OBO server (or first-time configuration) still
+      // requires the permission, even if existing has no OBO.
+      logger.warn(
+        `[updateMCPServer] User ${userId} attempted to add OBO to '${serverName}' without ${Permissions.CONFIGURE_OBO} permission`,
+      );
+      return res
+        .status(403)
+        .json({ message: 'Forbidden: Insufficient permissions to configure OBO' });
+    }
+
     const parsedConfig = await getMCPServersRegistry().updateServer(
       serverName,
       validation.data,
@@ -285,7 +457,7 @@ const updateMCPServerController = async (req, res) => {
       userId,
     );
 
-    res.status(200).json(redactServerSecrets(parsedConfig));
+    res.status(200).json(redactServerSecrets(parsedConfig, { canEdit: true }));
   } catch (error) {
     logger.error('[updateMCPServer]', error);
     const mcpErrorResponse = handleMCPError(error, res);
diff --git a/api/server/controllers/tools.js b/api/server/controllers/tools.js
index 07be1210c14..4551adf617c 100644
--- a/api/server/controllers/tools.js
+++ b/api/server/controllers/tools.js
@@ -10,6 +10,7 @@ const {
 } = require('librechat-data-provider');
 const { getRoleByName, createToolCall, getToolCallsByConvo, getMessage } = require('~/models');
 const { processFileURL, uploadImageBuffer } = require('~/server/services/Files/process');
+const { getRetentionExpiry } = require('~/server/services/Files/retention');
 const { processCodeOutput, runPreviewFinalize } = require('~/server/services/Files/Code/process');
 const { loadAuthValues } = require('~/server/services/Tools/credentials');
 const { loadTools } = require('~/app/clients/tools/util');
@@ -167,6 +168,7 @@ const callTool = async (req, res) => {
       conversationId,
       result: content,
       user: req.user.id,
+      ...(await getRetentionExpiry(req)),
     };
 
     if (!artifact || !artifact.files || toolId !== Tools.execute_code) {
diff --git a/api/server/experimental.js b/api/server/experimental.js
index b12b9deffe1..ac289615a35 100644
--- a/api/server/experimental.js
+++ b/api/server/experimental.js
@@ -16,14 +16,19 @@ const {
   isEnabled,
   apiNotFound,
   ErrorController,
+  QUERY_DEVTOOLS_HEADER,
   performStartupChecks,
   handleJsonParseError,
   initializeFileStorage,
+  maybeInjectQueryDevtoolsBootstrap,
   preAuthTenantMiddleware,
 } = require('@librechat/api');
 const { connectDb, indexSync } = require('~/db');
 const initializeOAuthReconnectManager = require('./services/initializeOAuthReconnectManager');
+const { capabilityContextMiddleware } = require('./middleware/roles/capabilities');
 const createValidateImageRequest = require('./middleware/validateImageRequest');
+const { startExpiredFileSweep } = require('./services/Files/process');
+const { initializeGitHubSkillSync } = require('./services/Skills/sync');
 const { jwtLogin, ldapLogin, passportLogin } = require('~/strategies');
 const { updateInterfacePermissions: updateInterfacePerms } = require('@librechat/api');
 const {
@@ -35,6 +40,7 @@ const {
 const { checkMigrations } = require('./services/start/migration');
 const initializeMCPs = require('./services/initializeMCPs');
 const configureSocialLogins = require('./socialLogins');
+const createSpaFallback = require('./utils/fallback');
 const { getAppConfig } = require('./services/Config');
 const staticCache = require('./utils/staticCache');
 const optionalJwtAuth = require('./middleware/optionalJwtAuth');
@@ -139,8 +145,32 @@ if (cluster.isMaster) {
   logger.info(`Spawning ${workers} workers to simulate multi-pod environment`);
 
   let activeWorkers = 0;
+  const listeningWorkers = new Set();
+  let retentionSweepWorkerId = null;
   const startTime = Date.now();
 
+  const assignRetentionSweepWorker = () => {
+    if (retentionSweepWorkerId && cluster.workers[retentionSweepWorkerId]) {
+      return;
+    }
+
+    const connectedWorkers = Object.values(cluster.workers).filter(
+      (worker) => worker && worker.isConnected(),
+    );
+    const availableWorkers = connectedWorkers.filter((worker) => listeningWorkers.has(worker.id));
+    const workerPool = availableWorkers.length > 0 ? availableWorkers : connectedWorkers;
+    const retentionSweepWorker = workerPool[workerPool.length - 1];
+    if (!retentionSweepWorker) {
+      return;
+    }
+
+    retentionSweepWorkerId = retentionSweepWorker.id;
+    logger.info(
+      wrapLogMessage(`Worker ${retentionSweepWorker.process.pid} assigned to file-retention sweep`),
+    );
+    retentionSweepWorker.send({ type: 'file-retention-sweep-worker' });
+  };
+
   /** Flush Redis cache before starting workers */
   flushRedisCache()
     .then(() => {
@@ -162,19 +192,29 @@ if (cluster.isMaster) {
       `Worker ${worker.process.pid} is online (${activeWorkers}/${workers}) after ${uptime}s`,
     );
 
-    /** Notify the last worker to perform one-time initialization tasks */
+    /** Assign one worker for process-wide background jobs */
     if (activeWorkers === workers) {
-      const allWorkers = Object.values(cluster.workers);
-      const lastWorker = allWorkers[allWorkers.length - 1];
-      if (lastWorker) {
-        logger.info(wrapLogMessage(`All ${workers} workers are online`));
-        lastWorker.send({ type: 'last-worker' });
-      }
+      logger.info(wrapLogMessage(`All ${workers} workers are online`));
+    }
+  });
+
+  cluster.on('listening', (worker) => {
+    listeningWorkers.add(worker.id);
+    if (
+      listeningWorkers.size === workers ||
+      (!retentionSweepWorkerId && activeWorkers >= workers)
+    ) {
+      assignRetentionSweepWorker();
     }
   });
 
   cluster.on('exit', (worker, code, signal) => {
     activeWorkers--;
+    listeningWorkers.delete(worker.id);
+    if (worker.id === retentionSweepWorkerId) {
+      retentionSweepWorkerId = null;
+      assignRetentionSweepWorker();
+    }
     logger.error(
       `Worker ${worker.process.pid} died (${activeWorkers}/${workers}). Code: ${code}, Signal: ${signal}`,
     );
@@ -202,6 +242,32 @@ if (cluster.isMaster) {
    * Each worker runs a full Express server instance
    */
   const app = express();
+  /**
+   * The master may assign the sweep worker before or after this worker has
+   * loaded app config. These flags join the IPC assignment with config
+   * availability and ensure the background sweep starts only once.
+   */
+  let shouldStartExpiredFileSweep = false;
+  let expiredFileSweepOptions = null;
+  let expiredFileSweepStarted = false;
+
+  const startExpiredFileSweepOnce = () => {
+    if (!shouldStartExpiredFileSweep || expiredFileSweepStarted || !expiredFileSweepOptions) {
+      return;
+    }
+
+    expiredFileSweepStarted = true;
+    startExpiredFileSweep(expiredFileSweepOptions);
+  };
+
+  /** Handle inter-process messages from master */
+  process.on('message', (msg) => {
+    if (msg.type === 'file-retention-sweep-worker') {
+      shouldStartExpiredFileSweep = true;
+      logger.info(wrapLogMessage(`Worker ${process.pid} is assigned file-retention sweep`));
+      startExpiredFileSweepOnce();
+    }
+  });
 
   const startServer = async () => {
     logger.info(`Worker ${process.pid} initializing...`);
@@ -233,6 +299,9 @@ if (cluster.isMaster) {
     /** Initialize app configuration */
     const appConfig = await getAppConfig();
     initializeFileStorage(appConfig);
+    initializeGitHubSkillSync(appConfig);
+    expiredFileSweepOptions = { appConfig, loadAppConfig: getAppConfig };
+    startExpiredFileSweepOnce();
     await performStartupChecks(appConfig);
     await updateInterfacePerms({ appConfig, getRoleByName, updateAccessPermissions });
 
@@ -252,6 +321,23 @@ if (cluster.isMaster) {
       }
     }
 
+    const sendIndexHtml = (req, res) => {
+      res.set({
+        'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
+        Pragma: process.env.INDEX_PRAGMA || 'no-cache',
+        Expires: process.env.INDEX_EXPIRES || '0',
+      });
+      res.vary(QUERY_DEVTOOLS_HEADER);
+
+      const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
+      const saneLang = lang.replace(/"/g, '&quot;');
+      let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
+      updatedIndexHtml = maybeInjectQueryDevtoolsBootstrap(updatedIndexHtml, req);
+
+      res.type('html');
+      res.send(updatedIndexHtml);
+    };
+
     /** Health check endpoint */
     app.get('/health', (_req, res) => res.status(200).send('OK'));
 
@@ -285,6 +371,7 @@ if (cluster.isMaster) {
       logger.warn('Response compression has been disabled via DISABLE_COMPRESSION.');
     }
 
+    app.get('/index.html', sendIndexHtml);
     app.use(staticCache(appConfig.paths.dist));
     app.use(staticCache(appConfig.paths.fonts));
     app.use(staticCache(appConfig.paths.assets));
@@ -307,10 +394,13 @@ if (cluster.isMaster) {
       await configureSocialLogins(app);
     }
 
+    app.use(capabilityContextMiddleware);
+
     /** Routes */
     app.use('/oauth', routes.oauth);
     app.use('/api/auth', routes.auth);
     app.use('/api/admin', routes.adminAuth);
+    app.use('/api/admin/skills', routes.adminSkills);
     app.use('/api/actions', routes.actions);
     app.use('/api/keys', routes.keys);
     app.use('/api/api-keys', routes.apiKeys);
@@ -319,6 +409,7 @@ if (cluster.isMaster) {
     app.use('/api/messages', routes.messages);
     app.use('/api/convos', routes.convos);
     app.use('/api/presets', routes.presets);
+    app.use('/api/projects', routes.projects);
     app.use('/api/prompts', routes.prompts);
     app.use('/api/skills', routes.skills);
     app.use('/api/categories', routes.categories);
@@ -342,20 +433,7 @@ if (cluster.isMaster) {
     app.use('/api', apiNotFound);
 
     /** SPA fallback - serve index.html for all unmatched routes */
-    app.use((req, res) => {
-      res.set({
-        'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
-        Pragma: process.env.INDEX_PRAGMA || 'no-cache',
-        Expires: process.env.INDEX_EXPIRES || '0',
-      });
-
-      const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
-      const saneLang = lang.replace(/"/g, '&quot;');
-      let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
-
-      res.type('html');
-      res.send(updatedIndexHtml);
-    });
+    app.use(createSpaFallback(sendIndexHtml));
 
     /** Error handler (must be last - Express identifies error middleware by its 4-arg signature) */
     app.use(ErrorController);
@@ -390,19 +468,6 @@ if (cluster.isMaster) {
         process.exit(1);
       }
     });
-
-    /** Handle inter-process messages from master */
-    process.on('message', async (msg) => {
-      if (msg.type === 'last-worker') {
-        logger.info(
-          wrapLogMessage(
-            `Worker ${process.pid} is the last worker and can perform special initialization tasks`,
-          ),
-        );
-        /** Add any one-time initialization tasks here */
-        /** For example: scheduled jobs, cleanup tasks, etc. */
-      }
-    });
   };
 
   startServer().catch((err) => {
diff --git a/api/server/index.js b/api/server/index.js
index 7c7f0e22bfe..c9486c90727 100644
--- a/api/server/index.js
+++ b/api/server/index.js
@@ -1,4 +1,4 @@
-require('dotenv').config();
+const telemetry = require('./telemetry');
 const fs = require('fs');
 const path = require('path');
 require('module-alias')({ base: path.resolve(__dirname, '..') });
@@ -13,33 +13,41 @@ const { logger, runAsSystem } = require('@librechat/data-schemas');
 const {
   isEnabled,
   apiNotFound,
+  createMetrics,
   ErrorController,
   memoryDiagnostics,
   performStartupChecks,
   handleJsonParseError,
   GenerationJobManager,
+  QUERY_DEVTOOLS_HEADER,
   createStreamServices,
   initializeFileStorage,
-  updateInterfacePermissions,
+  initializeDeploymentSkills,
+  maybeInjectQueryDevtoolsBootstrap,
   preAuthTenantMiddleware,
+  setupGracefulShutdown,
+  updateInterfacePermissions,
 } = require('@librechat/api');
 const { connectDb, indexSync } = require('~/db');
-const initializeOAuthReconnectManager = require('./services/initializeOAuthReconnectManager');
 const {
-  getRoleByName,
   updateAccessPermissions,
-  seedDatabase,
   sweepOrphanedPreviews,
+  getRoleByName,
+  seedDatabase,
 } = require('~/models');
+const initializeOAuthReconnectManager = require('./services/initializeOAuthReconnectManager');
 const { capabilityContextMiddleware } = require('./middleware/roles/capabilities');
 const createValidateImageRequest = require('./middleware/validateImageRequest');
+const { startExpiredFileSweep } = require('./services/Files/process');
+const { initializeGitHubSkillSync } = require('./services/Skills/sync');
 const { jwtLogin, ldapLogin, passportLogin } = require('~/strategies');
 const { checkMigrations } = require('./services/start/migration');
+const optionalJwtAuth = require('./middleware/optionalJwtAuth');
 const initializeMCPs = require('./services/initializeMCPs');
 const configureSocialLogins = require('./socialLogins');
+const createSpaFallback = require('./utils/fallback');
 const { getAppConfig } = require('./services/Config');
 const staticCache = require('./utils/staticCache');
-const optionalJwtAuth = require('./middleware/optionalJwtAuth');
 const noIndex = require('./middleware/noIndex');
 const logApiResponse = require('./middleware/logApiResponse');
 const routes = require('./routes');
@@ -52,8 +60,38 @@ const host = HOST || 'localhost';
 const trusted_proxy = Number(TRUST_PROXY) || 1; /* trust first proxy by default */
 
 const app = express();
+let serverReady = false;
+
+const SERVER_NOT_READY_CODE = 'SERVER_NOT_READY';
+const CHAT_START_RETRY_AFTER_SECONDS = '1';
+
+const rejectChatStartsUntilReady = (req, res, next) => {
+  if (serverReady || req.method !== 'POST' || req.path === '/abort') {
+    return next();
+  }
+
+  res.set('Retry-After', CHAT_START_RETRY_AFTER_SECONDS);
+  return res.status(503).json({
+    code: SERVER_NOT_READY_CODE,
+    error: 'Server is still starting. Please retry shortly.',
+  });
+};
+
+const configureGenerationStreams = () => {
+  const streamServices = createStreamServices();
+  GenerationJobManager.configure({
+    ...streamServices,
+    cleanupOnComplete: !isEnabled(process.env.STREAM_KEEP_COMPLETED_JOBS),
+  });
+  GenerationJobManager.initialize();
+};
 
 const startServer = async () => {
+  const { metricsMiddleware, metricsRouter } = createMetrics();
+  if (!process.env.METRICS_SECRET) {
+    logger.warn('[metrics] METRICS_SECRET is not set - /metrics will return 401 for all requests');
+  }
+
   if (typeof Bun !== 'undefined') {
     axios.defaults.headers.common['Accept-Encoding'] = 'gzip';
   }
@@ -84,6 +122,9 @@ const startServer = async () => {
   });
   const appConfig = await getAppConfig({ baseOnly: true });
   initializeFileStorage(appConfig);
+  await initializeDeploymentSkills({ projectRoot: path.resolve(__dirname, '../..') });
+  initializeGitHubSkillSync(appConfig);
+  startExpiredFileSweep({ appConfig, loadAppConfig: getAppConfig });
   await runAsSystem(async () => {
     await performStartupChecks(appConfig);
     await updateInterfacePermissions({ appConfig, getRoleByName, updateAccessPermissions });
@@ -105,9 +146,34 @@ const startServer = async () => {
     }
   }
 
+  const sendIndexHtml = (req, res) => {
+    res.set({
+      'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
+      Pragma: process.env.INDEX_PRAGMA || 'no-cache',
+      Expires: process.env.INDEX_EXPIRES || '0',
+    });
+    res.vary(QUERY_DEVTOOLS_HEADER);
+
+    const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
+    const saneLang = lang.replace(/"/g, '&quot;');
+    let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
+    updatedIndexHtml = maybeInjectQueryDevtoolsBootstrap(updatedIndexHtml, req);
+
+    res.type('html');
+    res.send(updatedIndexHtml);
+  };
+
   app.get('/health', (_req, res) => res.status(200).send('OK'));
+  app.get('/livez', (_req, res) => res.status(200).send('OK'));
+  app.get('/readyz', (_req, res) => {
+    if (!serverReady) {
+      return res.status(503).send('NOT_READY');
+    }
+    return res.status(200).send('OK');
+  });
 
   /* Middleware */
+  app.use(metricsMiddleware);
   app.use(noIndex);
   app.use(express.json({ limit: '3mb' }));
   app.use(express.urlencoded({ extended: true, limit: '3mb' }));
@@ -136,10 +202,15 @@ const startServer = async () => {
     console.warn('Response compression has been disabled via DISABLE_COMPRESSION.');
   }
 
+  app.get('/index.html', sendIndexHtml);
   app.use(staticCache(appConfig.paths.dist));
   app.use(staticCache(appConfig.paths.fonts));
   app.use(staticCache(appConfig.paths.assets));
 
+  if (telemetry.enabled) {
+    app.use(telemetry.telemetryMiddleware);
+  }
+
   if (!ALLOW_SOCIAL_LOGIN) {
     console.warn('Social logins are disabled. Set ALLOW_SOCIAL_LOGIN=true to enable them.');
   }
@@ -171,7 +242,9 @@ const startServer = async () => {
   app.use('/api/admin/grants', routes.adminGrants);
   app.use('/api/admin/groups', routes.adminGroups);
   app.use('/api/admin/roles', routes.adminRoles);
+  app.use('/api/admin/skills', routes.adminSkills);
   app.use('/api/admin/users', routes.adminUsers);
+  app.use('/api/admin/audit-log', routes.adminAuditLog);
   app.use('/api/actions', routes.actions);
   app.use('/api/keys', routes.keys);
   app.use('/api/api-keys', routes.apiKeys);
@@ -180,6 +253,7 @@ const startServer = async () => {
   app.use('/api/messages', routes.messages);
   app.use('/api/convos', routes.convos);
   app.use('/api/presets', routes.presets);
+  app.use('/api/projects', routes.projects);
   app.use('/api/prompts', routes.prompts);
   app.use('/api/skills', routes.skills);
   app.use('/api/categories', routes.categories);
@@ -192,6 +266,7 @@ const startServer = async () => {
   app.use('/images/', createValidateImageRequest(appConfig.secureImageLinks), routes.staticRoute);
   app.use('/api/share', preAuthTenantMiddleware, routes.share);
   app.use('/api/roles', routes.roles);
+  app.use('/api/agents/chat', rejectChatStartsUntilReady);
   app.use('/api/agents', routes.agents);
   app.use('/api/banner', routes.banner);
   app.use('/api/memories', routes.memories);
@@ -199,30 +274,26 @@ const startServer = async () => {
 
   app.use('/api/tags', routes.tags);
   app.use('/api/mcp', routes.mcp);
+  app.use('/api/rum', routes.rum);
+
+  app.use('/metrics', metricsRouter);
 
   /** 404 for unmatched API routes */
   app.use('/api', apiNotFound);
 
   /** SPA fallback - serve index.html for all unmatched routes */
-  app.use((req, res) => {
-    res.set({
-      'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
-      Pragma: process.env.INDEX_PRAGMA || 'no-cache',
-      Expires: process.env.INDEX_EXPIRES || '0',
-    });
-
-    const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
-    const saneLang = lang.replace(/"/g, '&quot;');
-    let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
-
-    res.type('html');
-    res.send(updatedIndexHtml);
-  });
+  app.use(createSpaFallback(sendIndexHtml));
 
+  /** Record trace errors before the final error controller. */
+  if (telemetry.enabled) {
+    app.use(telemetry.telemetryErrorMiddleware);
+  }
   /** Error handler (must be last - Express identifies error middleware by its 4-arg signature) */
   app.use(ErrorController);
 
-  app.listen(port, host, async (err) => {
+  configureGenerationStreams();
+
+  const server = app.listen(port, host, async (err) => {
     if (err) {
       logger.error('Failed to start server:', err);
       process.exit(1);
@@ -251,20 +322,20 @@ const startServer = async () => {
       });
       await checkMigrations();
 
-      // Configure stream services (auto-detects Redis from USE_REDIS env var)
-      const streamServices = createStreamServices();
-      GenerationJobManager.configure(streamServices);
-      GenerationJobManager.initialize();
-
       const inspectFlags = process.execArgv.some((arg) => arg.startsWith('--inspect'));
       if (inspectFlags || isEnabled(process.env.MEM_DIAG)) {
         memoryDiagnostics.start();
       }
+      serverReady = true;
+      logger.info('Server readiness checks passing.');
     } catch (initErr) {
+      serverReady = false;
       logger.error('Post-listen initialization failed:', initErr);
       process.exit(1);
     }
   });
+
+  setupGracefulShutdown(server);
 };
 
 /**
diff --git a/api/server/index.metrics.spec.js b/api/server/index.metrics.spec.js
new file mode 100644
index 00000000000..c907aca3b61
--- /dev/null
+++ b/api/server/index.metrics.spec.js
@@ -0,0 +1,166 @@
+const fs = require('fs');
+const request = require('supertest');
+const { MongoMemoryServer } = require('mongodb-memory-server');
+const mongoose = require('mongoose');
+
+jest.mock('~/server/services/Config', () => ({
+  loadCustomConfig: jest.fn(() => Promise.resolve({})),
+  getAppConfig: jest.fn().mockResolvedValue({
+    paths: {
+      uploads: '/tmp',
+      dist: '/tmp/dist',
+      fonts: '/tmp/fonts',
+      assets: '/tmp/assets',
+    },
+    fileStrategy: 'local',
+    imageOutputType: 'PNG',
+  }),
+  setCachedTools: jest.fn(),
+}));
+
+jest.mock('~/app/clients/tools', () => ({
+  createOpenAIImageTools: jest.fn(() => []),
+  createYouTubeTools: jest.fn(() => []),
+  manifestToolMap: {},
+  toolkits: [],
+}));
+
+jest.mock('~/config', () => ({
+  createMCPServersRegistry: jest.fn(),
+  createMCPManager: jest.fn().mockResolvedValue({
+    getAppToolFunctions: jest.fn().mockResolvedValue({}),
+  }),
+}));
+
+describe('Server metrics route', () => {
+  jest.setTimeout(30_000);
+
+  let mongoServer;
+  let app;
+
+  const originalReadFileSync = fs.readFileSync;
+
+  beforeAll(() => {
+    fs.readFileSync = function (filepath, options) {
+      if (filepath.includes('index.html')) {
+        return '<!DOCTYPE html><html><head><title>LibreChat</title></head><body><div id="root"></div></body></html>';
+      }
+      return originalReadFileSync(filepath, options);
+    };
+  });
+
+  afterAll(() => {
+    fs.readFileSync = originalReadFileSync;
+  });
+
+  beforeAll(async () => {
+    const fs = require('fs');
+    const path = require('path');
+
+    const dirs = ['/tmp/dist', '/tmp/fonts', '/tmp/assets'];
+    dirs.forEach((dir) => {
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+    });
+
+    fs.writeFileSync(
+      path.join('/tmp/dist', 'index.html'),
+      '<!DOCTYPE html><html><head><title>LibreChat</title></head><body><div id="root"></div></body></html>',
+    );
+
+    mongoServer = await MongoMemoryServer.create();
+    process.env.MONGO_URI = mongoServer.getUri();
+    process.env.PORT = '0';
+    process.env.METRICS_SECRET = 'test-secret';
+    app = require('~/server');
+
+    await healthCheckPoll(app);
+  });
+
+  afterEach(() => {
+    process.env.METRICS_SECRET = 'test-secret';
+  });
+
+  afterAll(async () => {
+    delete process.env.METRICS_SECRET;
+    await mongoServer.stop();
+    await mongoose.disconnect();
+  });
+
+  it('returns 401 at /metrics when METRICS_SECRET is unset', async () => {
+    const response = await request(app).get('/metrics');
+    expect(response.status).toBe(401);
+  });
+
+  it('returns 401 at /metrics when no token provided', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics');
+
+    expect(response.status).toBe(401);
+  });
+
+  it('returns 401 at /metrics when wrong token provided', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics').set('Authorization', 'Bearer wrong-token');
+
+    expect(response.status).toBe(401);
+  });
+
+  it('returns 401 at /metrics when the bearer scheme is omitted', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics').set('Authorization', 'test-secret');
+
+    expect(response.status).toBe(401);
+  });
+
+  it('returns 401 at /metrics for non-bearer auth schemes', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics').set('Authorization', 'Basic test-secret');
+
+    expect(response.status).toBe(401);
+  });
+
+  it('exposes Prometheus metrics at /metrics with correct bearer token', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics').set('Authorization', 'Bearer test-secret');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['content-type']).toMatch(/text\/plain/);
+    expect(response.text).toMatch(/^# HELP /m);
+    expect(response.text).toMatch(/^# TYPE /m);
+  });
+
+  it('accepts lowercase bearer scheme at /metrics', async () => {
+    process.env.METRICS_SECRET = 'test-secret';
+
+    const response = await request(app).get('/metrics').set('Authorization', 'bearer test-secret');
+
+    expect(response.status).toBe(200);
+  });
+});
+
+async function healthCheckPoll(app, retries = 0) {
+  const maxRetries = Math.floor(10000 / 30);
+  try {
+    const response = await request(app).get('/health');
+    if (response.status === 200) {
+      return;
+    }
+  } catch {
+    // Ignore connection errors during polling.
+  }
+
+  if (retries < maxRetries) {
+    await new Promise((resolve) => setTimeout(resolve, 30));
+    await healthCheckPoll(app, retries + 1);
+    return;
+  }
+
+  throw new Error('App did not become healthy within 10 seconds.');
+}
diff --git a/api/server/index.spec.js b/api/server/index.spec.js
index 7b3d062fce0..3e0fc07127d 100644
--- a/api/server/index.spec.js
+++ b/api/server/index.spec.js
@@ -1,4 +1,5 @@
 const fs = require('fs');
+const path = require('path');
 const request = require('supertest');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 const mongoose = require('mongoose');
@@ -32,6 +33,83 @@ jest.mock('~/config', () => ({
   }),
 }));
 
+jest.mock(
+  '@librechat/api/telemetry',
+  () => ({
+    initializeTelemetry: jest.fn(() => ({
+      enabled: false,
+      status: 'disabled',
+      shutdown: jest.fn(),
+    })),
+    telemetryMiddleware: jest.fn((_req, _res, next) => next()),
+    telemetryErrorMiddleware: jest.fn((err, _req, _res, next) => next(err)),
+  }),
+  { virtual: true },
+);
+
+describe('Telemetry wiring', () => {
+  const source = fs.readFileSync(path.join(__dirname, 'index.js'), 'utf8');
+
+  it('loads telemetry before other server imports', () => {
+    const firstStatement = source
+      .split('\n')
+      .map((line) => line.trim())
+      .find(Boolean);
+
+    expect(firstStatement).toBe("const telemetry = require('./telemetry');");
+  });
+
+  it('mounts telemetry middleware after static assets and before routes', () => {
+    const telemetryMiddlewareIndex = source.indexOf('app.use(telemetry.telemetryMiddleware);');
+    const staticAssetsIndex = source.indexOf('app.use(staticCache(appConfig.paths.assets));');
+    const apiRoutesIndex = source.indexOf("app.use('/api/auth'");
+
+    expect(telemetryMiddlewareIndex).toBeGreaterThan(-1);
+    expect(staticAssetsIndex).toBeGreaterThan(-1);
+    expect(apiRoutesIndex).toBeGreaterThan(-1);
+    expect(staticAssetsIndex).toBeLessThan(telemetryMiddlewareIndex);
+    expect(telemetryMiddlewareIndex).toBeLessThan(apiRoutesIndex);
+  });
+
+  it('mounts telemetry error middleware before ErrorController', () => {
+    const telemetryErrorMiddlewareIndex = source.indexOf(
+      'app.use(telemetry.telemetryErrorMiddleware);',
+    );
+    const errorControllerIndex = source.indexOf('app.use(ErrorController);');
+
+    expect(telemetryErrorMiddlewareIndex).toBeGreaterThan(-1);
+    expect(errorControllerIndex).toBeGreaterThan(-1);
+    expect(telemetryErrorMiddlewareIndex).toBeLessThan(errorControllerIndex);
+  });
+});
+
+describe('Startup readiness wiring', () => {
+  const source = fs.readFileSync(path.join(__dirname, 'index.js'), 'utf8');
+
+  it('configures generation streams before the server accepts requests', () => {
+    const streamConfigIndex = source.indexOf('configureGenerationStreams();');
+    const listenIndex = source.indexOf('const server = app.listen');
+    const postListenMcpIndex = source.indexOf('await initializeMCPs();');
+
+    expect(streamConfigIndex).toBeGreaterThan(-1);
+    expect(listenIndex).toBeGreaterThan(-1);
+    expect(postListenMcpIndex).toBeGreaterThan(-1);
+    expect(streamConfigIndex).toBeLessThan(listenIndex);
+    expect(streamConfigIndex).toBeLessThan(postListenMcpIndex);
+  });
+
+  it('mounts the chat-start readiness gate before agent routes', () => {
+    const readinessGateIndex = source.indexOf(
+      "app.use('/api/agents/chat', rejectChatStartsUntilReady);",
+    );
+    const agentsRouteIndex = source.indexOf("app.use('/api/agents', routes.agents);");
+
+    expect(readinessGateIndex).toBeGreaterThan(-1);
+    expect(agentsRouteIndex).toBeGreaterThan(-1);
+    expect(readinessGateIndex).toBeLessThan(agentsRouteIndex);
+  });
+});
+
 describe('Server Configuration', () => {
   // Increase the default timeout to allow for Mongo cleanup
   jest.setTimeout(30_000);
@@ -134,6 +212,32 @@ describe('Server Configuration', () => {
     expect(response.headers['content-type']).toMatch(/html/);
   });
 
+  it('should gate React Query Devtools config in SPA HTML by debug header', async () => {
+    const defaultResponse = await request(app).get('/this/does/not/exist');
+    const debugResponse = await request(app)
+      .get('/this/does/not/exist')
+      .set('x-librechat-enable-query-devtools', '1');
+    const directIndexResponse = await request(app)
+      .get('/index.html')
+      .set('x-librechat-enable-query-devtools', '1');
+
+    expect(defaultResponse.status).toBe(200);
+    expect(defaultResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(defaultResponse.text).not.toContain('enableQueryDevtools');
+
+    expect(debugResponse.status).toBe(200);
+    expect(debugResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(debugResponse.text).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(debugResponse.text).toContain('data-librechat-query-devtools="true"');
+    expect(debugResponse.text).toContain('"enableQueryDevtools":true');
+
+    expect(directIndexResponse.status).toBe(200);
+    expect(directIndexResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(directIndexResponse.text).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(directIndexResponse.text).toContain('data-librechat-query-devtools="true"');
+    expect(directIndexResponse.text).toContain('"enableQueryDevtools":true');
+  });
+
   it('should return 500 for unknown errors via ErrorController', async () => {
     // Testing the error handling here on top of unit tests to ensure the middleware is correctly integrated
 
diff --git a/api/server/middleware/__tests__/requireJwtAuth.spec.js b/api/server/middleware/__tests__/requireJwtAuth.spec.js
index 7f0963398d7..b70f371a941 100644
--- a/api/server/middleware/__tests__/requireJwtAuth.spec.js
+++ b/api/server/middleware/__tests__/requireJwtAuth.spec.js
@@ -41,25 +41,194 @@ jest.mock('@librechat/data-schemas', () => {
   const tenantStorage = new AsyncLocalStorage();
   return {
     getTenantId: () => tenantStorage.getStore()?.tenantId,
+    getUserId: () => tenantStorage.getStore()?.userId,
+    getRequestId: () => tenantStorage.getStore()?.requestId,
+    logger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
     tenantStorage,
   };
 });
 
 // Mock @librechat/api — the real tenantContextMiddleware is TS and cannot be
 // required directly from CJS tests. This thin wrapper mirrors the real logic
-// (read req.user.tenantId, call tenantStorage.run) using the same data-schemas
+// (read request context, call tenantStorage.run) using the same data-schemas
 // primitives. The real implementation is covered by packages/api tenant.spec.ts.
 jest.mock('@librechat/api', () => {
   const { tenantStorage } = require('@librechat/data-schemas');
+  const normalizeAuthLogValue = (value) => {
+    if (value == null) {
+      return undefined;
+    }
+    if (Array.isArray(value)) {
+      for (const entry of value) {
+        const normalized = normalizeAuthLogValue(entry);
+        if (normalized) {
+          return normalized;
+        }
+      }
+      return undefined;
+    }
+    if (typeof value === 'string') {
+      const trimmed = value.trim();
+      return trimmed || undefined;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+      return String(value);
+    }
+    return undefined;
+  };
+  const normalizeAuthLogContextValue = (value) => {
+    if (value == null) {
+      return undefined;
+    }
+    if (Array.isArray(value)) {
+      const values = value
+        .map((entry) => normalizeAuthLogValue(entry))
+        .filter((entry) => entry !== undefined);
+      return values.length > 0 ? values : undefined;
+    }
+    if (typeof value === 'string') {
+      return normalizeAuthLogValue(value);
+    }
+    if (typeof value === 'number') {
+      return Number.isFinite(value) ? value : undefined;
+    }
+    if (typeof value === 'boolean') {
+      return value;
+    }
+    return undefined;
+  };
+  const getAuthFailureField = (source, field) => {
+    if (!source) {
+      return undefined;
+    }
+    if (typeof source === 'string') {
+      return field === 'message' ? source : undefined;
+    }
+    if (typeof source === 'object') {
+      try {
+        return source[field];
+      } catch {
+        return undefined;
+      }
+    }
+    return undefined;
+  };
+  const getAuthFailureReason = (err, info, fallback = 'Unauthorized') =>
+    normalizeAuthLogValue(getAuthFailureField(info, 'message')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'message')) ??
+    fallback;
+  const getAuthFailureErrorName = (err, info) =>
+    normalizeAuthLogValue(getAuthFailureField(info, 'name')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'name'));
+  const getSafeTokenProvider = (tokenProvider) => {
+    const normalized = normalizeAuthLogValue(tokenProvider);
+    if (!normalized) {
+      return undefined;
+    }
+    return normalized === 'openid' || normalized === 'librechat' ? normalized : 'other';
+  };
+  const normalizeRoutePath = (path) => {
+    if (typeof path === 'string') {
+      return normalizeAuthLogValue(path);
+    }
+    if (Array.isArray(path)) {
+      for (const entry of path) {
+        const normalized = normalizeRoutePath(entry);
+        if (normalized) {
+          return normalized;
+        }
+      }
+    }
+    return undefined;
+  };
+  const joinRoutePath = (baseUrl, routePath) => {
+    const normalizedRoute = routePath === '/' ? '' : routePath;
+    if (!baseUrl) {
+      return normalizedRoute || '/';
+    }
+    if (!normalizedRoute) {
+      return baseUrl;
+    }
+    return `${baseUrl.replace(/\/$/, '')}/${normalizedRoute.replace(/^\//, '')}`;
+  };
+  const bucketConcretePath = (path) => {
+    const queryless = path?.split('?')[0];
+    if (!queryless) {
+      return undefined;
+    }
+    const segments = queryless.split('/').filter(Boolean);
+    if (segments.length === 0) {
+      return '/';
+    }
+    if (segments[0] === 'api' && segments[1]) {
+      return `/${segments.slice(0, 2).join('/')}`;
+    }
+    return `/${segments[0]}`;
+  };
+  const getRequestPath = (req) => {
+    const baseUrl = normalizeAuthLogValue(req.baseUrl);
+    const routePath = normalizeRoutePath(req.route?.path);
+    if (routePath) {
+      return joinRoutePath(baseUrl, routePath);
+    }
+    if (baseUrl) {
+      return baseUrl;
+    }
+    const path =
+      normalizeAuthLogValue(req.path) ?? normalizeAuthLogValue(req.originalUrl ?? req.url);
+    return bucketConcretePath(path);
+  };
+  const compactAuthLogContext = (log) =>
+    Object.fromEntries(
+      Object.entries(log)
+        .map(([key, value]) => [key, normalizeAuthLogContextValue(value)])
+        .filter(([, value]) => value !== undefined),
+    );
+  const buildSafeAuthLogContext = (req, authState, extra = {}) =>
+    compactAuthLogContext({
+      ...extra,
+      request_id:
+        normalizeAuthLogValue(req.requestId) ??
+        normalizeAuthLogValue(req.id) ??
+        normalizeAuthLogValue(req.headers?.['x-request-id']) ??
+        normalizeAuthLogValue(req.headers?.['x-correlation-id']),
+      method: normalizeAuthLogValue(req.method),
+      path: getRequestPath(req),
+      token_provider: getSafeTokenProvider(authState.tokenProvider),
+      openid_reuse_enabled: authState.openidReuseEnabled,
+      openid_jwt_available: authState.openidJwtAvailable,
+      has_openid_reuse_user_id: authState.hasOpenIdReuseUserId,
+    });
+  const formatAuthLogMessage = (message, context) => `${message} ${JSON.stringify(context)}`;
+  const normalizeContextValue = (value) => {
+    const trimmed = value?.trim?.();
+    return trimmed || undefined;
+  };
+  const getUserId = (user) =>
+    normalizeContextValue(user?.id?.toString?.()) ?? normalizeContextValue(user?._id?.toString?.());
+  const getRequestId = (req) =>
+    normalizeContextValue(req.requestId) ??
+    normalizeContextValue(req.id) ??
+    normalizeContextValue(req.headers?.['x-request-id']) ??
+    normalizeContextValue(req.headers?.['x-correlation-id']);
   return {
     isEnabled: jest.fn(() => false),
+    recordRumProxyRequest: jest.fn(),
+    getAuthFailureReason,
+    getAuthFailureErrorName,
+    buildSafeAuthLogContext,
+    formatAuthLogMessage,
     maybeRefreshCloudFrontAuthCookiesMiddleware: jest.fn((req, res, next) => next()),
     tenantContextMiddleware: (req, res, next) => {
-      const tenantId = req.user?.tenantId;
-      if (!tenantId) {
+      const context = {
+        tenantId: normalizeContextValue(req.user?.tenantId),
+        userId: getUserId(req.user),
+        requestId: getRequestId(req),
+      };
+      if (!context.tenantId && !context.userId && !context.requestId) {
         return next();
       }
-      return tenantStorage.run({ tenantId }, async () => next());
+      return tenantStorage.run(context, async () => next());
     },
   };
 });
@@ -67,8 +236,13 @@ jest.mock('@librechat/api', () => {
 // ── Helpers ─────────────────────────────────────────────────────────────
 
 const requireJwtAuth = require('../requireJwtAuth');
-const { getTenantId } = require('@librechat/data-schemas');
-const { isEnabled, maybeRefreshCloudFrontAuthCookiesMiddleware } = require('@librechat/api');
+const { requireRumProxyAuth } = requireJwtAuth;
+const { getTenantId, getUserId, logger } = require('@librechat/data-schemas');
+const {
+  isEnabled,
+  maybeRefreshCloudFrontAuthCookiesMiddleware,
+  recordRumProxyRequest,
+} = require('@librechat/api');
 const passport = require('passport');
 
 const jwtSecret = 'test-refresh-secret';
@@ -82,7 +256,11 @@ function signedOpenIdUserCookie(userId = 'user-openid') {
 }
 
 function mockRes() {
-  return { status: jest.fn().mockReturnThis(), json: jest.fn().mockReturnThis() };
+  return {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+    end: jest.fn().mockReturnThis(),
+  };
 }
 
 /** Runs requireJwtAuth and returns the tenantId observed inside next(). */
@@ -110,6 +288,11 @@ describe('requireJwtAuth tenant context chaining', () => {
     mockRegisteredStrategies = new Set(['jwt']);
     isEnabled.mockReturnValue(false);
     maybeRefreshCloudFrontAuthCookiesMiddleware.mockClear();
+    logger.debug.mockClear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+    logger.error.mockClear();
+    recordRumProxyRequest.mockClear();
     passport.authenticate.mockClear();
     passport._strategy.mockClear();
     if (originalJwtSecret === undefined) {
@@ -151,6 +334,27 @@ describe('requireJwtAuth tenant context chaining', () => {
     expect(next).toHaveBeenCalled();
   });
 
+  it('refreshes CloudFront auth cookies inside the request context', () => {
+    let observedContext;
+    maybeRefreshCloudFrontAuthCookiesMiddleware.mockImplementationOnce(
+      (_req, _res, middlewareNext) => {
+        observedContext = {
+          tenantId: getTenantId(),
+          userId: getUserId(),
+        };
+        middlewareNext();
+      },
+    );
+    const req = mockReq({ id: 'user-123', tenantId: 'tenant-abc', role: 'user' });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(observedContext).toEqual({ tenantId: 'tenant-abc', userId: 'user-123' });
+    expect(next).toHaveBeenCalled();
+  });
+
   it('ALS tenant context is NOT set when user has no tenantId', async () => {
     const tenantId = await runAuth({ role: 'user' });
     expect(tenantId).toBeUndefined();
@@ -166,6 +370,207 @@ describe('requireJwtAuth tenant context chaining', () => {
     expect(next).not.toHaveBeenCalled();
     expect(res.status).toHaveBeenCalledWith(401);
     expect(getTenantId()).toBeUndefined();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        primary_strategy: 'jwt',
+        fallback_attempted: false,
+        fallback_succeeded: false,
+        attempted_strategies: ['jwt'],
+        final_strategy: 'jwt',
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('logs OpenID JWT expiry when JWT fallback succeeds', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-expired-success',
+      method: 'GET',
+      path: '/api/messages',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: { user: { id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(res.status).not.toHaveBeenCalled();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-expired-success',
+        method: 'GET',
+        path: '/api/messages',
+        token_provider: 'openid',
+        openid_reuse_enabled: true,
+        openid_jwt_available: true,
+        has_openid_reuse_user_id: true,
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-expired-success',
+        auth_strategy: 'jwt',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: true,
+        primary_failure_reason: 'jwt expired',
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+      }),
+    );
+    expect(logger.debug.mock.calls[0][0]).toContain('"reason":"jwt expired"');
+    expect(logger.debug.mock.calls[0][0]).toContain('"fallback_attempted":true');
+    expect(logger.debug.mock.calls[1][0]).toContain('"fallback_succeeded":true');
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('does not let malformed Passport info break JWT fallback logging', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const info = {};
+    Object.defineProperties(info, {
+      message: {
+        get() {
+          throw new TypeError('message getter failed');
+        },
+      },
+      name: {
+        get() {
+          throw new TypeError('name getter failed');
+        },
+      },
+    });
+    const req = mockReq(undefined, {
+      requestId: 'req-malformed-info',
+      method: 'GET',
+      path: '/api/messages',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info,
+          status: 401,
+        },
+        jwt: { user: { id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    expect(() => requireJwtAuth(req, res, next)).not.toThrow();
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(res.status).not.toHaveBeenCalled();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-malformed-info',
+        fallback_attempted: true,
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-malformed-info',
+        fallback_succeeded: true,
+        primary_failure_reason: 'Unauthorized',
+      }),
+    );
+  });
+
+  it('logs OpenID JWT expiry when JWT fallback fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      id: 'req-expired-fail',
+      method: 'POST',
+      originalUrl: '/api/ask?access_token=hidden',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: {
+          user: false,
+          info: { message: 'invalid signature', name: 'JsonWebTokenError' },
+          status: 401,
+        },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-expired-fail',
+        method: 'POST',
+        path: '/api/ask',
+        fallback_attempted: true,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        request_id: 'req-expired-fail',
+        method: 'POST',
+        path: '/api/ask',
+        token_provider: 'openid',
+        attempted_strategies: ['openidJwt', 'jwt'],
+        final_strategy: 'jwt',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'invalid signature',
+        error_name: 'JsonWebTokenError',
+        status: 401,
+      }),
+    );
+    expect(logger.warn.mock.calls[0][0]).toContain('"reason":"invalid signature"');
+    expect(logger.warn.mock.calls[0][0]).toContain('"path":"/api/ask"');
   });
 
   it('does not fall back to OpenID JWT for bearer-only reuse requests', () => {
@@ -225,6 +630,98 @@ describe('requireJwtAuth tenant context chaining', () => {
     );
   });
 
+  it('logs OpenID user-id mismatch when JWT fallback succeeds', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-mismatch-success',
+      method: 'GET',
+      path: '/api/auth/me',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-a')}`,
+      },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-b', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: { id: 'user-a', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-success',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        reason: 'openid user-id mismatch',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-success',
+        auth_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: true,
+        primary_failure_reason: 'openid user-id mismatch',
+        reason: 'openid user-id mismatch',
+      }),
+    );
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('logs OpenID user-id mismatch when JWT fallback fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-mismatch-fail',
+      method: 'GET',
+      path: '/api/auth/me',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-a')}`,
+      },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-b', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: false, info: { message: 'Unauthorized' }, status: 401 },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-fail',
+        fallback_attempted: true,
+        reason: 'openid user-id mismatch',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-fail',
+        attempted_strategies: ['openidJwt', 'jwt'],
+        final_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+  });
+
   it('does not authenticate OpenID JWT when the reuse cookie belongs to another user', () => {
     isEnabled.mockReturnValue(true);
     mockRegisteredStrategies.add('openidJwt');
@@ -350,3 +847,141 @@ describe('requireJwtAuth tenant context chaining', () => {
     expect(getTenantId()).toBeUndefined();
   });
 });
+
+describe('requireRumProxyAuth', () => {
+  const originalJwtSecret = process.env.JWT_REFRESH_SECRET;
+
+  beforeEach(() => {
+    process.env.JWT_REFRESH_SECRET = jwtSecret;
+  });
+
+  afterEach(() => {
+    mockPassportError = null;
+    mockRegisteredStrategies = new Set(['jwt']);
+    isEnabled.mockReturnValue(false);
+    maybeRefreshCloudFrontAuthCookiesMiddleware.mockClear();
+    logger.debug.mockClear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+    logger.error.mockClear();
+    recordRumProxyRequest.mockClear();
+    passport.authenticate.mockClear();
+    passport._strategy.mockClear();
+    if (originalJwtSecret === undefined) {
+      delete process.env.JWT_REFRESH_SECRET;
+    } else {
+      process.env.JWT_REFRESH_SECRET = originalJwtSecret;
+    }
+  });
+
+  it('authenticates telemetry with the LibreChat JWT strategy without tenant or cookie refresh middleware', () => {
+    const req = mockReq({ id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledWith(
+      'jwt',
+      { session: false },
+      expect.any(Function),
+    );
+    expect(req.authStrategy).toBe('jwt');
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    // Success is recorded by the proxy.
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('authenticates telemetry with OpenID JWT reuse when the reuse cookie is present', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      headers: { cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie()}` },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-openid', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: false, info: { message: 'invalid signature' }, status: 401 },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledWith(
+      'openidJwt',
+      { session: false },
+      expect.any(Function),
+    );
+    expect(req.authStrategy).toBe('openidJwt');
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('falls back to LibreChat JWT when OpenID JWT telemetry auth fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      headers: { cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie()}` },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: { user: { id: 'user-openid', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledTimes(2);
+    expect(req.authStrategy).toBe('jwt');
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('drops invalid telemetry auth with 204 instead of returning an app auth error', () => {
+    const req = mockReq(undefined, {
+      path: '/v1/traces',
+      _mockStrategies: {
+        jwt: {
+          user: false,
+          info: { message: 'invalid signature', name: 'JsonWebTokenError' },
+          status: 401,
+        },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'auth_drop');
+    expect(res.status).toHaveBeenCalledWith(204);
+    expect(res.end).toHaveBeenCalled();
+  });
+
+  it('records passport errors separately from ordinary telemetry auth drops', () => {
+    mockPassportError = new Error('passport unavailable');
+    const req = mockReq(undefined, { path: '/v1/logs' });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('logs', 'auth_error');
+    expect(res.status).toHaveBeenCalledWith(204);
+    expect(res.end).toHaveBeenCalled();
+  });
+});
diff --git a/api/server/middleware/__tests__/validateMessageReq.spec.js b/api/server/middleware/__tests__/validateMessageReq.spec.js
new file mode 100644
index 00000000000..1889e62fbdb
--- /dev/null
+++ b/api/server/middleware/__tests__/validateMessageReq.spec.js
@@ -0,0 +1,237 @@
+jest.mock('~/models', () => ({
+  getConvo: jest.fn(),
+}));
+
+jest.mock('@librechat/api', () => ({
+  GenerationJobManager: {
+    getJob: jest.fn(),
+  },
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    warn: jest.fn(),
+  },
+}));
+
+const validateMessageReq = require('../validateMessageReq');
+const { getConvo } = require('~/models');
+const { GenerationJobManager } = require('@librechat/api');
+const { logger } = require('@librechat/data-schemas');
+
+function createResponse() {
+  const res = {
+    json: jest.fn(),
+    send: jest.fn(),
+    status: jest.fn(),
+  };
+  res.status.mockReturnValue(res);
+  return res;
+}
+
+describe('validateMessageReq', () => {
+  const userId = 'user-123';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should reject requests when URL and body conversationId values differ', async () => {
+    const req = {
+      params: { conversationId: 'convo-owned' },
+      body: { conversationId: 'convo-victim' },
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+
+    await validateMessageReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation ID mismatch' });
+    expect(getConvo).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should reject requests when URL and nested message conversationId values differ', async () => {
+    const req = {
+      params: { conversationId: 'convo-owned' },
+      body: { message: { conversationId: 'convo-victim' } },
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+
+    await validateMessageReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation ID mismatch' });
+    expect(getConvo).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should validate ownership against the URL conversationId when values match', async () => {
+    const req = {
+      params: { conversationId: 'convo-owned' },
+      body: { conversationId: 'convo-owned' },
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue({ conversationId: 'convo-owned', user: userId });
+
+    await validateMessageReq(req, res, next);
+
+    expect(getConvo).toHaveBeenCalledWith(userId, 'convo-owned');
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('should allow message reads for an owned active generation job before the conversation is saved', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId, tenantId: 'tenant-a' },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+    GenerationJobManager.getJob.mockResolvedValue({
+      status: 'running',
+      metadata: { userId, tenantId: 'tenant-a' },
+    });
+
+    await validateMessageReq(req, res, next);
+
+    expect(GenerationJobManager.getJob).toHaveBeenCalledWith('active-convo');
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.status).not.toHaveBeenCalled();
+  });
+
+  it('should allow message reads for an owned active generation job without tenant metadata', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+    GenerationJobManager.getJob.mockResolvedValue({
+      status: 'running',
+      metadata: { userId },
+    });
+
+    await validateMessageReq(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.status).not.toHaveBeenCalled();
+  });
+
+  it('should reject active job message reads owned by another user', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+    GenerationJobManager.getJob.mockResolvedValue({
+      status: 'running',
+      metadata: { userId: 'another-user' },
+    });
+
+    await validateMessageReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation not found' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should reject active job message reads from another tenant', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId, tenantId: 'tenant-a' },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+    GenerationJobManager.getJob.mockResolvedValue({
+      status: 'running',
+      metadata: { userId, tenantId: 'tenant-b' },
+    });
+
+    await validateMessageReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation not found' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should reject message-by-id reads before the conversation is saved', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo', messageId: 'message-id' },
+      body: {},
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+
+    await validateMessageReq(req, res, next);
+
+    expect(GenerationJobManager.getJob).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation not found' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should return not found when active job lookup fails', async () => {
+    const req = {
+      method: 'GET',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    const error = new Error('job store unavailable');
+    getConvo.mockResolvedValue(null);
+    GenerationJobManager.getJob.mockRejectedValue(error);
+
+    await validateMessageReq(req, res, next);
+
+    expect(GenerationJobManager.getJob).toHaveBeenCalledWith('active-convo');
+    expect(logger.warn).toHaveBeenCalledWith(
+      '[validateMessageReq] Active job lookup failed for active-convo:',
+      error,
+    );
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(res.json).toHaveBeenCalledWith({ error: 'Conversation not found' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should not allow unsaved conversation writes through active job ownership', async () => {
+    const req = {
+      method: 'POST',
+      params: { conversationId: 'active-convo' },
+      body: {},
+      user: { id: userId },
+    };
+    const res = createResponse();
+    const next = jest.fn();
+    getConvo.mockResolvedValue(null);
+
+    await validateMessageReq(req, res, next);
+
+    expect(GenerationJobManager.getJob).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(404);
+    expect(next).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/middleware/abortMiddleware.js b/api/server/middleware/abortMiddleware.js
index e0c5ae0ff09..feed002b0e3 100644
--- a/api/server/middleware/abortMiddleware.js
+++ b/api/server/middleware/abortMiddleware.js
@@ -7,6 +7,7 @@ const {
   GenerationJobManager,
   recordCollectedUsage,
   sanitizeMessageForTransmit,
+  buildAbortedResponseMetadata,
 } = require('@librechat/api');
 const { truncateText, smartTruncateText } = require('~/app/clients/prompts');
 const clearPendingReq = require('~/cache/clearPendingReq');
@@ -14,6 +15,36 @@ const { sendError } = require('~/server/middleware/error');
 const { abortRun } = require('./abortRun');
 const db = require('~/models');
 
+/**
+ * @param {Error | unknown} error
+ * @returns {boolean}
+ */
+const isAbortError = (error) => {
+  const visited = new Set();
+  let current = error;
+
+  while (current && typeof current === 'object' && !visited.has(current)) {
+    visited.add(current);
+
+    const errorName = current.name;
+    const errorCode = current.code;
+    const errorMessage = typeof current.message === 'string' ? current.message : '';
+
+    if (
+      errorName === 'AbortError' ||
+      errorCode === 'ABORT_ERR' ||
+      errorMessage.includes('AbortError') ||
+      /(?:operation|request|stream) was aborted/i.test(errorMessage)
+    ) {
+      return true;
+    }
+
+    current = current.cause;
+  }
+
+  return false;
+};
+
 /**
  * Spend tokens for all models from collected usage.
  * This handles both sequential and parallel agent execution.
@@ -110,6 +141,14 @@ async function abortMessage(req, res) {
     tokenCount: completionTokens,
   };
 
+  /** Persist the usage/cost rollup + context breakdown for the stopped response
+   *  so its branch/total cost and granular rows survive a reload, matching the
+   *  normal completion path. */
+  const abortMetadata = buildAbortedResponseMetadata(jobData);
+  if (abortMetadata) {
+    responseMessage.metadata = abortMetadata;
+  }
+
   // Spend tokens for ALL models from collectedUsage (handles parallel agents/addedConvo)
   if (collectedUsage && collectedUsage.length > 0) {
     await spendCollectedUsage({
@@ -150,6 +189,7 @@ async function abortMessage(req, res) {
           parentMessageId: jobData.userMessage.parentMessageId,
           conversationId: jobData.userMessage.conversationId,
           text: jobData.userMessage.text,
+          quotes: jobData.userMessage.quotes,
           isCreatedByUser: true,
         })
       : null,
@@ -190,18 +230,26 @@ const handleAbort = function () {
  * @returns {Promise<void>}
  */
 const handleAbortError = async (res, req, error, data) => {
+  const { sender, conversationId, messageId, parentMessageId, userMessageId, partialText } = data;
+
   if (error?.message?.includes('base64')) {
     logger.error('[handleAbortError] Error in base64 encoding', {
       ...error,
       stack: smartTruncateText(error?.stack, 1000),
       message: truncateText(error.message, 350),
     });
+  } else if (isAbortError(error)) {
+    logger.debug('[handleAbortError] AI response aborted by user', {
+      conversationId,
+      code: error?.code,
+      name: error?.name,
+      message: truncateText(error?.message ?? 'AbortError', 350),
+    });
   } else {
     logger.error('[handleAbortError] AI response error; aborting request:', error);
   }
-  const { sender, conversationId, messageId, parentMessageId, userMessageId, partialText } = data;
 
-  if (error.stack && error.stack.includes('google')) {
+  if (error?.stack && error.stack.includes('google')) {
     logger.warn(
       `AI Response error for conversation ${conversationId} likely caused by Google censor/filter`,
     );
diff --git a/api/server/middleware/abortMiddleware.spec.js b/api/server/middleware/abortMiddleware.spec.js
index a4ce85674bc..06e434065ab 100644
--- a/api/server/middleware/abortMiddleware.spec.js
+++ b/api/server/middleware/abortMiddleware.spec.js
@@ -73,7 +73,18 @@ jest.mock('./abortRun', () => ({
   abortRun: jest.fn(),
 }));
 
-const { spendCollectedUsage } = require('./abortMiddleware');
+const { logger } = require('@librechat/data-schemas');
+const { sendError } = require('~/server/middleware/error');
+const { handleAbortError, spendCollectedUsage } = require('./abortMiddleware');
+
+const buildAbortRequest = () => ({
+  body: {
+    model: 'gpt-4',
+  },
+  user: {
+    id: 'user-123',
+  },
+});
 
 describe('abortMiddleware - spendCollectedUsage', () => {
   beforeEach(() => {
@@ -237,3 +248,65 @@ describe('abortMiddleware - spendCollectedUsage', () => {
     });
   });
 });
+
+describe('abortMiddleware - handleAbortError', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it.each([
+    [
+      'native DOMException AbortError',
+      new DOMException('The operation was aborted', 'AbortError'),
+      'AbortError',
+    ],
+    [
+      'wrapped AbortError message',
+      new Error('SSE stream disconnected: AbortError: The operation was aborted'),
+      'Error',
+    ],
+    [
+      'cause-nested AbortError',
+      new Error('Request failed', {
+        cause: new DOMException('The operation was aborted', 'AbortError'),
+      }),
+      'Error',
+    ],
+  ])('logs a %s as a debug event instead of an error', async (_label, error, name) => {
+    await handleAbortError({}, buildAbortRequest(), error, {
+      sender: 'AI',
+      conversationId: 'convo-123',
+      messageId: 'message-123',
+      parentMessageId: 'parent-123',
+      userMessageId: 'user-message-123',
+    });
+
+    expect(logger.error).not.toHaveBeenCalled();
+    expect(logger.debug).toHaveBeenCalledWith('[handleAbortError] AI response aborted by user', {
+      conversationId: 'convo-123',
+      code: error.code,
+      name,
+      message: error.message,
+    });
+    expect(sendError).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps unexpected generation errors classified as errors', async () => {
+    const error = new Error('Provider failed');
+
+    await handleAbortError({}, buildAbortRequest(), error, {
+      sender: 'AI',
+      conversationId: 'convo-123',
+      messageId: 'message-123',
+      parentMessageId: 'parent-123',
+      userMessageId: 'user-message-123',
+    });
+
+    expect(logger.error).toHaveBeenCalledWith(
+      '[handleAbortError] AI response error; aborting request:',
+      error,
+    );
+    expect(logger.debug).not.toHaveBeenCalled();
+    expect(sendError).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/api/server/middleware/accessResources/canAccessSkillResource.js b/api/server/middleware/accessResources/canAccessSkillResource.js
index 1010ca89980..d68612df277 100644
--- a/api/server/middleware/accessResources/canAccessSkillResource.js
+++ b/api/server/middleware/accessResources/canAccessSkillResource.js
@@ -1,6 +1,7 @@
-const { ResourceType } = require('librechat-data-provider');
+const { ResourceType, PermissionBits } = require('librechat-data-provider');
 const { canAccessResource } = require('./canAccessResource');
 const { getSkillById } = require('~/models');
+const { getDeploymentSkillById } = require('@librechat/api');
 
 /**
  * Skill-specific middleware factory that checks skill access permissions.
@@ -19,12 +20,35 @@ const canAccessSkillResource = (options) => {
     throw new Error('canAccessSkillResource: requiredPermission is required and must be a number');
   }
 
-  return canAccessResource({
+  const aclMiddleware = canAccessResource({
     resourceType: ResourceType.SKILL,
     requiredPermission,
     resourceIdParam,
     idResolver: getSkillById,
   });
+
+  return (req, res, next) => {
+    const rawResourceId = req.params[resourceIdParam];
+    const deploymentSkill = rawResourceId ? getDeploymentSkillById(rawResourceId) : null;
+    if (!deploymentSkill) {
+      return aclMiddleware(req, res, next);
+    }
+    if (requiredPermission !== PermissionBits.VIEW) {
+      return res.status(403).json({
+        error: 'Forbidden',
+        message: 'Deployment skills are read-only',
+      });
+    }
+    req.resourceAccess = {
+      resourceType: ResourceType.SKILL,
+      resourceId: deploymentSkill._id,
+      customResourceId: rawResourceId,
+      permission: requiredPermission,
+      userId: req.user?.id,
+      resourceInfo: deploymentSkill,
+    };
+    return next();
+  };
 };
 
 module.exports = {
diff --git a/api/server/middleware/accessResources/fileAccess.js b/api/server/middleware/accessResources/fileAccess.js
index e1c5803c640..0ce391371eb 100644
--- a/api/server/middleware/accessResources/fileAccess.js
+++ b/api/server/middleware/accessResources/fileAccess.js
@@ -108,7 +108,9 @@ const fileAccess = async (req, res, next) => {
     // Tenant-scoped files are restricted to their tenant. Legacy files without
     // tenantId remain governed by owner/agent ACLs for non-tenant migrations.
     if (fileTenantId && fileTenantId !== userTenantId) {
-      logger.warn(`[fileAccess] User ${userId} denied cross-tenant access to file ${fileId}`);
+      logger.warn(
+        `[fileAccess] User ${userId} denied cross-tenant access to file ${fileId} (route ${req.originalUrl})`,
+      );
       return denyFileAccess(res);
     }
 
@@ -129,7 +131,9 @@ const fileAccess = async (req, res, next) => {
       return next();
     }
 
-    logger.warn(`[fileAccess] User ${userId} denied access to file ${fileId}`);
+    logger.warn(
+      `[fileAccess] User ${userId} denied access to file ${fileId} (route ${req.originalUrl})`,
+    );
     return denyFileAccess(res);
   } catch (error) {
     logger.error('[fileAccess] Error checking file access:', error);
diff --git a/api/server/middleware/buildEndpointOption.js b/api/server/middleware/buildEndpointOption.js
index cf4f773160b..84fb85dba83 100644
--- a/api/server/middleware/buildEndpointOption.js
+++ b/api/server/middleware/buildEndpointOption.js
@@ -1,4 +1,10 @@
-const { handleError } = require('@librechat/api');
+const {
+  handleError,
+  applyModelSpecPreset,
+  findModelSpecByName,
+  isModelSpecEndpointMatch,
+  resolveModelSpecPromptPrefixVariables,
+} = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const {
   EndpointURLs,
@@ -21,6 +27,8 @@ const buildFunction = {
 
 async function buildEndpointOption(req, res, next) {
   const { endpoint, endpointType } = req.body;
+  const isAgents =
+    isAgentsEndpoint(endpoint) || req.baseUrl.startsWith(EndpointURLs[EModelEndpoint.agents]);
 
   let endpointsConfig;
   try {
@@ -48,50 +56,80 @@ async function buildEndpointOption(req, res, next) {
   }
 
   const appConfig = req.config;
+  let appliedModelSpecPrivateFields = new Set();
   if (appConfig.modelSpecs?.list?.length && appConfig.modelSpecs?.enforce) {
     /** @type {{ list: TModelSpec[] }}*/
     const { list } = appConfig.modelSpecs;
-    const { spec } = parsedBody;
+    const rawSpec = req.body.spec;
+    const spec = parsedBody.spec ?? (typeof rawSpec === 'string' ? rawSpec : undefined);
+    const rawChatProjectId = req.body.chatProjectId;
+    const parsedBodyForModelSpec =
+      parsedBody.chatProjectId === undefined &&
+      (typeof rawChatProjectId === 'string' || rawChatProjectId === null)
+        ? { ...parsedBody, chatProjectId: rawChatProjectId }
+        : parsedBody;
 
     if (!spec) {
       return handleError(res, { text: 'No model spec selected' });
     }
 
-    const currentModelSpec = list.find((s) => s.name === spec);
+    const currentModelSpec = findModelSpecByName({ list }, spec);
     if (!currentModelSpec) {
       return handleError(res, { text: 'Invalid model spec' });
     }
 
-    if (endpoint !== currentModelSpec.preset.endpoint) {
+    if (!isModelSpecEndpointMatch(currentModelSpec, endpoint)) {
       return handleError(res, { text: 'Model spec mismatch' });
     }
 
     try {
-      currentModelSpec.preset.spec = spec;
-      parsedBody = parseCompactConvo({
+      const result = applyModelSpecPreset({
+        modelSpec: currentModelSpec,
+        parsedBody: parsedBodyForModelSpec,
         endpoint,
         endpointType,
-        conversation: currentModelSpec.preset,
         defaultParamsEndpoint,
+        includePresetDefaults: true,
       });
-      if (currentModelSpec.iconURL != null && currentModelSpec.iconURL !== '') {
-        parsedBody.iconURL = currentModelSpec.iconURL;
-      }
+      parsedBody = result.parsedBody;
+      appliedModelSpecPrivateFields = result.appliedPrivateFields;
     } catch (error) {
       logger.error(`Error parsing model spec for endpoint ${endpoint}`, error);
       return handleError(res, { text: 'Error parsing model spec' });
     }
   } else if (parsedBody.spec && appConfig.modelSpecs?.list) {
-    // Non-enforced mode: if spec is selected, derive iconURL from model spec
-    const modelSpec = appConfig.modelSpecs.list.find((s) => s.name === parsedBody.spec);
-    if (modelSpec?.iconURL) {
-      parsedBody.iconURL = modelSpec.iconURL;
+    const modelSpec = findModelSpecByName(appConfig.modelSpecs, parsedBody.spec);
+    if (modelSpec) {
+      if (!isModelSpecEndpointMatch(modelSpec, endpoint)) {
+        return handleError(res, { text: 'Model spec mismatch' });
+      }
+
+      try {
+        const result = applyModelSpecPreset({
+          modelSpec,
+          parsedBody,
+          endpoint,
+          endpointType,
+          defaultParamsEndpoint,
+        });
+        parsedBody = result.parsedBody;
+        appliedModelSpecPrivateFields = result.appliedPrivateFields;
+      } catch (error) {
+        logger.error(`Error parsing model spec for endpoint ${endpoint}`, error);
+        return handleError(res, { text: 'Error parsing model spec' });
+      }
     }
   }
 
+  if (!isAgents && appliedModelSpecPrivateFields.has('promptPrefix')) {
+    parsedBody = resolveModelSpecPromptPrefixVariables(
+      parsedBody,
+      req.user,
+      req.body.clientTimestamp,
+    );
+  }
+
   try {
-    const isAgents =
-      isAgentsEndpoint(endpoint) || req.baseUrl.startsWith(EndpointURLs[EModelEndpoint.agents]);
     const builder = isAgents
       ? (...args) => buildFunction[EModelEndpoint.agents](req, ...args)
       : buildFunction[endpointType ?? endpoint];
@@ -101,7 +139,10 @@ async function buildEndpointOption(req, res, next) {
     req.body.endpointOption = await builder(endpoint, parsedBody, endpointType);
 
     if (req.body.files && !isAgents) {
-      req.body.endpointOption.attachments = updateFilesUsage(req.body.files);
+      req.body.endpointOption.attachments = updateFilesUsage(req.body.files, undefined, {
+        user: req.user.id,
+        tenantId: req.user.tenantId,
+      });
     }
 
     next();
diff --git a/api/server/middleware/buildEndpointOption.spec.js b/api/server/middleware/buildEndpointOption.spec.js
index 5d93acd6bbb..abf49c14566 100644
--- a/api/server/middleware/buildEndpointOption.spec.js
+++ b/api/server/middleware/buildEndpointOption.spec.js
@@ -17,6 +17,10 @@ const mockBuildOptions = jest.fn((_endpoint, parsedBody) => ({
   ...parsedBody,
   endpoint: _endpoint,
 }));
+const mockAgentBuildOptions = jest.fn((_req, endpoint, parsedBody) => ({
+  ...parsedBody,
+  endpoint,
+}));
 
 jest.mock('~/server/services/Endpoints/azureAssistants', () => ({
   buildOptions: mockBuildOptions,
@@ -25,12 +29,13 @@ jest.mock('~/server/services/Endpoints/assistants', () => ({
   buildOptions: mockBuildOptions,
 }));
 jest.mock('~/server/services/Endpoints/agents', () => ({
-  buildOptions: mockBuildOptions,
+  buildOptions: mockAgentBuildOptions,
 }));
 
 jest.mock('~/models', () => ({
   updateFilesUsage: jest.fn(),
 }));
+const { updateFilesUsage } = require('~/models');
 
 const mockGetEndpointsConfig = jest.fn();
 jest.mock('~/server/services/Config', () => ({
@@ -38,6 +43,7 @@ jest.mock('~/server/services/Config', () => ({
 }));
 
 jest.mock('@librechat/api', () => ({
+  ...jest.requireActual('@librechat/api'),
   handleError: jest.fn(),
 }));
 
@@ -183,6 +189,9 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
         endpointType: EModelEndpoint.custom,
         spec: 'claude-opus-4.5',
         model: 'anthropic/claude-opus-4.5',
+        temperature: 0.1,
+        topP: 0.2,
+        chatProjectId: 'project-1',
       },
       {
         modelSpecs: {
@@ -191,6 +200,7 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
         },
       },
     );
+    req.baseUrl = '/api/agents/chat';
 
     await buildEndpointOption(req, createRes(), jest.fn());
 
@@ -204,7 +214,227 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
     const enforcedResult = parseCompactConvo.mock.results[1].value;
     expect(enforcedResult.maxOutputTokens).toBe(8192);
     expect(enforcedResult.temperature).toBe(0.7);
+    expect(enforcedResult.topP).toBeUndefined();
     expect(enforcedResult.maxContextTokens).toBe(50000);
+    expect(enforcedResult.chatProjectId).toBe('project-1');
+    expect(req.body.endpointOption.chatProjectId).toBe('project-1');
+  });
+
+  it('should rebuild enforced custom specs from the backend preset when compact parsing drops raw fields', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const modelSpec = {
+      name: 'approved-custom',
+      preset: {
+        endpoint: 'Mock Provider A',
+        endpointType: EModelEndpoint.custom,
+        model: 'mock-model-a',
+        promptPrefix: 'Use the approved custom model spec.',
+      },
+    };
+
+    const req = createReq(
+      {
+        endpoint: 'Mock Provider A',
+        endpointType: EModelEndpoint.custom,
+        spec: 'approved-custom',
+        model: { stale: 'cached-client-value' },
+        agent_id: 'agent_from_cached_client_state',
+        chatProjectId: 'project-1',
+      },
+      {
+        modelSpecs: {
+          enforce: true,
+          list: [modelSpec],
+        },
+      },
+    );
+    req.baseUrl = '/api/agents/chat';
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(parseCompactConvo.mock.results[0].value).toEqual({});
+    expect(req.body.endpointOption.spec).toBe('approved-custom');
+    expect(req.body.endpointOption.model).toBe('mock-model-a');
+    expect(req.body.endpointOption.promptPrefix).toBe('Use the approved custom model spec.');
+    expect(req.body.endpointOption.chatProjectId).toBe('project-1');
+  });
+
+  it('should restore private model spec preset fields in non-enforced mode', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const modelSpec = {
+      name: 'guarded-openai',
+      iconURL: 'openAI',
+      preset: {
+        endpoint: EModelEndpoint.openAI,
+        model: 'gpt-4o',
+        promptPrefix: 'private prompt prefix',
+        instructions: 'private instructions',
+        additional_instructions: 'private additional instructions',
+        temperature: 0.2,
+        maxContextTokens: 10000,
+      },
+    };
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'guarded-openai',
+        model: 'gpt-4o',
+        temperature: 0.8,
+      },
+      {
+        modelSpecs: {
+          enforce: false,
+          list: [modelSpec],
+        },
+      },
+    );
+    req.baseUrl = '/api/agents/chat';
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(req.body.endpointOption.promptPrefix).toBe('private prompt prefix');
+    expect(req.body.endpointOption.instructions).toBeUndefined();
+    expect(req.body.endpointOption.additional_instructions).toBeUndefined();
+    expect(req.body.endpointOption.temperature).toBe(0.8);
+    expect(req.body.endpointOption.maxContextTokens).toBeUndefined();
+    expect(req.body.endpointOption.iconURL).toBe('openAI');
+  });
+
+  it('should reject non-enforced model specs for a different endpoint', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'guarded-google',
+        model: 'gpt-4o',
+      },
+      {
+        modelSpecs: {
+          enforce: false,
+          list: [
+            {
+              name: 'guarded-google',
+              preset: {
+                endpoint: EModelEndpoint.google,
+                model: 'gemini-pro',
+                promptPrefix: 'private google prompt',
+              },
+            },
+          ],
+        },
+      },
+    );
+    const res = createRes();
+    const next = jest.fn();
+    const { handleError } = require('@librechat/api');
+
+    await buildEndpointOption(req, res, next);
+
+    expect(handleError).toHaveBeenCalledWith(res, { text: 'Model spec mismatch' });
+    expect(mockAgentBuildOptions).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('should restore private model spec examples when the parser supplies an empty default', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const examples = [{ input: { content: 'hello' }, output: { content: 'world' } }];
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.google,
+        spec: 'guarded-google',
+        model: 'gemini-pro',
+      },
+      {
+        modelSpecs: {
+          enforce: false,
+          list: [
+            {
+              name: 'guarded-google',
+              preset: {
+                endpoint: EModelEndpoint.google,
+                model: 'gemini-pro',
+                examples,
+              },
+            },
+          ],
+        },
+      },
+    );
+    req.baseUrl = '/api/agents/chat';
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(req.body.endpointOption.examples).toEqual(examples);
+  });
+
+  it('should resolve special variables for restored non-agent promptPrefix', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.assistants,
+        spec: 'guarded-assistant',
+        assistant_id: 'asst_123',
+      },
+      {
+        modelSpecs: {
+          enforce: false,
+          list: [
+            {
+              name: 'guarded-assistant',
+              preset: {
+                endpoint: EModelEndpoint.assistants,
+                assistant_id: 'asst_123',
+                promptPrefix: 'Help {{current_user}}.',
+              },
+            },
+          ],
+        },
+      },
+    );
+    req.user = { name: 'Ada' };
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(req.body.endpointOption.promptPrefix).toBe('Help Ada.');
+  });
+
+  it('should leave restored agent promptPrefix variables for agent initialization', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'guarded-openai',
+        model: 'gpt-4o',
+      },
+      {
+        modelSpecs: {
+          enforce: false,
+          list: [
+            {
+              name: 'guarded-openai',
+              preset: {
+                endpoint: EModelEndpoint.openAI,
+                model: 'gpt-4o',
+                promptPrefix: 'Help {{current_user}}.',
+              },
+            },
+          ],
+        },
+      },
+    );
+    req.baseUrl = '/api/agents/chat';
+    req.user = { name: 'Ada' };
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(req.body.endpointOption.promptPrefix).toBe('Help {{current_user}}.');
   });
 
   it('should fall back to OpenAI schema when getEndpointsConfig fails', async () => {
@@ -235,6 +465,30 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
     expect(parsedResult.max_tokens).toBe(4096);
   });
 
+  it('should scope non-agent chat attachment usage updates to the authenticated user', async () => {
+    const attachments = Promise.resolve([]);
+    updateFilesUsage.mockReturnValueOnce(attachments);
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.assistants,
+        assistant_id: 'asst_123',
+        files: [{ file_id: 'forged-file-id' }],
+      },
+      { modelSpecs: null },
+    );
+    req.user = { id: 'user-1' };
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(updateFilesUsage).toHaveBeenCalledWith(req.body.files, undefined, {
+      user: 'user-1',
+      tenantId: undefined,
+    });
+    expect(req.body.endpointOption.attachments).toBe(attachments);
+  });
+
   it('should not enter the enforce branch when modelSpecs.list is empty', async () => {
     mockGetEndpointsConfig.mockResolvedValue({});
 
diff --git a/api/server/middleware/canAccessSharedLink.js b/api/server/middleware/canAccessSharedLink.js
new file mode 100644
index 00000000000..79fd93e486c
--- /dev/null
+++ b/api/server/middleware/canAccessSharedLink.js
@@ -0,0 +1,6 @@
+const mongoose = require('mongoose');
+const { createSharedLinkAccessMiddleware } = require('@librechat/api');
+
+const canAccessSharedLink = createSharedLinkAccessMiddleware({ mongoose });
+
+module.exports = canAccessSharedLink;
diff --git a/api/server/middleware/checkDomainAllowed.js b/api/server/middleware/checkDomainAllowed.js
index f7a3f00e68e..104e6af7921 100644
--- a/api/server/middleware/checkDomainAllowed.js
+++ b/api/server/middleware/checkDomainAllowed.js
@@ -18,6 +18,7 @@ const checkDomainAllowed = async (req, res, next) => {
     const email = req?.user?.email;
     const appConfig = await getAppConfig({
       role: req?.user?.role,
+      userId: req?.user?.id,
       tenantId: req?.user?.tenantId,
     });
 
diff --git a/api/server/middleware/index.js b/api/server/middleware/index.js
index 64b9fb16185..bc523ff166c 100644
--- a/api/server/middleware/index.js
+++ b/api/server/middleware/index.js
@@ -1,4 +1,5 @@
 const validatePasswordReset = require('./validatePasswordReset');
+const setTwoFactorTempUser = require('./setTwoFactorTempUser');
 const validateRegistration = require('./validateRegistration');
 const buildEndpointOption = require('./buildEndpointOption');
 const validateMessageReq = require('./validateMessageReq');
@@ -10,6 +11,7 @@ const requireLdapAuth = require('./requireLdapAuth');
 const abortMiddleware = require('./abortMiddleware');
 const checkInviteUser = require('./checkInviteUser');
 const requireJwtAuth = require('./requireJwtAuth');
+const { requireRumProxyAuth } = require('./requireJwtAuth');
 const configMiddleware = require('./config/app');
 const validateModel = require('./validateModel');
 const moderateText = require('./moderateText');
@@ -36,6 +38,8 @@ module.exports = {
   moderateText,
   validateModel,
   requireJwtAuth,
+  requireRumProxyAuth,
+  setTwoFactorTempUser,
   checkInviteUser,
   requireLdapAuth,
   requireLocalAuth,
diff --git a/api/server/middleware/limiters/contextProjectionLimiter.js b/api/server/middleware/limiters/contextProjectionLimiter.js
new file mode 100644
index 00000000000..1f70c7ea8e3
--- /dev/null
+++ b/api/server/middleware/limiters/contextProjectionLimiter.js
@@ -0,0 +1,19 @@
+const rateLimit = require('express-rate-limit');
+const { limiterCache } = require('@librechat/api');
+
+const { CONTEXT_PROJECTION_WINDOW = 1, CONTEXT_PROJECTION_MAX = 20 } = process.env;
+
+const windowMs = (parseInt(CONTEXT_PROJECTION_WINDOW, 10) || 1) * 60 * 1000;
+const max = parseInt(CONTEXT_PROJECTION_MAX, 10) || 20;
+
+const contextProjectionLimiter = rateLimit({
+  windowMs,
+  max,
+  handler: (_req, res) => {
+    res.status(429).json({ message: 'Too many context projection requests. Try again later' });
+  },
+  keyGenerator: (req) => req.user?.id,
+  store: limiterCache('context_projection_limiter'),
+});
+
+module.exports = contextProjectionLimiter;
diff --git a/api/server/middleware/limiters/index.js b/api/server/middleware/limiters/index.js
index a38188d2a6b..19f246d0396 100644
--- a/api/server/middleware/limiters/index.js
+++ b/api/server/middleware/limiters/index.js
@@ -9,8 +9,10 @@ const registerLimiter = require('./registerLimiter');
 const toolCallLimiter = require('./toolCallLimiter');
 const messageLimiters = require('./messageLimiters');
 const promptUsageLimiter = require('./promptUsageLimiter');
+const contextProjectionLimiter = require('./contextProjectionLimiter');
 const verifyEmailLimiter = require('./verifyEmailLimiter');
 const resetPasswordLimiter = require('./resetPasswordLimiter');
+const twoFactorTempLimiter = require('./twoFactorTempLimiter');
 
 module.exports = {
   ...uploadLimiters,
@@ -21,8 +23,10 @@ module.exports = {
   loginLimiter,
   registerLimiter,
   toolCallLimiter,
+  contextProjectionLimiter,
   createTTSLimiters,
   createSTTLimiters,
   verifyEmailLimiter,
   resetPasswordLimiter,
+  twoFactorTempLimiter,
 };
diff --git a/api/server/middleware/limiters/twoFactorTempLimiter.js b/api/server/middleware/limiters/twoFactorTempLimiter.js
new file mode 100644
index 00000000000..97d0861af62
--- /dev/null
+++ b/api/server/middleware/limiters/twoFactorTempLimiter.js
@@ -0,0 +1,101 @@
+const jwt = require('jsonwebtoken');
+const { createHash } = require('crypto');
+const rateLimit = require('express-rate-limit');
+const { ViolationTypes } = require('librechat-data-provider');
+const { limiterCache, removePorts } = require('@librechat/api');
+const { logViolation } = require('~/cache');
+
+const {
+  LOGIN_WINDOW = 5,
+  LOGIN_MAX = 7,
+  LOGIN_VIOLATION_SCORE,
+  TWO_FACTOR_TEMP_WINDOW = LOGIN_WINDOW,
+  TWO_FACTOR_TEMP_MAX = LOGIN_MAX,
+  TWO_FACTOR_TEMP_VIOLATION_SCORE,
+} = process.env;
+const windowMs = TWO_FACTOR_TEMP_WINDOW * 60 * 1000;
+const max = TWO_FACTOR_TEMP_MAX;
+const score = TWO_FACTOR_TEMP_VIOLATION_SCORE ?? LOGIN_VIOLATION_SCORE;
+const windowInMinutes = windowMs / 60000;
+const message = `Too many verification attempts, please try again after ${windowInMinutes} minutes.`;
+
+const hashLimiterKey = (value) => createHash('sha256').update(value).digest('hex');
+
+const getUserLimiterKey = (req) => {
+  const userId = req.user?.id ?? req.user?._id;
+  if (userId) {
+    return `user:${userId.toString()}`;
+  }
+
+  const tempToken = req.body?.tempToken;
+  if (typeof tempToken === 'string' && tempToken) {
+    return `temp:${hashLimiterKey(tempToken)}`;
+  }
+
+  const ip = removePorts(req);
+  return ip ? `ip:${ip}` : 'ip:unknown';
+};
+
+const getTempTokenUserId = (tempToken) => {
+  if (!tempToken) {
+    return null;
+  }
+
+  try {
+    const payload = jwt.verify(tempToken, process.env.JWT_SECRET);
+    return payload?.userId ?? null;
+  } catch {
+    return null;
+  }
+};
+
+const createHandler = (limiter) => async (req, res) => {
+  const type = ViolationTypes.LOGINS;
+  const errorMessage = {
+    type,
+    max,
+    limiter,
+    windowInMinutes,
+  };
+
+  const userId = getTempTokenUserId(req.body?.tempToken);
+  if (userId && !req.user) {
+    req.user = { id: userId };
+  } else if (userId && !req.user.id && !req.user._id) {
+    req.user.id = userId;
+  }
+
+  await logViolation(req, res, type, errorMessage, score);
+  return res.status(429).json({ message });
+};
+
+const ipLimiterOptions = {
+  windowMs,
+  max,
+  handler: createHandler('ip'),
+  keyGenerator: removePorts,
+  store: limiterCache('two_factor_temp_limiter'),
+};
+
+const userLimiterOptions = {
+  windowMs,
+  max,
+  handler: createHandler('user'),
+  keyGenerator: getUserLimiterKey,
+  store: limiterCache('two_factor_temp_user_limiter'),
+};
+
+const twoFactorTempIpLimiter = rateLimit(ipLimiterOptions);
+const twoFactorTempUserLimiter = rateLimit(userLimiterOptions);
+
+const twoFactorTempLimiter = (req, res, next) => {
+  twoFactorTempIpLimiter(req, res, (err) => {
+    if (err) {
+      return next(err);
+    }
+
+    return twoFactorTempUserLimiter(req, res, next);
+  });
+};
+
+module.exports = twoFactorTempLimiter;
diff --git a/api/server/middleware/limiters/twoFactorTempLimiter.test.js b/api/server/middleware/limiters/twoFactorTempLimiter.test.js
new file mode 100644
index 00000000000..37b06c7fdb6
--- /dev/null
+++ b/api/server/middleware/limiters/twoFactorTempLimiter.test.js
@@ -0,0 +1,111 @@
+const jwt = require('jsonwebtoken');
+const express = require('express');
+const request = require('supertest');
+
+const originalEnv = process.env;
+const jwtSecret = 'test-two-factor-secret';
+
+const createToken = (userId) =>
+  jwt.sign({ userId, twoFAPending: true }, jwtSecret, { expiresIn: '5m' });
+
+const createApp = () => {
+  jest.resetModules();
+  process.env = {
+    ...originalEnv,
+    JWT_SECRET: jwtSecret,
+    LOGIN_MAX: '2',
+    LOGIN_WINDOW: '5',
+    TWO_FACTOR_TEMP_MAX: '2',
+    TWO_FACTOR_TEMP_WINDOW: '5',
+  };
+
+  jest.doMock('@librechat/api', () => ({
+    limiterCache: jest.fn(() => undefined),
+    removePorts: (req) => req?.['ip'],
+  }));
+  jest.doMock('~/cache', () => ({
+    logViolation: jest.fn().mockResolvedValue(undefined),
+  }));
+
+  const setTwoFactorTempUser = require('../setTwoFactorTempUser');
+  const twoFactorTempLimiter = require('./twoFactorTempLimiter');
+  const { logViolation } = require('~/cache');
+
+  const app = express();
+  app.set('trust proxy', 1);
+  app.use(express.json());
+  app.post('/verify', setTwoFactorTempUser, twoFactorTempLimiter, (req, res) =>
+    res.status(204).end(),
+  );
+
+  return { app, logViolation };
+};
+
+describe('twoFactorTempLimiter', () => {
+  afterEach(() => {
+    jest.dontMock('@librechat/api');
+    jest.dontMock('~/cache');
+    process.env = originalEnv;
+  });
+
+  it('limits a valid temp-token user across rotating source IPs', async () => {
+    const { app, logViolation } = createApp();
+    const tempToken = createToken('user-1');
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.1')
+      .send({ tempToken, token: '000000' })
+      .expect(204);
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.2')
+      .send({ tempToken, token: '000001' })
+      .expect(204);
+
+    const response = await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.3')
+      .send({ tempToken, token: '000002' })
+      .expect(429);
+
+    expect(response.body).toEqual({
+      message: 'Too many verification attempts, please try again after 5 minutes.',
+    });
+    expect(logViolation).toHaveBeenCalledTimes(1);
+    expect(logViolation.mock.calls[0][0].user).toEqual({ id: 'user-1' });
+    expect(logViolation.mock.calls[0][3]).toMatchObject({
+      limiter: 'user',
+      max: '2',
+      windowInMinutes: 5,
+    });
+  });
+
+  it('keeps the existing source IP limit before the user limit', async () => {
+    const { app, logViolation } = createApp();
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-a'), token: '000000' })
+      .expect(204);
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-b'), token: '000001' })
+      .expect(204);
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-c'), token: '000002' })
+      .expect(429);
+
+    expect(logViolation).toHaveBeenCalledTimes(1);
+    expect(logViolation.mock.calls[0][3]).toMatchObject({
+      limiter: 'ip',
+      max: '2',
+      windowInMinutes: 5,
+    });
+  });
+});
diff --git a/api/server/middleware/moderateText.js b/api/server/middleware/moderateText.js
index 775afbafbf2..1aed0991ad7 100644
--- a/api/server/middleware/moderateText.js
+++ b/api/server/middleware/moderateText.js
@@ -1,5 +1,5 @@
 const axios = require('axios');
-const { isEnabled } = require('@librechat/api');
+const { isEnabled, getReferencedQuotes, mergeQuotedText } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const { ErrorTypes } = require('librechat-data-provider');
 const denyRequest = require('./denyRequest');
@@ -11,10 +11,29 @@ async function moderateText(req, res, next) {
   try {
     const { text } = req.body;
 
+    /**
+     * Moderate the typed text, each quoted excerpt, and the merged blockquote+text
+     * exactly as the model receives it. Quotes are normalized via
+     * `getReferencedQuotes` first (matching `BaseClient`); moderating the merged
+     * string also covers content split across a quote and the typed body. The
+     * moderation API accepts an array of inputs.
+     */
+    const safeText = typeof text === 'string' ? text : '';
+    const inputs = [];
+    if (safeText.length > 0) {
+      inputs.push(safeText);
+    }
+    const quotes = getReferencedQuotes(req.body.quotes);
+    if (quotes != null) {
+      inputs.push(...quotes);
+      inputs.push(mergeQuotedText(safeText, quotes));
+    }
+    const input = inputs.length > 1 ? inputs : (inputs[0] ?? text);
+
     const response = await axios.post(
       process.env.OPENAI_MODERATION_REVERSE_PROXY || 'https://api.openai.com/v1/moderations',
       {
-        input: text,
+        input,
       },
       {
         headers: {
diff --git a/api/server/middleware/optionalShareFileAuth.js b/api/server/middleware/optionalShareFileAuth.js
new file mode 100644
index 00000000000..bebf087d201
--- /dev/null
+++ b/api/server/middleware/optionalShareFileAuth.js
@@ -0,0 +1,88 @@
+const cookie = require('cookie');
+const jwt = require('jsonwebtoken');
+const { isEnabled } = require('@librechat/api');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
+const { SystemRoles } = require('librechat-data-provider');
+const { getUserById, findSession } = require('~/models');
+
+const verifySignedUserId = (token) => {
+  try {
+    const payload = jwt.verify(token, process.env.JWT_REFRESH_SECRET);
+    return typeof payload?.id === 'string' ? payload.id : null;
+  } catch {
+    return null;
+  }
+};
+
+const getRefreshTokenUserId = async (token) => {
+  const userId = verifySignedUserId(token);
+  if (!userId) {
+    return null;
+  }
+
+  const session = await runAsSystem(() => findSession({ userId, refreshToken: token }));
+  return session ? userId : null;
+};
+
+const getOpenIdUserId = (parsed, req) => {
+  if (parsed.token_provider !== 'openid' || !isEnabled(process.env.OPENID_REUSE_TOKENS)) {
+    return null;
+  }
+
+  const sessionRefreshToken = req.session?.openidTokens?.refreshToken;
+  if (!parsed.refreshToken || parsed.refreshToken !== sessionRefreshToken) {
+    return null;
+  }
+
+  return verifySignedUserId(parsed.openid_user_id);
+};
+
+/**
+ * Fallback auth for share file routes that are hit by `<img>`/anchor requests,
+ * which can't carry the bearer access token. Resolves the viewer from the
+ * `refreshToken` cookie (or an active OpenID session plus signed `openid_user_id`
+ * cookie) so non-public shared links can authorize the viewer's ACL. Never
+ * blocks: on any failure it leaves `req.user` unset and lets
+ * `canAccessSharedLink` decide (public access, 401, or 403).
+ */
+const optionalShareFileAuth = async (req, res, next) => {
+  if (req.user) {
+    return next();
+  }
+
+  try {
+    const cookieHeader = req.headers.cookie;
+    if (!cookieHeader) {
+      return next();
+    }
+
+    const parsed = cookie.parse(cookieHeader);
+    const userId =
+      getOpenIdUserId(parsed, req) ||
+      (parsed.refreshToken ? await getRefreshTokenUserId(parsed.refreshToken) : null);
+    if (!userId) {
+      return next();
+    }
+
+    // Resolve in system context: this runs before canAccessSharedLink establishes
+    // the share tenant, so under strict tenant isolation a tenant-scoped User
+    // query would otherwise throw. The viewer's id comes from verified, active
+    // cookie auth; the share's tenant-scoped ACL check still gates access.
+    const user = await runAsSystem(() =>
+      getUserById(userId, '-password -__v -totpSecret -backupCodes'),
+    );
+    if (user) {
+      user.id = user._id.toString();
+      if (!user.role) {
+        user.role = SystemRoles.USER;
+      }
+      req.user = user;
+    }
+  } catch (error) {
+    logger.warn('[optionalShareFileAuth] cookie auth failed:', error?.message);
+  }
+
+  return next();
+};
+
+module.exports = optionalShareFileAuth;
diff --git a/api/server/middleware/optionalShareFileAuth.spec.js b/api/server/middleware/optionalShareFileAuth.spec.js
new file mode 100644
index 00000000000..ffc0cf5cfc9
--- /dev/null
+++ b/api/server/middleware/optionalShareFileAuth.spec.js
@@ -0,0 +1,136 @@
+const mockVerify = jest.fn();
+const mockGetUserById = jest.fn();
+const mockFindSession = jest.fn();
+const mockRunAsSystem = jest.fn((fn) => fn());
+
+jest.mock('jsonwebtoken', () => ({ verify: (...args) => mockVerify(...args) }));
+jest.mock('@librechat/api', () => ({ isEnabled: (v) => v === 'true' || v === true }), {
+  virtual: true,
+});
+jest.mock(
+  '@librechat/data-schemas',
+  () => ({
+    logger: { warn: jest.fn(), error: jest.fn() },
+    runAsSystem: (...args) => mockRunAsSystem(...args),
+  }),
+  { virtual: true },
+);
+jest.mock('librechat-data-provider', () => ({ SystemRoles: { USER: 'USER' } }), {
+  virtual: true,
+});
+jest.mock('~/models', () => ({
+  getUserById: (...args) => mockGetUserById(...args),
+  findSession: (...args) => mockFindSession(...args),
+}));
+
+const optionalShareFileAuth = require('./optionalShareFileAuth');
+
+const run = async (req) => {
+  const next = jest.fn();
+  await optionalShareFileAuth(req, {}, next);
+  return next;
+};
+
+describe('optionalShareFileAuth', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.JWT_REFRESH_SECRET = 'test-secret';
+  });
+
+  it('short-circuits when a bearer user is already set (no cookie work)', async () => {
+    const req = { user: { id: 'u1' }, headers: { cookie: 'refreshToken=x' } };
+    const next = await run(req);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(mockVerify).not.toHaveBeenCalled();
+    expect(mockGetUserById).not.toHaveBeenCalled();
+    expect(mockFindSession).not.toHaveBeenCalled();
+  });
+
+  it('resolves the viewer from a valid refreshToken cookie with a live session', async () => {
+    mockVerify.mockReturnValue({ id: 'viewer-1' });
+    mockFindSession.mockResolvedValue({ _id: 'session-1' });
+    mockGetUserById.mockResolvedValue({ _id: 'viewer-1', role: 'USER' });
+    const req = { headers: { cookie: 'refreshToken=good.jwt' } };
+    const next = await run(req);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(mockVerify).toHaveBeenCalledWith('good.jwt', 'test-secret');
+    expect(mockFindSession).toHaveBeenCalledWith({ userId: 'viewer-1', refreshToken: 'good.jwt' });
+    expect(mockRunAsSystem).toHaveBeenCalledTimes(2);
+    expect(req.user).toMatchObject({ id: 'viewer-1', role: 'USER' });
+  });
+
+  it('defaults the role to USER when the record has none', async () => {
+    mockVerify.mockReturnValue({ id: 'viewer-2' });
+    mockFindSession.mockResolvedValue({ _id: 'session-2' });
+    mockGetUserById.mockResolvedValue({ _id: 'viewer-2' });
+    const req = { headers: { cookie: 'refreshToken=good.jwt' } };
+    await run(req);
+    expect(req.user.role).toBe('USER');
+  });
+
+  it('leaves req.user unset when there is no cookie', async () => {
+    const req = { headers: {} };
+    const next = await run(req);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(req.user).toBeUndefined();
+    expect(mockGetUserById).not.toHaveBeenCalled();
+  });
+
+  it('leaves req.user unset when the refresh token has no live session', async () => {
+    mockVerify.mockReturnValue({ id: 'viewer-3' });
+    mockFindSession.mockResolvedValue(null);
+    const req = { headers: { cookie: 'refreshToken=revoked.jwt' } };
+    const next = await run(req);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(req.user).toBeUndefined();
+    expect(mockFindSession).toHaveBeenCalledWith({
+      userId: 'viewer-3',
+      refreshToken: 'revoked.jwt',
+    });
+    expect(mockRunAsSystem).toHaveBeenCalledTimes(1);
+    expect(mockGetUserById).not.toHaveBeenCalled();
+  });
+
+  it('leaves req.user unset when the token is invalid', async () => {
+    mockVerify.mockImplementation(() => {
+      throw new Error('bad token');
+    });
+    const req = { headers: { cookie: 'refreshToken=bad' } };
+    const next = await run(req);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(req.user).toBeUndefined();
+    expect(mockGetUserById).not.toHaveBeenCalled();
+  });
+
+  it('uses the signed openid_user_id cookie only for active OpenID-reuse sessions', async () => {
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    mockVerify.mockReturnValue({ id: 'oidc-1' });
+    mockGetUserById.mockResolvedValue({ _id: 'oidc-1', role: 'USER' });
+    const req = {
+      headers: {
+        cookie: 'token_provider=openid; refreshToken=stored-refresh; openid_user_id=signed.jwt',
+      },
+      session: { openidTokens: { refreshToken: 'stored-refresh' } },
+    };
+    await run(req);
+    expect(mockVerify).toHaveBeenCalledWith('signed.jwt', 'test-secret');
+    expect(mockFindSession).not.toHaveBeenCalled();
+    expect(req.user).toMatchObject({ id: 'oidc-1' });
+    delete process.env.OPENID_REUSE_TOKENS;
+  });
+
+  it('leaves req.user unset for OpenID-reuse cookies without an active matching session', async () => {
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    mockVerify.mockReturnValue({ id: 'oidc-2' });
+    const req = {
+      headers: {
+        cookie: 'token_provider=openid; refreshToken=stale-refresh; openid_user_id=signed.jwt',
+      },
+      session: { openidTokens: { refreshToken: 'current-refresh' } },
+    };
+    await run(req);
+    expect(req.user).toBeUndefined();
+    expect(mockGetUserById).not.toHaveBeenCalled();
+    delete process.env.OPENID_REUSE_TOKENS;
+  });
+});
diff --git a/api/server/middleware/requireJwtAuth.js b/api/server/middleware/requireJwtAuth.js
index e9abbc7fa89..9c4d1ca47c9 100644
--- a/api/server/middleware/requireJwtAuth.js
+++ b/api/server/middleware/requireJwtAuth.js
@@ -1,10 +1,16 @@
 const cookies = require('cookie');
 const jwt = require('jsonwebtoken');
 const passport = require('passport');
+const { logger } = require('@librechat/data-schemas');
 const {
   isEnabled,
   tenantContextMiddleware,
+  getAuthFailureReason,
+  getAuthFailureErrorName,
+  buildSafeAuthLogContext,
+  formatAuthLogMessage,
   maybeRefreshCloudFrontAuthCookiesMiddleware,
+  recordRumProxyRequest,
 } = require('@librechat/api');
 
 const hasPassportStrategy = (strategy) =>
@@ -30,15 +36,7 @@ const getAuthenticatedUserId = (user) => user?.id?.toString?.() ?? user?._id?.to
 const refreshCloudFrontCookies =
   maybeRefreshCloudFrontAuthCookiesMiddleware ?? ((_req, _res, next) => next());
 
-/**
- * Custom Middleware to handle JWT authentication, with support for OpenID token reuse.
- * Switches between JWT and OpenID authentication based on cookies and environment settings.
- *
- * After successful authentication (req.user populated), automatically chains into
- * `tenantContextMiddleware` to propagate `req.user.tenantId` into AsyncLocalStorage
- * for downstream Mongoose tenant isolation.
- */
-const requireJwtAuth = (req, res, next) => {
+const getAuthStrategies = (req) => {
   const cookieHeader = req.headers.cookie;
   const parsedCookies = cookieHeader ? cookies.parse(cookieHeader) : {};
   const tokenProvider = parsedCookies.token_provider;
@@ -47,7 +45,107 @@ const requireJwtAuth = (req, res, next) => {
   const openIdReuseUserId = getValidOpenIdReuseUserId(parsedCookies);
   const useOpenIdJwt =
     tokenProvider === 'openid' && openidJwtAvailable && openIdReuseUserId != null;
-  const strategies = useOpenIdJwt ? ['openidJwt', 'jwt'] : ['jwt'];
+
+  return {
+    tokenProvider,
+    openidReuseEnabled,
+    openidJwtAvailable,
+    openIdReuseUserId,
+    strategies: useOpenIdJwt ? ['openidJwt', 'jwt'] : ['jwt'],
+  };
+};
+
+const dropRumTelemetry = (res) => {
+  if (!res.headersSent) {
+    res.status(204).end();
+  }
+};
+
+// Keep in sync with packages/api/src/rum/proxy.ts; auth drops are recorded before proxy code runs.
+const getRumProxyEndpoint = (req) => {
+  if (req.path === '/v1/traces') {
+    return 'traces';
+  }
+  if (req.path === '/v1/logs') {
+    return 'logs';
+  }
+  return 'unknown';
+};
+
+const isOpenIdReuseUser = (strategy, user, openIdReuseUserId) =>
+  strategy !== 'openidJwt' || getAuthenticatedUserId(user) === openIdReuseUserId;
+
+/**
+ * Custom Middleware to handle JWT authentication, with support for OpenID token reuse.
+ * Switches between JWT and OpenID authentication based on cookies and environment settings.
+ *
+ * After successful authentication (req.user populated), automatically chains into
+ * `tenantContextMiddleware` to propagate request context into AsyncLocalStorage
+ * for downstream Mongoose tenant isolation and structured logging.
+ */
+const requireJwtAuth = (req, res, next) => {
+  const { tokenProvider, openidReuseEnabled, openidJwtAvailable, openIdReuseUserId, strategies } =
+    getAuthStrategies(req);
+  const authLogState = {
+    tokenProvider,
+    openidReuseEnabled,
+    openidJwtAvailable,
+    hasOpenIdReuseUserId: openIdReuseUserId != null,
+  };
+  let primaryFailureReason;
+  let primaryFailureErrorName;
+  let fallbackAttempted = false;
+
+  const logOpenIdFallbackAttempt = ({ fallbackStrategy, reason, errorName, status }) => {
+    primaryFailureReason = reason;
+    primaryFailureErrorName = errorName;
+    fallbackAttempted = true;
+    const message = '[requireJwtAuth] OpenID JWT auth failed; trying fallback';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      primary_strategy: 'openidJwt',
+      fallback_strategy: fallbackStrategy,
+      fallback_attempted: true,
+      reason,
+      error_name: errorName,
+      status,
+    });
+    logger.debug(formatAuthLogMessage(message, context), context);
+  };
+
+  const logAuthenticationFailure = ({ strategy, info, status, err }) => {
+    const message = '[requireJwtAuth] Authentication failed after all strategies';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      primary_strategy: strategies[0],
+      fallback_strategy: strategies[1],
+      fallback_attempted: fallbackAttempted,
+      fallback_succeeded: false,
+      attempted_strategies: strategies,
+      final_strategy: strategy,
+      reason: getAuthFailureReason(err, info),
+      error_name: getAuthFailureErrorName(err, info),
+      status: status || 401,
+    });
+    const log = fallbackAttempted ? logger.warn : logger.debug;
+    log.call(logger, formatAuthLogMessage(message, context), context);
+  };
+
+  const logFallbackSuccess = (strategy) => {
+    if (!fallbackAttempted || strategy !== 'jwt') {
+      return;
+    }
+    const message = '[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      auth_strategy: 'jwt',
+      primary_strategy: 'openidJwt',
+      fallback_strategy: 'jwt',
+      fallback_attempted: true,
+      fallback_succeeded: true,
+      primary_failure_reason: primaryFailureReason,
+      reason: primaryFailureReason,
+      error_name: primaryFailureErrorName,
+    });
+    logger.debug(formatAuthLogMessage(message, context), context);
+  };
 
   const authenticateWithStrategy = (index) => {
     const strategy = strategies[index];
@@ -57,26 +155,39 @@ const requireJwtAuth = (req, res, next) => {
       }
       if (!user) {
         if (index + 1 < strategies.length) {
+          logOpenIdFallbackAttempt({
+            fallbackStrategy: strategies[index + 1],
+            reason: getAuthFailureReason(err, info),
+            errorName: getAuthFailureErrorName(err, info),
+            status: status || 401,
+          });
           return authenticateWithStrategy(index + 1);
         }
+        logAuthenticationFailure({ strategy, info, status, err });
         return res.status(status || 401).json({
           message: info?.message || 'Unauthorized',
         });
       }
       if (strategy === 'openidJwt' && getAuthenticatedUserId(user) !== openIdReuseUserId) {
         if (index + 1 < strategies.length) {
+          logOpenIdFallbackAttempt({
+            fallbackStrategy: strategies[index + 1],
+            reason: 'openid user-id mismatch',
+            status: 401,
+          });
           return authenticateWithStrategy(index + 1);
         }
+        logAuthenticationFailure({ strategy, info, status: 401, err });
         return res.status(401).json({ message: 'Unauthorized' });
       }
       req.user = user;
       req.authStrategy = strategy;
-      refreshCloudFrontCookies(req, res, (refreshErr) => {
-        if (refreshErr) {
-          return next(refreshErr);
+      logFallbackSuccess(strategy);
+      tenantContextMiddleware(req, res, (tenantErr) => {
+        if (tenantErr) {
+          return next(tenantErr);
         }
-        // req.user is now populated by passport — set up tenant ALS context
-        tenantContextMiddleware(req, res, next);
+        refreshCloudFrontCookies(req, res, next);
       });
     })(req, res, next);
   };
@@ -84,4 +195,45 @@ const requireJwtAuth = (req, res, next) => {
   authenticateWithStrategy(0);
 };
 
+const requireRumProxyAuth = (req, res, next) => {
+  const { openIdReuseUserId, strategies } = getAuthStrategies(req);
+  const endpoint = getRumProxyEndpoint(req);
+  let authErrorSeen = false;
+
+  const dropTelemetry = () => {
+    recordRumProxyRequest(endpoint, authErrorSeen ? 'auth_error' : 'auth_drop');
+    dropRumTelemetry(res);
+  };
+
+  const finishAuthentication = (strategy, user) => {
+    req.user = user;
+    req.authStrategy = strategy;
+    next();
+  };
+
+  let nextStrategyIndex = 0;
+  const tryNextStrategy = () => {
+    const strategy = strategies[nextStrategyIndex];
+    nextStrategyIndex += 1;
+
+    if (!strategy) {
+      dropTelemetry();
+      return;
+    }
+
+    passport.authenticate(strategy, { session: false }, (err, user) => {
+      authErrorSeen = authErrorSeen || err != null;
+      if (err || !user || !isOpenIdReuseUser(strategy, user, openIdReuseUserId)) {
+        tryNextStrategy();
+        return;
+      }
+
+      finishAuthentication(strategy, user);
+    })(req, res, next);
+  };
+
+  tryNextStrategy();
+};
+
 module.exports = requireJwtAuth;
+module.exports.requireRumProxyAuth = requireRumProxyAuth;
diff --git a/api/server/middleware/setTwoFactorTempUser.js b/api/server/middleware/setTwoFactorTempUser.js
new file mode 100644
index 00000000000..facbbcba9a2
--- /dev/null
+++ b/api/server/middleware/setTwoFactorTempUser.js
@@ -0,0 +1,25 @@
+const jwt = require('jsonwebtoken');
+
+const setTwoFactorTempUser = (req, _res, next) => {
+  if (req.user?.id || req.user?._id) {
+    return next();
+  }
+
+  const { tempToken } = req.body ?? {};
+  if (!tempToken) {
+    return next();
+  }
+
+  try {
+    const payload = jwt.verify(tempToken, process.env.JWT_SECRET);
+    if (payload?.userId) {
+      req.user = { id: payload.userId };
+    }
+  } catch {
+    return next();
+  }
+
+  return next();
+};
+
+module.exports = setTwoFactorTempUser;
diff --git a/api/server/middleware/validateMessageReq.js b/api/server/middleware/validateMessageReq.js
index 430444a1727..15967cdc528 100644
--- a/api/server/middleware/validateMessageReq.js
+++ b/api/server/middleware/validateMessageReq.js
@@ -1,20 +1,61 @@
+const { GenerationJobManager } = require('@librechat/api');
+const { logger } = require('@librechat/data-schemas');
 const { getConvo } = require('~/models');
 
+function hasTenantMismatch(job, user) {
+  // Untenanted jobs remain readable by their owner for pre-multi-tenancy deployments.
+  return job.metadata?.tenantId != null && job.metadata.tenantId !== user.tenantId;
+}
+
+async function canReadActiveJobConversation(req, conversationId) {
+  if (req.method !== 'GET' || req.params?.messageId) {
+    return false;
+  }
+
+  let job;
+  try {
+    job = await GenerationJobManager.getJob(conversationId);
+  } catch (error) {
+    logger.warn(`[validateMessageReq] Active job lookup failed for ${conversationId}:`, error);
+    return false;
+  }
+
+  if (!job || job.status !== 'running') {
+    return false;
+  }
+
+  return job.metadata?.userId === req.user.id && !hasTenantMismatch(job, req.user);
+}
+
 // Middleware to validate conversationId and user relationship
 const validateMessageReq = async (req, res, next) => {
-  let conversationId = req.params.conversationId || req.body.conversationId;
+  const body = req.body ?? {};
+  const paramConversationId = req.params?.conversationId;
+  const bodyConversationId = body.conversationId;
+  const nestedConversationId = body.message?.conversationId;
 
-  if (conversationId === 'new') {
-    return res.status(200).send([]);
+  if (
+    (paramConversationId &&
+      ((bodyConversationId && paramConversationId !== bodyConversationId) ||
+        (nestedConversationId && paramConversationId !== nestedConversationId))) ||
+    (bodyConversationId && nestedConversationId && bodyConversationId !== nestedConversationId)
+  ) {
+    return res.status(400).json({ error: 'Conversation ID mismatch' });
   }
 
-  if (!conversationId && req.body.message) {
-    conversationId = req.body.message.conversationId;
+  const conversationId = paramConversationId || bodyConversationId || nestedConversationId;
+
+  if (conversationId === 'new') {
+    return res.status(200).send([]);
   }
 
   const conversation = await getConvo(req.user.id, conversationId);
 
   if (!conversation) {
+    if (await canReadActiveJobConversation(req, conversationId)) {
+      return next();
+    }
+
     return res.status(404).json({ error: 'Conversation not found' });
   }
 
diff --git a/api/server/routes/__test-utils__/convos-route-mocks.js b/api/server/routes/__test-utils__/convos-route-mocks.js
index a3718addff0..a0eb6fe3128 100644
--- a/api/server/routes/__test-utils__/convos-route-mocks.js
+++ b/api/server/routes/__test-utils__/convos-route-mocks.js
@@ -12,6 +12,8 @@ module.exports = {
     })),
     logAxiosError: jest.fn(),
     restoreTenantContextFromReq: jest.fn((req, res, next) => next()),
+    deleteConvoSharedLinksWithCleanup: jest.fn(),
+    deleteAllSharedLinksWithCleanup: jest.fn(),
     ...overrides,
   }),
 
diff --git a/api/server/routes/__tests__/config.rum.spec.js b/api/server/routes/__tests__/config.rum.spec.js
new file mode 100644
index 00000000000..2b0a5b20e24
--- /dev/null
+++ b/api/server/routes/__tests__/config.rum.spec.js
@@ -0,0 +1,194 @@
+jest.mock('~/cache/getLogStores');
+
+const mockGetAppConfig = jest.fn();
+jest.mock('~/server/services/Config/app', () => ({
+  getAppConfig: (...args) => mockGetAppConfig(...args),
+}));
+
+jest.mock('~/server/services/Config/ldap', () => ({
+  getLdapConfig: jest.fn(() => null),
+}));
+
+jest.mock('~/server/middleware/roles/capabilities', () => ({
+  hasCapability: jest.fn(),
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  getTenantId: jest.fn(() => undefined),
+}));
+
+jest.mock('@librechat/api', () => ({
+  ...jest.requireActual('@librechat/api'),
+  getCloudFrontConfig: jest.fn(() => null),
+}));
+
+const request = require('supertest');
+const express = require('express');
+const configRoute = require('../config');
+
+function createApp(user) {
+  const app = express();
+  app.disable('x-powered-by');
+  if (user) {
+    app.use((req, _res, next) => {
+      req.user = user;
+      next();
+    });
+  }
+  app.use('/api/config', configRoute);
+  return app;
+}
+
+const baseAppConfig = {
+  registration: { socialLogins: ['google', 'github'] },
+  interfaceConfig: { modelSelect: true },
+  turnstileConfig: { siteKey: 'test-key' },
+  modelSpecs: { list: [{ name: 'test-spec' }] },
+};
+
+const mockUser = {
+  id: 'user123',
+  role: 'USER',
+  tenantId: undefined,
+};
+
+afterEach(() => {
+  jest.resetAllMocks();
+  delete process.env.RUM_ENABLED;
+  delete process.env.RUM_PROVIDER;
+  delete process.env.RUM_URL;
+  delete process.env.RUM_PROXY_TARGET_URL;
+  delete process.env.RUM_SERVICE_NAME;
+  delete process.env.RUM_AUTH_MODE;
+  delete process.env.RUM_PUBLIC_TOKEN;
+  delete process.env.RUM_TRACE_PROPAGATION_TARGETS;
+  delete process.env.RUM_CONSOLE_CAPTURE;
+  delete process.env.RUM_DISABLE_REPLAY;
+  delete process.env.RUM_ADVANCED_NETWORK_CAPTURE;
+  delete process.env.RUM_SAMPLE_RATE;
+  delete process.env.RUM_ENVIRONMENT;
+});
+
+describe('GET /api/config RUM config', () => {
+  it('includes public-token RUM config when enabled with valid env', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'https://rum.example.com';
+    process.env.RUM_PUBLIC_TOKEN = 'public-token';
+    process.env.RUM_TRACE_PROPAGATION_TARGETS =
+      'https://app.example.com,https://api.openai.com,*,http://api.example.com';
+    process.env.RUM_SAMPLE_RATE = '0.25';
+    process.env.RUM_ENVIRONMENT = 'test';
+    const app = createApp(null);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body.rum).toEqual({
+      provider: 'hyperdx',
+      enabled: true,
+      url: 'https://rum.example.com',
+      serviceName: 'librechat-web',
+      authMode: 'publicToken',
+      publicToken: 'public-token',
+      tracePropagationTargets: ['https://app.example.com', 'https://api.openai.com'],
+      consoleCapture: false,
+      disableReplay: true,
+      advancedNetworkCapture: false,
+      sampleRate: 0.25,
+      environment: 'test',
+    });
+  });
+
+  it('omits malformed RUM config', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'not a url';
+    process.env.RUM_PUBLIC_TOKEN = 'public-token';
+    const app = createApp(null);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body).not.toHaveProperty('rum');
+  });
+
+  it('includes proxy RUM config when enabled with valid env', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const app = createApp(mockUser);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body.rum).toEqual({
+      provider: 'hyperdx',
+      enabled: true,
+      url: '/api/rum',
+      serviceName: 'librechat-web',
+      authMode: 'proxy',
+      consoleCapture: false,
+      disableReplay: true,
+      advancedNetworkCapture: false,
+    });
+  });
+
+  it('omits proxy RUM config without a target collector URL', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    const app = createApp(mockUser);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body).not.toHaveProperty('rum');
+  });
+
+  it('omits RUM config when the URL contains credentials', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'https://user:password@rum.example.com';
+    process.env.RUM_PUBLIC_TOKEN = 'public-token';
+    const app = createApp(null);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body).not.toHaveProperty('rum');
+  });
+
+  it('allows IPv6 localhost HTTP RUM URLs in public-token mode', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'http://[::1]:4318';
+    process.env.RUM_PUBLIC_TOKEN = 'public-token';
+    const app = createApp(null);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body.rum?.url).toBe('http://[::1]:4318');
+  });
+
+  it('omits unsupported userJwt RUM config for authenticated users', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'https://rum.example.com';
+    process.env.RUM_AUTH_MODE = 'userJwt';
+    const app = createApp(mockUser);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body).not.toHaveProperty('rum');
+  });
+
+  it('omits unsupported userJwt RUM config for unauthenticated users', async () => {
+    mockGetAppConfig.mockResolvedValue(baseAppConfig);
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_URL = 'https://rum.example.com';
+    process.env.RUM_AUTH_MODE = 'userJwt';
+    const app = createApp(null);
+
+    const response = await request(app).get('/api/config');
+
+    expect(response.body).not.toHaveProperty('rum');
+  });
+});
diff --git a/api/server/routes/__tests__/config.spec.js b/api/server/routes/__tests__/config.spec.js
index d92c56b8bbe..af82399e765 100644
--- a/api/server/routes/__tests__/config.spec.js
+++ b/api/server/routes/__tests__/config.spec.js
@@ -21,9 +21,16 @@ jest.mock('@librechat/data-schemas', () => ({
 }));
 
 const mockGetCloudFrontConfig = jest.fn(() => null);
+const mockResolveBuildInfo = jest.fn(() => ({
+  commit: null,
+  commitShort: null,
+  branch: null,
+  buildDate: null,
+}));
 jest.mock('@librechat/api', () => ({
   ...jest.requireActual('@librechat/api'),
   getCloudFrontConfig: (...args) => mockGetCloudFrontConfig(...args),
+  resolveBuildInfo: (...args) => mockResolveBuildInfo(...args),
 }));
 
 const request = require('supertest');
@@ -63,6 +70,12 @@ const mockUser = {
 
 afterEach(() => {
   jest.resetAllMocks();
+  mockResolveBuildInfo.mockReturnValue({
+    commit: null,
+    commitShort: null,
+    branch: null,
+    buildDate: null,
+  });
   delete process.env.APP_TITLE;
   delete process.env.CHECK_BALANCE;
   delete process.env.START_BALANCE;
@@ -88,6 +101,9 @@ afterEach(() => {
   delete process.env.SAML_CERT;
   delete process.env.SAML_SESSION_SECRET;
   delete process.env.ALLOW_ACCOUNT_DELETION;
+  delete process.env.ANALYTICS_GTM_ID;
+  delete process.env.CUSTOM_FOOTER;
+  delete process.env.HELP_AND_FAQ_URL;
 });
 
 describe('GET /api/config', () => {
@@ -143,9 +159,52 @@ describe('GET /api/config', () => {
       expect(response.body).not.toHaveProperty('bundlerURL');
       expect(response.body).not.toHaveProperty('staticBundlerURL');
       expect(response.body).not.toHaveProperty('sharePointFilePickerEnabled');
+      expect(response.body).not.toHaveProperty('sharePointBaseUrl');
+      expect(response.body).not.toHaveProperty('sharePointPickerGraphScope');
+      expect(response.body).not.toHaveProperty('sharePointPickerSharePointScope');
       expect(response.body).not.toHaveProperty('conversationImportMaxFileSize');
     });
 
+    it('should strip authenticated-only informational fields from unauthenticated response (#12688)', async () => {
+      process.env.ANALYTICS_GTM_ID = 'GTM-XYZ';
+      process.env.CUSTOM_FOOTER = 'internal footer text';
+      process.env.HELP_AND_FAQ_URL = 'https://internal.example.com/faq';
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.statusCode).toBe(200);
+      expect(response.body).not.toHaveProperty('showBirthdayIcon');
+      expect(response.body).not.toHaveProperty('helpAndFaqURL');
+      expect(response.body).not.toHaveProperty('sharedLinksEnabled');
+      expect(response.body).not.toHaveProperty('publicSharedLinksEnabled');
+      expect(response.body).not.toHaveProperty('analyticsGtmId');
+      expect(response.body).not.toHaveProperty('openidReuseTokens');
+      expect(response.body).not.toHaveProperty('allowAccountDeletion');
+      expect(response.body).not.toHaveProperty('customFooter');
+    });
+
+    it('should not include share-only fields when share context is requested', async () => {
+      process.env.ANALYTICS_GTM_ID = 'GTM-XYZ';
+      process.env.CUSTOM_FOOTER = 'public footer text';
+      process.env.HELP_AND_FAQ_URL = 'https://internal.example.com/faq';
+      process.env.SANDPACK_BUNDLER_URL = 'https://bundler.test';
+      process.env.SANDPACK_STATIC_BUNDLER_URL = 'https://static-bundler.test';
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config?context=share');
+
+      expect(response.statusCode).toBe(200);
+      expect(response.body).not.toHaveProperty('analyticsGtmId');
+      expect(response.body).not.toHaveProperty('customFooter');
+      expect(response.body).not.toHaveProperty('bundlerURL');
+      expect(response.body).not.toHaveProperty('staticBundlerURL');
+      expect(response.body).not.toHaveProperty('helpAndFaqURL');
+      expect(response.body).not.toHaveProperty('allowAccountDeletion');
+    });
+
     it('should include socialLogins and turnstile from base config', async () => {
       mockGetAppConfig.mockResolvedValue(baseAppConfig);
       const app = createApp(null);
@@ -193,7 +252,7 @@ describe('GET /api/config', () => {
       expect(response.body).toHaveProperty('serverDomain');
     });
 
-    it('should advertise CloudFront cookie refresh only when signed-cookie mode is active', async () => {
+    it('should omit CloudFront cookie refresh from unauthenticated response (#12688)', async () => {
       mockGetAppConfig.mockResolvedValue(baseAppConfig);
       mockGetCloudFrontConfig.mockReturnValue({
         domain: 'https://cdn.example.com',
@@ -206,69 +265,9 @@ describe('GET /api/config', () => {
 
       const response = await request(app).get('/api/config');
 
-      expect(response.body.cloudFront).toEqual({
-        cookieRefresh: {
-          endpoint: '/api/auth/cloudfront/refresh',
-          domain: 'https://cdn.example.com',
-        },
-      });
-    });
-
-    it('should omit CloudFront cookie refresh when signed-cookie mode is inactive', async () => {
-      mockGetAppConfig.mockResolvedValue(baseAppConfig);
-      mockGetCloudFrontConfig.mockReturnValue({
-        domain: 'https://cdn.example.com',
-        imageSigning: 'url',
-      });
-      const app = createApp(null);
-
-      const response = await request(app).get('/api/config');
-
-      expect(response.body).not.toHaveProperty('cloudFront');
-    });
-
-    it('should omit CloudFront cookie refresh when cookie mode cannot mint cookies', async () => {
-      mockGetAppConfig.mockResolvedValue(baseAppConfig);
-      mockGetCloudFrontConfig.mockReturnValue({
-        domain: 'https://cdn.example.com',
-        imageSigning: 'cookies',
-      });
-      const app = createApp(null);
-
-      const response = await request(app).get('/api/config');
-
       expect(response.body).not.toHaveProperty('cloudFront');
     });
 
-    it('should default allowAccountDeletion to true when env var is unset', async () => {
-      mockGetAppConfig.mockResolvedValue(baseAppConfig);
-      const app = createApp(null);
-
-      const response = await request(app).get('/api/config');
-
-      expect(response.body.allowAccountDeletion).toBe(true);
-    });
-
-    it('should set allowAccountDeletion to false when ALLOW_ACCOUNT_DELETION=false', async () => {
-      process.env.ALLOW_ACCOUNT_DELETION = 'false';
-      mockGetAppConfig.mockResolvedValue(baseAppConfig);
-      const app = createApp(null);
-
-      const response = await request(app).get('/api/config');
-
-      expect(response.body.allowAccountDeletion).toBe(false);
-    });
-
-    it('should set allowAccountDeletion to true when ALLOW_ACCOUNT_DELETION=true', async () => {
-      process.env.ALLOW_ACCOUNT_DELETION = 'true';
-      mockGetAppConfig.mockResolvedValue(baseAppConfig);
-      const app = createApp(null);
-
-      const response = await request(app).get('/api/config');
-
-      expect(response.body.allowAccountDeletion).toBe(true);
-    });
-
     it('should return 500 when getAppConfig throws', async () => {
       mockGetAppConfig.mockRejectedValue(new Error('Config service failure'));
       const app = createApp(null);
@@ -322,6 +321,45 @@ describe('GET /api/config', () => {
       expect(response.body.webSearch).toEqual({ searchProvider: 'tavily' });
     });
 
+    it('should strip private prompt fields from model spec presets', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        modelSpecs: {
+          enforce: false,
+          prioritize: true,
+          list: [
+            {
+              name: 'guarded-spec',
+              label: 'Guarded Spec',
+              skills: ['private-skill'],
+              preset: {
+                endpoint: 'openAI',
+                model: 'gpt-4o',
+                promptPrefix: 'private prompt prefix',
+                instructions: 'private assistant instructions',
+                additional_instructions: 'private additional instructions',
+                system: 'private bedrock system',
+                context: 'private context',
+                examples: [{ input: { content: 'a' }, output: { content: 'b' } }],
+                greeting: 'Hello',
+              },
+            },
+          ],
+        },
+      });
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.statusCode).toBe(200);
+      expect(response.body.modelSpecs.list[0].preset).toEqual({
+        endpoint: 'openAI',
+        model: 'gpt-4o',
+        greeting: 'Hello',
+      });
+      expect(response.body.modelSpecs.list[0]).not.toHaveProperty('skills');
+    });
+
     it('should include full interface config', async () => {
       mockGetAppConfig.mockResolvedValue(baseAppConfig);
       const app = createApp(mockUser);
@@ -345,6 +383,70 @@ describe('GET /api/config', () => {
       expect(response.body.conversationImportMaxFileSize).toBe(5000000);
     });
 
+    it('should include post-login informational fields', async () => {
+      process.env.ANALYTICS_GTM_ID = 'GTM-XYZ';
+      process.env.CUSTOM_FOOTER = 'authenticated footer text';
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).toHaveProperty('helpAndFaqURL');
+      expect(response.body).toHaveProperty('sharedLinksEnabled');
+      expect(response.body).toHaveProperty('publicSharedLinksEnabled');
+      expect(response.body).toHaveProperty('showBirthdayIcon');
+      expect(response.body).toHaveProperty('openidReuseTokens');
+      expect(response.body.analyticsGtmId).toBe('GTM-XYZ');
+      expect(response.body.customFooter).toBe('authenticated footer text');
+    });
+
+    it('should advertise CloudFront cookie refresh when signed-cookie mode is active', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockGetCloudFrontConfig.mockReturnValue({
+        domain: 'https://cdn.example.com',
+        imageSigning: 'cookies',
+        cookieDomain: '.example.com',
+        privateKey: 'test-private-key',
+        keyPairId: 'K123ABC',
+      });
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.cloudFront).toEqual({
+        cookieRefresh: {
+          endpoint: '/api/auth/cloudfront/refresh',
+          domain: 'https://cdn.example.com',
+        },
+      });
+    });
+
+    it('should omit CloudFront cookie refresh when signed-cookie mode is inactive', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockGetCloudFrontConfig.mockReturnValue({
+        domain: 'https://cdn.example.com',
+        imageSigning: 'url',
+      });
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).not.toHaveProperty('cloudFront');
+    });
+
+    it('should omit CloudFront cookie refresh when cookie mode cannot mint cookies', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockGetCloudFrontConfig.mockReturnValue({
+        domain: 'https://cdn.example.com',
+        imageSigning: 'cookies',
+      });
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).not.toHaveProperty('cloudFront');
+    });
+
     it('should merge per-user balance override into config', async () => {
       mockGetAppConfig.mockResolvedValue({
         ...baseAppConfig,
@@ -409,4 +511,112 @@ describe('GET /api/config', () => {
       expect(response.body).toHaveProperty('error');
     });
   });
+
+  describe('buildInfo payload', () => {
+    const populatedBuildInfo = {
+      commit: 'abcdef1234567890abcdef1234567890abcdef12',
+      commitShort: 'abcdef1',
+      branch: 'dev',
+      buildDate: '2026-04-20T12:00:00Z',
+    };
+
+    it('includes buildInfo in authenticated response when interface flag is not explicitly disabled', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockResolveBuildInfo.mockReturnValue(populatedBuildInfo);
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.buildInfo).toEqual(populatedBuildInfo);
+    });
+
+    it('omits buildInfo when interface.buildInfo is false', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        interfaceConfig: { ...baseAppConfig.interfaceConfig, buildInfo: false },
+      });
+      mockResolveBuildInfo.mockReturnValue(populatedBuildInfo);
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).not.toHaveProperty('buildInfo');
+    });
+
+    it('omits buildInfo when all resolver fields are null', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockResolveBuildInfo.mockReturnValue({
+        commit: null,
+        commitShort: null,
+        branch: null,
+        buildDate: null,
+      });
+      const app = createApp(mockUser);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).not.toHaveProperty('buildInfo');
+    });
+
+    it('includes buildInfo in unauthenticated response when flag is not disabled', async () => {
+      mockGetAppConfig.mockResolvedValue(baseAppConfig);
+      mockResolveBuildInfo.mockReturnValue(populatedBuildInfo);
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.buildInfo).toEqual(populatedBuildInfo);
+    });
+
+    it('omits buildInfo in unauthenticated response when interface.buildInfo is false', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        interfaceConfig: { ...baseAppConfig.interfaceConfig, buildInfo: false },
+      });
+      mockResolveBuildInfo.mockReturnValue(populatedBuildInfo);
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body).not.toHaveProperty('buildInfo');
+    });
+
+    it('propagates interface.buildInfo=false in unauthenticated response so clients can hide About tab', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        interfaceConfig: { ...baseAppConfig.interfaceConfig, buildInfo: false },
+      });
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.interface).toBeDefined();
+      expect(response.body.interface.buildInfo).toBe(false);
+    });
+
+    it('does not add interface.buildInfo=true to unauthenticated response (default stays implicit)', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        interfaceConfig: { privacyPolicy: { externalUrl: 'https://x' }, buildInfo: true },
+      });
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.interface).toBeDefined();
+      expect(response.body.interface).not.toHaveProperty('buildInfo');
+    });
+
+    it('includes interface block with only buildInfo=false when nothing else is set', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        ...baseAppConfig,
+        interfaceConfig: { buildInfo: false },
+      });
+      const app = createApp(null);
+
+      const response = await request(app).get('/api/config');
+
+      expect(response.body.interface).toEqual({ buildInfo: false });
+    });
+  });
 });
diff --git a/api/server/routes/__tests__/convos.spec.js b/api/server/routes/__tests__/convos.spec.js
index 23978f28e9b..9c760f50574 100644
--- a/api/server/routes/__tests__/convos.spec.js
+++ b/api/server/routes/__tests__/convos.spec.js
@@ -21,13 +21,11 @@ jest.mock('~/server/services/Endpoints/assistants', () => require(MOCKS).assista
 describe('Convos Routes', () => {
   let app;
   let convosRouter;
+  const { deleteToolCalls, deleteConvos, saveConvo } = require('~/models');
   const {
-    deleteAllSharedLinks,
-    deleteConvoSharedLink,
-    deleteToolCalls,
-    deleteConvos,
-    saveConvo,
-  } = require('~/models');
+    deleteAllSharedLinksWithCleanup,
+    deleteConvoSharedLinksWithCleanup,
+  } = require('@librechat/api');
 
   beforeAll(() => {
     convosRouter = require('../convos');
@@ -57,7 +55,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 10 });
-      deleteAllSharedLinks.mockResolvedValue({
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({
         message: 'All shared links deleted successfully',
         deletedCount: 3,
       });
@@ -75,12 +73,12 @@ describe('Convos Routes', () => {
       expect(deleteToolCalls).toHaveBeenCalledWith('test-user-123');
       expect(deleteToolCalls).toHaveBeenCalledTimes(1);
 
-      /** Verify deleteAllSharedLinks was called with correct userId */
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
-      expect(deleteAllSharedLinks).toHaveBeenCalledTimes(1);
+      /** Verify deleteAllSharedLinksWithCleanup was called with correct userId */
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledTimes(1);
     });
 
-    it('should call deleteAllSharedLinks even when no conversations exist', async () => {
+    it('should call deleteAllSharedLinksWithCleanup even when no conversations exist', async () => {
       const mockDbResponse = {
         deletedCount: 0,
         message: 'No conversations to delete',
@@ -88,7 +86,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
-      deleteAllSharedLinks.mockResolvedValue({
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({
         message: 'All shared links deleted successfully',
         deletedCount: 0,
       });
@@ -96,7 +94,7 @@ describe('Convos Routes', () => {
       const response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
     });
 
     it('should return 500 if deleteConvos fails', async () => {
@@ -123,10 +121,10 @@ describe('Convos Routes', () => {
       expect(response.text).toBe('Error clearing conversations');
     });
 
-    it('should return 500 if deleteAllSharedLinks fails', async () => {
+    it('should return 500 if deleteAllSharedLinksWithCleanup fails', async () => {
       deleteConvos.mockResolvedValue({ deletedCount: 5 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 10 });
-      deleteAllSharedLinks.mockRejectedValue(new Error('Shared links deletion failed'));
+      deleteAllSharedLinksWithCleanup.mockRejectedValue(new Error('Shared links deletion failed'));
 
       const response = await request(app).delete('/api/convos/all');
 
@@ -138,12 +136,12 @@ describe('Convos Routes', () => {
       /** First user */
       deleteConvos.mockResolvedValue({ deletedCount: 3 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 5 });
-      deleteAllSharedLinks.mockResolvedValue({ deletedCount: 2 });
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 2 });
 
       let response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
 
       jest.clearAllMocks();
 
@@ -158,12 +156,12 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 7 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 12 });
-      deleteAllSharedLinks.mockResolvedValue({ deletedCount: 4 });
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 4 });
 
       response = await request(app2).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-456');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-456');
     });
 
     it('should execute deletions in correct sequence', async () => {
@@ -179,15 +177,19 @@ describe('Convos Routes', () => {
         return Promise.resolve({ deletedCount: 10 });
       });
 
-      deleteAllSharedLinks.mockImplementation(() => {
-        executionOrder.push('deleteAllSharedLinks');
+      deleteAllSharedLinksWithCleanup.mockImplementation(() => {
+        executionOrder.push('deleteAllSharedLinksWithCleanup');
         return Promise.resolve({ deletedCount: 3 });
       });
 
       await request(app).delete('/api/convos/all');
 
       /** Verify all three functions were called */
-      expect(executionOrder).toEqual(['deleteConvos', 'deleteToolCalls', 'deleteAllSharedLinks']);
+      expect(executionOrder).toEqual([
+        'deleteConvos',
+        'deleteToolCalls',
+        'deleteAllSharedLinksWithCleanup',
+      ]);
     });
 
     it('should maintain data integrity by cleaning up shared links when conversations are deleted', async () => {
@@ -201,17 +203,17 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockConvosDeleted);
       deleteToolCalls.mockResolvedValue(mockToolCallsDeleted);
-      deleteAllSharedLinks.mockResolvedValue(mockSharedLinksDeleted);
+      deleteAllSharedLinksWithCleanup.mockResolvedValue(mockSharedLinksDeleted);
 
       const response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
 
       /** Verify that shared links cleanup was called for the same user */
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
 
       /** Verify no shared links remain for deleted conversations */
-      expect(deleteAllSharedLinks).toHaveBeenCalledAfter(deleteConvos);
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledAfter(deleteConvos);
     });
   });
 
@@ -225,7 +227,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 3 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 1,
       });
@@ -249,11 +251,14 @@ describe('Convos Routes', () => {
       /** Verify deleteToolCalls was called */
       expect(deleteToolCalls).toHaveBeenCalledWith('test-user-123', mockConversationId);
 
-      /** Verify deleteConvoSharedLink was called */
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      /** Verify deleteConvoSharedLinksWithCleanup was called */
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
     });
 
-    it('should not call deleteConvoSharedLink when no conversationId provided', async () => {
+    it('should not call deleteConvoSharedLinksWithCleanup when no conversationId provided', async () => {
       deleteConvos.mockResolvedValue({ deletedCount: 0 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
 
@@ -266,7 +271,7 @@ describe('Convos Routes', () => {
         });
 
       expect(response.status).toBe(200);
-      expect(deleteConvoSharedLink).not.toHaveBeenCalled();
+      expect(deleteConvoSharedLinksWithCleanup).not.toHaveBeenCalled();
     });
 
     it('should handle deletion of conversation without shared links', async () => {
@@ -274,7 +279,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 0,
       });
@@ -288,7 +293,10 @@ describe('Convos Routes', () => {
         });
 
       expect(response.status).toBe(201);
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
     });
 
     it('should return 400 when no parameters provided', async () => {
@@ -299,7 +307,7 @@ describe('Convos Routes', () => {
       expect(response.status).toBe(400);
       expect(response.body).toEqual({ error: 'no parameters provided' });
       expect(deleteConvos).not.toHaveBeenCalled();
-      expect(deleteConvoSharedLink).not.toHaveBeenCalled();
+      expect(deleteConvoSharedLinksWithCleanup).not.toHaveBeenCalled();
     });
 
     it('should return 400 when request body is empty (DoS prevention)', async () => {
@@ -336,12 +344,14 @@ describe('Convos Routes', () => {
       expect(deleteConvos).not.toHaveBeenCalled();
     });
 
-    it('should return 500 if deleteConvoSharedLink fails', async () => {
+    it('should return 500 if deleteConvoSharedLinksWithCleanup fails', async () => {
       const mockConversationId = 'conv-error';
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 2 });
-      deleteConvoSharedLink.mockRejectedValue(new Error('Failed to delete shared links'));
+      deleteConvoSharedLinksWithCleanup.mockRejectedValue(
+        new Error('Failed to delete shared links'),
+      );
 
       const response = await request(app)
         .delete('/api/convos')
@@ -369,8 +379,8 @@ describe('Convos Routes', () => {
         return Promise.resolve({ deletedCount: 2 });
       });
 
-      deleteConvoSharedLink.mockImplementation(() => {
-        executionOrder.push('deleteConvoSharedLink');
+      deleteConvoSharedLinksWithCleanup.mockImplementation(() => {
+        executionOrder.push('deleteConvoSharedLinksWithCleanup');
         return Promise.resolve({ deletedCount: 1 });
       });
 
@@ -382,7 +392,11 @@ describe('Convos Routes', () => {
           },
         });
 
-      expect(executionOrder).toEqual(['deleteConvos', 'deleteToolCalls', 'deleteConvoSharedLink']);
+      expect(executionOrder).toEqual([
+        'deleteConvos',
+        'deleteToolCalls',
+        'deleteConvoSharedLinksWithCleanup',
+      ]);
     });
 
     it('should prevent orphaned shared links when deleting single conversation', async () => {
@@ -390,7 +404,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 4 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 2,
       });
@@ -406,10 +420,13 @@ describe('Convos Routes', () => {
       expect(response.status).toBe(201);
 
       /** Verify shared links were deleted for the specific conversation */
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
 
       /** Verify it was called after the conversation was deleted */
-      expect(deleteConvoSharedLink).toHaveBeenCalledAfter(deleteConvos);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledAfter(deleteConvos);
     });
   });
 
@@ -544,6 +561,80 @@ describe('Convos Routes', () => {
       expect(response.body).toEqual({ error: 'conversationId is required' });
     });
   });
+
+  describe('POST /convos/pin', () => {
+    const mockConversationId = 'conv-123';
+
+    it('should pin a conversation', async () => {
+      const mockPinnedConvo = { conversationId: mockConversationId, pinned: true };
+      saveConvo.mockResolvedValue(mockPinnedConvo);
+
+      const response = await request(app).post('/api/convos/pin').send({ arg: mockPinnedConvo });
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual(mockPinnedConvo);
+      expect(saveConvo).toHaveBeenCalledWith(
+        { userId: 'test-user-123' },
+        { conversationId: mockConversationId, pinned: true },
+        { context: `POST /api/convos/pin ${mockConversationId}` },
+      );
+    });
+
+    it('should unpin a conversation', async () => {
+      const mockUnpinnedConvo = { conversationId: mockConversationId, pinned: false };
+      saveConvo.mockResolvedValue(mockUnpinnedConvo);
+
+      const response = await request(app).post('/api/convos/pin').send({ arg: mockUnpinnedConvo });
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual(mockUnpinnedConvo);
+      expect(saveConvo).toHaveBeenCalledWith(
+        { userId: 'test-user-123' },
+        { conversationId: mockConversationId, pinned: false },
+        { context: `POST /api/convos/pin ${mockConversationId}` },
+      );
+    });
+
+    it('should return 400 when conversationId is missing', async () => {
+      const response = await request(app)
+        .post('/api/convos/pin')
+        .send({ arg: { pinned: true } });
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({ error: 'conversationId is required' });
+      expect(saveConvo).not.toHaveBeenCalled();
+    });
+
+    it('should return 400 when pinned is not a boolean', async () => {
+      const response = await request(app)
+        .post('/api/convos/pin')
+        .send({ arg: { conversationId: mockConversationId, pinned: 'yes' } });
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({ error: 'pinned must be a boolean' });
+      expect(saveConvo).not.toHaveBeenCalled();
+    });
+
+    it('should return 400 when pinned is missing', async () => {
+      const response = await request(app)
+        .post('/api/convos/pin')
+        .send({ arg: { conversationId: mockConversationId } });
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({ error: 'pinned is required' });
+      expect(saveConvo).not.toHaveBeenCalled();
+    });
+
+    it('should return 500 when saveConvo fails', async () => {
+      saveConvo.mockRejectedValue(new Error('Database error'));
+
+      const response = await request(app)
+        .post('/api/convos/pin')
+        .send({ arg: { conversationId: mockConversationId, pinned: true } });
+
+      expect(response.status).toBe(500);
+    });
+  });
 });
 
 /**
diff --git a/api/server/routes/__tests__/mcp.spec.js b/api/server/routes/__tests__/mcp.spec.js
index 30a86a53b2f..5323fa0d0e7 100644
--- a/api/server/routes/__tests__/mcp.spec.js
+++ b/api/server/routes/__tests__/mcp.spec.js
@@ -3,7 +3,7 @@ const express = require('express');
 const request = require('supertest');
 const mongoose = require('mongoose');
 const cookieParser = require('cookie-parser');
-const { getBasePath } = require('@librechat/api');
+const { getBasePath, PENDING_STALE_MS } = require('@librechat/api');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
 function generateTestCsrfToken(flowId) {
@@ -24,7 +24,13 @@ const mockRegistryInstance = {
   removeServer: jest.fn(),
   getAllowedDomains: jest.fn().mockReturnValue(null),
   getAllowedAddresses: jest.fn().mockReturnValue(null),
+  resolveAllowlists: jest.fn().mockResolvedValue({
+    allowedDomains: null,
+    allowedAddresses: null,
+    useSSRFProtection: true,
+  }),
 };
+let mockMCPUseAllowed = true;
 
 jest.mock('@librechat/api', () => {
   const actual = jest.requireActual('@librechat/api');
@@ -35,6 +41,16 @@ jest.mock('@librechat/api', () => {
       getFlowState: jest.fn(),
       completeOAuthFlow: jest.fn(),
       generateFlowId: jest.fn(),
+      generateTokenFlowId: jest.fn(),
+      parseFlowId: jest.fn(),
+      buildStoredClientMetadata: jest.fn((metadata, resourceMetadata) =>
+        metadata
+          ? {
+              ...metadata,
+              ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+            }
+          : undefined,
+      ),
       resolveStateToFlowId: jest.fn(async (state) => state),
       storeStateMapping: jest.fn(),
       deleteStateMapping: jest.fn(),
@@ -46,7 +62,15 @@ jest.mock('@librechat/api', () => {
       deleteUserTokens: jest.fn(),
     },
     getUserMCPAuthMap: jest.fn(),
-    generateCheckAccess: jest.fn(() => (req, res, next) => next()),
+    generateCheckAccess: jest.fn(({ permissionType, permissions }) => (req, res, next) => {
+      const { PermissionTypes, Permissions } = require('librechat-data-provider');
+      const isMCPUseCheck =
+        permissionType === PermissionTypes.MCP_SERVERS && permissions.includes(Permissions.USE);
+      if (isMCPUseCheck && !mockMCPUseAllowed) {
+        return res.status(403).json({ message: 'Forbidden: Insufficient permissions' });
+      }
+      return next();
+    }),
     MCPServersRegistry: {
       getInstance: () => mockRegistryInstance,
     },
@@ -108,9 +132,11 @@ jest.mock('~/server/services/Config/mcp', () => ({
 }));
 
 const mockResolveAllMcpConfigs = jest.fn().mockResolvedValue({});
+const mockResolveMcpConfigNames = jest.fn().mockResolvedValue([]);
 jest.mock('~/server/services/MCP', () => ({
   getMCPSetupData: jest.fn(),
   resolveConfigServers: jest.fn().mockResolvedValue({}),
+  resolveMcpConfigNames: (...args) => mockResolveMcpConfigNames(...args),
   resolveAllMcpConfigs: (...args) => mockResolveAllMcpConfigs(...args),
   getServerConnectionStatus: jest.fn(),
 }));
@@ -143,6 +169,7 @@ describe('MCP Routes', () => {
   let app;
   let mongoServer;
   let mcpRouter;
+  let currentUser;
 
   beforeAll(async () => {
     mongoServer = await MongoMemoryServer.create();
@@ -157,7 +184,7 @@ describe('MCP Routes', () => {
     app.use(cookieParser());
 
     app.use((req, res, next) => {
-      req.user = { id: 'test-user-id' };
+      req.user = currentUser ?? { id: 'test-user-id' };
       next();
     });
 
@@ -171,17 +198,182 @@ describe('MCP Routes', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    currentUser = undefined;
+    mockResolveAllMcpConfigs.mockResolvedValue({});
+    mockResolveMcpConfigNames.mockResolvedValue([]);
+    const { MCPOAuthHandler } = require('@librechat/api');
+    const { getTenantId } = require('@librechat/data-schemas');
+    getTenantId.mockReturnValue(undefined);
+    MCPOAuthHandler.generateFlowId.mockImplementation((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    });
+    MCPOAuthHandler.generateTokenFlowId.mockImplementation((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    });
+    MCPOAuthHandler.parseFlowId.mockImplementation((flowId) => {
+      const parts = flowId.split(':');
+      if (parts[0] === 'tenant') {
+        if (parts.length < 4 || !parts[1] || !parts[2]) {
+          return null;
+        }
+        let tenantId;
+        try {
+          tenantId = decodeURIComponent(parts[1]);
+        } catch {
+          return null;
+        }
+        return {
+          tenantId,
+          userId: parts[2],
+          serverName: parts.slice(3).join(':'),
+        };
+      }
+      if (parts.length < 2 || !parts[0]) {
+        return null;
+      }
+      return {
+        userId: parts[0],
+        serverName: parts.slice(1).join(':'),
+      };
+    });
+    MCPOAuthHandler.buildStoredClientMetadata.mockImplementation((metadata, resourceMetadata) =>
+      metadata
+        ? {
+            ...metadata,
+            ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+          }
+        : undefined,
+    );
+    mockMCPUseAllowed = true;
+    /**
+     * Reset registry method implementations every test. `clearAllMocks` resets
+     * call records but NOT implementations, so a `.mockRejectedValue(...)` set
+     * by an earlier test leaks into later ones — including the new
+     * `getServerConfig` lookup in updateMCPServerController.
+     */
+    mockRegistryInstance.getServerConfig.mockReset().mockResolvedValue(undefined);
+    mockRegistryInstance.addServer.mockReset();
+    mockRegistryInstance.updateServer.mockReset();
+    mockRegistryInstance.removeServer.mockReset();
   });
 
   describe('GET /:serverName/oauth/initiate', () => {
     const { MCPOAuthHandler } = require('@librechat/api');
     const { getLogStores } = require('~/cache');
 
-    it('should initiate OAuth flow successfully', async () => {
+    it('should reuse stored authorization URL without starting a new OAuth flow', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(302);
+      expect(response.headers.location).toBe('https://oauth.example.com/auth?state=stored-state');
+      expect(response.headers['set-cookie']?.join('')).toContain('oauth_csrf=');
+      expect(MCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(MCPOAuthHandler.storeStateMapping).not.toHaveBeenCalled();
+      expect(mockRegistryInstance.getServerConfig).not.toHaveBeenCalled();
+    });
+
+    it('should accept tenant-scoped flow IDs when a tenant is active', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-a');
+      const tenantFlowId = 'tenant:tenant-a:test-user-id:test-server';
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: tenantFlowId,
+      });
+
+      expect(response.status).toBe(302);
+      expect(response.headers.location).toBe('https://oauth.example.com/auth?state=stored-state');
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(tenantFlowId, 'mcp_oauth');
+    });
+
+    it('should reject non-tenant flow IDs when a tenant is active', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-a');
+      const mockFlowManager = { getFlowState: jest.fn() };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(mockFlowManager.getFlowState).not.toHaveBeenCalled();
+    });
+
+    it('should reject stored authorization URL when flow is no longer pending', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({ error: 'Invalid flow state' });
+      expect(MCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(MCPOAuthHandler.storeStateMapping).not.toHaveBeenCalled();
+    });
+
+    it('should initiate OAuth flow when stored authorization URL is missing', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
           metadata: {
             serverUrl: 'https://test-server.com',
+            state: 'old-state-value',
             oauth: { clientId: 'test-client-id' },
           },
         }),
@@ -215,6 +407,24 @@ describe('MCP Routes', () => {
         null,
         undefined,
         null,
+        undefined,
+      );
+      expect(MCPOAuthHandler.deleteStateMapping).toHaveBeenCalledWith(
+        'old-state-value',
+        mockFlowManager,
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        'test-user-id:test-server',
+        'mcp_oauth',
+        expect.objectContaining({
+          state: 'random-state-value',
+          authorizationUrl: 'https://oauth.example.com/auth',
+        }),
+      );
+      expect(MCPOAuthHandler.storeStateMapping).toHaveBeenCalledWith(
+        'random-state-value',
+        'test-user-id:test-server',
+        mockFlowManager,
       );
     });
 
@@ -228,6 +438,27 @@ describe('MCP Routes', () => {
       expect(response.body).toEqual({ error: 'User mismatch' });
     });
 
+    it('should return 403 when flowId does not match authenticated user and server', async () => {
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'other-user-id:test-server',
+      });
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(getLogStores).not.toHaveBeenCalled();
+    });
+
+    it('should return 403 when flowId query value is not a string', async () => {
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/initiate')
+        .query('userId=test-user-id&flowId=test-user-id:test-server&flowId=other-flow');
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(getLogStores).not.toHaveBeenCalled();
+    });
+
     it('should return 404 when flow state is not found', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue(null),
@@ -238,7 +469,7 @@ describe('MCP Routes', () => {
 
       const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
         userId: 'test-user-id',
-        flowId: 'non-existent-flow-id',
+        flowId: 'test-user-id:test-server',
       });
 
       expect(response.status).toBe(404);
@@ -398,6 +629,26 @@ describe('MCP Routes', () => {
         expect(response.headers.location).toBe(`${basePath}/oauth/error?error=invalid_client`);
         expect(mockFlowManager.failFlow).not.toHaveBeenCalled();
       });
+
+      it('should redirect instead of hanging when OAuth error flow ID is malformed', async () => {
+        const mockFlowManager = {
+          failFlow: jest.fn(),
+        };
+
+        getLogStores.mockReturnValueOnce({});
+        require('~/config').getFlowStateManager.mockReturnValueOnce(mockFlowManager);
+        MCPOAuthHandler.resolveStateToFlowId.mockResolvedValueOnce('malformed-flow-id');
+
+        const response = await request(app).get('/api/mcp/test-server/oauth/callback').query({
+          error: 'invalid_client',
+          state: 'opaque-state',
+        });
+        const basePath = getBasePath();
+
+        expect(response.status).toBe(302);
+        expect(response.headers.location).toBe(`${basePath}/oauth/error?error=invalid_client`);
+        expect(mockFlowManager.failFlow).not.toHaveBeenCalled();
+      });
     });
 
     it('should redirect to error page when code is missing', async () => {
@@ -516,6 +767,69 @@ describe('MCP Routes', () => {
         expect(response.headers.location).toContain(`${basePath}/oauth/success`);
       });
 
+      it('should forward the merged server config so the tool cache gate sees request-scoped servers', async () => {
+        const flowId = 'test-user-id:test-server';
+        const mockFlowManager = {
+          getFlowState: jest.fn().mockResolvedValue({
+            status: 'PENDING',
+            createdAt: Date.now(),
+          }),
+          completeFlow: jest.fn().mockResolvedValue(true),
+          deleteFlow: jest.fn().mockResolvedValue(true),
+        };
+        const mockFlowState = {
+          serverName: 'test-server',
+          userId: 'test-user-id',
+          metadata: {},
+          clientInfo: {},
+          codeVerifier: 'test-verifier',
+        };
+        const mergedServerConfig = {
+          type: 'streamable-http',
+          url: 'https://override.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+          source: 'config',
+        };
+        const fetchedTools = [{ name: 'search', inputSchema: { type: 'object' } }];
+
+        getLogStores.mockReturnValue({});
+        require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+        MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+        MCPOAuthHandler.completeOAuthFlow.mockResolvedValue({
+          access_token: 'test-token',
+        });
+        MCPTokenStorage.storeTokens.mockResolvedValue();
+        mockRegistryInstance.getServerConfig.mockResolvedValue({});
+        mockResolveAllMcpConfigs.mockResolvedValueOnce({ 'test-server': mergedServerConfig });
+
+        const mockMcpManager = {
+          getUserConnection: jest.fn().mockResolvedValue({
+            fetchTools: jest.fn().mockResolvedValue(fetchedTools),
+          }),
+        };
+        require('~/config').getMCPManager.mockReturnValue(mockMcpManager);
+        require('~/config').getOAuthReconnectionManager.mockReturnValue({
+          clearReconnection: jest.fn(),
+        });
+        const { updateMCPServerTools } = require('~/server/services/Config/mcp');
+        updateMCPServerTools.mockResolvedValue();
+
+        const response = await request(app)
+          .get('/api/mcp/test-server/oauth/callback')
+          .query({ code: 'test-code', state: flowId });
+
+        expect(response.status).toBe(302);
+        expect(mockResolveAllMcpConfigs).toHaveBeenCalledWith('test-user-id');
+        expect(mockMcpManager.getUserConnection).toHaveBeenCalledWith(
+          expect.objectContaining({ serverConfig: mergedServerConfig }),
+        );
+        expect(updateMCPServerTools).toHaveBeenCalledWith({
+          userId: 'test-user-id',
+          serverName: 'test-server',
+          tools: fetchedTools,
+          serverConfig: mergedServerConfig,
+        });
+      });
+
       it('should reject when no PENDING flow exists and no cookies are present', async () => {
         const flowId = 'test-user-id:test-server';
         const mockFlowManager = {
@@ -564,7 +878,7 @@ describe('MCP Routes', () => {
         const mockFlowManager = {
           getFlowState: jest.fn().mockResolvedValue({
             status: 'PENDING',
-            createdAt: Date.now() - 3 * 60 * 1000,
+            createdAt: Date.now() - PENDING_STALE_MS - 60 * 1000,
           }),
         };
 
@@ -674,6 +988,140 @@ describe('MCP Routes', () => {
       );
     });
 
+    it('should clear tenant-scoped token flow state after storing callback tokens', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({ status: 'PENDING' }),
+        completeFlow: jest.fn().mockResolvedValue(),
+        deleteFlow: jest.fn().mockResolvedValue(true),
+      };
+      const mockFlowState = {
+        serverName: 'test-server',
+        userId: 'test-user-id',
+        metadata: {
+          toolFlowId: 'tool-flow-123',
+          token_endpoint: 'https://auth.example.com/token',
+        },
+        resourceMetadata: { resource: 'https://api.example.com/' },
+        clientInfo: {},
+        codeVerifier: 'test-verifier',
+        tenantId: 'tenant-a',
+      };
+      const mockTokens = {
+        access_token: 'test-access-token',
+        refresh_token: 'test-refresh-token',
+      };
+
+      MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+      MCPOAuthHandler.completeOAuthFlow.mockResolvedValue(mockTokens);
+      MCPTokenStorage.storeTokens.mockResolvedValue();
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+      require('~/config').getOAuthReconnectionManager.mockReturnValue({
+        clearReconnection: jest.fn(),
+      });
+      require('~/config').getMCPManager.mockReturnValue({
+        getUserConnection: jest.fn().mockResolvedValue({
+          fetchTools: jest.fn().mockResolvedValue([]),
+        }),
+      });
+      const { getCachedTools, setCachedTools } = require('~/server/services/Config');
+      getCachedTools.mockResolvedValue({});
+      setCachedTools.mockResolvedValue();
+
+      const flowId = 'test-user-id:test-server';
+      const csrfToken = generateTestCsrfToken(flowId);
+
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/callback')
+        .set('Cookie', [`oauth_csrf=${csrfToken}`])
+        .query({
+          code: 'test-auth-code',
+          state: flowId,
+        });
+
+      expect(response.status).toBe(302);
+      expect(MCPTokenStorage.storeTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          metadata: expect.objectContaining({
+            resource: 'https://api.example.com/',
+          }),
+        }),
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(flowId, 'mcp_get_tokens');
+    });
+
+    it('should complete pending token flow waiters after storing callback tokens', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockImplementation((id, type) => {
+          if (type === 'mcp_get_tokens' && id === 'tenant:tenant-a:test-user-id:test-server') {
+            return Promise.resolve({
+              type: 'mcp_get_tokens',
+              status: 'PENDING',
+            });
+          }
+          return Promise.resolve({ status: 'PENDING' });
+        }),
+        completeFlow: jest.fn().mockResolvedValue(true),
+        deleteFlow: jest.fn().mockResolvedValue(true),
+      };
+      const mockFlowState = {
+        serverName: 'test-server',
+        userId: 'test-user-id',
+        metadata: {},
+        clientInfo: {},
+        codeVerifier: 'test-verifier',
+        tenantId: 'tenant-a',
+      };
+      const mockTokens = {
+        access_token: 'fresh-access-token',
+        refresh_token: 'fresh-refresh-token',
+      };
+
+      MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+      MCPOAuthHandler.completeOAuthFlow.mockResolvedValue(mockTokens);
+      MCPTokenStorage.storeTokens.mockResolvedValue();
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+      require('~/config').getOAuthReconnectionManager.mockReturnValue({
+        clearReconnection: jest.fn(),
+      });
+      require('~/config').getMCPManager.mockReturnValue({
+        getUserConnection: jest.fn().mockResolvedValue({
+          fetchTools: jest.fn().mockResolvedValue([]),
+        }),
+      });
+      const { getCachedTools, setCachedTools } = require('~/server/services/Config');
+      getCachedTools.mockResolvedValue({});
+      setCachedTools.mockResolvedValue();
+
+      const flowId = 'test-user-id:test-server';
+      const csrfToken = generateTestCsrfToken(flowId);
+
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/callback')
+        .set('Cookie', [`oauth_csrf=${csrfToken}`])
+        .query({
+          code: 'test-auth-code',
+          state: flowId,
+        });
+
+      expect(response.status).toBe(302);
+      expect(mockFlowManager.completeFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+        mockTokens,
+      );
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(flowId, 'mcp_get_tokens');
+    });
+
     it('should use oauthHeaders from flow state when present', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue({ status: 'PENDING' }),
@@ -1084,6 +1532,49 @@ describe('MCP Routes', () => {
       });
     });
 
+    it('should return tokens for a tenant-prefixed flow owned by the user', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          result: {
+            access_token: 'tenant-access-token',
+          },
+        }),
+      };
+
+      getTenantId.mockReturnValue('tenant-a');
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/tokens/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({
+        tokens: {
+          access_token: 'tenant-access-token',
+        },
+      });
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_oauth',
+      );
+    });
+
+    it('should reject tenant-prefixed token flow access from another tenant', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-b');
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/tokens/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Access denied' });
+    });
+
     it('should return 401 when user is not authenticated', async () => {
       const unauthApp = express();
       unauthApp.use(express.json());
@@ -1176,6 +1667,48 @@ describe('MCP Routes', () => {
       });
     });
 
+    it('should return flow status for a tenant-prefixed flow owned by the user', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          error: null,
+        }),
+      };
+
+      getTenantId.mockReturnValue('tenant-a');
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/status/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({
+        status: 'PENDING',
+        completed: false,
+        failed: false,
+        error: null,
+      });
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_oauth',
+      );
+    });
+
+    it('should reject tenant-prefixed status access from another tenant', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-b');
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/status/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Access denied' });
+    });
+
     it('should return 403 when flowId does not match authenticated user', async () => {
       const response = await request(app).get('/api/mcp/oauth/status/other-user-id:test-server');
 
@@ -1539,6 +2072,7 @@ describe('MCP Routes', () => {
       expect(response.status).toBe(200);
       expect(response.body).toEqual({
         success: true,
+        oauthTimeout: expect.any(Number),
         connectionStatus: {
           server1: {
             connectionState: 'connected',
@@ -1953,6 +2487,16 @@ describe('MCP Routes', () => {
   });
 
   describe('GET /tools', () => {
+    it('should deny MCP tools when user lacks MCP server use permission', async () => {
+      mockMCPUseAllowed = false;
+
+      const response = await request(app).get('/api/mcp/tools');
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ message: 'Forbidden: Insufficient permissions' });
+      expect(mockResolveAllMcpConfigs).not.toHaveBeenCalled();
+    });
+
     it('should continue returning MCP tools when one server cache lookup fails', async () => {
       const { Constants } = require('librechat-data-provider');
       const { logger } = require('@librechat/data-schemas');
@@ -2061,11 +2605,13 @@ describe('MCP Routes', () => {
           type: 'sse',
           url: 'http://server1.com/sse',
           title: 'Server 1',
+          source: 'user',
         },
         'server-2': {
           type: 'sse',
           url: 'http://server2.com/sse',
           title: 'Server 2',
+          source: 'user',
         },
       };
 
@@ -2137,7 +2683,7 @@ describe('MCP Routes', () => {
 
       mockRegistryInstance.addServer.mockResolvedValue({
         serverName: 'test-sse-server',
-        config: validConfig,
+        config: { ...validConfig, source: 'user' },
       });
 
       const response = await request(app).post('/api/mcp/servers').send({ config: validConfig });
@@ -2155,6 +2701,35 @@ describe('MCP Routes', () => {
         }),
         'DB',
         'test-user-id',
+        [],
+      );
+    });
+
+    it('should reserve config-managed server names when creating MCP server', async () => {
+      const validConfig = {
+        type: 'sse',
+        url: 'https://mcp-server.example.com/sse',
+        title: 'Test SSE Server',
+      };
+
+      mockResolveMcpConfigNames.mockResolvedValueOnce(['config_slack']);
+      mockRegistryInstance.addServer.mockResolvedValue({
+        serverName: 'test-sse-server',
+        config: validConfig,
+      });
+
+      const response = await request(app).post('/api/mcp/servers').send({ config: validConfig });
+
+      expect(response.status).toBe(201);
+      expect(mockRegistryInstance.addServer).toHaveBeenCalledWith(
+        'temp_server_name',
+        expect.objectContaining({
+          type: 'sse',
+          url: 'https://mcp-server.example.com/sse',
+        }),
+        'DB',
+        'test-user-id',
+        ['config_slack'],
       );
     });
 
@@ -2286,6 +2861,240 @@ describe('MCP Routes', () => {
       expect(response.status).toBe(500);
       expect(response.body).toEqual({ message: 'Database connection failed' });
     });
+
+    describe('OBO permission gate', () => {
+      const oboConfig = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        title: 'OBO Server',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      };
+      const db = require('~/models');
+
+      beforeEach(() => {
+        currentUser = { id: 'test-user-id', role: 'USER' };
+        mockRegistryInstance.addServer.mockResolvedValue({
+          serverName: 'obo-server',
+          config: oboConfig,
+        });
+      });
+
+      it('rejects POST with obo body when role lacks CONFIGURE_OBO', async () => {
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              SHARE: false,
+              SHARE_PUBLIC: false,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+
+        const response = await request(app).post('/api/mcp/servers').send({ config: oboConfig });
+
+        expect(response.status).toBe(403);
+        expect(response.body.message).toMatch(/Insufficient permissions to configure OBO/);
+        expect(mockRegistryInstance.addServer).not.toHaveBeenCalled();
+      });
+
+      it('allows POST with obo body when role has CONFIGURE_OBO', async () => {
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              SHARE: false,
+              SHARE_PUBLIC: false,
+              CONFIGURE_OBO: true,
+            },
+          },
+        });
+
+        const response = await request(app).post('/api/mcp/servers').send({ config: oboConfig });
+
+        expect(response.status).toBe(201);
+        expect(mockRegistryInstance.addServer).toHaveBeenCalled();
+      });
+
+      it('allows POST without obo body regardless of CONFIGURE_OBO', async () => {
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+
+        const nonOboConfig = {
+          type: 'streamable-http',
+          url: 'https://mcp-server.example.com/mcp',
+          title: 'Plain Server',
+        };
+        mockRegistryInstance.addServer.mockResolvedValue({
+          serverName: 'plain-server',
+          config: nonOboConfig,
+        });
+
+        const response = await request(app).post('/api/mcp/servers').send({ config: nonOboConfig });
+
+        expect(response.status).toBe(201);
+        expect(db.getRoleByName).not.toHaveBeenCalled();
+        expect(mockRegistryInstance.addServer).toHaveBeenCalled();
+      });
+
+      it('rejects PATCH with obo body when role lacks CONFIGURE_OBO', async () => {
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+
+        const response = await request(app)
+          .patch('/api/mcp/servers/obo-server')
+          .send({ config: oboConfig });
+
+        expect(response.status).toBe(403);
+        expect(response.body.message).toMatch(/Insufficient permissions to configure OBO/);
+        expect(mockRegistryInstance.updateServer).not.toHaveBeenCalled();
+      });
+
+      it('allows PATCH without CONFIGURE_OBO when OBO is unchanged', async () => {
+        // Editor without CONFIGURE_OBO should still be able to edit non-OBO fields
+        // (title, URL, description) on an OBO server as long as the OBO block is
+        // re-sent unchanged. Closes the regression where any save of an OBO server
+        // by such a user was rejected even when OBO itself was not being modified.
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+        mockRegistryInstance.getServerConfig.mockResolvedValue({
+          ...oboConfig,
+          obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+        });
+        mockRegistryInstance.updateServer.mockResolvedValue({
+          ...oboConfig,
+          title: 'Renamed OBO Server',
+        });
+
+        const response = await request(app)
+          .patch('/api/mcp/servers/obo-server')
+          .send({
+            config: {
+              ...oboConfig,
+              title: 'Renamed OBO Server',
+              obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+            },
+          });
+
+        expect(response.status).toBe(200);
+        expect(mockRegistryInstance.updateServer).toHaveBeenCalled();
+      });
+
+      it('rejects PATCH that removes OBO from an existing OBO server without CONFIGURE_OBO', async () => {
+        // Closes the silent-downgrade vector: a user with UPDATE but not
+        // CONFIGURE_OBO must not be able to convert an OBO server to non-OBO,
+        // because doing so de-secures the server end-to-end.
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+        mockRegistryInstance.getServerConfig.mockResolvedValue({
+          ...oboConfig,
+          obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+        });
+
+        // Submit body that omits the obo field (auth_type changed away from OBO)
+        const downgradePayload = {
+          type: 'streamable-http',
+          url: 'https://mcp-server.example.com/mcp',
+          title: 'OBO Server',
+        };
+        const response = await request(app)
+          .patch('/api/mcp/servers/obo-server')
+          .send({ config: downgradePayload });
+
+        expect(response.status).toBe(403);
+        expect(response.body.message).toMatch(/Insufficient permissions to configure OBO/);
+        expect(mockRegistryInstance.updateServer).not.toHaveBeenCalled();
+      });
+
+      it('rejects PATCH that redirects the URL of an existing OBO server without CONFIGURE_OBO', async () => {
+        // Closes the OBO redirect vector — the original trust-boundary concern
+        // CONFIGURE_OBO was introduced to address. A user with UPDATE but
+        // without the permission must not be able to point an existing OBO
+        // server at an attacker-controlled endpoint, which would cause OBO
+        // tokens minted for other users to be exfiltrated to that endpoint.
+        // The same allowlist policy also covers `proxy`, `headers`, transport
+        // type, and auth blocks.
+        db.getRoleByName.mockResolvedValue({
+          name: 'USER',
+          permissions: {
+            MCP_SERVERS: {
+              USE: true,
+              CREATE: true,
+              CONFIGURE_OBO: false,
+            },
+          },
+        });
+        mockRegistryInstance.getServerConfig.mockResolvedValue({
+          ...oboConfig,
+          obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+        });
+
+        const redirectPayload = {
+          ...oboConfig,
+          url: 'https://attacker.example.com/mcp',
+          obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+        };
+        const response = await request(app)
+          .patch('/api/mcp/servers/obo-server')
+          .send({ config: redirectPayload });
+
+        expect(response.status).toBe(403);
+        expect(response.body.message).toMatch(/Insufficient permissions to configure OBO/);
+        expect(mockRegistryInstance.updateServer).not.toHaveBeenCalled();
+      });
+    });
+
+    it('should fail closed when config-managed names cannot be resolved', async () => {
+      const validConfig = {
+        type: 'sse',
+        url: 'https://mcp-server.example.com/sse',
+        title: 'Test Server',
+      };
+
+      mockResolveMcpConfigNames.mockRejectedValueOnce(new Error('Config lookup failed'));
+
+      const response = await request(app).post('/api/mcp/servers').send({ config: validConfig });
+
+      expect(response.status).toBe(500);
+      expect(response.body).toEqual({ message: 'Config lookup failed' });
+      expect(mockRegistryInstance.addServer).not.toHaveBeenCalled();
+    });
   });
 
   describe('GET /servers/:serverName', () => {
@@ -2294,6 +3103,7 @@ describe('MCP Routes', () => {
         type: 'sse',
         url: 'https://mcp-server.example.com/sse',
         title: 'Test Server',
+        source: 'user',
       };
 
       mockRegistryInstance.getServerConfig.mockResolvedValue(mockConfig);
@@ -2362,7 +3172,7 @@ describe('MCP Routes', () => {
         description: 'Updated description',
       };
 
-      mockRegistryInstance.updateServer.mockResolvedValue(updatedConfig);
+      mockRegistryInstance.updateServer.mockResolvedValue({ ...updatedConfig, source: 'user' });
 
       const response = await request(app)
         .patch('/api/mcp/servers/test-server')
diff --git a/api/server/routes/__tests__/messages-delete.spec.js b/api/server/routes/__tests__/messages-delete.spec.js
index 714d497719e..36c4e8e9e6a 100644
--- a/api/server/routes/__tests__/messages-delete.spec.js
+++ b/api/server/routes/__tests__/messages-delete.spec.js
@@ -197,3 +197,88 @@ describe('DELETE /:conversationId/:messageId – route handler', () => {
     expect(response.body).toEqual({ error: 'Internal server error' });
   });
 });
+
+describe('message route conversation ownership filters', () => {
+  let app;
+  const { getMessages, saveConvo, saveMessage } = require('~/models');
+
+  const authenticatedUserId = 'user-owner-123';
+
+  beforeAll(() => {
+    const messagesRouter = require('../messages');
+
+    app = express();
+    app.use(express.json());
+    app.use((req, res, next) => {
+      req.user = { id: authenticatedUserId };
+      next();
+    });
+    app.use('/api/messages', messagesRouter);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should save POST messages with the validated URL conversationId', async () => {
+    const urlConversationId = '11111111-1111-4111-8111-111111111111';
+    const bodyConversationId = '22222222-2222-4222-8222-222222222222';
+    const savedMessage = {
+      messageId: 'message-1',
+      conversationId: urlConversationId,
+      text: 'hello',
+      user: authenticatedUserId,
+    };
+
+    saveMessage.mockResolvedValue(savedMessage);
+    saveConvo.mockResolvedValue({ conversationId: urlConversationId });
+
+    const response = await request(app).post(`/api/messages/${urlConversationId}`).send({
+      messageId: savedMessage.messageId,
+      conversationId: bodyConversationId,
+      text: savedMessage.text,
+    });
+
+    expect(response.status).toBe(201);
+    expect(saveMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: authenticatedUserId }),
+      expect.objectContaining({
+        messageId: savedMessage.messageId,
+        conversationId: urlConversationId,
+        text: savedMessage.text,
+        user: authenticatedUserId,
+      }),
+      { context: 'POST /api/messages/:conversationId' },
+    );
+    expect(saveMessage.mock.calls[0][1].conversationId).not.toBe(bodyConversationId);
+    expect(saveConvo).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: authenticatedUserId }),
+      savedMessage,
+      { context: 'POST /api/messages/:conversationId' },
+    );
+  });
+
+  it('should filter conversation message reads by authenticated user', async () => {
+    getMessages.mockResolvedValue([{ messageId: 'message-1', conversationId: 'convo-1' }]);
+
+    const response = await request(app).get('/api/messages/convo-1');
+
+    expect(response.status).toBe(200);
+    expect(getMessages).toHaveBeenCalledWith(
+      { conversationId: 'convo-1', user: authenticatedUserId },
+      '-_id -__v -user',
+    );
+  });
+
+  it('should filter single message reads by authenticated user', async () => {
+    getMessages.mockResolvedValue([{ messageId: 'message-1', conversationId: 'convo-1' }]);
+
+    const response = await request(app).get('/api/messages/convo-1/message-1');
+
+    expect(response.status).toBe(200);
+    expect(getMessages).toHaveBeenCalledWith(
+      { conversationId: 'convo-1', messageId: 'message-1', user: authenticatedUserId },
+      '-_id -__v -user',
+    );
+  });
+});
diff --git a/api/server/routes/__tests__/rum.spec.js b/api/server/routes/__tests__/rum.spec.js
new file mode 100644
index 00000000000..cdd0ec3e761
--- /dev/null
+++ b/api/server/routes/__tests__/rum.spec.js
@@ -0,0 +1,73 @@
+const express = require('express');
+const request = require('supertest');
+
+const mockRequireRumProxyAuth = jest.fn((_req, _res, next) => next());
+const mockIsRumProxyEnabled = jest.fn();
+const mockProxyRumRequest = jest.fn((_req, res) => res.status(202).send());
+
+jest.mock('~/server/middleware', () => ({
+  requireRumProxyAuth: (...args) => mockRequireRumProxyAuth(...args),
+}));
+
+jest.mock('@librechat/api', () => ({
+  getRumProxyBodyLimit: jest.fn(() => '3mb'),
+  isRumProxyEnabled: (...args) => mockIsRumProxyEnabled(...args),
+  proxyRumRequest: (...args) => mockProxyRumRequest(...args),
+}));
+
+describe('RUM proxy routes', () => {
+  let app;
+
+  beforeAll(() => {
+    const rumRouter = require('../rum');
+
+    app = express();
+    app.use('/api/rum', rumRouter);
+  });
+
+  beforeEach(() => {
+    mockRequireRumProxyAuth.mockClear();
+    mockIsRumProxyEnabled.mockReset();
+    mockProxyRumRequest.mockClear();
+  });
+
+  it('returns 404 before auth and proxying when RUM proxy mode is disabled', async () => {
+    mockIsRumProxyEnabled.mockReturnValue(false);
+
+    const response = await request(app)
+      .post('/api/rum/v1/traces')
+      .set('Content-Type', 'application/x-protobuf')
+      .send(Buffer.from('payload'));
+
+    expect(response.status).toBe(404);
+    expect(response.body).toEqual({ message: 'RUM proxy is not configured' });
+    expect(mockRequireRumProxyAuth).not.toHaveBeenCalled();
+    expect(mockProxyRumRequest).not.toHaveBeenCalled();
+  });
+
+  it('authenticates and proxies when RUM proxy mode is enabled', async () => {
+    mockIsRumProxyEnabled.mockReturnValue(true);
+
+    const response = await request(app)
+      .post('/api/rum/v1/traces')
+      .set('Content-Type', 'application/x-protobuf')
+      .send(Buffer.from('payload'));
+
+    expect(response.status).toBe(202);
+    expect(mockRequireRumProxyAuth).toHaveBeenCalledTimes(1);
+    expect(mockProxyRumRequest).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses RUM-specific auth for logs as well as traces', async () => {
+    mockIsRumProxyEnabled.mockReturnValue(true);
+
+    const response = await request(app)
+      .post('/api/rum/v1/logs')
+      .set('Content-Type', 'application/x-protobuf')
+      .send(Buffer.from('payload'));
+
+    expect(response.status).toBe(202);
+    expect(mockRequireRumProxyAuth).toHaveBeenCalledTimes(1);
+    expect(mockProxyRumRequest).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/api/server/routes/__tests__/share.spec.js b/api/server/routes/__tests__/share.spec.js
new file mode 100644
index 00000000000..c9d6cb00373
--- /dev/null
+++ b/api/server/routes/__tests__/share.spec.js
@@ -0,0 +1,737 @@
+const express = require('express');
+const request = require('supertest');
+const mongoose = require('mongoose');
+
+const mockGetSharedLinkExpiration = jest.fn();
+const mockGrantCreationPermissions = jest.fn();
+const mockUpdateSharedLinkPermissionsExpiration = jest.fn();
+const mockSharedLinksAccess = jest.fn((_req, _res, next) => next());
+const mockBuildSharedLinkStartupPayload = jest.fn();
+const mockCanAccessSharedLink = jest.fn((_req, _res, next) => next());
+const mockGetAppConfig = jest.fn();
+const mockGetTenantId = jest.fn(() => undefined);
+
+jest.mock('@librechat/api', () => ({
+  isEnabled: jest.fn(() => true),
+  generateCheckAccess: jest.fn(() => mockSharedLinksAccess),
+  grantCreationPermissions: (...args) => mockGrantCreationPermissions(...args),
+  updateSharedLinkPermissionsExpiration: (...args) =>
+    mockUpdateSharedLinkPermissionsExpiration(...args),
+  ensureLinkPermissions: jest.fn(),
+  isFileSnapshotEnabled: jest.fn(() => true),
+  isFileSnapshotKillSwitchActive: jest.fn(() => false),
+  buildSharedLinkStartupPayload: (...args) => mockBuildSharedLinkStartupPayload(...args),
+  deleteSharedLinkWithCleanup: jest.fn(),
+  getSharedLinkExpiration: (...args) => mockGetSharedLinkExpiration(...args),
+  isActiveExpirationDate: jest.fn((expiredAt) => expiredAt > new Date()),
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { error: jest.fn(), warn: jest.fn() },
+  getTenantId: (...args) => mockGetTenantId(...args),
+  createTempChatExpirationDate: jest.fn(() => new Date('2030-01-01T00:00:00.000Z')),
+  runAsSystem: jest.fn((fn) => fn()),
+  tenantStorage: { run: jest.fn((_ctx, fn) => fn()) },
+  SYSTEM_TENANT_ID: '__SYSTEM__',
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  PermissionTypes: {
+    SHARED_LINKS: 'SHARED_LINKS',
+  },
+  Permissions: {
+    CREATE: 'CREATE',
+    SHARE_PUBLIC: 'SHARE_PUBLIC',
+  },
+  RetentionMode: {
+    ALL: 'all',
+    TEMPORARY: 'temporary',
+  },
+  FileSources: {
+    local: 'local',
+    s3: 's3',
+    cloudfront: 'cloudfront',
+    azure_blob: 'azure_blob',
+    firebase: 'firebase',
+    text: 'text',
+  },
+}));
+
+jest.mock('mongoose', () => ({
+  models: {
+    Conversation: {
+      findOne: jest.fn(),
+    },
+    SharedLink: {
+      findOne: jest.fn(),
+    },
+  },
+}));
+
+jest.mock('~/models', () => ({
+  getFiles: jest.fn(),
+  updateFile: jest.fn(),
+  getSharedMessages: jest.fn(),
+  createSharedLink: jest.fn(),
+  updateSharedLink: jest.fn(),
+  deleteSharedLink: jest.fn(),
+  getSharedLinks: jest.fn(),
+  getSharedLink: jest.fn(),
+  getSharedLinkFile: jest.fn(),
+  backfillSharedLinkFiles: jest.fn(),
+  getRoleByName: jest.fn(),
+}));
+
+const mockGetStrategyFunctions = jest.fn();
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: (...args) => mockGetStrategyFunctions(...args),
+}));
+jest.mock('~/server/utils/files', () => ({
+  cleanFileName: jest.fn((name) => name),
+  getContentDisposition: jest.fn((name, disposition = 'attachment') => `${disposition}; ${name}`),
+}));
+
+jest.mock(
+  '~/server/middleware/canAccessSharedLink',
+  () =>
+    (...args) =>
+      mockCanAccessSharedLink(...args),
+);
+jest.mock('~/server/middleware/optionalShareFileAuth', () => (_req, _res, next) => next());
+jest.mock('~/server/middleware/optionalJwtAuth', () => (req, _res, next) => next());
+jest.mock('~/server/middleware/requireJwtAuth', () => (req, res, next) => next());
+jest.mock('~/server/middleware/config/app', () => (_req, _res, next) => next());
+jest.mock('~/server/services/Config/app', () => ({
+  getAppConfig: (...args) => mockGetAppConfig(...args),
+}));
+
+const { Readable } = require('stream');
+const { RetentionMode } = require('librechat-data-provider');
+const { createTempChatExpirationDate, logger } = require('@librechat/data-schemas');
+const {
+  deleteSharedLinkWithCleanup,
+  isFileSnapshotEnabled,
+  isFileSnapshotKillSwitchActive,
+} = require('@librechat/api');
+const {
+  getFiles,
+  updateFile,
+  getSharedMessages,
+  createSharedLink,
+  updateSharedLink,
+  getSharedLinkFile,
+  backfillSharedLinkFiles,
+  getRoleByName,
+} = require('~/models');
+const shareRouter = require('../share');
+
+const activeExpiration = new Date('2030-01-01T00:00:00.000Z');
+const expiredExpiration = new Date('2020-01-01T00:00:00.000Z');
+
+const lean = (value) => ({
+  lean: jest.fn().mockResolvedValue(value),
+});
+
+const buildApp = ({ retentionMode = RetentionMode.TEMPORARY } = {}) => {
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: 'user-123' };
+    req.config = { interfaceConfig: { retentionMode } };
+    next();
+  });
+  app.use('/api/share', shareRouter);
+  return app;
+};
+
+describe('share routes', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
+    mockGetAppConfig.mockResolvedValue({
+      interfaceConfig: {
+        privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+      },
+    });
+    mockBuildSharedLinkStartupPayload.mockReturnValue({
+      appTitle: 'Shared Chat',
+      bundlerURL: 'https://bundler.example.com',
+      interface: {
+        privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+      },
+    });
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        SHARED_LINKS: {
+          SHARE_PUBLIC: true,
+        },
+      },
+    });
+    mockGrantCreationPermissions.mockResolvedValue(undefined);
+  });
+
+  it('serves shared startup config after shared-link access is granted', async () => {
+    const response = await request(buildApp()).get('/api/share/share-123/config');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['cache-control']).toBe('private, no-store');
+    expect(mockCanAccessSharedLink).toHaveBeenCalled();
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+    expect(mockBuildSharedLinkStartupPayload).toHaveBeenCalledWith({
+      interfaceConfig: {
+        privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+      },
+    });
+    expect(response.body).toEqual({
+      appTitle: 'Shared Chat',
+      bundlerURL: 'https://bundler.example.com',
+      interface: {
+        privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+      },
+    });
+  });
+
+  it('uses tenant-scoped app config for shared startup config when tenant context is present', async () => {
+    mockGetTenantId.mockReturnValue('tenant-abc');
+
+    const response = await request(buildApp()).get('/api/share/share-123/config');
+
+    expect(response.status).toBe(200);
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-abc' });
+  });
+
+  it('uses base app config for shared startup config in system context', async () => {
+    mockGetTenantId.mockReturnValue('__SYSTEM__');
+
+    const response = await request(buildApp()).get('/api/share/share-123/config');
+
+    expect(response.status).toBe(200);
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('prevents successful shared message responses from being cached', async () => {
+    getSharedMessages.mockResolvedValue({ shareId: 'share-123', messages: [] });
+
+    const response = await request(buildApp()).get('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['cache-control']).toBe('private, no-store');
+  });
+
+  it('expires new shares for retained non-temporary conversations', async () => {
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    const response = await request(buildApp())
+      .post('/api/share/convo-123')
+      .send({ targetMessageId: 'msg-123' });
+
+    expect(response.status).toBe(200);
+    expect(mockGetSharedLinkExpiration).toHaveBeenCalledWith(
+      expect.objectContaining({
+        conversationId: 'convo-123',
+        req: expect.objectContaining({ user: { id: 'user-123' } }),
+      }),
+      expect.objectContaining({
+        getConvo: expect.any(Function),
+        createExpirationDate: createTempChatExpirationDate,
+        logger,
+      }),
+    );
+    const [, dependencies] = mockGetSharedLinkExpiration.mock.calls[0];
+    mongoose.models.Conversation.findOne.mockReturnValue(lean({ expiredAt: activeExpiration }));
+    await dependencies.getConvo('user-123', 'convo-123');
+    expect(mongoose.models.Conversation.findOne).toHaveBeenCalledWith(
+      { conversationId: 'convo-123', user: 'user-123' },
+      'isTemporary expiredAt',
+    );
+    expect(createSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'convo-123',
+      'msg-123',
+      new Date('2030-01-01T00:00:00.000Z'),
+      true,
+    );
+    expect(mockGrantCreationPermissions).toHaveBeenCalledWith(
+      'link-123',
+      'user-123',
+      true,
+      new Date('2030-01-01T00:00:00.000Z'),
+    );
+    expect(mockSharedLinksAccess).toHaveBeenCalled();
+  });
+
+  it('snapshots files by default when the user does not opt out', async () => {
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    await request(buildApp()).post('/api/share/convo-123').send({ targetMessageId: 'msg-123' });
+
+    expect(createSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'convo-123',
+      'msg-123',
+      expect.anything(),
+      true,
+    );
+  });
+
+  it('does not snapshot files when the user opts out (snapshotFiles=false)', async () => {
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    await request(buildApp())
+      .post('/api/share/convo-123')
+      .send({ targetMessageId: 'msg-123', snapshotFiles: false });
+
+    expect(createSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'convo-123',
+      'msg-123',
+      expect.anything(),
+      false,
+    );
+  });
+
+  it('forces snapshotFiles=false when the feature is disabled, ignoring the body flag', async () => {
+    isFileSnapshotEnabled.mockReturnValueOnce(false);
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    await request(buildApp())
+      .post('/api/share/convo-123')
+      .send({ targetMessageId: 'msg-123', snapshotFiles: true });
+
+    expect(createSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'convo-123',
+      'msg-123',
+      expect.anything(),
+      false,
+    );
+  });
+
+  it('passes the snapshotFiles opt-out through on update', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
+
+    await request(buildApp()).patch('/api/share/share-123').send({ snapshotFiles: false });
+
+    expect(updateSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'share-123',
+      undefined,
+      expect.anything(),
+      false,
+    );
+  });
+
+  it('rejects new shares when the retained conversation expired', async () => {
+    mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    const response = await request(buildApp())
+      .post('/api/share/convo-123')
+      .send({ targetMessageId: 'msg-123' });
+
+    expect(response.status).toBe(404);
+    expect(createSharedLink).not.toHaveBeenCalled();
+  });
+
+  it('rejects new shares for expired conversations in all retention mode', async () => {
+    mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
+
+    const response = await request(buildApp({ retentionMode: RetentionMode.ALL }))
+      .post('/api/share/convo-123')
+      .send({ targetMessageId: 'msg-123' });
+
+    expect(response.status).toBe(404);
+    expect(createSharedLink).not.toHaveBeenCalled();
+  });
+
+  it('expires updated shares for retained non-temporary conversations', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
+
+    const response = await request(buildApp()).patch('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(mongoose.models.SharedLink.findOne).toHaveBeenCalledWith(
+      { shareId: 'share-123', user: 'user-123' },
+      'conversationId',
+    );
+    expect(mockGetSharedLinkExpiration).toHaveBeenCalledTimes(1);
+    expect(mockGetSharedLinkExpiration).toHaveBeenCalledWith(
+      expect.objectContaining({
+        conversationId: 'convo-123',
+        req: expect.objectContaining({ user: { id: 'user-123' } }),
+      }),
+      expect.objectContaining({
+        getConvo: expect.any(Function),
+        createExpirationDate: createTempChatExpirationDate,
+        logger,
+      }),
+    );
+    expect(updateSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'share-123',
+      undefined,
+      new Date('2030-01-01T00:00:00.000Z'),
+      true,
+    );
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith(
+      'link-456',
+      new Date('2030-01-01T00:00:00.000Z'),
+    );
+  });
+
+  it('rejects updated shares when the retained conversation expired', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
+    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+
+    const response = await request(buildApp()).patch('/api/share/share-123');
+
+    expect(response.status).toBe(404);
+    expect(updateSharedLink).not.toHaveBeenCalled();
+  });
+
+  it('rejects updated shares for expired conversations in all retention mode', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
+    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+
+    const response = await request(buildApp({ retentionMode: RetentionMode.ALL })).patch(
+      '/api/share/share-123',
+    );
+
+    expect(response.status).toBe(404);
+    expect(mongoose.models.SharedLink.findOne).toHaveBeenCalledWith(
+      { shareId: 'share-123', user: 'user-123' },
+      'conversationId',
+    );
+    expect(updateSharedLink).not.toHaveBeenCalled();
+  });
+
+  it('clears updated share expiration when the conversation is no longer retained', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(null);
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
+
+    const response = await request(buildApp()).patch('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(updateSharedLink).toHaveBeenCalledWith('user-123', 'share-123', undefined, null, true);
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith('link-456', null);
+    expect(mockSharedLinksAccess).not.toHaveBeenCalled();
+  });
+
+  it('preserves updated share expiration when the conversation cannot be found', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(undefined);
+    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+
+    const response = await request(buildApp()).patch('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(updateSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'share-123',
+      undefined,
+      undefined,
+      true,
+    );
+    expect(mockUpdateSharedLinkPermissionsExpiration).not.toHaveBeenCalled();
+  });
+
+  it('clears updated share expiration when creating a new expiration throws', async () => {
+    const error = new Error('bad config');
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockImplementationOnce(async (_input, dependencies) => {
+      dependencies.logger.error('[getSharedLinkExpiration] Error creating expiration date:', error);
+      return null;
+    });
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
+
+    const response = await request(buildApp()).patch('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(logger.error).toHaveBeenCalledWith(
+      '[getSharedLinkExpiration] Error creating expiration date:',
+      error,
+    );
+    expect(updateSharedLink).toHaveBeenCalledWith('user-123', 'share-123', undefined, null, true);
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith('link-456', null);
+  });
+
+  it('updates share target message while applying retention expiration', async () => {
+    mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
+    mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
+    updateSharedLink.mockResolvedValue({ shareId: 'share-456', targetMessageId: 'msg-456' });
+
+    const response = await request(buildApp())
+      .patch('/api/share/share-123')
+      .send({ targetMessageId: 'msg-456' });
+
+    expect(response.status).toBe(200);
+    expect(updateSharedLink).toHaveBeenCalledWith(
+      'user-123',
+      'share-123',
+      'msg-456',
+      new Date('2030-01-01T00:00:00.000Z'),
+      true,
+    );
+  });
+
+  it('rejects non-string target message updates', async () => {
+    const response = await request(buildApp())
+      .patch('/api/share/share-123')
+      .send({ targetMessageId: 123 });
+
+    expect(response.status).toBe(400);
+    expect(updateSharedLink).not.toHaveBeenCalled();
+  });
+
+  it('allows deleting existing shares without CREATE permission gate', async () => {
+    deleteSharedLinkWithCleanup.mockResolvedValue({ shareId: 'share-123' });
+
+    const response = await request(buildApp()).delete('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(mockSharedLinksAccess).not.toHaveBeenCalled();
+    expect(deleteSharedLinkWithCleanup).toHaveBeenCalledWith('user-123', 'share-123');
+  });
+});
+
+describe('share-scoped file routes', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetStrategyFunctions.mockReturnValue({
+      getDownloadStream: jest.fn(async () => Readable.from(['file-bytes'])),
+    });
+    // Live file record present by default (resolveShareFile requires it).
+    getFiles.mockResolvedValue([{ status: 'ready' }]);
+  });
+
+  it('serves a snapshotted image inline from its original stored object', async () => {
+    const getDownloadStream = jest.fn(async () => Readable.from(['file-bytes']));
+    mockGetStrategyFunctions.mockReturnValue({ getDownloadStream });
+    getSharedLinkFile.mockResolvedValue({
+      file: {
+        file_id: 'file-1',
+        source: 'local',
+        filepath: '/images/owner/pic.png',
+        type: 'image/png',
+        filename: 'pic.png',
+      },
+      hasSnapshots: true,
+    });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['content-type']).toContain('image/png');
+    expect(response.headers['x-content-type-options']).toBe('nosniff');
+    expect(response.headers['content-disposition']).toContain('inline');
+    expect(mockGetStrategyFunctions).toHaveBeenCalledWith('local');
+    expect(getDownloadStream).toHaveBeenCalledWith(expect.anything(), '/images/owner/pic.png');
+    expect(backfillSharedLinkFiles).not.toHaveBeenCalled();
+  });
+
+  it('forces attachment for unsafe inline types (no stored XSS)', async () => {
+    const getDownloadStream = jest.fn(async () => Readable.from(['<svg/>']));
+    mockGetStrategyFunctions.mockReturnValue({ getDownloadStream });
+    getSharedLinkFile.mockResolvedValue({
+      file: {
+        file_id: 'file-1',
+        source: 'local',
+        filepath: '/uploads/owner/evil.svg',
+        type: 'image/svg+xml',
+        filename: 'evil.svg',
+      },
+      hasSnapshots: true,
+    });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['content-type']).toContain('application/octet-stream');
+    expect(response.headers['content-disposition']).toContain('attachment');
+    expect(response.headers['x-content-type-options']).toBe('nosniff');
+  });
+
+  it('downloads a snapshotted file as an attachment', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: {
+        file_id: 'file-1',
+        source: 'local',
+        filepath: '/uploads/owner/file-1',
+        type: 'application/pdf',
+        filename: 'report.pdf',
+      },
+      hasSnapshots: true,
+    });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1/download');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['content-disposition']).toContain('attachment');
+  });
+
+  it('returns preview status read live from the file record', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: { file_id: 'file-1', source: 'local' },
+      hasSnapshots: true,
+    });
+    getFiles.mockResolvedValue([{ status: 'ready', text: 'extracted text', textFormat: 'text' }]);
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1/preview');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({
+      file_id: 'file-1',
+      status: 'ready',
+      text: 'extracted text',
+      textFormat: 'text',
+    });
+    expect(getFiles).toHaveBeenCalledWith({ file_id: 'file-1' }, null, {});
+  });
+
+  it('404s for a file not in the snapshot without rebuilding it', async () => {
+    getSharedLinkFile.mockResolvedValue({ file: null, hasSnapshots: true });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/not-shared');
+
+    expect(response.status).toBe(404);
+    expect(backfillSharedLinkFiles).not.toHaveBeenCalled();
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('lazily backfills only a legacy share that has no snapshot field', async () => {
+    getSharedLinkFile.mockResolvedValue({ file: null, hasSnapshots: false });
+    backfillSharedLinkFiles.mockResolvedValue({
+      file_id: 'file-1',
+      source: 'local',
+      filepath: '/images/owner/pic.png',
+      type: 'image/png',
+      filename: 'pic.png',
+    });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(200);
+    expect(backfillSharedLinkFiles).toHaveBeenCalledWith('share-123', 'file-1');
+  });
+
+  it('404s cleanly when the snapshotted file is no longer available', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: { file_id: 'file-1', source: 'local', filepath: '/uploads/owner/gone.pdf' },
+      hasSnapshots: true,
+    });
+    getFiles.mockResolvedValue([]); // original record deleted/expired
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(404);
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('404s (no serving) when the global kill switch is active', async () => {
+    isFileSnapshotKillSwitchActive.mockReturnValueOnce(true);
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(404);
+    expect(getSharedLinkFile).not.toHaveBeenCalled();
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('404s (no serving, no backfill) for a link that opted out of file sharing', async () => {
+    getSharedLinkFile.mockResolvedValue({ file: null, hasSnapshots: false, optedOut: true });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(404);
+    expect(backfillSharedLinkFiles).not.toHaveBeenCalled();
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('404s when the snapshotted file version was overwritten (revision mismatch)', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: {
+        file_id: 'file-1',
+        source: 'local',
+        filepath: '/uploads/owner/x',
+        previewRevision: 'r1',
+      },
+      hasSnapshots: true,
+    });
+    getFiles.mockResolvedValue([{ status: 'ready', previewRevision: 'r2' }]);
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(404);
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('404s when the snapshotted file was overwritten (size/bytes mismatch)', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: { file_id: 'file-1', source: 'local', filepath: '/uploads/owner/x', bytes: 100 },
+      hasSnapshots: true,
+    });
+    getFiles.mockResolvedValue([{ status: 'ready', bytes: 200 }]);
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(404);
+    expect(mockGetStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('strips a cache-busting query string before local streaming', async () => {
+    const getDownloadStream = jest.fn(async () => Readable.from(['bytes']));
+    mockGetStrategyFunctions.mockReturnValue({ getDownloadStream });
+    getSharedLinkFile.mockResolvedValue({
+      file: {
+        file_id: 'file-1',
+        source: 'local',
+        filepath: '/images/owner/pic.png?v=2',
+        type: 'image/png',
+        filename: 'pic.png',
+        bytes: 100,
+      },
+      hasSnapshots: true,
+    });
+    getFiles.mockResolvedValue([{ status: 'ready', bytes: 100 }]);
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1');
+
+    expect(response.status).toBe(200);
+    expect(getDownloadStream).toHaveBeenCalledWith(expect.anything(), '/images/owner/pic.png');
+  });
+
+  it('sweeps an orphaned pending preview to failed', async () => {
+    getSharedLinkFile.mockResolvedValue({
+      file: { file_id: 'file-1', source: 'local' },
+      hasSnapshots: true,
+    });
+    const stale = new Date(Date.now() - 5 * 60 * 1000);
+    getFiles.mockResolvedValue([{ status: 'pending', updatedAt: stale }]);
+    updateFile.mockResolvedValue({ status: 'failed', previewError: 'orphaned' });
+
+    const response = await request(buildApp()).get('/api/share/share-123/files/file-1/preview');
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({
+      file_id: 'file-1',
+      status: 'failed',
+      previewError: 'orphaned',
+    });
+    expect(updateFile).toHaveBeenCalledWith(
+      { file_id: 'file-1', status: 'failed', previewError: 'orphaned' },
+      { status: 'pending', updatedAt: stale },
+    );
+  });
+});
diff --git a/api/server/routes/accessPermissions.js b/api/server/routes/accessPermissions.js
index e53d0ef1a77..6ef731daba7 100644
--- a/api/server/routes/accessPermissions.js
+++ b/api/server/routes/accessPermissions.js
@@ -1,5 +1,11 @@
+const mongoose = require('mongoose');
 const express = require('express');
-const { ResourceType, PermissionBits } = require('librechat-data-provider');
+const {
+  AccessRoleIds,
+  PrincipalType,
+  ResourceType,
+  PermissionBits,
+} = require('librechat-data-provider');
 const {
   getUserEffectivePermissions,
   getAllEffectivePermissions,
@@ -82,6 +88,12 @@ const checkResourcePermissionAccess = (requiredPermission) => (req, res, next) =
       resourceIdParam: 'resourceId',
       idResolver: getSkillById,
     });
+  } else if (resourceType === ResourceType.SHARED_LINK) {
+    middleware = canAccessResource({
+      resourceType: ResourceType.SHARED_LINK,
+      requiredPermission,
+      resourceIdParam: 'resourceId',
+    });
   } else {
     return res.status(400).json({
       error: 'Bad Request',
@@ -93,6 +105,57 @@ const checkResourcePermissionAccess = (requiredPermission) => (req, res, next) =
   middleware(req, res, next);
 };
 
+const rejectSharedLinkOwnerPermissionChanges = async (req, res, next) => {
+  if (req.params.resourceType !== ResourceType.SHARED_LINK) {
+    return next();
+  }
+
+  const updated = Array.isArray(req.body?.updated) ? req.body.updated : [];
+  const removed = Array.isArray(req.body?.removed) ? req.body.removed : [];
+  const grantsOwner = updated.some(
+    (principal) => principal?.accessRoleId === AccessRoleIds.SHARED_LINK_OWNER,
+  );
+  const grantsPublicOwner = req.body?.publicAccessRoleId === AccessRoleIds.SHARED_LINK_OWNER;
+
+  if (grantsOwner || grantsPublicOwner) {
+    return res.status(400).json({
+      error: 'Bad Request',
+      message: 'Shared link owner permissions cannot be changed',
+    });
+  }
+
+  const userMutations = [...updated, ...removed].filter(
+    (principal) => principal?.type === PrincipalType.USER && principal?.id,
+  );
+
+  if (userMutations.length === 0) {
+    return next();
+  }
+
+  try {
+    const SharedLink = mongoose.models.SharedLink;
+    const link = await SharedLink.findById(req.params.resourceId, 'user').lean();
+    const ownerId = link?.user?.toString();
+    const touchesOwner = ownerId
+      ? userMutations.some((principal) => principal.id?.toString() === ownerId)
+      : false;
+
+    if (touchesOwner) {
+      return res.status(400).json({
+        error: 'Bad Request',
+        message: 'Shared link owner permissions cannot be changed',
+      });
+    }
+  } catch (_error) {
+    return res.status(500).json({
+      error: 'Internal Server Error',
+      message: 'Failed to validate shared link owner permissions',
+    });
+  }
+
+  return next();
+};
+
 /**
  * GET /api/permissions/{resourceType}/{resourceId}
  * Get all permissions for a specific resource
@@ -115,6 +178,7 @@ router.put(
   checkResourcePermissionAccess(PermissionBits.SHARE),
   checkShareAccess,
   checkSharePublicAccess,
+  rejectSharedLinkOwnerPermissionChanges,
   updateResourcePermissions,
 );
 
diff --git a/api/server/routes/accessPermissions.sharePolicy.test.js b/api/server/routes/accessPermissions.sharePolicy.test.js
index 0fc7a90deac..ed17a044529 100644
--- a/api/server/routes/accessPermissions.sharePolicy.test.js
+++ b/api/server/routes/accessPermissions.sharePolicy.test.js
@@ -30,6 +30,7 @@ jest.mock('~/server/controllers/PermissionsController', () => ({
 
 const express = require('express');
 const request = require('supertest');
+const mongoose = require('mongoose');
 const {
   SystemRoles,
   ResourceType,
@@ -48,6 +49,8 @@ const { getRoleByName } = require('~/models');
 
 describe('Access permissions share policy', () => {
   let app;
+  const mockSharedLinkFindById = jest.fn();
+  const originalSharedLinkModel = mongoose.models.SharedLink;
 
   const resourceId = '507f1f77bcf86cd799439011';
   const sharePolicyCases = [
@@ -116,8 +119,30 @@ describe('Access permissions share policy', () => {
     accessRoleId,
   });
 
+  const allowSharedLinkSharing = () => {
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: true,
+        },
+      },
+    });
+  };
+
+  const mockSharedLinkOwner = (ownerId = 'owner-user') => {
+    mockSharedLinkFindById.mockReturnValue({
+      lean: jest.fn().mockResolvedValue({ user: ownerId }),
+    });
+  };
+
   beforeEach(() => {
     jest.clearAllMocks();
+    if (mongoose.models.SharedLink) {
+      mongoose.models.SharedLink.findById = mockSharedLinkFindById;
+    } else {
+      mongoose.models.SharedLink = { findById: mockSharedLinkFindById };
+    }
     hasCapability.mockResolvedValue(false);
 
     app = express();
@@ -129,6 +154,14 @@ describe('Access permissions share policy', () => {
     app.use('/api/permissions', accessPermissionsRouter);
   });
 
+  afterAll(() => {
+    if (originalSharedLinkModel) {
+      mongoose.models.SharedLink = originalSharedLinkModel;
+    } else {
+      delete mongoose.models.SharedLink;
+    }
+  });
+
   it.each(sharePolicyCases)(
     'blocks non-public $label sharing when ACL SHARE passes but role SHARE is disabled',
     async ({ resourceType, permissionType, accessRoleId, middlewareOptions }) => {
@@ -208,4 +241,80 @@ describe('Access permissions share policy', () => {
     });
     expect(updateResourcePermissions).not.toHaveBeenCalled();
   });
+
+  it('blocks granting shared-link owner through generic permission updates', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner();
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [
+          {
+            type: PrincipalType.USER,
+            id: 'target-user',
+            accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+          },
+        ],
+        public: false,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+  });
+
+  it('blocks granting shared-link owner to the public principal', async () => {
+    allowSharedLinkSharing();
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        public: true,
+        publicAccessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+    expect(mockSharedLinkFindById).not.toHaveBeenCalled();
+  });
+
+  it('blocks removing the canonical shared-link owner', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner('owner-user');
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [],
+        removed: [{ type: PrincipalType.USER, id: 'owner-user' }],
+        public: false,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+  });
+
+  it('allows viewer grants for non-owner shared-link users', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner('owner-user');
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [
+          {
+            type: PrincipalType.USER,
+            id: 'target-user',
+            accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+          },
+        ],
+        public: false,
+      });
+
+    expect(response.status).toBe(200);
+    expect(updateResourcePermissions).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/api/server/routes/actions.js b/api/server/routes/actions.js
index 806edc66cc6..d9a2f2f7fad 100644
--- a/api/server/routes/actions.js
+++ b/api/server/routes/actions.js
@@ -14,7 +14,7 @@ const {
 } = require('@librechat/api');
 const { findToken, updateToken, createToken } = require('~/models');
 const { requireJwtAuth } = require('~/server/middleware');
-const { getFlowStateManager } = require('~/config');
+const { getActionFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const router = express.Router();
@@ -56,7 +56,7 @@ router.get('/:action_id/oauth/callback', async (req, res) => {
   const { action_id } = req.params;
   const { code, state } = req.query;
   const flowsCache = getLogStores(CacheKeys.FLOWS);
-  const flowManager = getFlowStateManager(flowsCache);
+  const flowManager = getActionFlowStateManager(flowsCache);
   const basePath = getBasePath();
   let identifier = action_id;
   try {
@@ -107,6 +107,7 @@ router.get('/:action_id/oauth/callback', async (req, res) => {
         client_url: flowState.metadata.client_url,
         redirect_uri: flowState.metadata.redirect_uri,
         token_exchange_method: flowState.metadata.token_exchange_method,
+        allowedAddresses: flowState.metadata.allowedAddresses,
         /** Encrypted values */
         encrypted_oauth_client_id: flowState.metadata.encrypted_oauth_client_id,
         encrypted_oauth_client_secret: flowState.metadata.encrypted_oauth_client_secret,
diff --git a/api/server/routes/admin/audit.js b/api/server/routes/admin/audit.js
new file mode 100644
index 00000000000..7332f8296a0
--- /dev/null
+++ b/api/server/routes/admin/audit.js
@@ -0,0 +1,35 @@
+const express = require('express');
+const { createAdminAuditLogHandlers } = require('@librechat/api');
+const { SystemCapabilities } = require('@librechat/data-schemas');
+const { requireCapability } = require('~/server/middleware/roles/capabilities');
+const { requireJwtAuth } = require('~/server/middleware');
+const db = require('~/models');
+
+const router = express.Router();
+
+const requireAdminAccess = requireCapability(SystemCapabilities.ACCESS_ADMIN);
+const requireAuditLogRead = requireCapability(SystemCapabilities.READ_AUDIT_LOG);
+
+const handlers = createAdminAuditLogHandlers({
+  listAuditLogPage: db.listAuditLogPage,
+  findAuditLogEntry: db.findAuditLogEntry,
+  streamAuditLogEntries: db.streamAuditLogEntries,
+  verifyAuditChain: db.verifyAuditChain,
+});
+
+/**
+ * `ACCESS_ADMIN` gates entry to the admin surface; `READ_AUDIT_LOG` then gates
+ * this specific feature within that surface. The two capabilities are
+ * independent in `CapabilityImplications`, so a role delegated only
+ * `READ_AUDIT_LOG` without `ACCESS_ADMIN` would otherwise bypass the admin
+ * boundary on this router — every other admin router enforces the same pair.
+ */
+router.use(requireJwtAuth, requireAdminAccess, requireAuditLogRead);
+
+router.get('/', handlers.listAuditLog);
+/** Literal sub-paths MUST precede `/:id` so they aren't matched as `{ id }`. */
+router.get('/export.csv', handlers.exportAuditLogCsv);
+router.get('/verify', handlers.verifyAuditLog);
+router.get('/:id', handlers.getAuditLogEntry);
+
+module.exports = router;
diff --git a/api/server/routes/admin/config.js b/api/server/routes/admin/config.js
index 0632077ea97..ab7aa01a2bd 100644
--- a/api/server/routes/admin/config.js
+++ b/api/server/routes/admin/config.js
@@ -2,6 +2,7 @@ const express = require('express');
 const { createAdminConfigHandlers } = require('@librechat/api');
 const { SystemCapabilities } = require('@librechat/data-schemas');
 const {
+  hasCapability,
   hasConfigCapability,
   requireCapability,
 } = require('~/server/middleware/roles/capabilities');
@@ -18,10 +19,12 @@ const handlers = createAdminConfigHandlers({
   findConfigByPrincipal: db.findConfigByPrincipal,
   upsertConfig: db.upsertConfig,
   patchConfigFields: db.patchConfigFields,
+  tombstoneConfigField: db.tombstoneConfigField,
   unsetConfigField: db.unsetConfigField,
   deleteConfig: db.deleteConfig,
   toggleConfigActive: db.toggleConfigActive,
   hasConfigCapability,
+  hasCapability,
   getAppConfig,
   invalidateConfigCaches,
 });
@@ -33,6 +36,7 @@ router.get('/base', handlers.getBaseConfig);
 router.get('/:principalType/:principalId', handlers.getConfig);
 router.put('/:principalType/:principalId', handlers.upsertConfigOverrides);
 router.patch('/:principalType/:principalId/fields', handlers.patchConfigField);
+router.post('/:principalType/:principalId/fields/tombstone', handlers.tombstoneConfigField);
 router.delete('/:principalType/:principalId/fields', handlers.deleteConfigField);
 router.delete('/:principalType/:principalId', handlers.deleteConfigOverrides);
 router.patch('/:principalType/:principalId/active', handlers.toggleConfig);
diff --git a/api/server/routes/admin/grants.js b/api/server/routes/admin/grants.js
index a0fa73dc430..f48c3ddd608 100644
--- a/api/server/routes/admin/grants.js
+++ b/api/server/routes/admin/grants.js
@@ -21,6 +21,9 @@ const handlers = createAdminGrantsHandlers({
   getHeldCapabilities: db.getHeldCapabilities,
   getCachedPrincipals,
   checkRoleExists: async (name) => (await db.getRoleByName(name)) != null,
+  recordAuditEntry: db.recordAuditEntry,
+  /** Opt-in: fail the grant request if its audit entry can't be persisted. */
+  auditFailClosed: process.env.AUDIT_LOG_FAIL_CLOSED === 'true',
 });
 
 router.use(requireJwtAuth, requireAdminAccess);
diff --git a/api/server/routes/admin/roles.js b/api/server/routes/admin/roles.js
index f2bbd7f7ea3..5c6d4e92e8b 100644
--- a/api/server/routes/admin/roles.js
+++ b/api/server/routes/admin/roles.js
@@ -29,6 +29,7 @@ const handlers = createAdminRolesHandlers({
   deleteConfig: db.deleteConfig,
   deleteAclEntries: db.deleteAclEntries,
   deleteGrantsForPrincipal: db.deleteGrantsForPrincipal,
+  recordAuditEntry: db.recordAuditEntry,
 });
 
 router.use(requireJwtAuth, requireAdminAccess);
diff --git a/api/server/routes/admin/skills.js b/api/server/routes/admin/skills.js
new file mode 100644
index 00000000000..54e54004ff2
--- /dev/null
+++ b/api/server/routes/admin/skills.js
@@ -0,0 +1,50 @@
+const express = require('express');
+const { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } = require('@librechat/api');
+const { SystemCapabilities } = require('@librechat/data-schemas');
+const { hasCapability, requireCapability } = require('~/server/middleware/roles/capabilities');
+const { requireJwtAuth } = require('~/server/middleware');
+const { upsertSkillSyncCredential, deleteSkillSyncCredential } = require('~/models');
+const { getGitHubSkillSyncRunnerForRequest } = require('~/server/services/Skills/sync');
+const { getAppConfig } = require('~/server/services/Config');
+const configMiddleware = require('~/server/middleware/config/app');
+
+const router = express.Router();
+const requireAdminAccess = requireCapability(SystemCapabilities.ACCESS_ADMIN);
+
+const syncAccess = createAdminSkillsSyncAccess({
+  getAppConfig,
+  hasCapability,
+});
+
+const handlers = createAdminSkillsSyncHandlers({
+  getRunner: getGitHubSkillSyncRunnerForRequest,
+  upsertCredential: upsertSkillSyncCredential,
+  deleteCredential: deleteSkillSyncCredential,
+});
+
+router.use(
+  requireJwtAuth,
+  requireAdminAccess,
+  configMiddleware,
+  syncAccess.attachBaseSkillSyncConfig,
+);
+
+router.get(
+  '/sync/status',
+  syncAccess.requireReadSkills,
+  syncAccess.attachCredentialReadAccess,
+  handlers.getSyncStatus,
+);
+router.post('/sync/run', syncAccess.requireSyncRunCapability, handlers.runSync);
+router.put(
+  '/sync/credentials/:credentialKey',
+  syncAccess.requirePlatformManageSkills,
+  handlers.setCredential,
+);
+router.delete(
+  '/sync/credentials/:credentialKey',
+  syncAccess.requirePlatformManageSkills,
+  handlers.deleteCredential,
+);
+
+module.exports = router;
diff --git a/api/server/routes/admin/skills.test.js b/api/server/routes/admin/skills.test.js
new file mode 100644
index 00000000000..f452d6ea212
--- /dev/null
+++ b/api/server/routes/admin/skills.test.js
@@ -0,0 +1,119 @@
+const express = require('express');
+const request = require('supertest');
+
+const mockRequireJwtAuth = jest.fn((req, res, next) => {
+  req.user = { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' };
+  next();
+});
+const mockCapabilityMiddleware = jest.fn((req, res, next) => next());
+const mockRequireCapability = jest.fn(() => mockCapabilityMiddleware);
+const mockHasCapability = jest.fn().mockResolvedValue(true);
+const mockConfigMiddleware = jest.fn((req, res, next) => {
+  req.config = { skillSync: { github: { enabled: false, sources: [] } } };
+  next();
+});
+const mockGetAppConfig = jest.fn();
+const mockGetGitHubSkillSyncRunnerForRequest = jest.fn();
+const mockHandlers = {
+  getSyncStatus: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  runSync: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  setCredential: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  deleteCredential: jest.fn((req, res) => res.status(200).json({ ok: true })),
+};
+const mockSyncAccess = {
+  attachBaseSkillSyncConfig: jest.fn((req, res, next) => next()),
+  requireReadSkills: jest.fn((req, res, next) => next()),
+  attachCredentialReadAccess: jest.fn((req, res, next) => next()),
+  requireSyncRunCapability: jest.fn((req, res, next) => next()),
+  requirePlatformManageSkills: jest.fn((req, res, next) => next()),
+};
+
+jest.mock('@librechat/data-schemas', () => ({
+  SystemCapabilities: {
+    ACCESS_ADMIN: 'access:admin',
+  },
+}));
+
+jest.mock('@librechat/api', () => ({
+  createAdminSkillsSyncAccess: jest.fn(() => mockSyncAccess),
+  createAdminSkillsSyncHandlers: jest.fn(() => mockHandlers),
+}));
+
+jest.mock('~/server/middleware/roles/capabilities', () => ({
+  hasCapability: mockHasCapability,
+  requireCapability: mockRequireCapability,
+}));
+
+jest.mock('~/server/middleware', () => ({
+  requireJwtAuth: mockRequireJwtAuth,
+}));
+
+jest.mock('~/server/middleware/config/app', () => mockConfigMiddleware);
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: mockGetAppConfig,
+}));
+
+jest.mock('~/models', () => ({
+  upsertSkillSyncCredential: jest.fn(),
+  deleteSkillSyncCredential: jest.fn(),
+}));
+
+jest.mock('~/server/services/Skills/sync', () => ({
+  getGitHubSkillSyncRunnerForRequest: mockGetGitHubSkillSyncRunnerForRequest,
+}));
+
+describe('admin skills sync routes', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function createApp() {
+    delete require.cache[require.resolve('./skills')];
+    const router = require('./skills');
+    const app = express();
+    app.use(express.json());
+    app.use('/api/admin/skills', router);
+    return app;
+  }
+
+  it('delegates skill sync access policy to the API package', async () => {
+    const app = createApp();
+
+    await request(app).get('/api/admin/skills/sync/status').expect(200);
+
+    const {
+      createAdminSkillsSyncAccess,
+      createAdminSkillsSyncHandlers,
+    } = require('@librechat/api');
+    expect(mockRequireCapability).toHaveBeenCalledWith('access:admin');
+    expect(createAdminSkillsSyncAccess).toHaveBeenCalledWith({
+      getAppConfig: mockGetAppConfig,
+      hasCapability: mockHasCapability,
+    });
+    expect(createAdminSkillsSyncHandlers).toHaveBeenCalledWith(
+      expect.objectContaining({ getRunner: mockGetGitHubSkillSyncRunnerForRequest }),
+    );
+    expect(mockRequireJwtAuth).toHaveBeenCalled();
+    expect(mockCapabilityMiddleware).toHaveBeenCalled();
+    expect(mockConfigMiddleware).toHaveBeenCalled();
+    expect(mockSyncAccess.attachBaseSkillSyncConfig).toHaveBeenCalled();
+    expect(mockSyncAccess.requireReadSkills).toHaveBeenCalled();
+    expect(mockSyncAccess.attachCredentialReadAccess).toHaveBeenCalled();
+    expect(mockHandlers.getSyncStatus).toHaveBeenCalled();
+  });
+
+  it('mounts package access middlewares before each sync endpoint handler', async () => {
+    const app = createApp();
+
+    await request(app).post('/api/admin/skills/sync/run').expect(200);
+    await request(app).put('/api/admin/skills/sync/credentials/default').send({}).expect(200);
+    await request(app).delete('/api/admin/skills/sync/credentials/default').expect(200);
+
+    expect(mockSyncAccess.requireSyncRunCapability).toHaveBeenCalled();
+    expect(mockHandlers.runSync).toHaveBeenCalled();
+    expect(mockSyncAccess.requirePlatformManageSkills).toHaveBeenCalledTimes(2);
+    expect(mockHandlers.setCredential).toHaveBeenCalled();
+    expect(mockHandlers.deleteCredential).toHaveBeenCalled();
+  });
+});
diff --git a/api/server/routes/agents/__tests__/abort.spec.js b/api/server/routes/agents/__tests__/abort.spec.js
index 442665d9737..418c5f42549 100644
--- a/api/server/routes/agents/__tests__/abort.spec.js
+++ b/api/server/routes/agents/__tests__/abort.spec.js
@@ -195,6 +195,43 @@ describe('Agent Abort Endpoint', () => {
         expect(response.status).toBe(200);
         expect(mockSaveMessage).not.toHaveBeenCalled();
       });
+
+      it('should skip message saving when abort content is only an OAuth prompt', async () => {
+        const jobStreamId = 'test-stream-123';
+
+        mockGenerationJobManager.getJob.mockResolvedValue({
+          metadata: { userId: 'test-user-123' },
+        });
+
+        mockGenerationJobManager.abortJob.mockResolvedValue({
+          success: true,
+          jobData: {
+            userMessage: { messageId: 'user-msg-123' },
+            responseMessageId: 'response-msg-456',
+            conversationId: jobStreamId,
+          },
+          content: [
+            {
+              type: 'tool_call',
+              tool_call: {
+                type: 'tool_call',
+                id: 'oauth-call-1',
+                name: 'oauth_mcp_Google-Workspace',
+                args: '',
+                auth: 'https://auth.example.com/oauth',
+              },
+            },
+          ],
+          text: '',
+        });
+
+        const response = await request(app)
+          .post('/api/agents/chat/abort')
+          .send({ conversationId: jobStreamId });
+
+        expect(response.status).toBe(200);
+        expect(mockSaveMessage).not.toHaveBeenCalled();
+      });
     });
 
     describe('Partial Response Saving', () => {
@@ -215,6 +252,7 @@ describe('Agent Abort Endpoint', () => {
             conversationId: jobStreamId,
             sender: 'TestAgent',
             endpoint: 'anthropic',
+            iconURL: 'https://example.com/spec-icon.png',
             model: 'claude-3',
           },
           content: [{ type: 'text', text: 'Partial response...' }],
@@ -238,6 +276,7 @@ describe('Agent Abort Endpoint', () => {
             text: 'Partial response...',
             sender: 'TestAgent',
             endpoint: 'anthropic',
+            iconURL: 'https://example.com/spec-icon.png',
             model: 'claude-3',
             unfinished: true,
             error: false,
@@ -264,8 +303,8 @@ describe('Agent Abort Endpoint', () => {
             responseMessageId: 'response-msg-456',
             conversationId: jobStreamId,
           },
-          content: [],
-          text: '',
+          content: [{ type: 'text', text: 'Partial response...' }],
+          text: 'Partial response...',
         });
 
         mockSaveMessage.mockRejectedValue(new Error('Database error'));
diff --git a/api/server/routes/agents/__tests__/streamTenant.spec.js b/api/server/routes/agents/__tests__/streamTenant.spec.js
index 1f89953186e..708a0712284 100644
--- a/api/server/routes/agents/__tests__/streamTenant.spec.js
+++ b/api/server/routes/agents/__tests__/streamTenant.spec.js
@@ -45,9 +45,11 @@ jest.mock('~/server/middleware', () => ({
 }));
 
 jest.mock('~/server/routes/agents/chat', () => require('express').Router());
-jest.mock('~/server/routes/agents/v1', () => ({
-  v1: require('express').Router(),
-}));
+jest.mock('~/server/routes/agents/v1', () => {
+  const router = require('express').Router();
+  router.use((req, res) => res.status(418).json({ error: 'v1 caught stream route' }));
+  return { v1: router };
+});
 jest.mock('~/server/routes/agents/openai', () => require('express').Router());
 jest.mock('~/server/routes/agents/responses', () => require('express').Router());
 
diff --git a/api/server/routes/agents/actions.js b/api/server/routes/agents/actions.js
index cccccedfd85..eab7c908aaf 100644
--- a/api/server/routes/agents/actions.js
+++ b/api/server/routes/agents/actions.js
@@ -1,7 +1,15 @@
 const express = require('express');
 const { nanoid } = require('nanoid');
 const { logger } = require('@librechat/data-schemas');
-const { generateCheckAccess, isActionDomainAllowed } = require('@librechat/api');
+const {
+  generateCheckAccess,
+  planAgentActionUpdate,
+  isActionDomainAllowed,
+  legacyActionDomainEncode,
+  validateActionOAuthMetadata,
+  ACTION_CREDENTIAL_REFRESH_MESSAGE,
+  buildActionOAuthTokenDeleteQueries,
+} = require('@librechat/api');
 const {
   Permissions,
   ResourceType,
@@ -12,17 +20,19 @@ const {
   validateActionDomain,
   validateAndParseOpenAPISpec,
 } = require('librechat-data-provider');
-const {
-  legacyDomainEncode,
-  encryptMetadata,
-  domainParser,
-} = require('~/server/services/ActionService');
+const { encryptMetadata, domainParser } = require('~/server/services/ActionService');
 const { findAccessibleResources } = require('~/server/services/PermissionService');
 const db = require('~/models');
 const { canAccessAgentResource } = require('~/server/middleware');
 
 const router = express.Router();
 
+async function deleteActionOAuthTokens(action_id) {
+  await Promise.all(
+    buildActionOAuthTokenDeleteQueries(action_id).map((query) => db.deleteTokens(query)),
+  );
+}
+
 const checkAgentCreate = generateCheckAccess({
   permissionType: PermissionTypes.AGENTS,
   permissions: [Permissions.USE, Permissions.CREATE],
@@ -47,6 +57,7 @@ router.get('/', async (req, res) => {
 
     const agentsResponse = await db.getListAgentsByAccess({
       accessibleIds: editableAgentObjectIds,
+      limit: null,
     });
 
     const editableAgentIds = agentsResponse.data.map((agent) => agent.id);
@@ -87,7 +98,7 @@ router.post(
         return res.status(400).json({ message: 'No functions provided' });
       }
 
-      let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
+      const metadata = await encryptMetadata(removeNullishValues(_metadata, true));
       const appConfig = req.config;
 
       // SECURITY: Validate the OpenAPI spec and extract the server URL
@@ -130,15 +141,16 @@ router.post(
         return res.status(400).json({ message: 'No domain provided' });
       }
 
-      const legacyDomain = legacyDomainEncode(metadata.domain);
+      const legacyDomain = legacyActionDomainEncode(metadata.domain);
 
-      const action_id = _action_id ?? nanoid();
+      const requestedActionId = _action_id;
+      const action_id = requestedActionId ?? nanoid();
       const initialPromises = [];
 
       // Permissions already validated by middleware - load agent directly
       initialPromises.push(db.getAgent({ id: agent_id }));
-      if (_action_id) {
-        initialPromises.push(db.getActions({ action_id }, true));
+      if (requestedActionId) {
+        initialPromises.push(db.getActions({ action_id: requestedActionId }, true));
       }
 
       /** @type {[Agent, [Action|undefined]]} */
@@ -147,47 +159,51 @@ router.post(
         return res.status(404).json({ message: 'Agent not found for adding action' });
       }
 
-      if (actions_result && actions_result.length) {
-        const action = actions_result[0];
-        if (action.agent_id !== agent_id) {
+      const storedAction = actions_result?.[0];
+      if (storedAction) {
+        if (storedAction.agent_id !== agent_id) {
           return res.status(403).json({ message: 'Action does not belong to this agent' });
         }
-        metadata = { ...action.metadata, ...metadata };
       }
 
-      const { actions: _actions = [], author: agent_author } = agent ?? {};
-      const actions = [];
-      for (const action of _actions) {
-        const [_action_domain, current_action_id] = action.split(actionDelimiter);
-        if (current_action_id === action_id) {
-          continue;
-        }
+      const { actions: agentActions = [], tools: agentTools = [], author: agent_author } = agent;
+      const plannedUpdate = planAgentActionUpdate({
+        agentActions,
+        agentTools,
+        incomingFunctions: functions,
+        incomingMetadata: metadata,
+        actionId: action_id,
+        requestedActionId,
+        encodedDomain,
+        legacyDomain,
+        previousLegacyDomain: legacyActionDomainEncode(storedAction?.metadata?.domain),
+        storedAction,
+      });
 
-        actions.push(action);
+      if (plannedUpdate.requiresCredentialRefresh) {
+        return res.status(400).json({
+          message: ACTION_CREDENTIAL_REFRESH_MESSAGE,
+        });
       }
 
-      actions.push(`${encodedDomain}${actionDelimiter}${action_id}`);
-
-      /** @type {string[]}} */
-      const { tools: _tools = [] } = agent;
-
-      const shouldRemoveAgentTool = (tool) => {
-        if (!tool) {
-          return false;
-        }
-        return (
-          tool.includes(encodedDomain) || tool.includes(legacyDomain) || tool.includes(action_id)
+      try {
+        await validateActionOAuthMetadata(
+          plannedUpdate.metadata.auth,
+          appConfig?.actions?.allowedAddresses,
         );
-      };
+      } catch (error) {
+        return res.status(400).json({ message: error.message });
+      }
 
-      const tools = _tools
-        .filter((tool) => !shouldRemoveAgentTool(tool))
-        .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${encodedDomain}`));
+      if (plannedUpdate.deleteOAuthTokens && requestedActionId) {
+        // Keep the callback URL stable while preventing old OAuth tokens from following a new target.
+        await deleteActionOAuthTokens(requestedActionId);
+      }
 
       // Force version update since actions are changing
       const updatedAgent = await db.updateAgent(
         { id: agent_id },
-        { tools, actions },
+        { tools: plannedUpdate.tools, actions: plannedUpdate.actions },
         {
           updatingUserId: req.user.id,
           forceVersion: true,
@@ -195,14 +211,21 @@ router.post(
       );
 
       // Only update user field for new actions
-      const actionUpdateData = { metadata, agent_id };
+      const actionUpdateData = {
+        action_id: plannedUpdate.actionId,
+        metadata: plannedUpdate.metadata,
+        agent_id,
+      };
       if (!actions_result || !actions_result.length) {
         // For new actions, use the agent owner's user ID
         actionUpdateData.user = agent_author || req.user.id;
       }
 
-      /** @type {[Action]} */
-      const updatedAction = await db.updateAction({ action_id, agent_id }, actionUpdateData);
+      /** @type {Action} */
+      const updatedAction = await db.updateAction(
+        { action_id: requestedActionId ?? action_id, agent_id },
+        actionUpdateData,
+      );
 
       const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
       for (let field of sensitiveFields) {
diff --git a/api/server/routes/agents/chat.js b/api/server/routes/agents/chat.js
index 0543b0b1aa6..8ffbde6552b 100644
--- a/api/server/routes/agents/chat.js
+++ b/api/server/routes/agents/chat.js
@@ -1,5 +1,5 @@
 const express = require('express');
-const { generateCheckAccess, skipAgentCheck } = require('@librechat/api');
+const { createMessageFilterPii, generateCheckAccess, skipAgentCheck } = require('@librechat/api');
 const { PermissionTypes, Permissions, PermissionBits } = require('librechat-data-provider');
 const {
   moderateText,
@@ -25,6 +25,7 @@ const checkAgentResourceAccess = canAccessAgentFromBody({
   requiredPermission: PermissionBits.VIEW,
 });
 
+router.use(createMessageFilterPii({ getConfig: (req) => req.config?.messageFilter?.pii }));
 router.use(moderateText);
 router.use(checkAgentAccess);
 router.use(checkAgentResourceAccess);
diff --git a/api/server/routes/agents/index.js b/api/server/routes/agents/index.js
index bbb39f5d2c9..145a6c03161 100644
--- a/api/server/routes/agents/index.js
+++ b/api/server/routes/agents/index.js
@@ -1,5 +1,11 @@
 const express = require('express');
-const { isEnabled, GenerationJobManager } = require('@librechat/api');
+const {
+  isEnabled,
+  GenerationJobManager,
+  hasPersistableAbortContent,
+  buildAbortedResponseMetadata,
+} = require('@librechat/api');
+const { createSseStreamTelemetry } = require('@librechat/api/telemetry');
 const { logger } = require('@librechat/data-schemas');
 const {
   uaParser,
@@ -42,8 +48,6 @@ router.use(requireJwtAuth);
 router.use(checkBan);
 router.use(uaParser);
 
-router.use('/', v1);
-
 /**
  * Stream endpoints - mounted before chatRouter to bypass rate limiters
  * These are GET requests and don't need message body validation or rate limiting
@@ -76,35 +80,43 @@ router.get('/chat/stream/:streamId', async (req, res) => {
     return res.status(403).json({ error: 'Unauthorized' });
   }
 
+  const streamTelemetry = createSseStreamTelemetry({ req, res, streamId, isResume });
+
   res.setHeader('Content-Encoding', 'identity');
   res.setHeader('Content-Type', 'text/event-stream');
   res.setHeader('Cache-Control', 'no-cache, no-transform');
   res.setHeader('Connection', 'keep-alive');
   res.setHeader('X-Accel-Buffering', 'no');
   res.flushHeaders();
+  streamTelemetry.recordHeadersFlushed();
 
   logger.debug(`[AgentStream] Client subscribed to ${streamId}, resume: ${isResume}`);
 
-  const writeEvent = (event) => {
+  const writeEvent = (event, options = {}) => {
     if (!res.writableEnded) {
-      res.write(`event: message\ndata: ${JSON.stringify(event)}\n\n`);
+      const eventName = options.eventName ?? 'message';
+      const payload = `event: ${eventName}\ndata: ${JSON.stringify(event)}\n\n`;
+      res.write(payload);
+      streamTelemetry.recordWrite(payload, { final: options.final });
       if (typeof res.flush === 'function') {
         res.flush();
       }
+      return true;
     }
+
+    return false;
   };
 
   const onDone = (event) => {
-    writeEvent(event);
+    streamTelemetry.recordFinalEventEmitted();
+    writeEvent(event, { final: true });
     res.end();
   };
 
   const onError = (error) => {
     if (!res.writableEnded) {
-      res.write(`event: error\ndata: ${JSON.stringify({ error })}\n\n`);
-      if (typeof res.flush === 'function') {
-        res.flush();
-      }
+      streamTelemetry.recordErrorEventEmitted();
+      writeEvent({ error }, { eventName: 'error' });
       res.end();
     }
   };
@@ -117,12 +129,7 @@ router.get('/chat/stream/:streamId', async (req, res) => {
 
     if (!res.writableEnded) {
       if (resumeState) {
-        res.write(
-          `event: message\ndata: ${JSON.stringify({ sync: true, resumeState, pendingEvents })}\n\n`,
-        );
-        if (typeof res.flush === 'function') {
-          res.flush();
-        }
+        writeEvent({ sync: true, resumeState, pendingEvents });
         GenerationJobManager.markSyncSent(streamId);
         logger.debug(
           `[AgentStream] Sent sync event for ${streamId} with ${resumeState.runSteps.length} run steps, ${pendingEvents.length} pending events`,
@@ -143,6 +150,7 @@ router.get('/chat/stream/:streamId', async (req, res) => {
   }
 
   if (!result) {
+    streamTelemetry.recordSubscribeFailed();
     onError('Failed to subscribe to stream');
     return;
   }
@@ -268,7 +276,8 @@ router.post('/chat/abort', async (req, res) => {
     if (
       abortResult.success &&
       abortResult.jobData?.userMessage?.messageId &&
-      abortResult.jobData?.responseMessageId
+      abortResult.jobData?.responseMessageId &&
+      hasPersistableAbortContent(abortResult.content)
     ) {
       const { jobData, content, text } = abortResult;
       const responseMessage = {
@@ -279,6 +288,7 @@ router.post('/chat/abort', async (req, res) => {
         text: text || '',
         sender: jobData.sender || 'AI',
         endpoint: jobData.endpoint,
+        iconURL: jobData.iconURL,
         model: jobData.model,
         unfinished: true,
         error: false,
@@ -286,6 +296,15 @@ router.post('/chat/abort', async (req, res) => {
         user: userId,
       };
 
+      /** Persist the usage/cost rollup + context breakdown for the stopped
+       *  response (from the job's tracked tokenUsage/contextUsage) so its
+       *  branch/total cost and granular rows survive a reload — parity with the
+       *  normal completion path. */
+      const abortMetadata = buildAbortedResponseMetadata(jobData);
+      if (abortMetadata) {
+        responseMessage.metadata = abortMetadata;
+      }
+
       try {
         await saveMessage(
           {
@@ -309,6 +328,8 @@ router.post('/chat/abort', async (req, res) => {
   return res.status(404).json({ error: 'Job not found', streamId: jobStreamId });
 });
 
+router.use('/', v1);
+
 const chatRouter = express.Router();
 chatRouter.use(configMiddleware);
 
diff --git a/api/server/routes/agents/middleware.js b/api/server/routes/agents/middleware.js
index f71c25c6f8f..efb4a8c0b0d 100644
--- a/api/server/routes/agents/middleware.js
+++ b/api/server/routes/agents/middleware.js
@@ -18,6 +18,7 @@ const apiKeyMiddleware = createRequireApiKeyAuth({
 const requireRemoteAgentAuth = createRemoteAgentAuth({
   apiKeyMiddleware,
   findUser: db.findUser,
+  getRolesByNames: db.findRolesByNames,
   updateUser: db.updateUser,
   getAppConfig,
 });
diff --git a/api/server/routes/assistants/actions.js b/api/server/routes/assistants/actions.js
index 7ddaffe5e7b..7d35cc6a99f 100644
--- a/api/server/routes/assistants/actions.js
+++ b/api/server/routes/assistants/actions.js
@@ -1,7 +1,7 @@
 const express = require('express');
 const { nanoid } = require('nanoid');
 const { logger } = require('@librechat/data-schemas');
-const { isActionDomainAllowed } = require('@librechat/api');
+const { isActionDomainAllowed, validateActionOAuthMetadata } = require('@librechat/api');
 const { actionDelimiter, EModelEndpoint, removeNullishValues } = require('librechat-data-provider');
 const {
   legacyDomainEncode,
@@ -71,6 +71,12 @@ router.post('/:assistant_id', async (req, res) => {
       metadata = { ...action.metadata, ...metadata };
     }
 
+    try {
+      await validateActionOAuthMetadata(metadata.auth, appConfig?.actions?.allowedAddresses);
+    } catch (error) {
+      return res.status(400).json({ message: error.message });
+    }
+
     if (!assistant) {
       return res.status(404).json({ message: 'Assistant not found' });
     }
diff --git a/api/server/routes/auth.2fa-ratelimit.test.js b/api/server/routes/auth.2fa-ratelimit.test.js
new file mode 100644
index 00000000000..35cc0e8840a
--- /dev/null
+++ b/api/server/routes/auth.2fa-ratelimit.test.js
@@ -0,0 +1,120 @@
+const express = require('express');
+const request = require('supertest');
+
+const mockSetTwoFactorTempUser = jest.fn((req, res, next) => next());
+const mockTwoFactorTempLimiter = jest.fn((req, res, next) => next());
+const mockCheckBan = jest.fn((req, res, next) => next());
+const mockVerify2FAWithTempToken = jest.fn((req, res) => res.status(204).end());
+
+jest.mock('@librechat/api', () => ({
+  createSetBalanceConfig: jest.fn(() => (req, res, next) => next()),
+  forceRefreshCloudFrontAuthCookies: jest.fn(),
+}));
+
+jest.mock('~/server/controllers/AuthController', () => ({
+  refreshController: jest.fn((req, res) => res.status(204).end()),
+  registrationController: jest.fn((req, res) => res.status(204).end()),
+  resetPasswordController: jest.fn((req, res) => res.status(204).end()),
+  resetPasswordRequestController: jest.fn((req, res) => res.status(204).end()),
+  graphTokenController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/TwoFactorController', () => ({
+  enable2FA: jest.fn((req, res) => res.status(204).end()),
+  verify2FA: jest.fn((req, res) => res.status(204).end()),
+  confirm2FA: jest.fn((req, res) => res.status(204).end()),
+  disable2FA: jest.fn((req, res) => res.status(204).end()),
+  regenerateBackupCodes: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/auth/TwoFactorAuthController', () => ({
+  verify2FAWithTempToken: (...args) => mockVerify2FAWithTempToken(...args),
+}));
+
+jest.mock('~/server/controllers/auth/LogoutController', () => ({
+  logoutController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/auth/LoginController', () => ({
+  loginController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/models', () => ({
+  findBalanceByUser: jest.fn(),
+  upsertBalanceFields: jest.fn(),
+}));
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: jest.fn(),
+}));
+
+jest.mock('~/server/middleware', () => {
+  const pass = (req, res, next) => next();
+  return {
+    logHeaders: pass,
+    loginLimiter: pass,
+    setTwoFactorTempUser: (...args) => mockSetTwoFactorTempUser(...args),
+    twoFactorTempLimiter: (...args) => mockTwoFactorTempLimiter(...args),
+    checkBan: (...args) => mockCheckBan(...args),
+    requireLocalAuth: pass,
+    requireLdapAuth: pass,
+    registerLimiter: pass,
+    checkInviteUser: pass,
+    validateRegistration: pass,
+    resetPasswordLimiter: pass,
+    validatePasswordReset: pass,
+    requireJwtAuth: pass,
+  };
+});
+
+const authRouter = require('./auth');
+
+describe('POST /api/auth/2fa/verify-temp rate limiting', () => {
+  let app;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockSetTwoFactorTempUser.mockImplementation((req, res, next) => next());
+    mockTwoFactorTempLimiter.mockImplementation((req, res, next) => next());
+    mockCheckBan.mockImplementation((req, res, next) => next());
+    mockVerify2FAWithTempToken.mockImplementation((req, res) => res.status(204).end());
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/auth', authRouter);
+  });
+
+  it('sets the temp user before limiting, checking bans, and verifying temp 2FA tokens', async () => {
+    await request(app).post('/api/auth/2fa/verify-temp').send({ token: '123456' }).expect(204);
+
+    expect(mockSetTwoFactorTempUser).toHaveBeenCalledTimes(1);
+    expect(mockTwoFactorTempLimiter).toHaveBeenCalledTimes(1);
+    expect(mockCheckBan).toHaveBeenCalledTimes(1);
+    expect(mockVerify2FAWithTempToken).toHaveBeenCalledTimes(1);
+    expect(mockSetTwoFactorTempUser.mock.invocationCallOrder[0]).toBeLessThan(
+      mockTwoFactorTempLimiter.mock.invocationCallOrder[0],
+    );
+    expect(mockTwoFactorTempLimiter.mock.invocationCallOrder[0]).toBeLessThan(
+      mockCheckBan.mock.invocationCallOrder[0],
+    );
+    expect(mockCheckBan.mock.invocationCallOrder[0]).toBeLessThan(
+      mockVerify2FAWithTempToken.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('does not verify the temp 2FA token after the limiter rejects the request', async () => {
+    mockTwoFactorTempLimiter.mockImplementation((req, res) =>
+      res.status(429).json({ message: 'Too many verification attempts' }),
+    );
+
+    const response = await request(app)
+      .post('/api/auth/2fa/verify-temp')
+      .send({ token: '123456' })
+      .expect(429);
+
+    expect(response.body).toEqual({ message: 'Too many verification attempts' });
+    expect(mockSetTwoFactorTempUser).toHaveBeenCalledTimes(1);
+    expect(mockCheckBan).not.toHaveBeenCalled();
+    expect(mockVerify2FAWithTempToken).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/routes/auth.cloudfront.test.js b/api/server/routes/auth.cloudfront.test.js
index 9d50ac97a71..ae786291046 100644
--- a/api/server/routes/auth.cloudfront.test.js
+++ b/api/server/routes/auth.cloudfront.test.js
@@ -50,6 +50,8 @@ jest.mock('~/server/middleware', () => {
   return {
     logHeaders: pass,
     loginLimiter: pass,
+    setTwoFactorTempUser: pass,
+    twoFactorTempLimiter: pass,
     checkBan: pass,
     requireLocalAuth: pass,
     requireLdapAuth: pass,
diff --git a/api/server/routes/auth.js b/api/server/routes/auth.js
index e2fc08187da..14c4e863897 100644
--- a/api/server/routes/auth.js
+++ b/api/server/routes/auth.js
@@ -87,7 +87,13 @@ router.post(
 
 router.post('/2fa/enable', middleware.requireJwtAuth, enable2FA);
 router.post('/2fa/verify', middleware.requireJwtAuth, verify2FA);
-router.post('/2fa/verify-temp', middleware.checkBan, verify2FAWithTempToken);
+router.post(
+  '/2fa/verify-temp',
+  middleware.setTwoFactorTempUser,
+  middleware.twoFactorTempLimiter,
+  middleware.checkBan,
+  verify2FAWithTempToken,
+);
 router.post('/2fa/confirm', middleware.requireJwtAuth, confirm2FA);
 router.post('/2fa/disable', middleware.requireJwtAuth, disable2FA);
 router.post('/2fa/backup/regenerate', middleware.requireJwtAuth, regenerateBackupCodes);
diff --git a/api/server/routes/balance.js b/api/server/routes/balance.js
index 87d84288806..70958244195 100644
--- a/api/server/routes/balance.js
+++ b/api/server/routes/balance.js
@@ -1,8 +1,17 @@
 const express = require('express');
+const { createSetBalanceConfig } = require('@librechat/api');
 const router = express.Router();
 const controller = require('../controllers/Balance');
 const { requireJwtAuth } = require('../middleware/');
+const { findBalanceByUser, upsertBalanceFields } = require('~/models');
+const { getAppConfig } = require('~/server/services/Config');
 
-router.get('/', requireJwtAuth, controller);
+const setBalanceConfig = createSetBalanceConfig({
+  getAppConfig,
+  findBalanceByUser,
+  upsertBalanceFields,
+});
+
+router.get('/', requireJwtAuth, setBalanceConfig, controller);
 
 module.exports = router;
diff --git a/api/server/routes/config.js b/api/server/routes/config.js
index 46f4cc09dac..f6eb66374e2 100644
--- a/api/server/routes/config.js
+++ b/api/server/routes/config.js
@@ -1,9 +1,18 @@
 const express = require('express');
-const { isEnabled, getBalanceConfig, getCloudFrontConfig } = require('@librechat/api');
-const { defaultSocialLogins } = require('librechat-data-provider');
+const {
+  isEnabled,
+  getBalanceConfig,
+  getCloudFrontConfig,
+  resolveBuildInfo,
+  resolveTitleTiming,
+  sanitizeModelSpecs,
+  isFileSnapshotEnabled,
+} = require('@librechat/api');
+const { EModelEndpoint, defaultSocialLogins } = require('librechat-data-provider');
 const { logger, getTenantId, SystemCapabilities } = require('@librechat/data-schemas');
 const { hasCapability } = require('~/server/middleware/roles/capabilities');
 const { getLdapConfig } = require('~/server/services/Config/ldap');
+const { getRumConfig } = require('~/server/services/Config/rum');
 const { getAppConfig } = require('~/server/services/Config/app');
 
 const router = express.Router();
@@ -20,15 +29,29 @@ const publicSharedLinksEnabled =
 const sharePointFilePickerEnabled = isEnabled(process.env.ENABLE_SHAREPOINT_FILEPICKER);
 const openidReuseTokens = isEnabled(process.env.OPENID_REUSE_TOKENS);
 
+/**
+ * Resolve build metadata eagerly at module load so the first `/api/config`
+ * request does not pay the cost of `execFileSync('git', ...)` on the hot path.
+ * The resolver caches its result after the first call.
+ */
+resolveBuildInfo();
+
 function isBirthday() {
   const today = new Date();
   return today.getMonth() === 1 && today.getDate() === 11;
 }
 
-function buildSharedPayload() {
+/**
+ * Pre-login fields rendered by the unauthenticated login, registration, password-reset,
+ * and email-verification pages. Any field added here is readable by anonymous callers
+ * of `GET /api/config`, so keep this set strictly to what those pages need.
+ *
+ * See client consumers under `client/src/components/Auth/` and `client/src/routes/Layouts/Startup.tsx`.
+ */
+function buildPreLoginPayload() {
   const isOpenIdEnabled =
     !!process.env.OPENID_CLIENT_ID &&
-    !!process.env.OPENID_CLIENT_SECRET &&
+    (isEnabled(process.env.OPENID_USE_PKCE) || !!process.env.OPENID_CLIENT_SECRET?.trim()) &&
     !!process.env.OPENID_ISSUER &&
     !!process.env.OPENID_SESSION_SECRET;
 
@@ -69,6 +92,47 @@ function buildSharedPayload() {
       !!process.env.EMAIL_PASSWORD &&
       !!process.env.EMAIL_FROM,
     passwordResetEnabled,
+  };
+
+  const minPasswordLength = parseInt(process.env.MIN_PASSWORD_LENGTH, 10);
+  if (minPasswordLength && !isNaN(minPasswordLength)) {
+    payload.minPasswordLength = minPasswordLength;
+  }
+
+  if (ldap) {
+    payload.ldap = ldap;
+  }
+
+  return payload;
+}
+
+/**
+ * Fields shared by authenticated chat and share-view config. Anonymous share
+ * views receive these through `/api/share/:shareId/config` after share access
+ * checks, not through the generic startup config endpoint.
+ */
+function buildPublicSharePayload() {
+  /** @type {Partial<TStartupConfig>} */
+  const payload = {
+    analyticsGtmId: process.env.ANALYTICS_GTM_ID,
+  };
+
+  if (typeof process.env.CUSTOM_FOOTER === 'string') {
+    payload.customFooter = process.env.CUSTOM_FOOTER;
+  }
+
+  return payload;
+}
+
+/**
+ * Post-login fields appended only when `req.user` is present. These describe the
+ * authenticated UX (account-settings links, share-link feature flags, birthday icon,
+ * openid token-reuse marker) and are not needed on the pre-login screens, so they
+ * are not exposed to unauthenticated callers.
+ */
+function buildPostLoginPayload() {
+  /** @type {Partial<TStartupConfig>} */
+  const payload = {
     showBirthdayIcon:
       isBirthday() ||
       isEnabled(process.env.SHOW_BIRTHDAY_ICON) ||
@@ -76,7 +140,6 @@ function buildSharedPayload() {
     helpAndFaqURL: process.env.HELP_AND_FAQ_URL || 'https://librechat.ai',
     sharedLinksEnabled,
     publicSharedLinksEnabled,
-    analyticsGtmId: process.env.ANALYTICS_GTM_ID,
     openidReuseTokens,
     /** Read inline (not module-level) for per-request evaluation and test isolation */
     allowAccountDeletion:
@@ -84,20 +147,23 @@ function buildSharedPayload() {
       isEnabled(process.env.ALLOW_ACCOUNT_DELETION),
   };
 
-  const minPasswordLength = parseInt(process.env.MIN_PASSWORD_LENGTH, 10);
-  if (minPasswordLength && !isNaN(minPasswordLength)) {
-    payload.minPasswordLength = minPasswordLength;
-  }
+  return payload;
+}
 
-  if (ldap) {
-    payload.ldap = ldap;
+function buildBuildInfoPayload(interfaceConfig) {
+  if (interfaceConfig?.buildInfo === false) {
+    return undefined;
   }
-
-  if (typeof process.env.CUSTOM_FOOTER === 'string') {
-    payload.customFooter = process.env.CUSTOM_FOOTER;
+  const info = resolveBuildInfo();
+  if (!info.commit && !info.branch && !info.buildDate) {
+    return undefined;
   }
-
-  return payload;
+  return {
+    commit: info.commit,
+    commitShort: info.commitShort,
+    branch: info.branch,
+    buildDate: info.buildDate,
+  };
 }
 
 function buildWebSearchConfig(appConfig) {
@@ -138,8 +204,9 @@ function buildCloudFrontStartupConfig() {
 
 router.get('/', async function (req, res) {
   try {
-    const sharedPayload = buildSharedPayload();
-    const cloudFront = buildCloudFrontStartupConfig();
+    const preLoginPayload = buildPreLoginPayload();
+    const publicSharePayload = buildPublicSharePayload();
+    const rum = getRumConfig();
 
     if (!req.user) {
       const tenantId = getTenantId();
@@ -147,14 +214,15 @@ router.get('/', async function (req, res) {
 
       /** @type {Partial<TStartupConfig>} */
       const payload = {
-        ...sharedPayload,
+        ...preLoginPayload,
         socialLogins: baseConfig?.registration?.socialLogins ?? defaultSocialLogins,
         turnstile: baseConfig?.turnstileConfig,
-        ...(cloudFront ? { cloudFront } : {}),
+        ...(rum ? { rum } : {}),
       };
 
       const interfaceConfig = baseConfig?.interfaceConfig;
-      if (interfaceConfig?.privacyPolicy || interfaceConfig?.termsOfService) {
+      const buildInfoDisabled = interfaceConfig?.buildInfo === false;
+      if (interfaceConfig?.privacyPolicy || interfaceConfig?.termsOfService || buildInfoDisabled) {
         payload.interface = {};
         if (interfaceConfig.privacyPolicy) {
           payload.interface.privacyPolicy = interfaceConfig.privacyPolicy;
@@ -162,6 +230,14 @@ router.get('/', async function (req, res) {
         if (interfaceConfig.termsOfService) {
           payload.interface.termsOfService = interfaceConfig.termsOfService;
         }
+        if (buildInfoDisabled) {
+          payload.interface.buildInfo = false;
+        }
+      }
+
+      const unauthBuildInfo = buildBuildInfoPayload(interfaceConfig);
+      if (unauthBuildInfo) {
+        payload.buildInfo = unauthBuildInfo;
       }
 
       return res.status(200).send(payload);
@@ -174,14 +250,22 @@ router.get('/', async function (req, res) {
     });
 
     const balanceConfig = getBalanceConfig(appConfig);
+    const cloudFront = buildCloudFrontStartupConfig();
 
     /** @type {TStartupConfig} */
     const payload = {
-      ...sharedPayload,
+      ...preLoginPayload,
+      ...publicSharePayload,
+      ...buildPostLoginPayload(),
+      sharedLinksSnapshotFilesEnabled: sharedLinksEnabled && isFileSnapshotEnabled(appConfig),
       socialLogins: appConfig?.registration?.socialLogins ?? defaultSocialLogins,
       interface: appConfig?.interfaceConfig,
+      titleGenerationTiming: resolveTitleTiming({
+        appConfig,
+        endpoint: EModelEndpoint.agents,
+      }),
       turnstile: appConfig?.turnstileConfig,
-      modelSpecs: appConfig?.modelSpecs,
+      modelSpecs: sanitizeModelSpecs(appConfig?.modelSpecs),
       balance: balanceConfig,
       bundlerURL: process.env.SANDPACK_BUNDLER_URL,
       staticBundlerURL: process.env.SANDPACK_STATIC_BUNDLER_URL,
@@ -193,6 +277,7 @@ router.get('/', async function (req, res) {
         ? parseInt(process.env.CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES, 10)
         : 0,
       ...(cloudFront ? { cloudFront } : {}),
+      ...(rum ? { rum } : {}),
     };
 
     const webSearch = buildWebSearchConfig(appConfig);
@@ -200,6 +285,11 @@ router.get('/', async function (req, res) {
       payload.webSearch = webSearch;
     }
 
+    const buildInfo = buildBuildInfoPayload(appConfig?.interfaceConfig);
+    if (buildInfo) {
+      payload.buildInfo = buildInfo;
+    }
+
     if (!payload.allowAccountDeletion) {
       try {
         const userId = req.user.id ?? req.user._id?.toString();
diff --git a/api/server/routes/convos.js b/api/server/routes/convos.js
index 3d65343648d..879b701d2e9 100644
--- a/api/server/routes/convos.js
+++ b/api/server/routes/convos.js
@@ -5,6 +5,8 @@ const {
   isEnabled,
   resolveImportMaxFileSize,
   restoreTenantContextFromReq,
+  deleteAllSharedLinksWithCleanup,
+  deleteConvoSharedLinksWithCleanup,
 } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, EModelEndpoint } = require('librechat-data-provider');
@@ -29,6 +31,9 @@ const assistantClients = {
 const router = express.Router();
 router.use(requireJwtAuth);
 
+const isValidProjectFilter = (projectId) =>
+  !projectId || projectId === 'unassigned' || /^[a-f\d]{24}$/i.test(projectId);
+
 router.get('/', async (req, res) => {
   const limit = parseInt(req.query.limit, 10) || 25;
   const cursor = req.query.cursor;
@@ -36,6 +41,13 @@ router.get('/', async (req, res) => {
   const search = req.query.search ? decodeURIComponent(req.query.search) : undefined;
   const sortBy = req.query.sortBy || 'updatedAt';
   const sortDirection = req.query.sortDirection || 'desc';
+  const projectId = Array.isArray(req.query.projectId)
+    ? req.query.projectId[0]
+    : req.query.projectId;
+
+  if (!isValidProjectFilter(projectId)) {
+    return res.status(400).json({ error: 'projectId must be a valid project id or unassigned' });
+  }
 
   let tags;
   if (req.query.tags) {
@@ -51,6 +63,7 @@ router.get('/', async (req, res) => {
       search,
       sortBy,
       sortDirection,
+      projectId,
     });
     res.status(200).json(result);
   } catch (error) {
@@ -133,7 +146,7 @@ router.delete('/', async (req, res) => {
     const dbResponse = await db.deleteConvos(req.user.id, filter);
     if (filter.conversationId) {
       await db.deleteToolCalls(req.user.id, filter.conversationId);
-      await db.deleteConvoSharedLink(req.user.id, filter.conversationId);
+      await deleteConvoSharedLinksWithCleanup(req.user.id, filter.conversationId);
     }
     res.status(201).json(dbResponse);
   } catch (error) {
@@ -146,7 +159,7 @@ router.delete('/all', async (req, res) => {
   try {
     const dbResponse = await db.deleteConvos(req.user.id, {});
     await db.deleteToolCalls(req.user.id);
-    await db.deleteAllSharedLinks(req.user.id);
+    await deleteAllSharedLinksWithCleanup(req.user.id);
     res.status(201).json(dbResponse);
   } catch (error) {
     logger.error('Error clearing conversations', error);
@@ -189,6 +202,34 @@ router.post('/archive', validateConvoAccess, async (req, res) => {
   }
 });
 
+router.post('/pin', validateConvoAccess, async (req, res) => {
+  const { conversationId, pinned } = req.body?.arg ?? {};
+
+  if (!conversationId) {
+    return res.status(400).json({ error: 'conversationId is required' });
+  }
+
+  if (pinned === undefined) {
+    return res.status(400).json({ error: 'pinned is required' });
+  }
+
+  if (typeof pinned !== 'boolean') {
+    return res.status(400).json({ error: 'pinned must be a boolean' });
+  }
+
+  try {
+    const dbResponse = await db.saveConvo(
+      { userId: req.user.id },
+      { conversationId, pinned },
+      { context: `POST /api/convos/pin ${conversationId}` },
+    );
+    res.status(200).json(dbResponse);
+  } catch (error) {
+    logger.error('Error pinning conversation', error);
+    res.status(500).send('Error pinning conversation');
+  }
+});
+
 /** Maximum allowed length for conversation titles */
 const MAX_CONVO_TITLE_LENGTH = 1024;
 
@@ -276,6 +317,7 @@ router.post(
         filepath: req.file.path,
         requestUserId: req.user.id,
         userRole: req.user.role,
+        interfaceConfig: req.config?.interfaceConfig,
       });
       res.status(201).json({ message: 'Conversation(s) imported successfully' });
     } catch (error) {
diff --git a/api/server/routes/endpoints.js b/api/server/routes/endpoints.js
index e7ff1c70000..ea55a9e54ac 100644
--- a/api/server/routes/endpoints.js
+++ b/api/server/routes/endpoints.js
@@ -1,9 +1,21 @@
 const express = require('express');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const configMiddleware = require('~/server/middleware/config/app');
 const endpointController = require('~/server/controllers/EndpointController');
+const tokenConfigController = require('~/server/controllers/TokenConfigController');
+const contextProjectionController = require('~/server/controllers/ContextProjectionController');
+const { contextProjectionLimiter } = require('~/server/middleware/limiters');
 
 const router = express.Router();
 /** Auth required for role/tenant-scoped endpoint config resolution. */
 router.get('/', requireJwtAuth, endpointController);
+router.get('/token-config', requireJwtAuth, configMiddleware, tokenConfigController);
+router.post(
+  '/context-projection',
+  requireJwtAuth,
+  contextProjectionLimiter,
+  configMiddleware,
+  contextProjectionController,
+);
 
 module.exports = router;
diff --git a/api/server/routes/files/files.agents.test.js b/api/server/routes/files/files.agents.test.js
index d2c76ea139a..664721f35be 100644
--- a/api/server/routes/files/files.agents.test.js
+++ b/api/server/routes/files/files.agents.test.js
@@ -14,7 +14,7 @@ const { createAgent, createFile } = require('~/models');
 
 // Only mock the external dependencies that we don't want to test
 jest.mock('~/server/services/Files/process', () => ({
-  processDeleteRequest: jest.fn().mockResolvedValue({}),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
   filterFile: jest.fn(),
   processFileUpload: jest.fn(),
   processAgentFileUpload: jest.fn().mockImplementation(async ({ res }) => {
diff --git a/api/server/routes/files/files.test.js b/api/server/routes/files/files.test.js
index 5758b77387d..473731de014 100644
--- a/api/server/routes/files/files.test.js
+++ b/api/server/routes/files/files.test.js
@@ -16,7 +16,7 @@ const { createAgent, createFile } = require('~/models');
 
 // Only mock the external dependencies that we don't want to test
 jest.mock('~/server/services/Files/process', () => ({
-  processDeleteRequest: jest.fn().mockResolvedValue({}),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
   filterFile: jest.fn(),
   processFileUpload: jest.fn(),
   processAgentFileUpload: jest.fn(),
diff --git a/api/server/routes/files/multer.js b/api/server/routes/files/multer.js
index cb155e2ac27..da17ce8008a 100644
--- a/api/server/routes/files/multer.js
+++ b/api/server/routes/files/multer.js
@@ -5,6 +5,7 @@ const multer = require('multer');
 const { sanitizeFilename } = require('@librechat/api');
 const {
   mergeFileConfig,
+  inferMimeType,
   getEndpointFileConfig,
   fileConfig: defaultFileConfig,
 } = require('librechat-data-provider');
@@ -37,6 +38,14 @@ const importFileFilter = (req, file, cb) => {
   }
 };
 
+const normalizeUploadMimeType = (file) => {
+  const mimeType = inferMimeType(file.originalname || '', file.mimetype || '');
+  if (mimeType && file.mimetype !== mimeType) {
+    file.mimetype = mimeType;
+  }
+  return mimeType;
+};
+
 /**
  *
  * @param {import('librechat-data-provider').FileConfig | undefined} customFileConfig
@@ -52,7 +61,9 @@ const createFileFilter = (customFileConfig) => {
       return cb(new Error('No file provided'), false);
     }
 
-    if (req.originalUrl.endsWith('/speech/stt') && file.mimetype.startsWith('audio/')) {
+    const mimeType = normalizeUploadMimeType(file);
+
+    if (req.originalUrl.endsWith('/speech/stt') && mimeType.startsWith('audio/')) {
       return cb(null, true);
     }
 
@@ -64,8 +75,8 @@ const createFileFilter = (customFileConfig) => {
       endpointType,
     });
 
-    if (!defaultFileConfig.checkType(file.mimetype, endpointFileConfig.supportedMimeTypes)) {
-      return cb(new Error('Unsupported file type: ' + file.mimetype), false);
+    if (!defaultFileConfig.checkType(mimeType, endpointFileConfig.supportedMimeTypes)) {
+      return cb(new Error('Unsupported file type: ' + (file.mimetype || mimeType)), false);
     }
 
     cb(null, true);
@@ -85,4 +96,4 @@ const createMulterInstance = async () => {
   });
 };
 
-module.exports = { createMulterInstance, storage, importFileFilter };
+module.exports = { createMulterInstance, storage, importFileFilter, createFileFilter };
diff --git a/api/server/routes/files/multer.spec.js b/api/server/routes/files/multer.spec.js
index 84b97fe7896..23b7a2458a3 100644
--- a/api/server/routes/files/multer.spec.js
+++ b/api/server/routes/files/multer.spec.js
@@ -4,7 +4,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
-const { createMulterInstance, storage, importFileFilter } = require('./multer');
+const { createMulterInstance, storage, importFileFilter, createFileFilter } = require('./multer');
 
 // Mock only the config service that requires external dependencies
 jest.mock('~/server/services/Config', () => ({
@@ -281,6 +281,25 @@ describe('Multer Configuration', () => {
       }
     });
 
+    it('should infer ZIP MIME type when multipart upload omits it', (done) => {
+      const { mergeFileConfig } = require('librechat-data-provider');
+      const fileFilter = createFileFilter(mergeFileConfig());
+      const zipFile = {
+        ...mockFile,
+        originalname: 'archive.zip',
+        mimetype: '',
+      };
+
+      const cb = jest.fn((err, result) => {
+        expect(err).toBeNull();
+        expect(result).toBe(true);
+        expect(zipFile.mimetype).toBe('application/zip');
+        done();
+      });
+
+      fileFilter(mockReq, zipFile, cb);
+    });
+
     it('should use real mergeFileConfig function', async () => {
       const { mergeFileConfig, mbToBytes } = require('librechat-data-provider');
 
diff --git a/api/server/routes/files/preview.spec.js b/api/server/routes/files/preview.spec.js
index 426b0697c68..36de49c223d 100644
--- a/api/server/routes/files/preview.spec.js
+++ b/api/server/routes/files/preview.spec.js
@@ -36,7 +36,7 @@ jest.mock('~/models', () => ({
 jest.mock('~/server/services/Files/process', () => ({
   filterFile: jest.fn(),
   processFileUpload: jest.fn(),
-  processDeleteRequest: jest.fn(),
+  processDeleteRequest: jest.fn().mockResolvedValue({ deletedFileIds: [], failedFileIds: [] }),
   processAgentFileUpload: jest.fn(),
 }));
 
diff --git a/api/server/routes/index.js b/api/server/routes/index.js
index cab2f92ed1d..ac2b38f579a 100644
--- a/api/server/routes/index.js
+++ b/api/server/routes/index.js
@@ -6,12 +6,15 @@ const adminConfig = require('./admin/config');
 const adminGrants = require('./admin/grants');
 const adminGroups = require('./admin/groups');
 const adminRoles = require('./admin/roles');
+const adminSkills = require('./admin/skills');
 const adminUsers = require('./admin/users');
+const adminAuditLog = require('./admin/audit');
 const endpoints = require('./endpoints');
 const staticRoute = require('./static');
 const messages = require('./messages');
 const memories = require('./memories');
 const presets = require('./presets');
+const projects = require('./projects');
 const prompts = require('./prompts');
 const skills = require('./skills');
 const balance = require('./balance');
@@ -32,8 +35,10 @@ const auth = require('./auth');
 const keys = require('./keys');
 const user = require('./user');
 const mcp = require('./mcp');
+const rum = require('./rum');
 
 module.exports = {
+  rum,
   mcp,
   auth,
   adminAuth,
@@ -41,7 +46,9 @@ module.exports = {
   adminGrants,
   adminGroups,
   adminRoles,
+  adminSkills,
   adminUsers,
+  adminAuditLog,
   keys,
   apiKeys,
   user,
@@ -57,6 +64,7 @@ module.exports = {
   config,
   models,
   prompts,
+  projects,
   skills,
   actions,
   presets,
diff --git a/api/server/routes/mcp.js b/api/server/routes/mcp.js
index 219f6455dc2..1637b8f7e19 100644
--- a/api/server/routes/mcp.js
+++ b/api/server/routes/mcp.js
@@ -14,6 +14,7 @@ const {
   MCPTokenStorage,
   setOAuthSession,
   PENDING_STALE_MS,
+  mcpConfig: mcpSettings,
   getUserMCPAuthMap,
   validateOAuthCsrf,
   OAUTH_CSRF_COOKIE,
@@ -38,6 +39,7 @@ const {
 } = require('~/config');
 const {
   getServerConnectionStatus,
+  resolveAllMcpConfigs,
   resolveConfigServers,
   getMCPSetupData,
 } = require('~/server/services/MCP');
@@ -52,6 +54,29 @@ const router = Router();
 
 const OAUTH_CSRF_COOKIE_PATH = '/api/mcp';
 
+const getOAuthFlowId = (userId, serverName) =>
+  MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+
+const canAccessOAuthFlow = (flowId, userId) => {
+  const parsed = MCPOAuthHandler.parseFlowId(flowId);
+  if (!parsed) {
+    return false;
+  }
+  if (parsed.tenantId && parsed.tenantId !== getTenantId()) {
+    return false;
+  }
+  return parsed.userId === userId || parsed.userId === 'system';
+};
+
+const clearGetTokensFlow = async ({ flowManager, flowId, tokens }) => {
+  const state = await flowManager.getFlowState(flowId, 'mcp_get_tokens');
+  if (state?.type === 'mcp_get_tokens' && state.status === 'PENDING') {
+    await flowManager.completeFlow(flowId, 'mcp_get_tokens', tokens);
+    return;
+  }
+  await flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+};
+
 const checkMCPUsePermissions = generateCheckAccess({
   permissionType: PermissionTypes.MCP_SERVERS,
   permissions: [Permissions.USE],
@@ -68,7 +93,7 @@ const checkMCPCreate = generateCheckAccess({
  * Get all MCP tools available to the user
  * Returns only MCP tools, completely decoupled from regular LibreChat tools
  */
-router.get('/tools', requireJwtAuth, async (req, res) => {
+router.get('/tools', requireJwtAuth, checkMCPUsePermissions, async (req, res) => {
   return getMCPTools(req, res);
 });
 
@@ -83,10 +108,21 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
     const user = req.user;
 
     // Verify the userId matches the authenticated user
-    if (userId !== user.id) {
+    if (typeof userId !== 'string' || userId !== user.id) {
       return res.status(403).json({ error: 'User mismatch' });
     }
 
+    const expectedFlowId = getOAuthFlowId(user.id, serverName);
+    if (typeof flowId !== 'string' || flowId !== expectedFlowId) {
+      logger.error('[MCP OAuth] Invalid flow ID for initiate request', {
+        serverName,
+        userId,
+        flowId,
+        expectedFlowId,
+      });
+      return res.status(403).json({ error: 'Flow mismatch' });
+    }
+
     logger.debug('[MCP OAuth] Initiate request', { serverName, userId, flowId });
 
     const flowsCache = getLogStores(CacheKeys.FLOWS);
@@ -99,7 +135,45 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
       return res.status(404).json({ error: 'Flow not found' });
     }
 
-    const { serverUrl, oauth: oauthConfig } = flowState.metadata || {};
+    const {
+      authorizationUrl: storedAuthorizationUrl,
+      serverName: flowServerName,
+      userId: flowUserId,
+      serverUrl,
+      oauth: oauthConfig,
+    } = flowState.metadata || {};
+
+    if (flowUserId && flowUserId !== user.id) {
+      logger.error('[MCP OAuth] Flow user mismatch', { flowId, userId, flowUserId });
+      return res.status(403).json({ error: 'User mismatch' });
+    }
+
+    if (flowServerName && flowServerName !== serverName) {
+      logger.error('[MCP OAuth] Flow server mismatch', { flowId, serverName, flowServerName });
+      return res.status(400).json({ error: 'Invalid flow state' });
+    }
+
+    const pendingAge = flowState.createdAt ? Date.now() - flowState.createdAt : Infinity;
+    const isFreshPendingFlow = flowState.status === 'PENDING' && pendingAge < PENDING_STALE_MS;
+    if (!isFreshPendingFlow) {
+      logger.error('[MCP OAuth] Flow is not active for initiation', {
+        flowId,
+        status: flowState.status,
+        pendingAge,
+      });
+      return res.status(400).json({ error: 'Invalid flow state' });
+    }
+
+    if (typeof storedAuthorizationUrl === 'string' && storedAuthorizationUrl.length > 0) {
+      logger.debug('[MCP OAuth] Reusing stored authorization URL', {
+        serverName,
+        userId,
+        flowId,
+      });
+      setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
+      return res.redirect(storedAuthorizationUrl);
+    }
+
     if (!serverUrl || !oauthConfig) {
       logger.error('[MCP OAuth] Missing server URL or OAuth config in flow state');
       return res.status(400).json({ error: 'Invalid flow state' });
@@ -108,8 +182,10 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
     const configServers = await resolveConfigServers(req);
     const oauthHeaders = await getOAuthHeaders(serverName, userId, configServers);
     const registry = getMCPServersRegistry();
-    const allowedDomains = registry.getAllowedDomains();
-    const allowedAddresses = registry.getAllowedAddresses();
+    const { allowedDomains, allowedAddresses } = await registry.resolveAllowlists({
+      userId,
+      role: req.user?.role,
+    });
     const {
       authorizationUrl,
       flowId: oauthFlowId,
@@ -123,10 +199,17 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
       allowedDomains,
       undefined,
       allowedAddresses,
+      getTenantId(),
     );
 
     logger.debug('[MCP OAuth] OAuth flow initiated', { oauthFlowId, authorizationUrl });
 
+    const oldState = flowState.metadata?.state;
+    if (typeof oldState === 'string') {
+      await MCPOAuthHandler.deleteStateMapping(oldState, flowManager);
+    }
+    const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+    await flowManager.initFlow(oauthFlowId, 'mcp_oauth', metadataWithUrl);
     await MCPOAuthHandler.storeStateMapping(flowMetadata.state, oauthFlowId, flowManager);
     setOAuthCsrfCookie(res, oauthFlowId, OAUTH_CSRF_COOKIE_PATH);
     res.redirect(authorizationUrl);
@@ -162,16 +245,21 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
           const flowManager = getFlowStateManager(flowsCache);
           const flowId = await MCPOAuthHandler.resolveStateToFlowId(state, flowManager);
           if (flowId) {
-            const flowParts = flowId.split(':');
-            const [flowUserId] = flowParts;
-            const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
-            const hasSession = !hasCsrf && validateOAuthSession(req, flowUserId);
-            if (hasCsrf || hasSession) {
-              await flowManager.failFlow(flowId, 'mcp_oauth', String(oauthError));
-              logger.debug('[MCP OAuth] Marked flow as FAILED with OAuth error', {
+            const parsed = MCPOAuthHandler.parseFlowId(flowId);
+            if (!parsed) {
+              logger.warn('[MCP OAuth] Invalid flow ID format for OAuth error callback', {
                 flowId,
-                error: oauthError,
               });
+            } else {
+              const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
+              const hasSession = !hasCsrf && validateOAuthSession(req, parsed.userId);
+              if (hasCsrf || hasSession) {
+                await flowManager.failFlow(flowId, 'mcp_oauth', String(oauthError));
+                logger.debug('[MCP OAuth] Marked flow as FAILED with OAuth error', {
+                  flowId,
+                  error: oauthError,
+                });
+              }
             }
           }
         } catch (err) {
@@ -203,16 +291,14 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
     }
     logger.debug('[MCP OAuth] Resolved flow ID from state', { flowId });
 
-    const flowParts = flowId.split(':');
-    if (flowParts.length < 2 || !flowParts[0] || !flowParts[1]) {
+    const parsedFlowId = MCPOAuthHandler.parseFlowId(flowId);
+    if (!parsedFlowId) {
       logger.error('[MCP OAuth] Invalid flow ID format', { flowId });
       return res.redirect(`${basePath}/oauth/error?error=invalid_state`);
     }
 
-    const [flowUserId] = flowParts;
-
     const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
-    const hasSession = !hasCsrf && validateOAuthSession(req, flowUserId);
+    const hasSession = !hasCsrf && validateOAuthSession(req, parsedFlowId.userId);
     let hasActiveFlow = false;
     if (!hasCsrf && !hasSession) {
       const pendingFlow = await flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -309,7 +395,10 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
             updateToken: db.updateToken,
             findToken: db.findToken,
             clientInfo: flowState.clientInfo,
-            metadata: flowState.metadata,
+            metadata: MCPOAuthHandler.buildStoredClientMetadata(
+              flowState.metadata,
+              flowState.resourceMetadata,
+            ),
           });
           logger.debug('[MCP OAuth] Stored OAuth tokens prior to reconnection', {
             serverName,
@@ -326,7 +415,23 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
          */
         if (typeof flowManager?.deleteFlow === 'function') {
           try {
-            await flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+            const tokenFlowId = MCPOAuthHandler.generateTokenFlowId(
+              flowState.userId,
+              serverName,
+              flowState.tenantId,
+            );
+            await clearGetTokensFlow({
+              flowManager,
+              flowId: tokenFlowId,
+              tokens,
+            });
+            if (tokenFlowId !== flowId) {
+              await clearGetTokensFlow({
+                flowManager,
+                flowId,
+                tokens,
+              });
+            }
           } catch (error) {
             logger.warn('[MCP OAuth] Failed to clear cached token flow state', error);
           }
@@ -340,10 +445,25 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
         if (flowState.userId !== 'system') {
           const user = { id: flowState.userId };
 
+          /** Merged config (incl. Config-tier overlays) so the reconnection and
+           *  the cache gate both see request-scoped servers the base registry
+           *  lookup misses */
+          let serverConfig;
+          try {
+            const allConfigs = await resolveAllMcpConfigs(flowState.userId);
+            serverConfig = allConfigs?.[serverName];
+          } catch (error) {
+            logger.warn(
+              `[MCP OAuth] Could not resolve server config for ${serverName} before reconnecting:`,
+              error,
+            );
+          }
+
           const userConnection = await mcpManager.getUserConnection({
             user,
             serverName,
             flowManager,
+            serverConfig,
             tokenMethods: {
               findToken: db.findToken,
               updateToken: db.updateToken,
@@ -364,6 +484,7 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
             userId: flowState.userId,
             serverName,
             tools,
+            serverConfig,
           });
         } else {
           logger.debug(`[MCP OAuth] System-level OAuth completed for ${serverName}`);
@@ -411,7 +532,7 @@ router.get('/oauth/tokens/:flowId', requireJwtAuth, async (req, res) => {
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    if (!flowId.startsWith(`${user.id}:`) && !flowId.startsWith('system:')) {
+    if (!canAccessOAuthFlow(flowId, user.id)) {
       return res.status(403).json({ error: 'Access denied' });
     }
 
@@ -448,7 +569,7 @@ router.post('/:serverName/oauth/bind', requireJwtAuth, setOAuthSession, async (r
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+    const flowId = getOAuthFlowId(user.id, serverName);
     setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
 
     res.json({ success: true });
@@ -471,7 +592,7 @@ router.get('/oauth/status/:flowId', requireJwtAuth, async (req, res) => {
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    if (!flowId.startsWith(`${user.id}:`) && !flowId.startsWith('system:')) {
+    if (!canAccessOAuthFlow(flowId, user.id)) {
       return res.status(403).json({ error: 'Access denied' });
     }
 
@@ -512,7 +633,7 @@ router.post('/oauth/cancel/:serverName', requireJwtAuth, async (req, res) => {
 
     const flowsCache = getLogStores(CacheKeys.FLOWS);
     const flowManager = getFlowStateManager(flowsCache);
-    const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+    const flowId = getOAuthFlowId(user.id, serverName);
     const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
 
     if (!flowState) {
@@ -600,7 +721,7 @@ router.post(
       const { success, message, oauthRequired, oauthUrl } = result;
 
       if (oauthRequired) {
-        const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+        const flowId = getOAuthFlowId(user.id, serverName);
         setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
       }
 
@@ -660,6 +781,7 @@ router.get('/connection/status', requireJwtAuth, async (req, res) => {
     res.json({
       success: true,
       connectionStatus,
+      oauthTimeout: mcpSettings.OAUTH_HANDLING_TIMEOUT,
     });
   } catch (error) {
     logger.error('[MCP Connection Status] Failed to get connection status', error);
diff --git a/api/server/routes/messages.js b/api/server/routes/messages.js
index 21b2b23feaf..17e740c5151 100644
--- a/api/server/routes/messages.js
+++ b/api/server/routes/messages.js
@@ -1,8 +1,13 @@
 const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const { logger } = require('@librechat/data-schemas');
-const { ContentTypes } = require('librechat-data-provider');
-const { unescapeLaTeX, countTokens } = require('@librechat/api');
+const { ContentTypes, isAssistantsEndpoint } = require('librechat-data-provider');
+const {
+  unescapeLaTeX,
+  countTokens,
+  sendFeedbackScore,
+  traceIdForMessage,
+} = require('@librechat/api');
 const { findAllArtifacts, replaceArtifactContent } = require('~/server/services/Artifacts/update');
 const { requireJwtAuth, validateMessageReq } = require('~/server/middleware');
 const db = require('~/models');
@@ -269,7 +274,7 @@ router.post('/artifact/:messageId', async (req, res) => {
 router.get('/:conversationId', validateMessageReq, async (req, res) => {
   try {
     const { conversationId } = req.params;
-    const messages = await db.getMessages({ conversationId }, '-_id -__v -user');
+    const messages = await db.getMessages({ conversationId, user: req.user.id }, '-_id -__v -user');
     res.status(200).json(messages);
   } catch (error) {
     logger.error('Error fetching messages:', error);
@@ -279,7 +284,7 @@ router.get('/:conversationId', validateMessageReq, async (req, res) => {
 
 router.post('/:conversationId', validateMessageReq, async (req, res) => {
   try {
-    const message = req.body;
+    const message = { ...req.body, conversationId: req.params.conversationId };
     const reqCtx = {
       userId: req?.user?.id,
       isTemporary: req?.body?.isTemporary,
@@ -304,7 +309,10 @@ router.post('/:conversationId', validateMessageReq, async (req, res) => {
 router.get('/:conversationId/:messageId', validateMessageReq, async (req, res) => {
   try {
     const { conversationId, messageId } = req.params;
-    const message = await db.getMessages({ conversationId, messageId }, '-_id -__v -user');
+    const message = await db.getMessages(
+      { conversationId, messageId, user: req.user.id },
+      '-_id -__v -user',
+    );
     if (!message) {
       return res.status(404).json({ error: 'Message not found' });
     }
@@ -331,7 +339,7 @@ router.put('/:conversationId/:messageId', validateMessageReq, async (req, res) =
     }
 
     const message = (
-      await db.getMessages({ conversationId, messageId }, 'content tokenCount')
+      await db.getMessages({ conversationId, messageId, user: req.user.id }, 'content tokenCount')
     )?.[0];
     if (!message) {
       return res.status(404).json({ error: 'Message not found' });
@@ -388,6 +396,25 @@ router.put('/:conversationId/:messageId/feedback', validateMessageReq, async (re
       { context: 'updateFeedback' },
     );
 
+    // Best-effort: Assistants messages do not have deterministic AgentRun traces.
+    if (!isAssistantsEndpoint(updatedMessage.endpoint)) {
+      sendFeedbackScore({
+        traceId: traceIdForMessage(messageId),
+        feedback: updatedMessage.feedback,
+        metadata: {
+          messageId: updatedMessage.messageId ?? messageId,
+          parentMessageId: updatedMessage.parentMessageId,
+          conversationId: updatedMessage.conversationId ?? conversationId,
+          sessionId: updatedMessage.conversationId ?? conversationId,
+          userId: req?.user?.id,
+          endpoint: updatedMessage.endpoint,
+          sender: updatedMessage.sender,
+          isCreatedByUser: updatedMessage.isCreatedByUser,
+          tokenCount: updatedMessage.tokenCount,
+        },
+      }).catch((err) => logger.error('[langfuse] feedback score failed:', err));
+    }
+
     res.json({
       messageId,
       conversationId,
diff --git a/api/server/routes/oauth.js b/api/server/routes/oauth.js
index 53021580313..d5e4c939ea9 100644
--- a/api/server/routes/oauth.js
+++ b/api/server/routes/oauth.js
@@ -4,7 +4,13 @@ const passport = require('passport');
 const { randomState } = require('openid-client');
 const { logger } = require('@librechat/data-schemas');
 const { ErrorTypes } = require('librechat-data-provider');
-const { createSetBalanceConfig } = require('@librechat/api');
+const {
+  buildOAuthFailureLog,
+  createOpenIDCallbackAuthenticator,
+  createSetBalanceConfig,
+  getOAuthFailureMessage,
+  redirectToAuthFailure,
+} = require('@librechat/api');
 const { checkDomainAllowed, loginLimiter, logHeaders } = require('~/server/middleware');
 const { createOAuthHandler } = require('~/server/controllers/auth/oauth');
 const { findBalanceByUser, upsertBalanceFields } = require('~/models');
@@ -23,19 +29,35 @@ const domains = {
   server: process.env.DOMAIN_SERVER,
 };
 
+const authFailureRedirectOptions = {
+  clientDomain: domains.client,
+  authFailedError: ErrorTypes.AUTH_FAILED,
+};
+
 router.use(logHeaders);
 router.use(loginLimiter);
 
 const oauthHandler = createOAuthHandler();
+const authenticateOpenIDCallback = createOpenIDCallbackAuthenticator({
+  passport,
+  logger,
+  ...authFailureRedirectOptions,
+});
 
 router.get('/error', (req, res) => {
   /** A single error message is pushed by passport when authentication fails. */
-  const errorMessage = req.session?.messages?.pop() || 'Unknown OAuth error';
-  logger.error('Error in OAuth authentication:', {
-    message: errorMessage,
-  });
-
-  res.redirect(`${domains.client}/login?redirect=false&error=${ErrorTypes.AUTH_FAILED}`);
+  const errorMessage = getOAuthFailureMessage(req);
+  logger.warn(
+    '[OAuth] Authentication failed',
+    buildOAuthFailureLog({
+      provider: 'unknown',
+      req,
+      info: { message: errorMessage },
+      defaultMessage: errorMessage,
+    }),
+  );
+
+  redirectToAuthFailure(res, authFailureRedirectOptions);
 });
 
 /**
@@ -100,11 +122,7 @@ router.get('/openid', (req, res, next) => {
 
 router.get(
   '/openid/callback',
-  passport.authenticate('openid', {
-    failureRedirect: `${domains.client}/oauth/error`,
-    failureMessage: true,
-    session: false,
-  }),
+  authenticateOpenIDCallback,
   setBalanceConfig,
   checkDomainAllowed,
   oauthHandler,
diff --git a/api/server/routes/oauth.test.js b/api/server/routes/oauth.test.js
new file mode 100644
index 00000000000..b6739ffdc57
--- /dev/null
+++ b/api/server/routes/oauth.test.js
@@ -0,0 +1,191 @@
+const express = require('express');
+const request = require('supertest');
+
+const originalDomainClient = process.env.DOMAIN_CLIENT;
+process.env.DOMAIN_CLIENT = 'http://client.test';
+
+const mockLogger = {
+  warn: jest.fn(),
+  error: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+};
+
+const mockOAuthHandler = jest.fn((_req, res) => res.status(204).end());
+const mockOpenIDCallbackMiddleware = jest.fn((_req, _res, next) => next());
+let mockOpenIDCallbackAuthenticatorOptions;
+const mockCreateOpenIDCallbackAuthenticator = jest.fn((options) => {
+  mockOpenIDCallbackAuthenticatorOptions = options;
+  return mockOpenIDCallbackMiddleware;
+});
+const mockBuildOAuthFailureLog = jest.fn(({ provider, req, err, info, defaultMessage }) => ({
+  provider,
+  code: err?.code ?? info?.code ?? info?.error ?? req.query?.error,
+  name: err?.name ?? info?.name,
+  message:
+    err?.message ??
+    info?.message ??
+    info?.error_description ??
+    req.query?.error_description ??
+    defaultMessage,
+  cause_code: err?.cause?.code ?? info?.cause?.code,
+  cause_name: err?.cause?.name ?? info?.cause?.name,
+  has_code: req.query?.code != null,
+  has_state: req.query?.state != null,
+  query_error: req.query?.error,
+  query_error_description: req.query?.error_description,
+  path: req.path,
+  forwarded_for: req.headers?.['x-forwarded-for'],
+  user_agent: req.headers?.['user-agent'],
+}));
+const mockGetOAuthFailureMessage = jest.fn(
+  (req) =>
+    req.session?.messages?.pop() ??
+    req.query?.error_description ??
+    req.query?.error ??
+    'OAuth authentication failed',
+);
+const mockRedirectToAuthFailure = jest.fn((res, { clientDomain, authFailedError }) =>
+  res.redirect(`${clientDomain}/login?redirect=false&error=${authFailedError}`),
+);
+const mockPassportAuthenticate = jest.fn(() => (_req, _res, next) => next());
+
+jest.mock('passport', () => ({
+  authenticate: (...args) => mockPassportAuthenticate(...args),
+}));
+
+jest.mock('openid-client', () => ({
+  randomState: jest.fn(() => 'random-state'),
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: mockLogger,
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  ...jest.requireActual('librechat-data-provider'),
+  ErrorTypes: {
+    AUTH_FAILED: 'auth_failed',
+  },
+}));
+
+jest.mock('@librechat/api', () => ({
+  buildOAuthFailureLog: (...args) => mockBuildOAuthFailureLog(...args),
+  createOpenIDCallbackAuthenticator: (...args) => mockCreateOpenIDCallbackAuthenticator(...args),
+  createSetBalanceConfig: jest.fn(() => (_req, _res, next) => next()),
+  getOAuthFailureMessage: (...args) => mockGetOAuthFailureMessage(...args),
+  redirectToAuthFailure: (...args) => mockRedirectToAuthFailure(...args),
+}));
+
+jest.mock('~/server/middleware', () => ({
+  checkDomainAllowed: jest.fn((_req, _res, next) => next()),
+  loginLimiter: jest.fn((_req, _res, next) => next()),
+  logHeaders: jest.fn((_req, _res, next) => next()),
+}));
+
+jest.mock('~/server/controllers/auth/oauth', () => ({
+  createOAuthHandler: jest.fn(() => mockOAuthHandler),
+}));
+
+jest.mock('~/models', () => ({
+  findBalanceByUser: jest.fn(),
+  upsertBalanceFields: jest.fn(),
+}));
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: jest.fn(),
+}));
+
+afterAll(() => {
+  if (originalDomainClient === undefined) {
+    delete process.env.DOMAIN_CLIENT;
+    return;
+  }
+  process.env.DOMAIN_CLIENT = originalDomainClient;
+});
+
+function getOAuthRouter() {
+  jest.resetModules();
+  return require('./oauth');
+}
+
+function createApp(sessionMessages) {
+  const app = express();
+  app.use((req, _res, next) => {
+    if (sessionMessages) {
+      req.session = { messages: [...sessionMessages] };
+    }
+    next();
+  });
+  app.use('/oauth', getOAuthRouter());
+  app.use((err, _req, res, _next) => {
+    res.status(500).json({ message: err.message });
+  });
+  return app;
+}
+
+describe('OAuth route failure logging', () => {
+  beforeEach(() => {
+    mockLogger.warn.mockClear();
+    mockLogger.error.mockClear();
+    mockLogger.info.mockClear();
+    mockLogger.debug.mockClear();
+    mockOAuthHandler.mockClear();
+    mockOpenIDCallbackMiddleware.mockClear();
+    mockBuildOAuthFailureLog.mockClear();
+    mockGetOAuthFailureMessage.mockClear();
+    mockRedirectToAuthFailure.mockClear();
+    mockPassportAuthenticate.mockClear();
+    mockOpenIDCallbackAuthenticatorOptions = undefined;
+    mockPassportAuthenticate.mockImplementation(() => (_req, _res, next) => next());
+    mockOpenIDCallbackMiddleware.mockImplementation((_req, _res, next) => next());
+  });
+
+  it('wires the package OpenID callback middleware into the route', async () => {
+    const app = createApp();
+
+    await request(app)
+      .get('/oauth/openid/callback?code=secret-code&state=secret-state')
+      .expect(204);
+
+    expect(mockOpenIDCallbackAuthenticatorOptions).toEqual({
+      passport: expect.objectContaining({ authenticate: expect.any(Function) }),
+      logger: mockLogger,
+      clientDomain: 'http://client.test',
+      authFailedError: 'auth_failed',
+    });
+    expect(mockOpenIDCallbackMiddleware).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.any(Object),
+      expect.any(Function),
+    );
+    expect(mockOAuthHandler).toHaveBeenCalled();
+  });
+
+  it('logs structured fallback errors without using Unknown OAuth error', async () => {
+    const app = createApp();
+
+    const response = await request(app)
+      .get('/oauth/error?error=access_denied&error_description=Denied%20by%20provider')
+      .set('x-forwarded-for', '203.0.113.10')
+      .expect(302);
+
+    expect(response.headers.location).toBe(
+      'http://client.test/login?redirect=false&error=auth_failed',
+    );
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      '[OAuth] Authentication failed',
+      expect.objectContaining({
+        provider: 'unknown',
+        code: 'access_denied',
+        message: 'Denied by provider',
+        query_error: 'access_denied',
+        query_error_description: 'Denied by provider',
+        has_code: false,
+        has_state: false,
+        forwarded_for: '203.0.113.10',
+      }),
+    );
+    expect(JSON.stringify(mockLogger.warn.mock.calls[0])).not.toContain('Unknown OAuth error');
+  });
+});
diff --git a/api/server/routes/projects.js b/api/server/routes/projects.js
new file mode 100644
index 00000000000..fd782a1ba5d
--- /dev/null
+++ b/api/server/routes/projects.js
@@ -0,0 +1,25 @@
+const express = require('express');
+const { createProjectHandlers } = require('@librechat/api');
+const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const db = require('~/models');
+
+const router = express.Router();
+const handlers = createProjectHandlers({
+  listChatProjects: db.listChatProjects,
+  createChatProject: db.createChatProject,
+  getChatProject: db.getChatProject,
+  updateChatProject: db.updateChatProject,
+  deleteChatProject: db.deleteChatProject,
+  assignConversationToProject: db.assignConversationToProject,
+});
+
+router.use(requireJwtAuth);
+
+router.get('/', handlers.listProjects);
+router.post('/', handlers.createProject);
+router.put('/conversations/:conversationId', handlers.assignConversationToProject);
+router.get('/:projectId', handlers.getProject);
+router.patch('/:projectId', handlers.updateProject);
+router.delete('/:projectId', handlers.deleteProject);
+
+module.exports = router;
diff --git a/api/server/routes/rum.js b/api/server/routes/rum.js
new file mode 100644
index 00000000000..cc5c2f281a4
--- /dev/null
+++ b/api/server/routes/rum.js
@@ -0,0 +1,28 @@
+const express = require('express');
+const { getRumProxyBodyLimit, isRumProxyEnabled, proxyRumRequest } = require('@librechat/api');
+const { requireRumProxyAuth } = require('~/server/middleware');
+
+const router = express.Router();
+const rawOtlpBody = express.raw({
+  limit: getRumProxyBodyLimit(),
+  type: ['application/x-protobuf', 'application/octet-stream'],
+});
+
+function requireRumProxyEnabled(_req, res, next) {
+  if (!isRumProxyEnabled()) {
+    return res.status(404).json({ message: 'RUM proxy is not configured' });
+  }
+
+  return next();
+}
+
+router.post(
+  '/v1/traces',
+  requireRumProxyEnabled,
+  requireRumProxyAuth,
+  rawOtlpBody,
+  proxyRumRequest,
+);
+router.post('/v1/logs', requireRumProxyEnabled, requireRumProxyAuth, rawOtlpBody, proxyRumRequest);
+
+module.exports = router;
diff --git a/api/server/routes/share.js b/api/server/routes/share.js
index 296644afded..1a15bd2f73c 100644
--- a/api/server/routes/share.js
+++ b/api/server/routes/share.js
@@ -1,33 +1,254 @@
+const mongoose = require('mongoose');
 const express = require('express');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
 const {
+  isEnabled,
+  generateCheckAccess,
+  grantCreationPermissions,
+  ensureLinkPermissions,
+  isFileSnapshotEnabled,
+  isFileSnapshotKillSwitchActive,
+  buildSharedLinkStartupPayload,
+  deleteSharedLinkWithCleanup,
+  updateSharedLinkPermissionsExpiration,
+  isActiveExpirationDate,
+  getSharedLinkExpiration,
+} = require('@librechat/api');
+const {
+  logger,
+  getTenantId,
+  runAsSystem,
+  tenantStorage,
+  SYSTEM_TENANT_ID,
+  createTempChatExpirationDate,
+} = require('@librechat/data-schemas');
+const { FileSources, PermissionTypes, Permissions } = require('librechat-data-provider');
+const {
+  getFiles,
+  updateFile,
   getSharedMessages,
   createSharedLink,
   updateSharedLink,
-  deleteSharedLink,
   getSharedLinks,
   getSharedLink,
+  getSharedLinkFile,
+  backfillSharedLinkFiles,
+  getRoleByName,
 } = require('~/models');
+const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { cleanFileName, getContentDisposition } = require('~/server/utils/files');
+const canAccessSharedLink = require('~/server/middleware/canAccessSharedLink');
+const optionalShareFileAuth = require('~/server/middleware/optionalShareFileAuth');
+const optionalJwtAuth = require('~/server/middleware/optionalJwtAuth');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const configMiddleware = require('~/server/middleware/config/app');
+const { getAppConfig } = require('~/server/services/Config/app');
 const router = express.Router();
 
+const checkSharedLinksAccess = generateCheckAccess({
+  permissionType: PermissionTypes.SHARED_LINKS,
+  permissions: [Permissions.CREATE],
+  getRoleByName,
+});
+
+const resolveSharedLinkExpiration = (req, conversationId) =>
+  getSharedLinkExpiration(
+    { req, conversationId },
+    {
+      getConvo: async (userId, sourceConversationId) => {
+        const Conversation = mongoose.models.Conversation;
+        return Conversation.findOne(
+          { conversationId: sourceConversationId, user: userId },
+          'isTemporary expiredAt',
+        ).lean();
+      },
+      createExpirationDate: createTempChatExpirationDate,
+      logger,
+    },
+  );
+
 /**
  * Shared messages
  */
 const allowSharedLinks =
   process.env.ALLOW_SHARED_LINKS === undefined || isEnabled(process.env.ALLOW_SHARED_LINKS);
 
+/** Run within the snapshot file's tenant context (mirrors canAccessSharedLink). */
+const runWithTenant = (tenantId, fn) =>
+  tenantId ? tenantStorage.run({ tenantId }, fn) : runAsSystem(fn);
+
+/** Mirrors the owner preview route: pending records older than this are swept to
+ * 'failed' on the next poll so the client poller terminates. */
+const PREVIEW_LAZY_SWEEP_CUTOFF_MS = 2 * 60 * 1000;
+
+const getShareStartupPayload = async () => {
+  const tenantId = getTenantId();
+  const appConfig = await getAppConfig(
+    tenantId && tenantId !== SYSTEM_TENANT_ID ? { tenantId } : { baseOnly: true },
+  );
+  return buildSharedLinkStartupPayload(appConfig);
+};
+
+/**
+ * MIME types that are safe to render inline. Everything else (text/html, SVG,
+ * and other active content) is served as an `attachment` so a public viewer
+ * can't execute uploaded bytes under the app origin by opening the URL directly.
+ */
+const SAFE_INLINE_TYPES = new Set([
+  'image/png',
+  'image/jpeg',
+  'image/jpg',
+  'image/gif',
+  'image/webp',
+  'image/bmp',
+  'image/avif',
+  'image/x-icon',
+  'application/pdf',
+]);
+
+/**
+ * Resolve a snapshotted file for a shared link. A file_id absent from the
+ * share's snapshot is denied (404) — this prevents a viewer from reaching files
+ * outside the shared-link snapshot. Only legacy shares (no `fileSnapshots` field
+ * at all) trigger a lazy backfill; an ordinary miss does not rebuild. The live
+ * file record is also required: if the original was deleted/expired, return a
+ * clean 404 instead of letting the stream error after headers are sent.
+ */
+const resolveShareFile = async (req, res, next) => {
+  try {
+    // Global kill switch only (env-based, viewer-independent): disabling stops
+    // serving for every link. The viewer's own config must NOT affect serving.
+    if (isFileSnapshotKillSwitchActive()) {
+      return res.status(404).json({ message: 'Shared file access is disabled' });
+    }
+
+    const { shareId, file_id } = req.params;
+    const { file, hasSnapshots, optedOut } = await getSharedLinkFile(shareId, file_id);
+    // Per-link opt-out: never serve and never backfill an opted-out link.
+    if (optedOut) {
+      return res.status(404).json({ message: 'File not found in shared link' });
+    }
+    let snapshot = file;
+    if (!snapshot && !hasSnapshots) {
+      snapshot = await backfillSharedLinkFiles(shareId, file_id);
+    }
+    if (!snapshot) {
+      logger.warn(
+        `[shareFileAccess] File ${file_id} not in snapshot for share ${shareId} (route ${req.originalUrl})`,
+      );
+      return res.status(404).json({ message: 'File not found in shared link' });
+    }
+
+    const [liveFile] = await getFiles({ file_id }, null, {});
+    if (!liveFile) {
+      logger.warn(
+        `[shareFileAccess] Snapshotted file ${file_id} no longer available for share ${shareId}`,
+      );
+      return res.status(404).json({ message: 'File no longer available' });
+    }
+
+    // Pin to the snapshotted version so an old link can't surface post-share content
+    // after a reused file_id (e.g. code-exec same-filename outputs) is overwritten.
+    // previewRevision changes for deferred/office files; `bytes` catches other
+    // overwrites that change size, and is stable across S3 URL refresh and the
+    // pending->ready transition (which don't alter file size). Same-size content
+    // swaps remain a best-effort gap inherent to the no-byte-copy design.
+    const revisionChanged =
+      (snapshot.previewRevision ?? null) !== (liveFile.previewRevision ?? null);
+    const bytesChanged =
+      snapshot.bytes != null && liveFile.bytes != null && snapshot.bytes !== liveFile.bytes;
+    if (revisionChanged || bytesChanged) {
+      logger.warn(
+        `[shareFileAccess] Snapshot version mismatch for file ${file_id} (share ${shareId})`,
+      );
+      return res.status(404).json({ message: 'File no longer available' });
+    }
+
+    req.shareFile = snapshot;
+    req.liveFile = liveFile;
+    return next();
+  } catch (error) {
+    logger.error('[shareFileAccess] Error resolving shared file:', error);
+    return res.status(500).json({ message: 'Error resolving shared file' });
+  }
+};
+
+/** Stream (or redirect to) a snapshotted file from its original stored object. */
+const streamSharedFile = async (req, res, file, requestedDisposition) => {
+  const source = file.source || FileSources.local;
+  const { getDownloadStream, getDownloadURL } = getStrategyFunctions(source);
+
+  // Inline only safe preview types; anything else is forced to attachment.
+  const disposition =
+    requestedDisposition === 'inline' && SAFE_INLINE_TYPES.has(file.type) ? 'inline' : 'attachment';
+
+  // Redirect to a signed storage URL only when explicitly requested (?direct=true);
+  // by default stream through the server so blob (XHR) callers work without bucket CORS.
+  const isDirectSource = source === FileSources.s3 || source === FileSources.cloudfront;
+  if (req.query.direct === 'true' && getDownloadURL && isDirectSource) {
+    try {
+      const url = await getDownloadURL({
+        req,
+        file,
+        customFilename: cleanFileName(file.filename),
+        contentType: file.type || 'application/octet-stream',
+      });
+      if (url) {
+        res.setHeader('Cache-Control', 'no-store');
+        return res.redirect(302, url);
+      }
+    } catch (error) {
+      logger.warn('[shareFileAccess] download URL generation failed, streaming instead:', error);
+    }
+  }
+
+  if (!getDownloadStream) {
+    return res.status(501).send('Not Implemented');
+  }
+
+  // Strip any cache-busting query string (e.g. code-output images add `?v=...`) so
+  // the local stream resolves the real filename, not a literal `*.png?v=...` path.
+  const streamPath = (file.storageKey || file.filepath || '').split('?')[0];
+  const fileStream = await getDownloadStream(req, streamPath);
+  fileStream.on('error', (error) => {
+    logger.error('[shareFileAccess] Stream error:', error);
+  });
+
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('Content-Disposition', getContentDisposition(file.filename, disposition));
+  res.setHeader(
+    'Content-Type',
+    disposition === 'inline' ? file.type || 'application/octet-stream' : 'application/octet-stream',
+  );
+  res.setHeader('Cache-Control', 'private, max-age=3600');
+  return fileStream.pipe(res);
+};
+
 if (allowSharedLinks) {
-  const allowSharedLinksPublic = isEnabled(process.env.ALLOW_SHARED_LINKS_PUBLIC);
+  router.get('/:shareId/config', optionalJwtAuth, canAccessSharedLink, async (_req, res) => {
+    try {
+      const payload = await getShareStartupPayload();
+      res.set('Cache-Control', 'private, no-store');
+      res.status(200).json(payload);
+    } catch (error) {
+      logger.error('Error getting shared startup config:', error);
+      res.status(500).json({ message: 'Error getting shared startup config' });
+    }
+  });
+
   router.get(
     '/:shareId',
-    allowSharedLinksPublic ? (req, res, next) => next() : requireJwtAuth,
+    optionalJwtAuth,
+    canAccessSharedLink,
+    configMiddleware,
     async (req, res) => {
       try {
-        const share = await getSharedMessages(req.params.shareId);
-
+        const share = await getSharedMessages(req.params.shareId, req.shareResourceId, {
+          // Viewer-independent: the per-link choice (stored on the share) decides
+          // file inclusion; only a global env kill switch can force it off here.
+          snapshotFiles: !isFileSnapshotKillSwitchActive(),
+        });
         if (share) {
+          res.set('Cache-Control', 'private, no-store');
           res.status(200).json(share);
         } else {
           res.status(404).end();
@@ -38,6 +259,97 @@ if (allowSharedLinks) {
       }
     },
   );
+
+  /**
+   * Preview status for a snapshotted file. Read live from the file record so the
+   * status is always current (deferred previews may resolve after the share was
+   * created) and large extracted text is never embedded in the share document.
+   */
+  router.get(
+    '/:shareId/files/:file_id/preview',
+    optionalJwtAuth,
+    optionalShareFileAuth,
+    canAccessSharedLink,
+    configMiddleware,
+    resolveShareFile,
+    async (req, res) => {
+      try {
+        const { file_id } = req.params;
+        let liveFile = req.liveFile;
+        // Lazy-sweep orphaned pending records to 'failed' so the client preview
+        // poller reaches a terminal state (mirrors the owner preview route).
+        if (liveFile?.status === 'pending' && liveFile.updatedAt instanceof Date) {
+          const ageMs = Date.now() - liveFile.updatedAt.getTime();
+          if (ageMs > PREVIEW_LAZY_SWEEP_CUTOFF_MS) {
+            const swept = await updateFile(
+              { file_id, status: 'failed', previewError: 'orphaned' },
+              { status: 'pending', updatedAt: liveFile.updatedAt },
+            );
+            if (swept) {
+              liveFile = swept;
+            }
+          }
+        }
+        const status = liveFile?.status || 'ready';
+        const payload = { file_id, status };
+        if (status === 'ready' && liveFile?.text != null) {
+          payload.text = liveFile.text;
+          payload.textFormat = liveFile.textFormat ?? null;
+        } else if (status === 'failed' && liveFile?.previewError) {
+          payload.previewError = liveFile.previewError;
+        }
+        res.set('Cache-Control', 'private, no-store');
+        return res.status(200).json(payload);
+      } catch (error) {
+        logger.error('[shareFileAccess] Error fetching shared preview:', error);
+        return res.status(500).json({ message: 'Error fetching preview' });
+      }
+    },
+  );
+
+  /** Download a snapshotted file (attachment disposition). */
+  router.get(
+    '/:shareId/files/:file_id/download',
+    optionalJwtAuth,
+    optionalShareFileAuth,
+    canAccessSharedLink,
+    configMiddleware,
+    resolveShareFile,
+    async (req, res) => {
+      try {
+        await runWithTenant(req.shareFile.tenantId, () =>
+          streamSharedFile(req, res, req.shareFile, 'attachment'),
+        );
+      } catch (error) {
+        logger.error('[shareFileAccess] Error downloading shared file:', error);
+        if (!res.headersSent) {
+          res.status(500).send('Error downloading file');
+        }
+      }
+    },
+  );
+
+  /** Inline-serve a snapshotted file (image src, generic view). */
+  router.get(
+    '/:shareId/files/:file_id',
+    optionalJwtAuth,
+    optionalShareFileAuth,
+    canAccessSharedLink,
+    configMiddleware,
+    resolveShareFile,
+    async (req, res) => {
+      try {
+        await runWithTenant(req.shareFile.tenantId, () =>
+          streamSharedFile(req, res, req.shareFile, 'inline'),
+        );
+      } catch (error) {
+        logger.error('[shareFileAccess] Error serving shared file:', error);
+        if (!res.headersSent) {
+          res.status(500).send('Error serving file');
+        }
+      }
+    },
+  );
 }
 
 /**
@@ -48,7 +360,6 @@ router.get('/', requireJwtAuth, async (req, res) => {
     const params = {
       pageParam: req.query.cursor,
       pageSize: Math.max(1, parseInt(req.query.pageSize) || 10),
-      isPublic: isEnabled(req.query.isPublic),
       sortBy: ['createdAt', 'title'].includes(req.query.sortBy) ? req.query.sortBy : 'createdAt',
       sortDirection: ['asc', 'desc'].includes(req.query.sortDirection)
         ? req.query.sortDirection
@@ -60,7 +371,6 @@ router.get('/', requireJwtAuth, async (req, res) => {
       req.user.id,
       params.pageParam,
       params.pageSize,
-      params.isPublic,
       params.sortBy,
       params.sortDirection,
       params.search,
@@ -84,9 +394,16 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
   try {
     const share = await getSharedLink(req.user.id, req.params.conversationId);
 
+    if (share._id && share.success) {
+      await ensureLinkPermissions(share._id, req.user.id);
+    }
+
     return res.status(200).json({
+      _id: share._id,
       success: share.success,
       shareId: share.shareId,
+      targetMessageId: share.targetMessageId,
+      snapshotFiles: share.snapshotFiles,
       conversationId: req.params.conversationId,
     });
   } catch (error) {
@@ -95,25 +412,77 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
   }
 });
 
-router.post('/:conversationId', requireJwtAuth, async (req, res) => {
-  try {
-    const { targetMessageId } = req.body;
-    const created = await createSharedLink(req.user.id, req.params.conversationId, targetMessageId);
-    if (created) {
-      res.status(200).json(created);
-    } else {
-      res.status(404).end();
+router.post(
+  '/:conversationId',
+  requireJwtAuth,
+  configMiddleware,
+  checkSharedLinksAccess,
+  async (req, res) => {
+    try {
+      const { targetMessageId } = req.body;
+      const expiredAt = await resolveSharedLinkExpiration(req, req.params.conversationId);
+      if (expiredAt != null && !isActiveExpirationDate(expiredAt)) {
+        return res.status(404).end();
+      }
+
+      const role = await getRoleByName(req.user.role);
+      const sharedLinksPerms = role?.permissions?.[PermissionTypes.SHARED_LINKS] || {};
+      const grantPublic = sharedLinksPerms[Permissions.SHARE_PUBLIC] === true;
+      // Per-link opt-out: snapshot only when the feature is enabled AND the user
+      // did not uncheck "share files" (body flag absent defaults to enabled).
+      const snapshotFiles = isFileSnapshotEnabled(req.config) && req.body?.snapshotFiles !== false;
+
+      const created = await createSharedLink(
+        req.user.id,
+        req.params.conversationId,
+        targetMessageId,
+        expiredAt,
+        snapshotFiles,
+      );
+      if (created) {
+        await grantCreationPermissions(created._id, req.user.id, grantPublic, expiredAt);
+        res.status(200).json(created);
+      } else {
+        res.status(404).end();
+      }
+    } catch (error) {
+      logger.error('Error creating shared link:', error);
+      res.status(500).json({ message: 'Error creating shared link' });
     }
-  } catch (error) {
-    logger.error('Error creating shared link:', error);
-    res.status(500).json({ message: 'Error creating shared link' });
-  }
-});
+  },
+);
 
-router.patch('/:shareId', requireJwtAuth, async (req, res) => {
+router.patch('/:shareId', requireJwtAuth, configMiddleware, async (req, res) => {
   try {
-    const updatedShare = await updateSharedLink(req.user.id, req.params.shareId);
+    const { targetMessageId } = req.body ?? {};
+    if (targetMessageId !== undefined && typeof targetMessageId !== 'string') {
+      return res.status(400).json({ message: 'targetMessageId must be a string' });
+    }
+
+    let expiredAt;
+    const SharedLink = mongoose.models.SharedLink;
+    const existing = await SharedLink.findOne(
+      { shareId: req.params.shareId, user: req.user.id },
+      'conversationId',
+    ).lean();
+    if (existing?.conversationId) {
+      expiredAt = await resolveSharedLinkExpiration(req, existing.conversationId);
+    }
+    if (expiredAt != null && !isActiveExpirationDate(expiredAt)) {
+      return res.status(404).end();
+    }
+
+    const updatedShare = await updateSharedLink(
+      req.user.id,
+      req.params.shareId,
+      targetMessageId,
+      expiredAt,
+      isFileSnapshotEnabled(req.config) && req.body?.snapshotFiles !== false,
+    );
     if (updatedShare) {
+      if (updatedShare._id && expiredAt !== undefined) {
+        await updateSharedLinkPermissionsExpiration(updatedShare._id, expiredAt);
+      }
       res.status(200).json(updatedShare);
     } else {
       res.status(404).end();
@@ -126,7 +495,7 @@ router.patch('/:shareId', requireJwtAuth, async (req, res) => {
 
 router.delete('/:shareId', requireJwtAuth, async (req, res) => {
   try {
-    const result = await deleteSharedLink(req.user.id, req.params.shareId);
+    const result = await deleteSharedLinkWithCleanup(req.user.id, req.params.shareId);
 
     if (!result) {
       return res.status(404).json({ message: 'Share not found' });
diff --git a/api/server/routes/skills.js b/api/server/routes/skills.js
index 694009a480b..99339d2a297 100644
--- a/api/server/routes/skills.js
+++ b/api/server/routes/skills.js
@@ -21,14 +21,11 @@ const {
 const {
   createSkill,
   getSkillById,
-  listSkillsByAccess,
   updateSkill,
   deleteSkill,
-  listSkillFiles,
   upsertSkillFile,
   deleteSkillFile,
   getSkillFileByPath,
-  updateSkillFileContent,
   getRoleByName,
 } = require('~/models');
 const { requireJwtAuth, canAccessSkillResource } = require('~/server/middleware');
@@ -40,8 +37,14 @@ const {
 } = require('~/server/services/PermissionService');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { createFileLimiters } = require('~/server/middleware/limiters/uploadLimiters');
+const { maybeRunGitHubSkillSyncForRequest } = require('~/server/services/Skills/sync');
 const configMiddleware = require('~/server/middleware/config/app');
 const { getFileStrategy } = require('~/server/utils/getFileStrategy');
+const {
+  getSkillDbMethods,
+  withDeploymentSkillIds,
+  getSkillStrategyFunctions,
+} = require('~/server/services/Endpoints/agents/skillDeps');
 
 const router = express.Router();
 
@@ -100,6 +103,7 @@ const checkSkillCreate = generateCheckAccess({
 // Rate limiters (reuse existing file upload limiters)
 // ---------------------------------------------------------------------------
 const { fileUploadIpLimiter, fileUploadUserLimiter } = createFileLimiters();
+const skillDbMethods = getSkillDbMethods();
 
 router.use(requireJwtAuth);
 router.use(configMiddleware);
@@ -110,18 +114,28 @@ router.use(checkSkillAccess);
 // ---------------------------------------------------------------------------
 const handlers = createSkillsHandlers({
   createSkill,
-  getSkillById,
-  listSkillsByAccess,
+  getSkillById: skillDbMethods.getSkillById,
+  listSkillsByAccess: skillDbMethods.listSkillsByAccess,
   updateSkill,
   deleteSkill,
-  listSkillFiles,
+  listSkillFiles: skillDbMethods.listSkillFiles,
   deleteSkillFile,
-  getSkillFileByPath,
-  updateSkillFileContent,
-  getStrategyFunctions,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
+  getSkillFileByPath: skillDbMethods.getSkillFileByPath,
+  updateSkillFileContent: skillDbMethods.updateSkillFileContent,
+  getStrategyFunctions: getSkillStrategyFunctions,
+  findAccessibleResources: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds(await findAccessibleResources(params))
+      : findAccessibleResources(params),
+  findPubliclyAccessibleResources: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds(await findPubliclyAccessibleResources(params))
+      : findPubliclyAccessibleResources(params),
+  hasPublicPermission: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds([]).some((id) => id.toString() === params.resourceId.toString()) ||
+        hasPublicPermission(params)
+      : hasPublicPermission(params),
   grantPermission,
   isValidObjectIdString,
 });
@@ -272,6 +286,14 @@ async function uploadFileHandler(req, res) {
 // ---------------------------------------------------------------------------
 // Routes
 // ---------------------------------------------------------------------------
+async function maybeStartRequestSkillSync(req, _res, next) {
+  try {
+    await maybeRunGitHubSkillSyncForRequest(req);
+  } catch (error) {
+    logger.error('[GET /skills] Failed to start request-scoped skill sync:', error);
+  }
+  next();
+}
 
 // Import: accepts .md / .zip / .skill via multipart
 router.post(
@@ -284,7 +306,7 @@ router.post(
   importHandler,
 );
 
-router.get('/', handlers.list);
+router.get('/', maybeStartRequestSkillSync, handlers.list);
 router.post('/', checkSkillCreate, handlers.create);
 
 router.get(
diff --git a/api/server/routes/skills.test.js b/api/server/routes/skills.test.js
index af99e4bc5e5..c48c0ff70bf 100644
--- a/api/server/routes/skills.test.js
+++ b/api/server/routes/skills.test.js
@@ -33,6 +33,7 @@ const {
 } = require('librechat-data-provider');
 
 let mockFileConfig;
+const mockMaybeRunGitHubSkillSyncForRequest = jest.fn(async () => false);
 
 jest.mock('~/server/services/Config', () => ({
   getCachedTools: jest.fn().mockResolvedValue({}),
@@ -68,6 +69,10 @@ jest.mock('~/server/utils/getFileStrategy', () => ({
   getFileStrategy: jest.fn().mockReturnValue('local'),
 }));
 
+jest.mock('~/server/services/Skills/sync', () => ({
+  maybeRunGitHubSkillSyncForRequest: mockMaybeRunGitHubSkillSyncForRequest,
+}));
+
 jest.mock('~/models', () => {
   const mongoose = require('mongoose');
   const { createMethods } = require('@librechat/data-schemas');
@@ -152,6 +157,7 @@ afterEach(async () => {
   await AclEntry.deleteMany({});
   currentTestUser = testUsers.owner;
   mockFileConfig = undefined;
+  mockMaybeRunGitHubSkillSyncForRequest.mockClear();
 });
 
 afterAll(async () => {
@@ -409,6 +415,12 @@ describe('Skill routes', () => {
       setTestUser(testUsers.owner);
       const res = await request(app).get('/api/skills');
       expect(res.status).toBe(200);
+      expect(mockMaybeRunGitHubSkillSyncForRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          config: expect.objectContaining({ fileStrategy: 'local' }),
+          user: expect.objectContaining({ id: testUsers.owner._id.toString() }),
+        }),
+      );
       expect(res.body.skills.length).toBe(1);
       expect(res.body.skills[0].name).toBe('mine-skill');
     });
diff --git a/api/server/services/ActionService.js b/api/server/services/ActionService.js
index 859496bf7c2..db8a536d8e5 100644
--- a/api/server/services/ActionService.js
+++ b/api/server/services/ActionService.js
@@ -9,6 +9,7 @@ const {
   refreshAccessToken,
   GenerationJobManager,
   createSSRFSafeAgents,
+  validateActionOAuthMetadata,
 } = require('@librechat/api');
 const {
   Time,
@@ -28,7 +29,7 @@ const {
   deleteActions,
   deleteAssistant,
 } = require('~/models');
-const { getFlowStateManager } = require('~/config');
+const { getActionFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const JWT_SECRET = process.env.JWT_SECRET;
@@ -203,6 +204,8 @@ async function createActionTool({
       if (metadata.auth && metadata.auth.type !== AuthTypeEnum.None) {
         try {
           if (metadata.auth.type === AuthTypeEnum.OAuth && metadata.auth.authorization_url) {
+            await validateActionOAuthMetadata(metadata.auth, allowedAddresses);
+
             const action_id = action.action_id;
             const identifier = `${userId}:${action.action_id}`;
             const requestLogin = async () => {
@@ -240,7 +243,7 @@ async function createActionTool({
                   },
                 };
                 const flowsCache = getLogStores(CacheKeys.FLOWS);
-                const flowManager = getFlowStateManager(flowsCache);
+                const flowManager = getActionFlowStateManager(flowsCache);
                 await flowManager.createFlowWithHandler(
                   `${identifier}:oauth_login:${config.metadata.thread_id}:${config.metadata.run_id}`,
                   'oauth_login',
@@ -266,6 +269,7 @@ async function createActionTool({
                     client_url: metadata.auth.client_url,
                     redirect_uri: `${process.env.DOMAIN_SERVER}/api/actions/${action_id}/oauth/callback`,
                     token_exchange_method: metadata.auth.token_exchange_method,
+                    allowedAddresses,
                     /** Encrypted values */
                     encrypted_oauth_client_id: encrypted.oauth_client_id,
                     encrypted_oauth_client_secret: encrypted.oauth_client_secret,
@@ -328,6 +332,7 @@ async function createActionTool({
                       encrypted_oauth_client_id: encrypted.oauth_client_id,
                       token_exchange_method: metadata.auth.token_exchange_method,
                       encrypted_oauth_client_secret: encrypted.oauth_client_secret,
+                      allowedAddresses,
                     },
                     {
                       findToken,
@@ -336,7 +341,7 @@ async function createActionTool({
                     },
                   );
                 const flowsCache = getLogStores(CacheKeys.FLOWS);
-                const flowManager = getFlowStateManager(flowsCache);
+                const flowManager = getActionFlowStateManager(flowsCache);
                 const refreshData = await flowManager.createFlowWithHandler(
                   `${identifier}:refresh`,
                   'oauth_refresh',
diff --git a/api/server/services/Artifacts/update.js b/api/server/services/Artifacts/update.js
index be1644b11c4..11831c96e8b 100644
--- a/api/server/services/Artifacts/update.js
+++ b/api/server/services/Artifacts/update.js
@@ -1,130 +1,9 @@
-const ARTIFACT_START = ':::artifact';
-const ARTIFACT_END = ':::';
-
-/**
- * Find all artifact boundaries in the message
- * @param {TMessage} message
- * @returns {Array<{start: number, end: number, source: 'content'|'text', partIndex?: number}>}
- */
-const findAllArtifacts = (message) => {
-  const artifacts = [];
-
-  // Check content parts first
-  if (message.content?.length) {
-    message.content.forEach((part, partIndex) => {
-      if (part.type === 'text' && typeof part.text === 'string') {
-        let currentIndex = 0;
-        let start = part.text.indexOf(ARTIFACT_START, currentIndex);
-
-        while (start !== -1) {
-          const end = part.text.indexOf(ARTIFACT_END, start + ARTIFACT_START.length);
-          artifacts.push({
-            start,
-            end: end !== -1 ? end + ARTIFACT_END.length : part.text.length,
-            source: 'content',
-            partIndex,
-            text: part.text,
-          });
-
-          currentIndex = end !== -1 ? end + ARTIFACT_END.length : part.text.length;
-          start = part.text.indexOf(ARTIFACT_START, currentIndex);
-        }
-      }
-    });
-  }
-
-  // Check message.text if no content parts
-  if (!artifacts.length && message.text) {
-    let currentIndex = 0;
-    let start = message.text.indexOf(ARTIFACT_START, currentIndex);
-
-    while (start !== -1) {
-      const end = message.text.indexOf(ARTIFACT_END, start + ARTIFACT_START.length);
-      artifacts.push({
-        start,
-        end: end !== -1 ? end + ARTIFACT_END.length : message.text.length,
-        source: 'text',
-        text: message.text,
-      });
-
-      currentIndex = end !== -1 ? end + ARTIFACT_END.length : message.text.length;
-      start = message.text.indexOf(ARTIFACT_START, currentIndex);
-    }
-  }
-
-  return artifacts;
-};
-
-const replaceArtifactContent = (originalText, artifact, original, updated) => {
-  const artifactContent = artifact.text.substring(artifact.start, artifact.end);
-
-  // Find boundaries between ARTIFACT_START and ARTIFACT_END
-  const contentStart = artifactContent.indexOf('\n', artifactContent.indexOf(ARTIFACT_START)) + 1;
-  let contentEnd = artifactContent.lastIndexOf(ARTIFACT_END);
-
-  // Special case: if contentEnd is 0, it means the only ::: found is at the start of :::artifact
-  // This indicates an incomplete artifact (no closing :::)
-  // We need to check that it's exactly at position 0 (the beginning of artifactContent)
-  if (contentEnd === 0 && artifactContent.indexOf(ARTIFACT_START) === 0) {
-    contentEnd = artifactContent.length;
-  }
-
-  if (contentStart === -1 || contentEnd === -1) {
-    return null;
-  }
-
-  // Check if there are code blocks - handle both ```\n and ```lang\n formats
-  let codeBlockStart = artifactContent.indexOf('```', contentStart);
-  const codeBlockEnd = artifactContent.lastIndexOf('\n```', contentEnd);
-
-  // If we found opening backticks, find the actual newline (skipping any language identifier)
-  if (codeBlockStart !== -1) {
-    const newlineAfterBackticks = artifactContent.indexOf('\n', codeBlockStart);
-    if (newlineAfterBackticks !== -1 && newlineAfterBackticks < contentEnd) {
-      codeBlockStart = newlineAfterBackticks;
-    } else {
-      codeBlockStart = -1;
-    }
-  }
-
-  // Determine where to look for the original content
-  let searchStart, searchEnd;
-  if (codeBlockStart !== -1) {
-    // Code block starts - searchStart is right after the newline following ```[lang]
-    searchStart = codeBlockStart + 1; // after the newline
-
-    if (codeBlockEnd !== -1 && codeBlockEnd > codeBlockStart) {
-      // Code block has proper ending
-      searchEnd = codeBlockEnd;
-    } else {
-      // No closing backticks found or they're before the opening (shouldn't happen)
-      // This might be an incomplete artifact - search to contentEnd
-      searchEnd = contentEnd;
-    }
-  } else {
-    // No code blocks at all
-    searchStart = contentStart;
-    searchEnd = contentEnd;
-  }
-
-  const innerContent = artifactContent.substring(searchStart, searchEnd);
-  // Remove trailing newline from original for comparison
-  const originalTrimmed = original.replace(/\n$/, '');
-  const relativeIndex = innerContent.indexOf(originalTrimmed);
-
-  if (relativeIndex === -1) {
-    return null;
-  }
-
-  const absoluteIndex = artifact.start + searchStart + relativeIndex;
-  const endText = originalText.substring(absoluteIndex + originalTrimmed.length);
-  const hasTrailingNewline = endText.startsWith('\n');
-
-  const updatedText =
-    originalText.substring(0, absoluteIndex) + updated + (hasTrailingNewline ? '' : '\n') + endText;
-
-  return updatedText.replace(/\n+(?=```\n:::)/g, '\n');
-};
+const {
+  ARTIFACT_START,
+  ARTIFACT_END,
+  findAllArtifacts,
+  replaceArtifactContent,
+} = require('@librechat/api');
 
 module.exports = {
   ARTIFACT_START,
diff --git a/api/server/services/Artifacts/update.spec.js b/api/server/services/Artifacts/update.spec.js
index 39a4f02863e..59cd1325a93 100644
--- a/api/server/services/Artifacts/update.spec.js
+++ b/api/server/services/Artifacts/update.spec.js
@@ -75,6 +75,85 @@ describe('findAllArtifacts', () => {
     expect(result).toHaveLength(2);
     expect(result[1].start).toBeGreaterThan(result[0].end);
   });
+
+  test('should ignore artifact close markers inside fenced content', () => {
+    const content = 'before\n:::\nafter';
+    const artifactText = `${ARTIFACT_START}{identifier="markdown" type="text/markdown" title="Markdown"}
+\`\`\`markdown
+${content}
+\`\`\`
+${ARTIFACT_END}`;
+    const message = { text: `${artifactText}\ntrailer` };
+
+    const result = findAllArtifacts(message);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].end).toBe(artifactText.length);
+  });
+
+  test('should allow trailing text after an artifact close marker', () => {
+    const artifactText = `${ARTIFACT_START}{identifier="plain" type="text/plain" title="Plain"}
+content
+${ARTIFACT_END}Thanks for reading`;
+    const message = { text: `${artifactText}\n${createArtifactText({ content: 'next' })}` };
+
+    const result = findAllArtifacts(message);
+
+    expect(result).toHaveLength(2);
+    expect(message.text.slice(result[0].end, result[0].end + 18)).toBe('Thanks for reading');
+  });
+
+  test('should not end an unclosed artifact at an internal marker in a closed fence', () => {
+    const artifactText = `${ARTIFACT_START}{identifier="markdown" type="text/markdown" title="Markdown"}
+\`\`\`markdown
+before
+:::
+after
+\`\`\`
+trailer`;
+    const message = { text: artifactText };
+
+    const result = findAllArtifacts(message);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].end).toBe(artifactText.length);
+  });
+
+  test('should keep artifact start markers inside fenced content', () => {
+    const artifactText = `${ARTIFACT_START}{identifier="markdown" type="text/markdown" title="Markdown"}
+\`\`\`markdown
+before
+:::
+:::artifact{identifier="sample" type="text/plain" title="Sample"}
+after
+\`\`\`
+${ARTIFACT_END}`;
+    const message = { text: artifactText };
+
+    const result = findAllArtifacts(message);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].end).toBe(artifactText.length);
+  });
+
+  test('should preserve the first fallback close in an unclosed fence', () => {
+    const firstArtifact = `${ARTIFACT_START}{identifier="first" type="text/html" title="First"}
+\`\`\`html
+<div>first</div>
+${ARTIFACT_END}`;
+    const secondArtifact = createArtifactText({
+      content: '<div>second</div>',
+      wrapCode: false,
+      prefix: '{identifier="second" type="text/html" title="Second"}',
+    });
+    const message = { text: `${firstArtifact}\n${secondArtifact}` };
+
+    const result = findAllArtifacts(message);
+
+    expect(result).toHaveLength(2);
+    expect(result[0].end).toBe(firstArtifact.length);
+    expect(result[1].start).toBe(firstArtifact.length + 1);
+  });
 });
 
 describe('replaceArtifactContent', () => {
@@ -143,6 +222,49 @@ describe('replaceArtifactContent', () => {
 
     expect(result).toBe(`${ARTIFACT_START}\n${updated}\n${ARTIFACT_END}`);
   });
+
+  test('should replace markdown artifacts with internal code fences', () => {
+    const original = `# Notes
+
+\`\`\`js
+console.log('inside');
+\`\`\`
+
+Done`;
+    const updated = original.replace('Done', 'Updated');
+    const artifactText = `${ARTIFACT_START}{identifier="notes" type="text/markdown" title="Notes"}
+${original}
+${ARTIFACT_END}`;
+    const message = { text: artifactText };
+    const artifacts = findAllArtifacts(message);
+
+    const result = replaceArtifactContent(artifactText, artifacts[0], original, updated);
+
+    expect(result).not.toBeNull();
+    expect(result).toContain('Updated');
+    expect(result).toContain("console.log('inside');");
+  });
+
+  test('should replace unclosed artifacts with internal markers in fenced content', () => {
+    const original = `before
+\`\`\`markdown
+inside
+:::
+still inside
+\`\`\`
+after`;
+    const artifactText = `${ARTIFACT_START}{identifier="notes" type="text/markdown" title="Notes"}
+${original}`;
+    const message = { text: artifactText };
+    const artifacts = findAllArtifacts(message);
+    const updated = original.replace('after', 'updated');
+
+    const result = replaceArtifactContent(artifactText, artifacts[0], original, updated);
+
+    expect(result).not.toBeNull();
+    expect(result).toContain('updated');
+    expect(result).toContain(':::');
+  });
 });
 
 describe('replaceArtifactContent with shared text', () => {
@@ -375,6 +497,26 @@ ${original}`;
       expect(result).toContain('UPDATED');
     });
 
+    test('should handle complete artifact marker with unclosed wrapping code block', () => {
+      const original = '# Markdown document\n\n```js\nconsole.log("missing closing fence");';
+      const artifactText = `${ARTIFACT_START}{identifier="doc" type="text/markdown" title="Doc"}
+\`\`\`markdown
+${original}
+${ARTIFACT_END}`;
+      const message = { text: artifactText };
+      const artifacts = findAllArtifacts(message);
+
+      expect(artifacts).toHaveLength(1);
+      expect(artifacts[0].end).toBe(artifactText.length);
+
+      const updated = original.replace('Markdown document', 'Updated document');
+      const result = replaceArtifactContent(artifactText, artifacts[0], original, updated);
+
+      expect(result).not.toBeNull();
+      expect(result).toContain('Updated document');
+      expect(result).toContain(ARTIFACT_END);
+    });
+
     test('should handle incomplete artifacts without code blocks', () => {
       const original = 'Some plain text content';
       const incompleteArtifact = `${ARTIFACT_START}{id="test"}\n${original}`;
diff --git a/api/server/services/AuthService.js b/api/server/services/AuthService.js
index 943c5a81f6f..8f6c281ee1d 100644
--- a/api/server/services/AuthService.js
+++ b/api/server/services/AuthService.js
@@ -3,6 +3,7 @@ const jwt = require('jsonwebtoken');
 const { webcrypto } = require('node:crypto');
 const {
   logger,
+  getTenantId,
   DEFAULT_SESSION_EXPIRY,
   DEFAULT_REFRESH_TOKEN_EXPIRY,
 } = require('@librechat/data-schemas');
@@ -44,9 +45,113 @@ const domains = {
   server: process.env.DOMAIN_SERVER,
 };
 
+const AuthTokenTypes = Object.freeze({
+  EMAIL_VERIFICATION: 'email_verification',
+  PASSWORD_RESET: 'password_reset',
+});
+
+const latestAuthTokenOptions = Object.freeze({ sort: { createdAt: -1 } });
 const genericVerificationMessage = 'Please check your email to verify your email address.';
+const invalidEmailVerificationMessage = 'Invalid or expired email verification token';
 const OPENID_SESSION_ID_TOKEN_EXPIRY_BUFFER_SECONDS = 30;
 
+const findPasswordResetToken = async (userId) => {
+  const typedToken = await findToken(
+    {
+      userId,
+      type: AuthTokenTypes.PASSWORD_RESET,
+    },
+    latestAuthTokenOptions,
+  );
+
+  if (typedToken) {
+    return typedToken;
+  }
+
+  return await findToken(
+    {
+      userId,
+      email: null,
+      identifier: null,
+      type: null,
+    },
+    latestAuthTokenOptions,
+  );
+};
+
+const findEmailVerificationToken = async (user) => {
+  const typedToken = await findToken(
+    {
+      userId: user._id,
+      email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
+    },
+    latestAuthTokenOptions,
+  );
+
+  if (typedToken) {
+    return typedToken;
+  }
+
+  return await findToken(
+    {
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    },
+    latestAuthTokenOptions,
+  );
+};
+
+const deleteEmailVerificationTokens = (user) =>
+  Promise.all([
+    deleteTokens({
+      userId: user._id,
+      email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
+    }),
+    deleteTokens({
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    }),
+  ]);
+
+const getEmailVerificationTokenDeleteQuery = (emailVerificationToken) => {
+  if (!emailVerificationToken.identifier && !emailVerificationToken.type) {
+    return {
+      token: emailVerificationToken.token,
+      userId: emailVerificationToken.userId,
+      email: emailVerificationToken.email,
+      identifier: null,
+      type: null,
+    };
+  }
+
+  return {
+    token: emailVerificationToken.token,
+    type: AuthTokenTypes.EMAIL_VERIFICATION,
+  };
+};
+
+const getPasswordResetTokenDeleteQuery = (passwordResetToken) => {
+  if (!passwordResetToken.email && !passwordResetToken.type) {
+    return {
+      token: passwordResetToken.token,
+      email: null,
+      identifier: null,
+      type: null,
+    };
+  }
+
+  return {
+    token: passwordResetToken.token,
+    type: AuthTokenTypes.PASSWORD_RESET,
+  };
+};
+
 const getUnexpiredOpenIDSessionIdToken = (idToken) => {
   if (!idToken) {
     return;
@@ -132,6 +237,7 @@ const sendVerificationEmail = async (user) => {
   await createToken({
     userId: user._id,
     email: user.email,
+    type: AuthTokenTypes.EMAIL_VERIFICATION,
     token: hash,
     createdAt: Date.now(),
     expiresIn: 900,
@@ -146,25 +252,46 @@ const sendVerificationEmail = async (user) => {
  */
 const verifyEmail = async (req) => {
   const { email, token } = req.body;
-  const decodedEmail = decodeURIComponent(email);
+
+  if (typeof email !== 'string' || typeof token !== 'string' || !email || !token) {
+    logger.warn('[verifyEmail] [Invalid email verification request]');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  let decodedEmail;
+  try {
+    decodedEmail = decodeURIComponent(email);
+  } catch {
+    logger.warn(`[verifyEmail] [Invalid email encoding] [Email: ${email}]`);
+    return new Error(invalidEmailVerificationMessage);
+  }
 
   const user = await findUser({ email: decodedEmail }, 'email _id emailVerified');
 
   if (!user) {
     logger.warn(`[verifyEmail] [User not found] [Email: ${decodedEmail}]`);
-    return new Error('User not found');
+    return new Error(invalidEmailVerificationMessage);
   }
 
-  if (user.emailVerified) {
-    logger.info(`[verifyEmail] Email already verified [Email: ${decodedEmail}]`);
-    return { message: 'Email already verified', status: 'success' };
-  }
-
-  let emailVerificationData = await findToken({ email: decodedEmail }, { sort: { createdAt: -1 } });
+  const emailVerificationData = await findEmailVerificationToken(user);
 
   if (!emailVerificationData) {
     logger.warn(`[verifyEmail] [No email verification data found] [Email: ${decodedEmail}]`);
-    return new Error('Invalid or expired password reset token');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  if (!emailVerificationData.token) {
+    logger.warn(
+      `[verifyEmail] [Email verification token data is invalid] [Email: ${decodedEmail}]`,
+    );
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  const tokenUserId = emailVerificationData.userId?.toString();
+  const userId = user._id?.toString();
+  if (!tokenUserId || tokenUserId !== userId) {
+    logger.warn(`[verifyEmail] [Email verification token user mismatch] [Email: ${decodedEmail}]`);
+    return new Error(invalidEmailVerificationMessage);
   }
 
   const isValid = bcrypt.compareSync(token, emailVerificationData.token);
@@ -173,17 +300,23 @@ const verifyEmail = async (req) => {
     logger.warn(
       `[verifyEmail] [Invalid or expired email verification token] [Email: ${decodedEmail}]`,
     );
-    return new Error('Invalid or expired email verification token');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  if (user.emailVerified) {
+    await deleteTokens(getEmailVerificationTokenDeleteQuery(emailVerificationData));
+    logger.info(`[verifyEmail] Email already verified [Email: ${decodedEmail}]`);
+    return { message: 'Email verification was successful', status: 'success' };
   }
 
   const updatedUser = await updateUser(emailVerificationData.userId, { emailVerified: true });
 
   if (!updatedUser) {
     logger.warn(`[verifyEmail] [User update failed] [Email: ${decodedEmail}]`);
-    return new Error('Failed to update user verification status');
+    return new Error(invalidEmailVerificationMessage);
   }
 
-  await deleteTokens({ token: emailVerificationData.token });
+  await deleteTokens(getEmailVerificationTokenDeleteQuery(emailVerificationData));
   logger.info(`[verifyEmail] Email verification successful [Email: ${decodedEmail}]`);
   return { message: 'Email verification was successful', status: 'success' };
 };
@@ -191,13 +324,13 @@ const verifyEmail = async (req) => {
 /**
  * Register a new user.
  * @param {IUser} user <email, password, name, username>
- * @param {Partial<IUser>} [additionalData={}]
+ * @param {Partial<IUser>} [additionalData={}] Trusted server-provided fields, such as CLI overrides.
  * @returns {Promise<{status: number, message: string, user?: IUser}>}
  */
 const registerUser = async (user, additionalData = {}) => {
-  const { error } = registerSchema.safeParse(user);
-  if (error) {
-    const errorMessage = errorsToString(error.errors);
+  const result = registerSchema.safeParse(user);
+  if (!result.success) {
+    const errorMessage = errorsToString(result.error.errors);
     logger.info(
       'Route: register - Validation Error',
       { name: 'Request params:', value: user },
@@ -207,11 +340,13 @@ const registerUser = async (user, additionalData = {}) => {
     return { status: 404, message: errorMessage };
   }
 
-  const { email, password, name, username, provider } = user;
+  const { email, password, name, username } = result.data;
+  const { provider, ...trustedAdditionalData } = additionalData ?? {};
 
   let newUserId;
   try {
-    const appConfig = await getAppConfig({ baseOnly: true });
+    const tenantId = getTenantId();
+    const appConfig = await getAppConfig(tenantId ? { tenantId } : {});
     if (!isEmailDomainAllowed(email, appConfig?.registration?.allowedDomains)) {
       const errorMessage =
         'The email address provided cannot be used. Please use a different email address.';
@@ -245,7 +380,7 @@ const registerUser = async (user, additionalData = {}) => {
       avatar: null,
       role: isFirstRegisteredUser ? SystemRoles.ADMIN : SystemRoles.USER,
       password: bcrypt.hashSync(password, salt),
-      ...additionalData,
+      ...trustedAdditionalData,
     };
 
     const emailEnabled = checkEmailConfig();
@@ -334,12 +469,16 @@ const requestPasswordReset = async (req) => {
     };
   }
 
-  await deleteTokens({ userId: user._id });
+  await Promise.all([
+    deleteTokens({ userId: user._id, type: AuthTokenTypes.PASSWORD_RESET }),
+    deleteTokens({ userId: user._id, email: null, identifier: null, type: null }),
+  ]);
 
   const [resetToken, hash] = createTokenHash();
 
   await createToken({
     userId: user._id,
+    type: AuthTokenTypes.PASSWORD_RESET,
     token: hash,
     createdAt: Date.now(),
     expiresIn: 900,
@@ -383,12 +522,7 @@ const requestPasswordReset = async (req) => {
  * @returns
  */
 const resetPassword = async (userId, token, password) => {
-  let passwordResetToken = await findToken(
-    {
-      userId,
-    },
-    { sort: { createdAt: -1 } },
-  );
+  const passwordResetToken = await findPasswordResetToken(userId);
 
   if (!passwordResetToken) {
     return new Error('Invalid or expired password reset token');
@@ -416,7 +550,7 @@ const resetPassword = async (userId, token, password) => {
     });
   }
 
-  await deleteTokens({ token: passwordResetToken.token });
+  await deleteTokens(getPasswordResetTokenDeleteQuery(passwordResetToken));
   logger.info(`[resetPassword] Password reset successful. [Email: ${user.email}]`);
   return { message: 'Password reset was successful' };
 };
@@ -448,6 +582,8 @@ const getCloudFrontAuthCookieSkipReason = (scope) => {
   return null;
 };
 
+const shouldLogCloudFrontAuthCookieSkip = (reason) => reason !== 'cloudfront_disabled';
+
 /**
  * Refreshes CloudFront signed cookies for authenticated image/avatar access.
  * @param {ServerRequest | null} req
@@ -477,15 +613,17 @@ const setCloudFrontAuthCookies = (req, res, user, options = {}) => {
   };
   const skipReason = getCloudFrontAuthCookieSkipReason(scope);
   if (skipReason) {
-    logger.debug('[setCloudFrontAuthCookies] CloudFront auth cookies skipped', {
-      attempted: false,
-      set: false,
-      reason: skipReason,
-      has_user_id: Boolean(scope.userId),
-      has_tenant_scope: Boolean(scope.tenantId),
-      has_storage_region: Boolean(scope.storageRegion),
-      has_previous_scope: Boolean(getPreviousCloudFrontScope(req)?.userId),
-    });
+    if (shouldLogCloudFrontAuthCookieSkip(skipReason)) {
+      logger.debug('[setCloudFrontAuthCookies] CloudFront auth cookies skipped', {
+        attempted: false,
+        set: false,
+        reason: skipReason,
+        has_user_id: Boolean(scope.userId),
+        has_tenant_scope: Boolean(scope.tenantId),
+        has_storage_region: Boolean(scope.storageRegion),
+        has_previous_scope: Boolean(getPreviousCloudFrontScope(req)?.userId),
+      });
+    }
     return false;
   }
 
@@ -717,7 +855,6 @@ const setOpenIDAuthTokens = (
 const resendVerificationEmail = async (req) => {
   try {
     const { email } = req.body;
-    await deleteTokens({ email });
     const user = await findUser({ email }, 'email _id name');
 
     if (!user) {
@@ -725,6 +862,8 @@ const resendVerificationEmail = async (req) => {
       return { status: 200, message: genericVerificationMessage };
     }
 
+    await deleteEmailVerificationTokens(user);
+
     const [verifyToken, hash] = createTokenHash();
 
     const verificationLink = `${
@@ -746,6 +885,7 @@ const resendVerificationEmail = async (req) => {
     await createToken({
       userId: user._id,
       email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
       token: hash,
       createdAt: Date.now(),
       expiresIn: 900,
diff --git a/api/server/services/AuthService.spec.js b/api/server/services/AuthService.spec.js
index c81b78e8e15..03579e7278f 100644
--- a/api/server/services/AuthService.spec.js
+++ b/api/server/services/AuthService.spec.js
@@ -1,31 +1,44 @@
-jest.mock('@librechat/data-schemas', () => ({
-  logger: { info: jest.fn(), warn: jest.fn(), debug: jest.fn(), error: jest.fn() },
-  DEFAULT_SESSION_EXPIRY: 900000,
-  DEFAULT_REFRESH_TOKEN_EXPIRY: 604800000,
-}));
-jest.mock('librechat-data-provider', () => ({
-  ErrorTypes: {},
-  SystemRoles: { USER: 'USER', ADMIN: 'ADMIN' },
-  errorsToString: jest.fn(),
-}));
-jest.mock('@librechat/api', () => ({
-  isEnabled: jest.fn((val) => val === 'true' || val === true),
-  checkEmailConfig: jest.fn(),
-  isEmailDomainAllowed: jest.fn(),
-  math: jest.fn((val, fallback) => (val ? Number(val) : fallback)),
-  shouldUseSecureCookie: jest.fn(() => false),
-  resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
-  setCloudFrontCookies: jest.fn(() => true),
-  getCloudFrontConfig: jest.fn(() => ({
-    domain: 'https://cdn.example.com',
-    imageSigning: 'cookies',
-    cookieDomain: '.example.com',
-    privateKey: 'test-private-key',
-    keyPairId: 'K123ABC',
-  })),
-  parseCloudFrontCookieScope: jest.fn(() => null),
-  CLOUDFRONT_SCOPE_COOKIE: 'LibreChat-CloudFront-Scope',
-}));
+jest.mock(
+  '@librechat/data-schemas',
+  () => ({
+    logger: { info: jest.fn(), warn: jest.fn(), debug: jest.fn(), error: jest.fn() },
+    getTenantId: jest.fn(() => undefined),
+    DEFAULT_SESSION_EXPIRY: 900000,
+    DEFAULT_REFRESH_TOKEN_EXPIRY: 604800000,
+  }),
+  { virtual: true },
+);
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    ErrorTypes: {},
+    SystemRoles: { USER: 'USER', ADMIN: 'ADMIN' },
+    errorsToString: jest.fn(),
+  }),
+  { virtual: true },
+);
+jest.mock(
+  '@librechat/api',
+  () => ({
+    isEnabled: jest.fn((val) => val === 'true' || val === true),
+    checkEmailConfig: jest.fn(),
+    isEmailDomainAllowed: jest.fn(),
+    math: jest.fn((val, fallback) => (val ? Number(val) : fallback)),
+    shouldUseSecureCookie: jest.fn(() => false),
+    resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
+    setCloudFrontCookies: jest.fn(() => true),
+    getCloudFrontConfig: jest.fn(() => ({
+      domain: 'https://cdn.example.com',
+      imageSigning: 'cookies',
+      cookieDomain: '.example.com',
+      privateKey: 'test-private-key',
+      keyPairId: 'K123ABC',
+    })),
+    parseCloudFrontCookieScope: jest.fn(() => null),
+    CLOUDFRONT_SCOPE_COOKIE: 'LibreChat-CloudFront-Scope',
+  }),
+  { virtual: true },
+);
 jest.mock('~/models', () => ({
   findUser: jest.fn(),
   findToken: jest.fn(),
@@ -42,11 +55,25 @@ jest.mock('~/models', () => ({
   deleteUserById: jest.fn(),
   generateRefreshToken: jest.fn(),
 }));
-jest.mock('~/strategies/validators', () => ({ registerSchema: { parse: jest.fn() } }));
+jest.mock('~/strategies/validators', () => ({
+  registerSchema: {
+    safeParse: jest.fn((user) => ({
+      success: true,
+      data: {
+        name: user.name,
+        username: user.username,
+        email: user.email,
+        password: user.password,
+        confirm_password: user.confirm_password,
+      },
+    })),
+  },
+}));
 jest.mock('~/server/services/Config', () => ({ getAppConfig: jest.fn() }));
 jest.mock('~/server/utils', () => ({ sendEmail: jest.fn() }));
 
 const {
+  checkEmailConfig,
   shouldUseSecureCookie,
   isEmailDomainAllowed,
   resolveAppConfigForUser,
@@ -55,20 +82,32 @@ const {
   parseCloudFrontCookieScope,
 } = require('@librechat/api');
 const jwt = require('jsonwebtoken');
-const { logger } = require('@librechat/data-schemas');
+const { logger, getTenantId } = require('@librechat/data-schemas');
 const {
   findUser,
+  findToken,
+  createUser,
+  updateUser,
+  countUsers,
   getUserById,
   generateToken,
   generateRefreshToken,
   createSession,
+  createToken,
+  deleteTokens,
 } = require('~/models');
 const { getAppConfig } = require('~/server/services/Config');
+const { sendEmail } = require('~/server/utils');
+const bcrypt = require('bcryptjs');
 const {
   setOpenIDAuthTokens,
   requestPasswordReset,
+  registerUser,
+  resetPassword,
+  resendVerificationEmail,
   setAuthTokens,
   setCloudFrontAuthCookies,
+  verifyEmail,
 } = require('./AuthService');
 
 /** Helper to build a mock Express response */
@@ -381,6 +420,161 @@ describe('setOpenIDAuthTokens', () => {
   });
 });
 
+describe('registerUser', () => {
+  const registrationPayload = {
+    name: 'Test User',
+    username: 'testuser',
+    email: 'test@example.com',
+    password: 'Password123!',
+    confirm_password: 'Password123!',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.ALLOW_UNVERIFIED_EMAIL_LOGIN = 'false';
+    checkEmailConfig.mockReturnValue(false);
+    isEmailDomainAllowed.mockReturnValue(true);
+    getAppConfig.mockResolvedValue({
+      balance: { enabled: false },
+      registration: { allowedDomains: [] },
+    });
+    findUser.mockResolvedValue(null);
+    countUsers.mockResolvedValue(1);
+    createUser.mockResolvedValue({ _id: 'new-user-id' });
+    updateUser.mockResolvedValue({ _id: 'new-user-id' });
+  });
+
+  it('ignores provider values from the public registration payload', async () => {
+    const result = await registerUser({ ...registrationPayload, provider: 'google' });
+
+    expect(result.status).toBe(200);
+    expect(createUser.mock.calls[0][0]).toEqual(
+      expect.objectContaining({
+        email: registrationPayload.email,
+        provider: 'local',
+      }),
+    );
+  });
+
+  it('allows trusted callers to set provider through additional data', async () => {
+    const result = await registerUser(registrationPayload, {
+      emailVerified: true,
+      provider: 'google',
+    });
+
+    expect(result.status).toBe(200);
+    expect(createUser.mock.calls[0][0]).toEqual(
+      expect.objectContaining({
+        email: registrationPayload.email,
+        emailVerified: true,
+        provider: 'google',
+      }),
+    );
+  });
+});
+
+describe('verifyEmail public response handling', () => {
+  const email = 'user@example.com';
+  const encodedEmail = encodeURIComponent(email);
+  const invalidEmailVerificationMessage = 'Invalid or expired email verification token';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('does not reveal that an account is already verified without a valid token', async () => {
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: true });
+    findToken.mockResolvedValue(null);
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'not-the-token' } });
+
+    expect(result).toBeInstanceOf(Error);
+    expect(result.message).toBe(invalidEmailVerificationMessage);
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('returns the same generic error for missing users and invalid tokens', async () => {
+    findUser.mockResolvedValueOnce(null);
+
+    const missingUserResult = await verifyEmail({
+      body: { email: encodedEmail, token: 'not-the-token' },
+    });
+
+    findUser.mockResolvedValueOnce({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValueOnce({
+      userId: 'user-id',
+      email,
+      token: bcrypt.hashSync('real-token', 10),
+    });
+
+    const invalidTokenResult = await verifyEmail({
+      body: { email: encodedEmail, token: 'not-the-token' },
+    });
+
+    expect(missingUserResult).toBeInstanceOf(Error);
+    expect(invalidTokenResult).toBeInstanceOf(Error);
+    expect(missingUserResult.message).toBe(invalidEmailVerificationMessage);
+    expect(invalidTokenResult.message).toBe(invalidEmailVerificationMessage);
+  });
+
+  it('verifies an unverified account when the token is valid', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+    updateUser.mockResolvedValue({ _id: 'user-id', emailVerified: true });
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(updateUser).toHaveBeenCalledWith('user-id', { emailVerified: true });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: hashedToken,
+      userId: 'user-id',
+      email,
+      identifier: null,
+      type: null,
+    });
+  });
+
+  it('returns the generic error when a valid verification update fails', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+    updateUser.mockResolvedValue(null);
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toBeInstanceOf(Error);
+    expect(result.message).toBe(invalidEmailVerificationMessage);
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('allows idempotent success only when an already verified account presents a valid token', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: true });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: hashedToken,
+      userId: 'user-id',
+      email,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
 describe('requestPasswordReset', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -444,6 +638,305 @@ describe('requestPasswordReset', () => {
     expect(result).not.toBeInstanceOf(Error);
     expect(result.message).toContain('If an account with that email exists');
   });
+
+  it('should only delete existing password reset tokens when issuing a new reset link', async () => {
+    const user = { _id: 'user-reset', email: 'user@example.com' };
+    findUser.mockResolvedValue(user);
+
+    const req = { body: { email: 'user@example.com' }, ip: '127.0.0.1' };
+    await requestPasswordReset(req);
+
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      type: 'password_reset',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: null,
+      identifier: null,
+      type: null,
+    });
+    expect(createToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: user._id,
+        type: 'password_reset',
+      }),
+    );
+  });
+});
+
+describe('resetPassword', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    checkEmailConfig.mockReturnValue(false);
+  });
+
+  it('should only accept password reset tokens for password reset', async () => {
+    const verificationHash = bcrypt.hashSync('verification-token', 10);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'password_reset') {
+        return null;
+      }
+      if (query.type === null && query.email === null && query.identifier === null) {
+        return null;
+      }
+      return { token: verificationHash, userId: 'user-reset', email: 'user@example.com' };
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'verification-token', 'new-password');
+
+    expect(result).toBeInstanceOf(Error);
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        email: null,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('should delete only the used password reset token after a successful reset', async () => {
+    const resetHash = bcrypt.hashSync('reset-token', 10);
+    findToken.mockResolvedValue({
+      token: resetHash,
+      userId: 'user-reset',
+      type: 'password_reset',
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'reset-token', 'new-password');
+
+    expect(result).toEqual({ message: 'Password reset was successful' });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: resetHash,
+      type: 'password_reset',
+    });
+  });
+
+  it('should accept legacy reset tokens without affecting verification-shaped tokens', async () => {
+    const legacyResetHash = bcrypt.hashSync('legacy-reset-token', 10);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'password_reset') {
+        return null;
+      }
+      if (query.type === null && query.email === null && query.identifier === null) {
+        return {
+          token: legacyResetHash,
+          userId: 'user-reset',
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'legacy-reset-token', 'new-password');
+
+    expect(result).toEqual({ message: 'Password reset was successful' });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        email: null,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: legacyResetHash,
+      email: null,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
+describe('verifyEmail', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should scope verification token lookup to the user and token category', async () => {
+    const verificationHash = bcrypt.hashSync('verification-token', 10);
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      emailVerified: false,
+    };
+    findUser.mockResolvedValue(user);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'email_verification') {
+        return {
+          userId: user._id,
+          email: user.email,
+          token: verificationHash,
+          type: 'email_verification',
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ ...user, emailVerified: true });
+
+    const result = await verifyEmail({
+      body: {
+        email: encodeURIComponent(user.email),
+        token: 'verification-token',
+      },
+    });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: user._id,
+        email: user.email,
+        type: 'email_verification',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: verificationHash,
+      type: 'email_verification',
+    });
+  });
+
+  it('should fall back only to legacy verification tokens for the same user', async () => {
+    const verificationHash = bcrypt.hashSync('legacy-verification-token', 10);
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      emailVerified: false,
+    };
+    findUser.mockResolvedValue(user);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'email_verification') {
+        return null;
+      }
+      if (query.type === null && query.identifier === null && query.userId === user._id) {
+        return {
+          userId: user._id,
+          email: user.email,
+          token: verificationHash,
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ ...user, emailVerified: true });
+
+    const result = await verifyEmail({
+      body: {
+        email: encodeURIComponent(user.email),
+        token: 'legacy-verification-token',
+      },
+    });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: user._id,
+        email: user.email,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: verificationHash,
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
+describe('resendVerificationEmail', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should not delete tokens when no user exists for the email', async () => {
+    findUser.mockResolvedValue(null);
+
+    const result = await resendVerificationEmail({
+      body: { email: 'missing@example.com' },
+    });
+
+    expect(result).toEqual({
+      status: 200,
+      message: 'Please check your email to verify your email address.',
+    });
+    expect(deleteTokens).not.toHaveBeenCalled();
+    expect(sendEmail).not.toHaveBeenCalled();
+    expect(createToken).not.toHaveBeenCalled();
+  });
+
+  it('should delete only verification tokens scoped to the resolved user', async () => {
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      name: 'User Verify',
+    };
+    findUser.mockResolvedValue(user);
+
+    const result = await resendVerificationEmail({
+      body: { email: user.email },
+    });
+
+    expect(result).toEqual({
+      status: 200,
+      message: 'Please check your email to verify your email address.',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: user.email,
+      type: 'email_verification',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    });
+    expect(deleteTokens).not.toHaveBeenCalledWith({ email: user.email });
+    expect(createToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: user._id,
+        email: user.email,
+        type: 'email_verification',
+      }),
+    );
+  });
 });
 
 describe('CloudFront cookie integration', () => {
@@ -576,13 +1069,9 @@ describe('CloudFront cookie integration', () => {
 
       expect(result).toBe(false);
       expect(setCloudFrontCookies).not.toHaveBeenCalled();
-      expect(logger.debug).toHaveBeenCalledWith(
+      expect(logger.debug).not.toHaveBeenCalledWith(
         '[setCloudFrontAuthCookies] CloudFront auth cookies skipped',
-        expect.objectContaining({
-          attempted: false,
-          set: false,
-          reason: 'cloudfront_disabled',
-        }),
+        expect.any(Object),
       );
     });
 
@@ -820,3 +1309,62 @@ describe('CloudFront cookie integration', () => {
     });
   });
 });
+
+describe('registerUser - allowedDomains admin-panel override', () => {
+  const validUser = {
+    email: 'new-user@example.com',
+    password: 'a-secure-password',
+    name: 'New User',
+    username: 'new-user',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    getTenantId.mockReturnValue(undefined);
+    isEmailDomainAllowed.mockReturnValue(true);
+    getAppConfig.mockResolvedValue({
+      registration: { allowedDomains: ['example.com'] },
+      balance: undefined,
+    });
+    findUser.mockResolvedValue(null);
+    countUsers.mockResolvedValue(0);
+  });
+
+  it('should resolve the full app config so admin-panel overrides on the __base__ principal apply', async () => {
+    // Regression guard for getAppConfig({ baseOnly: true }): that option short-circuits
+    // before the DB override merge, which silently ignores any admin-panel edits to
+    // registration.allowedDomains (the admin panel writes overrides to the __base__
+    // principal in the configs collection). registerUser must request the merged config
+    // so the global __base__ override is honored, same as it is for SSO callbacks via
+    // checkDomainAllowed.
+    await registerUser(validUser);
+
+    expect(getAppConfig).toHaveBeenCalledTimes(1);
+    expect(getAppConfig).toHaveBeenCalledWith({});
+    expect(getAppConfig).not.toHaveBeenCalledWith(expect.objectContaining({ baseOnly: true }));
+  });
+
+  it('should pass tenantId from ALS so the merged-config cache key matches tenant-scoped DB queries', async () => {
+    // /api/auth runs through preAuthTenantMiddleware, which puts a tenantId into
+    // AsyncLocalStorage. Mongoose queries inside getApplicableConfigs are scoped by ALS,
+    // but the per-principal merged-config cache key uses the explicit tenantId param.
+    // If we don't forward the ALS tenantId, tenant A's request caches at `__default__`
+    // and a later tenant B request can hit that entry — leaking config across tenants.
+    getTenantId.mockReturnValue('tenant-x');
+
+    await registerUser(validUser);
+
+    expect(getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-x' });
+  });
+
+  it('should block registration when the resolved allowedDomains rejects the email', async () => {
+    isEmailDomainAllowed.mockReturnValue(false);
+
+    const result = await registerUser({ ...validUser, email: 'blocked@evil.com' });
+
+    expect(result.status).toBe(403);
+    expect(result.message).toMatch(/cannot be used/i);
+    // Domain check must happen before any DB user lookup.
+    expect(findUser).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/services/Config/EndpointService.js b/api/server/services/Config/EndpointService.js
index 058341ca2cc..56fa84f2a26 100644
--- a/api/server/services/Config/EndpointService.js
+++ b/api/server/services/Config/EndpointService.js
@@ -17,6 +17,13 @@ const {
 
 const userProvidedOpenAI = isUserProvided(openAIApiKey);
 const anthropicUsesVertex = isEnabled(process.env.ANTHROPIC_USE_VERTEX);
+const firstNonEmpty = (...values) => values.find((value) => value != null && value !== '');
+const bedrockUserProvidedCredential = [
+  process.env.BEDROCK_AWS_BEARER_TOKEN,
+  process.env.BEDROCK_AWS_ACCESS_KEY_ID,
+  process.env.BEDROCK_AWS_SECRET_ACCESS_KEY,
+  process.env.BEDROCK_AWS_SESSION_TOKEN,
+].find(isUserProvided);
 
 module.exports = {
   config: {
@@ -38,7 +45,13 @@ module.exports = {
       EModelEndpoint.azureAssistants,
     ),
     [EModelEndpoint.bedrock]: generateConfig(
-      process.env.BEDROCK_AWS_SECRET_ACCESS_KEY ?? process.env.BEDROCK_AWS_DEFAULT_REGION,
+      bedrockUserProvidedCredential ??
+        firstNonEmpty(
+          process.env.BEDROCK_AWS_BEARER_TOKEN,
+          process.env.BEDROCK_AWS_SECRET_ACCESS_KEY,
+          process.env.BEDROCK_AWS_PROFILE,
+          process.env.BEDROCK_AWS_DEFAULT_REGION,
+        ),
     ),
     /* key will be part of separate config */
     [EModelEndpoint.agents]: generateConfig('true', undefined, EModelEndpoint.agents),
diff --git a/api/server/services/Config/__tests__/EndpointService.spec.js b/api/server/services/Config/__tests__/EndpointService.spec.js
index 82f7175d235..0943daca474 100644
--- a/api/server/services/Config/__tests__/EndpointService.spec.js
+++ b/api/server/services/Config/__tests__/EndpointService.spec.js
@@ -60,6 +60,12 @@ describe('EndpointService', () => {
     process.env = { ...originalEnv };
     delete process.env.ANTHROPIC_API_KEY;
     delete process.env.ANTHROPIC_USE_VERTEX;
+    delete process.env.BEDROCK_AWS_ACCESS_KEY_ID;
+    delete process.env.BEDROCK_AWS_SECRET_ACCESS_KEY;
+    delete process.env.BEDROCK_AWS_SESSION_TOKEN;
+    delete process.env.BEDROCK_AWS_BEARER_TOKEN;
+    delete process.env.BEDROCK_AWS_PROFILE;
+    delete process.env.BEDROCK_AWS_DEFAULT_REGION;
     Object.assign(process.env, env);
     return require('../EndpointService').config;
   }
@@ -80,4 +86,34 @@ describe('EndpointService', () => {
 
     expect(config[EModelEndpoint.anthropic]).toEqual({ userProvide: true });
   });
+
+  it('requires a user Bedrock key when bearer token user_provided is set with a legacy static secret', () => {
+    const config = loadConfig({
+      BEDROCK_AWS_SECRET_ACCESS_KEY: 'legacy-secret',
+      BEDROCK_AWS_BEARER_TOKEN: 'user_provided',
+      BEDROCK_AWS_DEFAULT_REGION: 'us-east-1',
+    });
+
+    expect(config[EModelEndpoint.bedrock]).toEqual({ userProvide: true });
+  });
+
+  it('enables Bedrock with static bearer token before static secret credentials', () => {
+    const config = loadConfig({
+      BEDROCK_AWS_SECRET_ACCESS_KEY: 'legacy-secret',
+      BEDROCK_AWS_BEARER_TOKEN: 'bedrock-api-key',
+      BEDROCK_AWS_DEFAULT_REGION: 'us-east-1',
+    });
+
+    expect(config[EModelEndpoint.bedrock]).toEqual({ userProvide: false });
+  });
+
+  it('skips blank optional Bedrock env vars before falling back to region', () => {
+    const config = loadConfig({
+      BEDROCK_AWS_BEARER_TOKEN: '',
+      BEDROCK_AWS_PROFILE: '',
+      BEDROCK_AWS_DEFAULT_REGION: 'us-east-1',
+    });
+
+    expect(config[EModelEndpoint.bedrock]).toEqual({ userProvide: false });
+  });
 });
diff --git a/api/server/services/Config/__tests__/getCachedTools.spec.js b/api/server/services/Config/__tests__/getCachedTools.spec.js
index 71ae8b5a573..3f85a018f0a 100644
--- a/api/server/services/Config/__tests__/getCachedTools.spec.js
+++ b/api/server/services/Config/__tests__/getCachedTools.spec.js
@@ -1,12 +1,6 @@
 const { CacheKeys } = require('librechat-data-provider');
 
-jest.mock('@librechat/data-schemas', () => ({
-  logger: {
-    error: jest.fn(),
-  },
-}));
 jest.mock('~/cache/getLogStores');
-const { logger } = require('@librechat/data-schemas');
 const getLogStores = require('~/cache/getLogStores');
 
 const mockCache = { get: jest.fn(), set: jest.fn(), delete: jest.fn() };
@@ -16,7 +10,6 @@ const {
   ToolCacheKeys,
   getCachedTools,
   setCachedTools,
-  getMCPServerTools,
   invalidateCachedTools,
 } = require('../getCachedTools');
 
@@ -74,41 +67,10 @@ describe('getCachedTools', () => {
       expect(mockCache.delete).toHaveBeenCalledWith(ToolCacheKeys.GLOBAL);
     });
 
-    it('getMCPServerTools should use TOOL_CACHE namespace', async () => {
-      mockCache.get.mockResolvedValue(null);
-      await getMCPServerTools('user1', 'github');
-      expect(getLogStores).toHaveBeenCalledWith(CacheKeys.TOOL_CACHE);
-      expect(mockCache.get).toHaveBeenCalledWith(ToolCacheKeys.MCP_SERVER('user1', 'github'));
-    });
-
-    it('getMCPServerTools should return null when the cache lookup fails', async () => {
-      const error = new Error('cache unavailable');
-      mockCache.get.mockRejectedValue(error);
-
-      await expect(getMCPServerTools('user1', 'github')).resolves.toBeNull();
-      expect(logger.error).toHaveBeenCalledWith(
-        '[getMCPServerTools] Error fetching cached tools for github:',
-        error,
-      );
-    });
-
-    it('getMCPServerTools should return null when the cache store is unavailable', async () => {
-      const error = new Error('cache store unavailable');
-      getLogStores.mockImplementationOnce(() => {
-        throw error;
-      });
-
-      await expect(getMCPServerTools('user1', 'github')).resolves.toBeNull();
-      expect(logger.error).toHaveBeenCalledWith(
-        '[getMCPServerTools] Error fetching cached tools for github:',
-        error,
-      );
-    });
-
     it('should NOT use CONFIG_STORE namespace', async () => {
       mockCache.get.mockResolvedValue(null);
       await getCachedTools();
-      await getMCPServerTools('user1', 'github');
+      await getCachedTools({ userId: 'user1', serverName: 'github' });
       mockCache.set.mockResolvedValue(true);
       await setCachedTools({ tool1: {} });
       mockCache.delete.mockResolvedValue(true);
diff --git a/api/server/services/Config/getCachedTools.js b/api/server/services/Config/getCachedTools.js
index 083cfae6bad..2877234b582 100644
--- a/api/server/services/Config/getCachedTools.js
+++ b/api/server/services/Config/getCachedTools.js
@@ -1,5 +1,4 @@
 const { CacheKeys, Time } = require('librechat-data-provider');
-const { logger } = require('@librechat/data-schemas');
 const getLogStores = require('~/cache/getLogStores');
 
 /**
@@ -82,27 +81,9 @@ async function invalidateCachedTools(options = {}) {
   await Promise.all(keysToDelete.map((key) => cache.delete(key)));
 }
 
-/**
- * Gets MCP tools for a specific server from cache
- * @function getMCPServerTools
- * @param {string} userId - The user ID
- * @param {string} serverName - The MCP server name
- * @returns {Promise<LCAvailableTools|null>} The available tools for the server
- */
-async function getMCPServerTools(userId, serverName) {
-  try {
-    const cache = getLogStores(CacheKeys.TOOL_CACHE);
-    return (await cache.get(ToolCacheKeys.MCP_SERVER(userId, serverName))) || null;
-  } catch (error) {
-    logger.error(`[getMCPServerTools] Error fetching cached tools for ${serverName}:`, error);
-    return null;
-  }
-}
-
 module.exports = {
   ToolCacheKeys,
   getCachedTools,
   setCachedTools,
-  getMCPServerTools,
   invalidateCachedTools,
 };
diff --git a/api/server/services/Config/loadAsyncEndpoints.js b/api/server/services/Config/loadAsyncEndpoints.js
index 0d6a05aff78..5eaf6afb650 100644
--- a/api/server/services/Config/loadAsyncEndpoints.js
+++ b/api/server/services/Config/loadAsyncEndpoints.js
@@ -1,10 +1,34 @@
 const path = require('path');
+const fs = require('fs/promises');
 const { logger } = require('@librechat/data-schemas');
 const { loadServiceKey, isUserProvided } = require('@librechat/api');
 const { config } = require('./EndpointService');
 
+const defaultServiceKeyPath = path.join(__dirname, '../../..', 'data', 'auth.json');
+
+async function getServiceKeyPath() {
+  const serviceKeyPath = process.env.GOOGLE_SERVICE_KEY_FILE?.trim();
+  if (serviceKeyPath) {
+    return serviceKeyPath;
+  }
+
+  try {
+    await fs.access(defaultServiceKeyPath);
+    return defaultServiceKeyPath;
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {
+      logger.warn(
+        `Unable to access default Google service key file: ${defaultServiceKeyPath}`,
+        error,
+      );
+    }
+    return null;
+  }
+}
+
 async function loadAsyncEndpoints() {
-  let serviceKey, googleUserProvides;
+  let serviceKey;
+  let googleUserProvides = false;
   const { googleKey } = config;
 
   /** Check if GOOGLE_KEY is provided at all(including 'user_provided') */
@@ -14,15 +38,15 @@ async function loadAsyncEndpoints() {
     /** If GOOGLE_KEY is provided, check if it's user_provided */
     googleUserProvides = isUserProvided(googleKey);
   } else {
-    /** Only attempt to load service key if GOOGLE_KEY is not provided */
-    const serviceKeyPath =
-      process.env.GOOGLE_SERVICE_KEY_FILE || path.join(__dirname, '../../..', 'data', 'auth.json');
-
-    try {
-      serviceKey = await loadServiceKey(serviceKeyPath);
-    } catch (error) {
-      logger.error('Error loading service key', error);
-      serviceKey = null;
+    const serviceKeyPath = await getServiceKeyPath();
+
+    if (serviceKeyPath) {
+      try {
+        serviceKey = await loadServiceKey(serviceKeyPath);
+      } catch (error) {
+        logger.warn('Error loading Google service key', error);
+        serviceKey = null;
+      }
     }
   }
 
diff --git a/api/server/services/Config/loadAsyncEndpoints.spec.js b/api/server/services/Config/loadAsyncEndpoints.spec.js
new file mode 100644
index 00000000000..1c63bf42285
--- /dev/null
+++ b/api/server/services/Config/loadAsyncEndpoints.spec.js
@@ -0,0 +1,119 @@
+const mockAccess = jest.fn();
+const mockLoadServiceKey = jest.fn();
+const mockIsUserProvided = jest.fn((value) => value === 'user_provided');
+const mockLogger = {
+  debug: jest.fn(),
+  error: jest.fn(),
+  warn: jest.fn(),
+};
+
+function mockOptionalModule(moduleName, factory) {
+  try {
+    require.resolve(moduleName);
+    jest.doMock(moduleName, factory);
+  } catch {
+    jest.doMock(moduleName, factory, { virtual: true });
+  }
+}
+
+function mockDependencies() {
+  jest.doMock('fs/promises', () => ({
+    access: mockAccess,
+  }));
+
+  mockOptionalModule('@librechat/api', () => ({
+    isEnabled: (value) => value === true || value === 'true' || value === '1',
+    isUserProvided: mockIsUserProvided,
+    loadServiceKey: mockLoadServiceKey,
+  }));
+
+  mockOptionalModule('@librechat/data-schemas', () => ({
+    logger: mockLogger,
+  }));
+
+  mockOptionalModule('librechat-data-provider', () => ({
+    EModelEndpoint: {
+      agents: 'agents',
+      anthropic: 'anthropic',
+      assistants: 'assistants',
+      azureAssistants: 'azureAssistants',
+      azureOpenAI: 'azureOpenAI',
+      bedrock: 'bedrock',
+      google: 'google',
+      openAI: 'openAI',
+    },
+  }));
+
+  jest.doMock('~/server/utils/handleText', () => ({
+    generateConfig: (key) => (key ? { userProvide: key === 'user_provided' } : false),
+  }));
+}
+
+describe('loadAsyncEndpoints', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.resetModules();
+    mockDependencies();
+    process.env = { ...originalEnv };
+    delete process.env.GOOGLE_KEY;
+    delete process.env.GOOGLE_SERVICE_KEY_FILE;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  function loadModule(env = {}) {
+    process.env = { ...process.env, ...env };
+    return require('./loadAsyncEndpoints');
+  }
+
+  it('does not load the default Google service key when the default file is missing', async () => {
+    mockAccess.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }));
+    const loadAsyncEndpoints = loadModule();
+
+    const result = await loadAsyncEndpoints();
+
+    expect(result).toEqual({ google: false });
+    expect(mockLoadServiceKey).not.toHaveBeenCalled();
+    expect(mockLogger.error).not.toHaveBeenCalled();
+  });
+
+  it('loads the default Google service key when the default file exists', async () => {
+    const serviceKey = { project_id: 'test-project' };
+    mockAccess.mockResolvedValue();
+    mockLoadServiceKey.mockResolvedValue(serviceKey);
+    const loadAsyncEndpoints = loadModule();
+
+    const result = await loadAsyncEndpoints();
+
+    expect(result).toEqual({ google: { userProvide: false } });
+    expect(mockLoadServiceKey).toHaveBeenCalledWith(expect.stringContaining('api/data/auth.json'));
+  });
+
+  it('loads an explicitly configured Google service key path without probing the default file', async () => {
+    const serviceKey = { project_id: 'test-project' };
+    mockLoadServiceKey.mockResolvedValue(serviceKey);
+    const loadAsyncEndpoints = loadModule({
+      GOOGLE_SERVICE_KEY_FILE: '/secrets/google-service-account.json',
+    });
+
+    const result = await loadAsyncEndpoints();
+
+    expect(result).toEqual({ google: { userProvide: false } });
+    expect(mockAccess).not.toHaveBeenCalled();
+    expect(mockLoadServiceKey).toHaveBeenCalledWith('/secrets/google-service-account.json');
+  });
+
+  it('uses GOOGLE_KEY without probing for a service key', async () => {
+    const loadAsyncEndpoints = loadModule({ GOOGLE_KEY: 'user_provided' });
+
+    const result = await loadAsyncEndpoints();
+
+    expect(result).toEqual({ google: { userProvide: true } });
+    expect(mockAccess).not.toHaveBeenCalled();
+    expect(mockLoadServiceKey).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/services/Config/loadConfigModels.spec.js b/api/server/services/Config/loadConfigModels.spec.js
index d3ec0309aeb..59f9a5c04ea 100644
--- a/api/server/services/Config/loadConfigModels.spec.js
+++ b/api/server/services/Config/loadConfigModels.spec.js
@@ -93,6 +93,41 @@ describe('loadConfigModels', () => {
     expect(result).toEqual({});
   });
 
+  it('passes userId when resolving scoped model config', async () => {
+    getAppConfig.mockResolvedValue({});
+
+    await loadConfigModels({
+      user: { id: 'testUserId', role: 'USER', tenantId: 'tenant-a' },
+    });
+
+    expect(getAppConfig).toHaveBeenCalledWith({
+      role: 'USER',
+      userId: 'testUserId',
+      tenantId: 'tenant-a',
+    });
+  });
+
+  it('uses req.config when available instead of calling getAppConfig', async () => {
+    const result = await loadConfigModels({
+      user: { id: 'testUserId' },
+      config: {
+        endpoints: {
+          custom: [
+            {
+              name: 'LocalOnly',
+              apiKey: 'local-key',
+              baseURL: 'https://example.com/v1',
+              models: { default: ['local-model'], fetch: false },
+            },
+          ],
+        },
+      },
+    });
+
+    expect(getAppConfig).not.toHaveBeenCalled();
+    expect(result.LocalOnly).toEqual(['local-model']);
+  });
+
   it('handles azure models and endpoint correctly', async () => {
     getAppConfig.mockResolvedValue({
       endpoints: {
diff --git a/api/server/services/Config/loadCustomConfig.js b/api/server/services/Config/loadCustomConfig.js
index c9147549749..c719a846657 100644
--- a/api/server/services/Config/loadCustomConfig.js
+++ b/api/server/services/Config/loadCustomConfig.js
@@ -177,7 +177,8 @@ https://www.librechat.ai/docs/configuration/stt_tts`);
 
 // Validate and fill out missing values for custom parameters
 function parseCustomParams(endpointName, customParams) {
-  const paramEndpoint = customParams.defaultParamsEndpoint;
+  const paramEndpoint = customParams.defaultParamsEndpoint ?? 'custom';
+  customParams.defaultParamsEndpoint = paramEndpoint;
   customParams.paramDefinitions = customParams.paramDefinitions || [];
 
   // Checks if `defaultParamsEndpoint` is a key in `paramSettings`.
diff --git a/api/server/services/Config/loadCustomConfig.spec.js b/api/server/services/Config/loadCustomConfig.spec.js
index 3fce8777e30..ff7ee90629c 100644
--- a/api/server/services/Config/loadCustomConfig.spec.js
+++ b/api/server/services/Config/loadCustomConfig.spec.js
@@ -11,7 +11,7 @@ jest.mock('librechat-data-provider', () => {
     paramSettings: {
       foo: {},
       bar: {},
-      custom: {},
+      custom: [],
       openrouter: [
         {
           key: 'promptCache',
@@ -59,6 +59,7 @@ jest.mock('@librechat/data-schemas', () => {
 const axios = require('axios');
 const { loadYaml } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
+const { ReasoningParameterFormat, ReasoningResponseKey } = require('librechat-data-provider');
 const loadCustomConfig = require('./loadCustomConfig');
 
 describe('loadCustomConfig', () => {
@@ -307,11 +308,28 @@ describe('loadCustomConfig', () => {
       );
     });
 
-    it('throws an error when defaultParamsEndpoint is not provided', async () => {
-      const malformedCustomParams = { defaultParamsEndpoint: undefined };
-      await expect(loadCustomParams(malformedCustomParams)).rejects.toThrow(
-        'defaultParamsEndpoint of "Google" endpoint is invalid. Valid options are foo, bar, custom, openrouter, google',
-      );
+    it('defaults defaultParamsEndpoint when only reasoningFormat is provided', async () => {
+      const parsedConfig = await loadCustomParams({
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+      });
+
+      expect(parsedConfig.endpoints.custom[0].customParams).toEqual({
+        defaultParamsEndpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        paramDefinitions: [],
+      });
+    });
+
+    it('defaults defaultParamsEndpoint when only reasoningKey is provided', async () => {
+      const parsedConfig = await loadCustomParams({
+        reasoningKey: ReasoningResponseKey.reasoning,
+      });
+
+      expect(parsedConfig.endpoints.custom[0].customParams).toEqual({
+        defaultParamsEndpoint: 'custom',
+        reasoningKey: ReasoningResponseKey.reasoning,
+        paramDefinitions: [],
+      });
     });
 
     it('fills the paramDefinitions with missing values', async () => {
diff --git a/api/server/services/Config/loadDefaultEConfig.js b/api/server/services/Config/loadDefaultEConfig.js
index 557b93ce8ec..d8e51e6455e 100644
--- a/api/server/services/Config/loadDefaultEConfig.js
+++ b/api/server/services/Config/loadDefaultEConfig.js
@@ -8,10 +8,12 @@ const { config } = require('./EndpointService');
  * @returns {Promise<Object.<string, EndpointWithOrder>>} An object whose keys are endpoint names and values are objects that contain the endpoint configuration and an order.
  */
 async function loadDefaultEndpointsConfig(appConfig) {
-  const { google } = await loadAsyncEndpoints(appConfig);
   const { assistants, azureAssistants, azureOpenAI } = config;
 
   const enabledEndpoints = getEnabledEndpoints();
+  const { google } = enabledEndpoints.includes(EModelEndpoint.google)
+    ? await loadAsyncEndpoints(appConfig)
+    : { google: false };
 
   const endpointConfig = {
     [EModelEndpoint.openAI]: config[EModelEndpoint.openAI],
diff --git a/api/server/services/Config/loadDefaultEConfig.spec.js b/api/server/services/Config/loadDefaultEConfig.spec.js
new file mode 100644
index 00000000000..6845a549a7d
--- /dev/null
+++ b/api/server/services/Config/loadDefaultEConfig.spec.js
@@ -0,0 +1,74 @@
+const mockGetEnabledEndpoints = jest.fn();
+const mockLoadAsyncEndpoints = jest.fn();
+
+function mockOptionalModule(moduleName, factory) {
+  try {
+    require.resolve(moduleName);
+    jest.doMock(moduleName, factory);
+  } catch {
+    jest.doMock(moduleName, factory, { virtual: true });
+  }
+}
+
+function mockDependencies() {
+  mockOptionalModule('librechat-data-provider', () => ({
+    EModelEndpoint: {
+      agents: 'agents',
+      anthropic: 'anthropic',
+      assistants: 'assistants',
+      azureAssistants: 'azureAssistants',
+      azureOpenAI: 'azureOpenAI',
+      bedrock: 'bedrock',
+      google: 'google',
+      openAI: 'openAI',
+    },
+    getEnabledEndpoints: mockGetEnabledEndpoints,
+  }));
+
+  jest.doMock('./loadAsyncEndpoints', () => mockLoadAsyncEndpoints);
+
+  jest.doMock('./EndpointService', () => ({
+    config: {
+      agents: { userProvide: false },
+      anthropic: false,
+      assistants: false,
+      azureAssistants: false,
+      azureOpenAI: false,
+      bedrock: false,
+      openAI: { userProvide: false },
+    },
+  }));
+}
+
+describe('loadDefaultEndpointsConfig', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.resetModules();
+    mockDependencies();
+  });
+
+  it('does not probe async Google credentials when Google is excluded from enabled endpoints', async () => {
+    mockGetEnabledEndpoints.mockReturnValue(['openAI']);
+    const loadDefaultEndpointsConfig = require('./loadDefaultEConfig');
+
+    const result = await loadDefaultEndpointsConfig();
+
+    expect(mockLoadAsyncEndpoints).not.toHaveBeenCalled();
+    expect(result).toEqual({
+      openAI: { userProvide: false, order: 0 },
+    });
+  });
+
+  it('loads async Google credentials when Google is enabled', async () => {
+    mockGetEnabledEndpoints.mockReturnValue(['google']);
+    mockLoadAsyncEndpoints.mockResolvedValue({ google: { userProvide: false } });
+    const loadDefaultEndpointsConfig = require('./loadDefaultEConfig');
+
+    const result = await loadDefaultEndpointsConfig();
+
+    expect(mockLoadAsyncEndpoints).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({
+      google: { userProvide: false, order: 0 },
+    });
+  });
+});
diff --git a/api/server/services/Config/loadDefaultModels.js b/api/server/services/Config/loadDefaultModels.js
index 85f2c42a333..f7ea0daf719 100644
--- a/api/server/services/Config/loadDefaultModels.js
+++ b/api/server/services/Config/loadDefaultModels.js
@@ -1,6 +1,7 @@
 const { logger } = require('@librechat/data-schemas');
 const { EModelEndpoint } = require('librechat-data-provider');
 const {
+  mergeHeaders,
   getAnthropicModels,
   getBedrockModels,
   getOpenAIModels,
@@ -17,21 +18,43 @@ const { getAppConfig } = require('./app');
 async function loadDefaultModels(req) {
   try {
     const appConfig =
-      req.config ?? (await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId }));
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
     const vertexConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic]?.vertexConfig;
 
+    /** Forward configured custom headers (endpoint over global `all`) so model
+     *  fetches reach a gateway-fronted provider the same as chat requests. */
+    const allHeaders = appConfig?.endpoints?.all?.headers;
+    const openAIHeaders = mergeHeaders(
+      allHeaders,
+      appConfig?.endpoints?.[EModelEndpoint.openAI]?.headers,
+    );
+    const anthropicHeaders = mergeHeaders(
+      allHeaders,
+      appConfig?.endpoints?.[EModelEndpoint.anthropic]?.headers,
+    );
+
     const [openAI, anthropic, azureOpenAI, assistants, azureAssistants, google, bedrock] =
       await Promise.all([
-        getOpenAIModels({ user: req.user.id }).catch((error) => {
-          logger.error('Error fetching OpenAI models:', error);
-          return [];
-        }),
-        getAnthropicModels({ user: req.user.id, vertexModels: vertexConfig?.modelNames }).catch(
+        getOpenAIModels({ user: req.user.id, headers: openAIHeaders, userObject: req.user }).catch(
           (error) => {
-            logger.error('Error fetching Anthropic models:', error);
+            logger.error('Error fetching OpenAI models:', error);
             return [];
           },
         ),
+        getAnthropicModels({
+          user: req.user.id,
+          vertexModels: vertexConfig?.modelNames,
+          headers: anthropicHeaders,
+          userObject: req.user,
+        }).catch((error) => {
+          logger.error('Error fetching Anthropic models:', error);
+          return [];
+        }),
         getOpenAIModels({ user: req.user.id, azure: true }).catch((error) => {
           logger.error('Error fetching Azure OpenAI models:', error);
           return [];
diff --git a/api/server/services/Config/mcp.js b/api/server/services/Config/mcp.js
index fa37e223f52..2bd64cc31b8 100644
--- a/api/server/services/Config/mcp.js
+++ b/api/server/services/Config/mcp.js
@@ -1,13 +1,17 @@
-const { createMCPToolCacheService } = require('@librechat/api');
+const { createMCPToolCacheService, MCPServersRegistry } = require('@librechat/api');
 const { getCachedTools, setCachedTools } = require('./getCachedTools');
 
-const { mergeAppTools, cacheMCPServerTools, updateMCPServerTools } = createMCPToolCacheService({
-  getCachedTools,
-  setCachedTools,
-});
+const { mergeAppTools, cacheMCPServerTools, updateMCPServerTools, getMCPServerTools } =
+  createMCPToolCacheService({
+    getCachedTools,
+    setCachedTools,
+    getServerConfig: (serverName, userId) =>
+      MCPServersRegistry.getInstance().getServerConfig(serverName, userId),
+  });
 
 module.exports = {
   mergeAppTools,
+  getMCPServerTools,
   cacheMCPServerTools,
   updateMCPServerTools,
 };
diff --git a/api/server/services/Config/rum.js b/api/server/services/Config/rum.js
new file mode 100644
index 00000000000..c9f36ea80b5
--- /dev/null
+++ b/api/server/services/Config/rum.js
@@ -0,0 +1,151 @@
+const { getRumProxyClientUrl, isEnabled, isRumProxyEnabled } = require('@librechat/api');
+const { logger } = require('@librechat/data-schemas');
+
+const DEFAULT_RUM_SERVICE_NAME = 'librechat-web';
+
+function parseBooleanEnv(value, defaultValue = false) {
+  if (value == null || value === '') {
+    return defaultValue;
+  }
+
+  return isEnabled(value);
+}
+
+function parseNumberEnv(value) {
+  if (value == null || value === '') {
+    return undefined;
+  }
+
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function parseCsvEnv(value) {
+  if (!value) {
+    return [];
+  }
+
+  return value
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}
+
+function isLocalhost(url) {
+  return url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+}
+
+function isSafeRumUrl(url) {
+  if (url.username || url.password) {
+    return false;
+  }
+
+  if (url.protocol === 'https:') {
+    return true;
+  }
+
+  return url.protocol === 'http:' && isLocalhost(url);
+}
+
+function isSafeTraceTarget(target) {
+  if (target.includes('*')) {
+    return false;
+  }
+
+  const url = parseUrl(target);
+  if (!url || url.protocol !== 'https:') {
+    return false;
+  }
+
+  return true;
+}
+
+function getRumConfig() {
+  if (!parseBooleanEnv(process.env.RUM_ENABLED)) {
+    return undefined;
+  }
+
+  const provider = process.env.RUM_PROVIDER || 'hyperdx';
+  if (provider !== 'hyperdx') {
+    logger.warn(`[config] Unsupported RUM provider "${provider}", disabling RUM`);
+    return undefined;
+  }
+
+  const authMode = process.env.RUM_AUTH_MODE || 'publicToken';
+  if (authMode !== 'publicToken' && authMode !== 'proxy') {
+    logger.warn(`[config] Unsupported RUM auth mode "${authMode}", disabling RUM`);
+    return undefined;
+  }
+
+  let rumUrl;
+  if (authMode === 'proxy') {
+    rumUrl = getRumProxyClientUrl();
+
+    if (!isRumProxyEnabled()) {
+      logger.warn('[config] RUM proxy mode requires RUM_PROXY_TARGET_URL, disabling RUM');
+      return undefined;
+    }
+  } else {
+    rumUrl = process.env.RUM_URL;
+    const parsedUrl = rumUrl ? parseUrl(rumUrl) : undefined;
+
+    if (!parsedUrl || !isSafeRumUrl(parsedUrl)) {
+      logger.warn('[config] Invalid RUM_URL, disabling RUM');
+      return undefined;
+    }
+
+    if (!process.env.RUM_PUBLIC_TOKEN) {
+      logger.warn('[config] RUM publicToken mode requires RUM_PUBLIC_TOKEN, disabling RUM');
+      return undefined;
+    }
+
+    rumUrl = parsedUrl.href.replace(/\/$/, '');
+  }
+
+  const rawTracePropagationTargets = parseCsvEnv(process.env.RUM_TRACE_PROPAGATION_TARGETS);
+  const tracePropagationTargets = rawTracePropagationTargets.filter(isSafeTraceTarget);
+  if (rawTracePropagationTargets.length !== tracePropagationTargets.length) {
+    logger.info('[config] Ignored unsafe RUM trace propagation targets');
+  }
+
+  const configuredSampleRate = parseNumberEnv(process.env.RUM_SAMPLE_RATE);
+  const sampleRate =
+    configuredSampleRate != null && configuredSampleRate >= 0 && configuredSampleRate <= 1
+      ? configuredSampleRate
+      : undefined;
+  const consoleCapture = parseBooleanEnv(process.env.RUM_CONSOLE_CAPTURE);
+  const advancedNetworkCapture = parseBooleanEnv(process.env.RUM_ADVANCED_NETWORK_CAPTURE);
+
+  if (consoleCapture) {
+    logger.warn('[config] RUM console capture is enabled and may collect sensitive browser logs');
+  }
+
+  if (advancedNetworkCapture) {
+    logger.warn('[config] RUM advanced network capture is enabled and may collect payload data');
+  }
+
+  return {
+    provider: 'hyperdx',
+    enabled: true,
+    url: rumUrl,
+    serviceName: process.env.RUM_SERVICE_NAME || DEFAULT_RUM_SERVICE_NAME,
+    authMode,
+    ...(authMode === 'publicToken' ? { publicToken: process.env.RUM_PUBLIC_TOKEN } : {}),
+    ...(tracePropagationTargets.length > 0 ? { tracePropagationTargets } : {}),
+    consoleCapture,
+    disableReplay: parseBooleanEnv(process.env.RUM_DISABLE_REPLAY, true),
+    advancedNetworkCapture,
+    ...(sampleRate != null ? { sampleRate } : {}),
+    ...(process.env.RUM_ENVIRONMENT ? { environment: process.env.RUM_ENVIRONMENT } : {}),
+  };
+}
+
+module.exports = { getRumConfig };
diff --git a/api/server/services/Endpoints/agents/addedConvo.js b/api/server/services/Endpoints/agents/addedConvo.js
index 2a2cd9ca30b..847c6c01af6 100644
--- a/api/server/services/Endpoints/agents/addedConvo.js
+++ b/api/server/services/Endpoints/agents/addedConvo.js
@@ -3,10 +3,14 @@ const {
   ADDED_AGENT_ID,
   initializeAgent,
   validateAgentModel,
+  resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
   loadAddedAgent: loadAddedAgentFn,
 } = require('@librechat/api');
+const { isEphemeralAgentId } = require('librechat-data-provider');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { getMCPServerTools } = require('~/server/services/Config');
+const { canAuthorSkillFiles } = require('./skillDeps');
 const db = require('~/models');
 
 const loadAddedAgent = (params) =>
@@ -40,6 +44,13 @@ const loadAddedAgent = (params) =>
  * @param {Map} params.agentConfigs - Map of agent configs to add to
  * @param {string} params.primaryAgentId - The primary agent ID
  * @param {Object|undefined} params.userMCPAuthMap - User MCP auth map to merge into
+ * @param {Array} [params.accessibleSkillIds] - Full VIEW-accessible skill IDs for the user
+ * @param {Array} [params.editableSkillIds] - Full EDIT-accessible skill IDs for the user
+ * @param {boolean} [params.skillsCapabilityEnabled] - Whether endpoint Skills are enabled
+ * @param {boolean} [params.ephemeralSkillsToggle] - Per-request ephemeral Skills badge state
+ * @param {boolean} [params.skillCreateAllowed] - Whether the user can create Skills
+ * @param {Record<string, boolean>} [params.skillStates] - Per-user Skill active overrides
+ * @param {boolean} [params.defaultActiveOnShare] - Default active state for shared Skills
  * @param {boolean} [params.codeEnvAvailable] - `execute_code` capability flag;
  *   forwarded verbatim to the added agent's `initializeAgent`. @see
  *   InitializeAgentParams.codeEnvAvailable for full semantics.
@@ -60,6 +71,13 @@ const processAddedConvo = async ({
   primaryAgentId,
   primaryAgent,
   userMCPAuthMap,
+  accessibleSkillIds = [],
+  editableSkillIds = [],
+  skillsCapabilityEnabled = false,
+  ephemeralSkillsToggle = false,
+  skillCreateAllowed = false,
+  skillStates,
+  defaultActiveOnShare,
   codeEnvAvailable,
 }) => {
   const addedConvo = endpointOption.addedConvo;
@@ -94,6 +112,47 @@ const processAddedConvo = async ({
       return { userMCPAuthMap };
     }
 
+    const selectedModelSpec =
+      addedConvo.spec && Array.isArray(req.config?.modelSpecs?.list)
+        ? req.config.modelSpecs.list.find((modelSpec) => modelSpec.name === addedConvo.spec)
+        : null;
+
+    if (
+      addedAgent &&
+      isEphemeralAgentId(addedAgent.id) &&
+      selectedModelSpec &&
+      Object.hasOwn(selectedModelSpec, 'skills')
+    ) {
+      if (selectedModelSpec.skills === true) {
+        addedAgent.skills_enabled = true;
+        delete addedAgent.skills;
+      } else if (selectedModelSpec.skills === false) {
+        addedAgent.skills_enabled = false;
+        addedAgent.skills = [];
+      } else if (Array.isArray(selectedModelSpec.skills)) {
+        const resolvedSkillIds = await resolveModelSpecSkillIds({
+          names: selectedModelSpec.skills,
+          accessibleSkillIds,
+          getSkillByName: db.getSkillByName,
+        });
+        addedAgent.skills_enabled = true;
+        addedAgent.skills = resolvedSkillIds.map((id) => id.toString());
+      }
+    }
+
+    const scopedSkillIds = resolveAgentScopedSkillIds({
+      agent: addedAgent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const scopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent: addedAgent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const addedConfig = await initializeAgent(
       {
         req,
@@ -105,7 +164,17 @@ const processAddedConvo = async ({
         agent: addedAgent,
         endpointOption,
         allowedProviders,
+        accessibleSkillIds: scopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
+          agent: addedAgent,
+          scopedEditableSkillIds,
+          skillCreateAllowed,
+          skillsCapabilityEnabled,
+          ephemeralSkillsToggle,
+        }),
         codeEnvAvailable,
+        skillStates,
+        defaultActiveOnShare,
       },
       {
         getFiles: db.getFiles,
@@ -118,6 +187,9 @@ const processAddedConvo = async ({
         getToolFilesByIds: db.getToolFilesByIds,
         getCodeGeneratedFiles: db.getCodeGeneratedFiles,
         filterFilesByAgentAccess,
+        listSkillsByAccess: db.listSkillsByAccess,
+        listAlwaysApplySkills: db.listAlwaysApplySkills,
+        getSkillByName: db.getSkillByName,
       },
     );
 
diff --git a/api/server/services/Endpoints/agents/addedConvo.spec.js b/api/server/services/Endpoints/agents/addedConvo.spec.js
index b5c9427690e..cca3372bbd2 100644
--- a/api/server/services/Endpoints/agents/addedConvo.spec.js
+++ b/api/server/services/Endpoints/agents/addedConvo.spec.js
@@ -1,6 +1,9 @@
 const mockInitializeAgent = jest.fn();
 const mockValidateAgentModel = jest.fn();
 const mockLoadAddedAgent = jest.fn();
+const mockResolveAgentScopedSkillIds = jest.fn();
+const mockResolveModelSpecSkillIds = jest.fn();
+const mockCanAuthorSkillFiles = jest.fn();
 const mockGetAgent = jest.fn();
 const mockGetMCPServerTools = jest.fn();
 
@@ -18,6 +21,8 @@ jest.mock('@librechat/api', () => ({
   initializeAgent: (...args) => mockInitializeAgent(...args),
   validateAgentModel: (...args) => mockValidateAgentModel(...args),
   loadAddedAgent: (params) => mockLoadAddedAgent(params),
+  resolveAgentScopedSkillIds: (...args) => mockResolveAgentScopedSkillIds(...args),
+  resolveModelSpecSkillIds: (...args) => mockResolveModelSpecSkillIds(...args),
 }));
 
 jest.mock('~/server/services/Files/permissions', () => ({
@@ -28,11 +33,20 @@ jest.mock('~/server/services/Config', () => ({
   getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
 }));
 
+jest.mock('./skillDeps', () => ({
+  canAuthorSkillFiles: (...args) => mockCanAuthorSkillFiles(...args),
+}));
+
 jest.mock('~/models', () => ({
   getAgent: (...args) => mockGetAgent(...args),
+  getSkillByName: jest.fn(),
+  listSkillsByAccess: jest.fn(),
+  listAlwaysApplySkills: jest.fn(),
 }));
 
 const { processAddedConvo } = require('./addedConvo');
+const db = require('~/models');
+const { Constants } = require('librechat-data-provider');
 
 const makeReq = () => ({ user: { id: 'u1', role: 'USER' } });
 
@@ -44,7 +58,7 @@ const makeReq = () => ({ user: { id: 'u1', role: 'USER' } });
  * `CodeExecutionToolDefinition` landed in their `toolDefinitions` via the
  * registry regardless of any explicit flag.
  */
-describe('processAddedConvo — codeEnvAvailable passthrough', () => {
+describe('processAddedConvo', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockValidateAgentModel.mockResolvedValue({ isValid: true });
@@ -53,6 +67,11 @@ describe('processAddedConvo — codeEnvAvailable passthrough', () => {
       userMCPAuthMap: undefined,
     });
     mockLoadAddedAgent.mockResolvedValue({ id: 'added-agent', provider: 'openai' });
+    mockResolveAgentScopedSkillIds.mockImplementation(
+      ({ accessibleSkillIds }) => accessibleSkillIds,
+    );
+    mockResolveModelSpecSkillIds.mockResolvedValue([]);
+    mockCanAuthorSkillFiles.mockReturnValue(false);
   });
 
   const baseParams = (overrides = {}) => ({
@@ -105,4 +124,108 @@ describe('processAddedConvo — codeEnvAvailable passthrough', () => {
       expect.anything(),
     );
   });
+
+  it('resolves and forwards model-spec skill scope for added ephemeral agents', async () => {
+    const accessibleSkillId = { toString: () => 'accessible-skill' };
+    const editableSkillId = { toString: () => 'editable-skill' };
+    const resolvedSkillId = { toString: () => 'resolved-skill' };
+    const scopedSkillId = { toString: () => 'scoped-skill' };
+    const scopedEditableSkillId = { toString: () => 'scoped-editable-skill' };
+    const skillStates = { 'scoped-skill': true };
+
+    mockLoadAddedAgent.mockResolvedValue({
+      id: Constants.EPHEMERAL_AGENT_ID,
+      provider: 'openai',
+      skills_enabled: true,
+      skills: [],
+    });
+    mockResolveModelSpecSkillIds.mockResolvedValue([resolvedSkillId]);
+    mockResolveAgentScopedSkillIds
+      .mockReturnValueOnce([scopedSkillId])
+      .mockReturnValueOnce([scopedEditableSkillId]);
+    mockCanAuthorSkillFiles.mockReturnValue(true);
+
+    await processAddedConvo(
+      baseParams({
+        req: {
+          user: { id: 'u1', role: 'USER' },
+          config: {
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-spec',
+                  skills: ['finance-analyst'],
+                },
+              ],
+            },
+          },
+        },
+        endpointOption: {
+          spec: 'primary-spec',
+          addedConvo: {
+            endpoint: 'openai',
+            model: 'gpt-4o',
+            spec: 'added-spec',
+          },
+        },
+        accessibleSkillIds: [accessibleSkillId],
+        editableSkillIds: [editableSkillId],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+        skillCreateAllowed: true,
+        skillStates,
+        defaultActiveOnShare: true,
+      }),
+    );
+
+    expect(mockResolveModelSpecSkillIds).toHaveBeenCalledWith({
+      names: ['finance-analyst'],
+      accessibleSkillIds: [accessibleSkillId],
+      getSkillByName: db.getSkillByName,
+    });
+    expect(mockResolveAgentScopedSkillIds).toHaveBeenNthCalledWith(1, {
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      accessibleSkillIds: [accessibleSkillId],
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockResolveAgentScopedSkillIds).toHaveBeenNthCalledWith(2, {
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      accessibleSkillIds: [editableSkillId],
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockCanAuthorSkillFiles).toHaveBeenCalledWith({
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      scopedEditableSkillIds: [scopedEditableSkillId],
+      skillCreateAllowed: true,
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockInitializeAgent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accessibleSkillIds: [scopedSkillId],
+        skillAuthoringAvailable: true,
+        skillStates,
+        defaultActiveOnShare: true,
+      }),
+      expect.objectContaining({
+        listSkillsByAccess: db.listSkillsByAccess,
+        listAlwaysApplySkills: db.listAlwaysApplySkills,
+        getSkillByName: db.getSkillByName,
+      }),
+    );
+  });
 });
diff --git a/api/server/services/Endpoints/agents/build.js b/api/server/services/Endpoints/agents/build.js
index 19ae3ab7e83..efd7130091b 100644
--- a/api/server/services/Endpoints/agents/build.js
+++ b/api/server/services/Endpoints/agents/build.js
@@ -7,7 +7,7 @@ const db = require('~/models');
 const loadAgent = (params) => loadAgentFn(params, { getAgent: db.getAgent, getMCPServerTools });
 
 const buildOptions = (req, endpoint, parsedBody, endpointType) => {
-  const { spec, iconURL, agent_id, ...model_parameters } = parsedBody;
+  const { spec, iconURL, agent_id, chatProjectId, ...model_parameters } = parsedBody;
   const agentPromise = loadAgent({
     req,
     spec,
@@ -28,6 +28,7 @@ const buildOptions = (req, endpoint, parsedBody, endpointType) => {
     endpoint,
     agent_id,
     endpointType,
+    chatProjectId,
     model_parameters,
     agent: agentPromise,
     addedConvo,
diff --git a/api/server/services/Endpoints/agents/initialize.js b/api/server/services/Endpoints/agents/initialize.js
index f1db6d325ae..9caee651c41 100644
--- a/api/server/services/Endpoints/agents/initialize.js
+++ b/api/server/services/Endpoints/agents/initialize.js
@@ -9,7 +9,10 @@ const {
   GenerationJobManager,
   getCustomEndpointConfig,
   discoverConnectedAgents,
+  resolveAgentTokenConfig,
   resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
+  buildAgentContextAttachmentsByAgentId,
 } = require('@librechat/api');
 const {
   ResourceType,
@@ -30,8 +33,11 @@ const { loadAgentTools, loadToolsForExecution } = require('~/server/services/Too
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('./skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { checkPermission, findAccessibleResources } = require('~/server/services/PermissionService');
@@ -131,7 +137,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
   /** Query accessible skill IDs once per run (shared across all agents).
    *  Skills activate under strict opt-in semantics — see
    *  `resolveAgentScopedSkillIds` for the per-agent activation predicate:
-   *    - Ephemeral agent → per-conversation skills badge toggle (full catalog).
+   *    - Ephemeral agent → model-spec `skills` config first, otherwise the
+   *      per-conversation skills badge toggle (full catalog).
    *    - Persisted agent → `agent.skills_enabled === true`. Optional
    *      `agent.skills` allowlist narrows the catalog; empty/undefined
    *      allowlist with the toggle on = full accessible catalog. */
@@ -139,15 +146,29 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
   const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
   const codeEnvAvailable = enabledCapabilities.has(AgentCapabilities.execute_code);
   const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
+  const skillDbMethods = getSkillDbMethods();
 
   const accessibleSkillIds = skillsCapabilityEnabled
+    ? withDeploymentSkillIds(
+        await findAccessibleResources({
+          userId: req.user.id,
+          role: req.user.role,
+          resourceType: ResourceType.SKILL,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+      )
+    : [];
+  const editableSkillIds = skillsCapabilityEnabled
     ? await findAccessibleResources({
         userId: req.user.id,
         role: req.user.role,
         resourceType: ResourceType.SKILL,
-        requiredPermissions: PermissionBits.VIEW,
+        requiredPermissions: PermissionBits.EDIT,
       })
     : [];
+  const skillCreateAllowed = skillsCapabilityEnabled
+    ? await getSkillToolDeps().canCreateSkill({ req })
+    : false;
 
   const { skillStates, defaultActiveOnShare } = await loadSkillStates({
     userId: req.user.id,
@@ -164,6 +185,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    *   agent?: object,
    *   tool_resources?: object,
    *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+   *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
    *   openAIApiKey?: string
    * }>}
    */
@@ -183,6 +205,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         toolNames,
         agent: ctx.agent,
         toolRegistry: ctx.toolRegistry,
+        mcpAvailableTools: ctx.mcpAvailableTools,
+        requestScopedConnections: ctx.requestScopedConnections,
         userMCPAuthMap: ctx.userMCPAuthMap,
         tool_resources: ctx.tool_resources,
         actionsEnabled: ctx.actionsEnabled,
@@ -194,14 +218,11 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
        *  the agent initialized. Falls back to `false` on any stray
        *  ctx miss so a skills-only agent never gains sandbox access
        *  even if capability lookup somehow skips. */
-      return enrichWithSkillConfigurable(
+      return enrichLoadedToolsWithAgentContext({
         result,
         req,
-        ctx.accessibleSkillIds,
-        ctx.codeEnvAvailable === true,
-        ctx.skillPrimedIdsByName,
-        ctx.activeSkillNames,
-      );
+        ctx,
+      });
     },
     toolEndCallback,
     ...getSkillToolDeps(),
@@ -222,6 +243,24 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    */
   const subagentAggregatorsByToolCallId = new Map();
 
+  /** Backend prices each model call authoritatively (premium tiers, cache
+   *  rates) and emits the cost on on_token_usage when contextCost is on, so
+   *  the gauge sums real costs instead of re-deriving from base rates.
+   *  `endpointTokenConfig` is filled in once `primaryConfig` resolves below so
+   *  custom-endpoint agents price with their configured rates, not defaults. */
+  const usageCost = {
+    enabled: appConfig?.interfaceConfig?.contextCost === true,
+    pricing: { getMultiplier: db.getMultiplier, getCacheMultiplier: db.getCacheMultiplier },
+  };
+
+  /** Latest visible context snapshot + every emitted usage payload for this
+   *  response, captured by the handlers and persisted on the response message's
+   *  metadata so the breakdown and branch/total cost survive a reload.
+   *  @type {{ latest: import('librechat-data-provider').TContextUsageEvent | null, count: number }} */
+  const contextUsageSink = { latest: null, count: 0 };
+  /** @type {Array<import('librechat-data-provider').TTokenUsageEvent>} */
+  const usageEmitSink = [];
+
   const eventHandlers = getDefaultHandlers({
     res,
     toolExecuteOptions,
@@ -232,6 +271,9 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     collectedThoughtSignatures,
     streamId,
     subagentAggregatorsByToolCallId,
+    usageCost,
+    contextUsageSink,
+    usageEmitSink,
   });
 
   if (!endpointOption.agent) {
@@ -278,12 +320,53 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    */
   const manualSkills = extractManualSkills(req.body);
 
+  const selectedModelSpec =
+    endpointOption.spec && Array.isArray(appConfig?.modelSpecs?.list)
+      ? appConfig.modelSpecs.list.find((modelSpec) => modelSpec.name === endpointOption.spec)
+      : null;
+
+  if (
+    primaryAgent &&
+    isEphemeralAgentId(primaryAgent.id) &&
+    selectedModelSpec &&
+    Object.hasOwn(selectedModelSpec, 'skills')
+  ) {
+    if (selectedModelSpec.skills === true) {
+      primaryAgent.skills_enabled = true;
+      delete primaryAgent.skills;
+    } else if (selectedModelSpec.skills === false) {
+      primaryAgent.skills_enabled = false;
+      primaryAgent.skills = [];
+    } else if (Array.isArray(selectedModelSpec.skills)) {
+      const resolvedSkillIds = await resolveModelSpecSkillIds({
+        names: selectedModelSpec.skills,
+        accessibleSkillIds,
+        getSkillByName: db.getSkillByName,
+      });
+      primaryAgent.skills_enabled = true;
+      primaryAgent.skills = resolvedSkillIds.map((id) => id.toString());
+    }
+  }
+
   const primaryScopedSkillIds = resolveAgentScopedSkillIds({
     agent: primaryAgent,
     accessibleSkillIds,
     skillsCapabilityEnabled,
     ephemeralSkillsToggle,
   });
+  const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+    agent: primaryAgent,
+    accessibleSkillIds: editableSkillIds,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+  });
+  const primarySkillAuthoringAvailable = canAuthorSkillFiles({
+    agent: primaryAgent,
+    scopedEditableSkillIds: primaryScopedEditableSkillIds,
+    skillCreateAllowed,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+  });
 
   const primaryConfig = await initializeAgent(
     {
@@ -298,6 +381,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       allowedProviders,
       isInitialAgent: true,
       accessibleSkillIds: primaryScopedSkillIds,
+      skillAuthoringAvailable: primarySkillAuthoringAvailable,
       codeEnvAvailable,
       skillStates,
       defaultActiveOnShare,
@@ -314,36 +398,24 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
       filterFilesByAgentAccess,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     },
   );
 
+  /** Price emitted usage with the primary agent's resolved endpoint config so
+   *  custom-endpoint agents reflect configured rates (mirrors the AgentClient
+   *  spending path, which reads the same config). */
+  usageCost.endpointTokenConfig = primaryConfig.endpointTokenConfig;
+
   logger.debug(
     `[initializeClient] Storing tool context for ${primaryConfig.id}: ${primaryConfig.toolDefinitions?.length ?? 0} tools, registry size: ${primaryConfig.toolRegistry?.size ?? '0'}`,
   );
-  /** Maps each primed skill name (manual `$` or always-apply) to the
-   *  `_id` of the exact doc that was primed. Plumbed to
-   *  `enrichWithSkillConfigurable` so the read_file handler can pin
-   *  same-name collision lookups to the resolver's chosen doc AND relax
-   *  the disable-model-invocation gate for skills whose body is already
-   *  in this turn's context. */
-  const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-    primaryConfig.manualSkillPrimes,
-    primaryConfig.alwaysApplySkillPrimes,
+  agentToolContexts.set(
+    primaryConfig.id,
+    buildAgentToolContext({ agent: primaryAgent, config: primaryConfig }),
   );
-  agentToolContexts.set(primaryConfig.id, {
-    agent: primaryAgent,
-    toolRegistry: primaryConfig.toolRegistry,
-    userMCPAuthMap: primaryConfig.userMCPAuthMap,
-    tool_resources: primaryConfig.tool_resources,
-    actionsEnabled: primaryConfig.actionsEnabled,
-    accessibleSkillIds: primaryConfig.accessibleSkillIds,
-    activeSkillNames: primaryConfig.activeSkillNames,
-    codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    skillPrimedIdsByName,
-  });
 
   const {
     agentConfigs: discoveredConfigs,
@@ -370,6 +442,19 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
+      computeSkillAuthoringAvailable: (agent) =>
+        canAuthorSkillFiles({
+          agent,
+          scopedEditableSkillIds: resolveAgentScopedSkillIds({
+            agent,
+            accessibleSkillIds: editableSkillIds,
+            skillsCapabilityEnabled,
+            ephemeralSkillsToggle,
+          }),
+          skillCreateAllowed,
+          skillsCapabilityEnabled,
+          ephemeralSkillsToggle,
+        }),
       skillStates,
       defaultActiveOnShare,
       codeEnvAvailable,
@@ -389,9 +474,9 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         getToolFilesByIds: db.getToolFilesByIds,
         getCodeGeneratedFiles: db.getCodeGeneratedFiles,
         filterFilesByAgentAccess,
-        listSkillsByAccess: db.listSkillsByAccess,
-        listAlwaysApplySkills: db.listAlwaysApplySkills,
-        getSkillByName: db.getSkillByName,
+        listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+        listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+        getSkillByName: skillDbMethods.getSkillByName,
       },
       // The callback fires during BFS, before the helper prunes agents
       // whose edges end up filtered. Don't populate `agentConfigs` here —
@@ -399,28 +484,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       // set. The per-agent tool context map is OK to keep populated even
       // for pruned ids: it's only read by closure in ON_TOOL_EXECUTE,
       // stale entries are unreachable at runtime.
-      //
-      // Handoff agents get the same `skillPrimedIdsByName` plumbing as the
-      // primary so `read_file` can pin same-name collisions to the exact
-      // primed doc AND relax the `disable-model-invocation: true` gate for
-      // skills whose body is already in this turn's context — matters for
-      // handoff agents that have their own always-apply skills bound or
-      // that the user `$`-invokes within the handoff flow.
       onAgentInitialized: (agentId, agent, config) => {
-        agentToolContexts.set(agentId, {
-          agent,
-          toolRegistry: config.toolRegistry,
-          userMCPAuthMap: config.userMCPAuthMap,
-          tool_resources: config.tool_resources,
-          actionsEnabled: config.actionsEnabled,
-          accessibleSkillIds: config.accessibleSkillIds,
-          activeSkillNames: config.activeSkillNames,
-          codeEnvAvailable: config.codeEnvAvailable,
-          skillPrimedIdsByName: buildSkillPrimedIdsByName(
-            config.manualSkillPrimes,
-            config.alwaysApplySkillPrimes,
-          ),
-        });
+        agentToolContexts.set(agentId, buildAgentToolContext({ agent, config }));
       },
       // Pass through the `@librechat/api` exports so that tests which
       // `jest.mock('@librechat/api')` can override the initializer/validator.
@@ -456,6 +521,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     parentMessageId,
     allowedProviders,
     primaryAgentId: primaryConfig.id,
+    accessibleSkillIds,
+    editableSkillIds,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+    skillCreateAllowed,
+    skillStates,
+    defaultActiveOnShare,
     codeEnvAvailable,
   });
 
@@ -467,16 +539,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     if (agentToolContexts.has(agentId)) {
       continue;
     }
-    agentToolContexts.set(agentId, {
-      agent: config,
-      toolRegistry: config.toolRegistry,
-      userMCPAuthMap: config.userMCPAuthMap,
-      tool_resources: config.tool_resources,
-      actionsEnabled: config.actionsEnabled,
-      accessibleSkillIds: config.accessibleSkillIds,
-      activeSkillNames: config.activeSkillNames,
-      codeEnvAvailable: config.codeEnvAvailable,
-    });
+    agentToolContexts.set(agentId, buildAgentToolContext({ agent: config, config }));
   }
 
   // `discoverConnectedAgents` always returns a concrete array, so no
@@ -564,6 +627,18 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         skippedAgentIds.add(agentId);
         return null;
       }
+      const scopedSkillIds = resolveAgentScopedSkillIds({
+        agent,
+        accessibleSkillIds,
+        skillsCapabilityEnabled,
+        ephemeralSkillsToggle,
+      });
+      const scopedEditableSkillIds = resolveAgentScopedSkillIds({
+        agent,
+        accessibleSkillIds: editableSkillIds,
+        skillsCapabilityEnabled,
+        ephemeralSkillsToggle,
+      });
       const config = await initializeAgent(
         {
           req,
@@ -575,9 +650,11 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           parentMessageId,
           endpointOption: { ...endpointOption, endpoint: EModelEndpoint.agents },
           allowedProviders,
-          accessibleSkillIds: resolveAgentScopedSkillIds({
+          accessibleSkillIds: scopedSkillIds,
+          skillAuthoringAvailable: canAuthorSkillFiles({
             agent,
-            accessibleSkillIds,
+            scopedEditableSkillIds,
+            skillCreateAllowed,
             skillsCapabilityEnabled,
             ephemeralSkillsToggle,
           }),
@@ -604,26 +681,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           getToolFilesByIds: db.getToolFilesByIds,
           getCodeGeneratedFiles: db.getCodeGeneratedFiles,
           filterFilesByAgentAccess,
-          listSkillsByAccess: db.listSkillsByAccess,
-          listAlwaysApplySkills: db.listAlwaysApplySkills,
-          getSkillByName: db.getSkillByName,
+          listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+          listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+          getSkillByName: skillDbMethods.getSkillByName,
         },
       );
       agentConfigs.set(agentId, config);
-      agentToolContexts.set(agentId, {
-        agent,
-        toolRegistry: config.toolRegistry,
-        userMCPAuthMap: config.userMCPAuthMap,
-        tool_resources: config.tool_resources,
-        actionsEnabled: config.actionsEnabled,
-        accessibleSkillIds: config.accessibleSkillIds,
-        activeSkillNames: config.activeSkillNames,
-        codeEnvAvailable: config.codeEnvAvailable,
-        skillPrimedIdsByName: buildSkillPrimedIdsByName(
-          config.manualSkillPrimes,
-          config.alwaysApplySkillPrimes,
-        ),
-      });
+      agentToolContexts.set(agentId, buildAgentToolContext({ agent, config }));
       return config;
     } catch (err) {
       logger.error(`[processAgent] Error processing subagent ${agentId}:`, err);
@@ -796,6 +860,11 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     }
   }
 
+  const agentContextAttachmentsByAgentId = buildAgentContextAttachmentsByAgentId([
+    primaryConfig,
+    ...agentConfigs.values(),
+  ]);
+
   let endpointConfig = appConfig.endpoints?.[primaryConfig.endpoint];
   if (!isAgentsEndpoint(primaryConfig.endpoint) && !endpointConfig) {
     try {
@@ -836,6 +905,28 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         })
     : undefined;
 
+  /** Per-agent resolved endpoint token config, keyed by agent id. Built from
+   *  `agentToolContexts` (the one map holding every agent, including pure
+   *  subagents pruned from `agentConfigs`) so usage billed/emitted for a
+   *  connected or subagent on a different custom endpoint is priced with THAT
+   *  agent's configured rates instead of the primary's. Every known agent is
+   *  recorded — even with an `undefined` config — so the resolver can tell a
+   *  known non-custom agent (built-in pricing) from an untagged/unknown one
+   *  (primary fallback).
+   *  @type {Map<string, import('@librechat/api').EndpointTokenConfig | undefined>} */
+  const endpointTokenConfigByAgentId = new Map();
+  for (const [agentId, ctx] of agentToolContexts) {
+    endpointTokenConfigByAgentId.set(agentId, ctx?.endpointTokenConfig);
+  }
+  /** Price emitted usage per producing agent too, so the streamed/persisted
+   *  `metadata.usage.cost` matches the per-agent balance transaction. */
+  usageCost.resolveEndpointTokenConfig = (usage) =>
+    resolveAgentTokenConfig({
+      agentId: usage?.agentId,
+      byAgentId: endpointTokenConfigByAgentId,
+      fallback: usageCost.endpointTokenConfig,
+    });
+
   const client = new AgentClient({
     req,
     res,
@@ -851,12 +942,25 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     agent: primaryConfig,
     spec: endpointOption.spec,
     iconURL: endpointOption.iconURL,
-    attachments: primaryConfig.attachments,
+    chatProjectId: endpointOption.chatProjectId,
+    attachments: primaryConfig.requestAttachments ?? primaryConfig.attachments,
+    agentContextAttachmentsByAgentId,
     endpointType: endpointOption.endpointType,
     resendFiles: primaryConfig.resendFiles ?? true,
     maxContextTokens: primaryConfig.maxContextTokens,
     endpoint: isEphemeralAgentId(primaryConfig.id) ? primaryConfig.endpoint : EModelEndpoint.agents,
     subagentAggregatorsByToolCallId,
+    /** Resolved endpoint token/pricing config so spending and cost reflect
+     *  configured rates for custom-endpoint agents instead of defaults. */
+    endpointTokenConfig: primaryConfig.endpointTokenConfig,
+    /** Per-agent override of the above for multi-endpoint graphs (connected
+     *  agents + subagents); falls back to the primary config when an agent
+     *  isn't present or has no configured rates. */
+    endpointTokenConfigByAgentId,
+    /** Capture sinks the handlers fill during the run; `sendCompletion` reads
+     *  them to persist the breakdown + usage rollup on the response message. */
+    contextUsageSink,
+    usageEmitSink,
   });
 
   if (streamId) {
diff --git a/api/server/services/Endpoints/agents/initialize.spec.js b/api/server/services/Endpoints/agents/initialize.spec.js
index 3bf6a67e50c..1e331fc40de 100644
--- a/api/server/services/Endpoints/agents/initialize.spec.js
+++ b/api/server/services/Endpoints/agents/initialize.spec.js
@@ -6,6 +6,7 @@ const {
   PrincipalModel,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_GRAPH_NODES,
+  Constants,
 } = require('librechat-data-provider');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
@@ -68,9 +69,10 @@ jest.mock('~/cache', () => ({
 }));
 
 const { initializeClient } = require('./initialize');
+const { getSkillToolDeps } = require('./skillDeps');
 const { logger } = require('@librechat/data-schemas');
 const { User, AclEntry } = require('~/db/models');
-const { createAgent } = require('~/models');
+const { createAgent, createSkill } = require('~/models');
 
 jest.spyOn(logger, 'warn').mockImplementation(() => {});
 
@@ -183,6 +185,15 @@ describe('initializeClient — processAgent ACL gate', () => {
     });
 
     const edges = [{ from: PRIMARY_ID, to: AUTHORIZED_ID, edgeType: 'handoff' }];
+    const requestAttachment = { file_id: 'request_file', filename: 'request.txt' };
+    const primaryContextAttachment = { file_id: 'primary_context', filename: 'primary.txt' };
+    const handoffContextAttachment = { file_id: 'handoff_context', filename: 'handoff.txt' };
+    const primaryConfig = {
+      ...makePrimaryConfig(edges),
+      attachments: [primaryContextAttachment, requestAttachment],
+      requestAttachments: [requestAttachment],
+      agentContextAttachments: [primaryContextAttachment],
+    };
     const handoffConfig = {
       id: AUTHORIZED_ID,
       edges: [],
@@ -190,14 +201,13 @@ describe('initializeClient — processAgent ACL gate', () => {
       toolRegistry: new Map(),
       userMCPAuthMap: null,
       tool_resources: {},
+      agentContextAttachments: [handoffContextAttachment],
     };
 
     let callCount = 0;
     mockInitializeAgent.mockImplementation(() => {
       callCount++;
-      return callCount === 1
-        ? Promise.resolve(makePrimaryConfig(edges))
-        : Promise.resolve(handoffConfig);
+      return callCount === 1 ? Promise.resolve(primaryConfig) : Promise.resolve(handoffConfig);
     });
 
     await initializeClient({
@@ -210,6 +220,99 @@ describe('initializeClient — processAgent ACL gate', () => {
     expect(mockInitializeAgent).toHaveBeenCalledTimes(2);
     expect(agentClientArgs.agent.edges).toHaveLength(1);
     expect(agentClientArgs.agent.edges[0].to).toBe(AUTHORIZED_ID);
+    expect(agentClientArgs.attachments).toEqual([requestAttachment]);
+    expect(agentClientArgs.agentContextAttachmentsByAgentId.get(PRIMARY_ID)).toEqual([
+      primaryContextAttachment,
+    ]);
+    expect(agentClientArgs.agentContextAttachmentsByAgentId.get(AUTHORIZED_ID)).toEqual([
+      handoffContextAttachment,
+    ]);
+  });
+
+  it('does not enable skill authoring for VIEW-only shared skills', async () => {
+    const { skill } = await createSkill({
+      name: 'shared-view-only',
+      description: 'Use for read-only sharing.',
+      body: '# Shared view-only skill\n',
+      author: new mongoose.Types.ObjectId(),
+      authorName: 'Skill Owner',
+    });
+    await AclEntry.create({
+      principalType: PrincipalType.USER,
+      principalId: testUser._id,
+      principalModel: PrincipalModel.USER,
+      resourceType: ResourceType.SKILL,
+      resourceId: skill._id,
+      permBits: PermissionBits.VIEW,
+      grantedBy: testUser._id,
+    });
+
+    const endpointOption = makeEndpointOption();
+    endpointOption.agent = Promise.resolve({
+      id: PRIMARY_ID,
+      name: 'Primary',
+      provider: 'openai',
+      model: 'gpt-4',
+      tools: [],
+      skills_enabled: true,
+    });
+    mockInitializeAgent.mockResolvedValue(makePrimaryConfig([]));
+    const req = makeReq();
+    req.config.endpoints.agents = { capabilities: ['skills'] };
+    const canCreateSkillSpy = jest
+      .spyOn(getSkillToolDeps(), 'canCreateSkill')
+      .mockResolvedValue(false);
+
+    try {
+      await initializeClient({
+        req,
+        res: {},
+        signal: new AbortController().signal,
+        endpointOption,
+      });
+    } finally {
+      canCreateSkillSpy.mockRestore();
+    }
+
+    const initializeParams = mockInitializeAgent.mock.calls[0][0];
+    expect(initializeParams.accessibleSkillIds.map(String)).toContain(skill._id.toString());
+    expect(initializeParams.skillAuthoringAvailable).toBe(false);
+  });
+
+  it('enables skill authoring when model specs enable skills for an ephemeral agent', async () => {
+    const endpointOption = makeEndpointOption();
+    endpointOption.spec = 'spec-skills';
+    endpointOption.agent = Promise.resolve({
+      id: Constants.EPHEMERAL_AGENT_ID,
+      name: 'Ephemeral Primary',
+      provider: 'openai',
+      model: 'gpt-4',
+      tools: [],
+    });
+    mockInitializeAgent.mockResolvedValue(makePrimaryConfig([]));
+    const req = makeReq();
+    req.config.endpoints.agents = { capabilities: ['skills'] };
+    req.config.modelSpecs = {
+      list: [{ name: 'spec-skills', skills: true }],
+    };
+    const canCreateSkillSpy = jest
+      .spyOn(getSkillToolDeps(), 'canCreateSkill')
+      .mockResolvedValue(true);
+
+    try {
+      await initializeClient({
+        req,
+        res: {},
+        signal: new AbortController().signal,
+        endpointOption,
+      });
+    } finally {
+      canCreateSkillSpy.mockRestore();
+    }
+
+    const initializeParams = mockInitializeAgent.mock.calls[0][0];
+    expect(initializeParams.agent.skills_enabled).toBe(true);
+    expect(initializeParams.skillAuthoringAvailable).toBe(true);
   });
 });
 
@@ -436,6 +539,48 @@ describe('initializeClient — subagent loading', () => {
     expect(arg.actionsEnabled).toBe(true);
   });
 
+  it('threads run-scoped MCP tool definitions into ON_TOOL_EXECUTE loading', async () => {
+    /** Regression guard for the request-scoped MCP/PTC handoff: the
+     *  `mcpAvailableTools` discovered at run start must survive
+     *  `buildAgentToolContext` and reach `loadToolsForExecution`, otherwise
+     *  request-scoped servers reinitialize on every programmatic tool call
+     *  and can trip the MCP circuit breaker under parallel calls. */
+    const mcpTool = 'list_tables_mcp_ClickHouse';
+    const mcpAvailableTools = {
+      ClickHouse: {
+        [mcpTool]: {
+          type: 'function',
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      },
+    };
+    const primaryConfig = {
+      ...makePrimaryConfig({}),
+      toolRegistry: new Map([[mcpTool, { name: mcpTool }]]),
+      mcpAvailableTools,
+    };
+    mockInitializeAgent.mockResolvedValue(primaryConfig);
+
+    await initializeClient({
+      req: makeSubagentReq(),
+      res: {},
+      signal: new AbortController().signal,
+      endpointOption: makeEndpointOption(),
+    });
+
+    expect(capturedToolExecuteOptions?.loadTools).toBeInstanceOf(Function);
+    await capturedToolExecuteOptions.loadTools([mcpTool], PRIMARY_ID);
+
+    expect(mockLoadToolsForExecution).toHaveBeenCalledTimes(1);
+    expect(mockLoadToolsForExecution).toHaveBeenCalledWith(
+      expect.objectContaining({ mcpAvailableTools }),
+    );
+  });
+
   it('deduplicates repeated ids in subagents.agent_ids', async () => {
     const subAgent = await createAgent({
       id: DUPLICATE_SUBAGENT_ID,
diff --git a/api/server/services/Endpoints/agents/skillDeps.js b/api/server/services/Endpoints/agents/skillDeps.js
index ee2c6841da1..7154c1d52b3 100644
--- a/api/server/services/Endpoints/agents/skillDeps.js
+++ b/api/server/services/Endpoints/agents/skillDeps.js
@@ -1,18 +1,216 @@
+const crypto = require('crypto');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { batchUploadCodeEnvFiles } = require('~/server/services/Files/Code/crud');
 const {
   getSessionInfo,
   checkIfActive,
   readSandboxFile,
+  writeSandboxFile,
 } = require('~/server/services/Files/Code/process');
-const { enrichWithSkillConfigurable } = require('@librechat/api');
+const {
+  checkAccess,
+  getStorageMetadata,
+  resolveRequestTenantId,
+  enrichWithSkillConfigurable,
+  mergeDeploymentSkillIds,
+  createDeploymentSkillMethods,
+  isDeploymentSkillFileSource,
+  getDeploymentSkillDownloadStream,
+} = require('@librechat/api');
+const {
+  Permissions,
+  FileContext,
+  ResourceType,
+  PermissionBits,
+  AccessRoleIds,
+  PrincipalType,
+  PermissionTypes,
+  isEphemeralAgentId,
+} = require('librechat-data-provider');
+const { checkPermission, grantPermission } = require('~/server/services/PermissionService');
+const { getFileStrategy } = require('~/server/utils/getFileStrategy');
 const db = require('~/models');
 
+const deploymentSkillMethods = createDeploymentSkillMethods({
+  getSkillById: db.getSkillById,
+  getSkillByName: db.getSkillByName,
+  listSkillsByAccess: db.listSkillsByAccess,
+  listAlwaysApplySkills: db.listAlwaysApplySkills,
+  listSkillFiles: db.listSkillFiles,
+  getSkillFileByPath: db.getSkillFileByPath,
+  updateSkillFileContent: db.updateSkillFileContent,
+  updateSkillFileCodeEnvIds: db.updateSkillFileCodeEnvIds,
+});
+
+function getSkillDbMethods() {
+  return deploymentSkillMethods;
+}
+
+function withDeploymentSkillIds(ids = []) {
+  return mergeDeploymentSkillIds(ids);
+}
+
+function getSkillStrategyFunctions(source) {
+  if (isDeploymentSkillFileSource(source)) {
+    return {
+      getDownloadStream: (_req, filepath) => getDeploymentSkillDownloadStream(filepath),
+    };
+  }
+  return getStrategyFunctions(source);
+}
+
+function resolveSkillStorage(req, { isImage = false } = {}) {
+  const source = getFileStrategy(req.config, { context: FileContext.skill_file, isImage });
+  const strategy = getStrategyFunctions(source);
+  if (!strategy.saveBuffer) {
+    throw new Error(`Storage backend "${source}" does not support file writes`);
+  }
+  return { saveBuffer: strategy.saveBuffer, source };
+}
+
+function basename(relativePath) {
+  const slash = relativePath.lastIndexOf('/');
+  return slash === -1 ? relativePath : relativePath.slice(slash + 1);
+}
+
+async function saveSkillFileContent({ req, skillId, relativePath, content, mimeType }) {
+  const existingFile = await db.getSkillFileByPath(skillId, relativePath);
+  const tenantId = resolveRequestTenantId(req);
+  const fileId = crypto.randomUUID();
+  const filename = basename(relativePath);
+  const storageFileName = `${fileId}__${filename}`;
+  const buffer = Buffer.from(content, 'utf8');
+  const storage = resolveSkillStorage(req, { isImage: mimeType.startsWith('image/') });
+  const filepath = await storage.saveBuffer({
+    userId: req.user.id,
+    buffer,
+    fileName: storageFileName,
+    basePath: 'uploads',
+    tenantId,
+  });
+  const storageMetadata = getStorageMetadata({ filepath, source: storage.source });
+
+  let result;
+  try {
+    result = await db.upsertSkillFile({
+      skillId,
+      relativePath,
+      file_id: fileId,
+      filename,
+      filepath,
+      ...storageMetadata,
+      source: storage.source,
+      mimeType,
+      bytes: buffer.length,
+      isExecutable: false,
+      author: req.user._id ?? req.user.id,
+      tenantId,
+    });
+    if (!result) {
+      const error = new Error('Skill file save failed to persist metadata');
+      error.code = 'SKILL_FILE_UPSERT_NOT_FOUND';
+      throw error;
+    }
+  } catch (error) {
+    const { deleteFile } = getStrategyFunctions(storage.source);
+    if (deleteFile) {
+      await deleteFile(req, { filepath, user: req.user.id, tenantId }).catch(() => undefined);
+    }
+    throw error;
+  }
+
+  if (existingFile && existingFile.filepath !== filepath) {
+    const { deleteFile } = getStrategyFunctions(existingFile.source);
+    if (deleteFile) {
+      deleteFile(req, {
+        filepath: existingFile.filepath,
+        storageKey: existingFile.storageKey,
+        storageRegion: existingFile.storageRegion,
+        user: existingFile.author ?? req.user.id,
+        tenantId: existingFile.tenantId ?? tenantId,
+      }).catch(() => undefined);
+    }
+  }
+
+  return { bytes: result.bytes, relativePath: result.relativePath };
+}
+
+function canCreateSkill({ req }) {
+  return checkAccess({
+    req,
+    user: req.user,
+    permissionType: PermissionTypes.SKILLS,
+    permissions: [Permissions.USE, Permissions.CREATE],
+    getRoleByName: db.getRoleByName,
+  });
+}
+
+function canEditSkill({ req, skillId }) {
+  return checkPermission({
+    userId: req.user.id,
+    role: req.user.role,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    requiredPermission: PermissionBits.EDIT,
+  });
+}
+
+function isAgentSkillsEnabledForRun({ agent, skillsCapabilityEnabled, ephemeralSkillsToggle }) {
+  if (!skillsCapabilityEnabled) {
+    return false;
+  }
+  if (isEphemeralAgentId(agent.id)) {
+    if (agent.skills_enabled === false) {
+      return false;
+    }
+    if (agent.skills_enabled === true) {
+      return true;
+    }
+    return ephemeralSkillsToggle === true;
+  }
+  return agent.skills_enabled === true;
+}
+
+function canAuthorSkillFiles({
+  agent,
+  scopedEditableSkillIds = [],
+  skillCreateAllowed,
+  skillsCapabilityEnabled,
+  ephemeralSkillsToggle,
+}) {
+  return (
+    isAgentSkillsEnabledForRun({ agent, skillsCapabilityEnabled, ephemeralSkillsToggle }) &&
+    (scopedEditableSkillIds.length > 0 || skillCreateAllowed === true)
+  );
+}
+
+function grantSkillOwner({ req, skillId }) {
+  return grantPermission({
+    principalType: PrincipalType.USER,
+    principalId: req.user.id,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    accessRoleId: AccessRoleIds.SKILL_OWNER,
+    grantedBy: req.user.id,
+  });
+}
+
+function getAuthorSkillByName({ req, name }) {
+  const author = req.user?._id ?? req.user?.id;
+  if (!author) {
+    return null;
+  }
+  return db.getAuthorSkillByName({
+    name,
+    author,
+    tenantId: resolveRequestTenantId(req),
+  });
+}
+
 /**
- * Builds the `skillPrimedIdsByName` map passed through to
- * `enrichWithSkillConfigurable`. Centralized here so the four CJS call
- * sites (`initialize.js`, `responses.js` x2, `openai.js`) share one
- * source of truth — if `ResolvedManualSkill` ever renames `_id` or
+ * Builds the `skillPrimedIdsByName` map threaded through
+ * `buildAgentToolContext`. Centralized here so every runtime route shares
+ * one source of truth — if `ResolvedManualSkill` ever renames `_id` or
  * gains new identifying fields, only this helper changes.
  *
  * Combines both manual (`$`-popover) primes AND always-apply primes so
@@ -59,17 +257,97 @@ function buildSkillPrimedIdsByName(manualSkillPrimes, alwaysApplySkillPrimes) {
   return out;
 }
 
+/**
+ * Builds the per-agent context consumed by ON_TOOL_EXECUTE. Keeping this
+ * shape in one Adapter gives every runtime path the same configurable
+ * fields and the same primed-skill pinning behavior.
+ *
+ * @param {object} params
+ * @param {object} params.agent
+ * @param {object} params.config
+ * @param {Record<string, import('@librechat/api').LCAvailableTools>} [params.config.mcpAvailableTools]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.config.requestScopedConnections]
+ * @returns {object}
+ */
+function buildAgentToolContext({ agent, config }) {
+  return {
+    agent,
+    /** Per-agent resolved endpoint token/pricing config. Retained here because
+     *  `agentToolContexts` is the one map that holds every agent — including
+     *  pure subagents pruned from `agentConfigs` — so usage can be priced with
+     *  the producing agent's config in multi-endpoint graphs. */
+    endpointTokenConfig: config.endpointTokenConfig,
+    toolRegistry: config.toolRegistry,
+    mcpAvailableTools: config.mcpAvailableTools,
+    requestScopedConnections: config.requestScopedConnections,
+    userMCPAuthMap: config.userMCPAuthMap,
+    tool_resources: config.tool_resources,
+    actionsEnabled: config.actionsEnabled,
+    accessibleSkillIds: config.accessibleSkillIds,
+    activeSkillNames: config.activeSkillNames,
+    codeEnvAvailable: config.codeEnvAvailable,
+    skillAuthoringAvailable: config.skillAuthoringAvailable,
+    fileAuthoringToolNames: config.fileAuthoringToolNames,
+    skillPrimedIdsByName:
+      buildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+  };
+}
+
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value ?? {}, key);
+}
+
+/**
+ * Applies per-agent runtime context to a loadToolsForExecution result.
+ *
+ * @param {object} params
+ * @param {{ loadedTools: unknown[], configurable?: Record<string, unknown> }} params.result
+ * @param {object} params.req
+ * @param {object | undefined} params.ctx
+ * @param {object | undefined} [params.fallback]
+ * @returns {{ loadedTools: unknown[], configurable: Record<string, unknown> }}
+ */
+function enrichLoadedToolsWithAgentContext({ result, req, ctx = {}, fallback = {} }) {
+  const codeEnvAvailable = hasOwn(ctx, 'codeEnvAvailable')
+    ? ctx.codeEnvAvailable === true
+    : fallback.codeEnvAvailable === true;
+  const skillAuthoringAvailable = hasOwn(ctx, 'skillAuthoringAvailable')
+    ? ctx.skillAuthoringAvailable === true
+    : fallback.skillAuthoringAvailable === true;
+
+  return enrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      codeEnvAvailable,
+      accessibleSkillIds: ctx.accessibleSkillIds ?? fallback.accessibleSkillIds,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName ?? fallback.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames ?? fallback.activeSkillNames,
+      skillAuthoringAvailable,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames ?? fallback.fileAuthoringToolNames,
+    },
+  });
+}
+
 /** Skill-related properties for ToolExecuteOptions (stable references, allocated once). */
 const skillToolDeps = {
-  getSkillByName: db.getSkillByName,
-  listSkillFiles: db.listSkillFiles,
-  getStrategyFunctions,
+  getSkillByName: deploymentSkillMethods.getSkillByName,
+  getAuthorSkillByName,
+  createSkill: db.createSkill,
+  updateSkill: db.updateSkill,
+  deleteSkill: db.deleteSkill,
+  canCreateSkill,
+  canEditSkill,
+  grantSkillOwner,
+  saveSkillFileContent,
+  listSkillFiles: deploymentSkillMethods.listSkillFiles,
+  getStrategyFunctions: getSkillStrategyFunctions,
   batchUploadCodeEnvFiles,
   getSessionInfo,
   checkIfActive,
-  updateSkillFileCodeEnvIds: db.updateSkillFileCodeEnvIds,
-  getSkillFileByPath: db.getSkillFileByPath,
-  updateSkillFileContent: db.updateSkillFileContent,
+  updateSkillFileCodeEnvIds: deploymentSkillMethods.updateSkillFileCodeEnvIds,
+  getSkillFileByPath: deploymentSkillMethods.getSkillFileByPath,
+  updateSkillFileContent: deploymentSkillMethods.updateSkillFileContent,
   /**
    * `read_file` falls back to a sandbox `cat` for `/mnt/data/...` paths
    * and for `{firstSegment}/...` paths whose first segment isn't a known
@@ -79,6 +357,7 @@ const skillToolDeps = {
    * the agents-side `ToolNode` via `tc.codeSessionContext`.
    */
   readSandboxFile,
+  writeSandboxFile,
 };
 
 function getSkillToolDeps() {
@@ -87,6 +366,13 @@ function getSkillToolDeps() {
 
 module.exports = {
   getSkillToolDeps,
+  canAuthorSkillFiles,
+  isAgentSkillsEnabledForRun,
+  getSkillDbMethods,
+  withDeploymentSkillIds,
+  getSkillStrategyFunctions,
   enrichWithSkillConfigurable,
   buildSkillPrimedIdsByName,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 };
diff --git a/api/server/services/Endpoints/agents/skillDeps.spec.js b/api/server/services/Endpoints/agents/skillDeps.spec.js
new file mode 100644
index 00000000000..3782a4664a0
--- /dev/null
+++ b/api/server/services/Endpoints/agents/skillDeps.spec.js
@@ -0,0 +1,107 @@
+const mockSaveBuffer = jest.fn();
+const mockDeleteFile = jest.fn();
+const mockGetStrategyFunctions = jest.fn();
+const mockGetFileStrategy = jest.fn();
+const mockGetStorageMetadata = jest.fn();
+const mockResolveRequestTenantId = jest.fn();
+const mockCreateDeploymentSkillMethods = jest.fn((methods) => methods);
+
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: (...args) => mockGetStrategyFunctions(...args),
+}));
+
+jest.mock('~/server/services/Files/Code/crud', () => ({
+  batchUploadCodeEnvFiles: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  getSessionInfo: jest.fn(),
+  checkIfActive: jest.fn(),
+  readSandboxFile: jest.fn(),
+  writeSandboxFile: jest.fn(),
+}));
+
+jest.mock('@librechat/api', () => ({
+  checkAccess: jest.fn(),
+  createDeploymentSkillMethods: (...args) => mockCreateDeploymentSkillMethods(...args),
+  enrichWithSkillConfigurable: jest.fn(),
+  getDeploymentSkillDownloadStream: jest.fn(),
+  getStorageMetadata: (...args) => mockGetStorageMetadata(...args),
+  isDeploymentSkillFileSource: jest.fn(() => false),
+  mergeDeploymentSkillIds: jest.fn((ids = []) => ids),
+  resolveRequestTenantId: (...args) => mockResolveRequestTenantId(...args),
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  AccessRoleIds: { SKILL_OWNER: 'SKILL_OWNER' },
+  FileContext: { skill_file: 'skill_file' },
+  PermissionBits: { EDIT: 2 },
+  Permissions: { USE: 'USE', CREATE: 'CREATE' },
+  PermissionTypes: { SKILLS: 'SKILLS' },
+  PrincipalType: { USER: 'USER' },
+  ResourceType: { SKILL: 'SKILL' },
+  isEphemeralAgentId: jest.fn(() => false),
+}));
+
+jest.mock('~/server/services/PermissionService', () => ({
+  checkPermission: jest.fn(),
+  grantPermission: jest.fn(),
+}));
+
+jest.mock('~/server/utils/getFileStrategy', () => ({
+  getFileStrategy: (...args) => mockGetFileStrategy(...args),
+}));
+
+const mockDb = {
+  getSkillFileByPath: jest.fn(),
+  upsertSkillFile: jest.fn(),
+};
+
+jest.mock('~/models', () => mockDb);
+
+const { getSkillToolDeps } = require('./skillDeps');
+
+describe('skillDeps saveSkillFileContent', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetFileStrategy.mockReturnValue('s3');
+    mockGetStrategyFunctions.mockReturnValue({
+      saveBuffer: mockSaveBuffer,
+      deleteFile: mockDeleteFile,
+    });
+    mockSaveBuffer.mockResolvedValue('https://files.example.test/uploads/file.txt');
+    mockDeleteFile.mockResolvedValue(undefined);
+    mockGetStorageMetadata.mockReturnValue({
+      storageKey: 'uploads/file.txt',
+      storageRegion: 'us-east-2',
+    });
+    mockResolveRequestTenantId.mockReturnValue('tenant-1');
+    mockDb.getSkillFileByPath.mockResolvedValue(null);
+  });
+
+  it('cleans up the uploaded object when metadata upsert returns no row', async () => {
+    mockDb.upsertSkillFile.mockResolvedValue(null);
+
+    await expect(
+      getSkillToolDeps().saveSkillFileContent({
+        req: {
+          user: { id: 'user-1', _id: 'user-1' },
+          config: {},
+        },
+        skillId: 'skill-1',
+        relativePath: 'references/template.html',
+        content: '<html></html>',
+        mimeType: 'text/html',
+      }),
+    ).rejects.toMatchObject({ code: 'SKILL_FILE_UPSERT_NOT_FOUND' });
+
+    expect(mockDeleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({ user: expect.objectContaining({ id: 'user-1' }) }),
+      {
+        filepath: 'https://files.example.test/uploads/file.txt',
+        user: 'user-1',
+        tenantId: 'tenant-1',
+      },
+    );
+  });
+});
diff --git a/api/server/services/Endpoints/agents/title.js b/api/server/services/Endpoints/agents/title.js
index b7e1a54e062..0aa955055e8 100644
--- a/api/server/services/Endpoints/agents/title.js
+++ b/api/server/services/Endpoints/agents/title.js
@@ -5,9 +5,47 @@ const getLogStores = require('~/cache/getLogStores');
 const { saveConvo } = require('~/models');
 
 /**
- * Add title to conversation in a way that avoids memory retention
+ * Add title to conversation in a way that avoids memory retention.
+ *
+ * @param {ServerRequest} req
+ * @param {Object} params
+ * @param {string} params.text - The user's first message.
+ * @param {TMessage} [params.response] - The assistant response (legacy/`final` timing only).
+ * @param {AgentClient} params.client
+ * @param {string} [params.conversationId] - Required for `immediate` timing, where
+ *   `response` is not yet available; falls back to `response.conversationId`.
+ * @param {boolean} [params.immediate] - When true, the title is generated in parallel
+ *   with the response (from the user's first message) and persisted to the conversation
+ *   only after `convoReady` resolves (the conversation row must exist for `noUpsert`).
+ * @param {Promise<void>} [params.convoReady] - Resolves once the conversation has been
+ *   persisted; awaited before saving the title in `immediate` mode.
+ * @param {AbortSignal} [params.signal] - When aborted (e.g. the user stops an
+ *   immediate-mode generation), cancels the in-flight title model call so a
+ *   turn stopped before the title finished does not consume the title model. A
+ *   title that already finished generating is still persisted and surfaced.
+ * @param {AbortSignal} [params.discardSignal] - When aborted, discards an
+ *   already-generated title instead of persisting it. Used only when this stream
+ *   is superseded by a newer run (or the turn failed), so a stale title does not
+ *   clobber the conversation now owned by the newer run. A plain user Stop does
+ *   NOT abort this — its generated title is kept.
+ * @param {(params: { conversationId: string, title: string }) => Promise<void>|void} [params.onTitleGenerated]
+ *   Called after the title is cached and before persistence waits for the
+ *   conversation row. Used by live streams to push the title immediately.
  */
-const addTitle = async (req, { text, response, client }) => {
+const addTitle = async (
+  req,
+  {
+    text,
+    response,
+    client,
+    conversationId,
+    immediate = false,
+    convoReady,
+    signal,
+    discardSignal,
+    onTitleGenerated,
+  },
+) => {
   const { TITLE_CONVO = true } = process.env ?? {};
   if (!isEnabled(TITLE_CONVO)) {
     return;
@@ -22,8 +60,14 @@ const addTitle = async (req, { text, response, client }) => {
     return;
   }
 
+  const convoId = conversationId ?? response?.conversationId;
+  if (!convoId) {
+    logger.warn('[addTitle] Missing conversationId; skipping title generation');
+    return;
+  }
+
   const titleCache = getLogStores(CacheKeys.GEN_TITLE);
-  const key = `${req.user.id}-${response.conversationId}`;
+  const key = `${req.user.id}-${convoId}`;
   /** @type {NodeJS.Timeout} */
   let timeoutId;
   try {
@@ -35,12 +79,22 @@ const addTitle = async (req, { text, response, client }) => {
 
     let titlePromise;
     let abortController = new AbortController();
+    /** Propagate a request abort (Stop) to the title generation so a cancelled
+     *  turn does not consume the title model or surface a title. */
+    if (signal) {
+      if (signal.aborted) {
+        abortController.abort();
+      } else {
+        signal.addEventListener('abort', () => abortController.abort(), { once: true });
+      }
+    }
     if (client && typeof client.titleConvo === 'function') {
       titlePromise = Promise.race([
         client
           .titleConvo({
             text,
             abortController,
+            immediate,
           })
           .catch((error) => {
             logger.error('Client title error:', error);
@@ -65,6 +119,39 @@ const addTitle = async (req, { text, response, client }) => {
     }
 
     await titleCache.set(key, title, 120000);
+
+    if (!signal?.aborted && typeof onTitleGenerated === 'function') {
+      try {
+        await onTitleGenerated({ conversationId: convoId, title });
+      } catch (error) {
+        logger.error('Error emitting generated title:', error);
+      }
+    }
+
+    /** In immediate mode the title is generated in parallel with the response,
+     *  so the conversation row may not exist yet. `saveConvo` with `noUpsert`
+     *  is a silent no-op when the row is missing, which would drop the title
+     *  from the database (the cache above still serves the live UI). Wait for
+     *  the controller to signal the conversation has been persisted. */
+    if (convoReady) {
+      await convoReady;
+    }
+
+    if (discardSignal?.aborted) {
+      // This stream was superseded by a newer run (or the turn failed) after the
+      // title had already been generated — discard it so a stale title does not
+      // clobber the conversation now owned by the newer run. A plain user Stop is
+      // not a discard: its generated title falls through and is persisted below.
+      // Only clear the cache if it still holds THIS task's title: a replacement
+      // stream shares the `userId-conversationId` key and may have already cached
+      // its own (valid) title that we must not remove.
+      const cached = await titleCache.get(key);
+      if (cached === title) {
+        await titleCache.delete(key);
+      }
+      return;
+    }
+
     await saveConvo(
       {
         userId: req?.user?.id,
@@ -72,7 +159,7 @@ const addTitle = async (req, { text, response, client }) => {
         interfaceConfig: req?.config?.interfaceConfig,
       },
       {
-        conversationId: response.conversationId,
+        conversationId: convoId,
         title,
       },
       { context: 'api/server/services/Endpoints/agents/title.js', noUpsert: true },
diff --git a/api/server/services/Endpoints/agents/title.test.js b/api/server/services/Endpoints/agents/title.test.js
new file mode 100644
index 00000000000..41537619900
--- /dev/null
+++ b/api/server/services/Endpoints/agents/title.test.js
@@ -0,0 +1,313 @@
+/** Backing store so `get` reflects prior `set`/`delete` — addTitle reads the cache
+ *  back to avoid clobbering a replacement stream's title on abort. */
+const mockCacheStore = new Map();
+const mockCache = {
+  get: jest.fn((key) => mockCacheStore.get(key)),
+  set: jest.fn((key, value) => mockCacheStore.set(key, value)),
+  delete: jest.fn((key) => mockCacheStore.delete(key)),
+};
+const mockSaveConvo = jest.fn();
+
+jest.mock('@librechat/api', () => ({
+  isEnabled: (val) => val === true || val === 'true',
+  sanitizeTitle: (title) => title,
+}));
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  CacheKeys: { GEN_TITLE: 'GEN_TITLE' },
+}));
+
+jest.mock('~/cache/getLogStores', () => jest.fn(() => mockCache));
+
+jest.mock('~/models', () => ({
+  saveConvo: (...args) => mockSaveConvo(...args),
+}));
+
+const addTitle = require('./title');
+
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+const makeClient = (title = 'Generated Title') => ({
+  options: { titleConvo: true },
+  titleConvo: jest.fn().mockResolvedValue(title),
+});
+
+const makeReq = () => ({ user: { id: 'user-1' }, body: {}, config: {} });
+
+describe('agents addTitle', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockCacheStore.clear();
+  });
+
+  it('uses the explicit conversationId for the cache key and saveConvo (immediate mode)', async () => {
+    const client = makeClient('My Title');
+
+    await addTitle(makeReq(), {
+      text: 'hello',
+      client,
+      conversationId: 'cid-immediate',
+      immediate: true,
+      convoReady: Promise.resolve(),
+    });
+
+    expect(mockCache.set).toHaveBeenCalledWith(
+      'user-1-cid-immediate',
+      'My Title',
+      expect.any(Number),
+    );
+    expect(mockSaveConvo).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ conversationId: 'cid-immediate', title: 'My Title' }),
+      expect.objectContaining({ noUpsert: true }),
+    );
+  });
+
+  it('passes immediate:true through to client.titleConvo', async () => {
+    const client = makeClient();
+
+    await addTitle(makeReq(), {
+      text: 'hello',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady: Promise.resolve(),
+    });
+
+    expect(client.titleConvo).toHaveBeenCalledWith(expect.objectContaining({ immediate: true }));
+  });
+
+  it('falls back to response.conversationId in legacy (final) mode', async () => {
+    const client = makeClient('Legacy Title');
+
+    await addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      response: { conversationId: 'resp-cid' },
+    });
+
+    expect(mockCache.set).toHaveBeenCalledWith(
+      'user-1-resp-cid',
+      'Legacy Title',
+      expect.any(Number),
+    );
+    expect(mockSaveConvo).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ conversationId: 'resp-cid', title: 'Legacy Title' }),
+      expect.objectContaining({ noUpsert: true }),
+    );
+    expect(client.titleConvo).toHaveBeenCalledWith(expect.objectContaining({ immediate: false }));
+  });
+
+  it('caches the title immediately but defers saveConvo until convoReady resolves', async () => {
+    const client = makeClient('Deferred Title');
+    let resolveConvo;
+    const convoReady = new Promise((resolve) => {
+      resolveConvo = resolve;
+    });
+
+    const pending = addTitle(makeReq(), {
+      text: 'hello',
+      client,
+      conversationId: 'cid-defer',
+      immediate: true,
+      convoReady,
+    });
+
+    await flush();
+
+    // Title is cached for the live UI, but persistence waits for the row to exist.
+    expect(mockCache.set).toHaveBeenCalledWith(
+      'user-1-cid-defer',
+      'Deferred Title',
+      expect.any(Number),
+    );
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+
+    resolveConvo();
+    await pending;
+
+    expect(mockSaveConvo).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ conversationId: 'cid-defer', title: 'Deferred Title' }),
+      expect.objectContaining({ noUpsert: true }),
+    );
+  });
+
+  it('notifies when the title is cached before waiting for convoReady', async () => {
+    const order = [];
+    const client = makeClient('Streamed Title');
+    const onTitleGenerated = jest.fn(async () => {
+      order.push('title-event');
+    });
+    let resolveConvo;
+    const convoReady = new Promise((resolve) => {
+      resolveConvo = resolve;
+    });
+
+    mockCache.set.mockImplementationOnce((key, value) => {
+      order.push('cache');
+      mockCacheStore.set(key, value);
+    });
+    mockSaveConvo.mockImplementationOnce(async () => {
+      order.push('save');
+    });
+
+    const pending = addTitle(makeReq(), {
+      text: 'hello',
+      client,
+      conversationId: 'cid-stream',
+      immediate: true,
+      convoReady,
+      onTitleGenerated,
+    });
+
+    await flush();
+
+    expect(onTitleGenerated).toHaveBeenCalledWith({
+      conversationId: 'cid-stream',
+      title: 'Streamed Title',
+    });
+    expect(order).toEqual(['cache', 'title-event']);
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+
+    resolveConvo();
+    await pending;
+
+    expect(order).toEqual(['cache', 'title-event', 'save']);
+  });
+
+  it('skips generation when the endpoint disables titleConvo', async () => {
+    const client = makeClient();
+    client.options.titleConvo = false;
+
+    await addTitle(makeReq(), { text: 'hi', client, conversationId: 'cid', immediate: true });
+
+    expect(client.titleConvo).not.toHaveBeenCalled();
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+  });
+
+  it('skips generation for temporary conversations', async () => {
+    const client = makeClient();
+    const req = makeReq();
+    req.body.isTemporary = true;
+
+    await addTitle(req, { text: 'hi', client, conversationId: 'cid', immediate: true });
+
+    expect(client.titleConvo).not.toHaveBeenCalled();
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+  });
+
+  it('skips generation when neither conversationId nor response is provided', async () => {
+    const client = makeClient();
+
+    await addTitle(makeReq(), { text: 'hi', client });
+
+    expect(client.titleConvo).not.toHaveBeenCalled();
+    expect(mockCache.set).not.toHaveBeenCalled();
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+  });
+
+  it('propagates the abort signal to the title model call', async () => {
+    const client = makeClient();
+    const ac = new AbortController();
+    ac.abort();
+
+    await addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady: Promise.resolve(),
+      signal: ac.signal,
+    });
+
+    const { abortController } = client.titleConvo.mock.calls[0][0];
+    expect(abortController.signal.aborted).toBe(true);
+  });
+
+  it('discards the title without persisting when the stream is superseded', async () => {
+    const client = makeClient();
+    const ac = new AbortController();
+    const onTitleGenerated = jest.fn();
+    ac.abort();
+
+    await addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady: Promise.resolve(),
+      signal: ac.signal,
+      discardSignal: ac.signal,
+      onTitleGenerated,
+    });
+
+    expect(onTitleGenerated).not.toHaveBeenCalled();
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+    expect(mockCache.delete).toHaveBeenCalledWith('user-1-cid');
+  });
+
+  it("does not delete a replacement stream's cached title when superseded", async () => {
+    const client = makeClient('Stale Title');
+    const ac = new AbortController();
+    ac.abort();
+    // Simulate a replacement stream having cached its own (newer) title under the
+    // shared `userId-conversationId` key by the time this stale task re-reads it.
+    mockCache.get.mockImplementationOnce(() => 'Newer Title');
+
+    await addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady: Promise.resolve(),
+      signal: ac.signal,
+      discardSignal: ac.signal,
+    });
+
+    expect(mockCache.delete).not.toHaveBeenCalled();
+    expect(mockSaveConvo).not.toHaveBeenCalled();
+  });
+
+  it('persists a title generated before a user Stop (signal aborted, not superseded)', async () => {
+    const client = makeClient('Kept Title');
+    // `signal` represents a user Stop; no `discardSignal` since the stream is not
+    // superseded. The title finishes generating and is emitted before the Stop.
+    const ac = new AbortController();
+    const onTitleGenerated = jest.fn();
+    let resolveConvo;
+    const convoReady = new Promise((resolve) => {
+      resolveConvo = resolve;
+    });
+
+    const pending = addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady,
+      signal: ac.signal,
+      onTitleGenerated,
+    });
+
+    await flush();
+    expect(onTitleGenerated).toHaveBeenCalledWith({ conversationId: 'cid', title: 'Kept Title' });
+
+    // User stops mid-response, then the conversation row is persisted.
+    ac.abort();
+    resolveConvo();
+    await pending;
+
+    expect(mockSaveConvo).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ conversationId: 'cid', title: 'Kept Title' }),
+      expect.objectContaining({ noUpsert: true }),
+    );
+    expect(mockCache.delete).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/services/Endpoints/assistants/initalize.js b/api/server/services/Endpoints/assistants/initalize.js
index d5a246dff7b..4b31f63fddb 100644
--- a/api/server/services/Endpoints/assistants/initalize.js
+++ b/api/server/services/Endpoints/assistants/initalize.js
@@ -1,6 +1,5 @@
 const OpenAI = require('openai');
-const { ProxyAgent } = require('undici');
-const { isUserProvided, checkUserKeyExpiry } = require('@librechat/api');
+const { isUserProvided, checkUserKeyExpiry, getProxyDispatcher } = require('@librechat/api');
 const { ErrorTypes, EModelEndpoint } = require('librechat-data-provider');
 const { getUserKeyValues, getUserKeyExpiry } = require('~/models');
 
@@ -45,10 +44,10 @@ const initializeClient = async ({ req, res, version }) => {
     opts.baseURL = baseURL;
   }
 
-  if (PROXY) {
-    const proxyAgent = new ProxyAgent(PROXY);
+  const proxyDispatcher = getProxyDispatcher(PROXY);
+  if (proxyDispatcher) {
     opts.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
diff --git a/api/server/services/Endpoints/azureAssistants/initialize.js b/api/server/services/Endpoints/azureAssistants/initialize.js
index e81f0bcd8ad..fde02b15892 100644
--- a/api/server/services/Endpoints/azureAssistants/initialize.js
+++ b/api/server/services/Endpoints/azureAssistants/initialize.js
@@ -1,10 +1,10 @@
 const OpenAI = require('openai');
-const { ProxyAgent } = require('undici');
 const {
   isUserProvided,
   resolveHeaders,
   constructAzureURL,
   checkUserKeyExpiry,
+  getProxyDispatcher,
 } = require('@librechat/api');
 const { ErrorTypes, EModelEndpoint, mapModelToAzureConfig } = require('librechat-data-provider');
 const { getUserKeyValues, getUserKeyExpiry } = require('~/models');
@@ -157,10 +157,10 @@ const initializeClient = async ({ req, res, version, endpointOption, initAppClie
     opts.baseURL = baseURL;
   }
 
-  if (PROXY) {
-    const proxyAgent = new ProxyAgent(PROXY);
+  const proxyDispatcher = getProxyDispatcher(PROXY);
+  if (proxyDispatcher) {
     opts.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
diff --git a/api/server/services/Files/Audio/STTService.js b/api/server/services/Files/Audio/STTService.js
index 7329bf6ac22..af46b9cc799 100644
--- a/api/server/services/Files/Audio/STTService.js
+++ b/api/server/services/Files/Audio/STTService.js
@@ -3,8 +3,7 @@ const fs = require('fs').promises;
 const FormData = require('form-data');
 const { Readable } = require('stream');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { genAzureEndpoint, logAxiosError } = require('@librechat/api');
+const { genAzureEndpoint, logAxiosError, applyAxiosProxyConfig } = require('@librechat/api');
 const { extractEnvVariable, STTProviders } = require('librechat-data-provider');
 const { getAppConfig } = require('~/server/services/Config');
 
@@ -142,6 +141,7 @@ class STTService {
       req.config ??
       (await getAppConfig({
         role: req?.user?.role,
+        userId: req?.user?.id,
         tenantId: req?.user?.tenantId,
       }));
     const sttSchema = appConfig?.speech?.stt;
@@ -302,9 +302,7 @@ class STTService {
 
     const options = { headers };
 
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
+    applyAxiosProxyConfig(options, url);
 
     try {
       const response = await axios.post(url, data, options);
diff --git a/api/server/services/Files/Audio/TTSService.js b/api/server/services/Files/Audio/TTSService.js
index 1125dd74ed9..301bbe90f84 100644
--- a/api/server/services/Files/Audio/TTSService.js
+++ b/api/server/services/Files/Audio/TTSService.js
@@ -1,7 +1,6 @@
 const axios = require('axios');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { genAzureEndpoint, logAxiosError } = require('@librechat/api');
+const { genAzureEndpoint, logAxiosError, applyAxiosProxyConfig } = require('@librechat/api');
 const { extractEnvVariable, TTSProviders } = require('librechat-data-provider');
 const { getRandomVoiceId, createChunkProcessor, splitTextIntoChunks } = require('./streamAudio');
 const { getAppConfig } = require('~/server/services/Config');
@@ -267,9 +266,7 @@ class TTSService {
 
     const options = { headers, responseType: stream ? 'stream' : 'arraybuffer' };
 
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
+    applyAxiosProxyConfig(options, url);
 
     try {
       return await axios.post(url, data, options);
@@ -297,6 +294,7 @@ class TTSService {
       req.config ??
       (await getAppConfig({
         role: req.user?.role,
+        userId: req.user?.id,
         tenantId: req.user?.tenantId,
       }));
     try {
@@ -366,6 +364,7 @@ class TTSService {
       req.config ??
       (await getAppConfig({
         role: req.user?.role,
+        userId: req.user?.id,
         tenantId: req.user?.tenantId,
       }));
     const provider = this.getProvider(appConfig);
diff --git a/api/server/services/Files/Audio/getCustomConfigSpeech.js b/api/server/services/Files/Audio/getCustomConfigSpeech.js
index b438771ec10..1edca8e1882 100644
--- a/api/server/services/Files/Audio/getCustomConfigSpeech.js
+++ b/api/server/services/Files/Audio/getCustomConfigSpeech.js
@@ -15,10 +15,13 @@ const { getAppConfig } = require('~/server/services/Config');
  */
 async function getCustomConfigSpeech(req, res) {
   try {
-    const appConfig = await getAppConfig({
-      role: req.user?.role,
-      tenantId: req.user?.tenantId,
-    });
+    const appConfig =
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
 
     if (!appConfig) {
       return res.status(200).send({
diff --git a/api/server/services/Files/Audio/getVoices.js b/api/server/services/Files/Audio/getVoices.js
index 22bd7cea6e4..a7cd7dbc30a 100644
--- a/api/server/services/Files/Audio/getVoices.js
+++ b/api/server/services/Files/Audio/getVoices.js
@@ -18,6 +18,7 @@ async function getVoices(req, res) {
       req.config ??
       (await getAppConfig({
         role: req.user?.role,
+        userId: req.user?.id,
         tenantId: req.user?.tenantId,
       }));
 
diff --git a/api/server/services/Files/Code/__tests__/process-traversal.spec.js b/api/server/services/Files/Code/__tests__/process-traversal.spec.js
index 791d6d258ca..57609c545aa 100644
--- a/api/server/services/Files/Code/__tests__/process-traversal.spec.js
+++ b/api/server/services/Files/Code/__tests__/process-traversal.spec.js
@@ -92,6 +92,11 @@ jest.mock('~/server/utils', () => ({
   determineFileType: jest.fn().mockResolvedValue({ mime: 'text/csv' }),
 }));
 
+jest.mock('~/server/services/Files/retention', () => ({
+  getRetentionExpiry: jest.fn(() => ({})),
+}));
+
+const { getRetentionExpiry } = require('~/server/services/Files/retention');
 const { createFile } = require('~/models');
 const { processCodeOutput } = require('../process');
 
@@ -143,6 +148,12 @@ describe('processCodeOutput path traversal protection', () => {
     expect(fileArg.tenantId).toBe('tenantA');
   });
 
+  test('getRetentionExpiry is called with the request object', async () => {
+    mockSanitizeArtifactPath.mockReturnValueOnce('output.csv');
+    await processCodeOutput({ ...baseParams, name: 'output.csv' });
+    expect(getRetentionExpiry).toHaveBeenCalledWith(baseParams.req);
+  });
+
   test('sanitized name is used for image file records', async () => {
     const { convertImage } = require('~/server/services/Files/images/convert');
     convertImage.mockResolvedValueOnce({
diff --git a/api/server/services/Files/Code/crud.js b/api/server/services/Files/Code/crud.js
index 035027b52d2..553599d3354 100644
--- a/api/server/services/Files/Code/crud.js
+++ b/api/server/services/Files/Code/crud.js
@@ -58,6 +58,71 @@ async function getCodeOutputDownloadStream(fileIdentifier, identity, req) {
   }
 }
 
+/**
+ * Deletes a file from the Code Environment server.
+ *
+ * @param {ServerRequest} req - Current authenticated request, used to mint Code API auth.
+ * @param {MongoFile} file - File metadata containing `metadata.codeEnvRef`.
+ * @returns {Promise<void>}
+ */
+async function deleteCodeEnvFile(req, file) {
+  const ref = file?.metadata?.codeEnvRef;
+  if (!ref) {
+    return;
+  }
+
+  let lastError;
+  const missingOrUnsupportedStatuses = new Set([404, 405]);
+  try {
+    const baseURL = getCodeBaseURL();
+    const query = buildCodeEnvDownloadQuery({
+      kind: ref.kind,
+      id: ref.id,
+      ...(ref.kind === 'skill' ? { version: ref.version } : {}),
+    });
+    const authHeaders = await getCodeApiAuthHeaders(req);
+    const baseRequest = {
+      method: 'delete',
+      headers: {
+        'User-Agent': 'LibreChat/1.0',
+        ...authHeaders,
+      },
+      httpAgent: codeServerHttpAgent,
+      httpsAgent: codeServerHttpsAgent,
+      timeout: 15000,
+    };
+    const urls = [
+      `${baseURL}/sessions/${ref.storage_session_id}/objects/${ref.file_id}${query}`,
+      `${baseURL}/files/${ref.storage_session_id}/${ref.file_id}${query}`,
+    ];
+
+    for (const url of urls) {
+      try {
+        await axios({ ...baseRequest, url });
+        return;
+      } catch (error) {
+        lastError = error;
+        if (!missingOrUnsupportedStatuses.has(error.response?.status)) {
+          throw error;
+        }
+      }
+    }
+  } catch (error) {
+    lastError = error;
+  }
+
+  if (lastError) {
+    logAxiosError({
+      error: lastError,
+      message: `Error deleting code environment file: ${lastError.message}`,
+    });
+    if (lastError.response?.status === 404) {
+      return;
+    }
+    throw new Error(lastError.message || 'An error occurred during file deletion.');
+  }
+}
+
 /**
  * Uploads a file to the Code Environment server.
  *
@@ -209,6 +274,7 @@ async function batchUploadCodeEnvFiles({ req, files, kind, id, version, read_onl
 }
 
 module.exports = {
+  deleteCodeEnvFile,
   getCodeOutputDownloadStream,
   uploadCodeEnvFile,
   batchUploadCodeEnvFiles,
diff --git a/api/server/services/Files/Code/crud.spec.js b/api/server/services/Files/Code/crud.spec.js
index e26eb4dbbb0..4e9c755ae1b 100644
--- a/api/server/services/Files/Code/crud.spec.js
+++ b/api/server/services/Files/Code/crud.spec.js
@@ -61,7 +61,7 @@ const {
   codeServerHttpsAgent,
   getCodeApiAuthHeaders,
 } = require('@librechat/api');
-const { getCodeOutputDownloadStream, uploadCodeEnvFile } = require('./crud');
+const { deleteCodeEnvFile, getCodeOutputDownloadStream, uploadCodeEnvFile } = require('./crud');
 
 describe('Code CRUD', () => {
   beforeEach(() => {
@@ -155,6 +155,94 @@ describe('Code CRUD', () => {
     });
   });
 
+  describe('deleteCodeEnvFile', () => {
+    const req = { user: { id: 'user-123' } };
+    const file = {
+      metadata: {
+        codeEnvRef: {
+          kind: 'agent',
+          id: 'agent-abc',
+          storage_session_id: 'session-1',
+          file_id: 'file-1',
+        },
+      },
+    };
+
+    it('deletes the code environment object with resource identity and auth headers', async () => {
+      getCodeApiAuthHeaders.mockResolvedValue({ Authorization: 'Bearer codeapi-token' });
+      mockAxios.mockResolvedValue({ status: 204 });
+
+      await deleteCodeEnvFile(req, file);
+
+      expect(getCodeApiAuthHeaders).toHaveBeenCalledWith(req);
+      expect(mockAxios).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'delete',
+          url: 'https://code-api.example.com/sessions/session-1/objects/file-1?kind=agent&id=agent-abc',
+          headers: expect.objectContaining({
+            Authorization: 'Bearer codeapi-token',
+            'User-Agent': 'LibreChat/1.0',
+          }),
+          httpAgent: codeServerHttpAgent,
+          httpsAgent: codeServerHttpsAgent,
+          timeout: 15000,
+        }),
+      );
+    });
+
+    it.each([404, 405])(
+      'falls back to the legacy code environment delete route after a %s',
+      async (status) => {
+        mockAxios
+          .mockRejectedValueOnce(
+            Object.assign(new Error('missing route'), { response: { status } }),
+          )
+          .mockResolvedValueOnce({ status: 204 });
+
+        await deleteCodeEnvFile(req, file);
+
+        expect(mockAxios).toHaveBeenNthCalledWith(
+          1,
+          expect.objectContaining({
+            method: 'delete',
+            url: 'https://code-api.example.com/sessions/session-1/objects/file-1?kind=agent&id=agent-abc',
+          }),
+        );
+        expect(mockAxios).toHaveBeenNthCalledWith(
+          2,
+          expect.objectContaining({
+            method: 'delete',
+            url: 'https://code-api.example.com/files/session-1/file-1?kind=agent&id=agent-abc',
+          }),
+        );
+      },
+    );
+
+    it('skips files without a code environment ref', async () => {
+      await deleteCodeEnvFile(req, {});
+
+      expect(mockAxios).not.toHaveBeenCalled();
+      expect(getCodeApiAuthHeaders).not.toHaveBeenCalled();
+    });
+
+    it('treats missing code environment objects as already deleted', async () => {
+      mockAxios
+        .mockRejectedValueOnce(Object.assign(new Error('missing'), { response: { status: 404 } }))
+        .mockRejectedValueOnce(Object.assign(new Error('missing'), { response: { status: 404 } }));
+
+      await expect(deleteCodeEnvFile(req, file)).resolves.toBeUndefined();
+      expect(mockAxios).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws when code environment deletion fails', async () => {
+      mockAxios.mockRejectedValue(
+        Object.assign(new Error('unavailable'), { response: { status: 500 } }),
+      );
+
+      await expect(deleteCodeEnvFile(req, file)).rejects.toThrow('unavailable');
+    });
+  });
+
   describe('uploadCodeEnvFile', () => {
     const baseUploadParams = {
       req: { user: { id: 'user-123' } },
diff --git a/api/server/services/Files/Code/process.js b/api/server/services/Files/Code/process.js
index a04c6329c66..10ba254a19c 100644
--- a/api/server/services/Files/Code/process.js
+++ b/api/server/services/Files/Code/process.js
@@ -36,6 +36,7 @@ const { filterFilesByAgentAccess } = require('~/server/services/Files/permission
 const { createFile, getFiles, updateFile, claimCodeFile } = require('~/models');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { convertImage } = require('~/server/services/Files/images/convert');
+const { getRetentionExpiry } = require('~/server/services/Files/retention');
 const { determineFileType } = require('~/server/utils');
 
 const axios = createAxiosInstance();
@@ -463,6 +464,7 @@ const processCodeOutput = async ({
         source: appConfig.fileStrategy,
         context: FileContext.execute_code,
         metadata: { codeEnvRef },
+        ...(await getRetentionExpiry(req)),
       };
       await createFile(file, true);
       return { file: Object.assign(file, { messageId, toolCallId }) };
@@ -565,6 +567,7 @@ const processCodeOutput = async ({
       context: FileContext.execute_code,
       usage: isUpdate ? (claimed.usage ?? 0) + 1 : 1,
       createdAt: isUpdate ? claimed.createdAt : formattedDate,
+      ...(await getRetentionExpiry(req)),
     };
 
     if (expectsPreview) {
@@ -1039,11 +1042,101 @@ async function readSandboxFile({ file_path, session_id, files, req }) {
   }
 }
 
+/**
+ * Writes a UTF-8 text file into the code-execution sandbox by running a
+ * small Python writer through the sandbox `/exec` endpoint. The payload is
+ * base64-encoded JSON so neither the file path nor the content is
+ * interpolated into shell syntax.
+ *
+ * @param {Object} params
+ * @param {string} params.file_path - Path inside the sandbox (prefer `/mnt/data/...`).
+ * @param {string} params.content - Complete UTF-8 text content to write.
+ * @param {string} [params.session_id] - Sandbox session id from the seeded context.
+ * @param {Array<{id: string, name: string, session_id?: string}>} [params.files] - File refs to mount.
+ * @param {ServerRequest} [params.req] - Current authenticated request, used to mint Code API auth.
+ * @returns {Promise<{stdout?: string, stderr?: string, session_id?: string, files?: Array<Object>} | null>}
+ */
+async function writeSandboxFile({ file_path, content, session_id, files, req }) {
+  const baseURL = getCodeBaseURL();
+  if (!baseURL) {
+    return null;
+  }
+
+  const payload = Buffer.from(
+    JSON.stringify({
+      file_path,
+      content_b64: Buffer.from(content, 'utf8').toString('base64'),
+    }),
+    'utf8',
+  ).toString('base64');
+  const code = [
+    "python3 - <<'PY'",
+    'import base64, json, os',
+    `payload = ${JSON.stringify(payload)}`,
+    "data = json.loads(base64.b64decode(payload).decode('utf-8'))",
+    "path = data['file_path']",
+    "content = base64.b64decode(data['content_b64'])",
+    'parent = os.path.dirname(path)',
+    'if parent:',
+    '    os.makedirs(parent, exist_ok=True)',
+    "with open(path, 'wb') as f:",
+    '    f.write(content)',
+    'print(f"WROTE {len(content)} bytes to {path}")',
+    'PY',
+  ].join('\n');
+
+  /** @type {Record<string, unknown>} */
+  const postData = { lang: 'bash', code };
+  if (session_id) {
+    postData.session_id = session_id;
+  }
+  if (files && files.length > 0) {
+    postData.files = files;
+  }
+
+  try {
+    const authHeaders = await getCodeApiAuthHeaders(req);
+    const response = await axios({
+      method: 'post',
+      url: `${baseURL}/exec`,
+      data: postData,
+      headers: {
+        'Content-Type': 'application/json',
+        'User-Agent': 'LibreChat/1.0',
+        ...authHeaders,
+      },
+      httpAgent: codeServerHttpAgent,
+      httpsAgent: codeServerHttpsAgent,
+      timeout: 15000,
+    });
+    const result = response?.data ?? {};
+    if (result.stderr && (result.stdout == null || result.stdout === '')) {
+      throw new Error(String(result.stderr).trim());
+    }
+    if (result.stdout == null && result.session_id == null) {
+      return null;
+    }
+    return {
+      stdout: result.stdout == null ? undefined : String(result.stdout),
+      stderr: result.stderr == null ? undefined : String(result.stderr),
+      session_id: result.session_id,
+      files: result.files,
+    };
+  } catch (error) {
+    logAxiosError({
+      message: `Error writing sandbox file "${file_path}"`,
+      error,
+    });
+    throw error;
+  }
+}
+
 module.exports = {
   primeFiles,
   checkIfActive,
   getSessionInfo,
   processCodeOutput,
   readSandboxFile,
+  writeSandboxFile,
   runPreviewFinalize,
 };
diff --git a/api/server/services/Files/Code/process.spec.js b/api/server/services/Files/Code/process.spec.js
index 6ade00b1f71..0bff06adf32 100644
--- a/api/server/services/Files/Code/process.spec.js
+++ b/api/server/services/Files/Code/process.spec.js
@@ -137,6 +137,10 @@ jest.mock('~/server/services/Files/images/convert', () => ({
   convertImage: jest.fn(),
 }));
 
+jest.mock('~/server/services/Files/retention', () => ({
+  getRetentionExpiry: jest.fn(() => ({})),
+}));
+
 // Mock determineFileType
 jest.mock('~/server/utils', () => ({
   determineFileType: jest.fn(),
@@ -145,6 +149,7 @@ jest.mock('~/server/utils', () => ({
 const http = require('http');
 const https = require('https');
 const { createFile, getFiles } = require('~/models');
+const { getRetentionExpiry } = require('~/server/services/Files/retention');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { convertImage } = require('~/server/services/Files/images/convert');
 const { determineFileType } = require('~/server/utils');
@@ -156,7 +161,13 @@ const {
   getStorageMetadata,
 } = require('@librechat/api');
 
-const { processCodeOutput, getSessionInfo, readSandboxFile, primeFiles } = require('./process');
+const {
+  processCodeOutput,
+  getSessionInfo,
+  readSandboxFile,
+  writeSandboxFile,
+  primeFiles,
+} = require('./process');
 
 describe('Code Process', () => {
   const mockReq = {
@@ -233,6 +244,7 @@ describe('Code Process', () => {
 
       expect(result.file_id).toBe('mock-uuid-1234');
       expect(result.usage).toBe(1);
+      expect(getRetentionExpiry).toHaveBeenCalledWith(baseParams.req);
     });
   });
 
@@ -1620,6 +1632,95 @@ describe('Code Process', () => {
     });
   });
 
+  describe('writeSandboxFile', () => {
+    function extractWritePayload() {
+      const code = mockAxios.mock.calls[0][0].data.code;
+      const match = /payload = "([^"]+)"/.exec(code);
+      expect(match).not.toBeNull();
+      const payload = JSON.parse(Buffer.from(match[1], 'base64').toString('utf8'));
+      return {
+        file_path: payload.file_path,
+        content: Buffer.from(payload.content_b64, 'base64').toString('utf8'),
+        code,
+      };
+    }
+
+    it('POSTs a bash python writer to /exec and forwards session context', async () => {
+      mockAxios.mockResolvedValueOnce({
+        data: {
+          stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+          stderr: '',
+          session_id: 'sess-new',
+          files: [{ id: 'file-new', name: 'new.txt', storage_session_id: 'sess-new' }],
+        },
+      });
+      const files = [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }];
+
+      const result = await writeSandboxFile({
+        file_path: '/mnt/data/new.txt',
+        content: 'hello world',
+        session_id: 'sess-prev',
+        files,
+        req: mockReq,
+      });
+
+      const call = mockAxios.mock.calls[0][0];
+      expect(call.method).toBe('post');
+      expect(call.url).toBe('https://code-api.example.com/exec');
+      expect(call.data.lang).toBe('bash');
+      expect(call.data.session_id).toBe('sess-prev');
+      expect(call.data.files).toEqual(files);
+      expect(call.timeout).toBe(15000);
+      expect(call.httpAgent).toBe(codeServerHttpAgent);
+      expect(call.httpsAgent).toBe(codeServerHttpsAgent);
+      expect(result).toMatchObject({
+        stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt' }],
+      });
+    });
+
+    it('encodes path and content in a base64 JSON payload instead of shell-interpolating them', async () => {
+      mockAxios.mockResolvedValueOnce({ data: { stdout: 'ok', stderr: '', session_id: 'sess' } });
+      const trickyPath = `/mnt/data/quote'$(whoami).txt`;
+      const trickyContent = "hello ' $(rm -rf /)\nsecond line";
+
+      await writeSandboxFile({
+        file_path: trickyPath,
+        content: trickyContent,
+      });
+
+      const { file_path, content, code } = extractWritePayload();
+      expect(file_path).toBe(trickyPath);
+      expect(content).toBe(trickyContent);
+      expect(code).not.toContain(trickyPath);
+      expect(code).not.toContain(trickyContent);
+    });
+
+    it('returns null when getCodeBaseURL is not configured', async () => {
+      const { getCodeBaseURL } = require('@librechat/agents');
+      getCodeBaseURL.mockReturnValueOnce('');
+
+      const result = await writeSandboxFile({
+        file_path: '/mnt/data/x.txt',
+        content: 'x',
+      });
+
+      expect(result).toBeNull();
+      expect(mockAxios).not.toHaveBeenCalled();
+    });
+
+    it('throws when the writer reports stderr without stdout', async () => {
+      mockAxios.mockResolvedValueOnce({
+        data: { stdout: '', stderr: 'Permission denied\n' },
+      });
+
+      await expect(writeSandboxFile({ file_path: '/root/nope.txt', content: 'x' })).rejects.toThrow(
+        'Permission denied',
+      );
+    });
+  });
+
   describe('primeFiles reupload pushes FRESH sandbox ids (Pass-N review P2)', () => {
     /**
      * Regression: when a primed code file is missing/expired in the
diff --git a/api/server/services/Files/images/avatar.js b/api/server/services/Files/images/avatar.js
index 640aed293ff..72e038cbece 100644
--- a/api/server/services/Files/images/avatar.js
+++ b/api/server/services/Files/images/avatar.js
@@ -26,7 +26,7 @@ const MAX_AVATAR_BYTES = 10 * 1024 * 1024;
  * measurable benefit on this path. If this ever becomes a hot path, hoist
  * the agents to module scope.
  */
-async function fetchAvatarBuffer(input) {
+async function fetchAvatarBuffer(input, fetchOptions = {}) {
   let parsed;
   try {
     parsed = new URL(input);
@@ -44,6 +44,7 @@ async function fetchAvatarBuffer(input) {
    * stronger of the two for this path — bounds total slow-loris exposure.
    */
   const response = await fetch(parsed.href, {
+    headers: fetchOptions.headers,
     agent: (urlObj) => (urlObj.protocol === 'https:' ? httpsAgent : httpAgent),
     redirect: 'error',
     timeout: 5000,
@@ -80,6 +81,7 @@ async function fetchAvatarBuffer(input) {
  * @param {string} options.desiredFormat - The desired output format of the image.
  * @param {(string|Buffer|File)} params.input - The input representing the avatar image. Can be a URL (string),
  *                                               a Buffer, or a File object.
+ * @param {{ headers?: Record<string, string> }} [params.fetchOptions] - Optional headers for trusted avatar URLs.
  *
  * @returns {Promise<any>}
  *          A promise that resolves to a resized buffer.
@@ -87,7 +89,7 @@ async function fetchAvatarBuffer(input) {
  * @throws {Error} Throws an error if the user ID is undefined, the input type is invalid, the image fetching fails,
  *                 or any other error occurs during the processing.
  */
-async function resizeAvatar({ userId, input, desiredFormat = EImageOutputType.PNG }) {
+async function resizeAvatar({ userId, input, desiredFormat = EImageOutputType.PNG, fetchOptions }) {
   try {
     if (userId === undefined) {
       throw new Error('User ID is undefined');
@@ -95,7 +97,7 @@ async function resizeAvatar({ userId, input, desiredFormat = EImageOutputType.PN
 
     let imageBuffer;
     if (typeof input === 'string') {
-      imageBuffer = await fetchAvatarBuffer(input);
+      imageBuffer = await fetchAvatarBuffer(input, fetchOptions);
     } else if (input instanceof Buffer) {
       imageBuffer = input;
     } else if (typeof input === 'object' && input instanceof File) {
diff --git a/api/server/services/Files/images/avatar.spec.js b/api/server/services/Files/images/avatar.spec.js
index cc3e0b1ad15..2eb2240468f 100644
--- a/api/server/services/Files/images/avatar.spec.js
+++ b/api/server/services/Files/images/avatar.spec.js
@@ -117,6 +117,26 @@ describe('resizeAvatar — fetchAvatarBuffer', () => {
       expect(agentFn(new URL('http://anything'))).toEqual({ __kind: 'http' });
       expect(createSSRFSafeAgents).toHaveBeenCalledTimes(1);
     });
+
+    it('passes configured fetch headers while preserving shared fetch controls', async () => {
+      fetch.mockResolvedValueOnce(makeResponse({ body: Buffer.from('rawimg') }));
+      await resizeAvatar({
+        userId: 'u1',
+        input: 'https://cdn.example.com/avatar.png',
+        fetchOptions: {
+          headers: {
+            Authorization: 'Bearer avatar-token',
+          },
+        },
+      });
+
+      const opts = fetch.mock.calls[0][1];
+      expect(opts.headers).toEqual({ Authorization: 'Bearer avatar-token' });
+      expect(opts.redirect).toBe('error');
+      expect(opts.timeout).toBe(5000);
+      expect(opts.size).toBe(10 * 1024 * 1024);
+      expect(typeof opts.agent).toBe('function');
+    });
   });
 
   describe('rejects unsafe responses', () => {
diff --git a/api/server/services/Files/process.js b/api/server/services/Files/process.js
index ea8ee14840a..f6d92ac5af6 100644
--- a/api/server/services/Files/process.js
+++ b/api/server/services/Files/process.js
@@ -18,12 +18,14 @@ const {
   getEndpointFileConfig,
   documentParserMimeTypes,
 } = require('librechat-data-provider');
-const { logger } = require('@librechat/data-schemas');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
 const {
   sanitizeFilename,
   parseText,
   processAudioFile,
   getStorageMetadata,
+  sweepExpiredFiles: sweepExpiredFilesWithDeps,
+  startExpiredFileSweep: startExpiredFileSweepWithDeps,
 } = require('@librechat/api');
 const {
   convertImage,
@@ -36,6 +38,7 @@ const { loadAuthValues } = require('~/server/services/Tools/credentials');
 const { getFileStrategy } = require('~/server/utils/getFileStrategy');
 const { checkCapability } = require('~/server/services/Config');
 const { LB_QueueAsyncCall } = require('~/server/utils/queue');
+const { getRetentionExpiry, getAgentFileRetentionExpiry } = require('./retention');
 const { getStrategyFunctions } = require('./strategies');
 const { determineFileType } = require('~/server/utils');
 const { STTService } = require('./Audio/STTService');
@@ -64,6 +67,19 @@ const createSanitizedUploadWrapper = (uploadFunction) => {
   };
 };
 
+const hasCodeEnvRef = (file) => file?.metadata?.codeEnvRef != null;
+
+const isMissingStorageError = (err) => {
+  const code = err?.code ?? err?.status ?? err?.statusCode ?? err?.response?.status;
+  if ([404, '404', 'ENOENT', 'NoSuchKey', 'NotFound', 'ResourceNotFound'].includes(code)) {
+    return true;
+  }
+
+  return /(?:file|object|blob|key|resource) (?:not found|does not exist)|no such (?:file|key)/i.test(
+    String(err?.message ?? ''),
+  );
+};
+
 /**
  * Enqueues the delete operation to the leaky bucket queue if necessary, or adds it directly to promises.
  *
@@ -72,10 +88,19 @@ const createSanitizedUploadWrapper = (uploadFunction) => {
  * @param {MongoFile} params.file - The file object to delete.
  * @param {Function} params.deleteFile - The delete file function.
  * @param {Promise[]} params.promises - The array of promises to await.
- * @param {string[]} params.resolvedFileIds - The array of promises to await.
+ * @param {Set<string>} params.resolvedFileIds - File IDs whose storage delete succeeded.
+ * @param {Set<string>} params.failedFileIds - File IDs whose storage delete failed.
  * @param {OpenAI | undefined} [params.openai] - If an OpenAI file, the initialized OpenAI client.
  */
-function enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileIds, openai }) {
+function enqueueDeleteOperation({
+  req,
+  file,
+  deleteFile,
+  promises,
+  resolvedFileIds,
+  failedFileIds,
+  openai,
+}) {
   if (checkOpenAIStorage(file.source)) {
     // Enqueue to leaky bucket
     promises.push(
@@ -85,10 +110,17 @@ function enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileI
           [],
           (err, result) => {
             if (err) {
+              if (isMissingStorageError(err)) {
+                resolvedFileIds.add(file.file_id);
+                logger.warn('File storage was already missing during delete', err);
+                resolve(result);
+                return;
+              }
+              failedFileIds.add(file.file_id);
               logger.error('Error deleting file from OpenAI source', err);
               reject(err);
             } else {
-              resolvedFileIds.push(file.file_id);
+              resolvedFileIds.add(file.file_id);
               resolve(result);
             }
           },
@@ -99,8 +131,14 @@ function enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileI
     // Add directly to promises
     promises.push(
       deleteFile(req, file)
-        .then(() => resolvedFileIds.push(file.file_id))
+        .then(() => resolvedFileIds.add(file.file_id))
         .catch((err) => {
+          if (isMissingStorageError(err)) {
+            resolvedFileIds.add(file.file_id);
+            logger.warn('File storage was already missing during delete', err);
+            return;
+          }
+          failedFileIds.add(file.file_id);
           logger.error('Error deleting file', err);
           return Promise.reject(err);
         }),
@@ -108,6 +146,49 @@ function enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileI
   }
 }
 
+const getDeleteMethod = ({ source, deletionMethods }) => {
+  if (deletionMethods[source]) {
+    return deletionMethods[source];
+  }
+
+  const { deleteFile } = getStrategyFunctions(source);
+  if (!deleteFile) {
+    throw new Error(`Delete function not implemented for ${source}`);
+  }
+
+  deletionMethods[source] = deleteFile;
+  return deleteFile;
+};
+
+const createDeleteFileWithSecondaryStorage = ({ source, deleteFile, deletionMethods }) => {
+  return async (req, file, openai) => {
+    const secondaryDeleteMethods = [];
+    if (file.embedded === true && source !== FileSources.vectordb) {
+      secondaryDeleteMethods.push(
+        getDeleteMethod({ source: FileSources.vectordb, deletionMethods }),
+      );
+    }
+    if (hasCodeEnvRef(file) && source !== FileSources.execute_code) {
+      secondaryDeleteMethods.push(
+        getDeleteMethod({ source: FileSources.execute_code, deletionMethods }),
+      );
+    }
+
+    try {
+      await deleteFile(req, file, openai);
+    } catch (err) {
+      if (!isMissingStorageError(err)) {
+        throw err;
+      }
+      logger.warn('Primary file storage was already missing during delete', err);
+    }
+
+    await Promise.all(
+      secondaryDeleteMethods.map((secondaryDeleteFile) => secondaryDeleteFile(req, file)),
+    );
+  };
+};
+
 // TODO: refactor as currently only image files can be deleted this way
 // as other filetypes will not reside in public path
 /**
@@ -121,11 +202,13 @@ function enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileI
  * @param {string} [params.req.body.assistant_id] - The assistant ID if file uploaded is associated to an assistant.
  * @param {string} [params.req.body.tool_resource] - The tool resource if assistant file uploaded is associated to a tool resource.
  *
- * @returns {Promise<void>}
+ * @returns {Promise<{ deletedFileIds: string[], failedFileIds: string[] }>}
+ * @throws {Error} When storage deletion cannot be scheduled or file metadata cleanup fails.
  */
 const processDeleteRequest = async ({ req, files }) => {
   const appConfig = req.config;
-  const resolvedFileIds = [];
+  const resolvedFileIds = new Set();
+  const failedFileIds = new Set();
   const deletionMethods = {};
   const promises = [];
 
@@ -167,7 +250,7 @@ const processDeleteRequest = async ({ req, files }) => {
     }
 
     if (source === FileSources.text) {
-      resolvedFileIds.push(file.file_id);
+      resolvedFileIds.add(file.file_id);
       continue;
     }
 
@@ -191,25 +274,16 @@ const processDeleteRequest = async ({ req, files }) => {
       promises.push(openai.beta.assistants.files.del(req.body.assistant_id, file.file_id));
     }
 
-    if (deletionMethods[source]) {
-      enqueueDeleteOperation({
-        req,
-        file,
-        deleteFile: deletionMethods[source],
-        promises,
-        resolvedFileIds,
-        openai,
-      });
-      continue;
-    }
-
-    const { deleteFile } = getStrategyFunctions(source);
-    if (!deleteFile) {
-      throw new Error(`Delete function not implemented for ${source}`);
-    }
-
-    deletionMethods[source] = deleteFile;
-    enqueueDeleteOperation({ req, file, deleteFile, promises, resolvedFileIds, openai });
+    const deleteFile = getDeleteMethod({ source, deletionMethods });
+    enqueueDeleteOperation({
+      req,
+      file,
+      deleteFile: createDeleteFileWithSecondaryStorage({ source, deleteFile, deletionMethods }),
+      promises,
+      resolvedFileIds,
+      failedFileIds,
+      openai,
+    });
   }
 
   if (agentFiles.length > 0) {
@@ -222,17 +296,60 @@ const processDeleteRequest = async ({ req, files }) => {
   }
 
   await Promise.allSettled(promises);
-  await db.deleteFiles(resolvedFileIds);
-
-  if (resolvedFileIds.length > 0) {
+  const deletedFileIds = [...resolvedFileIds];
+  let metadataDeletedFileIds = deletedFileIds;
+  if (deletedFileIds.length > 0) {
     try {
-      await db.removeAgentResourceFilesFromAllAgents({ file_ids: resolvedFileIds });
+      await db.deleteFiles(deletedFileIds);
     } catch (error) {
-      logger.error('Error cleaning up orphaned agent file references', error);
+      logger.error('Error deleting file metadata after storage deletion', error);
+      deletedFileIds.forEach((fileId) => failedFileIds.add(fileId));
+      metadataDeletedFileIds = [];
+      throw error;
+    }
+    if (metadataDeletedFileIds.length > 0) {
+      try {
+        await db.removeAgentResourceFilesFromAllAgents({ file_ids: metadataDeletedFileIds });
+      } catch (error) {
+        logger.error('Error cleaning up orphaned agent file references', error);
+      }
     }
   }
+
+  return {
+    deletedFileIds: metadataDeletedFileIds,
+    failedFileIds: [...failedFileIds],
+  };
 };
 
+/**
+ * Deletes expired file storage before removing the corresponding File records.
+ *
+ * Mongo TTL indexes delete only the metadata document, so file retention uses
+ * this application sweep for records with `expiredAt` instead.
+ *
+ * @param {object} params
+ * @param {AppConfig} params.appConfig
+ * @param {number} [params.limit]
+ * @param {() => Promise<AppConfig>} [params.loadAppConfig]
+ * @returns {Promise<{ scanned: number, deleted: number, failed: number }>}
+ */
+async function sweepExpiredFiles(options = {}) {
+  return sweepExpiredFilesWithDeps(options, {
+    getExpiredFiles: db.getExpiredFiles,
+    processDeleteRequest,
+    logger,
+  });
+}
+
+function startExpiredFileSweep(options = {}) {
+  return startExpiredFileSweepWithDeps(options, {
+    sweepExpiredFiles,
+    runAsSystem,
+    logger,
+  });
+}
+
 /**
  * Processes a file URL using a specified file handling strategy. This function accepts a strategy name,
  * fetches the corresponding file processing functions (for saving and retrieving file URLs), and then
@@ -251,6 +368,7 @@ const processDeleteRequest = async ({ req, files }) => {
  * @param {string} params.basePath - The base path or directory where the file will be saved or retrieved from.
  * @param {FileContext} params.context - The context of the file (e.g., 'avatar', 'image_generation', etc.)
  * @param {string} [params.tenantId] - Optional tenant identifier for tenant-prefixed storage paths.
+ * @param {ServerRequest} [params.req] - Request context used to apply data retention metadata.
  * @returns {Promise<MongoFile>} A promise that resolves to the DB representation (MongoFile)
  *  of the processed file. It throws an error if the file processing fails at any stage.
  */
@@ -262,6 +380,7 @@ const processFileURL = async ({
   basePath,
   context,
   tenantId,
+  req,
 }) => {
   const { saveURL, getFileURL } = getStrategyFunctions(fileStrategy);
   try {
@@ -305,6 +424,7 @@ const processFileURL = async ({
         source: fileStrategy,
         type,
         context,
+        ...(await getRetentionExpiry(req)),
         tenantId,
         width: dimensions.width,
         height: dimensions.height,
@@ -355,6 +475,7 @@ const processImageFile = async ({ req, res, metadata, returnFile = false }) => {
       context: FileContext.message_attachment,
       source,
       type: `image/${appConfig.imageOutputType}`,
+      ...(await getRetentionExpiry(req)),
       width,
       height,
       tenantId: req.user.tenantId,
@@ -415,6 +536,7 @@ const uploadImageBuffer = async ({ req, context, metadata = {}, resize = true })
       source,
       type,
       width,
+      ...(await getRetentionExpiry(req)),
       height,
       tenantId: req.user.tenantId,
     },
@@ -517,6 +639,7 @@ const processFileUpload = async ({ req, res, metadata }) => {
       context: isAssistantUpload ? FileContext.assistants : FileContext.message_attachment,
       model: isAssistantUpload ? req.body.model : undefined,
       type: file.mimetype,
+      ...(await getRetentionExpiry(req)),
       embedded,
       source,
       height,
@@ -631,20 +754,28 @@ const processAgentFileUpload = async ({ req, res, metadata }) => {
           `Extracted text from "${file.originalname}" exceeds the 15MB storage limit (${Math.round(textBytes / megabyte)}MB). Try a shorter document.`,
         );
       }
-      const fileInfo = removeNullishValues({
-        text,
-        bytes,
-        file_id,
-        temp_file_id,
-        user: req.user.id,
-        type,
-        filepath: filepath ?? file.path,
-        source: FileSources.text,
-        filename: file.originalname,
-        model: messageAttachment ? undefined : req.body.model,
-        context: messageAttachment ? FileContext.message_attachment : FileContext.agents,
-        tenantId: req.user.tenantId,
+      const retentionExpiry = await getAgentFileRetentionExpiry({
+        req,
+        messageAttachment,
+        tool_resource,
       });
+      const fileInfo = {
+        ...removeNullishValues({
+          text,
+          bytes,
+          file_id,
+          temp_file_id,
+          user: req.user.id,
+          type,
+          filepath: filepath ?? file.path,
+          source: FileSources.text,
+          filename: file.originalname,
+          model: messageAttachment ? undefined : req.body.model,
+          context: messageAttachment ? FileContext.message_attachment : FileContext.agents,
+          tenantId: req.user.tenantId,
+        }),
+        ...retentionExpiry,
+      };
 
       if (!messageAttachment && tool_resource) {
         await db.addAgentResourceFile({
@@ -825,24 +956,32 @@ const processAgentFileUpload = async ({ req, res, metadata }) => {
     });
   }
 
-  const fileInfo = removeNullishValues({
-    user: req.user.id,
-    file_id,
-    temp_file_id,
-    bytes,
-    filepath,
-    ...storageMetadata,
-    filename: filename ?? sanitizeFilename(file.originalname),
-    context: messageAttachment ? FileContext.message_attachment : FileContext.agents,
-    model: messageAttachment ? undefined : req.body.model,
-    metadata: fileInfoMetadata,
-    type: file.mimetype,
-    embedded,
-    source,
-    height,
-    width,
-    tenantId: req.user.tenantId,
+  const retentionExpiry = await getAgentFileRetentionExpiry({
+    req,
+    messageAttachment,
+    tool_resource,
   });
+  const fileInfo = {
+    ...removeNullishValues({
+      user: req.user.id,
+      file_id,
+      temp_file_id,
+      bytes,
+      filepath,
+      ...storageMetadata,
+      filename: filename ?? sanitizeFilename(file.originalname),
+      context: messageAttachment ? FileContext.message_attachment : FileContext.agents,
+      model: messageAttachment ? undefined : req.body.model,
+      metadata: fileInfoMetadata,
+      type: file.mimetype,
+      embedded,
+      source,
+      height,
+      width,
+      tenantId: req.user.tenantId,
+    }),
+    ...retentionExpiry,
+  };
 
   const result = await db.createFile(fileInfo, true);
 
@@ -887,6 +1026,7 @@ const processOpenAIFile = async ({
     source,
     model: openai.req.body.model,
     filename: originalName ?? file_id,
+    ...(await getRetentionExpiry(openai.req)),
     tenantId: openai.req?.user?.tenantId,
   };
 
@@ -894,7 +1034,11 @@ const processOpenAIFile = async ({
     await db.createFile(file, true);
   } else if (updateUsage) {
     try {
-      await db.updateFileUsage({ file_id });
+      await db.updateFileUsage({
+        file_id,
+        user: userId,
+        tenantId: openai.req?.user?.tenantId,
+      });
     } catch (error) {
       logger.error('Error updating file usage', error);
     }
@@ -931,9 +1075,14 @@ const processOpenAIImageOutput = async ({ req, buffer, file_id, filename, fileEx
     context: FileContext.assistants_output,
     file_id,
     filename,
+    ...(await getRetentionExpiry(req)),
     tenantId: req.user.tenantId,
   };
-  db.createFile(file, true);
+  try {
+    await db.createFile(file, true);
+  } catch (error) {
+    logger.warn('Error saving OpenAI image output file metadata', error);
+  }
   return file;
 };
 
@@ -1091,6 +1240,7 @@ async function saveBase64Image(
       user: req.user.id,
       bytes: image.bytes,
       width: image.width,
+      ...(await getRetentionExpiry(req)),
       height: image.height,
       tenantId: req.user.tenantId,
     },
@@ -1182,6 +1332,8 @@ module.exports = {
   saveBase64Image,
   processImageFile,
   uploadImageBuffer,
+  sweepExpiredFiles,
+  startExpiredFileSweep,
   processFileUpload,
   processDeleteRequest,
   processAgentFileUpload,
diff --git a/api/server/services/Files/process.spec.js b/api/server/services/Files/process.spec.js
index 99457522d45..1521f873bf5 100644
--- a/api/server/services/Files/process.spec.js
+++ b/api/server/services/Files/process.spec.js
@@ -1,22 +1,64 @@
 jest.mock('uuid', () => ({ v4: jest.fn(() => 'mock-uuid') }));
 
 jest.mock('@librechat/data-schemas', () => ({
-  logger: { warn: jest.fn(), debug: jest.fn(), error: jest.fn() },
+  logger: { warn: jest.fn(), debug: jest.fn(), error: jest.fn(), info: jest.fn() },
+  runAsSystem: jest.fn((fn) => fn()),
+  createTempChatExpirationDate: jest.fn(() => new Date('2030-01-01T00:00:00.000Z')),
 }));
 
-jest.mock('@librechat/agents', () => ({}));
-
-jest.mock('@librechat/api', () => ({
-  sanitizeFilename: jest.fn((n) => n),
-  parseText: jest.fn().mockResolvedValue({ text: '', bytes: 0 }),
-  processAudioFile: jest.fn(),
-  getStorageMetadata: jest.fn(() => ({})),
+jest.mock('@librechat/agents', () => ({
+  Providers: {
+    XAI: 'xai',
+    DEEPSEEK: 'deepseek',
+    MOONSHOT: 'moonshot',
+    OPENROUTER: 'openrouter',
+    VERTEXAI: 'vertexai',
+  },
 }));
 
-jest.mock('librechat-data-provider', () => ({
-  ...jest.requireActual('librechat-data-provider'),
-  mergeFileConfig: jest.fn(),
-}));
+jest.mock('librechat-data-provider', () => {
+  const actual = jest.requireActual('librechat-data-provider');
+  return {
+    ...actual,
+    Providers: actual.Providers,
+    RetentionMode: actual.RetentionMode ?? { ALL: 'all', TEMPORARY: 'temporary' },
+    documentParserMimeTypes: actual.documentParserMimeTypes ?? [
+      /^application\/pdf$/,
+      /^application\/vnd\.openxmlformats-officedocument\./,
+      /^application\/vnd\.ms-excel$/,
+      /^application\/vnd\.oasis\.opendocument\./,
+      /^application\/(?:x-)?msexcel$/,
+    ],
+    mergeFileConfig: jest.fn(),
+  };
+});
+
+jest.mock('@librechat/api', () => {
+  const actualDataProvider = jest.requireActual('librechat-data-provider');
+  const RetentionMode = actualDataProvider.RetentionMode ?? { ALL: 'all', TEMPORARY: 'temporary' };
+  const getRetentionExpiry = jest.fn(() => ({}));
+  return {
+    sanitizeFilename: jest.fn((n) => n),
+    parseText: jest.fn().mockResolvedValue({ text: '', bytes: 0 }),
+    processAudioFile: jest.fn(),
+    getStorageMetadata: jest.fn(() => ({})),
+    getRetentionExpiry,
+    getAgentFileRetentionExpiry: jest.fn(({ req, messageAttachment, toolResource }) => {
+      const interfaceConfig = req?.config?.interfaceConfig;
+      if (
+        !messageAttachment &&
+        !!toolResource &&
+        (interfaceConfig?.retentionMode !== RetentionMode.ALL ||
+          interfaceConfig?.retainAgentFiles === true)
+      ) {
+        return {};
+      }
+      return getRetentionExpiry(req);
+    }),
+    sweepExpiredFiles: jest.fn().mockResolvedValue({ scanned: 0, deleted: 0, failed: 0 }),
+    startExpiredFileSweep: jest.fn().mockReturnValue('sweep-interval'),
+  };
+});
 
 jest.mock('~/server/services/Files/images', () => ({
   convertImage: jest.fn(),
@@ -41,8 +83,12 @@ jest.mock('~/models', () => ({
   createFile: jest.fn().mockResolvedValue({ file_id: 'created-file-id' }),
   updateFileUsage: jest.fn(),
   deleteFiles: jest.fn(),
+  findFileById: jest.fn(),
+  getConvo: jest.fn(),
+  getExpiredFiles: jest.fn(),
   addAgentResourceFile: jest.fn().mockResolvedValue({}),
   removeAgentResourceFiles: jest.fn(),
+  removeAgentResourceFilesFromAllAgents: jest.fn(),
 }));
 
 jest.mock('~/server/utils/getFileStrategy', () => ({
@@ -61,6 +107,16 @@ jest.mock('~/server/services/Files/strategies', () => ({
   getStrategyFunctions: jest.fn(),
 }));
 
+jest.mock('./VectorDB/crud', () => ({
+  uploadVectors: jest.fn().mockResolvedValue({
+    bytes: 42,
+    filename: 'upload.bin',
+    filepath: 'vectordb',
+    embedded: true,
+  }),
+  deleteVectors: jest.fn(),
+}));
+
 jest.mock('~/server/utils', () => ({
   determineFileType: jest.fn(),
 }));
@@ -69,17 +125,31 @@ jest.mock('~/server/services/Files/Audio/STTService', () => ({
   STTService: { getInstance: jest.fn() },
 }));
 
+const {
+  getRetentionExpiry,
+  getAgentFileRetentionExpiry,
+  sweepExpiredFiles: sweepExpiredFilesWithDeps,
+  startExpiredFileSweep: startExpiredFileSweepWithDeps,
+} = require('@librechat/api');
 const {
   EToolResources,
   FileSources,
   FileContext,
+  RetentionMode,
   AgentCapabilities,
 } = require('librechat-data-provider');
 const { mergeFileConfig } = require('librechat-data-provider');
 const { checkCapability } = require('~/server/services/Config');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { uploadVectors } = require('./VectorDB/crud');
 const db = require('~/models');
-const { processAgentFileUpload, processFileURL } = require('./process');
+const {
+  processAgentFileUpload,
+  processDeleteRequest,
+  processFileURL,
+  sweepExpiredFiles,
+  startExpiredFileSweep,
+} = require('./process');
 
 const PDF_MIME = 'application/pdf';
 const DOCX_MIME = 'application/vnd.openxmlformats-officedocument.wordprocessingml.document';
@@ -90,7 +160,7 @@ const ODT_MIME = 'application/vnd.oasis.opendocument.text';
 const ODP_MIME = 'application/vnd.oasis.opendocument.presentation';
 const ODG_MIME = 'application/vnd.oasis.opendocument.graphics';
 
-const makeReq = ({ mimetype = PDF_MIME, ocrConfig = null } = {}) => ({
+const makeReq = ({ mimetype = PDF_MIME, ocrConfig = null, interfaceConfig, body } = {}) => ({
   user: { id: 'user-123', tenantId: 'tenant-a' },
   file: {
     path: '/tmp/upload.bin',
@@ -98,11 +168,12 @@ const makeReq = ({ mimetype = PDF_MIME, ocrConfig = null } = {}) => ({
     filename: 'upload-uuid.bin',
     mimetype,
   },
-  body: { model: 'gpt-4o' },
+  body: { model: 'gpt-4o', ...body },
   config: {
     fileConfig: {},
     fileStrategy: 'local',
     ocr: ocrConfig,
+    ...(interfaceConfig ? { interfaceConfig } : {}),
   },
 });
 
@@ -124,6 +195,17 @@ const makeFileConfig = ({ ocrSupportedMimeTypes = [] } = {}) => ({
   text: { supportedMimeTypes: [] },
 });
 
+const setupStoredFileUpload = (result = {}) => {
+  const handleFileUpload = jest.fn().mockResolvedValue({
+    bytes: 42,
+    filename: 'upload.bin',
+    filepath: '/uploads/upload.bin',
+    ...result,
+  });
+  getStrategyFunctions.mockReturnValue({ handleFileUpload });
+  return handleFileUpload;
+};
+
 describe('processAgentFileUpload', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -347,6 +429,198 @@ describe('processAgentFileUpload', () => {
     });
   });
 
+  describe('retention for agent resource uploads', () => {
+    test('skips retention metadata for persistent agent context files outside all-data retention when retainAgentFiles is disabled', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      const req = makeReq({
+        mimetype: PDF_MIME,
+        ocrConfig: null,
+        interfaceConfig: { retentionMode: RetentionMode.TEMPORARY, retainAgentFiles: false },
+        body: { conversationId: 'temporary-convo', isTemporary: true },
+      });
+
+      await processAgentFileUpload({ req, res: mockRes, metadata: makeMetadata() });
+
+      expect(getAgentFileRetentionExpiry).toHaveBeenCalledWith(
+        {
+          req,
+          messageAttachment: false,
+          toolResource: EToolResources.context,
+        },
+        expect.any(Object),
+      );
+      expect(getRetentionExpiry).not.toHaveBeenCalled();
+      expect(db.createFile).toHaveBeenCalledWith(expect.not.objectContaining({ expiredAt }), true);
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.context,
+        }),
+      );
+    });
+
+    test('skips retention metadata for persistent agent context files outside all-data retention when retainAgentFiles is enabled', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      const req = makeReq({
+        mimetype: PDF_MIME,
+        ocrConfig: null,
+        interfaceConfig: { retentionMode: RetentionMode.TEMPORARY, retainAgentFiles: true },
+      });
+
+      await processAgentFileUpload({ req, res: mockRes, metadata: makeMetadata() });
+
+      expect(getRetentionExpiry).not.toHaveBeenCalled();
+      expect(db.createFile).toHaveBeenCalledWith(expect.not.objectContaining({ expiredAt }), true);
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.context,
+        }),
+      );
+    });
+
+    test('applies all-data retention metadata to persistent agent context files when retainAgentFiles is disabled', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      getRetentionExpiry.mockResolvedValueOnce({ expiredAt });
+      const req = makeReq({
+        mimetype: PDF_MIME,
+        ocrConfig: null,
+        interfaceConfig: { retentionMode: RetentionMode.ALL, retainAgentFiles: false },
+      });
+
+      await processAgentFileUpload({ req, res: mockRes, metadata: makeMetadata() });
+
+      expect(getRetentionExpiry).toHaveBeenCalledTimes(1);
+      expect(getRetentionExpiry.mock.calls[0][0]).toBe(req);
+      expect(db.createFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expiredAt,
+          context: FileContext.agents,
+        }),
+        true,
+      );
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.context,
+        }),
+      );
+    });
+
+    test('skips all-data retention metadata for persistent agent context files when retainAgentFiles is enabled', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      const req = makeReq({
+        mimetype: PDF_MIME,
+        ocrConfig: null,
+        interfaceConfig: { retentionMode: RetentionMode.ALL, retainAgentFiles: true },
+      });
+
+      await processAgentFileUpload({ req, res: mockRes, metadata: makeMetadata() });
+
+      expect(getAgentFileRetentionExpiry).toHaveBeenCalledWith(
+        {
+          req,
+          messageAttachment: false,
+          toolResource: EToolResources.context,
+        },
+        expect.any(Object),
+      );
+      expect(getRetentionExpiry).not.toHaveBeenCalled();
+      expect(db.createFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: FileContext.agents,
+        }),
+        true,
+      );
+      expect(db.createFile).toHaveBeenCalledWith(expect.not.objectContaining({ expiredAt }), true);
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.context,
+        }),
+      );
+    });
+
+    test('applies retention metadata to context files uploaded as message attachments', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      getRetentionExpiry.mockResolvedValueOnce({ expiredAt });
+      const req = makeReq({ mimetype: PDF_MIME, ocrConfig: null });
+
+      await processAgentFileUpload({
+        req,
+        res: mockRes,
+        metadata: { ...makeMetadata(), message_file: true },
+      });
+
+      expect(getRetentionExpiry).toHaveBeenCalledTimes(1);
+      expect(getRetentionExpiry.mock.calls[0][0]).toBe(req);
+      expect(db.createFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expiredAt,
+          context: FileContext.message_attachment,
+        }),
+        true,
+      );
+      expect(db.addAgentResourceFile).not.toHaveBeenCalled();
+    });
+
+    test('skips retention metadata for persistent agent file-search files outside all-data retention', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      setupStoredFileUpload();
+      const req = makeReq({ mimetype: 'text/plain', ocrConfig: null });
+
+      await processAgentFileUpload({
+        req,
+        res: mockRes,
+        metadata: { ...makeMetadata(), tool_resource: EToolResources.file_search },
+      });
+
+      expect(uploadVectors).toHaveBeenCalled();
+      expect(getRetentionExpiry).not.toHaveBeenCalled();
+      expect(db.createFile).toHaveBeenCalledWith(expect.not.objectContaining({ expiredAt }), true);
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.file_search,
+        }),
+      );
+    });
+
+    test('applies all-data retention metadata to persistent agent file-search files', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      getRetentionExpiry.mockResolvedValueOnce({ expiredAt });
+      setupStoredFileUpload();
+      const req = makeReq({
+        mimetype: 'text/plain',
+        ocrConfig: null,
+        interfaceConfig: { retentionMode: RetentionMode.ALL },
+      });
+
+      await processAgentFileUpload({
+        req,
+        res: mockRes,
+        metadata: { ...makeMetadata(), tool_resource: EToolResources.file_search },
+      });
+
+      expect(uploadVectors).toHaveBeenCalled();
+      expect(getRetentionExpiry).toHaveBeenCalledTimes(1);
+      expect(getRetentionExpiry.mock.calls[0][0]).toBe(req);
+      expect(db.createFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expiredAt,
+          context: FileContext.agents,
+        }),
+        true,
+      );
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.file_search,
+        }),
+      );
+    });
+  });
+
   /* Phase C / option α regression: the upload must persist its sandbox
    * pointer under `metadata.codeEnvRef` (the post-cutover schema). The
    * legacy `metadata.fileIdentifier` key is silently stripped by mongoose
@@ -450,6 +724,72 @@ describe('processAgentFileUpload', () => {
       );
     });
 
+    it('skips retention metadata for persistent agent execute_code files outside all-data retention', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      setupCodeEnvUpload({ storage_session_id: 'sess-4', file_id: 'fid-4' });
+      const req = makeReq();
+
+      await processAgentFileUpload({
+        req,
+        res: mockRes,
+        metadata: {
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.execute_code,
+          file_id: 'file-uuid',
+        },
+      });
+
+      expect(getRetentionExpiry).not.toHaveBeenCalled();
+      expect(db.createFile).toHaveBeenCalledWith(expect.not.objectContaining({ expiredAt }), true);
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.execute_code,
+        }),
+      );
+    });
+
+    it('applies all-data retention metadata to persistent agent execute_code files', async () => {
+      const expiredAt = new Date('2030-01-01T00:00:00.000Z');
+      getRetentionExpiry.mockResolvedValueOnce({ expiredAt });
+      setupCodeEnvUpload({ storage_session_id: 'sess-5', file_id: 'fid-5' });
+      const req = makeReq({ interfaceConfig: { retentionMode: RetentionMode.ALL } });
+
+      await processAgentFileUpload({
+        req,
+        res: mockRes,
+        metadata: {
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.execute_code,
+          file_id: 'file-uuid',
+        },
+      });
+
+      expect(getRetentionExpiry).toHaveBeenCalledTimes(1);
+      expect(getRetentionExpiry.mock.calls[0][0]).toBe(req);
+      expect(db.createFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          expiredAt,
+          context: FileContext.agents,
+          metadata: {
+            codeEnvRef: {
+              kind: 'agent',
+              id: 'agent-abc',
+              storage_session_id: 'sess-5',
+              file_id: 'fid-5',
+            },
+          },
+        }),
+        true,
+      );
+      expect(db.addAgentResourceFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          agent_id: 'agent-abc',
+          tool_resource: EToolResources.execute_code,
+        }),
+      );
+    });
+
     it('does not persist legacy fileIdentifier key (mongoose strict drops it)', async () => {
       setupCodeEnvUpload({ storage_session_id: 'sess-3', file_id: 'fid-3' });
       const req = makeReq();
@@ -534,6 +874,110 @@ describe('processFileURL', () => {
     );
   });
 
+  it('applies retention metadata for generated images when retention mode is all', async () => {
+    getRetentionExpiry.mockResolvedValueOnce({
+      expiredAt: new Date('2030-01-01T00:00:00.000Z'),
+    });
+    const saveURL = jest.fn().mockResolvedValue({
+      filepath: 'https://cdn.example.com/t/tenant-a/images/user-123/image.png',
+      bytes: 512,
+      type: 'image/png',
+    });
+    const getFileURL = jest.fn();
+    getStrategyFunctions.mockReturnValue({ saveURL, getFileURL });
+
+    await processFileURL({
+      fileStrategy: FileSources.cloudfront,
+      userId: 'user-123',
+      URL: 'https://example.com/image.png',
+      fileName: 'image.png',
+      basePath: 'images',
+      context: FileContext.image_generation,
+      tenantId: 'tenant-a',
+      req: {
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+        body: {},
+        config: { interfaceConfig: { retentionMode: 'all', retainAgentFiles: true } },
+      },
+    });
+
+    expect(db.createFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        expiredAt: new Date('2030-01-01T00:00:00.000Z'),
+      }),
+      true,
+    );
+  });
+
+  it('applies retention metadata for retained non-temporary conversations', async () => {
+    const saveURL = jest.fn().mockResolvedValue({
+      filepath: 'https://cdn.example.com/t/tenant-a/images/user-123/image.png',
+      bytes: 512,
+      type: 'image/png',
+    });
+    const getFileURL = jest.fn();
+    getStrategyFunctions.mockReturnValue({ saveURL, getFileURL });
+    getRetentionExpiry.mockResolvedValueOnce({
+      expiredAt: new Date('2030-01-01T00:00:00.000Z'),
+    });
+
+    await processFileURL({
+      fileStrategy: FileSources.cloudfront,
+      userId: 'user-123',
+      URL: 'https://example.com/image.png',
+      fileName: 'image.png',
+      basePath: 'images',
+      context: FileContext.image_generation,
+      tenantId: 'tenant-a',
+      req: {
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-123' },
+        config: { interfaceConfig: { retentionMode: RetentionMode.TEMPORARY } },
+      },
+    });
+
+    expect(db.createFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        expiredAt: new Date('2030-01-01T00:00:00.000Z'),
+      }),
+      true,
+    );
+  });
+
+  it('keeps expired retained conversation files on the parent expiration', async () => {
+    const parentExpiredAt = new Date('2020-01-01T00:00:00.000Z');
+    const saveURL = jest.fn().mockResolvedValue({
+      filepath: 'https://cdn.example.com/t/tenant-a/images/user-123/image.png',
+      bytes: 512,
+      type: 'image/png',
+    });
+    const getFileURL = jest.fn();
+    getStrategyFunctions.mockReturnValue({ saveURL, getFileURL });
+    getRetentionExpiry.mockResolvedValueOnce({ expiredAt: parentExpiredAt });
+
+    await processFileURL({
+      fileStrategy: FileSources.cloudfront,
+      userId: 'user-123',
+      URL: 'https://example.com/image.png',
+      fileName: 'image.png',
+      basePath: 'images',
+      context: FileContext.image_generation,
+      tenantId: 'tenant-a',
+      req: {
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+        body: { conversationId: 'convo-123' },
+        config: { interfaceConfig: { retentionMode: RetentionMode.TEMPORARY } },
+      },
+    });
+
+    expect(db.createFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        expiredAt: parentExpiredAt,
+      }),
+      true,
+    );
+  });
+
   it('falls back to getFileURL with user and tenant context when metadata lacks filepath', async () => {
     const saveURL = jest.fn().mockResolvedValue({
       bytes: 256,
@@ -602,3 +1046,293 @@ describe('processFileURL', () => {
     );
   });
 });
+
+describe('processDeleteRequest', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('removes metadata when backing storage is already missing', async () => {
+    const missingError = Object.assign(new Error('no such file'), { code: 'ENOENT' });
+    const deleteFile = jest.fn().mockRejectedValue(missingError);
+    getStrategyFunctions.mockReturnValue({ deleteFile });
+    db.deleteFiles.mockResolvedValue({ deletedCount: 1 });
+
+    const result = await processDeleteRequest({
+      req: {
+        body: {},
+        config: {},
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+      },
+      files: [
+        {
+          file_id: 'expired-file',
+          filepath: '/images/user-123/expired.png',
+          source: FileSources.local,
+        },
+      ],
+    });
+
+    expect(db.deleteFiles).toHaveBeenCalledWith(['expired-file']);
+    expect(result).toEqual({ deletedFileIds: ['expired-file'], failedFileIds: [] });
+  });
+
+  it('does not treat unrelated not found messages as missing storage', async () => {
+    const deleteFile = jest.fn().mockRejectedValue(new Error('Configuration not found'));
+    getStrategyFunctions.mockReturnValue({ deleteFile });
+
+    const result = await processDeleteRequest({
+      req: {
+        body: {},
+        config: {},
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+      },
+      files: [
+        {
+          file_id: 'expired-file',
+          filepath: '/images/user-123/expired.png',
+          source: FileSources.local,
+        },
+      ],
+    });
+
+    expect(db.deleteFiles).not.toHaveBeenCalled();
+    expect(result).toEqual({ deletedFileIds: [], failedFileIds: ['expired-file'] });
+  });
+
+  it('throws metadata delete failures after storage deletion succeeds', async () => {
+    const deleteFile = jest.fn().mockResolvedValue(undefined);
+    const metadataError = new Error('mongo unavailable');
+    getStrategyFunctions.mockReturnValue({ deleteFile });
+    db.deleteFiles.mockRejectedValue(metadataError);
+
+    await expect(
+      processDeleteRequest({
+        req: {
+          body: {},
+          config: {},
+          user: { id: 'user-123', tenantId: 'tenant-a' },
+        },
+        files: [
+          {
+            file_id: 'expired-file',
+            filepath: '/images/user-123/expired.png',
+            source: FileSources.local,
+          },
+        ],
+      }),
+    ).rejects.toThrow('mongo unavailable');
+
+    expect(db.deleteFiles).toHaveBeenCalledWith(['expired-file']);
+    expect(db.removeAgentResourceFilesFromAllAgents).not.toHaveBeenCalled();
+  });
+
+  it('deletes vector storage before removing embedded file metadata', async () => {
+    const primaryDelete = jest.fn().mockResolvedValue(undefined);
+    const vectorDelete = jest.fn().mockResolvedValue(undefined);
+    getStrategyFunctions.mockImplementation((source) =>
+      source === FileSources.vectordb
+        ? { deleteFile: vectorDelete }
+        : { deleteFile: primaryDelete },
+    );
+    db.deleteFiles.mockResolvedValue({ deletedCount: 1 });
+    const req = {
+      body: {},
+      config: {},
+      user: { id: 'user-123', tenantId: 'tenant-a' },
+    };
+    const file = {
+      file_id: 'embedded-file',
+      filepath: '/uploads/embedded.txt',
+      source: FileSources.local,
+      embedded: true,
+    };
+
+    const result = await processDeleteRequest({ req, files: [file] });
+
+    expect(primaryDelete).toHaveBeenCalledWith(req, file, undefined);
+    expect(vectorDelete).toHaveBeenCalledWith(req, file);
+    expect(db.deleteFiles).toHaveBeenCalledWith(['embedded-file']);
+    expect(result).toEqual({ deletedFileIds: ['embedded-file'], failedFileIds: [] });
+  });
+
+  it('keeps embedded file metadata when vector deletion fails', async () => {
+    const primaryDelete = jest.fn().mockResolvedValue(undefined);
+    const vectorDelete = jest.fn().mockRejectedValue(new Error('rag unavailable'));
+    getStrategyFunctions.mockImplementation((source) =>
+      source === FileSources.vectordb
+        ? { deleteFile: vectorDelete }
+        : { deleteFile: primaryDelete },
+    );
+    const req = {
+      body: {},
+      config: {},
+      user: { id: 'user-123', tenantId: 'tenant-a' },
+    };
+    const file = {
+      file_id: 'embedded-file',
+      filepath: '/uploads/embedded.txt',
+      source: FileSources.local,
+      embedded: true,
+    };
+
+    const result = await processDeleteRequest({ req, files: [file] });
+
+    expect(primaryDelete).toHaveBeenCalledWith(req, file, undefined);
+    expect(vectorDelete).toHaveBeenCalledWith(req, file);
+    expect(db.deleteFiles).not.toHaveBeenCalled();
+    expect(result).toEqual({ deletedFileIds: [], failedFileIds: ['embedded-file'] });
+  });
+
+  it('does not delete vector storage when primary embedded file deletion fails', async () => {
+    const primaryDelete = jest.fn().mockRejectedValue(new Error('permission denied'));
+    const vectorDelete = jest.fn().mockResolvedValue(undefined);
+    getStrategyFunctions.mockImplementation((source) =>
+      source === FileSources.vectordb
+        ? { deleteFile: vectorDelete }
+        : { deleteFile: primaryDelete },
+    );
+    const req = {
+      body: {},
+      config: {},
+      user: { id: 'user-123', tenantId: 'tenant-a' },
+    };
+    const file = {
+      file_id: 'embedded-file',
+      filepath: '/uploads/embedded.txt',
+      source: FileSources.local,
+      embedded: true,
+    };
+
+    const result = await processDeleteRequest({ req, files: [file] });
+
+    expect(primaryDelete).toHaveBeenCalledWith(req, file, undefined);
+    expect(vectorDelete).not.toHaveBeenCalled();
+    expect(db.deleteFiles).not.toHaveBeenCalled();
+    expect(result).toEqual({ deletedFileIds: [], failedFileIds: ['embedded-file'] });
+  });
+
+  it('still deletes vector storage when primary embedded file storage is already missing', async () => {
+    const missingError = Object.assign(new Error('no such file'), { code: 'ENOENT' });
+    const primaryDelete = jest.fn().mockRejectedValue(missingError);
+    const vectorDelete = jest.fn().mockResolvedValue(undefined);
+    getStrategyFunctions.mockImplementation((source) =>
+      source === FileSources.vectordb
+        ? { deleteFile: vectorDelete }
+        : { deleteFile: primaryDelete },
+    );
+    db.deleteFiles.mockResolvedValue({ deletedCount: 1 });
+    const req = {
+      body: {},
+      config: {},
+      user: { id: 'user-123', tenantId: 'tenant-a' },
+    };
+    const file = {
+      file_id: 'embedded-file',
+      filepath: '/uploads/embedded.txt',
+      source: FileSources.local,
+      embedded: true,
+    };
+
+    const result = await processDeleteRequest({ req, files: [file] });
+
+    expect(primaryDelete).toHaveBeenCalledWith(req, file, undefined);
+    expect(vectorDelete).toHaveBeenCalledWith(req, file);
+    expect(db.deleteFiles).toHaveBeenCalledWith(['embedded-file']);
+    expect(result).toEqual({ deletedFileIds: ['embedded-file'], failedFileIds: [] });
+  });
+
+  it('deletes code environment storage before removing code resource file metadata', async () => {
+    const primaryDelete = jest.fn().mockResolvedValue(undefined);
+    const codeDelete = jest.fn().mockResolvedValue(undefined);
+    getStrategyFunctions.mockImplementation((source) =>
+      source === FileSources.execute_code
+        ? { deleteFile: codeDelete }
+        : { deleteFile: primaryDelete },
+    );
+    db.deleteFiles.mockResolvedValue({ deletedCount: 1 });
+    const req = {
+      body: {},
+      config: {},
+      user: { id: 'user-123', tenantId: 'tenant-a' },
+    };
+    const file = {
+      file_id: 'code-resource-file',
+      filepath: '/uploads/code-resource.txt',
+      source: FileSources.local,
+      metadata: {
+        codeEnvRef: {
+          kind: 'agent',
+          id: 'agent-abc',
+          storage_session_id: 'sess-1',
+          file_id: 'fid-1',
+        },
+      },
+    };
+
+    const result = await processDeleteRequest({ req, files: [file] });
+
+    expect(primaryDelete).toHaveBeenCalledWith(req, file, undefined);
+    expect(codeDelete).toHaveBeenCalledWith(req, file);
+    expect(db.deleteFiles).toHaveBeenCalledWith(['code-resource-file']);
+    expect(result).toEqual({ deletedFileIds: ['code-resource-file'], failedFileIds: [] });
+  });
+});
+
+describe('sweepExpiredFiles', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('delegates expired file sweeping to the shared package with backend dependencies', async () => {
+    const options = {
+      appConfig: { paths: { publicPath: '/tmp/public', uploads: '/tmp/uploads' } },
+      limit: 1,
+    };
+    sweepExpiredFilesWithDeps.mockResolvedValue({ scanned: 1, deleted: 1, failed: 0 });
+
+    const result = await sweepExpiredFiles(options);
+
+    expect(sweepExpiredFilesWithDeps).toHaveBeenCalledWith(
+      options,
+      expect.objectContaining({
+        getExpiredFiles: db.getExpiredFiles,
+        processDeleteRequest: expect.any(Function),
+        logger: expect.objectContaining({
+          error: expect.any(Function),
+          info: expect.any(Function),
+          warn: expect.any(Function),
+        }),
+      }),
+    );
+    expect(result).toEqual({ scanned: 1, deleted: 1, failed: 0 });
+  });
+});
+
+describe('startExpiredFileSweep', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('delegates background sweep startup to the shared package with system context', () => {
+    const options = {
+      appConfig: { paths: { publicPath: '/tmp/public', uploads: '/tmp/uploads' } },
+    };
+
+    const interval = startExpiredFileSweep(options);
+
+    expect(startExpiredFileSweepWithDeps).toHaveBeenCalledWith(
+      options,
+      expect.objectContaining({
+        sweepExpiredFiles: expect.any(Function),
+        runAsSystem: expect.any(Function),
+        logger: expect.objectContaining({
+          error: expect.any(Function),
+          info: expect.any(Function),
+          warn: expect.any(Function),
+        }),
+      }),
+    );
+    expect(interval).toBe('sweep-interval');
+  });
+});
diff --git a/api/server/services/Files/retention.js b/api/server/services/Files/retention.js
new file mode 100644
index 00000000000..e7394e29524
--- /dev/null
+++ b/api/server/services/Files/retention.js
@@ -0,0 +1,43 @@
+const {
+  getRetentionExpiry: getRetentionExpiryWithDeps,
+  getAgentFileRetentionExpiry: getAgentFileRetentionExpiryWithDeps,
+} = require('@librechat/api');
+const { logger, createTempChatExpirationDate } = require('@librechat/data-schemas');
+const db = require('~/models');
+
+const getRetentionDependencies = () => ({
+  getConvo: db.getConvoRetention ?? db.getConvo,
+  createExpirationDate: createTempChatExpirationDate,
+  logger,
+});
+
+/**
+ * Returns `{ expiredAt }` when the request indicates data retention applies, otherwise `{}`.
+ * Spread into file data objects before calling createFile.
+ * @param {ServerRequest} req
+ * @returns {Promise<{ expiredAt?: Date | null }>}
+ */
+async function getRetentionExpiry(req) {
+  return getRetentionExpiryWithDeps(req, getRetentionDependencies());
+}
+
+/**
+ * Returns `{ expiredAt }` for agent file uploads when retention applies, otherwise `{}`.
+ * @param {object} params
+ * @param {ServerRequest} params.req
+ * @param {boolean} [params.messageAttachment]
+ * @param {string} [params.tool_resource]
+ * @param {string} [params.toolResource]
+ * @returns {Promise<{ expiredAt?: Date | null }>}
+ */
+async function getAgentFileRetentionExpiry({ tool_resource, toolResource, ...params }) {
+  return getAgentFileRetentionExpiryWithDeps(
+    { ...params, toolResource: tool_resource ?? toolResource },
+    getRetentionDependencies(),
+  );
+}
+
+module.exports = {
+  getRetentionExpiry,
+  getAgentFileRetentionExpiry,
+};
diff --git a/api/server/services/Files/strategies.js b/api/server/services/Files/strategies.js
index e5acbd6903f..fd5c57bc97c 100644
--- a/api/server/services/Files/strategies.js
+++ b/api/server/services/Files/strategies.js
@@ -72,7 +72,7 @@ const {
   processAzureAvatar,
 } = require('./Azure');
 const { uploadOpenAIFile, deleteOpenAIFile, getOpenAIFileStream } = require('./OpenAI');
-const { getCodeOutputDownloadStream, uploadCodeEnvFile } = require('./Code');
+const { deleteCodeEnvFile, getCodeOutputDownloadStream, uploadCodeEnvFile } = require('./Code');
 const { uploadVectors, deleteVectors } = require('./VectorDB');
 
 /**
@@ -221,8 +221,7 @@ const codeOutputStrategy = () => ({
   handleImageUpload: null,
   /** @type {typeof prepareImagesLocal | null} */
   prepareImagePayload: null,
-  /** @type {typeof deleteLocalFile | null} */
-  deleteFile: null,
+  deleteFile: deleteCodeEnvFile,
   handleFileUpload: uploadCodeEnvFile,
   getDownloadStream: getCodeOutputDownloadStream,
 });
diff --git a/api/server/services/GraphTokenService.js b/api/server/services/GraphTokenService.js
index 843adbe5a2d..5eba0f2d0e3 100644
--- a/api/server/services/GraphTokenService.js
+++ b/api/server/services/GraphTokenService.js
@@ -1,77 +1,19 @@
-const client = require('openid-client');
 const { logger } = require('@librechat/data-schemas');
-const { CacheKeys } = require('librechat-data-provider');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
+const { exchangeOboToken } = require('./OboTokenService');
 
 /**
- * Get Microsoft Graph API token using existing token exchange mechanism
+ * Get Microsoft Graph API token using the On-Behalf-Of flow.
+ * Thin wrapper around the generic OBO exchange for Graph-specific error context.
+ *
  * @param {Object} user - User object with OpenID information
  * @param {string} accessToken - Federated access token used as OBO assertion
  * @param {string} scopes - Graph API scopes for the token
- * @param {boolean} fromCache - Whether to try getting token from cache first
+ * @param {boolean} [fromCache=true] - Whether to try getting token from cache first
  * @returns {Promise<Object>} Graph API token response with access_token and expires_in
  */
 async function getGraphApiToken(user, accessToken, scopes, fromCache = true) {
   try {
-    if (!user.openidId) {
-      throw new Error('User must be authenticated via Entra ID to access Microsoft Graph');
-    }
-
-    if (!accessToken) {
-      throw new Error('Access token is required for token exchange');
-    }
-
-    if (!scopes) {
-      throw new Error('Graph API scopes are required for token exchange');
-    }
-
-    const config = getOpenIdConfig();
-    if (!config) {
-      throw new Error('OpenID configuration not available');
-    }
-
-    const cacheKey = `${user.openidId}:${scopes}`;
-    const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
-
-    if (fromCache) {
-      const cachedToken = await tokensCache.get(cacheKey);
-      if (cachedToken) {
-        logger.debug(`[GraphTokenService] Using cached Graph API token for user: ${user.openidId}`);
-        return cachedToken;
-      }
-    }
-
-    logger.debug(`[GraphTokenService] Requesting new Graph API token for user: ${user.openidId}`);
-    logger.debug(`[GraphTokenService] Requested scopes: ${scopes}`);
-
-    const grantResponse = await client.genericGrantRequest(
-      config,
-      'urn:ietf:params:oauth:grant-type:jwt-bearer',
-      {
-        scope: scopes,
-        assertion: accessToken,
-        requested_token_use: 'on_behalf_of',
-      },
-    );
-
-    const tokenResponse = {
-      access_token: grantResponse.access_token,
-      token_type: 'Bearer',
-      expires_in: grantResponse.expires_in || 3600,
-      scope: scopes,
-    };
-
-    await tokensCache.set(
-      cacheKey,
-      tokenResponse,
-      (grantResponse.expires_in || 3600) * 1000, // Convert to milliseconds
-    );
-
-    logger.debug(
-      `[GraphTokenService] Successfully obtained and cached Graph API token for user: ${user.openidId}`,
-    );
-    return tokenResponse;
+    return await exchangeOboToken(user, accessToken, scopes, fromCache);
   } catch (error) {
     logger.error(
       `[GraphTokenService] Failed to acquire Graph API token for user ${user.openidId}:`,
diff --git a/api/server/services/MCP.js b/api/server/services/MCP.js
index 9d27734d945..46971a416e2 100644
--- a/api/server/services/MCP.js
+++ b/api/server/services/MCP.js
@@ -1,30 +1,46 @@
 const { tool } = require('@librechat/agents/langchain/tools');
 const { logger, getTenantId } = require('@librechat/data-schemas');
-const {
-  Providers,
-  StepTypes,
-  GraphEvents,
-  Constants: AgentConstants,
-} = require('@librechat/agents');
+const { Providers, Constants: AgentConstants } = require('@librechat/agents');
 const {
   sendEvent,
+  PENDING_STALE_MS,
   MCPOAuthHandler,
   isMCPDomainAllowed,
   normalizeServerName,
   normalizeJsonSchema,
   GenerationJobManager,
   resolveJsonSchemaRefs,
-  buildOAuthToolCallName,
+  sanitizeGeminiSchema,
+  buildMCPAuthStepId,
+  buildMCPAuthToolCall,
+  processMCPEnv,
+  buildMCPAuthRunStepEvent,
+  buildMCPAuthRunStepDeltaEvent,
+  buildMCPAuthRunStepEndDeltaEvent,
+  isUserSourced,
+  checkAccessWithRequestCache,
+  requiresEphemeralUserConnection,
+  containsGraphTokenPlaceholder,
 } = require('@librechat/api');
-const { Time, CacheKeys, Constants, isAssistantsEndpoint } = require('librechat-data-provider');
+const {
+  Time,
+  CacheKeys,
+  Constants,
+  Permissions,
+  PermissionTypes,
+  isAssistantsEndpoint,
+} = require('librechat-data-provider');
 const {
   getOAuthReconnectionManager,
   getMCPServersRegistry,
   getFlowStateManager,
   getMCPManager,
 } = require('~/config');
-const { findToken, createToken, updateToken, deleteTokens } = require('~/models');
+const db = require('~/models');
+const { findToken, createToken, updateToken, deleteTokens } = db;
 const { getGraphApiToken } = require('./GraphTokenService');
+const { exchangeOboToken } = require('./OboTokenService');
+const { createOboTrustChecker } = require('./OboPolicyService');
 const { reinitMCPServer } = require('./Tools/mcp');
 const { getAppConfig } = require('./Config');
 const { getLogStores } = require('~/cache');
@@ -36,6 +52,31 @@ const RECONNECT_THROTTLE_MS = 10_000;
 const missingToolCache = new Map();
 const MISSING_TOOL_TTL_MS = 10_000;
 
+async function userCanUseMCPServers(user, req) {
+  if (!user?.id || !user?.role) {
+    return false;
+  }
+
+  try {
+    return await checkAccessWithRequestCache({
+      req,
+      user,
+      permissionType: PermissionTypes.MCP_SERVERS,
+      permissions: [Permissions.USE],
+      getRoleByName: db.getRoleByName,
+    });
+  } catch (error) {
+    logger.error(`[MCP][User: ${user.id}] Failed MCP permission check`, error);
+    return false;
+  }
+}
+
+function createMCPPermissionContext(req) {
+  return {
+    canUseServers: (user = req?.user) => userCanUseMCPServers(user, req),
+  };
+}
+
 function evictStale(map, ttl) {
   if (map.size <= MAX_CACHE_SIZE) {
     return;
@@ -54,6 +95,22 @@ function evictStale(map, ttl) {
 const unavailableMsg =
   "This tool's MCP server is temporarily unavailable. Please try again shortly.";
 
+function getOAuthFlowId(userId, serverName, tenantId = getTenantId()) {
+  if (!tenantId) {
+    return MCPOAuthHandler.generateFlowId(userId, serverName);
+  }
+  return MCPOAuthHandler.generateFlowId(userId, serverName, tenantId);
+}
+
+async function getAppConfigForRequest(req) {
+  const user = req?.user;
+  return await getAppConfigForUser(user?.id, user);
+}
+
+async function getAppConfigForUser(userId, user) {
+  return await getAppConfig({ role: user?.role, tenantId: getTenantId(), userId });
+}
+
 /**
  * Resolves config-source MCP servers from admin Config overrides for the current
  * request context. Returns the parsed configs keyed by server name.
@@ -63,12 +120,7 @@ const unavailableMsg =
 async function resolveConfigServers(req) {
   try {
     const registry = getMCPServersRegistry();
-    const user = req?.user;
-    const appConfig = await getAppConfig({
-      role: user?.role,
-      tenantId: getTenantId(),
-      userId: user?.id,
-    });
+    const appConfig = await getAppConfigForRequest(req);
     return await registry.ensureConfigServers(appConfig?.mcpConfig || {});
   } catch (error) {
     logger.warn(
@@ -79,6 +131,18 @@ async function resolveConfigServers(req) {
   }
 }
 
+/**
+ * Resolves operator-managed MCP server names from admin Config overrides for the current request.
+ * Returns a request-time snapshot for DB server creation, not a cross-process lock.
+ * @throws Propagates app config lookup errors to keep DB server creation fail-closed.
+ * @param {import('express').Request} req - Express request with user context
+ * @returns {Promise<string[]>}
+ */
+async function resolveMcpConfigNames(req) {
+  const appConfig = await getAppConfigForRequest(req);
+  return Object.keys(appConfig?.mcpConfig || {});
+}
+
 /**
  * Resolves config-source servers and merges all server configs (YAML + config + user DB)
  * for the given user context. Shared helper for controllers needing the full merged config.
@@ -88,7 +152,7 @@ async function resolveConfigServers(req) {
  */
 async function resolveAllMcpConfigs(userId, user) {
   const registry = getMCPServersRegistry();
-  const appConfig = await getAppConfig({ role: user?.role, tenantId: getTenantId(), userId });
+  const appConfig = await getAppConfigForUser(userId, user);
   let configServers = {};
   try {
     configServers = await registry.ensureConfigServers(appConfig?.mcpConfig || {});
@@ -98,9 +162,48 @@ async function resolveAllMcpConfigs(userId, user) {
       error,
     );
   }
+  if (user?.role) {
+    return await registry.getAllServerConfigs(userId, configServers, user.role);
+  }
+
   return await registry.getAllServerConfigs(userId, configServers);
 }
 
+function getServerCustomUserVars(userMCPAuthMap, serverName) {
+  return userMCPAuthMap?.[`${Constants.mcp_prefix}${serverName}`];
+}
+
+/**
+ * Best-effort early gate; the authoritative check is
+ * `assertResolvedRuntimeConfigAllowed` in `@librechat/api`, whose resolution
+ * this must mirror. Graph placeholders resolve later (async), so a URL still
+ * carrying one defers to the authoritative check instead of rejecting here.
+ */
+async function isEarlyDomainAllowed({
+  serverConfig,
+  user,
+  requestBody,
+  userMCPAuthMap,
+  serverName,
+  allowedDomains,
+  allowedAddresses,
+}) {
+  const validationConfig = processMCPEnv({
+    user,
+    body: requestBody,
+    dbSourced: isUserSourced(serverConfig),
+    options: serverConfig,
+    customUserVars: getServerCustomUserVars(userMCPAuthMap, serverName),
+  });
+  if (
+    typeof validationConfig?.url === 'string' &&
+    containsGraphTokenPlaceholder(validationConfig.url)
+  ) {
+    return true;
+  }
+  return await isMCPDomainAllowed(validationConfig, allowedDomains, allowedAddresses);
+}
+
 /**
  * @param {string} toolName
  * @param {string} serverName
@@ -145,20 +248,11 @@ function isEmptyObjectSchema(jsonSchema) {
 function createRunStepDeltaEmitter({ res, stepId, toolCall, streamId = null }) {
   /**
    * @param {string} authURL - The URL to redirect the user for OAuth authentication.
+   * @param {{ expiresAt?: number }} [options]
    * @returns {Promise<void>}
    */
-  return async function (authURL) {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall, args: '' }],
-        auth: authURL,
-        expires_at: Date.now() + Time.TWO_MINUTES,
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP_DELTA, data };
+  return async function (authURL, options) {
+    const eventData = buildMCPAuthRunStepDeltaEvent({ authURL, stepId, toolCall, options });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -179,18 +273,7 @@ function createRunStepDeltaEmitter({ res, stepId, toolCall, streamId = null }) {
  */
 function createRunStepEmitter({ res, runId, stepId, toolCall, index, streamId = null }) {
   return async function () {
-    /** @type {import('@librechat/agents').RunStep} */
-    const data = {
-      runId: runId ?? Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
-      id: stepId,
-      type: StepTypes.TOOL_CALLS,
-      index: index ?? 0,
-      stepDetails: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [toolCall],
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP, data };
+    const eventData = buildMCPAuthRunStepEvent({ runId, stepId, toolCall, index });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -204,20 +287,43 @@ function createRunStepEmitter({ res, runId, stepId, toolCall, index, streamId =
  * @param {object} params
  * @param {string} params.flowId - The ID of the login flow.
  * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
- * @param {(authURL: string) => void} [params.callback]
+ * @param {(authURL: string, options?: { expiresAt?: number }) => void | Promise<void>} [params.callback]
  */
 function createOAuthStart({ flowId, flowManager, callback }) {
   /**
    * Creates a function to handle OAuth login requests.
    * @param {string} authURL - The URL to redirect the user for OAuth authentication.
+   * @param {{ expiresAt?: number }} [options]
    * @returns {Promise<boolean>} Returns true to indicate the event was sent successfully.
    */
-  return async function (authURL) {
+  return async function (authURL, options) {
+    let emitted = false;
+    const emitOAuthStart = async (message) => {
+      if (options) {
+        await callback?.(authURL, options);
+      } else {
+        await callback?.(authURL);
+      }
+      emitted = true;
+      logger.debug(message);
+    };
+
+    const existingFlow = await flowManager.getFlowState(flowId, 'oauth_login');
+    if (existingFlow) {
+      await emitOAuthStart('Re-sent OAuth login request to client');
+      return true;
+    }
+
     await flowManager.createFlowWithHandler(flowId, 'oauth_login', async () => {
-      callback?.(authURL);
-      logger.debug('Sent OAuth login request to client');
+      await emitOAuthStart('Sent OAuth login request to client');
       return true;
     });
+
+    if (!emitted) {
+      await emitOAuthStart('Re-sent OAuth login request to client');
+    }
+
+    return true;
   };
 }
 
@@ -230,15 +336,7 @@ function createOAuthStart({ flowId, flowManager, callback }) {
  */
 function createOAuthEnd({ res, stepId, toolCall, streamId = null }) {
   return async function () {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall }],
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP_DELTA, data };
+    const eventData = buildMCPAuthRunStepEndDeltaEvent({ stepId, toolCall });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -253,12 +351,13 @@ function createOAuthEnd({ res, stepId, toolCall, streamId = null }) {
  * @param {string} params.userId - The ID of the user.
  * @param {string} params.serverName - The name of the server.
  * @param {string} params.toolName - The name of the tool.
+ * @param {string} [params.tenantId] - The tenant ID for the current request.
  * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
  */
-function createAbortHandler({ userId, serverName, toolName, flowManager }) {
+function createAbortHandler({ userId, serverName, toolName, tenantId, flowManager }) {
   return function () {
     logger.info(`[MCP][User: ${userId}][${serverName}][${toolName}] Tool call aborted`);
-    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+    const flowId = getOAuthFlowId(userId, serverName, tenantId);
     // Clean up both mcp_oauth and mcp_get_tokens flows
     flowManager.failFlow(flowId, 'mcp_oauth', new Error('Tool call aborted'));
     flowManager.failFlow(flowId, 'mcp_get_tokens', new Error('Tool call aborted'));
@@ -267,14 +366,14 @@ function createAbortHandler({ userId, serverName, toolName, flowManager }) {
 
 /**
  * @param {Object} params
- * @param {() => void} params.runStepEmitter
- * @param {(authURL: string) => void} params.runStepDeltaEmitter
- * @returns {(authURL: string) => void}
+ * @param {() => Promise<void>} params.runStepEmitter
+ * @param {(authURL: string, options?: { expiresAt?: number }) => Promise<void>} params.runStepDeltaEmitter
+ * @returns {(authURL: string, options?: { expiresAt?: number }) => Promise<void>}
  */
 function createOAuthCallback({ runStepEmitter, runStepDeltaEmitter }) {
-  return function (authURL) {
-    runStepEmitter();
-    runStepDeltaEmitter(authURL);
+  return async function (authURL, options) {
+    await runStepEmitter();
+    await runStepDeltaEmitter(authURL, options);
   };
 }
 
@@ -288,6 +387,8 @@ function createOAuthCallback({ runStepEmitter, runStepDeltaEmitter }) {
  * @param {number} [params.index]
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
+ * @param {import('@librechat/api').ParsedServerConfig} [params.serverConfig] - Used to bypass reconnect throttling for request-scoped servers.
  * @returns { Promise<Array<typeof tool | { _call: (toolInput: Object | string) => unknown}>> } An object with `_call` method to execute the tool input.
  */
 async function reconnectServer({
@@ -296,36 +397,44 @@ async function reconnectServer({
   index,
   signal,
   serverName,
+  serverConfig,
   configServers,
   userMCPAuthMap,
+  requestBody,
+  requestScopedConnections,
   streamId = null,
 }) {
   logger.debug(
     `[MCP][reconnectServer] serverName: ${serverName}, user: ${user?.id}, hasUserMCPAuthMap: ${!!userMCPAuthMap}`,
   );
 
-  const throttleKey = `${user.id}:${serverName}`;
-  const now = Date.now();
-  const lastAttempt = lastReconnectAttempts.get(throttleKey) ?? 0;
-  if (now - lastAttempt < RECONNECT_THROTTLE_MS) {
-    logger.debug(`[MCP][reconnectServer] Throttled reconnect for ${serverName}`);
-    return null;
+  // Request-scoped servers reconnect on every message by design; throttling them
+  // would stub out healthy tools for messages sent within the throttle window.
+  const requestScoped = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
+  if (!requestScoped) {
+    const throttleKey = `${user.id}:${serverName}`;
+    const now = Date.now();
+    const lastAttempt = lastReconnectAttempts.get(throttleKey) ?? 0;
+    if (now - lastAttempt < RECONNECT_THROTTLE_MS) {
+      logger.debug(`[MCP][reconnectServer] Throttled reconnect for ${serverName}`);
+      return null;
+    }
+    lastReconnectAttempts.set(throttleKey, now);
+    evictStale(lastReconnectAttempts, RECONNECT_THROTTLE_MS);
   }
-  lastReconnectAttempts.set(throttleKey, now);
-  evictStale(lastReconnectAttempts, RECONNECT_THROTTLE_MS);
 
   const runId = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID;
   const flowId = `${user.id}:${serverName}:${Date.now()}`;
   const flowManager = getFlowStateManager(getLogStores(CacheKeys.FLOWS));
-  const stepId = 'step_oauth_login_' + serverName;
-  const toolCall = {
+  const stepId = buildMCPAuthStepId(serverName);
+  const toolCall = buildMCPAuthToolCall({
     id: flowId,
-    name: buildOAuthToolCallName(serverName),
-    type: 'tool_call_chunk',
-  };
+    serverName,
+  });
 
   // Set up abort handler to clean up OAuth flows if request is aborted
-  const oauthFlowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+  const tenantId = user?.tenantId ?? getTenantId();
+  const oauthFlowId = getOAuthFlowId(user.id, serverName, tenantId);
   const abortHandler = () => {
     logger.info(
       `[MCP][User: ${user.id}][${serverName}] Tool loading aborted, cleaning up OAuth flows`,
@@ -369,6 +478,8 @@ async function reconnectServer({
       oauthStart,
       flowManager,
       userMCPAuthMap,
+      requestBody,
+      requestScopedConnections,
       forceNew: true,
       returnOnOAuth: false,
       connectionTimeout: Time.THIRTY_SECONDS,
@@ -389,6 +500,7 @@ async function reconnectServer({
  *
  * @param {Object} params
  * @param {ServerResponse} params.res - The Express response object for sending events.
+ * @param {{ canUseServers: (user?: IUser) => Promise<boolean> }} [params.mcpPermissionContext] - Request-scoped MCP permission context.
  * @param {IUser} params.user - The user from the request object.
  * @param {string} params.serverName
  * @param {string} params.model
@@ -397,11 +509,14 @@ async function reconnectServer({
  * @param {AbortSignal} [params.signal]
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {import('@librechat/api').ParsedServerConfig} [params.config]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  * @returns { Promise<Array<typeof tool | { _call: (toolInput: Object | string) => unknown}>> } An object with `_call` method to execute the tool input.
  */
 async function createMCPTools({
   res,
+  mcpPermissionContext,
   user,
   index,
   signal,
@@ -410,19 +525,30 @@ async function createMCPTools({
   serverName,
   configServers,
   userMCPAuthMap,
+  requestBody,
+  requestScopedConnections,
   streamId = null,
 }) {
   const serverConfig =
     config ?? (await getMCPServersRegistry().getServerConfig(serverName, user?.id, configServers));
+
   if (serverConfig?.url) {
-    const appConfig = await getAppConfig({ role: user?.role, tenantId: user?.tenantId });
+    const appConfig = await getAppConfig({
+      role: user?.role,
+      tenantId: user?.tenantId,
+      userId: user?.id,
+    });
     const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
     const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
-    const isDomainAllowed = await isMCPDomainAllowed(
+    const isDomainAllowed = await isEarlyDomainAllowed({
       serverConfig,
+      user,
+      requestBody,
+      userMCPAuthMap,
+      serverName,
       allowedDomains,
       allowedAddresses,
-    );
+    });
     if (!isDomainAllowed) {
       logger.warn(`[MCP][${serverName}] Domain not allowed, skipping all tools`);
       return [];
@@ -435,8 +561,11 @@ async function createMCPTools({
     index,
     signal,
     serverName,
+    serverConfig,
     configServers,
     userMCPAuthMap,
+    requestBody,
+    requestScopedConnections,
     streamId,
   });
   if (result === null) {
@@ -452,6 +581,7 @@ async function createMCPTools({
   for (const tool of result.tools) {
     const toolInstance = await createMCPTool({
       res,
+      mcpPermissionContext,
       user,
       provider,
       userMCPAuthMap,
@@ -459,6 +589,8 @@ async function createMCPTools({
       streamId,
       availableTools: result.availableTools,
       toolKey: `${tool.name}${Constants.mcp_delimiter}${serverName}`,
+      requestBody,
+      requestScopedConnections,
       config: serverConfig,
     });
     if (toolInstance) {
@@ -473,6 +605,7 @@ async function createMCPTools({
  * Creates a single tool from the specified MCP Server via `toolKey`.
  * @param {Object} params
  * @param {ServerResponse} params.res - The Express response object for sending events.
+ * @param {{ canUseServers: (user?: IUser) => Promise<boolean> }} [params.mcpPermissionContext] - Request-scoped MCP permission context.
  * @param {IUser} params.user - The user from the request object.
  * @param {string} params.toolKey - The toolKey for the tool.
  * @param {string} params.model - The model for the tool.
@@ -481,12 +614,16 @@ async function createMCPTools({
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {Providers | EModelEndpoint} params.provider - The provider for the tool.
  * @param {LCAvailableTools} [params.availableTools]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  * @param {import('@librechat/api').ParsedServerConfig} [params.config]
+ * @param {(availableTools: LCAvailableTools) => void} [params.onAvailableTools]
  * @returns { Promise<typeof tool | { _call: (toolInput: Object | string) => unknown}> } An object with `_call` method to execute the tool input.
  */
 async function createMCPTool({
   res,
+  mcpPermissionContext,
   user,
   index,
   signal,
@@ -494,23 +631,37 @@ async function createMCPTool({
   provider,
   userMCPAuthMap,
   availableTools,
+  requestBody,
+  requestScopedConnections,
   config,
   configServers,
+  onAvailableTools,
   streamId = null,
 }) {
   const [toolName, serverName] = toolKey.split(Constants.mcp_delimiter);
 
   const serverConfig =
     config ?? (await getMCPServersRegistry().getServerConfig(serverName, user?.id, configServers));
+  const requestScopedTools = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
+  const useMissingToolCache = !requestScopedTools;
+
   if (serverConfig?.url) {
-    const appConfig = await getAppConfig({ role: user?.role, tenantId: user?.tenantId });
+    const appConfig = await getAppConfig({
+      role: user?.role,
+      tenantId: user?.tenantId,
+      userId: user?.id,
+    });
     const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
     const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
-    const isDomainAllowed = await isMCPDomainAllowed(
+    const isDomainAllowed = await isEarlyDomainAllowed({
       serverConfig,
+      user,
+      requestBody,
+      userMCPAuthMap,
+      serverName,
       allowedDomains,
       allowedAddresses,
-    );
+    });
     if (!isDomainAllowed) {
       logger.warn(`[MCP][${serverName}] Domain no longer allowed, skipping tool: ${toolName}`);
       return undefined;
@@ -520,7 +671,7 @@ async function createMCPTool({
   /** @type {LCTool | undefined} */
   let toolDefinition = availableTools?.[toolKey]?.function;
   if (!toolDefinition) {
-    const cachedAt = missingToolCache.get(toolKey);
+    const cachedAt = useMissingToolCache ? missingToolCache.get(toolKey) : undefined;
     if (cachedAt && Date.now() - cachedAt < MISSING_TOOL_TTL_MS) {
       logger.debug(
         `[MCP][${serverName}][${toolName}] Tool in negative cache, returning unavailable stub.`,
@@ -537,13 +688,19 @@ async function createMCPTool({
       index,
       signal,
       serverName,
+      serverConfig,
       configServers,
       userMCPAuthMap,
+      requestBody,
+      requestScopedConnections,
       streamId,
     });
+    if (result?.availableTools) {
+      onAvailableTools?.(result.availableTools);
+    }
     toolDefinition = result?.availableTools?.[toolKey]?.function;
 
-    if (!toolDefinition) {
+    if (!toolDefinition && useMissingToolCache) {
       missingToolCache.set(toolKey, Date.now());
       evictStale(missingToolCache, MISSING_TOOL_TTL_MS);
     }
@@ -558,6 +715,10 @@ async function createMCPTool({
 
   return createToolInstance({
     res,
+    mcpPermissionContext,
+    user,
+    requestBody,
+    requestScopedConnections,
     provider,
     toolName,
     serverName,
@@ -569,6 +730,10 @@ async function createMCPTool({
 
 function createToolInstance({
   res,
+  mcpPermissionContext,
+  user: capturedUser = null,
+  requestBody: capturedRequestBody,
+  requestScopedConnections: capturedRequestScopedConnections,
   toolName,
   serverName,
   serverConfig: capturedServerConfig,
@@ -582,6 +747,12 @@ function createToolInstance({
 
   let schema = parameters ? normalizeJsonSchema(resolveJsonSchemaRefs(parameters)) : null;
 
+  if (schema && isGoogle) {
+    // Gemini/Vertex AI accept only a subset of JSON Schema; sanitize so MCP tools with
+    // unions, non-string enums, etc. don't 400 (they work as-is on OpenAI/Claude).
+    schema = sanitizeGeminiSchema(schema);
+  }
+
   if (!schema || (isGoogle && isEmptyObjectSchema(schema))) {
     schema = {
       type: 'object',
@@ -596,18 +767,26 @@ function createToolInstance({
 
   /** @type {(toolArguments: Object | string, config?: GraphRunnableConfig) => Promise<unknown>} */
   const _call = async (toolArguments, config) => {
-    const userId = config?.configurable?.user?.id || config?.configurable?.user_id;
+    const effectiveUser = config?.configurable?.user ?? capturedUser;
+    const permissionUser = effectiveUser;
+    const userId = effectiveUser?.id || config?.configurable?.user_id || capturedUser?.id;
     /** @type {ReturnType<typeof createAbortHandler>} */
     let abortHandler = null;
     /** @type {AbortSignal} */
     let derivedSignal = null;
 
     try {
+      const provider = (config?.metadata?.provider || capturedProvider)?.toLowerCase();
+      const canUseMCP = mcpPermissionContext
+        ? await mcpPermissionContext.canUseServers(permissionUser)
+        : await userCanUseMCPServers(permissionUser);
+      if (!canUseMCP) {
+        throw new Error('Forbidden: Insufficient MCP server permissions');
+      }
       const flowsCache = getLogStores(CacheKeys.FLOWS);
       const flowManager = getFlowStateManager(flowsCache);
       derivedSignal = config?.signal ? AbortSignal.any([config.signal]) : undefined;
       const mcpManager = getMCPManager(userId);
-      const provider = (config?.metadata?.provider || capturedProvider)?.toLowerCase();
 
       const { args: _args, stepId, ...toolCall } = config.toolCall ?? {};
       const flowId = `${serverName}:oauth_login:${config.metadata.thread_id}:${config.metadata.run_id}`;
@@ -630,7 +809,8 @@ function createToolInstance({
       });
 
       if (derivedSignal) {
-        abortHandler = createAbortHandler({ userId, serverName, toolName, flowManager });
+        const tenantId = config?.configurable?.user?.tenantId ?? getTenantId();
+        abortHandler = createAbortHandler({ userId, serverName, toolName, tenantId, flowManager });
         derivedSignal.addEventListener('abort', abortHandler, { once: true });
       }
 
@@ -646,8 +826,10 @@ function createToolInstance({
         options: {
           signal: derivedSignal,
         },
-        user: config?.configurable?.user,
-        requestBody: config?.configurable?.requestBody,
+        user: effectiveUser,
+        requestBody: config?.configurable?.requestBody ?? capturedRequestBody,
+        requestScopedConnections:
+          config?.configurable?.requestScopedConnections ?? capturedRequestScopedConnections,
         customUserVars,
         flowManager,
         tokenMethods: {
@@ -659,6 +841,8 @@ function createToolInstance({
         oauthStart,
         oauthEnd,
         graphTokenResolver: getGraphApiToken,
+        oboTokenResolver: exchangeOboToken,
+        oboTrustChecker: createOboTrustChecker(),
       });
 
       if (isAssistantsEndpoint(provider) && Array.isArray(result)) {
@@ -703,7 +887,9 @@ function createToolInstance({
   });
   toolInstance.mcp = true;
   toolInstance.mcpRawServerName = serverName;
-  toolInstance.mcpJsonSchema = parameters;
+  // On Google/Vertex, propagate the union-flattened schema so definitions extracted
+  // from this instance don't reach the Gemini converter with unsupported unions.
+  toolInstance.mcpJsonSchema = isGoogle ? schema : parameters;
   return toolInstance;
 }
 
@@ -720,7 +906,9 @@ async function getMCPSetupData(userId, options = {}) {
 
   const appConfig = await getAppConfig({ role, tenantId, userId });
   const configServers = await registry.ensureConfigServers(appConfig?.mcpConfig || {});
-  const mcpConfig = await registry.getAllServerConfigs(userId, configServers);
+  const mcpConfig = role
+    ? await registry.getAllServerConfigs(userId, configServers, role)
+    : await registry.getAllServerConfigs(userId, configServers);
   const mcpManager = getMCPManager(userId);
   /** @type {Map<string, import('@librechat/api').MCPConnection>} */
   let appConnections = new Map();
@@ -751,12 +939,13 @@ async function getMCPSetupData(userId, options = {}) {
  * Check OAuth flow status for a user and server
  * @param {string} userId - The user ID
  * @param {string} serverName - The server name
+ * @param {string} [tenantId] - The tenant ID for the current request.
  * @returns {Object} Object containing hasActiveFlow and hasFailedFlow flags
  */
-async function checkOAuthFlowStatus(userId, serverName) {
+async function checkOAuthFlowStatus(userId, serverName, tenantId = getTenantId()) {
   const flowsCache = getLogStores(CacheKeys.FLOWS);
   const flowManager = getFlowStateManager(flowsCache);
-  const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+  const flowId = getOAuthFlowId(userId, serverName, tenantId);
 
   try {
     const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -765,7 +954,10 @@ async function checkOAuthFlowStatus(userId, serverName) {
     }
 
     const flowAge = Date.now() - flowState.createdAt;
-    const flowTTL = flowState.ttl || 180000; // Default 3 minutes
+    // Report active only while the flow is still usable (the handling/reuse window),
+    // not for the full Keyv retention TTL — otherwise the UI shows "connecting" for a
+    // flow the initiate/callback paths already reject, hiding the connect button.
+    const flowTTL = flowState.ttl || PENDING_STALE_MS;
 
     if (flowState.status === 'FAILED' || flowAge > flowTTL) {
       const wasCancelled = flowState.error && flowState.error.includes('cancelled');
@@ -858,9 +1050,13 @@ async function getServerConnectionStatus(
 module.exports = {
   createMCPTool,
   createMCPTools,
+  createMCPPermissionContext,
+  userCanUseMCPServers,
   getMCPSetupData,
   resolveConfigServers,
+  resolveMcpConfigNames,
   resolveAllMcpConfigs,
+  createOAuthStart,
   checkOAuthFlowStatus,
   getServerConnectionStatus,
   createUnavailableToolStub,
diff --git a/api/server/services/MCP.spec.js b/api/server/services/MCP.spec.js
index 3288aadd906..30fbc6442b8 100644
--- a/api/server/services/MCP.spec.js
+++ b/api/server/services/MCP.spec.js
@@ -1,5 +1,6 @@
 // Mock all dependencies - define mocks before imports
-// Mock all dependencies
+const mockGetTenantId = jest.fn();
+
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
     debug: jest.fn(),
@@ -7,6 +8,7 @@ jest.mock('@librechat/data-schemas', () => ({
     info: jest.fn(),
     warn: jest.fn(),
   },
+  getTenantId: mockGetTenantId,
 }));
 
 // Create mock registry instance
@@ -38,12 +40,14 @@ jest.mock('@librechat/api', () => {
 
 const { logger } = require('@librechat/data-schemas');
 const { MCPOAuthHandler } = require('@librechat/api');
-const { CacheKeys, Constants } = require('librechat-data-provider');
+const { CacheKeys, Constants, Permissions, PermissionTypes } = require('librechat-data-provider');
 const D = Constants.mcp_delimiter;
 const {
   createMCPTool,
   createMCPTools,
+  createMCPPermissionContext,
   getMCPSetupData,
+  createOAuthStart,
   checkOAuthFlowStatus,
   getServerConnectionStatus,
   createUnavailableToolStub,
@@ -71,6 +75,8 @@ jest.mock('~/models', () => ({
   findToken: jest.fn(),
   createToken: jest.fn(),
   updateToken: jest.fn(),
+  deleteTokens: jest.fn(),
+  getRoleByName: jest.fn(),
 }));
 
 jest.mock('./Tools/mcp', () => ({
@@ -90,6 +96,7 @@ describe('tests for the new helper functions used by the MCP connection status e
   beforeEach(() => {
     jest.clearAllMocks();
     jest.spyOn(MCPOAuthHandler, 'generateFlowId');
+    mockGetTenantId.mockReturnValue(undefined);
 
     mockGetMCPManager = require('~/config').getMCPManager;
     mockGetFlowStateManager = require('~/config').getFlowStateManager;
@@ -97,6 +104,85 @@ describe('tests for the new helper functions used by the MCP connection status e
     mockGetOAuthReconnectionManager = require('~/config').getOAuthReconnectionManager;
   });
 
+  describe('createOAuthStart', () => {
+    const flowId = 'test-server:oauth_login:thread-1:run-1';
+    const authUrl = 'https://auth.example.com/oauth?state=test';
+
+    it('should create a login flow and emit the OAuth URL for the first request', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue(null),
+        createFlowWithHandler: jest.fn(async (_flowId, _type, handler) => handler()),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        flowId,
+        'oauth_login',
+        expect.any(Function),
+      );
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Sent OAuth login request to client');
+    });
+
+    it('should replay the OAuth URL when the login flow already exists', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          result: true,
+        }),
+        createFlowWithHandler: jest.fn(),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).not.toHaveBeenCalled();
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Re-sent OAuth login request to client');
+    });
+
+    it('should replay the OAuth URL when flow creation is deduped internally', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue(null),
+        createFlowWithHandler: jest.fn().mockResolvedValue(true),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        flowId,
+        'oauth_login',
+        expect.any(Function),
+      );
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Re-sent OAuth login request to client');
+    });
+  });
+
   describe('getMCPSetupData', () => {
     const mockUserId = 'user-123';
     const mockConfig = {
@@ -246,8 +332,8 @@ describe('tests for the new helper functions used by the MCP connection status e
     it('should detect failed flow when TTL not specified and flow exceeds default TTL', async () => {
       const mockFlowState = {
         status: 'PENDING',
-        createdAt: Date.now() - 200000, // 200 seconds ago (> 180s default TTL)
-        // ttl not specified, should use 180000 default
+        createdAt: Date.now() - 16 * 60 * 1000, // 16 minutes ago (past the PENDING_STALE_MS window)
+        // ttl not specified, should fall back to the PENDING_STALE_MS default
       };
       const mockFlowManager = { getFlowState: jest.fn(() => mockFlowState) };
       mockGetFlowStateManager.mockReturnValue(mockFlowManager);
@@ -277,6 +363,28 @@ describe('tests for the new helper functions used by the MCP connection status e
       );
     });
 
+    it('should check the tenant-scoped OAuth flow when tenant context exists', async () => {
+      mockGetTenantId.mockReturnValue('tenant/a');
+      MCPOAuthHandler.generateFlowId.mockReturnValue('tenant-flow-id');
+      const mockFlowState = {
+        status: 'PENDING',
+        createdAt: Date.now() - 60000,
+        ttl: 180000,
+      };
+      const mockFlowManager = { getFlowState: jest.fn(() => mockFlowState) };
+      mockGetFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const result = await checkOAuthFlowStatus(mockUserId, mockServerName);
+
+      expect(MCPOAuthHandler.generateFlowId).toHaveBeenCalledWith(
+        mockUserId,
+        mockServerName,
+        'tenant/a',
+      );
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith('tenant-flow-id', 'mcp_oauth');
+      expect(result).toEqual({ hasActiveFlow: true, hasFailedFlow: false });
+    });
+
     it('should return false flags for other statuses', async () => {
       const mockFlowState = {
         status: 'COMPLETED',
@@ -660,12 +768,15 @@ describe('tests for the new helper functions used by the MCP connection status e
 
 describe('User parameter passing tests', () => {
   let mockReinitMCPServer;
+  let mockGetMCPManager;
   let mockGetFlowStateManager;
   let mockGetLogStores;
 
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
     mockReinitMCPServer = require('./Tools/mcp').reinitMCPServer;
+    mockGetMCPManager = require('~/config').getMCPManager;
     mockGetFlowStateManager = require('~/config').getFlowStateManager;
     mockGetLogStores = require('~/cache').getLogStores;
 
@@ -726,6 +837,57 @@ describe('User parameter passing tests', () => {
       expect(mockReinitMCPServer.mock.calls[0][0].user).toBe(mockUser);
     });
 
+    it('should fail tenant-scoped OAuth flows when tool loading is aborted', async () => {
+      const mockUser = { id: 'tenant-user', name: 'Tenant User' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const abortController = new AbortController();
+      const mockFlowManager = {
+        createFlowWithHandler: jest.fn(),
+        failFlow: jest.fn(),
+      };
+      mockGetTenantId.mockReturnValue('tenant/a');
+      mockGetFlowStateManager.mockReturnValue(mockFlowManager);
+      MCPOAuthHandler.generateFlowId.mockReturnValue('tenant-flow-id');
+
+      let resolveReinit;
+      mockReinitMCPServer.mockImplementation(
+        () =>
+          new Promise((resolve) => {
+            resolveReinit = resolve;
+          }),
+      );
+
+      const createToolsPromise = createMCPTools({
+        res: mockRes,
+        user: mockUser,
+        serverName: 'tenant-abort-server',
+        provider: 'openai',
+        signal: abortController.signal,
+        userMCPAuthMap: {},
+        config: { type: 'stdio' },
+      });
+
+      abortController.abort();
+      resolveReinit({ tools: [], availableTools: {} });
+      await createToolsPromise;
+
+      expect(MCPOAuthHandler.generateFlowId).toHaveBeenCalledWith(
+        mockUser.id,
+        'tenant-abort-server',
+        'tenant/a',
+      );
+      expect(mockFlowManager.failFlow).toHaveBeenCalledWith(
+        'tenant-flow-id',
+        'mcp_oauth',
+        expect.any(Error),
+      );
+      expect(mockFlowManager.failFlow).toHaveBeenCalledWith(
+        'tenant-flow-id',
+        'mcp_get_tokens',
+        expect.any(Error),
+      );
+    });
+
     it('should throw error if user is not provided', async () => {
       const mockRes = { write: jest.fn(), flush: jest.fn() };
 
@@ -788,6 +950,37 @@ describe('User parameter passing tests', () => {
       expect(mockReinitMCPServer.mock.calls[0][0].user).toBe(mockUser);
     });
 
+    it('should report available tools discovered during single tool reinit', async () => {
+      const mockUser = { id: 'user-discovery-callback', role: 'USER' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const onAvailableTools = jest.fn();
+      const discoveredTools = {
+        [`my-tool${D}my-server`]: {
+          function: { description: 'My Tool', parameters: {} },
+        },
+        [`other-tool${D}my-server`]: {
+          function: { description: 'Other Tool', parameters: {} },
+        },
+      };
+
+      mockReinitMCPServer.mockResolvedValue({
+        availableTools: discoveredTools,
+      });
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        toolKey: `my-tool${D}my-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+        onAvailableTools,
+      });
+
+      expect(result).toBeDefined();
+      expect(onAvailableTools).toHaveBeenCalledWith(discoveredTools);
+    });
+
     it('should not call reinitMCPServer when tool is in cache', async () => {
       const mockUser = { id: 'test-user-789' };
       const mockRes = { write: jest.fn(), flush: jest.fn() };
@@ -813,6 +1006,245 @@ describe('User parameter passing tests', () => {
       // Verify reinitMCPServer was NOT called since tool was in cache
       expect(mockReinitMCPServer).not.toHaveBeenCalled();
     });
+
+    it('should reject tool execution when user lacks MCP server use permission', async () => {
+      const mockUser = { id: 'mcp-denied-user', role: 'USER' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: false,
+          },
+        },
+      });
+
+      const mcpTool = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Cached tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      await expect(
+        mcpTool.invoke(
+          {},
+          {
+            configurable: {
+              user: mockUser,
+            },
+            metadata: {
+              provider: 'openai',
+            },
+            toolCall: {},
+          },
+        ),
+      ).rejects.toThrow(
+        '[MCP][test-server][test-tool] tool call failed: Forbidden: Insufficient MCP server permissions',
+      );
+      expect(mockGetMCPManager).not.toHaveBeenCalled();
+    });
+
+    it('should reuse request-scoped MCP permission checks across tool executions', async () => {
+      const mockUser = { id: 'mcp-allowed-user', role: 'USER' };
+      const mockReq = { user: mockUser };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+          },
+        },
+      });
+
+      const mockCallTool = jest.fn().mockResolvedValue(['ok', null]);
+      mockGetMCPManager.mockReturnValue({
+        callTool: mockCallTool,
+      });
+
+      const availableTools = {
+        [`search${D}test-server`]: {
+          function: {
+            description: 'Search tool',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+        [`fetch${D}test-server`]: {
+          function: {
+            description: 'Fetch tool',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+      const mcpPermissionContext = createMCPPermissionContext(mockReq);
+
+      const searchTool = await createMCPTool({
+        mcpPermissionContext,
+        res: mockRes,
+        user: mockUser,
+        toolKey: `search${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools,
+      });
+      const fetchTool = await createMCPTool({
+        mcpPermissionContext,
+        res: mockRes,
+        user: mockUser,
+        toolKey: `fetch${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools,
+      });
+
+      const invocationConfig = {
+        configurable: {
+          user: mockUser,
+        },
+        metadata: {
+          provider: 'openai',
+          thread_id: 'thread-1',
+          run_id: 'run-1',
+        },
+        toolCall: {},
+      };
+
+      await expect(searchTool.invoke({}, invocationConfig)).resolves.toBe('ok');
+      await expect(fetchTool.invoke({}, invocationConfig)).resolves.toBe('ok');
+
+      expect(getRoleByName).toHaveBeenCalledTimes(1);
+      expect(mockCallTool).toHaveBeenCalledTimes(2);
+    });
+
+    it('should pass the captured user to MCPManager.callTool when invocation config omits configurable.user', async () => {
+      const mockUser = { id: 'captured-user', email: 'captured@example.com', role: 'USER' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+          },
+        },
+      });
+
+      const mockCallTool = jest.fn().mockResolvedValue(['ok', null]);
+      mockGetMCPManager.mockReturnValue({
+        callTool: mockCallTool,
+      });
+
+      const mcpTool = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Cached tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      await expect(
+        mcpTool.invoke(
+          {},
+          {
+            configurable: {
+              user_id: mockUser.id,
+            },
+            metadata: {
+              provider: 'openai',
+              thread_id: 'thread-1',
+              run_id: 'run-1',
+            },
+            toolCall: {},
+          },
+        ),
+      ).resolves.toBe('ok');
+
+      expect(mockCallTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName: 'test-server',
+          toolName: 'test-tool',
+          user: mockUser,
+        }),
+      );
+    });
+
+    it('should pass captured request body when invocation config omits requestBody', async () => {
+      const mockUser = { id: 'captured-body-user', email: 'captured@example.com', role: 'USER' };
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+          },
+        },
+      });
+
+      const mockCallTool = jest.fn().mockResolvedValue(['ok', null]);
+      mockGetMCPManager.mockReturnValue({
+        callTool: mockCallTool,
+      });
+
+      const mcpTool = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        requestBody,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Cached tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      await expect(
+        mcpTool.invoke(
+          {},
+          {
+            configurable: {
+              user: mockUser,
+            },
+            metadata: {
+              provider: 'openai',
+              thread_id: 'thread-1',
+              run_id: 'run-1',
+            },
+            toolCall: {},
+          },
+        ),
+      ).resolves.toBe('ok');
+
+      expect(mockCallTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName: 'test-server',
+          toolName: 'test-tool',
+          requestBody,
+        }),
+      );
+    });
   });
 
   describe('reinitMCPServer (via reconnectServer)', () => {
@@ -922,8 +1354,12 @@ describe('User parameter passing tests', () => {
       // Should not call reinitMCPServer since domain check failed
       expect(mockReinitMCPServer).not.toHaveBeenCalled();
 
-      // Verify getAppConfig was called with user role
-      expect(mockGetAppConfig).toHaveBeenCalledWith({ role: 'user' });
+      // Verify getAppConfig was called with the user scope
+      expect(mockGetAppConfig).toHaveBeenCalledWith({
+        role: 'user',
+        tenantId: undefined,
+        userId: 'domain-test-user',
+      });
 
       // Verify domain validation was called with correct parameters
       expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
@@ -971,8 +1407,56 @@ describe('User parameter passing tests', () => {
       // Should create tool successfully
       expect(result).toBeDefined();
 
-      // Verify getAppConfig was called with user role
-      expect(mockGetAppConfig).toHaveBeenCalledWith({ role: 'admin' });
+      // Verify getAppConfig was called with the user scope
+      expect(mockGetAppConfig).toHaveBeenCalledWith({
+        role: 'admin',
+        tenantId: undefined,
+        userId: 'domain-test-user',
+      });
+    });
+
+    it('should validate the resolved runtime URL for tool creation', async () => {
+      const mockUser = { id: 'runtime-domain-user', role: 'user' };
+      const requestBody = { conversationId: 'tenant-a' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+
+      mockRegistryInstance.getServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/sse',
+        source: 'yaml',
+      });
+
+      mockGetAppConfig.mockResolvedValue({
+        mcpSettings: { allowedDomains: ['*.example.com'] },
+      });
+
+      mockIsMCPDomainAllowed.mockResolvedValueOnce(true);
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        requestBody,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Test tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      expect(result).toBeDefined();
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://tenant-a.example.com/sse',
+        }),
+        ['*.example.com'],
+        undefined,
+      );
     });
 
     it('should skip domain validation for stdio transports (no URL)', async () => {
@@ -1047,8 +1531,12 @@ describe('User parameter passing tests', () => {
       // Should not call reinitMCPServer since domain check failed early
       expect(mockReinitMCPServer).not.toHaveBeenCalled();
 
-      // Verify getAppConfig was called with user role
-      expect(mockGetAppConfig).toHaveBeenCalledWith({ role: 'user' });
+      // Verify getAppConfig was called with the user scope
+      expect(mockGetAppConfig).toHaveBeenCalledWith({
+        role: 'user',
+        tenantId: undefined,
+        userId: 'domain-test-user',
+      });
     });
 
     it('should use user role when fetching domain restrictions', async () => {
@@ -1100,9 +1588,17 @@ describe('User parameter passing tests', () => {
         availableTools,
       });
 
-      // Verify getAppConfig was called with correct roles
-      expect(mockGetAppConfig).toHaveBeenNthCalledWith(1, { role: 'admin' });
-      expect(mockGetAppConfig).toHaveBeenNthCalledWith(2, { role: 'user' });
+      // Verify getAppConfig was called with the correct user scopes
+      expect(mockGetAppConfig).toHaveBeenNthCalledWith(1, {
+        role: 'admin',
+        tenantId: undefined,
+        userId: 'admin-user',
+      });
+      expect(mockGetAppConfig).toHaveBeenNthCalledWith(2, {
+        role: 'user',
+        tenantId: undefined,
+        userId: 'regular-user',
+      });
     });
   });
 
@@ -1246,6 +1742,56 @@ describe('User parameter passing tests', () => {
       // Still only 1 real reconnect — user B was protected by the cache
       expect(mockReinitMCPServer).toHaveBeenCalledTimes(1);
     });
+
+    it('should bypass the negative cache for request-scoped tools', async () => {
+      const userA = { id: 'request-scoped-user-A' };
+      const userB = { id: 'request-scoped-user-B' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const serverName = 'request-scoped-server';
+      const toolKey = `tenant-tool${D}${serverName}`;
+
+      mockRegistryInstance.getServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://api.example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+
+      mockReinitMCPServer
+        .mockResolvedValueOnce({
+          availableTools: {},
+        })
+        .mockResolvedValueOnce({
+          availableTools: {
+            [toolKey]: {
+              function: { description: 'Tenant tool', parameters: {} },
+            },
+          },
+        });
+
+      await createMCPTool({
+        res: mockRes,
+        user: userA,
+        requestBody: { messageId: 'message-a' },
+        toolKey,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+      });
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: userB,
+        requestBody: { messageId: 'message-b' },
+        toolKey,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+      });
+
+      expect(result).toBeDefined();
+      expect(result.name).toContain('tenant-tool');
+      expect(mockReinitMCPServer).toHaveBeenCalledTimes(2);
+    });
   });
 
   describe('createMCPTools throttle handling', () => {
diff --git a/api/server/services/MCPRequestContext.js b/api/server/services/MCPRequestContext.js
new file mode 100644
index 00000000000..50a9c90a61e
--- /dev/null
+++ b/api/server/services/MCPRequestContext.js
@@ -0,0 +1,13 @@
+const {
+  cleanupMCPRequestContextForReq,
+  cleanupMCPRequestContext,
+  createMCPRequestContext,
+  getMCPRequestContext,
+} = require('@librechat/api');
+
+module.exports = {
+  cleanupMCPRequestContextForReq,
+  cleanupMCPRequestContext,
+  createMCPRequestContext,
+  getMCPRequestContext,
+};
diff --git a/api/server/services/OboPolicyService.js b/api/server/services/OboPolicyService.js
new file mode 100644
index 00000000000..99949a2701d
--- /dev/null
+++ b/api/server/services/OboPolicyService.js
@@ -0,0 +1,43 @@
+const { isOboConfigStillTrusted } = require('@librechat/api');
+const db = require('~/models');
+
+/**
+ * Checks whether a parsed MCP server config is DB-sourced (user-created) using
+ * the same `isUserSourced` heuristics as the rest of the MCP layer: an explicit
+ * `source` is authoritative when present; otherwise `dbId` presence is used.
+ */
+function isDbSourced({ source, dbId }) {
+  if (source != null) {
+    return source === 'user';
+  }
+  return !!dbId;
+}
+
+/**
+ * Builds the predicate the MCP runtime calls before performing an OBO token exchange.
+ *
+ * YAML/Config-sourced configs (admin-defined) bypass the check — admins are
+ * already trusted at the deployment level. DB-sourced configs (created via the
+ * UI) are gated on the original author still holding `MCP_SERVERS.CONFIGURE_OBO`,
+ * so retained configs fail closed when an author's role is downgraded.
+ */
+function createOboTrustChecker() {
+  return async ({ source, author, dbId }) => {
+    if (!isDbSourced({ source, dbId })) {
+      return true;
+    }
+    return isOboConfigStillTrusted({
+      authorId: author,
+      getUserRoleByAuthorId: async (userId) => {
+        const user = await db.findUser({ _id: userId }, 'role');
+        return user?.role;
+      },
+      getRolePermissions: async (roleName) => {
+        const role = await db.getRoleByName(roleName);
+        return role?.permissions;
+      },
+    });
+  };
+}
+
+module.exports = { createOboTrustChecker };
diff --git a/api/server/services/OboTokenService.js b/api/server/services/OboTokenService.js
new file mode 100644
index 00000000000..be269be9934
--- /dev/null
+++ b/api/server/services/OboTokenService.js
@@ -0,0 +1,194 @@
+const client = require('openid-client');
+const { logger } = require('@librechat/data-schemas');
+const { CacheKeys } = require('librechat-data-provider');
+const { getOpenIdConfig } = require('~/strategies/openidStrategy');
+const getLogStores = require('~/cache/getLogStores');
+
+const RETRYABLE_STATUS_CODES = new Set([429, 500, 502, 503, 504]);
+const RETRYABLE_ERROR_CODES = new Set(['ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN', 'ENOTFOUND']);
+const OBO_RETRY_DELAY_MS = 300;
+
+/**
+ * In-flight OBO exchanges keyed by `${openidId}:${scopes}`.
+ *
+ * Without coalescing, parallel tool calls that arrive on a cache miss each issue
+ * their own jwt-bearer request to the IdP. Under fan-out, Entra intermittently
+ * returns errors that look non-retryable, surfacing as "identity provider
+ * rejected the OBO token exchange." A user retry then hits the populated cache
+ * and succeeds, which matches the observed flakiness. Sharing a single upstream
+ * exchange per key removes the thundering herd.
+ */
+const inFlightExchanges = new Map();
+
+function getErrorStatus(error) {
+  return error?.status ?? error?.statusCode ?? error?.response?.status;
+}
+
+function getErrorCode(error) {
+  return typeof error?.code === 'string' ? error.code.toUpperCase() : undefined;
+}
+
+function isRetryableOboExchangeError(error) {
+  const status = getErrorStatus(error);
+  if (status != null && RETRYABLE_STATUS_CODES.has(status)) {
+    return true;
+  }
+
+  const code = getErrorCode(error);
+  if (code != null && RETRYABLE_ERROR_CODES.has(code)) {
+    return true;
+  }
+
+  const message = String(error?.message ?? '').toLowerCase();
+  return (
+    message.includes('timed out') ||
+    message.includes('timeout') ||
+    message.includes('econnreset') ||
+    message.includes('socket hang up') ||
+    message.includes('temporarily unavailable') ||
+    message.includes('too many requests') ||
+    message.includes('service unavailable')
+  );
+}
+
+function tagOboExchangeError(error, retryable) {
+  if (error && typeof error === 'object') {
+    error.retryable = retryable;
+    error.oboFailureReason = 'exchange_failed';
+  }
+  return error;
+}
+
+async function delay(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function performOboExchange({ user, accessToken, scopes, config, tokensCache, cacheKey }) {
+  const requestGrant = async () =>
+    client.genericGrantRequest(config, 'urn:ietf:params:oauth:grant-type:jwt-bearer', {
+      scope: scopes,
+      assertion: accessToken,
+      requested_token_use: 'on_behalf_of',
+    });
+
+  let grantResponse;
+  try {
+    grantResponse = await requestGrant();
+  } catch (error) {
+    const retryable = isRetryableOboExchangeError(error);
+    if (!retryable) {
+      throw tagOboExchangeError(error, false);
+    }
+
+    logger.warn(
+      `[OboTokenService] Transient OBO exchange failure for user: ${user.openidId}, retrying once`,
+      error,
+    );
+    await delay(OBO_RETRY_DELAY_MS);
+
+    try {
+      grantResponse = await requestGrant();
+    } catch (retryError) {
+      throw tagOboExchangeError(retryError, isRetryableOboExchangeError(retryError));
+    }
+  }
+
+  const tokenResponse = {
+    access_token: grantResponse.access_token,
+    token_type: 'Bearer',
+    expires_in: grantResponse.expires_in || 3600,
+    scope: scopes,
+  };
+
+  await tokensCache.set(cacheKey, tokenResponse, (grantResponse.expires_in || 3600) * 1000);
+
+  logger.debug(
+    `[OboTokenService] Successfully obtained and cached OBO token for user: ${user.openidId}`,
+  );
+  return tokenResponse;
+}
+
+/**
+ * Exchange a user's access token for a downstream-scoped token via the
+ * OAuth 2.0 On-Behalf-Of (jwt-bearer) grant.
+ *
+ * Concurrent callers for the same `${openidId}:${scopes}` key share a single
+ * upstream exchange (see `inFlightExchanges`) so a fan-out of tool calls right
+ * after a cache miss does not produce N parallel requests to the IdP.
+ *
+ * @param {Object} user - User object with OpenID information
+ * @param {string} accessToken - Federated access token used as OBO assertion
+ * @param {string} scopes - Scopes to request for the downstream service
+ * @param {boolean} [fromCache=true] - When true, read from cache and join any
+ *   in-flight exchange. When false, bypass both and force a fresh exchange.
+ * @returns {Promise<Object>} Token response with access_token and expires_in
+ */
+async function exchangeOboToken(user, accessToken, scopes, fromCache = true) {
+  if (!user.openidId) {
+    throw new Error('User must be authenticated via OpenID to perform OBO token exchange');
+  }
+
+  if (!accessToken) {
+    throw new Error('Access token is required for OBO exchange');
+  }
+
+  if (!scopes) {
+    throw new Error('Scopes are required for OBO exchange');
+  }
+
+  const config = getOpenIdConfig();
+  if (!config) {
+    throw new Error('OpenID configuration not available');
+  }
+
+  const cacheKey = `${user.openidId}:${scopes}`;
+  const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
+
+  if (fromCache) {
+    const cachedToken = await tokensCache.get(cacheKey);
+    if (cachedToken) {
+      logger.debug(`[OboTokenService] Using cached token for user: ${user.openidId}`);
+      return cachedToken;
+    }
+
+    const inFlight = inFlightExchanges.get(cacheKey);
+    if (inFlight) {
+      logger.debug(`[OboTokenService] Joining in-flight OBO exchange for user: ${user.openidId}`);
+      return inFlight;
+    }
+  }
+
+  logger.debug(
+    `[OboTokenService] Requesting new OBO token for user: ${user.openidId}, scopes: ${scopes}`,
+  );
+
+  const exchangePromise = performOboExchange({
+    user,
+    accessToken,
+    scopes,
+    config,
+    tokensCache,
+    cacheKey,
+  });
+
+  if (fromCache) {
+    inFlightExchanges.set(cacheKey, exchangePromise);
+    exchangePromise
+      .finally(() => {
+        if (inFlightExchanges.get(cacheKey) === exchangePromise) {
+          inFlightExchanges.delete(cacheKey);
+        }
+      })
+      .catch(() => {
+        /* The original rejection is delivered to the awaiting caller; this
+         * chain exists only to run cleanup, so swallow it here to avoid an
+         * unhandled-rejection warning on the cleanup promise. */
+      });
+  }
+
+  return exchangePromise;
+}
+
+module.exports = {
+  exchangeOboToken,
+};
diff --git a/api/server/services/OboTokenService.spec.js b/api/server/services/OboTokenService.spec.js
new file mode 100644
index 00000000000..122ddee4b21
--- /dev/null
+++ b/api/server/services/OboTokenService.spec.js
@@ -0,0 +1,342 @@
+jest.mock('~/strategies/openidStrategy');
+jest.mock('~/cache/getLogStores');
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: {
+    error: jest.fn(),
+    debug: jest.fn(),
+    warn: jest.fn(),
+  },
+}));
+
+const client = require('openid-client');
+const { getOpenIdConfig } = require('~/strategies/openidStrategy');
+const getLogStores = require('~/cache/getLogStores');
+const { exchangeOboToken } = require('./OboTokenService');
+
+describe('OboTokenService', () => {
+  let mockTokensCache;
+  let mockOpenIdConfig;
+
+  const mockUser = {
+    openidId: 'oidc-sub-123',
+    email: 'test@example.com',
+    name: 'Test User',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    mockTokensCache = {
+      get: jest.fn().mockResolvedValue(null),
+      set: jest.fn().mockResolvedValue(undefined),
+    };
+    getLogStores.mockReturnValue(mockTokensCache);
+
+    mockOpenIdConfig = {
+      client_id: 'test-client-id',
+      issuer: 'https://login.microsoftonline.com/tenant-id/v2.0',
+    };
+    getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
+
+    client.genericGrantRequest.mockResolvedValue({
+      access_token: 'exchanged-obo-token',
+      expires_in: 3600,
+    });
+  });
+
+  describe('input validation', () => {
+    it('should throw when user has no openidId', async () => {
+      await expect(
+        exchangeOboToken({ email: 'test@example.com' }, 'access-token', 'api://scope'),
+      ).rejects.toThrow('User must be authenticated via OpenID to perform OBO token exchange');
+    });
+
+    it('should throw when accessToken is missing', async () => {
+      await expect(exchangeOboToken(mockUser, '', 'api://scope')).rejects.toThrow(
+        'Access token is required for OBO exchange',
+      );
+    });
+
+    it('should throw when scopes are missing', async () => {
+      await expect(exchangeOboToken(mockUser, 'access-token', '')).rejects.toThrow(
+        'Scopes are required for OBO exchange',
+      );
+    });
+
+    it('should throw when OpenID config is not available', async () => {
+      getOpenIdConfig.mockReturnValue(null);
+
+      await expect(exchangeOboToken(mockUser, 'access-token', 'api://scope')).rejects.toThrow(
+        'OpenID configuration not available',
+      );
+    });
+  });
+
+  describe('cache behavior', () => {
+    it('should return cached token when fromCache is true and cache hit', async () => {
+      const cachedToken = {
+        access_token: 'cached-obo-token',
+        token_type: 'Bearer',
+        expires_in: 1800,
+        scope: 'api://mcp-server/Scope.Read',
+      };
+      mockTokensCache.get.mockResolvedValue(cachedToken);
+
+      const result = await exchangeOboToken(
+        mockUser,
+        'access-token',
+        'api://mcp-server/Scope.Read',
+        true,
+      );
+
+      expect(result).toBe(cachedToken);
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-123:api://mcp-server/Scope.Read');
+      expect(client.genericGrantRequest).not.toHaveBeenCalled();
+    });
+
+    it('should skip cache when fromCache is false', async () => {
+      const cachedToken = { access_token: 'cached-obo-token' };
+      mockTokensCache.get.mockResolvedValue(cachedToken);
+
+      const result = await exchangeOboToken(
+        mockUser,
+        'access-token',
+        'api://mcp-server/Scope.Read',
+        false,
+      );
+
+      expect(mockTokensCache.get).not.toHaveBeenCalled();
+      expect(client.genericGrantRequest).toHaveBeenCalled();
+      expect(result.access_token).toBe('exchanged-obo-token');
+    });
+
+    it('should default fromCache to true', async () => {
+      mockTokensCache.get.mockResolvedValue(null);
+
+      await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-123:api://scope');
+    });
+  });
+
+  describe('OBO token exchange', () => {
+    it('should call genericGrantRequest with jwt-bearer grant type', async () => {
+      await exchangeOboToken(mockUser, 'user-access-token', 'api://mcp-server/Tools.ReadWrite');
+
+      expect(client.genericGrantRequest).toHaveBeenCalledWith(
+        mockOpenIdConfig,
+        'urn:ietf:params:oauth:grant-type:jwt-bearer',
+        {
+          scope: 'api://mcp-server/Tools.ReadWrite',
+          assertion: 'user-access-token',
+          requested_token_use: 'on_behalf_of',
+        },
+      );
+    });
+
+    it('should return token response with correct structure', async () => {
+      const result = await exchangeOboToken(
+        mockUser,
+        'access-token',
+        'api://mcp-server/Tools.ReadWrite',
+      );
+
+      expect(result).toEqual({
+        access_token: 'exchanged-obo-token',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        scope: 'api://mcp-server/Tools.ReadWrite',
+      });
+    });
+
+    it('should cache the exchanged token with correct TTL', async () => {
+      client.genericGrantRequest.mockResolvedValue({
+        access_token: 'new-obo-token',
+        expires_in: 1800,
+      });
+
+      await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+
+      expect(mockTokensCache.set).toHaveBeenCalledWith(
+        'oidc-sub-123:api://scope',
+        {
+          access_token: 'new-obo-token',
+          token_type: 'Bearer',
+          expires_in: 1800,
+          scope: 'api://scope',
+        },
+        1800 * 1000,
+      );
+    });
+
+    it('should default expires_in to 3600 when not in response', async () => {
+      client.genericGrantRequest.mockResolvedValue({
+        access_token: 'no-expiry-token',
+      });
+
+      const result = await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+
+      expect(result.expires_in).toBe(3600);
+      expect(mockTokensCache.set).toHaveBeenCalledWith(
+        'oidc-sub-123:api://scope',
+        expect.objectContaining({ expires_in: 3600 }),
+        3600 * 1000,
+      );
+    });
+
+    it('should propagate errors from genericGrantRequest', async () => {
+      client.genericGrantRequest.mockRejectedValue(
+        new Error('invalid_grant: AADSTS50013: Assertion failed signature validation'),
+      );
+
+      await expect(exchangeOboToken(mockUser, 'bad-token', 'api://scope')).rejects.toThrow(
+        'invalid_grant: AADSTS50013: Assertion failed signature validation',
+      );
+    });
+
+    it('should retry once for transient Entra failures and succeed on the second attempt', async () => {
+      const transientError = Object.assign(new Error('Service unavailable'), { status: 503 });
+      const setTimeoutSpy = jest.spyOn(global, 'setTimeout').mockImplementation((callback) => {
+        callback();
+        return 0;
+      });
+
+      try {
+        client.genericGrantRequest.mockRejectedValueOnce(transientError).mockResolvedValueOnce({
+          access_token: 'retried-obo-token',
+          expires_in: 1800,
+        });
+
+        const result = await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+
+        expect(client.genericGrantRequest).toHaveBeenCalledTimes(2);
+        expect(result).toEqual({
+          access_token: 'retried-obo-token',
+          token_type: 'Bearer',
+          expires_in: 1800,
+          scope: 'api://scope',
+        });
+      } finally {
+        setTimeoutSpy.mockRestore();
+      }
+    });
+
+    it('should not retry permanent OBO exchange failures', async () => {
+      const permanentError = new Error(
+        'invalid_grant: AADSTS50013: Assertion failed signature validation',
+      );
+      client.genericGrantRequest.mockRejectedValue(permanentError);
+
+      await expect(exchangeOboToken(mockUser, 'bad-token', 'api://scope')).rejects.toThrow(
+        'invalid_grant: AADSTS50013: Assertion failed signature validation',
+      );
+
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('cache key isolation', () => {
+    it('should use different cache keys for different scopes', async () => {
+      await exchangeOboToken(mockUser, 'access-token', 'api://server-a/Scope.A');
+      await exchangeOboToken(mockUser, 'access-token', 'api://server-b/Scope.B');
+
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-123:api://server-a/Scope.A');
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-123:api://server-b/Scope.B');
+    });
+
+    it('should use different cache keys for different users', async () => {
+      const otherUser = { openidId: 'oidc-sub-456', email: 'other@example.com' };
+
+      await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+      await exchangeOboToken(otherUser, 'access-token', 'api://scope');
+
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-123:api://scope');
+      expect(mockTokensCache.get).toHaveBeenCalledWith('oidc-sub-456:api://scope');
+    });
+  });
+
+  describe('single-flight coalescing', () => {
+    /** Yields long enough for both pending callers to advance past their cache lookup. */
+    const flushMicrotasks = () => new Promise((resolve) => setImmediate(resolve));
+
+    it('coalesces concurrent exchanges for the same key into one IdP call', async () => {
+      let resolveGrant;
+      client.genericGrantRequest.mockReturnValueOnce(
+        new Promise((resolve) => {
+          resolveGrant = resolve;
+        }),
+      );
+
+      const callA = exchangeOboToken(mockUser, 'access-token', 'api://shared');
+      const callB = exchangeOboToken(mockUser, 'access-token', 'api://shared');
+
+      await flushMicrotasks();
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(1);
+
+      resolveGrant({ access_token: 'shared-obo-token', expires_in: 3600 });
+
+      const [resultA, resultB] = await Promise.all([callA, callB]);
+      expect(resultA).toEqual(resultB);
+      expect(resultA.access_token).toBe('shared-obo-token');
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(1);
+      expect(mockTokensCache.set).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not coalesce exchanges for different keys', async () => {
+      await Promise.all([
+        exchangeOboToken(mockUser, 'access-token', 'api://scope-a'),
+        exchangeOboToken(mockUser, 'access-token', 'api://scope-b'),
+      ]);
+
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(2);
+    });
+
+    it('clears the in-flight slot after a successful exchange', async () => {
+      await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(1);
+
+      await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(2);
+    });
+
+    it('clears the in-flight slot after a failed exchange', async () => {
+      client.genericGrantRequest
+        .mockRejectedValueOnce(
+          new Error('invalid_grant: AADSTS50013: Assertion failed signature validation'),
+        )
+        .mockResolvedValueOnce({ access_token: 'fresh-token', expires_in: 3600 });
+
+      await expect(exchangeOboToken(mockUser, 'access-token', 'api://scope')).rejects.toThrow(
+        'invalid_grant',
+      );
+
+      const result = await exchangeOboToken(mockUser, 'access-token', 'api://scope');
+      expect(result.access_token).toBe('fresh-token');
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(2);
+    });
+
+    it('bypasses in-flight coalescing when fromCache is false', async () => {
+      let resolveFirst;
+      client.genericGrantRequest
+        .mockReturnValueOnce(
+          new Promise((resolve) => {
+            resolveFirst = resolve;
+          }),
+        )
+        .mockResolvedValueOnce({ access_token: 'forced-fresh-token', expires_in: 3600 });
+
+      const callA = exchangeOboToken(mockUser, 'access-token', 'api://scope', true);
+      await flushMicrotasks();
+
+      const callB = exchangeOboToken(mockUser, 'access-token', 'api://scope', false);
+      expect(client.genericGrantRequest).toHaveBeenCalledTimes(2);
+
+      resolveFirst({ access_token: 'in-flight-token', expires_in: 3600 });
+
+      const [resultA, resultB] = await Promise.all([callA, callB]);
+      expect(resultA.access_token).toBe('in-flight-token');
+      expect(resultB.access_token).toBe('forced-fresh-token');
+    });
+  });
+});
diff --git a/api/server/services/PermissionService.js b/api/server/services/PermissionService.js
index 4d6d437842c..491dce8c51b 100644
--- a/api/server/services/PermissionService.js
+++ b/api/server/services/PermissionService.js
@@ -26,6 +26,22 @@ const validateResourceType = (resourceType) => {
   }
 };
 
+const ensureLocalUserPrincipalExists = async (principalId) => {
+  const user = await db.findUser({ _id: principalId }, '_id');
+  if (!user) {
+    throw new Error('User principal not found');
+  }
+  return user._id.toString();
+};
+
+const ensureLocalGroupPrincipalExists = async (principalId) => {
+  const group = await db.findGroupById(principalId, { _id: 1 });
+  if (!group) {
+    throw new Error('Group principal not found');
+  }
+  return group._id.toString();
+};
+
 /**
  * @import { TPrincipal } from 'librechat-data-provider'
  */
@@ -299,8 +315,8 @@ const ensurePrincipalExists = async function (principal) {
     return null;
   }
 
-  if (principal.id) {
-    return principal.id;
+  if (principal.type === PrincipalType.USER && principal.id) {
+    return await ensureLocalUserPrincipalExists(principal.id);
   }
 
   if (principal.type === PrincipalType.USER && principal.source === 'entra') {
@@ -365,6 +381,10 @@ const ensureGroupPrincipalExists = async function (principal, authContext = null
     throw new Error(`Invalid principal type: ${principal.type}. Expected '${PrincipalType.GROUP}'`);
   }
 
+  if (principal.id && principal.source !== 'entra') {
+    return await ensureLocalGroupPrincipalExists(principal.id);
+  }
+
   if (principal.source === 'entra') {
     if (!principal.name || !principal.idOnTheSource) {
       throw new Error('Entra ID group principals must have name and idOnTheSource');
diff --git a/api/server/services/PermissionService.spec.js b/api/server/services/PermissionService.spec.js
index e214d8ac496..ec63f63192d 100644
--- a/api/server/services/PermissionService.spec.js
+++ b/api/server/services/PermissionService.spec.js
@@ -1,5 +1,5 @@
 const mongoose = require('mongoose');
-const { RoleBits, createModels } = require('@librechat/data-schemas');
+const { RoleBits, createModels, tenantStorage } = require('@librechat/data-schemas');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 const {
   ResourceType,
@@ -15,6 +15,8 @@ const {
   getAvailableRoles,
   grantPermission,
   checkPermission,
+  ensurePrincipalExists,
+  ensureGroupPrincipalExists,
 } = require('./PermissionService');
 const { findRoleByIdentifier, getUserPrincipals, seedDefaultRoles } = require('~/models');
 
@@ -44,6 +46,8 @@ jest.mock('~/config', () => ({
 
 let mongoServer;
 let AclEntry;
+let User;
+let Group;
 
 beforeAll(async () => {
   mongoServer = await MongoMemoryServer.create();
@@ -58,6 +62,8 @@ beforeAll(async () => {
   Object.assign(mongoose.models, dbModels);
 
   AclEntry = dbModels.AclEntry;
+  User = dbModels.User;
+  Group = dbModels.Group;
 
   // Seed default roles
   await seedDefaultRoles();
@@ -243,6 +249,69 @@ describe('PermissionService', () => {
     });
   });
 
+  describe('principal validation for ACL writes', () => {
+    beforeEach(async () => {
+      await User.deleteMany({ email: /acl-principal/i });
+      await Group.deleteMany({ name: /ACL Principal/i });
+    });
+
+    test('rejects a local user id outside the current request context', async () => {
+      const outsideUser = await User.create({
+        name: 'ACL Principal Outside User',
+        email: 'acl-principal-outside-user@example.com',
+        tenantId: 'tenant-b',
+      });
+
+      await expect(
+        tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          ensurePrincipalExists({
+            type: PrincipalType.USER,
+            id: outsideUser._id.toString(),
+            name: 'Outside User',
+            source: 'local',
+          }),
+        ),
+      ).rejects.toThrow('User principal not found');
+    });
+
+    test('accepts a local user id in the current request context', async () => {
+      const currentUser = await User.create({
+        name: 'ACL Principal Current User',
+        email: 'acl-principal-current-user@example.com',
+        tenantId: 'tenant-a',
+      });
+
+      const principalId = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+        ensurePrincipalExists({
+          type: PrincipalType.USER,
+          id: currentUser._id.toString(),
+          name: 'Current User',
+          source: 'local',
+        }),
+      );
+
+      expect(principalId).toBe(currentUser._id.toString());
+    });
+
+    test('rejects a local group id outside the current request context', async () => {
+      const outsideGroup = await Group.create({
+        name: 'ACL Principal Outside Group',
+        tenantId: 'tenant-b',
+      });
+
+      await expect(
+        tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          ensureGroupPrincipalExists({
+            type: PrincipalType.GROUP,
+            id: outsideGroup._id.toString(),
+            name: 'Outside Group',
+            source: 'local',
+          }),
+        ),
+      ).rejects.toThrow('Group principal not found');
+    });
+  });
+
   describe('checkPermission', () => {
     let otherResourceId;
 
diff --git a/api/server/services/Skills/sync.js b/api/server/services/Skills/sync.js
new file mode 100644
index 00000000000..f19005639f1
--- /dev/null
+++ b/api/server/services/Skills/sync.js
@@ -0,0 +1,215 @@
+const { FileContext } = require('librechat-data-provider');
+const {
+  getStorageMetadata,
+  createGitHubSkillSyncRunner,
+  createSkillSyncTriggerOrchestrator,
+  startGitHubSkillSyncScheduler,
+} = require('@librechat/api');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
+const db = require('~/models');
+const { getAppConfig } = require('~/server/services/Config');
+const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { getFileStrategy } = require('~/server/utils/getFileStrategy');
+
+const SYSTEM_USER_ID = '000000000000000000000000';
+
+let appConfigRef;
+let runner;
+let scheduler;
+
+async function loadCurrentAppConfig() {
+  try {
+    const appConfig = await getAppConfig({ baseOnly: true });
+    appConfigRef = appConfig;
+    return appConfig;
+  } catch (error) {
+    if (appConfigRef) {
+      return appConfigRef;
+    }
+    throw error;
+  }
+}
+
+async function getSyncConfig(loadAppConfig = loadCurrentAppConfig) {
+  const appConfig = await loadAppConfig();
+  return appConfig?.skillSync;
+}
+
+async function resolveSkillStorage({ isImage = false, loadAppConfig = loadCurrentAppConfig } = {}) {
+  const appConfig = await loadAppConfig();
+  const source = getFileStrategy(appConfig, { context: FileContext.skill_file, isImage });
+  const strategy = getStrategyFunctions(source);
+  if (!strategy.saveBuffer) {
+    throw new Error(`Storage backend "${source}" does not support file writes`);
+  }
+  return { source, saveBuffer: strategy.saveBuffer };
+}
+
+async function getSyntheticReq({ userId = SYSTEM_USER_ID, tenantId, loadAppConfig } = {}) {
+  const appConfig = await (loadAppConfig ?? loadCurrentAppConfig)();
+  return {
+    config: appConfig,
+    user: {
+      id: userId,
+      _id: userId,
+      tenantId,
+    },
+  };
+}
+
+function withBaseSkillSyncConfig(req, baseConfig) {
+  if (!req?.config || req.config.config?.skillSync !== undefined) {
+    return req;
+  }
+  return {
+    ...req,
+    config: {
+      ...req.config,
+      config: {
+        ...(req.config.config ?? {}),
+        skillSync: baseConfig?.skillSync,
+      },
+    },
+  };
+}
+
+function createRunner({ getConfig, loadAppConfig, allowServerCredentials = true } = {}) {
+  const resolveAppConfig = loadAppConfig ?? loadCurrentAppConfig;
+  const resolveConfig = getConfig ?? (() => getSyncConfig(resolveAppConfig));
+  const createdRunner = createGitHubSkillSyncRunner({
+    getConfig: resolveConfig,
+    getCredentialToken: db.getSkillSyncCredentialToken,
+    getCredentialSummary: db.getSkillSyncCredentialSummary,
+    listCredentials: db.listSkillSyncCredentials,
+    listStatuses: db.listSkillSyncStatuses,
+    upsertStatus: db.upsertSkillSyncStatus,
+    tryAcquireLock: db.tryAcquireSkillSyncLock,
+    refreshLock: db.refreshSkillSyncLock,
+    releaseLock: db.releaseSkillSyncLock,
+    createSkill: db.createSkill,
+    updateSkill: db.updateSkill,
+    getSkillById: db.getSkillById,
+    findSkillBySourceIdentity: db.findSkillBySourceIdentity,
+    listSkillsBySource: db.listSkillsBySource,
+    listSkillFiles: db.listSkillFiles,
+    getSkillFileByPath: db.getSkillFileByPath,
+    upsertSkillFile: db.upsertSkillFile,
+    deleteSkillFile: db.deleteSkillFile,
+    deleteSkill: db.deleteSkill,
+    grantPermission: async ({
+      principalType,
+      principalId,
+      resourceType,
+      resourceId,
+      accessRoleId,
+      grantedBy,
+    }) => {
+      // Default access roles are seeded globally (no tenantId) under runAsSystem,
+      // but the runner may execute inside a source's tenant context. Resolve the
+      // role outside tenant isolation so the global role matches, then write the
+      // ACL entry in the active (tenant) context so tenant users can see it.
+      const role = await runAsSystem(() => db.findRoleByIdentifier(accessRoleId));
+      if (!role) {
+        throw new Error(`Role ${accessRoleId} not found`);
+      }
+      if (role.resourceType !== resourceType) {
+        throw new Error(
+          `Role ${accessRoleId} is for ${role.resourceType} resources, not ${resourceType}`,
+        );
+      }
+      return db.grantPermission(
+        principalType,
+        principalId,
+        resourceType,
+        resourceId,
+        role.permBits,
+        grantedBy,
+        undefined,
+        role._id,
+      );
+    },
+    saveBuffer: async ({ userId, buffer, fileName, basePath, isImage, tenantId }) => {
+      const storage = await resolveSkillStorage({ isImage, loadAppConfig: resolveAppConfig });
+      const filepath = await storage.saveBuffer({
+        userId: userId ?? SYSTEM_USER_ID,
+        buffer,
+        fileName,
+        basePath,
+        tenantId,
+      });
+      return {
+        filepath,
+        source: storage.source,
+        ...getStorageMetadata({ filepath, source: storage.source }),
+      };
+    },
+    deleteFile: async (file) => {
+      const strategy = getStrategyFunctions(file.source);
+      if (!strategy.deleteFile) {
+        return;
+      }
+      await strategy.deleteFile(
+        await getSyntheticReq({
+          userId: file.user?.toString?.() ?? file.user ?? SYSTEM_USER_ID,
+          tenantId: file.tenantId,
+          loadAppConfig: resolveAppConfig,
+        }),
+        file,
+      );
+    },
+    allowServerCredentials,
+  });
+  return {
+    getStatus: createdRunner.getStatus,
+    runOnce: createdRunner.runOnce,
+  };
+}
+
+const triggerOrchestrator = createSkillSyncTriggerOrchestrator({
+  createRunner,
+  logger,
+});
+
+function getGitHubSkillSyncRunnerForRequest(req) {
+  return triggerOrchestrator.getRunnerForAdminRequest(withBaseSkillSyncConfig(req, appConfigRef));
+}
+
+async function maybeRunGitHubSkillSyncForRequest(req) {
+  const baseConfig = await loadCurrentAppConfig();
+  return triggerOrchestrator.maybeRunForRequest({
+    ...withBaseSkillSyncConfig(req, baseConfig),
+    skillSyncAllowServerCredentials: false,
+  });
+}
+
+function initializeGitHubSkillSync(appConfig) {
+  appConfigRef = appConfig;
+  runner = createRunner();
+  scheduler = startGitHubSkillSyncScheduler({
+    getConfig: getSyncConfig,
+    runner,
+  });
+  return { runner, scheduler };
+}
+
+function getGitHubSkillSyncRunner() {
+  if (!runner) {
+    runner = createRunner();
+  }
+  return runner;
+}
+
+function stopGitHubSkillSyncScheduler() {
+  if (scheduler) {
+    scheduler.stop();
+    scheduler = undefined;
+  }
+}
+
+module.exports = {
+  initializeGitHubSkillSync,
+  getGitHubSkillSyncRunner,
+  getGitHubSkillSyncRunnerForRequest,
+  maybeRunGitHubSkillSyncForRequest,
+  stopGitHubSkillSyncScheduler,
+};
diff --git a/api/server/services/Skills/sync.test.js b/api/server/services/Skills/sync.test.js
new file mode 100644
index 00000000000..069ffc6db27
--- /dev/null
+++ b/api/server/services/Skills/sync.test.js
@@ -0,0 +1,583 @@
+const mockGetAppConfig = jest.fn();
+const mockGetStrategyFunctions = jest.fn();
+const mockGetFileStrategy = jest.fn();
+const mockFindRoleByIdentifier = jest.fn();
+const mockGrantPermission = jest.fn();
+let mockRunnerDeps;
+let mockRunnerStatus;
+const mockCreatedRunners = [];
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: mockGetAppConfig,
+}));
+
+jest.mock('@librechat/api', () => {
+  const actualApi = jest.requireActual('@librechat/api');
+  return {
+    createSkillSyncTriggerOrchestrator: actualApi.createSkillSyncTriggerOrchestrator,
+    createGitHubSkillSyncRunner: jest.fn((deps) => {
+      mockRunnerDeps = deps;
+      const runner = {
+        getStatus: jest.fn(async () => {
+          if (mockRunnerStatus) {
+            return mockRunnerStatus;
+          }
+          const config = await deps.getConfig();
+          const github = config?.github ?? {};
+          return {
+            enabled: github.enabled ?? false,
+            intervalMinutes: github.intervalMinutes ?? 60,
+            runOnStartup: github.runOnStartup ?? false,
+            sources: (github.sources ?? []).map((source) => ({
+              provider: 'github',
+              sourceId: source.id,
+              status: 'idle',
+              credentialPresent:
+                deps.allowServerCredentials !== false &&
+                Boolean(source.credentialKey || source.token),
+              owner: source.owner,
+              repo: source.repo,
+              ref: source.ref,
+              paths: source.paths,
+              syncedSkillCount: 0,
+              syncedFileCount: 0,
+              deletedSkillCount: 0,
+              deletedFileCount: 0,
+            })),
+            credentials: [],
+          };
+        }),
+        runOnce: jest.fn(async () => deps.getConfig()),
+      };
+      mockCreatedRunners.push({ deps, runner });
+      return runner;
+    }),
+    getStorageMetadata: jest.fn(() => ({})),
+    startGitHubSkillSyncScheduler: jest.fn(() => ({ stop: jest.fn() })),
+  };
+});
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    error: jest.fn(),
+    warn: jest.fn(),
+  },
+  runAsSystem: jest.fn((fn) => fn()),
+}));
+
+jest.mock('~/models', () => ({
+  findRoleByIdentifier: mockFindRoleByIdentifier,
+  grantPermission: mockGrantPermission,
+  getSkillSyncCredentialToken: jest.fn(),
+  getSkillSyncCredentialSummary: jest.fn(),
+  listSkillSyncCredentials: jest.fn(async () => []),
+  listSkillSyncStatuses: jest.fn(async () => []),
+  upsertSkillSyncStatus: jest.fn(),
+  tryAcquireSkillSyncLock: jest.fn(),
+  refreshSkillSyncLock: jest.fn(),
+  releaseSkillSyncLock: jest.fn(),
+  createSkill: jest.fn(),
+  updateSkill: jest.fn(),
+  getSkillById: jest.fn(),
+  findSkillBySourceIdentity: jest.fn(),
+  listSkillsBySource: jest.fn(),
+  listSkillFiles: jest.fn(),
+  getSkillFileByPath: jest.fn(),
+  upsertSkillFile: jest.fn(),
+  deleteSkillFile: jest.fn(),
+  deleteSkill: jest.fn(),
+}));
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: mockGetStrategyFunctions,
+}));
+jest.mock('~/server/utils/getFileStrategy', () => ({ getFileStrategy: mockGetFileStrategy }));
+
+describe('GitHub skill sync service', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetAppConfig.mockReset();
+    mockGetStrategyFunctions.mockReset();
+    mockGetFileStrategy.mockReset();
+    mockFindRoleByIdentifier.mockReset();
+    mockGrantPermission.mockReset();
+    mockRunnerDeps = undefined;
+    mockRunnerStatus = undefined;
+    mockCreatedRunners.length = 0;
+  });
+
+  it('resolves sync config from fresh base app config for runner operations', async () => {
+    const startupSkillSync = {
+      github: {
+        enabled: false,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [],
+      },
+    };
+    const freshSkillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 5,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'librechat-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            credentialKey: 'github-skills-prod',
+          },
+        ],
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ skillSync: freshSkillSync });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ skillSync: startupSkillSync });
+    const result = await runner.runOnce();
+
+    expect(result).toBe(freshSkillSync);
+    expect(mockRunnerDeps.getConfig).toBeDefined();
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('does not return raw unvalidated config.skillSync as sync config', async () => {
+    const rawSkillSync = {
+      github: {
+        enabled: true,
+        sources: 'not-an-array',
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ config: { skillSync: rawSkillSync } });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ config: { skillSync: rawSkillSync } });
+    const result = await runner.runOnce();
+
+    expect(result).toBeUndefined();
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('does not let user skill-list sync use server credentials from resolved config', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'other-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    const requestRunner = mockCreatedRunners[0].runner;
+    const requestConfig = await mockCreatedRunners[0].deps.getConfig();
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+    expect(requestRunner.runOnce).not.toHaveBeenCalled();
+    expect(requestConfig.github.runOnStartup).toBe(false);
+    expect(requestConfig.github.sources[0]).toEqual(
+      expect.objectContaining({
+        id: 'tenant-skills',
+        tenantId: 'tenant-a',
+      }),
+    );
+  });
+
+  it('does not auto-start request-scoped sync when server credentials are unavailable', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'idle',
+          credentialPresent: false,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+    expect(mockCreatedRunners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('does not start a request-scoped sync for base YAML skillSync config', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'base-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ skillSync });
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners).toHaveLength(0);
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('creates an admin request runner from resolved skillSync config overrides', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'other-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    const runner = service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const config = await mockCreatedRunners[0].deps.getConfig();
+
+    expect(runner.runOnce).toBe(mockCreatedRunners[0].runner.runOnce);
+    expect(runner.getStatus).toBe(mockCreatedRunners[0].runner.getStatus);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(true);
+    expect(config.github.runOnStartup).toBe(true);
+    expect(config.github.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('preserves base admin runner tenant scope when request config has no nested base copy', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'base-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'base-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync });
+    service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const config = await mockCreatedRunners[1].deps.getConfig();
+
+    expect(config.github.sources[0]).toEqual(
+      expect.objectContaining({ id: 'base-skills', tenantId: 'base-tenant' }),
+    );
+  });
+
+  it('does not allow request-built admin override runners to use server credentials by default', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+  });
+
+  it('does not start a request-scoped sync when the configured source is already running', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'running',
+          credentialPresent: true,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          startedAt: new Date(),
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('retries a request-scoped sync when a running source status is stale', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'running',
+          credentialPresent: true,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          startedAt: new Date(Date.now() - 40 * 60 * 1000),
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(true);
+    expect(mockCreatedRunners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses the file owner when deleting synced files from storage', async () => {
+    const deleteFile = jest.fn(async () => undefined);
+    const ownerId = '507f1f77bcf86cd799439011';
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockGetStrategyFunctions.mockReturnValue({ deleteFile });
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+    await mockRunnerDeps.deleteFile({
+      filepath: `/uploads/${ownerId}/file.txt`,
+      source: 'local',
+      user: ownerId,
+      tenantId: 'tenant-a',
+    });
+
+    expect(deleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        user: expect.objectContaining({
+          id: ownerId,
+          _id: ownerId,
+          tenantId: 'tenant-a',
+        }),
+      }),
+      expect.objectContaining({
+        user: ownerId,
+        tenantId: 'tenant-a',
+      }),
+    );
+  });
+
+  it('does not force manual sync runs into the system tenant context', async () => {
+    const { runAsSystem } = require('@librechat/data-schemas');
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ skillSync: undefined });
+    await runner.runOnce();
+
+    expect(runAsSystem).not.toHaveBeenCalled();
+  });
+
+  it('resolves the access role outside tenant isolation but writes the ACL in context', async () => {
+    const { runAsSystem } = require('@librechat/data-schemas');
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockFindRoleByIdentifier.mockResolvedValue({
+      _id: 'role-object-id',
+      resourceType: 'skill',
+      permBits: 1,
+    });
+    mockGrantPermission.mockResolvedValue({ _id: 'acl-entry-id' });
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+    await mockRunnerDeps.grantPermission({
+      principalType: 'public',
+      principalId: null,
+      resourceType: 'skill',
+      resourceId: 'skill-id',
+      accessRoleId: 'skill_viewer',
+      grantedBy: 'system',
+    });
+
+    expect(runAsSystem).toHaveBeenCalledTimes(1);
+    expect(mockFindRoleByIdentifier).toHaveBeenCalledWith('skill_viewer');
+    expect(mockGrantPermission).toHaveBeenCalledWith(
+      'public',
+      null,
+      'skill',
+      'skill-id',
+      1,
+      'system',
+      undefined,
+      'role-object-id',
+    );
+  });
+
+  it('fails the grant when the access role does not exist', async () => {
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockFindRoleByIdentifier.mockResolvedValue(null);
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+
+    await expect(
+      mockRunnerDeps.grantPermission({
+        principalType: 'public',
+        principalId: null,
+        resourceType: 'skill',
+        resourceId: 'skill-id',
+        accessRoleId: 'skill_viewer',
+        grantedBy: 'system',
+      }),
+    ).rejects.toThrow('Role skill_viewer not found');
+    expect(mockGrantPermission).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/services/Threads/manage.js b/api/server/services/Threads/manage.js
index 27520f38a55..772cbd977bf 100644
--- a/api/server/services/Threads/manage.js
+++ b/api/server/services/Threads/manage.js
@@ -467,7 +467,7 @@ async function checkMessageGaps({
     apiMessages.push(currentMessage);
   }
 
-  const dbMessages = await getMessages({ conversationId });
+  const dbMessages = await getMessages({ conversationId, user: openai.req.user.id });
   const assistant_id = dbMessages?.[0]?.model;
 
   const syncedMessages = await syncMessages({
diff --git a/api/server/services/ToolService.js b/api/server/services/ToolService.js
index 1c1e2cf4b95..b11529205bf 100644
--- a/api/server/services/ToolService.js
+++ b/api/server/services/ToolService.js
@@ -1,9 +1,7 @@
-const { logger } = require('@librechat/data-schemas');
+const { logger, redactMessage } = require('@librechat/data-schemas');
 const { tool: toolFn, DynamicStructuredTool } = require('@librechat/agents/langchain/tools');
 const {
   sleep,
-  StepTypes,
-  GraphEvents,
   createToolSearch,
   createBashExecutionTool,
   Constants: AgentConstants,
@@ -18,10 +16,18 @@ const {
   isActionDomainAllowed,
   buildWebSearchContext,
   buildImageToolContext,
-  buildOAuthToolCallName,
   buildToolClassification,
+  getMissingCustomUserVars,
   buildWebSearchDynamicContext,
   getCodeApiAuthHeaders,
+  getReplayablePendingMCPOAuthStart,
+  getMCPServerNamesFromTools,
+  buildMCPAuthToolCall,
+  buildMCPAuthStepId,
+  buildMCPAuthRunStepEvent,
+  buildMCPAuthRunStepDeltaEvent,
+  buildMCPAuthRunStepCompletedEvent,
+  isFileAuthoringToolDefinition,
 } = require('@librechat/api');
 const {
   Time,
@@ -62,12 +68,12 @@ const { primeFiles: primeCodeFiles } = require('~/server/services/Files/Code/pro
 const { manifestToolMap, toolkits } = require('~/app/clients/tools/manifest');
 const { createOnSearchResults } = require('~/server/services/Tools/search');
 const { reinitMCPServer } = require('~/server/services/Tools/mcp');
-const { resolveConfigServers } = require('~/server/services/MCP');
+const { createMCPPermissionContext, resolveConfigServers } = require('~/server/services/MCP');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
 const { recordUsage } = require('~/server/services/Threads');
 const { loadTools } = require('~/app/clients/tools/util');
-const { redactMessage } = require('~/config/parsers');
 const { findPluginAuthsByKeys } = require('~/models');
-const { getFlowStateManager } = require('~/config');
+const { getFlowStateManager, getMCPServersRegistry } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const domainSeparatorRegex = new RegExp(actionDomainSeparator, 'g');
@@ -523,6 +529,7 @@ const isBuiltInTool = (toolName) =>
  * @returns {Promise<{
  *   toolDefinitions?: import('@librechat/api').LCTool[];
  *   toolRegistry?: Map<string, import('@librechat/api').LCTool>;
+ *   mcpAvailableTools?: Record<string, import('@librechat/api').LCAvailableTools>;
  *   userMCPAuthMap?: Record<string, Record<string, string>>;
  *   hasDeferredTools?: boolean;
  * }>}
@@ -550,6 +557,9 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
   const codeExecutionEnabled =
     agent.tools?.includes(Tools.execute_code) === true &&
     enabledCapabilities.has(AgentCapabilities.execute_code);
+  const hasMCPTools = agent.tools?.some((tool) => tool?.includes(Constants.mcp_delimiter));
+  const mcpPermissionContext = createMCPPermissionContext(req);
+  const canUseMCP = hasMCPTools ? await mcpPermissionContext.canUseServers(req.user) : true;
 
   const filteredTools = agent.tools?.filter((tool) => {
     if (tool === Tools.file_search) {
@@ -564,6 +574,9 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
     if (isActionTool(tool)) {
       return actionsEnabled;
     }
+    if (tool?.includes(Constants.mcp_delimiter)) {
+      return areToolsEnabled && canUseMCP;
+    }
     if (!areToolsEnabled) {
       return false;
     }
@@ -576,9 +589,9 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
 
   /** @type {Record<string, Record<string, string>>} */
   let userMCPAuthMap;
-  if (agent.tools?.some((t) => t.includes(Constants.mcp_delimiter))) {
+  if (filteredTools?.some((t) => t.includes(Constants.mcp_delimiter))) {
     userMCPAuthMap = await getUserMCPAuthMap({
-      tools: agent.tools,
+      tools: filteredTools,
       userId: req.user.id,
       findPluginAuthsByKeys,
     });
@@ -588,40 +601,44 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
   const flowManager = getFlowStateManager(flowsCache);
   const configServers = await resolveConfigServers(req);
   const pendingOAuthServers = new Set();
+  const pendingOAuthStarts = new Map();
+  const emittedOAuthStarts = new Map();
+  const oauthToolCallIds = new Map();
+  const oauthStepIndexes = new Map();
+  /** @type {Record<string, import('@librechat/api').LCAvailableTools>} */
+  const mcpAvailableTools = {};
+  const requestScopedConnections = getMCPRequestContext(req, res);
+  const rememberMCPAvailableTools = (serverName, availableTools) => {
+    if (!availableTools || Object.keys(availableTools).length === 0) {
+      return;
+    }
+    mcpAvailableTools[serverName] = availableTools;
+  };
 
-  const createOAuthEmitter = (serverName) => {
-    return async (authURL) => {
-      const flowId = `${req.user.id}:${serverName}:${Date.now()}`;
-      const stepId = 'step_oauth_login_' + serverName;
-      const toolCall = {
+  const createOAuthEmitter = (serverName, index) => {
+    return async (authURL, options) => {
+      if (emittedOAuthStarts.get(serverName) === authURL) {
+        return;
+      }
+      emittedOAuthStarts.set(serverName, authURL);
+
+      const flowId =
+        oauthToolCallIds.get(serverName) ?? `${req.user.id}:${serverName}:${Date.now()}`;
+      const stepId = buildMCPAuthStepId(serverName);
+      oauthToolCallIds.set(serverName, flowId);
+      oauthStepIndexes.set(serverName, index);
+      const toolCall = buildMCPAuthToolCall({
         id: flowId,
-        name: buildOAuthToolCallName(serverName),
-        type: 'tool_call_chunk',
-      };
-
-      const runStepData = {
-        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
-        id: stepId,
-        type: StepTypes.TOOL_CALLS,
-        index: 0,
-        stepDetails: {
-          type: StepTypes.TOOL_CALLS,
-          tool_calls: [toolCall],
-        },
-      };
-
-      const runStepDeltaData = {
-        id: stepId,
-        delta: {
-          type: StepTypes.TOOL_CALLS,
-          tool_calls: [{ ...toolCall, args: '' }],
-          auth: authURL,
-          expires_at: Date.now() + Time.TWO_MINUTES,
-        },
-      };
+        serverName,
+      });
 
-      const runStepEvent = { event: GraphEvents.ON_RUN_STEP, data: runStepData };
-      const runStepDeltaEvent = { event: GraphEvents.ON_RUN_STEP_DELTA, data: runStepDeltaData };
+      const runStepEvent = buildMCPAuthRunStepEvent({ stepId, toolCall, index });
+      const runStepDeltaEvent = buildMCPAuthRunStepDeltaEvent({
+        authURL,
+        stepId,
+        toolCall,
+        options,
+      });
 
       if (streamId) {
         await GenerationJobManager.emitChunk(streamId, runStepEvent);
@@ -637,14 +654,125 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
     };
   };
 
+  const createOAuthEndEmitter = (serverName) => {
+    return async () => {
+      const stepId = buildMCPAuthStepId(serverName);
+      const toolCall = buildMCPAuthToolCall({
+        id: oauthToolCallIds.get(serverName),
+        args: '',
+        output: 'OAuth authentication completed',
+        serverName,
+        type: 'tool_call',
+      });
+      const runStepCompletedEvent = buildMCPAuthRunStepCompletedEvent({
+        stepId,
+        toolCall,
+        index: oauthStepIndexes.get(serverName) ?? 0,
+      });
+
+      if (streamId) {
+        await GenerationJobManager.emitChunk(streamId, runStepCompletedEvent);
+      } else if (res && !res.writableEnded) {
+        sendEvent(res, runStepCompletedEvent);
+      } else {
+        logger.warn(
+          `[Tool Definitions] Cannot emit OAuth completion for ${serverName}: no streamId and res not available`,
+        );
+      }
+    };
+  };
+
+  const getPendingOAuthStartForEmit = async (serverName) => {
+    const cachedOAuthStart = pendingOAuthStarts.get(serverName);
+    if (cachedOAuthStart?.options?.expiresAt != null) {
+      return cachedOAuthStart;
+    }
+
+    const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+      flowManager,
+      userId: req.user.id,
+      serverName,
+    });
+    if (!pendingOAuthStart) {
+      return cachedOAuthStart;
+    }
+
+    if (!cachedOAuthStart || pendingOAuthStart.authURL === cachedOAuthStart.authURL) {
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+      return pendingOAuthStart;
+    }
+
+    return cachedOAuthStart;
+  };
+
   const getOrFetchMCPServerTools = async (userId, serverName) => {
-    const cached = await getMCPServerTools(userId, serverName);
+    const addPendingOAuthServer = async () => {
+      const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+        flowManager,
+        userId,
+        serverName,
+      });
+      if (!pendingOAuthStart) {
+        return false;
+      }
+
+      pendingOAuthServers.add(serverName);
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+      return true;
+    };
+
+    let serverConfig;
+    try {
+      serverConfig =
+        configServers?.[serverName] ??
+        (await getMCPServersRegistry().getServerConfig(serverName, userId, configServers));
+    } catch (err) {
+      logger.warn(
+        `[Tool Definitions] MCP registry unavailable while resolving '${serverName}': ${
+          err?.message ?? err
+        }. Skipping MCP tool exposure for this lookup.`,
+      );
+      return null;
+    }
+
+    if (!serverConfig) {
+      logger.warn(
+        `[Tool Definitions] Skipping MCP server '${serverName}': no server config found (server may have been removed).`,
+      );
+      return null;
+    }
+
+    const customUserVars = userMCPAuthMap?.[`${Constants.mcp_prefix}${serverName}`];
+    const missingUserVars = getMissingCustomUserVars(serverConfig, customUserVars);
+    if (missingUserVars.length > 0) {
+      logger.warn(
+        `[Tool Definitions] Skipping MCP server '${serverName}': required user-provided variable(s) not set: ${missingUserVars.join(
+          ', ',
+        )}. Tools will not be exposed until the user configures them.`,
+      );
+      return null;
+    }
+
+    if (mcpAvailableTools[serverName]) {
+      return mcpAvailableTools[serverName];
+    }
+
+    const cached = await getMCPServerTools(userId, serverName, serverConfig);
     if (cached) {
+      rememberMCPAvailableTools(serverName, cached);
+      await addPendingOAuthServer();
       return cached;
     }
 
-    const oauthStart = async () => {
+    if (await addPendingOAuthServer()) {
+      return null;
+    }
+
+    const oauthStart = async (authURL, options) => {
       pendingOAuthServers.add(serverName);
+      if (typeof authURL === 'string' && authURL.length > 0) {
+        pendingOAuthStarts.set(serverName, { authURL, options });
+      }
     };
 
     const result = await reinitMCPServer({
@@ -654,8 +782,11 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
       serverName,
       configServers,
       userMCPAuthMap,
+      requestBody: req.body,
+      requestScopedConnections,
     });
 
+    rememberMCPAvailableTools(serverName, result?.availableTools);
     return result?.availableTools || null;
   };
 
@@ -727,6 +858,7 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
       deferredToolsEnabled,
       programmaticToolsEnabled,
       codeExecutionEnabled,
+      provider: agent.provider,
     },
     {
       isBuiltInTool,
@@ -735,26 +867,51 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
     },
   );
 
+  for (const serverName of getMCPServerNamesFromTools(filteredTools)) {
+    if (pendingOAuthServers.has(serverName)) {
+      continue;
+    }
+
+    const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+      flowManager,
+      userId: req.user.id,
+      serverName,
+    });
+    if (pendingOAuthStart) {
+      pendingOAuthServers.add(serverName);
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+    }
+  }
+
   if (pendingOAuthServers.size > 0 && (res || streamId)) {
     const serverNames = Array.from(pendingOAuthServers);
     logger.info(
       `[Tool Definitions] OAuth required for ${serverNames.length} server(s): ${serverNames.join(', ')}. Emitting events and waiting.`,
     );
 
-    const oauthWaitPromises = serverNames.map(async (serverName) => {
+    const oauthWaitPromises = serverNames.map(async (serverName, index) => {
       try {
+        const pendingOAuthStart = await getPendingOAuthStartForEmit(serverName);
+        const oauthStart = createOAuthEmitter(serverName, index);
+        if (pendingOAuthStart) {
+          await oauthStart(pendingOAuthStart.authURL, pendingOAuthStart.options);
+        }
+
         const result = await reinitMCPServer({
           user: req.user,
           serverName,
           configServers,
           userMCPAuthMap,
           flowManager,
+          requestBody: req.body,
           returnOnOAuth: false,
-          oauthStart: createOAuthEmitter(serverName),
+          oauthStart,
+          oauthEnd: createOAuthEndEmitter(serverName),
           connectionTimeout: Time.TWO_MINUTES,
         });
 
         if (result?.availableTools) {
+          rememberMCPAvailableTools(serverName, result.availableTools);
           logger.info(`[Tool Definitions] OAuth completed for ${serverName}, tools available`);
           return { serverName, success: true };
         }
@@ -783,6 +940,7 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
           deferredToolsEnabled,
           programmaticToolsEnabled,
           codeExecutionEnabled,
+          provider: agent.provider,
         },
         {
           isBuiltInTool,
@@ -882,6 +1040,8 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
 
   return {
     toolRegistry,
+    mcpAvailableTools,
+    requestScopedConnections,
     userMCPAuthMap,
     toolContextMap,
     dynamicToolContextMap,
@@ -950,6 +1110,9 @@ async function loadAgentTools({
   };
   const areToolsEnabled = checkCapability(AgentCapabilities.tools);
   const actionsEnabled = checkCapability(AgentCapabilities.actions);
+  const hasMCPTools = agent.tools?.some((tool) => tool?.includes(Constants.mcp_delimiter));
+  const mcpPermissionContext = createMCPPermissionContext(req);
+  const canUseMCP = hasMCPTools ? await mcpPermissionContext.canUseServers(req.user) : true;
 
   let includesWebSearch = false;
   const _agentTools = agent.tools?.filter((tool) => {
@@ -962,6 +1125,8 @@ async function loadAgentTools({
       return includesWebSearch;
     } else if (isActionTool(tool)) {
       return actionsEnabled;
+    } else if (tool?.includes(Constants.mcp_delimiter)) {
+      return areToolsEnabled && canUseMCP;
     } else if (!areToolsEnabled) {
       return false;
     }
@@ -979,9 +1144,9 @@ async function loadAgentTools({
 
   /** @type {Record<string, Record<string, string>>} */
   let userMCPAuthMap;
-  if (agent.tools?.some((t) => t.includes(Constants.mcp_delimiter))) {
+  if (_agentTools?.some((t) => t.includes(Constants.mcp_delimiter))) {
     userMCPAuthMap = await getUserMCPAuthMap({
-      tools: agent.tools,
+      tools: _agentTools,
       userId: req.user.id,
       findPluginAuthsByKeys,
     });
@@ -1002,6 +1167,8 @@ async function loadAgentTools({
       processFileURL,
       uploadImageBuffer,
       returnMetadata: true,
+      mcpPermissionContext,
+      requestScopedConnections: getMCPRequestContext(req, res),
       [Tools.web_search]: webSearchCallbacks,
     },
     webSearch: appConfig.webSearch,
@@ -1077,6 +1244,7 @@ async function loadAgentTools({
   if (!hasActionTools) {
     return {
       toolRegistry,
+      requestScopedConnections: getMCPRequestContext(req, res),
       userMCPAuthMap,
       toolContextMap,
       dynamicToolContextMap,
@@ -1095,6 +1263,7 @@ async function loadAgentTools({
     }
     return {
       toolRegistry,
+      requestScopedConnections: getMCPRequestContext(req, res),
       userMCPAuthMap,
       toolContextMap,
       dynamicToolContextMap,
@@ -1223,6 +1392,7 @@ async function loadAgentTools({
 
   return {
     toolRegistry,
+    requestScopedConnections: getMCPRequestContext(req, res),
     toolContextMap,
     dynamicToolContextMap,
     userMCPAuthMap,
@@ -1248,6 +1418,8 @@ async function loadAgentTools({
  * @param {Object} params.agent - The agent object
  * @param {string[]} params.toolNames - Names of tools to load
  * @param {Map} [params.toolRegistry] - Tool registry
+ * @param {Record<string, import('@librechat/api').LCAvailableTools>} [params.mcpAvailableTools] - Run-scoped MCP tool definitions
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections] - Run-scoped MCP connections
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap] - User MCP auth map
  * @param {Object} [params.tool_resources] - Tool resources
  * @param {string|null} [params.streamId] - Stream ID for web search callbacks
@@ -1261,6 +1433,8 @@ async function loadToolsForExecution({
   agent,
   toolNames,
   toolRegistry,
+  mcpAvailableTools,
+  requestScopedConnections,
   userMCPAuthMap,
   tool_resources,
   streamId = null,
@@ -1268,7 +1442,8 @@ async function loadToolsForExecution({
 }) {
   const appConfig = req.config;
   const allLoadedTools = [];
-  const configurable = { userMCPAuthMap };
+  const mcpRequestScopedConnections = requestScopedConnections ?? getMCPRequestContext(req, res);
+  const configurable = { userMCPAuthMap, requestScopedConnections: mcpRequestScopedConnections };
 
   const isToolSearch = toolNames.includes(AgentConstants.TOOL_SEARCH);
   const ptcToolNames = [
@@ -1276,20 +1451,25 @@ async function loadToolsForExecution({
     AgentConstants.PROGRAMMATIC_TOOL_CALLING,
   ].filter((name) => toolNames.includes(name));
   const isPTCRequested = ptcToolNames.length > 0;
+  const isBashToolRequested = toolNames.includes(AgentConstants.BASH_TOOL);
+  const isLegacyExecuteCodeRequested = toolNames.includes(Tools.execute_code);
+  const isCodeExecutionToolRequested = isBashToolRequested || isLegacyExecuteCodeRequested;
 
   let enabledCapabilities;
-  if (actionsEnabled === undefined || isPTCRequested) {
+  if (actionsEnabled === undefined || isPTCRequested || isCodeExecutionToolRequested) {
     enabledCapabilities = await resolveAgentCapabilities(req, appConfig, agent?.id);
   }
   if (actionsEnabled === undefined) {
     actionsEnabled = enabledCapabilities.has(AgentCapabilities.actions);
   }
+  const codeExecutionEnabled =
+    enabledCapabilities?.has(AgentCapabilities.execute_code) === true &&
+    agent?.tools?.includes(Tools.execute_code) === true;
 
   const isPTC =
     isPTCRequested &&
     enabledCapabilities.has(AgentCapabilities.programmatic_tools) &&
-    enabledCapabilities.has(AgentCapabilities.execute_code) &&
-    agent?.tools?.includes(Tools.execute_code) === true;
+    codeExecutionEnabled;
 
   logger.debug(
     `[loadToolsForExecution] isToolSearch: ${isToolSearch}, toolRegistry: ${toolRegistry?.size ?? 'undefined'}`,
@@ -1323,7 +1503,16 @@ async function loadToolsForExecution({
     }
   }
 
-  const isBashTool = toolNames.includes(AgentConstants.BASH_TOOL);
+  const isBashTool =
+    isBashToolRequested &&
+    codeExecutionEnabled &&
+    toolRegistry?.has(AgentConstants.BASH_TOOL) === true;
+  if (isBashToolRequested && !isBashTool) {
+    logger.warn(
+      `[loadToolsForExecution] Skipping unregistered or unauthorized ${AgentConstants.BASH_TOOL}. ` +
+        `User: ${req.user.id} | Agent: ${agent?.id ?? 'unknown'}`,
+    );
+  }
   if (isBashTool) {
     try {
       const bashTool = createBashExecutionTool({
@@ -1335,6 +1524,13 @@ async function loadToolsForExecution({
     }
   }
 
+  const fileAuthoringToolNames = new Set(
+    toolRegistry
+      ? Array.from(toolRegistry.values())
+          .filter((definition) => isFileAuthoringToolDefinition(definition))
+          .map((definition) => definition.name)
+      : [],
+  );
   const specialToolNames = new Set([
     AgentConstants.TOOL_SEARCH,
     AgentConstants.PROGRAMMATIC_TOOL_CALLING,
@@ -1342,6 +1538,7 @@ async function loadToolsForExecution({
     AgentConstants.BASH_TOOL,
     AgentConstants.SKILL_TOOL,
     AgentConstants.READ_FILE,
+    ...fileAuthoringToolNames,
   ]);
 
   let ptcOrchestratedToolNames = [];
@@ -1352,9 +1549,22 @@ async function loadToolsForExecution({
   }
 
   const requestedNonSpecialToolNames = toolNames.filter((name) => !specialToolNames.has(name));
+  const allowedNonSpecialToolNames = requestedNonSpecialToolNames.filter((name) => {
+    if (name !== Tools.execute_code) {
+      return true;
+    }
+    const allowed = codeExecutionEnabled && toolRegistry?.has(Tools.execute_code) === true;
+    if (!allowed) {
+      logger.warn(
+        `[loadToolsForExecution] Skipping unregistered or unauthorized ${Tools.execute_code}. ` +
+          `User: ${req.user.id} | Agent: ${agent?.id ?? 'unknown'}`,
+      );
+    }
+    return allowed;
+  });
   const allToolNamesToLoad = isPTC
-    ? [...new Set([...requestedNonSpecialToolNames, ...ptcOrchestratedToolNames])]
-    : requestedNonSpecialToolNames;
+    ? [...new Set([...allowedNonSpecialToolNames, ...ptcOrchestratedToolNames])]
+    : allowedNonSpecialToolNames;
 
   const actionToolNames = [];
   const regularToolNames = [];
@@ -1380,6 +1590,8 @@ async function loadToolsForExecution({
         processFileURL,
         uploadImageBuffer,
         returnMetadata: true,
+        mcpAvailableTools,
+        requestScopedConnections: mcpRequestScopedConnections,
         [Tools.web_search]: webSearchCallbacks,
       },
       webSearch: appConfig?.webSearch,
diff --git a/api/server/services/Tools/mcp.js b/api/server/services/Tools/mcp.js
index f1ebcf97961..c0e32ccd8f6 100644
--- a/api/server/services/Tools/mcp.js
+++ b/api/server/services/Tools/mcp.js
@@ -1,7 +1,11 @@
 const { logger } = require('@librechat/data-schemas');
+const { getMissingCustomUserVars, requiresEphemeralUserConnection } = require('@librechat/api');
 const { CacheKeys, Constants } = require('librechat-data-provider');
 const { getMCPManager, getMCPServersRegistry, getFlowStateManager } = require('~/config');
 const { findToken, createToken, updateToken, deleteTokens } = require('~/models');
+const { getGraphApiToken } = require('~/server/services/GraphTokenService');
+const { exchangeOboToken } = require('~/server/services/OboTokenService');
+const { createOboTrustChecker } = require('~/server/services/OboPolicyService');
 const { updateMCPServerTools } = require('~/server/services/Config');
 const { getLogStores } = require('~/cache');
 
@@ -17,7 +21,10 @@ const { getLogStores } = require('~/cache');
  * @param {boolean} [params.forceNew]
  * @param {number} [params.connectionTimeout]
  * @param {FlowStateManager<any>} [params.flowManager]
- * @param {(authURL: string) => Promise<void>} [params.oauthStart]
+ * @param {(authURL: string, options?: { expiresAt?: number }) => Promise<void>} [params.oauthStart]
+ * @param {() => Promise<void>} [params.oauthEnd]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  */
 async function reinitMCPServer({
@@ -32,20 +39,26 @@ async function reinitMCPServer({
   oauthStart: _oauthStart,
   flowManager: _flowManager,
   serverConfig: providedConfig,
+  requestBody,
+  requestScopedConnections,
+  oauthEnd,
 }) {
   /** @type {MCPConnection | null} */
   let connection = null;
+  let serverConfig = providedConfig;
   /** @type {LCAvailableTools | null} */
   let availableTools = null;
   /** @type {ReturnType<MCPConnection['fetchTools']> | null} */
   let tools = null;
   let oauthRequired = false;
   let oauthUrl = null;
+  let ephemeralServer = false;
 
   try {
     const registry = getMCPServersRegistry();
-    const serverConfig =
-      providedConfig ?? (await registry.getServerConfig(serverName, user?.id, configServers));
+    serverConfig =
+      serverConfig ?? (await registry.getServerConfig(serverName, user?.id, configServers));
+    ephemeralServer = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
     if (serverConfig?.inspectionFailed) {
       if (serverConfig.source === 'config') {
         logger.info(
@@ -60,32 +73,54 @@ async function reinitMCPServer({
           oauthUrl: null,
           tools: null,
         };
-      }
-      logger.info(
-        `[MCP Reinitialize] Server ${serverName} had failed inspection, attempting reinspection`,
-      );
-      try {
-        const storageLocation = serverConfig.source === 'user' ? 'DB' : 'CACHE';
-        await registry.reinspectServer(serverName, storageLocation, user?.id);
-        logger.info(`[MCP Reinitialize] Reinspection succeeded for server: ${serverName}`);
-      } catch (reinspectError) {
-        logger.error(
-          `[MCP Reinitialize] Reinspection failed for server ${serverName}:`,
-          reinspectError,
+      } else {
+        logger.info(
+          `[MCP Reinitialize] Server ${serverName} had failed inspection, attempting reinspection`,
         );
-        return {
-          availableTools: null,
-          success: false,
-          message: `MCP server '${serverName}' is still unreachable`,
-          oauthRequired: false,
-          serverName,
-          oauthUrl: null,
-          tools: null,
-        };
+        try {
+          const storageLocation = serverConfig.source === 'user' ? 'DB' : 'CACHE';
+          await registry.reinspectServer(serverName, storageLocation, user?.id);
+          logger.info(`[MCP Reinitialize] Reinspection succeeded for server: ${serverName}`);
+        } catch (reinspectError) {
+          logger.error(
+            `[MCP Reinitialize] Reinspection failed for server ${serverName}:`,
+            reinspectError,
+          );
+          return {
+            availableTools: null,
+            success: false,
+            message: `MCP server '${serverName}' is still unreachable`,
+            oauthRequired: false,
+            serverName,
+            oauthUrl: null,
+            tools: null,
+          };
+        }
       }
     }
 
     const customUserVars = userMCPAuthMap?.[`${Constants.mcp_prefix}${serverName}`];
+
+    const missingUserVars = getMissingCustomUserVars(serverConfig ?? {}, customUserVars);
+    if (missingUserVars.length > 0) {
+      logger.warn(
+        `[MCP Reinitialize] Skipping server '${serverName}': required user-provided variable(s) not set: ${missingUserVars.join(
+          ', ',
+        )}. Tools will not be exposed until the user configures them.`,
+      );
+      return {
+        availableTools: null,
+        success: false,
+        message: `MCP server '${serverName}' requires user-provided variable(s) [${missingUserVars.join(
+          ', ',
+        )}] which are not set`,
+        oauthRequired: false,
+        serverName,
+        oauthUrl: null,
+        tools: null,
+      };
+    }
+
     const flowManager = _flowManager ?? getFlowStateManager(getLogStores(CacheKeys.FLOWS));
     const mcpManager = getMCPManager();
     const tokenMethods = { findToken, updateToken, createToken, deleteTokens };
@@ -108,9 +143,15 @@ async function reinitMCPServer({
         flowManager,
         tokenMethods,
         returnOnOAuth,
+        oauthEnd,
         customUserVars,
+        requestBody,
+        requestScopedConnections,
         connectionTimeout,
         serverConfig,
+        graphTokenResolver: getGraphApiToken,
+        oboTokenResolver: exchangeOboToken,
+        oboTrustChecker: createOboTrustChecker(),
       });
 
       logger.info(`[MCP Reinitialize] Successfully established connection for ${serverName}`);
@@ -142,8 +183,12 @@ async function reinitMCPServer({
             tokenMethods,
             oauthStart,
             customUserVars,
+            requestBody,
             connectionTimeout,
             configServers,
+            graphTokenResolver: getGraphApiToken,
+            oboTokenResolver: exchangeOboToken,
+            oboTrustChecker: createOboTrustChecker(),
           });
 
           if (discoveryResult.tools && discoveryResult.tools.length > 0) {
@@ -174,6 +219,7 @@ async function reinitMCPServer({
         userId: user.id,
         serverName,
         tools,
+        serverConfig,
       });
     }
 
@@ -221,6 +267,17 @@ async function reinitMCPServer({
       '[MCP Reinitialize] Error loading MCP Tools, servers may still be initializing:',
       error,
     );
+  } finally {
+    if (connection && ephemeralServer && !requestScopedConnections) {
+      try {
+        await connection.disconnect();
+      } catch (error) {
+        logger.warn(
+          `[MCP Reinitialize] Failed to disconnect ephemeral server ${serverName}`,
+          error,
+        );
+      }
+    }
   }
 }
 
diff --git a/api/server/services/Tools/mcp.spec.js b/api/server/services/Tools/mcp.spec.js
new file mode 100644
index 00000000000..ab8cd3f2811
--- /dev/null
+++ b/api/server/services/Tools/mcp.spec.js
@@ -0,0 +1,186 @@
+const { Constants } = require('librechat-data-provider');
+
+const mockGetConnection = jest.fn();
+const mockDiscoverServerTools = jest.fn();
+const mockGetGraphApiToken = jest.fn();
+const mockUpdateMCPServerTools = jest.fn();
+
+jest.mock('~/config', () => ({
+  getMCPManager: jest.fn(() => ({
+    getConnection: mockGetConnection,
+    discoverServerTools: mockDiscoverServerTools,
+  })),
+  getMCPServersRegistry: jest.fn(() => ({ getServerConfig: jest.fn() })),
+  getFlowStateManager: jest.fn(() => ({})),
+}));
+jest.mock('~/models', () => ({
+  findToken: jest.fn(),
+  createToken: jest.fn(),
+  updateToken: jest.fn(),
+  deleteTokens: jest.fn(),
+}));
+jest.mock('~/server/services/Config', () => ({
+  updateMCPServerTools: mockUpdateMCPServerTools,
+}));
+jest.mock('~/server/services/GraphTokenService', () => ({
+  getGraphApiToken: mockGetGraphApiToken,
+}));
+jest.mock('~/cache', () => ({
+  getLogStores: jest.fn(() => ({})),
+}));
+
+const { reinitMCPServer } = require('./mcp');
+
+describe('reinitMCPServer — customUserVars gating (issue #10969)', () => {
+  const user = { id: 'user-123' };
+  const serverName = 'Thingy';
+  const serverConfig = {
+    type: 'streamable-http',
+    url: 'https://thingy.example.com/mcp',
+    customUserVars: {
+      THINGY_TOKEN: { title: 'Thingy Access Token', description: 'Create this in Thingy' },
+    },
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUpdateMCPServerTools.mockResolvedValue({});
+  });
+
+  it('does not connect and exposes no tools when a required customUserVar is unset', async () => {
+    const result = await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig,
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockGetConnection).not.toHaveBeenCalled();
+    expect(result).toMatchObject({
+      availableTools: null,
+      success: false,
+      tools: null,
+      oauthRequired: false,
+      serverName,
+    });
+    expect(result.message).toContain('THINGY_TOKEN');
+  });
+
+  it('does not connect when the stored value for a required customUserVar is empty', async () => {
+    const result = await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig,
+      userMCPAuthMap: { [`${Constants.mcp_prefix}${serverName}`]: { THINGY_TOKEN: '' } },
+    });
+
+    expect(mockGetConnection).not.toHaveBeenCalled();
+    expect(result.success).toBe(false);
+    expect(result.availableTools).toBeNull();
+  });
+
+  it('proceeds to connect once every required customUserVar is provided', async () => {
+    mockGetConnection.mockResolvedValue({ fetchTools: jest.fn().mockResolvedValue([]) });
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig,
+      userMCPAuthMap: {
+        [`${Constants.mcp_prefix}${serverName}`]: { THINGY_TOKEN: 'secret-token' },
+      },
+    });
+
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+    expect(mockGetConnection).toHaveBeenCalledWith(
+      expect.objectContaining({
+        serverName,
+        customUserVars: { THINGY_TOKEN: 'secret-token' },
+      }),
+    );
+  });
+
+  it('passes request body and Graph resolver into connection creation', async () => {
+    mockGetConnection.mockResolvedValue({ fetchTools: jest.fn().mockResolvedValue([]) });
+    const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig: { type: 'streamable-http', url: 'https://thingy.example.com/mcp' },
+      requestBody,
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockGetConnection).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestBody,
+        graphTokenResolver: mockGetGraphApiToken,
+      }),
+    );
+  });
+
+  it('passes request body and Graph resolver into OAuth discovery fallback', async () => {
+    mockGetConnection.mockRejectedValue(new Error('OAuth authentication required'));
+    mockDiscoverServerTools.mockResolvedValue({ tools: [], oauthRequired: true, oauthUrl: null });
+    const requestBody = { conversationId: 'conv-456', messageId: 'msg-456' };
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig: { type: 'streamable-http', url: 'https://thingy.example.com/mcp' },
+      requestBody,
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockDiscoverServerTools).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestBody,
+        graphTokenResolver: mockGetGraphApiToken,
+      }),
+    );
+  });
+
+  it('disconnects ephemeral BODY-scoped connections after loading tools', async () => {
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const tools = [{ name: 'search', inputSchema: { type: 'object', properties: {} } }];
+    const serverConfig = {
+      type: 'streamable-http',
+      url: 'https://thingy.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      source: 'yaml',
+    };
+    mockGetConnection.mockResolvedValue({
+      disconnect,
+      fetchTools: jest.fn().mockResolvedValue(tools),
+    });
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig,
+      requestBody: { messageId: 'msg-789' },
+      userMCPAuthMap: undefined,
+    });
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(mockUpdateMCPServerTools).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tools,
+        serverConfig,
+      }),
+    );
+  });
+
+  it('proceeds to connect when the server declares no customUserVars', async () => {
+    mockGetConnection.mockResolvedValue({ fetchTools: jest.fn().mockResolvedValue([]) });
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig: { type: 'streamable-http', url: 'https://thingy.example.com/mcp' },
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockGetConnection).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/api/server/services/__tests__/MCP.spec.js b/api/server/services/__tests__/MCP.spec.js
index 39e99d54ac9..ca3d5eea9a1 100644
--- a/api/server/services/__tests__/MCP.spec.js
+++ b/api/server/services/__tests__/MCP.spec.js
@@ -23,6 +23,17 @@ jest.mock('~/server/services/Config', () => ({
   loadCustomConfig: jest.fn(),
 }));
 
+jest.mock('@librechat/api', () => ({
+  sendEvent: jest.fn(),
+  MCPOAuthHandler: jest.fn(),
+  isMCPDomainAllowed: jest.fn(),
+  normalizeServerName: jest.fn((name) => name),
+  normalizeJsonSchema: jest.fn((schema) => schema),
+  GenerationJobManager: jest.fn(),
+  resolveJsonSchemaRefs: jest.fn((schema) => schema),
+  buildOAuthToolCallName: jest.fn((name) => name),
+}));
+
 jest.mock('~/cache', () => ({ getLogStores: jest.fn() }));
 jest.mock('~/models', () => ({
   findToken: jest.fn(),
@@ -32,12 +43,18 @@ jest.mock('~/models', () => ({
 jest.mock('~/server/services/GraphTokenService', () => ({
   getGraphApiToken: jest.fn(),
 }));
+jest.mock('~/server/services/OboTokenService', () => ({
+  exchangeOboToken: jest.fn(),
+}));
+jest.mock('~/server/services/OboPolicyService', () => ({
+  createOboTrustChecker: jest.fn(() => async () => true),
+}));
 jest.mock('~/server/services/Tools/mcp', () => ({
   reinitMCPServer: jest.fn(),
 }));
 
 const { getAppConfig } = require('~/server/services/Config');
-const { resolveConfigServers, resolveAllMcpConfigs } = require('../MCP');
+const { resolveConfigServers, resolveMcpConfigNames, resolveAllMcpConfigs } = require('../MCP');
 
 describe('resolveConfigServers', () => {
   beforeEach(() => jest.clearAllMocks());
@@ -82,6 +99,35 @@ describe('resolveConfigServers', () => {
   });
 });
 
+describe('resolveMcpConfigNames', () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it('resolves current request config server names', async () => {
+    getAppConfig.mockResolvedValue({ mcpConfig: { cfg_srv: {}, yaml_srv: {} } });
+
+    const result = await resolveMcpConfigNames({ user: { id: 'u1', role: 'admin' } });
+
+    expect(result).toEqual(['cfg_srv', 'yaml_srv']);
+    expect(getAppConfig).toHaveBeenCalledWith(
+      expect.objectContaining({ role: 'admin', userId: 'u1' }),
+    );
+  });
+
+  it('returns [] when mcpConfig is absent', async () => {
+    getAppConfig.mockResolvedValue({});
+
+    const result = await resolveMcpConfigNames({ user: { id: 'u1' } });
+
+    expect(result).toEqual([]);
+  });
+
+  it('propagates getAppConfig failures for write-path callers', async () => {
+    getAppConfig.mockRejectedValue(new Error('db timeout'));
+
+    await expect(resolveMcpConfigNames({ user: { id: 'u1' } })).rejects.toThrow('db timeout');
+  });
+});
+
 describe('resolveAllMcpConfigs', () => {
   beforeEach(() => jest.clearAllMocks());
 
@@ -99,9 +145,13 @@ describe('resolveAllMcpConfigs', () => {
       cfg_srv: { name: 'cfg_srv' },
       yaml_srv: { name: 'yaml_srv' },
     });
-    expect(mockRegistry.getAllServerConfigs).toHaveBeenCalledWith('u1', {
-      cfg_srv: { name: 'cfg_srv' },
-    });
+    expect(mockRegistry.getAllServerConfigs).toHaveBeenCalledWith(
+      'u1',
+      {
+        cfg_srv: { name: 'cfg_srv' },
+      },
+      'user',
+    );
   });
 
   it('continues with empty configServers when ensureConfigServers fails', async () => {
diff --git a/api/server/services/__tests__/ToolService.spec.js b/api/server/services/__tests__/ToolService.spec.js
index be066d67927..9f496c5f3af 100644
--- a/api/server/services/__tests__/ToolService.spec.js
+++ b/api/server/services/__tests__/ToolService.spec.js
@@ -1,3 +1,4 @@
+const { Constants: AgentConstants } = require('@librechat/agents');
 const {
   Tools,
   Constants,
@@ -11,6 +12,8 @@ const {
 const mockGetEndpointsConfig = jest.fn();
 const mockGetMCPServerTools = jest.fn();
 const mockGetCachedTools = jest.fn();
+const mockSendEvent = jest.fn();
+const mockEmitChunk = jest.fn();
 jest.mock('~/server/services/Config', () => ({
   getEndpointsConfig: (...args) => mockGetEndpointsConfig(...args),
   getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
@@ -23,6 +26,10 @@ jest.mock('@librechat/api', () => ({
   ...jest.requireActual('@librechat/api'),
   loadToolDefinitions: (...args) => mockLoadToolDefinitions(...args),
   getUserMCPAuthMap: (...args) => mockGetUserMCPAuthMap(...args),
+  sendEvent: (...args) => mockSendEvent(...args),
+  GenerationJobManager: {
+    emitChunk: (...args) => mockEmitChunk(...args),
+  },
 }));
 
 const mockLoadToolsUtil = jest.fn();
@@ -35,6 +42,10 @@ const mockDomainParser = jest.fn();
 const mockLegacyDomainEncode = jest.fn();
 const mockDecryptMetadata = jest.fn();
 const mockCreateActionTool = jest.fn();
+const mockGetServerConfig = jest.fn();
+const mockFlowManager = { getFlowState: jest.fn() };
+const mockResolveConfigServers = jest.fn();
+const mockUserCanUseMCPServers = jest.fn().mockResolvedValue(true);
 jest.mock('~/server/services/Tools/credentials', () => ({
   loadAuthValues: jest.fn().mockResolvedValue({}),
 }));
@@ -68,10 +79,17 @@ jest.mock('~/models', () => ({
   findPluginAuthsByKeys: jest.fn(),
 }));
 jest.mock('~/config', () => ({
-  getFlowStateManager: jest.fn(() => ({})),
+  getFlowStateManager: jest.fn(() => mockFlowManager),
+  getMCPServersRegistry: jest.fn(() => ({
+    getServerConfig: (...args) => mockGetServerConfig(...args),
+  })),
 }));
 jest.mock('~/server/services/MCP', () => ({
-  resolveConfigServers: jest.fn().mockResolvedValue({}),
+  resolveConfigServers: (...args) => mockResolveConfigServers(...args),
+  createMCPPermissionContext: jest.fn((req) => ({
+    canUseServers: (user) => mockUserCanUseMCPServers(user, req),
+  })),
+  userCanUseMCPServers: mockUserCanUseMCPServers,
 }));
 jest.mock('~/cache', () => ({
   getLogStores: jest.fn(() => ({})),
@@ -83,6 +101,8 @@ const {
   processRequiredActions,
   resolveAgentCapabilities,
 } = require('../ToolService');
+const { reinitMCPServer } = require('~/server/services/Tools/mcp');
+const { PENDING_STALE_MS } = require('@librechat/api');
 
 function createMockReq(capabilities) {
   return {
@@ -113,6 +133,12 @@ describe('ToolService - Action Capability Gating', () => {
     });
     mockLoadToolsUtil.mockResolvedValue({ loadedTools: [], toolContextMap: {} });
     mockLoadActionSets.mockResolvedValue([]);
+    mockGetMCPServerTools.mockResolvedValue(null);
+    mockGetCachedTools.mockResolvedValue(null);
+    mockGetUserMCPAuthMap.mockResolvedValue({});
+    mockGetServerConfig.mockResolvedValue(undefined);
+    mockFlowManager.getFlowState.mockResolvedValue(undefined);
+    mockResolveConfigServers.mockResolvedValue({});
   });
 
   describe('resolveAgentCapabilities', () => {
@@ -245,6 +271,28 @@ describe('ToolService - Action Capability Gating', () => {
       expect(callArgs.tools).toContain(regularTool);
     });
 
+    it('should filter MCP tool definitions when user lacks MCP server use permission', async () => {
+      const { userCanUseMCPServers } = require('~/server/services/MCP');
+      userCanUseMCPServers.mockResolvedValueOnce(false);
+
+      const mcpTool = `search${Constants.mcp_delimiter}myserver`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+
+      await loadAgentTools({
+        req,
+        res: {},
+        agent: { id: 'agent_123', tools: [regularTool, mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(mockLoadToolDefinitions).toHaveBeenCalledTimes(1);
+      const [callArgs] = mockLoadToolDefinitions.mock.calls[0];
+      expect(callArgs.tools).toContain(regularTool);
+      expect(callArgs.tools).not.toContain(mcpTool);
+    });
+
     it('should return actionsEnabled in the result', async () => {
       const capabilities = [AgentCapabilities.tools];
       const req = createMockReq(capabilities);
@@ -259,6 +307,623 @@ describe('ToolService - Action Capability Gating', () => {
 
       expect(result.actionsEnabled).toBe(false);
     });
+
+    it('emits separate MCP OAuth login steps and completion events for multiple pending servers', async () => {
+      const req = createMockReq([AgentCapabilities.tools]);
+      const res = { writableEnded: false };
+      const servers = ['ELI', 'Vespa'];
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig([AgentCapabilities.tools]));
+      mockResolveConfigServers.mockResolvedValue(
+        Object.fromEntries(
+          servers.map((serverName) => [
+            serverName,
+            {
+              type: 'streamable-http',
+              url: `https://mcp.example.com/${serverName}`,
+              requiresOAuth: true,
+            },
+          ]),
+        ),
+      );
+
+      mockLoadToolDefinitions
+        .mockImplementationOnce(async (_args, deps) => {
+          await deps.getOrFetchMCPServerTools(req.user.id, servers[0]);
+          await deps.getOrFetchMCPServerTools(req.user.id, servers[1]);
+          return {
+            toolDefinitions: [],
+            toolRegistry: new Map(),
+            hasDeferredTools: false,
+          };
+        })
+        .mockResolvedValue({
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        });
+
+      reinitMCPServer.mockImplementation(
+        async ({ serverName, returnOnOAuth, oauthStart, oauthEnd }) => {
+          if (returnOnOAuth === false) {
+            await oauthStart(`https://auth.example.com/${serverName}`);
+            await oauthEnd();
+            return { availableTools: { [`tool_${serverName}`]: {} } };
+          }
+
+          await oauthStart(`https://auth.example.com/${serverName}`);
+          return { availableTools: null };
+        },
+      );
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: {
+          id: 'agent_123',
+          tools: servers.map((server) => `search${Constants.mcp_delimiter}${server}`),
+        },
+        definitionsOnly: true,
+      });
+
+      const runStepEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.stepDetails?.type === 'tool_calls');
+      const deltaEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.delta?.type === 'tool_calls');
+      const authDeltaEvents = deltaEvents.filter((event) => event.data.delta.auth);
+      const completionEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.result?.tool_call?.name?.startsWith('oauth'));
+
+      expect(runStepEvents.map((event) => event.data.index)).toEqual([0, 1]);
+      expect(authDeltaEvents.map((event) => event.data.id)).toEqual([
+        'step_oauth_login_ELI',
+        'step_oauth_login_Vespa',
+      ]);
+      expect(completionEvents.map((event) => event.data.result.id)).toEqual([
+        'step_oauth_login_ELI',
+        'step_oauth_login_Vespa',
+      ]);
+    });
+
+    it('should not expose cached MCP tool definitions when the registry lookup fails', async () => {
+      const serverName = 'private-server';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockImplementation(() => {
+        throw new Error('MCPServersRegistry has not been initialized.');
+      });
+      mockGetMCPServerTools.mockResolvedValue({
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'Cached private search',
+            parameters: {},
+          },
+        },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res: {},
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([]);
+      expect(mockGetMCPServerTools).not.toHaveBeenCalled();
+    });
+
+    it('should re-emit pending MCP OAuth prompts when cached tool definitions exist', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue({
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'Cached search',
+            parameters: {},
+          },
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: { [mcpTool]: {} } };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ requiresOAuth: true }),
+      );
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+          }),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should not join in-flight MCP initialization before replaying pending OAuth prompts', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `${Constants.mcp_all}${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: null };
+      });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ requiresOAuth: true }),
+      );
+      expect(reinitMCPServer).toHaveBeenCalledTimes(1);
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should re-emit pending MCP OAuth prompts when selected MCP tools are already concrete', async () => {
+      const serverName = `Google${Constants.mcp_delimiter}Workspace`;
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockResolvedValue({
+        toolDefinitions: [mcpTool],
+        toolRegistry: new Map(),
+        hasDeferredTools: false,
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: { [mcpTool]: {} } };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(mockGetMCPServerTools).not.toHaveBeenCalled();
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should emit stored pending MCP OAuth prompts before waiting on a silent in-flight join', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockResolvedValue({
+        toolDefinitions: [mcpTool],
+        toolRegistry: new Map(),
+        hasDeferredTools: false,
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools: null });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should preserve OAuth URLs emitted while discovering MCP tools before a silent wait join', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer
+        .mockImplementationOnce(async ({ oauthStart }) => {
+          await oauthStart(authorizationUrl, { expiresAt: Date.now() + 60_000 });
+          return { availableTools: null };
+        })
+        .mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(reinitMCPServer).toHaveBeenCalledTimes(2);
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should pass request body context into MCP tool definition reinitialization', async () => {
+      const serverName = 'Body-Scoped';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      req.body = { conversationId: 'conv-123', messageId: 'msg-123' };
+
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          requestBody: req.body,
+        }),
+      );
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({
+          url: expect.stringContaining('LIBRECHAT_BODY_MESSAGEID'),
+        }),
+      );
+    });
+
+    it('returns run-scoped MCP tool definitions for request-scoped servers', async () => {
+      const serverName = 'ClickHouse';
+      const mcpTool = `list_tables${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      req.body = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const availableTools = {
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://mcp.example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map([[mcpTool, { name: mcpTool }]]),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools });
+
+      const result = await loadAgentTools({
+        req,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(result.mcpAvailableTools).toEqual({ [serverName]: availableTools });
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({
+          url: expect.stringContaining('LIBRECHAT_BODY_MESSAGEID'),
+        }),
+      );
+    });
+
+    it('should preserve pending-flow expiry for OAuth URLs captured during discovery', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      const createdAt = Date.now() - 45_000;
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValueOnce(null).mockResolvedValueOnce({
+        status: 'PENDING',
+        createdAt,
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer
+        .mockImplementationOnce(async ({ oauthStart }) => {
+          await oauthStart(authorizationUrl);
+          return { availableTools: null };
+        })
+        .mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      const authDeltaEvent = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .find((event) => event.data?.delta?.auth === authorizationUrl);
+      expect(authDeltaEvent?.data.delta.expires_at).toBe(createdAt + PENDING_STALE_MS);
+    });
+
+    it('should use request-scoped MCP config before falling back to the registry', async () => {
+      const serverName = 'config-server';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockResolveConfigServers.mockResolvedValue({
+        [serverName]: {
+          type: 'streamable-http',
+          url: 'https://config.example.com/mcp',
+          customUserVars: {
+            TOKEN: { title: 'Token', description: 'Token' },
+          },
+        },
+      });
+      mockGetUserMCPAuthMap.mockResolvedValue({
+        [`${Constants.mcp_prefix}${serverName}`]: { TOKEN: 'secret' },
+      });
+      mockGetMCPServerTools.mockResolvedValue({
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'Config search',
+            parameters: {},
+          },
+        },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res: {},
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(mockGetServerConfig).not.toHaveBeenCalled();
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ url: 'https://config.example.com/mcp' }),
+      );
+    });
   });
 
   describe('loadAgentTools (definitionsOnly=false) — action tool filtering', () => {
@@ -300,6 +965,29 @@ describe('ToolService - Action Capability Gating', () => {
     const actionToolName = `get_weather${actionDelimiter}api_example_com`;
     const regularTool = Tools.web_search;
 
+    it('does not load code execution tools that were not registered for the agent', async () => {
+      const capabilities = [
+        AgentCapabilities.tools,
+        AgentCapabilities.web_search,
+        AgentCapabilities.execute_code,
+      ];
+      const req = createMockReq(capabilities);
+      const toolRegistry = new Map([[Tools.web_search, { name: Tools.web_search }]]);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+
+      const result = await loadToolsForExecution({
+        req,
+        res: {},
+        agent: { id: 'agent_without_code', tools: [Tools.web_search] },
+        toolNames: [AgentConstants.BASH_TOOL, Tools.execute_code],
+        toolRegistry,
+        actionsEnabled: false,
+      });
+
+      expect(result.loadedTools.map((tool) => tool.name)).toEqual([]);
+      expect(mockLoadToolsUtil).not.toHaveBeenCalled();
+    });
+
     it('loads bash PTC under the legacy programmatic tool name when code capabilities are enabled', async () => {
       const capabilities = [
         AgentCapabilities.tools,
@@ -326,6 +1014,49 @@ describe('ToolService - Action Capability Gating', () => {
       expect(result.configurable.ptcToolMap.size).toBe(0);
     });
 
+    it('passes run-scoped MCP tool definitions into PTC execution loading', async () => {
+      const capabilities = [
+        AgentCapabilities.tools,
+        AgentCapabilities.programmatic_tools,
+        AgentCapabilities.execute_code,
+      ];
+      const req = createMockReq(capabilities);
+      const serverName = 'ClickHouse';
+      const mcpTool = `list_tables${Constants.mcp_delimiter}${serverName}`;
+      const mcpAvailableTools = {
+        [serverName]: {
+          [mcpTool]: {
+            function: {
+              name: mcpTool,
+              description: 'List tables',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      };
+      const toolRegistry = new Map([[mcpTool, { name: mcpTool }]]);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+
+      await loadToolsForExecution({
+        req,
+        res: {},
+        agent: { id: 'agent_ptc', tools: [Tools.execute_code] },
+        toolNames: [Constants.BASH_PROGRAMMATIC_TOOL_CALLING],
+        toolRegistry,
+        mcpAvailableTools,
+        actionsEnabled: false,
+      });
+
+      expect(mockLoadToolsUtil).toHaveBeenCalledWith(
+        expect.objectContaining({
+          tools: [mcpTool],
+          options: expect.objectContaining({
+            mcpAvailableTools,
+          }),
+        }),
+      );
+    });
+
     it('does not load PTC when programmatic tools capability is disabled', async () => {
       const capabilities = [AgentCapabilities.tools, AgentCapabilities.execute_code];
       const req = createMockReq(capabilities);
diff --git a/api/server/services/initializeMCPs.js b/api/server/services/initializeMCPs.js
index be52b6e6ede..e3b35a6e867 100644
--- a/api/server/services/initializeMCPs.js
+++ b/api/server/services/initializeMCPs.js
@@ -3,6 +3,21 @@ const { logger } = require('@librechat/data-schemas');
 const { mergeAppTools, getAppConfig } = require('./Config');
 const { createMCPServersRegistry, createMCPManager } = require('~/config');
 
+/**
+ * Resolves the current request's effective MCP allowlists from the merged (tenant-scoped)
+ * config. The registry calls this per inspection/connection so admin-panel `mcpSettings`
+ * overrides are honored without a restart. Tenant comes from the ALS context inside
+ * `getAppConfig`; `userId`/`role` pick up user/role-scoped overrides when an actor exists.
+ * @param {{ userId?: string, role?: string }} [ctx]
+ */
+async function resolveMCPAllowlists(ctx) {
+  const appConfig = await getAppConfig({ role: ctx?.role, userId: ctx?.userId });
+  return {
+    allowedDomains: appConfig?.mcpSettings?.allowedDomains,
+    allowedAddresses: appConfig?.mcpSettings?.allowedAddresses,
+  };
+}
+
 /**
  * Initialize MCP servers
  */
@@ -15,6 +30,7 @@ async function initializeMCPs() {
       mongoose,
       appConfig?.mcpSettings?.allowedDomains,
       appConfig?.mcpSettings?.allowedAddresses,
+      resolveMCPAllowlists,
     );
   } catch (error) {
     logger.error('[MCP] Failed to initialize MCPServersRegistry:', error);
diff --git a/api/server/services/initializeMCPs.spec.js b/api/server/services/initializeMCPs.spec.js
index c62b85ae1b2..fe0766343c7 100644
--- a/api/server/services/initializeMCPs.spec.js
+++ b/api/server/services/initializeMCPs.spec.js
@@ -82,6 +82,7 @@ describe('initializeMCPs', () => {
         expect.anything(), // mongoose
         ['localhost'],
         undefined,
+        expect.any(Function), // per-request allowlist resolver
       );
     });
 
@@ -98,6 +99,7 @@ describe('initializeMCPs', () => {
         expect.anything(),
         allowedDomains,
         undefined,
+        expect.any(Function),
       );
     });
 
@@ -113,9 +115,34 @@ describe('initializeMCPs', () => {
         expect.anything(),
         undefined,
         undefined,
+        expect.any(Function),
       );
     });
 
+    it('wires a per-request resolver that reads the merged (non-baseOnly) config', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        mcpConfig: null,
+        mcpSettings: { allowedDomains: ['yaml.com'] },
+      });
+
+      await initializeMCPs();
+
+      const resolver = mockCreateMCPServersRegistry.mock.calls[0][3];
+      expect(typeof resolver).toBe('function');
+
+      // The resolver resolves the request's merged allowlists — not the boot YAML base.
+      mockGetAppConfig.mockResolvedValue({
+        mcpSettings: { allowedDomains: ['merged.com'], allowedAddresses: ['10.0.0.0/8'] },
+      });
+      const resolved = await resolver({ userId: 'u1', role: 'ADMIN' });
+
+      expect(mockGetAppConfig).toHaveBeenLastCalledWith({ role: 'ADMIN', userId: 'u1' });
+      expect(resolved).toEqual({
+        allowedDomains: ['merged.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+      });
+    });
+
     it('should throw and log error if MCPServersRegistry initialization fails', async () => {
       const registryError = new Error('Registry initialization failed');
       mockCreateMCPServersRegistry.mockImplementation(() => {
diff --git a/api/server/socialLogins.js b/api/server/socialLogins.js
index dfb03b4d37d..f4d088e6d03 100644
--- a/api/server/socialLogins.js
+++ b/api/server/socialLogins.js
@@ -1,7 +1,7 @@
 const passport = require('passport');
 const session = require('express-session');
 const { CacheKeys } = require('librechat-data-provider');
-const { isEnabled, shouldUseSecureCookie } = require('@librechat/api');
+const { math, isEnabled, shouldUseSecureCookie } = require('@librechat/api');
 const { logger, DEFAULT_SESSION_EXPIRY } = require('@librechat/data-schemas');
 const {
   openIdJwtLogin,
@@ -20,6 +20,23 @@ const {
 } = require('~/strategies');
 const { getLogStores } = require('~/cache');
 
+const DEFAULT_OPENID_REUSE_MAX_SESSION_AGE_MS = 15 * 60 * 1000;
+
+const getSessionExpiry = () => math(process.env.SESSION_EXPIRY, DEFAULT_SESSION_EXPIRY);
+
+const getOpenIdSessionExpiry = () => {
+  const sessionExpiry = getSessionExpiry();
+  if (!isEnabled(process.env.OPENID_REUSE_TOKENS)) {
+    return sessionExpiry;
+  }
+
+  const reuseMaxSessionAge = math(
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS,
+    DEFAULT_OPENID_REUSE_MAX_SESSION_AGE_MS,
+  );
+  return Math.max(sessionExpiry, reuseMaxSessionAge);
+};
+
 /**
  * Configures OpenID Connect for the application.
  * @param {Express.Application} app - The Express application instance.
@@ -27,7 +44,7 @@ const { getLogStores } = require('~/cache');
  */
 async function configureOpenId(app) {
   logger.info('Configuring OpenID Connect...');
-  const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
+  const sessionExpiry = getOpenIdSessionExpiry();
   const sessionOptions = {
     secret: process.env.OPENID_SESSION_SECRET,
     resave: false,
@@ -83,7 +100,7 @@ const configureSocialLogins = async (app) => {
   }
   if (
     process.env.OPENID_CLIENT_ID &&
-    process.env.OPENID_CLIENT_SECRET &&
+    (isEnabled(process.env.OPENID_USE_PKCE) || process.env.OPENID_CLIENT_SECRET?.trim()) &&
     process.env.OPENID_ISSUER &&
     process.env.OPENID_SCOPE &&
     process.env.OPENID_SESSION_SECRET
@@ -97,7 +114,7 @@ const configureSocialLogins = async (app) => {
     process.env.SAML_SESSION_SECRET
   ) {
     logger.info('Configuring SAML Connect...');
-    const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
+    const sessionExpiry = getSessionExpiry();
     const sessionOptions = {
       secret: process.env.SAML_SESSION_SECRET,
       resave: false,
diff --git a/api/server/socialLogins.spec.js b/api/server/socialLogins.spec.js
new file mode 100644
index 00000000000..bf016a43ebb
--- /dev/null
+++ b/api/server/socialLogins.spec.js
@@ -0,0 +1,143 @@
+const mockSessionMiddleware = jest.fn((req, res, next) => next());
+const mockPassportSessionMiddleware = jest.fn((req, res, next) => next());
+const mockSession = jest.fn(() => mockSessionMiddleware);
+const mockPassportUse = jest.fn();
+const mockPassportSession = jest.fn(() => mockPassportSessionMiddleware);
+const mockGetLogStores = jest.fn(() => 'openid-session-store');
+const mockOpenIdJwtLogin = jest.fn(() => 'openid-jwt-strategy');
+const mockSetupOpenId = jest.fn();
+const mockSetupSaml = jest.fn();
+const mockIsEnabled = jest.fn();
+const mockShouldUseSecureCookie = jest.fn(() => true);
+const mockMath = jest.fn((value, fallback) => {
+  if (value == null || value === '') {
+    return fallback;
+  }
+  if (typeof value === 'number') {
+    return value;
+  }
+  return value
+    .split('*')
+    .map((part) => Number(part.trim()))
+    .reduce((result, part) => result * part, 1);
+});
+
+jest.mock(
+  'express-session',
+  () =>
+    (...args) =>
+      mockSession(...args),
+);
+jest.mock('passport', () => ({
+  use: (...args) => mockPassportUse(...args),
+  session: (...args) => mockPassportSession(...args),
+}));
+jest.mock('librechat-data-provider', () => ({
+  CacheKeys: {
+    OPENID_SESSION: 'openid-session',
+    SAML_SESSION: 'saml-session',
+  },
+}));
+jest.mock('@librechat/api', () => ({
+  math: (...args) => mockMath(...args),
+  isEnabled: (...args) => mockIsEnabled(...args),
+  shouldUseSecureCookie: (...args) => mockShouldUseSecureCookie(...args),
+}));
+jest.mock('@librechat/data-schemas', () => ({
+  DEFAULT_SESSION_EXPIRY: 900000,
+  logger: { error: jest.fn(), info: jest.fn() },
+}));
+jest.mock('~/cache', () => ({ getLogStores: (...args) => mockGetLogStores(...args) }));
+jest.mock('~/strategies', () => ({
+  openIdJwtLogin: (...args) => mockOpenIdJwtLogin(...args),
+  facebookLogin: jest.fn(),
+  facebookAdminLogin: jest.fn(),
+  discordLogin: jest.fn(),
+  discordAdminLogin: jest.fn(),
+  setupOpenId: (...args) => mockSetupOpenId(...args),
+  googleLogin: jest.fn(),
+  googleAdminLogin: jest.fn(),
+  githubLogin: jest.fn(),
+  githubAdminLogin: jest.fn(),
+  appleLogin: jest.fn(),
+  appleAdminLogin: jest.fn(),
+  setupSaml: (...args) => mockSetupSaml(...args),
+}));
+
+const configureSocialLogins = require('./socialLogins');
+
+describe('configureSocialLogins OpenID session expiry', () => {
+  const ORIGINAL_ENV = process.env;
+
+  const setupOpenIdEnv = () => {
+    process.env.OPENID_CLIENT_ID = 'client-id';
+    process.env.OPENID_CLIENT_SECRET = 'client-secret';
+    process.env.OPENID_ISSUER = 'https://issuer.example.com';
+    process.env.OPENID_SCOPE = 'openid profile email';
+    process.env.OPENID_SESSION_SECRET = 'openid-session-secret';
+    process.env.OPENID_USE_PKCE = 'false';
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = {};
+    setupOpenIdEnv();
+    mockSetupOpenId.mockResolvedValue({ issuer: 'https://issuer.example.com' });
+    mockIsEnabled.mockImplementation((value) => value === 'true');
+  });
+
+  afterAll(() => {
+    process.env = ORIGINAL_ENV;
+  });
+
+  it('extends the OpenID session cookie to the reuse window when token reuse is enabled', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 15';
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: {
+          maxAge: 3600000,
+          secure: true,
+        },
+      }),
+    );
+    expect(mockOpenIdJwtLogin).toHaveBeenCalledWith({ issuer: 'https://issuer.example.com' });
+    expect(mockPassportUse).toHaveBeenCalledWith('openidJwt', 'openid-jwt-strategy');
+  });
+
+  it('keeps a longer SESSION_EXPIRY when the reuse window is shorter', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 60 * 2';
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: expect.objectContaining({ maxAge: 7200000 }),
+      }),
+    );
+  });
+
+  it('uses SESSION_EXPIRY when OpenID token reuse is disabled', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 15';
+    process.env.OPENID_REUSE_TOKENS = '';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: expect.objectContaining({ maxAge: 900000 }),
+      }),
+    );
+    expect(mockPassportUse).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/telemetry.js b/api/server/telemetry.js
new file mode 100644
index 00000000000..cb0058355b0
--- /dev/null
+++ b/api/server/telemetry.js
@@ -0,0 +1,40 @@
+require('dotenv').config();
+
+function isTruthy(value) {
+  return value?.trim().toLowerCase() === 'true';
+}
+
+function isTelemetryEnabled() {
+  return isTruthy(process.env.OTEL_TRACING_ENABLED) && !isTruthy(process.env.OTEL_SDK_DISABLED);
+}
+
+if (isTelemetryEnabled()) {
+  const {
+    initializeTelemetry,
+    telemetryMiddleware,
+    telemetryErrorMiddleware,
+  } = require('@librechat/api/telemetry');
+  const controller = initializeTelemetry();
+
+  module.exports = {
+    get enabled() {
+      return controller.enabled;
+    },
+    get status() {
+      return controller.status;
+    },
+    shutdown: controller.shutdown,
+    telemetryMiddleware,
+    telemetryErrorMiddleware,
+  };
+} else {
+  module.exports = {
+    enabled: false,
+    get status() {
+      return 'disabled';
+    },
+    shutdown: async () => {},
+    telemetryMiddleware: (_req, _res, next) => next(),
+    telemetryErrorMiddleware: (err, _req, _res, next) => next(err),
+  };
+}
diff --git a/api/server/telemetry.spec.js b/api/server/telemetry.spec.js
new file mode 100644
index 00000000000..8f848da8e76
--- /dev/null
+++ b/api/server/telemetry.spec.js
@@ -0,0 +1,91 @@
+describe('telemetry bootstrap', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...originalEnv };
+    delete process.env.OTEL_SDK_DISABLED;
+    delete process.env.OTEL_TRACING_ENABLED;
+    jest.doMock('dotenv', () => ({
+      config: jest.fn(),
+    }));
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    jest.dontMock('dotenv');
+    jest.dontMock('@librechat/api/telemetry');
+    jest.resetModules();
+  });
+
+  it('does not load OpenTelemetry packages by default', () => {
+    jest.doMock(
+      '@librechat/api/telemetry',
+      () => {
+        throw new Error('telemetry package should not load when tracing is disabled');
+      },
+      { virtual: true },
+    );
+
+    const telemetry = require('./telemetry');
+
+    expect(telemetry.enabled).toBe(false);
+    expect(telemetry.status).toBe('disabled');
+  });
+
+  it('does not load OpenTelemetry packages when the SDK is disabled', () => {
+    process.env.OTEL_SDK_DISABLED = 'true';
+    process.env.OTEL_TRACING_ENABLED = 'true';
+    jest.doMock(
+      '@librechat/api/telemetry',
+      () => {
+        throw new Error('telemetry package should not load when the SDK is disabled');
+      },
+      { virtual: true },
+    );
+
+    const telemetry = require('./telemetry');
+
+    expect(telemetry.enabled).toBe(false);
+    expect(telemetry.status).toBe('disabled');
+  });
+
+  it('loads and exposes telemetry middleware when tracing is enabled', () => {
+    process.env.OTEL_TRACING_ENABLED = 'true';
+    let enabled = true;
+    let status = 'starting';
+    const telemetryMiddleware = jest.fn();
+    const telemetryErrorMiddleware = jest.fn();
+    const initializeTelemetry = jest.fn(() => ({
+      get enabled() {
+        return enabled;
+      },
+      get status() {
+        return status;
+      },
+      shutdown: jest.fn(),
+    }));
+    jest.doMock(
+      '@librechat/api/telemetry',
+      () => ({
+        initializeTelemetry,
+        telemetryMiddleware,
+        telemetryErrorMiddleware,
+      }),
+      { virtual: true },
+    );
+
+    const telemetry = require('./telemetry');
+
+    expect(initializeTelemetry).toHaveBeenCalledTimes(1);
+    expect(telemetry.enabled).toBe(true);
+    expect(telemetry.status).toBe('starting');
+    expect(telemetry.telemetryMiddleware).toBe(telemetryMiddleware);
+    expect(telemetry.telemetryErrorMiddleware).toBe(telemetryErrorMiddleware);
+
+    enabled = false;
+    status = 'failed';
+    expect(telemetry.enabled).toBe(false);
+    expect(telemetry.status).toBe('failed');
+  });
+});
diff --git a/api/server/utils/__tests__/staticCache.spec.js b/api/server/utils/__tests__/staticCache.spec.js
index 5d285017bd4..2b22223393c 100644
--- a/api/server/utils/__tests__/staticCache.spec.js
+++ b/api/server/utils/__tests__/staticCache.spec.js
@@ -5,6 +5,12 @@ const request = require('supertest');
 const zlib = require('zlib');
 const staticCache = require('../staticCache');
 
+const binaryParser = (res, callback) => {
+  const chunks = [];
+  res.on('data', (chunk) => chunks.push(chunk));
+  res.on('end', () => callback(null, Buffer.concat(chunks)));
+};
+
 describe('staticCache', () => {
   let app;
   let testDir;
@@ -36,10 +42,15 @@ describe('staticCache', () => {
     fs.writeFileSync(manifestFile, jsonContent);
     fs.writeFileSync(swFile, swContent);
 
-    // Create gzipped versions of some files
+    // Create precompressed versions of some files
     fs.writeFileSync(testFile + '.gz', zlib.gzipSync(jsContent));
+    fs.writeFileSync(testFile + '.br', zlib.brotliCompressSync(jsContent));
     fs.writeFileSync(path.join(testDir, 'test.css'), 'body { color: red; }');
     fs.writeFileSync(path.join(testDir, 'test.css.gz'), zlib.gzipSync('body { color: red; }'));
+    fs.writeFileSync(
+      path.join(testDir, 'test.css.br'),
+      zlib.brotliCompressSync('body { color: red; }'),
+    );
 
     // Create a file that only exists in gzipped form
     fs.writeFileSync(
@@ -67,6 +78,7 @@ describe('staticCache', () => {
     delete process.env.NODE_ENV;
     delete process.env.STATIC_CACHE_S_MAX_AGE;
     delete process.env.STATIC_CACHE_MAX_AGE;
+    delete process.env.ENABLE_STATIC_ASSET_BROTLI;
   });
   describe('cache headers in production', () => {
     beforeEach(() => {
@@ -193,6 +205,51 @@ describe('staticCache', () => {
       process.env.NODE_ENV = 'production';
     });
 
+    it('should serve Brotli files when client accepts Brotli encoding', async () => {
+      process.env.ENABLE_STATIC_ASSET_BROTLI = 'true';
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.js')
+        .set('Accept-Encoding', 'br, gzip, deflate')
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('br');
+      expect(response.headers['content-type']).toMatch(/javascript/);
+      expect(response.headers['cache-control']).toBe('public, max-age=172800, s-maxage=86400');
+      expect(zlib.brotliDecompressSync(response.body).toString()).toBe('console.log("test");');
+    });
+
+    it('should prefer Brotli over gzip when both encodings are accepted', async () => {
+      process.env.ENABLE_STATIC_ASSET_BROTLI = 'true';
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.css')
+        .set('Accept-Encoding', 'gzip, br')
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('br');
+      expect(response.headers['content-type']).toMatch(/css/);
+      expect(zlib.brotliDecompressSync(response.body).toString()).toBe('body { color: red; }');
+    });
+
+    it('should keep serving gzip when Brotli is not enabled', async () => {
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.js')
+        .set('Accept-Encoding', 'br, gzip, deflate')
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('gzip');
+      expect(response.text).toBe('console.log("test");');
+    });
+
     it('should serve gzipped files when client accepts gzip encoding', async () => {
       app.use(staticCache(testDir, { skipGzipScan: false }));
 
diff --git a/api/server/utils/fallback.js b/api/server/utils/fallback.js
new file mode 100644
index 00000000000..3e067ab9caf
--- /dev/null
+++ b/api/server/utils/fallback.js
@@ -0,0 +1,20 @@
+/** Static asset extensions that must 404 when missing — serving the SPA's
+ * index.html for them breaks strict MIME checks and poisons SW/browser caches. */
+const STATIC_ASSET_EXT =
+  /\.(?:js|mjs|css|map|json|wasm|webmanifest|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|otf|eot)$/i;
+
+/**
+ * Creates the SPA fallback middleware: serves index.html for unmatched
+ * routes while returning 404 for missing static assets.
+ * @param {(req: import('express').Request, res: import('express').Response) => void} sendIndexHtml
+ */
+function createSpaFallback(sendIndexHtml) {
+  return (req, res) => {
+    if (STATIC_ASSET_EXT.test(req.path)) {
+      return res.status(404).end();
+    }
+    return sendIndexHtml(req, res);
+  };
+}
+
+module.exports = createSpaFallback;
diff --git a/api/server/utils/import/importBatchBuilder.js b/api/server/utils/import/importBatchBuilder.js
index be47cd3692b..b1856737cdf 100644
--- a/api/server/utils/import/importBatchBuilder.js
+++ b/api/server/utils/import/importBatchBuilder.js
@@ -1,16 +1,26 @@
 const { v4: uuidv4 } = require('uuid');
-const { logger } = require('@librechat/data-schemas');
-const { EModelEndpoint, Constants, openAISettings } = require('librechat-data-provider');
+const {
+  logger,
+  createFallbackRetentionDate,
+  createTempChatExpirationDate,
+} = require('@librechat/data-schemas');
+const {
+  EModelEndpoint,
+  Constants,
+  RetentionMode,
+  openAISettings,
+} = require('librechat-data-provider');
 const { bulkIncrementTagCounts, bulkSaveConvos, bulkSaveMessages } = require('~/models');
 const { FALLBACK_MODEL_BY_ENDPOINT } = require('./defaults');
 
 /**
  * Factory function for creating an instance of ImportBatchBuilder.
  * @param {string} requestUserId - The ID of the user making the request.
+ * @param {object} [interfaceConfig] - Runtime interface config for import retention.
  * @returns {ImportBatchBuilder} - The newly created ImportBatchBuilder instance.
  */
-function createImportBatchBuilder(requestUserId) {
-  return new ImportBatchBuilder(requestUserId);
+function createImportBatchBuilder(requestUserId, interfaceConfig) {
+  return new ImportBatchBuilder(requestUserId, interfaceConfig);
 }
 
 /**
@@ -20,11 +30,36 @@ class ImportBatchBuilder {
   /**
    * Creates an instance of ImportBatchBuilder.
    * @param {string} requestUserId - The ID of the user making the import request.
+   * @param {object} [interfaceConfig] - Runtime interface config for import retention.
    */
-  constructor(requestUserId) {
+  constructor(requestUserId, interfaceConfig) {
     this.requestUserId = requestUserId;
+    this.interfaceConfig = interfaceConfig;
     this.conversations = [];
     this.messages = [];
+    this.retentionFields = undefined;
+  }
+
+  getRetentionFields() {
+    if (this.retentionFields !== undefined) {
+      return this.retentionFields;
+    }
+
+    if (this.interfaceConfig?.retentionMode !== RetentionMode.ALL) {
+      this.retentionFields = {};
+      return this.retentionFields;
+    }
+
+    try {
+      this.retentionFields = {
+        isTemporary: false,
+        expiredAt: createTempChatExpirationDate(this.interfaceConfig),
+      };
+    } catch (error) {
+      logger.error('[ImportBatchBuilder] Error creating import expiration date:', error);
+      this.retentionFields = { isTemporary: false, expiredAt: createFallbackRetentionDate() };
+    }
+    return this.retentionFields;
   }
 
   /**
@@ -89,6 +124,7 @@ class ImportBatchBuilder {
       overrideTimestamp: true,
       endpoint: this.endpoint,
       model: originalConvo.model ?? fallbackModel,
+      ...this.getRetentionFields(),
     };
     convo._id && delete convo._id;
     this.conversations.push(convo);
@@ -161,6 +197,7 @@ class ImportBatchBuilder {
       error: false,
       sender,
       text,
+      ...this.getRetentionFields(),
     };
     message._id && delete message._id;
     this.lastMessageId = newMessageId;
diff --git a/api/server/utils/import/importConversations.js b/api/server/utils/import/importConversations.js
index ad2d743f019..21bba86e3a7 100644
--- a/api/server/utils/import/importConversations.js
+++ b/api/server/utils/import/importConversations.js
@@ -2,15 +2,16 @@ const fs = require('fs').promises;
 const { resolveImportMaxFileSize } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const { getImporter } = require('./importers');
+const { createImportBatchBuilder } = require('./importBatchBuilder');
 
 const maxFileSize = resolveImportMaxFileSize();
 
 /**
  * Job definition for importing a conversation.
- * @param {{ filepath: string, requestUserId: string, userRole?: string }} job
+ * @param {{ filepath: string, requestUserId: string, userRole?: string, interfaceConfig?: object }} job
  */
 const importConversations = async (job) => {
-  const { filepath, requestUserId, userRole } = job;
+  const { filepath, requestUserId, userRole, interfaceConfig } = job;
   try {
     logger.debug(`user: ${requestUserId} | Importing conversation(s) from file...`);
 
@@ -24,7 +25,12 @@ const importConversations = async (job) => {
     const fileData = await fs.readFile(filepath, 'utf8');
     const jsonData = JSON.parse(fileData);
     const importer = getImporter(jsonData);
-    await importer(jsonData, requestUserId, undefined, userRole);
+    await importer(
+      jsonData,
+      requestUserId,
+      (userId) => createImportBatchBuilder(userId, interfaceConfig),
+      userRole,
+    );
     logger.debug(`user: ${requestUserId} | Finished importing conversations`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Failed to import conversation: `, error);
diff --git a/api/server/utils/import/importers-timestamp.spec.js b/api/server/utils/import/importers-timestamp.spec.js
index e12c099abb8..268cc74c0d8 100644
--- a/api/server/utils/import/importers-timestamp.spec.js
+++ b/api/server/utils/import/importers-timestamp.spec.js
@@ -7,6 +7,7 @@ const { getImporter } = require('./importers');
 jest.mock('~/models', () => ({
   bulkSaveConvos: jest.fn(),
   bulkSaveMessages: jest.fn(),
+  bulkIncrementTagCounts: jest.fn(),
 }));
 
 const mockGetEndpointsConfig = jest.fn().mockResolvedValue(null);
diff --git a/api/server/utils/import/importers.js b/api/server/utils/import/importers.js
index b86be3798e0..435572d65a3 100644
--- a/api/server/utils/import/importers.js
+++ b/api/server/utils/import/importers.js
@@ -22,8 +22,11 @@ function getImporter(jsonData) {
       return importClaudeConvo;
     }
     // ChatGPT format has mapping object in each conversation
-    logger.info('Importing ChatGPT conversation');
-    return importChatGptConvo;
+    if (jsonData.length === 0 || jsonData[0]?.mapping) {
+      logger.info('Importing ChatGPT conversation');
+      return importChatGptConvo;
+    }
+    throw new Error('Unsupported import type');
   }
 
   // For ChatbotUI
@@ -81,6 +84,7 @@ async function importChatBotUiConvo(
     logger.info(`user: ${requestUserId} | ChatbotUI conversation imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from ChatbotUI file`, error);
+    throw error;
   }
 }
 
@@ -197,6 +201,7 @@ async function importClaudeConvo(
     logger.info(`user: ${requestUserId} | Claude conversation imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from Claude file`, error);
+    throw error;
   }
 }
 
@@ -305,6 +310,7 @@ async function importLibreChatConvo(
     logger.debug(`user: ${requestUserId} | Conversation "${jsonData.title}" imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from LibreChat file`, error);
+    throw error;
   }
 }
 
@@ -336,6 +342,7 @@ async function importChatGptConvo(
     await importBatchBuilder.saveBatch();
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from imported file`, error);
+    throw error;
   }
 }
 
@@ -355,7 +362,7 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
   // Map all message IDs to new UUIDs
   const messageMap = new Map();
   for (const [id, mapping] of Object.entries(conv.mapping)) {
-    if (mapping.message && mapping.message.content.content_type) {
+    if (mapping.message?.content?.content_type) {
       const newMessageId = uuidv4();
       messageMap.set(id, newMessageId);
     }
@@ -467,6 +474,9 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
     }
 
     const newMessageId = messageMap.get(id);
+    if (!newMessageId) {
+      continue;
+    }
     const parentMessageId = findValidParent(mapping.parent);
 
     const messageText = formatMessageText(mapping.message);
@@ -474,7 +484,7 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
     const isCreatedByUser = role === 'user';
     let sender = isCreatedByUser ? 'user' : 'assistant';
     const model =
-      mapping.message.metadata.model_slug || defaultModel || openAISettings.model.default;
+      mapping.message.metadata?.model_slug || defaultModel || openAISettings.model.default;
 
     if (!isCreatedByUser) {
       /** Extracted model name from model slug */
@@ -598,7 +608,7 @@ function formatMessageText(messageData) {
     messageText = `\`\`\`json\n${JSON.stringify(messageData.content, null, 2)}\n\`\`\``;
   }
 
-  if (isText && messageData.author.role !== 'user') {
+  if (isText && messageData.author?.role !== 'user') {
     messageText = processAssistantMessage(messageData, messageText);
   }
 
diff --git a/api/server/utils/import/importers.spec.js b/api/server/utils/import/importers.spec.js
index cbd39afb341..a9bd679f55f 100644
--- a/api/server/utils/import/importers.spec.js
+++ b/api/server/utils/import/importers.spec.js
@@ -3,6 +3,7 @@ const path = require('path');
 const {
   EModelEndpoint,
   Constants,
+  RetentionMode,
   openAISettings,
   anthropicSettings,
 } = require('librechat-data-provider');
@@ -28,6 +29,7 @@ jest.mock('~/server/controllers/ModelController', () => ({
 jest.mock('~/models', () => ({
   bulkSaveConvos: jest.fn(),
   bulkSaveMessages: jest.fn(),
+  bulkIncrementTagCounts: jest.fn(),
 }));
 
 afterEach(() => {
@@ -762,6 +764,86 @@ describe('importChatGptConvo', () => {
     expect(userMsg.createdAt).toEqual(new Date(1000 * 1000));
     expect(assistantMsg.createdAt).toEqual(new Date(2000 * 1000));
   });
+
+  it('should import messages missing metadata without failing (newer ChatGPT exports)', async () => {
+    const testData = [
+      {
+        title: 'Missing Metadata Test',
+        create_time: 1714585031.148505,
+        update_time: 1714585060.879308,
+        mapping: {
+          'root-node': {
+            id: 'root-node',
+            message: null,
+            parent: null,
+            children: ['user-msg-1'],
+          },
+          'user-msg-1': {
+            id: 'user-msg-1',
+            message: {
+              id: 'user-msg-1',
+              author: { role: 'user' },
+              create_time: 1714585031.150442,
+              content: { content_type: 'text', parts: ['User message without metadata'] },
+            },
+            parent: 'root-node',
+            children: ['assistant-msg-1'],
+          },
+          'assistant-msg-1': {
+            id: 'assistant-msg-1',
+            message: {
+              id: 'assistant-msg-1',
+              author: { role: 'assistant' },
+              create_time: 1714585032.150442,
+              content: { content_type: 'text', parts: ['Assistant response without metadata'] },
+            },
+            parent: 'user-msg-1',
+            children: ['no-content-msg'],
+          },
+          'no-content-msg': {
+            id: 'no-content-msg',
+            message: {
+              id: 'no-content-msg',
+              author: { role: 'tool' },
+              create_time: 1714585033.150442,
+            },
+            parent: 'assistant-msg-1',
+            children: [],
+          },
+        },
+      },
+    ];
+
+    const requestUserId = 'user-123';
+    const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+    jest.spyOn(importBatchBuilder, 'saveMessage');
+
+    const importer = getImporter(testData);
+    await importer(testData, requestUserId, () => importBatchBuilder);
+
+    const savedMessages = importBatchBuilder.saveMessage.mock.calls.map((call) => call[0]);
+    expect(savedMessages).toHaveLength(2);
+
+    const userMessage = savedMessages.find((msg) => msg.isCreatedByUser);
+    const assistantMessage = savedMessages.find((msg) => !msg.isCreatedByUser);
+    expect(userMessage.model).toBe(openAISettings.model.default);
+    expect(assistantMessage.model).toBe(openAISettings.model.default);
+    expect(assistantMessage.parentMessageId).toBe(userMessage.messageId);
+  });
+
+  it('should rethrow errors so failed imports are not reported as successful', async () => {
+    const jsonData = JSON.parse(
+      fs.readFileSync(path.join(__dirname, '__data__', 'chatgpt-export.json'), 'utf8'),
+    );
+    const requestUserId = 'user-123';
+    const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+    jest.spyOn(importBatchBuilder, 'saveBatch').mockRejectedValue(new Error('db unavailable'));
+
+    const importer = getImporter(jsonData);
+    await expect(importer(jsonData, requestUserId, () => importBatchBuilder)).rejects.toThrow(
+      'db unavailable',
+    );
+  });
 });
 
 describe('importLibreChatConvo', () => {
@@ -1046,6 +1128,23 @@ describe('importLibreChatConvo', () => {
       expect(result.conversation.endpoint).toBe(EModelEndpoint.openAI);
       expect(result.conversation.model).toBe(openAISettings.model.default);
     });
+
+    it('applies all-data retention to imported conversations and messages', () => {
+      const requestUserId = 'user-123';
+      const builder = new ImportBatchBuilder(requestUserId, {
+        retentionMode: RetentionMode.ALL,
+        temporaryChatRetention: 24,
+      });
+      builder.startConversation(EModelEndpoint.openAI);
+      const message = builder.addUserMessage('Retained import');
+      const result = builder.finishConversation('Imported retained chat');
+
+      expect(message.isTemporary).toBe(false);
+      expect(message.expiredAt).toBeInstanceOf(Date);
+      expect(result.conversation.isTemporary).toBe(false);
+      expect(result.conversation.expiredAt).toBeInstanceOf(Date);
+      expect(result.conversation.expiredAt).toBe(message.expiredAt);
+    });
   });
 });
 
@@ -1116,6 +1215,17 @@ describe('getImporter', () => {
     const jsonData = { unsupported: 'data' };
     expect(() => getImporter(jsonData)).toThrow('Unsupported import type');
   });
+
+  it('should throw for array-based files that are not ChatGPT or Claude exports', () => {
+    const openWebUiExport = [
+      { id: 'abc', title: 'Open WebUI Chat', chat: { history: { messages: {} } } },
+    ];
+    expect(() => getImporter(openWebUiExport)).toThrow('Unsupported import type');
+  });
+
+  it('should route empty arrays to the ChatGPT importer without throwing', () => {
+    expect(() => getImporter([])).not.toThrow();
+  });
 });
 
 describe('processAssistantMessage', () => {
diff --git a/api/server/utils/staticCache.js b/api/server/utils/staticCache.js
index ecaea856d0a..a16830a56c8 100644
--- a/api/server/utils/staticCache.js
+++ b/api/server/utils/staticCache.js
@@ -6,9 +6,10 @@ const oneDayInSeconds = 24 * 60 * 60;
 
 const sMaxAge = process.env.STATIC_CACHE_S_MAX_AGE || oneDayInSeconds;
 const maxAge = process.env.STATIC_CACHE_MAX_AGE || oneDayInSeconds * 2;
+const isEnabled = (value) => value === true || String(value).toLowerCase() === 'true';
 
 /**
- * Creates an Express static middleware with optional gzip compression and configurable caching
+ * Creates an Express static middleware with optional precompressed asset serving and configurable caching
  *
  * @param {string} staticPath - The file system path to serve static files from
  * @param {Object} [options={}] - Configuration options
@@ -18,6 +19,7 @@ const maxAge = process.env.STATIC_CACHE_MAX_AGE || oneDayInSeconds * 2;
  */
 function staticCache(staticPath, options = {}) {
   const { noCache = false, skipGzipScan = false } = options;
+  const enableBrotli = isEnabled(process.env.ENABLE_STATIC_ASSET_BROTLI);
 
   const setHeaders = (res, filePath) => {
     if (process.env.NODE_ENV?.toLowerCase() !== 'production') {
@@ -36,7 +38,8 @@ function staticCache(staticPath, options = {}) {
       fileName === 'index.html' ||
       fileName.endsWith('.webmanifest') ||
       fileName === 'manifest.json' ||
-      fileName === 'sw.js'
+      fileName === 'sw.js' ||
+      fileName === 'sw-heal.js'
     ) {
       res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
     } else {
@@ -51,8 +54,8 @@ function staticCache(staticPath, options = {}) {
     });
   } else {
     return expressStaticGzip(staticPath, {
-      enableBrotli: false,
-      orderPreference: ['gz'],
+      enableBrotli,
+      orderPreference: enableBrotli ? ['br', 'gz'] : ['gz'],
       setHeaders,
       index: false,
     });
diff --git a/api/strategies/openIdJwtStrategy.js b/api/strategies/openIdJwtStrategy.js
index 78145f1109b..14f50f3f042 100644
--- a/api/strategies/openIdJwtStrategy.js
+++ b/api/strategies/openIdJwtStrategy.js
@@ -1,7 +1,6 @@
 const cookies = require('cookie');
 const jwksRsa = require('jwks-rsa');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
 const { SystemRoles } = require('librechat-data-provider');
 const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
 const {
@@ -10,12 +9,17 @@ const {
   getOpenIdEmail,
   getOpenIdIssuer,
   normalizeOpenIdIssuer,
+  getHttpsProxyAgent,
   math,
 } = require('@librechat/api');
 const { updateUser, findUser } = require('~/models');
 
 const getOpenIdJwtAudience = () => {
-  const audiences = [process.env.OPENID_CLIENT_ID, process.env.OPENID_AUDIENCE].filter(Boolean);
+  const parsedAudience = (process.env.OPENID_AUDIENCE ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean);
+  const audiences = [process.env.OPENID_CLIENT_ID, ...parsedAudience].filter(Boolean);
   const uniqueAudiences = [...new Set(audiences)];
 
   return uniqueAudiences.length > 1 ? uniqueAudiences : uniqueAudiences[0];
@@ -69,8 +73,9 @@ const openIdJwtLogin = (openIdConfig) => {
     jwksUri: openIdConfig.serverMetadata().jwks_uri,
   };
 
-  if (process.env.PROXY) {
-    jwksRsaOptions.requestAgent = new HttpsProxyAgent(process.env.PROXY);
+  const requestAgent = getHttpsProxyAgent(jwksRsaOptions.jwksUri);
+  if (requestAgent) {
+    jwksRsaOptions.requestAgent = requestAgent;
   }
 
   return new JwtStrategy(
diff --git a/api/strategies/openIdJwtStrategy.spec.js b/api/strategies/openIdJwtStrategy.spec.js
index 59229a3d159..5b4bc86c495 100644
--- a/api/strategies/openIdJwtStrategy.spec.js
+++ b/api/strategies/openIdJwtStrategy.spec.js
@@ -28,6 +28,7 @@ jest.mock('@librechat/api', () => ({
   getOpenIdEmail: jest.requireActual('@librechat/api').getOpenIdEmail,
   getOpenIdIssuer: jest.fn(() => 'https://issuer.example.com'),
   normalizeOpenIdIssuer: jest.requireActual('@librechat/api').normalizeOpenIdIssuer,
+  getHttpsProxyAgent: jest.fn(() => undefined),
   math: jest.fn((val, fallback) => fallback),
 }));
 jest.mock('~/models', () => ({
@@ -119,6 +120,52 @@ describe('openIdJwtStrategy – token validation', () => {
     });
   });
 
+  it('uses a single OPENID_AUDIENCE value when no client ID is configured', () => {
+    withEnv({ OPENID_CLIENT_ID: undefined, OPENID_AUDIENCE: 'librechat' }, () => {
+      openIdJwtLogin(mockOpenIdConfig);
+    });
+
+    expect(capturedStrategyOptions.audience).toBe('librechat');
+  });
+
+  it('splits comma-separated OPENID_AUDIENCE values into multiple accepted audiences', () => {
+    withEnv({ OPENID_CLIENT_ID: undefined, OPENID_AUDIENCE: 'librechat,control-plane-web' }, () => {
+      openIdJwtLogin(mockOpenIdConfig);
+    });
+
+    expect(capturedStrategyOptions.audience).toEqual(['librechat', 'control-plane-web']);
+  });
+
+  it('trims whitespace around comma-separated OPENID_AUDIENCE values', () => {
+    withEnv(
+      { OPENID_CLIENT_ID: undefined, OPENID_AUDIENCE: ' librechat , control-plane-web ' },
+      () => {
+        openIdJwtLogin(mockOpenIdConfig);
+      },
+    );
+
+    expect(capturedStrategyOptions.audience).toEqual(['librechat', 'control-plane-web']);
+  });
+
+  it('falls back to OPENID_CLIENT_ID when OPENID_AUDIENCE is empty', () => {
+    withEnv({ OPENID_CLIENT_ID: 'client-id-only', OPENID_AUDIENCE: '' }, () => {
+      openIdJwtLogin(mockOpenIdConfig);
+    });
+
+    expect(capturedStrategyOptions.audience).toBe('client-id-only');
+  });
+
+  it('combines OPENID_CLIENT_ID with comma-separated OPENID_AUDIENCE values and deduplicates', () => {
+    withEnv(
+      { OPENID_CLIENT_ID: 'librechat', OPENID_AUDIENCE: 'librechat,control-plane-web' },
+      () => {
+        openIdJwtLogin(mockOpenIdConfig);
+      },
+    );
+
+    expect(capturedStrategyOptions.audience).toEqual(['librechat', 'control-plane-web']);
+  });
+
   it('rejects OpenID JWTs whose issuer does not match the configured issuer', async () => {
     findOpenIDUser.mockResolvedValue({ user: null, error: null, migration: false });
     openIdJwtLogin(mockOpenIdConfig);
@@ -339,7 +386,7 @@ describe('openIdJwtStrategy – OPENID_EMAIL_CLAIM', () => {
       role: SystemRoles.USER,
     };
     findUser.mockImplementation(async (query) => {
-      if (query.$or && query.$or.some((c) => c.openidId === payload.sub)) {
+      if (query.openidId === payload.sub && query.openidIssuer === 'https://issuer.example.com') {
         return existingUser;
       }
       return null;
@@ -348,13 +395,10 @@ describe('openIdJwtStrategy – OPENID_EMAIL_CLAIM', () => {
     const req = { headers: { authorization: 'Bearer tok' }, session: {} };
     await invokeVerify(req, payload);
 
-    expect(findUser).toHaveBeenCalledWith(
-      expect.objectContaining({
-        $or: expect.arrayContaining([
-          { openidId: payload.sub, openidIssuer: 'https://issuer.example.com' },
-        ]),
-      }),
-    );
+    expect(findUser).toHaveBeenCalledWith({
+      openidId: payload.sub,
+      openidIssuer: 'https://issuer.example.com',
+    });
   });
 
   it('should use OPENID_EMAIL_CLAIM when set for email lookup', async () => {
@@ -365,12 +409,13 @@ describe('openIdJwtStrategy – OPENID_EMAIL_CLAIM', () => {
     const { user } = await invokeVerify(req, payload);
 
     expect(findUser).toHaveBeenCalledTimes(2);
-    expect(findUser.mock.calls[0][0]).toMatchObject({
-      $or: expect.arrayContaining([
-        { openidId: payload.sub, openidIssuer: 'https://issuer.example.com' },
-      ]),
+    expect(findUser.mock.calls[0][0]).toEqual({
+      openidId: payload.sub,
+      openidIssuer: 'https://issuer.example.com',
+    });
+    expect(findUser.mock.calls[1][0]).toEqual({
+      email: 'test@corp.example.com',
     });
-    expect(findUser.mock.calls[1][0]).toEqual({ email: 'test@corp.example.com' });
     expect(user).toBe(false);
   });
 
diff --git a/api/strategies/openidStrategy.js b/api/strategies/openidStrategy.js
index 595c2b535a4..d9c2684314f 100644
--- a/api/strategies/openidStrategy.js
+++ b/api/strategies/openidStrategy.js
@@ -1,11 +1,9 @@
 const undici = require('undici');
 const { get } = require('lodash');
-const fetch = require('node-fetch');
 const passport = require('passport');
 const client = require('openid-client');
 const jwtDecode = require('jsonwebtoken/decode');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { hashToken, logger } = require('@librechat/data-schemas');
+const { hashToken, logger, tenantStorage } = require('@librechat/data-schemas');
 const { Strategy: OpenIDStrategy } = require('openid-client/passport');
 const { CacheKeys, ErrorTypes, SystemRoles } = require('librechat-data-provider');
 const {
@@ -16,13 +14,19 @@ const {
   getOpenIdEmail,
   getOpenIdIssuer,
   getBalanceConfig,
+  selectOpenIdRole,
+  getAvatarSaveParams,
   isEmailDomainAllowed,
   getAvatarFileStrategy,
-  getAvatarSaveParams,
   resolveAppConfigForUser,
+  getOpenIdProxyDispatcher,
+  getOpenIdRoleSyncOptions,
+  getOpenIdRolesForOpenIdSync,
+  getLibreChatRolesForOpenIdSync,
 } = require('@librechat/api');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
-const { findUser, createUser, updateUser } = require('~/models');
+const { resizeAvatar } = require('~/server/services/Files/images/avatar');
+const { findUser, createUser, updateUser, findRolesByNames } = require('~/models');
 const { getAppConfig } = require('~/server/services/Config');
 const getLogStores = require('~/cache/getLogStores');
 
@@ -58,11 +62,12 @@ async function customFetch(url, options) {
   try {
     /** @type {undici.RequestInit} */
     let fetchOptions = options;
-    if (process.env.PROXY) {
-      logger.info(`[openidStrategy] proxy agent configured: ${process.env.PROXY}`);
+    const dispatcher = getOpenIdProxyDispatcher();
+    if (dispatcher) {
+      logger.info('[openidStrategy] proxy dispatcher configured');
       fetchOptions = {
         ...options,
-        dispatcher: new undici.ProxyAgent(process.env.PROXY),
+        dispatcher,
       };
     }
 
@@ -104,6 +109,12 @@ This violates RFC 7235 and may cause issues with strict OAuth clients. Removing
 /** @typedef {Configuration | null}  */
 let openidConfig = null;
 
+const getOpenIdAuthorizationAudience = () =>
+  (process.env.OPENID_AUDIENCE ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .find(Boolean);
+
 /**
  * Custom OpenID Strategy
  *
@@ -124,10 +135,11 @@ class CustomOpenIDStrategy extends OpenIDStrategy {
       params.set('state', options.state);
     }
 
-    if (process.env.OPENID_AUDIENCE) {
-      params.set('audience', process.env.OPENID_AUDIENCE);
+    const authorizationAudience = getOpenIdAuthorizationAudience();
+    if (authorizationAudience) {
+      params.set('audience', authorizationAudience);
       logger.debug(
-        `[openidStrategy] Adding audience to authorization request: ${process.env.OPENID_AUDIENCE}`,
+        `[openidStrategy] Adding audience to authorization request: ${authorizationAudience}`,
       );
     }
 
@@ -200,43 +212,64 @@ const getUserInfo = async (config, accessToken, sub) => {
   }
 };
 
-/**
- * Downloads an image from a URL using an access token.
- * @param {string} url
- * @param {Configuration} config
- * @param {string} accessToken access token
- * @param {string} sub - The subject identifier of the user. usually found as "sub" in the claims of the token
- * @returns {Promise<Buffer | string>} The image buffer or an empty string if the download fails.
- */
-const downloadImage = async (url, config, accessToken, sub) => {
+function getUrlOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+
+function getOpenIDAvatarAuthorizedOrigins(config) {
+  const metadata = config?.serverMetadata?.() ?? {};
+  const metadataOrigins = [metadata.issuer, metadata.userinfo_endpoint]
+    .map(getUrlOrigin)
+    .filter(Boolean);
+  const configuredOrigins = (process.env.OPENID_AVATAR_AUTHORIZED_ORIGINS ?? '')
+    .split(/[\s,]+/)
+    .map(getUrlOrigin)
+    .filter(Boolean);
+
+  return new Set([...metadataOrigins, ...configuredOrigins]);
+}
+
+function shouldAuthorizeOpenIDAvatar(url, config) {
+  const origin = getUrlOrigin(url);
+  if (!origin) {
+    return false;
+  }
+
+  return getOpenIDAvatarAuthorizedOrigins(config).has(origin);
+}
+
+async function getOpenIDAvatarFetchOptions(url, config, accessToken, sub) {
+  if (!shouldAuthorizeOpenIDAvatar(url, config)) {
+    return undefined;
+  }
+
   const exchangedAccessToken = await exchangeAccessTokenIfNeeded(config, accessToken, sub, true);
+  return {
+    headers: {
+      Authorization: `Bearer ${exchangedAccessToken}`,
+    },
+  };
+}
+
+const resizeIdentityProviderAvatar = async (url, userId, config, accessToken, sub) => {
   if (!url) {
     return '';
   }
 
   try {
-    const options = {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${exchangedAccessToken}`,
-      },
-    };
-
-    if (process.env.PROXY) {
-      options.agent = new HttpsProxyAgent(process.env.PROXY);
-    }
-
-    const response = await fetch(url, options);
-
-    if (response.ok) {
-      const buffer = await response.buffer();
-      return buffer;
-    } else {
-      throw new Error(`${response.statusText} (HTTP ${response.status})`);
+    const fetchOptions = await getOpenIDAvatarFetchOptions(url, config, accessToken, sub);
+    const avatarParams = { userId, input: url };
+    if (fetchOptions) {
+      avatarParams.fetchOptions = fetchOptions;
     }
+    return await resizeAvatar(avatarParams);
   } catch (error) {
     logger.error(
-      `[openidStrategy] downloadImage: Error downloading image at URL "${url}": ${error}`,
+      `[openidStrategy] resizeIdentityProviderAvatar: Error processing avatar at URL "${url}": ${error}`,
     );
     return '';
   }
@@ -388,9 +421,9 @@ async function resolveGroupsFromOverage(accessToken, sub) {
       body: JSON.stringify({ securityEnabledOnly: false }),
     };
 
-    if (process.env.PROXY) {
-      const { ProxyAgent } = undici;
-      fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+    const dispatcher = getOpenIdProxyDispatcher();
+    if (dispatcher) {
+      fetchOptions.dispatcher = dispatcher;
     }
 
     const response = await undici.fetch(url, fetchOptions);
@@ -425,6 +458,104 @@ async function resolveGroupsFromOverage(accessToken, sub) {
   }
 }
 
+/**
+ * Resolve the source object (decoded token or userinfo) for a role check
+ * based on the configured token kind. Throws on invalid configuration so
+ * misconfiguration surfaces loudly instead of silently denying every login.
+ *
+ * @param {string} kind - One of 'access', 'id', or 'userinfo'
+ * @param {string} label - Human-readable label for error messages (e.g. 'required role')
+ * @param {Object} tokenset - The OpenID tokenset
+ * @param {Object} userinfo - Merged userinfo (id-token claims + UserInfo endpoint response)
+ */
+function getRoleSource(kind, label, tokenset, userinfo) {
+  if (kind === 'access') {
+    return jwtDecode(tokenset.access_token);
+  }
+  if (kind === 'id') {
+    return jwtDecode(tokenset.id_token);
+  }
+  if (kind === 'userinfo') {
+    return userinfo;
+  }
+  logger.error(
+    `[openidStrategy] Invalid ${label} token kind: ${kind}. Must be one of 'access', 'id', or 'userinfo'.`,
+  );
+  throw new Error(`Invalid ${label} token kind`);
+}
+
+/**
+ * Applies generic OpenID role sync to the request-local user before the existing final update.
+ */
+async function applyOpenIdRoleSync({
+  user,
+  username,
+  tokenset,
+  claims,
+  userinfo,
+  resolvedOverageGroups,
+}) {
+  const options = getOpenIdRoleSyncOptions();
+  if (!options.enabled) {
+    return;
+  }
+
+  if (user.role === SystemRoles.ADMIN) {
+    logger.info(
+      `[openidStrategy] OpenID role sync skipped for ${username}; existing ADMIN role is not managed by generic role sync`,
+    );
+    return;
+  }
+
+  const resolveGroupOverage = async () =>
+    resolvedOverageGroups || (await resolveGroupsFromOverage(tokenset.access_token, claims.sub));
+
+  const openIdRoleValues = await getOpenIdRolesForOpenIdSync({
+    options,
+    accessToken: tokenset.access_token,
+    idToken: tokenset.id_token,
+    claims,
+    userinfo,
+    decodeToken: jwtDecode,
+    resolveGroupOverage,
+  });
+  if (openIdRoleValues === undefined) {
+    logger.warn(
+      `[openidStrategy] OpenID role sync skipped; claim '${options.claim}' was not found, invalid, or unresolved`,
+    );
+    return;
+  }
+
+  const libreChatRoles = {
+    getRolesByNames: findRolesByNames,
+    rolePriority: options.rolePriority,
+    fallbackRole: options.fallbackRole,
+    logPrefix: '[openidStrategy]',
+  };
+
+  /** Role definitions are tenant-scoped, so validate configured roles in the matched user's tenant. */
+  const { rolePriority, fallbackRole } = user?.tenantId
+    ? await tenantStorage.run({ tenantId: user.tenantId }, async () =>
+        getLibreChatRolesForOpenIdSync(libreChatRoles),
+      )
+    : await getLibreChatRolesForOpenIdSync(libreChatRoles);
+  const result = selectOpenIdRole({
+    currentRole: user.role,
+    openIdRoleValues,
+    rolePriority,
+    fallbackRole,
+  });
+
+  if (!result.selectedRole || result.selectedRole === user.role) {
+    return;
+  }
+
+  logger.info(
+    `[openidStrategy] OpenID role sync updated role for ${username}: ${user.role || 'unset'} -> ${result.selectedRole}`,
+  );
+  user.role = result.selectedRole;
+}
+
 /**
  * Process OpenID authentication tokenset and userinfo
  * This is the core logic extracted from the passport strategy callback
@@ -493,12 +624,7 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
     const requiredRoleParameterPath = process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH;
     const requiredRoleTokenKind = process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND;
 
-    let decodedToken = '';
-    if (requiredRoleTokenKind === 'access' && tokenset.access_token) {
-      decodedToken = jwtDecode(tokenset.access_token);
-    } else if (requiredRoleTokenKind === 'id' && tokenset.id_token) {
-      decodedToken = jwtDecode(tokenset.id_token);
-    }
+    const decodedToken = getRoleSource(requiredRoleTokenKind, 'required role', tokenset, userinfo);
 
     let roles = get(decodedToken, requiredRoleParameterPath);
 
@@ -589,25 +715,10 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
   const adminRole = process.env.OPENID_ADMIN_ROLE;
   const adminRoleParameterPath = process.env.OPENID_ADMIN_ROLE_PARAMETER_PATH;
   const adminRoleTokenKind = process.env.OPENID_ADMIN_ROLE_TOKEN_KIND;
+  let adminRoleGranted = false;
 
   if (adminRole && adminRoleParameterPath && adminRoleTokenKind) {
-    let adminRoleObject;
-    switch (adminRoleTokenKind) {
-      case 'access':
-        adminRoleObject = jwtDecode(tokenset.access_token);
-        break;
-      case 'id':
-        adminRoleObject = jwtDecode(tokenset.id_token);
-        break;
-      case 'userinfo':
-        adminRoleObject = userinfo;
-        break;
-      default:
-        logger.error(
-          `[openidStrategy] Invalid admin role token kind: ${adminRoleTokenKind}. Must be one of 'access', 'id', or 'userinfo'.`,
-        );
-        throw new Error('Invalid admin role token kind');
-    }
+    const adminRoleObject = getRoleSource(adminRoleTokenKind, 'admin role', tokenset, userinfo);
 
     let adminRoles = get(adminRoleObject, adminRoleParameterPath);
 
@@ -637,6 +748,7 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
 
     if (adminRoles && (adminRoles === true || adminRoleValues.includes(adminRole))) {
       user.role = SystemRoles.ADMIN;
+      adminRoleGranted = true;
       logger.info(`[openidStrategy] User ${username} is an admin based on role: ${adminRole}`);
     } else if (user.role === SystemRoles.ADMIN) {
       user.role = SystemRoles.USER;
@@ -646,6 +758,33 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
     }
   }
 
+  if (!adminRoleGranted) {
+    const roleBeforeSync = user.role;
+    await applyOpenIdRoleSync({
+      user,
+      username,
+      tokenset,
+      claims,
+      userinfo,
+      resolvedOverageGroups,
+    });
+    /**
+     * The earlier login-policy check ran with the pre-sync role. If role sync moved a
+     * tenant user into a different role, re-resolve the tenant config and re-enforce
+     * `allowedDomains` so role-scoped overrides for the new role are honored and a token
+     * cannot complete login under the previous role's looser policy.
+     */
+    if (user?.tenantId && user.role !== roleBeforeSync) {
+      const postSyncConfig = await resolveAppConfigForUser(getAppConfig, user);
+      if (!isEmailDomainAllowed(email, postSyncConfig?.registration?.allowedDomains)) {
+        logger.error(
+          `[OpenID Strategy] Authentication blocked after role sync - email domain not allowed [Identifier: ${email}]`,
+        );
+        throw new Error('Email domain not allowed');
+      }
+    }
+  }
+
   if (!!userinfo && userinfo.picture && !user.avatar?.includes('manual=true')) {
     /** @type {string | undefined} */
     const imageUrl = userinfo.picture;
@@ -657,8 +796,10 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
       fileName = userinfo.sub + '.png';
     }
 
-    const imageBuffer = await downloadImage(
+    const userId = user._id.toString();
+    const imageBuffer = await resizeIdentityProviderAvatar(
       imageUrl,
+      userId,
       openidConfig,
       tokenset.access_token,
       userinfo.sub,
@@ -669,7 +810,7 @@ async function processOpenIDAuth(tokenset, existingUsersOnly = false) {
       const imagePath = await saveBuffer(
         getAvatarSaveParams(fileStrategy, {
           fileName,
-          userId: user._id.toString(),
+          userId,
           buffer: imageBuffer,
           tenantId: user.tenantId,
         }),
@@ -767,18 +908,25 @@ const setupOpenIdAdmin = (openidConfig) => {
  */
 async function setupOpenId() {
   try {
+    const usePKCE = isEnabled(process.env.OPENID_USE_PKCE);
     const shouldGenerateNonce = isEnabled(process.env.OPENID_GENERATE_NONCE);
 
     /** @type {ClientMetadata} */
     const clientMetadata = {
       client_id: process.env.OPENID_CLIENT_ID,
-      client_secret: process.env.OPENID_CLIENT_SECRET,
+      response_types: ['code'],
+      grant_types: ['authorization_code'],
     };
 
-    if (shouldGenerateNonce) {
-      clientMetadata.response_types = ['code'];
-      clientMetadata.grant_types = ['authorization_code'];
-      clientMetadata.token_endpoint_auth_method = 'client_secret_post';
+    const clientSecret = process.env.OPENID_CLIENT_SECRET?.trim();
+
+    if (clientSecret) {
+      clientMetadata.client_secret = clientSecret;
+      if (shouldGenerateNonce) {
+        clientMetadata.token_endpoint_auth_method = 'client_secret_post';
+      }
+    } else if (usePKCE) {
+      clientMetadata.token_endpoint_auth_method = 'none';
     }
 
     /** @type {Configuration} */
@@ -793,10 +941,10 @@ async function setupOpenId() {
     );
 
     logger.info(`[openidStrategy] OpenID authentication configuration`, {
+      usePKCE,
+      hasClientSecret: !!clientSecret,
+      tokenEndpointAuthMethod: clientMetadata.token_endpoint_auth_method ?? '(library default)',
       generateNonce: shouldGenerateNonce,
-      reason: shouldGenerateNonce
-        ? 'OPENID_GENERATE_NONCE=true - Will generate nonce and use explicit metadata for federated providers'
-        : 'OPENID_GENERATE_NONCE=false - Standard flow without explicit nonce or metadata',
     });
 
     const openidLogin = new CustomOpenIDStrategy(
@@ -805,7 +953,7 @@ async function setupOpenId() {
         scope: process.env.OPENID_SCOPE,
         callbackURL: process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL,
         clockTolerance: process.env.OPENID_CLOCK_TOLERANCE || 300,
-        usePKCE: isEnabled(process.env.OPENID_USE_PKCE),
+        usePKCE,
       },
       createOpenIDCallback(),
     );
@@ -835,4 +983,5 @@ module.exports = {
   setupOpenId,
   getOpenIdConfig,
   getOpenIdEmail,
+  getRoleSource,
 };
diff --git a/api/strategies/openidStrategy.spec.js b/api/strategies/openidStrategy.spec.js
index 15e507e9b56..36a491a0685 100644
--- a/api/strategies/openidStrategy.spec.js
+++ b/api/strategies/openidStrategy.spec.js
@@ -2,42 +2,104 @@ const undici = require('undici');
 const fetch = require('node-fetch');
 const jwtDecode = require('jsonwebtoken/decode');
 const { ErrorTypes, FileSources } = require('librechat-data-provider');
-const { findUser, createUser, updateUser } = require('~/models');
-const { getOpenIdIssuer, resolveAppConfigForUser } = require('@librechat/api');
+const { findUser, createUser, updateUser, findRolesByNames } = require('~/models');
+const {
+  getOpenIdProxyDispatcher,
+  resolveAppConfigForUser,
+  getOpenIdIssuer,
+  isEnabled,
+} = require('@librechat/api');
+const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { getAppConfig } = require('~/server/services/Config');
 const { setupOpenId } = require('./openidStrategy');
 
+const mockCloudfrontFileSource = FileSources.cloudfront ?? 'cloudfront';
+
 // --- Mocks ---
 jest.mock('node-fetch');
 jest.mock('jsonwebtoken/decode');
 jest.mock('undici', () => ({
   fetch: jest.fn(),
-  ProxyAgent: jest.fn(),
 }));
 jest.mock('~/server/services/Files/strategies', () => ({
   getStrategyFunctions: jest.fn(() => ({
     saveBuffer: jest.fn().mockResolvedValue('/fake/path/to/avatar.png'),
   })),
 }));
+jest.mock('~/server/services/Files/images/avatar', () => ({
+  resizeAvatar: jest.fn().mockResolvedValue(Buffer.from('safe avatar')),
+}));
 jest.mock('~/server/services/Config', () => ({
   getAppConfig: jest.fn().mockResolvedValue({}),
 }));
-jest.mock('@librechat/api', () => ({
-  ...jest.requireActual('@librechat/api'),
-  isEnabled: jest.fn(() => false),
-  isEmailDomainAllowed: jest.fn(() => true),
-  findOpenIDUser: jest.requireActual('@librechat/api').findOpenIDUser,
-  getOpenIdEmail: jest.requireActual('@librechat/api').getOpenIdEmail,
-  getBalanceConfig: jest.fn(() => ({
-    enabled: false,
-  })),
-  getOpenIdIssuer: jest.fn(() => 'https://fake-issuer.com'),
-  resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
-}));
+jest.mock('@librechat/api', () => {
+  const actual = jest.requireActual('@librechat/api');
+  const getStringClaim = (claims, claim) => {
+    const value = claims[claim];
+    return typeof value === 'string' && value ? value : undefined;
+  };
+
+  return {
+    ...actual,
+    isEnabled: jest.fn(() => false),
+    isEmailDomainAllowed: jest.fn(() => true),
+    findOpenIDUser: actual.findOpenIDUser,
+    getOpenIdEmail: jest.fn((claims, strategyName = 'openidStrategy') => {
+      if (claims == null) {
+        return undefined;
+      }
+
+      const claimKey = process.env.OPENID_EMAIL_CLAIM?.trim();
+      if (claimKey) {
+        const value = claims[claimKey];
+        if (typeof value === 'string' && value) {
+          return value;
+        }
+
+        const { logger } = require('@librechat/data-schemas');
+        if (value != null) {
+          logger.warn(
+            `[${strategyName}] OPENID_EMAIL_CLAIM="${claimKey}" resolved to a non-string value (type: ${typeof value}). Falling back to: email -> preferred_username -> upn.`,
+          );
+        } else {
+          logger.warn(
+            `[${strategyName}] OPENID_EMAIL_CLAIM="${claimKey}" not present in userinfo. Falling back to: email -> preferred_username -> upn.`,
+          );
+        }
+      }
+
+      return (
+        getStringClaim(claims, 'email') ??
+        getStringClaim(claims, 'preferred_username') ??
+        getStringClaim(claims, 'upn')
+      );
+    }),
+    getBalanceConfig: jest.fn(() => ({
+      enabled: false,
+    })),
+    getOpenIdIssuer: jest.fn(() => 'https://fake-issuer.com'),
+    getOpenIdProxyDispatcher: jest.fn(() => undefined),
+    getAvatarFileStrategy: jest.fn((config, fallbackStrategy) => {
+      const { FileSources } = jest.requireActual('librechat-data-provider');
+      if (config?.fileStrategies) {
+        return config.fileStrategies.avatar ?? config.fileStrategies.default ?? config.fileStrategy;
+      }
+      return config?.fileStrategy ?? fallbackStrategy ?? FileSources.local;
+    }),
+    getAvatarSaveParams: jest.fn((strategy, params) => {
+      const { FileSources } = jest.requireActual('librechat-data-provider');
+      return strategy === FileSources.s3 || strategy === mockCloudfrontFileSource
+        ? { ...params, basePath: 'avatars' }
+        : params;
+    }),
+    resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
+  };
+});
 jest.mock('~/models', () => ({
   findUser: jest.fn(),
   createUser: jest.fn(),
   updateUser: jest.fn(),
+  findRolesByNames: jest.fn(),
 }));
 jest.mock('@librechat/data-schemas', () => ({
   ...jest.requireActual('@librechat/api'),
@@ -47,6 +109,9 @@ jest.mock('@librechat/data-schemas', () => ({
     debug: jest.fn(),
     error: jest.fn(),
   },
+  tenantStorage: {
+    run: jest.fn((_context, fn) => fn()),
+  },
   hashToken: jest.fn().mockResolvedValue('hashed-token'),
 }));
 jest.mock('~/cache/getLogStores', () =>
@@ -80,20 +145,28 @@ jest.mock('openid-client', () => {
 jest.mock('openid-client/passport', () => {
   /** Store callbacks by strategy name - 'openid' and 'openidAdmin' */
   const verifyCallbacks = {};
+  const strategies = {};
   let lastVerifyCallback;
 
-  const mockStrategy = jest.fn((options, verify) => {
+  const mockStrategy = jest.fn(function (options, verify) {
     lastVerifyCallback = verify;
-    return { name: 'openid', options, verify };
+    this.name = 'openid';
+    this.options = options;
+    this.verify = verify;
   });
+  mockStrategy.prototype.authorizationRequestParams = jest.fn(() => new URLSearchParams());
 
   return {
     Strategy: mockStrategy,
     /** Get the last registered callback (for backward compatibility) */
     __getVerifyCallback: () => lastVerifyCallback,
+    __getStrategyByName: (name) => strategies[name],
     /** Store callback by name when passport.use is called */
-    __setVerifyCallback: (name, callback) => {
-      verifyCallbacks[name] = callback;
+    __setStrategy: (name, strategy) => {
+      strategies[name] = strategy;
+      if (strategy?.verify) {
+        verifyCallbacks[name] = strategy.verify;
+      }
     },
     /** Get callback by strategy name */
     __getVerifyCallbackByName: (name) => verifyCallbacks[name],
@@ -104,9 +177,7 @@ jest.mock('openid-client/passport', () => {
 jest.mock('passport', () => ({
   use: jest.fn((name, strategy) => {
     const passportMock = require('openid-client/passport');
-    if (strategy && strategy.verify) {
-      passportMock.__setVerifyCallback(name, strategy.verify);
-    }
+    passportMock.__setStrategy(name, strategy);
   }),
 }));
 
@@ -145,6 +216,17 @@ describe('setupOpenId', () => {
   beforeEach(async () => {
     // Clear previous mock calls and reset implementations
     jest.clearAllMocks();
+    isEnabled.mockImplementation(jest.requireActual('@librechat/api').isEnabled);
+    require('~/cache/getLogStores').mockImplementation(() => ({
+      get: jest.fn(),
+      set: jest.fn(),
+    }));
+    getOpenIdProxyDispatcher.mockReturnValue(undefined);
+    require('openid-client').genericGrantRequest.mockReset();
+    require('openid-client').genericGrantRequest.mockResolvedValue({
+      access_token: 'exchanged_graph_token',
+      expires_in: 3600,
+    });
 
     // Reset environment variables needed by the strategy
     process.env.OPENID_ISSUER = 'https://fake-issuer.com';
@@ -162,8 +244,19 @@ describe('setupOpenId', () => {
     delete process.env.OPENID_USERNAME_CLAIM;
     delete process.env.OPENID_NAME_CLAIM;
     delete process.env.OPENID_EMAIL_CLAIM;
+    delete process.env.OPENID_AUDIENCE;
+    delete process.env.OPENID_AVATAR_AUTHORIZED_ORIGINS;
     delete process.env.PROXY;
     delete process.env.OPENID_USE_PKCE;
+    delete process.env.OPENID_GENERATE_NONCE;
+    delete process.env.OPENID_ROLE_SYNC_ENABLED;
+    delete process.env.OPENID_ROLE_SYNC_API_ENABLED;
+    delete process.env.OPENID_ROLE_SYNC_SOURCE;
+    delete process.env.OPENID_ROLE_SYNC_CLAIM;
+    delete process.env.OPENID_ROLE_SYNC_ROLE_PRIORITY;
+    delete process.env.OPENID_ROLE_SYNC_FALLBACK_ROLE;
+    delete process.env.OPENID_ON_BEHALF_FLOW_FOR_USERINFO_REQUIRED;
+    delete process.env.OPENID_ON_BEHALF_FLOW_USERINFO_SCOPE;
 
     // Default jwtDecode mock returns a token that includes the required role.
     jwtDecode.mockReturnValue({
@@ -180,14 +273,11 @@ describe('setupOpenId', () => {
     updateUser.mockImplementation(async (id, userData) => {
       return { _id: id, ...userData };
     });
+    findRolesByNames.mockImplementation(async (roleNames) =>
+      roleNames.map((roleName) => ({ name: roleName })),
+    );
 
-    // For image download, simulate a successful response
-    const fakeBuffer = Buffer.from('fake image');
-    const fakeResponse = {
-      ok: true,
-      buffer: jest.fn().mockResolvedValue(fakeBuffer),
-    };
-    fetch.mockResolvedValue(fakeResponse);
+    resizeAvatar.mockResolvedValue(Buffer.from('safe avatar'));
 
     // Call the setup function and capture the verify callback for the regular 'openid' strategy
     // (not 'openidAdmin' which requires existing users)
@@ -195,6 +285,126 @@ describe('setupOpenId', () => {
     verifyCallback = require('openid-client/passport').__getVerifyCallbackByName('openid');
   });
 
+  describe('clientMetadata construction in setupOpenId', () => {
+    let openidClient;
+
+    beforeEach(() => {
+      openidClient = require('openid-client');
+      openidClient.discovery.mockClear();
+    });
+
+    it('sets token_endpoint_auth_method to none for PKCE without a client secret', async () => {
+      process.env.OPENID_USE_PKCE = 'true';
+      delete process.env.OPENID_CLIENT_SECRET;
+
+      await setupOpenId();
+
+      const [, , metadata] = openidClient.discovery.mock.calls.at(-1);
+      expect(metadata.token_endpoint_auth_method).toBe('none');
+      expect(metadata.client_secret).toBeUndefined();
+    });
+
+    it('leaves token_endpoint_auth_method unset for secret-based clients without nonce', async () => {
+      process.env.OPENID_USE_PKCE = 'false';
+      process.env.OPENID_CLIENT_SECRET = 'my-secret';
+
+      await setupOpenId();
+
+      const [, , metadata] = openidClient.discovery.mock.calls.at(-1);
+      expect(metadata.client_secret).toBe('my-secret');
+      expect(metadata.token_endpoint_auth_method).toBeUndefined();
+    });
+
+    it('sets client_secret and client_secret_post when nonce generation is enabled', async () => {
+      process.env.OPENID_USE_PKCE = 'false';
+      process.env.OPENID_GENERATE_NONCE = 'true';
+      process.env.OPENID_CLIENT_SECRET = 'my-secret';
+
+      await setupOpenId();
+
+      const [, , metadata] = openidClient.discovery.mock.calls.at(-1);
+      expect(metadata.client_secret).toBe('my-secret');
+      expect(metadata.token_endpoint_auth_method).toBe('client_secret_post');
+    });
+
+    it('treats whitespace-only secret as absent', async () => {
+      process.env.OPENID_USE_PKCE = 'true';
+      process.env.OPENID_CLIENT_SECRET = '   ';
+
+      await setupOpenId();
+
+      const [, , metadata] = openidClient.discovery.mock.calls.at(-1);
+      expect(metadata.client_secret).toBeUndefined();
+      expect(metadata.token_endpoint_auth_method).toBe('none');
+    });
+
+    it('does not force an auth method when PKCE and a client secret are both configured without nonce', async () => {
+      process.env.OPENID_USE_PKCE = 'true';
+      process.env.OPENID_CLIENT_SECRET = 'my-secret';
+
+      await setupOpenId();
+
+      const [, , metadata] = openidClient.discovery.mock.calls.at(-1);
+      expect(metadata.client_secret).toBe('my-secret');
+      expect(metadata.token_endpoint_auth_method).toBeUndefined();
+    });
+
+    it('uses the shared OpenID proxy dispatcher for custom fetch requests', async () => {
+      const dispatcher = { dispatch: jest.fn() };
+      const response = { status: 204, statusText: 'No Content', headers: new Headers() };
+      getOpenIdProxyDispatcher.mockReturnValue(dispatcher);
+      undici.fetch.mockResolvedValue(response);
+
+      await setupOpenId();
+
+      const [, , , , options] = openidClient.discovery.mock.calls.at(-1);
+      const openIdFetch = options[openidClient.customFetch];
+      await expect(
+        openIdFetch('https://issuer.example.com/.well-known/openid-configuration', {
+          method: 'GET',
+        }),
+      ).resolves.toBe(response);
+
+      expect(getOpenIdProxyDispatcher).toHaveBeenCalled();
+      expect(undici.fetch).toHaveBeenCalledWith(
+        'https://issuer.example.com/.well-known/openid-configuration',
+        {
+          method: 'GET',
+          dispatcher,
+        },
+      );
+    });
+  });
+
+  describe('authorizationRequestParams', () => {
+    const getLoginStrategy = () => require('openid-client/passport').__getStrategyByName('openid');
+
+    it('adds a single OpenID audience to authorization requests', () => {
+      process.env.OPENID_AUDIENCE = 'librechat';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, { state: 'login-state' });
+
+      expect(params.get('audience')).toBe('librechat');
+      expect(params.get('state')).toBe('login-state');
+    });
+
+    it('uses the first non-empty audience when OPENID_AUDIENCE accepts multiple JWT audiences', () => {
+      process.env.OPENID_AUDIENCE = ' librechat , control-plane-web ';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, {});
+
+      expect(params.get('audience')).toBe('librechat');
+    });
+
+    it('does not add an authorization audience when OPENID_AUDIENCE is empty', () => {
+      process.env.OPENID_AUDIENCE = ' , ';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, {});
+
+      expect(params.has('audience')).toBe(false);
+    });
+  });
+
   it('should create a new user with correct username when preferred_username claim exists', async () => {
     // Arrange – our userinfo already has preferred_username 'testusername'
     const userinfo = tokenset.claims();
@@ -503,6 +713,72 @@ describe('setupOpenId', () => {
     expect(createUser).toHaveBeenCalled();
   });
 
+  it('should allow login when required role is found in userinfo claims', async () => {
+    process.env.OPENID_REQUIRED_ROLE = 'requiredRole';
+    process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH = 'roles';
+    process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND = 'userinfo';
+
+    // The role is intentionally absent from the id_token and only present in
+    // the userinfo response — exercises the userinfo branch of the switch.
+    jwtDecode.mockReturnValue({});
+    require('openid-client').fetchUserInfo.mockResolvedValue({
+      roles: ['requiredRole'],
+    });
+
+    await setupOpenId();
+    verifyCallback = require('openid-client/passport').__getVerifyCallbackByName('openid');
+
+    const { user } = await validate(tokenset);
+
+    expect(user).toBeTruthy();
+    expect(user.email).toBe(tokenset.claims().email);
+  });
+
+  it('should reject login when required role is missing from userinfo claims', async () => {
+    const { logger } = require('@librechat/data-schemas');
+    process.env.OPENID_REQUIRED_ROLE = 'requiredRole';
+    process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH = 'roles';
+    process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND = 'userinfo';
+
+    jwtDecode.mockReturnValue({});
+    require('openid-client').fetchUserInfo.mockResolvedValue({
+      other_claim: 'value',
+    });
+
+    await setupOpenId();
+    verifyCallback = require('openid-client/passport').__getVerifyCallbackByName('openid');
+
+    const { user, details } = await validate(tokenset);
+
+    expect(user).toBe(false);
+    expect(details.message).toBe('You must have "requiredRole" role to log in.');
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.stringContaining("Key 'roles' not found in userinfo token!"),
+    );
+  });
+
+  it('should reject login with invalid required role token kind', async () => {
+    const { logger } = require('@librechat/data-schemas');
+    process.env.OPENID_REQUIRED_ROLE = 'requiredRole';
+    process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH = 'roles';
+    process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND = 'invalid';
+
+    jwtDecode.mockReturnValue({
+      roles: ['requiredRole'],
+    });
+
+    await setupOpenId();
+    verifyCallback = require('openid-client/passport').__getVerifyCallbackByName('openid');
+
+    await expect(validate(tokenset)).rejects.toThrow('Invalid required role token kind');
+
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "Invalid required role token kind: invalid. Must be one of 'access', 'id', or 'userinfo'",
+      ),
+    );
+  });
+
   describe('group overage and groups handling', () => {
     it.each([
       ['groups array contains required group', ['group-required', 'other-group'], true, undefined],
@@ -790,6 +1066,10 @@ describe('setupOpenId', () => {
   });
 
   describe('OBO token exchange for overage', () => {
+    beforeEach(() => {
+      delete process.env.OPENID_ADMIN_ROLE;
+    });
+
     it('exchanges access token via OBO before calling Graph API', async () => {
       const openidClient = require('openid-client');
       process.env.OPENID_REQUIRED_ROLE = 'group-required';
@@ -1096,7 +1376,7 @@ describe('setupOpenId', () => {
     });
   });
 
-  it('should attempt to download and save the avatar if picture is provided', async () => {
+  it('should process and save the avatar through the shared avatar path if picture is provided', async () => {
     const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 
     // Act
@@ -1106,8 +1386,11 @@ describe('setupOpenId', () => {
     const { saveBuffer } = strategyResult.value;
     const [saveParams] = saveBuffer.mock.calls[0];
 
-    // Assert – verify that download was attempted and the avatar field was set via updateUser
-    expect(fetch).toHaveBeenCalled();
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'newUserId',
+      input: 'https://example.com/avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
     expect(saveParams).toEqual(
       expect.objectContaining({
         fileName: 'hashed-token.png',
@@ -1120,9 +1403,47 @@ describe('setupOpenId', () => {
     expect(user.avatar).toBe('/fake/path/to/avatar.png');
   });
 
+  it('uses only the shared avatar processor for OpenID picture URLs', async () => {
+    await validate(tokenset);
+
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'newUserId',
+      input: 'https://example.com/avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it('adds auth headers for configured OpenID avatar origins', async () => {
+    process.env.OPENID_AVATAR_AUTHORIZED_ORIGINS = 'https://example.com';
+
+    await validate(tokenset);
+
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'newUserId',
+      input: 'https://example.com/avatar.png',
+      fetchOptions: {
+        headers: {
+          Authorization: 'Bearer fake_access_token',
+        },
+      },
+    });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it('continues login when shared avatar processing rejects the picture URL', async () => {
+    const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+    resizeAvatar.mockRejectedValueOnce(new Error('avatar processing failed'));
+
+    const { user } = await validate(tokenset);
+
+    expect(user).toBeTruthy();
+    expect(user.avatar).toBeUndefined();
+    expect(getStrategyFunctions).not.toHaveBeenCalled();
+  });
+
   it('should save CloudFront IdP avatars under the shared avatar prefix', async () => {
     const { getStrategyFunctions } = require('~/server/services/Files/strategies');
-    getAppConfig.mockResolvedValueOnce({ fileStrategy: FileSources.cloudfront });
+    getAppConfig.mockResolvedValueOnce({ fileStrategy: mockCloudfrontFileSource });
 
     const { user } = await validate(tokenset);
     const strategyResult =
@@ -1130,7 +1451,12 @@ describe('setupOpenId', () => {
     const { saveBuffer } = strategyResult.value;
     const [saveParams] = saveBuffer.mock.calls[0];
 
-    expect(getStrategyFunctions).toHaveBeenLastCalledWith(FileSources.cloudfront);
+    expect(getStrategyFunctions).toHaveBeenLastCalledWith(mockCloudfrontFileSource);
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'newUserId',
+      input: 'https://example.com/avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
     expect(saveParams).toEqual(
       expect.objectContaining({
         basePath: 'avatars',
@@ -1151,6 +1477,7 @@ describe('setupOpenId', () => {
 
     // Assert – fetch should not be called and avatar should remain undefined or empty
     expect(fetch).not.toHaveBeenCalled();
+    expect(resizeAvatar).not.toHaveBeenCalled();
     // Depending on your implementation, user.avatar may be undefined or an empty string.
   });
 
@@ -1303,6 +1630,296 @@ describe('setupOpenId', () => {
     expect(user.role).toBeUndefined();
   });
 
+  describe('OpenID role sync', () => {
+    beforeEach(() => {
+      process.env.OPENID_ROLE_SYNC_ENABLED = 'true';
+      process.env.OPENID_ROLE_SYNC_SOURCE = 'id';
+      process.env.OPENID_ROLE_SYNC_CLAIM = 'roles';
+      process.env.OPENID_ROLE_SYNC_ROLE_PRIORITY = 'STANDARD-USER,BASIC-USER';
+      process.env.OPENID_ROLE_SYNC_FALLBACK_ROLE = 'USER';
+    });
+
+    it('selects the highest configured matching role from the OpenID token', async () => {
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'BASIC-USER', 'STANDARD-USER'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('STANDARD-USER');
+      expect(updateUser).toHaveBeenCalledWith(
+        'newUserId',
+        expect.objectContaining({ role: 'STANDARD-USER' }),
+      );
+    });
+
+    it('does not run when disabled', async () => {
+      delete process.env.OPENID_ROLE_SYNC_ENABLED;
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'STANDARD-USER'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBeUndefined();
+      expect(findRolesByNames).not.toHaveBeenCalled();
+    });
+
+    it('leaves ADMIN authoritative when OPENID_ADMIN_ROLE grants admin', async () => {
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'STANDARD-USER'],
+        permissions: ['admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('ADMIN');
+    });
+
+    it('preserves an existing ADMIN role when admin is manually assigned', async () => {
+      delete process.env.OPENID_ADMIN_ROLE;
+      delete process.env.OPENID_ADMIN_ROLE_PARAMETER_PATH;
+      delete process.env.OPENID_ADMIN_ROLE_TOKEN_KIND;
+      const existingAdminUser = {
+        _id: 'existingAdminId',
+        provider: 'openid',
+        email: tokenset.claims().email,
+        openidId: tokenset.claims().sub,
+        username: 'adminuser',
+        name: 'Admin User',
+        role: 'ADMIN',
+      };
+
+      findUser.mockImplementation(async (query) => {
+        if (query.openidId === tokenset.claims().sub || query.email === tokenset.claims().email) {
+          return existingAdminUser;
+        }
+        return null;
+      });
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'STANDARD-USER'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('ADMIN');
+      expect(findRolesByNames).not.toHaveBeenCalled();
+    });
+
+    it('uses fallback when a valid role claim has no configured role match', async () => {
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'external-role'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('USER');
+    });
+
+    it('uses fallback when the role claim is present but empty', async () => {
+      // The required-role gate reads the same `roles` claim this test empties, so
+      // disable it to model an IdP that authenticates the user yet emits no roles.
+      delete process.env.OPENID_REQUIRED_ROLE;
+      jwtDecode.mockReturnValue({
+        roles: '',
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('USER');
+      expect(updateUser).toHaveBeenCalledWith(
+        'newUserId',
+        expect.objectContaining({ role: 'USER' }),
+      );
+    });
+
+    it('applies fallback when the role claim is absent from the token', async () => {
+      // Required-role gate reads the same `roles` claim; disable it to model an IdP
+      // that authenticates the user but stops emitting the role claim entirely.
+      delete process.env.OPENID_REQUIRED_ROLE;
+      jwtDecode.mockReturnValue({
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('USER');
+      expect(updateUser).toHaveBeenCalledWith(
+        'newUserId',
+        expect.objectContaining({ role: 'USER' }),
+      );
+    });
+
+    it('rejects login when configured sync roles do not exist', async () => {
+      findRolesByNames.mockImplementation(async (roleNames) =>
+        roleNames
+          .filter((roleName) => roleName !== 'STANDARD-USER')
+          .map((roleName) => ({ name: roleName })),
+      );
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'STANDARD-USER'],
+        permissions: ['not-admin'],
+      });
+
+      await expect(validate(tokenset)).rejects.toThrow(
+        'OpenID role sync configured roles do not exist: STANDARD-USER',
+      );
+    });
+
+    it('can assign a non-admin role after the existing admin demotion path runs', async () => {
+      const existingAdminUser = {
+        _id: 'existingAdminId',
+        provider: 'openid',
+        email: tokenset.claims().email,
+        openidId: tokenset.claims().sub,
+        username: 'adminuser',
+        name: 'Admin User',
+        role: 'ADMIN',
+      };
+
+      findUser.mockImplementation(async (query) => {
+        if (query.openidId === tokenset.claims().sub || query.email === tokenset.claims().email) {
+          return existingAdminUser;
+        }
+        return null;
+      });
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'STANDARD-USER'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('STANDARD-USER');
+      expect(updateUser).toHaveBeenCalledWith(
+        existingAdminUser._id,
+        expect.objectContaining({ role: 'STANDARD-USER' }),
+      );
+    });
+
+    it('wraps role lookup in tenant context for tenant users', async () => {
+      const existingUser = {
+        _id: 'existingTenantUserId',
+        provider: 'openid',
+        email: tokenset.claims().email,
+        openidId: tokenset.claims().sub,
+        username: 'tenantuser',
+        name: 'Tenant User',
+        tenantId: 'tenant-a',
+        role: 'USER',
+      };
+      const { tenantStorage } = require('@librechat/data-schemas');
+
+      findUser.mockImplementation(async (query) => {
+        if (query.openidId === tokenset.claims().sub || query.email === tokenset.claims().email) {
+          return existingUser;
+        }
+        return null;
+      });
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'BASIC-USER'],
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('BASIC-USER');
+      expect(tenantStorage.run).toHaveBeenCalledWith(
+        { tenantId: 'tenant-a' },
+        expect.any(Function),
+      );
+    });
+
+    it('re-enforces tenant login policy after role sync changes the role', async () => {
+      const existingUser = {
+        _id: 'existingTenantUserId',
+        provider: 'openid',
+        email: tokenset.claims().email,
+        openidId: tokenset.claims().sub,
+        username: 'tenantuser',
+        name: 'Tenant User',
+        tenantId: 'tenant-a',
+        role: 'USER',
+      };
+      const { isEmailDomainAllowed } = require('@librechat/api');
+
+      findUser.mockImplementation(async (query) => {
+        if (query.openidId === tokenset.claims().sub || query.email === tokenset.claims().email) {
+          return existingUser;
+        }
+        return null;
+      });
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole', 'BASIC-USER'],
+        permissions: ['not-admin'],
+      });
+      // Pre-sync domain check passes; the post-sync re-resolved config rejects the domain.
+      isEmailDomainAllowed.mockReturnValueOnce(true).mockReturnValueOnce(false);
+      resolveAppConfigForUser.mockResolvedValue({
+        registration: { allowedDomains: ['restricted.com'] },
+      });
+
+      const { user, details } = await validate(tokenset);
+
+      expect(user).toBe(false);
+      expect(details).toEqual({ message: 'Email domain not allowed' });
+    });
+
+    it('reuses required-role overage groups for role sync', async () => {
+      process.env.OPENID_REQUIRED_ROLE = 'group-required';
+      process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH = 'groups';
+      process.env.OPENID_ROLE_SYNC_CLAIM = 'groups';
+
+      jwtDecode.mockReturnValue({
+        hasgroups: true,
+        permissions: ['not-admin'],
+      });
+      undici.fetch.mockResolvedValue({
+        ok: true,
+        json: async () => ({ value: ['group-required', 'STANDARD-USER'] }),
+      });
+
+      const { user } = await validate(tokenset);
+
+      expect(user.role).toBe('STANDARD-USER');
+      expect(undici.fetch).toHaveBeenCalledTimes(1);
+    });
+
+    it('leaves the role unchanged when role-sync group overage cannot be resolved', async () => {
+      process.env.OPENID_ROLE_SYNC_CLAIM = 'groups';
+      const existingUser = {
+        _id: 'existingUserId',
+        provider: 'openid',
+        email: tokenset.claims().email,
+        openidId: tokenset.claims().sub,
+        username: 'existinguser',
+        name: 'Existing User',
+        role: 'BASIC-USER',
+      };
+
+      findUser.mockImplementation(async (query) => {
+        if (query.openidId === tokenset.claims().sub || query.email === tokenset.claims().email) {
+          return existingUser;
+        }
+        return null;
+      });
+      jwtDecode.mockReturnValue({
+        roles: ['requiredRole'],
+        hasgroups: true,
+        permissions: ['not-admin'],
+      });
+
+      const { user } = await validate({ ...tokenset, access_token: undefined });
+
+      expect(user.role).toBe('BASIC-USER');
+    });
+  });
+
   it('should demote existing admin user when admin role is removed from token', async () => {
     // Arrange – simulate an existing user who is currently an admin
     const existingAdminUser = {
@@ -1916,3 +2533,61 @@ describe('setupOpenId', () => {
     });
   });
 });
+
+describe('getRoleSource', () => {
+  const { getRoleSource } = require('./openidStrategy');
+  const { logger } = require('@librechat/data-schemas');
+
+  const accessClaims = { roles: ['from-access'] };
+  const idClaims = { roles: ['from-id'] };
+  const userinfo = { roles: ['from-userinfo'] };
+  const tokenset = { access_token: 'access.jwt', id_token: 'id.jwt' };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jwtDecode.mockImplementation((token) => {
+      if (token === 'access.jwt') return accessClaims;
+      if (token === 'id.jwt') return idClaims;
+      return {};
+    });
+  });
+
+  it.each([
+    ['access', accessClaims],
+    ['id', idClaims],
+    ['userinfo', userinfo],
+  ])('returns the expected source object for kind=%s', (kind, expected) => {
+    expect(getRoleSource(kind, 'required role', tokenset, userinfo)).toEqual(expected);
+  });
+
+  it.each([
+    ['undefined', undefined],
+    ['empty string', ''],
+    ['unknown kind', 'bogus'],
+  ])('throws and logs for invalid kind: %s', (_name, kind) => {
+    expect(() => getRoleSource(kind, 'required role', tokenset, userinfo)).toThrow(
+      'Invalid required role token kind',
+    );
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.stringContaining(`Invalid required role token kind: ${kind}`),
+    );
+  });
+
+  it('uses the provided label in the error message and thrown error', () => {
+    expect(() => getRoleSource('bogus', 'admin role', tokenset, userinfo)).toThrow(
+      'Invalid admin role token kind',
+    );
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Invalid admin role token kind: bogus'),
+    );
+  });
+
+  it('propagates jwtDecode errors when the requested token is missing', () => {
+    jwtDecode.mockImplementation(() => {
+      throw new Error('Invalid token specified');
+    });
+    expect(() => getRoleSource('access', 'required role', {}, userinfo)).toThrow(
+      'Invalid token specified',
+    );
+  });
+});
diff --git a/api/strategies/samlStrategy.js b/api/strategies/samlStrategy.js
index b21a4a482b9..cab43044b98 100644
--- a/api/strategies/samlStrategy.js
+++ b/api/strategies/samlStrategy.js
@@ -1,6 +1,5 @@
 const fs = require('fs');
 const path = require('path');
-const fetch = require('node-fetch');
 const passport = require('passport');
 const { ErrorTypes } = require('librechat-data-provider');
 const { hashToken, logger } = require('@librechat/data-schemas');
@@ -13,6 +12,7 @@ const {
   resolveAppConfigForUser,
 } = require('@librechat/api');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { findUser, createUser, updateUser } = require('~/models');
 const { getAppConfig } = require('~/server/services/Config');
 const paths = require('~/config/paths');
@@ -110,21 +110,17 @@ function getPicture(profile) {
   return getSamlClaim(profile, 'SAML_PICTURE_CLAIM', 'picture');
 }
 
-/**
- * Downloads an image from a URL using an access token.
- * @param {string} url
- * @returns {Promise<Buffer>}
- */
-const downloadImage = async (url) => {
+const resizeIdentityProviderAvatar = async (url, userId) => {
+  if (!url) {
+    return null;
+  }
+
   try {
-    const response = await fetch(url);
-    if (response.ok) {
-      return await response.buffer();
-    } else {
-      throw new Error(`${response.statusText} (HTTP ${response.status})`);
-    }
+    return await resizeAvatar({ userId, input: url });
   } catch (error) {
-    logger.error(`[samlStrategy] Error downloading image at URL "${url}": ${error}`);
+    logger.error(
+      `[samlStrategy] resizeIdentityProviderAvatar: Error processing avatar at URL "${url}": ${error}`,
+    );
     return null;
   }
 };
@@ -264,7 +260,8 @@ function createSamlCallback(existingUsersOnly = false) {
 
       const picture = getPicture(profile);
       if (picture && !user.avatar?.includes('manual=true')) {
-        const imageBuffer = await downloadImage(profile.picture);
+        const userId = user._id.toString();
+        const imageBuffer = await resizeIdentityProviderAvatar(picture, userId);
         if (imageBuffer) {
           let fileName;
           if (crypto) {
@@ -278,7 +275,7 @@ function createSamlCallback(existingUsersOnly = false) {
           const imagePath = await saveBuffer(
             getAvatarSaveParams(fileStrategy, {
               fileName,
-              userId: user._id.toString(),
+              userId,
               buffer: imageBuffer,
               tenantId: user.tenantId,
             }),
diff --git a/api/strategies/samlStrategy.spec.js b/api/strategies/samlStrategy.spec.js
index dbf003e58c4..301fee3a875 100644
--- a/api/strategies/samlStrategy.spec.js
+++ b/api/strategies/samlStrategy.spec.js
@@ -53,6 +53,9 @@ jest.mock('~/server/services/Files/strategies', () => ({
     saveBuffer: jest.fn().mockResolvedValue('/fake/path/to/avatar.png'),
   })),
 }));
+jest.mock('~/server/services/Files/images/avatar', () => ({
+  resizeAvatar: jest.fn().mockResolvedValue(Buffer.from('safe avatar')),
+}));
 jest.mock('~/config/paths', () => ({
   root: '/fake/root/path',
 }));
@@ -64,6 +67,7 @@ const { Strategy: SamlStrategy } = require('@node-saml/passport-saml');
 const { FileSources } = require('librechat-data-provider');
 const { findUser } = require('~/models');
 const { resolveAppConfigForUser } = require('@librechat/api');
+const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { getAppConfig } = require('~/server/services/Config');
 const { setupSaml, getCertificateContent } = require('./samlStrategy');
 
@@ -288,12 +292,7 @@ u7wlOSk+oFzDIO/UILIA
     delete process.env.SAML_PICTURE_CLAIM;
     delete process.env.SAML_NAME_CLAIM;
 
-    // Simulate image download
-    const fakeBuffer = Buffer.from('fake image');
-    fetch.mockResolvedValue({
-      ok: true,
-      buffer: jest.fn().mockResolvedValue(fakeBuffer),
-    });
+    resizeAvatar.mockResolvedValue(Buffer.from('safe avatar'));
 
     await setupSaml();
   });
@@ -447,7 +446,7 @@ u7wlOSk+oFzDIO/UILIA
     expect(result.details.message).toBe(require('librechat-data-provider').ErrorTypes.AUTH_FAILED);
   });
 
-  it('should attempt to download and save the avatar if picture is provided', async () => {
+  it('should process and save the avatar through the shared avatar path if picture is provided', async () => {
     const { getStrategyFunctions } = require('~/server/services/Files/strategies');
     const profile = { ...baseProfile };
 
@@ -457,7 +456,11 @@ u7wlOSk+oFzDIO/UILIA
     const { saveBuffer } = strategyResult.value;
     const [saveParams] = saveBuffer.mock.calls[0];
 
-    expect(fetch).toHaveBeenCalled();
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'mock-user-id',
+      input: 'https://example.com/avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
     expect(saveParams).toEqual(
       expect.objectContaining({
         fileName: 'hashed-token.png',
@@ -469,6 +472,38 @@ u7wlOSk+oFzDIO/UILIA
     expect(user.avatar).toBe('/fake/path/to/avatar.png');
   });
 
+  it('continues login when shared avatar processing rejects the picture URL', async () => {
+    const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+    const profile = { ...baseProfile };
+    resizeAvatar.mockRejectedValueOnce(new Error('avatar processing failed'));
+
+    const { user } = await validate(profile);
+
+    expect(user).toBeTruthy();
+    expect(user.avatar).toBeUndefined();
+    expect(getStrategyFunctions).not.toHaveBeenCalled();
+  });
+
+  it('uses the configured SAML picture claim for shared avatar processing', async () => {
+    process.env.SAML_PICTURE_CLAIM = 'avatar_url';
+    verifyCallback = null;
+    await setupSaml();
+
+    const profile = {
+      ...baseProfile,
+      picture: 'https://example.com/ignored.png',
+      avatar_url: 'https://idp.example.com/custom-avatar.png',
+    };
+
+    await validate(profile);
+
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'mock-user-id',
+      input: 'https://idp.example.com/custom-avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
   it('should save CloudFront SAML avatars under the shared avatar prefix', async () => {
     const { getStrategyFunctions } = require('~/server/services/Files/strategies');
     getAppConfig.mockResolvedValueOnce({ fileStrategies: { avatar: FileSources.cloudfront } });
@@ -481,6 +516,11 @@ u7wlOSk+oFzDIO/UILIA
     const [saveParams] = saveBuffer.mock.calls[0];
 
     expect(getStrategyFunctions).toHaveBeenLastCalledWith(FileSources.cloudfront);
+    expect(resizeAvatar).toHaveBeenCalledWith({
+      userId: 'mock-user-id',
+      input: 'https://example.com/avatar.png',
+    });
+    expect(fetch).not.toHaveBeenCalled();
     expect(saveParams).toEqual(
       expect.objectContaining({
         basePath: 'avatars',
@@ -498,6 +538,7 @@ u7wlOSk+oFzDIO/UILIA
     await validate(profile);
 
     expect(fetch).not.toHaveBeenCalled();
+    expect(resizeAvatar).not.toHaveBeenCalled();
   });
 
   it('should pass the found user to resolveAppConfigForUser', async () => {
diff --git a/api/test/__mocks__/logger.js b/api/test/__mocks__/logger.js
index 62f9bee93a6..699a94883f1 100644
--- a/api/test/__mocks__/logger.js
+++ b/api/test/__mocks__/logger.js
@@ -1,5 +1,13 @@
 jest.mock('winston', () => {
-  const mockFormatFunction = jest.fn((fn) => fn);
+  // Real `winston.format(fn)` returns a Format constructor whose instances
+  // expose a `.transform(info, opts)` method that winston's pipeline calls.
+  // The previous mock `(fn) => fn` collapsed this — `parsers.redactFormat()`
+  // (called at @librechat/data-schemas dist module-load) ended up invoking
+  // the inner transform fn with no `info` argument, throwing on `info.level`.
+  // Returning a thunk that yields `{ transform: fn }` matches real winston's
+  // shape just enough that module-load completes cleanly; the inner fn is
+  // only ever invoked by winston's pipeline (never at load time).
+  const mockFormatFunction = jest.fn((fn) => () => ({ transform: fn }));
 
   mockFormatFunction.colorize = jest.fn();
   mockFormatFunction.combine = jest.fn();
@@ -50,12 +58,3 @@ jest.mock('~/config', () => {
     },
   };
 });
-
-jest.mock('~/config/parsers', () => {
-  return {
-    redactMessage: jest.fn(),
-    redactFormat: jest.fn(),
-    debugTraverse: jest.fn(),
-    formatConsoleMeta: jest.fn(() => ''),
-  };
-});
diff --git a/api/test/app/clients/tools/structured/OpenAIImageTools.test.js b/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
index aa0726b9163..b83ed5335c6 100644
--- a/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
+++ b/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
@@ -25,6 +25,8 @@ jest.mock('@librechat/api', () => ({
     },
   },
   extractBaseURL: jest.fn((url) => url),
+  getProxyDispatcher: jest.fn(() => undefined),
+  applyAxiosProxyConfig: jest.fn(),
 }));
 
 jest.mock('~/server/services/Files/strategies', () => ({
diff --git a/api/test/app/clients/tools/util/fileSearch.test.js b/api/test/app/clients/tools/util/fileSearch.test.js
index 782e48f720b..d9b5edb64cf 100644
--- a/api/test/app/clients/tools/util/fileSearch.test.js
+++ b/api/test/app/clients/tools/util/fileSearch.test.js
@@ -230,3 +230,63 @@ describe('fileSearch.js - tuple return validation', () => {
     });
   });
 });
+
+describe('entity_id scoping by file origin', () => {
+  const ORIGINAL_RAG_API_URL = process.env.RAG_API_URL;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.RAG_API_URL = 'http://localhost:8000';
+    generateShortLivedToken.mockReturnValue('mock-jwt-token');
+    axios.post.mockResolvedValue({ data: [] });
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_RAG_API_URL === undefined) {
+      delete process.env.RAG_API_URL;
+    } else {
+      process.env.RAG_API_URL = ORIGINAL_RAG_API_URL;
+    }
+  });
+
+  function bodiesSent() {
+    return axios.post.mock.calls
+      .filter(([url]) => String(url).endsWith('/query'))
+      .map(([, body]) => body);
+  }
+
+  it('sends entity_id only for agent knowledge-base files', async () => {
+    const tool = await createFileSearchTool({
+      userId: 'user1',
+      entity_id: 'agent_123',
+      files: [
+        { file_id: 'kb-1', filename: 'kb.pdf', fromAgent: true },
+        { file_id: 'user-1', filename: 'attachment.txt', fromAgent: false },
+      ],
+    });
+    await tool.func({ query: 'q' });
+
+    const bodies = bodiesSent();
+    expect(bodies.find((b) => b.file_id === 'kb-1').entity_id).toBe('agent_123');
+    expect(bodies.find((b) => b.file_id === 'user-1').entity_id).toBeUndefined();
+  });
+
+  it('omits entity_id when fromAgent is not set (safe default)', async () => {
+    const tool = await createFileSearchTool({
+      userId: 'user1',
+      entity_id: 'agent_123',
+      files: [{ file_id: 'legacy-1', filename: 'legacy.pdf' }],
+    });
+    await tool.func({ query: 'q' });
+    expect(bodiesSent()[0].entity_id).toBeUndefined();
+  });
+
+  it('sends no entity_id when none is provided', async () => {
+    const tool = await createFileSearchTool({
+      userId: 'user1',
+      files: [{ file_id: 'f1', filename: 'a.txt', fromAgent: true }],
+    });
+    await tool.func({ query: 'q' });
+    expect(bodiesSent()[0].entity_id).toBeUndefined();
+  });
+});
diff --git a/api/utils/logger.js b/api/utils/logger.js
index 542a0a53275..36f23c25cd9 100644
--- a/api/utils/logger.js
+++ b/api/utils/logger.js
@@ -1,12 +1,18 @@
 const winston = require('winston');
 
+const useFileLogging =
+  typeof process.env.LOG_TO_FILE !== 'string' || process.env.LOG_TO_FILE.toLowerCase() !== 'false';
+
+const transports = [new winston.transports.Console()];
+
+if (useFileLogging) {
+  transports.push(new winston.transports.File({ filename: 'login-logs.log' }));
+}
+
 const logger = winston.createLogger({
   level: 'info',
   format: winston.format.combine(winston.format.timestamp(), winston.format.json()),
-  transports: [
-    new winston.transports.Console(),
-    new winston.transports.File({ filename: 'login-logs.log' }),
-  ],
+  transports,
 });
 
 module.exports = logger;
diff --git a/api/utils/tokens.spec.js b/api/utils/tokens.spec.js
index 143d3bb2462..82c5a8b31fb 100644
--- a/api/utils/tokens.spec.js
+++ b/api/utils/tokens.spec.js
@@ -333,6 +333,9 @@ describe('getModelMaxTokens', () => {
     expect(getModelMaxTokens('gemini-3.1-pro-preview-customtools', EModelEndpoint.google)).toBe(
       maxTokensMap[EModelEndpoint.google]['gemini-3.1'],
     );
+    expect(getModelMaxTokens('gemini-3.5-flash', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google]['gemini-3.5-flash'],
+    );
     expect(getModelMaxTokens('gemini-2.5-pro', EModelEndpoint.google)).toBe(
       maxTokensMap[EModelEndpoint.google]['gemini-2.5-pro'],
     );
@@ -353,6 +356,37 @@ describe('getModelMaxTokens', () => {
     );
   });
 
+  test('should return correct context tokens for Gemma models', () => {
+    expect(maxTokensMap[EModelEndpoint.google].gemma).toBe(32768);
+    expect(getModelMaxTokens('gemma', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google].gemma,
+    );
+    expect(getModelMaxTokens('gemma-2-9b-it', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google]['gemma-2'],
+    );
+    expect(getModelMaxTokens('gemma-3-27b-it', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google]['gemma-3-27b'],
+    );
+    expect(getModelMaxTokens('gemma4:latest', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google].gemma4,
+    );
+    expect(getModelMaxTokens('gemma4:e4b', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google].gemma4,
+    );
+    expect(getModelMaxTokens('Gemma4:31B', EModelEndpoint.custom)).toBe(
+      maxTokensMap[EModelEndpoint.custom]['gemma4:31b'],
+    );
+    expect(getModelMaxTokens('ollama/gemma4:31b', EModelEndpoint.custom)).toBe(
+      maxTokensMap[EModelEndpoint.custom]['gemma4:31b'],
+    );
+    expect(getModelMaxTokens('google/gemma-4-31B-it', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google]['gemma-4-31b'],
+    );
+    expect(getModelMaxTokens('google/gemma-4-26B-A4B-it', EModelEndpoint.google)).toBe(
+      maxTokensMap[EModelEndpoint.google]['gemma-4-26b-a4b'],
+    );
+  });
+
   test('should return correct tokens for partial match - Cohere models', () => {
     expect(getModelMaxTokens('command', EModelEndpoint.custom)).toBe(
       maxTokensMap[EModelEndpoint.custom]['command'],
@@ -1456,6 +1490,99 @@ describe('Claude Model Tests', () => {
     });
   });
 
+  it('should return correct context length for Claude Opus 4.8 (1M)', () => {
+    expect(getModelMaxTokens('claude-opus-4-8', EModelEndpoint.anthropic)).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-opus-4-8'],
+    );
+    expect(getModelMaxTokens('claude-opus-4-8')).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-opus-4-8'],
+    );
+  });
+
+  it('should return correct max output tokens for Claude Opus 4.8 (128K)', () => {
+    const { getModelMaxOutputTokens } = require('@librechat/api');
+    expect(getModelMaxOutputTokens('claude-opus-4-8', EModelEndpoint.anthropic)).toBe(
+      maxOutputTokensMap[EModelEndpoint.anthropic]['claude-opus-4-8'],
+    );
+  });
+
+  it('should match model names correctly for Claude Opus 4.8', () => {
+    const modelVariations = [
+      'claude-opus-4-8',
+      'claude-opus-4-8-20260528',
+      'claude-opus-4-8-latest',
+      'anthropic/claude-opus-4-8',
+      'claude-opus-4-8/anthropic',
+      'claude-opus-4-8-preview',
+    ];
+
+    modelVariations.forEach((model) => {
+      expect(matchModelName(model, EModelEndpoint.anthropic)).toBe('claude-opus-4-8');
+    });
+  });
+
+  it('should return correct context length for Claude Fable 5 (1M)', () => {
+    expect(getModelMaxTokens('claude-fable-5', EModelEndpoint.anthropic)).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+    expect(getModelMaxTokens('claude-fable-5')).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+  });
+
+  it('should return correct max output tokens for Claude Fable 5 (128K)', () => {
+    const { getModelMaxOutputTokens } = require('@librechat/api');
+    expect(getModelMaxOutputTokens('claude-fable-5', EModelEndpoint.anthropic)).toBe(
+      maxOutputTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+  });
+
+  it('should match model names correctly for Claude Fable 5', () => {
+    const modelVariations = [
+      'claude-fable-5',
+      'claude-fable-5-20260609',
+      'claude-fable-5-latest',
+      'anthropic/claude-fable-5',
+      'claude-fable-5/anthropic',
+      'anthropic.claude-fable-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      expect(matchModelName(model, EModelEndpoint.anthropic)).toBe('claude-fable-5');
+    });
+  });
+
+  it('should return correct context length for Claude Mythos 5 (1M)', () => {
+    expect(getModelMaxTokens('claude-mythos-5', EModelEndpoint.anthropic)).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+    expect(getModelMaxTokens('claude-mythos-5')).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+  });
+
+  it('should return correct max output tokens for Claude Mythos 5 (128K)', () => {
+    const { getModelMaxOutputTokens } = require('@librechat/api');
+    expect(getModelMaxOutputTokens('claude-mythos-5', EModelEndpoint.anthropic)).toBe(
+      maxOutputTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+  });
+
+  it('should match model names correctly for Claude Mythos 5', () => {
+    const modelVariations = [
+      'claude-mythos-5',
+      'claude-mythos-5-20260609',
+      'claude-mythos-5-latest',
+      'anthropic/claude-mythos-5',
+      'claude-mythos-5/anthropic',
+      'anthropic.claude-mythos-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      expect(matchModelName(model, EModelEndpoint.anthropic)).toBe('claude-mythos-5');
+    });
+  });
+
   it('should return correct context length for Claude Sonnet 4.6 (1M)', () => {
     expect(getModelMaxTokens('claude-sonnet-4-6', EModelEndpoint.anthropic)).toBe(
       maxTokensMap[EModelEndpoint.anthropic]['claude-sonnet-4-6'],
diff --git a/bun.lock b/bun.lock
index 1414f98a71c..ab6db72c2f4 100644
--- a/bun.lock
+++ b/bun.lock
@@ -37,7 +37,7 @@
     },
     "api": {
       "name": "@librechat/backend",
-      "version": "0.8.6-rc1",
+      "version": "0.8.7",
       "dependencies": {
         "@anthropic-ai/vertex-sdk": "^0.14.3",
         "@aws-sdk/client-bedrock-runtime": "^3.980.0",
@@ -130,7 +130,7 @@
     },
     "client": {
       "name": "@librechat/frontend",
-      "version": "0.8.6-rc1",
+      "version": "0.8.7",
       "dependencies": {
         "@ariakit/react": "^0.4.15",
         "@ariakit/react-core": "^0.4.17",
@@ -264,7 +264,7 @@
     },
     "packages/api": {
       "name": "@librechat/api",
-      "version": "1.7.30",
+      "version": "1.7.34",
       "devDependencies": {
         "@babel/preset-env": "^7.21.5",
         "@babel/preset-react": "^7.18.6",
@@ -345,7 +345,7 @@
     },
     "packages/client": {
       "name": "@librechat/client",
-      "version": "0.4.59",
+      "version": "0.4.63",
       "devDependencies": {
         "@babel/core": "^7.28.5",
         "@babel/preset-env": "^7.28.5",
@@ -433,7 +433,7 @@
     },
     "packages/data-provider": {
       "name": "librechat-data-provider",
-      "version": "0.8.502",
+      "version": "0.8.509",
       "dependencies": {
         "axios": "^1.13.5",
         "dayjs": "^1.11.13",
@@ -470,7 +470,7 @@
     },
     "packages/data-schemas": {
       "name": "@librechat/data-schemas",
-      "version": "0.0.51",
+      "version": "0.0.56",
       "devDependencies": {
         "@rollup/plugin-alias": "^5.1.0",
         "@rollup/plugin-commonjs": "^29.0.0",
diff --git a/client/index.html b/client/index.html
index c94c3981b41..d302fb250a7 100644
--- a/client/index.html
+++ b/client/index.html
@@ -48,6 +48,91 @@
       `;
       document.head.appendChild(loadingContainerStyle);
     </script>
+    <script>
+      (function () {
+        var KEY = 'lc-asset-recovery-at';
+        function shouldRecover() {
+          try {
+            var last = Number(sessionStorage.getItem(KEY)) || 0;
+            if (Date.now() - last < 60000) {
+              return false;
+            }
+            sessionStorage.setItem(KEY, String(Date.now()));
+            return true;
+          } catch (e) {
+            return false;
+          }
+        }
+        /** Recovers from stale builds (e.g. an outdated service worker serving old
+         * hashed chunks after a deploy) by unregistering workers and reloading once.
+         * Returns true when a recovery reload was initiated. */
+        window.__lcRecoverStaleAssets = function () {
+          if (!shouldRecover()) {
+            return false;
+          }
+          var reload = function () {
+            window.location.reload();
+          };
+          if (navigator.serviceWorker) {
+            var scopeBase = new URL('./', document.baseURI || window.location.href).href;
+            navigator.serviceWorker
+              .getRegistrations()
+              .then(function (registrations) {
+                return Promise.all(
+                  registrations
+                    .filter(function (registration) {
+                      return registration.scope.indexOf(scopeBase) === 0;
+                    })
+                    .map(function (registration) {
+                      return registration.unregister();
+                    }),
+                );
+              })
+              .then(reload, reload);
+          } else {
+            reload();
+          }
+          return true;
+        };
+        if (navigator.serviceWorker) {
+          navigator.serviceWorker.addEventListener('message', function (event) {
+            if (!event.data || event.data.type !== 'LC_SW_PING') {
+              return;
+            }
+            var source = event.source || navigator.serviceWorker.controller;
+            if (source) {
+              source.postMessage({ type: 'LC_SW_PONG' });
+            }
+          });
+        }
+        window.addEventListener(
+          'error',
+          function (event) {
+            var el = event.target;
+            if (!el || !el.tagName) {
+              return;
+            }
+            var failedScript = el.tagName === 'SCRIPT' && el.src;
+            var failedPreload =
+              el.tagName === 'LINK' && /preload/.test(el.rel || '') && /\.js$/.test(el.href || '');
+            if (failedScript || failedPreload) {
+              window.__lcRecoverStaleAssets();
+            }
+          },
+          true,
+        );
+        window.addEventListener('unhandledrejection', function (event) {
+          var message = event.reason && event.reason.message;
+          if (
+            typeof message === 'string' &&
+            (message.indexOf('dynamically imported module') !== -1 ||
+              message.indexOf('Importing a module script failed') !== -1)
+          ) {
+            window.__lcRecoverStaleAssets();
+          }
+        });
+      })();
+    </script>
     <script defer type="module" src="/src/main.jsx"></script>
   </head>
   <body>
diff --git a/client/jest.config.cjs b/client/jest.config.cjs
index 41f9df59f46..c017263847b 100644
--- a/client/jest.config.cjs
+++ b/client/jest.config.cjs
@@ -1,4 +1,4 @@
-/** v0.8.6-rc1 */
+/** v0.8.7 */
 module.exports = {
   roots: ['<rootDir>/src'],
   testEnvironment: 'jsdom',
diff --git a/client/nginx.conf b/client/nginx.conf
index 906b3af128a..3df5d7b92d3 100644
--- a/client/nginx.conf
+++ b/client/nginx.conf
@@ -2,6 +2,12 @@
 # generated 2024-01-21, Mozilla Guideline v5.7, nginx 1.24.0, OpenSSL 3.1.4, intermediate configuration
 # https://ssl-config.mozilla.org/#server=nginx&version=1.24.0&config=intermediate&openssl=3.1.4&guideline=5.7
 
+# Map the Upgrade header so the admin-panel proxy can pass WebSocket/SSE connections.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
@@ -38,6 +44,31 @@ server {
 #    }
 }
 
+# Admin panel (ClickHouse) served on the admin.localhost subdomain.
+# Uses Docker's embedded DNS (127.0.0.11) with a variable upstream so nginx
+# still starts when the admin-panel service is not running.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name admin.localhost;
+
+    client_max_body_size 25M;
+
+    resolver 127.0.0.11 valid=30s;
+    set $admin_panel_upstream http://admin-panel:3000;
+
+    location / {
+        proxy_pass $admin_panel_upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
+
 #server {
 #    listen 443 ssl http2;
 #    listen [::]:443 ssl http2;
@@ -98,3 +129,31 @@ server {
 #        proxy_set_header Host $host;
 #    }
 #}
+
+# SSL variant for the admin panel subdomain (mirror of the admin.localhost block above).
+# Over HTTPS you can also set ADMIN_PANEL_SESSION_COOKIE_SECURE=true on the admin-panel service.
+#server {
+#    listen 443 ssl http2;
+#    listen [::]:443 ssl http2;
+
+#    ssl_certificate /etc/nginx/ssl/nginx.crt;
+#    ssl_certificate_key /etc/nginx/ssl/nginx.key;
+
+#    server_name admin.localhost;
+
+#    client_max_body_size 25M;
+
+#    resolver 127.0.0.11 valid=30s;
+#    set $admin_panel_upstream http://admin-panel:3000;
+
+#    location / {
+#        proxy_pass $admin_panel_upstream;
+#        proxy_set_header Host $host;
+#        proxy_set_header X-Real-IP $remote_addr;
+#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#        proxy_set_header X-Forwarded-Proto $scheme;
+#        proxy_http_version 1.1;
+#        proxy_set_header Upgrade $http_upgrade;
+#        proxy_set_header Connection $connection_upgrade;
+#    }
+#}
diff --git a/client/package.json b/client/package.json
index 80b46c2b4cf..5128591cbce 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/frontend",
-  "version": "v0.8.6-rc1",
+  "version": "v0.8.7",
   "description": "",
   "type": "module",
   "scripts": {
@@ -29,12 +29,13 @@
   },
   "homepage": "https://librechat.ai",
   "dependencies": {
-    "@ariakit/react": "^0.4.15",
-    "@ariakit/react-core": "^0.4.17",
+    "@ariakit/react": "^0.4.29",
+    "@ariakit/react-core": "^0.4.26",
     "@codesandbox/sandpack-react": "^2.19.10",
     "@dicebear/collection": "^9.4.1",
     "@dicebear/core": "^9.4.1",
     "@headlessui/react": "^2.1.2",
+    "@hyperdx/browser": "^0.24.0",
     "@librechat/client": "*",
     "@marsidev/react-turnstile": "^1.1.0",
     "@mcp-ui/client": "^5.7.0",
@@ -69,7 +70,7 @@
     "downloadjs": "^1.4.7",
     "export-from-json": "^1.7.2",
     "filenamify": "^6.0.0",
-    "framer-motion": "^11.5.4",
+    "framer-motion": "^12.40.0",
     "heic-to": "^1.1.14",
     "html-to-image": "^1.11.11",
     "i18next": "^24.2.2",
@@ -81,8 +82,15 @@
     "lodash": "^4.17.23",
     "lucide-react": "^0.394.0",
     "match-sorter": "^8.1.0",
+    "mdast-util-directive": "^3.0.0",
+    "mdast-util-from-markdown": "^2.0.1",
+    "mdast-util-gfm": "^3.0.0",
+    "mdast-util-math": "^3.0.0",
     "mermaid": "^11.15.0",
+    "micromark-extension-directive": "^3.0.1",
+    "micromark-extension-gfm": "^3.0.0",
     "micromark-extension-llm-math": "^3.1.0",
+    "micromark-extension-math": "^3.1.0",
     "qrcode.react": "^4.2.0",
     "rc-input-number": "^7.4.2",
     "react": "^18.2.0",
@@ -110,7 +118,7 @@
     "remark-gfm": "^4.0.0",
     "remark-math": "^6.0.0",
     "remark-supersub": "^1.0.0",
-    "sse.js": "^2.5.0",
+    "sse.js": "^2.8.0",
     "swr": "^2.3.8",
     "tailwind-merge": "^1.9.1",
     "tailwindcss-animate": "^1.0.5",
@@ -132,10 +140,10 @@
     "@types/jest": "^29.5.14",
     "@types/js-cookie": "^3.0.6",
     "@types/lodash": "^4.17.15",
-    "@types/node": "^20.19.35",
+    "@types/node": "^24.12.4",
     "@types/react": "^18.2.11",
     "@types/react-dom": "^18.2.4",
-    "@vitejs/plugin-react": "^5.1.4",
+    "@vitejs/plugin-react": "^6.0.2",
     "autoprefixer": "^10.4.20",
     "babel-plugin-replace-ts-export-assignment": "^0.0.2",
     "babel-plugin-root-import": "^6.6.0",
@@ -148,15 +156,15 @@
     "jest-canvas-mock": "^2.5.2",
     "jest-environment-jsdom": "^30.2.0",
     "jest-file-loader": "^1.0.3",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "monaco-editor": "^0.55.1",
     "postcss": "^8.4.31",
     "postcss-preset-env": "^11.2.0",
     "tailwindcss": "^3.4.1",
-    "typescript": "^5.3.3",
-    "vite": "^7.3.1",
-    "vite-plugin-compression2": "^2.2.1",
-    "vite-plugin-node-polyfills": "^0.25.0",
-    "vite-plugin-pwa": "^1.2.0"
+    "typescript": "^5.9.3",
+    "vite": "^8.0.16",
+    "vite-plugin-compression2": "^2.5.3",
+    "vite-plugin-node-polyfills": "^0.28.0",
+    "vite-plugin-pwa": "^1.3.0"
   }
 }
diff --git a/client/src/@types/i18next.d.ts b/client/src/@types/i18next.d.ts
index 82f1ce1a3d1..2070c552715 100644
--- a/client/src/@types/i18next.d.ts
+++ b/client/src/@types/i18next.d.ts
@@ -1,9 +1,12 @@
-import { defaultNS, resources } from '~/locales/i18n';
+import translationEn from '~/locales/en/translation.json';
+import { defaultNS } from '~/locales/i18n';
 
 declare module 'i18next' {
   interface CustomTypeOptions {
     defaultNS: typeof defaultNS;
-    resources: typeof resources.en;
+    resources: {
+      translation: typeof translationEn;
+    };
     strictKeyChecks: true;
   }
 }
diff --git a/client/src/App.jsx b/client/src/App.jsx
index fe280f71297..78ed8438b04 100644
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -4,11 +4,12 @@ import { DndProvider } from 'react-dnd';
 import { RouterProvider } from 'react-router-dom';
 import * as RadixToast from '@radix-ui/react-toast';
 import { HTML5Backend } from 'react-dnd-html5-backend';
-import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
 import { Toast, ThemeProvider, ToastProvider } from '@librechat/client';
 import { QueryClient, QueryClientProvider, QueryCache } from '@tanstack/react-query';
 import { ScreenshotProvider, useApiErrorBoundary } from './hooks';
 import WakeLockManager from '~/components/System/WakeLockManager';
+import QueryDevtoolsGate from '~/components/QueryDevtoolsGate';
+import LanguageSync from '~/components/System/LanguageSync';
 import { getThemeFromEnv } from './utils/getThemeFromEnv';
 import { initializeFontSize } from '~/store/fontSize';
 import { LiveAnnouncer } from '~/a11y';
@@ -47,6 +48,7 @@ const App = () => {
   return (
     <QueryClientProvider client={queryClient}>
       <RecoilRoot>
+        <LanguageSync />
         <LiveAnnouncer>
           <ThemeProvider
             // Only pass initialTheme and themeRGB if environment theme exists
@@ -63,7 +65,7 @@ const App = () => {
                 <DndProvider backend={HTML5Backend}>
                   <RouterProvider router={router} />
                   <WakeLockManager />
-                  <ReactQueryDevtools initialIsOpen={false} position="top-right" />
+                  <QueryDevtoolsGate />
                   <Toast />
                   <RadixToast.Viewport className="pointer-events-none fixed inset-0 z-[1000] mx-auto my-2 flex max-w-[560px] flex-col items-stretch justify-start md:pb-5" />
                 </DndProvider>
diff --git a/client/src/Providers/ArtifactContext.tsx b/client/src/Providers/ArtifactContext.tsx
index 938f26d6e86..62136b7c78a 100644
--- a/client/src/Providers/ArtifactContext.tsx
+++ b/client/src/Providers/ArtifactContext.tsx
@@ -8,17 +8,31 @@ type TArtifactContext = {
 export const ArtifactContext = createContext<TArtifactContext>({} as TArtifactContext);
 export const useArtifactContext = () => useContext(ArtifactContext);
 
-export function ArtifactProvider({ children }: { children: ReactNode }) {
+export function ArtifactProvider({
+  children,
+  baseIndex = 0,
+}: {
+  children: ReactNode;
+  /**
+   * Offset added to every assigned index, so per-block memoized rendering can
+   * seed each block's provider with the count of artifacts in earlier blocks
+   * and keep document-order indices stable.
+   */
+  baseIndex?: number;
+}) {
   const counterRef = useRef(0);
 
-  const getNextIndex = useCallback((skip: boolean) => {
-    if (skip) {
-      return counterRef.current;
-    }
-    const nextIndex = counterRef.current;
-    counterRef.current += 1;
-    return nextIndex;
-  }, []);
+  const getNextIndex = useCallback(
+    (skip: boolean) => {
+      if (skip) {
+        return baseIndex + counterRef.current;
+      }
+      const nextIndex = counterRef.current;
+      counterRef.current += 1;
+      return baseIndex + nextIndex;
+    },
+    [baseIndex],
+  );
 
   const resetCounter = useCallback(() => {
     counterRef.current = 0;
diff --git a/client/src/Providers/ArtifactsContext.tsx b/client/src/Providers/ArtifactsContext.tsx
index fd67d5af948..2eb26e04b07 100644
--- a/client/src/Providers/ArtifactsContext.tsx
+++ b/client/src/Providers/ArtifactsContext.tsx
@@ -1,6 +1,6 @@
 import React, { createContext, useContext, useMemo } from 'react';
 import { useRecoilValue } from 'recoil';
-import type { TMessage } from 'librechat-data-provider';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { getLatestText } from '~/utils';
 import store from '~/store';
 
@@ -20,16 +20,12 @@ interface ArtifactsProviderProps {
 
 export function ArtifactsProvider({ children, value }: ArtifactsProviderProps) {
   const isSubmitting = useRecoilValue(store.isSubmittingFamily(0));
-  const latestMessage = useRecoilValue(store.latestMessageFamily(0));
+  const latestMessage = useLatestMessage(0);
   const conversationId = useRecoilValue(store.conversationIdByIndex(0));
 
   const chatLatestMessageText = useMemo(() => {
-    return getLatestText({
-      text: latestMessage?.text ?? null,
-      content: latestMessage?.content ?? null,
-      messageId: latestMessage?.messageId ?? null,
-    } as TMessage);
-  }, [latestMessage?.messageId, latestMessage?.text, latestMessage?.content]);
+    return getLatestText(latestMessage);
+  }, [latestMessage]);
 
   const defaultContextValue = useMemo<ArtifactsContextValue>(
     () => ({
diff --git a/client/src/Providers/BadgeRowContext.tsx b/client/src/Providers/BadgeRowContext.tsx
index 025532f0c6a..448af4339f5 100644
--- a/client/src/Providers/BadgeRowContext.tsx
+++ b/client/src/Providers/BadgeRowContext.tsx
@@ -1,7 +1,7 @@
 import React, { createContext, useContext, useEffect, useMemo, useRef } from 'react';
 import { useSetRecoilState } from 'recoil';
 import { Tools, Constants, LocalStorageKeys, AgentCapabilities } from 'librechat-data-provider';
-import type { TAgentsEndpoint } from 'librechat-data-provider';
+import type { TAgentsEndpoint, TEphemeralAgent } from 'librechat-data-provider';
 import {
   useMCPServerManager,
   useSearchApiKeyForm,
@@ -170,7 +170,7 @@ export default function BadgeRowProvider({
         if (prev == null) {
           /** ephemeralAgent is null — use localStorage defaults */
           if (hasOverrides || mcpOverrides) {
-            const result = { ...initialValues };
+            const result: TEphemeralAgent = { ...initialValues };
             if (mcpOverrides) {
               result.mcp = mcpOverrides;
             }
diff --git a/client/src/Providers/CodeBlockContext.tsx b/client/src/Providers/CodeBlockContext.tsx
index 2823f532bea..ad2ffe73509 100644
--- a/client/src/Providers/CodeBlockContext.tsx
+++ b/client/src/Providers/CodeBlockContext.tsx
@@ -8,17 +8,33 @@ type TCodeBlockContext = {
 export const CodeBlockContext = createContext<TCodeBlockContext>({} as TCodeBlockContext);
 export const useCodeBlockContext = () => useContext(CodeBlockContext);
 
-export function CodeBlockProvider({ children }: { children: ReactNode }) {
+export function CodeBlockProvider({
+  children,
+  baseIndex = 0,
+}: {
+  children: ReactNode;
+  /**
+   * Offset added to every assigned index. When rendering a message as
+   * independently memoized blocks, each block gets its own provider seeded with
+   * the running count of executable code blocks in earlier blocks, so document-
+   * order indices are preserved without a single shared (memoization-fragile)
+   * counter.
+   */
+  baseIndex?: number;
+}) {
   const counterRef = useRef(0);
 
-  const getNextIndex = useCallback((skip: boolean) => {
-    if (skip) {
-      return counterRef.current;
-    }
-    const nextIndex = counterRef.current;
-    counterRef.current += 1;
-    return nextIndex;
-  }, []);
+  const getNextIndex = useCallback(
+    (skip: boolean) => {
+      if (skip) {
+        return baseIndex + counterRef.current;
+      }
+      const nextIndex = counterRef.current;
+      counterRef.current += 1;
+      return baseIndex + nextIndex;
+    },
+    [baseIndex],
+  );
 
   const resetCounter = useCallback(() => {
     counterRef.current = 0;
diff --git a/client/src/Providers/MessagesViewContext.tsx b/client/src/Providers/MessagesViewContext.tsx
index c44972918c3..1d9172c95be 100644
--- a/client/src/Providers/MessagesViewContext.tsx
+++ b/client/src/Providers/MessagesViewContext.tsx
@@ -20,7 +20,6 @@ interface MessagesViewContextValue {
   index: ReturnType<typeof useChatContext>['index'];
   latestMessageId: ReturnType<typeof useChatContext>['latestMessageId'];
   latestMessageDepth: ReturnType<typeof useChatContext>['latestMessageDepth'];
-  setLatestMessage: ReturnType<typeof useChatContext>['setLatestMessage'];
   getMessages: ReturnType<typeof useChatContext>['getMessages'];
   setMessages: ReturnType<typeof useChatContext>['setMessages'];
 }
@@ -44,7 +43,6 @@ export function MessagesViewProvider({ children }: { children: React.ReactNode }
     latestMessageDepth,
     setAbortScroll,
     handleContinue,
-    setLatestMessage,
     abortScroll,
     getMessages,
     setMessages,
@@ -87,9 +85,8 @@ export function MessagesViewProvider({ children }: { children: React.ReactNode }
       index,
       latestMessageId,
       latestMessageDepth,
-      setLatestMessage,
     }),
-    [index, latestMessageId, latestMessageDepth, setLatestMessage],
+    [index, latestMessageId, latestMessageDepth],
   );
 
   /** Combine all values into final context value */
@@ -191,9 +188,9 @@ export function useOptionalMessagesConversation() {
 
 /** Hook for components that only need message state */
 export function useMessagesState() {
-  const { index, latestMessageId, latestMessageDepth, setLatestMessage } = useMessagesViewContext();
+  const { index, latestMessageId, latestMessageDepth } = useMessagesViewContext();
   return useMemo(
-    () => ({ index, latestMessageId, latestMessageDepth, setLatestMessage }),
-    [index, latestMessageId, latestMessageDepth, setLatestMessage],
+    () => ({ index, latestMessageId, latestMessageDepth }),
+    [index, latestMessageId, latestMessageDepth],
   );
 }
diff --git a/client/src/Providers/ShareContext.tsx b/client/src/Providers/ShareContext.tsx
index fc5a1db00aa..74caf07cb98 100644
--- a/client/src/Providers/ShareContext.tsx
+++ b/client/src/Providers/ShareContext.tsx
@@ -1,5 +1,5 @@
 import { createContext, useContext } from 'react';
-type TShareContext = { isSharedConvo?: boolean };
+type TShareContext = { isSharedConvo?: boolean; shareId?: string };
 
 export const ShareContext = createContext<TShareContext>({} as TShareContext);
 export const useShareContext = () => useContext(ShareContext);
diff --git a/client/src/a11y/LiveMessage.tsx b/client/src/a11y/LiveMessage.tsx
index b773deae53d..b25b48f1080 100644
--- a/client/src/a11y/LiveMessage.tsx
+++ b/client/src/a11y/LiveMessage.tsx
@@ -16,17 +16,17 @@ const LiveMessage: React.FC<LiveMessageProps> = ({
 
   useEffect(() => {
     if (ariaLive === 'assertive') {
-      announceAssertive(message);
+      announceAssertive({ message });
     } else if (ariaLive === 'polite') {
-      announcePolite(message);
+      announcePolite({ message });
     }
   }, [message, ariaLive, announceAssertive, announcePolite]);
 
   useEffect(() => {
     return () => {
       if (clearOnUnmount === true || clearOnUnmount === 'true') {
-        announceAssertive('');
-        announcePolite('');
+        announceAssertive({ message: '' });
+        announcePolite({ message: '' });
       }
     };
   }, [clearOnUnmount, announceAssertive, announcePolite]);
diff --git a/client/src/common/selector.ts b/client/src/common/selector.ts
index af69ca4af50..002755d114d 100644
--- a/client/src/common/selector.ts
+++ b/client/src/common/selector.ts
@@ -10,6 +10,8 @@ export interface Endpoint {
   agentNames?: Record<string, string>;
   assistantNames?: Record<string, string>;
   modelIcons?: Record<string, string | undefined>;
+  showMarketplace?: boolean;
+  searchAliases?: string[];
 }
 
 export interface SelectedValues {
diff --git a/client/src/common/types.ts b/client/src/common/types.ts
index 1db8ba3b3e7..a27743a8f0c 100644
--- a/client/src/common/types.ts
+++ b/client/src/common/types.ts
@@ -16,6 +16,8 @@ export function isEphemeralAgent(agentId: string | null | undefined): boolean {
 export interface ConfigFieldDetail {
   title: string;
   description: string;
+  /** Whether the field holds a secret and should be masked (defaults to masked when omitted). */
+  sensitive?: boolean;
 }
 
 export type CodeBarProps = {
@@ -349,6 +351,12 @@ export type TOptions = {
   isResubmission?: boolean;
   /** Currently only utilized when `isResubmission === true`, uses that message's currently attached files */
   overrideFiles?: t.TMessage['files'];
+  /**
+   * Assistant message being regenerated. Used to derive the optimistic response
+   * id for non-tail regenerations without accidentally keying the stream to the
+   * conversation tail.
+   */
+  targetResponseMessageId?: string | null;
   /**
    * Carry forward a user message's manually-invoked skills when the caller
    * is resubmitting / regenerating that same message — the compose-time
@@ -357,11 +365,18 @@ export type TOptions = {
    * pills are still visible on the user bubble.
    */
   overrideManualSkills?: string[];
+  /**
+   * Carry forward a user message's quoted excerpts when resubmitting /
+   * regenerating that same message — the compose-time atom is drained on the
+   * original submit, so without this the second turn would lose the quoted
+   * context even though the references still show on the user bubble.
+   */
+  overrideQuotes?: string[];
   /** Added conversation for multi-convo feature - sent to server as part of submission payload */
   addedConvo?: t.TConversation;
 };
 
-export type TAskFunction = (props: TAskProps, options?: TOptions) => void;
+export type TAskFunction = (props: TAskProps, options?: TOptions) => false | void;
 
 /**
  * Stable context object passed from non-memo'd wrapper components (Message, MessageContent)
@@ -604,7 +619,6 @@ export type NewConversationParams = {
   preset?: Partial<t.TPreset>;
   modelsData?: t.TModelsConfig;
   buildDefault?: boolean;
-  keepLatestMessage?: boolean;
   keepAddedConvos?: boolean;
   disableParams?: boolean;
 };
@@ -651,5 +665,8 @@ export type TThread = { id: string; createdAt: string };
 declare global {
   interface Window {
     google_tag_manager?: unknown;
+    __LIBRECHAT_CONFIG__?: {
+      enableQueryDevtools?: boolean;
+    };
   }
 }
diff --git a/client/src/components/Agents/Marketplace.tsx b/client/src/components/Agents/Marketplace.tsx
index adf406f7b06..1e534dbf85b 100644
--- a/client/src/components/Agents/Marketplace.tsx
+++ b/client/src/components/Agents/Marketplace.tsx
@@ -218,17 +218,17 @@ const AgentMarketplace: React.FC<AgentMarketplaceProps> = ({ className = '' }) =
             {/* Sticky wrapper for search bar and categories */}
             <div className="sticky top-0 z-10 mt-4 bg-presentation pb-4 md:mt-0">
               <div className="container mx-auto max-w-4xl px-4">
-                <div className="mx-auto mb-3 flex max-w-2xl items-center justify-between gap-2 md:hidden">
-                  <OpenSidebar />
-                  <MarketplaceAdminSettings compact />
-                </div>
+                {isSmallScreen ? (
+                  <div className="mx-auto mb-3 flex max-w-2xl items-center justify-between gap-2">
+                    <OpenSidebar />
+                    <MarketplaceAdminSettings compact />
+                  </div>
+                ) : null}
                 {/* Search bar */}
                 <div className="mx-auto flex max-w-2xl gap-2 pb-6">
                   <SearchBar value={searchQuery} onSearch={handleSearch} />
                   {/* TODO: Remove this once we have a better way to handle admin settings */}
-                  <div className="hidden md:block">
-                    <MarketplaceAdminSettings />
-                  </div>
+                  {!isSmallScreen && <MarketplaceAdminSettings />}
                 </div>
 
                 {/* Category tabs */}
diff --git a/client/src/components/Agents/VirtualizedAgentGrid.tsx b/client/src/components/Agents/VirtualizedAgentGrid.tsx
index 0fed2c19744..a2843c5b20b 100644
--- a/client/src/components/Agents/VirtualizedAgentGrid.tsx
+++ b/client/src/components/Agents/VirtualizedAgentGrid.tsx
@@ -1,8 +1,8 @@
 import React, { useMemo, useEffect, useCallback, useRef } from 'react';
-import { AutoSizer, List as VirtualList, WindowScroller } from 'react-virtualized';
 import { throttle } from 'lodash';
 import { Spinner } from '@librechat/client';
 import { PermissionBits } from 'librechat-data-provider';
+import { AutoSizer, List as VirtualList, WindowScroller } from 'react-virtualized';
 import type t from 'librechat-data-provider';
 import { useMarketplaceAgentsInfiniteQuery } from '~/data-provider/Agents';
 import { useAgentCategories, useLocalize } from '~/hooks';
@@ -175,7 +175,7 @@ const VirtualizedAgentGrid: React.FC<VirtualizedAgentGridProps> = ({
               const globalIndex = index * cardsPerRow + cardIndex;
               return (
                 <div key={`${agent.id}-${globalIndex}`} role="gridcell">
-                  <AgentCard agent={agent} onClick={() => onSelectAgent(agent)} />
+                  <AgentCard agent={agent} onSelect={onSelectAgent} />
                 </div>
               );
             })}
@@ -282,7 +282,7 @@ const VirtualizedAgentGrid: React.FC<VirtualizedAgentGridProps> = ({
                   const rowCount = getRowCount(currentAgents.length, cardsPerRow);
 
                   return (
-                    <div ref={registerChild}>
+                    <div ref={registerChild as React.LegacyRef<HTMLDivElement>}>
                       <VirtualList
                         ref={listRef}
                         autoHeight
diff --git a/client/src/components/Agents/tests/ErrorDisplay.spec.tsx b/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
index 303308cefc3..f0552669b4e 100644
--- a/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
+++ b/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
@@ -272,7 +272,7 @@ describe('ErrorDisplay', () => {
     });
 
     it('handles null/undefined errors', () => {
-      render(<ErrorDisplay error={null} />);
+      render(<ErrorDisplay error={{}} />);
 
       expect(screen.getByText('Something went wrong')).toBeInTheDocument();
       expect(
diff --git a/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx b/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
index 293bd8878e4..198ba4271fd 100644
--- a/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
+++ b/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
@@ -1,15 +1,55 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { jest } from '@jest/globals';
-import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
 import type * as t from 'librechat-data-provider';
+import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
+
+type RowRendererProps = {
+  index: number;
+  key: string;
+  style: React.CSSProperties;
+  parent: { props: { width: number } };
+};
+
+type VirtualListMockProps = {
+  rowRenderer: (props: RowRendererProps) => React.ReactNode;
+  rowCount: number;
+  width?: number;
+  style?: React.CSSProperties;
+  'aria-rowcount'?: number;
+  'data-testid'?: string;
+  'data-total-rows'?: number;
+};
+
+type WindowScrollerChildProps = {
+  height: number;
+  isScrolling: boolean;
+  registerChild: (ref: HTMLElement | null) => void;
+  onChildScroll: () => void;
+  scrollTop: number;
+};
+
+type LocalizeParams = {
+  count?: number;
+  category?: string;
+};
+
+type MockAgentCardProps = {
+  agent: {
+    id: string;
+    name?: string;
+    description?: string;
+  };
+};
 
 // Mock react-virtualized for performance testing
 const mockRowRenderer = jest.fn();
 
 jest.mock('react-virtualized', () => {
-  const mockRowRendererRef = { current: jest.fn() };
+  const ReactActual = jest.requireActual<typeof import('react')>('react');
+  const mockRowRendererRef: { current: VirtualListMockProps['rowRenderer'] | null } = {
+    current: null,
+  };
 
   return {
     AutoSizer: ({
@@ -24,62 +64,60 @@ jest.mock('react-virtualized', () => {
       }
       return children({ width: 1200, height: 800 });
     },
-    List: ({
-      rowRenderer,
-      rowCount,
-      autoHeight,
-      height,
-      width,
-      rowHeight,
-      overscanRowCount,
-      scrollTop,
-      isScrolling,
-      onScroll,
-      style,
-      'aria-rowcount': ariaRowCount,
-      'data-testid': dataTestId,
-      'data-total-rows': dataTotalRows,
-    }: {
-      rowRenderer: any;
-      rowCount: number;
-      [key: string]: any;
-    }) => {
-      // Store the row renderer for testing
-      if (typeof rowRenderer === 'function') {
-        mockRowRendererRef.current = rowRenderer;
-        mockRowRenderer.mockImplementation(rowRenderer);
-      }
-      // Only render visible rows to simulate virtualization
-      const visibleRows = Math.min(10, rowCount); // Simulate 10 visible rows
-      return (
-        <div
-          data-testid={dataTestId || 'virtual-list'}
-          data-total-rows={dataTotalRows || rowCount}
-          aria-rowcount={ariaRowCount}
-          style={style}
-        >
-          {Array.from({ length: visibleRows }, (_, index) =>
-            rowRenderer({
-              index,
-              key: `row-${index}`,
-              style: { height: 184 },
-              parent: { props: { width: width || 1200 } },
-            }),
-          )}
-        </div>
-      );
-    },
+    List: ReactActual.forwardRef(
+      (
+        {
+          rowRenderer,
+          rowCount,
+          width,
+          style,
+          'aria-rowcount': ariaRowCount,
+          'data-testid': dataTestId,
+          'data-total-rows': dataTotalRows,
+        }: VirtualListMockProps,
+        ref: React.ForwardedRef<{ forceUpdateGrid: () => void }>,
+      ) => {
+        ReactActual.useImperativeHandle(ref, () => ({
+          forceUpdateGrid: () => {},
+        }));
+
+        // Store the row renderer for testing
+        if (typeof rowRenderer === 'function') {
+          mockRowRendererRef.current = rowRenderer;
+          mockRowRenderer.mockImplementation(rowRenderer);
+        }
+        // Only render visible rows to simulate virtualization
+        const visibleRows = Math.min(10, rowCount); // Simulate 10 visible rows
+        return (
+          <div
+            data-testid={dataTestId || 'virtual-list'}
+            data-total-rows={dataTotalRows || rowCount}
+            aria-rowcount={ariaRowCount}
+            style={style}
+          >
+            {Array.from({ length: visibleRows }, (_, index) =>
+              rowRenderer({
+                index,
+                key: `row-${index}`,
+                style: { height: 184 },
+                parent: { props: { width: width || 1200 } },
+              }),
+            )}
+          </div>
+        );
+      },
+    ),
     WindowScroller: ({
       children,
-      scrollElement,
+      scrollElement: _scrollElement,
     }: {
-      children: (props: any) => React.ReactNode;
+      children: (props: WindowScrollerChildProps) => React.ReactNode;
       scrollElement?: HTMLElement | null;
     }) => {
       return children({
         height: 800,
         isScrolling: false,
-        registerChild: (ref: any) => {},
+        registerChild: (_ref: HTMLElement | null) => {},
         onChildScroll: () => {},
         scrollTop: 0,
       });
@@ -126,7 +164,7 @@ jest.mock('~/hooks', () => ({
       { value: 'development', label: 'Development' },
     ],
   }),
-  useLocalize: () => (key: string, params?: any) => {
+  useLocalize: () => (key: string, params?: LocalizeParams) => {
     if (key === 'com_agents_grid_announcement') {
       return `Found ${params?.count || 0} agents in ${params?.category || 'category'}`;
     }
@@ -139,7 +177,7 @@ jest.mock('../SmartLoader', () => ({
 }));
 
 jest.mock('../AgentCard', () => {
-  return function MockAgentCard({ agent }: { agent: any }) {
+  return function MockAgentCard({ agent }: MockAgentCardProps) {
     return (
       <div data-testid={`agent-card-${agent.id}`} style={{ height: '160px' }}>
         <h3>{agent.name}</h3>
diff --git a/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx b/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
index eed35afa0eb..2aed774e819 100644
--- a/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
+++ b/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
@@ -1,82 +1,115 @@
 import React from 'react';
-import { render, screen, waitFor } from '@testing-library/react';
+import { render, screen } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { jest } from '@jest/globals';
-import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
 import type t from 'librechat-data-provider';
+import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
+
+type RowRendererProps = {
+  index: number;
+  key: string;
+  style: React.CSSProperties;
+  parent: { props: { width: number } };
+};
+
+type VirtualListMockProps = {
+  rowRenderer: (props: RowRendererProps) => React.ReactNode;
+  rowCount: number;
+  width?: number;
+  style?: React.CSSProperties;
+  'aria-rowcount'?: number;
+  'data-testid'?: string;
+  'data-total-rows'?: number;
+};
+
+type WindowScrollerChildProps = {
+  height: number;
+  isScrolling: boolean;
+  registerChild: (ref: HTMLElement | null) => void;
+  onChildScroll: () => void;
+  scrollTop: number;
+};
+
+type MarketplaceAgentsMock = {
+  useMarketplaceAgentsInfiniteQuery: jest.Mock;
+};
+
+type LocalizeParams = {
+  count?: number;
+  category?: string;
+};
 
 // Mock react-virtualized
-jest.mock('react-virtualized', () => ({
-  AutoSizer: ({
-    children,
-    disableHeight,
-  }: {
-    children: (props: { width: number; height?: number }) => React.ReactNode;
-    disableHeight?: boolean;
-  }) => {
-    if (disableHeight) {
-      return children({ width: 800 });
-    }
-    return children({ width: 800, height: 600 });
-  },
-  List: ({
-    rowRenderer,
-    rowCount,
-    width,
-    style,
-    'aria-rowcount': ariaRowCount,
-    'data-testid': dataTestId,
-    'data-total-rows': dataTotalRows,
-  }: {
-    rowRenderer: any;
-    rowCount: number;
-    autoHeight?: boolean;
-    height?: number;
-    width?: number;
-    rowHeight?: number;
-    overscanRowCount?: number;
-    scrollTop?: number;
-    isScrolling?: boolean;
-    onScroll?: any;
-    style?: any;
-    'aria-rowcount'?: number;
-    'data-testid'?: string;
-    'data-total-rows'?: number;
-  }) => (
-    <div
-      data-testid={dataTestId || 'virtual-list'}
-      aria-rowcount={ariaRowCount}
-      data-total-rows={dataTotalRows}
-      style={style}
-    >
-      {Array.from({ length: Math.min(rowCount, 5) }, (_, index) =>
-        rowRenderer({
-          index,
-          key: `row-${index}`,
-          style: {},
-          parent: { props: { width: width || 800 } },
-        }),
-      )}
-    </div>
-  ),
-  WindowScroller: ({
-    children,
-  }: {
-    children: (props: any) => React.ReactNode;
-    scrollElement?: HTMLElement | null;
-  }) => {
-    return children({
-      height: 600,
-      isScrolling: false,
-      registerChild: (_ref: any) => {},
-      onChildScroll: () => {},
-      scrollTop: 0,
-    });
-  },
-}));
+jest.mock('react-virtualized', () => {
+  const ReactActual = jest.requireActual<typeof import('react')>('react');
+
+  return {
+    AutoSizer: ({
+      children,
+      disableHeight,
+    }: {
+      children: (props: { width: number; height?: number }) => React.ReactNode;
+      disableHeight?: boolean;
+    }) => {
+      if (disableHeight) {
+        return children({ width: 800 });
+      }
+      return children({ width: 800, height: 600 });
+    },
+    List: ReactActual.forwardRef(
+      (
+        {
+          rowRenderer,
+          rowCount,
+          width,
+          style,
+          'aria-rowcount': ariaRowCount,
+          'data-testid': dataTestId,
+          'data-total-rows': dataTotalRows,
+        }: VirtualListMockProps,
+        ref: React.ForwardedRef<{ forceUpdateGrid: () => void }>,
+      ) => {
+        ReactActual.useImperativeHandle(ref, () => ({
+          forceUpdateGrid: () => {},
+        }));
+
+        return (
+          <div
+            data-testid={dataTestId || 'virtual-list'}
+            aria-rowcount={ariaRowCount}
+            data-total-rows={dataTotalRows}
+            style={style}
+          >
+            {Array.from({ length: Math.min(rowCount, 5) }, (_, index) =>
+              rowRenderer({
+                index,
+                key: `row-${index}`,
+                style: {},
+                parent: { props: { width: width || 800 } },
+              }),
+            )}
+          </div>
+        );
+      },
+    ),
+    WindowScroller: ({
+      children,
+    }: {
+      children: (props: WindowScrollerChildProps) => React.ReactNode;
+      scrollElement?: HTMLElement | null;
+    }) => {
+      return children({
+        height: 600,
+        isScrolling: false,
+        registerChild: (_ref: HTMLElement | null) => {},
+        onChildScroll: () => {},
+        scrollTop: 0,
+      });
+    },
+  };
+});
 
 // Mock the data provider
-const mockInfiniteQuery = {
+const createMockInfiniteQuery = (overrides = {}) => ({
   data: {
     pages: [
       {
@@ -104,10 +137,11 @@ const mockInfiniteQuery = {
   hasNextPage: true,
   refetch: jest.fn(),
   isFetchingNextPage: false,
-};
+  ...overrides,
+});
 
 jest.mock('~/data-provider/Agents', () => ({
-  useMarketplaceAgentsInfiniteQuery: jest.fn(() => mockInfiniteQuery),
+  useMarketplaceAgentsInfiniteQuery: jest.fn(),
 }));
 
 // Mock other hooks
@@ -118,7 +152,7 @@ jest.mock('~/hooks', () => ({
       { value: 'development', label: 'Development' },
     ],
   }),
-  useLocalize: () => (key: string, params?: any) => {
+  useLocalize: () => (key: string, params?: LocalizeParams) => {
     if (key === 'com_agents_grid_announcement') {
       return `Found ${params?.count || 0} agents in ${params?.category || 'category'}`;
     }
@@ -131,9 +165,15 @@ jest.mock('../SmartLoader', () => ({
 }));
 
 jest.mock('../AgentCard', () => {
-  return function MockAgentCard({ agent, onClick }: { agent: t.Agent; onClick: () => void }) {
+  return function MockAgentCard({
+    agent,
+    onSelect,
+  }: {
+    agent: t.Agent;
+    onSelect: (agent: t.Agent) => void;
+  }) {
     return (
-      <div data-testid={`agent-card-${agent.id}`} onClick={onClick}>
+      <div data-testid={`agent-card-${agent.id}`} onClick={() => onSelect(agent)}>
         <h3>{agent.name}</h3>
         <p>{agent.description}</p>
       </div>
@@ -151,9 +191,16 @@ describe('VirtualizedAgentGrid', () => {
         mutations: { retry: false },
       },
     });
+
+    const useMarketplaceAgentsInfiniteQuery = (
+      jest.requireMock('~/data-provider/Agents') as MarketplaceAgentsMock
+    ).useMarketplaceAgentsInfiniteQuery;
+    useMarketplaceAgentsInfiniteQuery.mockImplementation(() => createMockInfiniteQuery());
   });
 
-  const renderComponent = (props = {}) => {
+  const renderComponent = (
+    props: Partial<React.ComponentProps<typeof VirtualizedAgentGrid>> = {},
+  ) => {
     const defaultProps = {
       category: 'all',
       searchQuery: '',
@@ -167,33 +214,27 @@ describe('VirtualizedAgentGrid', () => {
     );
   };
 
-  it('renders virtual list container', async () => {
+  it('renders virtual list container', () => {
     renderComponent();
 
-    await waitFor(() => {
-      expect(screen.getByTestId('virtual-list')).toBeInTheDocument();
-    });
+    expect(screen.getByTestId('virtual-list')).toBeInTheDocument();
   });
 
-  it('displays agent cards in virtual rows', async () => {
+  it('displays agent cards in virtual rows', () => {
     renderComponent();
 
-    await waitFor(() => {
-      expect(screen.getByTestId('agent-card-1')).toBeInTheDocument();
-      expect(screen.getByTestId('agent-card-2')).toBeInTheDocument();
-    });
+    expect(screen.getByTestId('agent-card-1')).toBeInTheDocument();
+    expect(screen.getByTestId('agent-card-2')).toBeInTheDocument();
 
     expect(screen.getByText('Test Agent 1')).toBeInTheDocument();
     expect(screen.getByText('Test Agent 2')).toBeInTheDocument();
   });
 
-  it('calls onSelectAgent when agent card is clicked', async () => {
+  it('calls onSelectAgent when agent card is clicked', () => {
     const onSelectAgent = jest.fn();
     renderComponent({ onSelectAgent });
 
-    await waitFor(() => {
-      expect(screen.getByTestId('agent-card-1')).toBeInTheDocument();
-    });
+    expect(screen.getByTestId('agent-card-1')).toBeInTheDocument();
 
     screen.getByTestId('agent-card-1').click();
 
@@ -205,15 +246,16 @@ describe('VirtualizedAgentGrid', () => {
     });
   });
 
-  it('shows loading spinner when loading', async () => {
+  it('shows loading spinner when loading', () => {
     const mockQuery = jest.fn(() => ({
-      ...mockInfiniteQuery,
+      ...createMockInfiniteQuery(),
       isLoading: true,
       data: undefined,
     }));
 
-    const useMarketplaceAgentsInfiniteQuery =
-      jest.requireMock('~/data-provider/Agents').useMarketplaceAgentsInfiniteQuery;
+    const useMarketplaceAgentsInfiniteQuery = (
+      jest.requireMock('~/data-provider/Agents') as MarketplaceAgentsMock
+    ).useMarketplaceAgentsInfiniteQuery;
     useMarketplaceAgentsInfiniteQuery.mockImplementation(mockQuery);
 
     renderComponent();
@@ -224,17 +266,10 @@ describe('VirtualizedAgentGrid', () => {
     expect(spinner).toHaveClass('h-8 w-8 text-primary');
   });
 
-  it('has proper accessibility attributes', async () => {
-    // Reset the mock to ensure we have data
-    const useMarketplaceAgentsInfiniteQuery =
-      jest.requireMock('~/data-provider/Agents').useMarketplaceAgentsInfiniteQuery;
-    useMarketplaceAgentsInfiniteQuery.mockImplementation(() => mockInfiniteQuery);
-
+  it('has proper accessibility attributes', () => {
     renderComponent({ category: 'productivity' });
 
-    await waitFor(() => {
-      expect(screen.getByTestId('virtual-list')).toBeInTheDocument();
-    });
+    expect(screen.getByTestId('virtual-list')).toBeInTheDocument();
 
     const gridContainer = screen.getByRole('grid');
     expect(gridContainer).toHaveAttribute('aria-label');
diff --git a/client/src/components/Artifacts/ArtifactCodeEditor.tsx b/client/src/components/Artifacts/ArtifactCodeEditor.tsx
index d03397821dd..a349f30eda0 100644
--- a/client/src/components/Artifacts/ArtifactCodeEditor.tsx
+++ b/client/src/components/Artifacts/ArtifactCodeEditor.tsx
@@ -49,6 +49,23 @@ const TYPE_MAP: Record<string, string> = {
   'application/vnd.mermaid': 'markdown',
 };
 
+type ArtifactEditTarget = {
+  artifactId: string;
+  messageId: string;
+  index: number;
+};
+
+type PendingUpdate = ArtifactEditTarget & {
+  code: string;
+  original: string;
+};
+
+type ArtifactMutationVars = {
+  messageId: string;
+  index: number;
+  updated: string;
+};
+
 function getMonacoLanguage(type?: string, language?: string): string {
   if (language && LANG_MAP[language]) {
     return LANG_MAP[language];
@@ -56,6 +73,30 @@ function getMonacoLanguage(type?: string, language?: string): string {
   return TYPE_MAP[type ?? ''] ?? 'plaintext';
 }
 
+function getArtifactEditTarget(artifact: Artifact): ArtifactEditTarget | null {
+  if (artifact.index == null) {
+    return null;
+  }
+
+  return {
+    artifactId: artifact.id,
+    messageId: artifact.messageId ?? '',
+    index: artifact.index,
+  };
+}
+
+function isSameArtifactTarget(left: ArtifactEditTarget, right: ArtifactEditTarget): boolean {
+  return (
+    left.artifactId === right.artifactId &&
+    left.messageId === right.messageId &&
+    left.index === right.index
+  );
+}
+
+function isSameMutationTarget(target: ArtifactEditTarget, vars: ArtifactMutationVars): boolean {
+  return target.messageId === vars.messageId && target.index === vars.index;
+}
+
 export const ArtifactCodeEditor = function ArtifactCodeEditor({
   artifact,
   monacoRef,
@@ -70,25 +111,68 @@ export const ArtifactCodeEditor = function ArtifactCodeEditor({
   const { setCurrentCode } = useCodeState();
   const [currentUpdate, setCurrentUpdate] = useState<string | null>(null);
   const { isMutating, setIsMutating } = useMutationState();
+  const artifactRef = useRef(artifact);
+  const isMutatingRef = useRef(isMutating);
+  const currentUpdateRef = useRef(currentUpdate);
+  const setCurrentCodeRef = useRef(setCurrentCode);
+  const pendingUpdateRef = useRef<PendingUpdate | null>(null);
+  const runMutationRef = useRef<(code: string, original?: string) => void>(() => {});
+
   const editArtifact = useEditArtifact({
     onMutate: (vars) => {
+      isMutatingRef.current = true;
+      currentUpdateRef.current = vars.updated;
       setIsMutating(true);
       setCurrentUpdate(vars.updated);
     },
-    onSuccess: () => {
+    onSuccess: (_data, vars) => {
+      isMutatingRef.current = false;
+      currentUpdateRef.current = null;
       setIsMutating(false);
       setCurrentUpdate(null);
+
+      const pending = pendingUpdateRef.current;
+      pendingUpdateRef.current = null;
+      const currentTarget = getArtifactEditTarget(artifactRef.current);
+      if (
+        pending == null ||
+        currentTarget == null ||
+        !isSameArtifactTarget(pending, currentTarget)
+      ) {
+        return;
+      }
+
+      const original = isSameMutationTarget(pending, vars) ? vars.updated : pending.original;
+      if (pending.code.trim() !== original.trim()) {
+        setCurrentCodeRef.current(pending.code);
+        runMutationRef.current(pending.code, original);
+      }
     },
     onError: () => {
+      const pending = pendingUpdateRef.current;
+      pendingUpdateRef.current = null;
+      isMutatingRef.current = false;
+      currentUpdateRef.current = null;
       setIsMutating(false);
+      setCurrentUpdate(null);
+
+      const currentTarget = getArtifactEditTarget(artifactRef.current);
+      if (
+        pending == null ||
+        currentTarget == null ||
+        !isSameArtifactTarget(pending, currentTarget)
+      ) {
+        return;
+      }
+
+      if (pending.code.trim() !== pending.original.trim()) {
+        setCurrentCodeRef.current(pending.code);
+        runMutationRef.current(pending.code, pending.original);
+      }
     },
   });
 
-  const artifactRef = useRef(artifact);
-  const isMutatingRef = useRef(isMutating);
-  const currentUpdateRef = useRef(currentUpdate);
   const editArtifactRef = useRef(editArtifact);
-  const setCurrentCodeRef = useRef(setCurrentCode);
   const prevContentRef = useRef(artifact.content ?? '');
   const prevArtifactId = useRef(artifact.id);
   const prevReadOnly = useRef(readOnly);
@@ -99,28 +183,51 @@ export const ArtifactCodeEditor = function ArtifactCodeEditor({
   editArtifactRef.current = editArtifact;
   setCurrentCodeRef.current = setCurrentCode;
 
+  const runMutation = useCallback(
+    (code: string, originalOverride?: string) => {
+      const art = artifactRef.current;
+      const target = getArtifactEditTarget(art);
+      if (readOnly || target == null) {
+        return;
+      }
+
+      const original = originalOverride ?? art.content ?? '';
+      if (isMutatingRef.current) {
+        pendingUpdateRef.current = {
+          ...target,
+          code,
+          original,
+        };
+        return;
+      }
+
+      const isNotOriginal = code.trim() !== original.trim();
+      const isNotRepeated =
+        currentUpdateRef.current == null ? true : code.trim() !== currentUpdateRef.current.trim();
+
+      if (!isNotOriginal || !isNotRepeated) {
+        return;
+      }
+
+      setCurrentCodeRef.current(code);
+      editArtifactRef.current.mutate({
+        index: target.index,
+        messageId: target.messageId,
+        original,
+        updated: code,
+      });
+    },
+    [readOnly],
+  );
+
+  runMutationRef.current = runMutation;
+
   const debouncedMutation = useMemo(
     () =>
       debounce((code: string) => {
-        if (readOnly || isMutatingRef.current || artifactRef.current.index == null) {
-          return;
-        }
-        const art = artifactRef.current;
-        const isNotOriginal = art.content != null && code.trim() !== art.content.trim();
-        const isNotRepeated =
-          currentUpdateRef.current == null ? true : code.trim() !== currentUpdateRef.current.trim();
-
-        if (art.content != null && isNotOriginal && isNotRepeated && art.index != null) {
-          setCurrentCodeRef.current(code);
-          editArtifactRef.current.mutate({
-            index: art.index,
-            messageId: art.messageId ?? '',
-            original: art.content,
-            updated: code,
-          });
-        }
+        runMutationRef.current(code);
       }, 500),
-    [readOnly],
+    [],
   );
 
   useEffect(() => {
@@ -176,6 +283,7 @@ export const ArtifactCodeEditor = function ArtifactCodeEditor({
       return;
     }
     prevArtifactId.current = artifact.id;
+    pendingUpdateRef.current = null;
     prevContentRef.current = artifact.content ?? '';
     const ed = monacoRef.current;
     if (ed && artifact.content != null) {
diff --git a/client/src/components/Artifacts/ArtifactPreview.tsx b/client/src/components/Artifacts/ArtifactPreview.tsx
index 8257f76887f..c49c22772e3 100644
--- a/client/src/components/Artifacts/ArtifactPreview.tsx
+++ b/client/src/components/Artifacts/ArtifactPreview.tsx
@@ -4,7 +4,7 @@ import type {
   SandpackProviderProps,
   SandpackPreviewRef,
 } from '@codesandbox/sandpack-react/unstyled';
-import type { TStartupConfig } from 'librechat-data-provider';
+import type { SandpackStartupConfig } from '~/utils/artifacts';
 import type { ArtifactFiles } from '~/common';
 import { sharedFiles, buildSandpackOptions } from '~/utils/artifacts';
 
@@ -23,7 +23,7 @@ export const ArtifactPreview = memo(function ({
   sharedProps: Partial<SandpackProviderProps>;
   previewRef: MutableRefObject<SandpackPreviewRef>;
   currentCode?: string;
-  startupConfig?: TStartupConfig;
+  startupConfig?: SandpackStartupConfig;
 }) {
   const artifactFiles = useMemo(() => {
     if (Object.keys(files).length === 0) {
diff --git a/client/src/components/Artifacts/ArtifactTabs.tsx b/client/src/components/Artifacts/ArtifactTabs.tsx
index 32332215f03..3ebc98a3661 100644
--- a/client/src/components/Artifacts/ArtifactTabs.tsx
+++ b/client/src/components/Artifacts/ArtifactTabs.tsx
@@ -3,11 +3,12 @@ import * as Tabs from '@radix-ui/react-tabs';
 import type { SandpackPreviewRef } from '@codesandbox/sandpack-react/unstyled';
 import type { editor } from 'monaco-editor';
 import type { Artifact } from '~/common';
-import { useCodeState } from '~/Providers/EditorContext';
+import { useGetSharedStartupConfig, useGetStartupConfig } from '~/data-provider';
 import useArtifactProps from '~/hooks/Artifacts/useArtifactProps';
 import { ArtifactCodeEditor } from './ArtifactCodeEditor';
-import { useGetStartupConfig } from '~/data-provider';
+import { useCodeState } from '~/Providers/EditorContext';
 import { ArtifactPreview } from './ArtifactPreview';
+import { useShareContext } from '~/Providers';
 
 export default function ArtifactTabs({
   artifact,
@@ -19,7 +20,14 @@ export default function ArtifactTabs({
   isSharedConvo?: boolean;
 }) {
   const { currentCode, setCurrentCode } = useCodeState();
-  const { data: startupConfig } = useGetStartupConfig();
+  const { shareId } = useShareContext();
+  const shouldUseSharedConfig =
+    isSharedConvo === true && typeof shareId === 'string' && shareId.length > 0;
+  const { data: startupConfig } = useGetStartupConfig({ enabled: !shouldUseSharedConfig });
+  const { data: sharedStartupConfig } = useGetSharedStartupConfig(shareId, {
+    enabled: shouldUseSharedConfig,
+  });
+  const resolvedStartupConfig = shouldUseSharedConfig ? sharedStartupConfig : startupConfig;
   const monacoRef = useRef<editor.IStandaloneCodeEditor | null>(null);
   const lastIdRef = useRef<string | null>(null);
 
@@ -55,7 +63,7 @@ export default function ArtifactTabs({
           previewRef={previewRef}
           sharedProps={sharedProps}
           currentCode={currentCode}
-          startupConfig={startupConfig}
+          startupConfig={resolvedStartupConfig}
         />
       </Tabs.Content>
     </div>
diff --git a/client/src/components/Artifacts/Mermaid.tsx b/client/src/components/Artifacts/Mermaid.tsx
deleted file mode 100644
index 5eb55be3aef..00000000000
--- a/client/src/components/Artifacts/Mermaid.tsx
+++ /dev/null
@@ -1,157 +0,0 @@
-import React, { useEffect, useRef, useState, useCallback } from 'react';
-import mermaid from 'mermaid';
-import { Button } from '@librechat/client';
-import { ZoomIn, ZoomOut, RotateCcw } from 'lucide-react';
-import { TransformWrapper, TransformComponent } from 'react-zoom-pan-pinch';
-import type { ReactZoomPanPinchRef } from 'react-zoom-pan-pinch';
-import { artifactFlowchartConfig } from '~/utils/mermaid';
-
-interface MermaidDiagramProps {
-  content: string;
-  isDarkMode?: boolean;
-}
-
-const MermaidDiagram: React.FC<MermaidDiagramProps> = ({ content, isDarkMode = true }) => {
-  const mermaidRef = useRef<HTMLDivElement>(null);
-  const transformRef = useRef<ReactZoomPanPinchRef>(null);
-  const [isRendered, setIsRendered] = useState(false);
-  const theme = isDarkMode ? 'dark' : 'neutral';
-  const bgColor = isDarkMode ? '#212121' : '#FFFFFF';
-
-  useEffect(() => {
-    mermaid.initialize({
-      startOnLoad: false,
-      theme,
-      securityLevel: 'sandbox',
-      flowchart: artifactFlowchartConfig,
-    });
-
-    const renderDiagram = async () => {
-      if (!mermaidRef.current) {
-        return;
-      }
-
-      try {
-        const { svg } = await mermaid.render('mermaid-diagram', content);
-        mermaidRef.current.innerHTML = svg;
-
-        const svgElement = mermaidRef.current.querySelector('svg');
-        if (svgElement) {
-          svgElement.style.width = '100%';
-          svgElement.style.height = '100%';
-        }
-        setIsRendered(true);
-      } catch (error) {
-        console.error('Mermaid rendering error:', error);
-        if (mermaidRef.current) {
-          mermaidRef.current.innerHTML = 'Error rendering diagram';
-        }
-      }
-    };
-
-    renderDiagram();
-  }, [content, theme]);
-
-  const centerAndFitDiagram = useCallback(() => {
-    if (transformRef.current && mermaidRef.current) {
-      const { centerView, zoomToElement } = transformRef.current;
-      zoomToElement(mermaidRef.current as HTMLElement);
-      centerView(1, 0);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (isRendered) {
-      centerAndFitDiagram();
-    }
-  }, [isRendered, centerAndFitDiagram]);
-
-  const handlePanning = useCallback(() => {
-    if (!transformRef.current) {
-      return;
-    }
-
-    const { state, instance } = transformRef.current;
-    if (!state || !instance) {
-      return;
-    }
-    const { scale, positionX, positionY } = state;
-    const { wrapperComponent, contentComponent } = instance;
-
-    if (!wrapperComponent || !contentComponent) {
-      return;
-    }
-
-    const wrapperRect = wrapperComponent.getBoundingClientRect();
-    const contentRect = contentComponent.getBoundingClientRect();
-    const maxX = wrapperRect.width - contentRect.width * scale;
-    const maxY = wrapperRect.height - contentRect.height * scale;
-
-    let newX = positionX;
-    let newY = positionY;
-
-    if (newX > 0) {
-      newX = 0;
-    }
-    if (newY > 0) {
-      newY = 0;
-    }
-    if (newX < maxX) {
-      newX = maxX;
-    }
-    if (newY < maxY) {
-      newY = maxY;
-    }
-
-    if (newX !== positionX || newY !== positionY) {
-      instance.setTransformState(scale, newX, newY);
-    }
-  }, []);
-
-  return (
-    <div
-      className="relative h-screen w-screen cursor-move p-5"
-      style={{ backgroundColor: bgColor }}
-    >
-      <TransformWrapper
-        ref={transformRef}
-        initialScale={1}
-        minScale={0.1}
-        maxScale={10}
-        limitToBounds={false}
-        centerOnInit={true}
-        initialPositionY={0}
-        wheel={{ step: 0.1 }}
-        panning={{ velocityDisabled: true }}
-        alignmentAnimation={{ disabled: true }}
-        onPanning={handlePanning}
-      >
-        {({ zoomIn, zoomOut }) => (
-          <>
-            <TransformComponent
-              wrapperStyle={{ width: '100%', height: '100%', overflow: 'hidden' }}
-            >
-              <div
-                ref={mermaidRef}
-                style={{ width: 'auto', height: 'auto', minWidth: '100%', minHeight: '100%' }}
-              />
-            </TransformComponent>
-            <div className="absolute bottom-2 right-2 flex space-x-2">
-              <Button onClick={() => zoomIn(0.1)} variant="outline" size="icon">
-                <ZoomIn className="h-4 w-4" />
-              </Button>
-              <Button onClick={() => zoomOut(0.1)} variant="outline" size="icon">
-                <ZoomOut className="h-4 w-4" />
-              </Button>
-              <Button onClick={centerAndFitDiagram} variant="outline" size="icon">
-                <RotateCcw className="h-4 w-4" />
-              </Button>
-            </div>
-          </>
-        )}
-      </TransformWrapper>
-    </div>
-  );
-};
-
-export default MermaidDiagram;
diff --git a/client/src/components/Audio/Voices.tsx b/client/src/components/Audio/Voices.tsx
index f41d57ac26f..5d1d843b588 100644
--- a/client/src/components/Audio/Voices.tsx
+++ b/client/src/components/Audio/Voices.tsx
@@ -6,7 +6,7 @@ import { useLocalize, useTTSBrowser, useTTSExternal } from '~/hooks';
 import { logger } from '~/utils';
 import store from '~/store';
 
-export function BrowserVoiceDropdown() {
+export function BrowserVoiceDropdown({ disabled = false }: { disabled?: boolean }) {
   const localize = useLocalize();
   const { voices = [] } = useTTSBrowser();
   const [voice, setVoice] = useRecoilState(store.voice);
@@ -33,12 +33,13 @@ export function BrowserVoiceDropdown() {
         testId="BrowserVoiceDropdown"
         className="z-50"
         aria-labelledby={labelId}
+        disabled={disabled}
       />
     </div>
   );
 }
 
-export function ExternalVoiceDropdown() {
+export function ExternalVoiceDropdown({ disabled = false }: { disabled?: boolean }) {
   const localize = useLocalize();
   const { voices = [] } = useTTSExternal();
   const [voice, setVoice] = useRecoilState(store.voice);
@@ -65,6 +66,7 @@ export function ExternalVoiceDropdown() {
         testId="ExternalVoiceDropdown"
         className="z-50"
         aria-labelledby={labelId}
+        disabled={disabled}
       />
     </div>
   );
diff --git a/client/src/components/Auth/LoginForm.tsx b/client/src/components/Auth/LoginForm.tsx
index c51c2002e32..3d0a2528d5f 100644
--- a/client/src/components/Auth/LoginForm.tsx
+++ b/client/src/components/Auth/LoginForm.tsx
@@ -1,7 +1,7 @@
 import React, { useState, useEffect, useContext } from 'react';
 import { useForm } from 'react-hook-form';
 import { Turnstile } from '@marsidev/react-turnstile';
-import { ThemeContext, Spinner, Button, isDark } from '@librechat/client';
+import { ThemeContext, SecretInput, Spinner, Button, isDark } from '@librechat/client';
 import type { TLoginUser, TStartupConfig } from 'librechat-data-provider';
 import type { TAuthContext } from '~/common';
 import { useResendVerificationEmail, useGetStartupConfig } from '~/data-provider';
@@ -31,6 +31,13 @@ const LoginForm: React.FC<TLoginFormProps> = ({ onSubmit, startupConfig, error,
   const useUsernameLogin = config?.ldap?.username;
   const validTheme = isDark(theme) ? 'dark' : 'light';
   const requireCaptcha = Boolean(startupConfig.turnstile?.siteKey);
+  const authInputClassName =
+    'webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 hover:border-border-light focus:border-green-500 focus:outline-none focus-visible:border-green-500';
+  const authSecretInputClassName = `${authInputClassName} h-auto pr-12`;
+  const authLabelClassName =
+    'absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-600 dark:peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4';
+  const authSecretButtonClassName =
+    'size-9 rounded-xl text-text-secondary-alt hover:bg-transparent hover:text-text-primary';
 
   useEffect(() => {
     if (error && error.includes('422') && !showResendLink) {
@@ -102,13 +109,10 @@ const LoginForm: React.FC<TLoginFormProps> = ({ onSubmit, startupConfig, error,
                   : (value) => validateEmail(value, localize('com_auth_email_pattern')),
               })}
               aria-invalid={!!errors.email}
-              className="webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 focus:border-green-500 focus:outline-none"
+              className={authInputClassName}
               placeholder=" "
             />
-            <label
-              htmlFor="email"
-              className="absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-600 dark:peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4"
-            >
+            <label htmlFor="email" className={authLabelClassName}>
               {useUsernameLogin
                 ? localize('com_auth_username').replace(/ \(.*$/, '')
                 : localize('com_auth_email_address')}
@@ -118,8 +122,7 @@ const LoginForm: React.FC<TLoginFormProps> = ({ onSubmit, startupConfig, error,
         </div>
         <div className="mb-2">
           <div className="relative">
-            <input
-              type="password"
+            <SecretInput
               id="password"
               autoComplete="current-password"
               aria-label={localize('com_auth_password')}
@@ -132,15 +135,13 @@ const LoginForm: React.FC<TLoginFormProps> = ({ onSubmit, startupConfig, error,
                 maxLength: { value: 128, message: localize('com_auth_password_max_length') },
               })}
               aria-invalid={!!errors.password}
-              className="webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 focus:border-green-500 focus:outline-none"
+              className={authSecretInputClassName}
               placeholder=" "
+              label={localize('com_auth_password')}
+              labelClassName={authLabelClassName}
+              controlsClassName="right-2"
+              buttonClassName={authSecretButtonClassName}
             />
-            <label
-              htmlFor="password"
-              className="absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-600 dark:peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4"
-            >
-              {localize('com_auth_password')}
-            </label>
           </div>
           {renderError('password')}
         </div>
diff --git a/client/src/components/Auth/Registration.tsx b/client/src/components/Auth/Registration.tsx
index 3766bdff50d..e37e3a7a506 100644
--- a/client/src/components/Auth/Registration.tsx
+++ b/client/src/components/Auth/Registration.tsx
@@ -1,7 +1,7 @@
 import { useForm } from 'react-hook-form';
 import React, { useContext, useState } from 'react';
 import { Turnstile } from '@marsidev/react-turnstile';
-import { ThemeContext, Spinner, Button, isDark } from '@librechat/client';
+import { ThemeContext, SecretInput, Spinner, Button, isDark } from '@librechat/client';
 import { useNavigate, useOutletContext, useLocation } from 'react-router-dom';
 import { useRegisterUserMutation } from 'librechat-data-provider/react-query';
 import { loginPage } from 'librechat-data-provider';
@@ -36,6 +36,13 @@ const Registration: React.FC = () => {
 
   // only require captcha if we have a siteKey
   const requireCaptcha = Boolean(startupConfig?.turnstile?.siteKey);
+  const authInputClassName =
+    'webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 hover:border-border-light focus:border-green-500 focus:outline-none focus-visible:border-green-500';
+  const authSecretInputClassName = `${authInputClassName} h-auto pr-12`;
+  const authLabelClassName =
+    'absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4';
+  const authSecretButtonClassName =
+    'size-9 rounded-xl text-text-secondary-alt hover:bg-transparent hover:text-text-primary';
 
   const registerUser = useRegisterUserMutation({
     onMutate: () => {
@@ -64,37 +71,58 @@ const Registration: React.FC = () => {
     },
   });
 
-  const renderInput = (id: string, label: TranslationKeys, type: string, validation: object) => (
-    <div className="mb-4">
-      <div className="relative">
-        <input
-          id={id}
-          type={type}
-          autoComplete={id}
-          aria-label={localize(label)}
-          {...register(
-            id as 'name' | 'email' | 'username' | 'password' | 'confirm_password',
-            validation,
+  const renderInput = (id: string, label: TranslationKeys, type: string, validation: object) => {
+    const fieldLabel = localize(label);
+    const field = register(
+      id as 'name' | 'email' | 'username' | 'password' | 'confirm_password',
+      validation,
+    );
+
+    return (
+      <div className="mb-4">
+        <div className="relative">
+          {type === 'password' ? (
+            <SecretInput
+              id={id}
+              autoComplete={id}
+              aria-label={fieldLabel}
+              {...field}
+              aria-invalid={!!errors[id]}
+              className={authSecretInputClassName}
+              placeholder=" "
+              data-testid={id}
+              label={fieldLabel}
+              labelClassName={authLabelClassName}
+              controlsClassName="right-2"
+              buttonClassName={authSecretButtonClassName}
+            />
+          ) : (
+            <>
+              <input
+                id={id}
+                type={type}
+                autoComplete={id}
+                aria-label={fieldLabel}
+                {...field}
+                aria-invalid={!!errors[id]}
+                className={authInputClassName}
+                placeholder=" "
+                data-testid={id}
+              />
+              <label htmlFor={id} className={authLabelClassName}>
+                {fieldLabel}
+              </label>
+            </>
           )}
-          aria-invalid={!!errors[id]}
-          className="webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 focus:border-green-500 focus:outline-none"
-          placeholder=" "
-          data-testid={id}
-        />
-        <label
-          htmlFor={id}
-          className="absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4"
-        >
-          {localize(label)}
-        </label>
+        </div>
+        {errors[id] && (
+          <span role="alert" className="mt-1 text-sm text-red-500">
+            {String(errors[id]?.message) ?? ''}
+          </span>
+        )}
       </div>
-      {errors[id] && (
-        <span role="alert" className="mt-1 text-sm text-red-500">
-          {String(errors[id]?.message) ?? ''}
-        </span>
-      )}
-    </div>
-  );
+    );
+  };
 
   return (
     <>
diff --git a/client/src/components/Auth/ResetPassword.tsx b/client/src/components/Auth/ResetPassword.tsx
index 6bececb7fe7..e86a499adcf 100644
--- a/client/src/components/Auth/ResetPassword.tsx
+++ b/client/src/components/Auth/ResetPassword.tsx
@@ -1,5 +1,5 @@
 import { useForm } from 'react-hook-form';
-import { Spinner, Button } from '@librechat/client';
+import { Spinner, Button, SecretInput } from '@librechat/client';
 import { useOutletContext } from 'react-router-dom';
 import { useNavigate, useSearchParams } from 'react-router-dom';
 import { useResetPasswordMutation } from 'librechat-data-provider/react-query';
@@ -20,6 +20,12 @@ function ResetPassword() {
   const password = watch('password');
   const resetPassword = useResetPasswordMutation();
   const { setError, setHeaderText, startupConfig } = useOutletContext<TLoginLayoutContext>();
+  const authInputClassName =
+    'webkit-dark-styles transition-color peer h-auto w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pr-12 pt-3 text-text-primary duration-200 hover:border-border-light focus:border-green-500 focus:outline-none focus-visible:border-green-500';
+  const authLabelClassName =
+    'absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4';
+  const authSecretButtonClassName =
+    'size-9 rounded-xl text-text-secondary-alt hover:bg-transparent hover:text-text-primary';
 
   const onSubmit = (data: TResetPassword) => {
     resetPassword.mutate(data, {
@@ -75,8 +81,7 @@ function ResetPassword() {
             value={params.get('userId') ?? ''}
             {...register('userId', { required: 'Unable to process: No valid user id' })}
           />
-          <input
-            type="password"
+          <SecretInput
             id="password"
             autoComplete="current-password"
             aria-label={localize('com_auth_password')}
@@ -92,15 +97,13 @@ function ResetPassword() {
               },
             })}
             aria-invalid={!!errors.password}
-            className="webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 focus:border-green-500 focus:outline-none"
+            className={authInputClassName}
             placeholder=" "
+            label={localize('com_auth_password')}
+            labelClassName={authLabelClassName}
+            controlsClassName="right-2"
+            buttonClassName={authSecretButtonClassName}
           />
-          <label
-            htmlFor="password"
-            className="absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4"
-          >
-            {localize('com_auth_password')}
-          </label>
         </div>
 
         {errors.password && (
@@ -111,23 +114,20 @@ function ResetPassword() {
       </div>
       <div className="mb-2">
         <div className="relative">
-          <input
-            type="password"
+          <SecretInput
             id="confirm_password"
             aria-label={localize('com_auth_password_confirm')}
             {...register('confirm_password', {
               validate: (value) => value === password || localize('com_auth_password_not_match'),
             })}
             aria-invalid={!!errors.confirm_password}
-            className="webkit-dark-styles transition-color peer w-full rounded-2xl border border-border-light bg-surface-primary px-3.5 pb-2.5 pt-3 text-text-primary duration-200 focus:border-green-500 focus:outline-none"
+            className={authInputClassName}
             placeholder=" "
+            label={localize('com_auth_password_confirm')}
+            labelClassName={authLabelClassName}
+            controlsClassName="right-2"
+            buttonClassName={authSecretButtonClassName}
           />
-          <label
-            htmlFor="confirm_password"
-            className="absolute start-3 top-1.5 z-10 origin-[0] -translate-y-4 scale-75 transform bg-surface-primary px-2 text-sm text-text-secondary-alt duration-200 peer-placeholder-shown:top-1/2 peer-placeholder-shown:-translate-y-1/2 peer-placeholder-shown:scale-100 peer-focus:top-1.5 peer-focus:-translate-y-4 peer-focus:scale-75 peer-focus:px-2 peer-focus:text-green-500 rtl:peer-focus:left-auto rtl:peer-focus:translate-x-1/4"
-          >
-            {localize('com_auth_password_confirm')}
-          </label>
         </div>
         {errors.confirm_password && (
           <span role="alert" className="mt-1 text-sm text-red-500 dark:text-red-900">
diff --git a/client/src/components/Auth/__tests__/Login.spec.tsx b/client/src/components/Auth/__tests__/Login.spec.tsx
index 3937deb6242..f01c12d2cfe 100644
--- a/client/src/components/Auth/__tests__/Login.spec.tsx
+++ b/client/src/components/Auth/__tests__/Login.spec.tsx
@@ -1,7 +1,7 @@
 import reactRouter from 'react-router-dom';
 import userEvent from '@testing-library/user-event';
-import { getByTestId, render, waitFor } from 'test/layout-test-utils';
 import type { TStartupConfig } from 'librechat-data-provider';
+import { getByTestId, render, waitFor } from 'test/layout-test-utils';
 import * as endpointQueries from '~/data-provider/Endpoints/queries';
 import * as miscDataProvider from '~/data-provider/Misc/queries';
 import * as authMutations from '~/data-provider/Auth/mutations';
@@ -176,7 +176,7 @@ test('calls loginUser.mutate on login', async () => {
 });
 
 test('Navigates to / on successful login', async () => {
-  const { getByLabelText, history } = setup({
+  const { getByLabelText } = setup({
     // @ts-ignore - we don't need all parameters of the QueryObserverResult
     useLoginUserReturnValue: {
       isLoading: false,
@@ -202,5 +202,5 @@ test('Navigates to / on successful login', async () => {
   await userEvent.type(passwordInput, 'password');
   await userEvent.click(submitButton);
 
-  waitFor(() => expect(history.location.pathname).toBe('/'));
+  waitFor(() => expect(window.location.pathname).toBe('/'));
 });
diff --git a/client/src/components/Auth/__tests__/LoginForm.spec.tsx b/client/src/components/Auth/__tests__/LoginForm.spec.tsx
index f6376d166d1..14692befaad 100644
--- a/client/src/components/Auth/__tests__/LoginForm.spec.tsx
+++ b/client/src/components/Auth/__tests__/LoginForm.spec.tsx
@@ -1,9 +1,9 @@
-import { render, getByTestId } from 'test/layout-test-utils';
 import userEvent from '@testing-library/user-event';
 import type { TStartupConfig } from 'librechat-data-provider';
 import * as endpointQueries from '~/data-provider/Endpoints/queries';
 import * as miscDataProvider from '~/data-provider/Misc/queries';
 import * as authMutations from '~/data-provider/Auth/mutations';
+import { render, getByTestId } from 'test/layout-test-utils';
 import * as authQueries from '~/data-provider/Auth/queries';
 import Login from '../LoginForm';
 
@@ -18,8 +18,10 @@ const mockStartupConfig: TStartupConfig = {
   githubLoginEnabled: true,
   googleLoginEnabled: true,
   openidLoginEnabled: true,
+  appleLoginEnabled: false,
   openidLabel: 'Test OpenID',
   openidImageUrl: 'http://test-server.com',
+  openidAutoRedirect: false,
   samlLoginEnabled: true,
   samlLabel: 'Test SAML',
   samlImageUrl: 'http://test-server.com',
@@ -33,9 +35,11 @@ const mockStartupConfig: TStartupConfig = {
     enabled: false,
   },
   emailEnabled: false,
-  checkBalance: false,
   showBirthdayIcon: false,
   helpAndFaqURL: '',
+  sharedLinksEnabled: true,
+  publicSharedLinksEnabled: true,
+  allowAccountDeletion: true,
 };
 
 const setup = ({
@@ -106,15 +110,25 @@ beforeEach(() => {
 
 test('renders login form', () => {
   const { getByLabelText } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   expect(getByLabelText(/email/i)).toBeInTheDocument();
   expect(getByLabelText(/password/i)).toBeInTheDocument();
 });
 
 test('submits login form', async () => {
-  const { getByLabelText, getByRole } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+  const { getByLabelText } = render(
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   const emailInput = getByLabelText(/email/i);
   const passwordInput = getByLabelText(/password/i);
@@ -128,8 +142,13 @@ test('submits login form', async () => {
 });
 
 test('displays validation error messages', async () => {
-  const { getByLabelText, getByRole, getByText } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+  const { getByLabelText, getByText } = render(
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   const emailInput = getByLabelText(/email/i);
   const passwordInput = getByLabelText(/password/i);
diff --git a/client/src/components/Banners/Banner.tsx b/client/src/components/Banners/Banner.tsx
index a1e9056c078..72c1891683d 100644
--- a/client/src/components/Banners/Banner.tsx
+++ b/client/src/components/Banners/Banner.tsx
@@ -1,8 +1,12 @@
-import DOMPurify from 'dompurify';
 import { XIcon } from 'lucide-react';
 import { useRecoilState } from 'recoil';
 import { Button, cn } from '@librechat/client';
 import { useEffect, useMemo, useRef } from 'react';
+import {
+  CONFIG_HTML_TEXT_TAGS,
+  CONFIG_HTML_CLASS_ATTR,
+  createConfigHtmlSanitizer,
+} from '~/utils/configHtml';
 import { useGetBannerQuery } from '~/data-provider';
 import store from '~/store';
 
@@ -10,25 +14,21 @@ export const Banner = ({ onHeightChange }: { onHeightChange?: (height: number) =
   const { data: banner } = useGetBannerQuery();
   const [hideBannerHint, setHideBannerHint] = useRecoilState<string[]>(store.hideBannerHint);
   const bannerRef = useRef<HTMLDivElement>(null);
+  const sanitize = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_TEXT_TAGS,
+        allowedAttr: CONFIG_HTML_CLASS_ATTR,
+      }),
+    [],
+  );
 
   const sanitizedMessage = useMemo(() => {
     if (!banner?.message) {
       return '';
     }
-    const sanitizer = DOMPurify();
-    sanitizer.addHook('afterSanitizeAttributes', (node) => {
-      if (node.tagName === 'A') {
-        node.setAttribute('target', '_blank');
-        node.setAttribute('rel', 'noopener noreferrer');
-      }
-    });
-    return sanitizer.sanitize(banner.message, {
-      ALLOWED_TAGS: ['a', 'strong', 'b', 'em', 'i', 'br', 'code', 'span'],
-      ALLOWED_ATTR: ['href', 'class', 'target', 'rel'],
-      ALLOW_DATA_ATTR: false,
-      ALLOW_ARIA_ATTR: false,
-    });
-  }, [banner?.message]);
+    return sanitize(banner.message);
+  }, [banner?.message, sanitize]);
 
   useEffect(() => {
     if (onHeightChange && bannerRef.current) {
diff --git a/client/src/components/Chat/ChatView.tsx b/client/src/components/Chat/ChatView.tsx
index d2bd7edf0da..1c84b93b82a 100644
--- a/client/src/components/Chat/ChatView.tsx
+++ b/client/src/components/Chat/ChatView.tsx
@@ -4,12 +4,19 @@ import { useForm } from 'react-hook-form';
 import { Spinner } from '@librechat/client';
 import { useParams } from 'react-router-dom';
 import { Constants, buildTree } from 'librechat-data-provider';
-import type { TMessage } from 'librechat-data-provider';
+import type { TChatProject, TMessage } from 'librechat-data-provider';
 import type { ChatFormValues } from '~/common';
+import {
+  useAddedResponse,
+  useResumeOnLoad,
+  useAdaptiveSSE,
+  useChatHelpers,
+  useLocalize,
+} from '~/hooks';
 import { ChatContext, AddedChatContext, ChatFormProvider, useFileMapContext } from '~/Providers';
-import { useAddedResponse, useResumeOnLoad, useAdaptiveSSE, useChatHelpers } from '~/hooks';
 import ConversationStarters from './Input/ConversationStarters';
 import { useGetMessagesByConvoId } from '~/data-provider';
+import ProjectLandingChip from './ProjectLandingChip';
 import MessagesView from './Messages/MessagesView';
 import Presentation from './Presentation';
 import ChatForm from './Input/ChatForm';
@@ -29,9 +36,11 @@ function LoadingSpinner() {
   );
 }
 
-function ChatView({ index = 0 }: { index?: number }) {
+function ChatView({ index = 0, project }: { index?: number; project?: TChatProject }) {
   const { conversationId } = useParams();
+  const localize = useLocalize();
   const rootSubmission = useRecoilValue(store.submissionByIndex(index));
+  const isSubmitting = useRecoilValue(store.isSubmittingFamily(index));
   const centerFormOnLanding = useRecoilValue(store.centerFormOnLanding);
 
   const methods = useForm<ChatFormValues>({
@@ -40,16 +49,20 @@ function ChatView({ index = 0 }: { index?: number }) {
 
   const fileMap = useFileMapContext();
 
-  const { data: messagesTree = null, isLoading } = useGetMessagesByConvoId(conversationId ?? '', {
-    select: useCallback(
-      (data: TMessage[]) => {
-        const dataTree = buildTree({ messages: data, fileMap });
-        return dataTree?.length === 0 ? null : (dataTree ?? null);
-      },
-      [fileMap],
-    ),
-    enabled: !!fileMap,
-  });
+  const { data: messagesTree = null, isLoading } = useGetMessagesByConvoId(
+    conversationId ?? '',
+    {
+      select: useCallback(
+        (data: TMessage[]) => {
+          const dataTree = buildTree({ messages: data, fileMap });
+          return dataTree?.length === 0 ? null : (dataTree ?? null);
+        },
+        [fileMap],
+      ),
+      enabled: !!fileMap,
+    },
+    { isStreaming: isSubmitting },
+  );
 
   const chatHelpers = useChatHelpers(index, conversationId);
   const addedChatHelpers = useAddedResponse();
@@ -65,6 +78,7 @@ function ChatView({ index = 0 }: { index?: number }) {
     (!messagesTree || messagesTree.length === 0) &&
     (conversationId === Constants.NEW_CONVO || !conversationId);
   const isNavigating = (!messagesTree || messagesTree.length === 0) && conversationId != null;
+  const isProjectLandingPage = isLandingPage && project != null;
 
   if (isLoading && conversationId !== Constants.NEW_CONVO) {
     content = <LoadingSpinner />;
@@ -76,6 +90,11 @@ function ChatView({ index = 0 }: { index?: number }) {
     content = <Landing centerFormOnLanding={centerFormOnLanding} />;
   }
 
+  const chatFormPlaceholder =
+    isProjectLandingPage && project
+      ? localize('com_ui_new_chat_in_project', { name: project.name })
+      : undefined;
+
   return (
     <ChatFormProvider {...methods}>
       <ChatContext.Provider value={chatHelpers}>
@@ -99,8 +118,10 @@ function ChatView({ index = 0 }: { index?: number }) {
                       isLandingPage && 'max-w-3xl transition-all duration-200 xl:max-w-4xl',
                     )}
                   >
-                    <ChatForm index={index} />
-                    {isLandingPage ? <ConversationStarters /> : <Footer />}
+                    {isProjectLandingPage && project && <ProjectLandingChip project={project} />}
+                    {isLandingPage && <ConversationStarters />}
+                    <ChatForm index={index} placeholder={chatFormPlaceholder} />
+                    {!isLandingPage && <Footer />}
                   </div>
                 </div>
                 {isLandingPage && <Footer />}
diff --git a/client/src/components/Chat/ExportAndShareMenu.tsx b/client/src/components/Chat/ExportAndShareMenu.tsx
index 739f2c497b6..5dcbe9ea139 100644
--- a/client/src/components/Chat/ExportAndShareMenu.tsx
+++ b/client/src/components/Chat/ExportAndShareMenu.tsx
@@ -2,11 +2,12 @@ import { useState, useId, useRef } from 'react';
 import { useRecoilValue } from 'recoil';
 import * as Ariakit from '@ariakit/react';
 import { Upload, Share2 } from 'lucide-react';
+import { PermissionTypes, Permissions } from 'librechat-data-provider';
 import { DropdownPopup, TooltipAnchor, useMediaQuery } from '@librechat/client';
 import type * as t from '~/common';
 import ExportModal from '~/components/Nav/ExportConversation/ExportModal';
 import { ShareButton } from '~/components/Conversations/ConvoOptions';
-import { useLocalize } from '~/hooks';
+import { useHasAccess, useLocalize } from '~/hooks';
 import store from '~/store';
 
 export default function ExportAndShareMenu({
@@ -22,6 +23,10 @@ export default function ExportAndShareMenu({
   const menuId = useId();
   const shareButtonRef = useRef<HTMLButtonElement>(null);
   const exportButtonRef = useRef<HTMLButtonElement>(null);
+  const canCreateSharedLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.CREATE,
+  });
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const conversation = useRecoilValue(store.conversationByIndex(0));
 
@@ -48,11 +53,11 @@ export default function ExportAndShareMenu({
       label: localize('com_ui_share'),
       onClick: shareHandler,
       icon: <Share2 className="icon-md mr-2 text-text-secondary" />,
-      show: isSharedButtonEnabled,
+      show: isSharedButtonEnabled && canCreateSharedLinks,
       /** NOTE: THE FOLLOWING PROPS ARE REQUIRED FOR MENU ITEMS THAT OPEN DIALOGS */
       hideOnClick: false,
       ref: shareButtonRef,
-      render: (props) => <button {...props} />,
+      render: (props) => <button {...props} data-testid="share-conversation-menu-item" />,
     },
     {
       label: localize('com_endpoint_export'),
diff --git a/client/src/components/Chat/Footer.tsx b/client/src/components/Chat/Footer.tsx
index 541647a8d0d..90d78737b94 100644
--- a/client/src/components/Chat/Footer.tsx
+++ b/client/src/components/Chat/Footer.tsx
@@ -2,11 +2,23 @@ import React, { useEffect, memo } from 'react';
 import TagManager from 'react-gtm-module';
 import ReactMarkdown from 'react-markdown';
 import { Constants } from 'librechat-data-provider';
+import type { TStartupConfig } from 'librechat-data-provider';
 import { useGetStartupConfig } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 
-function Footer({ className }: { className?: string }) {
-  const { data: config } = useGetStartupConfig();
+type FooterProps = {
+  className?: string;
+  startupConfig?: FooterStartupConfig | null;
+};
+
+type FooterStartupConfig = Pick<Partial<TStartupConfig>, 'analyticsGtmId' | 'customFooter'> & {
+  interface?: Pick<NonNullable<TStartupConfig['interface']>, 'privacyPolicy' | 'termsOfService'>;
+};
+
+function Footer({ className, startupConfig }: FooterProps) {
+  const shouldFetchConfig = startupConfig === undefined;
+  const { data: fetchedConfig } = useGetStartupConfig({ enabled: shouldFetchConfig });
+  const config = shouldFetchConfig ? fetchedConfig : startupConfig;
   const localize = useLocalize();
 
   const privacyPolicy = config?.interface?.privacyPolicy;
diff --git a/client/src/components/Chat/Header.tsx b/client/src/components/Chat/Header.tsx
index 31ff30ffce5..fc3e4e750ef 100644
--- a/client/src/components/Chat/Header.tsx
+++ b/client/src/components/Chat/Header.tsx
@@ -45,7 +45,7 @@ function Header() {
     <div className="via-presentation/70 md:from-presentation/80 md:via-presentation/50 2xl:from-presentation/0 absolute top-0 z-10 flex h-[52px] w-full items-center justify-between bg-gradient-to-b from-presentation to-transparent p-2 font-semibold text-text-primary 2xl:via-transparent">
       <div className="hide-scrollbar flex w-full items-center justify-between gap-2 overflow-x-auto">
         <div className="mx-1 flex items-center">
-          <OpenSidebar className="md:hidden" />
+          {isSmallScreen ? <OpenSidebar /> : null}
           {!(navVisible && isSmallScreen) && (
             <div
               className={cn(
diff --git a/client/src/components/Chat/Input/AddedConvo.tsx b/client/src/components/Chat/Input/AddedConvo.tsx
index 63152693ce0..764612ec90c 100644
--- a/client/src/components/Chat/Input/AddedConvo.tsx
+++ b/client/src/components/Chat/Input/AddedConvo.tsx
@@ -41,6 +41,7 @@ export default function AddedConvo({
           <EndpointIcon
             conversation={addedConvo}
             endpointsConfig={endpointsConfig}
+            agentsMap={agentsMap}
             containerClassName="shadow-stroke overflow-hidden rounded-full"
             context="menu-item"
             size={20}
diff --git a/client/src/components/Chat/Input/Artifacts.tsx b/client/src/components/Chat/Input/Artifacts.tsx
index bd406399868..ddc36eb7eef 100644
--- a/client/src/components/Chat/Input/Artifacts.tsx
+++ b/client/src/components/Chat/Input/Artifacts.tsx
@@ -1,10 +1,10 @@
 import React, { memo, useState, useCallback, useMemo, useEffect } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { CheckboxButton } from '@librechat/client';
-import { ArtifactModes } from 'librechat-data-provider';
 import { WandSparkles, ChevronDown } from 'lucide-react';
+import { ArtifactModes, defaultAgentCapabilities } from 'librechat-data-provider';
+import { useLocalize, useAgentCapabilities } from '~/hooks';
 import { useBadgeRowContext } from '~/Providers';
-import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
 interface ArtifactsToggleState {
@@ -17,6 +17,10 @@ function Artifacts() {
   const context = useBadgeRowContext();
   const { toggleState, debouncedChange, isPinned } = context?.artifacts ?? {};
 
+  const { artifactsEnabled } = useAgentCapabilities(
+    context?.agentsConfig?.capabilities ?? defaultAgentCapabilities,
+  );
+
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
   const [isButtonExpanded, setIsButtonExpanded] = useState(false);
 
@@ -73,6 +77,10 @@ function Artifacts() {
     }
   }, [isCustomEnabled, debouncedChange]);
 
+  if (!artifactsEnabled) {
+    return null;
+  }
+
   if (!isEnabled && !isPinned) {
     return null;
   }
diff --git a/client/src/components/Chat/Input/ArtifactsSubMenu.tsx b/client/src/components/Chat/Input/ArtifactsSubMenu.tsx
index b968c0ab555..2166cb669a3 100644
--- a/client/src/components/Chat/Input/ArtifactsSubMenu.tsx
+++ b/client/src/components/Chat/Input/ArtifactsSubMenu.tsx
@@ -1,12 +1,12 @@
 import React from 'react';
 import * as Ariakit from '@ariakit/react';
 import { PinIcon } from '@librechat/client';
-import { ChevronRight, WandSparkles } from 'lucide-react';
 import { ArtifactModes } from 'librechat-data-provider';
+import { ChevronRight, WandSparkles } from 'lucide-react';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
-interface ArtifactsSubMenuProps {
+interface ArtifactsSubMenuProps extends React.HTMLAttributes<HTMLButtonElement> {
   isArtifactsPinned: boolean;
   setIsArtifactsPinned: (value: boolean) => void;
   artifactsMode: string;
@@ -15,7 +15,7 @@ interface ArtifactsSubMenuProps {
   handleCustomToggle: () => void;
 }
 
-const ArtifactsSubMenu = React.forwardRef<HTMLDivElement, ArtifactsSubMenuProps>(
+const ArtifactsSubMenu = React.forwardRef<HTMLButtonElement, ArtifactsSubMenuProps>(
   (
     {
       isArtifactsPinned,
@@ -24,6 +24,7 @@ const ArtifactsSubMenu = React.forwardRef<HTMLDivElement, ArtifactsSubMenuProps>
       handleArtifactsToggle,
       handleShadcnToggle,
       handleCustomToggle,
+      className,
       ...props
     },
     ref,
@@ -41,25 +42,24 @@ const ArtifactsSubMenu = React.forwardRef<HTMLDivElement, ArtifactsSubMenuProps>
     const isCustomEnabled = artifactsMode === ArtifactModes.CUSTOM;
 
     return (
-      <div ref={ref}>
+      <>
         <Ariakit.MenuProvider store={menuStore}>
-          <Ariakit.MenuItem
+          <Ariakit.MenuButton
+            ref={ref}
             {...props}
-            hideOnClick={false}
-            render={
-              <Ariakit.MenuButton
-                onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
-                  e.stopPropagation();
-                  handleArtifactsToggle();
-                }}
-                onMouseEnter={() => {
-                  if (isEnabled) {
-                    menuStore.show();
-                  }
-                }}
-                className="flex w-full cursor-pointer items-center justify-between rounded-lg p-2 hover:bg-surface-hover"
-              />
-            }
+            onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
+              e.stopPropagation();
+              handleArtifactsToggle();
+            }}
+            onMouseEnter={() => {
+              if (isEnabled) {
+                menuStore.show();
+              }
+            }}
+            className={cn(
+              'flex w-full cursor-pointer items-center justify-between rounded-lg p-2 hover:bg-surface-hover',
+              className,
+            )}
           >
             <div className="flex items-center gap-2">
               <WandSparkles className="icon-md" aria-hidden="true" />
@@ -83,7 +83,7 @@ const ArtifactsSubMenu = React.forwardRef<HTMLDivElement, ArtifactsSubMenuProps>
                 <PinIcon unpin={isArtifactsPinned} />
               </div>
             </button>
-          </Ariakit.MenuItem>
+          </Ariakit.MenuButton>
 
           {isEnabled && (
             <Ariakit.Menu
@@ -144,7 +144,7 @@ const ArtifactsSubMenu = React.forwardRef<HTMLDivElement, ArtifactsSubMenuProps>
             </Ariakit.Menu>
           )}
         </Ariakit.MenuProvider>
-      </div>
+      </>
     );
   },
 );
diff --git a/client/src/components/Chat/Input/AudioRecorder.tsx b/client/src/components/Chat/Input/AudioRecorder.tsx
index e9e19d09047..3eaefcdcc87 100644
--- a/client/src/components/Chat/Input/AudioRecorder.tsx
+++ b/client/src/components/Chat/Input/AudioRecorder.tsx
@@ -2,8 +2,8 @@ import { memo, useCallback, useRef } from 'react';
 import { MicOff } from 'lucide-react';
 import { useToastContext, TooltipAnchor, ListeningIcon, Spinner } from '@librechat/client';
 import { useLocalize, useSpeechToText, useGetAudioSettings } from '~/hooks';
+import { globalAudioId, type TAskFunction } from '~/common';
 import { useChatFormContext } from '~/Providers';
-import { globalAudioId } from '~/common';
 import { cn } from '~/utils';
 
 const isExternalSTT = (speechToTextEndpoint: string) => speechToTextEndpoint === 'external';
@@ -11,13 +11,11 @@ export default memo(function AudioRecorder({
   disabled,
   ask,
   methods,
-  textAreaRef,
   isSubmitting,
 }: {
   disabled: boolean;
-  ask: (data: { text: string }) => void;
+  ask: TAskFunction;
   methods: ReturnType<typeof useChatFormContext>;
-  textAreaRef: React.RefObject<HTMLTextAreaElement>;
   isSubmitting: boolean;
 }) {
   const { setValue, reset, getValues } = methods;
@@ -49,7 +47,10 @@ export default memo(function AudioRecorder({
           isExternalSTT(speechToTextEndpoint) && existingTextRef.current
             ? `${existingTextRef.current} ${text}`
             : text;
-        ask({ text: finalText });
+        const submitted = ask({ text: finalText });
+        if (submitted === false) {
+          return;
+        }
         reset({ text: '' });
         existingTextRef.current = '';
       }
@@ -79,10 +80,6 @@ export default memo(function AudioRecorder({
     onTranscriptionComplete,
   );
 
-  if (!textAreaRef.current) {
-    return null;
-  }
-
   const handleStartRecording = async () => {
     existingTextRef.current = getValues('text') || '';
     startRecording();
diff --git a/client/src/components/Chat/Input/ChatForm.tsx b/client/src/components/Chat/Input/ChatForm.tsx
index a4f4f062f55..c02ee15e1a8 100644
--- a/client/src/components/Chat/Input/ChatForm.tsx
+++ b/client/src/components/Chat/Input/ChatForm.tsx
@@ -5,12 +5,6 @@ import { useRecoilState, useRecoilValue } from 'recoil';
 import { Constants, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import type { TConversation } from 'librechat-data-provider';
 import type { ExtendedFile, FileSetter, ConvoGenerator } from '~/common';
-import {
-  useChatContext,
-  useChatFormContext,
-  useAddedChatContext,
-  useAssistantsMapContext,
-} from '~/Providers';
 import {
   useTextarea,
   useAutoSave,
@@ -21,17 +15,27 @@ import {
   useSubmitMessage,
   useFocusChatEffect,
 } from '~/hooks';
+import {
+  useChatContext,
+  useChatFormContext,
+  useAddedChatContext,
+  useAssistantsMapContext,
+} from '~/Providers';
+import PendingManualSkillsChips from './PendingManualSkillsChips';
+import { cn, getModelSpec, removeFocusRings } from '~/utils';
+import { useGetStartupConfig } from '~/data-provider';
 import { mainTextareaId, BadgeItem } from '~/common';
+import PendingQuoteChips from './PendingQuoteChips';
 import AttachFileChat from './Files/AttachFileChat';
 import FileFormChat from './Files/FileFormChat';
-import { cn, removeFocusRings } from '~/utils';
 import TextareaHeader from './TextareaHeader';
-import PendingManualSkillsChips from './PendingManualSkillsChips';
-import SkillsCommand from './SkillsCommand';
 import PromptsCommand from './PromptsCommand';
+import SkillsCommand from './SkillsCommand';
 import AudioRecorder from './AudioRecorder';
 import CollapseChat from './CollapseChat';
+import QuoteButton from './QuoteButton';
 import StreamAudio from './StreamAudio';
+import TokenUsage from './TokenUsage';
 import StopButton from './StopButton';
 import SendButton from './SendButton';
 import EditBadges from './EditBadges';
@@ -41,6 +45,7 @@ import store from '~/store';
 
 interface ChatFormProps {
   index: number;
+  placeholder?: string;
   /** From ChatContext — individual values so memo can compare them */
   files: Map<string, ExtendedFile>;
   setFiles: FileSetter;
@@ -54,6 +59,7 @@ interface ChatFormProps {
 
 const ChatForm = memo(function ChatForm({
   index,
+  placeholder,
   files,
   setFiles,
   conversation,
@@ -96,15 +102,27 @@ const ChatForm = memo(function ChatForm({
     setConversation: setAddedConvo,
   } = useAddedChatContext();
   const assistantMap = useAssistantsMapContext();
+  const { data: startupConfig } = useGetStartupConfig();
 
   const endpoint = useMemo(
     () => conversation?.endpointType ?? conversation?.endpoint,
     [conversation?.endpointType, conversation?.endpoint],
   );
+  const modelSpec = useMemo(
+    () => getModelSpec({ specName: conversation?.spec, startupConfig }),
+    [conversation?.spec, startupConfig],
+  );
+  const hideBadgeRow = modelSpec?.hideBadgeRow === true;
   const conversationId = useMemo(
     () => conversation?.conversationId ?? Constants.NEW_CONVO,
     [conversation?.conversationId],
   );
+  /**
+   * The quote feature merges excerpts server-side in `BaseClient.sendMessage`,
+   * which the Assistants endpoints bypass — so hide the UI there rather than
+   * letting users queue quotes the assistant never receives.
+   */
+  const quotesEnabled = useMemo(() => !isAssistantsEndpoint(endpoint), [endpoint]);
 
   const isRTL = useMemo(
     () => (chatDirection != null ? chatDirection?.toLowerCase() === 'rtl' : false),
@@ -170,6 +188,7 @@ const ChatForm = memo(function ChatForm({
     submitButtonRef,
     setIsScrollable,
     disabled: disableInputs,
+    placeholder,
   });
 
   useQueryParams({ textAreaRef });
@@ -239,6 +258,8 @@ const ChatForm = memo(function ChatForm({
       )}
     >
       <div className="relative flex h-full flex-1 items-stretch md:flex-col">
+        {/* Primary composer owns the selection popup so split-view doesn't double it. */}
+        {index === 0 && quotesEnabled && <QuoteButton conversationId={conversationId} />}
         <div className={cn('flex w-full items-center', isRTL && 'flex-row-reverse')}>
           <Mention
             index={index}
@@ -274,6 +295,7 @@ const ChatForm = memo(function ChatForm({
           >
             <TextareaHeader addedConvo={addedConvo} setAddedConvo={setAddedConvo} />
             <PendingManualSkillsChips conversationId={conversationId} />
+            {quotesEnabled && <PendingQuoteChips conversationId={conversationId} />}
             {/* WIP */}
             <EditBadges
               isEditingChatBadges={isEditingBadges}
@@ -355,7 +377,10 @@ const ChatForm = memo(function ChatForm({
               </div>
               <BadgeRow
                 showEphemeralBadges={
-                  !!endpoint && !isAgentsEndpoint(endpoint) && !isAssistantsEndpoint(endpoint)
+                  !!endpoint &&
+                  !hideBadgeRow &&
+                  !isAgentsEndpoint(endpoint) &&
+                  !isAssistantsEndpoint(endpoint)
                 }
                 isSubmitting={isSubmitting}
                 conversationId={conversationId}
@@ -366,11 +391,11 @@ const ChatForm = memo(function ChatForm({
                 }
               />
               <div className="mx-auto flex" />
+              <TokenUsage index={index} conversation={conversation} isSubmitting={isSubmitting} />
               {SpeechToText && (
                 <AudioRecorder
                   methods={methods}
                   ask={submitMessage}
-                  textAreaRef={textAreaRef}
                   disabled={disableInputs || isNotAppendable}
                   isSubmitting={isSubmitting}
                 />
@@ -403,7 +428,7 @@ ChatForm.displayName = 'ChatForm';
  * to the memo'd ChatForm. This prevents ChatForm from re-rendering on every
  * streaming chunk — it only re-renders when the specific values it uses change.
  */
-function ChatFormWrapper({ index = 0 }: { index?: number }) {
+function ChatFormWrapper({ index = 0, placeholder }: { index?: number; placeholder?: string }) {
   const {
     files,
     setFiles,
@@ -432,6 +457,7 @@ function ChatFormWrapper({ index = 0 }: { index?: number }) {
       conversation?.spec,
       conversation?.useResponsesApi,
       conversation?.model,
+      conversation?.maxContextTokens,
       hasMessages,
     ],
   );
@@ -455,6 +481,7 @@ function ChatFormWrapper({ index = 0 }: { index?: number }) {
   return (
     <ChatForm
       index={index}
+      placeholder={placeholder}
       files={files}
       setFiles={setFiles}
       conversation={stableConversation}
diff --git a/client/src/components/Chat/Input/CircleRender.tsx b/client/src/components/Chat/Input/CircleRender.tsx
deleted file mode 100644
index 5b46f657448..00000000000
--- a/client/src/components/Chat/Input/CircleRender.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import React from 'react';
-import { ECallState } from 'librechat-data-provider';
-import { CircleIcon, CircleDotsIcon } from '@librechat/client';
-
-const CircleRender = ({ rmsLevel, isCameraOn, state }) => {
-  const getIconComponent = (state) => {
-    switch (state) {
-      case ECallState.Thinking:
-        return <CircleDotsIcon />;
-      default:
-        return (
-          <div className="smooth-transition" style={{ transform: `scale(${transformScale})` }}>
-            <CircleIcon state={state} size="256" />
-          </div>
-        );
-    }
-  };
-
-  const baseScale = isCameraOn ? 0.5 : 1;
-  const scaleMultiplier =
-    rmsLevel > 0.08
-      ? 1.8
-      : rmsLevel > 0.07
-        ? 1.6
-        : rmsLevel > 0.05
-          ? 1.4
-          : rmsLevel > 0.01
-            ? 1.2
-            : 1;
-
-  const transformScale = baseScale * scaleMultiplier;
-
-  return getIconComponent(state);
-};
-
-export default CircleRender;
diff --git a/client/src/components/Chat/Input/ConversationStarters.tsx b/client/src/components/Chat/Input/ConversationStarters.tsx
index bd78f4b2b43..ea9549e1808 100644
--- a/client/src/components/Chat/Input/ConversationStarters.tsx
+++ b/client/src/components/Chat/Input/ConversationStarters.tsx
@@ -1,8 +1,12 @@
 import { useMemo, useCallback } from 'react';
 import { EModelEndpoint, Constants } from 'librechat-data-provider';
+import {
+  useGetAssistantDocsQuery,
+  useGetEndpointsQuery,
+  useGetStartupConfig,
+} from '~/data-provider';
 import { useChatContext, useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
-import { useGetAssistantDocsQuery, useGetEndpointsQuery } from '~/data-provider';
-import { getIconEndpoint, getEntity } from '~/utils';
+import { getIconEndpoint, getEntity, getModelSpec } from '~/utils';
 import { useSubmitMessage } from '~/hooks';
 
 const ConversationStarters = () => {
@@ -10,6 +14,7 @@ const ConversationStarters = () => {
   const agentsMap = useAgentsMapContext();
   const assistantMap = useAssistantsMapContext();
   const { data: endpointsConfig } = useGetEndpointsQuery();
+  const { data: startupConfig } = useGetStartupConfig();
 
   const endpointType = useMemo(() => {
     let ep = conversation?.endpoint ?? '';
@@ -35,17 +40,26 @@ const ConversationStarters = () => {
     assistant_id: conversation?.assistant_id,
   });
 
+  const modelSpec = useMemo(
+    () => getModelSpec({ specName: conversation?.spec, startupConfig }),
+    [conversation?.spec, startupConfig],
+  );
+
   const conversation_starters = useMemo(() => {
     if (entity?.conversation_starters?.length) {
       return entity.conversation_starters;
     }
 
+    if (modelSpec?.conversation_starters?.length) {
+      return modelSpec.conversation_starters;
+    }
+
     if (isAgent) {
       return [];
     }
 
     return documentsMap.get(entity?.id ?? '')?.conversation_starters ?? [];
-  }, [documentsMap, isAgent, entity]);
+  }, [documentsMap, isAgent, entity, modelSpec]);
 
   const { submitMessage } = useSubmitMessage();
   const sendConversationStarter = useCallback(
@@ -58,18 +72,17 @@ const ConversationStarters = () => {
   }
 
   return (
-    <div className="mt-8 flex flex-wrap justify-center gap-3 px-4">
+    <div className="mb-8 mt-2 flex w-full flex-wrap items-stretch justify-center gap-2 px-4">
       {conversation_starters
         .slice(0, Constants.MAX_CONVO_STARTERS)
         .map((text: string, index: number) => (
           <button
             key={index}
             onClick={() => sendConversationStarter(text)}
-            className="relative flex w-40 cursor-pointer flex-col gap-2 rounded-2xl border border-border-medium px-3 pb-4 pt-3 text-start align-top text-[15px] shadow-[0_0_2px_0_rgba(0,0,0,0.05),0_4px_6px_0_rgba(0,0,0,0.02)] transition-colors duration-300 ease-in-out fade-in hover:bg-surface-tertiary"
+            style={{ animationDelay: `${index * 75}ms`, animationFillMode: 'backwards' }}
+            className="flex max-w-[16rem] cursor-pointer items-center justify-center rounded-2xl border border-border-medium bg-surface-secondary px-4 py-2.5 text-center text-sm text-text-secondary shadow-sm transition-colors duration-200 fade-in hover:border-border-heavy hover:bg-surface-tertiary hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary"
           >
-            <p className="break-word line-clamp-3 overflow-hidden text-balance break-all text-text-secondary">
-              {text}
-            </p>
+            <span className="line-clamp-2 text-balance break-words">{text}</span>
           </button>
         ))}
     </div>
diff --git a/client/src/components/Chat/Input/Files/AttachFile.tsx b/client/src/components/Chat/Input/Files/AttachFile.tsx
index 098fa2c4c3f..413caa21b21 100644
--- a/client/src/components/Chat/Input/Files/AttachFile.tsx
+++ b/client/src/components/Chat/Input/Files/AttachFile.tsx
@@ -2,6 +2,7 @@ import React, { useRef } from 'react';
 import { FileUpload, TooltipAnchor, AttachmentIcon } from '@librechat/client';
 import type { TConversation } from 'librechat-data-provider';
 import type { ExtendedFile, FileSetter } from '~/common';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { useFileHandlingNoChatContext, useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -21,6 +22,8 @@ const AttachFile = ({
   const localize = useLocalize();
   const inputRef = useRef<HTMLInputElement>(null);
   const isUploadDisabled = disabled ?? false;
+  const tooltipDescription = useShortcutHint('uploadFile', localize('com_sidepanel_attach_files'));
+  const ariaKey = useShortcutAriaKey('uploadFile');
 
   const { handleFileChange } = useFileHandlingNoChatContext(undefined, {
     files,
@@ -32,13 +35,14 @@ const AttachFile = ({
   return (
     <FileUpload ref={inputRef} handleFileChange={handleFileChange}>
       <TooltipAnchor
-        description={localize('com_sidepanel_attach_files')}
+        description={tooltipDescription}
         id="attach-file"
         disabled={isUploadDisabled}
         render={
           <button
             type="button"
             aria-label={localize('com_sidepanel_attach_files')}
+            aria-keyshortcuts={ariaKey}
             disabled={isUploadDisabled}
             className={cn(
               'flex size-9 items-center justify-center rounded-full p-1 transition-colors hover:bg-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary focus-visible:ring-opacity-50',
diff --git a/client/src/components/Chat/Input/Files/AttachFileMenu.tsx b/client/src/components/Chat/Input/Files/AttachFileMenu.tsx
index b39a1302c21..952b337b3c4 100644
--- a/client/src/components/Chat/Input/Files/AttachFileMenu.tsx
+++ b/client/src/components/Chat/Input/Files/AttachFileMenu.tsx
@@ -34,6 +34,7 @@ import {
   useLocalize,
 } from '~/hooks';
 import { useSharePointFileHandlingNoChatContext } from '~/hooks/Files/useSharePointFileHandling';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { SharePointPickerDialog } from '~/components/SharePoint';
 import { useGetStartupConfig } from '~/data-provider';
 import { ephemeralAgentByConvoId } from '~/store';
@@ -78,6 +79,8 @@ const AttachFileMenu = ({
   const isUploadDisabled = disabled ?? false;
   const inputRef = useRef<HTMLInputElement>(null);
   const [isPopoverActive, setIsPopoverActive] = useState(false);
+  const uploadFileTooltip = useShortcutHint('uploadFile', localize('com_sidepanel_attach_files'));
+  const uploadFileAriaKey = useShortcutAriaKey('uploadFile');
   const [ephemeralAgent, setEphemeralAgent] = useRecoilState(
     ephemeralAgentByConvoId(conversationId),
   );
@@ -277,6 +280,7 @@ const AttachFileMenu = ({
           disabled={isUploadDisabled}
           id="attach-file-menu-button"
           aria-label="Attach File Options"
+          aria-keyshortcuts={uploadFileAriaKey}
           className={cn(
             'flex size-9 items-center justify-center rounded-full p-1 hover:bg-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary focus-visible:ring-opacity-50',
             isPopoverActive && 'bg-surface-hover',
@@ -288,7 +292,7 @@ const AttachFileMenu = ({
         </Ariakit.MenuButton>
       }
       id="attach-file-menu-button"
-      description={localize('com_sidepanel_attach_files')}
+      description={uploadFileTooltip}
       disabled={isUploadDisabled}
     />
   );
diff --git a/client/src/components/Chat/Input/Files/FileRow.tsx b/client/src/components/Chat/Input/Files/FileRow.tsx
index bf04b16ade0..27bef5526d0 100644
--- a/client/src/components/Chat/Input/Files/FileRow.tsx
+++ b/client/src/components/Chat/Input/Files/FileRow.tsx
@@ -115,7 +115,7 @@ export default function FileRow({
               if (abortUpload && file.progress < 1) {
                 abortUpload();
               }
-              if (file.progress >= 1) {
+              if (file.progress >= 1 && !file.attached) {
                 showToast({
                   message: localize('com_ui_deleting_file'),
                   status: 'info',
diff --git a/client/src/components/Chat/Input/Files/__tests__/AttachFileMenu.spec.tsx b/client/src/components/Chat/Input/Files/__tests__/AttachFileMenu.spec.tsx
index 25b2014d516..3f86cb5102c 100644
--- a/client/src/components/Chat/Input/Files/__tests__/AttachFileMenu.spec.tsx
+++ b/client/src/components/Chat/Input/Files/__tests__/AttachFileMenu.spec.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
-import { render, screen, fireEvent } from '@testing-library/react';
 import { RecoilRoot } from 'recoil';
+import { render, screen, fireEvent } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { EModelEndpoint, EToolResources, Providers } from 'librechat-data-provider';
 import AttachFileMenu from '../AttachFileMenu';
diff --git a/client/src/components/Chat/Input/MCPConfigDialog.tsx b/client/src/components/Chat/Input/MCPConfigDialog.tsx
index a4cb03251e5..0e054d7b91e 100644
--- a/client/src/components/Chat/Input/MCPConfigDialog.tsx
+++ b/client/src/components/Chat/Input/MCPConfigDialog.tsx
@@ -1,8 +1,12 @@
-import DOMPurify from 'dompurify';
 import React, { useEffect, useMemo } from 'react';
 import { useForm, Controller } from 'react-hook-form';
-import { Button, Input, Label, OGDialog, OGDialogTemplate } from '@librechat/client';
+import { Button, Input, Label, SecretInput, OGDialog, OGDialogTemplate } from '@librechat/client';
 import type { ConfigFieldDetail } from '~/common';
+import {
+  CONFIG_HTML_BLOCK_TAGS,
+  CONFIG_HTML_CLASS_ATTR,
+  createConfigHtmlSanitizer,
+} from '~/utils/configHtml';
 import { useLocalize } from '~/hooks';
 
 interface MCPConfigDialogProps {
@@ -36,24 +40,14 @@ export default function MCPConfigDialog({
     defaultValues: initialValues,
   });
 
-  const sanitizer = useMemo(() => {
-    const instance = DOMPurify();
-    instance.addHook('afterSanitizeAttributes', (node) => {
-      if (node.tagName === 'A') {
-        node.setAttribute('target', '_blank');
-        node.setAttribute('rel', 'noopener noreferrer');
-      }
-    });
-    return instance;
-  }, []);
-
-  const sanitize = (html: string) =>
-    sanitizer.sanitize(html, {
-      ALLOWED_TAGS: ['a', 'strong', 'b', 'em', 'i', 'br', 'code', 'span', 'p'],
-      ALLOWED_ATTR: ['href', 'class', 'target', 'rel'],
-      ALLOW_DATA_ATTR: false,
-      ALLOW_ARIA_ATTR: false,
-    });
+  const sanitize = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_BLOCK_TAGS,
+        allowedAttr: CONFIG_HTML_CLASS_ATTR,
+      }),
+    [],
+  );
 
   useEffect(() => {
     if (isOpen) {
@@ -90,15 +84,34 @@ export default function MCPConfigDialog({
                   name={key}
                   control={control}
                   defaultValue={initialValues[key] || ''}
-                  render={({ field }) => (
-                    <Input
-                      id={key}
-                      type="text"
-                      {...field}
-                      placeholder={localize('com_ui_mcp_enter_var', { 0: details.title })}
-                      className="w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 dark:border-gray-600 dark:bg-gray-700 dark:text-white sm:text-sm"
-                    />
-                  )}
+                  render={({ field }) => {
+                    const placeholder = localize('com_ui_mcp_enter_var', { 0: details.title });
+                    const className =
+                      'w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 dark:border-gray-600 dark:bg-gray-700 dark:text-white sm:text-sm';
+                    if (details.sensitive === false) {
+                      return (
+                        <Input
+                          id={key}
+                          {...field}
+                          type="text"
+                          placeholder={placeholder}
+                          className={className}
+                        />
+                      );
+                    }
+                    return (
+                      <SecretInput
+                        id={key}
+                        {...field}
+                        autoComplete="new-password"
+                        data-lpignore="true"
+                        data-1p-ignore="true"
+                        controlsOnHover
+                        placeholder={placeholder}
+                        className={className}
+                      />
+                    );
+                  }}
                 />
                 {details.description && (
                   <p
diff --git a/client/src/components/Chat/Input/MCPSubMenu.tsx b/client/src/components/Chat/Input/MCPSubMenu.tsx
index a1ed542d97b..c66a6d9df22 100644
--- a/client/src/components/Chat/Input/MCPSubMenu.tsx
+++ b/client/src/components/Chat/Input/MCPSubMenu.tsx
@@ -8,12 +8,12 @@ import { useBadgeRowContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
-interface MCPSubMenuProps {
+interface MCPSubMenuProps extends React.HTMLAttributes<HTMLButtonElement> {
   placeholder?: string;
 }
 
-const MCPSubMenu = React.forwardRef<HTMLDivElement, MCPSubMenuProps>(
-  ({ placeholder, ...props }, ref) => {
+const MCPSubMenu = React.forwardRef<HTMLButtonElement, MCPSubMenuProps>(
+  ({ placeholder, className, ...props }, ref) => {
     const localize = useLocalize();
     const context = useBadgeRowContext();
     const { storageContextKey, mcpServerManager } = context ?? {};
@@ -48,20 +48,19 @@ const MCPSubMenu = React.forwardRef<HTMLDivElement, MCPSubMenuProps>(
     const configDialogProps = getConfigDialogProps();
 
     return (
-      <div ref={ref}>
+      <>
         <Ariakit.MenuProvider store={menuStore}>
-          <Ariakit.MenuItem
+          <Ariakit.MenuButton
+            ref={ref}
             {...props}
-            hideOnClick={false}
-            render={
-              <Ariakit.MenuButton
-                onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
-                  e.stopPropagation();
-                  menuStore.toggle();
-                }}
-                className="flex w-full cursor-pointer items-center justify-between rounded-lg p-2 hover:bg-surface-hover"
-              />
-            }
+            onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
+              e.stopPropagation();
+              menuStore.toggle();
+            }}
+            className={cn(
+              'flex w-full cursor-pointer items-center justify-between rounded-lg p-2 hover:bg-surface-hover',
+              className,
+            )}
           >
             <div className="flex items-center gap-2">
               <MCPIcon className="h-5 w-5 flex-shrink-0 text-text-primary" aria-hidden="true" />
@@ -85,7 +84,7 @@ const MCPSubMenu = React.forwardRef<HTMLDivElement, MCPSubMenuProps>(
                 <PinIcon unpin={isPinned} />
               </div>
             </button>
-          </Ariakit.MenuItem>
+          </Ariakit.MenuButton>
 
           <Ariakit.Menu
             portal={true}
@@ -114,7 +113,7 @@ const MCPSubMenu = React.forwardRef<HTMLDivElement, MCPSubMenuProps>(
         {configDialogProps && (
           <MCPConfigDialog {...configDialogProps} storageContextKey={storageContextKey} />
         )}
-      </div>
+      </>
     );
   },
 );
diff --git a/client/src/components/Chat/Input/Mention.tsx b/client/src/components/Chat/Input/Mention.tsx
index c2d352a4e60..a188503478c 100644
--- a/client/src/components/Chat/Input/Mention.tsx
+++ b/client/src/components/Chat/Input/Mention.tsx
@@ -1,8 +1,8 @@
 import { memo, useState, useRef, useEffect } from 'react';
-import { useRecoilValue, useSetRecoilState } from 'recoil';
 import { AutoSizer, List } from 'react-virtualized';
 import { Spinner, useCombobox } from '@librechat/client';
 import { EModelEndpoint } from 'librechat-data-provider';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
 import type { RecoilState } from 'recoil';
 import type { MentionOption, ConvoGenerator } from '~/common';
 import { useGetConversation, useLocalize, TranslationKeys } from '~/hooks';
@@ -128,6 +128,10 @@ function MentionContent({
     }
   }, [open, options]);
 
+  useEffect(() => {
+    setActiveIndex((prev) => Math.min(prev, Math.max(matches.length - 1, 0)));
+  }, [matches.length]);
+
   useEffect(() => {
     return () => {
       if (timeoutRef.current) {
@@ -191,10 +195,23 @@ function MentionContent({
               textAreaRef.current?.focus();
             }
             if (e.key === 'ArrowDown') {
+              if (matches.length === 0) {
+                return;
+              }
               setActiveIndex((prevIndex) => (prevIndex + 1) % matches.length);
             } else if (e.key === 'ArrowUp') {
+              if (matches.length === 0) {
+                return;
+              }
               setActiveIndex((prevIndex) => (prevIndex - 1 + matches.length) % matches.length);
             } else if (e.key === 'Enter' || e.key === 'Tab') {
+              if (matches.length === 0) {
+                e.preventDefault();
+                setOpen(false);
+                setShowPopover(false);
+                textAreaRef.current?.focus();
+                return;
+              }
               const mentionOption = matches[activeIndex] as MentionOption | undefined;
               if (mentionOption?.type === 'endpoint') {
                 e.preventDefault();
diff --git a/client/src/components/Chat/Input/PendingQuoteChips.tsx b/client/src/components/Chat/Input/PendingQuoteChips.tsx
new file mode 100644
index 00000000000..7ba436c0621
--- /dev/null
+++ b/client/src/components/Chat/Input/PendingQuoteChips.tsx
@@ -0,0 +1,170 @@
+import { memo, useRef, useState, useEffect, useCallback } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { TextQuote, X } from 'lucide-react';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
+import { useLocalize } from '~/hooks';
+import store from '~/store';
+
+const CHIP_CLASS =
+  'inline-flex max-w-full items-center gap-1 rounded-2xl border border-border-light bg-surface-secondary px-2.5 py-1.5 text-sm text-text-secondary';
+const REMOVE_BTN_CLASS =
+  '-mr-0.5 shrink-0 rounded-full p-0.5 text-text-secondary hover:bg-surface-tertiary hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy';
+const TRIGGER_CLASS =
+  'inline-flex min-w-0 items-center gap-1.5 rounded-full focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy';
+/** Grace period so moving the pointer between the chip and the popup doesn't close it. */
+const CLOSE_DELAY_MS = 120;
+
+/**
+ * Chip row rendered above the textarea for excerpts the user quoted via the
+ * "Add to chat" selection popup. Shows a single chip: the excerpt text for one
+ * selection, or a collapsed "{n} selections" pill for multiple — so the
+ * composer never fills with a row of chips.
+ *
+ * The collapsed pill is an Ariakit `Popover` disclosure: it opens on
+ * click / Enter / Space (keyboard users tab through the excerpts, Escape closes
+ * and Ariakit restores focus to the trigger) and on hover for mouse users.
+ * `autoFocusOnShow` is disabled so opening never pulls focus off the composer;
+ * `autoFocusOnHide` still returns focus to the trigger when focus was inside.
+ *
+ * Reads + writes `pendingQuotesByConvoId` directly; the atom is drained in
+ * `useChatFunctions.ask` on submit, so chips disappear once the message is sent
+ * (the excerpts then re-render as `MessageQuotes` on the user bubble).
+ */
+function PendingQuoteChips({ conversationId }: { conversationId: string }) {
+  const localize = useLocalize();
+  const quotes = useRecoilValue(store.pendingQuotesByConvoId(conversationId));
+  const setQuotes = useSetRecoilState(store.pendingQuotesByConvoId(conversationId));
+
+  const popover = Ariakit.usePopoverStore({ placement: 'top-start' });
+  const closeTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  /**
+   * Ariakit only restores focus to the trigger on hide when it took focus on
+   * show, so keep `autoFocusOnShow` on for keyboard/click opens (Escape returns
+   * focus to the trigger) and off for hover so it never pulls focus off the
+   * composer mid-typing.
+   */
+  const [focusOnShow, setFocusOnShow] = useState(true);
+
+  const cancelClose = useCallback(() => {
+    if (closeTimerRef.current != null) {
+      clearTimeout(closeTimerRef.current);
+      closeTimerRef.current = null;
+    }
+  }, []);
+  const openByPointer = useCallback(() => {
+    cancelClose();
+    setFocusOnShow(false);
+    popover.show();
+  }, [cancelClose, popover]);
+  const scheduleClose = useCallback(() => {
+    cancelClose();
+    closeTimerRef.current = setTimeout(() => popover.hide(), CLOSE_DELAY_MS);
+  }, [cancelClose, popover]);
+
+  useEffect(() => cancelClose, [cancelClose]);
+
+  const clearAll = useCallback(() => setQuotes([]), [setQuotes]);
+  const removeAt = useCallback(
+    (index: number) => setQuotes((prev) => prev.filter((_, i) => i !== index)),
+    [setQuotes],
+  );
+
+  if (quotes.length === 0) {
+    return null;
+  }
+
+  const isMulti = quotes.length > 1;
+
+  return (
+    <div
+      className="flex flex-wrap gap-1.5 px-2 pt-2"
+      role="list"
+      aria-label={localize('com_ui_quotes_queued')}
+      data-testid="pending-quote-chips"
+      data-quote-count={quotes.length}
+    >
+      {!isMulti ? (
+        <span role="listitem" className={CHIP_CLASS}>
+          <TextQuote className="h-4 w-4 shrink-0 text-cyan-500" aria-hidden="true" />
+          <span className="max-w-[16rem] truncate" title={quotes[0]}>
+            {quotes[0]}
+          </span>
+          <button
+            type="button"
+            aria-label={localize('com_ui_remove_quote')}
+            onClick={clearAll}
+            className={REMOVE_BTN_CLASS}
+          >
+            <X className="h-3.5 w-3.5" aria-hidden="true" />
+          </button>
+        </span>
+      ) : (
+        <>
+          <span
+            role="listitem"
+            className={CHIP_CLASS}
+            onPointerEnter={openByPointer}
+            onPointerLeave={scheduleClose}
+          >
+            <Ariakit.PopoverDisclosure
+              store={popover}
+              className={TRIGGER_CLASS}
+              aria-label={localize('com_ui_quote_selections', { 0: quotes.length })}
+              onClick={() => setFocusOnShow(true)}
+            >
+              <TextQuote className="h-4 w-4 shrink-0 text-cyan-500" aria-hidden="true" />
+              <span className="truncate">
+                {localize('com_ui_quote_selections', { 0: quotes.length })}
+              </span>
+            </Ariakit.PopoverDisclosure>
+            <button
+              type="button"
+              aria-label={localize('com_ui_remove_all_quotes')}
+              onClick={clearAll}
+              className={REMOVE_BTN_CLASS}
+            >
+              <X className="h-3.5 w-3.5" aria-hidden="true" />
+            </button>
+          </span>
+          <Ariakit.Popover
+            store={popover}
+            portal
+            gutter={8}
+            autoFocusOnShow={focusOnShow}
+            data-testid="quote-selections-popup"
+            onPointerEnter={cancelClose}
+            onPointerLeave={scheduleClose}
+            className="z-50 w-80 max-w-[90vw] rounded-xl border border-border-light bg-surface-secondary p-2 text-text-primary shadow-lg outline-none"
+          >
+            <ul className="flex flex-col gap-1" aria-label={localize('com_ui_referenced_quotes')}>
+              {quotes.map((text, index) => (
+                <li
+                  key={`${index}-${text.slice(0, 24)}`}
+                  className="flex items-start gap-1.5 rounded-xl px-1.5 py-1 hover:bg-surface-tertiary"
+                >
+                  <TextQuote
+                    className="mt-0.5 h-3.5 w-3.5 shrink-0 text-text-tertiary"
+                    aria-hidden="true"
+                  />
+                  <span className="line-clamp-2 flex-1 whitespace-pre-wrap break-words text-sm text-text-secondary">
+                    {text}
+                  </span>
+                  <button
+                    type="button"
+                    aria-label={localize('com_ui_remove_quote')}
+                    onClick={() => removeAt(index)}
+                    className="mt-0.5 shrink-0 rounded-full p-0.5 text-text-secondary hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy"
+                  >
+                    <X className="h-3.5 w-3.5" aria-hidden="true" />
+                  </button>
+                </li>
+              ))}
+            </ul>
+          </Ariakit.Popover>
+        </>
+      )}
+    </div>
+  );
+}
+
+export default memo(PendingQuoteChips);
diff --git a/client/src/components/Chat/Input/PromptsCommand.tsx b/client/src/components/Chat/Input/PromptsCommand.tsx
index 6db9eb62bc8..4efa7a1a7f4 100644
--- a/client/src/components/Chat/Input/PromptsCommand.tsx
+++ b/client/src/components/Chat/Input/PromptsCommand.tsx
@@ -138,10 +138,15 @@ function PromptsCommand({
   useEffect(() => {
     if (!open) {
       setActiveIndex(0);
+      setSearchValue('');
     } else {
       setVariableGroup(null);
     }
-  }, [open]);
+  }, [open, setSearchValue]);
+
+  useEffect(() => {
+    setActiveIndex((prev) => Math.min(prev, Math.max(matches.length - 1, 0)));
+  }, [matches.length]);
 
   useEffect(() => {
     return () => {
@@ -214,10 +219,23 @@ function PromptsCommand({
                 textAreaRef.current?.focus();
               }
               if (e.key === 'ArrowDown') {
+                if (matches.length === 0) {
+                  return;
+                }
                 setActiveIndex((prevIndex) => (prevIndex + 1) % matches.length);
               } else if (e.key === 'ArrowUp') {
+                if (matches.length === 0) {
+                  return;
+                }
                 setActiveIndex((prevIndex) => (prevIndex - 1 + matches.length) % matches.length);
               } else if (e.key === 'Enter' || e.key === 'Tab') {
+                if (matches.length === 0) {
+                  e.preventDefault();
+                  setOpen(false);
+                  setShowPromptsPopover(false);
+                  textAreaRef.current?.focus();
+                  return;
+                }
                 if (e.key === 'Enter') {
                   e.preventDefault();
                 }
diff --git a/client/src/components/Chat/Input/QuoteButton.tsx b/client/src/components/Chat/Input/QuoteButton.tsx
new file mode 100644
index 00000000000..01a391e192b
--- /dev/null
+++ b/client/src/components/Chat/Input/QuoteButton.tsx
@@ -0,0 +1,185 @@
+import { memo, useRef, useState, useEffect, useCallback, useLayoutEffect } from 'react';
+import { createPortal } from 'react-dom';
+import { TextQuote } from 'lucide-react';
+import { useSetRecoilState } from 'recoil';
+import { mainTextareaId } from '~/common';
+import { useLocalize } from '~/hooks';
+import store from '~/store';
+
+/** Only selections fully inside a rendered chat message get the popup. */
+const MESSAGE_SELECTOR = '.message-render';
+/** Max characters captured per excerpt (backend re-caps as defense-in-depth). */
+const MAX_QUOTE_LENGTH = 1500;
+/** Max excerpts queued at once; mirrors the backend `QUOTE_MAX_COUNT` cap so
+ *  the composer never shows more quotes than the model actually receives. */
+const MAX_QUOTE_COUNT = 10;
+/** Vertical gap (px) between the selection and the popup. */
+const POPUP_OFFSET = 8;
+/** Keep the popup this far (px) from the viewport edges. */
+const EDGE_MARGIN = 16;
+
+type SelectionState = {
+  text: string;
+  /** Viewport-relative anchor of the selection (used to place the button). */
+  top: number;
+  bottom: number;
+  centerX: number;
+};
+
+const resolveMessageElement = (node: Node | null): HTMLElement | null => {
+  const element = node instanceof Element ? node : (node?.parentElement ?? null);
+  return (element?.closest(MESSAGE_SELECTOR) as HTMLElement | null) ?? null;
+};
+
+const readSelection = (): SelectionState | null => {
+  const selection = window.getSelection();
+  if (!selection || selection.rangeCount === 0 || selection.isCollapsed) {
+    return null;
+  }
+
+  const anchorMessage = resolveMessageElement(selection.anchorNode);
+  const focusMessage = resolveMessageElement(selection.focusNode);
+  if (!anchorMessage || anchorMessage !== focusMessage) {
+    return null;
+  }
+
+  const text = selection
+    .toString()
+    .replace(/\u00a0/g, ' ')
+    .trim();
+  if (text.length === 0) {
+    return null;
+  }
+
+  const rect = selection.getRangeAt(0).getBoundingClientRect();
+  if (rect.width === 0 && rect.height === 0) {
+    return null;
+  }
+
+  return {
+    text: text.slice(0, MAX_QUOTE_LENGTH),
+    top: rect.top,
+    bottom: rect.bottom,
+    centerX: rect.left + rect.width / 2,
+  };
+};
+
+/**
+ * ChatGPT-style floating "Add to chat" button. Watches for text selections
+ * inside chat messages and, on click, appends the selected excerpt to the
+ * conversation's pending-quotes queue so it shows as a removable chip above
+ * the composer and rides along with the next submission.
+ *
+ * Rendered through a portal so the `fixed` positioning stays viewport-relative
+ * regardless of any transformed ancestor in the composer tree. The on-screen
+ * position is computed from the button's measured size (no CSS transform), so it
+ * is clamped accurately to the viewport — flipping below the selection when
+ * there is no room above and keeping its full width within the side margins.
+ */
+function QuoteButton({ conversationId }: { conversationId: string }) {
+  const localize = useLocalize();
+  const [selection, setSelection] = useState<SelectionState | null>(null);
+  const [pos, setPos] = useState<{ top: number; left: number } | null>(null);
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const setQuotes = useSetRecoilState(store.pendingQuotesByConvoId(conversationId));
+
+  useEffect(() => {
+    const updateSelection = () => {
+      setSelection(readSelection());
+      /** Recompute placement from scratch for the new selection. */
+      setPos(null);
+    };
+    const clearSelection = () => setSelection(null);
+    /** Hide the popup the instant the selection collapses or empties, including
+     *  paths that fire no mouse/key event — e.g. a streaming markdown re-render
+     *  replacing the selected text node, which would otherwise leave the button
+     *  stranded over a now-collapsed caret. Only hides here; showing stays gated
+     *  on mouseup/dblclick/keyup so an in-progress drag never flickers it. */
+    const handleSelectionChange = () => {
+      const sel = window.getSelection();
+      if (!sel || sel.rangeCount === 0 || sel.isCollapsed) {
+        setSelection(null);
+      }
+    };
+
+    document.addEventListener('mouseup', updateSelection);
+    /** Chromium commits a double-click word selection on `dblclick`, after
+     *  `mouseup` has already read a still-collapsed range, so listen here too. */
+    document.addEventListener('dblclick', updateSelection);
+    document.addEventListener('keyup', updateSelection);
+    document.addEventListener('selectionchange', handleSelectionChange);
+    document.addEventListener('scroll', clearSelection, true);
+    window.addEventListener('resize', clearSelection);
+
+    return () => {
+      document.removeEventListener('mouseup', updateSelection);
+      document.removeEventListener('dblclick', updateSelection);
+      document.removeEventListener('keyup', updateSelection);
+      document.removeEventListener('selectionchange', handleSelectionChange);
+      document.removeEventListener('scroll', clearSelection, true);
+      window.removeEventListener('resize', clearSelection);
+    };
+  }, []);
+
+  /** Clamp using the button's real size so it never lands off-screen. Runs
+   *  before paint, so the first visible frame is already in its final spot. */
+  useLayoutEffect(() => {
+    if (!selection || !buttonRef.current) {
+      return;
+    }
+    const { width, height } = buttonRef.current.getBoundingClientRect();
+    const maxLeft = Math.max(EDGE_MARGIN, window.innerWidth - width - EDGE_MARGIN);
+    const left = Math.min(Math.max(selection.centerX - width / 2, EDGE_MARGIN), maxLeft);
+
+    const aboveTop = selection.top - POPUP_OFFSET - height;
+    const belowTop = selection.bottom + POPUP_OFFSET;
+    const maxTop = Math.max(EDGE_MARGIN, window.innerHeight - height - EDGE_MARGIN);
+    const top = aboveTop >= EDGE_MARGIN ? aboveTop : Math.min(belowTop, maxTop);
+
+    setPos({ top: Math.max(top, EDGE_MARGIN), left });
+  }, [selection]);
+
+  const addQuote = useCallback(() => {
+    if (!selection) {
+      return;
+    }
+    setQuotes((prev) =>
+      prev.includes(selection.text) || prev.length >= MAX_QUOTE_COUNT
+        ? prev
+        : [...prev, selection.text],
+    );
+    setSelection(null);
+    setPos(null);
+    window.getSelection()?.removeAllRanges();
+    document.getElementById(mainTextareaId)?.focus();
+  }, [selection, setQuotes]);
+
+  if (!selection) {
+    return null;
+  }
+
+  return createPortal(
+    <button
+      ref={buttonRef}
+      type="button"
+      /** Keep the selection alive while the click lands. */
+      onMouseDown={(e) => e.preventDefault()}
+      onClick={addQuote}
+      aria-label={localize('com_ui_add_to_chat')}
+      data-testid="add-to-chat-button"
+      style={{
+        top: pos?.top ?? 0,
+        left: pos?.left ?? 0,
+        /** Hidden until measured so it never flashes at an unclamped position. */
+        visibility: pos == null ? 'hidden' : 'visible',
+      }}
+      className="fixed z-50 inline-flex items-center gap-1.5 rounded-full border border-border-light bg-surface-secondary px-3 py-1.5 text-sm font-medium text-text-primary shadow-lg transition-colors hover:bg-surface-tertiary"
+    >
+      <TextQuote className="h-4 w-4" aria-hidden="true" />
+      {localize('com_ui_add_to_chat')}
+    </button>,
+    document.body,
+  );
+}
+
+export default memo(QuoteButton);
diff --git a/client/src/components/Chat/Input/StopButton.tsx b/client/src/components/Chat/Input/StopButton.tsx
index fd94ba806c9..cc45348072e 100644
--- a/client/src/components/Chat/Input/StopButton.tsx
+++ b/client/src/components/Chat/Input/StopButton.tsx
@@ -18,6 +18,7 @@ export default memo(function StopButton({
       render={
         <button
           type="button"
+          data-testid="stop-generation-button"
           className={cn(
             'rounded-full bg-text-primary p-1.5 text-text-primary outline-offset-4 transition-all duration-200 disabled:cursor-not-allowed disabled:text-text-secondary disabled:opacity-10',
           )}
diff --git a/client/src/components/Chat/Input/StreamAudio.tsx b/client/src/components/Chat/Input/StreamAudio.tsx
index 221acaaa2ca..d199962eff7 100644
--- a/client/src/components/Chat/Input/StreamAudio.tsx
+++ b/client/src/components/Chat/Input/StreamAudio.tsx
@@ -5,6 +5,7 @@ import { useQueryClient } from '@tanstack/react-query';
 import { useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
 import type { TMessage } from 'librechat-data-provider';
 import { useCustomAudioRef, MediaSourceAppender, usePauseGlobalAudio } from '~/hooks/Audio';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { getLatestText, logger } from '~/utils';
 import { useAuthContext } from '~/hooks';
 import { globalAudioId } from '~/common';
@@ -29,7 +30,7 @@ export default function StreamAudio({ index = 0 }) {
   const activeRunId = useRecoilValue(store.activeRunFamily(index));
   const automaticPlayback = useRecoilValue(store.automaticPlayback);
   const isSubmitting = useRecoilValue(store.isSubmittingFamily(index));
-  const latestMessage = useRecoilValue(store.latestMessageFamily(index));
+  const latestMessage = useLatestMessage(index);
   const setIsPlaying = useSetRecoilState(store.globalAudioPlayingFamily(index));
   const [audioRunId, setAudioRunId] = useRecoilState(store.audioRunFamily(index));
   const [isFetching, setIsFetching] = useRecoilState(store.globalAudioFetchingFamily(index));
diff --git a/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx b/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx
new file mode 100644
index 00000000000..f8c479b68a3
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx
@@ -0,0 +1,202 @@
+import type { TokenUsageView } from '~/hooks/Chat/useTokenUsage';
+import type { CurrencyConfig } from '~/utils';
+import { groupToolTokens, formatTokens, formatCost } from '~/utils';
+import { useLocalize } from '~/hooks';
+
+interface RowProps {
+  label: string;
+  value: number;
+  max?: number;
+}
+
+function Row({ label, value, max }: RowProps) {
+  const percent = max != null && max > 0 ? Math.min((value / max) * 100, 100) : null;
+  return (
+    <div className="flex items-center justify-between gap-4 text-sm">
+      <span className="text-text-secondary">{label}</span>
+      <span className="font-medium text-text-primary">
+        {formatTokens(value)}
+        {percent != null && (
+          <span className="ml-1 text-xs text-text-secondary" aria-hidden="true">
+            ({Math.round(percent)}%)
+          </span>
+        )}
+      </span>
+    </div>
+  );
+}
+
+interface BreakdownProps {
+  view: TokenUsageView;
+  showCost: boolean;
+  currency?: CurrencyConfig;
+}
+
+export default function Breakdown({ view, showCost, currency }: BreakdownProps) {
+  const localize = useLocalize();
+  const { usedTokens, maxTokens, percent, snapshot, snapshotActive, branchUsage, hasUsage } = view;
+  /** Show the all-branches total only when it (a) exceeds the active branch —
+   *  epsilon guards against float summation order surfacing a spurious row in an
+   *  unbranched conversation — and (b) has COMPLETE cost coverage, so a sibling
+   *  branch saved without cost can't render an under-reported total. */
+  const showTotal = view.totalUsage.costKnown && view.totalCost - view.branchCost > 1e-9;
+
+  const breakdown = snapshotActive ? snapshot?.breakdown : undefined;
+  const instructionTokens =
+    snapshot?.effectiveInstructionTokens ?? breakdown?.instructionTokens ?? 0;
+  const systemTokens =
+    (breakdown?.systemMessageTokens ?? 0) + (breakdown?.dynamicInstructionTokens ?? 0);
+  /** Summary has its own row, so exclude it (it's part of `usedTokens`) to avoid
+   *  double-counting it inside the Messages row on a summarized turn. */
+  const messageTokens = Math.max(
+    0,
+    usedTokens - instructionTokens - (breakdown?.summaryTokens ?? 0),
+  );
+  const freeTokens = maxTokens != null ? Math.max(0, maxTokens - usedTokens) : null;
+
+  const groups =
+    breakdown?.toolTokenCounts != null
+      ? groupToolTokens(breakdown.toolTokenCounts, breakdown.deferredToolNames)
+      : null;
+  const toolRows =
+    groups == null
+      ? null
+      : ([
+          [localize('com_ui_context_tools_system'), groups.system],
+          [localize('com_ui_context_tools_mcp'), groups.mcp],
+          [localize('com_ui_skills'), groups.skills],
+          [localize('com_ui_context_subagents'), groups.subagents],
+          [localize('com_ui_context_tools_system_deferred'), groups.systemDeferred],
+          [localize('com_ui_context_tools_mcp_deferred'), groups.mcpDeferred],
+        ] as const);
+
+  return (
+    <div className="w-64 space-y-3" role="region" aria-label={localize('com_ui_context_usage')}>
+      <div className="flex items-center justify-between">
+        <span className="text-sm font-medium text-text-primary">
+          {localize('com_ui_context_window')}
+        </span>
+        <span className="text-xs font-medium text-text-secondary">
+          {maxTokens != null
+            ? `${formatTokens(usedTokens)} / ${formatTokens(maxTokens)} (${Math.round(percent)}%)`
+            : formatTokens(usedTokens)}
+        </span>
+      </div>
+
+      <div
+        role="progressbar"
+        aria-valuemin={0}
+        aria-valuemax={100}
+        aria-valuenow={maxTokens != null ? Math.round(percent) : undefined}
+        aria-label={localize('com_ui_context_usage')}
+        className="h-2 w-full overflow-hidden rounded-full bg-surface-tertiary"
+      >
+        {percent > 0 && (
+          <div
+            className="h-full rounded-full bg-text-primary transition-all duration-300"
+            style={{ width: `${Math.min(percent, 100)}%` }}
+          />
+        )}
+      </div>
+
+      <div
+        className="space-y-1.5"
+        data-testid={breakdown ? 'context-breakdown' : 'context-estimate'}
+      >
+        {breakdown ? (
+          <>
+            <Row
+              label={localize('com_ui_context_messages')}
+              value={messageTokens}
+              max={maxTokens}
+            />
+            {systemTokens > 0 && (
+              <Row label={localize('com_ui_context_system')} value={systemTokens} max={maxTokens} />
+            )}
+            {toolRows != null ? (
+              toolRows.map(
+                ([label, value]) =>
+                  value > 0 && <Row key={label} label={label} value={value} max={maxTokens} />,
+              )
+            ) : (
+              <Row
+                label={localize('com_ui_context_tools')}
+                value={breakdown.toolSchemaTokens}
+                max={maxTokens}
+              />
+            )}
+            {breakdown.summaryTokens > 0 && (
+              <Row
+                label={localize('com_ui_context_summary')}
+                value={breakdown.summaryTokens}
+                max={maxTokens}
+              />
+            )}
+            {freeTokens != null && (
+              <Row label={localize('com_ui_context_free')} value={freeTokens} max={maxTokens} />
+            )}
+          </>
+        ) : (
+          <>
+            {view.branchTotals.summaryBaseline > 0 && (
+              <Row
+                label={localize('com_ui_context_summary')}
+                value={view.branchTotals.summaryBaseline}
+                max={maxTokens}
+              />
+            )}
+            <Row label={localize('com_ui_input')} value={view.branchTotals.input} />
+            <Row
+              label={localize('com_ui_output')}
+              value={view.branchTotals.output + view.liveTokens}
+            />
+            {maxTokens == null && (
+              <p className="text-xs text-text-secondary">{localize('com_ui_context_unknown')}</p>
+            )}
+            <p className="text-xs italic text-text-secondary">{localize('com_ui_estimated')}</p>
+          </>
+        )}
+      </div>
+
+      {hasUsage && (
+        <>
+          <div className="border-t border-border-light" role="separator" />
+          <div className="space-y-1.5" data-testid="token-usage-totals">
+            <Row label={localize('com_ui_input')} value={branchUsage.input} />
+            <Row label={localize('com_ui_output')} value={branchUsage.output} />
+            {branchUsage.cacheRead > 0 && (
+              <Row label={localize('com_ui_cache_read')} value={branchUsage.cacheRead} />
+            )}
+            {branchUsage.cacheWrite > 0 && (
+              <Row label={localize('com_ui_cache_write')} value={branchUsage.cacheWrite} />
+            )}
+          </div>
+        </>
+      )}
+
+      {showCost && hasUsage && branchUsage.costKnown && (
+        <>
+          <div className="border-t border-border-light" role="separator" />
+          <div className="space-y-1.5" data-testid="token-usage-cost">
+            <div className="flex items-center justify-between text-sm">
+              <span className="text-text-secondary">
+                {showTotal
+                  ? localize('com_ui_context_cost_branch')
+                  : localize('com_ui_context_cost')}
+              </span>
+              <span className="font-medium text-text-primary">
+                {formatCost(view.branchCost, currency)}
+              </span>
+            </div>
+            {showTotal && (
+              <div className="flex items-center justify-between text-xs">
+                <span className="text-text-secondary">{localize('com_ui_context_cost_total')}</span>
+                <span className="text-text-secondary">{formatCost(view.totalCost, currency)}</span>
+              </div>
+            )}
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/client/src/components/Chat/Input/TokenUsage/Gauge.tsx b/client/src/components/Chat/Input/TokenUsage/Gauge.tsx
new file mode 100644
index 00000000000..ba7e420302d
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/Gauge.tsx
@@ -0,0 +1,62 @@
+import { cn } from '~/utils';
+
+const SIZE = 28;
+const STROKE_WIDTH = 3.5;
+const RADIUS = (SIZE - STROKE_WIDTH) / 2;
+const CIRCUMFERENCE = 2 * Math.PI * RADIUS;
+
+interface GaugeProps {
+  /** 0–100, clamped by the caller */
+  percent: number;
+  /** Max context unknown — render an empty track only */
+  indeterminate: boolean;
+}
+
+function getStrokeClass(percent: number, indeterminate: boolean): string {
+  if (indeterminate) {
+    return 'stroke-text-secondary';
+  }
+  if (percent > 90) {
+    return 'stroke-red-500';
+  }
+  if (percent > 75) {
+    return 'stroke-yellow-500';
+  }
+  return 'stroke-text-secondary';
+}
+
+export default function Gauge({ percent, indeterminate }: GaugeProps) {
+  const offset = CIRCUMFERENCE - (percent / 100) * CIRCUMFERENCE;
+
+  return (
+    <svg
+      width={SIZE}
+      height={SIZE}
+      viewBox={`0 0 ${SIZE} ${SIZE}`}
+      className="-rotate-90"
+      aria-hidden="true"
+      focusable="false"
+    >
+      <circle
+        cx={SIZE / 2}
+        cy={SIZE / 2}
+        r={RADIUS}
+        fill="transparent"
+        strokeWidth={STROKE_WIDTH}
+        className="stroke-border-heavy"
+        strokeDasharray={indeterminate ? '2 4' : undefined}
+      />
+      <circle
+        cx={SIZE / 2}
+        cy={SIZE / 2}
+        r={RADIUS}
+        fill="transparent"
+        strokeWidth={STROKE_WIDTH}
+        strokeDasharray={CIRCUMFERENCE}
+        strokeDashoffset={indeterminate ? CIRCUMFERENCE : offset}
+        strokeLinecap="round"
+        className={cn('transition-all duration-300', getStrokeClass(percent, indeterminate))}
+      />
+    </svg>
+  );
+}
diff --git a/client/src/components/Chat/Input/TokenUsage/index.tsx b/client/src/components/Chat/Input/TokenUsage/index.tsx
new file mode 100644
index 00000000000..ff969148d5f
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/index.tsx
@@ -0,0 +1,131 @@
+import { memo, useRef } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { TooltipAnchor } from '@librechat/client';
+import type { TConversation } from 'librechat-data-provider';
+import type { CurrencyConfig } from '~/utils';
+import { formatTokens, formatCost, cn } from '~/utils';
+import useTokenUsage from '~/hooks/Chat/useTokenUsage';
+import { useGetStartupConfig } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+import Breakdown from './Breakdown';
+import Gauge from './Gauge';
+
+interface TokenUsageProps {
+  index: number;
+  conversation: TConversation | null;
+  isSubmitting: boolean;
+}
+
+function TokenUsageIndicator({
+  index,
+  conversation,
+  isSubmitting,
+  showCost,
+  currency,
+}: TokenUsageProps & {
+  showCost: boolean;
+  currency?: CurrencyConfig;
+}) {
+  const localize = useLocalize();
+  const view = useTokenUsage({ index, conversation, isSubmitting });
+  const popover = Ariakit.usePopoverStore({ placement: 'top' });
+  const disclosureRef = useRef<HTMLButtonElement>(null);
+
+  /** Hide until the branch has data — keeps a fresh, message-less chat clean and
+   *  lets the indicator animate into view once the first tokens land. */
+  if (view.usedTokens <= 0) {
+    return null;
+  }
+
+  const hasMax = view.maxTokens != null && view.maxTokens > 0;
+  const ariaLabel = hasMax
+    ? localize('com_ui_context_usage_label', {
+        0: formatTokens(view.usedTokens),
+        1: formatTokens(view.maxTokens ?? 0),
+        2: String(Math.round(view.percent)),
+      })
+    : localize('com_ui_context_usage_label_unknown', { 0: formatTokens(view.usedTokens) });
+
+  const snapshotSummary = hasMax
+    ? localize('com_ui_context_usage_snapshot', {
+        0: formatTokens(view.usedTokens),
+        1: formatTokens(view.maxTokens ?? 0),
+        2: String(Math.round(view.percent)),
+      })
+    : localize('com_ui_context_usage_snapshot_unknown', { 0: formatTokens(view.usedTokens) });
+  const snapshot =
+    showCost && view.hasUsage && view.branchUsage.costKnown
+      ? `${snapshotSummary} · ${formatCost(view.branchCost, currency)}`
+      : snapshotSummary;
+
+  return (
+    <>
+      <TooltipAnchor
+        description={snapshot}
+        side="top"
+        render={
+          <Ariakit.PopoverDisclosure
+            ref={disclosureRef}
+            store={popover}
+            type="button"
+            data-testid="token-usage"
+            aria-label={ariaLabel}
+            aria-haspopup="dialog"
+            className={cn(
+              'flex size-9 items-center justify-center rounded-full p-1 transition-colors',
+              'hover:bg-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
+              'duration-300 animate-in fade-in zoom-in-95',
+            )}
+          >
+            <span
+              role="meter"
+              aria-valuemin={0}
+              aria-valuemax={hasMax ? view.maxTokens : undefined}
+              aria-valuenow={view.usedTokens}
+              aria-label={localize('com_ui_context_usage')}
+              className="flex items-center justify-center"
+            >
+              <Gauge percent={view.percent} indeterminate={!hasMax} />
+            </span>
+          </Ariakit.PopoverDisclosure>
+        }
+      />
+      {/* Focus the labelled dialog on open so screen readers enter and announce
+          the breakdown, and so focus stays contained instead of falling back to
+          the body (which the composer's global focus logic would steal). The
+          visible ring is suppressed via focus:outline-none, and finalFocus
+          returns focus to the gauge trigger on close. */}
+      <Ariakit.Popover
+        store={popover}
+        gutter={8}
+        portal
+        unmountOnHide
+        finalFocus={disclosureRef}
+        aria-label={localize('com_ui_context_usage')}
+        className="z-[200] rounded-xl border border-border-medium bg-surface-secondary p-3 shadow-lg focus:outline-none"
+      >
+        <Breakdown view={view} showCost={showCost} currency={currency} />
+      </Ariakit.Popover>
+    </>
+  );
+}
+
+/** Config gate kept outside the indicator so disabled deployments mount nothing */
+const TokenUsage = memo(function TokenUsage(props: TokenUsageProps) {
+  const { data: startupConfig } = useGetStartupConfig();
+  /** Wait for config before mounting: until it loads `contextUsage === false`
+   *  reads as undefined, so a disabled deployment would briefly mount the
+   *  indicator and fire the token-config query on first load */
+  if (startupConfig == null || startupConfig.interface?.contextUsage === false) {
+    return null;
+  }
+  return (
+    <TokenUsageIndicator
+      {...props}
+      showCost={startupConfig.interface?.contextCost === true}
+      currency={startupConfig.interface?.currency}
+    />
+  );
+});
+
+export default TokenUsage;
diff --git a/client/src/components/Chat/Input/ToolsDropdown.tsx b/client/src/components/Chat/Input/ToolsDropdown.tsx
index fa6150b61dd..25225808bda 100644
--- a/client/src/components/Chat/Input/ToolsDropdown.tsx
+++ b/client/src/components/Chat/Input/ToolsDropdown.tsx
@@ -226,7 +226,7 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
       onClick: handleSkillsToggle,
       hideOnClick: false,
       render: (props) => (
-        <div {...props}>
+        <div {...props} data-testid="tools-menu-skills">
           <div className="flex items-center gap-2">
             <ScrollText className="icon-md" aria-hidden="true" />
             <span>{localize('com_ui_skills')}</span>
diff --git a/client/src/components/Chat/Input/__tests__/Mention.spec.tsx b/client/src/components/Chat/Input/__tests__/Mention.spec.tsx
new file mode 100644
index 00000000000..d5a9d863a01
--- /dev/null
+++ b/client/src/components/Chat/Input/__tests__/Mention.spec.tsx
@@ -0,0 +1,208 @@
+/**
+ * Locks in the `@` mention popover keyboard contract for the empty-result
+ * edge case (issue #13929 / PR #13928): when filtering yields zero matches
+ * the arrow keys must be no-ops rather than computing a `% 0` -> NaN active
+ * index, and Enter/Tab must close the popover and return focus to the
+ * textarea. Deleting back to a non-empty list has to leave keyboard
+ * navigation working from a valid index.
+ */
+import React from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import type { RecoilState } from 'recoil';
+import type { MentionOption } from '~/common';
+
+const POPOVER_ATOM = 'show-mention-popover';
+const PLACEHOLDER = 'com_ui_mention';
+
+const mockSetShowPopover = jest.fn();
+const mockShowPopover = { current: true };
+
+jest.mock('recoil', () => {
+  const actual = jest.requireActual('recoil');
+  return {
+    ...actual,
+    useRecoilValue: jest.fn((atom: unknown) =>
+      atom === POPOVER_ATOM ? mockShowPopover.current : undefined,
+    ),
+    useSetRecoilState: jest.fn((atom: unknown) =>
+      atom === POPOVER_ATOM ? mockSetShowPopover : jest.fn(),
+    ),
+  };
+});
+
+const mockUseMentions = jest.fn();
+jest.mock('~/hooks/Input/useMentions', () => ({
+  __esModule: true,
+  default: () => mockUseMentions(),
+}));
+
+jest.mock('~/hooks/Input/useSelectMention', () => ({
+  __esModule: true,
+  default: () => ({ onSelectMention: jest.fn() }),
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+  useGetConversation: () => jest.fn(),
+}));
+
+jest.mock('~/Providers', () => ({
+  useAssistantsMapContext: () => ({}),
+}));
+
+/* react-virtualized renders nothing in jsdom without a measured size; replace
+   AutoSizer + List with a flat ul so every row's MentionItem button renders. */
+jest.mock('react-virtualized', () => ({
+  ...jest.requireActual('react-virtualized'),
+  AutoSizer: ({ children }: { children: (size: { width: number }) => React.ReactNode }) =>
+    children({ width: 320 }),
+  List: ({
+    rowCount,
+    rowRenderer,
+  }: {
+    rowCount: number;
+    rowRenderer: (args: {
+      index: number;
+      key: string;
+      style: React.CSSProperties;
+    }) => React.ReactNode;
+  }) => {
+    const rows: React.ReactNode[] = [];
+    for (let i = 0; i < rowCount; i++) {
+      rows.push(rowRenderer({ index: i, key: `row-${i}`, style: {} }));
+    }
+    return <ul data-testid="mention-list">{rows}</ul>;
+  },
+}));
+
+import Mention from '../Mention';
+
+const makeTextarea = (initial = '@') => {
+  const textarea = document.createElement('textarea');
+  textarea.value = initial;
+  document.body.appendChild(textarea);
+  return { current: textarea } as React.MutableRefObject<HTMLTextAreaElement | null>;
+};
+
+const makeMention = (overrides: Partial<MentionOption>): MentionOption => ({
+  type: 'preset',
+  label: 'Alpha',
+  value: 'alpha',
+  description: '',
+  ...overrides,
+});
+
+const options: MentionOption[] = [
+  makeMention({ label: 'Alpha', value: 'alpha' }),
+  makeMention({ label: 'Beta', value: 'beta' }),
+];
+
+const mentionsBundle = {
+  options,
+  presets: [],
+  isLoading: false,
+  modelSpecs: [],
+  agentsList: [],
+  modelsConfig: {},
+  endpointsConfig: {},
+  assistantListMap: {},
+};
+
+const activeItemId = () =>
+  document.querySelector('.bg-surface-active')?.closest('button')?.id ?? null;
+
+const getInput = () => screen.getByPlaceholderText(PLACEHOLDER);
+
+beforeAll(() => {
+  Element.prototype.scrollIntoView = jest.fn();
+});
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  document.body.innerHTML = '';
+  mockShowPopover.current = true;
+  mockUseMentions.mockReturnValue(mentionsBundle);
+});
+
+const renderMention = () => {
+  const textAreaRef = makeTextarea('@');
+  const utils = render(
+    <Mention
+      index={0}
+      popoverAtom={POPOVER_ATOM as unknown as RecoilState<boolean>}
+      newConversation={jest.fn()}
+      textAreaRef={textAreaRef}
+    />,
+  );
+  return { textAreaRef, ...utils };
+};
+
+describe('Mention keyboard navigation', () => {
+  it('renders nothing when the popover atom is false', () => {
+    mockShowPopover.current = false;
+    const { container } = renderMention();
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('moves the active highlight with ArrowDown/ArrowUp and wraps around', () => {
+    renderMention();
+    const input = getInput();
+
+    expect(activeItemId()).toBe('mention-item-0');
+
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('mention-item-1');
+
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('mention-item-0');
+
+    fireEvent.keyDown(input, { key: 'ArrowUp' });
+    expect(activeItemId()).toBe('mention-item-1');
+  });
+
+  it('keeps navigation working after filtering to zero matches and back', () => {
+    renderMention();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    expect(screen.queryByRole('button')).toBeNull();
+
+    /* Arrow keys on an empty list must be no-ops, not `% 0` -> NaN. */
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    fireEvent.keyDown(input, { key: 'ArrowUp' });
+
+    fireEvent.change(input, { target: { value: '' } });
+    expect(screen.getAllByRole('button')).toHaveLength(2);
+
+    /* Without the guard the active index would still be NaN here and no
+       item would highlight; with it, navigation resumes from a valid index. */
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('mention-item-1');
+  });
+
+  it('closes the popover and refocuses the textarea when Enter is pressed with no matches', () => {
+    const { textAreaRef } = renderMention();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    const notPrevented = fireEvent.keyDown(input, { key: 'Enter' });
+
+    expect(notPrevented).toBe(false);
+    expect(mockSetShowPopover).toHaveBeenCalledWith(false);
+    expect(document.activeElement).toBe(textAreaRef.current);
+  });
+
+  it('prevents the default Tab action when closing on no matches so the refocus sticks', () => {
+    const { textAreaRef } = renderMention();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    const notPrevented = fireEvent.keyDown(input, { key: 'Tab' });
+
+    /* Without preventDefault the browser's default Tab would move focus off
+       the textarea right after we refocus it. */
+    expect(notPrevented).toBe(false);
+    expect(mockSetShowPopover).toHaveBeenCalledWith(false);
+    expect(document.activeElement).toBe(textAreaRef.current);
+  });
+});
diff --git a/client/src/components/Chat/Input/__tests__/PendingQuoteChips.test.tsx b/client/src/components/Chat/Input/__tests__/PendingQuoteChips.test.tsx
new file mode 100644
index 00000000000..6e863cf3725
--- /dev/null
+++ b/client/src/components/Chat/Input/__tests__/PendingQuoteChips.test.tsx
@@ -0,0 +1,57 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import { render, screen, fireEvent } from '@testing-library/react';
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string, params?: Record<string, unknown>) =>
+    `${key}:${params?.[0] ?? ''}`,
+}));
+
+import store from '~/store';
+import PendingQuoteChips from '../PendingQuoteChips';
+
+const CONVO_ID = 'convo-1';
+
+const renderWithQuotes = (quotes: string[]) =>
+  render(
+    <RecoilRoot initializeState={({ set }) => set(store.pendingQuotesByConvoId(CONVO_ID), quotes)}>
+      <PendingQuoteChips conversationId={CONVO_ID} />
+    </RecoilRoot>,
+  );
+
+describe('PendingQuoteChips', () => {
+  it('renders nothing when there are no pending quotes', () => {
+    const { container } = renderWithQuotes([]);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('shows the excerpt text for a single selection', () => {
+    renderWithQuotes(['alpha excerpt']);
+    const chips = screen.getByTestId('pending-quote-chips');
+    expect(chips).toHaveAttribute('data-quote-count', '1');
+    expect(chips).toHaveTextContent('alpha excerpt');
+  });
+
+  it('collapses multiple selections into a single "{n} selections" chip', () => {
+    renderWithQuotes(['alpha excerpt', 'beta excerpt']);
+    const chips = screen.getByTestId('pending-quote-chips');
+    expect(chips).toHaveAttribute('data-quote-count', '2');
+    // Collapsed label (the localize mock renders "<key>:<count>").
+    expect(chips).toHaveTextContent('com_ui_quote_selections:2');
+    // The composer shows ONE chip, not a row of two (the per-excerpt list lives
+    // in the hover popup, which only mounts on hover).
+    expect(screen.getAllByRole('listitem')).toHaveLength(1);
+  });
+
+  it('removes the single selection when its × is clicked', () => {
+    const { container } = renderWithQuotes(['only one']);
+    fireEvent.click(screen.getByRole('button', { name: /com_ui_remove_quote/ }));
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('clears all selections from the collapsed chip', () => {
+    const { container } = renderWithQuotes(['first', 'second']);
+    fireEvent.click(screen.getByRole('button', { name: /com_ui_remove_all_quotes/ }));
+    expect(container.firstChild).toBeNull();
+  });
+});
diff --git a/client/src/components/Chat/Input/__tests__/PromptsCommand.spec.tsx b/client/src/components/Chat/Input/__tests__/PromptsCommand.spec.tsx
new file mode 100644
index 00000000000..adf9f637166
--- /dev/null
+++ b/client/src/components/Chat/Input/__tests__/PromptsCommand.spec.tsx
@@ -0,0 +1,220 @@
+/**
+ * Locks in the `/` prompts popover keyboard contract, specifically the
+ * empty-result edge case that mirrors the `$` skills command and the `@`
+ * mention popover: when filtering yields zero matches the arrow keys must
+ * be no-ops (never `% 0` into a `NaN` active index) and Enter/Tab must
+ * close the popover and return focus to the textarea. Deleting back to a
+ * non-empty list has to leave keyboard navigation working.
+ */
+import React from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import type { PromptOption } from '~/common';
+
+const PLACEHOLDER = 'com_ui_command_usage_placeholder';
+
+const mockSetShowPromptsPopover = jest.fn();
+const mockShowPromptsPopover = { current: true };
+
+jest.mock('recoil', () => {
+  const actual = jest.requireActual('recoil');
+  return {
+    ...actual,
+    useRecoilValue: jest.fn((atom: unknown) =>
+      atom === 'show-prompts-popover' ? mockShowPromptsPopover.current : undefined,
+    ),
+    useSetRecoilState: jest.fn((atom: unknown) =>
+      atom === 'show-prompts-popover' ? mockSetShowPromptsPopover : jest.fn(),
+    ),
+  };
+});
+
+jest.mock('~/store', () => ({
+  __esModule: true,
+  default: {
+    showPromptsPopoverFamily: () => 'show-prompts-popover',
+  },
+}));
+
+const mockRecordUsage = jest.fn();
+jest.mock('~/data-provider', () => ({
+  useRecordPromptUsage: () => ({ mutate: mockRecordUsage }),
+}));
+
+const mockPromptGroupsContext = jest.fn();
+jest.mock('~/Providers', () => ({
+  usePromptGroupsContext: () => mockPromptGroupsContext(),
+}));
+
+jest.mock('~/components/Prompts', () => ({
+  VariableDialog: () => null,
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+/* react-virtualized renders nothing in jsdom without a measured size; replace
+   AutoSizer + List with a flat ul so every row's MentionItem button renders. */
+jest.mock('react-virtualized', () => ({
+  ...jest.requireActual('react-virtualized'),
+  AutoSizer: ({ children }: { children: (size: { width: number }) => React.ReactNode }) =>
+    children({ width: 320 }),
+  List: ({
+    rowCount,
+    rowRenderer,
+  }: {
+    rowCount: number;
+    rowRenderer: (args: {
+      index: number;
+      key: string;
+      style: React.CSSProperties;
+    }) => React.ReactNode;
+  }) => {
+    const rows: React.ReactNode[] = [];
+    for (let i = 0; i < rowCount; i++) {
+      rows.push(rowRenderer({ index: i, key: `row-${i}`, style: {} }));
+    }
+    return <ul data-testid="prompts-list">{rows}</ul>;
+  },
+}));
+
+import PromptsCommand from '../PromptsCommand';
+
+const makeTextarea = (initial = '/') => {
+  const textarea = document.createElement('textarea');
+  textarea.value = initial;
+  document.body.appendChild(textarea);
+  return { current: textarea } as React.MutableRefObject<HTMLTextAreaElement | null>;
+};
+
+const makePrompt = (overrides: Partial<PromptOption>): PromptOption => ({
+  id: '1',
+  type: 'prompt',
+  label: 'Alpha',
+  value: 'Alpha',
+  description: '',
+  ...overrides,
+});
+
+const promptGroups: PromptOption[] = [
+  makePrompt({ id: '1', label: 'Alpha', value: 'Alpha' }),
+  makePrompt({ id: '2', label: 'Beta', value: 'Beta' }),
+];
+
+const promptsMap = {
+  '1': { _id: '1', productionPrompt: { prompt: 'Alpha body' } },
+  '2': { _id: '2', productionPrompt: { prompt: 'Beta body' } },
+};
+
+const activeItemId = () =>
+  document.querySelector('.bg-surface-active')?.closest('button')?.id ?? null;
+
+const getInput = () => screen.getByPlaceholderText(PLACEHOLDER);
+
+beforeAll(() => {
+  Element.prototype.scrollIntoView = jest.fn();
+});
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  document.body.innerHTML = '';
+  mockShowPromptsPopover.current = true;
+  mockPromptGroupsContext.mockReturnValue({
+    hasAccess: true,
+    allPromptGroups: {
+      data: { promptGroups, promptsMap },
+      isLoading: false,
+    },
+  });
+});
+
+const renderCommand = () => {
+  const textAreaRef = makeTextarea('/');
+  const utils = render(
+    <PromptsCommand index={0} textAreaRef={textAreaRef} submitPrompt={jest.fn()} />,
+  );
+  return { textAreaRef, ...utils };
+};
+
+describe('PromptsCommand keyboard navigation', () => {
+  it('renders nothing when the popover atom is false', () => {
+    mockShowPromptsPopover.current = false;
+    const { container } = renderCommand();
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('moves the active highlight with ArrowDown/ArrowUp and wraps around', () => {
+    renderCommand();
+    const input = getInput();
+
+    expect(activeItemId()).toBe('prompt-item-0');
+
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('prompt-item-1');
+
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('prompt-item-0');
+
+    fireEvent.keyDown(input, { key: 'ArrowUp' });
+    expect(activeItemId()).toBe('prompt-item-1');
+  });
+
+  it('keeps navigation working after filtering to zero matches and back', () => {
+    renderCommand();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    expect(screen.queryByRole('button')).toBeNull();
+
+    /* Arrow keys on an empty list must be no-ops, not `% 0` -> NaN. */
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    fireEvent.keyDown(input, { key: 'ArrowUp' });
+
+    fireEvent.change(input, { target: { value: '' } });
+    expect(screen.getAllByRole('button')).toHaveLength(2);
+
+    /* Without the guard the active index would still be NaN here and no
+       item would highlight; with it, navigation resumes from a valid index. */
+    fireEvent.keyDown(input, { key: 'ArrowDown' });
+    expect(activeItemId()).toBe('prompt-item-1');
+  });
+
+  it('closes the popover and refocuses the textarea when Enter is pressed with no matches', () => {
+    const { textAreaRef } = renderCommand();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    const notPrevented = fireEvent.keyDown(input, { key: 'Enter' });
+
+    expect(notPrevented).toBe(false);
+    expect(mockSetShowPromptsPopover).toHaveBeenCalledWith(false);
+    expect(document.activeElement).toBe(textAreaRef.current);
+  });
+
+  it('prevents the default Tab action when closing on no matches so the refocus sticks', () => {
+    const { textAreaRef } = renderCommand();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    const notPrevented = fireEvent.keyDown(input, { key: 'Tab' });
+
+    /* Without preventDefault the browser's default Tab would move focus off
+       the textarea right after we refocus it. */
+    expect(notPrevented).toBe(false);
+    expect(mockSetShowPromptsPopover).toHaveBeenCalledWith(false);
+    expect(document.activeElement).toBe(textAreaRef.current);
+  });
+
+  it('clears the stale search filter when the popover closes', () => {
+    renderCommand();
+    const input = getInput();
+
+    fireEvent.change(input, { target: { value: 'zzz' } });
+    expect((input as HTMLInputElement).value).toBe('zzz');
+
+    /* PromptsCommand stays mounted across close (unlike Mention), so a leftover
+       no-match query has to be cleared or the popover reopens still filtered. */
+    fireEvent.keyDown(input, { key: 'Enter' });
+    expect((getInput() as HTMLInputElement).value).toBe('');
+  });
+});
diff --git a/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx b/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
index 53ec6388f7b..ecafb845866 100644
--- a/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
+++ b/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
@@ -320,7 +320,7 @@ describe('SkillsCommand', () => {
       isFetchingNextPage: false,
     });
     mockUseAgentsMapContext.mockReturnValue({
-      agent_1: { id: 'agent_1', skills_enabled: true },
+      agent_1: { id: 'agent_1', skills: [], skills_enabled: true },
     });
 
     const textAreaRef = makeTextarea('$');
diff --git a/client/src/components/Chat/Landing.tsx b/client/src/components/Chat/Landing.tsx
index 7707fe7066d..d3a3d3c8b19 100644
--- a/client/src/components/Chat/Landing.tsx
+++ b/client/src/components/Chat/Landing.tsx
@@ -2,11 +2,18 @@ import { useMemo, useCallback, useState, useEffect, useRef } from 'react';
 import { easings } from '@react-spring/web';
 import { EModelEndpoint } from 'librechat-data-provider';
 import { BirthdayIcon, TooltipAnchor, SplitText } from '@librechat/client';
+import {
+  getIconEndpoint,
+  getEntity,
+  getModelSpec,
+  createConfigHtmlSanitizer,
+  CONFIG_HTML_MEDIA_TAGS,
+  CONFIG_HTML_MEDIA_ATTR,
+} from '~/utils';
 import { useChatContext, useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
 import { useGetEndpointsQuery, useGetStartupConfig } from '~/data-provider';
 import ConvoIcon from '~/components/Endpoints/ConvoIcon';
 import { useLocalize, useAuthContext } from '~/hooks';
-import { getIconEndpoint, getEntity } from '~/utils';
 
 const containerClassName =
   'shadow-stroke relative flex h-full items-center justify-center rounded-full bg-white dark:bg-presentation dark:text-white text-black dark:after:shadow-none ';
@@ -61,8 +68,26 @@ export default function Landing({ centerFormOnLanding }: { centerFormOnLanding:
     assistant_id: conversation?.assistant_id,
   });
 
-  const name = entity?.name ?? '';
-  const description = (entity?.description || conversation?.greeting) ?? '';
+  const modelSpec = useMemo(
+    () => getModelSpec({ specName: conversation?.spec, startupConfig }),
+    [conversation?.spec, startupConfig],
+  );
+
+  const brandedSpecLabel = modelSpec?.showOnLanding ? modelSpec.label : '';
+  const brandedSpecDescription = (modelSpec?.showOnLanding && modelSpec.description) || '';
+  const name = entity?.name ?? brandedSpecLabel;
+  const description =
+    (entity?.description || brandedSpecDescription || conversation?.greeting) ?? '';
+  const descriptionIsHTML = description.trim().startsWith('<');
+
+  const sanitizeDescription = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_MEDIA_TAGS,
+        allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+      }),
+    [],
+  );
 
   const getGreeting = useCallback(() => {
     if (typeof startupConfig?.interface?.customWelcome === 'string') {
@@ -198,11 +223,17 @@ export default function Landing({ centerFormOnLanding }: { centerFormOnLanding:
             />
           )}
         </div>
-        {description && (
-          <div className="animate-fadeIn mt-4 max-w-md text-center text-sm font-normal text-text-primary">
-            {description}
-          </div>
-        )}
+        {description &&
+          (descriptionIsHTML ? (
+            <div
+              className="animate-fadeIn mt-4 flex max-w-md items-center justify-center gap-2 text-center text-sm font-normal text-text-primary [&_img]:inline-block [&_img]:h-4 [&_img]:w-4"
+              dangerouslySetInnerHTML={{ __html: sanitizeDescription(description) }}
+            />
+          ) : (
+            <div className="animate-fadeIn mt-4 max-w-md text-center text-sm font-normal text-text-primary">
+              {description}
+            </div>
+          ))}
       </div>
     </div>
   );
diff --git a/client/src/components/Chat/Menus/BookmarkMenu.tsx b/client/src/components/Chat/Menus/BookmarkMenu.tsx
index d66fccd24b7..a42a917fbd2 100644
--- a/client/src/components/Chat/Menus/BookmarkMenu.tsx
+++ b/client/src/components/Chat/Menus/BookmarkMenu.tsx
@@ -14,7 +14,7 @@ import { BookmarkContext } from '~/Providers/BookmarkContext';
 import { BookmarkEditDialog } from '~/components/Bookmarks';
 import { useBookmarkSuccess, useLocalize } from '~/hooks';
 import { NotificationSeverity } from '~/common';
-import { cn, logger } from '~/utils';
+import { cn, isTemporaryConversation, logger } from '~/utils';
 import store from '~/store';
 
 const BookmarkMenu: FC = () => {
@@ -26,8 +26,7 @@ const BookmarkMenu: FC = () => {
   const conversationId = conversation?.conversationId ?? '';
   const updateConvoTags = useBookmarkSuccess(conversationId);
   const tags = conversation?.tags;
-  const isTemporary = conversation?.expiredAt != null;
-
+  const isTemporary = isTemporaryConversation(conversation);
   const menuId = useId();
   const [isMenuOpen, setIsMenuOpen] = useState(false);
   const [isDialogOpen, setIsDialogOpen] = useState(false);
diff --git a/client/src/components/Chat/Menus/Endpoints/DialogManager.tsx b/client/src/components/Chat/Menus/Endpoints/DialogManager.tsx
index 75eed646b00..1596512294a 100644
--- a/client/src/components/Chat/Menus/Endpoints/DialogManager.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/DialogManager.tsx
@@ -24,6 +24,26 @@ const DialogManager = ({
           endpointType={getEndpointField(endpointsConfig, keyDialogEndpoint, 'type')}
           onOpenChange={onOpenChange}
           userProvideURL={getEndpointField(endpointsConfig, keyDialogEndpoint, 'userProvideURL')}
+          userProvideAccessKeyId={getEndpointField(
+            endpointsConfig,
+            keyDialogEndpoint,
+            'userProvideAccessKeyId',
+          )}
+          userProvideSecretAccessKey={getEndpointField(
+            endpointsConfig,
+            keyDialogEndpoint,
+            'userProvideSecretAccessKey',
+          )}
+          userProvideSessionToken={getEndpointField(
+            endpointsConfig,
+            keyDialogEndpoint,
+            'userProvideSessionToken',
+          )}
+          userProvideBearerToken={getEndpointField(
+            endpointsConfig,
+            keyDialogEndpoint,
+            'userProvideBearerToken',
+          )}
         />
       )}
     </>
diff --git a/client/src/components/Chat/Menus/Endpoints/ModelSelector.tsx b/client/src/components/Chat/Menus/Endpoints/ModelSelector.tsx
index b59b7187439..0d2dbeeb6f5 100644
--- a/client/src/components/Chat/Menus/Endpoints/ModelSelector.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/ModelSelector.tsx
@@ -9,6 +9,7 @@ import {
   renderCustomGroups,
 } from './components';
 import { ModelSelectorProvider, useModelSelectorContext } from './ModelSelectorContext';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { ModelSelectorChatProvider } from './ModelSelectorChatContext';
 import { getSelectedIcon, getDisplayValue } from './utils';
 import { CustomMenu as Menu } from './CustomMenu';
@@ -19,6 +20,8 @@ const defaultInterface = getConfigDefaults().interface;
 
 function ModelSelectorContent() {
   const localize = useLocalize();
+  const modelSelectorHint = useShortcutHint('openModelSelector', localize('com_ui_select_model'));
+  const modelSelectorAriaKey = useShortcutAriaKey('openModelSelector');
 
   const {
     // LibreChat
@@ -64,9 +67,11 @@ function ModelSelectorContent() {
   const trigger = (
     <TooltipAnchor
       aria-label={localize('com_ui_select_model')}
-      description={localize('com_ui_select_model')}
+      description={modelSelectorHint}
       render={
         <button
+          data-testid="model-selector-button"
+          aria-keyshortcuts={modelSelectorAriaKey}
           className="my-1 flex h-9 w-full max-w-[70vw] items-center justify-center gap-2 rounded-xl border border-border-light bg-presentation px-3 py-2 text-sm text-text-primary hover:bg-surface-active-alt"
           aria-label={localize('com_ui_select_model')}
         >
diff --git a/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx b/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
index 5a51db6ce99..b09bef94be9 100644
--- a/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
@@ -1,5 +1,5 @@
-import debounce from 'lodash/debounce';
 import React, { createContext, useContext, useState, useMemo, useCallback } from 'react';
+import debounce from 'lodash/debounce';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type * as t from 'librechat-data-provider';
 import type { Endpoint, SelectedValues } from '~/common';
@@ -161,8 +161,8 @@ export function ModelSelectorProvider({ children, startupConfig }: ModelSelector
       return null;
     }
     const allItems = [...modelSpecs, ...mappedEndpoints];
-    return filterItems(allItems, searchValue, agentsMap, assistantsMap || {});
-  }, [searchValue, modelSpecs, mappedEndpoints, agentsMap, assistantsMap]);
+    return filterItems(allItems, searchValue, agentsMap, assistantsMap || {}, localize);
+  }, [searchValue, modelSpecs, mappedEndpoints, agentsMap, assistantsMap, localize]);
 
   const setDebouncedSearchValue = useMemo(
     () =>
diff --git a/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts b/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts
new file mode 100644
index 00000000000..a4b5069a691
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts
@@ -0,0 +1,46 @@
+import type { useLocalize } from '~/hooks';
+import type { Endpoint } from '~/common';
+import { filterItems } from '../utils';
+
+const agentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: true,
+  icon: null,
+  showMarketplace: true,
+  searchAliases: ['agent marketplace', 'marketplace'],
+};
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
+describe('model selector utilities', () => {
+  it('matches endpoint search aliases', () => {
+    const results = filterItems([agentsEndpoint], 'marketplace', undefined, undefined);
+    expect(results).toEqual([agentsEndpoint]);
+  });
+
+  it('matches localized Marketplace labels', () => {
+    const localize = ((key: string) => {
+      if (key === 'com_agents_marketplace') {
+        return 'Tienda de Agentes';
+      }
+      if (key === 'com_ui_marketplace') {
+        return 'Tienda';
+      }
+      return key;
+    }) as ReturnType<typeof useLocalize>;
+
+    const results = filterItems([agentsEndpoint], 'tienda', undefined, undefined, localize);
+    expect(results).toEqual([agentsEndpoint]);
+  });
+
+  it('does not match agents when there are no selectable agent options', () => {
+    const results = filterItems([disabledAgentsEndpoint], 'my agents', undefined, undefined);
+    expect(results).toEqual([]);
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx b/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
index c8cef36010f..fc2852edda1 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
@@ -5,11 +5,12 @@ import { CheckCircle2, MousePointerClick, SettingsIcon } from 'lucide-react';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TModelSpec } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
-import { CustomMenu as Menu, CustomMenuItem as MenuItem } from '../CustomMenu';
+import { CustomMenu as Menu, CustomMenuItem as MenuItem, CustomMenuSeparator } from '../CustomMenu';
+import MarketplaceItem, { marketplaceSearchMatches } from './Marketplace';
+import { filterModels, shouldRenderEndpointOption } from '../utils';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { renderEndpointModels } from './EndpointModelItem';
 import { ModelSpecItem } from './ModelSpecItem';
-import { filterModels } from '../utils';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -127,9 +128,15 @@ function EndpointMenuContent({
         assistantsMap,
       )
     : null;
+  const renderedModels = filteredModels ?? endpoint.models?.map((model) => model.name) ?? [];
+  const showMarketplace =
+    endpoint.showMarketplace === true && marketplaceSearchMatches(searchValue, localize);
+  const hasSelectableRows = endpointSpecs.length > 0 || renderedModels.length > 0;
 
   return (
     <>
+      {showMarketplace && <MarketplaceItem label={localize('com_agents_marketplace')} />}
+      {showMarketplace && hasSelectableRows && <CustomMenuSeparator />}
       {endpointSpecs.map((spec: TModelSpec) => (
         <ModelSpecItem key={spec.name} spec={spec} isSelected={selectedSpec === spec.name} />
       ))}
@@ -175,6 +182,10 @@ export function EndpointItem({ endpoint, endpointIndex }: EndpointItemProps) {
 
   const isEndpointSelected = !selectedSpec && selectedEndpoint === endpoint.value;
 
+  if (!shouldRenderEndpointOption(endpoint)) {
+    return null;
+  }
+
   if (endpoint.hasModels) {
     const placeholder =
       isAgentsEndpoint(endpoint.value) || isAssistantsEndpoint(endpoint.value)
diff --git a/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx b/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
index eb1081435d8..3c4cb840a46 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
@@ -1,6 +1,7 @@
 import React, { memo, useState } from 'react';
 import { AlertCircle } from 'lucide-react';
 import type { IconMapProps } from '~/common';
+import { getKnownEndpointAsset, hasKnownEndpointIcon } from '~/hooks/Endpoint/UnknownIcon';
 import { icons } from '~/hooks/Endpoint/Icons';
 
 interface GroupIconProps {
@@ -42,13 +43,27 @@ const GroupIcon: React.FC<GroupIconProps> = ({ iconURL, groupName }) => {
     );
   }
 
+  const resolvedIconURL = getKnownEndpointAsset(iconURL);
+
+  if (!resolvedIconURL && hasKnownEndpointIcon(iconURL)) {
+    const Icon: IconType = icons.unknown as IconType;
+    return (
+      <Icon
+        size={20}
+        endpoint={iconURL}
+        context="menu-item"
+        className="icon-md shrink-0 text-text-primary"
+      />
+    );
+  }
+
   return (
     <div
       className="icon-md shrink-0 overflow-hidden rounded-full"
       style={{ width: 20, height: 20 }}
     >
       <img
-        src={iconURL}
+        src={resolvedIconURL || iconURL}
         alt={groupName}
         className="h-full w-full object-cover"
         onError={handleImageError}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx b/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx
new file mode 100644
index 00000000000..577e537866f
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx
@@ -0,0 +1,49 @@
+import { LayoutGrid } from 'lucide-react';
+import { useNavigate } from 'react-router-dom';
+import type { LocalizeFunction } from '~/common';
+import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import { cn } from '~/utils';
+
+const marketplaceSearchAliases = ['agent marketplace', 'marketplace'];
+
+export function marketplaceSearchMatches(searchValue: string, localize: LocalizeFunction): boolean {
+  const searchTerm = searchValue.trim().toLowerCase();
+  if (!searchTerm) {
+    return true;
+  }
+
+  return [
+    localize('com_agents_marketplace'),
+    localize('com_ui_marketplace'),
+    ...marketplaceSearchAliases,
+  ].some((label) => label.toLowerCase().includes(searchTerm));
+}
+
+export default function MarketplaceItem({
+  className,
+  label,
+}: {
+  className?: string;
+  label: string;
+}) {
+  const navigate = useNavigate();
+
+  return (
+    <MenuItem
+      onClick={() => navigate('/agents')}
+      aria-label={label}
+      data-testid="model-selector-marketplace-item"
+      className={cn(
+        'flex w-full cursor-pointer items-center justify-between rounded-lg px-2 text-sm',
+        className,
+      )}
+    >
+      <div className="flex w-full min-w-0 items-center gap-2 px-1 py-1">
+        <div className="flex h-5 w-5 shrink-0 items-center justify-center">
+          <LayoutGrid className="h-5 w-5 text-text-primary" aria-hidden="true" />
+        </div>
+        <span className="truncate text-left">{label}</span>
+      </div>
+    </MenuItem>
+  );
+}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx b/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
index a73d1d8e47c..10662fa55b5 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
@@ -5,6 +5,7 @@ import type { TModelSpec } from 'librechat-data-provider';
 import { useFavorites, useLocalize, useIsActiveItem } from '~/hooks';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import SpecDescription from './SpecDescription';
 import SpecIcon from './SpecIcon';
 import { cn } from '~/utils';
 
@@ -48,9 +49,7 @@ export function ModelSpecItem({ spec, isSelected }: ModelSpecItemProps) {
         )}
         <div className="flex min-w-0 flex-col gap-1">
           <span className="truncate text-left">{spec.label}</span>
-          {spec.description && (
-            <span className="break-words text-xs font-normal">{spec.description}</span>
-          )}
+          <SpecDescription description={spec.description} />
         </div>
       </div>
       <button
diff --git a/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx b/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
index 26831a577e9..a64907ff26f 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
@@ -4,8 +4,11 @@ import { CheckCircle2, EarthIcon } from 'lucide-react';
 import { isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TModelSpec } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
+import MarketplaceItem, { marketplaceSearchMatches } from './Marketplace';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import { shouldRenderEndpointOption } from '../utils';
+import SpecDescription from './SpecDescription';
 import SpecIcon from './SpecIcon';
 import { cn } from '~/utils';
 
@@ -80,9 +83,7 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                 )}
                 <div className="flex min-w-0 flex-col gap-1">
                   <span className="truncate text-left">{spec.label}</span>
-                  {spec.description && (
-                    <span className="break-words text-xs font-normal">{spec.description}</span>
-                  )}
+                  <SpecDescription description={spec.description} />
                 </div>
               </div>
               {selectedSpec === spec.name && (
@@ -102,11 +103,20 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
         } else {
           // For an endpoint item
           const endpoint = item as Endpoint;
-          if (endpoint.hasModels && endpoint.models && endpoint.models.length > 0) {
+          if (!shouldRenderEndpointOption(endpoint)) {
+            return null;
+          }
+
+          if (endpoint.hasModels) {
             const lowerQuery = searchValue.toLowerCase();
-            const filteredModels = endpoint.label.toLowerCase().includes(lowerQuery)
-              ? endpoint.models
-              : endpoint.models.filter((model) => {
+            const endpointMatches = endpoint.label.toLowerCase().includes(lowerQuery);
+            const showMarketplace =
+              endpoint.showMarketplace === true &&
+              (endpointMatches || marketplaceSearchMatches(searchValue, localize));
+            const models = endpoint.models ?? [];
+            const filteredModels = endpointMatches
+              ? models
+              : models.filter((model) => {
                   let modelName = model.name;
                   if (
                     isAgentsEndpoint(endpoint.value) &&
@@ -124,7 +134,7 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                   return modelName.toLowerCase().includes(lowerQuery);
                 });
 
-            if (!filteredModels.length) {
+            if (!filteredModels.length && !showMarketplace) {
               return null; // skip if no models match
             }
 
@@ -138,6 +148,12 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                   )}
                   {endpoint.label}
                 </div>
+                {showMarketplace && (
+                  <MarketplaceItem
+                    className="px-3 py-2 pl-6"
+                    label={localize('com_agents_marketplace')}
+                  />
+                )}
                 {filteredModels.map((model) => {
                   const modelId = model.name;
 
diff --git a/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx b/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx
new file mode 100644
index 00000000000..b67395380ad
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx
@@ -0,0 +1,32 @@
+import { useMemo } from 'react';
+import { createConfigHtmlSanitizer, CONFIG_HTML_MEDIA_TAGS, CONFIG_HTML_MEDIA_ATTR } from '~/utils';
+
+interface SpecDescriptionProps {
+  description?: string;
+}
+
+export default function SpecDescription({ description }: SpecDescriptionProps) {
+  const sanitize = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_MEDIA_TAGS,
+        allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+      }),
+    [],
+  );
+
+  if (!description) {
+    return null;
+  }
+
+  if (!description.trim().startsWith('<')) {
+    return <span className="break-words text-xs font-normal">{description}</span>;
+  }
+
+  return (
+    <span
+      className="inline-flex items-center gap-1 break-words text-xs font-normal [&_img]:inline-block [&_img]:h-3.5 [&_img]:w-3.5"
+      dangerouslySetInnerHTML={{ __html: sanitize(description) }}
+    />
+  );
+}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/SpecIcon.tsx b/client/src/components/Chat/Menus/Endpoints/components/SpecIcon.tsx
index 1a3d9ca4805..2e354db08b7 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/SpecIcon.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/SpecIcon.tsx
@@ -5,6 +5,7 @@ import type { IconMapProps } from '~/common';
 import { getModelSpecIconURL, getIconKey } from '~/utils';
 import { URLIcon } from '~/components/Endpoints/URLIcon';
 import { icons } from '~/hooks/Endpoint/Icons';
+import { isImageURL } from '~/utils/icons';
 
 interface SpecIconProps {
   currentSpec: TModelSpec;
@@ -15,14 +16,15 @@ type IconType = (props: IconMapProps) => React.JSX.Element;
 
 const SpecIcon: React.FC<SpecIconProps> = ({ currentSpec, endpointsConfig }) => {
   const iconURL = getModelSpecIconURL(currentSpec);
-  const { endpoint } = currentSpec.preset;
+  const endpoint = currentSpec.preset?.endpoint;
   const endpointIconURL = getEndpointField(endpointsConfig, endpoint, 'iconURL');
   const iconKey = getIconKey({ endpoint, endpointsConfig, endpointIconURL });
+  const shouldRenderURLIcon = isImageURL(iconURL);
   let Icon: IconType;
 
-  if (!iconURL.includes('http')) {
+  if (!shouldRenderURLIcon) {
     Icon = (icons[iconURL] ?? icons[iconKey] ?? icons.unknown) as IconType;
-  } else if (iconURL) {
+  } else {
     return (
       <URLIcon
         iconURL={iconURL}
@@ -32,8 +34,6 @@ const SpecIcon: React.FC<SpecIconProps> = ({ currentSpec, endpointsConfig }) =>
         endpoint={endpoint || undefined}
       />
     );
-  } else {
-    Icon = (icons[endpoint ?? ''] ?? icons[iconKey] ?? icons.unknown) as IconType;
   }
 
   return (
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx
new file mode 100644
index 00000000000..5a8d6eca1c1
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx
@@ -0,0 +1,80 @@
+import React from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import type { Endpoint, SelectedValues } from '~/common';
+import { EndpointItem } from '../EndpointItem';
+
+const mockHandleSelectEndpoint = jest.fn();
+const mockHandleOpenKeyDialog = jest.fn();
+const mockSetEndpointSearchValue = jest.fn();
+
+let mockSelectedValues: SelectedValues = { endpoint: '', model: '', modelSpec: '' };
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+jest.mock('~/components/Chat/Menus/Endpoints/ModelSelectorContext', () => ({
+  useModelSelectorContext: () => ({
+    agentsMap: undefined,
+    assistantsMap: undefined,
+    modelSpecs: [],
+    selectedValues: mockSelectedValues,
+    endpointSearchValues: {},
+    handleOpenKeyDialog: mockHandleOpenKeyDialog,
+    handleSelectEndpoint: mockHandleSelectEndpoint,
+    setEndpointSearchValue: mockSetEndpointSearchValue,
+    endpointRequiresUserKey: () => false,
+  }),
+}));
+
+jest.mock('~/components/Chat/Menus/Endpoints/CustomMenu', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+
+  return {
+    CustomMenu: ({ children, label }: { children?: React.ReactNode; label?: React.ReactNode }) =>
+      React.createElement('div', null, label, children),
+    CustomMenuItem: React.forwardRef(function MockMenuItem(
+      { children, ...rest }: { children?: React.ReactNode },
+      ref: React.Ref<HTMLButtonElement>,
+    ) {
+      return React.createElement('button', { ref, type: 'button', ...rest }, children);
+    }),
+    CustomMenuSeparator: () => React.createElement('hr'),
+  };
+});
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
+const customEndpoint: Endpoint = {
+  value: 'custom',
+  label: 'Custom',
+  hasModels: false,
+  icon: null,
+};
+
+describe('EndpointItem', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+  });
+
+  it('does not render agents as a leaf endpoint when no selectable rows exist', () => {
+    render(<EndpointItem endpoint={disabledAgentsEndpoint} endpointIndex={0} />);
+
+    expect(screen.queryByText('My Agents')).not.toBeInTheDocument();
+    expect(mockHandleSelectEndpoint).not.toHaveBeenCalled();
+  });
+
+  it('keeps non-agent endpoints without models selectable', () => {
+    render(<EndpointItem endpoint={customEndpoint} endpointIndex={0} />);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Custom' }));
+
+    expect(mockHandleSelectEndpoint).toHaveBeenCalledWith(customEndpoint);
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx
new file mode 100644
index 00000000000..ee8ba0f5f06
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx
@@ -0,0 +1,64 @@
+import { render, screen } from '@testing-library/react';
+import GroupIcon from '../GroupIcon';
+
+jest.mock('~/hooks/Endpoint/Icons', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+  const createIcon =
+    (iconKey: string) =>
+    ({ className, endpoint }: { className?: string; endpoint?: string | null }) =>
+      React.createElement('span', {
+        className,
+        'data-testid': 'endpoint-icon',
+        'data-icon-key': iconKey,
+        'data-endpoint': endpoint ?? '',
+      });
+
+  return {
+    icons: {
+      openAI: createIcon('openAI'),
+      unknown: createIcon('unknown'),
+    },
+  };
+});
+
+describe('GroupIcon', () => {
+  it('renders built-in endpoint icon keys', () => {
+    render(<GroupIcon iconURL="openAI" groupName="OpenAI" />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-icon-key', 'openAI');
+  });
+
+  it('resolves known endpoint asset aliases case-insensitively', () => {
+    render(<GroupIcon iconURL="OpenRouter" groupName="OpenRouter" />);
+
+    expect(screen.getByRole('img', { name: 'OpenRouter' })).toHaveAttribute(
+      'src',
+      'assets/openrouter.png',
+    );
+  });
+
+  it('resolves known endpoint asset aliases to shipped file paths', () => {
+    render(<GroupIcon iconURL="Helicone" groupName="Helicone" />);
+
+    expect(screen.getByRole('img', { name: 'Helicone' })).toHaveAttribute(
+      'src',
+      'assets/helicone.svg',
+    );
+  });
+
+  it('renders known endpoint aliases backed by components', () => {
+    render(<GroupIcon iconURL="Moonshot" groupName="Moonshot" />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-icon-key', 'unknown');
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-endpoint', 'Moonshot');
+  });
+
+  it('renders configured image URLs directly', () => {
+    render(<GroupIcon iconURL="/assets/openrouter.png" groupName="OpenRouter" />);
+
+    expect(screen.getByRole('img', { name: 'OpenRouter' })).toHaveAttribute(
+      'src',
+      '/assets/openrouter.png',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
index 8ab9235f6fd..34acdd0e792 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
@@ -1,10 +1,11 @@
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen } from '@testing-library/react';
 import type { Endpoint, SelectedValues } from '~/common';
 import { SearchResults } from '../SearchResults';
 
 const mockHandleSelectSpec = jest.fn();
 const mockHandleSelectModel = jest.fn();
 const mockHandleSelectEndpoint = jest.fn();
+const mockNavigate = jest.fn();
 let mockSelectedValues: SelectedValues;
 
 jest.mock('~/components/Chat/Menus/Endpoints/ModelSelectorContext', () => ({
@@ -29,6 +30,10 @@ jest.mock('~/components/Chat/Menus/Endpoints/CustomMenu', () => {
   };
 });
 
+jest.mock('react-router-dom', () => ({
+  useNavigate: () => mockNavigate,
+}));
+
 jest.mock('../SpecIcon', () => {
   const React = jest.requireActual<typeof import('react')>('react');
   return {
@@ -54,6 +59,24 @@ const noModelsEndpoint: Endpoint = {
   icon: null,
 };
 
+const agentsMarketplaceEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: true,
+  models: [{ name: 'agent-1' }],
+  agentNames: { 'agent-1': 'Support Agent' },
+  showMarketplace: true,
+  searchAliases: ['agent marketplace', 'marketplace'],
+  icon: null,
+};
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
 describe('SearchResults', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -106,4 +129,36 @@ describe('SearchResults', () => {
     const item = screen.getByRole('menuitem');
     expect(item).toHaveAttribute('aria-selected', 'true');
   });
+
+  it('renders Marketplace from agent endpoint search results and navigates to agents', () => {
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+    render(
+      <SearchResults
+        results={[agentsMarketplaceEndpoint]}
+        localize={localize}
+        searchValue="marketplace"
+      />,
+    );
+
+    const item = screen.getByRole('menuitem', { name: 'com_agents_marketplace' });
+    expect(item).toBeInTheDocument();
+
+    fireEvent.click(item);
+    expect(mockNavigate).toHaveBeenCalledWith('/agents');
+    expect(mockHandleSelectModel).not.toHaveBeenCalled();
+  });
+
+  it('does not render agents as a selectable endpoint when marketplace and agent rows are unavailable', () => {
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+    render(
+      <SearchResults
+        results={[disabledAgentsEndpoint]}
+        localize={localize}
+        searchValue="my agents"
+      />,
+    );
+
+    expect(screen.queryByRole('menuitem', { name: 'My Agents' })).not.toBeInTheDocument();
+    expect(mockHandleSelectEndpoint).not.toHaveBeenCalled();
+  });
 });
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx
new file mode 100644
index 00000000000..524e1ff5837
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx
@@ -0,0 +1,39 @@
+import { render, screen } from '@testing-library/react';
+import SpecDescription from '../SpecDescription';
+
+describe('SpecDescription', () => {
+  it('renders nothing without a description', () => {
+    const { container } = render(<SpecDescription />);
+
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('renders plain text descriptions without interpreting markup', () => {
+    render(<SpecDescription description="Fast & accurate < 1s responses" />);
+
+    expect(screen.getByText('Fast & accurate < 1s responses')).toBeInTheDocument();
+  });
+
+  it('renders HTML descriptions with inline images', () => {
+    const { container } = render(
+      <SpecDescription description='<span>Powered by <img src="/assets/claude.png" alt="Claude" /> Claude</span>' />,
+    );
+
+    const image = container.querySelector('img');
+    expect(image).toHaveAttribute('src', '/assets/claude.png');
+    expect(image).toHaveAttribute('alt', 'Claude');
+    expect(container).toHaveTextContent('Powered by Claude');
+  });
+
+  it('strips scripts, event handlers, and unsafe URLs from HTML descriptions', () => {
+    const { container } = render(
+      <SpecDescription description='<span onclick="alert(1)">Safe<script>alert(1)</script><img src="javascript:alert(1)" onerror="alert(1)"></span>' />,
+    );
+
+    expect(container).toHaveTextContent('Safe');
+    expect(container.querySelector('script')).toBeNull();
+    expect(container.querySelector('[onclick]')).toBeNull();
+    expect(container.querySelector('[onerror]')).toBeNull();
+    expect(container.querySelector('img')?.getAttribute('src') ?? '').not.toContain('javascript');
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecIcon.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecIcon.test.tsx
new file mode 100644
index 00000000000..e480a4bde70
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecIcon.test.tsx
@@ -0,0 +1,90 @@
+import { render, screen } from '@testing-library/react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TModelSpec, TEndpointsConfig } from 'librechat-data-provider';
+import SpecIcon from '../SpecIcon';
+
+jest.mock('~/hooks/Endpoint/Icons', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+  const createIcon =
+    (iconKey: string) =>
+    ({ endpoint, iconURL }: { endpoint?: string | null; iconURL?: string }) =>
+      React.createElement('span', {
+        'data-testid': 'endpoint-icon',
+        'data-icon-key': iconKey,
+        'data-endpoint': endpoint ?? '',
+        'data-icon-url': iconURL ?? '',
+      });
+
+  return {
+    icons: {
+      google: createIcon('google'),
+      openAI: createIcon('openAI'),
+      unknown: createIcon('unknown'),
+    },
+  };
+});
+
+jest.mock('~/components/Endpoints/URLIcon', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+  return {
+    URLIcon: ({ iconURL, endpoint }: { iconURL: string; endpoint?: string }) =>
+      React.createElement('span', {
+        'data-testid': 'url-icon',
+        'data-icon-url': iconURL,
+        'data-endpoint': endpoint ?? '',
+      }),
+  };
+});
+
+describe('SpecIcon', () => {
+  const endpointsConfig = {} as TEndpointsConfig;
+
+  it('renders the explicit spec icon when runtime spec data is missing preset', () => {
+    const currentSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+      iconURL: EModelEndpoint.google,
+    } as TModelSpec;
+
+    render(<SpecIcon currentSpec={currentSpec} endpointsConfig={endpointsConfig} />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute(
+      'data-icon-key',
+      EModelEndpoint.google,
+    );
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-endpoint', '');
+  });
+
+  it('renders same-origin absolute spec icon URLs as images', () => {
+    const currentSpec = {
+      name: 'clickhouse-test',
+      label: 'ClickHouse Test',
+      iconURL: '/assets/clickhouse-logo.svg',
+      preset: {
+        endpoint: EModelEndpoint.anthropic,
+      },
+    } as TModelSpec;
+
+    render(<SpecIcon currentSpec={currentSpec} endpointsConfig={endpointsConfig} />);
+
+    expect(screen.getByTestId('url-icon')).toHaveAttribute(
+      'data-icon-url',
+      '/assets/clickhouse-logo.svg',
+    );
+    expect(screen.getByTestId('url-icon')).toHaveAttribute(
+      'data-endpoint',
+      EModelEndpoint.anthropic,
+    );
+  });
+
+  it('falls back to the unknown icon when runtime spec data has no icon or preset', () => {
+    const currentSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+    } as TModelSpec;
+
+    render(<SpecIcon currentSpec={currentSpec} endpointsConfig={endpointsConfig} />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-icon-key', 'unknown');
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/index.ts b/client/src/components/Chat/Menus/Endpoints/components/index.ts
index bc08e6a8a18..a2e3478bfdb 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/index.ts
+++ b/client/src/components/Chat/Menus/Endpoints/components/index.ts
@@ -3,3 +3,4 @@ export * from './EndpointModelItem';
 export * from './EndpointItem';
 export * from './SearchResults';
 export * from './CustomGroup';
+export * from './Marketplace';
diff --git a/client/src/components/Chat/Menus/Endpoints/utils.ts b/client/src/components/Chat/Menus/Endpoints/utils.ts
index 1681ed7f1d6..474d3f23ea6 100644
--- a/client/src/components/Chat/Menus/Endpoints/utils.ts
+++ b/client/src/components/Chat/Menus/Endpoints/utils.ts
@@ -16,13 +16,17 @@ export function filterItems<
     label: string;
     name?: string;
     value?: string;
+    hasModels?: boolean;
     models?: Array<{ name: string; isGlobal?: boolean }>;
+    searchAliases?: string[];
+    showMarketplace?: boolean;
   },
 >(
   items: T[],
   searchValue: string,
   agentsMap: TAgentsMap | undefined,
   assistantsMap: TAssistantsMap | undefined,
+  localize?: ReturnType<typeof useLocalize>,
 ): T[] | null {
   const searchTermLower = searchValue.trim().toLowerCase();
   if (!searchTermLower) {
@@ -30,10 +34,20 @@ export function filterItems<
   }
 
   return items.filter((item) => {
+    if (!shouldRenderEndpointOption(item)) {
+      return false;
+    }
+
     const itemMatches =
       item.label.toLowerCase().includes(searchTermLower) ||
       (item.name && item.name.toLowerCase().includes(searchTermLower)) ||
-      (item.value && item.value.toLowerCase().includes(searchTermLower));
+      (item.value && item.value.toLowerCase().includes(searchTermLower)) ||
+      item.searchAliases?.some((alias) => alias.toLowerCase().includes(searchTermLower)) ||
+      (item.showMarketplace === true &&
+        localize != null &&
+        [localize('com_agents_marketplace'), localize('com_ui_marketplace')].some((label) =>
+          label.toLowerCase().includes(searchTermLower),
+        ));
 
     if (itemMatches) {
       return true;
@@ -67,6 +81,13 @@ export function filterItems<
   });
 }
 
+export function shouldRenderEndpointOption(endpoint: {
+  value?: string;
+  hasModels?: boolean;
+}): boolean {
+  return !isAgentsEndpoint(endpoint.value) || endpoint.hasModels === true;
+}
+
 export function filterModels(
   endpoint: Endpoint,
   models: string[],
diff --git a/client/src/components/Chat/Menus/Models/fakeData.ts b/client/src/components/Chat/Menus/Models/fakeData.ts
index 43d4cf489a2..6095dde6ef5 100644
--- a/client/src/components/Chat/Menus/Models/fakeData.ts
+++ b/client/src/components/Chat/Menus/Models/fakeData.ts
@@ -32,7 +32,7 @@ export const data: TModelSpec[] = [
     // iconURL: 'https://i.ytimg.com/vi/SaneSRqePVY/maxresdefault.jpg',
     iconURL: EModelEndpoint.openAI, // Allow using project-included icons
     preset: {
-      chatGptLabel: 'Vision Helper',
+      modelLabel: 'Vision Helper',
       greeting: "What's up!!",
       endpoint: EModelEndpoint.openAI,
       model: 'gpt-4-turbo',
diff --git a/client/src/components/Chat/Menus/OpenSidebar.tsx b/client/src/components/Chat/Menus/OpenSidebar.tsx
index 0a932b2e448..e8a158a0014 100644
--- a/client/src/components/Chat/Menus/OpenSidebar.tsx
+++ b/client/src/components/Chat/Menus/OpenSidebar.tsx
@@ -1,6 +1,7 @@
 import { startTransition } from 'react';
 import { useSetRecoilState } from 'recoil';
 import { TooltipAnchor, Button, Sidebar } from '@librechat/client';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 import store from '~/store';
@@ -11,6 +12,8 @@ export const OPEN_SIDEBAR_ID = 'open-sidebar-button';
 export default function OpenSidebar({ className }: { className?: string }) {
   const localize = useLocalize();
   const setSidebarExpanded = useSetRecoilState(store.sidebarExpanded);
+  const tooltipDescription = useShortcutHint('toggleSidebar', localize('com_nav_open_sidebar'));
+  const ariaKey = useShortcutAriaKey('toggleSidebar');
 
   const handleClick = () => {
     startTransition(() => {
@@ -23,7 +26,7 @@ export default function OpenSidebar({ className }: { className?: string }) {
 
   return (
     <TooltipAnchor
-      description={localize('com_nav_open_sidebar')}
+      description={tooltipDescription}
       render={
         <Button
           id={OPEN_SIDEBAR_ID}
@@ -33,6 +36,7 @@ export default function OpenSidebar({ className }: { className?: string }) {
           aria-label={localize('com_nav_open_sidebar')}
           aria-expanded={false}
           aria-controls="chat-history-nav"
+          aria-keyshortcuts={ariaKey}
           className={cn(
             'rounded-xl bg-presentation duration-0 hover:bg-surface-active-alt',
             className,
diff --git a/client/src/components/Chat/Messages/Content/CodeAnalyze.tsx b/client/src/components/Chat/Messages/Content/CodeAnalyze.tsx
index 3d4fdee1c9f..dd80e95d783 100644
--- a/client/src/components/Chat/Messages/Content/CodeAnalyze.tsx
+++ b/client/src/components/Chat/Messages/Content/CodeAnalyze.tsx
@@ -11,10 +11,12 @@ export default function CodeAnalyze({
   initialProgress = 0.1,
   code,
   outputs = [],
+  onExpand,
 }: {
   initialProgress: number;
   code: string;
   outputs: Record<string, unknown>[];
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const progress = useProgress(initialProgress);
@@ -27,6 +29,16 @@ export default function CodeAnalyze({
     }
   }, [autoExpand]);
 
+  const handleToggleCode = () => {
+    setShowCode((prev) => {
+      const next = !prev;
+      if (next) {
+        onExpand?.();
+      }
+      return next;
+    });
+  };
+
   const logs = outputs.reduce((acc, output) => {
     if (output['logs']) {
       return acc + output['logs'] + '\n';
@@ -42,7 +54,7 @@ export default function CodeAnalyze({
       <div className="my-1 flex items-center gap-2.5">
         <ProgressText
           progress={progress}
-          onClick={() => setShowCode((prev) => !prev)}
+          onClick={handleToggleCode}
           inProgressText={localize('com_ui_analyzing')}
           finishedText={localize('com_ui_analyzing_finished')}
           hasInput={!!code.length}
diff --git a/client/src/components/Chat/Messages/Content/Container.tsx b/client/src/components/Chat/Messages/Content/Container.tsx
index 7d5f8425115..042dc68c2f3 100644
--- a/client/src/components/Chat/Messages/Content/Container.tsx
+++ b/client/src/components/Chat/Messages/Content/Container.tsx
@@ -1,6 +1,7 @@
 import { TMessage } from 'librechat-data-provider';
-import Files from './Files';
+import MessageQuotes from './MessageQuotes';
 import SkillPills from './SkillPills';
+import Files from './Files';
 
 const Container = ({ children, message }: { children: React.ReactNode; message?: TMessage }) => (
   <div
@@ -9,6 +10,7 @@ const Container = ({ children, message }: { children: React.ReactNode; message?:
   >
     {message?.isCreatedByUser === true && (
       <>
+        <MessageQuotes quotes={message.quotes} />
         <Files message={message} />
         <SkillPills skills={message.alwaysAppliedSkills} source="always-apply" />
         <SkillPills skills={message.manualSkills} source="manual" />
diff --git a/client/src/components/Chat/Messages/Content/ContentParts.tsx b/client/src/components/Chat/Messages/Content/ContentParts.tsx
index 6a8a544d435..00569c11f54 100644
--- a/client/src/components/Chat/Messages/Content/ContentParts.tsx
+++ b/client/src/components/Chat/Messages/Content/ContentParts.tsx
@@ -1,4 +1,4 @@
-import { memo, useMemo, useCallback } from 'react';
+import { memo, useRef, useMemo, useCallback } from 'react';
 import { ContentTypes } from 'librechat-data-provider';
 import type {
   TMessageContentParts,
@@ -6,11 +6,12 @@ import type {
   TAttachment,
   Agents,
 } from 'librechat-data-provider';
+import type { ToolCallGroupExpansionState } from './ToolCallGroup';
 import { ParallelContentRenderer, type PartWithIndex } from './ParallelContent';
 import { mapAttachments, groupSequentialToolCalls } from '~/utils';
 import { MessageContext, SearchContext } from '~/Providers';
-import { EditTextPart, EmptyText } from './Parts';
 import PendingSkillCall from './Parts/PendingSkillCall';
+import { EditTextPart, EmptyText } from './Parts';
 import MemoryArtifacts from './MemoryArtifacts';
 import ToolCallGroup from './ToolCallGroup';
 import Container from './Container';
@@ -19,6 +20,18 @@ import Part from './Part';
 const getToolCallId = (part: TMessageContentParts): string =>
   (part?.[ContentTypes.TOOL_CALL] as Agents.ToolCall | undefined)?.id ?? '';
 
+const getToolGroupId = (parts: PartWithIndex[], fallbackScope: number): string => {
+  const firstPart = parts[0];
+  if (!firstPart) {
+    return 'empty';
+  }
+  const toolCallId = getToolCallId(firstPart.part);
+  if (toolCallId) {
+    return `tool:${toolCallId}`;
+  }
+  return `fallback:${fallbackScope}:${firstPart.idx}`;
+};
+
 type PartWithContextProps = {
   part: TMessageContentParts;
   idx: number;
@@ -32,6 +45,7 @@ type PartWithContextProps = {
   isLast: boolean;
   partAttachments: TAttachment[] | undefined;
   hideAttachments?: boolean;
+  onToolExpand?: () => void;
 };
 
 const PartWithContext = memo(function PartWithContext({
@@ -47,6 +61,7 @@ const PartWithContext = memo(function PartWithContext({
   isLast,
   partAttachments,
   hideAttachments,
+  onToolExpand,
 }: PartWithContextProps) {
   const contextValue = useMemo(
     () => ({
@@ -72,6 +87,7 @@ const PartWithContext = memo(function PartWithContext({
         isLast={isLastPart}
         showCursor={isLastPart && isLast}
         hideAttachments={hideAttachments}
+        onToolExpand={onToolExpand}
       />
     </MessageContext.Provider>
   );
@@ -89,6 +105,8 @@ type ContentPartsProps = {
    * the full message object) so `React.memo` stays shallow-happy.
    */
   manualSkills?: string[];
+  /** ISO timestamp of the parent message, surfaced in parallel column headers. */
+  createdAt?: string | null;
   conversationId?: string | null;
   attachments?: TAttachment[];
   searchResults?: { [key: string]: SearchResultData };
@@ -126,9 +144,31 @@ const ContentParts = memo(function ContentParts({
   conversationId,
   isCreatedByUser,
   isLatestMessage,
+  createdAt,
 }: ContentPartsProps) {
   const attachmentMap = useMemo(() => mapAttachments(attachments ?? []), [attachments]);
   const effectiveIsSubmitting = isLatestMessage ? isSubmitting : false;
+  const toolGroupExpansionRef = useRef(new Map<string, ToolCallGroupExpansionState>());
+  const fallbackScopeRef = useRef({ messageId, scope: 0 });
+  if (fallbackScopeRef.current.messageId !== messageId) {
+    if (!effectiveIsSubmitting) {
+      fallbackScopeRef.current.scope += 1;
+      toolGroupExpansionRef.current.clear();
+    }
+    fallbackScopeRef.current.messageId = messageId;
+  }
+  const fallbackScope = fallbackScopeRef.current.scope;
+
+  const handleGroupExpansionChange = useCallback(
+    (groupId: string, state: ToolCallGroupExpansionState) => {
+      if (!state.userOverride) {
+        toolGroupExpansionRef.current.delete(groupId);
+        return;
+      }
+      toolGroupExpansionRef.current.set(groupId, state);
+    },
+    [],
+  );
 
   /**
    * Interim skill cards — rendered in a separate slot ABOVE the Parts
@@ -219,7 +259,7 @@ const ContentParts = memo(function ContentParts({
   );
 
   const renderGroupedPart = useCallback(
-    (part: TMessageContentParts, idx: number, isLastPart: boolean) => {
+    (part: TMessageContentParts, idx: number, isLastPart: boolean, onToolExpand?: () => void) => {
       return (
         <PartWithContext
           key={`provider-${messageId}-${idx}`}
@@ -235,6 +275,7 @@ const ContentParts = memo(function ContentParts({
           isSubmitting={effectiveIsSubmitting}
           partAttachments={attachmentMap[getToolCallId(part)]}
           hideAttachments
+          onToolExpand={onToolExpand}
         />
       );
     },
@@ -269,12 +310,13 @@ const ContentParts = memo(function ContentParts({
         if (group.type === 'single') {
           return group;
         }
+        const groupId = getToolGroupId(group.parts, fallbackScope);
         const groupAttachments = group.parts.flatMap(
           ({ part }) => attachmentMap[getToolCallId(part)] ?? [],
         );
-        return { ...group, groupAttachments };
+        return { ...group, groupId, groupAttachments };
       }),
-    [sequentialParts, attachmentMap],
+    [sequentialParts, attachmentMap, fallbackScope],
   );
 
   // Early return: no content to render AND no pending skill cards
@@ -336,6 +378,7 @@ const ContentParts = memo(function ContentParts({
         <ParallelContentRenderer
           content={content}
           messageId={messageId}
+          createdAt={createdAt}
           conversationId={conversationId}
           attachments={attachments}
           searchResults={searchResults}
@@ -361,15 +404,18 @@ const ContentParts = memo(function ContentParts({
           const { part, idx } = group.part;
           return renderPart(part, idx, idx === lastContentIdx);
         }
+        const { groupId } = group;
         return (
           <ToolCallGroup
-            key={`tool-group-${group.parts[0].idx}`}
+            key={`tool-group-${groupId}`}
             parts={group.parts}
             isSubmitting={effectiveIsSubmitting}
             isLast={group.parts.some((p) => p.idx === lastContentIdx)}
             renderPart={renderGroupedPart}
             lastContentIdx={lastContentIdx}
             groupAttachments={group.groupAttachments}
+            initialExpansionState={toolGroupExpansionRef.current.get(groupId)}
+            onExpansionChange={(state) => handleGroupExpansionChange(groupId, state)}
           />
         );
       })}
diff --git a/client/src/components/Chat/Messages/Content/EditMessage.tsx b/client/src/components/Chat/Messages/Content/EditMessage.tsx
index 53fa4f88009..2030c5ffc98 100644
--- a/client/src/components/Chat/Messages/Content/EditMessage.tsx
+++ b/client/src/components/Chat/Messages/Content/EditMessage.tsx
@@ -1,6 +1,6 @@
 import { useRef, useEffect, useCallback } from 'react';
-import { useForm } from 'react-hook-form';
 import { useRecoilValue } from 'recoil';
+import { useForm } from 'react-hook-form';
 import { TextareaAutosize, TooltipAnchor } from '@librechat/client';
 import { useUpdateMessageMutation } from 'librechat-data-provider/react-query';
 import type { TEditProps } from '~/common';
@@ -65,6 +65,9 @@ const EditMessage = ({
            *  carry the picks forward so the new turn primes the same skills
            *  instead of running unprimed. */
           overrideManualSkills: message.manualSkills,
+          /** Carry the edited user message's quoted excerpts forward so the new
+           *  turn sends the same referenced context the pills still show. */
+          overrideQuotes: message.quotes,
           addedConvo: getAddedConvo() || undefined,
         },
       );
@@ -88,6 +91,9 @@ const EditMessage = ({
            *  the same manual skills so the regenerated response is primed
            *  identically. */
           overrideManualSkills: parentMessage.manualSkills,
+          /** Replaying the parent user turn: keep its quoted excerpts so the
+           *  regenerated response is sent the same referenced context. */
+          overrideQuotes: parentMessage.quotes,
           addedConvo: getAddedConvo() || undefined,
         },
       );
diff --git a/client/src/components/Chat/Messages/Content/FilePreviewDialog.tsx b/client/src/components/Chat/Messages/Content/FilePreviewDialog.tsx
index 45881749f72..79886c5d73c 100644
--- a/client/src/components/Chat/Messages/Content/FilePreviewDialog.tsx
+++ b/client/src/components/Chat/Messages/Content/FilePreviewDialog.tsx
@@ -3,9 +3,10 @@ import copy from 'copy-to-clipboard';
 import { useRecoilValue } from 'recoil';
 import { Download } from 'lucide-react';
 import { OGDialog, OGDialogContent, OGDialogTitle, OGDialogDescription } from '@librechat/client';
-import CopyButton from '~/components/Messages/Content/CopyButton';
+import { useFileDownload, useSharedFileDownload } from '~/data-provider';
 import { logger, sortPagesByRelevance, triggerDownload } from '~/utils';
-import { useFileDownload } from '~/data-provider';
+import CopyButton from '~/components/Messages/Content/CopyButton';
+import { useShareContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
@@ -14,6 +15,7 @@ interface FilePreviewDialogProps {
   onOpenChange: (open: boolean) => void;
   fileName: string;
   fileId?: string;
+  filePath?: string;
   relevance?: number;
   pages?: number[];
   pageRelevance?: Record<number, number>;
@@ -128,6 +130,7 @@ export default function FilePreviewDialog({
   onOpenChange,
   fileName,
   fileId,
+  filePath,
   relevance,
   pages,
   pageRelevance,
@@ -136,7 +139,13 @@ export default function FilePreviewDialog({
 }: FilePreviewDialogProps) {
   const localize = useLocalize();
   const user = useRecoilValue(store.user);
-  const { refetch: downloadFile } = useFileDownload(user?.id ?? '', fileId, { direct: false });
+  const { shareId } = useShareContext();
+  const { refetch: downloadOwned } = useFileDownload(user?.id ?? '', fileId, { direct: false });
+  const { refetch: downloadShared } = useSharedFileDownload(shareId, fileId);
+  // Use the share route only for snapshotted files (filepath rewritten to the
+  // share path); otherwise fall back to the owner route.
+  const useShared = !!shareId && (filePath?.startsWith('/api/share/') ?? false);
+  const downloadFile = useShared ? downloadShared : downloadOwned;
 
   const [fileContent, setFileContent] = useState<string | null>(null);
   const [fileBlobUrl, setFileBlobUrl] = useState<string | null>(null);
diff --git a/client/src/components/Chat/Messages/Content/Files.tsx b/client/src/components/Chat/Messages/Content/Files.tsx
index 176507edc1b..4e4d85060c2 100644
--- a/client/src/components/Chat/Messages/Content/Files.tsx
+++ b/client/src/components/Chat/Messages/Content/Files.tsx
@@ -46,6 +46,7 @@ const Files = ({ message }: { message?: TMessage }) => {
         onOpenChange={handleClose}
         fileName={selectedFile?.filename ?? ''}
         fileId={selectedFile?.file_id}
+        filePath={selectedFile?.filepath}
         fileType={selectedFile?.type ?? undefined}
         fileSize={(selectedFile as TFile)?.bytes}
       />
diff --git a/client/src/components/Chat/Messages/Content/Image.tsx b/client/src/components/Chat/Messages/Content/Image.tsx
index 7e3e12e65bd..070d379c7c4 100644
--- a/client/src/components/Chat/Messages/Content/Image.tsx
+++ b/client/src/components/Chat/Messages/Content/Image.tsx
@@ -51,16 +51,17 @@ const Image = ({
   const absoluteImageUrl = useMemo(() => {
     if (!imagePath) return imagePath;
 
-    if (
-      imagePath.startsWith('http') ||
-      imagePath.startsWith('data:') ||
-      !imagePath.startsWith('/images/')
-    ) {
+    if (imagePath.startsWith('http') || imagePath.startsWith('data:')) {
       return imagePath;
     }
 
-    const baseURL = apiBaseUrl();
-    return `${baseURL}${imagePath}`;
+    // Root-relative server paths (`/images/...` static, `/api/share/...` share
+    // routes) are resolved against the API base so they load under a subpath.
+    if (imagePath.startsWith('/images/') || imagePath.startsWith('/api/')) {
+      return `${apiBaseUrl()}${imagePath}`;
+    }
+
+    return imagePath;
   }, [imagePath]);
 
   const downloadImage = async () => {
diff --git a/client/src/components/Chat/Messages/Content/Markdown.tsx b/client/src/components/Chat/Messages/Content/Markdown.tsx
index 1217869a2c3..54e01e11452 100644
--- a/client/src/components/Chat/Messages/Content/Markdown.tsx
+++ b/client/src/components/Chat/Messages/Content/Markdown.tsx
@@ -1,25 +1,9 @@
 import React, { memo, useMemo } from 'react';
-import remarkGfm from 'remark-gfm';
-import remarkMath from 'remark-math';
-import supersub from 'remark-supersub';
-import rehypeKatex from 'rehype-katex';
 import { useRecoilValue } from 'recoil';
-import ReactMarkdown from 'react-markdown';
-import rehypeHighlight from 'rehype-highlight';
-import remarkDirective from 'remark-directive';
-import type { Pluggable } from 'unified';
-import { Citation, CompositeCitation, HighlightedText } from '~/components/Web/Citation';
-import {
-  mcpUIResourcePlugin,
-  MCPUIResource,
-  MCPUIResourceCarousel,
-} from '~/components/MCPUIResource';
-import { Artifact, artifactPlugin } from '~/components/Artifacts/Artifact';
-import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from './markdownConfig';
 import MarkdownErrorBoundary from './MarkdownErrorBoundary';
-import { langSubset, preprocessLaTeX } from '~/utils';
-import { unicodeCitation } from '~/components/Web';
-import { code, a, p, img } from './MarkdownComponents';
+import MarkdownBlocks from './MarkdownBlocks';
+import { preprocessLaTeX } from '~/utils';
 import store from '~/store';
 
 type TContentProps = {
@@ -38,31 +22,6 @@ const Markdown = memo(function Markdown({ content = '', isLatestMessage }: TCont
     return LaTeXParsing ? preprocessLaTeX(content) : content;
   }, [content, LaTeXParsing, isInitializing]);
 
-  const rehypePlugins = useMemo(
-    () => [
-      [rehypeKatex],
-      [
-        rehypeHighlight,
-        {
-          detect: true,
-          ignoreMissing: true,
-          subset: langSubset,
-        },
-      ],
-    ],
-    [],
-  );
-
-  const remarkPlugins: Pluggable[] = [
-    supersub,
-    remarkGfm,
-    remarkDirective,
-    artifactPlugin,
-    [remarkMath, { singleDollarTextMath: false }],
-    unicodeCitation,
-    mcpUIResourcePlugin,
-  ];
-
   if (isInitializing) {
     return (
       <div className="absolute">
@@ -75,34 +34,12 @@ const Markdown = memo(function Markdown({ content = '', isLatestMessage }: TCont
 
   return (
     <MarkdownErrorBoundary content={content} codeExecution={true}>
-      <ArtifactProvider>
-        <CodeBlockProvider>
-          <ReactMarkdown
-            /** @ts-ignore */
-            remarkPlugins={remarkPlugins}
-            /* @ts-ignore */
-            rehypePlugins={rehypePlugins}
-            components={
-              {
-                code,
-                a,
-                p,
-                img,
-                artifact: Artifact,
-                citation: Citation,
-                'highlighted-text': HighlightedText,
-                'composite-citation': CompositeCitation,
-                'mcp-ui-resource': MCPUIResource,
-                'mcp-ui-carousel': MCPUIResourceCarousel,
-              } as {
-                [nodeType: string]: React.ElementType;
-              }
-            }
-          >
-            {currentContent}
-          </ReactMarkdown>
-        </CodeBlockProvider>
-      </ArtifactProvider>
+      <MarkdownBlocks
+        content={currentContent}
+        remarkPlugins={getRemarkPlugins()}
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      />
     </MarkdownErrorBoundary>
   );
 });
diff --git a/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx b/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx
new file mode 100644
index 00000000000..3c664f4b0c0
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx
@@ -0,0 +1,165 @@
+import React, { Profiler } from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { render } from '@testing-library/react';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from './markdownConfig';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import CodeBlock from '~/components/Messages/Content/CodeBlock';
+import Markdown from './Markdown';
+
+/**
+ * Streaming render benchmark comparing the previous whole-message renderer
+ * (one ReactMarkdown re-parsing everything per token) against the per-block
+ * memoized renderer. This file lives outside `__tests__/` and is named
+ * `.bench.tsx` so the default jest run skips it; execute it explicitly with:
+ *
+ *   node node_modules/jest/bin/jest.js --runInBand --coverage=false \
+ *     --testMatch '**\/MarkdownBlocks.bench.tsx'
+ *
+ * Two metrics are reported:
+ *  - codeBlockRenders: deterministic structural metric — how many times code
+ *    blocks render across the whole stream (the memoization win, noise-free).
+ *  - totalMs: summed React Profiler actualDuration (wall-clock; jsdom absolute
+ *    numbers are not browser-accurate, but the OLD/NEW ratio is indicative).
+ */
+
+jest.mock('~/components/Messages/Content/CodeBlock', () => ({
+  __esModule: true,
+  default: jest.fn(() => null),
+}));
+
+const codeBlockMock = CodeBlock as unknown as jest.Mock;
+
+const LANGS = ['python', 'javascript', 'typescript', 'bash', 'json', 'sql', 'go', 'rust'];
+
+const buildMessage = (sections: number): string => {
+  const parts: string[] = [];
+  for (let i = 0; i < sections; i += 1) {
+    parts.push(`## Section ${i + 1}`, '');
+    parts.push(
+      `This is paragraph ${i + 1} explaining the code below with some **bold** and ` +
+        `\`inline\` text, intentionally a bit long to add realistic reflow cost during ` +
+        `streaming, repeated across every section of the message.`,
+      '',
+    );
+    const lang = LANGS[i % LANGS.length];
+    parts.push('```' + lang);
+    for (let l = 0; l < 8; l += 1) {
+      parts.push(`const value_${i}_${l} = computeSomething(${l}, "arg_${l}"); // line ${l}`);
+    }
+    parts.push('```', '');
+    if (i % 3 === 0) {
+      parts.push('| Name | Type | Value |', '| --- | --- | --- |');
+      for (let r = 0; r < 5; r += 1) {
+        parts.push(`| item_${i}_${r} | number | ${r * i} |`);
+      }
+      parts.push('');
+    }
+  }
+  return parts.join('\n');
+};
+
+const makePrefixes = (content: string, steps: number): string[] => {
+  const prefixes: string[] = [];
+  for (let s = 1; s <= steps; s += 1) {
+    prefixes.push(content.slice(0, Math.ceil((content.length * s) / steps)));
+  }
+  return prefixes;
+};
+
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+const NewMarkdown = ({ content }: { content: string }) => (
+  <Markdown content={content} isLatestMessage={true} />
+);
+
+const measure = (
+  Component: React.ComponentType<{ content: string }>,
+  prefixes: string[],
+): { totalMs: number; codeBlockRenders: number } => {
+  codeBlockMock.mockClear();
+  let totalMs = 0;
+  const onRender = (_id: string, _phase: string, actualDuration: number) => {
+    totalMs += actualDuration;
+  };
+  const tree = (content: string) => (
+    <Profiler id="bench" onRender={onRender}>
+      <RecoilRoot>
+        <Component content={content} />
+      </RecoilRoot>
+    </Profiler>
+  );
+  const { rerender, unmount } = render(tree(prefixes[0]));
+  for (let i = 1; i < prefixes.length; i += 1) {
+    rerender(tree(prefixes[i]));
+  }
+  const result = { totalMs, codeBlockRenders: codeBlockMock.mock.calls.length };
+  unmount();
+  return result;
+};
+
+describe('Markdown streaming benchmark (OLD whole-message vs NEW per-block)', () => {
+  it('reports render cost across a simulated stream', () => {
+    const content = buildMessage(12);
+    const steps = 80;
+    const prefixes = makePrefixes(content, steps);
+    const iterations = 3;
+
+    // Warm up module/highlight caches so the first measured run isn't skewed.
+    measure(OldMarkdown, prefixes);
+    measure(NewMarkdown, prefixes);
+
+    const old: Array<{ totalMs: number; codeBlockRenders: number }> = [];
+    const neu: Array<{ totalMs: number; codeBlockRenders: number }> = [];
+    for (let i = 0; i < iterations; i += 1) {
+      old.push(measure(OldMarkdown, prefixes));
+      neu.push(measure(NewMarkdown, prefixes));
+    }
+
+    const minMs = (rs: Array<{ totalMs: number }>) => Math.min(...rs.map((r) => r.totalMs));
+    const oldMs = minMs(old);
+    const newMs = minMs(neu);
+    const oldRenders = old[0].codeBlockRenders;
+    const newRenders = neu[0].codeBlockRenders;
+
+    console.log(
+      [
+        '',
+        '================ Markdown streaming benchmark ================',
+        `message size: ${content.length} chars, stream steps: ${steps}, iterations: ${iterations}`,
+        '',
+        `code-block renders over the stream (structural, noise-free):`,
+        `  OLD (whole-message): ${oldRenders}`,
+        `  NEW (per-block)    : ${newRenders}`,
+        `  reduction          : ${(100 * (1 - newRenders / oldRenders)).toFixed(1)}%`,
+        '',
+        `total render time (min of ${iterations}, summed Profiler actualDuration; jsdom):`,
+        `  OLD: ${oldMs.toFixed(1)} ms`,
+        `  NEW: ${newMs.toFixed(1)} ms`,
+        `  speedup: ${(oldMs / newMs).toFixed(2)}x`,
+        '=============================================================',
+        '',
+      ].join('\n'),
+    );
+
+    // Sanity: the per-block renderer must not render code blocks MORE than the
+    // whole-message renderer. The real win is asserted separately below.
+    expect(newRenders).toBeLessThanOrEqual(oldRenders);
+    // Memoization should cut total code-block renders by a wide margin.
+    expect(newRenders).toBeLessThan(oldRenders * 0.5);
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx b/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx
new file mode 100644
index 00000000000..89f2fc76bd6
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx
@@ -0,0 +1,110 @@
+import React, { memo, useMemo } from 'react';
+import ReactMarkdown from 'react-markdown';
+import type { PluggableList } from 'unified';
+import type { ElementType } from 'react';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import { splitMarkdownIntoBlocks } from './splitMarkdown';
+
+type SharedProps = {
+  remarkPlugins: PluggableList;
+  rehypePlugins: PluggableList;
+  components: { [nodeType: string]: ElementType };
+};
+
+type MarkdownBlockProps = SharedProps & {
+  content: string;
+  codeBaseIndex: number;
+  artifactBaseIndex: number;
+};
+
+/**
+ * Renders one top-level markdown block inside its own code/artifact providers,
+ * seeded with the running index of executable code blocks and artifacts in
+ * earlier blocks. Memoized on `content` and the base indices: a completed block
+ * whose source slice and bases are unchanged across streamed tokens skips both
+ * re-parsing and re-rendering, so only the final, still-growing block re-parses.
+ */
+const MarkdownBlock = memo(
+  function MarkdownBlock({
+    content,
+    codeBaseIndex,
+    artifactBaseIndex,
+    remarkPlugins,
+    rehypePlugins,
+    components,
+  }: MarkdownBlockProps) {
+    return (
+      <ArtifactProvider baseIndex={artifactBaseIndex}>
+        <CodeBlockProvider baseIndex={codeBaseIndex}>
+          <ReactMarkdown
+            /** @ts-ignore */
+            remarkPlugins={remarkPlugins}
+            /** @ts-ignore */
+            rehypePlugins={rehypePlugins}
+            components={components}
+          >
+            {content}
+          </ReactMarkdown>
+        </CodeBlockProvider>
+      </ArtifactProvider>
+    );
+  },
+  (prev, next) =>
+    prev.content === next.content &&
+    prev.codeBaseIndex === next.codeBaseIndex &&
+    prev.artifactBaseIndex === next.artifactBaseIndex,
+);
+MarkdownBlock.displayName = 'MarkdownBlock';
+
+type MarkdownBlocksProps = SharedProps & {
+  content: string;
+};
+
+/**
+ * Splits a message into top-level blocks and renders each independently so
+ * that, during streaming, only the last block re-parses while earlier blocks
+ * (tables, code, etc.) stay memoized. Each block's executable code and artifact
+ * indices are preserved in document order via per-block providers seeded with
+ * prefix-summed base indices.
+ */
+const MarkdownBlocks = memo(function MarkdownBlocks({
+  content,
+  remarkPlugins,
+  rehypePlugins,
+  components,
+}: MarkdownBlocksProps) {
+  const blocks = useMemo(() => {
+    let codeBaseIndex = 0;
+    let artifactBaseIndex = 0;
+    return splitMarkdownIntoBlocks(content).map((block) => {
+      const entry = { raw: block.raw, codeBaseIndex, artifactBaseIndex };
+      codeBaseIndex += block.codeBlockCount;
+      artifactBaseIndex += block.artifactCount;
+      return entry;
+    });
+  }, [content]);
+
+  return (
+    <>
+      {blocks.map((block, index) => (
+        // Key includes the base indices so that an in-place edit which inserts a
+        // block before existing code/artifact blocks (shifting their base) forces
+        // a remount, refreshing the index each code/artifact block captures in a
+        // ref. During append-only streaming these stay constant, so completed
+        // blocks keep a stable key and are not remounted.
+        <MarkdownBlock
+          key={`${index}-${block.codeBaseIndex}-${block.artifactBaseIndex}`}
+          content={block.raw}
+          codeBaseIndex={block.codeBaseIndex}
+          artifactBaseIndex={block.artifactBaseIndex}
+          remarkPlugins={remarkPlugins}
+          rehypePlugins={rehypePlugins}
+          components={components}
+        />
+      ))}
+    </>
+  );
+});
+MarkdownBlocks.displayName = 'MarkdownBlocks';
+
+export default MarkdownBlocks;
diff --git a/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx b/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
index c38c40f1e10..5147dd2a9ac 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
@@ -185,6 +185,19 @@ export const p: React.ElementType = memo(function MarkdownParagraph({ children }
 });
 p.displayName = 'MarkdownParagraph';
 
+type TTableProps = {
+  children: React.ReactNode;
+};
+
+export const table: React.ElementType = memo(function MarkdownTable({ children }: TTableProps) {
+  return (
+    <div className="markdown-table-wrapper w-full max-w-full">
+      <table>{children}</table>
+    </div>
+  );
+});
+table.displayName = 'MarkdownTable';
+
 type TImageProps = {
   src?: string;
   alt?: string;
diff --git a/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx b/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
index 0342c60f8a2..08d91a43b5e 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
@@ -4,9 +4,9 @@ import supersub from 'remark-supersub';
 import ReactMarkdown from 'react-markdown';
 import rehypeHighlight from 'rehype-highlight';
 import type { PluggableList } from 'unified';
-import { code, codeNoExecution, a, p } from './MarkdownComponents';
+import { code, codeNoExecution, a, p, table } from './MarkdownComponents';
+import { langSubset, remarkApproxTilde } from '~/utils';
 import { CodeBlockProvider } from '~/Providers';
-import { langSubset } from '~/utils';
 
 interface ErrorBoundaryState {
   hasError: boolean;
@@ -61,6 +61,7 @@ class MarkdownErrorBoundary extends React.Component<
         <CodeBlockProvider>
           <ReactMarkdown
             remarkPlugins={[
+              remarkApproxTilde,
               /** @ts-ignore */
               supersub,
               remarkGfm,
@@ -72,6 +73,7 @@ class MarkdownErrorBoundary extends React.Component<
                 code: codeExecution ? code : codeNoExecution,
                 a,
                 p,
+                table,
               } as {
                 [nodeType: string]: React.ElementType;
               }
diff --git a/client/src/components/Chat/Messages/Content/MarkdownLite.tsx b/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
index 24980d8a90a..b9d70480d82 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
@@ -6,10 +6,10 @@ import supersub from 'remark-supersub';
 import ReactMarkdown from 'react-markdown';
 import rehypeHighlight from 'rehype-highlight';
 import type { PluggableList } from 'unified';
-import { code, codeNoExecution, a, p, img } from './MarkdownComponents';
+import { code, codeNoExecution, a, p, img, table } from './MarkdownComponents';
 import { CodeBlockProvider, ArtifactProvider } from '~/Providers';
 import MarkdownErrorBoundary from './MarkdownErrorBoundary';
-import { langSubset } from '~/utils';
+import { langSubset, remarkApproxTilde } from '~/utils';
 
 const MarkdownLite = memo(
   ({ content = '', codeExecution = true }: { content?: string; codeExecution?: boolean }) => {
@@ -31,6 +31,7 @@ const MarkdownLite = memo(
           <CodeBlockProvider>
             <ReactMarkdown
               remarkPlugins={[
+                remarkApproxTilde,
                 /** @ts-ignore */
                 supersub,
                 remarkGfm,
@@ -44,6 +45,7 @@ const MarkdownLite = memo(
                   a,
                   p,
                   img,
+                  table,
                 } as {
                   [nodeType: string]: React.ElementType;
                 }
diff --git a/client/src/components/Chat/Messages/Content/MessageQuotes.tsx b/client/src/components/Chat/Messages/Content/MessageQuotes.tsx
new file mode 100644
index 00000000000..5298c03f5d0
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/MessageQuotes.tsx
@@ -0,0 +1,46 @@
+import { memo } from 'react';
+import { TextQuote } from 'lucide-react';
+import { useLocalize } from '~/hooks';
+
+/**
+ * Renders the verbatim excerpts a user quoted on a submitted message as
+ * compact reference blocks above the message text. Presentational — takes
+ * only the scalar `quotes` array (not the full message) so `React.memo`
+ * comparisons on parent wrappers stay shallow.
+ *
+ * The backend persists `message.quotes`, so callers pass
+ * `quotes={message.quotes}` and the references survive reload and history
+ * renders, mirroring how `SkillPills` reads `message.manualSkills`.
+ */
+function MessageQuotes({ quotes }: { quotes?: string[] }) {
+  const localize = useLocalize();
+
+  if (!quotes || quotes.length === 0) {
+    return null;
+  }
+
+  return (
+    <div
+      className="flex w-full flex-col gap-1.5"
+      role="list"
+      aria-label={localize('com_ui_referenced_quotes')}
+      data-testid="message-quotes"
+    >
+      {quotes.map((text, index) => (
+        <div
+          key={`${index}-${text.slice(0, 24)}`}
+          role="listitem"
+          className="flex items-start gap-1.5 rounded-2xl border border-border-light bg-surface-secondary px-2.5 py-1.5 text-sm text-text-secondary"
+        >
+          <TextQuote
+            className="mt-0.5 h-3.5 w-3.5 shrink-0 text-text-tertiary"
+            aria-hidden="true"
+          />
+          <span className="line-clamp-3 whitespace-pre-wrap break-words">{text}</span>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+export default memo(MessageQuotes);
diff --git a/client/src/components/Chat/Messages/Content/ParallelContent.tsx b/client/src/components/Chat/Messages/Content/ParallelContent.tsx
index 2c56bc04e3e..b1d75c86ef9 100644
--- a/client/src/components/Chat/Messages/Content/ParallelContent.tsx
+++ b/client/src/components/Chat/Messages/Content/ParallelContent.tsx
@@ -1,10 +1,10 @@
 import { memo, useMemo } from 'react';
 import type { TMessageContentParts, SearchResultData, TAttachment } from 'librechat-data-provider';
-import { SearchContext } from '~/Providers';
 import MemoryArtifacts from './MemoryArtifacts';
 import Sources from '~/components/Web/Sources';
-import { EmptyText } from './Parts';
+import { SearchContext } from '~/Providers';
 import SiblingHeader from './SiblingHeader';
+import { EmptyText } from './Parts';
 import Container from './Container';
 import { cn } from '~/utils';
 
@@ -137,6 +137,7 @@ type ParallelColumnsProps = {
   columns: ParallelColumn[];
   groupId: number;
   messageId: string;
+  createdAt?: string | null;
   isSubmitting: boolean;
   lastContentIdx: number;
   conversationId?: string | null;
@@ -150,6 +151,7 @@ export const ParallelColumns = memo(function ParallelColumns({
   columns,
   groupId,
   messageId,
+  createdAt,
   conversationId,
   isSubmitting,
   lastContentIdx,
@@ -169,6 +171,7 @@ export const ParallelColumns = memo(function ParallelColumns({
             <SiblingHeader
               agentId={agentId}
               messageId={messageId}
+              createdAt={createdAt}
               isSubmitting={isSubmitting}
               conversationId={conversationId}
             />
@@ -193,6 +196,7 @@ export const ParallelColumns = memo(function ParallelColumns({
 type ParallelContentRendererProps = {
   content?: Array<TMessageContentParts | undefined>;
   messageId: string;
+  createdAt?: string | null;
   conversationId?: string | null;
   attachments?: TAttachment[];
   searchResults?: { [key: string]: SearchResultData };
@@ -207,6 +211,7 @@ type ParallelContentRendererProps = {
 export const ParallelContentRenderer = memo(function ParallelContentRenderer({
   content,
   messageId,
+  createdAt,
   conversationId,
   attachments,
   searchResults,
@@ -253,6 +258,7 @@ export const ParallelContentRenderer = memo(function ParallelContentRenderer({
           columns={columns}
           groupId={groupId}
           messageId={messageId}
+          createdAt={createdAt}
           renderPart={renderPart}
           isSubmitting={isSubmitting}
           conversationId={conversationId}
diff --git a/client/src/components/Chat/Messages/Content/Part.tsx b/client/src/components/Chat/Messages/Content/Part.tsx
index 888298cdb83..6df833370a8 100644
--- a/client/src/components/Chat/Messages/Content/Part.tsx
+++ b/client/src/components/Chat/Messages/Content/Part.tsx
@@ -18,6 +18,7 @@ import {
   Text,
   SkillCall,
   ReadFileCall,
+  FileAuthoringCall,
   BashCall,
   SubagentCall,
 } from './Parts';
@@ -40,6 +41,7 @@ type PartProps = {
   isCreatedByUser: boolean;
   attachments?: TAttachment[];
   hideAttachments?: boolean;
+  onToolExpand?: () => void;
 };
 
 const Part = memo(function Part({
@@ -50,6 +52,7 @@ const Part = memo(function Part({
   showCursor,
   isCreatedByUser,
   hideAttachments,
+  onToolExpand,
 }: PartProps) {
   if (!part) {
     return null;
@@ -143,6 +146,7 @@ const Part = memo(function Part({
           attachments={attachments}
           commandField="code"
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (
@@ -159,6 +163,7 @@ const Part = memo(function Part({
           initialProgress={toolCall.progress ?? 0.1}
           args={toolCall.args}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (
@@ -187,6 +192,7 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           attachments={attachments}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (isToolCall && toolCall.name === Constants.SUBAGENT) {
@@ -222,6 +228,20 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           attachments={attachments}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
+        />
+      );
+    } else if (isToolCall && (toolCall.name === 'create_file' || toolCall.name === 'edit_file')) {
+      return (
+        <FileAuthoringCall
+          toolName={toolCall.name}
+          args={toolCall.args}
+          output={toolCall.output ?? ''}
+          initialProgress={toolCall.progress ?? 0.1}
+          isSubmitting={isSubmitting}
+          attachments={attachments}
+          hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (isToolCall && toolCall.name === Tools.bash_tool) {
@@ -233,6 +253,7 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           attachments={attachments}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (isToolCall && toolCall.name === Tools.web_search) {
@@ -243,6 +264,7 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           attachments={attachments}
           isLast={isLast}
+          onExpand={onToolExpand}
         />
       );
     } else if (isToolCall && (toolCall.name === 'file_search' || toolCall.name === 'retrieval')) {
@@ -252,6 +274,7 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           output={toolCall.output ?? undefined}
           attachments={attachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (isToolCall && toolCall.name?.startsWith(Constants.LC_TRANSFER_TO_)) {
@@ -268,6 +291,7 @@ const Part = memo(function Part({
           auth={toolCall.auth}
           isLast={isLast}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (toolCall.type === ToolCallTypes.CODE_INTERPRETER) {
@@ -277,6 +301,7 @@ const Part = memo(function Part({
           initialProgress={toolCall.progress ?? 0.1}
           code={code_interpreter.input}
           outputs={code_interpreter.outputs ?? []}
+          onExpand={onToolExpand}
         />
       );
     } else if (
@@ -289,6 +314,7 @@ const Part = memo(function Part({
           isSubmitting={isSubmitting}
           output={(toolCall as { output?: string }).output}
           attachments={attachments}
+          onExpand={onToolExpand}
         />
       );
     } else if (
@@ -326,6 +352,7 @@ const Part = memo(function Part({
           output={toolCall.function.output}
           isLast={isLast}
           hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
         />
       );
     }
diff --git a/client/src/components/Chat/Messages/Content/Parts/Attachment.tsx b/client/src/components/Chat/Messages/Content/Parts/Attachment.tsx
index 65aa00ed1cc..e6525ff8c4f 100644
--- a/client/src/components/Chat/Messages/Content/Parts/Attachment.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/Attachment.tsx
@@ -1,5 +1,5 @@
 import { memo, useEffect, useId, useLayoutEffect, useMemo, useRef, useState } from 'react';
-import { Loader2, AlertCircle, Download } from 'lucide-react';
+import { Loader2, AlertCircle, Download, ChevronDown, Files as FilesIcon } from 'lucide-react';
 import { Tools } from 'librechat-data-provider';
 import type { TAttachment, TFile, TAttachmentMetadata } from 'librechat-data-provider';
 import type { ToolArtifactType } from '~/utils/artifacts';
@@ -20,7 +20,7 @@ import Image from '~/components/Chat/Messages/Content/Image';
 import ToolMermaidArtifact from './ToolMermaidArtifact';
 import ToolArtifactCard from './ToolArtifactCard';
 import { useAttachmentLink } from './LogLink';
-import { useLocalize, useAttachmentPreviewSync } from '~/hooks';
+import { useLocalize, useAttachmentPreviewSync, useExpandCollapse } from '~/hooks';
 import { cn, getFileType } from '~/utils';
 
 const COLLAPSED_MAX_HEIGHT = 320;
@@ -197,92 +197,232 @@ const FileAttachment = memo(({ attachment }: { attachment: Partial<TAttachment>
   );
 });
 
-const TextAttachment = memo(({ attachment }: { attachment: Partial<TAttachment> }) => {
+const FileAttachmentGroup = memo(({ attachments }: { attachments: TAttachment[] }) => {
   const localize = useLocalize();
-  const preId = useId();
-  const preRef = useRef<HTMLPreElement>(null);
-  const [isVisible, setIsVisible] = useState(false);
-  const [expanded, setExpanded] = useState(false);
-  // Decided once after layout: does the text actually overflow the collapsed
-  // height? Char count is a poor proxy (a 100-char file with many newlines can
-  // overflow; 800 chars of dense single-line text may not), so we measure.
-  const [overflowed, setOverflowed] = useState(false);
-  const file = attachment as TFile & TAttachmentMetadata;
-  const { handleDownload } = useAttachmentLink({
-    href: attachment.filepath ?? '',
-    filename: attachment.filename ?? '',
-    file_id: file.file_id,
-    user: file.user,
-    source: file.source,
-  });
-  const extension = attachment.filename?.split('.').pop();
-  const text = file.text ?? '';
+  const panelId = useId();
+  const [isExpanded, setIsExpanded] = useState(false);
+  const { style: expandStyle, ref: expandRef } = useExpandCollapse(isExpanded);
+  const visibleAttachments = useMemo(
+    () => attachments.filter((attachment) => Boolean(attachment.filepath)),
+    [attachments],
+  );
+  const count = visibleAttachments.length;
+  const summary = useMemo(() => {
+    const names = visibleAttachments.map((attachment) => displayFilename(attachment.filename));
+    if (names.length <= 2) {
+      return names.join(', ');
+    }
+    return `${names.slice(0, 2).join(', ')} ${localize('com_ui_plus_n_more', {
+      0: String(names.length - 2),
+    })}`;
+  }, [visibleAttachments, localize]);
+  const groupedAttachments = useMemo(() => {
+    const files: TAttachment[] = [];
+    const textPreviews: TAttachment[] = [];
+    for (const attachment of visibleAttachments) {
+      if (isTextAttachment(attachment)) {
+        textPreviews.push(attachment);
+        continue;
+      }
+      files.push(attachment);
+    }
+    return { files, textPreviews };
+  }, [visibleAttachments]);
 
-  useEffect(() => {
-    const timer = setTimeout(() => setIsVisible(true), 50);
-    return () => clearTimeout(timer);
-  }, []);
+  if (count === 0) {
+    return null;
+  }
 
-  useLayoutEffect(() => {
-    const el = preRef.current;
-    if (!el) {
-      return;
+  if (count === 1) {
+    const [attachment] = visibleAttachments;
+    if (!attachment) {
+      return null;
     }
-    setOverflowed(el.scrollHeight > COLLAPSED_MAX_HEIGHT + 1);
-  }, [text]);
+    return (
+      <div className="my-2 flex flex-wrap items-center gap-2.5">
+        <FileAttachment attachment={attachment} key={renderAttachmentKey('file', attachment, 0)} />
+      </div>
+    );
+  }
 
-  const isClamped = overflowed && !expanded;
+  const fileCount = localize('com_ui_n_files', { 0: String(count) });
+  const buttonLabel = isExpanded
+    ? localize('com_ui_hide_n_files', { 0: String(count) })
+    : localize('com_ui_show_n_files', { 0: String(count) });
 
   return (
-    <div
-      className={cn(
-        'text-attachment-container flex w-full flex-col gap-1.5',
-        'transition-all duration-300 ease-out',
-        isVisible ? 'translate-y-0 opacity-100' : 'translate-y-2 opacity-0',
-      )}
-      style={{
-        transformOrigin: 'center top',
-        willChange: 'opacity, transform',
-        WebkitFontSmoothing: 'subpixel-antialiased',
-      }}
-    >
-      {attachment.filepath && (
-        <FileContainer
-          file={attachment}
-          onClick={handleDownload}
-          overrideType={extension}
-          displayName={displayFilename(attachment.filename)}
-          containerClassName="max-w-fit"
-          buttonClassName="bg-surface-secondary hover:cursor-pointer hover:bg-surface-hover active:bg-surface-secondary focus:bg-surface-hover hover:border-border-heavy active:border-border-heavy"
-        />
-      )}
-      <div className="rounded-lg bg-surface-secondary p-4">
-        <pre
-          id={preId}
-          ref={preRef}
+    <div className="my-2 w-full max-w-full">
+      <button
+        type="button"
+        aria-expanded={isExpanded}
+        aria-controls={panelId}
+        aria-label={buttonLabel}
+        onClick={() => setIsExpanded((prev) => !prev)}
+        className={cn(
+          'inline-flex w-full max-w-full items-center gap-2 rounded-lg py-1 pr-2 text-sm',
+          'text-text-secondary transition-colors hover:text-text-primary',
+          'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-heavy',
+        )}
+      >
+        <FilesIcon className="size-4 shrink-0" aria-hidden="true" />
+        <span className="shrink-0 font-medium">{fileCount}</span>
+        {summary.length > 0 && (
+          <span className="min-w-0 truncate text-left text-xs font-normal" title={summary}>
+            {'— '}
+            {summary}
+          </span>
+        )}
+        <ChevronDown
           className={cn(
-            'whitespace-pre-wrap break-words font-mono text-sm leading-6 text-text-primary',
-            isClamped ? 'overflow-hidden' : 'overflow-auto',
+            'ml-auto size-4 shrink-0 transition-transform duration-200 ease-out',
+            isExpanded && 'rotate-180',
           )}
-          style={isClamped ? { maxHeight: COLLAPSED_MAX_HEIGHT } : undefined}
-        >
-          {text}
-        </pre>
-        {overflowed && (
-          <button
-            type="button"
-            onClick={() => setExpanded((prev) => !prev)}
-            aria-expanded={expanded}
-            aria-controls={preId}
-            className="mt-2 text-xs text-text-secondary transition-colors hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-heavy"
-          >
-            {expanded ? localize('com_ui_collapse') : localize('com_ui_show_all')}
-          </button>
-        )}
+          aria-hidden="true"
+        />
+      </button>
+      <div id={panelId} style={expandStyle}>
+        <div className="overflow-hidden" ref={expandRef} aria-hidden={!isExpanded}>
+          <div className="flex flex-col gap-2.5 pt-2">
+            {groupedAttachments.files.length > 0 && (
+              <div className="flex flex-wrap items-center gap-2.5">
+                {groupedAttachments.files.map((attachment, index) => (
+                  <FileAttachment
+                    attachment={attachment}
+                    key={renderAttachmentKey('file', attachment, index)}
+                  />
+                ))}
+              </div>
+            )}
+            {groupedAttachments.textPreviews.map((attachment, index) => (
+              <TextAttachment
+                attachment={attachment}
+                showFileChip={false}
+                key={renderAttachmentKey('text', attachment, index)}
+              />
+            ))}
+          </div>
+        </div>
       </div>
     </div>
   );
 });
+FileAttachmentGroup.displayName = 'FileAttachmentGroup';
+
+const TextAttachment = memo(
+  ({
+    attachment,
+    showFileChip = true,
+  }: {
+    attachment: Partial<TAttachment>;
+    showFileChip?: boolean;
+  }) => {
+    const localize = useLocalize();
+    const preId = useId();
+    const preRef = useRef<HTMLPreElement>(null);
+    const [isVisible, setIsVisible] = useState(false);
+    const [expanded, setExpanded] = useState(false);
+    // Decided once after layout: does the text actually overflow the collapsed
+    // height? Char count is a poor proxy (a 100-char file with many newlines can
+    // overflow; 800 chars of dense single-line text may not), so we measure.
+    const [overflowed, setOverflowed] = useState(false);
+    const file = attachment as TFile & TAttachmentMetadata;
+    const { handleDownload } = useAttachmentLink({
+      href: attachment.filepath ?? '',
+      filename: attachment.filename ?? '',
+      file_id: file.file_id,
+      user: file.user,
+      source: file.source,
+    });
+    const extension = attachment.filename?.split('.').pop();
+    const text = file.text ?? '';
+    const visibleFilename = displayFilename(attachment.filename);
+
+    useEffect(() => {
+      const timer = setTimeout(() => setIsVisible(true), 50);
+      return () => clearTimeout(timer);
+    }, []);
+
+    useLayoutEffect(() => {
+      const el = preRef.current;
+      if (!el) {
+        return;
+      }
+      setOverflowed(el.scrollHeight > COLLAPSED_MAX_HEIGHT + 1);
+    }, [text]);
+
+    const isClamped = overflowed && !expanded;
+
+    return (
+      <div
+        className={cn(
+          'text-attachment-container flex w-full flex-col gap-1.5',
+          'transition-all duration-300 ease-out',
+          isVisible ? 'translate-y-0 opacity-100' : 'translate-y-2 opacity-0',
+        )}
+        style={{
+          transformOrigin: 'center top',
+          willChange: 'opacity, transform',
+          WebkitFontSmoothing: 'subpixel-antialiased',
+        }}
+      >
+        {attachment.filepath && showFileChip && (
+          <FileContainer
+            file={attachment}
+            onClick={handleDownload}
+            overrideType={extension}
+            displayName={displayFilename(attachment.filename)}
+            containerClassName="max-w-fit"
+            buttonClassName="bg-surface-secondary hover:cursor-pointer hover:bg-surface-hover active:bg-surface-secondary focus:bg-surface-hover hover:border-border-heavy active:border-border-heavy"
+          />
+        )}
+        <div className="overflow-hidden rounded-lg bg-surface-secondary">
+          {!showFileChip && (
+            <div className="flex items-center justify-between gap-2 border-b border-border-light px-3 py-2">
+              <span className="min-w-0 truncate text-sm font-medium" title={visibleFilename}>
+                {visibleFilename}
+              </span>
+              {attachment.filepath && (
+                <button
+                  type="button"
+                  onClick={handleDownload}
+                  aria-label={`${localize('com_ui_download')} ${visibleFilename}`}
+                  title={localize('com_ui_download')}
+                  className="flex size-7 shrink-0 items-center justify-center rounded-md text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-heavy"
+                >
+                  <Download className="size-4" aria-hidden="true" />
+                </button>
+              )}
+            </div>
+          )}
+          <div className="p-4">
+            <pre
+              id={preId}
+              ref={preRef}
+              className={cn(
+                'whitespace-pre-wrap break-words font-mono text-sm leading-6 text-text-primary',
+                isClamped ? 'overflow-hidden' : 'overflow-auto',
+              )}
+              style={isClamped ? { maxHeight: COLLAPSED_MAX_HEIGHT } : undefined}
+            >
+              {text}
+            </pre>
+            {overflowed && (
+              <button
+                type="button"
+                onClick={() => setExpanded((prev) => !prev)}
+                aria-expanded={expanded}
+                aria-controls={preId}
+                className="mt-2 text-xs text-text-secondary transition-colors hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-heavy"
+              >
+                {expanded ? localize('com_ui_collapse') : localize('com_ui_show_all')}
+              </button>
+            )}
+          </div>
+        </div>
+      </div>
+    );
+  },
+);
 
 const ImageAttachment = memo(({ attachment }: { attachment: TAttachment }) => {
   const [isLoaded, setIsLoaded] = useState(false);
@@ -449,19 +589,24 @@ export function AttachmentGroup({ attachments }: { attachments?: TAttachment[] }
   mermaidArtifacts.sort(bySalience);
   imageAttachments.sort(bySalience);
 
+  const downloadableFileAttachments = fileAttachments.filter((attachment) =>
+    Boolean(attachment.filepath),
+  );
+  const downloadableTextAttachments = textAttachments.filter((attachment) =>
+    Boolean(attachment.filepath),
+  );
+  const textOnlyAttachments = textAttachments.filter((attachment) => !attachment.filepath);
+  const groupDownloadableFiles =
+    downloadableFileAttachments.length + downloadableTextAttachments.length > 1;
+  const groupedFileAttachments = groupDownloadableFiles
+    ? [...downloadableFileAttachments, ...downloadableTextAttachments].sort(bySalience)
+    : downloadableFileAttachments;
+  const visibleTextAttachments = groupDownloadableFiles ? textOnlyAttachments : textAttachments;
+
   return (
     <>
-      {fileAttachments.length > 0 && (
-        <div className="my-2 flex flex-wrap items-center gap-2.5">
-          {fileAttachments.map((attachment, index) =>
-            attachment.filepath ? (
-              <FileAttachment
-                attachment={attachment}
-                key={renderAttachmentKey('file', attachment, index)}
-              />
-            ) : null,
-          )}
-        </div>
+      {groupedFileAttachments.length > 0 && (
+        <FileAttachmentGroup attachments={groupedFileAttachments} />
       )}
       {(resolvedPanel.length > 0 || pendingPanel.length > 0) && (
         <div className="my-2 flex flex-wrap items-center gap-2">
@@ -492,9 +637,9 @@ export function AttachmentGroup({ attachments }: { attachments?: TAttachment[] }
           ))}
         </div>
       )}
-      {textAttachments.length > 0 && (
+      {visibleTextAttachments.length > 0 && (
         <div className="my-2 flex flex-col gap-3">
-          {textAttachments.map((attachment, index) => (
+          {visibleTextAttachments.map((attachment, index) => (
             <TextAttachment
               attachment={attachment}
               key={renderAttachmentKey('text', attachment, index)}
diff --git a/client/src/components/Chat/Messages/Content/Parts/BashCall.tsx b/client/src/components/Chat/Messages/Content/Parts/BashCall.tsx
index d9e5e92116e..7221a0f7f01 100644
--- a/client/src/components/Chat/Messages/Content/Parts/BashCall.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/BashCall.tsx
@@ -20,6 +20,7 @@ export default function BashCall({
   attachments,
   commandField = 'command',
   hideAttachments = false,
+  onExpand,
 }: {
   initialProgress: number;
   isSubmitting: boolean;
@@ -28,13 +29,14 @@ export default function BashCall({
   attachments?: TAttachment[];
   commandField?: string;
   hideAttachments?: boolean;
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const command = useMemo(() => parseJsonField(args, commandField), [args, commandField]);
   const isWritingCommand = !command || !areToolCallArgsComplete(args);
 
   const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError, hasOutput } =
-    useToolCallState(initialProgress, isSubmitting, output, !!command);
+    useToolCallState(initialProgress, isSubmitting, output, !!command, onExpand);
 
   const highlighted = useLazyHighlight(command || undefined, 'bash');
   const outputHasError = useMemo(() => ERROR_PATTERNS.test(output), [output]);
diff --git a/client/src/components/Chat/Messages/Content/Parts/ExecuteCode.tsx b/client/src/components/Chat/Messages/Content/Parts/ExecuteCode.tsx
index 018fe50ee74..c2ab2d575eb 100644
--- a/client/src/components/Chat/Messages/Content/Parts/ExecuteCode.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/ExecuteCode.tsx
@@ -57,6 +57,7 @@ export default function ExecuteCode({
   output = '',
   attachments,
   hideAttachments = false,
+  onExpand,
 }: {
   initialProgress: number;
   isSubmitting: boolean;
@@ -64,12 +65,13 @@ export default function ExecuteCode({
   output?: string;
   attachments?: TAttachment[];
   hideAttachments?: boolean;
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const { lang = 'py', code } = useParseArgs(args) ?? ({} as ParsedArgs);
 
   const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError, hasOutput } =
-    useToolCallState(initialProgress, isSubmitting, output, !!code);
+    useToolCallState(initialProgress, isSubmitting, output, !!code, onExpand);
 
   const highlighted = useLazyHighlight(code, lang);
   const outputHasError = useMemo(() => ERROR_PATTERNS.test(output), [output]);
diff --git a/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx b/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx
new file mode 100644
index 00000000000..ae8b6fe993c
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx
@@ -0,0 +1,215 @@
+import { useMemo } from 'react';
+import { FilePenLine, FilePlus2 } from 'lucide-react';
+import type { TAttachment } from 'librechat-data-provider';
+import parseJsonField, { parseJsonFieldOccurrences } from './parseJsonField';
+import ProgressText from '~/components/Chat/Messages/Content/ProgressText';
+import useToolCallState from './useToolCallState';
+import useLazyHighlight from './useLazyHighlight';
+import CodeWindowHeader from './CodeWindowHeader';
+import { AttachmentGroup } from './Attachment';
+import { langFromPath } from './ReadFileCall';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+type FileAuthoringToolName = 'create_file' | 'edit_file';
+
+type ToolCallArgs = string | Record<string, unknown> | undefined;
+
+interface TextEditPreview {
+  oldText: string;
+  newText: string;
+}
+
+function hasDiff(output: string): boolean {
+  return /\n@@\s/.test(output) || output.includes('\n--- ') || output.includes('\n+++ ');
+}
+
+function parseArgsObject(args: ToolCallArgs): Record<string, unknown> | undefined {
+  if (typeof args === 'object' && args !== null) {
+    return args;
+  }
+  if (typeof args !== 'string') {
+    return undefined;
+  }
+  try {
+    const parsed = JSON.parse(args);
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}
+
+function textValue(value: unknown): string {
+  return typeof value === 'string' ? value : '';
+}
+
+function editPreviewLines(prefix: '-' | '+', text: string): string {
+  return text
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+}
+
+function formatEditPreview(edits: TextEditPreview[]): string {
+  return edits
+    .map((edit, index) => {
+      const suffix = edits.length > 1 ? ` ${index + 1}` : '';
+      return [
+        `--- old_text${suffix}`,
+        `+++ new_text${suffix}`,
+        '@@',
+        editPreviewLines('-', edit.oldText),
+        editPreviewLines('+', edit.newText),
+      ].join('\n');
+    })
+    .join('\n\n');
+}
+
+function buildEditArgsPreview(args: ToolCallArgs): string {
+  const parsed = parseArgsObject(args);
+  if (Array.isArray(parsed?.edits) && parsed.edits.length > 0) {
+    const edits = parsed.edits
+      .map((edit): TextEditPreview | undefined => {
+        if (typeof edit !== 'object' || edit === null || Array.isArray(edit)) {
+          return undefined;
+        }
+        const entry = edit as Record<string, unknown>;
+        const oldText = textValue(entry.old_text);
+        const newText = textValue(entry.new_text);
+        return oldText || newText ? { oldText, newText } : undefined;
+      })
+      .filter((edit): edit is TextEditPreview => !!edit);
+    return formatEditPreview(edits);
+  }
+
+  if (parsed) {
+    const oldText = textValue(parsed.old_text);
+    const newText = textValue(parsed.new_text);
+    return oldText || newText ? formatEditPreview([{ oldText, newText }]) : '';
+  }
+
+  /** Partial JSON during streaming: pair up field occurrences in document order, covering both single-replacement and batched `edits` args */
+  const oldTexts = parseJsonFieldOccurrences(args, 'old_text');
+  const newTexts = parseJsonFieldOccurrences(args, 'new_text');
+  const editCount = Math.max(oldTexts.length, newTexts.length);
+  const edits = Array.from({ length: editCount }, (_, index) => ({
+    oldText: oldTexts[index] ?? '',
+    newText: newTexts[index] ?? '',
+  })).filter((edit) => edit.oldText || edit.newText);
+  return formatEditPreview(edits);
+}
+
+export default function FileAuthoringCall({
+  toolName,
+  isSubmitting,
+  initialProgress = 0.1,
+  args,
+  output = '',
+  attachments,
+  hideAttachments = false,
+  onExpand,
+}: {
+  toolName: FileAuthoringToolName;
+  initialProgress: number;
+  isSubmitting: boolean;
+  args?: string | Record<string, unknown>;
+  output?: string;
+  attachments?: TAttachment[];
+  hideAttachments?: boolean;
+  onExpand?: () => void;
+}) {
+  const localize = useLocalize();
+  const isCreate = toolName === 'create_file';
+  /** `create_file` can overwrite an existing file (sandbox `overwrite: true`,
+   *  or skill SKILL.md updates). The host-authored summary always opens with
+   *  `Created`/`Updated`, so key the finished label off it for truthfulness. */
+  const overwrote = isCreate && output.startsWith('Updated ');
+  const filePath = useMemo(() => parseJsonField(args, 'file_path'), [args]);
+  const authoredContent = useMemo(() => parseJsonField(args, 'content'), [args]);
+  const editArgsPreview = useMemo(() => buildEditArgsPreview(args), [args]);
+  const fileName = filePath.split('/').pop() || filePath;
+  const fileLang = useMemo(() => langFromPath(filePath), [filePath]);
+  const argsPreview = isCreate ? authoredContent : editArgsPreview;
+  const outputIsDiff = hasDiff(output);
+  /** A diff in the output supersedes the args preview — it carries the input with real file context */
+  const preview = outputIsDiff ? output : argsPreview || output;
+  const showOutputSection = !!output && preview !== output;
+  const previewIsDiff = outputIsDiff || (!isCreate && !!editArgsPreview && preview !== output);
+  let previewLang = 'plaintext';
+  if (previewIsDiff) {
+    previewLang = 'diff';
+  } else if (isCreate && authoredContent && preview === authoredContent) {
+    previewLang = fileLang;
+  }
+
+  const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError } =
+    useToolCallState(initialProgress, isSubmitting, output, !!filePath || !!preview, onExpand);
+
+  const highlighted = useLazyHighlight(preview || undefined, previewLang);
+  const Icon = isCreate && !overwrote ? FilePlus2 : FilePenLine;
+  let finishedKey: 'com_ui_created_file' | 'com_ui_updated_file' | 'com_ui_edited_file' =
+    'com_ui_edited_file';
+  if (isCreate) {
+    finishedKey = overwrote ? 'com_ui_updated_file' : 'com_ui_created_file';
+  }
+
+  return (
+    <>
+      <div className="relative my-1.5 flex size-5 shrink-0 items-center gap-2.5">
+        <ProgressText
+          progress={progress}
+          onClick={toggleCode}
+          inProgressText={localize(isCreate ? 'com_ui_creating_file' : 'com_ui_editing_file', {
+            0: fileName,
+          })}
+          finishedText={
+            cancelled ? localize('com_ui_cancelled') : localize(finishedKey, { 0: fileName })
+          }
+          errorSuffix={hasError && !cancelled ? localize('com_ui_tool_failed') : undefined}
+          icon={
+            <Icon
+              className={cn(
+                'size-4 shrink-0 text-text-secondary',
+                progress < 1 && !cancelled && !hasError && 'animate-pulse',
+              )}
+              aria-hidden="true"
+            />
+          }
+          hasInput={!!filePath || !!preview}
+          isExpanded={showCode}
+          error={cancelled}
+        />
+      </div>
+      <div style={expandStyle}>
+        <div className="overflow-hidden" ref={expandRef}>
+          {!!preview && (
+            <div className="my-2 overflow-hidden rounded-lg border border-border-light bg-surface-secondary">
+              <CodeWindowHeader language={previewIsDiff ? 'diff' : fileName} code={preview} />
+              <pre className="max-h-[300px] overflow-auto bg-surface-chat p-4 font-mono text-xs dark:bg-surface-primary-alt">
+                <code className={`hljs language-${previewLang} !whitespace-pre`}>
+                  {highlighted ?? preview}
+                </code>
+              </pre>
+              {showOutputSection && (
+                <pre
+                  className={cn(
+                    'max-h-[300px] overflow-auto whitespace-pre-wrap break-words border-t border-border-light px-3 py-2.5 font-mono text-xs',
+                    hasError ? 'text-red-600 dark:text-red-400' : 'text-text-primary',
+                  )}
+                >
+                  {output}
+                </pre>
+              )}
+            </div>
+          )}
+        </div>
+      </div>
+      {!hideAttachments && attachments && attachments.length > 0 && (
+        <AttachmentGroup attachments={attachments} />
+      )}
+    </>
+  );
+}
diff --git a/client/src/components/Chat/Messages/Content/Parts/LogLink.tsx b/client/src/components/Chat/Messages/Content/Parts/LogLink.tsx
index 50716f05c85..7d81a7c42e7 100644
--- a/client/src/components/Chat/Messages/Content/Parts/LogLink.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/LogLink.tsx
@@ -1,8 +1,9 @@
 import React from 'react';
-import { FileSources } from 'librechat-data-provider';
 import { useToastContext } from '@librechat/client';
+import { FileSources, sharedFileDownload } from 'librechat-data-provider';
 import { useCodeOutputDownload, useFileDownload } from '~/data-provider';
 import { isHttpDownloadTarget, triggerDownload } from '~/utils';
+import { useShareContext } from '~/Providers';
 
 interface LogLinkProps {
   href: string;
@@ -47,6 +48,7 @@ export const useAttachmentLink = ({
   source,
 }: AttachmentLinkOptions) => {
   const { showToast } = useToastContext();
+  const { shareId } = useShareContext();
 
   const useLocalDownload = isLocallyStoredSource(source) && !!file_id && !!user;
   const { refetch: downloadFromApi } = useFileDownload(user, file_id, { source });
@@ -55,6 +57,15 @@ export const useAttachmentLink = ({
   const handleDownload = async (event: React.MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => {
     event.preventDefault();
     try {
+      // In a shared view, a snapshotted file's href is rewritten to the share
+      // route; download it through the share-scoped path (authorized by share
+      // permission, not owner ACL). Non-snapshotted files fall through so the
+      // original href / code-output path still works when snapshots are disabled.
+      if (shareId && file_id && href.startsWith('/api/share/')) {
+        triggerDownload(sharedFileDownload(shareId, file_id), filename);
+        return;
+      }
+
       if (!useLocalDownload && isHttpDownloadTarget(href)) {
         triggerDownload(href, filename);
         return;
diff --git a/client/src/components/Chat/Messages/Content/Parts/ReadFileCall.tsx b/client/src/components/Chat/Messages/Content/Parts/ReadFileCall.tsx
index 98bd7dfd9ff..da9d5e3806f 100644
--- a/client/src/components/Chat/Messages/Content/Parts/ReadFileCall.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/ReadFileCall.tsx
@@ -68,6 +68,7 @@ export default function ReadFileCall({
   output = '',
   attachments,
   hideAttachments = false,
+  onExpand,
 }: {
   initialProgress: number;
   isSubmitting: boolean;
@@ -75,6 +76,7 @@ export default function ReadFileCall({
   output?: string;
   attachments?: TAttachment[];
   hideAttachments?: boolean;
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const filePath = useMemo(() => parseJsonField(args, 'file_path'), [args]);
@@ -82,7 +84,7 @@ export default function ReadFileCall({
   const lang = useMemo(() => langFromPath(filePath), [filePath]);
 
   const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError, hasOutput } =
-    useToolCallState(initialProgress, isSubmitting, output, !!filePath);
+    useToolCallState(initialProgress, isSubmitting, output, !!filePath, onExpand);
 
   const highlighted = useLazyHighlight(hasOutput ? output : undefined, lang);
 
diff --git a/client/src/components/Chat/Messages/Content/Parts/SkillCall.tsx b/client/src/components/Chat/Messages/Content/Parts/SkillCall.tsx
index 7f99ada76ee..fae460a3d6d 100644
--- a/client/src/components/Chat/Messages/Content/Parts/SkillCall.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/SkillCall.tsx
@@ -16,6 +16,7 @@ export default function SkillCall({
   output = '',
   attachments,
   hideAttachments = false,
+  onExpand,
 }: {
   initialProgress: number;
   isSubmitting: boolean;
@@ -23,12 +24,13 @@ export default function SkillCall({
   output?: string;
   attachments?: TAttachment[];
   hideAttachments?: boolean;
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const skillName = useMemo(() => parseJsonField(args, 'skillName'), [args]);
 
   const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError, hasOutput } =
-    useToolCallState(initialProgress, isSubmitting, output, !!skillName);
+    useToolCallState(initialProgress, isSubmitting, output, !!skillName, onExpand);
 
   return (
     <>
diff --git a/client/src/components/Chat/Messages/Content/Parts/SubagentCall.tsx b/client/src/components/Chat/Messages/Content/Parts/SubagentCall.tsx
index 6a94c079c83..23f5537e24a 100644
--- a/client/src/components/Chat/Messages/Content/Parts/SubagentCall.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/SubagentCall.tsx
@@ -42,10 +42,10 @@ interface SubagentCallProps {
 }
 
 const TICKER_MAX_LINES = 3;
-/** Trailing-edge throttle window for the live preview. Tuned down from
- *  the original 1.2s so the ticker feels snappy when the container is
- *  already full and frames are scrolling. */
-const TICKER_THROTTLE_MS = 800;
+/** Trailing-edge refresh window for the live preview once the ticker has
+ *  enough text to fill the row. Keeps long streaming lines from repainting
+ *  every token while still letting the collapsed subagent UI feel responsive. */
+export const SUBAGENT_TICKER_THROTTLE_MS = 400;
 /** Below this live-buffer length we skip throttling entirely. Without
  *  this the user would see "Reasoning: I" for ~1s while the model
  *  streams the rest of the sentence — the pass-through lets early
@@ -243,7 +243,7 @@ export default function SubagentCall({
 
   const displayedTickerLines = useThrottledValue(
     tickerLines,
-    TICKER_THROTTLE_MS,
+    SUBAGENT_TICKER_THROTTLE_MS,
     shouldThrottleTicker,
   );
 
@@ -293,7 +293,12 @@ export default function SubagentCall({
    * from routing through `Parts/index`.
    */
   const renderDialogPart = useCallback(
-    (part: TMessageContentParts, idx: number, isLastPart: boolean): JSX.Element | null => {
+    (
+      part: TMessageContentParts,
+      idx: number,
+      isLastPart: boolean,
+      onToolExpand?: () => void,
+    ): JSX.Element | null => {
       return (
         <SubagentDialogPart
           key={`${toolCallId}-part-${idx}`}
@@ -301,6 +306,7 @@ export default function SubagentCall({
           isSubmitting={running}
           showCursor={running && isLastPart}
           isLast={isLastPart}
+          onToolExpand={onToolExpand}
         />
       );
     },
@@ -811,11 +817,13 @@ function SubagentDialogPart({
   isSubmitting,
   showCursor,
   isLast,
+  onToolExpand,
 }: {
   part: TMessageContentParts;
   isSubmitting: boolean;
   showCursor: boolean;
   isLast: boolean;
+  onToolExpand?: () => void;
 }): JSX.Element | null {
   if (part.type === ContentTypes.TEXT) {
     const text = (part as { text: string }).text;
@@ -849,6 +857,7 @@ function SubagentDialogPart({
         isSubmitting={isSubmitting}
         isLast={isLast}
         name={tc.name ?? ''}
+        onExpand={onToolExpand}
       />
     );
   }
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
index ac9910bd0f2..555c8c6ffe6 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
-import { render, screen, fireEvent, act } from '@testing-library/react';
 import { RecoilRoot, useRecoilValue } from 'recoil';
-import type { MutableSnapshot } from 'recoil';
+import { render, screen, fireEvent, act } from '@testing-library/react';
 import type { TAttachment } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
 import Attachment, { AttachmentGroup } from '../Attachment';
 import store from '~/store';
 
@@ -16,6 +16,10 @@ jest.mock('~/hooks', () => ({
    * routing tests don't exercise the preview flow itself — stub it
    * to a no-op so it doesn't blow up jsdom rendering. */
   useAttachmentPreviewSync: () => ({ status: 'ready', previewError: undefined, isPolling: false }),
+  useExpandCollapse: (isExpanded: boolean) => ({
+    style: { display: 'grid', gridTemplateRows: isExpanded ? '1fr' : '0fr' },
+    ref: { current: null },
+  }),
 }));
 
 jest.mock('../LogLink', () => ({
@@ -194,9 +198,8 @@ describe('Attachment routing for tool artifacts', () => {
      * yet); use it as the canonical "unrouted text" example. */
     const json = baseAttachment({
       filename: 'data.json',
-      type: 'application/json',
       text: '{"a":1,"b":2}',
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<Attachment attachment={json} />);
     expect(container.querySelector('pre')).not.toBeNull();
     expect(screen.queryByTestId('mermaid-render')).not.toBeInTheDocument();
@@ -540,10 +543,9 @@ describe('ToolArtifactCard click behaviour', () => {
     const xlsx = baseAttachment({
       file_id: 'just-resolved-xlsx',
       filename: 'data.xlsx',
-      type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
       text: '<table>resolved</table>',
       textFormat: 'html',
-    } as Partial<TAttachment>);
+    });
     const initializeState = (snap: MutableSnapshot) => {
       snap.set(store.isSubmittingFamily(0), false);
       snap.set(store.artifactsVisibility, false);
@@ -576,10 +578,9 @@ describe('ToolArtifactCard click behaviour', () => {
     const xlsx = baseAttachment({
       file_id: 'one-shot-xlsx',
       filename: 'data.xlsx',
-      type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
       text: '<table>resolved</table>',
       textFormat: 'html',
-    } as Partial<TAttachment>);
+    });
     const initializeState = (snap: MutableSnapshot) => {
       snap.set(store.isSubmittingFamily(0), false);
       snap.set(store.artifactsVisibility, false);
@@ -706,16 +707,15 @@ describe('AttachmentGroup routing', () => {
     const empty = baseAttachment({
       file_id: 'empty-zip',
       filename: 'placeholder.zip',
-      type: 'application/zip',
       bytes: 0,
-    } as Partial<TAttachment>);
+    });
     const real = baseAttachment({
       file_id: 'real-zip',
       filename: 'archive.zip',
-      type: 'application/zip',
       bytes: 1024,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[empty, real]} />);
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_show_n_files' }));
     const chips = Array.from(container.querySelectorAll('[data-testid="file-container"]'));
     expect(chips.length).toBe(2);
     const filenames = chips.map((c) => c.textContent ?? '');
@@ -724,6 +724,46 @@ describe('AttachmentGroup routing', () => {
     expect(filenames[1]).toMatch(/placeholder\.zip/);
   });
 
+  it('keeps multiple downloadable files in their own collapsed group while images render outwardly', () => {
+    const first = baseAttachment({
+      file_id: 'file-a',
+      filename: 'a.zip',
+    });
+    const second = baseAttachment({
+      file_id: 'file-b',
+      filename: 'b.zip',
+    });
+    const json = baseAttachment({
+      file_id: 'file-c',
+      filename: 'c.json',
+      text: '{"c":true}',
+    });
+    const image = baseAttachment({
+      file_id: 'image-a',
+      filename: 'preview.png',
+      width: 16,
+      height: 16,
+    });
+
+    const { container } = renderWith(
+      <AttachmentGroup attachments={[first, second, json, image]} />,
+    );
+
+    const toggle = screen.getByRole('button', { name: 'com_ui_show_n_files' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'false');
+    const panel = document.getElementById(toggle.getAttribute('aria-controls') ?? '');
+    expect(panel?.firstElementChild).toHaveAttribute('aria-hidden', 'true');
+    expect(screen.getByTestId('image')).toBeInTheDocument();
+    expect(screen.getAllByTestId('file-container').map((chip) => chip.textContent)).not.toContain(
+      'c.json',
+    );
+
+    fireEvent.click(toggle);
+    expect(toggle).toHaveAttribute('aria-expanded', 'true');
+    expect(screen.getByText('c.json')).toBeInTheDocument();
+    expect(container.querySelector('pre')?.textContent).toBe('{"c":true}');
+  });
+
   it('passes a non-dotfile filename through to FileContainer unchanged', () => {
     /** `displayFilename` deliberately leaves non-dotfile names alone —
      * the `-<6 hex>` tail on `archive-deadbe.zip` could be either a
@@ -735,9 +775,8 @@ describe('AttachmentGroup routing', () => {
     const sandboxFile = baseAttachment({
       file_id: 'sandbox-zip',
       filename: 'archive-deadbe.zip',
-      type: 'application/zip',
       bytes: 1024,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[sandboxFile]} />);
     const chip = container.querySelector('[data-testid="file-container"]');
     expect(chip?.textContent).toBe('archive-deadbe.zip');
@@ -753,9 +792,8 @@ describe('AttachmentGroup routing', () => {
     const sandboxDotfile = baseAttachment({
       file_id: 'sandbox-config',
       filename: '_.config-abcdef.zip',
-      type: 'application/zip',
       bytes: 12,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[sandboxDotfile]} />);
     const chip = container.querySelector('[data-testid="file-container"]');
     expect(chip?.textContent).toBe('.config.zip');
@@ -774,7 +812,6 @@ describe('AttachmentGroup routing', () => {
       baseAttachment({
         file_id: 'pending-1',
         filename: 'data.xlsx',
-        type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
         status: 'pending',
       } as Partial<TAttachment>),
       baseAttachment({
@@ -810,7 +847,6 @@ describe('AttachmentGroup routing', () => {
       baseAttachment({
         file_id: 'c',
         filename: 'data.json',
-        type: 'application/json',
         text: '{"a":1}',
       } as Partial<TAttachment>),
       baseAttachment({
@@ -826,9 +862,15 @@ describe('AttachmentGroup routing', () => {
     expect(screen.getByText('index.html')).toBeInTheDocument();
     // Mermaid render
     expect(screen.getByTestId('mermaid-render')).toBeInTheDocument();
-    // Inline text fallback for JSON (CSV now goes to SPREADSHEET)
-    expect(container.querySelector('pre')).not.toBeNull();
-    // FileContainer for the plain zip (and potentially others)
-    expect(screen.getAllByTestId('file-container').length).toBeGreaterThan(0);
+    // JSON and plain zip are both downloadable file outputs, so they collapse together.
+    const toggle = screen.getByRole('button', { name: 'com_ui_show_n_files' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'false');
+    const chipLabels = screen.getAllByTestId('file-container').map((chip) => chip.textContent);
+    expect(chipLabels).toContain('archive.zip');
+    expect(chipLabels).not.toContain('data.json');
+
+    fireEvent.click(toggle);
+    expect(screen.getByText('data.json')).toBeInTheDocument();
+    expect(container.querySelector('pre')?.textContent).toBe('{"a":1}');
   });
 });
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx
new file mode 100644
index 00000000000..a57a00c9540
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx
@@ -0,0 +1,281 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import FileAuthoringCall from '../FileAuthoringCall';
+
+jest.mock('~/hooks', () => ({
+  useLocalize:
+    () =>
+    (key: string, values?: Record<string | number, string>): string => {
+      const translations: Record<string, string> = {
+        com_ui_created_file: 'Created {{0}}',
+        com_ui_creating_file: 'Creating {{0}}',
+        com_ui_updated_file: 'Updated {{0}}',
+        com_ui_edited_file: 'Edited {{0}}',
+        com_ui_editing_file: 'Editing {{0}}',
+        com_ui_cancelled: 'Cancelled',
+        com_ui_tool_failed: 'failed',
+      };
+      return (translations[key] ?? key).replace('{{0}}', values?.[0] ?? '');
+    },
+}));
+
+jest.mock('~/utils', () => ({
+  cn: (...classes: Array<string | false | null | undefined>) => classes.filter(Boolean).join(' '),
+}));
+
+jest.mock('~/components/Chat/Messages/Content/ProgressText', () => ({
+  __esModule: true,
+  default: ({
+    progress,
+    inProgressText,
+    finishedText,
+  }: {
+    progress: number;
+    inProgressText: string;
+    finishedText: string;
+  }) => <div data-testid="progress-text">{progress < 1 ? inProgressText : finishedText}</div>,
+}));
+
+jest.mock('../CodeWindowHeader', () => ({
+  __esModule: true,
+  default: ({ language }: { language: string }) => (
+    <div data-testid="code-window-header" data-language={language} />
+  ),
+}));
+
+jest.mock('../Attachment', () => ({
+  AttachmentGroup: () => <div data-testid="attachment-group" />,
+}));
+
+jest.mock('../useLazyHighlight', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+
+jest.mock('../useToolCallState', () => ({
+  __esModule: true,
+  default: (initialProgress: number) => ({
+    showCode: true,
+    toggleCode: jest.fn(),
+    expandStyle: {},
+    expandRef: { current: null },
+    progress: initialProgress,
+    cancelled: false,
+    hasError: false,
+  }),
+}));
+
+describe('FileAuthoringCall', () => {
+  it('shows create_file content args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nUse this skill for testing.',
+        }}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Creating SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Use this skill for testing/)).toBeInTheDocument();
+  });
+
+  it('keeps authored content visible alongside the output after create_file completes', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nLarge generated body stays visible after completion.',
+        }}
+        output="Created skills/demo/SKILL.md (4096 chars)."
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Created SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Large generated body stays visible/)).toBeInTheDocument();
+    expect(screen.getByText('Created skills/demo/SKILL.md (4096 chars).')).toBeInTheDocument();
+  });
+
+  it('labels a create_file overwrite as Updated when the output summary says so', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nRevised body.',
+        }}
+        output="Updated skills/demo/SKILL.md (8302 chars)."
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Updated SKILL.md');
+  });
+
+  it('prefers the output diff over the args preview after edit_file completes', () => {
+    const output = [
+      'Edited skills/demo/SKILL.md (exact match).',
+      '',
+      '--- skills/demo/SKILL.md',
+      '+++ skills/demo/SKILL.md',
+      '@@ -1,1 +1,1 @@',
+      '-old line',
+      '+new line',
+    ].join('\n');
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'old line',
+          new_text: 'new line',
+        }}
+        output={output}
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-old line');
+    expect(preview).toHaveTextContent('+new line');
+    expect(screen.queryByText(/--- old_text/)).not.toBeInTheDocument();
+  });
+
+  it('shows the attempted input alongside the error output when edit_file fails', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'missing text',
+          new_text: 'replacement',
+        }}
+        output="Error: old_text matched 0 locations in skills/demo/SKILL.md."
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-missing text');
+    expect(preview).toHaveTextContent('+replacement');
+    expect(screen.getByText(/matched 0 locations/)).toBeInTheDocument();
+  });
+
+  it('shows edit_file replacement args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'description: Old behavior',
+          new_text: 'description: New behavior',
+        }}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Editing SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'diff');
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text');
+    expect(preview).toHaveTextContent('+++ new_text');
+    expect(preview).toHaveTextContent('-description: Old behavior');
+    expect(preview).toHaveTextContent('+description: New behavior');
+  });
+
+  it('streams create_file content from partial JSON string args during run_step_delta', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={'{"file_path":"skills/demo/SKILL.md","content":"# Demo\\n\\nStreaming body so far'}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Creating SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Streaming body so far/)).toBeInTheDocument();
+  });
+
+  it('streams edit_file replacement preview from partial JSON string args', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={
+          '{"file_path":"skills/demo/SKILL.md","old_text":"description: Old behavior","new_text":"description: New beh'
+        }
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-description: Old behavior');
+    expect(preview).toHaveTextContent('+description: New beh');
+  });
+
+  it('streams batched edit_file previews from a partial edits array', () => {
+    const args =
+      '{"file_path":"skills/demo/SKILL.md","edits":[' +
+      '{"old_text":"first old","new_text":"first new"},' +
+      '{"old_text":"second old","new_text":"second n';
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={args}
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text 1');
+    expect(preview).toHaveTextContent('-first old');
+    expect(preview).toHaveTextContent('+first new');
+    expect(preview).toHaveTextContent('--- old_text 2');
+    expect(preview).toHaveTextContent('-second old');
+    expect(preview).toHaveTextContent('+second n');
+  });
+
+  it('shows batched edit_file replacements from edits args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          edits: [
+            { old_text: 'first old', new_text: 'first new' },
+            { old_text: 'second old', new_text: 'second new' },
+          ],
+        }}
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text 1');
+    expect(preview).toHaveTextContent('+++ new_text 2');
+    expect(preview).toHaveTextContent('-first old');
+    expect(preview).toHaveTextContent('+second new');
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
index bb34bb1deeb..19feccef2cf 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
-import { render, screen } from '@testing-library/react';
 import { RecoilRoot } from 'recoil';
-import type { MutableSnapshot } from 'recoil';
+import { render, screen } from '@testing-library/react';
 import type { TAttachment } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
 import LogContent from '../LogContent';
 import store from '~/store';
 
@@ -110,9 +110,8 @@ describe('LogContent attachment routing', () => {
     const json = baseAttachment({
       file_id: 'c',
       filename: 'data.json',
-      type: 'application/json',
       text: '{"a":1,"b":2}',
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<LogContent output="" attachments={[json]} />);
     expect(container.querySelector('pre')).not.toBeNull();
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
@@ -123,8 +122,7 @@ describe('LogContent attachment routing', () => {
     const zip = baseAttachment({
       file_id: 'd',
       filename: 'archive.zip',
-      type: 'application/zip',
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[zip]} />);
     expect(screen.getByTestId('log-link')).toHaveAttribute('data-filename', 'archive.zip');
   });
@@ -137,9 +135,8 @@ describe('LogContent attachment routing', () => {
     const pptx = baseAttachment({
       file_id: 'e',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
       text: '<!DOCTYPE html><body><ol><li>Slide 1</li></ol></body>',
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[pptx]} />);
     expect(screen.getByText('slides.pptx')).toBeInTheDocument();
   });
@@ -151,9 +148,8 @@ describe('LogContent attachment routing', () => {
     const pptx = baseAttachment({
       file_id: 'e2',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-      text: undefined as unknown as string,
-    } as Partial<TAttachment>);
+      text: undefined,
+    });
     renderWith(<LogContent output="" attachments={[pptx]} />);
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
     expect(screen.getByTestId('log-link')).toHaveAttribute('data-filename', 'slides.pptx');
@@ -168,10 +164,9 @@ describe('LogContent attachment routing', () => {
     const expired = baseAttachment({
       file_id: 'x-expired',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
       text: '<!DOCTYPE html><body><ol><li>Slide 1</li></ol></body>',
       expiresAt: Date.now() - 60_000,
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[expired]} />);
     // No panel card and no log-link (the expired branch returns plain text).
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
@@ -211,7 +206,6 @@ describe('LogContent attachment routing', () => {
          * bucket, so it would no longer satisfy the "inline pre" check
          * below. */
         filename: 'notes.json',
-        type: 'application/json',
         text: '{"a":1,"b":2}',
       } as Partial<TAttachment>),
     ] as TAttachment[];
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogLink.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogLink.test.tsx
index 6b408acb332..f4e1257a700 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogLink.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogLink.test.tsx
@@ -1,12 +1,13 @@
 import React from 'react';
-import { render, screen, fireEvent, waitFor } from '@testing-library/react';
 import { FileSources } from 'librechat-data-provider';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
 import LogLink from '../LogLink';
 
 const mockShowToast = jest.fn();
 const mockDownloadFromApi = jest.fn();
 const mockDownloadFromUrl = jest.fn();
 const mockTriggerDownload = jest.fn();
+let mockShareContext: { shareId?: string } = {};
 
 jest.mock('@librechat/client', () => ({
   useToastContext: () => ({ showToast: mockShowToast }),
@@ -17,6 +18,10 @@ jest.mock('~/data-provider', () => ({
   useCodeOutputDownload: () => ({ refetch: mockDownloadFromUrl }),
 }));
 
+jest.mock('~/Providers', () => ({
+  useShareContext: () => mockShareContext,
+}));
+
 jest.mock('~/utils', () => ({
   isHttpDownloadTarget: (target?: string | null) => /^https?:\/\//i.test(target ?? ''),
   triggerDownload: (...args: Parameters<typeof mockTriggerDownload>) =>
@@ -26,6 +31,7 @@ jest.mock('~/utils', () => ({
 describe('LogLink download routing', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockShareContext = {};
   });
 
   it('navigates directly to http URLs when no stored file metadata is available', async () => {
@@ -76,6 +82,28 @@ describe('LogLink download routing', () => {
     expect(mockDownloadFromUrl).not.toHaveBeenCalled();
   });
 
+  it('routes downloads through the share-scoped route in a shared view', async () => {
+    mockShareContext = { shareId: 'share-9' };
+    const filename = 'file.pdf';
+
+    render(
+      <LogLink href="/api/share/share-9/files/file-1" file_id="file-1" filename={filename}>
+        {filename}
+      </LogLink>,
+    );
+
+    fireEvent.click(screen.getByRole('link', { name: filename }));
+
+    await waitFor(() => {
+      expect(mockTriggerDownload).toHaveBeenCalledWith(
+        '/api/share/share-9/files/file-1/download',
+        'file.pdf',
+      );
+    });
+    expect(mockDownloadFromApi).not.toHaveBeenCalled();
+    expect(mockDownloadFromUrl).not.toHaveBeenCalled();
+  });
+
   it('keeps legacy code-output handles on the blob download path', async () => {
     const filename = 'legacy.txt';
     mockDownloadFromUrl.mockResolvedValue({ data: 'blob:https://app.example.com/file' });
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
index 47a9aa12cb7..2b968071add 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
 import { RecoilRoot, useRecoilCallback } from 'recoil';
-import { render, screen, act, fireEvent, waitFor } from '@testing-library/react';
+import { render, screen, act, fireEvent, waitFor, within } from '@testing-library/react';
 import type { SubagentUpdateEvent } from 'librechat-data-provider';
 import type {
   SubagentContentPart,
@@ -8,15 +8,14 @@ import type {
   SubagentAggregatorState,
 } from '~/utils/subagentContent';
 import type { SubagentProgress } from '~/store/subagents';
-
 import {
   foldSubagentEvent,
   foldSubagentEventIntoTicker,
   initSubagentAggregatorState,
   initSubagentTickerState,
 } from '~/utils/subagentContent';
+import SubagentCall, { SUBAGENT_TICKER_THROTTLE_MS } from '../SubagentCall';
 import { subagentProgressByToolCallId } from '~/store/subagents';
-import SubagentCall from '../SubagentCall';
 
 jest.mock('~/hooks', () => ({
   useLocalize:
@@ -84,6 +83,7 @@ jest.mock('../Attachment', () => ({
 }));
 
 jest.mock('@librechat/client', () => ({
+  __esModule: true,
   OGDialog: ({ children }: { children: React.ReactNode }) => <>{children}</>,
   OGDialogContent: ({ children }: { children: React.ReactNode }) => (
     <div data-testid="dialog-content">{children}</div>
@@ -131,6 +131,10 @@ jest.mock('~/utils', () => ({
   cn: (...classes: unknown[]) => classes.filter(Boolean).join(' '),
 }));
 
+afterEach(() => {
+  jest.useRealTimers();
+});
+
 /** The dialog wraps single parts in `Container` and grouped tool_calls in
  *  `ToolCallGroup`. Stub both as transparent wrappers so the tests still
  *  assert on the leaf renderers (Text/Reasoning/ToolCall) without pulling
@@ -229,10 +233,20 @@ function renderWithState(args: {
       />
     </RecoilRoot>,
   );
-  act(() => {
-    setter.current?.(args.progress ?? null);
-  });
-  return rendered;
+  const setProgress = (next: SubagentProgress | null) => {
+    act(() => {
+      setter.current?.(next);
+    });
+  };
+  setProgress(args.progress ?? null);
+  return { ...rendered, setProgress };
+}
+
+/** Open the subagent dialog. Required when another test file in the same Jest
+ *  worker has already loaded the real `@librechat/client` module; Radix only
+ *  mounts dialog content while `open` is true. */
+function openSubagentDialog(headerLabel = 'Ran agent') {
+  fireEvent.click(screen.getByRole('button', { name: headerLabel }));
 }
 
 describe('SubagentCall — status resolution', () => {
@@ -443,6 +457,52 @@ describe('SubagentCall — ticker', () => {
     /** Only one "Writing:" label, not three — deltas collapse into one live line. */
     expect(screen.getAllByText('Writing:')).toHaveLength(1);
   });
+
+  it('refreshes long live previews after the subagent ticker throttle window', () => {
+    jest.useFakeTimers();
+    const firstPreview = 'First live preview '.repeat(8).trim();
+    const secondPreview = 'Second live preview '.repeat(8).trim();
+    const eventForText = (text: string): SubagentUpdateEvent => ({
+      runId: 'p',
+      subagentRunId: 'run_a',
+      subagentType: 'self',
+      subagentAgentId: 'child',
+      phase: 'message_delta',
+      data: { delta: { content: [{ type: 'text', text }] } },
+      timestamp: '',
+    });
+    const progressForText = (text: string): SubagentProgress =>
+      progressFromEvents({
+        subagentRunId: 'run_a',
+        subagentType: 'self',
+        status: 'message_delta',
+        events: [eventForText(text)],
+      });
+
+    const { setProgress } = renderWithState({
+      toolCallId: 'call_throttled_writing',
+      initialProgress: 0.3,
+      isSubmitting: true,
+      progress: progressForText(firstPreview),
+    });
+    const ticker = within(screen.getByRole('button', { name: 'Running agent' }));
+
+    expect(ticker.getByText(firstPreview)).toBeInTheDocument();
+    setProgress(progressForText(secondPreview));
+    expect(ticker.getByText(firstPreview)).toBeInTheDocument();
+    expect(ticker.queryByText(secondPreview)).not.toBeInTheDocument();
+
+    act(() => {
+      jest.advanceTimersByTime(SUBAGENT_TICKER_THROTTLE_MS - 1);
+    });
+    expect(ticker.getByText(firstPreview)).toBeInTheDocument();
+    expect(ticker.queryByText(secondPreview)).not.toBeInTheDocument();
+
+    act(() => {
+      jest.advanceTimersByTime(1);
+    });
+    expect(ticker.getByText(secondPreview)).toBeInTheDocument();
+  });
 });
 
 describe('SubagentCall — dialog content', () => {
@@ -462,6 +522,7 @@ describe('SubagentCall — dialog content', () => {
       </RecoilRoot>,
     );
 
+    openSubagentDialog();
     expect(screen.getByTestId('prompt-markdown')).toHaveTextContent('# Review prompt');
     expect(screen.getByText('final answer')).toBeInTheDocument();
 
@@ -537,8 +598,7 @@ describe('SubagentCall — dialog content', () => {
       }),
     });
 
-    /** The mocked `OGDialog` always renders children, so dialog content is
-     *  inspectable without simulating a click. */
+    openSubagentDialog();
     expect(screen.getByTestId('reasoning-part')).toHaveTextContent('Let me compute.');
     expect(screen.getByTestId('tool-call-part')).toHaveAttribute('data-name', 'calculator');
     expect(screen.getByTestId('tool-call-part')).toHaveTextContent('4');
@@ -546,15 +606,9 @@ describe('SubagentCall — dialog content', () => {
   });
 
   it('falls back to the raw tool output when no content parts were recorded', () => {
-    renderWithState({
-      toolCallId: 'call_fallback',
-      initialProgress: 1,
-      isSubmitting: false,
-      progress: null,
-    });
     /** No events → no aggregated parts. The SubagentCall should still
      *  render the raw final `output` that came back in the parent's
-     *  tool_call (we pass it explicitly below). */
+     *  tool_call. */
     const { rerender } = render(
       <RecoilRoot>
         <SubagentCall
@@ -565,8 +619,9 @@ describe('SubagentCall — dialog content', () => {
         />
       </RecoilRoot>,
     );
+    openSubagentDialog();
     expect(screen.getByText('raw final text')).toBeInTheDocument();
-    rerender(<RecoilRoot />);
+    rerender(<RecoilRoot>{null}</RecoilRoot>);
   });
 
   it('renders persistedContent parts when no live events are available (page-refresh flow)', () => {
@@ -604,6 +659,7 @@ describe('SubagentCall — dialog content', () => {
       </RecoilRoot>,
     );
 
+    openSubagentDialog();
     expect(screen.getByTestId('reasoning-part')).toHaveTextContent('Prior thinking.');
     expect(screen.getByTestId('tool-call-part')).toHaveAttribute('data-name', 'calculator');
     expect(screen.getByTestId('tool-call-part')).toHaveTextContent('2436');
@@ -637,6 +693,7 @@ describe('SubagentCall — dialog content', () => {
         />
       </RecoilRoot>,
     );
+    openSubagentDialog();
     expect(screen.getByText('Persisted answer.')).toBeInTheDocument();
   });
 
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
index f97c05d281b..aaf388b080c 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
@@ -17,6 +17,10 @@ jest.mock('~/hooks', () => ({
    * deferred-preview lifecycle. Stub to a no-op for tests that
    * don't exercise the preview flow. */
   useAttachmentPreviewSync: () => ({ status: 'ready', previewError: undefined, isPolling: false }),
+  useExpandCollapse: (isExpanded: boolean) => ({
+    style: { display: 'grid', gridTemplateRows: isExpanded ? '1fr' : '0fr' },
+    ref: { current: null },
+  }),
 }));
 
 const mockHandleDownload = jest.fn();
@@ -67,7 +71,6 @@ const textAttachment = (overrides: Partial<TAttachment> = {}): TAttachment =>
      * bearing, downloadable, expandable) without the panel coupling. */
     filename: 'output.json',
     filepath: '/files/output.json',
-    type: 'application/json',
     text: '{"a":1,"b":2,"c":3}',
     ...overrides,
   }) as TAttachment;
@@ -186,12 +189,69 @@ describe('AttachmentGroup', () => {
       textAttachment({
         file_id: 'b',
         filename: 'archive.zip',
-        type: 'application/zip',
-        text: undefined as unknown as string,
+        text: undefined,
       }),
     ] as TAttachment[];
     const { container } = render(<AttachmentGroup attachments={attachments} />);
     expect(container.querySelector('pre')).toBeNull();
     expect(screen.getAllByTestId('file-container').length).toBeGreaterThan(0);
   });
+
+  it('does not collapse a single downloadable text preview with a non-downloadable placeholder', () => {
+    const attachments = [
+      textAttachment({
+        file_id: 'placeholder',
+        filename: 'placeholder.zip',
+        filepath: '',
+        text: undefined,
+      }),
+      textAttachment({
+        file_id: 'json',
+        filename: 'output.json',
+        filepath: '/files/output.json',
+        text: '{"ok":true}',
+      }),
+    ] as TAttachment[];
+
+    const { container } = render(<AttachmentGroup attachments={attachments} />);
+
+    expect(screen.queryByRole('button', { name: 'com_ui_show_n_files' })).not.toBeInTheDocument();
+    expect(container.querySelector('pre')?.textContent).toBe('{"ok":true}');
+    expect(screen.getByTestId('file-container')).toHaveTextContent('output.json');
+  });
+
+  it('keeps long grouped text previews clamped until the nested preview is expanded', () => {
+    setScrollHeight(800);
+    const longJson = Array.from({ length: 1000 }, (_, index) => `{"line":${index}}`).join('\n');
+    const attachments = [
+      textAttachment({
+        file_id: 'archive',
+        filename: 'archive.zip',
+        text: undefined,
+      }),
+      textAttachment({
+        file_id: 'json',
+        filename: 'output.json',
+        filepath: '/files/output.json',
+        text: longJson,
+      }),
+    ] as TAttachment[];
+
+    const { container } = render(<AttachmentGroup attachments={attachments} />);
+    const groupToggle = screen.getByRole('button', { name: 'com_ui_show_n_files' });
+    fireEvent.click(groupToggle);
+
+    expect(screen.getByText('output.json')).toBeInTheDocument();
+    const pre = container.querySelector('pre');
+    expect(pre).not.toBeNull();
+    expect(pre).toHaveStyle({ maxHeight: '320px' });
+    const previewToggle = screen.getByRole('button', { name: 'Show all' });
+    expect(previewToggle).toHaveAttribute('aria-expanded', 'false');
+
+    fireEvent.click(previewToggle);
+    expect(screen.getByRole('button', { name: 'Collapse' })).toHaveAttribute(
+      'aria-expanded',
+      'true',
+    );
+  });
 });
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts b/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
index 02113c8a255..f624097f594 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
@@ -1,5 +1,4 @@
 import type { TAttachment } from 'librechat-data-provider';
-import { TOOL_ARTIFACT_TYPES } from '~/utils/artifacts';
 import {
   artifactTypeForAttachment,
   attachmentSalience,
@@ -8,6 +7,7 @@ import {
   isInternalSandboxArtifact,
   isTextAttachment,
 } from '../attachmentTypes';
+import { TOOL_ARTIFACT_TYPES } from '~/utils/artifacts';
 
 const baseAttachment = (overrides: Partial<TAttachment> = {}): TAttachment =>
   ({
@@ -138,9 +138,8 @@ describe('artifactTypeForAttachment', () => {
      * pipeline instead. */
     const attachment = baseAttachment({
       filename: 'photo.jpg',
-      type: 'image/jpeg',
       text: undefined,
-    } as Partial<TAttachment>);
+    });
     expect(artifactTypeForAttachment(attachment)).toBeNull();
   });
 });
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts b/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
index 0d02d9b8361..facffb222f9 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
@@ -1,4 +1,7 @@
-import parseJsonField, { areToolCallArgsComplete } from '../parseJsonField';
+import parseJsonField, {
+  parseJsonFieldOccurrences,
+  areToolCallArgsComplete,
+} from '../parseJsonField';
 
 describe('parseJsonField', () => {
   describe('object args', () => {
@@ -100,6 +103,71 @@ describe('parseJsonField', () => {
       expect(parseJsonField(partial, 'command')).toBe('tab\\there');
     });
   });
+
+  describe('in-progress streaming fields — unterminated values', () => {
+    it('extracts a field whose closing quote has not streamed in yet', () => {
+      const partial = '{"file_path":"skills/demo/SKILL.md","content":"# Demo\\nline two';
+      expect(parseJsonField(partial, 'content')).toBe('# Demo\nline two');
+    });
+
+    it('grows the extracted value as more deltas arrive', () => {
+      const full = '{"file_path":"a.md","content":"# Title\\n\\nBody text here"}';
+      const lengths = [40, 48, 56, full.length];
+      const values = lengths.map((len) => parseJsonField(full.slice(0, len), 'content'));
+      expect(values[values.length - 1]).toBe('# Title\n\nBody text here');
+      values.slice(1).forEach((value, index) => {
+        expect(value.startsWith(values[index])).toBe(true);
+      });
+    });
+
+    it('drops a dangling backslash from a partially streamed escape', () => {
+      const partial = '{"content":"line one\\';
+      expect(parseJsonField(partial, 'content')).toBe('line one');
+    });
+
+    it('unescapes a complete escaped backslash at the stream edge', () => {
+      const partial = '{"content":"path C:\\\\';
+      expect(parseJsonField(partial, 'content')).toBe('path C:\\');
+    });
+
+    it('handles escaped quotes inside an unterminated value', () => {
+      const partial = '{"command":"say \\"hi';
+      expect(parseJsonField(partial, 'command')).toBe('say "hi');
+    });
+
+    it('returns empty string when the value has not opened yet', () => {
+      expect(parseJsonField('{"content":', 'content')).toBe('');
+      expect(parseJsonField('{"content":"', 'content')).toBe('');
+    });
+
+    it('does not run past a completed field into later args', () => {
+      const partial = '{"old_text":"keep this","new_text":"and th';
+      expect(parseJsonField(partial, 'old_text')).toBe('keep this');
+      expect(parseJsonField(partial, 'new_text')).toBe('and th');
+    });
+  });
+});
+
+describe('parseJsonFieldOccurrences', () => {
+  it('returns empty array for non-string args', () => {
+    expect(parseJsonFieldOccurrences(undefined, 'old_text')).toEqual([]);
+    expect(parseJsonFieldOccurrences({ old_text: 'x' }, 'old_text')).toEqual([]);
+    expect(parseJsonFieldOccurrences('', 'old_text')).toEqual([]);
+  });
+
+  it('extracts repeated fields from a partial edits array in document order', () => {
+    const partial =
+      '{"file_path":"a.md","edits":[' +
+      '{"old_text":"first old","new_text":"first new"},' +
+      '{"old_text":"second old","new_text":"second n';
+    expect(parseJsonFieldOccurrences(partial, 'old_text')).toEqual(['first old', 'second old']);
+    expect(parseJsonFieldOccurrences(partial, 'new_text')).toEqual(['first new', 'second n']);
+  });
+
+  it('extracts a single top-level field', () => {
+    const partial = '{"file_path":"a.md","old_text":"only one';
+    expect(parseJsonFieldOccurrences(partial, 'old_text')).toEqual(['only one']);
+  });
 });
 
 describe('areToolCallArgsComplete', () => {
diff --git a/client/src/components/Chat/Messages/Content/Parts/index.ts b/client/src/components/Chat/Messages/Content/Parts/index.ts
index da495abb825..6d6bf470b75 100644
--- a/client/src/components/Chat/Messages/Content/Parts/index.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/index.ts
@@ -11,5 +11,6 @@ export { default as AgentUpdate } from './AgentUpdate';
 export { default as EditTextPart } from './EditTextPart';
 export { default as SkillCall } from './SkillCall';
 export { default as ReadFileCall } from './ReadFileCall';
+export { default as FileAuthoringCall } from './FileAuthoringCall';
 export { default as BashCall } from './BashCall';
 export { default as SubagentCall } from './SubagentCall';
diff --git a/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts b/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
index cf4f9a3aa42..e177fff1dda 100644
--- a/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
@@ -15,6 +15,24 @@ export function areToolCallArgsComplete(args: ToolCallArgs): boolean {
   }
 }
 
+/** Matches `"field":"value"`, tolerating a missing closing quote and a dangling escape at the end of partially streamed args. */
+function fieldRegex(field: string, flags?: string): RegExp {
+  const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`"${escaped}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)(?:"|\\\\?$)`, flags);
+}
+
+function unescapeJsonString(value: string): string {
+  return value.replace(/\\(.)/g, (_, c: string) => {
+    if (c === 'n') {
+      return '\n';
+    }
+    if (c === '"' || c === '\\') {
+      return c;
+    }
+    return `\\${c}`;
+  });
+}
+
 /** Extracts a string field from tool call args, handling object, JSON string, and partial-JSON fallback. */
 export default function parseJsonField(args: ToolCallArgs, field: string): string {
   if (typeof args === 'object' && args !== null) {
@@ -28,19 +46,17 @@ export default function parseJsonField(args: ToolCallArgs, field: string): strin
   } catch {
     // partial JSON during streaming; fall through to regex
   }
-  const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const re = new RegExp(`"${escaped}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`);
-  const match = args?.match(re);
+  const match = args?.match(fieldRegex(field));
   if (!match) {
     return '';
   }
-  return match[1].replace(/\\(.)/g, (_, c: string) => {
-    if (c === 'n') {
-      return '\n';
-    }
-    if (c === '"' || c === '\\') {
-      return c;
-    }
-    return `\\${c}`;
-  });
+  return unescapeJsonString(match[1]);
+}
+
+/** Extracts every occurrence of a string field from partially streamed JSON args, in document order. */
+export function parseJsonFieldOccurrences(args: ToolCallArgs, field: string): string[] {
+  if (typeof args !== 'string' || args.length === 0) {
+    return [];
+  }
+  return Array.from(args.matchAll(fieldRegex(field, 'g')), (match) => unescapeJsonString(match[1]));
 }
diff --git a/client/src/components/Chat/Messages/Content/Parts/useToolCallState.ts b/client/src/components/Chat/Messages/Content/Parts/useToolCallState.ts
index 35992214441..7a487d4b7ee 100644
--- a/client/src/components/Chat/Messages/Content/Parts/useToolCallState.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/useToolCallState.ts
@@ -21,6 +21,7 @@ export default function useToolCallState(
   isSubmitting: boolean,
   output: string,
   hasInput: boolean,
+  onExpand?: () => void,
 ): ToolCallState {
   const autoExpand = useRecoilValue(store.autoExpandTools);
   const hasOutput = output.length > 0;
@@ -37,7 +38,15 @@ export default function useToolCallState(
   }, [autoExpand, hasContent]);
 
   const progress = useProgress(initialProgress);
-  const toggleCode = useCallback(() => setShowCode((prev) => !prev), []);
+  const toggleCode = useCallback(() => {
+    setShowCode((prev) => {
+      const next = !prev;
+      if (next) {
+        onExpand?.();
+      }
+      return next;
+    });
+  }, [onExpand]);
   const cancelled = !isSubmitting && progress < 1 && !hasError;
 
   return {
diff --git a/client/src/components/Chat/Messages/Content/RetrievalCall.tsx b/client/src/components/Chat/Messages/Content/RetrievalCall.tsx
index f367f07febe..97f86fdb754 100644
--- a/client/src/components/Chat/Messages/Content/RetrievalCall.tsx
+++ b/client/src/components/Chat/Messages/Content/RetrievalCall.tsx
@@ -326,11 +326,13 @@ export default function RetrievalCall({
   isSubmitting,
   output,
   attachments,
+  onExpand,
 }: {
   initialProgress: number;
   isSubmitting: boolean;
   output?: string;
   attachments?: TAttachment[];
+  onExpand?: () => void;
 }) {
   const progress = useProgress(initialProgress);
   const localize = useLocalize();
@@ -400,6 +402,16 @@ export default function RetrievalCall({
     }
   }, [autoExpand, hasOutput]);
 
+  const handleToggleOutput = useCallback(() => {
+    setShowOutput((prev) => {
+      const next = !prev;
+      if (next) {
+        onExpand?.();
+      }
+      return next;
+    });
+  }, [onExpand]);
+
   return (
     <div className="my-1">
       <span className="sr-only" aria-live="polite" aria-atomic="true">
@@ -416,7 +428,7 @@ export default function RetrievalCall({
       <div className="relative my-1 flex h-5 shrink-0 items-center gap-2.5">
         <ProgressText
           progress={progress}
-          onClick={hasOutput ? () => setShowOutput((prev) => !prev) : undefined}
+          onClick={hasOutput ? handleToggleOutput : undefined}
           inProgressText={localize('com_ui_searching_files')}
           finishedText={localize('com_ui_retrieved_files')}
           errorSuffix={errorState && !cancelled ? localize('com_ui_tool_failed') : undefined}
diff --git a/client/src/components/Chat/Messages/Content/SiblingHeader.tsx b/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
index 080974ed2b2..160966fb136 100644
--- a/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
+++ b/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
@@ -3,6 +3,7 @@ import { GitBranchPlus } from 'lucide-react';
 import { useToastContext } from '@librechat/client';
 import { EModelEndpoint, parseEphemeralAgentId, stripAgentIdSuffix } from 'librechat-data-provider';
 import type { TMessage, Agent } from 'librechat-data-provider';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import { useBranchMessageMutation } from '~/data-provider/Messages';
 import MessageIcon from '~/components/Share/MessageIcon';
 import { useAgentsMapContext } from '~/Providers';
@@ -14,6 +15,8 @@ type SiblingHeaderProps = {
   agentId?: string;
   /** The messageId of the parent message */
   messageId?: string;
+  /** ISO timestamp of the parent message */
+  createdAt?: string | null;
   /** The conversationId */
   conversationId?: string | null;
   /** Whether a submission is in progress */
@@ -27,6 +30,7 @@ type SiblingHeaderProps = {
 export default function SiblingHeader({
   agentId,
   messageId,
+  createdAt,
   conversationId,
   isSubmitting,
 }: SiblingHeaderProps) {
@@ -117,6 +121,7 @@ export default function SiblingHeader({
           />
         </div>
         <span className="truncate text-sm font-medium text-text-primary">{displayName}</span>
+        <MessageTimestamp value={createdAt} />
       </div>
       <button
         type="button"
diff --git a/client/src/components/Chat/Messages/Content/ToolCall.tsx b/client/src/components/Chat/Messages/Content/ToolCall.tsx
index bd344bcc49f..2efde33a204 100644
--- a/client/src/components/Chat/Messages/Content/ToolCall.tsx
+++ b/client/src/components/Chat/Messages/Content/ToolCall.tsx
@@ -28,6 +28,7 @@ export default function ToolCall({
   attachments,
   auth,
   hideAttachments = false,
+  onExpand,
 }: {
   initialProgress: number;
   isLast?: boolean;
@@ -38,6 +39,7 @@ export default function ToolCall({
   attachments?: TAttachment[];
   auth?: string;
   hideAttachments?: boolean;
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const autoExpand = useRecoilValue(store.autoExpandTools);
@@ -163,6 +165,16 @@ export default function ToolCall({
   const progress = useProgress(initialProgress);
   const showCancelled = cancelled || (errorState && !output);
 
+  const handleToggleInfo = useCallback(() => {
+    setShowInfo((prev) => {
+      const next = !prev;
+      if (next) {
+        onExpand?.();
+      }
+      return next;
+    });
+  }, [onExpand]);
+
   const subtitle = useMemo(() => {
     if (isMCPToolCall && mcpServerName) {
       return localize('com_ui_via_server', { 0: mcpServerName });
@@ -205,7 +217,7 @@ export default function ToolCall({
       <div className="relative my-1.5 flex h-5 shrink-0 items-center gap-2.5">
         <ProgressText
           progress={progress}
-          onClick={() => setShowInfo((prev) => !prev)}
+          onClick={handleToggleInfo}
           inProgressText={
             function_name
               ? localize('com_assistants_running_var', { 0: function_name })
diff --git a/client/src/components/Chat/Messages/Content/ToolCallGroup.tsx b/client/src/components/Chat/Messages/Content/ToolCallGroup.tsx
index e7ef24151b1..52b166b110e 100644
--- a/client/src/components/Chat/Messages/Content/ToolCallGroup.tsx
+++ b/client/src/components/Chat/Messages/Content/ToolCallGroup.tsx
@@ -1,4 +1,4 @@
-import { useState, useMemo, useEffect, useCallback } from 'react';
+import { useState, useRef, useMemo, useEffect, useCallback } from 'react';
 import { useRecoilValue } from 'recoil';
 import { ChevronDown, Users } from 'lucide-react';
 import { Tools, Constants, ContentTypes, ToolCallTypes } from 'librechat-data-provider';
@@ -9,7 +9,7 @@ import type {
   FunctionToolCall,
 } from 'librechat-data-provider';
 import type { PartWithIndex } from './ParallelContent';
-import { useLocalize, useExpandCollapse } from '~/hooks';
+import { useLocalize, useExpandCollapse, scheduleMessageContentLayoutReconcile } from '~/hooks';
 import { cn, getToolDisplayLabel } from '~/utils';
 import { StackedToolIcons } from './ToolOutput';
 import { useMCPIconMap } from '~/hooks/MCP';
@@ -75,11 +75,23 @@ interface ToolCallGroupProps {
   parts: PartWithIndex[];
   isSubmitting: boolean;
   isLast: boolean;
-  renderPart: (part: TMessageContentParts, idx: number, isLastPart: boolean) => React.ReactNode;
+  renderPart: (
+    part: TMessageContentParts,
+    idx: number,
+    isLastPart: boolean,
+    onToolExpand?: () => void,
+  ) => React.ReactNode;
   lastContentIdx: number;
   groupAttachments?: TAttachment[];
+  initialExpansionState?: ToolCallGroupExpansionState;
+  onExpansionChange?: (state: ToolCallGroupExpansionState) => void;
 }
 
+export type ToolCallGroupExpansionState = {
+  isExpanded: boolean;
+  userOverride: boolean;
+};
+
 export default function ToolCallGroup({
   parts,
   isSubmitting,
@@ -87,9 +99,13 @@ export default function ToolCallGroup({
   renderPart,
   lastContentIdx,
   groupAttachments,
+  initialExpansionState,
+  onExpansionChange,
 }: ToolCallGroupProps) {
   const localize = useLocalize();
   const mcpIconMap = useMCPIconMap();
+  const rootRef = useRef<HTMLDivElement | null>(null);
+  const cancelLayoutReconcileRef = useRef<(() => void) | null>(null);
   const count = parts.length;
 
   const toolMetadata = useMemo(() => parts.map((p) => getToolMeta(p.part)), [parts]);
@@ -136,9 +152,33 @@ export default function ToolCallGroup({
 
   const autoExpand = useRecoilValue(store.autoExpandTools);
   const autoCollapse = !autoExpand && count >= 2 && allCompleted;
-  const [isExpanded, setIsExpanded] = useState(autoExpand || !autoCollapse);
-  const [userOverride, setUserOverride] = useState(false);
+  const initialState = initialExpansionState?.userOverride === true ? initialExpansionState : null;
+  const [isExpanded, setIsExpanded] = useState(
+    initialState?.isExpanded ?? (autoExpand || !autoCollapse),
+  );
+  const [userOverride, setUserOverride] = useState(initialState != null);
+  const [shouldRenderBody, setShouldRenderBody] = useState(isExpanded);
+  const previousIsExpandedRef = useRef(isExpanded);
   const { style: expandStyle, ref: expandRef } = useExpandCollapse(isExpanded);
+  const notifyLayoutChange = useCallback(() => {
+    cancelLayoutReconcileRef.current?.();
+    cancelLayoutReconcileRef.current = scheduleMessageContentLayoutReconcile(rootRef.current);
+  }, []);
+
+  useEffect(
+    () => () => {
+      cancelLayoutReconcileRef.current?.();
+    },
+    [],
+  );
+
+  useEffect(() => {
+    const wasExpanded = previousIsExpandedRef.current;
+    previousIsExpandedRef.current = isExpanded;
+    if (wasExpanded && !isExpanded) {
+      notifyLayoutChange();
+    }
+  }, [isExpanded, notifyLayoutChange]);
 
   useEffect(() => {
     if (autoCollapse && !userOverride) {
@@ -147,9 +187,35 @@ export default function ToolCallGroup({
   }, [autoCollapse, userOverride]);
 
   const handleToggle = useCallback(() => {
+    const nextExpanded = !isExpanded;
     setUserOverride(true);
-    setIsExpanded((prev) => !prev);
-  }, []);
+    if (nextExpanded) {
+      setShouldRenderBody(true);
+    }
+    setIsExpanded(nextExpanded);
+    onExpansionChange?.({ isExpanded: nextExpanded, userOverride: true });
+  }, [isExpanded, onExpansionChange]);
+
+  const handleToolExpand = useCallback(() => {
+    setUserOverride(true);
+    setShouldRenderBody(true);
+    setIsExpanded(true);
+    onExpansionChange?.({ isExpanded: true, userOverride: true });
+  }, [onExpansionChange]);
+
+  const handleTransitionEnd = useCallback(
+    (event: React.TransitionEvent<HTMLDivElement>) => {
+      if (event.target !== event.currentTarget) {
+        return;
+      }
+      if (isExpanded) {
+        return;
+      }
+      setShouldRenderBody(false);
+      notifyLayoutChange();
+    },
+    [isExpanded, notifyLayoutChange],
+  );
 
   const getSubagentLabel = () =>
     subagentsDone
@@ -165,13 +231,14 @@ export default function ToolCallGroup({
   );
 
   useEffect(() => {
-    if (hasActiveToolCall) {
+    if (hasActiveToolCall && !userOverride) {
+      setShouldRenderBody(true);
       setIsExpanded(true);
     }
-  }, [hasActiveToolCall]);
+  }, [hasActiveToolCall, userOverride]);
 
   return (
-    <div className="mb-2 mt-1">
+    <div className="mb-2 mt-1" ref={rootRef}>
       <button
         type="button"
         className="inline-flex w-full items-center gap-2 py-1 text-text-secondary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-heavy"
@@ -216,12 +283,16 @@ export default function ToolCallGroup({
           aria-hidden="true"
         />
       </button>
-      <div style={expandStyle}>
-        <div className="overflow-hidden" ref={expandRef}>
-          <div className="py-0.5 pl-4">
-            {parts.map(({ part, idx }) => renderPart(part, idx, isLast && idx === lastContentIdx))}
+      <div style={expandStyle} onTransitionEnd={handleTransitionEnd} aria-hidden={!isExpanded}>
+        {shouldRenderBody && (
+          <div className="overflow-hidden" ref={expandRef}>
+            <div className="py-0.5 pl-4">
+              {parts.map(({ part, idx }) =>
+                renderPart(part, idx, isLast && idx === lastContentIdx, handleToolExpand),
+              )}
+            </div>
           </div>
-        </div>
+        )}
       </div>
       {groupAttachments && groupAttachments.length > 0 && (
         <AttachmentGroup attachments={groupAttachments} />
diff --git a/client/src/components/Chat/Messages/Content/WebSearch.tsx b/client/src/components/Chat/Messages/Content/WebSearch.tsx
index e4029193cc9..c8d76a04b21 100644
--- a/client/src/components/Chat/Messages/Content/WebSearch.tsx
+++ b/client/src/components/Chat/Messages/Content/WebSearch.tsx
@@ -82,12 +82,14 @@ export default function WebSearch({
   isLast,
   output,
   attachments,
+  onExpand,
 }: {
   isLast?: boolean;
   isSubmitting: boolean;
   output?: string | null;
   initialProgress: number;
   attachments?: TAttachment[];
+  onExpand?: () => void;
 }) {
   const localize = useLocalize();
   const { searchResults } = useSearchContext();
@@ -139,26 +141,21 @@ export default function WebSearch({
     return [];
   }, [searchResults, attachments, ownTurn]);
 
-  const processedSources = useMemo(() => {
+  // Show favicons from the raw SERP results immediately rather than waiting for
+  // each source to flip to `processed`; the agents scrape barrier would otherwise
+  // freeze the stack on "Searching the web" for the slowest scrape's duration.
+  const streamingSources = useMemo(() => {
     if (complete && !finalizing) {
       return [];
     }
-    if (!searchResults) {
-      return [];
-    }
-    const result = searchResults[ownTurn];
+    const result = searchResults?.[ownTurn];
     if (!result) {
       return [];
     }
-    if (finalizing) {
-      return [...(result.organic || []), ...(result.topStories || [])];
-    }
-    return [...(result.organic || []), ...(result.topStories || [])].filter(
-      (source) => source.processed === true,
-    );
+    return [...(result.organic || []), ...(result.topStories || [])];
   }, [searchResults, complete, finalizing, ownTurn]);
 
-  const showSources = processedSources.length > 0;
+  const showSources = streamingSources.length > 0;
   const progressText = useMemo(() => {
     let text: ProgressKeys =
       ownTurn !== '0' ? 'com_ui_web_searching_again' : 'com_ui_web_searching';
@@ -182,6 +179,16 @@ export default function WebSearch({
     }
   }, [autoExpand, sourceCount]);
 
+  const handleToggleSources = () => {
+    setShowSourceList((prev) => {
+      const next = !prev;
+      if (next) {
+        onExpand?.();
+      }
+      return next;
+    });
+  };
+
   if (cancelled) {
     return null;
   }
@@ -204,7 +211,7 @@ export default function WebSearch({
               : 'pointer-events-none text-text-secondary',
           )}
           disabled={!hasSourceData}
-          onClick={hasSourceData ? () => setShowSourceList((prev) => !prev) : undefined}
+          onClick={hasSourceData ? handleToggleSources : undefined}
           aria-expanded={hasSourceData ? showSourceList : undefined}
           aria-label={
             hasSourceData
@@ -266,7 +273,7 @@ export default function WebSearch({
       <span className="sr-only" aria-live="polite" aria-atomic="true">
         {progressText}
       </span>
-      {showSources && <StackedFavicons sources={processedSources} start={-5} />}
+      {showSources && <StackedFavicons sources={streamingSources} start={-5} />}
       <Globe className="size-4 shrink-0 text-text-secondary" aria-hidden="true" />
       <span className="tool-status-text shimmer font-medium text-text-secondary">
         {progressText}
diff --git a/client/src/components/Chat/Messages/Content/__tests__/ContentParts.integration.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/ContentParts.integration.test.tsx
index 9cfd848bff4..555bf7c4f6d 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/ContentParts.integration.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/ContentParts.integration.test.tsx
@@ -2,7 +2,7 @@ import React from 'react';
 import { RecoilRoot } from 'recoil';
 import { ContentTypes } from 'librechat-data-provider';
 import type { TAttachment, TMessageContentParts } from 'librechat-data-provider';
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen } from '@testing-library/react';
 import ContentParts from '../ContentParts';
 
 jest.mock('~/hooks', () => ({
@@ -17,6 +17,7 @@ jest.mock('~/hooks', () => ({
     ref: { current: null },
   }),
   useProgress: (initial: number) => (initial >= 1 ? 1 : initial),
+  scheduleMessageContentLayoutReconcile: jest.fn(() => jest.fn()),
 }));
 
 jest.mock('~/hooks/MCP', () => ({
@@ -126,6 +127,19 @@ const makeMcpToolCall = (id: string, hasOutput = true): TMessageContentParts =>
     },
   }) as unknown as TMessageContentParts;
 
+const makeMcpToolCallWithoutId = (name: string, hasOutput = true): TMessageContentParts =>
+  ({
+    type: ContentTypes.TOOL_CALL,
+    [ContentTypes.TOOL_CALL]: {
+      name: `${name}${MCP_DELIMITER}Everything`,
+      args: '{}',
+      output: hasOutput ? 'image_returned' : '',
+    },
+  }) as unknown as TMessageContentParts;
+
+const makeTextPart = (text: string): TMessageContentParts =>
+  ({ type: ContentTypes.TEXT, text }) as unknown as TMessageContentParts;
+
 const imageAttachment = (toolCallId: string, name = 'tiny.png'): TAttachment =>
   ({
     filename: name,
@@ -222,4 +236,118 @@ describe('ContentParts integration: MCP image hoist and grouping', () => {
 
     expect(screen.queryByTestId('attachment-group')).not.toBeInTheDocument();
   });
+
+  it('keeps a manually expanded completed tool group open when its content index shifts', () => {
+    const content = [makeMcpToolCall('t1'), makeMcpToolCall('t2')];
+    const nextContent = [makeTextPart('streamed preface'), ...content];
+
+    const { rerender } = render(
+      <RecoilRoot>
+        <ContentParts {...baseProps} content={content} />
+      </RecoilRoot>,
+    );
+
+    const toggle = screen.getByRole('button', { name: 'Used 2 tools' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'false');
+
+    fireEvent.click(toggle);
+    expect(toggle).toHaveAttribute('aria-expanded', 'true');
+
+    rerender(
+      <RecoilRoot>
+        <ContentParts {...baseProps} content={nextContent} />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('button', { name: 'Used 2 tools' })).toHaveAttribute(
+      'aria-expanded',
+      'true',
+    );
+  });
+
+  it('keeps a running tool group open when an individual tool is expanded before completion', () => {
+    const runningContent = [makeMcpToolCall('t1', false), makeMcpToolCall('t2', false)];
+    const completedContent = [makeMcpToolCall('t1'), makeMcpToolCall('t2')];
+
+    const { rerender } = render(
+      <RecoilRoot>
+        <ContentParts {...baseProps} isSubmitting isLatestMessage content={runningContent} />
+      </RecoilRoot>,
+    );
+
+    const toggle = screen.getByRole('button', { name: 'Used 2 tools' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'true');
+
+    fireEvent.click(screen.getAllByTestId('progress-text')[0]);
+
+    rerender(
+      <RecoilRoot>
+        <ContentParts
+          {...baseProps}
+          isSubmitting={false}
+          isLatestMessage
+          content={completedContent}
+        />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('button', { name: 'Used 2 tools' })).toHaveAttribute(
+      'aria-expanded',
+      'true',
+    );
+  });
+
+  it('does not reuse fallback-index expansion state across message ids', () => {
+    const content = [makeMcpToolCallWithoutId('first'), makeMcpToolCallWithoutId('second')];
+
+    const { rerender } = render(
+      <RecoilRoot>
+        <ContentParts {...baseProps} messageId="msg1" content={content} />
+      </RecoilRoot>,
+    );
+
+    const toggle = screen.getByRole('button', { name: 'Used 2 tools' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'false');
+
+    fireEvent.click(toggle);
+    expect(toggle).toHaveAttribute('aria-expanded', 'true');
+
+    rerender(
+      <RecoilRoot>
+        <ContentParts {...baseProps} messageId="msg2" content={content} />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('button', { name: 'Used 2 tools' })).toHaveAttribute(
+      'aria-expanded',
+      'false',
+    );
+  });
+
+  it('keeps id-backed expansion state across transient message id changes', () => {
+    const content = [makeMcpToolCall('t1'), makeMcpToolCall('t2')];
+
+    const { rerender } = render(
+      <RecoilRoot>
+        <ContentParts {...baseProps} messageId="placeholder-msg" content={content} />
+      </RecoilRoot>,
+    );
+
+    const toggle = screen.getByRole('button', { name: 'Used 2 tools' });
+    expect(toggle).toHaveAttribute('aria-expanded', 'false');
+
+    fireEvent.click(toggle);
+    expect(toggle).toHaveAttribute('aria-expanded', 'true');
+
+    rerender(
+      <RecoilRoot>
+        <ContentParts {...baseProps} messageId="server-msg" content={content} />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('button', { name: 'Used 2 tools' })).toHaveAttribute(
+      'aria-expanded',
+      'true',
+    );
+  });
 });
diff --git a/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
index 6ca06056fa3..bde96149040 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import Markdown from '../Markdown';
+import MarkdownLite from '../MarkdownLite';
 import { RecoilRoot } from 'recoil';
 import { UI_RESOURCE_MARKER } from '~/components/MCPUIResource/plugin';
 import {
@@ -108,3 +109,35 @@ describe('Markdown with MCP UI markers (resource IDs)', () => {
     expect(renderers[1]).toHaveAttribute('data-resource-uri', 'ui://weather/nyc');
   });
 });
+
+describe('Markdown table rendering', () => {
+  const tableMarkdown = [
+    '| Alpha | Bravo | Charlie | Delta | Echo | Foxtrot | Golf | Hotel |',
+    '| --- | --- | --- | --- | --- | --- | --- | --- |',
+    '| one | two | three | four | five | six | seven | eight |',
+  ].join('\n');
+
+  it('wraps GFM tables in a horizontally scrollable container', () => {
+    render(
+      <RecoilRoot>
+        <Markdown content={tableMarkdown} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('table').parentElement).toHaveClass(
+      'markdown-table-wrapper',
+      'w-full',
+      'max-w-full',
+    );
+  });
+
+  it('wraps lightweight Markdown tables in a horizontally scrollable container', () => {
+    render(<MarkdownLite content={tableMarkdown} />);
+
+    expect(screen.getByRole('table').parentElement).toHaveClass(
+      'markdown-table-wrapper',
+      'w-full',
+      'max-w-full',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx
new file mode 100644
index 00000000000..2e2ade6e3e4
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx
@@ -0,0 +1,117 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { MemoryRouter } from 'react-router-dom';
+import { render, screen } from '@testing-library/react';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from '../markdownConfig';
+import { MessageContext, ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import Markdown from '../Markdown';
+
+/**
+ * End-to-end artifact-index regression tests. The real `Artifact` component
+ * computes its document-order index via the (per-block) ArtifactProvider and
+ * stores it on the artifact passed to `ArtifactButton`; we stub only
+ * `ArtifactButton` to read that index back. This verifies the per-block base
+ * indexing assigns artifacts the same indices the whole-message renderer did —
+ * the index used by artifact edit/update calls.
+ */
+jest.mock('~/components/Artifacts/ArtifactButton', () => ({
+  __esModule: true,
+  default: ({ artifact }: { artifact?: { index?: number; identifier?: string } }) => (
+    <div
+      data-testid="art"
+      data-index={String(artifact?.index)}
+      data-id={String(artifact?.identifier)}
+    />
+  ),
+}));
+
+const artifact = (id: string, title: string) =>
+  `:::artifact{identifier="${id}" type="text/markdown" title="${title}"}\nhello ${id}\n:::`;
+
+const wrap = (ui: React.ReactNode) => (
+  <MemoryRouter>
+    <RecoilRoot>
+      <MessageContext.Provider value={{ messageId: 'm1', isExpanded: true }}>
+        {ui}
+      </MessageContext.Provider>
+    </RecoilRoot>
+  </MemoryRouter>
+);
+
+/** The previous whole-message renderer: one ReactMarkdown under one ArtifactProvider. */
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+const readArtifacts = async () =>
+  (await screen.findAllByTestId('art')).map((el) => ({
+    idx: el.getAttribute('data-index'),
+    id: el.getAttribute('data-id'),
+  }));
+
+describe('MarkdownBlocks artifact-index parity (e2e)', () => {
+  it('assigns document-order indices to multiple artifacts', async () => {
+    const content = `${artifact('a', 'A')}\n\n${artifact('b', 'B')}`;
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+
+    expect(await readArtifacts()).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('matches the whole-message renderer indices (text + artifacts interleaved)', async () => {
+    const content = `Intro.\n\n${artifact('a', 'A')}\n\nMiddle.\n\n${artifact('b', 'B')}\n\nEnd.`;
+
+    const { unmount } = render(wrap(<OldMarkdown content={content} />));
+    const oldIdx = await readArtifacts();
+    unmount();
+
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+    const newIdx = await readArtifacts();
+
+    expect(newIdx).toEqual(oldIdx);
+    expect(newIdx).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('refreshes artifact indices when an in-place edit inserts an artifact before another', async () => {
+    const before = `Intro.\n\n${artifact('b', 'B')}`;
+    const after = `${artifact('a', 'A')}\n\n${artifact('b', 'B')}`;
+
+    const { rerender } = render(wrap(<Markdown content={before} isLatestMessage={false} />));
+    expect(await readArtifacts()).toEqual([{ idx: '0', id: 'b' }]);
+
+    rerender(wrap(<Markdown content={after} isLatestMessage={false} />));
+    // 'b' was index 0; inserting 'a' before it shifts its base to 1. Without the
+    // base-aware block key its ref-cached index would stay 0 (duplicating 'a').
+    expect(await readArtifacts()).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('does not consume an index for inline text artifact directives', async () => {
+    // `:artifact{}` (text directive) renders as literal text, not an Artifact, so
+    // the following real artifact must still be index 0.
+    const content = `See :artifact{identifier="x"} inline.\n\n${artifact('a', 'A')}`;
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+
+    expect(await readArtifacts()).toEqual([{ idx: '0', id: 'a' }]);
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx
new file mode 100644
index 00000000000..b681bc109ab
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx
@@ -0,0 +1,240 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from '../markdownConfig';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import Markdown from '../Markdown';
+
+/**
+ * Stub CodeBlock so we can read the blockIndex each executable code block
+ * receives, while still exercising the real `code` override's skip/single-line
+ * decision (which decides whether a CodeBlock renders at all).
+ */
+jest.mock('~/components/Messages/Content/CodeBlock', () => ({
+  __esModule: true,
+  default: ({ lang, blockIndex }: { lang?: string; blockIndex?: number }) => (
+    <div data-testid="cb" data-block-index={String(blockIndex)} data-lang={String(lang)} />
+  ),
+}));
+
+/** The previous whole-message renderer: a single ReactMarkdown under one set of providers. */
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+/**
+ * The whole-message renderer emits whitespace-only text nodes ("\n") between
+ * top-level block elements; the per-block renderer parses each block in
+ * isolation and omits them. That whitespace is collapsed between block-level
+ * elements, so it is visually and functionally irrelevant — normalize it away
+ * before comparing structure.
+ */
+const normalizeHtml = (html: string) => html.replace(/>\s+</g, '><').trim();
+
+const indicesIn = (container: HTMLElement) =>
+  Array.from(container.querySelectorAll('[data-testid="cb"]')).map((el) => ({
+    idx: el.getAttribute('data-block-index'),
+    lang: el.getAttribute('data-lang'),
+  }));
+
+const streamThrough = (
+  Component: React.ComponentType<{ content: string }>,
+  content: string,
+): HTMLElement => {
+  const lines = content.split('\n');
+  const { container, rerender } = render(
+    <RecoilRoot>
+      <Component content={lines[0]} />
+    </RecoilRoot>,
+  );
+  for (let i = 2; i <= lines.length; i += 1) {
+    rerender(
+      <RecoilRoot>
+        <Component content={lines.slice(0, i).join('\n')} />
+      </RecoilRoot>,
+    );
+  }
+  return container;
+};
+
+const MIXED = [
+  'Intro paragraph.',
+  '',
+  '```python',
+  'print("one")',
+  'x = 1',
+  '```',
+  '',
+  'Some `inline` code here.',
+  '',
+  '```js',
+  'console.log("two");',
+  'const y = 2;',
+  '```',
+  '',
+  '```math',
+  'E = mc^2',
+  '```',
+  '',
+  '```bash',
+  'echo single',
+  '```',
+  '',
+  '```mermaid',
+  'graph TD; A-->B;',
+  '```',
+  '',
+  '```ts',
+  'const z: number = 3;',
+  'export {};',
+  '```',
+].join('\n');
+
+const EXPECTED = [
+  { idx: '0', lang: 'python' },
+  { idx: '1', lang: 'js' },
+  { idx: '2', lang: 'bash' },
+  { idx: '3', lang: 'ts' },
+];
+
+const NewMarkdown = ({ content }: { content: string }) => (
+  <Markdown content={content} isLatestMessage={false} />
+);
+
+describe('MarkdownBlocks code-block index parity', () => {
+  it('assigns document-order indices on a direct render (matches whole-message renderer)', () => {
+    const { container: oldC } = render(
+      <RecoilRoot>
+        <OldMarkdown content={MIXED} />
+      </RecoilRoot>,
+    );
+    const { container: newC } = render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+
+    expect(indicesIn(oldC)).toEqual(EXPECTED);
+    expect(indicesIn(newC)).toEqual(EXPECTED);
+  });
+
+  it('keeps indices correct across a simulated stream (no drift under memoization)', () => {
+    const oldC = streamThrough(OldMarkdown, MIXED);
+    const newC = streamThrough(NewMarkdown, MIXED);
+
+    expect(indicesIn(oldC)).toEqual(EXPECTED);
+    expect(indicesIn(newC)).toEqual(EXPECTED);
+  });
+
+  it('streamed indices match a fresh direct render (stable for stored execution results)', () => {
+    const streamed = streamThrough(NewMarkdown, MIXED);
+    const { container: fresh } = render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(indicesIn(streamed)).toEqual(indicesIn(fresh));
+  });
+
+  it('refreshes indices when an in-place edit inserts a code block before existing ones', () => {
+    const before = 'intro\n\n```js\na\n```';
+    const after = '```py\nx\n```\n\n```js\na\n```';
+    const { container, rerender } = render(
+      <RecoilRoot>
+        <Markdown content={before} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(indicesIn(container)).toEqual([{ idx: '0', lang: 'js' }]);
+
+    rerender(
+      <RecoilRoot>
+        <Markdown content={after} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    // The js block's base shifted 0 -> 1; without forcing a remount its ref-cached
+    // index would stay 0 (duplicating py). It must become 1.
+    expect(indicesIn(container)).toEqual([
+      { idx: '0', lang: 'py' },
+      { idx: '1', lang: 'js' },
+    ]);
+  });
+});
+
+describe('MarkdownBlocks DOM equivalence (non-code blocks)', () => {
+  const cases: Array<[string, string]> = [
+    ['paragraphs', 'First paragraph.\n\nSecond paragraph.'],
+    ['gfm table', ['| a | b |', '| - | - |', '| 1 | 2 |', '| 3 | 4 |'].join('\n')],
+    ['unordered list', '- one\n- two\n- three'],
+    ['ordered list', '1. one\n2. two'],
+    ['headings + text', '# Title\n\nBody text with **bold** and _italics_.'],
+    ['blockquote', '> quoted line one\n> quoted line two'],
+    ['inline code', 'Use the `useMemo` hook for memoization.'],
+    ['mixed', '# H\n\nPara with `code`.\n\n| x | y |\n| - | - |\n| 1 | 2 |\n\n- a\n- b'],
+  ];
+
+  it.each(cases)('renders identical DOM to the whole-message renderer: %s', (_label, content) => {
+    const { container: oldC } = render(
+      <RecoilRoot>
+        <OldMarkdown content={content} />
+      </RecoilRoot>,
+    );
+    const { container: newC } = render(
+      <RecoilRoot>
+        <Markdown content={content} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(normalizeHtml(newC.innerHTML)).toBe(normalizeHtml(oldC.innerHTML));
+  });
+});
+
+describe('MarkdownBlocks rendering smoke', () => {
+  it('renders an empty cursor placeholder while initializing', () => {
+    const { container } = render(
+      <RecoilRoot>
+        <Markdown content="" isLatestMessage={true} />
+      </RecoilRoot>,
+    );
+    expect(container.querySelector('.result-thinking')).not.toBeNull();
+  });
+
+  it('renders executable code blocks for a multi-code message', () => {
+    render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(screen.getAllByTestId('cb')).toHaveLength(4);
+  });
+});
+
+describe('MarkdownBlocks document-level definitions', () => {
+  it('resolves a reference-style link whose definition is in a separate block', () => {
+    const queryClient = new QueryClient();
+    const content = 'See [docs][d] for details.\n\n[d]: https://example.com/docs';
+    render(
+      <QueryClientProvider client={queryClient}>
+        <RecoilRoot>
+          <Markdown content={content} isLatestMessage={false} />
+        </RecoilRoot>
+      </QueryClientProvider>,
+    );
+    expect(screen.getByRole('link', { name: 'docs' })).toHaveAttribute(
+      'href',
+      'https://example.com/docs',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/MessageQuotes.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/MessageQuotes.test.tsx
new file mode 100644
index 00000000000..7cb2e753cb0
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/MessageQuotes.test.tsx
@@ -0,0 +1,38 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+import MessageQuotes from '../MessageQuotes';
+
+describe('MessageQuotes', () => {
+  it('renders nothing when quotes is undefined', () => {
+    const { container } = render(<MessageQuotes />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders nothing when quotes is empty', () => {
+    const { container } = render(<MessageQuotes quotes={[]} />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders one reference block per quote, preserving text', () => {
+    render(<MessageQuotes quotes={['first excerpt', 'second excerpt']} />);
+    const items = screen.getAllByRole('listitem');
+    expect(items).toHaveLength(2);
+    expect(items[0]).toHaveTextContent('first excerpt');
+    expect(items[1]).toHaveTextContent('second excerpt');
+  });
+
+  it('localizes the list aria-label', () => {
+    render(<MessageQuotes quotes={['excerpt']} />);
+    expect(screen.getByRole('list')).toHaveAttribute('aria-label', 'com_ui_referenced_quotes');
+  });
+
+  it('renders duplicate quote strings as separate blocks', () => {
+    render(<MessageQuotes quotes={['same', 'same']} />);
+    expect(screen.getAllByRole('listitem')).toHaveLength(2);
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
index 1da1d389d12..5fd14982879 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
@@ -14,6 +14,9 @@ jest.mock('../Parts', () => ({
   Text: ({ text }: { text?: string }) => <div data-testid="text">{text}</div>,
   SkillCall: () => <div data-testid="skill-call" />,
   ReadFileCall: () => <div data-testid="read-file-call" />,
+  FileAuthoringCall: ({ toolName }: { toolName: string }) => (
+    <div data-testid="file-authoring-call" data-tool-name={toolName} />
+  ),
   BashCall: ({ commandField }: { commandField?: string }) => (
     <div data-testid="bash-call" data-command-field={commandField ?? 'command'} />
   ),
@@ -101,4 +104,31 @@ describe('Part tool renderer selection', () => {
     expect(screen.getByTestId('execute-code')).toBeInTheDocument();
     expect(screen.queryByTestId('bash-call')).not.toBeInTheDocument();
   });
+
+  it('routes create_file calls through the file-authoring renderer', () => {
+    renderPart(
+      toolCallPart('create_file', '{"file_path":"skills/demo/SKILL.md","content":"# Demo"}'),
+    );
+
+    expect(screen.getByTestId('file-authoring-call')).toHaveAttribute(
+      'data-tool-name',
+      'create_file',
+    );
+    expect(screen.queryByTestId('tool-call')).not.toBeInTheDocument();
+  });
+
+  it('routes edit_file calls through the file-authoring renderer', () => {
+    renderPart(
+      toolCallPart(
+        'edit_file',
+        '{"file_path":"skills/demo/SKILL.md","old_text":"Demo","new_text":"Updated"}',
+      ),
+    );
+
+    expect(screen.getByTestId('file-authoring-call')).toHaveAttribute(
+      'data-tool-name',
+      'edit_file',
+    );
+    expect(screen.queryByTestId('tool-call')).not.toBeInTheDocument();
+  });
 });
diff --git a/client/src/components/Chat/Messages/Content/__tests__/ToolCallGroup.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/ToolCallGroup.test.tsx
index 706eaf39243..058e21f6d2c 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/ToolCallGroup.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/ToolCallGroup.test.tsx
@@ -2,8 +2,9 @@ import React from 'react';
 import { RecoilRoot } from 'recoil';
 import { Tools, Constants, ContentTypes } from 'librechat-data-provider';
 import type { TAttachment, TMessageContentParts } from 'librechat-data-provider';
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
 import ToolCallGroup from '../ToolCallGroup';
+import { scheduleMessageContentLayoutReconcile } from '~/hooks';
 
 jest.mock('~/hooks', () => ({
   useLocalize: () => (key: string, values?: Record<string | number, string>) => {
@@ -22,6 +23,7 @@ jest.mock('~/hooks', () => ({
     },
     ref: { current: null },
   }),
+  scheduleMessageContentLayoutReconcile: jest.fn(() => jest.fn()),
 }));
 
 jest.mock('~/hooks/MCP', () => ({
@@ -95,6 +97,9 @@ const renderGroup = (props: React.ComponentProps<typeof ToolCallGroup>) =>
     </RecoilRoot>,
   );
 
+const mockScheduleMessageContentLayoutReconcile =
+  scheduleMessageContentLayoutReconcile as jest.Mock;
+
 describe('ToolCallGroup image hoisting', () => {
   const parts = [
     { part: makePart('t1'), idx: 0 },
@@ -113,6 +118,10 @@ describe('ToolCallGroup image hoisting', () => {
     ),
   } satisfies React.ComponentProps<typeof ToolCallGroup>;
 
+  beforeEach(() => {
+    mockScheduleMessageContentLayoutReconcile.mockClear();
+  });
+
   it('renders an AttachmentGroup outside the collapsible container with all attachments', () => {
     renderGroup({
       ...baseProps,
@@ -140,6 +149,70 @@ describe('ToolCallGroup image hoisting', () => {
     expect(screen.queryByTestId('attachment-group')).not.toBeInTheDocument();
   });
 
+  it('does not reconcile layout for an initially collapsed completed group', () => {
+    renderGroup(baseProps);
+    expect(mockScheduleMessageContentLayoutReconcile).not.toHaveBeenCalled();
+  });
+
+  it('does not render tool bodies for an initially collapsed large completed group', () => {
+    const largeParts = Array.from({ length: 59 }, (_, idx) => ({
+      part: makePart(`t${idx}`),
+      idx,
+    }));
+    const renderPart = jest.fn((_p: TMessageContentParts, idx: number) => (
+      <div data-testid={`inner-${idx}`} key={idx}>
+        {'inner'}
+      </div>
+    ));
+
+    renderGroup({
+      ...baseProps,
+      parts: largeParts,
+      lastContentIdx: largeParts.length - 1,
+      renderPart,
+    });
+
+    expect(screen.getByRole('button', { name: 'Used 59 tools' })).toBeInTheDocument();
+    expect(renderPart).not.toHaveBeenCalled();
+    expect(screen.queryByTestId('inner-0')).not.toBeInTheDocument();
+  });
+
+  it('mounts tool bodies when a collapsed group is expanded', () => {
+    renderGroup(baseProps);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Used 2 tools' }));
+
+    expect(screen.getByTestId('inner-0')).toBeInTheDocument();
+    expect(screen.getByTestId('inner-1')).toBeInTheDocument();
+  });
+
+  it('unmounts tool bodies after a collapsed group finishes transitioning', () => {
+    renderGroup(baseProps);
+
+    const button = screen.getByRole('button', { name: 'Used 2 tools' });
+    const collapsible = button.nextElementSibling as HTMLElement;
+    fireEvent.click(button);
+    fireEvent.click(button);
+    expect(screen.getByTestId('inner-0')).toBeInTheDocument();
+
+    fireEvent.transitionEnd(collapsible);
+
+    expect(screen.queryByTestId('inner-0')).not.toBeInTheDocument();
+  });
+
+  it('reconciles layout after the group collapses from an expanded state', async () => {
+    renderGroup(baseProps);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Used 2 tools' }));
+    expect(mockScheduleMessageContentLayoutReconcile).not.toHaveBeenCalled();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Used 2 tools' }));
+
+    await waitFor(() => {
+      expect(mockScheduleMessageContentLayoutReconcile).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it('renders the image AttachmentGroup as a sibling of the collapsible panel, not a child', () => {
     const { container } = renderGroup({
       ...baseProps,
diff --git a/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
index 6e472e3f49b..91d94998989 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
@@ -35,11 +35,11 @@ Object.defineProperty(HTMLElement.prototype, 'scrollTo', {
 
 describe('UIResourceCarousel', () => {
   const mockUIResources: UIResource[] = [
-    { uri: 'resource1', mimeType: 'text/html', text: 'Resource 1' },
-    { uri: 'resource2', mimeType: 'text/html', text: 'Resource 2' },
-    { uri: 'resource3', mimeType: 'text/html', text: 'Resource 3' },
-    { uri: 'resource4', mimeType: 'text/html', text: 'Resource 4' },
-    { uri: 'resource5', mimeType: 'text/html', text: 'Resource 5' },
+    { resourceId: 'resource1', uri: 'resource1', mimeType: 'text/html', text: 'Resource 1' },
+    { resourceId: 'resource2', uri: 'resource2', mimeType: 'text/html', text: 'Resource 2' },
+    { resourceId: 'resource3', uri: 'resource3', mimeType: 'text/html', text: 'Resource 3' },
+    { resourceId: 'resource4', uri: 'resource4', mimeType: 'text/html', text: 'Resource 4' },
+    { resourceId: 'resource5', uri: 'resource5', mimeType: 'text/html', text: 'Resource 5' },
   ];
 
   const mockHandleUIAction = handleUIAction as jest.MockedFunction<typeof handleUIAction>;
diff --git a/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
index e18ad58e49b..fc29f0391ba 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
@@ -205,13 +205,13 @@ describe('WebSearch', () => {
     });
   });
 
-  describe('processedSources scoping', () => {
-    it('shows processed sources only from ownTurn during streaming', () => {
+  describe('streaming favicons', () => {
+    it('renders favicons for all ownTurn sources during streaming, before they are processed', () => {
       const searchResults = makeSearchResults({
         0: {
           organic: [
             { link: 'https://a.com', title: 'A', processed: true } as ValidSource,
-            { link: 'https://b.com', title: 'B', processed: false } as ValidSource,
+            { link: 'https://b.com', title: 'B' } as ValidSource,
           ],
         },
         1: {
@@ -229,11 +229,27 @@ describe('WebSearch', () => {
         initialProgress: 0.5,
       });
 
-      const favicons = screen.queryAllByTestId('stacked-favicons');
-      if (favicons.length > 0) {
-        const count = Number(favicons[0].getAttribute('data-count'));
-        expect(count).toBeLessThanOrEqual(2);
-      }
+      const favicons = screen.getByTestId('stacked-favicons');
+      // Both turn-0 sources show immediately — including the unprocessed one —
+      // while the turn-1 source stays scoped out.
+      expect(Number(favicons.getAttribute('data-count'))).toBe(2);
+      expect(screen.getAllByText('Processing results').length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('stays on "Searching the web" until any source for the turn arrives', () => {
+      const searchResults = makeSearchResults({ 0: { organic: [] } });
+      const attachments = [makeAttachment(0, searchResults['0'])];
+
+      renderWebSearch({
+        searchResults,
+        attachments,
+        isSubmitting: true,
+        isLast: true,
+        initialProgress: 0.5,
+      });
+
+      expect(screen.queryByTestId('stacked-favicons')).not.toBeInTheDocument();
+      expect(screen.getAllByText('Searching the web').length).toBeGreaterThanOrEqual(1);
     });
   });
 
diff --git a/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts b/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts
new file mode 100644
index 00000000000..100a984f47c
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts
@@ -0,0 +1,168 @@
+import { splitMarkdownIntoBlocks } from '../splitMarkdown';
+
+const raws = (content: string) => splitMarkdownIntoBlocks(content).map((block) => block.raw);
+
+describe('splitMarkdownIntoBlocks', () => {
+  it('returns [] for empty content', () => {
+    expect(splitMarkdownIntoBlocks('')).toEqual([]);
+  });
+
+  it('returns a single block for one paragraph', () => {
+    expect(raws('Hello world.')).toEqual(['Hello world.']);
+  });
+
+  it('splits consecutive paragraphs into separate blocks', () => {
+    expect(raws('First.\n\nSecond.')).toEqual(['First.', 'Second.']);
+  });
+
+  it('keeps a GFM table as one atomic block', () => {
+    const table = '| a | b |\n| - | - |\n| 1 | 2 |';
+    const content = `Intro.\n\n${table}\n\nOutro.`;
+    expect(raws(content)).toEqual(['Intro.', table, 'Outro.']);
+  });
+
+  it('keeps a fenced code block (with internal blank lines) as one block', () => {
+    const code = '```js\nconst x = 1;\n\nconst y = 2;\n```';
+    const content = `Before.\n\n${code}\n\nAfter.`;
+    expect(raws(content)).toEqual(['Before.', code, 'After.']);
+  });
+
+  it('keeps a $$ math block as one block', () => {
+    const mathBlock = '$$\nE = mc^2\n$$';
+    const content = `Text.\n\n${mathBlock}\n\nMore.`;
+    expect(raws(content)).toEqual(['Text.', mathBlock, 'More.']);
+  });
+
+  it('keeps a :::artifact::: container (with inner blank lines) intact', () => {
+    const artifact = ':::artifact{title="t"}\nline one\n\nline two\n:::';
+    const content = `Lead.\n\n${artifact}\n\nTail.`;
+    expect(raws(content)).toEqual(['Lead.', artifact, 'Tail.']);
+  });
+
+  it('keeps a list as one block (does not split items)', () => {
+    const list = '- one\n- two\n- three';
+    expect(raws(list)).toEqual([list]);
+  });
+
+  it('does not split inline constructs across blocks (inline code/markers stay in their paragraph)', () => {
+    const para = 'Use `inline` code and \\ui{abc} markers here.';
+    expect(raws(para)).toEqual([para]);
+  });
+
+  it('each block re-parses to the same single block (idempotent boundaries)', () => {
+    const content = ['# Heading', '', 'A paragraph.', '', '```py\nprint(1)\n```'].join('\n');
+    const blocks = raws(content);
+    expect(blocks).toHaveLength(3);
+    for (const block of blocks) {
+      expect(raws(block)).toEqual([block]);
+    }
+  });
+
+  describe('index counts (mirror the code/artifact render decision)', () => {
+    it('counts a multi-line fenced code block as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```js\nconst x = 1;\nconst y = 2;\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a single-line block with a known language as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```bash\necho hi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a no-language single-line block as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```\necho hi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a single-line block with an unsupported language (renderer still renders a CodeBlock)', () => {
+      const [block] = splitMarkdownIntoBlocks('```madeuplang\nhi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('does NOT count math or mermaid fences', () => {
+      expect(splitMarkdownIntoBlocks('```math\nE=mc^2\n```')[0].codeBlockCount).toBe(0);
+      expect(splitMarkdownIntoBlocks('```mermaid\ngraph TD; A-->B;\n```')[0].codeBlockCount).toBe(
+        0,
+      );
+    });
+
+    it('does NOT count hyphenated math/mermaid languages (renderer normalizes them)', () => {
+      expect(
+        splitMarkdownIntoBlocks('```mermaid-js\ngraph TD; A-->B;\n```')[0].codeBlockCount,
+      ).toBe(0);
+      expect(splitMarkdownIntoBlocks('```math-tex\nE=mc^2\n```')[0].codeBlockCount).toBe(0);
+    });
+
+    it('does count a fence that merely starts with math/mermaid letters', () => {
+      expect(splitMarkdownIntoBlocks('```mathematica\nx\n```')[0].codeBlockCount).toBe(1);
+    });
+
+    it('counts an artifact container once and does not count code inside it', () => {
+      const artifact = ':::artifact{title="t"}\n```js\nconst x = 1;\nconst y = 2;\n```\n:::';
+      const [block] = splitMarkdownIntoBlocks(artifact);
+      expect(block.artifactCount).toBe(1);
+      expect(block.codeBlockCount).toBe(0);
+    });
+
+    it('counts leaf artifact directives, not just containers', () => {
+      expect(splitMarkdownIntoBlocks('::artifact{identifier="a" type="x"}')[0].artifactCount).toBe(
+        1,
+      );
+    });
+
+    it('does NOT count inline text artifact directives (the plugin rewrites them to text)', () => {
+      expect(splitMarkdownIntoBlocks('see :artifact{identifier="b"} inline')[0].artifactCount).toBe(
+        0,
+      );
+    });
+  });
+
+  describe('document-level definitions force single-block rendering', () => {
+    it('keeps a reference-style link and its definition in one block', () => {
+      const content = 'See [docs][d] for details.\n\n[d]: https://example.com/docs';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('keeps a footnote reference and its definition in one block', () => {
+      const content = 'Claim with a note.[^1]\n\n[^1]: the footnote text';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('forces single-block when a definition is nested in a blockquote', () => {
+      const content = 'See [docs][d].\n\n> [d]: https://example.com/docs';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('forces single-block when a definition is nested in a list item', () => {
+      const content = 'See [a][d].\n\n- item\n\n  [d]: https://example.com';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('still splits when no document-level definition is present', () => {
+      const blocks = splitMarkdownIntoBlocks('First paragraph.\n\nSecond paragraph.');
+      expect(blocks).toHaveLength(2);
+    });
+  });
+
+  describe('raw HTML blocks force single-block rendering', () => {
+    it('renders the whole message as one block for multiple top-level HTML blocks', () => {
+      const content = '<div>a</div>\n\n<div>b</div>';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('still splits when HTML is only inline within a paragraph', () => {
+      const blocks = splitMarkdownIntoBlocks('para with <br> inline.\n\nsecond para');
+      expect(blocks).toHaveLength(2);
+    });
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/markdownConfig.ts b/client/src/components/Chat/Messages/Content/markdownConfig.ts
new file mode 100644
index 00000000000..90ac6a70440
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/markdownConfig.ts
@@ -0,0 +1,80 @@
+import remarkGfm from 'remark-gfm';
+import remarkMath from 'remark-math';
+import supersub from 'remark-supersub';
+import rehypeKatex from 'rehype-katex';
+import rehypeHighlight from 'rehype-highlight';
+import remarkDirective from 'remark-directive';
+import type { PluggableList } from 'unified';
+import type { ElementType } from 'react';
+import {
+  mcpUIResourcePlugin,
+  MCPUIResource,
+  MCPUIResourceCarousel,
+} from '~/components/MCPUIResource';
+import { Citation, CompositeCitation, HighlightedText } from '~/components/Web/Citation';
+import { Artifact, artifactPlugin } from '~/components/Artifacts/Artifact';
+import { code, a, p, img, table } from './MarkdownComponents';
+import { langSubset, remarkApproxTilde } from '~/utils';
+import { unicodeCitation } from '~/components/Web';
+
+/**
+ * Single source of truth for the markdown rendering pipeline, shared by the
+ * whole-message renderer and the per-block memoized renderer so both produce
+ * identical output.
+ *
+ * These are exposed as lazily-initialized, cached getters rather than top-level
+ * consts on purpose: `MarkdownComponents` participates in a circular import
+ * (`MarkdownComponents` → `CodeBlock` → `Parts` → `Markdown` → here →
+ * `MarkdownComponents`). Reading `code`/`a`/… at module-evaluation time throws
+ * `Cannot access 'code' before initialization` under native ESM. Deferring the
+ * read to first call (render time) sidesteps the temporal dead zone, and caching
+ * keeps a stable reference so react-markdown does not rebuild its processor.
+ */
+let remarkPluginsCache: PluggableList | null = null;
+let rehypePluginsCache: PluggableList | null = null;
+let markdownComponentsCache: { [nodeType: string]: ElementType } | null = null;
+
+export const getRemarkPlugins = (): PluggableList => {
+  if (remarkPluginsCache === null) {
+    remarkPluginsCache = [
+      remarkApproxTilde,
+      supersub,
+      remarkGfm,
+      remarkDirective,
+      artifactPlugin,
+      [remarkMath, { singleDollarTextMath: false }],
+      unicodeCitation,
+      mcpUIResourcePlugin,
+    ];
+  }
+  return remarkPluginsCache;
+};
+
+export const getRehypePlugins = (): PluggableList => {
+  if (rehypePluginsCache === null) {
+    rehypePluginsCache = [
+      [rehypeKatex],
+      [rehypeHighlight, { detect: true, ignoreMissing: true, subset: langSubset }],
+    ];
+  }
+  return rehypePluginsCache;
+};
+
+export const getMarkdownComponents = (): { [nodeType: string]: ElementType } => {
+  if (markdownComponentsCache === null) {
+    markdownComponentsCache = {
+      code,
+      a,
+      p,
+      img,
+      table,
+      artifact: Artifact,
+      citation: Citation,
+      'highlighted-text': HighlightedText,
+      'composite-citation': CompositeCitation,
+      'mcp-ui-resource': MCPUIResource,
+      'mcp-ui-carousel': MCPUIResourceCarousel,
+    };
+  }
+  return markdownComponentsCache;
+};
diff --git a/client/src/components/Chat/Messages/Content/splitMarkdown.ts b/client/src/components/Chat/Messages/Content/splitMarkdown.ts
new file mode 100644
index 00000000000..1037839c6e4
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/splitMarkdown.ts
@@ -0,0 +1,157 @@
+import { gfm } from 'micromark-extension-gfm';
+import { math } from 'micromark-extension-math';
+import { gfmFromMarkdown } from 'mdast-util-gfm';
+import { mathFromMarkdown } from 'mdast-util-math';
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { directive } from 'micromark-extension-directive';
+import { directiveFromMarkdown } from 'mdast-util-directive';
+
+export type MarkdownBlock = {
+  /** Exact source slice for this top-level block. */
+  raw: string;
+  /** Executable code blocks within this block (those that render a runnable CodeBlock). */
+  codeBlockCount: number;
+  /** Artifact containers within this block. */
+  artifactCount: number;
+};
+
+type MdastNode = {
+  type: string;
+  name?: string;
+  lang?: string | null;
+  value?: string;
+  children?: MdastNode[];
+  position?: { start?: { offset?: number }; end?: { offset?: number } };
+};
+
+/**
+ * Mirror the `code` component's decision for whether a fenced block renders as a
+ * runnable CodeBlock (and therefore consumes a block index). Every fenced code
+ * block does, except `math` and `mermaid` fences, which have dedicated
+ * renderers. mdast strips a fenced block's trailing newline, but
+ * react-markdown/remark-rehype re-add it, so the `code` component never treats a
+ * fenced block as single-line inline code regardless of its language — only true
+ * inline code (an `inlineCode` node, not counted here) is.
+ */
+const renderedCodeLang = (lang: string): string =>
+  /language-(\w+)/.exec(`language-${lang}`)?.[1] ?? '';
+
+/**
+ * Normalize the fence info string the same way the `code` component does — it
+ * reads the language from `className` via `/language-(\w+)/`, so only the leading
+ * word characters survive (`mermaid-js` → `mermaid`, `math-tex` → `math`). A
+ * fence is executable (consumes a CodeBlock index) unless it normalizes to
+ * `math` or `mermaid`, which have dedicated renderers.
+ */
+const isExecutableCode = (lang: string): boolean => {
+  const normalized = renderedCodeLang(lang);
+  return normalized !== 'math' && normalized !== 'mermaid';
+};
+
+const containsDefinition = (node: MdastNode): boolean => {
+  if (node.type === 'definition' || node.type === 'footnoteDefinition') {
+    return true;
+  }
+  return (node.children ?? []).some(containsDefinition);
+};
+
+const ARTIFACT_DIRECTIVE_TYPES = new Set(['containerDirective', 'leafDirective']);
+
+const countWithin = (node: MdastNode, counts: { code: number; artifact: number }): void => {
+  if (ARTIFACT_DIRECTIVE_TYPES.has(node.type) && node.name === 'artifact') {
+    // artifactPlugin renders container (`:::artifact:::`) and leaf
+    // (`::artifact{}`) artifact directives as an Artifact, each consuming one
+    // index; their children never render as executable code blocks, so stop
+    // descending. Inline text directives (`:artifact{}`) are intentionally
+    // excluded — the plugin rewrites every textDirective to literal text, so no
+    // Artifact renders and no index is consumed.
+    counts.artifact += 1;
+    return;
+  }
+  if (node.type === 'code' && isExecutableCode(node.lang ?? '')) {
+    counts.code += 1;
+  }
+  if (node.children) {
+    for (const child of node.children) {
+      countWithin(child, counts);
+    }
+  }
+};
+
+/**
+ * Parse markdown into an mdast tree using the same structural constructs the
+ * render pipeline relies on (GFM tables, container directives like
+ * `:::artifact:::`, and `$$` math), so top-level block boundaries match what
+ * react-markdown produces. Inline-only transforms (citations, MCP-UI markers,
+ * supersub) never cross a top-level block, so they are intentionally omitted.
+ */
+const parseToMdast = (content: string): MdastNode =>
+  fromMarkdown(content, {
+    extensions: [gfm(), directive(), math()],
+    mdastExtensions: [gfmFromMarkdown(), directiveFromMarkdown(), mathFromMarkdown()],
+  }) as MdastNode;
+
+/**
+ * Split a markdown string into its top-level blocks, returning the exact source
+ * slice for each block plus the index counts it consumes. Completed blocks
+ * produce byte-identical slices (and stable counts) across streamed updates,
+ * which is what makes per-block memoization effective: only the final, still-
+ * growing block changes from one token to the next.
+ *
+ * Inter-block whitespace (blank lines) is not part of any node's span and is
+ * dropped; block-level elements carry their own margins, so rendering each
+ * slice independently is visually equivalent to rendering the whole string.
+ */
+export function splitMarkdownIntoBlocks(content: string): MarkdownBlock[] {
+  if (!content) {
+    return [];
+  }
+
+  const tree = parseToMdast(content);
+  const children = tree.children ?? [];
+
+  if (children.length === 0) {
+    return [{ raw: content, codeBlockCount: 0, artifactCount: 0 }];
+  }
+
+  // Per-block rendering loses document-global context, so render the whole
+  // message as one block when it uses a construct that needs it:
+  //  - reference/footnote definitions are document-scoped (and may be nested in
+  //    a blockquote or list item), so a reference would otherwise render as
+  //    literal text once severed from its definition; and
+  //  - top-level raw HTML blocks are escaped to text (rehypeRaw is not enabled),
+  //    so the separator between adjacent HTML blocks would otherwise be dropped.
+  const requiresWholeMessage = children.some(
+    (node) => node.type === 'html' || containsDefinition(node),
+  );
+  if (requiresWholeMessage) {
+    return [{ raw: content, ...blockCounts(children) }];
+  }
+
+  const blocks: MarkdownBlock[] = [];
+
+  for (const node of children) {
+    const start = node.position?.start?.offset;
+    const end = node.position?.end?.offset;
+    if (start == null || end == null) {
+      return [{ raw: content, ...blockCounts(children) }];
+    }
+    const counts = { code: 0, artifact: 0 };
+    countWithin(node, counts);
+    blocks.push({
+      raw: content.slice(start, end),
+      codeBlockCount: counts.code,
+      artifactCount: counts.artifact,
+    });
+  }
+
+  return blocks;
+}
+
+const blockCounts = (children: MdastNode[]): { codeBlockCount: number; artifactCount: number } => {
+  const counts = { code: 0, artifact: 0 };
+  for (const node of children) {
+    countWithin(node, counts);
+  }
+  return { codeBlockCount: counts.code, artifactCount: counts.artifact };
+};
diff --git a/client/src/components/Chat/Messages/Feedback.tsx b/client/src/components/Chat/Messages/Feedback.tsx
index eea1464e66f..9bc10c19270 100644
--- a/client/src/components/Chat/Messages/Feedback.tsx
+++ b/client/src/components/Chat/Messages/Feedback.tsx
@@ -1,14 +1,6 @@
 import React, { useState, useCallback, useMemo, useEffect } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { TFeedback, TFeedbackTag, getTagsForRating } from 'librechat-data-provider';
-import {
-  Button,
-  OGDialog,
-  OGDialogContent,
-  OGDialogTitle,
-  ThumbUpIcon,
-  ThumbDownIcon,
-} from '@librechat/client';
 import {
   AlertCircle,
   PenTool,
@@ -19,6 +11,14 @@ import {
   Lightbulb,
   Search,
 } from 'lucide-react';
+import {
+  Button,
+  OGDialog,
+  OGDialogContent,
+  OGDialogTitle,
+  ThumbUpIcon,
+  ThumbDownIcon,
+} from '@librechat/client';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -218,8 +218,9 @@ function buttonClasses(isActive: boolean, isLast: boolean) {
   return cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-    !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+    !isLast &&
+      'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
     isActive && 'active text-text-primary bg-surface-hover',
   );
diff --git a/client/src/components/Chat/Messages/Fork.tsx b/client/src/components/Chat/Messages/Fork.tsx
index ca03533ea29..1c4e79d4b5c 100644
--- a/client/src/components/Chat/Messages/Fork.tsx
+++ b/client/src/components/Chat/Messages/Fork.tsx
@@ -229,8 +229,9 @@ export default function Fork({
   const buttonStyle = cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-    !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+    !isLast &&
+      'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
     isActive && 'active text-text-primary bg-surface-hover',
   );
diff --git a/client/src/components/Chat/Messages/HoverButtons.tsx b/client/src/components/Chat/Messages/HoverButtons.tsx
index 180e8b599e1..f1d41fa6d63 100644
--- a/client/src/components/Chat/Messages/HoverButtons.tsx
+++ b/client/src/components/Chat/Messages/HoverButtons.tsx
@@ -1,7 +1,7 @@
 import React, { useState, useMemo, memo } from 'react';
 import { useRecoilState } from 'recoil';
-import type { TConversation, TMessage, TFeedback } from 'librechat-data-provider';
 import { EditIcon, Clipboard, CheckMark, ContinueIcon, RegenerateIcon } from '@librechat/client';
+import type { TConversation, TMessage, TFeedback } from 'librechat-data-provider';
 import { useGenerationsByLatest, useLocalize } from '~/hooks';
 import { Fork } from '~/components/Conversations';
 import MessageAudio from './MessageAudio';
@@ -35,6 +35,7 @@ type HoverButtonProps = {
   isLast?: boolean;
   className?: string;
   buttonStyle?: string;
+  dataTestId?: string;
 };
 
 const extractMessageContent = (message: TMessage): string => {
@@ -80,12 +81,14 @@ const HoverButton = memo(
     isDisabled = false,
     isLast = false,
     className = '',
+    dataTestId,
   }: HoverButtonProps) => {
     const buttonStyle = cn(
       'hover-button rounded-lg p-1.5 text-text-secondary-alt',
       'hover:text-text-primary hover:bg-surface-hover',
-      'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-      !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+      'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+      !isLast &&
+        'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
       !isVisible && 'opacity-0',
       'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
       isActive && isVisible && 'active text-text-primary bg-surface-hover',
@@ -95,6 +98,7 @@ const HoverButton = memo(
     return (
       <button
         id={id}
+        data-testid={dataTestId}
         className={buttonStyle}
         onClick={onClick}
         type="button"
@@ -169,6 +173,7 @@ const HoverButtons = ({
             title={localize('com_ui_regenerate')}
             icon={<RegenerateIcon size="19" />}
             isLast={isLast}
+            dataTestId={isLast ? 'regenerate-generation-button' : undefined}
           />
         )}
       </div>
@@ -200,6 +205,7 @@ const HoverButtons = ({
               icon={props.icon}
               isActive={props.isActive}
               isLast={isLast}
+              dataTestId={isLast && !isCreatedByUser ? 'read-aloud-button' : undefined}
             />
           )}
         />
@@ -215,8 +221,11 @@ const HoverButtons = ({
         isLast={isLast}
         className={cn(
           'ml-0 flex items-center gap-1.5 text-xs',
-          isSubmitting && isCreatedByUser ? 'md:opacity-0 md:group-hover:opacity-100' : '',
+          isSubmitting && isCreatedByUser
+            ? 'group-hover:opacity-100 [@media(hover:hover)]:opacity-0'
+            : '',
         )}
+        dataTestId={!isCreatedByUser ? 'copy-response-button' : undefined}
       />
 
       {/* Edit Button */}
@@ -255,6 +264,7 @@ const HoverButtons = ({
           title={localize('com_ui_regenerate')}
           icon={<RegenerateIcon size="19" />}
           isLast={isLast}
+          dataTestId={isLast ? 'regenerate-generation-button' : undefined}
           className="active"
         />
       )}
@@ -266,6 +276,7 @@ const HoverButtons = ({
           title={localize('com_ui_continue')}
           icon={<ContinueIcon className="w-19 h-19 -rotate-180" />}
           isLast={isLast}
+          dataTestId={isLast ? 'continue-generation-button' : undefined}
           className="active"
         />
       )}
diff --git a/client/src/components/Chat/Messages/MessageIcon.tsx b/client/src/components/Chat/Messages/MessageIcon.tsx
index 1c4401c3384..0e4d1f4ffc2 100644
--- a/client/src/components/Chat/Messages/MessageIcon.tsx
+++ b/client/src/components/Chat/Messages/MessageIcon.tsx
@@ -5,6 +5,7 @@ import type { TMessageIcon } from '~/common';
 import ConvoIconURL from '~/components/Endpoints/ConvoIconURL';
 import { useGetEndpointsQuery } from '~/data-provider';
 import { getIconEndpoint } from '~/utils';
+import { isImageURL } from '~/utils/icons';
 import Icon from '~/components/Endpoints/Icon';
 
 type MessageIconProps = {
@@ -64,7 +65,7 @@ const MessageIcon = memo(({ iconData, assistant, agent }: MessageIconProps) => {
     [endpointsConfig, endpoint],
   );
 
-  if (iconData?.isCreatedByUser !== true && iconURL != null && iconURL.includes('http')) {
+  if (iconData?.isCreatedByUser !== true && isImageURL(iconURL)) {
     return (
       <ConvoIconURL
         iconURL={iconURL}
diff --git a/client/src/components/Chat/Messages/MessageNav.tsx b/client/src/components/Chat/Messages/MessageNav.tsx
index 9ef79197ce7..fd96ab9d5dc 100644
--- a/client/src/components/Chat/Messages/MessageNav.tsx
+++ b/client/src/components/Chat/Messages/MessageNav.tsx
@@ -3,8 +3,8 @@ import { ChevronUp, ChevronDown } from 'lucide-react';
 import { ContentTypes } from 'librechat-data-provider';
 import { HoverCard, HoverCardTrigger, HoverCardPortal, HoverCardContent } from '@librechat/client';
 import type { TMessage, TMessageContentParts } from 'librechat-data-provider';
+import { useMessagesConversation, useMessagesSubmission } from '~/Providers';
 import { useGetMessagesByConvoId } from '~/data-provider';
-import { useMessagesConversation } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -12,14 +12,17 @@ type MessageEntry = {
   id: string;
   isUser: boolean;
   preview: string;
+  isEnd?: boolean;
 };
 
+const MESSAGES_END_ID = 'messages-end';
+
 function extractPreviewFromContent(content?: TMessageContentParts[]): string {
   if (!content) {
     return '';
   }
   for (const part of content) {
-    if (part.type !== ContentTypes.TEXT) {
+    if (part?.type !== ContentTypes.TEXT) {
       continue;
     }
     const textField = part.text;
@@ -67,12 +70,16 @@ function getMessageEntries(root: ParentNode, messagesById: Map<string, TMessage>
     const msg = messagesById.get(id);
     entries.push(msg ? buildEntry(id, msg) : buildFallbackEntry(node, id));
   }
+  if (entries.length > 0 && root.querySelector('#' + MESSAGES_END_ID)) {
+    entries.push({ id: MESSAGES_END_ID, isUser: false, preview: '', isEnd: true });
+  }
   return entries;
 }
 
 const JUMP_EPS = 4;
 const SCROLL_DURATION = 400;
 const BOTTOM_SNAP_RETRIES = 2;
+const DRAG_THRESHOLD = 4;
 
 function easeOutCubic(t: number): number {
   return 1 - Math.pow(1 - t, 3);
@@ -86,6 +93,18 @@ function readScrollMargin(el: HTMLElement | null): number {
   return Number.isFinite(value) ? value : 0;
 }
 
+function computeTargetScroll(
+  container: HTMLElement,
+  el: HTMLElement,
+  scrollMargin: number,
+): number {
+  const cRect = container.getBoundingClientRect();
+  const elRect = el.getBoundingClientRect();
+  const target = container.scrollTop + (elRect.top - cRect.top) - scrollMargin;
+  const max = container.scrollHeight - container.clientHeight;
+  return Math.max(0, Math.min(target, max));
+}
+
 const indicatorButtonClasses = cn(
   'flex h-[5px] items-center justify-center rounded-sm',
   'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
@@ -96,12 +115,14 @@ const MessageIndicator = memo(function MessageIndicator({
   isActive,
   isCurrent,
   label,
+  hoverText,
   onSelect,
 }: {
   entry: MessageEntry;
   isActive: boolean;
   isCurrent: boolean;
   label: string;
+  hoverText: string;
   onSelect: (id: string) => void;
 }) {
   return (
@@ -110,24 +131,35 @@ const MessageIndicator = memo(function MessageIndicator({
         <button
           type="button"
           onClick={() => onSelect(entry.id)}
-          className={cn(indicatorButtonClasses, entry.isUser ? 'w-4' : 'w-6')}
+          className={cn(indicatorButtonClasses, entry.isEnd || !entry.isUser ? 'w-6' : 'w-4')}
           aria-label={label}
           aria-current={isCurrent ? 'true' : undefined}
           data-msg-id={entry.id}
         >
-          <span
-            className={cn(
-              'block w-full rounded-full transition-all duration-200',
-              isActive
-                ? 'h-[5px] bg-gray-800 dark:bg-gray-100'
-                : 'h-[3px] bg-gray-400 dark:bg-gray-500',
-            )}
-          />
+          {entry.isEnd ? (
+            <span
+              className={cn(
+                'block rounded-full transition-all duration-200',
+                isActive
+                  ? 'h-1.5 w-1.5 bg-gray-800 dark:bg-gray-100'
+                  : 'h-1 w-1 bg-gray-400 dark:bg-gray-500',
+              )}
+            />
+          ) : (
+            <span
+              className={cn(
+                'block w-full rounded-full transition-all duration-200',
+                isActive
+                  ? 'h-[5px] bg-gray-800 dark:bg-gray-100'
+                  : 'h-[3px] bg-gray-400 dark:bg-gray-500',
+              )}
+            />
+          )}
         </button>
       </HoverCardTrigger>
       <HoverCardPortal>
         <HoverCardContent side="left" sideOffset={12} className="z-[999] max-w-[280px] px-3 py-2">
-          <p className="line-clamp-3 text-xs text-text-secondary">{entry.preview}</p>
+          <p className="line-clamp-3 text-xs text-text-secondary">{hoverText}</p>
         </HoverCardContent>
       </HoverCardPortal>
     </HoverCard>
@@ -145,9 +177,14 @@ const chevronButtonClasses = cn(
 function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivElement> }) {
   const localize = useLocalize();
   const { conversationId } = useMessagesConversation();
-  const { data: messages } = useGetMessagesByConvoId(conversationId ?? '', {
-    enabled: !!conversationId,
-  });
+  const { isSubmitting } = useMessagesSubmission();
+  const { data: messages } = useGetMessagesByConvoId(
+    conversationId ?? '',
+    {
+      enabled: !!conversationId,
+    },
+    { isStreaming: isSubmitting },
+  );
   const messagesById = useMemo(() => {
     const map = new Map<string, TMessage>();
     if (messages) {
@@ -175,6 +212,9 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
   const messagesByIdRef = useRef(messagesById);
   const scrollTokenRef = useRef(0);
   const scrollMarginRef = useRef(0);
+  const navRef = useRef<HTMLElement>(null);
+  const dragCleanupRef = useRef<(() => void) | null>(null);
+  const suppressClickRef = useRef(false);
 
   const getCurrentVisibleId = useCallback((): string | null => {
     let nextId: string | null = null;
@@ -217,43 +257,193 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
     refreshEntries();
   }, [messagesById, refreshEntries]);
 
-  const scrollToStart = useCallback((id: string) => {
+  const resolveEntryEl = useCallback(
+    (id: string): HTMLElement | null => {
+      if (id === MESSAGES_END_ID) {
+        return scrollableRef.current?.querySelector<HTMLElement>('#' + MESSAGES_END_ID) ?? null;
+      }
+      return document.getElementById(id);
+    },
+    [scrollableRef],
+  );
+
+  const scrollToStart = useCallback(
+    (id: string) => {
+      const el = resolveEntryEl(id);
+      if (!el) {
+        return;
+      }
+      const container = el.closest<HTMLElement>('.scrollbar-gutter-stable');
+      if (!container) {
+        el.scrollIntoView({ behavior: 'smooth', block: 'start' });
+        return;
+      }
+      const token = ++scrollTokenRef.current;
+      const scrollMargin = scrollMarginRef.current || readScrollMargin(el);
+      const startScroll = container.scrollTop;
+      const start = performance.now();
+
+      const step = (now: number) => {
+        if (token !== scrollTokenRef.current) {
+          return;
+        }
+        const progress = Math.min(1, (now - start) / SCROLL_DURATION);
+        const current = resolveEntryEl(id);
+        if (!current) {
+          return;
+        }
+        const clamped = computeTargetScroll(container, current, scrollMargin);
+        container.scrollTop = startScroll + (clamped - startScroll) * easeOutCubic(progress);
+        if (progress < 1) {
+          requestAnimationFrame(step);
+        }
+      };
+
+      requestAnimationFrame(step);
+    },
+    [resolveEntryEl],
+  );
+
+  const scrollToImmediate = useCallback(
+    (id: string) => {
+      const el = resolveEntryEl(id);
+      if (!el) {
+        return;
+      }
+      const container = el.closest<HTMLElement>('.scrollbar-gutter-stable');
+      if (!container) {
+        return;
+      }
+      scrollTokenRef.current++;
+      const scrollMargin = scrollMarginRef.current || readScrollMargin(el);
+      container.scrollTop = computeTargetScroll(container, el, scrollMargin);
+    },
+    [resolveEntryEl],
+  );
+
+  const focusMessage = useCallback((id: string) => {
     const el = document.getElementById(id);
     if (!el) {
       return;
     }
-    const container = el.closest<HTMLElement>('.scrollbar-gutter-stable');
-    if (!container) {
-      el.scrollIntoView({ behavior: 'smooth', block: 'start' });
-      return;
+    if (!el.hasAttribute('tabindex')) {
+      el.setAttribute('tabindex', '-1');
+    }
+    el.focus({ preventScroll: true });
+  }, []);
+
+  const handleSelect = useCallback(
+    (id: string) => {
+      if (suppressClickRef.current) {
+        suppressClickRef.current = false;
+        return;
+      }
+      scrollToStart(id);
+      if (id !== MESSAGES_END_ID) {
+        focusMessage(id);
+      }
+    },
+    [scrollToStart, focusMessage],
+  );
+
+  const focusNav = useCallback((): boolean => {
+    const nav = navRef.current;
+    if (!nav) {
+      return false;
+    }
+    const target =
+      nav.querySelector<HTMLElement>('[aria-current="true"]') ??
+      nav.querySelector<HTMLElement>('[data-msg-id]');
+    if (!target) {
+      return false;
     }
-    const token = ++scrollTokenRef.current;
-    const scrollMargin = scrollMarginRef.current || readScrollMargin(el);
-    const startScroll = container.scrollTop;
-    const start = performance.now();
+    target.focus();
+    return document.activeElement === target;
+  }, []);
 
-    const step = (now: number) => {
-      if (token !== scrollTokenRef.current) {
+  const scrubTo = useCallback(
+    (clientY: number) => {
+      const col = columnRef.current;
+      if (!col) {
         return;
       }
-      const progress = Math.min(1, (now - start) / SCROLL_DURATION);
-      const current = document.getElementById(id);
-      if (!current) {
+      const ribs = col.querySelectorAll<HTMLElement>('[data-msg-id]');
+      const count = ribs.length;
+      if (count === 0) {
         return;
       }
-      const cRect = container.getBoundingClientRect();
-      const elRect = current.getBoundingClientRect();
-      const targetScroll = container.scrollTop + (elRect.top - cRect.top) - scrollMargin;
-      const max = container.scrollHeight - container.clientHeight;
-      const clamped = Math.max(0, Math.min(targetScroll, max));
-      container.scrollTop = startScroll + (clamped - startScroll) * easeOutCubic(progress);
-      if (progress < 1) {
-        requestAnimationFrame(step);
+      const rect = col.getBoundingClientRect();
+      const fraction = rect.height > 0 ? (clientY - rect.top) / rect.height : 0;
+      const index = Math.max(0, Math.min(count - 1, Math.round(fraction * (count - 1))));
+      const id = ribs[index].getAttribute('data-msg-id');
+      if (id) {
+        scrollToImmediate(id);
       }
-    };
+    },
+    [scrollToImmediate],
+  );
 
-    requestAnimationFrame(step);
-  }, []);
+  const handlePointerDown = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      if (e.button !== 0) {
+        return;
+      }
+      dragCleanupRef.current?.();
+      suppressClickRef.current = false;
+      const state = { pointerId: e.pointerId, startY: e.clientY, dragging: false };
+
+      const finish = (wasDragging: boolean) => {
+        document.removeEventListener('pointermove', onMove);
+        document.removeEventListener('pointerup', onUp);
+        document.removeEventListener('pointercancel', onUp);
+        window.removeEventListener('blur', onBlur);
+        dragCleanupRef.current = null;
+        if (wasDragging) {
+          suppressClickRef.current = true;
+          window.setTimeout(() => {
+            suppressClickRef.current = false;
+          }, 0);
+        }
+      };
+
+      function onMove(ev: PointerEvent) {
+        if (ev.pointerId !== state.pointerId) {
+          return;
+        }
+        if ((ev.buttons & 1) === 0) {
+          finish(state.dragging);
+          return;
+        }
+        if (!state.dragging) {
+          if (Math.abs(ev.clientY - state.startY) < DRAG_THRESHOLD) {
+            return;
+          }
+          state.dragging = true;
+        }
+        scrubTo(ev.clientY);
+      }
+
+      function onUp(ev: PointerEvent) {
+        if (ev.pointerId !== state.pointerId) {
+          return;
+        }
+        finish(state.dragging);
+      }
+
+      function onBlur() {
+        finish(state.dragging);
+      }
+
+      dragCleanupRef.current = () => finish(state.dragging);
+      document.addEventListener('pointermove', onMove);
+      document.addEventListener('pointerup', onUp);
+      document.addEventListener('pointercancel', onUp);
+      window.addEventListener('blur', onBlur);
+    },
+    [scrubTo],
+  );
+
+  useEffect(() => () => dragCleanupRef.current?.(), []);
 
   useEffect(() => {
     refreshEntries();
@@ -326,7 +516,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
     const offsetsBottom: number[] = new Array(entries.length);
     const recomputeOffsets = () => {
       for (let i = 0; i < entries.length; i++) {
-        const el = document.getElementById(entries[i].id);
+        const el = resolveEntryEl(entries[i].id);
         offsetsTop[i] = el ? el.offsetTop : Number.POSITIVE_INFINITY;
         offsetsBottom[i] = el ? el.offsetTop + el.offsetHeight : Number.POSITIVE_INFINITY;
       }
@@ -382,10 +572,11 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       }
 
       const scrollTop = container.scrollTop;
+      const containerMaxScrollTop = Math.max(0, container.scrollHeight - container.clientHeight);
       let nextCanUp = false;
       let nextCanDown = false;
       for (let i = 0; i < offsetsTop.length; i++) {
-        const snap = offsetsTop[i] - scrollMargin;
+        const snap = Math.min(offsetsTop[i] - scrollMargin, containerMaxScrollTop);
         if (snap < scrollTop - JUMP_EPS) {
           nextCanUp = true;
         } else if (snap > scrollTop + JUMP_EPS) {
@@ -400,7 +591,6 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       if (!col) {
         return;
       }
-      const containerMaxScrollTop = Math.max(0, container.scrollHeight - container.clientHeight);
       if (containerMaxScrollTop > 0 && scrollTop >= containerMaxScrollTop - JUMP_EPS) {
         scheduleColumnBottomScroll();
         return;
@@ -465,7 +655,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       cancelColumnBottomScroll();
       resizeObserver.disconnect();
     };
-  }, [entries, scrollableRef]);
+  }, [entries, scrollableRef, resolveEntryEl]);
 
   useEffect(() => {
     const root = scrollableRef.current;
@@ -538,7 +728,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
     const elementByNewId = new Map<HTMLElement, string>();
     for (let i = 0; i < entries.length; i++) {
       const id = entries[i].id;
-      const el = document.getElementById(id);
+      const el = resolveEntryEl(id);
       if (el) {
         elementByNewId.set(el, id);
       }
@@ -576,7 +766,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       setCurrentId(getCurrentVisibleId());
       setVisibleIds(new Set(visibleSet));
     }
-  }, [entries, getCurrentVisibleId]);
+  }, [entries, getCurrentVisibleId, resolveEntryEl]);
 
   const jumpToPrevious = useCallback(() => {
     const container = scrollableRef.current;
@@ -589,7 +779,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
         ? scrollMarginRef.current
         : readScrollMargin(document.getElementById(entries[0].id));
     for (let i = entries.length - 1; i >= 0; i--) {
-      const el = document.getElementById(entries[i].id);
+      const el = resolveEntryEl(entries[i].id);
       if (!el) {
         continue;
       }
@@ -599,7 +789,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       }
     }
     container.scrollTo({ top: 0, behavior: 'smooth' });
-  }, [entries, scrollableRef, scrollToStart]);
+  }, [entries, scrollableRef, scrollToStart, resolveEntryEl]);
 
   const jumpToNext = useCallback(() => {
     const container = scrollableRef.current;
@@ -612,7 +802,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
         ? scrollMarginRef.current
         : readScrollMargin(document.getElementById(entries[0].id));
     for (let i = 0; i < entries.length; i++) {
-      const el = document.getElementById(entries[i].id);
+      const el = resolveEntryEl(entries[i].id);
       if (!el) {
         continue;
       }
@@ -621,15 +811,31 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
         return;
       }
     }
-  }, [entries, scrollableRef, scrollToStart]);
+  }, [entries, scrollableRef, scrollToStart, resolveEntryEl]);
+
+  useEffect(() => {
+    const onKeyDown = (e: KeyboardEvent) => {
+      if (e.altKey && e.shiftKey && (e.code === 'KeyM' || e.key.toLowerCase() === 'm')) {
+        if (focusNav()) {
+          e.preventDefault();
+        }
+      }
+    };
+    document.addEventListener('keydown', onKeyDown);
+    return () => document.removeEventListener('keydown', onKeyDown);
+  }, [focusNav]);
 
-  if (entries.length < 3) {
+  const hasEnd = entries.length > 0 && entries[entries.length - 1].isEnd === true;
+  const messageCount = hasEnd ? entries.length - 1 : entries.length;
+  if (messageCount < 3) {
     return null;
   }
 
   return (
     <nav
+      ref={navRef}
       aria-label={localize('com_ui_message_nav')}
+      aria-keyshortcuts="Shift+Alt+M"
       className={cn(
         'group/nav absolute right-2 top-1/2 z-40 hidden max-h-[min(24rem,calc(100%-2rem))]',
         '-translate-y-1/2 flex-col items-center gap-1.5 rounded-full px-1 py-2 md:flex',
@@ -650,22 +856,31 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
 
       <div
         ref={columnRef}
-        className="flex min-h-0 flex-col items-center gap-1.5 overflow-y-auto [&::-webkit-scrollbar]:hidden"
+        onPointerDown={handlePointerDown}
+        className="flex min-h-0 cursor-grab touch-none select-none flex-col items-center gap-1.5 overflow-y-auto active:cursor-grabbing [&::-webkit-scrollbar]:hidden"
         style={{ scrollbarWidth: 'none', msOverflowStyle: 'none' }}
       >
-        {entries.map((entry) => (
-          <MessageIndicator
-            key={entry.id}
-            entry={entry}
-            isActive={visibleIds.has(entry.id)}
-            isCurrent={currentId === entry.id}
-            onSelect={scrollToStart}
-            label={localize(
-              entry.isUser ? 'com_ui_message_nav_go_to_user' : 'com_ui_message_nav_go_to_assistant',
-              { 0: entry.preview.slice(0, 30) },
-            )}
-          />
-        ))}
+        {entries.map((entry) => {
+          const label = entry.isEnd
+            ? localize('com_ui_scroll_to_bottom')
+            : localize(
+                entry.isUser
+                  ? 'com_ui_message_nav_go_to_user'
+                  : 'com_ui_message_nav_go_to_assistant',
+                { 0: entry.preview.slice(0, 30) },
+              );
+          return (
+            <MessageIndicator
+              key={entry.id}
+              entry={entry}
+              isActive={visibleIds.has(entry.id)}
+              isCurrent={currentId === entry.id}
+              onSelect={handleSelect}
+              label={label}
+              hoverText={entry.isEnd ? label : entry.preview}
+            />
+          );
+        })}
       </div>
 
       <button
diff --git a/client/src/components/Chat/Messages/MessageParts.tsx b/client/src/components/Chat/Messages/MessageParts.tsx
index ff6b01b2ddb..c4b5930214e 100644
--- a/client/src/components/Chat/Messages/MessageParts.tsx
+++ b/client/src/components/Chat/Messages/MessageParts.tsx
@@ -5,6 +5,7 @@ import type { TMessageContentParts } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon } from '~/common';
 import { useMessageHelpers, useLocalize, useAttachments, useContentMetadata } from '~/hooks';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import MessageIcon from '~/components/Chat/Messages/MessageIcon';
 import ContentParts from './Content/ContentParts';
 import { fontSizeAtom } from '~/store/fontSize';
@@ -107,7 +108,12 @@ export default function Message(props: TMessageProps) {
           <div
             id={messageId ?? ''}
             aria-label={getMessageAriaLabel(message, localize)}
-            className={cn(baseClasses.common, baseClasses.chat, 'message-render')}
+            className={cn(
+              baseClasses.common,
+              baseClasses.chat,
+              'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
+              'message-render',
+            )}
           >
             {!hasParallelContent && (
               <div className="relative flex flex-shrink-0 flex-col items-center">
@@ -129,6 +135,7 @@ export default function Message(props: TMessageProps) {
                     {getHeaderPrefixForScreenReader(message, localize)}
                   </span>
                   {name}
+                  <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
                 </h2>
               )}
               <div className="flex flex-col gap-1">
diff --git a/client/src/components/Chat/Messages/MessagesView.tsx b/client/src/components/Chat/Messages/MessagesView.tsx
index 9c59cab292e..0e2166b028a 100644
--- a/client/src/components/Chat/Messages/MessagesView.tsx
+++ b/client/src/components/Chat/Messages/MessagesView.tsx
@@ -26,6 +26,7 @@ function MessagesViewContent({
 
   const {
     conversation,
+    contentRef,
     scrollableRef,
     messagesEndRef,
     showScrollButton,
@@ -49,7 +50,7 @@ function MessagesViewContent({
               width: '100%',
             }}
           >
-            <div className="flex flex-col pb-9 pt-14 dark:bg-transparent">
+            <div ref={contentRef} className="flex flex-col pb-9 pt-14 dark:bg-transparent">
               {(_messagesTree && _messagesTree.length == 0) || _messagesTree === null ? (
                 <div
                   className={cn(
diff --git a/client/src/components/Chat/Messages/MinimalHoverButtons.tsx b/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
index b10e38d0314..4de428dc47d 100644
--- a/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
+++ b/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
@@ -1,6 +1,6 @@
 import { useState } from 'react';
 import { Clipboard, CheckMark } from '@librechat/client';
-import type { TMessage, TAttachment, SearchResultData } from 'librechat-data-provider';
+import type { TMessage, SearchResultData } from 'librechat-data-provider';
 import { useLocalize, useCopyToClipboard } from '~/hooks';
 
 type THoverButtons = {
@@ -20,7 +20,7 @@ export default function MinimalHoverButtons({ message, searchResults }: THoverBu
   return (
     <div className="visible mt-1 flex justify-center gap-1 self-end text-gray-400 lg:justify-start">
       <button
-        className="ml-0 flex items-center gap-1.5 rounded-lg p-1.5 text-xs text-text-secondary-alt transition-colors duration-200 hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white md:opacity-0 md:group-focus-within:opacity-100 md:group-hover:opacity-100"
+        className="ml-0 flex items-center gap-1.5 rounded-lg p-1.5 text-xs text-text-secondary-alt transition-colors duration-200 hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-black group-focus-within:opacity-100 group-hover:opacity-100 dark:focus-visible:ring-white [@media(hover:hover)]:opacity-0"
         onClick={() => copyToClipboard(setIsCopied)}
         type="button"
         title={
diff --git a/client/src/components/Chat/Messages/SearchButtons.tsx b/client/src/components/Chat/Messages/SearchButtons.tsx
index 0b2a5d8895a..03574946c7f 100644
--- a/client/src/components/Chat/Messages/SearchButtons.tsx
+++ b/client/src/components/Chat/Messages/SearchButtons.tsx
@@ -45,7 +45,6 @@ export default function SearchButtons({ message }: { message: TMessage }) {
           conversationId,
           title,
         } as TConversation),
-      { resetLatestMessage: true },
     );
   };
 
diff --git a/client/src/components/Chat/Messages/SearchMessage.tsx b/client/src/components/Chat/Messages/SearchMessage.tsx
index 982aee06cef..955810b20b6 100644
--- a/client/src/components/Chat/Messages/SearchMessage.tsx
+++ b/client/src/components/Chat/Messages/SearchMessage.tsx
@@ -1,10 +1,11 @@
 import { useMemo } from 'react';
 import { useAtomValue } from 'jotai';
 import { useRecoilValue } from 'recoil';
-import { useAuthContext, useLocalize } from '~/hooks';
 import type { TMessageProps, TMessageIcon } from '~/common';
 import MinimalHoverButtons from '~/components/Chat/Messages/MinimalHoverButtons';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import Icon from '~/components/Chat/Messages/MessageIcon';
+import { useAuthContext, useLocalize } from '~/hooks';
 import SearchContent from './Content/SearchContent';
 import { fontSizeAtom } from '~/store/fontSize';
 import SearchButtons from './SearchButtons';
@@ -26,7 +27,10 @@ const MessageBody = ({ message, messageLabel, fontSize }) => (
   <div
     className={cn('relative flex w-11/12 flex-col', message.isCreatedByUser ? '' : 'agent-turn')}
   >
-    <div className={cn('select-none font-semibold', fontSize)}>{messageLabel}</div>
+    <div className={cn('select-none font-semibold', fontSize)}>
+      {messageLabel}
+      <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
+    </div>
     <SearchContent message={message} />
     <SubRow classes="text-xs">
       <MinimalHoverButtons message={message} />
diff --git a/client/src/components/Chat/Messages/SiblingSwitch.tsx b/client/src/components/Chat/Messages/SiblingSwitch.tsx
index aeb2f0cbce6..74af2c6bda3 100644
--- a/client/src/components/Chat/Messages/SiblingSwitch.tsx
+++ b/client/src/components/Chat/Messages/SiblingSwitch.tsx
@@ -26,7 +26,7 @@ export default function SiblingSwitch({
   const buttonStyle = cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
   );
 
diff --git a/client/src/components/Chat/Messages/__tests__/HoverActions.streaming.spec.tsx b/client/src/components/Chat/Messages/__tests__/HoverActions.streaming.spec.tsx
new file mode 100644
index 00000000000..efebd8a82d8
--- /dev/null
+++ b/client/src/components/Chat/Messages/__tests__/HoverActions.streaming.spec.tsx
@@ -0,0 +1,213 @@
+import React, { useMemo } from 'react';
+import { RecoilRoot, type MutableSnapshot } from 'recoil';
+import { MemoryRouter } from 'react-router-dom';
+import { render, screen, act } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { QueryClient, QueryClientProvider, useQueryClient } from '@tanstack/react-query';
+import { QueryKeys, type TConversation, type TMessage } from 'librechat-data-provider';
+import { ChatContext, MessagesViewProvider, useChatContext } from '~/Providers';
+import { useLatestMessage, useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
+import Message from '~/components/Chat/Messages/Message';
+import store from '~/store';
+
+let mockHoverButtonsRenderCount = 0;
+
+jest.mock('~/components/Chat/Messages/HoverButtons', () => ({
+  __esModule: true,
+  default: () => {
+    mockHoverButtonsRenderCount += 1;
+    return <div data-testid="hover-buttons" />;
+  },
+}));
+
+jest.mock('~/components/Chat/Messages/Content/MessageContent', () => ({
+  __esModule: true,
+  default: ({ text }: { text: string }) => <div data-testid="message-content">{text}</div>,
+}));
+
+jest.mock('~/components/Chat/Messages/MessageIcon', () => ({
+  __esModule: true,
+  default: () => <div data-testid="message-icon" />,
+}));
+
+jest.mock('~/components/Chat/Messages/ui/PlaceholderRow', () => ({
+  __esModule: true,
+  default: () => <div data-testid="placeholder-row" />,
+}));
+
+jest.mock('~/hooks', () => {
+  const useMessageProcess = jest.requireActual('~/hooks/Messages/useMessageProcess').default;
+  const useMemoizedChatContext = jest.requireActual(
+    '~/hooks/Messages/useMemoizedChatContext',
+  ).default;
+  return {
+    useMessageProcess,
+    useMemoizedChatContext,
+    useContentMetadata: () => ({ hasParallelContent: false }),
+    useLocalize: () => (key: string) => key,
+    useMessageActions: ({
+      chatContext,
+      message,
+    }: {
+      chatContext: {
+        ask: jest.Mock;
+        index: number;
+        regenerate: jest.Mock;
+        conversation: TConversation | null;
+        latestMessageId: string | undefined;
+        latestMessageDepth: number | undefined;
+        handleContinue: jest.Mock;
+      };
+      message?: TMessage;
+    }) => ({
+      ask: chatContext.ask,
+      edit: false,
+      index: chatContext.index,
+      agent: undefined,
+      assistant: undefined,
+      conversation: chatContext.conversation,
+      messageLabel: message?.sender ?? 'Assistant',
+      handleFeedback: jest.fn(),
+      handleContinue: chatContext.handleContinue,
+      copyToClipboard: jest.fn(),
+      latestMessageId: chatContext.latestMessageId,
+      regenerateMessage: jest.fn(),
+      latestMessageDepth: chatContext.latestMessageDepth,
+    }),
+  };
+});
+
+const conversation = {
+  conversationId: 'conversation-streaming',
+  endpoint: 'openAI',
+  model: 'gpt-4',
+} as TConversation;
+
+const userMessage = {
+  messageId: 'user-message',
+  parentMessageId: '00000000-0000-0000-0000-000000000000',
+  conversationId: conversation.conversationId,
+  text: 'Tell me something',
+  isCreatedByUser: true,
+} as TMessage;
+
+const optimisticAssistantMessage = {
+  messageId: 'assistant-message_',
+  parentMessageId: userMessage.messageId,
+  conversationId: conversation.conversationId,
+  sender: 'Assistant',
+  text: '',
+  isCreatedByUser: false,
+} as TMessage;
+
+const canonicalAssistantMessage = {
+  ...optimisticAssistantMessage,
+  messageId: 'assistant-message',
+  text: 'Streaming canonical response',
+} as TMessage;
+
+function createQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  });
+}
+
+function DerivedStreamingRow() {
+  const queryClient = useQueryClient();
+  const latestMessage = useLatestMessage(0);
+  const latestMessageId = useLatestMessageId(0);
+  const latestMessageDepth = latestMessage?.depth;
+
+  const chatContext = useMemo(
+    () =>
+      ({
+        ask: jest.fn(),
+        index: 0,
+        regenerate: jest.fn(),
+        conversation,
+        latestMessageId: latestMessageId ?? undefined,
+        latestMessageDepth,
+        handleContinue: jest.fn(),
+        isSubmitting: true,
+        abortScroll: false,
+        setAbortScroll: jest.fn(),
+        getMessages: () =>
+          queryClient.getQueryData<TMessage[]>([QueryKeys.messages, conversation.conversationId]),
+        setMessages: (messages: TMessage[]) => {
+          queryClient.setQueryData<TMessage[]>(
+            [QueryKeys.messages, conversation.conversationId],
+            messages,
+          );
+        },
+      }) as unknown as ReturnType<typeof useChatContext>,
+    [latestMessageDepth, latestMessageId, queryClient],
+  );
+
+  if (!latestMessage) {
+    return null;
+  }
+
+  return (
+    <ChatContext.Provider value={chatContext}>
+      <MessagesViewProvider>
+        <Message message={latestMessage} currentEditId={null} setCurrentEditId={jest.fn()} />
+      </MessagesViewProvider>
+    </ChatContext.Provider>
+  );
+}
+
+function renderStreamingRow() {
+  const queryClient = createQueryClient();
+  queryClient.setQueryData<TMessage[]>(
+    [QueryKeys.messages, conversation.conversationId],
+    [userMessage, optimisticAssistantMessage],
+  );
+
+  const initializeState = ({ set }: MutableSnapshot) => {
+    set(store.conversationByIndex(0), conversation);
+    set(store.isSubmittingFamily(0), true);
+  };
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <RecoilRoot initializeState={initializeState}>
+        <MemoryRouter initialEntries={[`/c/${conversation.conversationId}`]}>
+          <DerivedStreamingRow />
+        </MemoryRouter>
+      </RecoilRoot>
+    </QueryClientProvider>,
+  );
+
+  return queryClient;
+}
+
+describe('streaming hover actions', () => {
+  beforeEach(() => {
+    mockHoverButtonsRenderCount = 0;
+  });
+
+  it('does not mount hover actions while an optimistic assistant row is replaced', async () => {
+    const user = userEvent.setup();
+    const queryClient = renderStreamingRow();
+
+    await user.hover(screen.getByTestId('message-content'));
+
+    expect(screen.queryByTestId('hover-buttons')).toBeNull();
+    expect(mockHoverButtonsRenderCount).toBe(0);
+
+    act(() => {
+      queryClient.setQueryData<TMessage[]>(
+        [QueryKeys.messages, conversation.conversationId],
+        [userMessage, canonicalAssistantMessage],
+      );
+    });
+
+    expect(screen.queryByTestId('hover-buttons')).toBeNull();
+    expect(mockHoverButtonsRenderCount).toBe(0);
+    expect(screen.getByTestId('placeholder-row')).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx b/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
index c19142494a6..f17767f680f 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
+++ b/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
@@ -1,5 +1,5 @@
 import React from 'react';
-import { render } from '@testing-library/react';
+import { render, screen } from '@testing-library/react';
 import { EModelEndpoint } from 'librechat-data-provider';
 import type { Agent } from 'librechat-data-provider';
 import type { TMessageIcon } from '~/common';
@@ -62,6 +62,22 @@ describe('MessageIcon render cycles', () => {
     expect(iconRenderCount.current).toBe(1);
   });
 
+  it('renders same-origin absolute model spec icon URLs directly', () => {
+    render(
+      <MessageIcon
+        iconData={{
+          ...baseIconData,
+          iconURL: '/assets/clickhouse-logo.svg',
+        }}
+      />,
+    );
+
+    expect(screen.getByTestId('convo-icon-url')).toHaveAttribute(
+      'data-icon-url',
+      '/assets/clickhouse-logo.svg',
+    );
+  });
+
   it('does not re-render when parent re-renders with same field values but new object references', () => {
     const agent = makeAgent();
     const { rerender } = render(<MessageIcon iconData={baseIconData} agent={agent} />);
@@ -88,7 +104,7 @@ describe('MessageIcon render cycles', () => {
     const { rerender } = render(<MessageIcon iconData={baseIconData} agent={agent1} />);
     iconRenderCount.current = 0;
 
-    const agent2 = makeAgent({ avatar: { filepath: '/images/new-avatar.png' } });
+    const agent2 = makeAgent({ avatar: { filepath: '/images/new-avatar.png', source: 'local' } });
     rerender(<MessageIcon iconData={baseIconData} agent={agent2} />);
 
     expect(iconRenderCount.current).toBe(1);
diff --git a/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts b/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
index db4e9df3163..f4f78139180 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
+++ b/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
@@ -62,8 +62,14 @@ describe('MessageIcon arePropsEqual', () => {
   it('returns false when agent avatar filepath changes', () => {
     expect(
       arePropsEqual(
-        { iconData: baseIconData, agent: makeAgent({ avatar: { filepath: '/a.png' } }) },
-        { iconData: baseIconData, agent: makeAgent({ avatar: { filepath: '/b.png' } }) },
+        {
+          iconData: baseIconData,
+          agent: makeAgent({ avatar: { filepath: '/a.png', source: 'local' } }),
+        },
+        {
+          iconData: baseIconData,
+          agent: makeAgent({ avatar: { filepath: '/b.png', source: 'local' } }),
+        },
       ),
     ).toBe(false);
   });
diff --git a/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx b/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
index d9c02baa431..cb232e1614e 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
+++ b/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
@@ -9,10 +9,18 @@ type TestMessage = {
   conversationId?: string;
   text?: string;
   isCreatedByUser?: boolean;
+  content?: Array<
+    | {
+        type?: string;
+        text?: string | { value?: string };
+      }
+    | undefined
+  >;
 };
 
 const mockUseGetMessagesByConvoId = jest.fn();
 const mockUseMessagesConversation = jest.fn();
+const mockUseMessagesSubmission = jest.fn();
 
 jest.mock('~/data-provider', () => ({
   useGetMessagesByConvoId: (...args: unknown[]) => mockUseGetMessagesByConvoId(...args),
@@ -20,6 +28,7 @@ jest.mock('~/data-provider', () => ({
 
 jest.mock('~/Providers', () => ({
   useMessagesConversation: (...args: unknown[]) => mockUseMessagesConversation(...args),
+  useMessagesSubmission: (...args: unknown[]) => mockUseMessagesSubmission(...args),
 }));
 
 jest.mock('~/hooks', () => ({
@@ -86,6 +95,21 @@ class MockIntersectionObserver {
 
 const originalIO = global.IntersectionObserver;
 
+class PointerEventPolyfill extends MouseEvent {
+  pointerId: number;
+  constructor(type: string, params: MouseEventInit & { pointerId?: number } = {}) {
+    super(type, params);
+    this.pointerId = params.pointerId ?? 0;
+  }
+}
+
+if (typeof (global as { PointerEvent?: unknown }).PointerEvent === 'undefined') {
+  (global as unknown as { PointerEvent: typeof PointerEventPolyfill }).PointerEvent =
+    PointerEventPolyfill;
+  (window as unknown as { PointerEvent: typeof PointerEventPolyfill }).PointerEvent =
+    PointerEventPolyfill;
+}
+
 import MessageNav from '../MessageNav';
 
 function buildMessage(overrides: Partial<TestMessage> = {}): TestMessage {
@@ -158,6 +182,7 @@ beforeEach(() => {
   ).IntersectionObserver = MockIntersectionObserver;
   jest.useFakeTimers();
   mockUseMessagesConversation.mockReturnValue({ conversationId: 'test-convo' });
+  mockUseMessagesSubmission.mockReturnValue({ isSubmitting: false });
   mockUseGetMessagesByConvoId.mockReturnValue({ data: [] });
 });
 
@@ -276,6 +301,22 @@ describe('MessageNav', () => {
       expect(text.endsWith('...')).toBe(true);
       expect(text.length).toBe(83);
     });
+
+    it('skips sparse content entries when deriving preview text', () => {
+      const messages = [
+        buildMessage({
+          messageId: 'a',
+          text: '',
+          isCreatedByUser: true,
+          content: [undefined, { type: 'text', text: 'content-preview' }],
+        }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+      const preview = container.querySelectorAll('[data-testid="hover-card-content"] p')[0];
+      expect(preview).toHaveTextContent('content-preview');
+    });
   });
 
   describe('accessibility', () => {
@@ -605,6 +646,311 @@ describe('MessageNav', () => {
     });
   });
 
+  describe('focus management', () => {
+    it('moves focus to the target message when an indicator is clicked', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const indicator = container.querySelectorAll('[data-msg-id]')[1] as HTMLButtonElement;
+      act(() => {
+        fireEvent.click(indicator);
+      });
+
+      const message = document.getElementById('b');
+      expect(message).toHaveAttribute('tabindex', '-1');
+      expect(document.activeElement).toBe(message);
+    });
+
+    it('focuses the current indicator when Shift+Alt+M is pressed', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const io = MockIntersectionObserver.last();
+      act(() => {
+        io!.trigger([{ target: document.getElementById('b')!, isIntersecting: true }]);
+        jest.advanceTimersByTime(32);
+      });
+
+      act(() => {
+        fireEvent.keyDown(document, { code: 'KeyM', altKey: true, shiftKey: true });
+      });
+
+      expect(document.activeElement).toBe(container.querySelector('[data-msg-id="b"]'));
+    });
+
+    it('focuses the current indicator via the produced key on non-QWERTY layouts', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const io = MockIntersectionObserver.last();
+      act(() => {
+        io!.trigger([{ target: document.getElementById('b')!, isIntersecting: true }]);
+        jest.advanceTimersByTime(32);
+      });
+
+      act(() => {
+        fireEvent.keyDown(document, { key: 'm', code: 'Semicolon', altKey: true, shiftKey: true });
+      });
+
+      expect(document.activeElement).toBe(container.querySelector('[data-msg-id="b"]'));
+    });
+
+    it('consumes Shift+Alt+M only when the nav is rendered', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      renderNav(messages);
+
+      let notPrevented = true;
+      act(() => {
+        notPrevented = fireEvent.keyDown(document, {
+          code: 'KeyM',
+          altKey: true,
+          shiftKey: true,
+        });
+      });
+
+      expect(notPrevented).toBe(false);
+    });
+
+    it('does not consume Shift+Alt+M when the nav is not rendered', () => {
+      renderNav([buildMessage({ messageId: 'solo', text: 'only one', isCreatedByUser: true })]);
+
+      let notPrevented = true;
+      act(() => {
+        notPrevented = fireEvent.keyDown(document, {
+          code: 'KeyM',
+          altKey: true,
+          shiftKey: true,
+        });
+      });
+
+      expect(notPrevented).toBe(true);
+    });
+
+    it('ignores the keyboard shortcut without the alt and shift modifiers', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      act(() => {
+        fireEvent.keyDown(document, { code: 'KeyM' });
+      });
+
+      const navButtons = container.querySelectorAll('[data-msg-id]');
+      expect(Array.from(navButtons)).not.toContain(document.activeElement);
+    });
+  });
+
+  describe('drag to scroll', () => {
+    function setupDraggableNav() {
+      const messages = Array.from({ length: 5 }, (_, i) =>
+        buildMessage({
+          messageId: `m-${i}`,
+          text: `message ${i}`,
+          isCreatedByUser: i % 2 === 0,
+        }),
+      );
+      const result = renderNav(messages);
+      const column = result.container.querySelector('nav > div') as HTMLDivElement;
+      column.getBoundingClientRect = () => ({ top: 0, bottom: 50, height: 50 }) as DOMRect;
+
+      const ribs = Array.from(column.querySelectorAll('[data-msg-id]')) as HTMLElement[];
+
+      const writes: number[] = [];
+      Object.defineProperty(result.scrollable, 'scrollTop', {
+        get: () => 0,
+        set: (v: number) => {
+          writes.push(v);
+        },
+        configurable: true,
+      });
+
+      return { ...result, column, ribs, writes };
+    }
+
+    it('scrubs the conversation while dragging past the threshold', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+
+      expect(writes.length).toBeGreaterThan(0);
+    });
+
+    it('keeps tracking the drag after the pointer leaves the narrow column', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        // pointer has moved off the column; the move bubbles to the document listener
+        fireEvent.pointerMove(document.body, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+
+      expect(writes.length).toBeGreaterThan(0);
+    });
+
+    it('maps the pointer proportionally across the full set of messages', () => {
+      const { column } = setupDraggableNav();
+      const getById = jest.spyOn(document, 'getElementById');
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+      expect(getById.mock.calls.map((c) => c[0])).toContain('m-2');
+
+      getById.mockClear();
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 50 });
+      });
+      expect(getById.mock.calls.map((c) => c[0])).toContain('m-4');
+
+      getById.mockRestore();
+    });
+
+    it('does not scrub for movement under the threshold', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 2 });
+      });
+
+      expect(writes.length).toBe(0);
+    });
+
+    it('ignores pointer moves after the interaction ends', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 0 });
+      });
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 40 });
+      });
+
+      expect(writes.length).toBe(0);
+    });
+
+    it('ends the drag when the primary button is released during a move', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 0, clientY: 30 });
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('ends the drag when the window loses focus', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        window.dispatchEvent(new Event('blur'));
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('tears down a previous drag when a new pointer starts', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 2, button: 0, buttons: 1, clientY: 0 });
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('selects via the native click when a press does not become a drag', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 0 });
+      });
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).toBe(document.getElementById('m-0'));
+    });
+
+    it('suppresses the click that immediately follows a drag', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 25 });
+      });
+
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).not.toBe(document.getElementById('m-0'));
+    });
+
+    it('clears click suppression after the drag so a later activation is honored', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 25 });
+        jest.advanceTimersByTime(1);
+      });
+
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).toBe(document.getElementById('m-0'));
+    });
+  });
+
   describe('observers', () => {
     it('observes each message on mount', () => {
       const messages = [
@@ -752,4 +1098,191 @@ describe('MessageNav', () => {
       expect(container.querySelector('[data-msg-id="d"]')).not.toBeNull();
     });
   });
+
+  describe('end-of-conversation indicator', () => {
+    function buildDomWithEnd(
+      messages: TestMessage[],
+      opts: { endOffsetTop?: number; scrollTop?: number } = {},
+    ) {
+      const scrollable = document.createElement('div');
+      scrollable.className = 'scrollbar-gutter-stable';
+      Object.defineProperty(scrollable, 'clientHeight', { value: 600, configurable: true });
+      Object.defineProperty(scrollable, 'scrollHeight', { value: 3000, configurable: true });
+      Object.defineProperty(scrollable, 'scrollTop', {
+        value: opts.scrollTop ?? 0,
+        writable: true,
+        configurable: true,
+      });
+
+      const content = document.createElement('div');
+      content.className = 'flex flex-col';
+      scrollable.appendChild(content);
+
+      for (let i = 0; i < messages.length; i++) {
+        const m = messages[i];
+        const div = document.createElement('div');
+        div.id = m.messageId;
+        div.className = 'message-render';
+        div.textContent = m.text ?? '';
+        Object.defineProperty(div, 'offsetTop', { value: 100 + i * 200, configurable: true });
+        Object.defineProperty(div, 'offsetHeight', { value: 150, configurable: true });
+        content.appendChild(div);
+      }
+
+      const end = document.createElement('div');
+      end.id = 'messages-end';
+      Object.defineProperty(end, 'offsetTop', {
+        value: opts.endOffsetTop ?? 100 + messages.length * 200,
+        configurable: true,
+      });
+      Object.defineProperty(end, 'offsetHeight', { value: 0, configurable: true });
+      content.appendChild(end);
+
+      document.body.appendChild(scrollable);
+      return { scrollable, content, end };
+    }
+
+    function renderNavWithEnd(
+      messages: TestMessage[],
+      opts?: { endOffsetTop?: number; scrollTop?: number },
+    ) {
+      mockUseGetMessagesByConvoId.mockReturnValue({ data: messages });
+      const dom = buildDomWithEnd(messages, opts);
+      const scrollableRef = { current: dom.scrollable } as RefObject<HTMLDivElement>;
+      const result = render(<MessageNav scrollableRef={scrollableRef} />);
+      act(() => {
+        jest.advanceTimersByTime(250);
+      });
+      return { ...result, ...dom, scrollableRef };
+    }
+
+    const threeMessages = (): TestMessage[] => [
+      buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+      buildMessage({ messageId: 'b', text: 'bravo' }),
+      buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+    ];
+
+    it('appends a terminus indicator as the last rib when #messages-end exists', () => {
+      const { container } = renderNavWithEnd(threeMessages());
+      const ribs = container.querySelectorAll('[data-msg-id]');
+      expect(ribs).toHaveLength(4);
+      expect(ribs[3].getAttribute('data-msg-id')).toBe('messages-end');
+      expect(ribs[3].getAttribute('aria-label')).toBe('com_ui_scroll_to_bottom');
+    });
+
+    it('omits the terminus indicator and the nav when there are fewer than 3 messages', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+      ];
+      const { container } = renderNavWithEnd(messages);
+      expect(container.querySelector('nav')).toBeNull();
+    });
+
+    it('scrolls toward the bottom without moving focus when the terminus is clicked', () => {
+      const { container } = renderNavWithEnd(threeMessages());
+      const rafSpy = jest.spyOn(window, 'requestAnimationFrame');
+      const endRib = container.querySelector('[data-msg-id="messages-end"]') as HTMLButtonElement;
+
+      act(() => {
+        fireEvent.click(endRib);
+      });
+
+      expect(rafSpy).toHaveBeenCalled();
+      const end = document.getElementById('messages-end');
+      expect(document.activeElement).not.toBe(end);
+      expect(end?.hasAttribute('tabindex')).toBe(false);
+      rafSpy.mockRestore();
+    });
+
+    it('keeps the next chevron disabled at the bottom even when the terminus sits below max scroll', () => {
+      const { container, scrollable } = renderNavWithEnd(threeMessages(), { endOffsetTop: 2900 });
+
+      Object.defineProperty(scrollable, 'scrollTop', {
+        value: 2400,
+        writable: true,
+        configurable: true,
+      });
+      act(() => {
+        fireEvent.scroll(scrollable);
+        jest.advanceTimersByTime(32);
+      });
+
+      const prev = container.querySelector(
+        'button[aria-label="com_ui_message_nav_previous"]',
+      ) as HTMLButtonElement;
+      const next = container.querySelector(
+        'button[aria-label="com_ui_message_nav_next"]',
+      ) as HTMLButtonElement;
+
+      expect(next.disabled).toBe(true);
+      expect(prev.disabled).toBe(false);
+    });
+
+    it('scrubs to the terminus when dragging to the bottom of the column', () => {
+      const messages = Array.from({ length: 5 }, (_, i) =>
+        buildMessage({
+          messageId: `m-${i}`,
+          text: `message ${i}`,
+          isCreatedByUser: i % 2 === 0,
+        }),
+      );
+      const { container, scrollable } = renderNavWithEnd(messages);
+      const column = container.querySelector('nav > div') as HTMLDivElement;
+      column.getBoundingClientRect = () => ({ top: 0, bottom: 50, height: 50 }) as DOMRect;
+      const qs = jest.spyOn(scrollable, 'querySelector');
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 50 });
+      });
+
+      expect(qs.mock.calls.some((c) => String(c[0]).includes('messages-end'))).toBe(true);
+      qs.mockRestore();
+    });
+
+    it('resolves the terminus within its own container across multiple mounted navs', () => {
+      const messagesA = [
+        buildMessage({ messageId: 'a1', text: 'one', isCreatedByUser: true }),
+        buildMessage({ messageId: 'a2', text: 'two' }),
+        buildMessage({ messageId: 'a3', text: 'three', isCreatedByUser: true }),
+      ];
+      const messagesB = [
+        buildMessage({ messageId: 'b1', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b2', text: 'beta' }),
+        buildMessage({ messageId: 'b3', text: 'gamma', isCreatedByUser: true }),
+      ];
+
+      mockUseGetMessagesByConvoId.mockReturnValue({ data: messagesA });
+      const domA = buildDomWithEnd(messagesA);
+      render(
+        <MessageNav scrollableRef={{ current: domA.scrollable } as RefObject<HTMLDivElement>} />,
+      );
+      act(() => {
+        jest.advanceTimersByTime(250);
+      });
+
+      mockUseGetMessagesByConvoId.mockReturnValue({ data: messagesB });
+      const domB = buildDomWithEnd(messagesB);
+      const { container: navB } = render(
+        <MessageNav scrollableRef={{ current: domB.scrollable } as RefObject<HTMLDivElement>} />,
+      );
+      act(() => {
+        jest.advanceTimersByTime(250);
+      });
+
+      const qsA = jest.spyOn(domA.scrollable, 'querySelector');
+      const qsB = jest.spyOn(domB.scrollable, 'querySelector');
+
+      const endRibB = navB.querySelector('[data-msg-id="messages-end"]') as HTMLButtonElement;
+      act(() => {
+        fireEvent.click(endRibB);
+      });
+
+      expect(qsB.mock.calls.some((c) => String(c[0]).includes('messages-end'))).toBe(true);
+      expect(qsA.mock.calls.some((c) => String(c[0]).includes('messages-end'))).toBe(false);
+      qsA.mockRestore();
+      qsB.mockRestore();
+    });
+  });
 });
diff --git a/client/src/components/Chat/Messages/ui/MessageRender.tsx b/client/src/components/Chat/Messages/ui/MessageRender.tsx
index dd556360364..3fc1879a5be 100644
--- a/client/src/components/Chat/Messages/ui/MessageRender.tsx
+++ b/client/src/components/Chat/Messages/ui/MessageRender.tsx
@@ -5,6 +5,7 @@ import type { TMessage } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon, TMessageChatContext } from '~/common';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
 import MessageContent from '~/components/Chat/Messages/Content/MessageContent';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import { useLocalize, useMessageActions, useContentMetadata } from '~/hooks';
 import PlaceholderRow from '~/components/Chat/Messages/ui/PlaceholderRow';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
@@ -72,6 +73,7 @@ function areMessageRenderPropsEqual(prev: MessageRenderProps, next: MessageRende
     prevMsg.text === nextMsg.text &&
     prevMsg.error === nextMsg.error &&
     prevMsg.unfinished === nextMsg.unfinished &&
+    prevMsg.createdAt === nextMsg.createdAt &&
     prevMsg.depth === nextMsg.depth &&
     prevMsg.isCreatedByUser === nextMsg.isCreatedByUser &&
     (prevMsg.children?.length ?? 0) === (nextMsg.children?.length ?? 0) &&
@@ -80,7 +82,8 @@ function areMessageRenderPropsEqual(prev: MessageRenderProps, next: MessageRende
     prevMsg.endpoint === nextMsg.endpoint &&
     prevMsg.iconURL === nextMsg.iconURL &&
     prevMsg.feedback?.rating === nextMsg.feedback?.rating &&
-    (prevMsg.files?.length ?? 0) === (nextMsg.files?.length ?? 0)
+    (prevMsg.files?.length ?? 0) === (nextMsg.files?.length ?? 0) &&
+    (prevMsg.quotes?.length ?? 0) === (nextMsg.quotes?.length ?? 0)
   );
 }
 
@@ -179,7 +182,7 @@ const MessageRender = memo(function MessageRender({
   };
 
   const conditionalClasses = {
-    focus: 'focus:outline-none focus:ring-2 focus:ring-border-xheavy',
+    focus: 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
   };
 
   return (
@@ -212,6 +215,7 @@ const MessageRender = memo(function MessageRender({
           <h2 className={cn('select-none font-semibold', fontSize)}>
             <span className="sr-only">{getHeaderPrefixForScreenReader(msg, localize)}</span>
             {messageLabel}
+            <MessageTimestamp value={msg.createdAt ?? msg.clientTimestamp} />
           </h2>
         )}
 
diff --git a/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx b/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx
new file mode 100644
index 00000000000..079fa4349ce
--- /dev/null
+++ b/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx
@@ -0,0 +1,31 @@
+import { useTranslation } from 'react-i18next';
+import useTimeTick from '~/hooks/useTimeTick';
+import { getMessageTimestamp } from '~/utils';
+
+/**
+ * Inline message timestamp shown next to the author name in the message header.
+ * On hover-capable pointers it reveals on row hover/focus; on touch and other
+ * non-hover devices it stays visible. Recent messages show the relative form
+ * ("10 minutes ago") with the absolute date on hover; older messages show the
+ * absolute date directly.
+ */
+export default function MessageTimestamp({ value }: { value?: string | null }) {
+  const { i18n } = useTranslation();
+  // Re-render on a shared interval so relative labels stay current while idle.
+  useTimeTick();
+  const timestamp = getMessageTimestamp(value, i18n.language);
+
+  if (!timestamp) {
+    return null;
+  }
+
+  return (
+    <time
+      dateTime={timestamp.iso}
+      title={timestamp.isRecent ? timestamp.absolute : undefined}
+      className="ml-2 text-xs font-normal text-text-secondary transition-opacity duration-200 group-focus-within:opacity-100 group-hover:opacity-100 [@media(hover:hover)]:opacity-0"
+    >
+      {timestamp.isRecent ? timestamp.relative : timestamp.absolute}
+    </time>
+  );
+}
diff --git a/client/src/components/Chat/ProjectLandingChip.tsx b/client/src/components/Chat/ProjectLandingChip.tsx
new file mode 100644
index 00000000000..22692e8c007
--- /dev/null
+++ b/client/src/components/Chat/ProjectLandingChip.tsx
@@ -0,0 +1,89 @@
+import { useCallback, useMemo } from 'react';
+import { useSearchParams } from 'react-router-dom';
+import { Folder, X } from 'lucide-react';
+import { ControlCombobox, TooltipAnchor } from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import type { OptionWithIcon } from '~/common';
+import { useProjectsInfiniteQuery } from '~/data-provider';
+import { useChatContext } from '~/Providers';
+import { useLocalize } from '~/hooks';
+
+/**
+ * Subtle project indicator shown on a project-scoped new-chat landing.
+ * Clicking the chip switches the project (searchable combobox); the trailing
+ * `×` removes the project scope. Both update the conversation draft and the
+ * `?projectId` search param in place, so the typed message and model are kept.
+ */
+export default function ProjectLandingChip({ project }: { project: TChatProject }) {
+  const localize = useLocalize();
+  const { conversation, setConversation } = useChatContext();
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  const { data } = useProjectsInfiniteQuery(
+    { sortBy: 'lastConversationAt', sortDirection: 'desc', limit: 100 },
+    { staleTime: 30000 },
+  );
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const items = useMemo<OptionWithIcon[]>(
+    () =>
+      projects.map((item) => ({
+        label: item.name,
+        value: item._id,
+        icon: <Folder className="h-4 w-4 text-text-secondary" aria-hidden="true" />,
+      })),
+    [projects],
+  );
+
+  const applyProject = useCallback(
+    (projectId: string | null) => {
+      if (conversation) {
+        setConversation({ ...conversation, chatProjectId: projectId });
+      }
+      const nextParams = new URLSearchParams(searchParams);
+      if (projectId) {
+        nextParams.set('projectId', projectId);
+      } else {
+        nextParams.delete('projectId');
+      }
+      setSearchParams(nextParams, { replace: true });
+    },
+    [conversation, setConversation, searchParams, setSearchParams],
+  );
+
+  return (
+    <div className="group mb-2.5 flex items-center gap-1 px-1">
+      <ControlCombobox
+        selectId="project-landing-select"
+        selectedValue={project._id}
+        displayValue={project.name}
+        items={items}
+        setValue={(value) => {
+          if (value) {
+            applyProject(value);
+          }
+        }}
+        SelectIcon={<Folder className="h-3.5 w-3.5 text-text-secondary" aria-hidden="true" />}
+        ariaLabel={localize('com_ui_change_project')}
+        searchPlaceholder={localize('com_ui_search_projects')}
+        isCollapsed={false}
+        showCarat={true}
+        placement="top"
+        containerClassName="w-auto px-0"
+        className="h-8 w-auto min-w-[11rem] gap-1.5 rounded-full px-2.5 text-sm font-medium text-text-secondary hover:text-text-primary"
+      />
+      <TooltipAnchor
+        description={localize('com_ui_remove_from_project')}
+        render={
+          <button
+            type="button"
+            aria-label={localize('com_ui_remove_from_project')}
+            onClick={() => applyProject(null)}
+            className="flex h-7 w-7 shrink-0 items-center justify-center rounded-full text-text-secondary opacity-0 outline-none transition-all hover:bg-surface-hover hover:text-text-primary focus-visible:opacity-100 focus-visible:ring-2 focus-visible:ring-ring-primary group-hover:opacity-100"
+          >
+            <X className="h-3.5 w-3.5" aria-hidden="true" />
+          </button>
+        }
+      />
+    </div>
+  );
+}
diff --git a/client/src/components/Chat/TemporaryChat.tsx b/client/src/components/Chat/TemporaryChat.tsx
index b1acf1ba13f..39d42462bcf 100644
--- a/client/src/components/Chat/TemporaryChat.tsx
+++ b/client/src/components/Chat/TemporaryChat.tsx
@@ -3,6 +3,7 @@ import { useRecoilValue } from 'recoil';
 import { TooltipAnchor } from '@librechat/client';
 import { MessageCircleDashed } from 'lucide-react';
 import { useRecoilState, useRecoilCallback } from 'recoil';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 import store from '~/store';
@@ -12,6 +13,8 @@ export function TemporaryChat() {
   const [isTemporary, setIsTemporary] = useRecoilState(store.isTemporary);
   const conversation = useRecoilValue(store.conversationByIndex(0));
   const isSubmitting = useRecoilValue(store.isSubmittingFamily(0));
+  const tooltipDescription = useShortcutHint('toggleTemporaryChat', localize('com_ui_temporary'));
+  const ariaKey = useShortcutAriaKey('toggleTemporaryChat');
 
   const handleBadgeToggle = useRecoilCallback(
     () => () => {
@@ -30,12 +33,13 @@ export function TemporaryChat() {
   return (
     <div className="relative flex flex-wrap items-center gap-2">
       <TooltipAnchor
-        description={localize('com_ui_temporary')}
+        description={tooltipDescription}
         render={
           <button
             onClick={handleBadgeToggle}
             aria-label={localize('com_ui_temporary')}
             aria-pressed={isTemporary}
+            aria-keyshortcuts={ariaKey}
             className={cn(
               'inline-flex size-9 flex-shrink-0 items-center justify-center rounded-xl border border-border-light text-text-primary transition-all ease-in-out',
               isTemporary
diff --git a/client/src/components/Conversations/ConversationEndpointIcon.tsx b/client/src/components/Conversations/ConversationEndpointIcon.tsx
new file mode 100644
index 00000000000..381fe541858
--- /dev/null
+++ b/client/src/components/Conversations/ConversationEndpointIcon.tsx
@@ -0,0 +1,49 @@
+import { memo } from 'react';
+import type { TConversation, TEndpointsConfig } from 'librechat-data-provider';
+import { useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
+import EndpointIcon from '~/components/Endpoints/EndpointIcon';
+import { areConversationIconFieldsEqual } from './utils';
+import { useGetEndpointsQuery } from '~/data-provider';
+
+const emptyEndpointsConfig = {} as TEndpointsConfig;
+
+type EndpointIconContext = 'message' | 'nav' | 'landing' | 'menu-item';
+
+type ConversationEndpointIconProps = {
+  conversation: TConversation;
+  className?: string;
+  context?: EndpointIconContext;
+  size?: number;
+};
+
+function ConversationEndpointIcon({
+  conversation,
+  className,
+  context = 'menu-item',
+  size = 20,
+}: ConversationEndpointIconProps) {
+  const { data: endpointsConfig = emptyEndpointsConfig } = useGetEndpointsQuery();
+  const agentsMap = useAgentsMapContext();
+  const assistantMap = useAssistantsMapContext();
+
+  return (
+    <EndpointIcon
+      conversation={conversation}
+      endpointsConfig={endpointsConfig}
+      assistantMap={assistantMap}
+      agentsMap={agentsMap}
+      className={className}
+      size={size}
+      context={context}
+    />
+  );
+}
+
+export default memo(ConversationEndpointIcon, (prevProps, nextProps) => {
+  return (
+    prevProps.className === nextProps.className &&
+    prevProps.context === nextProps.context &&
+    prevProps.size === nextProps.size &&
+    areConversationIconFieldsEqual(prevProps.conversation, nextProps.conversation)
+  );
+});
diff --git a/client/src/components/Conversations/Conversations.tsx b/client/src/components/Conversations/Conversations.tsx
index 4a4e1308841..08effab6e08 100644
--- a/client/src/components/Conversations/Conversations.tsx
+++ b/client/src/components/Conversations/Conversations.tsx
@@ -1,14 +1,23 @@
 import { useMemo, memo, type FC, useCallback, useEffect, useRef } from 'react';
 import throttle from 'lodash/throttle';
-import { ChevronDown } from 'lucide-react';
 import { useRecoilValue } from 'recoil';
-import { Spinner, useMediaQuery } from '@librechat/client';
-import { List, AutoSizer, CellMeasurer, CellMeasurerCache } from 'react-virtualized';
+import { ChevronDown } from 'lucide-react';
+import { QueryKeys } from 'librechat-data-provider';
+import { useQueryClient } from '@tanstack/react-query';
+import { List, CellMeasurer, CellMeasurerCache } from 'react-virtualized';
+import { Spinner, TooltipAnchor, NewChatIcon, useMediaQuery } from '@librechat/client';
 import type { TConversation } from 'librechat-data-provider';
-import { useLocalize, TranslationKeys, useFavorites, useShowMarketplace } from '~/hooks';
+import {
+  useLocalize,
+  TranslationKeys,
+  useFavorites,
+  useShowMarketplace,
+  useNewConvo,
+  useElementSize,
+} from '~/hooks';
+import { groupConversationsByDate, clearMessagesCache, cn } from '~/utils';
 import FavoritesList from '~/components/Nav/Favorites/FavoritesList';
 import { useActiveJobs } from '~/data-provider';
-import { groupConversationsByDate, cn } from '~/utils';
 import Convo from './Convo';
 import store from '~/store';
 
@@ -32,6 +41,7 @@ interface ConversationsProps {
   isSearchLoading: boolean;
   isChatsExpanded: boolean;
   setIsChatsExpanded: (expanded: boolean) => void;
+  showFavorites?: boolean;
 }
 
 interface MeasuredRowProps {
@@ -76,25 +86,69 @@ interface ChatsHeaderProps {
   onToggle: () => void;
 }
 
+const headerIconButtonClassName =
+  'flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-text-secondary outline-none transition-colors hover:bg-surface-active-alt hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white';
+
 /** Collapsible header for the Chats section */
 const ChatsHeader: FC<ChatsHeaderProps> = memo(({ isExpanded, onToggle }) => {
   const localize = useLocalize();
+  const queryClient = useQueryClient();
+  const { newConversation } = useNewConvo();
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+
+  const handleNewChat = useCallback(() => {
+    clearMessagesCache(queryClient, conversation?.conversationId);
+    queryClient.invalidateQueries([QueryKeys.messages]);
+    newConversation();
+  }, [conversation?.conversationId, newConversation, queryClient]);
+
   return (
-    <button
-      onClick={onToggle}
-      className="group flex w-full items-center justify-between rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
-      type="button"
-    >
-      <span className="select-none">{localize('com_ui_chats')}</span>
-      <ChevronDown
-        className={cn('h-3 w-3 transition-transform duration-200', isExpanded ? 'rotate-180' : '')}
+    <div className="flex h-8 w-full items-center gap-0.5 pr-2">
+      <button
+        onClick={onToggle}
+        className="group flex min-w-0 flex-1 items-center gap-1 rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        type="button"
+        aria-expanded={isExpanded}
+      >
+        <span className="select-none truncate">{localize('com_ui_chats')}</span>
+        <ChevronDown
+          className={cn(
+            'h-3 w-3 shrink-0 transition-transform duration-200',
+            isExpanded ? '' : '-rotate-90',
+          )}
+          aria-hidden="true"
+        />
+      </button>
+      <TooltipAnchor
+        description={localize('com_ui_new_chat')}
+        render={
+          <button
+            type="button"
+            aria-label={localize('com_ui_new_chat')}
+            className={headerIconButtonClassName}
+            onClick={handleNewChat}
+          >
+            <NewChatIcon className="h-4 w-4" />
+          </button>
+        }
       />
-    </button>
+    </div>
   );
 });
 
 ChatsHeader.displayName = 'ChatsHeader';
 
+const PinnedHeader: FC = memo(() => {
+  const localize = useLocalize();
+  return (
+    <h2 className="pl-1 pt-1 text-text-secondary" style={{ fontSize: '0.7rem' }}>
+      {localize('com_ui_pinned')}
+    </h2>
+  );
+});
+
+PinnedHeader.displayName = 'PinnedHeader';
+
 const DateLabel: FC<{ groupName: string; isFirst?: boolean }> = memo(({ groupName, isFirst }) => {
   const localize = useLocalize();
   return (
@@ -114,42 +168,12 @@ DateLabel.displayName = 'DateLabel';
 
 type FlattenedItem =
   | { type: 'favorites' }
-  | { type: 'chats-header' }
+  | { type: 'pinned-header' }
+  | { type: 'pinned-convo'; convo: TConversation }
   | { type: 'header'; groupName: string }
   | { type: 'convo'; convo: TConversation }
   | { type: 'loading' };
 
-const MemoizedConvo = memo(
-  ({
-    conversation,
-    retainView,
-    toggleNav,
-    isGenerating,
-  }: {
-    conversation: TConversation;
-    retainView: () => void;
-    toggleNav: () => void;
-    isGenerating: boolean;
-  }) => {
-    return (
-      <Convo
-        conversation={conversation}
-        retainView={retainView}
-        toggleNav={toggleNav}
-        isGenerating={isGenerating}
-      />
-    );
-  },
-  (prevProps, nextProps) => {
-    return (
-      prevProps.conversation.conversationId === nextProps.conversation.conversationId &&
-      prevProps.conversation.title === nextProps.conversation.title &&
-      prevProps.conversation.endpoint === nextProps.conversation.endpoint &&
-      prevProps.isGenerating === nextProps.isGenerating
-    );
-  },
-);
-
 const Conversations: FC<ConversationsProps> = ({
   conversations: rawConversations,
   moveToTop,
@@ -160,6 +184,7 @@ const Conversations: FC<ConversationsProps> = ({
   isSearchLoading,
   isChatsExpanded,
   setIsChatsExpanded,
+  showFavorites = true,
 }) => {
   const localize = useLocalize();
   const search = useRecoilValue(store.search);
@@ -167,6 +192,11 @@ const Conversations: FC<ConversationsProps> = ({
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const convoHeight = isSmallScreen ? 44 : 34;
   const showAgentMarketplace = useShowMarketplace();
+  const {
+    ref: listContainerRef,
+    width: listWidth,
+    height: listHeight,
+  } = useElementSize<HTMLDivElement>();
 
   const favoritesContentKeyRef = useRef('');
 
@@ -179,7 +209,9 @@ const Conversations: FC<ConversationsProps> = ({
 
   // Determine if FavoritesList will render content
   const shouldShowFavorites =
-    !search.query && (isFavoritesLoading || favorites.length > 0 || showAgentMarketplace);
+    showFavorites &&
+    !search.query &&
+    (isFavoritesLoading || favorites.length > 0 || showAgentMarketplace);
 
   favoritesContentKeyRef.current = `${favorites.length}-${showAgentMarketplace ? 1 : 0}-${isFavoritesLoading ? 1 : 0}`;
 
@@ -188,6 +220,11 @@ const Conversations: FC<ConversationsProps> = ({
     [rawConversations],
   );
 
+  const pinnedConversations = useMemo(
+    () => filteredConversations.filter((c) => c.pinned),
+    [filteredConversations],
+  );
+
   const groupedConversations = useMemo(
     () => groupConversationsByDate(filteredConversations),
     [filteredConversations],
@@ -199,9 +236,15 @@ const Conversations: FC<ConversationsProps> = ({
     if (shouldShowFavorites) {
       items.push({ type: 'favorites' });
     }
-    items.push({ type: 'chats-header' });
 
     if (isChatsExpanded) {
+      if (!search.query && pinnedConversations.length > 0) {
+        items.push({ type: 'pinned-header' });
+        items.push(
+          ...pinnedConversations.map((convo) => ({ type: 'pinned-convo' as const, convo })),
+        );
+      }
+
       groupedConversations.forEach(([groupName, convos]) => {
         items.push({ type: 'header', groupName });
         items.push(...convos.map((convo) => ({ type: 'convo' as const, convo })));
@@ -212,7 +255,14 @@ const Conversations: FC<ConversationsProps> = ({
       }
     }
     return items;
-  }, [groupedConversations, isLoading, isChatsExpanded, shouldShowFavorites]);
+  }, [
+    groupedConversations,
+    pinnedConversations,
+    isLoading,
+    isChatsExpanded,
+    shouldShowFavorites,
+    search.query,
+  ]);
 
   // Store flattenedItems in a ref for keyMapper to access without recreating cache
   const flattenedItemsRef = useRef(flattenedItems);
@@ -232,11 +282,15 @@ const Conversations: FC<ConversationsProps> = ({
           if (item.type === 'favorites') {
             return `favorites-${favoritesContentKeyRef.current}`;
           }
-          if (item.type === 'chats-header') {
-            return 'chats-header';
+          if (item.type === 'pinned-header') {
+            return 'pinned-header';
+          }
+          if (item.type === 'pinned-convo') {
+            return `pinned-${item.convo.conversationId}`;
           }
           if (item.type === 'header') {
-            return `header-${item.groupName}`;
+            const firstHeaderIndex = flattenedItemsRef.current[0]?.type === 'favorites' ? 1 : 0;
+            return `header-${item.groupName}-${index === firstHeaderIndex ? 'first' : 'sub'}`;
           }
           if (item.type === 'convo') {
             return `convo-${item.convo.conversationId}`;
@@ -276,6 +330,17 @@ const Conversations: FC<ConversationsProps> = ({
     return () => cancelAnimationFrame(frameId);
   }, [search.query, cache, containerRef]);
 
+  /** Grid only re-derives row offsets when the row count changes; reorders that
+   *  keep the count (e.g. a convo bumped across date groups) need an explicit recompute. */
+  useEffect(() => {
+    const frameId = requestAnimationFrame(() => {
+      if (containerRef.current && 'recomputeRowHeights' in containerRef.current) {
+        containerRef.current.recomputeRowHeights(0);
+      }
+    });
+    return () => cancelAnimationFrame(frameId);
+  }, [flattenedItems, containerRef]);
+
   const rowRenderer = useCallback(
     ({ index, key, parent, style }) => {
       const item = flattenedItems[index];
@@ -297,22 +362,33 @@ const Conversations: FC<ConversationsProps> = ({
         );
       }
 
-      if (item.type === 'chats-header') {
+      if (item.type === 'pinned-header') {
         return (
           <MeasuredRow key={key} {...rowProps}>
-            <ChatsHeader
-              isExpanded={isChatsExpanded}
-              onToggle={() => setIsChatsExpanded(!isChatsExpanded)}
+            <PinnedHeader />
+          </MeasuredRow>
+        );
+      }
+
+      if (item.type === 'pinned-convo') {
+        const isGenerating = activeJobIds.has(item.convo.conversationId ?? '');
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <Convo
+              conversation={item.convo}
+              retainView={moveToTop}
+              toggleNav={toggleNav}
+              isGenerating={isGenerating}
             />
           </MeasuredRow>
         );
       }
 
       if (item.type === 'header') {
-        // First date header index depends on whether favorites row is included
-        // With favorites: [favorites, chats-header, first-header] → index 2
-        // Without favorites: [chats-header, first-header] → index 1
-        const firstHeaderIndex = shouldShowFavorites ? 2 : 1;
+        // First date header index depends on favorites row, pinned header, and pinned convos
+        // At most: [favorites, pinned-header, # pinned-convos] → first-header
+        const pinnedOffset = pinnedConversations.length > 0 ? pinnedConversations.length + 1 : 0;
+        const firstHeaderIndex = (flattenedItems[0]?.type === 'favorites' ? 1 : 0) + pinnedOffset;
         return (
           <MeasuredRow key={key} {...rowProps}>
             <DateLabel groupName={item.groupName} isFirst={index === firstHeaderIndex} />
@@ -324,7 +400,7 @@ const Conversations: FC<ConversationsProps> = ({
         const isGenerating = activeJobIds.has(item.convo.conversationId ?? '');
         return (
           <MeasuredRow key={key} {...rowProps}>
-            <MemoizedConvo
+            <Convo
               conversation={item.convo}
               retainView={moveToTop}
               toggleNav={toggleNav}
@@ -336,17 +412,7 @@ const Conversations: FC<ConversationsProps> = ({
 
       return null;
     },
-    [
-      cache,
-      flattenedItems,
-      moveToTop,
-      toggleNav,
-      isSmallScreen,
-      isChatsExpanded,
-      setIsChatsExpanded,
-      shouldShowFavorites,
-      activeJobIds,
-    ],
+    [cache, flattenedItems, moveToTop, toggleNav, isSmallScreen, pinnedConversations, activeJobIds],
   );
 
   const getRowHeight = useCallback(
@@ -370,34 +436,36 @@ const Conversations: FC<ConversationsProps> = ({
 
   return (
     <div className="relative flex h-full min-h-0 flex-col pb-2 text-sm text-text-primary">
+      <div className="px-3">
+        <ChatsHeader
+          isExpanded={isChatsExpanded}
+          onToggle={() => setIsChatsExpanded(!isChatsExpanded)}
+        />
+      </div>
       {isSearchLoading ? (
         <div className="flex flex-1 items-center justify-center">
           <Spinner className="text-text-primary" />
           <span className="ml-2 text-text-primary">{localize('com_ui_loading')}</span>
         </div>
       ) : (
-        <div className="flex-1">
-          <AutoSizer>
-            {({ width, height }) => (
-              <List
-                ref={containerRef}
-                width={width}
-                height={height}
-                deferredMeasurementCache={cache}
-                rowCount={flattenedItems.length}
-                rowHeight={getRowHeight}
-                rowRenderer={rowRenderer}
-                overscanRowCount={10}
-                aria-readonly={false}
-                className="outline-none"
-                aria-label="Conversations"
-                onRowsRendered={handleRowsRendered}
-                tabIndex={-1}
-                style={{ outline: 'none' }}
-                containerRole="rowgroup"
-              />
-            )}
-          </AutoSizer>
+        <div ref={listContainerRef} className="min-h-0 flex-1 overflow-hidden">
+          <List
+            ref={containerRef}
+            width={listWidth}
+            height={listHeight}
+            deferredMeasurementCache={cache}
+            rowCount={flattenedItems.length}
+            rowHeight={getRowHeight}
+            rowRenderer={rowRenderer}
+            overscanRowCount={10}
+            aria-readonly={false}
+            className="outline-none"
+            aria-label="Conversations"
+            onRowsRendered={handleRowsRendered}
+            tabIndex={-1}
+            style={{ outline: 'none' }}
+            containerRole="rowgroup"
+          />
         </div>
       )}
     </div>
diff --git a/client/src/components/Conversations/Convo.tsx b/client/src/components/Conversations/Convo.tsx
index 108755a291b..4c802b139d1 100644
--- a/client/src/components/Conversations/Convo.tsx
+++ b/client/src/components/Conversations/Convo.tsx
@@ -1,13 +1,14 @@
-import React, { useState, useEffect, useRef, useMemo, useCallback } from 'react';
+import React, { memo, useState, useEffect, useRef, useMemo, useCallback } from 'react';
+import { Pin } from 'lucide-react';
 import { useRecoilValue } from 'recoil';
 import { useParams } from 'react-router-dom';
 import { Constants } from 'librechat-data-provider';
 import { useToastContext, useMediaQuery } from '@librechat/client';
 import type { TConversation } from 'librechat-data-provider';
-import { useUpdateConversationMutation } from '~/data-provider';
-import EndpointIcon from '~/components/Endpoints/EndpointIcon';
 import { useNavigateToConvo, useLocalize, useShiftKey } from '~/hooks';
-import { useGetEndpointsQuery } from '~/data-provider';
+import ConversationEndpointIcon from './ConversationEndpointIcon';
+import { useUpdateConversationMutation } from '~/data-provider';
+import { areConversationRenderPropsEqual } from './utils';
 import { NotificationSeverity } from '~/common';
 import { ConvoOptions } from './ConvoOptions';
 import RenameForm from './RenameForm';
@@ -22,7 +23,7 @@ interface ConversationProps {
   isGenerating?: boolean;
 }
 
-export default function Conversation({
+function Conversation({
   conversation,
   retainView,
   toggleNav,
@@ -32,7 +33,6 @@ export default function Conversation({
   const localize = useLocalize();
   const { showToast } = useToastContext();
   const { navigateToConvo } = useNavigateToConvo();
-  const { data: endpointsConfig } = useGetEndpointsQuery();
   const currentConvoId = useMemo(() => params.conversationId, [params.conversationId]);
   const updateConvoMutation = useUpdateConversationMutation(currentConvoId ?? '');
   const activeConvos = useRecoilValue(store.allConversationsSelector);
@@ -142,7 +142,7 @@ export default function Conversation({
   }, []);
 
   const handleNavigation = (ctrlOrMetaKey: boolean) => {
-    if (ctrlOrMetaKey) {
+    if (ctrlOrMetaKey && !isGenerating) {
       toggleNav();
       const baseUrl = window.location.origin;
       const path = `/c/${conversationId}`;
@@ -162,21 +162,58 @@ export default function Conversation({
 
     navigateToConvo(conversation, {
       currentConvoId,
-      resetLatestMessage: !(conversationId ?? '') || conversationId === Constants.NEW_CONVO,
     });
   };
 
   const convoOptionsProps = {
     title,
+    isPinned: conversation.pinned,
     retainView,
     renameHandler: handleRename,
     isActiveConvo,
     conversationId,
+    chatProjectId: conversation.chatProjectId,
     isPopoverActive,
     setIsPopoverActive: handlePopoverOpenChange,
     isShiftHeld: isActiveConvo ? isShiftHeld : false,
   };
 
+  const generatingSpinner = (
+    <svg
+      className="h-5 w-5 flex-shrink-0 animate-spin text-text-primary"
+      viewBox="0 0 24 24"
+      fill="none"
+      aria-label={localize('com_ui_generating')}
+    >
+      <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="3" />
+      <path
+        className="opacity-75"
+        fill="currentColor"
+        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+      />
+    </svg>
+  );
+
+  let actionVisibilityClassName =
+    'pointer-events-none max-w-0 scale-x-0 opacity-0 group-focus-within:pointer-events-auto group-focus-within:max-w-[60px] group-focus-within:scale-x-100 group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:max-w-[60px] group-hover:scale-x-100 group-hover:opacity-100';
+  if (isGenerating) {
+    actionVisibilityClassName = 'pointer-events-none w-5 scale-x-100 opacity-100';
+  } else if (isPopoverActive || isActiveConvo) {
+    actionVisibilityClassName = 'pointer-events-auto scale-x-100 opacity-100';
+  }
+
+  let actionWidthClassName = '';
+  if (!isGenerating && !isPopoverActive && isActiveConvo && isShiftHeld) {
+    actionWidthClassName = 'max-w-[60px]';
+  } else if (!isGenerating) {
+    actionWidthClassName = 'max-w-[28px]';
+  }
+
+  const showConvoOptions = !renaming && (hasInteracted || isActiveConvo);
+  const actionContent = isGenerating
+    ? generatingSpinner
+    : showConvoOptions && <ConvoOptions {...convoOptionsProps} />;
+
   return (
     <div
       ref={containerRef}
@@ -235,52 +272,27 @@ export default function Conversation({
           isSmallScreen={isSmallScreen}
           localize={localize}
         >
-          {isGenerating ? (
-            <svg
-              className="h-5 w-5 flex-shrink-0 animate-spin text-text-primary"
-              viewBox="0 0 24 24"
-              fill="none"
-              aria-label={localize('com_ui_generating')}
-            >
-              <circle
-                className="opacity-25"
-                cx="12"
-                cy="12"
-                r="10"
-                stroke="currentColor"
-                strokeWidth="3"
-              />
-              <path
-                className="opacity-75"
-                fill="currentColor"
-                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-              />
-            </svg>
-          ) : (
-            <EndpointIcon
-              conversation={conversation}
-              endpointsConfig={endpointsConfig}
-              size={20}
-              context="menu-item"
-            />
-          )}
+          <ConversationEndpointIcon conversation={conversation} size={20} context="menu-item" />
         </ConvoLink>
       )}
+      {conversation.pinned === true && (
+        <Pin className="icon-sm mr-1 shrink-0 text-text-primary" aria-hidden="true" />
+      )}
       <div
         className={cn(
-          'mr-2 flex origin-left',
-          isPopoverActive || isActiveConvo
-            ? 'pointer-events-auto scale-x-100 opacity-100'
-            : 'pointer-events-none max-w-0 scale-x-0 opacity-0 group-focus-within:pointer-events-auto group-focus-within:max-w-[60px] group-focus-within:scale-x-100 group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:max-w-[60px] group-hover:scale-x-100 group-hover:opacity-100',
-          !isPopoverActive && isActiveConvo && isShiftHeld ? 'max-w-[60px]' : 'max-w-[28px]',
+          'mr-2 flex origin-left items-center justify-center',
+          actionVisibilityClassName,
+          actionWidthClassName,
         )}
         // Removing aria-hidden to fix accessibility issue: ARIA hidden element must not be focusable or contain focusable elements
         // but not sure what its original purpose was, so leaving the property commented out until it can be cleared safe to delete.
         // aria-hidden={!(isPopoverActive || isActiveConvo)}
       >
         {/* Only render ConvoOptions when user interacts (hover/focus) or for active conversation */}
-        {!renaming && (hasInteracted || isActiveConvo) && <ConvoOptions {...convoOptionsProps} />}
+        {actionContent}
       </div>
     </div>
   );
 }
+
+export default memo(Conversation, areConversationRenderPropsEqual);
diff --git a/client/src/components/Conversations/ConvoLink.tsx b/client/src/components/Conversations/ConvoLink.tsx
index 543407501e7..e425757635f 100644
--- a/client/src/components/Conversations/ConvoLink.tsx
+++ b/client/src/components/Conversations/ConvoLink.tsx
@@ -23,7 +23,7 @@ const ConvoLink: React.FC<ConvoLinkProps> = ({
   return (
     <div
       className={cn(
-        'flex grow items-center gap-2 overflow-hidden rounded-lg px-2',
+        'flex min-w-0 grow items-center gap-2 overflow-hidden rounded-lg px-2',
         isActiveConvo || isPopoverActive ? 'bg-surface-active-alt' : '',
       )}
       title={title ?? undefined}
@@ -45,16 +45,16 @@ const ConvoLink: React.FC<ConvoLinkProps> = ({
         aria-label={title || localize('com_ui_untitled')}
       >
         {title || localize('com_ui_untitled')}
+        <div
+          className={cn(
+            'pointer-events-none absolute bottom-0 right-0 top-0 w-20 bg-gradient-to-l',
+            isActiveConvo || isPopoverActive
+              ? 'from-surface-active-alt'
+              : 'from-surface-primary-alt from-0% to-transparent group-hover:from-surface-active-alt group-hover:from-0%',
+          )}
+          aria-hidden="true"
+        />
       </div>
-      <div
-        className={cn(
-          'pointer-events-none absolute bottom-0.5 right-0.5 top-0.5 w-20 rounded-r-md bg-gradient-to-l',
-          isActiveConvo || isPopoverActive
-            ? 'from-surface-active-alt'
-            : 'from-surface-primary-alt from-0% to-transparent group-hover:from-surface-active-alt group-hover:from-40%',
-        )}
-        aria-hidden="true"
-      />
     </div>
   );
 };
diff --git a/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx b/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
index 25889e0e676..47d0370bb05 100644
--- a/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
+++ b/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
@@ -1,28 +1,43 @@
 import { useState, useId, useRef, memo, useCallback, useMemo } from 'react';
 import * as Ariakit from '@ariakit/react';
-import { useParams, useNavigate } from 'react-router-dom';
-import { QueryKeys } from 'librechat-data-provider';
 import { useQueryClient } from '@tanstack/react-query';
+import { useParams, useNavigate } from 'react-router-dom';
 import { DropdownPopup, Spinner, useToastContext } from '@librechat/client';
-import { Ellipsis, Share2, CopyPlus, Archive, Pen, Trash } from 'lucide-react';
-import type { MouseEvent } from 'react';
+import { QueryKeys, PermissionTypes, Permissions } from 'librechat-data-provider';
+import {
+  Ellipsis,
+  Share2,
+  CopyPlus,
+  Archive,
+  FolderInput,
+  FolderX,
+  Pen,
+  Pin,
+  Trash,
+} from 'lucide-react';
 import type { TMessage } from 'librechat-data-provider';
+import type { MouseEvent } from 'react';
 import {
   useDuplicateConversationMutation,
+  useAssignConversationToProjectMutation,
   useDeleteConversationMutation,
   useGetStartupConfig,
   useArchiveConvoMutation,
+  usePinConversationMutation,
 } from '~/data-provider';
-import { useLocalize, useNavigateToConvo, useNewConvo } from '~/hooks';
+import { useHasAccess, useLocalize, useNavigateToConvo, useNewConvo } from '~/hooks';
 import { NotificationSeverity } from '~/common';
 import { useChatContext } from '~/Providers';
+import ProjectButton from './ProjectButton';
 import DeleteButton from './DeleteButton';
 import ShareButton from './ShareButton';
 import { cn } from '~/utils';
 
 function ConvoOptions({
   conversationId,
+  chatProjectId,
   title,
+  isPinned = false,
   retainView,
   renameHandler,
   isPopoverActive,
@@ -31,7 +46,9 @@ function ConvoOptions({
   isShiftHeld = false,
 }: {
   conversationId: string | null;
+  chatProjectId?: string | null;
   title: string | null;
+  isPinned?: boolean;
   retainView: () => void;
   renameHandler: (e: MouseEvent) => void;
   isPopoverActive: boolean;
@@ -53,11 +70,20 @@ function ConvoOptions({
   const menuId = useId();
   const shareButtonRef = useRef<HTMLButtonElement>(null);
   const deleteButtonRef = useRef<HTMLButtonElement>(null);
+  const projectButtonRef = useRef<HTMLButtonElement>(null);
   const [showShareDialog, setShowShareDialog] = useState(false);
   const [showDeleteDialog, setShowDeleteDialog] = useState(false);
+  const [showProjectDialog, setShowProjectDialog] = useState(false);
   const [announcement, setAnnouncement] = useState('');
 
+  const canCreateSharedLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.CREATE,
+  });
+
   const archiveConvoMutation = useArchiveConvoMutation();
+  const assignConversationToProject = useAssignConversationToProjectMutation();
+  const pinConvoMutation = usePinConversationMutation();
 
   const deleteMutation = useDeleteConversationMutation({
     onSuccess: () => {
@@ -106,6 +132,7 @@ function ConvoOptions({
 
   const isDuplicateLoading = duplicateConversation.isLoading;
   const isArchiveLoading = archiveConvoMutation.isLoading;
+  const isPinLoading = pinConvoMutation.isLoading;
   const isDeleteLoading = deleteMutation.isLoading;
 
   const shareHandler = useCallback(() => {
@@ -116,6 +143,37 @@ function ConvoOptions({
     setShowDeleteDialog(true);
   }, []);
 
+  const projectHandler = useCallback(() => {
+    setShowProjectDialog(true);
+  }, []);
+
+  const removeProjectHandler = useCallback(() => {
+    const convoId = conversationId ?? '';
+    if (!convoId) {
+      return;
+    }
+    assignConversationToProject.mutate(
+      { conversationId: convoId, projectId: null },
+      {
+        onSuccess: () => {
+          setIsPopoverActive(false);
+          showToast({
+            message: localize('com_ui_project_updated'),
+            severity: NotificationSeverity.SUCCESS,
+            showIcon: true,
+          });
+        },
+        onError: () => {
+          showToast({
+            message: localize('com_ui_project_update_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+  }, [assignConversationToProject, conversationId, localize, setIsPopoverActive, showToast]);
+
   const handleInstantDelete = useCallback(
     (e: MouseEvent) => {
       e.stopPropagation();
@@ -177,6 +235,26 @@ function ConvoOptions({
     ],
   );
 
+  const handlePinClick = useCallback(() => {
+    const convoId = conversationId ?? '';
+    if (!convoId) {
+      return;
+    }
+    pinConvoMutation.mutate(
+      { conversationId: convoId, pinned: !isPinned },
+      {
+        onSuccess: () => setIsPopoverActive(false),
+        onError: () => {
+          showToast({
+            message: localize(isPinned ? 'com_ui_unpin_error' : 'com_ui_pin_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+  }, [conversationId, isPinned, pinConvoMutation, setIsPopoverActive, showToast, localize]);
+
   const handleDuplicateClick = useCallback(() => {
     duplicateConversation.mutate({
       conversationId: conversationId ?? '',
@@ -189,7 +267,7 @@ function ConvoOptions({
         label: localize('com_ui_share'),
         onClick: shareHandler,
         icon: <Share2 className="icon-sm mr-2 text-text-primary" aria-hidden="true" />,
-        show: startupConfig && startupConfig.sharedLinksEnabled,
+        show: startupConfig && startupConfig.sharedLinksEnabled && canCreateSharedLinks,
         ariaHasPopup: 'dialog' as const,
         ariaControls: 'share-conversation-dialog',
         /** NOTE: THE FOLLOWING PROPS ARE REQUIRED FOR MENU ITEMS THAT OPEN DIALOGS */
@@ -197,6 +275,16 @@ function ConvoOptions({
         ref: shareButtonRef,
         render: (props) => <button {...props} />,
       },
+      {
+        label: localize(isPinned ? 'com_ui_unpin' : 'com_ui_pin'),
+        onClick: handlePinClick,
+        hideOnClick: false,
+        icon: isPinLoading ? (
+          <Spinner className="size-4" />
+        ) : (
+          <Pin className="icon-sm mr-2 text-text-primary" aria-hidden="true" />
+        ),
+      },
       {
         label: localize('com_ui_rename'),
         onClick: renameHandler,
@@ -212,6 +300,27 @@ function ConvoOptions({
           <CopyPlus className="icon-sm mr-2 text-text-primary" aria-hidden="true" />
         ),
       },
+      {
+        label: localize('com_ui_change_project'),
+        onClick: projectHandler,
+        icon: <FolderInput className="icon-sm mr-2 text-text-primary" aria-hidden="true" />,
+        ariaHasPopup: 'dialog' as const,
+        ariaControls: 'project-conversation-dialog',
+        hideOnClick: false,
+        ref: projectButtonRef,
+        render: (props) => <button {...props} />,
+      },
+      {
+        label: localize('com_ui_remove_from_project'),
+        onClick: removeProjectHandler,
+        show: Boolean(chatProjectId),
+        hideOnClick: false,
+        icon: assignConversationToProject.isLoading ? (
+          <Spinner className="size-4" />
+        ) : (
+          <FolderX className="icon-sm mr-2 text-text-primary" aria-hidden="true" />
+        ),
+      },
       {
         label: localize('com_ui_archive'),
         onClick: handleArchiveClick,
@@ -236,14 +345,22 @@ function ConvoOptions({
     ],
     [
       localize,
+      isPinned,
+      isPinLoading,
       shareHandler,
       startupConfig,
       renameHandler,
       deleteHandler,
       isArchiveLoading,
       isDuplicateLoading,
+      handlePinClick,
       handleArchiveClick,
+      canCreateSharedLinks,
       handleDuplicateClick,
+      projectHandler,
+      removeProjectHandler,
+      chatProjectId,
+      assignConversationToProject.isLoading,
     ],
   );
 
@@ -342,6 +459,16 @@ function ConvoOptions({
           setShowDeleteDialog={setShowDeleteDialog}
         />
       )}
+      {showProjectDialog && (
+        <ProjectButton
+          conversationId={conversationId ?? ''}
+          chatProjectId={chatProjectId}
+          setMenuOpen={setIsPopoverActive}
+          triggerRef={projectButtonRef}
+          showProjectDialog={showProjectDialog}
+          setShowProjectDialog={setShowProjectDialog}
+        />
+      )}
     </>
   );
 }
@@ -350,6 +477,8 @@ export default memo(ConvoOptions, (prevProps, nextProps) => {
   return (
     prevProps.conversationId === nextProps.conversationId &&
     prevProps.title === nextProps.title &&
+    prevProps.chatProjectId === nextProps.chatProjectId &&
+    prevProps.isPinned === nextProps.isPinned &&
     prevProps.isPopoverActive === nextProps.isPopoverActive &&
     prevProps.isActiveConvo === nextProps.isActiveConvo &&
     prevProps.isShiftHeld === nextProps.isShiftHeld
diff --git a/client/src/components/Conversations/ConvoOptions/DeleteButton.tsx b/client/src/components/Conversations/ConvoOptions/DeleteButton.tsx
index 17691b4a080..b49cff6e2e0 100644
--- a/client/src/components/Conversations/ConvoOptions/DeleteButton.tsx
+++ b/client/src/components/Conversations/ConvoOptions/DeleteButton.tsx
@@ -26,11 +26,13 @@ type DeleteButtonProps = {
   setShowDeleteDialog?: (value: boolean) => void;
   triggerRef?: React.RefObject<HTMLButtonElement>;
   setMenuOpen?: (open: boolean) => void;
+  currentConversationId?: string;
 };
 
 export function DeleteConversationDialog({
   setShowDeleteDialog,
   conversationId,
+  currentConversationId,
   setMenuOpen,
   retainView,
   title,
@@ -38,6 +40,7 @@ export function DeleteConversationDialog({
   setMenuOpen?: (open: boolean) => void;
   setShowDeleteDialog: (value: boolean) => void;
   conversationId: string;
+  currentConversationId?: string;
   retainView: () => void;
   title: string;
 }) {
@@ -46,7 +49,8 @@ export function DeleteConversationDialog({
   const queryClient = useQueryClient();
   const { showToast } = useToastContext();
   const { newConversation } = useNewConvo();
-  const { conversationId: currentConvoId } = useParams();
+  const { conversationId: routeConversationId } = useParams();
+  const currentConvoId = currentConversationId ?? routeConversationId;
 
   const deleteMutation = useDeleteConversationMutation({
     onSuccess: () => {
@@ -112,6 +116,7 @@ export function DeleteConversationDialog({
 
 export default function DeleteButton({
   conversationId,
+  currentConversationId,
   retainView,
   title,
   setMenuOpen,
@@ -132,6 +137,7 @@ export default function DeleteButton({
       <DeleteConversationDialog
         setShowDeleteDialog={setShowDeleteDialog}
         conversationId={conversationId}
+        currentConversationId={currentConversationId}
         setMenuOpen={setMenuOpen}
         retainView={retainView}
         title={title}
diff --git a/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx b/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx
new file mode 100644
index 00000000000..a0860ef29b7
--- /dev/null
+++ b/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx
@@ -0,0 +1,157 @@
+import { useEffect, useMemo, useState, type RefObject } from 'react';
+import {
+  Button,
+  Spinner,
+  OGDialog,
+  OGDialogClose,
+  OGDialogTitle,
+  OGDialogHeader,
+  OGDialogContent,
+  useToastContext,
+} from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import { useAssignConversationToProjectMutation, useProjectsInfiniteQuery } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+import { NotificationSeverity } from '~/common';
+
+type ProjectButtonProps = {
+  conversationId: string;
+  chatProjectId?: string | null;
+  showProjectDialog?: boolean;
+  setShowProjectDialog?: (value: boolean) => void;
+  triggerRef?: RefObject<HTMLButtonElement>;
+  setMenuOpen?: (open: boolean) => void;
+};
+
+function ProjectConversationDialog({
+  conversationId,
+  chatProjectId,
+  setMenuOpen,
+  setShowProjectDialog,
+}: {
+  conversationId: string;
+  chatProjectId?: string | null;
+  setMenuOpen?: (open: boolean) => void;
+  setShowProjectDialog: (value: boolean) => void;
+}) {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+  const [selectedProjectId, setSelectedProjectId] = useState(chatProjectId ?? '');
+  const assignConversation = useAssignConversationToProjectMutation();
+  const { data, fetchNextPage, isFetchingNextPage } = useProjectsInfiniteQuery({
+    sortBy: 'name',
+    sortDirection: 'asc',
+  });
+
+  const projects = useMemo<TChatProject[]>(
+    () => data?.pages.flatMap((page) => page.projects) ?? [],
+    [data?.pages],
+  );
+  const hasNextPage = data?.pages[data.pages.length - 1]?.nextCursor != null;
+
+  useEffect(() => {
+    setSelectedProjectId(chatProjectId ?? '');
+  }, [chatProjectId]);
+
+  const saveProject = () => {
+    assignConversation.mutate(
+      {
+        conversationId,
+        projectId: selectedProjectId || null,
+      },
+      {
+        onSuccess: () => {
+          setShowProjectDialog(false);
+          setMenuOpen?.(false);
+          showToast({
+            message: localize('com_ui_project_updated'),
+            severity: NotificationSeverity.SUCCESS,
+            showIcon: true,
+          });
+        },
+        onError: () => {
+          showToast({
+            message: localize('com_ui_project_update_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+  };
+
+  return (
+    <OGDialogContent
+      id="project-conversation-dialog"
+      className="w-11/12 max-w-md"
+      showCloseButton={false}
+    >
+      <OGDialogHeader>
+        <OGDialogTitle>{localize('com_ui_change_project')}</OGDialogTitle>
+      </OGDialogHeader>
+      <label className="flex flex-col gap-2 text-sm text-text-primary">
+        {localize('com_ui_select_project')}
+        <select
+          value={selectedProjectId}
+          onChange={(event) => setSelectedProjectId(event.target.value)}
+          className="h-10 rounded-lg border border-border-light bg-surface-primary px-3 text-sm outline-none focus:ring-2 focus:ring-ring-primary"
+        >
+          <option value="">{localize('com_ui_unassigned')}</option>
+          {projects.map((project) => (
+            <option key={project._id} value={project._id}>
+              {project.name}
+            </option>
+          ))}
+        </select>
+      </label>
+      {hasNextPage && (
+        <button
+          type="button"
+          className="mt-3 text-sm text-text-secondary hover:text-text-primary"
+          onClick={() => fetchNextPage()}
+          disabled={isFetchingNextPage}
+        >
+          {isFetchingNextPage ? localize('com_ui_loading') : localize('com_ui_load_more')}
+        </button>
+      )}
+      <div className="flex justify-end gap-4 pt-4">
+        <OGDialogClose asChild>
+          <Button aria-label="cancel" variant="outline">
+            {localize('com_ui_cancel')}
+          </Button>
+        </OGDialogClose>
+        <Button onClick={saveProject} disabled={assignConversation.isLoading}>
+          {assignConversation.isLoading ? <Spinner /> : localize('com_ui_save')}
+        </Button>
+      </div>
+    </OGDialogContent>
+  );
+}
+
+export default function ProjectButton({
+  conversationId,
+  chatProjectId,
+  setMenuOpen,
+  showProjectDialog,
+  setShowProjectDialog,
+  triggerRef,
+}: ProjectButtonProps) {
+  if (showProjectDialog === undefined || setShowProjectDialog === undefined) {
+    return null;
+  }
+
+  if (!conversationId) {
+    return null;
+  }
+
+  return (
+    <OGDialog open={showProjectDialog} onOpenChange={setShowProjectDialog} triggerRef={triggerRef}>
+      <ProjectConversationDialog
+        conversationId={conversationId}
+        chatProjectId={chatProjectId}
+        setMenuOpen={setMenuOpen}
+        setShowProjectDialog={setShowProjectDialog}
+      />
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Conversations/ConvoOptions/ShareButton.tsx b/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
index 0bf2cb093b5..d1dfeb162dc 100644
--- a/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
+++ b/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
@@ -1,13 +1,13 @@
 import React, { useState, useEffect } from 'react';
-import { useRecoilValue } from 'recoil';
 import { QRCodeSVG } from 'qrcode.react';
 import { Copy, CopyCheck } from 'lucide-react';
 import { useGetSharedLinkQuery } from 'librechat-data-provider/react-query';
-import { OGDialogTemplate, Button, Spinner, OGDialog } from '@librechat/client';
+import { OGDialogTemplate, Button, Spinner, OGDialog, Checkbox, Label } from '@librechat/client';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { useLocalize, useCopyToClipboard } from '~/hooks';
+import { useGetStartupConfig } from '~/data-provider';
 import SharedLinkButton from './SharedLinkButton';
 import { buildShareLinkUrl, cn } from '~/utils';
-import store from '~/store';
 
 export default function ShareButton({
   conversationId,
@@ -23,8 +23,11 @@ export default function ShareButton({
   children?: React.ReactNode;
 }) {
   const localize = useLocalize();
+  const { data: startupConfig } = useGetStartupConfig();
+  const canSnapshotFiles = startupConfig?.sharedLinksSnapshotFilesEnabled === true;
   const [showQR, setShowQR] = useState(false);
   const [sharedLink, setSharedLink] = useState('');
+  const [snapshotFiles, setSnapshotFiles] = useState(true);
   const [isCopying, setIsCopying] = useState(false);
   const [announcement, setAnnouncement] = useState('');
   const copyLink = useCopyToClipboard({ text: sharedLink });
@@ -35,29 +38,37 @@ export default function ShareButton({
       setAnnouncement('');
     }, 1000);
   };
-  const latestMessage = useRecoilValue(store.latestMessageFamily(0));
+  const latestMessage = useLatestMessage(0);
   const { data: share, isLoading } = useGetSharedLinkQuery(conversationId);
+  const shareId = share?.shareId ?? '';
 
   useEffect(() => {
-    if (share?.shareId !== undefined) {
-      setSharedLink(buildShareLinkUrl(share.shareId));
+    if (shareId) {
+      setSharedLink(buildShareLinkUrl(shareId));
     }
-  }, [share]);
+  }, [shareId]);
+
+  // Reflect an existing link's stored "share files" choice so the checkbox isn't
+  // misleading (legacy links have no stored choice → keep the default of enabled).
+  useEffect(() => {
+    if (share?.success === true && typeof share.snapshotFiles === 'boolean') {
+      setSnapshotFiles(share.snapshotFiles);
+    }
+  }, [share?.success, share?.snapshotFiles]);
 
   const button =
     isLoading === true ? null : (
       <SharedLinkButton
         share={share}
         conversationId={conversationId}
-        targetMessageId={latestMessage?.messageId}
+        targetMessageId={latestMessage?.messageId ?? undefined}
         showQR={showQR}
         setShowQR={setShowQR}
         setSharedLink={setSharedLink}
+        snapshotFiles={canSnapshotFiles ? snapshotFiles : undefined}
       />
     );
 
-  const shareId = share?.shareId ?? '';
-
   return (
     <OGDialog open={open} onOpenChange={onOpenChange} triggerRef={triggerRef}>
       {children}
@@ -80,6 +91,33 @@ export default function ShareButton({
                   : localize('com_ui_share_create_message');
               })()}
             </div>
+            {canSnapshotFiles && isLoading !== true && (
+              <div className="flex items-start gap-3 px-2 py-2">
+                <Checkbox
+                  id="share-files-checkbox"
+                  checked={snapshotFiles}
+                  onCheckedChange={(checked) => setSnapshotFiles(checked === true)}
+                  aria-label={localize('com_ui_share_files')}
+                  className="mt-0.5"
+                />
+                <div className="flex flex-col gap-0.5">
+                  <Label
+                    htmlFor="share-files-checkbox"
+                    className="cursor-pointer text-sm font-medium text-text-primary"
+                  >
+                    {localize('com_ui_share_files')}
+                  </Label>
+                  <span className="text-xs text-text-secondary">
+                    {localize('com_ui_share_files_description')}
+                  </span>
+                  {shareId && (
+                    <span className="text-xs font-medium text-text-secondary">
+                      {localize('com_ui_share_files_refresh_note')}
+                    </span>
+                  )}
+                </div>
+              </div>
+            )}
             <div className="relative items-center overflow-auto rounded-lg p-2">
               {showQR && (
                 <div className="mb-4 flex flex-col items-center">
@@ -95,7 +133,12 @@ export default function ShareButton({
 
               {shareId && (
                 <div className="flex items-center gap-2 rounded-md bg-surface-secondary p-2">
-                  <div className="flex-1 break-all text-sm text-text-secondary">{sharedLink}</div>
+                  <div
+                    className="flex-1 break-all text-sm text-text-secondary"
+                    data-testid="shared-link-url"
+                  >
+                    {sharedLink}
+                  </div>
                   <span className="sr-only" aria-live="polite" aria-atomic="true">
                     {announcement}
                   </span>
diff --git a/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx b/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
index 7c53cab64c0..4455ed7b5fa 100644
--- a/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
+++ b/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
@@ -1,6 +1,12 @@
 import { useState, useRef } from 'react';
 import { Trans } from 'react-i18next';
 import { QrCode, RotateCw, Trash2 } from 'lucide-react';
+import {
+  PermissionTypes,
+  Permissions,
+  PermissionBits,
+  ResourceType,
+} from 'librechat-data-provider';
 import {
   Label,
   Button,
@@ -19,9 +25,10 @@ import {
   useUpdateSharedLinkMutation,
   useDeleteSharedLinkMutation,
 } from '~/data-provider';
+import GenericGrantAccessDialog from '~/components/Sharing/GenericGrantAccessDialog';
+import { useHasAccess, useResourcePermissions, useLocalize } from '~/hooks';
 import { NotificationSeverity } from '~/common';
 import { buildShareLinkUrl } from '~/utils';
-import { useLocalize } from '~/hooks';
 
 export default function SharedLinkButton({
   share,
@@ -30,6 +37,7 @@ export default function SharedLinkButton({
   showQR,
   setShowQR,
   setSharedLink,
+  snapshotFiles,
 }: {
   share: TSharedLinkGetResponse | undefined;
   conversationId: string;
@@ -37,6 +45,7 @@ export default function SharedLinkButton({
   showQR: boolean;
   setShowQR: (showQR: boolean) => void;
   setSharedLink: (sharedLink: string) => void;
+  snapshotFiles?: boolean;
 }) {
   const localize = useLocalize();
   const { showToast } = useToastContext();
@@ -92,7 +101,7 @@ export default function SharedLinkButton({
     if (!shareId) {
       return;
     }
-    const updateShare = await mutateAsync({ shareId });
+    const updateShare = await mutateAsync({ shareId, targetMessageId, snapshotFiles });
     const newLink = generateShareLink(updateShare.shareId);
     setSharedLink(newLink);
     setAnnouncement(localize('com_ui_link_refreshed'));
@@ -102,7 +111,7 @@ export default function SharedLinkButton({
   };
 
   const createShareLink = async () => {
-    const share = await mutate({ conversationId, targetMessageId });
+    const share = await mutate({ conversationId, targetMessageId, snapshotFiles });
     const newLink = generateShareLink(share.shareId);
     setSharedLink(newLink);
   };
@@ -127,6 +136,22 @@ export default function SharedLinkButton({
     }
   };
 
+  const hasAccessToShareLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.SHARE,
+  });
+
+  const { hasPermission, isLoading: permissionsLoading } = useResourcePermissions(
+    ResourceType.SHARED_LINK,
+    share?._id || '',
+  );
+
+  const canManageAccess =
+    hasAccessToShareLinks &&
+    !permissionsLoading &&
+    hasPermission(PermissionBits.SHARE) &&
+    !!share?._id;
+
   const qrCodeLabel = showQR ? localize('com_ui_hide_qr') : localize('com_ui_show_qr');
 
   return (
@@ -192,6 +217,27 @@ export default function SharedLinkButton({
                 </Button>
               )}
             />
+
+            {canManageAccess && (
+              <GenericGrantAccessDialog
+                resourceType={ResourceType.SHARED_LINK}
+                resourceDbId={share?._id}
+                resourceName={share?.shareId ?? undefined}
+              >
+                <TooltipAnchor
+                  description={localize('com_ui_shared_link_manage_access')}
+                  render={(props) => (
+                    <Button
+                      {...props}
+                      variant="outline"
+                      aria-label={localize('com_ui_shared_link_manage_access')}
+                    >
+                      {localize('com_ui_shared_link_manage_access')}
+                    </Button>
+                  )}
+                />
+              </GenericGrantAccessDialog>
+            )}
           </div>
         )}
         <OGDialog
diff --git a/client/src/components/Conversations/ConvoOptions/index.js b/client/src/components/Conversations/ConvoOptions/index.js
index c294bb45ce6..44a5e2c9d3d 100644
--- a/client/src/components/Conversations/ConvoOptions/index.js
+++ b/client/src/components/Conversations/ConvoOptions/index.js
@@ -1,4 +1,5 @@
 export * from './DeleteButton';
+export { default as ProjectButton } from './ProjectButton';
 export { default as ShareButton } from './ShareButton';
 export { default as SharedLinkButton } from './SharedLinkButton';
 export { default as ConvoOptions } from './ConvoOptions';
diff --git a/client/src/components/Conversations/ConvoOptions/index.ts b/client/src/components/Conversations/ConvoOptions/index.ts
index c294bb45ce6..44a5e2c9d3d 100644
--- a/client/src/components/Conversations/ConvoOptions/index.ts
+++ b/client/src/components/Conversations/ConvoOptions/index.ts
@@ -1,4 +1,5 @@
 export * from './DeleteButton';
+export { default as ProjectButton } from './ProjectButton';
 export { default as ShareButton } from './ShareButton';
 export { default as SharedLinkButton } from './SharedLinkButton';
 export { default as ConvoOptions } from './ConvoOptions';
diff --git a/client/src/components/Conversations/ProjectsSection.tsx b/client/src/components/Conversations/ProjectsSection.tsx
new file mode 100644
index 00000000000..23c19f4ddec
--- /dev/null
+++ b/client/src/components/Conversations/ProjectsSection.tsx
@@ -0,0 +1,565 @@
+import { memo, useCallback, useEffect, useId, useMemo, useRef, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { QueryKeys } from 'librechat-data-provider';
+import { useQueryClient } from '@tanstack/react-query';
+import { useRecoilCallback, useRecoilValue } from 'recoil';
+import { useNavigate, useLocation } from 'react-router-dom';
+import {
+  ChevronDown,
+  ChevronRight,
+  Ellipsis,
+  Folder,
+  FolderPlus,
+  Folders,
+  Pencil,
+  Trash2,
+} from 'lucide-react';
+import {
+  Button,
+  Input,
+  Spinner,
+  OGDialog,
+  OGDialogClose,
+  OGDialogTitle,
+  OGDialogHeader,
+  OGDialogContent,
+  TooltipAnchor,
+  DropdownPopup,
+  NewChatIcon,
+  useToastContext,
+} from '@librechat/client';
+import type { TChatProject, TConversation } from 'librechat-data-provider';
+import type { MenuItemProps } from '~/common';
+import {
+  useProjectsInfiniteQuery,
+  useActiveJobs,
+  useConversationsInfiniteQuery,
+  useUpdateProjectMutation,
+  useDeleteProjectMutation,
+} from '~/data-provider';
+import ProjectCreateDialog from '~/components/Projects/ProjectCreateDialog';
+import { useLocalize, useLocalStorage, useNewConvo } from '~/hooks';
+import { clearMessagesCache, cn } from '~/utils';
+import { NotificationSeverity } from '~/common';
+import Convo from './Convo';
+import store from '~/store';
+
+const INLINE_CHAT_LIMIT = 8;
+
+const iconButtonClassName =
+  'flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-text-secondary outline-none transition-colors hover:bg-surface-active-alt hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white';
+
+function ProjectRenameDialog({
+  open,
+  onOpenChange,
+  project,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  project: TChatProject;
+}) {
+  const localize = useLocalize();
+  const formId = useId();
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const [name, setName] = useState(project.name);
+  const updateProject = useUpdateProjectMutation();
+  const { showToast } = useToastContext();
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+    setName(project.name);
+    const frameId = requestAnimationFrame(() => inputRef.current?.focus());
+    return () => cancelAnimationFrame(frameId);
+  }, [open, project.name]);
+
+  const handleSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const trimmed = name.trim();
+    if (!trimmed || updateProject.isLoading) {
+      return;
+    }
+    updateProject.mutate(
+      { projectId: project._id, name: trimmed },
+      {
+        onSuccess: () => onOpenChange(false),
+        onError: () =>
+          showToast({
+            message: localize('com_ui_project_rename_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          }),
+      },
+    );
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange}>
+      <OGDialogContent className="w-11/12 max-w-md" showCloseButton={false}>
+        <OGDialogHeader>
+          <OGDialogTitle>{localize('com_ui_rename_project')}</OGDialogTitle>
+        </OGDialogHeader>
+        <form id={formId} onSubmit={handleSubmit}>
+          <Input
+            ref={inputRef}
+            value={name}
+            onChange={(event) => setName(event.target.value)}
+            aria-label={localize('com_ui_project_name')}
+            className="w-full bg-transparent text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+          />
+        </form>
+        <div className="flex justify-end gap-4 pt-4">
+          <OGDialogClose asChild>
+            <Button aria-label="cancel" variant="outline">
+              {localize('com_ui_cancel')}
+            </Button>
+          </OGDialogClose>
+          <Button
+            type="submit"
+            form={formId}
+            variant="submit"
+            disabled={!name.trim() || updateProject.isLoading}
+          >
+            {updateProject.isLoading ? <Spinner className="size-4" /> : localize('com_ui_save')}
+          </Button>
+        </div>
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
+
+function ProjectDeleteDialog({
+  open,
+  onOpenChange,
+  project,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  project: TChatProject;
+}) {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const location = useLocation();
+  const deleteProject = useDeleteProjectMutation();
+  const { showToast } = useToastContext();
+
+  const confirmDelete = () => {
+    deleteProject.mutate(project._id, {
+      onSuccess: () => {
+        onOpenChange(false);
+        if (location.pathname === `/projects/${project._id}`) {
+          navigate('/projects');
+        }
+      },
+      onError: () =>
+        showToast({
+          message: localize('com_ui_project_delete_error'),
+          severity: NotificationSeverity.ERROR,
+          showIcon: true,
+        }),
+    });
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange}>
+      <OGDialogContent className="w-11/12 max-w-md" showCloseButton={false}>
+        <OGDialogHeader>
+          <OGDialogTitle>{localize('com_ui_delete_project')}</OGDialogTitle>
+        </OGDialogHeader>
+        <div className="text-sm text-text-secondary">
+          {localize('com_ui_delete_project_confirm', { name: project.name })}
+        </div>
+        <div className="flex justify-end gap-4 pt-4">
+          <OGDialogClose asChild>
+            <Button aria-label="cancel" variant="outline">
+              {localize('com_ui_cancel')}
+            </Button>
+          </OGDialogClose>
+          <Button variant="destructive" onClick={confirmDelete} disabled={deleteProject.isLoading}>
+            {deleteProject.isLoading ? <Spinner className="size-4" /> : localize('com_ui_delete')}
+          </Button>
+        </div>
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
+
+const noop = () => {};
+
+type ProjectChatsInlineProps = {
+  projectId: string;
+  toggleNav: () => void;
+  onShowAll: () => void;
+};
+
+const ProjectChatsInline = memo(function ProjectChatsInline({
+  projectId,
+  toggleNav,
+  onShowAll,
+}: ProjectChatsInlineProps) {
+  const localize = useLocalize();
+  const { data: activeJobsData } = useActiveJobs();
+  const activeJobIds = useMemo(
+    () => new Set(activeJobsData?.activeJobIds ?? []),
+    [activeJobsData?.activeJobIds],
+  );
+  const { data, isLoading } = useConversationsInfiniteQuery(
+    { projectId, sortBy: 'updatedAt', sortDirection: 'desc' },
+    { staleTime: 30000, cacheTime: 300000 },
+  );
+
+  const conversations = useMemo<TConversation[]>(
+    () =>
+      (data?.pages.flatMap((page) => page.conversations) ?? []).filter(Boolean) as TConversation[],
+    [data?.pages],
+  );
+  const hasMore =
+    conversations.length > INLINE_CHAT_LIMIT ||
+    (data?.pages[data.pages.length - 1]?.nextCursor ?? null) != null;
+  const visible = conversations.slice(0, INLINE_CHAT_LIMIT);
+
+  if (isLoading && conversations.length === 0) {
+    return (
+      <div className="flex justify-start py-1.5 pl-2">
+        <Spinner className="h-4 w-4 text-text-secondary" />
+      </div>
+    );
+  }
+
+  if (conversations.length === 0) {
+    return (
+      <div className="py-1.5 pl-2 text-xs text-text-secondary">
+        {localize('com_ui_no_project_chats')}
+      </div>
+    );
+  }
+
+  return (
+    <div data-testid={`project-chats-${projectId}`}>
+      {visible.map((convo) => (
+        <Convo
+          key={convo.conversationId}
+          conversation={convo}
+          retainView={noop}
+          toggleNav={toggleNav}
+          isGenerating={activeJobIds.has(convo.conversationId ?? '')}
+        />
+      ))}
+      {hasMore && (
+        <button
+          type="button"
+          onClick={onShowAll}
+          className="ml-1 mt-0.5 rounded-md px-2 py-1 text-xs font-medium text-text-secondary outline-none transition-colors hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        >
+          {localize('com_ui_show_all')}
+        </button>
+      )}
+    </div>
+  );
+});
+
+ProjectChatsInline.displayName = 'ProjectChatsInline';
+
+type ProjectItemProps = {
+  project: TChatProject;
+  toggleNav: () => void;
+  defaultExpanded: boolean;
+};
+
+const ProjectItem = memo(
+  function ProjectItem({ project, toggleNav, defaultExpanded }: ProjectItemProps) {
+    const localize = useLocalize();
+    const navigate = useNavigate();
+    const queryClient = useQueryClient();
+    const { newConversation } = useNewConvo();
+    const getCurrentConversationId = useRecoilCallback(
+      ({ snapshot }) =>
+        async () => {
+          const conversation = await snapshot.getPromise(store.conversationByIndex(0));
+          return conversation?.conversationId;
+        },
+      [],
+    );
+    const menuId = useId();
+    const [expanded, setExpanded] = useState(defaultExpanded);
+    const [isMenuOpen, setIsMenuOpen] = useState(false);
+    const [isRenameOpen, setIsRenameOpen] = useState(false);
+    const [isDeleteOpen, setIsDeleteOpen] = useState(false);
+
+    const openProject = useCallback(() => {
+      navigate(`/projects/${project._id}`);
+      toggleNav();
+    }, [navigate, project._id, toggleNav]);
+
+    const startChat = useCallback(async () => {
+      const conversationId = await getCurrentConversationId();
+      clearMessagesCache(queryClient, conversationId);
+      queryClient.invalidateQueries([QueryKeys.messages]);
+      newConversation({ template: { chatProjectId: project._id } });
+      toggleNav();
+    }, [getCurrentConversationId, newConversation, project._id, queryClient, toggleNav]);
+
+    const menuItems = useMemo<MenuItemProps[]>(
+      () => [
+        {
+          id: `${menuId}-open`,
+          label: localize('com_ui_open_project'),
+          icon: <Folder className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: openProject,
+        },
+        {
+          id: `${menuId}-rename`,
+          label: localize('com_ui_rename'),
+          icon: <Pencil className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: () => setIsRenameOpen(true),
+        },
+        {
+          id: `${menuId}-delete`,
+          label: localize('com_ui_delete'),
+          icon: <Trash2 className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: () => setIsDeleteOpen(true),
+        },
+      ],
+      [localize, menuId, openProject],
+    );
+
+    return (
+      <li className="list-none">
+        <div className="group/project-row relative flex h-9 items-center rounded-lg text-sm text-text-primary transition-colors hover:bg-surface-active-alt">
+          <button
+            type="button"
+            onClick={() => setExpanded((prev) => !prev)}
+            aria-expanded={expanded}
+            aria-label={project.name}
+            className="flex min-w-0 flex-1 items-center gap-1.5 rounded-lg py-1.5 pl-1.5 pr-14 text-left outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+          >
+            <ChevronRight
+              className={cn(
+                'h-3.5 w-3.5 shrink-0 text-text-secondary transition-transform duration-200',
+                expanded && 'rotate-90',
+              )}
+              aria-hidden="true"
+            />
+            <Folder className="h-4 w-4 shrink-0 text-text-secondary" aria-hidden="true" />
+            <span className="truncate">{project.name}</span>
+          </button>
+          <div className="absolute right-2 top-1/2 flex -translate-y-1/2 items-center gap-0.5 rounded-md bg-surface-active-alt opacity-0 transition-opacity group-focus-within/project-row:opacity-100 group-hover/project-row:opacity-100 has-[[data-state=open]]:opacity-100">
+            <TooltipAnchor
+              description={localize('com_ui_new_chat_in_project', { name: project.name })}
+              render={
+                <button
+                  type="button"
+                  aria-label={localize('com_ui_new_chat_in_project', { name: project.name })}
+                  className={iconButtonClassName}
+                  onClick={startChat}
+                >
+                  <NewChatIcon className="h-4 w-4" />
+                </button>
+              }
+            />
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={menuId}
+              isOpen={isMenuOpen}
+              setIsOpen={setIsMenuOpen}
+              className="z-[125] min-w-44"
+              iconClassName="mr-2 text-text-secondary"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_more_options')}
+                  className={cn(
+                    iconButtonClassName,
+                    isMenuOpen && 'bg-surface-active-alt text-text-primary',
+                  )}
+                >
+                  <Ellipsis className="h-4 w-4" aria-hidden="true" />
+                </Ariakit.MenuButton>
+              }
+              items={menuItems}
+            />
+          </div>
+        </div>
+        {expanded && (
+          <ProjectChatsInline
+            projectId={project._id}
+            toggleNav={toggleNav}
+            onShowAll={openProject}
+          />
+        )}
+        <ProjectRenameDialog open={isRenameOpen} onOpenChange={setIsRenameOpen} project={project} />
+        <ProjectDeleteDialog open={isDeleteOpen} onOpenChange={setIsDeleteOpen} project={project} />
+      </li>
+    );
+  },
+  (prevProps, nextProps) =>
+    prevProps.project._id === nextProps.project._id &&
+    prevProps.project.name === nextProps.project.name &&
+    prevProps.project.updatedAt === nextProps.project.updatedAt &&
+    prevProps.defaultExpanded === nextProps.defaultExpanded &&
+    prevProps.toggleNav === nextProps.toggleNav,
+);
+
+ProjectItem.displayName = 'ProjectItem';
+
+interface ProjectsSectionProps {
+  toggleNav: () => void;
+  isAuthenticated: boolean;
+}
+
+const ProjectsSection = ({ toggleNav, isAuthenticated }: ProjectsSectionProps) => {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const [storedExpanded, setStoredExpanded] = useLocalStorage('projectsSectionExpanded', true);
+  const [hasToggledSection, setHasToggledSection] = useLocalStorage(
+    'projectsSectionToggled',
+    false,
+  );
+  const [isCreateOpen, setIsCreateOpen] = useState(false);
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+  const activeProjectId = conversation?.chatProjectId ?? null;
+
+  const { data, isLoading } = useProjectsInfiniteQuery(
+    { sortBy: 'lastConversationAt', sortDirection: 'desc', limit: 25 },
+    { enabled: isAuthenticated, staleTime: 30000, cacheTime: 300000 },
+  );
+
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const hasMore = (data?.pages[data.pages.length - 1]?.nextCursor ?? null) != null;
+
+  /**
+   * Collapse the section by default for users with no projects who have never
+   * toggled it, to keep the sidebar compact. An explicit toggle — or a collapse
+   * set before this default existed (stored === false) — is always respected.
+   */
+  const respectStoredExpanded = hasToggledSection || storedExpanded === false;
+  const isExpanded = respectStoredExpanded ? storedExpanded : isLoading || projects.length > 0;
+
+  const openProjects = useCallback(() => {
+    navigate('/projects');
+    toggleNav();
+  }, [navigate, toggleNav]);
+
+  const renderProjectsBody = () => {
+    if (isLoading && projects.length === 0) {
+      return (
+        <div className="flex justify-start py-2 pl-2">
+          <Spinner className="h-4 w-4 text-text-secondary" />
+        </div>
+      );
+    }
+
+    if (projects.length === 0) {
+      return (
+        <button
+          type="button"
+          onClick={() => setIsCreateOpen(true)}
+          className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-sm text-text-secondary outline-none transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        >
+          <FolderPlus className="h-4 w-4 shrink-0" aria-hidden="true" />
+          <span className="truncate">{localize('com_ui_new_project')}</span>
+        </button>
+      );
+    }
+
+    return (
+      <ul className="m-0 list-none p-0">
+        {projects.map((project) => (
+          <ProjectItem
+            key={project._id}
+            project={project}
+            toggleNav={toggleNav}
+            defaultExpanded={project._id === activeProjectId}
+          />
+        ))}
+        {hasMore && (
+          <li className="list-none">
+            <button
+              type="button"
+              onClick={openProjects}
+              className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-xs font-medium text-text-secondary outline-none transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+            >
+              {localize('com_ui_all_projects')}
+            </button>
+          </li>
+        )}
+      </ul>
+    );
+  };
+
+  if (!isAuthenticated) {
+    return null;
+  }
+
+  return (
+    <div className="flex flex-col px-3 text-sm">
+      <div className="flex h-8 w-full items-center gap-0.5 pr-2">
+        <button
+          onClick={() => {
+            setStoredExpanded(!isExpanded);
+            setHasToggledSection(true);
+          }}
+          className="group flex min-w-0 flex-1 items-center gap-1 rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+          type="button"
+          aria-expanded={isExpanded}
+        >
+          <span className="select-none truncate">{localize('com_ui_projects')}</span>
+          <ChevronDown
+            className={cn(
+              'h-3 w-3 shrink-0 transition-transform duration-200',
+              isExpanded ? '' : '-rotate-90',
+            )}
+            aria-hidden="true"
+          />
+        </button>
+        <TooltipAnchor
+          description={localize('com_ui_all_projects')}
+          render={
+            <button
+              type="button"
+              aria-label={localize('com_ui_all_projects')}
+              className={iconButtonClassName}
+              onClick={openProjects}
+            >
+              <Folders className="h-4 w-4" aria-hidden="true" />
+            </button>
+          }
+        />
+        <TooltipAnchor
+          description={localize('com_ui_new_project')}
+          render={
+            <button
+              type="button"
+              aria-label={localize('com_ui_new_project')}
+              className={iconButtonClassName}
+              onClick={() => setIsCreateOpen(true)}
+            >
+              <FolderPlus className="h-4 w-4" aria-hidden="true" />
+            </button>
+          }
+        />
+      </div>
+
+      {isExpanded && (
+        <div className="scrollbar-gutter-stable max-h-[42vh] overflow-y-auto">
+          {renderProjectsBody()}
+        </div>
+      )}
+
+      <ProjectCreateDialog
+        open={isCreateOpen}
+        onOpenChange={setIsCreateOpen}
+        onCreated={(project) => {
+          navigate(`/projects/${project._id}`);
+          toggleNav();
+        }}
+      />
+    </div>
+  );
+};
+
+ProjectsSection.displayName = 'ProjectsSection';
+
+export default memo(ProjectsSection);
diff --git a/client/src/components/Conversations/__tests__/Conversations.test.tsx b/client/src/components/Conversations/__tests__/Conversations.test.tsx
index a4f403fb7f7..55406d742d9 100644
--- a/client/src/components/Conversations/__tests__/Conversations.test.tsx
+++ b/client/src/components/Conversations/__tests__/Conversations.test.tsx
@@ -3,6 +3,9 @@ import { render } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import { RecoilRoot } from 'recoil';
 import type { CellMeasurerCache, List } from 'react-virtualized';
+import type { TConversation } from 'librechat-data-provider';
+import Conversations from '../Conversations';
+import store from '~/store';
 
 let mockCapturedCache: CellMeasurerCache | null = null;
 
@@ -10,11 +13,6 @@ jest.mock('react-virtualized', () => {
   const actual = jest.requireActual('react-virtualized');
   return {
     ...actual,
-    AutoSizer: ({
-      children,
-    }: {
-      children: (size: { width: number; height: number }) => React.ReactNode;
-    }) => children({ width: 300, height: 600 }),
     CellMeasurer: ({
       children,
     }: {
@@ -48,11 +46,15 @@ jest.mock('react-virtualized', () => {
 });
 
 jest.mock('~/store', () => {
-  const { atom } = jest.requireActual('recoil');
+  const { atom, atomFamily } = jest.requireActual('recoil');
   return {
     __esModule: true,
     default: {
       search: atom({ key: 'test-conversations-search', default: { query: '' } }),
+      conversationByIndex: atomFamily({
+        key: 'test-conversations-convo-by-index',
+        default: null,
+      }),
     },
   };
 });
@@ -70,12 +72,20 @@ jest.mock('~/hooks', () => ({
   useFavorites: () => mockFavoritesState,
   useLocalize: () => (key: string) => key,
   useShowMarketplace: () => mockShowMarketplace,
+  useNewConvo: () => ({ newConversation: jest.fn() }),
+  useElementSize: () => ({ ref: jest.fn(), width: 300, height: 600 }),
   TranslationKeys: {},
 }));
 
+jest.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({ invalidateQueries: jest.fn() }),
+}));
+
 jest.mock('@librechat/client', () => ({
   Spinner: () => <div data-testid="spinner" />,
   useMediaQuery: () => false,
+  TooltipAnchor: ({ render }: { render: React.ReactNode }) => render,
+  NewChatIcon: () => <svg data-testid="new-chat-icon" />,
 }));
 
 jest.mock('~/data-provider', () => ({
@@ -84,6 +94,7 @@ jest.mock('~/data-provider', () => ({
 
 jest.mock('~/utils', () => ({
   groupConversationsByDate: () => [],
+  clearMessagesCache: jest.fn(),
   cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
 }));
 
@@ -97,8 +108,6 @@ jest.mock('../Convo', () => ({
   default: () => <div data-testid="convo" />,
 }));
 
-import Conversations from '../Conversations';
-
 describe('Conversations – favorites CellMeasurerCache key invalidation', () => {
   const containerRef = createRef<List>();
 
@@ -183,3 +192,65 @@ describe('Conversations – favorites CellMeasurerCache key invalidation', () =>
     expect(cache.getHeight(0, 0)).toBe(88);
   });
 });
+
+const pinnedConvo = {
+  conversationId: 'pinned-1',
+  title: 'Pinned Chat',
+  pinned: true,
+  endpoint: 'openAI',
+  createdAt: new Date().toISOString(),
+  updatedAt: new Date().toISOString(),
+} as TConversation;
+
+describe('Conversations – pinned header', () => {
+  const containerRef = createRef<List>();
+
+  beforeEach(() => {
+    mockCapturedCache = null;
+    mockFavoritesState.favorites = [];
+    mockFavoritesState.isLoading = false;
+    mockShowMarketplace = false;
+  });
+
+  const renderConversations = (conversations: TConversation[], searchQuery = '') =>
+    render(
+      <RecoilRoot
+        initializeState={({ set }) => {
+          set(store.search, {
+            query: searchQuery,
+            enabled: true,
+            debouncedQuery: searchQuery,
+            isSearching: true,
+            isTyping: false,
+          });
+        }}
+      >
+        <Conversations
+          conversations={conversations}
+          moveToTop={jest.fn()}
+          toggleNav={jest.fn()}
+          containerRef={containerRef}
+          loadMoreConversations={jest.fn()}
+          isLoading={false}
+          isSearchLoading={false}
+          isChatsExpanded={true}
+          setIsChatsExpanded={jest.fn()}
+        />
+      </RecoilRoot>,
+    );
+
+  it('shows the pinned header when there are pinned conversations', () => {
+    const { getByText } = renderConversations([pinnedConvo]);
+    expect(getByText('com_ui_pinned')).toBeInTheDocument();
+  });
+
+  it('does not show the pinned header when there are no pinned conversations', () => {
+    const { queryByText } = renderConversations([]);
+    expect(queryByText('com_ui_pinned')).not.toBeInTheDocument();
+  });
+
+  it('does not show the pinned header during search', () => {
+    const { queryByText } = renderConversations([pinnedConvo], 'some query');
+    expect(queryByText('com_ui_pinned')).not.toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Conversations/utils.ts b/client/src/components/Conversations/utils.ts
new file mode 100644
index 00000000000..3c45d1a0e28
--- /dev/null
+++ b/client/src/components/Conversations/utils.ts
@@ -0,0 +1,47 @@
+import type { TConversation } from 'librechat-data-provider';
+
+export type ConversationRenderProps = {
+  conversation: TConversation;
+  isGenerating?: boolean;
+};
+
+export function areConversationIconFieldsEqual(
+  prevConversation: TConversation,
+  nextConversation: TConversation,
+) {
+  return (
+    prevConversation.endpoint === nextConversation.endpoint &&
+    prevConversation.endpointType === nextConversation.endpointType &&
+    prevConversation.iconURL === nextConversation.iconURL &&
+    prevConversation.model === nextConversation.model &&
+    prevConversation.modelLabel === nextConversation.modelLabel &&
+    prevConversation.chatGptLabel === nextConversation.chatGptLabel &&
+    prevConversation.spec === nextConversation.spec &&
+    prevConversation.agent_id === nextConversation.agent_id &&
+    prevConversation.assistant_id === nextConversation.assistant_id
+  );
+}
+
+export function areConversationListItemFieldsEqual(
+  prevConversation: TConversation,
+  nextConversation: TConversation,
+) {
+  return (
+    areConversationIconFieldsEqual(prevConversation, nextConversation) &&
+    prevConversation.conversationId === nextConversation.conversationId &&
+    prevConversation.title === nextConversation.title &&
+    prevConversation.chatProjectId === nextConversation.chatProjectId &&
+    prevConversation.createdAt === nextConversation.createdAt &&
+    prevConversation.updatedAt === nextConversation.updatedAt
+  );
+}
+
+export function areConversationRenderPropsEqual(
+  prevProps: ConversationRenderProps,
+  nextProps: ConversationRenderProps,
+) {
+  return (
+    areConversationListItemFieldsEqual(prevProps.conversation, nextProps.conversation) &&
+    prevProps.isGenerating === nextProps.isGenerating
+  );
+}
diff --git a/client/src/components/Endpoints/ConvoIcon.tsx b/client/src/components/Endpoints/ConvoIcon.tsx
index 0ac36924a6f..859f3b957b9 100644
--- a/client/src/components/Endpoints/ConvoIcon.tsx
+++ b/client/src/components/Endpoints/ConvoIcon.tsx
@@ -4,6 +4,7 @@ import type * as t from 'librechat-data-provider';
 import { getIconKey, getEntity, getIconEndpoint } from '~/utils';
 import ConvoIconURL from '~/components/Endpoints/ConvoIconURL';
 import { icons } from '~/hooks/Endpoint/Icons';
+import { isImageURL } from '~/utils/icons';
 
 export default function ConvoIcon({
   conversation,
@@ -51,7 +52,7 @@ export default function ConvoIcon({
 
   return (
     <>
-      {iconURL && iconURL.includes('http') ? (
+      {isImageURL(iconURL) ? (
         <ConvoIconURL
           iconURL={iconURL}
           modelLabel={conversation?.chatGptLabel ?? conversation?.modelLabel ?? ''}
diff --git a/client/src/components/Endpoints/ConvoIconURL.tsx b/client/src/components/Endpoints/ConvoIconURL.tsx
index e3fd6bc6367..ba28b5e115b 100644
--- a/client/src/components/Endpoints/ConvoIconURL.tsx
+++ b/client/src/components/Endpoints/ConvoIconURL.tsx
@@ -1,7 +1,7 @@
 import { memo, useMemo } from 'react';
-import type { IconMapProps } from '~/common';
 import { URLIcon } from '~/components/Endpoints/URLIcon';
 import { icons } from '~/hooks/Endpoint/Icons';
+import { isImageURL } from '~/utils/icons';
 
 interface ConvoIconURLProps {
   iconURL?: string;
@@ -40,10 +40,7 @@ const ConvoIconURL: React.FC<ConvoIconURLProps> = ({
   context,
 }) => {
   const Icon = useMemo(() => icons[iconURL] ?? icons.unknown, [iconURL]);
-  const isURL = useMemo(
-    () => !!(iconURL && (iconURL.includes('http') || iconURL.startsWith('/images/'))),
-    [iconURL],
-  );
+  const isURL = useMemo(() => isImageURL(iconURL), [iconURL]);
   if (isURL) {
     return (
       <URLIcon
diff --git a/client/src/components/Endpoints/EndpointIcon.tsx b/client/src/components/Endpoints/EndpointIcon.tsx
index c32ea123696..c2add9ed7a4 100644
--- a/client/src/components/Endpoints/EndpointIcon.tsx
+++ b/client/src/components/Endpoints/EndpointIcon.tsx
@@ -1,65 +1,82 @@
-import { getEndpointField, isAssistantsEndpoint } from 'librechat-data-provider';
+import { getEndpointField, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import type {
   TPreset,
   TConversation,
+  TAgentsMap,
   TAssistantsMap,
   TEndpointsConfig,
 } from 'librechat-data-provider';
 import ConvoIconURL from '~/components/Endpoints/ConvoIconURL';
 import MinimalIcon from '~/components/Endpoints/MinimalIcon';
-import { getIconEndpoint } from '~/utils';
+import { getAgentAvatarUrl, getIconEndpoint } from '~/utils';
+import { isImageURL } from '~/utils/icons';
+
+const emptyEndpointsConfig = {} as TEndpointsConfig;
 
 export default function EndpointIcon({
   conversation,
-  endpointsConfig,
+  endpointsConfig = emptyEndpointsConfig,
   className = 'mr-0',
   assistantMap,
+  agentsMap,
   context,
+  size = 20,
 }: {
   conversation: TConversation | TPreset | null;
   endpointsConfig: TEndpointsConfig;
   containerClassName?: string;
   context?: 'message' | 'nav' | 'landing' | 'menu-item';
   assistantMap?: TAssistantsMap;
+  agentsMap?: TAgentsMap;
   className?: string;
   size?: number;
 }) {
   const convoIconURL = conversation?.iconURL ?? '';
-  let endpoint = conversation?.endpoint;
+  const originalEndpoint = conversation?.endpoint;
+  let endpoint = originalEndpoint;
   endpoint = getIconEndpoint({ endpointsConfig, iconURL: convoIconURL, endpoint });
 
   const endpointType = getEndpointField(endpointsConfig, endpoint, 'type');
   const endpointIconURL = getEndpointField(endpointsConfig, endpoint, 'iconURL');
 
+  const agent = isAgentsEndpoint(endpoint) ? agentsMap?.[conversation?.agent_id ?? ''] : null;
   const assistant = isAssistantsEndpoint(endpoint)
     ? assistantMap?.[endpoint]?.[conversation?.assistant_id ?? '']
     : null;
+  const agentAvatar = getAgentAvatarUrl(agent) ?? '';
+  const agentName = agent?.name ?? '';
   const assistantAvatar = (assistant && (assistant.metadata?.avatar as string)) || '';
   const assistantName = assistant && (assistant.name ?? '');
+  const entityAvatar = agentAvatar || assistantAvatar;
+  const entityName = agentName || assistantName || '';
+  const hasCustomIcon =
+    isImageURL(convoIconURL) || (convoIconURL !== '' && convoIconURL !== originalEndpoint);
 
-  const iconURL = assistantAvatar || convoIconURL;
+  const iconURL = hasCustomIcon ? convoIconURL : entityAvatar || convoIconURL;
 
-  if (iconURL && (iconURL.includes('http') || iconURL.startsWith('/images/'))) {
+  if (isImageURL(iconURL)) {
     return (
       <ConvoIconURL
         iconURL={iconURL}
-        modelLabel={conversation?.chatGptLabel ?? conversation?.modelLabel ?? ''}
+        modelLabel={entityName || conversation?.chatGptLabel || conversation?.modelLabel || ''}
         context={context}
         endpointIconURL={endpointIconURL}
         assistantAvatar={assistantAvatar}
         assistantName={assistantName ?? ''}
+        agentAvatar={agentAvatar}
+        agentName={agentName}
       />
     );
   } else {
     return (
       <MinimalIcon
-        size={20}
         iconURL={endpointIconURL}
         endpoint={endpoint}
         endpointType={endpointType}
         model={conversation?.model}
         error={false}
         className={className}
+        size={size}
         isCreatedByUser={false}
         chatGptLabel={undefined}
         modelLabel={undefined}
diff --git a/client/src/components/Endpoints/Settings/Google.tsx b/client/src/components/Endpoints/Settings/Google.tsx
index 18bf95a1d0e..caf4e100be1 100644
--- a/client/src/components/Endpoints/Settings/Google.tsx
+++ b/client/src/components/Endpoints/Settings/Google.tsx
@@ -49,6 +49,7 @@ export default function Settings({ conversation, setOption, models, readonly }:
   const setTopP = setOption('topP');
   const setTopK = setOption('topK');
   const setMaxOutputTokens = setOption('maxOutputTokens');
+  const maxOutputTokensDefault = google.maxOutputTokens.reset(model ?? '');
 
   return (
     <div className="grid grid-cols-5 gap-6">
@@ -267,7 +268,7 @@ export default function Settings({ conversation, setOption, models, readonly }:
                 <small className="opacity-40">
                   (
                   {localize('com_endpoint_default_with_num', {
-                    0: google.maxOutputTokens.default + '',
+                    0: maxOutputTokensDefault + '',
                   })}
                   )
                 </small>
@@ -292,9 +293,9 @@ export default function Settings({ conversation, setOption, models, readonly }:
             </div>
             <Slider
               disabled={readonly}
-              value={[maxOutputTokens ?? google.maxOutputTokens.default]}
+              value={[maxOutputTokens ?? maxOutputTokensDefault]}
               onValueChange={(value) => setMaxOutputTokens(value[0])}
-              onDoubleClick={() => setMaxOutputTokens(google.maxOutputTokens.default)}
+              onDoubleClick={() => setMaxOutputTokens(maxOutputTokensDefault)}
               max={google.maxOutputTokens.max}
               min={google.maxOutputTokens.min}
               step={google.maxOutputTokens.step}
diff --git a/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx b/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx
new file mode 100644
index 00000000000..5dedc2ed4d9
--- /dev/null
+++ b/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx
@@ -0,0 +1,95 @@
+import React from 'react';
+import '@testing-library/jest-dom';
+import { render, screen } from '@testing-library/react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { Agent, TConversation, TEndpointsConfig } from 'librechat-data-provider';
+import EndpointIcon from '../EndpointIcon';
+
+jest.mock('~/components/Endpoints/ConvoIconURL', () => ({
+  __esModule: true,
+  default: ({
+    iconURL,
+    modelLabel,
+    agentAvatar,
+    agentName,
+  }: {
+    iconURL: string;
+    modelLabel?: string;
+    agentAvatar?: string;
+    agentName?: string;
+  }) => (
+    <img
+      src={iconURL}
+      alt={modelLabel || 'Icon'}
+      data-testid="convo-url-icon"
+      data-agent-avatar={agentAvatar}
+      data-agent-name={agentName}
+    />
+  ),
+}));
+
+jest.mock('~/components/Endpoints/MinimalIcon', () => ({
+  __esModule: true,
+  default: ({ endpoint, iconURL }: { endpoint?: string | null; iconURL?: string }) => (
+    <div data-testid="minimal-icon" data-endpoint={endpoint ?? ''} data-icon-url={iconURL ?? ''} />
+  ),
+}));
+
+const endpointsConfig = {
+  [EModelEndpoint.agents]: { order: 0 },
+  [EModelEndpoint.google]: { order: 1 },
+} as TEndpointsConfig;
+
+const agent = {
+  id: 'agent_123',
+  name: 'Research Agent',
+  avatar: {
+    filepath: '/images/agents/agent_123/avatar.png',
+    source: 'local',
+  },
+} as Agent;
+
+describe('EndpointIcon', () => {
+  it('uses the agent avatar when the agents endpoint would otherwise render its default icon', () => {
+    const conversation = {
+      endpoint: EModelEndpoint.agents,
+      agent_id: agent.id,
+      iconURL: EModelEndpoint.agents,
+    } as TConversation;
+
+    render(
+      <EndpointIcon
+        conversation={conversation}
+        endpointsConfig={endpointsConfig}
+        agentsMap={{ [agent.id]: agent }}
+      />,
+    );
+
+    const icon = screen.getByTestId('convo-url-icon');
+    expect(icon).toHaveAttribute('src', '/images/agents/agent_123/avatar.png');
+    expect(icon).toHaveAttribute('alt', 'Research Agent');
+  });
+
+  it('keeps an explicit model spec icon ahead of the agent avatar', () => {
+    const conversation = {
+      endpoint: EModelEndpoint.agents,
+      agent_id: agent.id,
+      spec: 'research-spec',
+      iconURL: EModelEndpoint.google,
+    } as TConversation;
+
+    render(
+      <EndpointIcon
+        conversation={conversation}
+        endpointsConfig={endpointsConfig}
+        agentsMap={{ [agent.id]: agent }}
+      />,
+    );
+
+    expect(screen.queryByTestId('convo-url-icon')).not.toBeInTheDocument();
+    expect(screen.getByTestId('minimal-icon')).toHaveAttribute(
+      'data-endpoint',
+      EModelEndpoint.google,
+    );
+  });
+});
diff --git a/client/src/components/Files/FileList/FileTableColumns.tsx b/client/src/components/Files/FileList/FileTableColumns.tsx
index 754cb061db5..bbad3473186 100644
--- a/client/src/components/Files/FileList/FileTableColumns.tsx
+++ b/client/src/components/Files/FileList/FileTableColumns.tsx
@@ -3,10 +3,13 @@ import { PlusIcon } from 'lucide-react';
 import { Button, Checkbox, DotsIcon, FileIcon } from '@librechat/client';
 import type { ColumnDef } from '@tanstack/react-table';
 import type { TFile } from 'librechat-data-provider';
+import type { TVectorStore } from '~/common';
 import { formatDate, getFileType } from '~/utils';
 import { useLocalize } from '~/hooks';
 
-export const fileTableColumns: ColumnDef<TFile>[] = [
+type TFileWithVectors = TFile & { vectorsAttached?: TVectorStore[] };
+
+export const fileTableColumns: ColumnDef<TFileWithVectors>[] = [
   {
     id: 'select',
     header: ({ table }) => {
@@ -53,7 +56,7 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
       size: '150px',
     },
     accessorKey: 'filename',
-    header: ({ column }) => {
+    header: () => {
       const localize = useLocalize();
       return <>{localize('com_ui_name')}</>;
     },
@@ -68,7 +71,8 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
       return 'Vector Stores';
     },
     cell: ({ row }) => {
-      const { vectorsAttached: attachedVectorStores } = row.original;
+      const localize = useLocalize();
+      const { vectorsAttached: attachedVectorStores = [] } = row.original;
       return (
         <>
           {attachedVectorStores.map((vectorStore, index) => {
@@ -80,7 +84,7 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
                 >
                   <PlusIcon className="h-3 w-3" />
                   &nbsp;
-                  {attachedVectorStores.length - index} more
+                  {localize('com_ui_more_count', { 0: attachedVectorStores.length - index })}
                 </span>
               );
             }
@@ -100,17 +104,19 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
   {
     accessorKey: 'updatedAt',
     header: () => {
-      const localize = useLocalize();
       return 'Modified';
     },
-    cell: ({ row }) => formatDate(row.original.updatedAt),
+    cell: ({ row }) => {
+      const { updatedAt } = row.original;
+      return formatDate(updatedAt instanceof Date ? updatedAt.toISOString() : (updatedAt ?? ''));
+    },
   },
   {
     accessorKey: 'actions',
     header: () => {
       return 'Actions';
     },
-    cell: ({ row }) => {
+    cell: () => {
       return (
         <>
           <Button className="w-min content-center bg-transparent text-gray-500 hover:bg-slate-200">
diff --git a/client/src/components/Files/VectorStore/VectorStoreListItem.tsx b/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
index 66a54b1593c..d0a266b3d23 100644
--- a/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
+++ b/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
@@ -2,6 +2,7 @@ import React from 'react';
 import { useNavigate } from 'react-router-dom';
 import { Button, DotsIcon, TrashIcon } from '@librechat/client';
 import { TVectorStore } from '~/common';
+import { useLocalize } from '~/hooks';
 
 type VectorStoreListItemProps = {
   vectorStore: TVectorStore;
@@ -13,6 +14,7 @@ export default function VectorStoreListItem({
   deleteVectorStore,
 }: VectorStoreListItemProps) {
   const navigate = useNavigate();
+  const localize = useLocalize();
   return (
     <div
       onClick={() => {
@@ -26,7 +28,10 @@ export default function VectorStoreListItem({
       </div>
       <div className="w-2/6 text-gray-500">
         <p>
-          {vectorStore.file_counts.total} Files ({vectorStore.bytes / 1000}KB)
+          {localize('com_ui_files_count_size', {
+            0: vectorStore.file_counts?.total ?? 0,
+            1: (vectorStore.bytes ?? 0) / 1000,
+          })}
         </p>
         <p className="text-sm">{vectorStore.created_at.toString()}</p>
       </div>
diff --git a/client/src/components/Input/Generations/Button.tsx b/client/src/components/Input/Generations/Button.tsx
index baf65debc60..def41de95ad 100644
--- a/client/src/components/Input/Generations/Button.tsx
+++ b/client/src/components/Input/Generations/Button.tsx
@@ -1,3 +1,5 @@
+import type { ShortcutActionId } from '~/hooks/useKeyboardShortcuts';
+import { useShortcutAriaKey, useShortcutDisplay } from '~/hooks/useKeyboardShortcuts';
 import { cn, removeFocusOutlines } from '~/utils/';
 
 export default function Button({
@@ -5,15 +7,21 @@ export default function Button({
   children,
   onClick,
   className = '',
+  shortcutId,
 }: {
   type?: 'regenerate' | 'continue' | 'stop';
   children: React.ReactNode;
   onClick: (e: React.MouseEvent<HTMLButtonElement>) => void;
   className?: string;
+  shortcutId?: ShortcutActionId;
 }) {
+  const shortcutDisplay = useShortcutDisplay(shortcutId);
+  const ariaKey = useShortcutAriaKey(shortcutId);
+
   return (
     <button
       data-testid={`${type}-generation-button`}
+      aria-keyshortcuts={ariaKey}
       className={cn(
         'custom-btn btn-neutral relative -z-0 whitespace-nowrap border-0 md:border',
         removeFocusOutlines,
@@ -21,7 +29,14 @@ export default function Button({
       )}
       onClick={onClick}
     >
-      <div className="flex w-full items-center justify-center gap-2">{children}</div>
+      <div className="flex w-full items-center justify-center gap-2">
+        {children}
+        {shortcutDisplay && (
+          <span className="hidden rounded-md border border-border-light px-1.5 py-0.5 text-[10px] leading-none text-text-secondary md:inline-flex">
+            {shortcutDisplay}
+          </span>
+        )}
+      </div>
     </button>
   );
 }
diff --git a/client/src/components/Input/Generations/Regenerate.tsx b/client/src/components/Input/Generations/Regenerate.tsx
index 715168cb929..7eff9f0eae3 100644
--- a/client/src/components/Input/Generations/Regenerate.tsx
+++ b/client/src/components/Input/Generations/Regenerate.tsx
@@ -7,7 +7,7 @@ export default function Regenerate({ onClick }: TGenButtonProps) {
   const localize = useLocalize();
 
   return (
-    <Button onClick={onClick}>
+    <Button onClick={onClick} shortcutId="regenerateResponse">
       <RegenerateIcon className="h-3 w-3 flex-shrink-0 text-gray-600/90 dark:text-gray-400" />
       {localize('com_ui_regenerate')}
     </Button>
diff --git a/client/src/components/Input/Generations/Stop.tsx b/client/src/components/Input/Generations/Stop.tsx
index d66baa9450d..44ce392d489 100644
--- a/client/src/components/Input/Generations/Stop.tsx
+++ b/client/src/components/Input/Generations/Stop.tsx
@@ -7,7 +7,7 @@ export default function Stop({ onClick }: TGenButtonProps) {
   const localize = useLocalize();
 
   return (
-    <Button type="stop" onClick={onClick}>
+    <Button type="stop" onClick={onClick} shortcutId="stopGenerating">
       <StopGeneratingIcon className="text-gray-600/90 dark:text-gray-400" />
       {localize('com_ui_stop')}
     </Button>
diff --git a/client/src/components/Input/Generations/__tests__/Button.spec.tsx b/client/src/components/Input/Generations/__tests__/Button.spec.tsx
index 77c71a13530..f4f6629ea8a 100644
--- a/client/src/components/Input/Generations/__tests__/Button.spec.tsx
+++ b/client/src/components/Input/Generations/__tests__/Button.spec.tsx
@@ -1,9 +1,13 @@
+/* eslint-disable i18next/no-literal-string */
+import { RecoilRoot } from 'recoil';
 import { render, fireEvent } from '@testing-library/react';
 import Button from '../Button';
 
+const renderWithRecoil = (ui: React.ReactElement) => render(<RecoilRoot>{ui}</RecoilRoot>);
+
 describe('Button', () => {
   it('renders with the correct type and children', () => {
-    const { getByTestId, getByText } = render(
+    const { getByTestId, getByText } = renderWithRecoil(
       <Button
         type="regenerate"
         onClick={() => {
@@ -19,7 +23,7 @@ describe('Button', () => {
 
   it('calls onClick when clicked', () => {
     const handleClick = jest.fn();
-    const { getByText } = render(
+    const { getByText } = renderWithRecoil(
       <Button type="continue" onClick={handleClick}>
         Continue
       </Button>,
diff --git a/client/src/components/Input/SetKeyDialog/BedrockConfig.tsx b/client/src/components/Input/SetKeyDialog/BedrockConfig.tsx
new file mode 100644
index 00000000000..c36e741bcba
--- /dev/null
+++ b/client/src/components/Input/SetKeyDialog/BedrockConfig.tsx
@@ -0,0 +1,111 @@
+import React from 'react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import { useFormContext, Controller } from 'react-hook-form';
+import { useLocalize } from '~/hooks';
+import InputWithLabel from './InputWithLabel';
+
+const BedrockConfig = ({
+  userProvideAccessKeyId,
+  userProvideSecretAccessKey,
+  userProvideSessionToken,
+  userProvideBearerToken,
+}: {
+  endpoint: EModelEndpoint | string;
+  userProvideURL?: boolean | null;
+  userProvideAccessKeyId?: boolean;
+  userProvideSecretAccessKey?: boolean;
+  userProvideSessionToken?: boolean;
+  userProvideBearerToken?: boolean;
+}) => {
+  const { control } = useFormContext();
+  const localize = useLocalize();
+
+  const renderFields = () => {
+    const fields: React.ReactNode[] = [];
+
+    if (userProvideAccessKeyId) {
+      fields.push(
+        <Controller
+          key="bedrockAccessKeyId"
+          name="bedrockAccessKeyId"
+          control={control}
+          render={({ field }) => (
+            <InputWithLabel
+              id="bedrockAccessKeyId"
+              {...field}
+              label={localize('com_endpoint_config_bedrock_access_key_id')}
+              labelClassName="mb-1"
+              inputClassName="mb-2"
+            />
+          )}
+        />,
+      );
+    }
+
+    if (userProvideSecretAccessKey) {
+      if (fields.length > 0) fields.push(<div key="spacer1" className="mt-3" />);
+      fields.push(
+        <Controller
+          key="bedrockSecretAccessKey"
+          name="bedrockSecretAccessKey"
+          control={control}
+          render={({ field }) => (
+            <InputWithLabel
+              id="bedrockSecretAccessKey"
+              {...field}
+              label={localize('com_endpoint_config_bedrock_secret_access_key')}
+              labelClassName="mb-1"
+              inputClassName="mb-2"
+            />
+          )}
+        />,
+      );
+    }
+
+    if (userProvideSessionToken) {
+      if (fields.length > 0) fields.push(<div key="spacer2" className="mt-3" />);
+      fields.push(
+        <Controller
+          key="bedrockSessionToken"
+          name="bedrockSessionToken"
+          control={control}
+          render={({ field }) => (
+            <InputWithLabel
+              id="bedrockSessionToken"
+              {...field}
+              label={localize('com_endpoint_config_bedrock_session_token')}
+              labelClassName="mb-1"
+              inputClassName="mb-2"
+            />
+          )}
+        />,
+      );
+    }
+
+    if (userProvideBearerToken) {
+      if (fields.length > 0) fields.push(<div key="spacer3" className="mt-3" />);
+      fields.push(
+        <Controller
+          key="bedrockBearerToken"
+          name="bedrockBearerToken"
+          control={control}
+          render={({ field }) => (
+            <InputWithLabel
+              id="bedrockBearerToken"
+              {...field}
+              label={localize('com_endpoint_config_bedrock_bearer_token')}
+              labelClassName="mb-1"
+              inputClassName="mb-2"
+            />
+          )}
+        />,
+      );
+    }
+
+    return <>{fields}</>;
+  };
+
+  return <form className="flex-wrap">{renderFields()}</form>;
+};
+
+export default BedrockConfig;
diff --git a/client/src/components/Input/SetKeyDialog/CustomEndpoint.tsx b/client/src/components/Input/SetKeyDialog/CustomEndpoint.tsx
index fd5aa5d7431..e1d3ecb7ca4 100644
--- a/client/src/components/Input/SetKeyDialog/CustomEndpoint.tsx
+++ b/client/src/components/Input/SetKeyDialog/CustomEndpoint.tsx
@@ -22,6 +22,7 @@ const CustomEndpoint = ({
             label={`${endpoint} API Key`}
             labelClassName="mb-1"
             inputClassName="mb-2"
+            secret
           />
         )}
       />
diff --git a/client/src/components/Input/SetKeyDialog/GoogleConfig.tsx b/client/src/components/Input/SetKeyDialog/GoogleConfig.tsx
index 3efeb5c09c2..659b135e544 100644
--- a/client/src/components/Input/SetKeyDialog/GoogleConfig.tsx
+++ b/client/src/components/Input/SetKeyDialog/GoogleConfig.tsx
@@ -53,6 +53,7 @@ const GoogleConfig = ({ userKey, setUserKey }: Pick<TConfigProps, 'userKey' | 's
         }
         label={localize('com_endpoint_config_google_api_key')}
         subLabel={localize('com_endpoint_config_google_gemini_api')}
+        secret
       />
     </>
   );
diff --git a/client/src/components/Input/SetKeyDialog/InputWithLabel.tsx b/client/src/components/Input/SetKeyDialog/InputWithLabel.tsx
index 38eb512f419..807ff0d454d 100644
--- a/client/src/components/Input/SetKeyDialog/InputWithLabel.tsx
+++ b/client/src/components/Input/SetKeyDialog/InputWithLabel.tsx
@@ -1,7 +1,7 @@
 import { forwardRef } from 'react';
-import { Input, Label } from '@librechat/client';
+import { Input, Label, SecretInput } from '@librechat/client';
 import type { ChangeEvent, FC, Ref } from 'react';
-import { cn, defaultTextPropsLabel, removeFocusOutlines, defaultTextProps } from '~/utils/';
+import { cn } from '~/utils/';
 import { useLocalize } from '~/hooks';
 
 interface InputWithLabelProps {
@@ -12,11 +12,21 @@ interface InputWithLabelProps {
   onChange: (event: ChangeEvent<HTMLInputElement>) => void;
   labelClassName?: string;
   inputClassName?: string;
+  secret?: boolean;
   ref?: Ref<HTMLInputElement>;
 }
 
 const InputWithLabel: FC<InputWithLabelProps> = forwardRef((props, ref) => {
-  const { id, value, label, subLabel, onChange, labelClassName = '', inputClassName = '' } = props;
+  const {
+    id,
+    value,
+    label,
+    secret = false,
+    subLabel,
+    onChange,
+    labelClassName = '',
+    inputClassName = '',
+  } = props;
   const localize = useLocalize();
   return (
     <>
@@ -24,19 +34,37 @@ const InputWithLabel: FC<InputWithLabelProps> = forwardRef((props, ref) => {
         <Label htmlFor={id} className="text-left text-sm font-medium">
           {label}
         </Label>
-        {Label && <Label className="mx-1 text-right text-sm text-text-secondary">{subLabel}</Label>}
+        {subLabel && (
+          <Label className="mx-1 text-right text-sm text-text-secondary">{subLabel}</Label>
+        )}
         <br />
       </div>
       <div className="h-1" />
-      <Input
-        id={id}
-        data-testid={`input-${id}`}
-        value={value ?? ''}
-        onChange={onChange}
-        ref={ref}
-        placeholder={`${localize('com_endpoint_config_value')} ${label}`}
-        className={cn('flex h-10 max-h-10 w-full resize-none px-3 py-2')}
-      />
+      {secret ? (
+        <SecretInput
+          id={id}
+          data-testid={`input-${id}`}
+          value={value ?? ''}
+          onChange={onChange}
+          ref={ref}
+          autoComplete="new-password"
+          data-lpignore="true"
+          data-1p-ignore="true"
+          controlsOnHover
+          placeholder={`${localize('com_endpoint_config_value')} ${label}`}
+          className={cn('flex h-10 max-h-10 w-full resize-none px-3 py-2', inputClassName)}
+        />
+      ) : (
+        <Input
+          id={id}
+          data-testid={`input-${id}`}
+          value={value ?? ''}
+          onChange={onChange}
+          ref={ref}
+          placeholder={`${localize('com_endpoint_config_value')} ${label}`}
+          className={cn('flex h-10 max-h-10 w-full resize-none px-3 py-2', inputClassName)}
+        />
+      )}
     </>
   );
 });
diff --git a/client/src/components/Input/SetKeyDialog/OpenAIConfig.tsx b/client/src/components/Input/SetKeyDialog/OpenAIConfig.tsx
index 97debbcf1e5..5be2ee12626 100644
--- a/client/src/components/Input/SetKeyDialog/OpenAIConfig.tsx
+++ b/client/src/components/Input/SetKeyDialog/OpenAIConfig.tsx
@@ -24,6 +24,7 @@ const OpenAIConfig = ({
               label={`${isAzure ? 'Azure q' : ''}OpenAI API Key`}
               labelClassName="mb-1"
               inputClassName="mb-2"
+              secret
             />
           )}
         />
@@ -39,6 +40,7 @@ const OpenAIConfig = ({
                 {...field}
                 label={'Azure OpenAI API Key'}
                 labelClassName="mb-1"
+                secret
               />
             )}
           />
diff --git a/client/src/components/Input/SetKeyDialog/OtherConfig.tsx b/client/src/components/Input/SetKeyDialog/OtherConfig.tsx
index 8cc0bdb07e2..fb45d584745 100644
--- a/client/src/components/Input/SetKeyDialog/OtherConfig.tsx
+++ b/client/src/components/Input/SetKeyDialog/OtherConfig.tsx
@@ -11,6 +11,7 @@ const OtherConfig = ({ userKey, setUserKey, endpoint }: TConfigProps) => {
       value={userKey ?? ''}
       onChange={(e: React.ChangeEvent<HTMLInputElement>) => setUserKey(e.target.value ?? '')}
       label={localize('com_endpoint_config_key_name')}
+      secret
     />
   );
 };
diff --git a/client/src/components/Input/SetKeyDialog/SetKeyDialog.tsx b/client/src/components/Input/SetKeyDialog/SetKeyDialog.tsx
index 7fec25e4a50..8735333da6d 100644
--- a/client/src/components/Input/SetKeyDialog/SetKeyDialog.tsx
+++ b/client/src/components/Input/SetKeyDialog/SetKeyDialog.tsx
@@ -25,6 +25,7 @@ import CustomConfig from './CustomEndpoint';
 import GoogleConfig from './GoogleConfig';
 import OpenAIConfig from './OpenAIConfig';
 import OtherConfig from './OtherConfig';
+import BedrockConfig from './BedrockConfig';
 import HelpText from './HelpText';
 import { logger } from '~/utils';
 
@@ -35,6 +36,7 @@ const endpointComponents = {
   [EModelEndpoint.azureOpenAI]: OpenAIConfig,
   [EModelEndpoint.assistants]: OpenAIConfig,
   [EModelEndpoint.azureAssistants]: OpenAIConfig,
+  [EModelEndpoint.bedrock]: BedrockConfig,
   default: OtherConfig,
 };
 
@@ -44,6 +46,7 @@ const formSet: Set<string> = new Set([
   EModelEndpoint.azureOpenAI,
   EModelEndpoint.assistants,
   EModelEndpoint.azureAssistants,
+  EModelEndpoint.bedrock,
 ]);
 
 const EXPIRY = {
@@ -150,10 +153,18 @@ const SetKeyDialog = ({
   endpoint,
   endpointType,
   userProvideURL,
+  userProvideAccessKeyId,
+  userProvideSecretAccessKey,
+  userProvideSessionToken,
+  userProvideBearerToken,
 }: Pick<TDialogProps, 'open' | 'onOpenChange'> & {
   endpoint: EModelEndpoint | string;
   endpointType?: EModelEndpoint;
   userProvideURL?: boolean | null;
+  userProvideAccessKeyId?: boolean;
+  userProvideSecretAccessKey?: boolean;
+  userProvideSessionToken?: boolean;
+  userProvideBearerToken?: boolean;
 }) => {
   const methods = useForm({
     defaultValues: {
@@ -163,6 +174,10 @@ const SetKeyDialog = ({
       azureOpenAIApiInstanceName: '',
       azureOpenAIApiDeploymentName: '',
       azureOpenAIApiVersion: '',
+      bedrockAccessKeyId: '',
+      bedrockSecretAccessKey: '',
+      bedrockSessionToken: '',
+      bedrockBearerToken: '',
       // TODO: allow endpoint definitions from user
       // name: '',
       // TODO: add custom endpoint models defined by user
@@ -177,6 +192,7 @@ const SetKeyDialog = ({
   const localize = useLocalize();
 
   const expirationOptions = Object.values(EXPIRY);
+  const configuredEndpoint = endpointType ?? endpoint;
 
   const handleExpirationChange = (label: string) => {
     setExpiresAtLabel(label);
@@ -212,9 +228,12 @@ const SetKeyDialog = ({
     if (formSet.has(endpoint) || formSet.has(endpointType ?? '')) {
       // TODO: handle other user provided options besides baseURL and apiKey
       methods.handleSubmit((data) => {
-        const isAzure = endpoint === EModelEndpoint.azureOpenAI;
+        const isAzure = configuredEndpoint === EModelEndpoint.azureOpenAI;
+        const isBedrock = configuredEndpoint === EModelEndpoint.bedrock;
         const isOpenAIBase =
-          isAzure || endpoint === EModelEndpoint.openAI || isAssistantsEndpoint(endpoint);
+          isAzure ||
+          configuredEndpoint === EModelEndpoint.openAI ||
+          isAssistantsEndpoint(configuredEndpoint);
         if (isAzure) {
           data.apiKey = 'n/a';
         }
@@ -223,6 +242,9 @@ const SetKeyDialog = ({
           if (!isAzure && key.startsWith('azure')) {
             return false;
           }
+          if (!isBedrock && key.startsWith('bedrock')) {
+            return false;
+          }
           if (isOpenAIBase && key === 'baseURL') {
             return false;
           }
@@ -232,16 +254,68 @@ const SetKeyDialog = ({
           return data[key] === '';
         });
 
-        if (emptyValues.length > 0) {
+        if (isBedrock) {
+          const bearerToken = userProvideBearerToken ? data.bedrockBearerToken?.trim() : '';
+          const accessKeyId = userProvideAccessKeyId ? data.bedrockAccessKeyId?.trim() : '';
+          const secretAccessKey = userProvideSecretAccessKey
+            ? data.bedrockSecretAccessKey?.trim()
+            : '';
+          const sessionToken = userProvideSessionToken ? data.bedrockSessionToken?.trim() : '';
+          const accessKeyIdLabel = localize('com_endpoint_config_bedrock_access_key_id');
+          const secretAccessKeyLabel = localize('com_endpoint_config_bedrock_secret_access_key');
+          const sessionTokenLabel = localize('com_endpoint_config_bedrock_session_token');
+          const bearerTokenLabel = localize('com_endpoint_config_bedrock_bearer_token');
+          const canSubmitBearerToken = !!bearerToken;
+          const hasUserProvidedAccessKeyAuth =
+            !!userProvideAccessKeyId || !!userProvideSecretAccessKey || !!userProvideSessionToken;
+          const missingFields = [
+            !canSubmitBearerToken && !hasUserProvidedAccessKeyAuth && userProvideBearerToken
+              ? bearerTokenLabel
+              : '',
+            !canSubmitBearerToken && userProvideAccessKeyId && !accessKeyId ? accessKeyIdLabel : '',
+            !canSubmitBearerToken && userProvideSecretAccessKey && !secretAccessKey
+              ? secretAccessKeyLabel
+              : '',
+            !canSubmitBearerToken && userProvideSessionToken && !sessionToken
+              ? sessionTokenLabel
+              : '',
+          ].filter(Boolean);
+
+          if (!canSubmitBearerToken && missingFields.length > 0) {
+            showToast({
+              message: `${localize('com_endpoint_config_required_fields')} ${missingFields.join(', ')}`,
+              status: NotificationSeverity.ERROR,
+            });
+            onOpenChange(true);
+            return;
+          }
+
+          if (!canSubmitBearerToken && !hasUserProvidedAccessKeyAuth) {
+            showToast({
+              message: localize('com_endpoint_config_bedrock_credentials_required'),
+              status: NotificationSeverity.ERROR,
+            });
+            onOpenChange(true);
+            return;
+          }
+        } else if (emptyValues.length > 0) {
           showToast({
-            message: 'The following fields are required: ' + emptyValues.join(', '),
-            status: 'error',
+            message: `${localize('com_endpoint_config_required_fields')} ${emptyValues.join(', ')}`,
+            status: NotificationSeverity.ERROR,
           });
           onOpenChange(true);
           return;
         }
 
-        const { apiKey, baseURL, ...azureOptions } = data;
+        const {
+          apiKey,
+          baseURL,
+          bedrockAccessKeyId,
+          bedrockSecretAccessKey,
+          bedrockSessionToken,
+          bedrockBearerToken,
+          ...azureOptions
+        } = data;
         const userProvidedData = { apiKey, baseURL };
         if (isAzure) {
           userProvidedData.apiKey = JSON.stringify({
@@ -250,6 +324,23 @@ const SetKeyDialog = ({
             azureOpenAIApiDeploymentName: azureOptions.azureOpenAIApiDeploymentName,
             azureOpenAIApiVersion: azureOptions.azureOpenAIApiVersion,
           });
+        } else if (isBedrock) {
+          const bearerToken = userProvideBearerToken ? bedrockBearerToken.trim() : '';
+          const accessKeyId = userProvideAccessKeyId ? bedrockAccessKeyId.trim() : '';
+          const secretAccessKey = userProvideSecretAccessKey ? bedrockSecretAccessKey.trim() : '';
+          const sessionToken = userProvideSessionToken ? bedrockSessionToken.trim() : '';
+
+          if (bearerToken) {
+            userProvidedData.apiKey = JSON.stringify({
+              bearerToken,
+            });
+          } else {
+            userProvidedData.apiKey = JSON.stringify({
+              ...(accessKeyId && { accessKeyId }),
+              ...(secretAccessKey && { secretAccessKey }),
+              ...(sessionToken && { sessionToken }),
+            });
+          }
         }
 
         saveKey(JSON.stringify(userProvidedData));
@@ -270,8 +361,7 @@ const SetKeyDialog = ({
     setUserKey('');
   };
 
-  const EndpointComponent =
-    endpointComponents[endpointType ?? endpoint] ?? endpointComponents['default'];
+  const EndpointComponent = endpointComponents[configuredEndpoint] ?? endpointComponents['default'];
   const expiryTime = getExpiry();
 
   return (
@@ -305,6 +395,10 @@ const SetKeyDialog = ({
               endpoint={endpoint}
               setUserKey={setUserKey}
               userProvideURL={userProvideURL}
+              userProvideAccessKeyId={userProvideAccessKeyId}
+              userProvideSecretAccessKey={userProvideSecretAccessKey}
+              userProvideSessionToken={userProvideSessionToken}
+              userProvideBearerToken={userProvideBearerToken}
             />
           </FormProvider>
           <HelpText endpoint={endpoint} />
diff --git a/client/src/components/MCP/CustomUserVarsSection.tsx b/client/src/components/MCP/CustomUserVarsSection.tsx
index a986a2786f3..22548723992 100644
--- a/client/src/components/MCP/CustomUserVarsSection.tsx
+++ b/client/src/components/MCP/CustomUserVarsSection.tsx
@@ -1,13 +1,20 @@
 import React, { useMemo } from 'react';
-import DOMPurify from 'dompurify';
 import { useForm, Controller } from 'react-hook-form';
-import { Input, Label, Button } from '@librechat/client';
+import { Label, Input, Button, SecretInput } from '@librechat/client';
+import type { Control, FieldErrors } from 'react-hook-form';
 import { useMCPAuthValuesQuery } from '~/data-provider/Tools/queries';
+import {
+  CONFIG_HTML_INLINE_TAGS,
+  CONFIG_HTML_CLASS_ATTR,
+  createConfigHtmlSanitizer,
+} from '~/utils/configHtml';
 import { useLocalize } from '~/hooks';
 
 export interface CustomUserVarConfig {
   title: string;
   description?: string;
+  /** Whether the field holds a secret and should be masked (defaults to masked when omitted). */
+  sensitive?: boolean;
 }
 
 interface CustomUserVarsSectionProps {
@@ -21,42 +28,26 @@ interface AuthFieldProps {
   name: string;
   config: CustomUserVarConfig;
   hasValue: boolean;
-  control: any;
-  errors: any;
+  control: Control<Record<string, string>>;
+  errors: FieldErrors<Record<string, string>>;
   autoFocus?: boolean;
 }
 
 function AuthField({ name, config, hasValue, control, errors, autoFocus }: AuthFieldProps) {
   const localize = useLocalize();
   const statusText = hasValue ? localize('com_ui_set') : localize('com_ui_unset');
-
-  const sanitizer = useMemo(() => {
-    const instance = DOMPurify();
-    instance.addHook('afterSanitizeAttributes', (node) => {
-      if (node.tagName && node.tagName === 'A') {
-        node.setAttribute('target', '_blank');
-        node.setAttribute('rel', 'noopener noreferrer');
-      }
-    });
-    return instance;
-  }, []);
+  const sanitize = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_INLINE_TAGS,
+        allowedAttr: CONFIG_HTML_CLASS_ATTR,
+      }),
+    [],
+  );
 
   const sanitizedDescription = useMemo(() => {
-    if (!config.description) {
-      return '';
-    }
-    try {
-      return sanitizer.sanitize(config.description, {
-        ALLOWED_TAGS: ['a', 'strong', 'b', 'em', 'i', 'br', 'code'],
-        ALLOWED_ATTR: ['href', 'class', 'target', 'rel'],
-        ALLOW_DATA_ATTR: false,
-        ALLOW_ARIA_ATTR: false,
-      });
-    } catch (error) {
-      console.error('Sanitization failed', error);
-      return config.description;
-    }
-  }, [config.description, sanitizer]);
+    return sanitize(config.description);
+  }, [config.description, sanitize]);
 
   return (
     <div className="space-y-2">
@@ -82,29 +73,30 @@ function AuthField({ name, config, hasValue, control, errors, autoFocus }: AuthF
         name={name}
         control={control}
         defaultValue=""
-        render={({ field }) => (
-          <Input
-            id={name}
-            // Prevent autofill: browser DOM mutations bypass React's synthetic
-            // onChange, silently emptying react-hook-form state on submit.
-            type="new-password"
-            autoComplete="new-password"
-            data-lpignore="true"
-            data-1p-ignore="true"
-            /* autoFocus is generally disabled due to the fact that it can disorient users,
-             * but in this case, the required field would logically be immediately navigated to anyways, and the component's
-             * functionality emulates that of a new modal opening, where users would expect focus to be shifted to the new content */
-            // eslint-disable-next-line jsx-a11y/no-autofocus
-            autoFocus={autoFocus}
-            {...field}
-            placeholder={
-              hasValue
-                ? localize('com_ui_mcp_update_var', { 0: config.title })
-                : localize('com_ui_mcp_enter_var', { 0: config.title })
-            }
-            className="w-full rounded border border-border-medium bg-transparent px-2 py-1 text-text-primary placeholder:text-text-secondary focus:outline-none sm:text-sm"
-          />
-        )}
+        render={({ field }) => {
+          const placeholder = hasValue
+            ? localize('com_ui_mcp_update_var', { 0: config.title })
+            : localize('com_ui_mcp_enter_var', { 0: config.title });
+          const className =
+            'w-full rounded border border-border-medium bg-transparent px-2 py-1 text-text-primary placeholder:text-text-secondary focus:outline-none sm:text-sm';
+          // Prevent autofill: browser DOM mutations bypass React's synthetic
+          // onChange, silently emptying react-hook-form state on submit.
+          const sharedProps = {
+            id: name,
+            'data-lpignore': 'true',
+            'data-1p-ignore': 'true',
+            /* autoFocus is generally disorienting, but here the required field is navigated to
+             * anyway, and the section emulates a modal opening where users expect focus to shift. */
+            autoFocus,
+            ...field,
+            placeholder,
+            className,
+          };
+          if (config.sensitive === false) {
+            return <Input {...sharedProps} type="text" autoComplete="off" />;
+          }
+          return <SecretInput {...sharedProps} autoComplete="new-password" controlsOnHover />;
+        }}
       />
       {sanitizedDescription && (
         <p
diff --git a/client/src/components/MCP/MCPServerStatusIcon.tsx b/client/src/components/MCP/MCPServerStatusIcon.tsx
index 8ae225b2e28..24943c41ef2 100644
--- a/client/src/components/MCP/MCPServerStatusIcon.tsx
+++ b/client/src/components/MCP/MCPServerStatusIcon.tsx
@@ -73,8 +73,19 @@ export default function MCPServerStatusIcon({
 
   const { connectionState } = serverStatus;
 
-  // Connecting: show spinner only (no action available)
+  // Connecting: show spinner, with cancel when an OAuth flow is pending.
   if (connectionState === 'connecting') {
+    if (canCancel) {
+      return (
+        <LoadingStatusIcon
+          serverName={serverName}
+          onConfigClick={onConfigClick}
+          onCancel={onCancel}
+          canCancel={canCancel}
+        />
+      );
+    }
+
     return <ConnectingSpinner serverName={serverName} />;
   }
 
diff --git a/client/src/components/MCP/ServerInitializationSection.tsx b/client/src/components/MCP/ServerInitializationSection.tsx
index c080866b3d4..bbed167da6c 100644
--- a/client/src/components/MCP/ServerInitializationSection.tsx
+++ b/client/src/components/MCP/ServerInitializationSection.tsx
@@ -38,15 +38,33 @@ export default function ServerInitializationSection({
 
   const serverStatus = connectionStatus?.[serverName];
   const isConnected = serverStatus?.connectionState === 'connected';
-  const canCancel = isCancellable(serverName);
+  const hasPendingOAuth =
+    requiresOAuth &&
+    serverStatus?.requiresOAuth === true &&
+    serverStatus.connectionState === 'connecting';
+  const canCancel = isCancellable(serverName) || hasPendingOAuth;
   const isServerInitializing = isInitializing(serverName);
   const serverOAuthUrl = getOAuthUrl(serverName);
 
   const shouldShowReinit = isConnected && (requiresOAuth || hasCustomUserVars);
-  const shouldShowInit = !isConnected && !serverOAuthUrl;
+  const shouldShowInit = !isConnected && !serverOAuthUrl && !hasPendingOAuth;
 
   if (!shouldShowReinit && !shouldShowInit && !serverOAuthUrl) {
-    return null;
+    if (!hasPendingOAuth) {
+      return null;
+    }
+
+    return (
+      <Button
+        onClick={() => cancelOAuthFlow(serverName)}
+        disabled={!canCancel}
+        variant="outline"
+        size={sidePanel ? 'sm' : 'default'}
+        className="w-full"
+      >
+        {localize('com_ui_cancel')}
+      </Button>
+    );
   }
 
   if (serverOAuthUrl) {
diff --git a/client/src/components/MCP/__tests__/CustomUserVarsSection.test.tsx b/client/src/components/MCP/__tests__/CustomUserVarsSection.test.tsx
index 67b934e31ca..7c2ce2816a2 100644
--- a/client/src/components/MCP/__tests__/CustomUserVarsSection.test.tsx
+++ b/client/src/components/MCP/__tests__/CustomUserVarsSection.test.tsx
@@ -27,8 +27,25 @@ describe('CustomUserVarsSection', () => {
 
     const input = screen.getByLabelText(/My API Key/);
     expect(input).toHaveAttribute('autocomplete', 'new-password');
-    expect(input).toHaveAttribute('type', 'new-password');
+    expect(input).toHaveAttribute('type', 'password');
     expect(input).toHaveAttribute('data-lpignore', 'true');
     expect(input).toHaveAttribute('data-1p-ignore', 'true');
   });
+
+  it('renders non-sensitive fields as unmasked text while keeping secrets masked', () => {
+    render(
+      <CustomUserVarsSection
+        serverName="test-server"
+        fields={{
+          api_key: { title: 'My API Key', description: 'Your API key' },
+          project_key: { title: 'Project Key', description: 'Your project key', sensitive: false },
+        }}
+        onSave={jest.fn()}
+        onRevoke={jest.fn()}
+      />,
+    );
+
+    expect(screen.getByLabelText(/My API Key/)).toHaveAttribute('type', 'password');
+    expect(screen.getByLabelText(/Project Key/)).toHaveAttribute('type', 'text');
+  });
 });
diff --git a/client/src/components/MCP/mcpServerUtils.ts b/client/src/components/MCP/mcpServerUtils.ts
index eb93303ca16..feef7dccdea 100644
--- a/client/src/components/MCP/mcpServerUtils.ts
+++ b/client/src/components/MCP/mcpServerUtils.ts
@@ -187,7 +187,9 @@ export function shouldShowActionButton(statusIconProps?: MCPServerStatusIconProp
 
   // Show for disconnected/error (can reconnect/configure)
   if (connectionState === 'disconnected' || connectionState === 'error') return true;
-  // Don't show connecting spinner (no action)
+  // Show a cancel action for pending OAuth connections.
+  if (connectionState === 'connecting' && requiresOAuth && canCancel) return true;
+  // Don't show connecting spinner when no action is available.
   if (connectionState === 'connecting') return false;
   // Connected: only show if there's config to manage
   if (connectionState === 'connected') return hasCustomUserVars || requiresOAuth;
diff --git a/client/src/components/Messages/Content/RunCode.tsx b/client/src/components/Messages/Content/RunCode.tsx
index da7db2739aa..15c31bb85be 100644
--- a/client/src/components/Messages/Content/RunCode.tsx
+++ b/client/src/components/Messages/Content/RunCode.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useMemo, useCallback, useEffect, useRef } from 'react';
 import debounce from 'lodash/debounce';
+import { useRecoilCallback } from 'recoil';
 import { Tools } from 'librechat-data-provider';
 import { TerminalSquareIcon, Check, X } from 'lucide-react';
 import { Spinner, TooltipAnchor, useToastContext } from '@librechat/client';
@@ -8,6 +9,7 @@ import { useToolCallMutation } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 import { cn, normalizeLanguage } from '~/utils';
 import { useMessageContext } from '~/Providers';
+import store from '~/store';
 
 type RunState = 'idle' | 'loading' | 'success' | 'error';
 
@@ -23,6 +25,13 @@ const RunCode: React.FC<CodeBarProps & { iconOnly?: boolean }> = React.memo(
 
     const { messageId, conversationId, partIndex } = useMessageContext();
     const normalizedLang = useMemo(() => normalizeLanguage(lang), [lang]);
+    // Read at click time so retention context is current without re-rendering every code block.
+    const getIsTemporary = useRecoilCallback(
+      ({ snapshot }) =>
+        () =>
+          snapshot.getPromise(store.isTemporary),
+      [],
+    );
 
     const handleExecute = useCallback(async () => {
       const codeString: string = codeRef.current?.textContent ?? '';
@@ -42,8 +51,18 @@ const RunCode: React.FC<CodeBarProps & { iconOnly?: boolean }> = React.memo(
         conversationId: conversationId ?? '',
         lang: normalizedLang,
         code: codeString,
+        isTemporary: await getIsTemporary(),
       });
-    }, [codeRef, execute, partIndex, messageId, blockIndex, conversationId, normalizedLang]);
+    }, [
+      codeRef,
+      execute,
+      partIndex,
+      messageId,
+      blockIndex,
+      conversationId,
+      normalizedLang,
+      getIsTemporary,
+    ]);
 
     const debouncedExecute = useMemo(
       () => debounce(handleExecute, 1000, { leading: true }),
diff --git a/client/src/components/Messages/ContentRender.tsx b/client/src/components/Messages/ContentRender.tsx
index da40bec1047..10800aff0fa 100644
--- a/client/src/components/Messages/ContentRender.tsx
+++ b/client/src/components/Messages/ContentRender.tsx
@@ -5,6 +5,7 @@ import type { TMessage, TMessageContentParts } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon, TMessageChatContext } from '~/common';
 import { useAttachments, useLocalize, useMessageActions, useContentMetadata } from '~/hooks';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import ContentParts from '~/components/Chat/Messages/Content/ContentParts';
 import PlaceholderRow from '~/components/Chat/Messages/ui/PlaceholderRow';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
@@ -70,6 +71,7 @@ function areContentRenderPropsEqual(prev: ContentRenderProps, next: ContentRende
     prevMsg.text === nextMsg.text &&
     prevMsg.error === nextMsg.error &&
     prevMsg.unfinished === nextMsg.unfinished &&
+    prevMsg.createdAt === nextMsg.createdAt &&
     prevMsg.depth === nextMsg.depth &&
     prevMsg.isCreatedByUser === nextMsg.isCreatedByUser &&
     (prevMsg.children?.length ?? 0) === (nextMsg.children?.length ?? 0) &&
@@ -80,7 +82,8 @@ function areContentRenderPropsEqual(prev: ContentRenderProps, next: ContentRende
     prevMsg.feedback?.rating === nextMsg.feedback?.rating &&
     (prevMsg.attachments?.length ?? 0) === (nextMsg.attachments?.length ?? 0) &&
     (prevMsg.manualSkills?.length ?? 0) === (nextMsg.manualSkills?.length ?? 0) &&
-    (prevMsg.alwaysAppliedSkills?.length ?? 0) === (nextMsg.alwaysAppliedSkills?.length ?? 0)
+    (prevMsg.alwaysAppliedSkills?.length ?? 0) === (nextMsg.alwaysAppliedSkills?.length ?? 0) &&
+    (prevMsg.quotes?.length ?? 0) === (nextMsg.quotes?.length ?? 0)
   );
 }
 
@@ -172,7 +175,7 @@ const ContentRender = memo(function ContentRender({
   };
 
   const conditionalClasses = {
-    focus: 'focus:outline-none focus:ring-2 focus:ring-border-xheavy',
+    focus: 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
   };
 
   return (
@@ -205,6 +208,7 @@ const ContentRender = memo(function ContentRender({
           <h2 className={cn('select-none font-semibold', fontSize)}>
             <span className="sr-only">{getHeaderPrefixForScreenReader(msg, localize)}</span>
             {messageLabel}
+            <MessageTimestamp value={msg.createdAt ?? msg.clientTimestamp} />
           </h2>
         )}
 
@@ -223,6 +227,7 @@ const ContentRender = memo(function ContentRender({
               isLatestMessage={isLatestMessage}
               isSubmitting={isSubmitting}
               isCreatedByUser={msg.isCreatedByUser}
+              createdAt={msg.createdAt ?? msg.clientTimestamp}
               conversationId={conversation?.conversationId}
               content={msg.content as Array<TMessageContentParts | undefined>}
             />
diff --git a/client/src/components/Nav/AccountSettings.tsx b/client/src/components/Nav/AccountSettings.tsx
index 01417ef3624..d5c37652616 100644
--- a/client/src/components/Nav/AccountSettings.tsx
+++ b/client/src/components/Nav/AccountSettings.tsx
@@ -1,12 +1,96 @@
 import { useState, memo, useRef } from 'react';
+import { useSetRecoilState } from 'recoil';
 import * as Menu from '@ariakit/react/menu';
-import { FileText, LogOut } from 'lucide-react';
-import { LinkIcon, GearIcon, DropdownMenuSeparator, Avatar } from '@librechat/client';
+import { GearIcon, DropdownMenuSeparator, Avatar } from '@librechat/client';
+import {
+  Archive,
+  ChevronRight,
+  CircleHelp,
+  FileText,
+  Keyboard,
+  LifeBuoy,
+  LogOut,
+  Scale,
+  ShieldCheck,
+} from 'lucide-react';
+import { ArchivedChatsModal } from '~/components/Nav/SettingsTabs/General/ArchivedChatsModal';
 import { MyFilesModal } from '~/components/Chat/Input/Files/MyFilesModal';
 import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
 import { useAuthContext } from '~/hooks/AuthContext';
 import { useLocalize } from '~/hooks';
 import Settings from './Settings';
+import store from '~/store';
+
+function HelpSubmenu({
+  helpAndFaqURL,
+  termsOfServiceURL,
+  privacyPolicyURL,
+  onShowShortcuts,
+}: {
+  helpAndFaqURL?: string;
+  termsOfServiceURL?: string;
+  privacyPolicyURL?: string;
+  onShowShortcuts: () => void;
+}) {
+  const localize = useLocalize();
+  const hasHelpFaq = !!helpAndFaqURL && helpAndFaqURL !== '/';
+  const hasTos = !!termsOfServiceURL;
+  const hasPrivacy = !!privacyPolicyURL;
+  const showLegalDivider = (hasHelpFaq || true) && (hasTos || hasPrivacy);
+
+  return (
+    <Menu.MenuProvider placement="right-start">
+      <Menu.MenuItem
+        hideOnClick={false}
+        render={
+          <Menu.MenuButton className="select-item flex w-full cursor-pointer items-center gap-2 text-sm" />
+        }
+      >
+        <CircleHelp className="icon-md" aria-hidden="true" />
+        <span className="flex-1 text-left">{localize('com_nav_help')}</span>
+        <ChevronRight className="h-4 w-4 text-text-secondary" aria-hidden="true" />
+      </Menu.MenuItem>
+      <Menu.Menu
+        portal
+        gutter={12}
+        className="account-settings-popover popover-ui popover-from-left z-[126] w-[244px] rounded-lg"
+      >
+        {hasHelpFaq && (
+          <Menu.MenuItem
+            onClick={() => window.open(helpAndFaqURL, '_blank', 'noopener,noreferrer')}
+            className="select-item text-sm"
+          >
+            <LifeBuoy className="icon-md" aria-hidden="true" />
+            {localize('com_nav_help_faq')}
+          </Menu.MenuItem>
+        )}
+        <Menu.MenuItem onClick={onShowShortcuts} className="select-item text-sm">
+          <Keyboard className="icon-md" aria-hidden="true" />
+          {localize('com_shortcut_keyboard_shortcuts')}
+        </Menu.MenuItem>
+        {showLegalDivider && (hasTos || hasPrivacy) && <DropdownMenuSeparator />}
+        {hasTos && (
+          <Menu.MenuItem
+            onClick={() => window.open(termsOfServiceURL, '_blank', 'noopener,noreferrer')}
+            className="select-item text-sm"
+          >
+            <Scale className="icon-md" aria-hidden="true" />
+            {localize('com_ui_terms_of_service')}
+          </Menu.MenuItem>
+        )}
+        {hasPrivacy && (
+          <Menu.MenuItem
+            onClick={() => window.open(privacyPolicyURL, '_blank', 'noopener,noreferrer')}
+            className="select-item text-sm"
+          >
+            <ShieldCheck className="icon-md" aria-hidden="true" />
+            {localize('com_ui_privacy_policy')}
+          </Menu.MenuItem>
+        )}
+      </Menu.Menu>
+    </Menu.MenuProvider>
+  );
+}
 
 function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
   const localize = useLocalize();
@@ -17,10 +101,12 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
   });
   const [showSettings, setShowSettings] = useState(false);
   const [showFiles, setShowFiles] = useState(false);
+  const setShowShortcutsDialog = useSetRecoilState(store.showShortcutsDialog);
+  const [showArchived, setShowArchived] = useState(false);
   const accountSettingsButtonRef = useRef<HTMLButtonElement>(null);
 
   return (
-    <Menu.MenuProvider>
+    <Menu.MenuProvider placement={collapsed ? 'right-end' : undefined}>
       <Menu.MenuButton
         ref={accountSettingsButtonRef}
         aria-label={localize('com_nav_account_settings')}
@@ -50,7 +136,6 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
       <Menu.Menu
         portal
         className="account-settings-popover popover-ui z-[125] w-[305px] rounded-lg md:w-[244px]"
-        placement={collapsed ? 'right-end' : undefined}
         style={{
           transformOrigin: collapsed ? 'left bottom' : 'bottom',
           translate: collapsed ? '4px 0' : '0 -4px',
@@ -69,20 +154,25 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
             <DropdownMenuSeparator />
           </>
         )}
+        <HelpSubmenu
+          helpAndFaqURL={startupConfig?.helpAndFaqURL}
+          termsOfServiceURL={startupConfig?.interface?.termsOfService?.externalUrl}
+          privacyPolicyURL={startupConfig?.interface?.privacyPolicy?.externalUrl}
+          onShowShortcuts={() => setShowShortcutsDialog(true)}
+        />
         <Menu.MenuItem onClick={() => setShowFiles(true)} className="select-item text-sm">
           <FileText className="icon-md" aria-hidden="true" />
           {localize('com_nav_my_files')}
         </Menu.MenuItem>
-        {startupConfig?.helpAndFaqURL !== '/' && (
-          <Menu.MenuItem
-            onClick={() => window.open(startupConfig?.helpAndFaqURL, '_blank')}
-            className="select-item text-sm"
-          >
-            <LinkIcon aria-hidden="true" />
-            {localize('com_nav_help_faq')}
-          </Menu.MenuItem>
-        )}
-        <Menu.MenuItem onClick={() => setShowSettings(true)} className="select-item text-sm">
+        <Menu.MenuItem onClick={() => setShowArchived(true)} className="select-item text-sm">
+          <Archive className="icon-md" aria-hidden="true" />
+          {localize('com_nav_archived_chats')}
+        </Menu.MenuItem>
+        <Menu.MenuItem
+          onClick={() => setShowSettings(true)}
+          className="select-item text-sm"
+          data-testid="nav-settings"
+        >
           <GearIcon className="icon-md" aria-hidden="true" />
           {localize('com_nav_settings')}
         </Menu.MenuItem>
@@ -99,6 +189,13 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
           triggerRef={accountSettingsButtonRef}
         />
       )}
+      {showArchived && (
+        <ArchivedChatsModal
+          open={showArchived}
+          onOpenChange={setShowArchived}
+          triggerRef={accountSettingsButtonRef}
+        />
+      )}
       {showSettings && <Settings open={showSettings} onOpenChange={setShowSettings} />}
     </Menu.MenuProvider>
   );
diff --git a/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx b/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
index 03dc401d608..e1fd91590fb 100644
--- a/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
+++ b/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
@@ -1,12 +1,12 @@
 import React from 'react';
 import { render, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom';
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RecoilRoot } from 'recoil';
 import { DndProvider } from 'react-dnd';
-import { HTML5Backend } from 'react-dnd-html5-backend';
 import { BrowserRouter } from 'react-router-dom';
 import { dataService } from 'librechat-data-provider';
+import { HTML5Backend } from 'react-dnd-html5-backend';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { Agent } from 'librechat-data-provider';
 
 // Mock store before importing FavoritesList
@@ -71,7 +71,7 @@ jest.mock('~/hooks/Input/useSelectMention', () => () => ({
   onSelectSpec: mockOnSelectSpec,
 }));
 
-const mockUseGetStartupConfig = jest.fn(() => ({
+const mockUseGetStartupConfig = jest.fn((): { data?: { modelSpecs: { list: unknown[] } } } => ({
   data: { modelSpecs: { list: [] as unknown[] } },
 }));
 
diff --git a/client/src/components/Nav/KeyboardDeleteDialog.tsx b/client/src/components/Nav/KeyboardDeleteDialog.tsx
new file mode 100644
index 00000000000..9b8d4600742
--- /dev/null
+++ b/client/src/components/Nav/KeyboardDeleteDialog.tsx
@@ -0,0 +1,34 @@
+import { useCallback } from 'react';
+import { useRecoilState } from 'recoil';
+import DeleteButton from '~/components/Conversations/ConvoOptions/DeleteButton';
+import store from '~/store';
+
+const retainView = () => {};
+
+export default function KeyboardDeleteDialog() {
+  const [target, setTarget] = useRecoilState(store.keyboardDeleteTarget);
+
+  const setShowDeleteDialog = useCallback(
+    (open: boolean) => {
+      if (!open) {
+        setTarget(null);
+      }
+    },
+    [setTarget],
+  );
+
+  if (!target) {
+    return null;
+  }
+
+  return (
+    <DeleteButton
+      title={target.title}
+      conversationId={target.conversationId}
+      currentConversationId={target.conversationId}
+      retainView={retainView}
+      showDeleteDialog={true}
+      setShowDeleteDialog={setShowDeleteDialog}
+    />
+  );
+}
diff --git a/client/src/components/Nav/KeyboardShortcutsDialog.tsx b/client/src/components/Nav/KeyboardShortcutsDialog.tsx
new file mode 100644
index 00000000000..cc49b8596b8
--- /dev/null
+++ b/client/src/components/Nav/KeyboardShortcutsDialog.tsx
@@ -0,0 +1,403 @@
+import { memo, useCallback, useMemo, useState } from 'react';
+import { Plus, X } from 'lucide-react';
+import { useRecoilState } from 'recoil';
+import { OGDialog, OGDialogContent, OGDialogTitle, OGDialogClose } from '@librechat/client';
+import type { ShortcutActionId, ShortcutBindingInfo } from '~/hooks/useKeyboardShortcuts';
+import type { TranslationKeys } from '~/hooks/useLocalize';
+import type { ShortcutBinding } from '~/utils/shortcuts';
+import { RecorderInfo, RecorderPill, useShortcutRecorder } from './ShortcutRecorder';
+import { isMac, useShortcutBindings } from '~/hooks/useKeyboardShortcuts';
+import { bindingDisplayKeys } from '~/utils/shortcuts';
+import ShortcutKeyCombo from './ShortcutKeyCombo';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+import store from '~/store';
+
+type GroupedBindings = Record<string, ShortcutBindingInfo[]>;
+
+const PANELS_GROUP = 'com_shortcut_group_panels';
+
+function EditingRow({
+  info,
+  label,
+  bindingMap,
+  getActionLabel,
+  setBinding,
+  onStopEdit,
+}: {
+  info: ShortcutBindingInfo;
+  label: string;
+  bindingMap: Map<string, ShortcutActionId>;
+  getActionLabel: (id: string) => string;
+  setBinding: (id: ShortcutActionId, binding: ShortcutBinding | null) => void;
+  onStopEdit: () => void;
+}) {
+  const localize = useLocalize();
+
+  const handleSave = useCallback(
+    (binding: ShortcutBinding) => {
+      setBinding(info.id, binding);
+      onStopEdit();
+    },
+    [info.id, setBinding, onStopEdit],
+  );
+
+  const handleSaveReplacing = useCallback(
+    (binding: ShortcutBinding, conflictId: string) => {
+      setBinding(conflictId as ShortcutActionId, null);
+      setBinding(info.id, binding);
+      onStopEdit();
+    },
+    [info.id, setBinding, onStopEdit],
+  );
+
+  const recorder = useShortcutRecorder({
+    initial: info.binding,
+    bindingMap: bindingMap as Map<string, string>,
+    ownerId: info.id,
+    getActionLabel,
+    onSave: handleSave,
+    onCancel: onStopEdit,
+  });
+
+  return (
+    <div ref={recorder.boundaryRef} className="flex flex-col gap-1.5">
+      <div className="flex items-center justify-between gap-3">
+        <span className="truncate text-[13px] text-text-primary">{label}</span>
+        <RecorderPill
+          state={recorder}
+          ariaLabel={localize('com_shortcut_edit_aria', { 0: label })}
+          ownerId={info.id}
+        />
+      </div>
+      <RecorderInfo
+        state={recorder}
+        ownerId={info.id}
+        onCancel={onStopEdit}
+        onSaveReplacing={handleSaveReplacing}
+      />
+    </div>
+  );
+}
+
+function ShortcutRow({
+  info,
+  isEditing,
+  onStartEdit,
+  onStopEdit,
+  bindingMap,
+  getActionLabel,
+  setBinding,
+  resetBinding,
+}: {
+  info: ShortcutBindingInfo;
+  isEditing: boolean;
+  onStartEdit: (id: ShortcutActionId) => void;
+  onStopEdit: () => void;
+  bindingMap: Map<string, ShortcutActionId>;
+  getActionLabel: (id: string) => string;
+  setBinding: (id: ShortcutActionId, binding: ShortcutBinding | null) => void;
+  resetBinding: (id: ShortcutActionId) => void;
+}) {
+  const localize = useLocalize();
+  const label = localize(info.labelKey as TranslationKeys);
+  const displayKeys = useMemo(() => bindingDisplayKeys(info.binding, isMac), [info.binding]);
+  const editAriaLabel = localize('com_shortcut_edit_aria', { 0: label });
+  const isUnset = displayKeys.length === 0;
+
+  if (isEditing) {
+    return (
+      <div className="px-2 py-2">
+        <EditingRow
+          info={info}
+          label={label}
+          bindingMap={bindingMap}
+          getActionLabel={getActionLabel}
+          setBinding={setBinding}
+          onStopEdit={onStopEdit}
+        />
+      </div>
+    );
+  }
+
+  return (
+    <div className="group flex items-center justify-between gap-3 px-2 py-2">
+      <span
+        className={cn(
+          'truncate text-[13px]',
+          isUnset ? 'text-text-secondary' : 'text-text-primary',
+        )}
+      >
+        {label}
+      </span>
+      <div className="flex items-center gap-2">
+        {info.isCustom && (
+          <button
+            type="button"
+            onClick={() => resetBinding(info.id)}
+            className="text-[11.5px] text-text-secondary opacity-0 transition-opacity hover:text-text-primary focus-visible:opacity-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring group-hover:opacity-100"
+          >
+            {localize('com_shortcut_reset')}
+          </button>
+        )}
+        {isUnset ? (
+          <button
+            type="button"
+            onClick={() => onStartEdit(info.id)}
+            aria-label={editAriaLabel}
+            data-testid={`edit-shortcut-${info.id}`}
+            className="inline-flex h-[22px] items-center gap-1 rounded-md border border-dashed border-border-medium bg-transparent px-2 text-[11px] font-medium text-text-secondary transition-colors hover:border-border-heavy hover:bg-surface-tertiary hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:hover:bg-surface-secondary-alt"
+          >
+            <Plus className="h-3 w-3" aria-hidden="true" />
+            {localize('com_shortcut_set')}
+          </button>
+        ) : (
+          <button
+            type="button"
+            onClick={() => onStartEdit(info.id)}
+            aria-label={editAriaLabel}
+            data-testid={`edit-shortcut-${info.id}`}
+            className="rounded-md px-1 py-0.5 transition-colors hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:hover:bg-surface-secondary-alt"
+          >
+            <ShortcutKeyCombo keys={displayKeys} />
+          </button>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function ShortcutGroup({
+  groupKey,
+  bindings,
+  editingId,
+  onStartEdit,
+  onStopEdit,
+  bindingMap,
+  getActionLabel,
+  setBinding,
+  resetBinding,
+}: {
+  groupKey: string;
+  bindings: ShortcutBindingInfo[];
+  editingId: ShortcutActionId | null;
+  onStartEdit: (id: ShortcutActionId) => void;
+  onStopEdit: () => void;
+  bindingMap: Map<string, ShortcutActionId>;
+  getActionLabel: (id: string) => string;
+  setBinding: (id: ShortcutActionId, binding: ShortcutBinding | null) => void;
+  resetBinding: (id: ShortcutActionId) => void;
+}) {
+  const localize = useLocalize();
+  return (
+    <section className="mb-6 last:mb-0">
+      <h3 className="mb-2 px-2 text-[12px] font-medium text-text-secondary">
+        {localize(groupKey as TranslationKeys)}
+      </h3>
+      <div className="flex flex-col">
+        {bindings.map((info) => (
+          <ShortcutRow
+            key={info.id}
+            info={info}
+            isEditing={editingId === info.id}
+            onStartEdit={onStartEdit}
+            onStopEdit={onStopEdit}
+            bindingMap={bindingMap}
+            getActionLabel={getActionLabel}
+            setBinding={setBinding}
+            resetBinding={resetBinding}
+          />
+        ))}
+      </div>
+    </section>
+  );
+}
+
+function PanelsSection({
+  bindings,
+  editingId,
+  onStartEdit,
+  onStopEdit,
+  bindingMap,
+  getActionLabel,
+  setBinding,
+  resetBinding,
+}: {
+  bindings: ShortcutBindingInfo[];
+  editingId: ShortcutActionId | null;
+  onStartEdit: (id: ShortcutActionId) => void;
+  onStopEdit: () => void;
+  bindingMap: Map<string, ShortcutActionId>;
+  getActionLabel: (id: string) => string;
+  setBinding: (id: ShortcutActionId, binding: ShortcutBinding | null) => void;
+  resetBinding: (id: ShortcutActionId) => void;
+}) {
+  const localize = useLocalize();
+  return (
+    <section className="border-t border-border-light px-5 pb-2 pt-4">
+      <div className="mb-2 flex items-baseline justify-between gap-3 px-2">
+        <h3 className="text-[12px] font-medium text-text-secondary">
+          {localize('com_shortcut_group_panels')}
+        </h3>
+        <p className="text-text-secondary/80 text-[11.5px]">
+          {localize('com_shortcut_group_panels_hint')}
+        </p>
+      </div>
+      <div className="grid grid-cols-1 gap-x-10 md:grid-cols-2">
+        {bindings.map((info) => (
+          <ShortcutRow
+            key={info.id}
+            info={info}
+            isEditing={editingId === info.id}
+            onStartEdit={onStartEdit}
+            onStopEdit={onStopEdit}
+            bindingMap={bindingMap}
+            getActionLabel={getActionLabel}
+            setBinding={setBinding}
+            resetBinding={resetBinding}
+          />
+        ))}
+      </div>
+    </section>
+  );
+}
+
+function KeyboardShortcutsDialog() {
+  const localize = useLocalize();
+  const { bindings, bindingMap, setBinding, resetBinding, resetAll } = useShortcutBindings();
+  const [open, setOpen] = useRecoilState(store.showShortcutsDialog);
+  const [editingId, setEditingId] = useState<ShortcutActionId | null>(null);
+
+  const grouped = useMemo<GroupedBindings>(() => {
+    const groups: GroupedBindings = {};
+    for (const info of bindings) {
+      const group = info.groupKey;
+      if (!groups[group]) {
+        groups[group] = [];
+      }
+      groups[group].push(info);
+    }
+    return groups;
+  }, [bindings]);
+
+  const groupEntries = useMemo(() => Object.entries(grouped), [grouped]);
+
+  const leftColumn = useMemo(
+    () => groupEntries.filter(([key]) => key !== 'com_shortcut_group_chat' && key !== PANELS_GROUP),
+    [groupEntries],
+  );
+  const rightColumn = useMemo(
+    () => groupEntries.filter(([key]) => key === 'com_shortcut_group_chat'),
+    [groupEntries],
+  );
+  const panelEntries = useMemo(() => grouped[PANELS_GROUP] ?? [], [grouped]);
+
+  const labelMap = useMemo<Map<string, string>>(() => {
+    const map = new Map<string, string>();
+    for (const info of bindings) {
+      map.set(info.id, localize(info.labelKey as TranslationKeys));
+    }
+    return map;
+  }, [bindings, localize]);
+
+  const getActionLabel = useCallback((id: string) => labelMap.get(id) ?? id, [labelMap]);
+
+  const handleStartEdit = useCallback((id: ShortcutActionId) => {
+    setEditingId(id);
+  }, []);
+  const handleStopEdit = useCallback(() => {
+    setEditingId(null);
+  }, []);
+
+  const hasAnyCustom = useMemo(() => bindings.some((b) => b.isCustom), [bindings]);
+
+  return (
+    <OGDialog
+      open={open}
+      onOpenChange={(next) => {
+        if (!next) {
+          setEditingId(null);
+        }
+        setOpen(next);
+      }}
+    >
+      <OGDialogContent
+        showCloseButton={false}
+        className="flex max-h-[85vh] w-11/12 max-w-3xl flex-col overflow-hidden p-0"
+      >
+        <header className="flex shrink-0 items-center justify-between gap-4 px-7 pt-6">
+          <OGDialogTitle className="text-[16px] font-semibold text-text-primary">
+            {localize('com_shortcut_keyboard_shortcuts')}
+          </OGDialogTitle>
+          <OGDialogClose className="inline-flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-text-secondary transition-colors hover:bg-surface-tertiary hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring dark:hover:bg-surface-secondary-alt">
+            <X className="h-4 w-4" />
+            <span className="sr-only">{localize('com_ui_close')}</span>
+          </OGDialogClose>
+        </header>
+
+        <div className="flex-1 overflow-y-auto">
+          <div className="grid grid-cols-1 gap-x-10 px-5 pb-2 pt-5 md:grid-cols-2">
+            <div>
+              {leftColumn.map(([groupKey, items]) => (
+                <ShortcutGroup
+                  key={groupKey}
+                  groupKey={groupKey}
+                  bindings={items}
+                  editingId={editingId}
+                  onStartEdit={handleStartEdit}
+                  onStopEdit={handleStopEdit}
+                  bindingMap={bindingMap}
+                  getActionLabel={getActionLabel}
+                  setBinding={setBinding}
+                  resetBinding={resetBinding}
+                />
+              ))}
+            </div>
+            <div>
+              {rightColumn.map(([groupKey, items]) => (
+                <ShortcutGroup
+                  key={groupKey}
+                  groupKey={groupKey}
+                  bindings={items}
+                  editingId={editingId}
+                  onStartEdit={handleStartEdit}
+                  onStopEdit={handleStopEdit}
+                  bindingMap={bindingMap}
+                  getActionLabel={getActionLabel}
+                  setBinding={setBinding}
+                  resetBinding={resetBinding}
+                />
+              ))}
+            </div>
+          </div>
+          {panelEntries.length > 0 && (
+            <PanelsSection
+              bindings={panelEntries}
+              editingId={editingId}
+              onStartEdit={handleStartEdit}
+              onStopEdit={handleStopEdit}
+              bindingMap={bindingMap}
+              getActionLabel={getActionLabel}
+              setBinding={setBinding}
+              resetBinding={resetBinding}
+            />
+          )}
+        </div>
+
+        {hasAnyCustom && (
+          <footer className="flex shrink-0 justify-end border-t border-border-light px-7 py-3">
+            <button
+              type="button"
+              onClick={resetAll}
+              className="text-[12px] text-text-secondary transition-colors hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            >
+              {localize('com_shortcut_reset_all')}
+            </button>
+          </footer>
+        )}
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
+
+export default memo(KeyboardShortcutsDialog);
diff --git a/client/src/components/Nav/NavToggle.tsx b/client/src/components/Nav/NavToggle.tsx
index 301ccdfe8c2..07a4fdccf94 100644
--- a/client/src/components/Nav/NavToggle.tsx
+++ b/client/src/components/Nav/NavToggle.tsx
@@ -1,4 +1,5 @@
 import { TooltipAnchor } from '@librechat/client';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -45,6 +46,9 @@ export default function NavToggle({
   }
 
   const ariaDescription = localize(actionKey, { 0: sidebarLabel });
+  const shortcutId = side === 'left' ? 'toggleSidebar' : undefined;
+  const tooltipDescription = useShortcutHint(shortcutId, ariaDescription);
+  const ariaKey = useShortcutAriaKey(shortcutId);
 
   return (
     <div
@@ -65,7 +69,8 @@ export default function NavToggle({
         id={`toggle-${side}-nav`}
         onClick={onToggle}
         role="button"
-        description={ariaDescription}
+        description={tooltipDescription}
+        aria-keyshortcuts={ariaKey}
         className="flex items-center justify-center"
         tabIndex={0}
       >
diff --git a/client/src/components/Nav/SearchBar.tsx b/client/src/components/Nav/SearchBar.tsx
index 84648ac67d0..3bbcacb5061 100644
--- a/client/src/components/Nav/SearchBar.tsx
+++ b/client/src/components/Nav/SearchBar.tsx
@@ -5,6 +5,7 @@ import { Search, X } from 'lucide-react';
 import { QueryKeys } from 'librechat-data-provider';
 import { useQueryClient } from '@tanstack/react-query';
 import { useLocation, useNavigate } from 'react-router-dom';
+import { useShortcutAriaKey } from '~/hooks/useKeyboardShortcuts';
 import { useLocalize, useNewConvo } from '~/hooks';
 import { cn } from '~/utils';
 import store from '~/store';
@@ -23,6 +24,7 @@ const SearchBar = forwardRef((props: SearchBarProps, ref: React.Ref<HTMLDivEleme
   const [text, setText] = useState('');
   const inputRef = useRef<HTMLInputElement>(null);
   const [showClearIcon, setShowClearIcon] = useState(false);
+  const focusSearchAriaKey = useShortcutAriaKey('focusSearch');
 
   const { newConversation: newConvo } = useNewConvo();
   const [search, setSearchState] = useRecoilState(store.search);
@@ -117,6 +119,7 @@ const SearchBar = forwardRef((props: SearchBarProps, ref: React.Ref<HTMLDivEleme
       />
       <input
         type="text"
+        data-testid="nav-search-input"
         ref={inputRef}
         className="m-0 mr-0 w-full border-none bg-transparent p-0 pl-7 text-sm leading-tight placeholder-text-secondary placeholder-opacity-100 focus-visible:outline-none group-focus-within:placeholder-text-primary group-hover:placeholder-text-primary"
         value={text}
@@ -125,6 +128,7 @@ const SearchBar = forwardRef((props: SearchBarProps, ref: React.Ref<HTMLDivEleme
           e.code === 'Space' ? e.stopPropagation() : null;
         }}
         aria-label={localize('com_nav_search_placeholder')}
+        aria-keyshortcuts={focusSearchAriaKey}
         placeholder={localize('com_nav_search_placeholder')}
         onKeyUp={handleKeyUp}
         onFocus={() => setSearchState((prev) => ({ ...prev, isSearching: true }))}
diff --git a/client/src/components/Nav/Settings.tsx b/client/src/components/Nav/Settings.tsx
index 4a2f1aacdfd..bde59fdb6d3 100644
--- a/client/src/components/Nav/Settings.tsx
+++ b/client/src/components/Nav/Settings.tsx
@@ -1,263 +1,6 @@
-import React, { useState, useRef } from 'react';
-import * as Tabs from '@radix-ui/react-tabs';
-import { SettingsTabValues } from 'librechat-data-provider';
-import { MessageSquare, Command, DollarSign } from 'lucide-react';
-import { Dialog, DialogPanel, DialogTitle, Transition, TransitionChild } from '@headlessui/react';
-import {
-  GearIcon,
-  DataIcon,
-  UserIcon,
-  SpeechIcon,
-  useMediaQuery,
-  PersonalizationIcon,
-} from '@librechat/client';
 import type { TDialogProps } from '~/common';
-import {
-  General,
-  Chat,
-  Commands,
-  Speech,
-  Personalization,
-  Data,
-  Balance,
-  Account,
-} from './SettingsTabs';
-import usePersonalizationAccess from '~/hooks/usePersonalizationAccess';
-import { useLocalize, TranslationKeys } from '~/hooks';
-import { useGetStartupConfig } from '~/data-provider';
-import { cn } from '~/utils';
+import { SettingsDialog } from './Settings/index';
 
-export default function Settings({ open, onOpenChange }: TDialogProps) {
-  const isSmallScreen = useMediaQuery('(max-width: 767px)');
-  const { data: startupConfig } = useGetStartupConfig();
-  const localize = useLocalize();
-  const [activeTab, setActiveTab] = useState(SettingsTabValues.GENERAL);
-  const tabRefs = useRef({});
-  const { hasAnyPersonalizationFeature, hasMemoryOptOut } = usePersonalizationAccess();
-
-  const handleKeyDown = (event: React.KeyboardEvent) => {
-    const tabs: SettingsTabValues[] = [
-      SettingsTabValues.GENERAL,
-      SettingsTabValues.CHAT,
-      SettingsTabValues.COMMANDS,
-      SettingsTabValues.SPEECH,
-      ...(hasAnyPersonalizationFeature ? [SettingsTabValues.PERSONALIZATION] : []),
-      SettingsTabValues.DATA,
-      ...(startupConfig?.balance?.enabled ? [SettingsTabValues.BALANCE] : []),
-      SettingsTabValues.ACCOUNT,
-    ];
-    const currentIndex = tabs.indexOf(activeTab);
-
-    switch (event.key) {
-      case 'ArrowDown':
-        event.preventDefault();
-        setActiveTab(tabs[(currentIndex + 1) % tabs.length]);
-        break;
-      case 'ArrowUp':
-        event.preventDefault();
-        setActiveTab(tabs[(currentIndex - 1 + tabs.length) % tabs.length]);
-        break;
-      case 'Home':
-        event.preventDefault();
-        setActiveTab(tabs[0]);
-        break;
-      case 'End':
-        event.preventDefault();
-        setActiveTab(tabs[tabs.length - 1]);
-        break;
-    }
-  };
-
-  const settingsTabs: {
-    value: SettingsTabValues;
-    icon: React.JSX.Element;
-    label: TranslationKeys;
-  }[] = [
-    {
-      value: SettingsTabValues.GENERAL,
-      icon: <GearIcon />,
-      label: 'com_nav_setting_general',
-    },
-    {
-      value: SettingsTabValues.CHAT,
-      icon: <MessageSquare className="icon-sm" aria-hidden="true" />,
-      label: 'com_nav_setting_chat',
-    },
-    {
-      value: SettingsTabValues.COMMANDS,
-      icon: <Command className="icon-sm" aria-hidden="true" />,
-      label: 'com_nav_commands',
-    },
-    {
-      value: SettingsTabValues.SPEECH,
-      icon: <SpeechIcon className="icon-sm" aria-hidden="true" />,
-      label: 'com_nav_setting_speech',
-    },
-    ...(hasAnyPersonalizationFeature
-      ? [
-          {
-            value: SettingsTabValues.PERSONALIZATION,
-            icon: <PersonalizationIcon />,
-            label: 'com_nav_setting_personalization' as TranslationKeys,
-          },
-        ]
-      : []),
-    {
-      value: SettingsTabValues.DATA,
-      icon: <DataIcon />,
-      label: 'com_nav_setting_data',
-    },
-    ...(startupConfig?.balance?.enabled
-      ? [
-          {
-            value: SettingsTabValues.BALANCE,
-            icon: <DollarSign size={18} />,
-            label: 'com_nav_setting_balance' as TranslationKeys,
-          },
-        ]
-      : ([] as { value: SettingsTabValues; icon: React.JSX.Element; label: TranslationKeys }[])),
-    {
-      value: SettingsTabValues.ACCOUNT,
-      icon: <UserIcon />,
-      label: 'com_nav_setting_account',
-    },
-  ];
-
-  const handleTabChange = (value: string) => {
-    setActiveTab(value as SettingsTabValues);
-  };
-
-  return (
-    <Transition appear show={open}>
-      <Dialog as="div" className="relative z-50" onClose={onOpenChange}>
-        <TransitionChild
-          enter="ease-out duration-200"
-          enterFrom="opacity-0"
-          enterTo="opacity-100"
-          leave="ease-in duration-200"
-          leaveFrom="opacity-100"
-          leaveTo="opacity-0"
-        >
-          <div className="fixed inset-0 bg-black opacity-50 dark:opacity-80" aria-hidden="true" />
-        </TransitionChild>
-
-        <TransitionChild
-          enter="ease-out duration-200"
-          enterFrom="opacity-0 scale-95"
-          enterTo="opacity-100 scale-100"
-          leave="ease-in duration-100"
-          leaveFrom="opacity-100 scale-100"
-          leaveTo="opacity-0 scale-95"
-        >
-          <div className={cn('fixed inset-0 flex w-screen items-center justify-center p-4')}>
-            <DialogPanel
-              className={cn(
-                'max-h-[90vh] overflow-hidden rounded-xl rounded-b-lg bg-background pb-6 shadow-2xl backdrop-blur-2xl animate-in sm:rounded-2xl md:w-[680px]',
-              )}
-            >
-              <DialogTitle
-                className="mb-1 flex items-center justify-between p-6 pb-5 text-left"
-                as="div"
-              >
-                <h2 className="text-lg font-medium leading-6 text-text-primary">
-                  {localize('com_nav_settings')}
-                </h2>
-                <button
-                  type="button"
-                  className="rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-border-xheavy focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-surface-primary dark:focus:ring-offset-surface-primary"
-                  onClick={() => onOpenChange(false)}
-                >
-                  <svg
-                    xmlns="http://www.w3.org/2000/svg"
-                    width="24"
-                    height="24"
-                    viewBox="0 0 24 24"
-                    fill="none"
-                    stroke="currentColor"
-                    strokeWidth="2"
-                    strokeLinecap="round"
-                    strokeLinejoin="round"
-                    className="h-5 w-5 text-text-primary"
-                  >
-                    <line x1="18" x2="6" y1="6" y2="18"></line>
-                    <line x1="6" x2="18" y1="6" y2="18"></line>
-                  </svg>
-                  <span className="sr-only">{localize('com_ui_close_settings')}</span>
-                </button>
-              </DialogTitle>
-              <div className="max-h-[calc(90vh-120px)] overflow-auto px-6 md:w-[680px]">
-                <Tabs.Root
-                  value={activeTab}
-                  onValueChange={handleTabChange}
-                  className="flex flex-col gap-10 md:flex-row"
-                  orientation="vertical"
-                >
-                  <Tabs.List
-                    aria-label="Settings"
-                    className={cn(
-                      'min-w-auto max-w-auto relative -ml-[8px] flex flex-shrink-0 flex-col flex-nowrap overflow-auto sm:max-w-none',
-                      isSmallScreen
-                        ? 'flex-row rounded-xl bg-surface-secondary'
-                        : 'sticky top-0 h-full',
-                    )}
-                    onKeyDown={handleKeyDown}
-                  >
-                    {settingsTabs.map(({ value, icon, label }) => (
-                      <Tabs.Trigger
-                        key={value}
-                        className={cn(
-                          'group relative z-10 m-1 flex items-center justify-start gap-2 rounded-xl px-2 py-1.5 transition-all duration-200 ease-in-out',
-                          isSmallScreen
-                            ? 'flex-1 justify-center text-nowrap p-1 px-3 text-sm text-text-secondary radix-state-active:bg-surface-hover radix-state-active:text-text-primary'
-                            : 'bg-transparent text-text-secondary radix-state-active:bg-surface-tertiary radix-state-active:text-text-primary',
-                        )}
-                        value={value}
-                        ref={(el) => (tabRefs.current[value] = el)}
-                      >
-                        {icon}
-                        {localize(label)}
-                      </Tabs.Trigger>
-                    ))}
-                  </Tabs.List>
-                  <div className="overflow-auto sm:w-full sm:max-w-none md:pr-0.5 md:pt-0.5">
-                    <Tabs.Content value={SettingsTabValues.GENERAL} tabIndex={-1}>
-                      <General />
-                    </Tabs.Content>
-                    <Tabs.Content value={SettingsTabValues.CHAT} tabIndex={-1}>
-                      <Chat />
-                    </Tabs.Content>
-                    <Tabs.Content value={SettingsTabValues.COMMANDS} tabIndex={-1}>
-                      <Commands />
-                    </Tabs.Content>
-                    <Tabs.Content value={SettingsTabValues.SPEECH} tabIndex={-1}>
-                      <Speech />
-                    </Tabs.Content>
-                    {hasAnyPersonalizationFeature && (
-                      <Tabs.Content value={SettingsTabValues.PERSONALIZATION} tabIndex={-1}>
-                        <Personalization
-                          hasMemoryOptOut={hasMemoryOptOut}
-                          hasAnyPersonalizationFeature={hasAnyPersonalizationFeature}
-                        />
-                      </Tabs.Content>
-                    )}
-                    <Tabs.Content value={SettingsTabValues.DATA} tabIndex={-1}>
-                      <Data />
-                    </Tabs.Content>
-                    {startupConfig?.balance?.enabled && (
-                      <Tabs.Content value={SettingsTabValues.BALANCE} tabIndex={-1}>
-                        <Balance />
-                      </Tabs.Content>
-                    )}
-                    <Tabs.Content value={SettingsTabValues.ACCOUNT} tabIndex={-1}>
-                      <Account />
-                    </Tabs.Content>
-                  </div>
-                </Tabs.Root>
-              </div>
-            </DialogPanel>
-          </div>
-        </TransitionChild>
-      </Dialog>
-    </Transition>
-  );
+export default function Settings(props: TDialogProps) {
+  return <SettingsDialog {...props} />;
 }
diff --git a/client/src/components/Nav/Settings/BillingControls.tsx b/client/src/components/Nav/Settings/BillingControls.tsx
new file mode 100644
index 00000000000..91c835d9074
--- /dev/null
+++ b/client/src/components/Nav/Settings/BillingControls.tsx
@@ -0,0 +1,61 @@
+import type { TBalanceResponse } from 'librechat-data-provider';
+import AutoRefillSettings from '../SettingsTabs/Balance/AutoRefillSettings';
+import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
+import TokenCreditsItem from '../SettingsTabs/Balance/TokenCreditsItem';
+import { useAuthContext, useLocalize } from '~/hooks';
+
+function useBalance(): Partial<TBalanceResponse> {
+  const { isAuthenticated } = useAuthContext();
+  const { data: startupConfig } = useGetStartupConfig();
+
+  const balanceQuery = useGetUserBalance({
+    enabled: !!isAuthenticated && !!startupConfig?.balance?.enabled,
+  });
+
+  return balanceQuery.data ?? {};
+}
+
+export function TokenCredits() {
+  const { tokenCredits = 0 } = useBalance();
+  return <TokenCreditsItem tokenCredits={tokenCredits} />;
+}
+
+export function AutoRefill() {
+  const localize = useLocalize();
+  const {
+    autoRefillEnabled = false,
+    lastRefill,
+    refillAmount,
+    refillIntervalUnit,
+    refillIntervalValue,
+  } = useBalance();
+
+  const hasValidRefillSettings =
+    lastRefill !== undefined &&
+    refillAmount !== undefined &&
+    refillIntervalUnit !== undefined &&
+    refillIntervalValue !== undefined;
+
+  if (!autoRefillEnabled) {
+    return (
+      <div className="text-sm text-text-secondary">
+        {localize('com_nav_balance_auto_refill_disabled')}
+      </div>
+    );
+  }
+
+  if (!hasValidRefillSettings) {
+    return (
+      <div className="text-sm text-red-500">{localize('com_nav_balance_auto_refill_error')}</div>
+    );
+  }
+
+  return (
+    <AutoRefillSettings
+      lastRefill={lastRefill}
+      refillAmount={refillAmount}
+      refillIntervalUnit={refillIntervalUnit}
+      refillIntervalValue={refillIntervalValue}
+    />
+  );
+}
diff --git a/client/src/components/Nav/Settings/Content.tsx b/client/src/components/Nav/Settings/Content.tsx
new file mode 100644
index 00000000000..dd8bc2c7039
--- /dev/null
+++ b/client/src/components/Nav/Settings/Content.tsx
@@ -0,0 +1,81 @@
+import { useMemo } from 'react';
+import type { SettingsContextValue, SettingsTab, SettingEntry } from './types';
+import { filterSettings } from './search';
+import { useLocalize } from '~/hooks';
+import { registry } from './registry';
+import Section from './Section';
+import { TABS } from './types';
+
+interface ContentProps {
+  activeTab: SettingsTab;
+  query: string;
+  ctx: SettingsContextValue;
+}
+
+function visible(entry: SettingEntry, ctx: SettingsContextValue): boolean {
+  return !entry.show || entry.show(ctx);
+}
+
+export default function Content({ activeTab, query, ctx }: ContentProps) {
+  const localize = useLocalize();
+  const tab = TABS.find((t) => t.id === activeTab)!;
+
+  const results = useMemo(
+    () => (query.trim() ? filterSettings(registry, query, ctx, localize) : null),
+    [query, ctx, localize],
+  );
+
+  if (results !== null) {
+    return (
+      <div aria-label={localize('com_ui_settings_results_aria')} aria-live="polite">
+        {results.length === 0 ? (
+          <p className="p-2 text-sm text-text-secondary">
+            {localize('com_ui_settings_no_results')}
+          </p>
+        ) : (
+          <div className="divide-y divide-border-light overflow-hidden rounded-xl border border-border-light text-sm text-text-primary">
+            {results.map(({ entry, label }) => {
+              const Cmp = entry.Component;
+              const tabMeta = TABS.find((t) => t.id === entry.tab)!;
+              const sectionMeta = tabMeta.sections.find((s) => s.id === entry.section);
+              return (
+                <div key={entry.id} className="px-4 py-3">
+                  <div className="mb-1.5 text-xs text-text-tertiary">
+                    {localize(tabMeta.labelKey)} ›{' '}
+                    {sectionMeta ? localize(sectionMeta.labelKey) : label}
+                  </div>
+                  <Cmp />
+                </div>
+              );
+            })}
+          </div>
+        )}
+      </div>
+    );
+  }
+
+  return (
+    <div>
+      {tab.sections.map((section) => {
+        const entries = registry.filter(
+          (e) => e.tab === activeTab && e.section === section.id && visible(e, ctx),
+        );
+        if (entries.length === 0) {
+          return null;
+        }
+        return (
+          <Section key={section.id} heading={localize(section.labelKey)} danger={section.danger}>
+            {entries.map((e) => {
+              const Cmp = e.Component;
+              return (
+                <div key={e.id} className="px-4 py-3">
+                  <Cmp />
+                </div>
+              );
+            })}
+          </Section>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/Settings/Dialog.tsx b/client/src/components/Nav/Settings/Dialog.tsx
new file mode 100644
index 00000000000..fa2f2dd4133
--- /dev/null
+++ b/client/src/components/Nav/Settings/Dialog.tsx
@@ -0,0 +1,138 @@
+import { useState } from 'react';
+import * as Tabs from '@radix-ui/react-tabs';
+import { X, ChevronLeft } from 'lucide-react';
+import { useMediaQuery } from '@librechat/client';
+import { SettingsTabValues } from 'librechat-data-provider';
+import { Dialog, DialogPanel, DialogTitle, Transition, TransitionChild } from '@headlessui/react';
+import type { TDialogProps } from '~/common';
+import type { SettingsTab } from './types';
+import { useSettingsContext } from './context';
+import { useLocalize } from '~/hooks';
+import Sidebar from './Sidebar';
+import Content from './Content';
+import { TABS } from './types';
+import { cn } from '~/utils';
+
+export default function SettingsDialog({ open, onOpenChange }: TDialogProps) {
+  const localize = useLocalize();
+  const ctx = useSettingsContext();
+  const isSmallScreen = useMediaQuery('(max-width: 767px)');
+  const [activeTab, setActiveTab] = useState<SettingsTab>(SettingsTabValues.GENERAL);
+  const [query, setQuery] = useState('');
+  const [mobileDetail, setMobileDetail] = useState(false);
+
+  const searching = query.trim().length > 0;
+  const inDetail = isSmallScreen && mobileDetail && !searching;
+  const showSidebar = !isSmallScreen || !inDetail;
+  const showContent = !isSmallScreen || inDetail || searching;
+  const hideTabs = isSmallScreen && searching;
+  const visibleTabs = TABS.filter((t) => !t.show || t.show(ctx));
+  const effectiveTab = visibleTabs.some((t) => t.id === activeTab)
+    ? activeTab
+    : SettingsTabValues.GENERAL;
+  const activeMeta = TABS.find((t) => t.id === effectiveTab);
+
+  const selectTab = (tab: SettingsTab) => {
+    setActiveTab(tab);
+    if (isSmallScreen) {
+      setMobileDetail(true);
+    }
+  };
+
+  return (
+    <Transition appear show={open}>
+      <Dialog as="div" className="relative z-50" onClose={() => onOpenChange(false)}>
+        <TransitionChild
+          enter="ease-out duration-200"
+          enterFrom="opacity-0"
+          enterTo="opacity-100"
+          leave="ease-in duration-200"
+          leaveFrom="opacity-100"
+          leaveTo="opacity-0"
+        >
+          <div className="fixed inset-0 bg-black opacity-50 dark:opacity-80" aria-hidden="true" />
+        </TransitionChild>
+        <TransitionChild
+          enter="ease-out duration-200"
+          enterFrom="opacity-0 scale-95"
+          enterTo="opacity-100 scale-100"
+          leave="ease-in duration-100"
+          leaveFrom="opacity-100 scale-100"
+          leaveTo="opacity-0 scale-95"
+        >
+          <div className="fixed inset-0 flex w-screen items-center justify-center p-4">
+            <DialogPanel
+              className={cn(
+                'flex max-h-[85vh] w-full flex-col overflow-hidden rounded-2xl bg-background shadow-2xl',
+                'md:h-[85vh] md:w-[900px]',
+              )}
+            >
+              <DialogTitle
+                as="div"
+                className="flex items-center justify-between border-b border-border-light p-5"
+              >
+                {inDetail ? (
+                  <button
+                    type="button"
+                    onClick={() => setMobileDetail(false)}
+                    className="-ml-1 flex items-center gap-1 rounded-lg p-1 text-text-primary transition-colors hover:bg-surface-hover focus:outline-none focus:ring-2 focus:ring-border-xheavy"
+                    aria-label={localize('com_ui_back')}
+                  >
+                    <ChevronLeft className="h-5 w-5" aria-hidden="true" />
+                    <span className="text-lg font-medium">
+                      {activeMeta ? localize(activeMeta.labelKey) : localize('com_nav_settings')}
+                    </span>
+                  </button>
+                ) : (
+                  <h2 className="text-lg font-medium text-text-primary">
+                    {localize('com_nav_settings')}
+                  </h2>
+                )}
+                <button
+                  type="button"
+                  onClick={() => onOpenChange(false)}
+                  className="rounded-lg p-1 text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus:outline-none focus:ring-2 focus:ring-border-xheavy"
+                >
+                  <X className="h-5 w-5" aria-hidden="true" />
+                  <span className="sr-only">{localize('com_ui_close_settings')}</span>
+                </button>
+              </DialogTitle>
+              <Tabs.Root
+                value={effectiveTab}
+                onValueChange={(v) => setActiveTab(v as SettingsTab)}
+                orientation="vertical"
+                className="flex flex-1 flex-col gap-4 overflow-hidden p-5 md:flex-row md:gap-6"
+              >
+                {showSidebar && (
+                  <Sidebar
+                    ctx={ctx}
+                    query={query}
+                    onQueryChange={setQuery}
+                    onSelectTab={selectTab}
+                    showChevron={isSmallScreen}
+                    hideTabs={hideTabs}
+                  />
+                )}
+                {showContent && (
+                  <div className="flex-1 overflow-y-auto md:pr-1">
+                    {searching ? (
+                      <Content activeTab={effectiveTab} query={query} ctx={ctx} />
+                    ) : (
+                      <Tabs.Content
+                        value={effectiveTab}
+                        tabIndex={-1}
+                        className="focus:outline-none"
+                      >
+                        <Content activeTab={effectiveTab} query={query} ctx={ctx} />
+                      </Tabs.Content>
+                    )}
+                  </div>
+                )}
+              </Tabs.Root>
+            </DialogPanel>
+          </div>
+        </TransitionChild>
+      </Dialog>
+    </Transition>
+  );
+}
diff --git a/client/src/components/Nav/Settings/MemoryToggle.tsx b/client/src/components/Nav/Settings/MemoryToggle.tsx
new file mode 100644
index 00000000000..5e3a5cab128
--- /dev/null
+++ b/client/src/components/Nav/Settings/MemoryToggle.tsx
@@ -0,0 +1,49 @@
+import { useState, useEffect } from 'react';
+import { Switch, useToastContext } from '@librechat/client';
+import { useGetUserQuery, useUpdateMemoryPreferencesMutation } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+
+export default function MemoryToggle() {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+  const { data: user } = useGetUserQuery();
+  const [referenceSavedMemories, setReferenceSavedMemories] = useState(true);
+
+  const mutation = useUpdateMemoryPreferencesMutation({
+    onSuccess: () =>
+      showToast({ message: localize('com_ui_preferences_updated'), status: 'success' }),
+    onError: () => {
+      showToast({ message: localize('com_ui_error_updating_preferences'), status: 'error' });
+      setReferenceSavedMemories((prev) => !prev);
+    },
+  });
+
+  useEffect(() => {
+    if (user?.personalization?.memories !== undefined) {
+      setReferenceSavedMemories(user.personalization.memories);
+    }
+  }, [user?.personalization?.memories]);
+
+  const onToggle = (checked: boolean) => {
+    setReferenceSavedMemories(checked);
+    mutation.mutate({ memories: checked });
+  };
+
+  return (
+    <div className="flex items-center justify-between">
+      <div>
+        <div id="reference-saved-memories-label">{localize('com_ui_reference_saved_memories')}</div>
+        <div id="reference-saved-memories-description" className="mt-1 text-xs text-text-secondary">
+          {localize('com_ui_reference_saved_memories_description')}
+        </div>
+      </div>
+      <Switch
+        checked={referenceSavedMemories}
+        onCheckedChange={onToggle}
+        disabled={mutation.isLoading}
+        aria-labelledby="reference-saved-memories-label"
+        aria-describedby="reference-saved-memories-description"
+      />
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/Settings/Section.tsx b/client/src/components/Nav/Settings/Section.tsx
new file mode 100644
index 00000000000..49c44db632f
--- /dev/null
+++ b/client/src/components/Nav/Settings/Section.tsx
@@ -0,0 +1,31 @@
+import type { ReactNode } from 'react';
+import { cn } from '~/utils';
+
+interface SectionProps {
+  heading: string;
+  danger?: boolean;
+  children: ReactNode;
+}
+
+export default function Section({ heading, danger, children }: SectionProps) {
+  return (
+    <section className="mb-7">
+      <h3
+        className={cn(
+          'mb-2 px-1 text-xs font-semibold uppercase tracking-wide',
+          danger ? 'text-red-500' : 'text-text-secondary',
+        )}
+      >
+        {heading}
+      </h3>
+      <div
+        className={cn(
+          'divide-y divide-border-light overflow-hidden rounded-xl border text-sm text-text-primary',
+          danger ? 'border-red-500/30' : 'border-border-light',
+        )}
+      >
+        {children}
+      </div>
+    </section>
+  );
+}
diff --git a/client/src/components/Nav/Settings/Sidebar.tsx b/client/src/components/Nav/Settings/Sidebar.tsx
new file mode 100644
index 00000000000..46334885217
--- /dev/null
+++ b/client/src/components/Nav/Settings/Sidebar.tsx
@@ -0,0 +1,92 @@
+import * as Tabs from '@radix-ui/react-tabs';
+import { Search, X, ChevronRight } from 'lucide-react';
+import type { SettingsContextValue, SettingsTab } from './types';
+import { useLocalize } from '~/hooks';
+import { TABS } from './types';
+import { cn } from '~/utils';
+
+interface SidebarProps {
+  ctx: SettingsContextValue;
+  query: string;
+  onQueryChange: (q: string) => void;
+  onSelectTab: (tab: SettingsTab) => void;
+  showChevron?: boolean;
+  hideTabs?: boolean;
+}
+
+export default function Sidebar({
+  ctx,
+  query,
+  onQueryChange,
+  onSelectTab,
+  showChevron = false,
+  hideTabs = false,
+}: SidebarProps) {
+  const localize = useLocalize();
+  const tabs = TABS.filter((t) => !t.show || t.show(ctx));
+
+  return (
+    <div className="flex w-full flex-col gap-3 md:w-[230px]">
+      <div className="relative">
+        <Search
+          className="pointer-events-none absolute left-2 top-1/2 h-4 w-4 -translate-y-1/2 text-text-tertiary"
+          aria-hidden="true"
+        />
+        <input
+          type="text"
+          value={query}
+          onChange={(e) => onQueryChange(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === 'Escape' && query.length > 0) {
+              e.preventDefault();
+              e.stopPropagation();
+              onQueryChange('');
+            }
+          }}
+          placeholder={localize('com_ui_settings_search_placeholder')}
+          aria-label={localize('com_ui_settings_search_placeholder')}
+          className="w-full rounded-lg bg-surface-secondary py-2 pl-8 pr-8 text-sm text-text-primary focus:outline-none focus:ring-2 focus:ring-border-xheavy"
+        />
+        {query.length > 0 && (
+          <button
+            type="button"
+            onClick={() => onQueryChange('')}
+            aria-label={localize('com_ui_clear_search')}
+            className="absolute right-1.5 top-1/2 -translate-y-1/2 rounded-md p-1 text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus:outline-none focus:ring-2 focus:ring-border-xheavy"
+          >
+            <X className="h-4 w-4" aria-hidden="true" />
+          </button>
+        )}
+      </div>
+      {!hideTabs && (
+        <Tabs.List
+          aria-label={localize('com_nav_settings')}
+          className="flex flex-col gap-1 overflow-visible"
+        >
+          {tabs.map((tab) => (
+            <Tabs.Trigger
+              key={tab.id}
+              value={tab.id}
+              onClick={() => onSelectTab(tab.id)}
+              className={cn(
+                'flex items-center justify-between gap-2 rounded-xl px-3 py-2.5 text-sm text-text-secondary transition-colors hover:bg-surface-hover md:py-2',
+                'radix-state-active:bg-surface-tertiary radix-state-active:text-text-primary',
+              )}
+            >
+              <span className="flex items-center gap-2">
+                {tab.icon}
+                <span className="whitespace-nowrap">{localize(tab.labelKey)}</span>
+              </span>
+              {showChevron && (
+                <ChevronRight
+                  className="h-4 w-4 flex-shrink-0 text-text-tertiary"
+                  aria-hidden="true"
+                />
+              )}
+            </Tabs.Trigger>
+          ))}
+        </Tabs.List>
+      )}
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/Settings/SpeechControls.tsx b/client/src/components/Nav/Settings/SpeechControls.tsx
new file mode 100644
index 00000000000..40818131530
--- /dev/null
+++ b/client/src/components/Nav/Settings/SpeechControls.tsx
@@ -0,0 +1,13 @@
+import { useGetCustomConfigSpeechQuery } from 'librechat-data-provider/react-query';
+import { EngineSTTDropdown } from '../SettingsTabs/Speech/STT';
+import { EngineTTSDropdown } from '../SettingsTabs/Speech/TTS';
+
+export function EngineSTTSetting() {
+  const { data } = useGetCustomConfigSpeechQuery();
+  return <EngineSTTDropdown external={Boolean(data?.sttExternal)} />;
+}
+
+export function EngineTTSSetting() {
+  const { data } = useGetCustomConfigSpeechQuery();
+  return <EngineTTSDropdown external={Boolean(data?.ttsExternal)} />;
+}
diff --git a/client/src/components/Nav/Settings/__tests__/Dialog.spec.tsx b/client/src/components/Nav/Settings/__tests__/Dialog.spec.tsx
new file mode 100644
index 00000000000..c2c7deefddb
--- /dev/null
+++ b/client/src/components/Nav/Settings/__tests__/Dialog.spec.tsx
@@ -0,0 +1,38 @@
+/* eslint-disable i18next/no-literal-string */
+import userEvent from '@testing-library/user-event';
+import { render, screen } from 'test/layout-test-utils';
+import { SettingsDialog } from '../index';
+
+jest.mock('../Content', () =>
+  jest.fn(({ query }: { activeTab: string; query: string; ctx: unknown }) =>
+    query.trim() ? (
+      <div aria-label="Search results" aria-live="polite" />
+    ) : (
+      <div>
+        <h3>Appearance</h3>
+      </div>
+    ),
+  ),
+);
+
+describe('SettingsDialog', () => {
+  it('renders the General tab by default with its sections', () => {
+    render(<SettingsDialog open onOpenChange={jest.fn()} />);
+    expect(screen.getByRole('heading', { name: /settings/i, level: 2 })).toBeInTheDocument();
+    expect(screen.getByText('Appearance')).toBeInTheDocument();
+  });
+
+  it('renders the active panel as a tabpanel wired to its trigger', () => {
+    render(<SettingsDialog open onOpenChange={jest.fn()} />);
+    const panel = screen.getByRole('tabpanel');
+    const trigger = screen.getByRole('tab', { selected: true });
+    expect(trigger).toHaveAttribute('aria-controls', panel.id);
+    expect(panel).toHaveAttribute('aria-labelledby', trigger.id);
+  });
+
+  it('switches to search results when typing a query', async () => {
+    render(<SettingsDialog open onOpenChange={jest.fn()} />);
+    await userEvent.type(screen.getByRole('textbox'), 'language');
+    expect(await screen.findByLabelText('Search results')).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx b/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx
new file mode 100644
index 00000000000..3cfb50e7d95
--- /dev/null
+++ b/client/src/components/Nav/Settings/__tests__/Sidebar.spec.tsx
@@ -0,0 +1,81 @@
+import * as Tabs from '@radix-ui/react-tabs';
+import userEvent from '@testing-library/user-event';
+import { SettingsTabValues } from 'librechat-data-provider';
+import type { SettingsContextValue } from '../types';
+import { render, screen } from 'test/layout-test-utils';
+import Sidebar from '../Sidebar';
+
+const ctx: SettingsContextValue = {
+  balanceEnabled: false,
+  hasAnyPersonalizationFeature: false,
+  hasMemoryOptOut: false,
+  hasRemoteAgents: false,
+  hasUserProvidedEndpoints: false,
+  hasMultiConvo: false,
+  hasPrompts: false,
+  isLocalProvider: true,
+  twoFactorEnabled: false,
+  allowAccountDeletion: true,
+  aboutEnabled: false,
+  engineTTS: 'browser',
+};
+
+function setup(extra: Partial<SettingsContextValue> = {}, query = '') {
+  const onQueryChange = jest.fn();
+  render(
+    <Tabs.Root value={SettingsTabValues.GENERAL}>
+      <Sidebar
+        ctx={{ ...ctx, ...extra }}
+        query={query}
+        onQueryChange={onQueryChange}
+        onSelectTab={jest.fn()}
+      />
+    </Tabs.Root>,
+  );
+  return { onQueryChange };
+}
+
+describe('Sidebar', () => {
+  it('hides the About tab when build info is disabled', () => {
+    setup();
+    expect(screen.queryByText('About')).not.toBeInTheDocument();
+  });
+
+  it('shows the About tab when build info is enabled', () => {
+    setup({ aboutEnabled: true });
+    expect(screen.getByText('About')).toBeInTheDocument();
+  });
+
+  it('forwards typing to onQueryChange', async () => {
+    const { onQueryChange } = setup();
+    await userEvent.type(screen.getByRole('textbox'), 'theme');
+    expect(onQueryChange).toHaveBeenCalled();
+  });
+
+  it('Escape clears search when query is non-empty', async () => {
+    const { onQueryChange } = setup({}, 'theme');
+    const input = screen.getByRole('textbox');
+    input.focus();
+    await userEvent.keyboard('{Escape}');
+    expect(onQueryChange).toHaveBeenCalledWith('');
+  });
+
+  it('Escape does not call onQueryChange when query is empty', async () => {
+    const { onQueryChange } = setup({}, '');
+    const input = screen.getByRole('textbox');
+    input.focus();
+    await userEvent.keyboard('{Escape}');
+    expect(onQueryChange).not.toHaveBeenCalled();
+  });
+
+  it('shows a clear button that clears the query when there is text', async () => {
+    const { onQueryChange } = setup({}, 'theme');
+    await userEvent.click(screen.getByRole('button', { name: /clear search/i }));
+    expect(onQueryChange).toHaveBeenCalledWith('');
+  });
+
+  it('hides the clear button when the query is empty', () => {
+    setup({}, '');
+    expect(screen.queryByRole('button', { name: /clear search/i })).not.toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Nav/Settings/__tests__/registry.spec.ts b/client/src/components/Nav/Settings/__tests__/registry.spec.ts
new file mode 100644
index 00000000000..46a57908e84
--- /dev/null
+++ b/client/src/components/Nav/Settings/__tests__/registry.spec.ts
@@ -0,0 +1,33 @@
+import { isValidElementType } from 'react-is';
+import en from '~/locales/en/translation.json';
+import { registry } from '../registry';
+import { TABS } from '../types';
+
+const validTabSections = new Map(TABS.map((t) => [t.id, new Set(t.sections.map((s) => s.id))]));
+
+describe('settings registry', () => {
+  it('has unique ids', () => {
+    const ids = registry.map((e) => e.id);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+
+  it('references a valid tab and section for every entry', () => {
+    for (const entry of registry) {
+      const sections = validTabSections.get(entry.tab);
+      expect(sections).toBeDefined();
+      expect(sections!.has(entry.section)).toBe(true);
+    }
+  });
+
+  it('uses label keys that exist in the English locale', () => {
+    for (const entry of registry) {
+      expect(en).toHaveProperty(entry.labelKey);
+    }
+  });
+
+  it('has a renderable Component for every entry', () => {
+    for (const entry of registry) {
+      expect(isValidElementType(entry.Component)).toBe(true);
+    }
+  });
+});
diff --git a/client/src/components/Nav/Settings/__tests__/search.spec.ts b/client/src/components/Nav/Settings/__tests__/search.spec.ts
new file mode 100644
index 00000000000..a3aaccefe39
--- /dev/null
+++ b/client/src/components/Nav/Settings/__tests__/search.spec.ts
@@ -0,0 +1,30 @@
+import { normalize, matchesQuery } from '../search';
+
+describe('normalize', () => {
+  it('lowercases and strips diacritics', () => {
+    expect(normalize('Café')).toBe('cafe');
+    expect(normalize('  Théme  ')).toBe('theme');
+  });
+});
+
+describe('matchesQuery', () => {
+  const haystack = { label: 'Theme', keywords: ['dark', 'light', 'appearance'] };
+
+  it('matches the label case-insensitively', () => {
+    expect(matchesQuery('the', haystack)).toBe(true);
+    expect(matchesQuery('THEME', haystack)).toBe(true);
+  });
+
+  it('matches a keyword synonym', () => {
+    expect(matchesQuery('dark', haystack)).toBe(true);
+  });
+
+  it('returns false when nothing matches', () => {
+    expect(matchesQuery('zzz', haystack)).toBe(false);
+  });
+
+  it('matches everything on empty query', () => {
+    expect(matchesQuery('', haystack)).toBe(true);
+    expect(matchesQuery('   ', haystack)).toBe(true);
+  });
+});
diff --git a/client/src/components/Nav/Settings/context.tsx b/client/src/components/Nav/Settings/context.tsx
new file mode 100644
index 00000000000..1126a9096d3
--- /dev/null
+++ b/client/src/components/Nav/Settings/context.tsx
@@ -0,0 +1,70 @@
+import { useMemo } from 'react';
+import { useRecoilValue } from 'recoil';
+import { PermissionTypes, Permissions } from 'librechat-data-provider';
+import type { SettingsContextValue } from './types';
+import useProviderKeys from '../SettingsTabs/ProviderKeys/useProviderKeys';
+import usePersonalizationAccess from '~/hooks/usePersonalizationAccess';
+import { useHasAccess, useAuthContext } from '~/hooks';
+import { useGetStartupConfig } from '~/data-provider';
+import store from '~/store';
+
+export function useSettingsContext(): SettingsContextValue {
+  const { user } = useAuthContext();
+  const { data: startupConfig } = useGetStartupConfig();
+  const { hasAnyPersonalizationFeature, hasMemoryOptOut } = usePersonalizationAccess();
+
+  const hasRemoteAgents = useHasAccess({
+    permissionType: PermissionTypes.REMOTE_AGENTS,
+    permission: Permissions.USE,
+  });
+  const hasMultiConvo = useHasAccess({
+    permissionType: PermissionTypes.MULTI_CONVO,
+    permission: Permissions.USE,
+  });
+  const hasPrompts = useHasAccess({
+    permissionType: PermissionTypes.PROMPTS,
+    permission: Permissions.USE,
+  });
+
+  const balanceEnabled = startupConfig?.balance?.enabled === true;
+  const isLocalProvider = user?.provider === 'local';
+  const twoFactorEnabled = user?.twoFactorEnabled === true;
+  const allowAccountDeletion = startupConfig?.allowAccountDeletion !== false;
+  const aboutEnabled = startupConfig?.interface?.buildInfo !== false;
+  const hasRemoteAgentsBool = hasRemoteAgents === true;
+  const hasMultiConvoBool = hasMultiConvo === true;
+  const hasPromptsBool = hasPrompts === true;
+  const engineTTS = useRecoilValue<string>(store.engineTTS);
+  const hasUserProvidedEndpoints = useProviderKeys().length > 0;
+
+  return useMemo(
+    () => ({
+      balanceEnabled,
+      hasAnyPersonalizationFeature,
+      hasMemoryOptOut,
+      hasRemoteAgents: hasRemoteAgentsBool,
+      hasUserProvidedEndpoints,
+      hasMultiConvo: hasMultiConvoBool,
+      hasPrompts: hasPromptsBool,
+      isLocalProvider,
+      twoFactorEnabled,
+      allowAccountDeletion,
+      aboutEnabled,
+      engineTTS,
+    }),
+    [
+      balanceEnabled,
+      hasAnyPersonalizationFeature,
+      hasMemoryOptOut,
+      hasRemoteAgentsBool,
+      hasUserProvidedEndpoints,
+      hasMultiConvoBool,
+      hasPromptsBool,
+      isLocalProvider,
+      twoFactorEnabled,
+      allowAccountDeletion,
+      aboutEnabled,
+      engineTTS,
+    ],
+  );
+}
diff --git a/client/src/components/Nav/Settings/controls.tsx b/client/src/components/Nav/Settings/controls.tsx
new file mode 100644
index 00000000000..55d0d384127
--- /dev/null
+++ b/client/src/components/Nav/Settings/controls.tsx
@@ -0,0 +1,50 @@
+import { useContext, useCallback } from 'react';
+import Cookies from 'js-cookie';
+import { useRecoilState } from 'recoil';
+import { ThemeContext } from '@librechat/client';
+import type { ComponentType } from 'react';
+import type { TranslationKeys } from '~/hooks';
+import { ThemeSelector, LangSelector } from '../SettingsTabs/General/Selectors';
+import ToggleSwitch from '../SettingsTabs/ToggleSwitch';
+import store from '~/store';
+
+export function toggleControl(opts: {
+  stateAtom: Parameters<typeof ToggleSwitch>[0]['stateAtom'];
+  localizationKey: TranslationKeys;
+  switchId: string;
+  hoverCardText?: TranslationKeys;
+}): ComponentType {
+  const Control = () => (
+    <ToggleSwitch
+      stateAtom={opts.stateAtom}
+      localizationKey={opts.localizationKey}
+      switchId={opts.switchId}
+      hoverCardText={opts.hoverCardText}
+    />
+  );
+  Control.displayName = `Toggle(${opts.switchId})`;
+  return Control;
+}
+
+export function ThemeSetting() {
+  const { theme, setTheme } = useContext(ThemeContext);
+  const onChange = useCallback((value: string) => setTheme(value), [setTheme]);
+  return <ThemeSelector theme={theme} onChange={onChange} />;
+}
+
+export function LangSetting() {
+  const [langcode, setLangcode] = useRecoilState(store.lang);
+  const onChange = useCallback(
+    (value: string) => {
+      const userLang =
+        value === 'auto' ? navigator.language || navigator.languages?.[0] || 'en-US' : value;
+      requestAnimationFrame(() => {
+        document.documentElement.lang = userLang;
+      });
+      setLangcode(userLang);
+      Cookies.set('lang', userLang, { expires: 365 });
+    },
+    [setLangcode],
+  );
+  return <LangSelector langcode={langcode} onChange={onChange} />;
+}
diff --git a/client/src/components/Nav/Settings/index.ts b/client/src/components/Nav/Settings/index.ts
new file mode 100644
index 00000000000..c5d441a8d3d
--- /dev/null
+++ b/client/src/components/Nav/Settings/index.ts
@@ -0,0 +1 @@
+export { default as SettingsDialog } from './Dialog';
diff --git a/client/src/components/Nav/Settings/registry.tsx b/client/src/components/Nav/Settings/registry.tsx
new file mode 100644
index 00000000000..a2682963ab6
--- /dev/null
+++ b/client/src/components/Nav/Settings/registry.tsx
@@ -0,0 +1,572 @@
+import { SettingsTabValues } from 'librechat-data-provider';
+import type { SettingEntry } from './types';
+import {
+  TextToSpeechSwitch,
+  VoiceDropdown,
+  CacheTTSSwitch,
+  AutomaticPlaybackSwitch,
+  CloudBrowserVoicesSwitch,
+  PlaybackRate,
+} from '../SettingsTabs/Speech/TTS';
+import {
+  SpeechToTextSwitch,
+  LanguageSTTDropdown,
+  AutoTranscribeAudioSwitch,
+  AutoSendTextSelector,
+  DecibelSelector,
+} from '../SettingsTabs/Speech/STT';
+import DisplayUsernameMessages from '../SettingsTabs/Account/DisplayUsernameMessages';
+import ConversationModeSwitch from '../SettingsTabs/Speech/ConversationModeSwitch';
+import EnableTwoFactorItem from '../SettingsTabs/Account/TwoFactorAuthentication';
+import ImportConversations from '../SettingsTabs/Data/ImportConversations';
+import { toggleControl, ThemeSetting, LangSetting } from './controls';
+import BackupCodesItem from '../SettingsTabs/Account/BackupCodesItem';
+import { EngineSTTSetting, EngineTTSSetting } from './SpeechControls';
+import FontSizeSelector from '../SettingsTabs/Chat/FontSizeSelector';
+import AdvancedPrompts from '../SettingsTabs/Chat/AdvancedPrompts';
+import DeleteAccount from '../SettingsTabs/Account/DeleteAccount';
+import { ForkSettings } from '../SettingsTabs/Chat/ForkSettings';
+import ChatDirection from '../SettingsTabs/Chat/ChatDirection';
+import { DeleteCache } from '../SettingsTabs/Data/DeleteCache';
+import { RevokeKeys } from '../SettingsTabs/Data/RevokeKeys';
+import { ClearChats } from '../SettingsTabs/Data/ClearChats';
+import { TokenCredits, AutoRefill } from './BillingControls';
+import SharedLinks from '../SettingsTabs/Data/SharedLinks';
+import { showThinkingAtom } from '~/store/showThinking';
+import ProviderKeys from '../SettingsTabs/ProviderKeys';
+import Avatar from '../SettingsTabs/Account/Avatar';
+import About from '../SettingsTabs/About/About';
+import ApiKeys from '../SettingsTabs/ApiKeys';
+import MemoryToggle from './MemoryToggle';
+import { TTSEndpoints } from '~/common';
+import store from '~/store';
+
+const { GENERAL, CHAT, SPEECH, DATA, ACCOUNT, ABOUT } = SettingsTabValues;
+
+export const registry: SettingEntry[] = [
+  // General · Appearance
+  {
+    id: 'theme',
+    tab: GENERAL,
+    section: 'appearance',
+    labelKey: 'com_nav_theme',
+    keywords: ['dark', 'light', 'appearance', 'color'],
+    Component: ThemeSetting,
+  },
+  {
+    id: 'language',
+    tab: GENERAL,
+    section: 'appearance',
+    labelKey: 'com_nav_language',
+    keywords: ['locale', 'translation'],
+    Component: LangSetting,
+  },
+  {
+    id: 'fontSize',
+    tab: GENERAL,
+    section: 'appearance',
+    labelKey: 'com_nav_font_size',
+    keywords: ['text', 'zoom'],
+    Component: FontSizeSelector,
+  },
+  {
+    id: 'chatDirection',
+    tab: GENERAL,
+    section: 'appearance',
+    labelKey: 'com_nav_chat_direction',
+    keywords: ['rtl', 'ltr'],
+    Component: ChatDirection,
+  },
+  // General · Layout
+  {
+    id: 'maximizeChatSpace',
+    tab: GENERAL,
+    section: 'layout',
+    labelKey: 'com_nav_maximize_chat_space',
+    Component: toggleControl({
+      stateAtom: store.maximizeChatSpace,
+      localizationKey: 'com_nav_maximize_chat_space',
+      switchId: 'maximizeChatSpace',
+    }),
+  },
+  {
+    id: 'centerFormOnLanding',
+    tab: GENERAL,
+    section: 'layout',
+    labelKey: 'com_nav_center_chat_input',
+    Component: toggleControl({
+      stateAtom: store.centerFormOnLanding,
+      localizationKey: 'com_nav_center_chat_input',
+      switchId: 'centerFormOnLanding',
+    }),
+  },
+  {
+    id: 'showScrollButton',
+    tab: GENERAL,
+    section: 'layout',
+    labelKey: 'com_nav_scroll_button',
+    Component: toggleControl({
+      stateAtom: store.showScrollButton,
+      localizationKey: 'com_nav_scroll_button',
+      switchId: 'showScrollButton',
+    }),
+  },
+  // General · Accessibility
+  {
+    id: 'keepScreenAwake',
+    tab: GENERAL,
+    section: 'accessibility',
+    labelKey: 'com_nav_keep_screen_awake',
+    Component: toggleControl({
+      stateAtom: store.keepScreenAwake,
+      localizationKey: 'com_nav_keep_screen_awake',
+      switchId: 'keepScreenAwake',
+    }),
+  },
+
+  // Chat · Sending
+  {
+    id: 'enterToSend',
+    tab: CHAT,
+    section: 'sending',
+    labelKey: 'com_nav_enter_to_send',
+    keywords: ['return', 'newline'],
+    Component: toggleControl({
+      stateAtom: store.enterToSend,
+      localizationKey: 'com_nav_enter_to_send',
+      switchId: 'enterToSend',
+      hoverCardText: 'com_nav_info_enter_to_send',
+    }),
+  },
+  {
+    id: 'saveDrafts',
+    tab: CHAT,
+    section: 'sending',
+    labelKey: 'com_nav_save_drafts',
+    Component: toggleControl({
+      stateAtom: store.saveDrafts,
+      localizationKey: 'com_nav_save_drafts',
+      switchId: 'saveDrafts',
+      hoverCardText: 'com_nav_info_save_draft',
+    }),
+  },
+  {
+    id: 'saveBadgesState',
+    tab: CHAT,
+    section: 'sending',
+    labelKey: 'com_nav_save_badges_state',
+    Component: toggleControl({
+      stateAtom: store.saveBadgesState,
+      localizationKey: 'com_nav_save_badges_state',
+      switchId: 'showBadges',
+      hoverCardText: 'com_nav_info_save_badges_state',
+    }),
+  },
+  // Chat · Commands
+  {
+    id: 'atCommand',
+    tab: CHAT,
+    section: 'commands',
+    labelKey: 'com_nav_at_command_description',
+    Component: toggleControl({
+      stateAtom: store.atCommand,
+      localizationKey: 'com_nav_at_command_description',
+      switchId: 'atCommand',
+    }),
+  },
+  {
+    id: 'plusCommand',
+    tab: CHAT,
+    section: 'commands',
+    labelKey: 'com_nav_plus_command_description',
+    show: (ctx) => ctx.hasMultiConvo,
+    Component: toggleControl({
+      stateAtom: store.plusCommand,
+      localizationKey: 'com_nav_plus_command_description',
+      switchId: 'plusCommand',
+    }),
+  },
+  {
+    id: 'slashCommand',
+    tab: CHAT,
+    section: 'commands',
+    labelKey: 'com_nav_slash_command_description',
+    show: (ctx) => ctx.hasPrompts,
+    Component: toggleControl({
+      stateAtom: store.slashCommand,
+      localizationKey: 'com_nav_slash_command_description',
+      switchId: 'slashCommand',
+    }),
+  },
+  // Chat · Messages
+  {
+    id: 'enableUserMsgMarkdown',
+    tab: CHAT,
+    section: 'messages',
+    labelKey: 'com_nav_user_msg_markdown',
+    Component: toggleControl({
+      stateAtom: store.enableUserMsgMarkdown,
+      localizationKey: 'com_nav_user_msg_markdown',
+      switchId: 'enableUserMsgMarkdown',
+    }),
+  },
+  {
+    id: 'usernameDisplay',
+    tab: CHAT,
+    section: 'messages',
+    labelKey: 'com_nav_user_name_display',
+    keywords: ['username', 'name'],
+    Component: DisplayUsernameMessages,
+  },
+  {
+    id: 'latexParsing',
+    tab: CHAT,
+    section: 'messages',
+    labelKey: 'com_nav_latex_parsing',
+    Component: toggleControl({
+      stateAtom: store.LaTeXParsing,
+      localizationKey: 'com_nav_latex_parsing',
+      switchId: 'latexParsing',
+      hoverCardText: 'com_nav_info_latex_parsing',
+    }),
+  },
+  {
+    id: 'showThinking',
+    tab: CHAT,
+    section: 'messages',
+    labelKey: 'com_nav_show_thinking',
+    Component: toggleControl({
+      stateAtom: showThinkingAtom,
+      localizationKey: 'com_nav_show_thinking',
+      switchId: 'showThinking',
+    }),
+  },
+  {
+    id: 'autoExpandTools',
+    tab: CHAT,
+    section: 'messages',
+    labelKey: 'com_nav_auto_expand_tools',
+    Component: toggleControl({
+      stateAtom: store.autoExpandTools,
+      localizationKey: 'com_nav_auto_expand_tools',
+      switchId: 'autoExpandTools',
+    }),
+  },
+  // Chat · Conversations
+  {
+    id: 'newChatSwitchToHistory',
+    tab: CHAT,
+    section: 'conversations',
+    labelKey: 'com_nav_new_chat_switch_to_history',
+    Component: toggleControl({
+      stateAtom: store.newChatSwitchToHistory,
+      localizationKey: 'com_nav_new_chat_switch_to_history',
+      switchId: 'newChatSwitchToHistory',
+    }),
+  },
+  {
+    id: 'autoScroll',
+    tab: CHAT,
+    section: 'conversations',
+    labelKey: 'com_nav_auto_scroll',
+    Component: toggleControl({
+      stateAtom: store.autoScroll,
+      localizationKey: 'com_nav_auto_scroll',
+      switchId: 'autoScroll',
+    }),
+  },
+  {
+    id: 'modularChat',
+    tab: CHAT,
+    section: 'conversations',
+    labelKey: 'com_nav_modular_chat',
+    Component: toggleControl({
+      stateAtom: store.modularChat,
+      localizationKey: 'com_nav_modular_chat',
+      switchId: 'modularChat',
+    }),
+  },
+  {
+    id: 'defaultTemporaryChat',
+    tab: CHAT,
+    section: 'conversations',
+    labelKey: 'com_nav_default_temporary_chat',
+    Component: toggleControl({
+      stateAtom: store.defaultTemporaryChat,
+      localizationKey: 'com_nav_default_temporary_chat',
+      switchId: 'defaultTemporaryChat',
+      hoverCardText: 'com_nav_info_default_temporary_chat',
+    }),
+  },
+  {
+    id: 'forkSettings',
+    tab: CHAT,
+    section: 'conversations',
+    labelKey: 'com_ui_fork_default',
+    keywords: ['fork', 'branch', 'split'],
+    Component: ForkSettings,
+  },
+  // Chat · Prompts
+  {
+    id: 'advancedPrompts',
+    tab: CHAT,
+    section: 'prompts',
+    labelKey: 'com_nav_advanced_prompts',
+    keywords: ['prompt'],
+    Component: AdvancedPrompts,
+  },
+  {
+    id: 'alwaysMakeProd',
+    tab: CHAT,
+    section: 'prompts',
+    labelKey: 'com_nav_always_make_prod',
+    Component: toggleControl({
+      stateAtom: store.alwaysMakeProd,
+      localizationKey: 'com_nav_always_make_prod',
+      switchId: 'alwaysMakeProd',
+    }),
+  },
+  {
+    id: 'autoSendPrompts',
+    tab: CHAT,
+    section: 'prompts',
+    labelKey: 'com_nav_auto_send_prompts',
+    Component: toggleControl({
+      stateAtom: store.autoSendPrompts,
+      localizationKey: 'com_nav_auto_send_prompts',
+      switchId: 'autoSendPrompts',
+      hoverCardText: 'com_nav_auto_send_prompts_desc',
+    }),
+  },
+
+  // Speech · Speech-to-text
+  {
+    id: 'speechToText',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_nav_speech_to_text',
+    Component: SpeechToTextSwitch,
+  },
+  {
+    id: 'engineSTT',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_ui_settings_label_engine_stt',
+    Component: EngineSTTSetting,
+  },
+  {
+    id: 'languageSTT',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_ui_settings_label_language_stt',
+    Component: LanguageSTTDropdown,
+  },
+  {
+    id: 'autoTranscribeAudio',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_nav_auto_transcribe_audio',
+    Component: AutoTranscribeAudioSwitch,
+  },
+  {
+    id: 'decibelValue',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_ui_settings_label_decibel',
+    Component: DecibelSelector,
+  },
+  {
+    id: 'autoSendText',
+    tab: SPEECH,
+    section: 'stt',
+    labelKey: 'com_nav_auto_send_text',
+    Component: AutoSendTextSelector,
+  },
+  // Speech · Text-to-speech
+  {
+    id: 'textToSpeech',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_nav_text_to_speech',
+    Component: TextToSpeechSwitch,
+  },
+  {
+    id: 'engineTTS',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_ui_settings_label_engine_tts',
+    Component: EngineTTSSetting,
+  },
+  {
+    id: 'voice',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_ui_settings_label_voice',
+    Component: VoiceDropdown,
+  },
+  {
+    id: 'conversationMode',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_ui_settings_label_conversation_mode',
+    Component: ConversationModeSwitch,
+  },
+  {
+    id: 'automaticPlayback',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_nav_automatic_playback',
+    Component: AutomaticPlaybackSwitch,
+  },
+  {
+    id: 'cloudBrowserVoices',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_nav_enable_cloud_browser_voice',
+    show: (ctx) => ctx.engineTTS === TTSEndpoints.browser,
+    Component: CloudBrowserVoicesSwitch,
+  },
+  {
+    id: 'playbackRate',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_ui_settings_label_playback_rate',
+    Component: PlaybackRate,
+  },
+  {
+    id: 'cacheTTS',
+    tab: SPEECH,
+    section: 'tts',
+    labelKey: 'com_nav_enable_cache_tts',
+    Component: CacheTTSSwitch,
+  },
+
+  // Data controls · Memory
+  {
+    id: 'referenceSavedMemories',
+    tab: DATA,
+    section: 'memory',
+    labelKey: 'com_ui_reference_saved_memories',
+    keywords: ['memory', 'personalization'],
+    show: (ctx) => ctx.hasMemoryOptOut,
+    Component: MemoryToggle,
+  },
+  // Data controls · Your data
+  {
+    id: 'importConversations',
+    tab: DATA,
+    section: 'data',
+    labelKey: 'com_ui_settings_label_import',
+    Component: ImportConversations,
+  },
+  {
+    id: 'sharedLinks',
+    tab: DATA,
+    section: 'data',
+    labelKey: 'com_ui_settings_label_shared_links',
+    Component: SharedLinks,
+  },
+  // Data controls · API keys
+  {
+    id: 'providerApiKeys',
+    tab: DATA,
+    section: 'apiKeys',
+    labelKey: 'com_ui_settings_label_provider_api_keys',
+    keywords: ['api', 'key', 'keys', 'provider', 'endpoint', 'credentials'],
+    show: (ctx) => ctx.hasUserProvidedEndpoints,
+    Component: ProviderKeys,
+  },
+  {
+    id: 'agentApiKeys',
+    tab: DATA,
+    section: 'apiKeys',
+    labelKey: 'com_ui_settings_label_agent_api_keys',
+    show: (ctx) => ctx.hasRemoteAgents,
+    Component: ApiKeys,
+  },
+  {
+    id: 'revokeKeys',
+    tab: DATA,
+    section: 'apiKeys',
+    labelKey: 'com_ui_settings_label_revoke_keys',
+    Component: RevokeKeys,
+  },
+  // Data controls · Danger zone
+  {
+    id: 'deleteCache',
+    tab: DATA,
+    section: 'danger',
+    labelKey: 'com_ui_settings_label_delete_cache',
+    Component: DeleteCache,
+  },
+  {
+    id: 'clearChats',
+    tab: DATA,
+    section: 'danger',
+    labelKey: 'com_ui_settings_label_clear_chats',
+    Component: ClearChats,
+  },
+
+  // Account · Profile
+  {
+    id: 'avatar',
+    tab: ACCOUNT,
+    section: 'profile',
+    labelKey: 'com_ui_settings_label_avatar',
+    Component: Avatar,
+  },
+  // Account · Security
+  {
+    id: 'twoFactor',
+    tab: ACCOUNT,
+    section: 'security',
+    labelKey: 'com_ui_settings_label_2fa',
+    show: (ctx) => ctx.isLocalProvider,
+    Component: EnableTwoFactorItem,
+  },
+  {
+    id: 'backupCodes',
+    tab: ACCOUNT,
+    section: 'security',
+    labelKey: 'com_ui_settings_label_backup_codes',
+    show: (ctx) => ctx.isLocalProvider && ctx.twoFactorEnabled,
+    Component: BackupCodesItem,
+  },
+  // Account · Billing
+  {
+    id: 'tokenCredits',
+    tab: ACCOUNT,
+    section: 'billing',
+    labelKey: 'com_ui_settings_label_credits',
+    show: (ctx) => ctx.balanceEnabled,
+    Component: TokenCredits,
+  },
+  {
+    id: 'autoRefill',
+    tab: ACCOUNT,
+    section: 'billing',
+    labelKey: 'com_ui_settings_label_auto_refill',
+    show: (ctx) => ctx.balanceEnabled,
+    Component: AutoRefill,
+  },
+  // Account · Danger zone
+  {
+    id: 'deleteAccount',
+    tab: ACCOUNT,
+    section: 'danger',
+    labelKey: 'com_ui_settings_label_delete_account',
+    show: (ctx) => ctx.allowAccountDeletion,
+    Component: DeleteAccount,
+  },
+
+  // About
+  {
+    id: 'about',
+    tab: ABOUT,
+    section: 'about',
+    labelKey: 'com_nav_setting_about',
+    keywords: ['version', 'build', 'diagnostics'],
+    show: (ctx) => ctx.aboutEnabled,
+    Component: About,
+  },
+];
diff --git a/client/src/components/Nav/Settings/search.ts b/client/src/components/Nav/Settings/search.ts
new file mode 100644
index 00000000000..5b7fed0e889
--- /dev/null
+++ b/client/src/components/Nav/Settings/search.ts
@@ -0,0 +1,43 @@
+import type { SettingEntry, SettingsContextValue } from './types';
+
+export function normalize(value: string): string {
+  return value.normalize('NFD').replace(/[̀-ͯ]/g, '').trim().toLowerCase();
+}
+
+export function matchesQuery(
+  query: string,
+  haystack: { label: string; keywords?: string[] },
+): boolean {
+  const q = normalize(query);
+  if (q.length === 0) {
+    return true;
+  }
+  if (normalize(haystack.label).includes(q)) {
+    return true;
+  }
+  return (haystack.keywords ?? []).some((k) => normalize(k).includes(q));
+}
+
+export interface SearchResult {
+  entry: SettingEntry;
+  label: string;
+}
+
+export function filterSettings(
+  entries: SettingEntry[],
+  query: string,
+  ctx: SettingsContextValue,
+  localize: (key: SettingEntry['labelKey']) => string,
+): SearchResult[] {
+  const results: SearchResult[] = [];
+  for (const entry of entries) {
+    if (entry.show && !entry.show(ctx)) {
+      continue;
+    }
+    const label = localize(entry.labelKey);
+    if (matchesQuery(query, { label, keywords: entry.keywords })) {
+      results.push({ entry, label });
+    }
+  }
+  return results;
+}
diff --git a/client/src/components/Nav/Settings/types.ts b/client/src/components/Nav/Settings/types.ts
new file mode 100644
index 00000000000..05a87c9c70c
--- /dev/null
+++ b/client/src/components/Nav/Settings/types.ts
@@ -0,0 +1,136 @@
+import { createElement } from 'react';
+import { MessageSquare, Info } from 'lucide-react';
+import { SettingsTabValues } from 'librechat-data-provider';
+import { GearIcon, DataIcon, UserIcon, SpeechIcon } from '@librechat/client';
+import type { ComponentType, ReactNode } from 'react';
+import type { TranslationKeys } from '~/hooks';
+
+export type SettingsTab =
+  | SettingsTabValues.GENERAL
+  | SettingsTabValues.CHAT
+  | SettingsTabValues.SPEECH
+  | SettingsTabValues.DATA
+  | SettingsTabValues.ACCOUNT
+  | SettingsTabValues.ABOUT;
+
+export type SectionId =
+  | 'appearance'
+  | 'layout'
+  | 'accessibility'
+  | 'sending'
+  | 'commands'
+  | 'messages'
+  | 'conversations'
+  | 'prompts'
+  | 'stt'
+  | 'tts'
+  | 'memory'
+  | 'data'
+  | 'apiKeys'
+  | 'danger'
+  | 'profile'
+  | 'security'
+  | 'billing'
+  | 'about';
+
+export interface SettingsContextValue {
+  balanceEnabled: boolean;
+  hasAnyPersonalizationFeature: boolean;
+  hasMemoryOptOut: boolean;
+  hasRemoteAgents: boolean;
+  hasUserProvidedEndpoints: boolean;
+  hasMultiConvo: boolean;
+  hasPrompts: boolean;
+  isLocalProvider: boolean;
+  twoFactorEnabled: boolean;
+  allowAccountDeletion: boolean;
+  aboutEnabled: boolean;
+  engineTTS: string;
+}
+
+export interface SettingEntry {
+  id: string;
+  tab: SettingsTab;
+  section: SectionId;
+  labelKey: TranslationKeys;
+  keywords?: string[];
+  Component: ComponentType;
+  show?: (ctx: SettingsContextValue) => boolean;
+}
+
+export interface SectionMeta {
+  id: SectionId;
+  labelKey: TranslationKeys;
+  danger?: boolean;
+}
+
+export interface TabMeta {
+  id: SettingsTab;
+  labelKey: TranslationKeys;
+  icon: ReactNode;
+  sections: SectionMeta[];
+  show?: (ctx: SettingsContextValue) => boolean;
+}
+
+export const TABS: TabMeta[] = [
+  {
+    id: SettingsTabValues.GENERAL,
+    labelKey: 'com_nav_setting_general',
+    icon: createElement(GearIcon),
+    sections: [
+      { id: 'appearance', labelKey: 'com_ui_settings_section_appearance' },
+      { id: 'layout', labelKey: 'com_ui_settings_section_layout' },
+      { id: 'accessibility', labelKey: 'com_ui_settings_section_accessibility' },
+    ],
+  },
+  {
+    id: SettingsTabValues.CHAT,
+    labelKey: 'com_nav_setting_chat',
+    icon: createElement(MessageSquare, { className: 'icon-sm', 'aria-hidden': true }),
+    sections: [
+      { id: 'sending', labelKey: 'com_ui_settings_section_sending' },
+      { id: 'commands', labelKey: 'com_ui_settings_section_commands' },
+      { id: 'messages', labelKey: 'com_ui_settings_section_messages' },
+      { id: 'conversations', labelKey: 'com_ui_settings_section_conversations' },
+      { id: 'prompts', labelKey: 'com_ui_settings_section_prompts' },
+    ],
+  },
+  {
+    id: SettingsTabValues.SPEECH,
+    labelKey: 'com_nav_setting_speech',
+    icon: createElement(SpeechIcon, { className: 'icon-sm' }),
+    sections: [
+      { id: 'stt', labelKey: 'com_ui_settings_section_stt' },
+      { id: 'tts', labelKey: 'com_ui_settings_section_tts' },
+    ],
+  },
+  {
+    id: SettingsTabValues.DATA,
+    labelKey: 'com_ui_settings_tab_data',
+    icon: createElement(DataIcon),
+    sections: [
+      { id: 'memory', labelKey: 'com_ui_settings_section_memory' },
+      { id: 'data', labelKey: 'com_ui_settings_section_data' },
+      { id: 'apiKeys', labelKey: 'com_ui_settings_section_api_keys' },
+      { id: 'danger', labelKey: 'com_ui_settings_section_danger_zone', danger: true },
+    ],
+  },
+  {
+    id: SettingsTabValues.ACCOUNT,
+    labelKey: 'com_nav_setting_account',
+    icon: createElement(UserIcon),
+    sections: [
+      { id: 'profile', labelKey: 'com_ui_settings_section_profile' },
+      { id: 'security', labelKey: 'com_ui_settings_section_security' },
+      { id: 'billing', labelKey: 'com_ui_settings_section_billing' },
+      { id: 'danger', labelKey: 'com_ui_settings_section_danger_zone', danger: true },
+    ],
+  },
+  {
+    id: SettingsTabValues.ABOUT,
+    labelKey: 'com_nav_setting_about',
+    icon: createElement(Info, { className: 'icon-sm', 'aria-hidden': true }),
+    sections: [{ id: 'about', labelKey: 'com_nav_setting_about' }],
+    show: (ctx) => ctx.aboutEnabled,
+  },
+];
diff --git a/client/src/components/Nav/SettingsTabs/About/About.spec.tsx b/client/src/components/Nav/SettingsTabs/About/About.spec.tsx
new file mode 100644
index 00000000000..46d9158668c
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/About/About.spec.tsx
@@ -0,0 +1,170 @@
+import React from 'react';
+import { act, render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Constants } from 'librechat-data-provider';
+import type { TStartupConfig } from 'librechat-data-provider';
+import About from './About';
+
+const mockCopy = jest.fn<boolean, unknown[]>();
+jest.mock('copy-to-clipboard', () => ({
+  __esModule: true,
+  default: (...args: unknown[]) => mockCopy(...args),
+}));
+
+const mockUseGetStartupConfig = jest.fn();
+jest.mock('~/data-provider', () => ({
+  useGetStartupConfig: () => mockUseGetStartupConfig(),
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+const populatedBuildInfo: NonNullable<TStartupConfig['buildInfo']> = {
+  commit: 'abcdef1234567890abcdef1234567890abcdef12',
+  commitShort: 'abcdef1',
+  branch: 'dev',
+  buildDate: '2026-04-20T12:00:00Z',
+};
+
+beforeEach(() => {
+  mockCopy.mockReset();
+  mockCopy.mockReturnValue(true);
+  mockUseGetStartupConfig.mockReturnValue({ data: { buildInfo: populatedBuildInfo } });
+});
+
+describe('About', () => {
+  describe('rendering', () => {
+    it('renders version, commit (short), branch, and build date when buildInfo is populated', () => {
+      render(<About />);
+
+      expect(screen.getByText(Constants.VERSION as string)).toBeInTheDocument();
+      expect(screen.getByText('abcdef1')).toBeInTheDocument();
+      expect(screen.getByText('dev')).toBeInTheDocument();
+      expect(screen.getByText('2026-04-20 12:00:00 UTC')).toBeInTheDocument();
+    });
+
+    it('renders em-dash placeholders when buildInfo is missing', () => {
+      mockUseGetStartupConfig.mockReturnValue({ data: {} });
+      render(<About />);
+
+      // version still populated from Constants.VERSION; the other three rows fall back to placeholder
+      const placeholders = screen.getAllByText('—');
+      expect(placeholders.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('renders em-dash placeholders when startupConfig is undefined (initial load)', () => {
+      mockUseGetStartupConfig.mockReturnValue({ data: undefined });
+      render(<About />);
+
+      const placeholders = screen.getAllByText('—');
+      expect(placeholders.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('shows the raw string when buildDate is not a valid ISO', () => {
+      mockUseGetStartupConfig.mockReturnValue({
+        data: { buildInfo: { ...populatedBuildInfo, buildDate: 'not-a-date' } },
+      });
+      render(<About />);
+      expect(screen.getByText('not-a-date')).toBeInTheDocument();
+    });
+  });
+
+  describe('copy diagnostics', () => {
+    it('writes a preformatted diagnostics blob to the clipboard on click', async () => {
+      const user = userEvent.setup();
+      render(<About />);
+
+      await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+
+      expect(mockCopy).toHaveBeenCalledTimes(1);
+      const [blob, options] = mockCopy.mock.calls[0] as [string, { format: string }];
+      expect(options).toEqual({ format: 'text/plain' });
+      expect(blob).toContain(`LibreChat version: ${Constants.VERSION}`);
+      expect(blob).toContain(`Commit: ${populatedBuildInfo.commit}`);
+      expect(blob).toContain(`Branch: ${populatedBuildInfo.branch}`);
+      expect(blob).toContain('Build date: 2026-04-20 12:00:00 UTC');
+      expect(blob).toContain('User agent: ');
+    });
+
+    it('writes em-dash placeholders into the blob when buildInfo is missing', async () => {
+      mockUseGetStartupConfig.mockReturnValue({ data: {} });
+      const user = userEvent.setup();
+      render(<About />);
+
+      await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+
+      const [blob] = mockCopy.mock.calls[0] as [string];
+      expect(blob).toContain('Commit: —');
+      expect(blob).toContain('Branch: —');
+      expect(blob).toContain('Build date: —');
+    });
+
+    it('does not flip to "Copied" when copy-to-clipboard reports failure', async () => {
+      mockCopy.mockReturnValue(false);
+      const user = userEvent.setup();
+      render(<About />);
+
+      await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+
+      expect(
+        screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }),
+      ).toBeInTheDocument();
+      expect(
+        screen.queryByRole('button', { name: /com_nav_about_diagnostics_copied/i }),
+      ).not.toBeInTheDocument();
+      expect(screen.getByRole('status').textContent).toBe('');
+    });
+
+    it('toggles the button label to "Copied" after click and resets after the timer', async () => {
+      jest.useFakeTimers();
+      try {
+        const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
+        render(<About />);
+
+        await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+        expect(
+          screen.getByRole('button', { name: /com_nav_about_diagnostics_copied/i }),
+        ).toBeInTheDocument();
+
+        act(() => {
+          jest.advanceTimersByTime(2000);
+        });
+        expect(
+          screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }),
+        ).toBeInTheDocument();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('clears the pending reset timer on unmount (no state update on unmounted component)', async () => {
+      jest.useFakeTimers();
+      const clearSpy = jest.spyOn(globalThis, 'clearTimeout');
+      try {
+        const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
+        const { unmount } = render(<About />);
+        await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+        clearSpy.mockClear();
+        unmount();
+        expect(clearSpy).toHaveBeenCalled();
+      } finally {
+        clearSpy.mockRestore();
+        jest.useRealTimers();
+      }
+    });
+  });
+
+  describe('status live region', () => {
+    it('announces the copied state via a dedicated sr-only live region', async () => {
+      const user = userEvent.setup();
+      render(<About />);
+
+      const status = screen.getByRole('status');
+      expect(status.textContent).toBe('');
+
+      await user.click(screen.getByRole('button', { name: /com_nav_about_diagnostics_copy/i }));
+      expect(status.textContent).toMatch(/com_nav_about_diagnostics_copied/);
+    });
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/About/About.tsx b/client/src/components/Nav/SettingsTabs/About/About.tsx
new file mode 100644
index 00000000000..820f7dc2bb7
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/About/About.tsx
@@ -0,0 +1,120 @@
+import { memo, useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import copy from 'copy-to-clipboard';
+import { Constants } from 'librechat-data-provider';
+import type { TStartupConfig } from 'librechat-data-provider';
+import CopyButton from '~/components/Messages/Content/CopyButton';
+import { useGetStartupConfig } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+
+const UNKNOWN_PLACEHOLDER = '—';
+
+function formatBuildDate(raw: string | null | undefined): string {
+  if (!raw) {
+    return UNKNOWN_PLACEHOLDER;
+  }
+  const date = new Date(raw);
+  if (Number.isNaN(date.getTime())) {
+    return raw;
+  }
+  return date
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d{3}Z$/, ' UTC');
+}
+
+function buildDiagnosticsBlob(
+  version: string,
+  buildInfo: TStartupConfig['buildInfo'] | undefined,
+): string {
+  const lines: string[] = [
+    `LibreChat version: ${version}`,
+    `Commit: ${buildInfo?.commit ?? UNKNOWN_PLACEHOLDER}`,
+    `Branch: ${buildInfo?.branch ?? UNKNOWN_PLACEHOLDER}`,
+    `Build date: ${formatBuildDate(buildInfo?.buildDate)}`,
+    `User agent: ${typeof navigator !== 'undefined' ? navigator.userAgent : UNKNOWN_PLACEHOLDER}`,
+  ];
+  return lines.join('\n');
+}
+
+function Row({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="flex items-center justify-between gap-4 py-2.5 first:pt-0 last:pb-0">
+      <dt className="text-text-secondary">{label}</dt>
+      <dd className="break-all text-right font-mono text-xs text-text-primary">{value}</dd>
+    </div>
+  );
+}
+
+function About() {
+  const localize = useLocalize();
+  const { data: startupConfig } = useGetStartupConfig();
+  const [isCopied, setIsCopied] = useState(false);
+  const copyResetTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  const buildInfo = startupConfig?.buildInfo;
+  const version: string = Constants.VERSION;
+
+  const diagnosticsBlob = useMemo(
+    () => buildDiagnosticsBlob(version, buildInfo),
+    [version, buildInfo],
+  );
+
+  useEffect(
+    () => () => {
+      if (copyResetTimerRef.current) {
+        clearTimeout(copyResetTimerRef.current);
+      }
+    },
+    [],
+  );
+
+  const handleCopy = useCallback(() => {
+    const succeeded = copy(diagnosticsBlob, { format: 'text/plain' });
+    if (!succeeded) {
+      return;
+    }
+    setIsCopied(true);
+    if (copyResetTimerRef.current) {
+      clearTimeout(copyResetTimerRef.current);
+    }
+    copyResetTimerRef.current = setTimeout(() => setIsCopied(false), 2000);
+  }, [diagnosticsBlob]);
+
+  return (
+    <div className="flex flex-col text-sm text-text-primary">
+      <dl className="flex flex-col divide-y divide-border-light">
+        <Row label={localize('com_nav_about_version')} value={version} />
+        <Row
+          label={localize('com_nav_about_commit')}
+          value={buildInfo?.commitShort ?? UNKNOWN_PLACEHOLDER}
+        />
+        <Row
+          label={localize('com_nav_about_branch')}
+          value={buildInfo?.branch ?? UNKNOWN_PLACEHOLDER}
+        />
+        <Row
+          label={localize('com_nav_about_build_date')}
+          value={formatBuildDate(buildInfo?.buildDate)}
+        />
+      </dl>
+
+      <div className="mt-4 flex flex-col items-start gap-3 border-t border-border-light pt-4">
+        <p className="text-xs text-text-secondary">
+          {localize('com_nav_about_diagnostics_description')}
+        </p>
+        <CopyButton
+          isCopied={isCopied}
+          onClick={handleCopy}
+          label={localize('com_nav_about_diagnostics_copy')}
+          copiedLabel={localize('com_nav_about_diagnostics_copied')}
+          className="ml-0 gap-2 self-start rounded-lg border border-border-light bg-surface-secondary px-3 py-1.5 text-xs font-medium text-text-primary hover:bg-surface-tertiary"
+        />
+        <span className="sr-only" role="status" aria-live="polite" aria-atomic="true">
+          {isCopied ? localize('com_nav_about_diagnostics_copied') : ''}
+        </span>
+      </div>
+    </div>
+  );
+}
+
+export default memo(About);
diff --git a/client/src/components/Nav/SettingsTabs/Account/Account.spec.tsx b/client/src/components/Nav/SettingsTabs/Account/Account.spec.tsx
deleted file mode 100644
index f87a01431bc..00000000000
--- a/client/src/components/Nav/SettingsTabs/Account/Account.spec.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-import React from 'react';
-import { SystemRoles } from 'librechat-data-provider';
-import { render, screen } from '@testing-library/react';
-import type { TUser } from 'librechat-data-provider';
-import Account from './Account';
-
-jest.mock('./DisplayUsernameMessages', () => () => <div data-testid="display-username" />);
-jest.mock('./Avatar', () => () => <div data-testid="avatar" />);
-jest.mock('./TwoFactorAuthentication', () => () => <div data-testid="two-factor" />);
-jest.mock('./BackupCodesItem', () => () => <div data-testid="backup-codes" />);
-jest.mock('./DeleteAccount', () => () => <div data-testid="delete-account" />);
-
-const mockUseAuthContext = jest.fn();
-const mockUseGetStartupConfig = jest.fn();
-
-jest.mock('~/hooks', () => ({
-  useAuthContext: () => mockUseAuthContext(),
-}));
-
-jest.mock('~/data-provider', () => ({
-  useGetStartupConfig: () => mockUseGetStartupConfig(),
-}));
-
-const baseUser: TUser = {
-  id: 'user-123',
-  username: 'testuser',
-  email: 'test@example.com',
-  name: 'Test User',
-  avatar: '',
-  role: SystemRoles.USER,
-  provider: 'local',
-  createdAt: '2023-01-01T00:00:00.000Z',
-  updatedAt: '2023-01-01T00:00:00.000Z',
-};
-
-beforeEach(() => {
-  mockUseAuthContext.mockReturnValue({ user: baseUser });
-  mockUseGetStartupConfig.mockReturnValue({ data: { allowAccountDeletion: true } });
-});
-
-afterEach(() => {
-  jest.resetAllMocks();
-});
-
-describe('Account', () => {
-  describe('DeleteAccount visibility', () => {
-    it('renders DeleteAccount when allowAccountDeletion is true', () => {
-      render(<Account />);
-      expect(screen.getByTestId('delete-account')).toBeInTheDocument();
-    });
-
-    it('hides DeleteAccount when allowAccountDeletion is false', () => {
-      mockUseGetStartupConfig.mockReturnValue({ data: { allowAccountDeletion: false } });
-      render(<Account />);
-      expect(screen.queryByTestId('delete-account')).not.toBeInTheDocument();
-    });
-
-    it('shows DeleteAccount when startup config is still loading', () => {
-      mockUseGetStartupConfig.mockReturnValue({ data: undefined });
-      render(<Account />);
-      expect(screen.getByTestId('delete-account')).toBeInTheDocument();
-    });
-  });
-});
diff --git a/client/src/components/Nav/SettingsTabs/Account/Account.tsx b/client/src/components/Nav/SettingsTabs/Account/Account.tsx
deleted file mode 100644
index e19f42f4dc7..00000000000
--- a/client/src/components/Nav/SettingsTabs/Account/Account.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import React from 'react';
-import DisplayUsernameMessages from './DisplayUsernameMessages';
-import DeleteAccount from './DeleteAccount';
-import Avatar from './Avatar';
-import EnableTwoFactorItem from './TwoFactorAuthentication';
-import BackupCodesItem from './BackupCodesItem';
-import { useGetStartupConfig } from '~/data-provider';
-import { useAuthContext } from '~/hooks';
-
-function Account() {
-  const { user } = useAuthContext();
-  const { data: startupConfig } = useGetStartupConfig();
-
-  return (
-    <div className="flex flex-col gap-3 p-1 text-sm text-text-primary">
-      <div className="pb-3">
-        <DisplayUsernameMessages />
-      </div>
-      <div className="pb-3">
-        <Avatar />
-      </div>
-      {user?.provider === 'local' && (
-        <>
-          <div className="pb-3">
-            <EnableTwoFactorItem />
-          </div>
-          {user?.twoFactorEnabled && (
-            <div className="pb-3">
-              <BackupCodesItem />
-            </div>
-          )}
-        </>
-      )}
-      {startupConfig?.allowAccountDeletion !== false && (
-        <div className="pb-3">
-          <DeleteAccount />
-        </div>
-      )}
-    </div>
-  );
-}
-
-export default React.memo(Account);
diff --git a/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx b/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
index a478f9b2c73..c21e295ed16 100644
--- a/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
+++ b/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
@@ -11,6 +11,7 @@ import {
   Progress,
 } from '@librechat/client';
 import type { TUser, TVerify2FARequest } from 'librechat-data-provider';
+import type { Variants } from 'framer-motion';
 import {
   useConfirmTwoFactorMutation,
   useDisableTwoFactorMutation,
@@ -24,7 +25,7 @@ import store from '~/store';
 
 export type Phase = 'setup' | 'qr' | 'verify' | 'backup' | 'disable';
 
-const phaseVariants = {
+const phaseVariants: Variants = {
   initial: { opacity: 0, scale: 0.95 },
   animate: { opacity: 1, scale: 1, transition: { duration: 0.3, ease: 'easeOut' } },
   exit: { opacity: 0, scale: 0.95, transition: { duration: 0.3, ease: 'easeIn' } },
diff --git a/client/src/components/Nav/SettingsTabs/Account/TwoFactorPhases/QRPhase.tsx b/client/src/components/Nav/SettingsTabs/Account/TwoFactorPhases/QRPhase.tsx
index ba31a257998..12c8a788248 100644
--- a/client/src/components/Nav/SettingsTabs/Account/TwoFactorPhases/QRPhase.tsx
+++ b/client/src/components/Nav/SettingsTabs/Account/TwoFactorPhases/QRPhase.tsx
@@ -1,10 +1,8 @@
-import React, { useState } from 'react';
+import React from 'react';
 import { motion } from 'framer-motion';
 import { QRCodeSVG } from 'qrcode.react';
-import { Copy, Check } from 'lucide-react';
-import { Input, Button, Label } from '@librechat/client';
+import { Button, Label, SecretInput } from '@librechat/client';
 import { useLocalize } from '~/hooks';
-import { cn } from '~/utils';
 
 const fadeAnimation = {
   initial: { opacity: 0, y: 20 },
@@ -23,13 +21,6 @@ interface QRPhaseProps {
 
 export const QRPhase: React.FC<QRPhaseProps> = ({ secret, otpauthUrl, onNext }) => {
   const localize = useLocalize();
-  const [isCopying, setIsCopying] = useState(false);
-
-  const handleCopy = async () => {
-    await navigator.clipboard.writeText(secret);
-    setIsCopying(true);
-    setTimeout(() => setIsCopying(false), 2000);
-  };
 
   return (
     <motion.div {...fadeAnimation} className="space-y-6">
@@ -45,21 +36,14 @@ export const QRPhase: React.FC<QRPhaseProps> = ({ secret, otpauthUrl, onNext })
           <Label className="text-sm font-medium text-text-secondary">
             {localize('com_ui_secret_key')}
           </Label>
-          <div className="flex gap-2">
-            <Input value={secret} readOnly className="font-mono text-lg tracking-wider" />
-            <Button
-              size="sm"
-              variant="outline"
-              onClick={handleCopy}
-              className={cn('h-auto shrink-0', isCopying ? 'cursor-default' : '')}
-            >
-              {isCopying ? (
-                <Check className="size-4" aria-hidden="true" />
-              ) : (
-                <Copy className="size-4" aria-hidden="true" />
-              )}
-            </Button>
-          </div>
+          <SecretInput
+            value={secret}
+            readOnly
+            showCopy
+            controlsOnHover
+            aria-label={localize('com_ui_secret_key')}
+            className="font-mono text-lg tracking-wider"
+          />
         </div>
       </div>
       <Button onClick={onNext} className="w-full">
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/Admin.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/Admin.tsx
new file mode 100644
index 00000000000..dd9af627918
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/Admin.tsx
@@ -0,0 +1,46 @@
+import { ShieldEllipsis } from 'lucide-react';
+import { Button, useToastContext } from '@librechat/client';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
+import type { PermissionConfig } from '~/components/ui';
+import { useUpdateRemoteAgentsPermissionsMutation } from '~/data-provider';
+import { AdminSettingsDialog } from '~/components/ui';
+import { useLocalize } from '~/hooks';
+
+const remoteAgentsPermissions: PermissionConfig[] = [
+  { permission: Permissions.USE, labelKey: 'com_ui_remote_agents_allow_use' },
+  { permission: Permissions.CREATE, labelKey: 'com_ui_remote_agents_allow_create' },
+  { permission: Permissions.SHARE, labelKey: 'com_ui_remote_agents_allow_share' },
+  { permission: Permissions.SHARE_PUBLIC, labelKey: 'com_ui_remote_agents_allow_share_public' },
+];
+
+export default function Admin() {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+
+  const mutation = useUpdateRemoteAgentsPermissionsMutation({
+    onSuccess: () => {
+      showToast({ status: 'success', message: localize('com_ui_saved') });
+    },
+    onError: () => {
+      showToast({ status: 'error', message: localize('com_ui_error_save_admin_settings') });
+    },
+  });
+
+  const trigger = (
+    <Button variant="outline" size="sm" className="gap-1.5 text-text-secondary">
+      <ShieldEllipsis className="h-4 w-4" aria-hidden="true" />
+      {localize('com_ui_admin_panel')}
+    </Button>
+  );
+
+  return (
+    <AdminSettingsDialog
+      permissionType={PermissionTypes.REMOTE_AGENTS}
+      sectionKey="com_ui_remote_agents"
+      permissions={remoteAgentsPermissions}
+      menuId="remote-agents-role-dropdown"
+      mutation={mutation}
+      trigger={trigger}
+    />
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/ApiKeys.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/ApiKeys.tsx
new file mode 100644
index 00000000000..a857ddd8c39
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/ApiKeys.tsx
@@ -0,0 +1,55 @@
+import { useState } from 'react';
+import { Plus } from 'lucide-react';
+import {
+  Label,
+  Button,
+  OGDialog,
+  OGDialogTitle,
+  OGDialogHeader,
+  InfoHoverCard,
+  OGDialogTrigger,
+  OGDialogContent,
+} from '@librechat/client';
+import CreateKeyDialog from './CreateKeyDialog';
+import { useLocalize } from '~/hooks';
+import Admin from './Admin';
+import List from './List';
+
+export default function ApiKeys() {
+  const localize = useLocalize();
+  const [open, setOpen] = useState(false);
+  const [createOpen, setCreateOpen] = useState(false);
+
+  return (
+    <div className="flex items-center justify-between">
+      <Label id="agent-api-keys-label">{localize('com_ui_agent_api_keys')}</Label>
+      <OGDialog open={open} onOpenChange={setOpen}>
+        <OGDialogTrigger asChild>
+          <Button variant="outline" aria-labelledby="agent-api-keys-label">
+            {localize('com_ui_manage')}
+          </Button>
+        </OGDialogTrigger>
+        <OGDialogContent
+          className="w-11/12 max-w-2xl bg-background text-text-primary shadow-2xl"
+          aria-describedby={undefined}
+        >
+          <OGDialogHeader className="space-y-0 pr-8 text-left">
+            <div className="flex items-center gap-1.5">
+              <OGDialogTitle>{localize('com_ui_agent_api_keys')}</OGDialogTitle>
+              <InfoHoverCard text={localize('com_ui_api_keys_description')} />
+            </div>
+          </OGDialogHeader>
+          <List onCreate={() => setCreateOpen(true)} />
+          <div className="flex items-center gap-2">
+            <Admin />
+            <Button size="sm" className="ml-auto gap-1.5" onClick={() => setCreateOpen(true)}>
+              <Plus className="h-4 w-4" aria-hidden="true" />
+              {localize('com_ui_create_api_key')}
+            </Button>
+          </div>
+          <CreateKeyDialog open={createOpen} onOpenChange={setCreateOpen} />
+        </OGDialogContent>
+      </OGDialog>
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/Create.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/Create.tsx
new file mode 100644
index 00000000000..20b8f4f4798
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/Create.tsx
@@ -0,0 +1,114 @@
+import { useRef, useState } from 'react';
+import { useCreateAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import { Button, Input, Label, Radio, Spinner, useToastContext } from '@librechat/client';
+import type { TAgentApiKeyCreateResponse } from 'librechat-data-provider';
+import type { FormEvent } from 'react';
+import { computeExpiresAt, formatDate, DEFAULT_EXPIRY, EXPIRY_OPTIONS } from './utils';
+import { useLocalize } from '~/hooks';
+
+type CreateProps = {
+  onCreated: (result: TAgentApiKeyCreateResponse) => void;
+  onCancel: () => void;
+};
+
+export default function Create({ onCreated, onCancel }: CreateProps) {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+  const [name, setName] = useState('');
+  const [nameError, setNameError] = useState(false);
+  const [expiry, setExpiry] = useState(DEFAULT_EXPIRY);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const createMutation = useCreateAgentApiKeyMutation();
+
+  const expiresAt = computeExpiresAt(expiry);
+
+  const handleSubmit = async (event: FormEvent) => {
+    event.preventDefault();
+    if (createMutation.isLoading) {
+      return;
+    }
+    if (!name.trim()) {
+      setNameError(true);
+      inputRef.current?.focus();
+      return;
+    }
+    try {
+      const result = await createMutation.mutateAsync({
+        name: name.trim(),
+        expiresAt: computeExpiresAt(expiry),
+      });
+      onCreated(result);
+    } catch {
+      showToast({ message: localize('com_ui_api_key_create_error'), status: 'error' });
+    }
+  };
+
+  return (
+    <form onSubmit={handleSubmit} className="space-y-5">
+      <div className="space-y-2">
+        <Label htmlFor="api-key-name">{localize('com_ui_api_key_name')}</Label>
+        <Input
+          id="api-key-name"
+          ref={inputRef}
+          value={name}
+          maxLength={100}
+          aria-invalid={nameError}
+          aria-describedby={nameError ? 'api-key-name-error' : undefined}
+          onChange={(e) => {
+            setName(e.target.value);
+            if (nameError) {
+              setNameError(false);
+            }
+          }}
+          placeholder={localize('com_ui_api_key_name_placeholder')}
+        />
+        {nameError && (
+          <p
+            id="api-key-name-error"
+            role="alert"
+            className="text-xs text-red-500 dark:text-red-400"
+          >
+            {localize('com_ui_api_key_name_required')}
+          </p>
+        )}
+      </div>
+      <div className="space-y-2">
+        <Label id="api-key-expiry-label">{localize('com_ui_api_key_expiration')}</Label>
+        <Radio
+          fullWidth
+          value={expiry}
+          onChange={setExpiry}
+          aria-labelledby="api-key-expiry-label"
+          options={EXPIRY_OPTIONS.map(({ value, labelKey }) => ({
+            value,
+            label: localize(labelKey),
+          }))}
+        />
+        <p className="text-xs text-text-secondary">
+          {expiresAt == null
+            ? localize('com_ui_api_key_no_expiration')
+            : localize('com_ui_api_key_expires_on', { 0: formatDate(expiresAt) })}
+        </p>
+      </div>
+      <div className="flex justify-end gap-2">
+        <Button
+          type="button"
+          variant="outline"
+          onClick={onCancel}
+          disabled={createMutation.isLoading}
+        >
+          {localize('com_ui_cancel')}
+        </Button>
+        <Button
+          type="submit"
+          variant="submit"
+          disabled={createMutation.isLoading || !name.trim()}
+          aria-busy={createMutation.isLoading}
+          aria-label={localize('com_ui_create')}
+        >
+          {createMutation.isLoading ? <Spinner className="h-4 w-4" /> : localize('com_ui_create')}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/CreateKeyDialog.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/CreateKeyDialog.tsx
new file mode 100644
index 00000000000..fc7fe3eb0ba
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/CreateKeyDialog.tsx
@@ -0,0 +1,47 @@
+import { useState } from 'react';
+import { OGDialog, OGDialogContent, OGDialogHeader, OGDialogTitle } from '@librechat/client';
+import type { TAgentApiKeyCreateResponse } from 'librechat-data-provider';
+import { useLocalize } from '~/hooks';
+import Create from './Create';
+import Reveal from './Reveal';
+
+type CreateKeyDialogProps = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+};
+
+export default function CreateKeyDialog({ open, onOpenChange }: CreateKeyDialogProps) {
+  const localize = useLocalize();
+  const [createdKey, setCreatedKey] = useState<TAgentApiKeyCreateResponse | null>(null);
+  const [prevOpen, setPrevOpen] = useState(open);
+
+  if (open !== prevOpen) {
+    setPrevOpen(open);
+    if (open) {
+      setCreatedKey(null);
+    }
+  }
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange}>
+      <OGDialogContent
+        showCloseButton={false}
+        className="w-11/12 max-w-lg"
+        aria-describedby={undefined}
+      >
+        <OGDialogHeader>
+          <OGDialogTitle>
+            {createdKey != null
+              ? localize('com_ui_api_key_created')
+              : localize('com_ui_create_api_key')}
+          </OGDialogTitle>
+        </OGDialogHeader>
+        {createdKey != null ? (
+          <Reveal createdKey={createdKey} onDone={() => onOpenChange(false)} />
+        ) : (
+          <Create onCreated={setCreatedKey} onCancel={() => onOpenChange(false)} />
+        )}
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/DeleteKeyDialog.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/DeleteKeyDialog.tsx
new file mode 100644
index 00000000000..271cee4e210
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/DeleteKeyDialog.tsx
@@ -0,0 +1,67 @@
+import { useDeleteAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import { Spinner, OGDialog, OGDialogTemplate, useToastContext } from '@librechat/client';
+import type { RefObject } from 'react';
+import { useLocalize } from '~/hooks';
+
+type DeleteKeyDialogProps = {
+  id: string;
+  name: string;
+  keyPrefix: string;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  triggerRef?: RefObject<HTMLButtonElement | null>;
+};
+
+export default function DeleteKeyDialog({
+  id,
+  name,
+  keyPrefix,
+  open,
+  onOpenChange,
+  triggerRef,
+}: DeleteKeyDialogProps) {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+  const deleteMutation = useDeleteAgentApiKeyMutation();
+
+  const handleDelete = () => {
+    deleteMutation.mutate(id, {
+      onSuccess: () => {
+        showToast({ message: localize('com_ui_api_key_deleted'), status: 'success' });
+        onOpenChange(false);
+      },
+      onError: () => {
+        showToast({ message: localize('com_ui_api_key_delete_error'), status: 'error' });
+      },
+    });
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange} triggerRef={triggerRef}>
+      <OGDialogTemplate
+        showCloseButton={false}
+        title={localize('com_ui_delete_api_key')}
+        className="max-w-[450px]"
+        main={
+          <div className="space-y-3 text-left">
+            <p className="text-sm text-text-primary">
+              {localize('com_ui_api_key_delete_confirm', { 0: name })}
+            </p>
+            <div className="flex items-center rounded-lg border border-border-light bg-surface-secondary px-3 py-2">
+              <code className="break-all font-mono text-xs text-text-secondary">{keyPrefix}…</code>
+            </div>
+            <p className="text-sm text-text-secondary">
+              {localize('com_ui_api_key_delete_warning')}
+            </p>
+          </div>
+        }
+        selection={{
+          selectHandler: handleDelete,
+          selectClasses:
+            'bg-surface-destructive text-white transition-all duration-200 hover:bg-surface-destructive-hover',
+          selectText: deleteMutation.isLoading ? <Spinner /> : localize('com_ui_delete'),
+        }}
+      />
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/Item.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/Item.tsx
new file mode 100644
index 00000000000..ff8a5718f8c
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/Item.tsx
@@ -0,0 +1,79 @@
+import { useRef, useState } from 'react';
+import { Trash2 } from 'lucide-react';
+import { Button } from '@librechat/client';
+import type { TAgentApiKeyListItem } from 'librechat-data-provider';
+import { formatDate, formatRelativeTime, getExpiryStatus } from './utils';
+import DeleteKeyDialog from './DeleteKeyDialog';
+import { useLocalize } from '~/hooks';
+
+type ItemProps = {
+  apiKey: TAgentApiKeyListItem;
+};
+
+export default function Item({ apiKey }: ItemProps) {
+  const localize = useLocalize();
+  const deleteButtonRef = useRef<HTMLButtonElement | null>(null);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+
+  const status = getExpiryStatus(apiKey.expiresAt);
+
+  return (
+    <li className="hover:bg-surface-secondary/50 group flex items-start justify-between gap-3 px-4 py-3 transition-colors first:rounded-t-xl last:rounded-b-xl">
+      <div className="min-w-0 flex-1 space-y-1">
+        <div className="flex items-center gap-2">
+          <span className="truncate font-medium text-text-primary">{apiKey.name}</span>
+          {status?.state === 'expired' && (
+            <span className="shrink-0 rounded-full border border-red-500/20 bg-red-500/10 px-2 py-0.5 text-xs font-medium text-red-600 dark:text-red-400">
+              {localize('com_ui_api_key_expired')}
+            </span>
+          )}
+          {status?.state === 'expiring' && (
+            <span className="shrink-0 rounded-full border border-amber-500/20 bg-amber-500/10 px-2 py-0.5 text-xs font-medium text-amber-600 dark:text-amber-500">
+              {status.days === 1
+                ? localize('com_ui_api_key_expires_in_day')
+                : localize('com_ui_api_key_expires_in_days', { 0: status.days })}
+            </span>
+          )}
+        </div>
+        <div className="flex flex-wrap items-center gap-x-2 gap-y-0.5 text-xs text-text-secondary">
+          <code className="font-mono">{apiKey.keyPrefix}…</code>
+          <span aria-hidden="true" className="text-text-tertiary">
+            ·
+          </span>
+          <span>
+            {apiKey.lastUsedAt
+              ? localize('com_ui_api_key_last_used', { 0: formatRelativeTime(apiKey.lastUsedAt) })
+              : localize('com_ui_api_key_never_used')}
+          </span>
+          <span aria-hidden="true" className="text-text-tertiary">
+            ·
+          </span>
+          <span>
+            {apiKey.expiresAt
+              ? localize('com_ui_api_key_expires_on', { 0: formatDate(apiKey.expiresAt) })
+              : localize('com_ui_api_key_no_expiration')}
+          </span>
+        </div>
+      </div>
+      <Button
+        ref={deleteButtonRef}
+        variant="destructive"
+        size="icon"
+        onClick={() => setDeleteOpen(true)}
+        aria-label={localize('com_ui_api_key_delete_name', { 0: apiKey.name })}
+        aria-haspopup="dialog"
+        className="size-8 shrink-0 self-center"
+      >
+        <Trash2 className="icon-sm" aria-hidden="true" />
+      </Button>
+      <DeleteKeyDialog
+        id={apiKey.id}
+        name={apiKey.name}
+        keyPrefix={apiKey.keyPrefix}
+        open={deleteOpen}
+        onOpenChange={setDeleteOpen}
+        triggerRef={deleteButtonRef}
+      />
+    </li>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/List.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/List.tsx
new file mode 100644
index 00000000000..28e6327b0a9
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/List.tsx
@@ -0,0 +1,73 @@
+import { Plus, KeyRound } from 'lucide-react';
+import { Button, Spinner } from '@librechat/client';
+import { useGetAgentApiKeysQuery } from 'librechat-data-provider/react-query';
+import { useLocalize } from '~/hooks';
+import Item from './Item';
+
+type ListProps = {
+  onCreate: () => void;
+  headingId?: string;
+};
+
+export default function List({ onCreate, headingId }: ListProps) {
+  const localize = useLocalize();
+  const { data, isLoading, isError, isFetching, refetch } = useGetAgentApiKeysQuery();
+
+  if (isLoading) {
+    return (
+      <div
+        data-testid="api-keys-loading"
+        className="flex items-center justify-center rounded-xl border border-border-light py-12"
+      >
+        <Spinner className="h-6 w-6 text-text-secondary" />
+      </div>
+    );
+  }
+
+  if (isError && data == null) {
+    return (
+      <div className="flex flex-col items-center gap-3 rounded-xl border border-border-light px-6 py-10 text-center">
+        <p className="text-sm text-text-secondary">{localize('com_ui_api_keys_load_error')}</p>
+        <Button variant="outline" size="sm" onClick={() => refetch()} disabled={isFetching}>
+          {localize('com_ui_retry')}
+        </Button>
+      </div>
+    );
+  }
+
+  const keys = data?.keys ?? [];
+
+  if (keys.length === 0) {
+    return (
+      <div className="flex flex-col items-center gap-3 rounded-xl border border-border-light px-6 py-12 text-center">
+        <span className="flex h-12 w-12 items-center justify-center rounded-full bg-surface-secondary text-text-secondary">
+          <KeyRound className="h-5 w-5" aria-hidden="true" />
+        </span>
+        <div className="space-y-1">
+          <h3 className="text-sm font-medium text-text-primary">
+            {localize('com_ui_api_keys_empty_title')}
+          </h3>
+          <p className="mx-auto max-w-xs text-sm text-text-secondary">
+            {localize('com_ui_api_keys_empty_text')}
+          </p>
+        </div>
+        <Button size="sm" className="mt-1 gap-1.5" onClick={onCreate}>
+          <Plus className="h-4 w-4" aria-hidden="true" />
+          {localize('com_ui_create_api_key')}
+        </Button>
+      </div>
+    );
+  }
+
+  return (
+    <ul
+      className="divide-y divide-border-light overflow-hidden rounded-xl border border-border-light"
+      aria-labelledby={headingId}
+      aria-label={headingId == null ? localize('com_ui_agent_api_keys') : undefined}
+    >
+      {keys.map((apiKey) => (
+        <Item key={apiKey.id} apiKey={apiKey} />
+      ))}
+    </ul>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/Reveal.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/Reveal.tsx
new file mode 100644
index 00000000000..f4e15cd03f2
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/Reveal.tsx
@@ -0,0 +1,47 @@
+import { useState } from 'react';
+import { TriangleAlert } from 'lucide-react';
+import { Button, Label, SecretInput } from '@librechat/client';
+import type { TAgentApiKeyCreateResponse } from 'librechat-data-provider';
+import CopyButton from '~/components/Messages/Content/CopyButton';
+import { useLocalize, useCopyToClipboard } from '~/hooks';
+
+type RevealProps = {
+  createdKey: TAgentApiKeyCreateResponse;
+  onDone: () => void;
+};
+
+export default function Reveal({ createdKey, onDone }: RevealProps) {
+  const localize = useLocalize();
+  const [isCopied, setIsCopied] = useState(false);
+  const copyToClipboard = useCopyToClipboard({ text: createdKey.key });
+
+  return (
+    <div className="min-w-0 space-y-4">
+      <div className="flex gap-2.5 rounded-lg border border-amber-500/20 bg-amber-500/10 p-3">
+        <TriangleAlert
+          className="mt-0.5 h-4 w-4 shrink-0 text-amber-600 dark:text-amber-500"
+          aria-hidden="true"
+        />
+        <p className="text-sm text-amber-700 dark:text-amber-300">
+          {localize('com_ui_api_key_warning')}
+        </p>
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="reveal-api-key">{localize('com_ui_your_api_key')}</Label>
+        <SecretInput
+          id="reveal-api-key"
+          readOnly
+          value={createdKey.key}
+          className="font-mono"
+          aria-label={localize('com_ui_your_api_key')}
+          copyButton={
+            <CopyButton iconOnly isCopied={isCopied} onClick={() => copyToClipboard(setIsCopied)} />
+          }
+        />
+      </div>
+      <div className="flex justify-end">
+        <Button onClick={onDone}>{localize('com_ui_done')}</Button>
+      </div>
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/ApiKeys.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/ApiKeys.spec.tsx
new file mode 100644
index 00000000000..a803448f4b1
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/ApiKeys.spec.tsx
@@ -0,0 +1,99 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import {
+  useGetAgentApiKeysQuery,
+  useCreateAgentApiKeyMutation,
+  useDeleteAgentApiKeyMutation,
+} from 'librechat-data-provider/react-query';
+import { render, fireEvent, waitFor } from 'test/layout-test-utils';
+import ApiKeys from '../ApiKeys';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useGetAgentApiKeysQuery: jest.fn(),
+  useCreateAgentApiKeyMutation: jest.fn(),
+  useDeleteAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockQuery = useGetAgentApiKeysQuery as jest.Mock;
+const mockCreate = useCreateAgentApiKeyMutation as jest.Mock;
+const mockDelete = useDeleteAgentApiKeyMutation as jest.Mock;
+
+const createdKey = {
+  id: 'new-1',
+  name: 'CI key',
+  key: 'lc-secret-full-key',
+  keyPrefix: 'lc-secret',
+  createdAt: '2026-06-13T00:00:00Z',
+};
+
+function openManageDialog() {
+  const utils = render(<ApiKeys />);
+  fireEvent.click(utils.getByRole('button', { name: 'Agent API Keys' }));
+  return utils;
+}
+
+describe('ApiKeys', () => {
+  beforeEach(() => {
+    mockQuery.mockReturnValue({
+      data: { keys: [] },
+      isLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: jest.fn(),
+    });
+    mockCreate.mockReturnValue({
+      mutateAsync: jest.fn().mockResolvedValue(createdKey),
+      isLoading: false,
+    });
+    mockDelete.mockReturnValue({ mutateAsync: jest.fn(), isLoading: false });
+  });
+
+  it('renders a manage trigger without opening the dialog', () => {
+    const { getByText, getByRole, queryByRole } = render(<ApiKeys />);
+    expect(getByText('Manage')).toBeInTheDocument();
+    expect(getByRole('button', { name: 'Agent API Keys' })).toBeInTheDocument();
+    expect(queryByRole('heading', { name: 'Agent API Keys' })).not.toBeInTheDocument();
+  });
+
+  it('opens the management dialog with the empty state', () => {
+    const { getByText } = openManageDialog();
+    expect(getByText('Connect your agents to external apps')).toBeInTheDocument();
+  });
+
+  it('opens the create dialog from within the management dialog', () => {
+    const { getAllByRole, getByRole } = openManageDialog();
+    fireEvent.click(getAllByRole('button', { name: 'Create API Key' })[0]);
+    expect(getByRole('heading', { name: 'Create API Key' })).toBeInTheDocument();
+  });
+
+  it('walks through create -> reveal -> close', async () => {
+    const { getAllByRole, getByRole, getByLabelText, getByDisplayValue, queryByRole } =
+      openManageDialog();
+    fireEvent.click(getAllByRole('button', { name: 'Create API Key' })[0]);
+
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: 'CI key' } });
+    fireEvent.click(getByRole('button', { name: 'Create' }));
+
+    await waitFor(() =>
+      expect(getByRole('heading', { name: 'API key created successfully' })).toBeInTheDocument(),
+    );
+    expect(getByDisplayValue('lc-secret-full-key')).toBeInTheDocument();
+
+    fireEvent.click(getByRole('button', { name: 'Done' }));
+    await waitFor(() =>
+      expect(
+        queryByRole('heading', { name: 'API key created successfully' }),
+      ).not.toBeInTheDocument(),
+    );
+  });
+
+  it('closes the create dialog on cancel without creating a key', () => {
+    const mutateAsync = jest.fn();
+    mockCreate.mockReturnValue({ mutateAsync, isLoading: false });
+    const { getAllByRole, getByRole } = openManageDialog();
+    fireEvent.click(getAllByRole('button', { name: 'Create API Key' })[0]);
+    fireEvent.click(getByRole('button', { name: 'Cancel' }));
+    expect(mutateAsync).not.toHaveBeenCalled();
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Create.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Create.spec.tsx
new file mode 100644
index 00000000000..15a76827858
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Create.spec.tsx
@@ -0,0 +1,87 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import { useCreateAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import { render, fireEvent, waitFor } from 'test/layout-test-utils';
+import Create from '../Create';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useCreateAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockCreate = useCreateAgentApiKeyMutation as jest.Mock;
+
+const createdKey = {
+  id: 'new-1',
+  name: 'CI key',
+  key: 'lc-secret-full-key',
+  keyPrefix: 'lc-secret',
+  createdAt: '2026-06-13T00:00:00Z',
+};
+
+describe('Create', () => {
+  let mutateAsync: jest.Mock;
+
+  beforeEach(() => {
+    mutateAsync = jest.fn().mockResolvedValue(createdKey);
+    mockCreate.mockReturnValue({ mutateAsync, isLoading: false });
+  });
+
+  it('keeps Create disabled until a non-empty name is entered', () => {
+    const { getByRole, getByLabelText } = render(
+      <Create onCreated={jest.fn()} onCancel={jest.fn()} />,
+    );
+    expect(getByRole('button', { name: 'Create' })).toBeDisabled();
+
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: '   ' } });
+    expect(getByRole('button', { name: 'Create' })).toBeDisabled();
+
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: 'CI key' } });
+    expect(getByRole('button', { name: 'Create' })).toBeEnabled();
+    expect(mutateAsync).not.toHaveBeenCalled();
+  });
+
+  it('submits the trimmed name with the default 30-day expiration', async () => {
+    const onCreated = jest.fn();
+    const { getByRole, getByLabelText } = render(
+      <Create onCreated={onCreated} onCancel={jest.fn()} />,
+    );
+
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: '  CI key  ' } });
+    fireEvent.click(getByRole('button', { name: 'Create' }));
+
+    await waitFor(() => expect(onCreated).toHaveBeenCalledWith(createdKey));
+
+    const payload = mutateAsync.mock.calls[0][0];
+    expect(payload.name).toBe('CI key');
+    const diffDays = (new Date(payload.expiresAt).getTime() - Date.now()) / 86400000;
+    expect(diffDays).toBeGreaterThan(29.9);
+    expect(diffDays).toBeLessThanOrEqual(30.1);
+  });
+
+  it('calls onCancel from the cancel button', () => {
+    const onCancel = jest.fn();
+    const { getByRole } = render(<Create onCreated={jest.fn()} onCancel={onCancel} />);
+    fireEvent.click(getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not call onCreated when creation fails', async () => {
+    mutateAsync.mockRejectedValue(new Error('boom'));
+    const onCreated = jest.fn();
+    const { getByRole, getByLabelText } = render(
+      <Create onCreated={onCreated} onCancel={jest.fn()} />,
+    );
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: 'CI key' } });
+    fireEvent.click(getByRole('button', { name: 'Create' }));
+    await waitFor(() => expect(mutateAsync).toHaveBeenCalled());
+    expect(onCreated).not.toHaveBeenCalled();
+  });
+
+  it('disables actions while creating', () => {
+    mockCreate.mockReturnValue({ mutateAsync, isLoading: true });
+    const { getByRole } = render(<Create onCreated={jest.fn()} onCancel={jest.fn()} />);
+    expect(getByRole('button', { name: 'Create' })).toBeDisabled();
+    expect(getByRole('button', { name: 'Cancel' })).toBeDisabled();
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/CreateKeyDialog.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/CreateKeyDialog.spec.tsx
new file mode 100644
index 00000000000..9c30c06e303
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/CreateKeyDialog.spec.tsx
@@ -0,0 +1,61 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import { useCreateAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import { render, fireEvent, waitFor } from 'test/layout-test-utils';
+import CreateKeyDialog from '../CreateKeyDialog';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useCreateAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockCreate = useCreateAgentApiKeyMutation as jest.Mock;
+
+const createdKey = {
+  id: 'new-1',
+  name: 'CI key',
+  key: 'lc-secret-full-key',
+  keyPrefix: 'lc-secret',
+  createdAt: '2026-06-13T00:00:00Z',
+};
+
+describe('CreateKeyDialog', () => {
+  let mutateAsync: jest.Mock;
+
+  beforeEach(() => {
+    mutateAsync = jest.fn().mockResolvedValue(createdKey);
+    mockCreate.mockReturnValue({ mutateAsync, isLoading: false });
+  });
+
+  it('renders nothing when closed', () => {
+    const { queryByRole } = render(<CreateKeyDialog open={false} onOpenChange={jest.fn()} />);
+    expect(queryByRole('heading', { name: 'Create API Key' })).not.toBeInTheDocument();
+  });
+
+  it('creates a key, reveals it, and closes on done', async () => {
+    const onOpenChange = jest.fn();
+    const { getByRole, getByLabelText, getByDisplayValue } = render(
+      <CreateKeyDialog open onOpenChange={onOpenChange} />,
+    );
+
+    expect(getByRole('heading', { name: 'Create API Key' })).toBeInTheDocument();
+
+    fireEvent.change(getByLabelText('Key Name'), { target: { value: 'CI key' } });
+    fireEvent.click(getByRole('button', { name: 'Create' }));
+
+    await waitFor(() =>
+      expect(getByRole('heading', { name: 'API key created successfully' })).toBeInTheDocument(),
+    );
+    expect(getByDisplayValue('lc-secret-full-key')).toBeInTheDocument();
+
+    fireEvent.click(getByRole('button', { name: 'Done' }));
+    expect(onOpenChange).toHaveBeenCalledWith(false);
+  });
+
+  it('cancels without creating', () => {
+    const onOpenChange = jest.fn();
+    const { getByRole } = render(<CreateKeyDialog open onOpenChange={onOpenChange} />);
+    fireEvent.click(getByRole('button', { name: 'Cancel' }));
+    expect(onOpenChange).toHaveBeenCalledWith(false);
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/DeleteKeyDialog.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/DeleteKeyDialog.spec.tsx
new file mode 100644
index 00000000000..63dfb280221
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/DeleteKeyDialog.spec.tsx
@@ -0,0 +1,56 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import { useDeleteAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import { render, fireEvent, waitFor } from 'test/layout-test-utils';
+import DeleteKeyDialog from '../DeleteKeyDialog';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useDeleteAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockDelete = useDeleteAgentApiKeyMutation as jest.Mock;
+
+describe('DeleteKeyDialog', () => {
+  let mutate: jest.Mock;
+
+  beforeEach(() => {
+    mutate = jest.fn();
+    mockDelete.mockReturnValue({ mutate, isLoading: false });
+  });
+
+  it('renders nothing actionable while closed', () => {
+    const { queryByText } = render(
+      <DeleteKeyDialog
+        id="key-1"
+        name="CI Pipeline"
+        keyPrefix="lc-abc123"
+        open={false}
+        onOpenChange={jest.fn()}
+      />,
+    );
+    expect(queryByText(/This action cannot be undone/)).not.toBeInTheDocument();
+    expect(mutate).not.toHaveBeenCalled();
+  });
+
+  it('shows the key details and deletes on confirm', async () => {
+    mutate.mockImplementation((id, opts) => opts?.onSuccess?.());
+    const onOpenChange = jest.fn();
+    const { getByRole, getByText } = render(
+      <DeleteKeyDialog
+        id="key-1"
+        name="CI Pipeline"
+        keyPrefix="lc-abc123"
+        open
+        onOpenChange={onOpenChange}
+      />,
+    );
+
+    expect(getByText(/This action cannot be undone/)).toBeInTheDocument();
+    expect(getByText(/lc-abc123/)).toBeInTheDocument();
+
+    fireEvent.click(getByRole('button', { name: 'Delete' }));
+    await waitFor(() => expect(mutate).toHaveBeenCalledWith('key-1', expect.any(Object)));
+    expect(onOpenChange).toHaveBeenCalledWith(false);
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Item.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Item.spec.tsx
new file mode 100644
index 00000000000..af7bcf63b38
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Item.spec.tsx
@@ -0,0 +1,68 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import { useDeleteAgentApiKeyMutation } from 'librechat-data-provider/react-query';
+import type { TAgentApiKeyListItem } from 'librechat-data-provider';
+import { render, fireEvent } from 'test/layout-test-utils';
+import Item from '../Item';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useDeleteAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockDelete = useDeleteAgentApiKeyMutation as jest.Mock;
+
+const baseKey: TAgentApiKeyListItem = {
+  id: 'key-1',
+  name: 'CI Pipeline',
+  keyPrefix: 'lc-abc123',
+  createdAt: '2026-06-01T00:00:00Z',
+};
+
+function renderItem(apiKey = baseKey) {
+  return render(
+    <ul>
+      <Item apiKey={apiKey} />
+    </ul>,
+  );
+}
+
+beforeEach(() => {
+  mockDelete.mockReturnValue({ mutate: jest.fn(), isLoading: false });
+});
+
+describe('Item', () => {
+  it('renders the name, prefix, and readable metadata', () => {
+    const { getByText } = renderItem();
+    expect(getByText('CI Pipeline')).toBeInTheDocument();
+    expect(getByText(/lc-abc123/)).toBeInTheDocument();
+    expect(getByText(/Never used/)).toBeInTheDocument();
+    expect(getByText(/No expiration/)).toBeInTheDocument();
+  });
+
+  it('shows the expiring badge within 14 days', () => {
+    const expiresAt = new Date(Date.now() + 5 * 86400000).toISOString();
+    const { getByText } = renderItem({ ...baseKey, expiresAt });
+    expect(getByText(/Expires in \d+ days/)).toBeInTheDocument();
+  });
+
+  it('uses the singular badge at exactly 1 day', () => {
+    const expiresAt = new Date(Date.now() + 12 * 3600000).toISOString();
+    const { getByText } = renderItem({ ...baseKey, expiresAt });
+    expect(getByText('Expires in 1 day')).toBeInTheDocument();
+  });
+
+  it('shows the expired badge for past expiry', () => {
+    const { getByText } = renderItem({ ...baseKey, expiresAt: '2020-01-01T00:00:00Z' });
+    expect(getByText('Expired')).toBeInTheDocument();
+  });
+
+  it('exposes a labelled delete button that opens the delete dialog', async () => {
+    const { getByRole, findByText } = renderItem();
+    const deleteButton = getByRole('button', { name: 'Delete API key CI Pipeline' });
+    expect(deleteButton).toBeInTheDocument();
+
+    fireEvent.click(deleteButton);
+    expect(await findByText(/This action cannot be undone/)).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/List.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/List.spec.tsx
new file mode 100644
index 00000000000..9f51af29bac
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/List.spec.tsx
@@ -0,0 +1,102 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import {
+  useGetAgentApiKeysQuery,
+  useDeleteAgentApiKeyMutation,
+} from 'librechat-data-provider/react-query';
+import { render, fireEvent } from 'test/layout-test-utils';
+import List from '../List';
+
+jest.mock('librechat-data-provider/react-query', () => ({
+  ...jest.requireActual('librechat-data-provider/react-query'),
+  useGetAgentApiKeysQuery: jest.fn(),
+  useDeleteAgentApiKeyMutation: jest.fn(),
+}));
+
+const mockQuery = useGetAgentApiKeysQuery as jest.Mock;
+const mockDelete = useDeleteAgentApiKeyMutation as jest.Mock;
+
+function renderList(props: Partial<React.ComponentProps<typeof List>> = {}) {
+  return render(<List onCreate={jest.fn()} {...props} />);
+}
+
+describe('List', () => {
+  beforeEach(() => {
+    mockDelete.mockReturnValue({ mutateAsync: jest.fn(), isLoading: false });
+    mockQuery.mockReturnValue({
+      data: { keys: [] },
+      isLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: jest.fn(),
+    });
+  });
+
+  it('shows a loading indicator', () => {
+    mockQuery.mockReturnValue({
+      data: undefined,
+      isLoading: true,
+      isError: false,
+      refetch: jest.fn(),
+    });
+    const { getByTestId } = renderList();
+    expect(getByTestId('api-keys-loading')).toBeInTheDocument();
+  });
+
+  it('shows the error state and retries', () => {
+    const refetch = jest.fn();
+    mockQuery.mockReturnValue({
+      data: undefined,
+      isLoading: false,
+      isError: true,
+      isFetching: false,
+      refetch,
+    });
+    const { getByText, getByRole } = renderList();
+    expect(getByText('Failed to load API keys')).toBeInTheDocument();
+    fireEvent.click(getByRole('button', { name: 'Retry' }));
+    expect(refetch).toHaveBeenCalled();
+  });
+
+  it('shows the onboarding empty state with a create CTA', () => {
+    const onCreate = jest.fn();
+    const { getByText, getByRole } = renderList({ onCreate });
+    expect(getByText('Connect your agents to external apps')).toBeInTheDocument();
+    fireEvent.click(getByRole('button', { name: 'Create API Key' }));
+    expect(onCreate).toHaveBeenCalled();
+  });
+
+  it('renders a semantic list of keys', () => {
+    mockQuery.mockReturnValue({
+      data: {
+        keys: [
+          { id: '1', name: 'Alpha', keyPrefix: 'lc-aaa', createdAt: '2026-01-01T00:00:00Z' },
+          { id: '2', name: 'Beta', keyPrefix: 'lc-bbb', createdAt: '2026-02-01T00:00:00Z' },
+        ],
+      },
+      isLoading: false,
+      isError: false,
+      isFetching: false,
+      refetch: jest.fn(),
+    });
+    const { getByRole, getByText } = renderList();
+    expect(getByRole('list', { name: 'Agent API Keys' })).toBeInTheDocument();
+    expect(getByText('Alpha')).toBeInTheDocument();
+    expect(getByText('Beta')).toBeInTheDocument();
+  });
+
+  it('keeps showing cached keys when a background refetch fails', () => {
+    mockQuery.mockReturnValue({
+      data: {
+        keys: [{ id: '1', name: 'Alpha', keyPrefix: 'lc-aaa', createdAt: '2026-01-01T00:00:00Z' }],
+      },
+      isLoading: false,
+      isError: true,
+      isFetching: false,
+      refetch: jest.fn(),
+    });
+    const { getByText, queryByText } = renderList();
+    expect(getByText('Alpha')).toBeInTheDocument();
+    expect(queryByText('Failed to load API keys')).not.toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Reveal.spec.tsx b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Reveal.spec.tsx
new file mode 100644
index 00000000000..55772807037
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/Reveal.spec.tsx
@@ -0,0 +1,45 @@
+import React from 'react';
+import '@testing-library/jest-dom/extend-expect';
+import { render, fireEvent } from 'test/layout-test-utils';
+import Reveal from '../Reveal';
+
+const createdKey = {
+  id: 'new-1',
+  name: 'CI key',
+  key: 'lc-secret-full-key',
+  keyPrefix: 'lc-secret',
+  createdAt: '2026-06-13T00:00:00Z',
+};
+
+describe('Reveal', () => {
+  it('shows the one-time warning and the key value', () => {
+    const { getByText, getByDisplayValue } = render(
+      <Reveal createdKey={createdKey} onDone={jest.fn()} />,
+    );
+    expect(getByText(/You won't be able to see it again/)).toBeInTheDocument();
+    expect(getByDisplayValue('lc-secret-full-key')).toBeInTheDocument();
+  });
+
+  it('hides the key by default behind a password field', () => {
+    const { getByDisplayValue } = render(<Reveal createdKey={createdKey} onDone={jest.fn()} />);
+    expect(getByDisplayValue('lc-secret-full-key')).toHaveAttribute('type', 'password');
+  });
+
+  it('calls onDone', () => {
+    const onDone = jest.fn();
+    const { getByRole } = render(<Reveal createdKey={createdKey} onDone={onDone} />);
+    fireEvent.click(getByRole('button', { name: 'Done' }));
+    expect(onDone).toHaveBeenCalled();
+  });
+
+  it('renders the standardized copy control inside the input', () => {
+    const { getByRole } = render(<Reveal createdKey={createdKey} onDone={jest.fn()} />);
+    expect(getByRole('button', { name: 'Copy' })).toBeInTheDocument();
+  });
+
+  it('shows copied feedback after clicking copy', async () => {
+    const { getByRole, findByRole } = render(<Reveal createdKey={createdKey} onDone={jest.fn()} />);
+    fireEvent.click(getByRole('button', { name: 'Copy' }));
+    expect(await findByRole('button', { name: /Copied/ })).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/utils.spec.ts b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/utils.spec.ts
new file mode 100644
index 00000000000..f41cdb00152
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/__tests__/utils.spec.ts
@@ -0,0 +1,61 @@
+import {
+  computeExpiresAt,
+  getExpiryStatus,
+  formatDate,
+  EXPIRY_NEVER,
+  DEFAULT_EXPIRY,
+} from '../utils';
+
+describe('computeExpiresAt', () => {
+  it('returns null for the never option', () => {
+    expect(computeExpiresAt(EXPIRY_NEVER)).toBeNull();
+  });
+
+  it('returns an ISO date the given number of days ahead', () => {
+    const result = computeExpiresAt('7');
+    expect(result).not.toBeNull();
+    const diffDays = (new Date(result as string).getTime() - Date.now()) / 86400000;
+    expect(diffDays).toBeGreaterThan(6.9);
+    expect(diffDays).toBeLessThanOrEqual(7.1);
+  });
+
+  it('returns null for non-numeric input', () => {
+    expect(computeExpiresAt('abc')).toBeNull();
+  });
+});
+
+describe('getExpiryStatus', () => {
+  const now = new Date('2026-06-13T12:00:00Z');
+
+  it('returns null when there is no expiration', () => {
+    expect(getExpiryStatus(undefined, now)).toBeNull();
+  });
+
+  it('returns null when expiration is more than 14 days away', () => {
+    expect(getExpiryStatus('2026-12-01T00:00:00Z', now)).toBeNull();
+  });
+
+  it('returns expiring with day count within 14 days', () => {
+    expect(getExpiryStatus('2026-06-18T12:00:00Z', now)).toEqual({ state: 'expiring', days: 5 });
+  });
+
+  it('returns expired for past dates', () => {
+    expect(getExpiryStatus('2026-06-01T00:00:00Z', now)).toEqual({ state: 'expired' });
+  });
+});
+
+describe('formatDate', () => {
+  it('formats a valid ISO date', () => {
+    expect(formatDate('2026-06-01T00:00:00Z')).toContain('2026');
+  });
+
+  it('returns an empty string for invalid input', () => {
+    expect(formatDate('garbage')).toBe('');
+  });
+});
+
+describe('DEFAULT_EXPIRY', () => {
+  it('is 30 days', () => {
+    expect(DEFAULT_EXPIRY).toBe('30');
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/index.ts b/client/src/components/Nav/SettingsTabs/ApiKeys/index.ts
new file mode 100644
index 00000000000..176b46e5da7
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/index.ts
@@ -0,0 +1 @@
+export { default } from './ApiKeys';
diff --git a/client/src/components/Nav/SettingsTabs/ApiKeys/utils.ts b/client/src/components/Nav/SettingsTabs/ApiKeys/utils.ts
new file mode 100644
index 00000000000..5b96aad32a2
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ApiKeys/utils.ts
@@ -0,0 +1,65 @@
+import { formatDistanceToNow } from 'date-fns';
+
+import type { TranslationKeys } from '~/hooks';
+
+export const EXPIRY_NEVER = 'never';
+export const DEFAULT_EXPIRY = '30';
+
+export const EXPIRY_OPTIONS: { value: string; labelKey: TranslationKeys }[] = [
+  { value: '7', labelKey: 'com_ui_api_key_expire_7d' },
+  { value: '30', labelKey: 'com_ui_api_key_expire_30d' },
+  { value: '90', labelKey: 'com_ui_api_key_expire_90d' },
+  { value: '365', labelKey: 'com_ui_api_key_expire_1y' },
+  { value: EXPIRY_NEVER, labelKey: 'com_ui_api_key_expire_never' },
+];
+
+const MS_PER_DAY = 86400000;
+const EXPIRING_THRESHOLD_DAYS = 14;
+
+export function computeExpiresAt(option: string): string | null {
+  if (option === EXPIRY_NEVER) {
+    return null;
+  }
+  const days = Number(option);
+  if (!Number.isFinite(days) || days <= 0) {
+    return null;
+  }
+  return new Date(Date.now() + days * MS_PER_DAY).toISOString();
+}
+
+export function formatDate(dateStr: string): string {
+  const date = new Date(dateStr);
+  if (isNaN(date.getTime())) {
+    return '';
+  }
+  return date.toLocaleDateString(undefined, {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+  });
+}
+
+export function formatRelativeTime(dateStr: string): string {
+  const date = new Date(dateStr);
+  if (isNaN(date.getTime())) {
+    return '';
+  }
+  return formatDistanceToNow(date, { addSuffix: true });
+}
+
+export type ExpiryStatus = { state: 'expired' } | { state: 'expiring'; days: number } | null;
+
+export function getExpiryStatus(expiresAt?: string, now: Date = new Date()): ExpiryStatus {
+  if (!expiresAt) {
+    return null;
+  }
+  const diffMs = new Date(expiresAt).getTime() - now.getTime();
+  if (diffMs <= 0) {
+    return { state: 'expired' };
+  }
+  const days = Math.ceil(diffMs / MS_PER_DAY);
+  if (days <= EXPIRING_THRESHOLD_DAYS) {
+    return { state: 'expiring', days };
+  }
+  return null;
+}
diff --git a/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx b/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx
deleted file mode 100644
index 18b4368e0ba..00000000000
--- a/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-import React from 'react';
-import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
-import { useAuthContext, useLocalize } from '~/hooks';
-import TokenCreditsItem from './TokenCreditsItem';
-import AutoRefillSettings from './AutoRefillSettings';
-
-function Balance() {
-  const localize = useLocalize();
-  const { isAuthenticated } = useAuthContext();
-  const { data: startupConfig } = useGetStartupConfig();
-
-  const balanceQuery = useGetUserBalance({
-    enabled: !!isAuthenticated && !!startupConfig?.balance?.enabled,
-  });
-  const balanceData = balanceQuery.data;
-
-  // Pull out all the fields we need, with safe defaults
-  const {
-    tokenCredits = 0,
-    autoRefillEnabled = false,
-    lastRefill,
-    refillAmount,
-    refillIntervalUnit,
-    refillIntervalValue,
-  } = balanceData ?? {};
-
-  // Check that all auto-refill props are present
-  const hasValidRefillSettings =
-    lastRefill !== undefined &&
-    refillAmount !== undefined &&
-    refillIntervalUnit !== undefined &&
-    refillIntervalValue !== undefined;
-
-  return (
-    <div className="flex flex-col gap-4 p-4 text-sm text-text-primary">
-      {/* Token credits display */}
-      <TokenCreditsItem tokenCredits={tokenCredits} />
-
-      {/* Auto-refill display */}
-      {autoRefillEnabled ? (
-        hasValidRefillSettings ? (
-          <AutoRefillSettings
-            lastRefill={lastRefill}
-            refillAmount={refillAmount}
-            refillIntervalUnit={refillIntervalUnit}
-            refillIntervalValue={refillIntervalValue}
-          />
-        ) : (
-          <div className="text-sm text-red-600">
-            {localize('com_nav_balance_auto_refill_error')}
-          </div>
-        )
-      ) : (
-        <div className="text-sm text-gray-600">
-          {localize('com_nav_balance_auto_refill_disabled')}
-        </div>
-      )}
-    </div>
-  );
-}
-
-export default React.memo(Balance);
diff --git a/client/src/components/Nav/SettingsTabs/Chat/Chat.tsx b/client/src/components/Nav/SettingsTabs/Chat/Chat.tsx
deleted file mode 100644
index 5f821d3d8ce..00000000000
--- a/client/src/components/Nav/SettingsTabs/Chat/Chat.tsx
+++ /dev/null
@@ -1,131 +0,0 @@
-import { memo } from 'react';
-import { showThinkingAtom } from '~/store/showThinking';
-import AdvancedPrompts from './AdvancedPrompts';
-import FontSizeSelector from './FontSizeSelector';
-import { ForkSettings } from './ForkSettings';
-import ChatDirection from './ChatDirection';
-import ToggleSwitch from '../ToggleSwitch';
-import store from '~/store';
-
-const toggleSwitchConfigs = [
-  {
-    stateAtom: store.alwaysMakeProd,
-    localizationKey: 'com_nav_always_make_prod' as const,
-    switchId: 'alwaysMakeProd',
-    hoverCardText: undefined,
-    key: 'alwaysMakeProd',
-  },
-  {
-    stateAtom: store.autoSendPrompts,
-    localizationKey: 'com_nav_auto_send_prompts' as const,
-    switchId: 'autoSendPrompts',
-    hoverCardText: 'com_nav_auto_send_prompts_desc' as const,
-    key: 'autoSendPrompts',
-  },
-  {
-    stateAtom: store.enterToSend,
-    localizationKey: 'com_nav_enter_to_send' as const,
-    switchId: 'enterToSend',
-    hoverCardText: 'com_nav_info_enter_to_send' as const,
-    key: 'enterToSend',
-  },
-  {
-    stateAtom: store.maximizeChatSpace,
-    localizationKey: 'com_nav_maximize_chat_space' as const,
-    switchId: 'maximizeChatSpace',
-    hoverCardText: undefined,
-    key: 'maximizeChatSpace',
-  },
-  {
-    stateAtom: store.centerFormOnLanding,
-    localizationKey: 'com_nav_center_chat_input' as const,
-    switchId: 'centerFormOnLanding',
-    hoverCardText: undefined,
-    key: 'centerFormOnLanding',
-  },
-  {
-    stateAtom: showThinkingAtom,
-    localizationKey: 'com_nav_show_thinking' as const,
-    switchId: 'showThinking',
-    hoverCardText: undefined,
-    key: 'showThinking',
-  },
-  {
-    stateAtom: store.autoExpandTools,
-    localizationKey: 'com_nav_auto_expand_tools' as const,
-    switchId: 'autoExpandTools',
-    hoverCardText: undefined,
-    key: 'autoExpandTools',
-  },
-  {
-    stateAtom: store.LaTeXParsing,
-    localizationKey: 'com_nav_latex_parsing' as const,
-    switchId: 'latexParsing',
-    hoverCardText: 'com_nav_info_latex_parsing' as const,
-    key: 'latexParsing',
-  },
-  {
-    stateAtom: store.saveDrafts,
-    localizationKey: 'com_nav_save_drafts' as const,
-    switchId: 'saveDrafts',
-    hoverCardText: 'com_nav_info_save_draft' as const,
-    key: 'saveDrafts',
-  },
-  {
-    stateAtom: store.showScrollButton,
-    localizationKey: 'com_nav_scroll_button' as const,
-    switchId: 'showScrollButton',
-    hoverCardText: undefined,
-    key: 'showScrollButton',
-  },
-  {
-    stateAtom: store.saveBadgesState,
-    localizationKey: 'com_nav_save_badges_state' as const,
-    switchId: 'showBadges',
-    hoverCardText: 'com_nav_info_save_badges_state' as const,
-    key: 'showBadges',
-  },
-  {
-    stateAtom: store.modularChat,
-    localizationKey: 'com_nav_modular_chat' as const,
-    switchId: 'modularChat',
-    hoverCardText: undefined,
-    key: 'modularChat',
-  },
-  {
-    stateAtom: store.defaultTemporaryChat,
-    localizationKey: 'com_nav_default_temporary_chat' as const,
-    switchId: 'defaultTemporaryChat',
-    hoverCardText: 'com_nav_info_default_temporary_chat' as const,
-    key: 'defaultTemporaryChat',
-  },
-];
-
-function Chat() {
-  return (
-    <div className="flex flex-col gap-3 p-1 text-sm text-text-primary">
-      <div className="pb-3">
-        <FontSizeSelector />
-      </div>
-      <div className="pb-3">
-        <ChatDirection />
-      </div>
-      {toggleSwitchConfigs.map((config) => (
-        <div key={config.key} className="pb-3">
-          <ToggleSwitch
-            stateAtom={config.stateAtom}
-            localizationKey={config.localizationKey}
-            hoverCardText={config.hoverCardText}
-            switchId={config.switchId}
-          />
-        </div>
-      ))}
-      <div className="pb-3">
-        <AdvancedPrompts />
-      </div>
-      <ForkSettings />
-    </div>
-  );
-}
-
-export default memo(Chat);
diff --git a/client/src/components/Nav/SettingsTabs/Commands/Commands.tsx b/client/src/components/Nav/SettingsTabs/Commands/Commands.tsx
deleted file mode 100644
index ff04c9087bc..00000000000
--- a/client/src/components/Nav/SettingsTabs/Commands/Commands.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-import { memo } from 'react';
-import { InfoHoverCard, ESide } from '@librechat/client';
-import { PermissionTypes, Permissions } from 'librechat-data-provider';
-import { useLocalize, useHasAccess } from '~/hooks';
-import ToggleSwitch from '../ToggleSwitch';
-import store from '~/store';
-
-const commandSwitchConfigs = [
-  {
-    stateAtom: store.atCommand,
-    localizationKey: 'com_nav_at_command_description' as const,
-    switchId: 'atCommand',
-    key: 'atCommand',
-    permissionType: undefined,
-  },
-  {
-    stateAtom: store.plusCommand,
-    localizationKey: 'com_nav_plus_command_description' as const,
-    switchId: 'plusCommand',
-    key: 'plusCommand',
-    permissionType: PermissionTypes.MULTI_CONVO,
-  },
-  {
-    stateAtom: store.slashCommand,
-    localizationKey: 'com_nav_slash_command_description' as const,
-    switchId: 'slashCommand',
-    key: 'slashCommand',
-    permissionType: PermissionTypes.PROMPTS,
-  },
-] as const;
-
-function Commands() {
-  const localize = useLocalize();
-
-  const hasAccessToPrompts = useHasAccess({
-    permissionType: PermissionTypes.PROMPTS,
-    permission: Permissions.USE,
-  });
-
-  const hasAccessToMultiConvo = useHasAccess({
-    permissionType: PermissionTypes.MULTI_CONVO,
-    permission: Permissions.USE,
-  });
-
-  const getShowSwitch = (permissionType?: PermissionTypes) => {
-    if (!permissionType) {
-      return true;
-    }
-    if (permissionType === PermissionTypes.MULTI_CONVO) {
-      return hasAccessToMultiConvo === true;
-    }
-    if (permissionType === PermissionTypes.PROMPTS) {
-      return hasAccessToPrompts === true;
-    }
-    return true;
-  };
-
-  return (
-    <div className="space-y-4 p-1">
-      <div className="flex items-center gap-2">
-        <h3 className="text-lg font-medium text-text-primary">
-          {localize('com_nav_chat_commands')}
-        </h3>
-        <InfoHoverCard side={ESide.Bottom} text={localize('com_nav_chat_commands_info')} />
-      </div>
-      <div className="flex flex-col gap-3 text-sm text-text-primary">
-        {commandSwitchConfigs.map((config) => (
-          <div key={config.key} className="pb-3">
-            <ToggleSwitch
-              stateAtom={config.stateAtom}
-              localizationKey={config.localizationKey}
-              switchId={config.switchId}
-              showSwitch={getShowSwitch(config.permissionType)}
-            />
-          </div>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-export default memo(Commands);
diff --git a/client/src/components/Nav/SettingsTabs/Data/AgentApiKeys.tsx b/client/src/components/Nav/SettingsTabs/Data/AgentApiKeys.tsx
deleted file mode 100644
index f75b93526a9..00000000000
--- a/client/src/components/Nav/SettingsTabs/Data/AgentApiKeys.tsx
+++ /dev/null
@@ -1,362 +0,0 @@
-import React, { useState } from 'react';
-import {
-  useGetAgentApiKeysQuery,
-  useCreateAgentApiKeyMutation,
-  useDeleteAgentApiKeyMutation,
-} from 'librechat-data-provider/react-query';
-import { Permissions, PermissionTypes } from 'librechat-data-provider';
-import { Plus, Trash2, Copy, CopyCheck, Key, Eye, EyeOff, ShieldEllipsis } from 'lucide-react';
-import {
-  Button,
-  Input,
-  Label,
-  Spinner,
-  OGDialog,
-  OGDialogClose,
-  OGDialogTitle,
-  OGDialogHeader,
-  OGDialogContent,
-  OGDialogTrigger,
-  useToastContext,
-} from '@librechat/client';
-import type { PermissionConfig } from '~/components/ui';
-import { useUpdateRemoteAgentsPermissionsMutation } from '~/data-provider';
-import { useLocalize, useCopyToClipboard } from '~/hooks';
-import { AdminSettingsDialog } from '~/components/ui';
-
-function CreateKeyDialog({ onKeyCreated }: { onKeyCreated?: () => void }) {
-  const localize = useLocalize();
-  const { showToast } = useToastContext();
-  const [open, setOpen] = useState(false);
-  const [name, setName] = useState('');
-  const [newKey, setNewKey] = useState<string | null>(null);
-  const [showKey, setShowKey] = useState(false);
-  const [isCopying, setIsCopying] = useState(false);
-  const createMutation = useCreateAgentApiKeyMutation();
-  const copyKey = useCopyToClipboard({ text: newKey || '' });
-
-  const handleCreate = async () => {
-    if (!name.trim()) {
-      showToast({ message: localize('com_ui_api_key_name_required'), status: 'error' });
-      return;
-    }
-
-    try {
-      const result = await createMutation.mutateAsync({ name: name.trim() });
-      setNewKey(result.key);
-      showToast({ message: localize('com_ui_api_key_created'), status: 'success' });
-      onKeyCreated?.();
-    } catch {
-      showToast({ message: localize('com_ui_api_key_create_error'), status: 'error' });
-    }
-  };
-
-  const handleClose = () => {
-    setName('');
-    setNewKey(null);
-    setShowKey(false);
-    setOpen(false);
-  };
-
-  const handleCopy = () => {
-    if (isCopying) {
-      return;
-    }
-    copyKey(setIsCopying);
-    showToast({ message: localize('com_ui_api_key_copied'), status: 'success' });
-  };
-
-  return (
-    <OGDialog open={open} onOpenChange={setOpen}>
-      <OGDialogTrigger asChild>
-        <Button variant="outline" size="sm" className="gap-2">
-          <Plus className="h-4 w-4" />
-          {localize('com_ui_create_api_key')}
-        </Button>
-      </OGDialogTrigger>
-      <OGDialogContent className="max-w-md">
-        <OGDialogTitle>{localize('com_ui_create_api_key')}</OGDialogTitle>
-        <div className="space-y-4 py-4">
-          {!newKey ? (
-            <>
-              <div className="space-y-2">
-                <Label htmlFor="key-name">{localize('com_ui_api_key_name')}</Label>
-                <Input
-                  id="key-name"
-                  value={name}
-                  onChange={(e) => setName(e.target.value)}
-                  placeholder={localize('com_ui_api_key_name_placeholder')}
-                />
-              </div>
-              <div className="flex justify-end gap-2">
-                <OGDialogClose asChild>
-                  <Button variant="outline" onClick={handleClose}>
-                    {localize('com_ui_cancel')}
-                  </Button>
-                </OGDialogClose>
-                <Button onClick={handleCreate} disabled={createMutation.isLoading}>
-                  {createMutation.isLoading ? (
-                    <Spinner className="h-4 w-4" />
-                  ) : (
-                    localize('com_ui_create')
-                  )}
-                </Button>
-              </div>
-            </>
-          ) : (
-            <>
-              <div className="rounded-lg border border-yellow-500/50 bg-yellow-50 p-4 dark:bg-yellow-900/20">
-                <p className="text-sm text-yellow-800 dark:text-yellow-200">
-                  {localize('com_ui_api_key_warning')}
-                </p>
-              </div>
-              <div className="space-y-2">
-                <Label>{localize('com_ui_your_api_key')}</Label>
-                <div className="flex gap-2">
-                  <Input
-                    value={showKey ? newKey : '•'.repeat(newKey.length)}
-                    readOnly
-                    className="font-mono text-sm"
-                  />
-                  <Button
-                    variant="outline"
-                    size="icon"
-                    onClick={() => setShowKey(!showKey)}
-                    title={showKey ? localize('com_ui_hide') : localize('com_ui_show')}
-                  >
-                    {showKey ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
-                  </Button>
-                  <Button
-                    variant="outline"
-                    size="icon"
-                    onClick={handleCopy}
-                    disabled={isCopying}
-                    title={localize('com_ui_copy')}
-                  >
-                    {isCopying ? <CopyCheck className="h-4 w-4" /> : <Copy className="h-4 w-4" />}
-                  </Button>
-                </div>
-              </div>
-              <div className="flex justify-end">
-                <Button onClick={handleClose}>{localize('com_ui_done')}</Button>
-              </div>
-            </>
-          )}
-        </div>
-      </OGDialogContent>
-    </OGDialog>
-  );
-}
-
-function KeyItem({
-  id,
-  name,
-  keyPrefix,
-  createdAt,
-  lastUsedAt,
-}: {
-  id: string;
-  name: string;
-  keyPrefix: string;
-  createdAt: string;
-  lastUsedAt?: string;
-}) {
-  const localize = useLocalize();
-  const { showToast } = useToastContext();
-  const [confirmDelete, setConfirmDelete] = useState(false);
-  const deleteMutation = useDeleteAgentApiKeyMutation();
-
-  const handleDelete = async () => {
-    try {
-      await deleteMutation.mutateAsync(id);
-      showToast({ message: localize('com_ui_api_key_deleted'), status: 'success' });
-    } catch {
-      showToast({ message: localize('com_ui_api_key_delete_error'), status: 'error' });
-    }
-    setConfirmDelete(false);
-  };
-
-  const formatDate = (dateStr: string) => {
-    return new Date(dateStr).toLocaleDateString(undefined, {
-      year: 'numeric',
-      month: 'short',
-      day: 'numeric',
-    });
-  };
-
-  return (
-    <div className="flex items-center justify-between rounded-lg border border-border-light p-3">
-      <div className="flex items-center gap-3">
-        <Key className="h-5 w-5 text-text-secondary" />
-        <div>
-          <div className="font-medium">{name}</div>
-          <div className="text-sm text-text-secondary">
-            <span className="font-mono">{keyPrefix}...</span>
-            <span className="mx-2">•</span>
-            <span>
-              {localize('com_ui_created')} {formatDate(createdAt)}
-            </span>
-            {lastUsedAt && (
-              <>
-                <span className="mx-2">•</span>
-                <span>
-                  {localize('com_ui_last_used')} {formatDate(lastUsedAt)}
-                </span>
-              </>
-            )}
-          </div>
-        </div>
-      </div>
-      <div>
-        {confirmDelete ? (
-          <div className="flex gap-2">
-            <Button variant="outline" size="sm" onClick={() => setConfirmDelete(false)}>
-              {localize('com_ui_cancel')}
-            </Button>
-            <Button
-              variant="destructive"
-              size="sm"
-              onClick={handleDelete}
-              disabled={deleteMutation.isLoading}
-            >
-              {deleteMutation.isLoading ? (
-                <Spinner className="h-4 w-4" />
-              ) : (
-                localize('com_ui_delete')
-              )}
-            </Button>
-          </div>
-        ) : (
-          <Button
-            variant="ghost"
-            size="icon"
-            onClick={() => setConfirmDelete(true)}
-            title={localize('com_ui_delete')}
-          >
-            <Trash2 className="h-4 w-4 text-text-secondary hover:text-red-500" />
-          </Button>
-        )}
-      </div>
-    </div>
-  );
-}
-
-function ApiKeysContent({ isOpen }: { isOpen: boolean }) {
-  const localize = useLocalize();
-  const { data, isLoading, error } = useGetAgentApiKeysQuery({ enabled: isOpen });
-
-  if (error) {
-    return <div className="text-sm text-red-500">{localize('com_ui_api_keys_load_error')}</div>;
-  }
-
-  return (
-    <div className="space-y-4">
-      <div className="flex items-center justify-end gap-2">
-        <RemoteAgentsAdminSettings />
-        <CreateKeyDialog />
-      </div>
-
-      <div className="max-h-[400px] space-y-2 overflow-y-auto">
-        {isLoading && (
-          <div className="flex items-center justify-center py-8">
-            <Spinner className="h-6 w-6" />
-          </div>
-        )}
-        {!isLoading &&
-          data?.keys &&
-          data.keys.length > 0 &&
-          data.keys.map((key) => (
-            <KeyItem
-              key={key.id}
-              id={key.id}
-              name={key.name}
-              keyPrefix={key.keyPrefix}
-              createdAt={key.createdAt}
-              lastUsedAt={key.lastUsedAt}
-            />
-          ))}
-        {!isLoading && (!data?.keys || data.keys.length === 0) && (
-          <div className="rounded-lg border-2 border-dashed border-border-light p-8 text-center">
-            <Key className="mx-auto h-8 w-8 text-text-secondary" />
-            <p className="mt-2 text-sm text-text-secondary">{localize('com_ui_no_api_keys')}</p>
-          </div>
-        )}
-      </div>
-    </div>
-  );
-}
-
-const remoteAgentsPermissions: PermissionConfig[] = [
-  { permission: Permissions.USE, labelKey: 'com_ui_remote_agents_allow_use' },
-  { permission: Permissions.CREATE, labelKey: 'com_ui_remote_agents_allow_create' },
-  { permission: Permissions.SHARE, labelKey: 'com_ui_remote_agents_allow_share' },
-  { permission: Permissions.SHARE_PUBLIC, labelKey: 'com_ui_remote_agents_allow_share_public' },
-];
-
-function RemoteAgentsAdminSettings() {
-  const localize = useLocalize();
-  const { showToast } = useToastContext();
-
-  const mutation = useUpdateRemoteAgentsPermissionsMutation({
-    onSuccess: () => {
-      showToast({ status: 'success', message: localize('com_ui_saved') });
-    },
-    onError: () => {
-      showToast({ status: 'error', message: localize('com_ui_error_save_admin_settings') });
-    },
-  });
-
-  const trigger = (
-    <Button
-      variant="ghost"
-      size="icon"
-      className="h-8 w-8"
-      aria-label={localize('com_ui_admin_settings')}
-    >
-      <ShieldEllipsis className="h-5 w-5" aria-hidden="true" />
-    </Button>
-  );
-
-  return (
-    <AdminSettingsDialog
-      permissionType={PermissionTypes.REMOTE_AGENTS}
-      sectionKey="com_ui_remote_agents"
-      permissions={remoteAgentsPermissions}
-      menuId="remote-agents-role-dropdown"
-      mutation={mutation}
-      trigger={trigger}
-    />
-  );
-}
-
-export function AgentApiKeys() {
-  const localize = useLocalize();
-  const [isOpen, setIsOpen] = useState(false);
-
-  return (
-    <div className="flex items-center justify-between">
-      <Label id="api-keys-label">{localize('com_ui_agent_api_keys')}</Label>
-
-      <OGDialog open={isOpen} onOpenChange={setIsOpen}>
-        <OGDialogTrigger asChild>
-          <Button aria-labelledby="api-keys-label" variant="outline">
-            {localize('com_ui_manage')}
-          </Button>
-        </OGDialogTrigger>
-
-        <OGDialogContent
-          title={localize('com_ui_agent_api_keys')}
-          className="w-11/12 max-w-2xl bg-background text-text-primary shadow-2xl"
-        >
-          <OGDialogHeader>
-            <OGDialogTitle>{localize('com_ui_agent_api_keys')}</OGDialogTitle>
-            <p className="text-sm text-text-secondary">
-              {localize('com_ui_agent_api_keys_description')}
-            </p>
-          </OGDialogHeader>
-          <ApiKeysContent isOpen={isOpen} />
-        </OGDialogContent>
-      </OGDialog>
-    </div>
-  );
-}
diff --git a/client/src/components/Nav/SettingsTabs/Data/Data.tsx b/client/src/components/Nav/SettingsTabs/Data/Data.tsx
deleted file mode 100644
index eb8cea98c29..00000000000
--- a/client/src/components/Nav/SettingsTabs/Data/Data.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-import React, { useState, useRef } from 'react';
-import { useOnClickOutside } from '@librechat/client';
-import { Permissions, PermissionTypes } from 'librechat-data-provider';
-import ImportConversations from './ImportConversations';
-import { AgentApiKeys } from './AgentApiKeys';
-import { DeleteCache } from './DeleteCache';
-import { RevokeKeys } from './RevokeKeys';
-import { ClearChats } from './ClearChats';
-import SharedLinks from './SharedLinks';
-import { useHasAccess } from '~/hooks';
-
-function Data() {
-  const dataTabRef = useRef(null);
-  const [confirmClearConvos, setConfirmClearConvos] = useState(false);
-  useOnClickOutside(dataTabRef, () => confirmClearConvos && setConfirmClearConvos(false), []);
-  const hasAccessToApiKeys = useHasAccess({
-    permissionType: PermissionTypes.REMOTE_AGENTS,
-    permission: Permissions.USE,
-  });
-
-  return (
-    <div className="flex flex-col gap-3 p-1 text-sm text-text-primary">
-      <div className="pb-3">
-        <ImportConversations />
-      </div>
-      <div className="pb-3">
-        <SharedLinks />
-      </div>
-      {hasAccessToApiKeys && (
-        <div className="pb-3">
-          <AgentApiKeys />
-        </div>
-      )}
-      <div className="pb-3">
-        <RevokeKeys />
-      </div>
-      <div className="pb-3">
-        <DeleteCache />
-      </div>
-      <div className="pb-3">
-        <ClearChats />
-      </div>
-    </div>
-  );
-}
-
-export default React.memo(Data);
diff --git a/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx b/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
index af1803adf7c..0eaaed20888 100644
--- a/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
+++ b/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
@@ -38,7 +38,6 @@ const PAGE_SIZE = 25;
 
 const DEFAULT_PARAMS: SharedLinksListParams = {
   pageSize: PAGE_SIZE,
-  isPublic: true,
   sortBy: 'createdAt',
   sortDirection: 'desc',
   search: '',
@@ -333,6 +332,7 @@ export default function SharedLinks() {
           <DataTable
             columns={columns}
             data={allLinks}
+            className="scrollbar-gutter-stable"
             onDelete={handleDelete}
             filterColumn="title"
             hasNextPage={hasNextPage}
diff --git a/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx b/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx
deleted file mode 100644
index 2e6f6df07da..00000000000
--- a/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { useState } from 'react';
-import { OGDialogTemplate, OGDialog, OGDialogTrigger, Button } from '@librechat/client';
-import ArchivedChatsTable from './ArchivedChatsTable';
-import { useLocalize } from '~/hooks';
-
-export default function ArchivedChats() {
-  const localize = useLocalize();
-  const [isOpen, setIsOpen] = useState(false);
-
-  return (
-    <div className="flex items-center justify-between">
-      <div>{localize('com_nav_archived_chats')}</div>
-      <OGDialog open={isOpen} onOpenChange={setIsOpen}>
-        <OGDialogTrigger asChild>
-          <Button variant="outline" aria-label="Archived chats">
-            {localize('com_ui_manage')}
-          </Button>
-        </OGDialogTrigger>
-        <OGDialogTemplate
-          title={localize('com_nav_archived_chats')}
-          className="max-w-[1000px]"
-          showCancelButton={false}
-          main={<ArchivedChatsTable isOpen={isOpen} onOpenChange={setIsOpen} />}
-        />
-      </OGDialog>
-    </div>
-  );
-}
diff --git a/client/src/components/Nav/SettingsTabs/General/ArchivedChatsModal.tsx b/client/src/components/Nav/SettingsTabs/General/ArchivedChatsModal.tsx
new file mode 100644
index 00000000000..0f8c84a3abc
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/General/ArchivedChatsModal.tsx
@@ -0,0 +1,43 @@
+import { useRef } from 'react';
+import { OGDialog, OGDialogContent, OGDialogHeader, OGDialogTitle } from '@librechat/client';
+import type { RefObject } from 'react';
+import ArchivedChatsTable from './ArchivedChatsTable';
+import { useLocalize } from '~/hooks';
+
+export function ArchivedChatsModal({
+  open,
+  onOpenChange,
+  triggerRef,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  triggerRef?: RefObject<HTMLButtonElement | HTMLDivElement | null>;
+}) {
+  const localize = useLocalize();
+  const contentRef = useRef<HTMLDivElement>(null);
+
+  /** The virtualized table has no stable focusable on mount, so Radix's default
+   *  autofocus lands on a row that the virtualizer tears out, dropping focus to
+   *  the page's top focus guard; anchor focus to the dialog content instead. */
+  const handleOpenAutoFocus = (event: Event) => {
+    event.preventDefault();
+    contentRef.current?.focus();
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange} triggerRef={triggerRef}>
+      <OGDialogContent
+        ref={contentRef}
+        tabIndex={-1}
+        onOpenAutoFocus={handleOpenAutoFocus}
+        title={localize('com_nav_archived_chats')}
+        className="w-11/12 max-w-[1000px] bg-background text-text-primary shadow-2xl focus:outline-none"
+      >
+        <OGDialogHeader>
+          <OGDialogTitle>{localize('com_nav_archived_chats')}</OGDialogTitle>
+        </OGDialogHeader>
+        <ArchivedChatsTable onOpenChange={onOpenChange} />
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/General/ArchivedChatsTable.tsx b/client/src/components/Nav/SettingsTabs/General/ArchivedChatsTable.tsx
index 46752da5d1b..15ac9dc456d 100644
--- a/client/src/components/Nav/SettingsTabs/General/ArchivedChatsTable.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/ArchivedChatsTable.tsx
@@ -109,7 +109,7 @@ export default function ArchivedChatsTable({
     },
   });
 
-  const unarchiveMutation = useArchiveConvoMutation({
+  const { mutate: unarchiveConversation, isLoading: isUnarchiving } = useArchiveConvoMutation({
     onSuccess: async () => {
       await refetch();
     },
@@ -253,20 +253,16 @@ export default function ArchivedChatsTable({
                     variant="ghost"
                     className="h-8 w-8 p-0 hover:bg-surface-hover"
                     onClick={() =>
-                      unarchiveMutation.mutate({
+                      unarchiveConversation({
                         conversationId: conversation.conversationId,
                         isArchived: false,
                       })
                     }
                     title={localize('com_ui_unarchive_conversation')}
                     aria-label={localize('com_ui_unarchive_conversation')}
-                    disabled={unarchiveMutation.isLoading}
+                    disabled={isUnarchiving}
                   >
-                    {unarchiveMutation.isLoading ? (
-                      <Spinner />
-                    ) : (
-                      <ArchiveRestore className="size-4" />
-                    )}
+                    {isUnarchiving ? <Spinner /> : <ArchiveRestore className="size-4" />}
                   </Button>
                 }
               />
@@ -296,24 +292,29 @@ export default function ArchivedChatsTable({
         },
       },
     ],
-    [isSmallScreen, localize, unarchiveMutation],
+    [isSmallScreen, localize, unarchiveConversation, isUnarchiving],
   );
 
   return (
     <>
-      <DataTable
-        columns={columns}
-        data={allConversations}
-        filterColumn="title"
-        onFilterChange={debouncedFilterChange}
-        filterValue={queryParams.search}
-        fetchNextPage={handleFetchNextPage}
-        hasNextPage={hasNextPage}
-        isFetchingNextPage={isFetchingNextPage}
-        isLoading={isLoading}
-        showCheckboxes={false}
-        enableSearch={searchState.enabled === true}
-      />
+      {/* Fixed height keeps the loading (skeleton) and loaded states the same
+          size, so the virtualized table can't reflow the dialog on load. */}
+      <div className="h-[60vh]">
+        <DataTable
+          columns={columns}
+          data={allConversations}
+          className="scrollbar-gutter-stable"
+          filterColumn="title"
+          onFilterChange={debouncedFilterChange}
+          filterValue={queryParams.search}
+          fetchNextPage={handleFetchNextPage}
+          hasNextPage={hasNextPage}
+          isFetchingNextPage={isFetchingNextPage}
+          isLoading={isLoading}
+          showCheckboxes={false}
+          enableSearch={searchState.enabled === true}
+        />
+      </div>
 
       <OGDialog open={isDeleteOpen} onOpenChange={onOpenChange}>
         <OGDialogContent
diff --git a/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx b/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
index 2ad856d688e..012a6194aa5 100644
--- a/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
@@ -2,8 +2,9 @@ import 'test/matchMedia.mock';
 import React from 'react';
 import { render, fireEvent, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom/extend-expect';
-import { LangSelector } from './General';
 import { RecoilRoot } from 'recoil';
+import { LangSelector } from './Selectors';
+import store from '~/store';
 
 describe('LangSelector', () => {
   let mockOnChange;
@@ -54,4 +55,19 @@ describe('LangSelector', () => {
       expect(mockOnChange).toHaveBeenCalledWith('it-IT');
     });
   });
+
+  it('shows a loading indicator while language resources load', () => {
+    global.ResizeObserver = class MockedResizeObserver {
+      observe = jest.fn();
+      unobserve = jest.fn();
+      disconnect = jest.fn();
+    };
+    const { getByRole } = render(
+      <RecoilRoot initializeState={({ set }) => set(store.languageLoading, true)}>
+        <LangSelector langcode="en-US" onChange={mockOnChange} />
+      </RecoilRoot>,
+    );
+
+    expect(getByRole('status', { name: 'Loading...' })).toBeInTheDocument();
+  });
 });
diff --git a/client/src/components/Nav/SettingsTabs/General/General.tsx b/client/src/components/Nav/SettingsTabs/General/Selectors.tsx
similarity index 59%
rename from client/src/components/Nav/SettingsTabs/General/General.tsx
rename to client/src/components/Nav/SettingsTabs/General/Selectors.tsx
index 90224ac032f..0470fd94ce8 100644
--- a/client/src/components/Nav/SettingsTabs/General/General.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/Selectors.tsx
@@ -1,43 +1,8 @@
-import React, { useContext, useCallback } from 'react';
-import Cookies from 'js-cookie';
-import { useRecoilState } from 'recoil';
-import { Dropdown, ThemeContext } from '@librechat/client';
-import ArchivedChats from './ArchivedChats';
-import ToggleSwitch from '../ToggleSwitch';
+import { useRecoilValue } from 'recoil';
+import { Dropdown, Spinner } from '@librechat/client';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
-const toggleSwitchConfigs = [
-  {
-    stateAtom: store.enableUserMsgMarkdown,
-    localizationKey: 'com_nav_user_msg_markdown' as const,
-    switchId: 'enableUserMsgMarkdown',
-    hoverCardText: undefined,
-    key: 'enableUserMsgMarkdown',
-  },
-  {
-    stateAtom: store.autoScroll,
-    localizationKey: 'com_nav_auto_scroll' as const,
-    switchId: 'autoScroll',
-    hoverCardText: undefined,
-    key: 'autoScroll',
-  },
-  {
-    stateAtom: store.keepScreenAwake,
-    localizationKey: 'com_nav_keep_screen_awake' as const,
-    switchId: 'keepScreenAwake',
-    hoverCardText: undefined,
-    key: 'keepScreenAwake',
-  },
-  {
-    stateAtom: store.newChatSwitchToHistory,
-    localizationKey: 'com_nav_new_chat_switch_to_history' as const,
-    switchId: 'newChatSwitchToHistory',
-    hoverCardText: undefined,
-    key: 'newChatSwitchToHistory',
-  },
-];
-
 export const ThemeSelector = ({
   theme,
   onChange,
@@ -85,6 +50,7 @@ export const LangSelector = ({
   portal?: boolean;
 }) => {
   const localize = useLocalize();
+  const isLanguageLoading = useRecoilValue(store.languageLoading);
 
   const languageOptions = [
     { value: 'auto', label: localize('com_nav_lang_auto') },
@@ -137,70 +103,29 @@ export const LangSelector = ({
     <div className="flex items-center justify-between">
       <div id={labelId}>{localize('com_nav_language')}</div>
 
-      <Dropdown
-        value={langcode}
-        onChange={onChange}
-        sizeClasses="[--anchor-max-height:256px] max-h-[60vh]"
-        options={languageOptions}
-        className="z-50"
-        aria-labelledby={labelId}
-        portal={portal}
-      />
-    </div>
-  );
-};
-
-function General() {
-  const { theme, setTheme } = useContext(ThemeContext);
-
-  const [langcode, setLangcode] = useRecoilState(store.lang);
-
-  const changeTheme = useCallback(
-    (value: string) => {
-      setTheme(value);
-    },
-    [setTheme],
-  );
-
-  const changeLang = useCallback(
-    (value: string) => {
-      let userLang = value;
-      if (value === 'auto') {
-        userLang = navigator.language || navigator.languages[0];
-      }
-
-      requestAnimationFrame(() => {
-        document.documentElement.lang = userLang;
-      });
-      setLangcode(userLang);
-      Cookies.set('lang', userLang, { expires: 365 });
-    },
-    [setLangcode],
-  );
-
-  return (
-    <div className="flex flex-col gap-3 p-1 text-sm text-text-primary">
-      <div className="pb-3">
-        <ThemeSelector theme={theme} onChange={changeTheme} />
-      </div>
-      <div className="pb-3">
-        <LangSelector langcode={langcode} onChange={changeLang} />
-      </div>
-      {toggleSwitchConfigs.map((config) => (
-        <div key={config.key} className="pb-3">
-          <ToggleSwitch
-            stateAtom={config.stateAtom}
-            localizationKey={config.localizationKey}
-            hoverCardText={config.hoverCardText}
-            switchId={config.switchId}
-          />
-        </div>
-      ))}
-      <div className="pb-3">
-        <ArchivedChats />
+      <div className="flex items-center gap-2">
+        {isLanguageLoading && (
+          <span
+            role="status"
+            aria-label={localize('com_ui_loading')}
+            className="flex size-5 items-center justify-center text-text-secondary"
+          >
+            <Spinner className="size-4" />
+          </span>
+        )}
+        <Dropdown
+          value={langcode}
+          onChange={onChange}
+          sizeClasses="[--anchor-max-height:256px] max-h-[60vh] w-[220px]"
+          options={languageOptions}
+          className="z-50"
+          aria-labelledby={labelId}
+          portal={portal}
+          searchable
+          searchPlaceholder={localize('com_ui_search_language')}
+          searchEmptyText={localize('com_ui_no_results_found')}
+        />
       </div>
     </div>
   );
-}
-
-export default React.memo(General);
+};
diff --git a/client/src/components/Nav/SettingsTabs/General/ThemeSelector.spec.tsx b/client/src/components/Nav/SettingsTabs/General/ThemeSelector.spec.tsx
index d3c55f1062e..9fc01308079 100644
--- a/client/src/components/Nav/SettingsTabs/General/ThemeSelector.spec.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/ThemeSelector.spec.tsx
@@ -1,11 +1,10 @@
 // ThemeSelector.spec.tsx
 import 'test/matchMedia.mock';
-
 import React from 'react';
 import { render, fireEvent, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom/extend-expect';
-import { ThemeSelector } from './General';
 import { RecoilRoot } from 'recoil';
+import { ThemeSelector } from './Selectors';
 
 describe('ThemeSelector', () => {
   let mockOnChange;
diff --git a/client/src/components/Nav/SettingsTabs/Personalization.tsx b/client/src/components/Nav/SettingsTabs/Personalization.tsx
deleted file mode 100644
index f9e43dc6f5d..00000000000
--- a/client/src/components/Nav/SettingsTabs/Personalization.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import { useState, useEffect } from 'react';
-import { Switch, useToastContext } from '@librechat/client';
-import { useGetUserQuery, useUpdateMemoryPreferencesMutation } from '~/data-provider';
-import { useLocalize } from '~/hooks';
-
-interface PersonalizationProps {
-  hasMemoryOptOut: boolean;
-  hasAnyPersonalizationFeature: boolean;
-}
-
-export default function Personalization({
-  hasMemoryOptOut,
-  hasAnyPersonalizationFeature,
-}: PersonalizationProps) {
-  const localize = useLocalize();
-  const { showToast } = useToastContext();
-  const { data: user } = useGetUserQuery();
-  const [referenceSavedMemories, setReferenceSavedMemories] = useState(true);
-
-  const updateMemoryPreferencesMutation = useUpdateMemoryPreferencesMutation({
-    onSuccess: () => {
-      showToast({
-        message: localize('com_ui_preferences_updated'),
-        status: 'success',
-      });
-    },
-    onError: () => {
-      showToast({
-        message: localize('com_ui_error_updating_preferences'),
-        status: 'error',
-      });
-      // Revert the toggle on error
-      setReferenceSavedMemories((prev) => !prev);
-    },
-  });
-
-  // Initialize state from user data
-  useEffect(() => {
-    if (user?.personalization?.memories !== undefined) {
-      setReferenceSavedMemories(user.personalization.memories);
-    }
-  }, [user?.personalization?.memories]);
-
-  const handleMemoryToggle = (checked: boolean) => {
-    setReferenceSavedMemories(checked);
-    updateMemoryPreferencesMutation.mutate({ memories: checked });
-  };
-
-  if (!hasAnyPersonalizationFeature) {
-    return (
-      <div className="flex flex-col gap-3 text-sm text-text-primary">
-        <div className="text-text-secondary">{localize('com_ui_no_personalization_available')}</div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="flex flex-col gap-3 text-sm text-text-primary">
-      {/* Memory Settings Section */}
-      {hasMemoryOptOut && (
-        <>
-          <div className="border-b border-border-medium pb-3">
-            <div className="text-base font-semibold">{localize('com_ui_memory')}</div>
-          </div>
-
-          <div className="flex items-center justify-between">
-            <div>
-              <div id="reference-saved-memories-label" className="flex items-center gap-2">
-                {localize('com_ui_reference_saved_memories')}
-              </div>
-              <div
-                id="reference-saved-memories-description"
-                className="mt-1 text-xs text-text-secondary"
-              >
-                {localize('com_ui_reference_saved_memories_description')}
-              </div>
-            </div>
-            <Switch
-              checked={referenceSavedMemories}
-              onCheckedChange={handleMemoryToggle}
-              disabled={updateMemoryPreferencesMutation.isLoading}
-              aria-labelledby="reference-saved-memories-label"
-              aria-describedby="reference-saved-memories-description"
-            />
-          </div>
-        </>
-      )}
-    </div>
-  );
-}
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeyRow.tsx b/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeyRow.tsx
new file mode 100644
index 00000000000..1d6a2b2e378
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeyRow.tsx
@@ -0,0 +1,92 @@
+import React, { useMemo, useState } from 'react';
+import { Button } from '@librechat/client';
+import { alternateName, getEndpointField } from 'librechat-data-provider';
+import type { TEndpointsConfig } from 'librechat-data-provider';
+import { SetKeyDialog } from '~/components/Input/SetKeyDialog';
+import { useUserKey, useLocalize } from '~/hooks';
+import { icons } from '~/hooks/Endpoint/Icons';
+import { getIconKey } from '~/utils';
+
+interface ProviderKeyRowProps {
+  endpoint: string;
+  endpointsConfig: TEndpointsConfig;
+}
+
+export default function ProviderKeyRow({ endpoint, endpointsConfig }: ProviderKeyRowProps) {
+  const localize = useLocalize();
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const { getExpiry, checkExpiry } = useUserKey(endpoint);
+
+  const endpointType = getEndpointField(endpointsConfig, endpoint, 'type');
+  const iconURL = getEndpointField(endpointsConfig, endpoint, 'iconURL');
+  const iconKey = getIconKey({ endpoint, endpointsConfig, endpointType });
+  const Icon = icons[iconKey];
+
+  const label = useMemo(() => alternateName[endpoint] || endpoint, [endpoint]);
+  const expiry = getExpiry();
+  const hasKey = !!expiry && checkExpiry();
+  const expiryLabel = useMemo(() => {
+    if (!expiry) {
+      return localize('com_ui_provider_api_keys_not_set');
+    }
+    if (expiry === 'never') {
+      return localize('com_endpoint_config_key_never_expires');
+    }
+    return `${localize('com_endpoint_config_key_encryption')} ${new Date(expiry).toLocaleString()}`;
+  }, [expiry, localize]);
+
+  return (
+    <>
+      <div className="flex items-center justify-between gap-3 py-2">
+        <div className="flex min-w-0 items-center gap-3">
+          {Icon && (
+            <div className="flex shrink-0 items-center justify-center" aria-hidden="true">
+              {React.createElement(Icon, {
+                size: 20,
+                className: 'text-text-primary shrink-0 icon-md',
+                iconURL,
+                endpoint,
+              })}
+            </div>
+          )}
+          <div className="min-w-0">
+            <div className="truncate font-medium text-text-primary">{label}</div>
+            <div className="truncate text-xs text-text-secondary">{expiryLabel}</div>
+          </div>
+        </div>
+        <Button variant="outline" onClick={() => setDialogOpen(true)}>
+          {hasKey ? localize('com_ui_update') : localize('com_endpoint_config_key')}
+        </Button>
+      </div>
+      {dialogOpen && (
+        <SetKeyDialog
+          open={dialogOpen}
+          onOpenChange={setDialogOpen}
+          endpoint={endpoint}
+          endpointType={endpointType}
+          userProvideURL={getEndpointField(endpointsConfig, endpoint, 'userProvideURL')}
+          userProvideAccessKeyId={getEndpointField(
+            endpointsConfig,
+            endpoint,
+            'userProvideAccessKeyId',
+          )}
+          userProvideSecretAccessKey={getEndpointField(
+            endpointsConfig,
+            endpoint,
+            'userProvideSecretAccessKey',
+          )}
+          userProvideSessionToken={getEndpointField(
+            endpointsConfig,
+            endpoint,
+            'userProvideSessionToken',
+          )}
+          userProvideBearerToken={getEndpointField(
+            endpointsConfig,
+            endpoint,
+            'userProvideBearerToken',
+          )}
+        />
+      )}
+    </>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeys.tsx b/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeys.tsx
new file mode 100644
index 00000000000..e83c4b28fb7
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/ProviderKeys.tsx
@@ -0,0 +1,59 @@
+import { useState } from 'react';
+import {
+  Label,
+  Button,
+  OGDialog,
+  OGDialogTitle,
+  OGDialogHeader,
+  InfoHoverCard,
+  OGDialogTrigger,
+  OGDialogContent,
+} from '@librechat/client';
+import { useGetEndpointsQuery } from '~/data-provider';
+import useProviderKeys from './useProviderKeys';
+import ProviderKeyRow from './ProviderKeyRow';
+import { useLocalize } from '~/hooks';
+
+export default function ProviderKeys() {
+  const localize = useLocalize();
+  const [open, setOpen] = useState(false);
+  const { data: endpointsConfig } = useGetEndpointsQuery();
+  const endpoints = useProviderKeys();
+
+  return (
+    <div className="flex items-center justify-between">
+      <Label id="provider-api-keys-label">
+        {localize('com_ui_settings_label_provider_api_keys')}
+      </Label>
+      <OGDialog open={open} onOpenChange={setOpen}>
+        <OGDialogTrigger asChild>
+          <Button variant="outline" aria-labelledby="provider-api-keys-label">
+            {localize('com_ui_manage')}
+          </Button>
+        </OGDialogTrigger>
+        <OGDialogContent
+          className="w-11/12 max-w-2xl bg-background text-text-primary shadow-2xl"
+          aria-describedby={undefined}
+        >
+          <OGDialogHeader className="space-y-0 pr-8 text-left">
+            <div className="flex items-center gap-1.5">
+              <OGDialogTitle>{localize('com_ui_settings_label_provider_api_keys')}</OGDialogTitle>
+              <InfoHoverCard text={localize('com_ui_provider_api_keys_description')} />
+            </div>
+          </OGDialogHeader>
+          {endpointsConfig && (
+            <div className="divide-y divide-border-light">
+              {endpoints.map((endpoint) => (
+                <ProviderKeyRow
+                  key={endpoint}
+                  endpoint={endpoint}
+                  endpointsConfig={endpointsConfig}
+                />
+              ))}
+            </div>
+          )}
+        </OGDialogContent>
+      </OGDialog>
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/index.ts b/client/src/components/Nav/SettingsTabs/ProviderKeys/index.ts
new file mode 100644
index 00000000000..d17ee82837b
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/index.ts
@@ -0,0 +1 @@
+export { default } from './ProviderKeys';
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/useProviderKeys.ts b/client/src/components/Nav/SettingsTabs/ProviderKeys/useProviderKeys.ts
new file mode 100644
index 00000000000..7f7f50d9aed
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/useProviderKeys.ts
@@ -0,0 +1,28 @@
+import { useMemo } from 'react';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
+import { useGetEndpointsQuery, useGetStartupConfig } from '~/data-provider';
+import { getUserKeyEndpoints } from './utils';
+import { useHasAccess } from '~/hooks';
+
+/**
+ * Reachable endpoints requiring a user-provided key, filtered the same way the model
+ * selector and mention popover are (modelSpecs, addedEndpoints, agent allowedProviders).
+ */
+export default function useProviderKeys(): string[] {
+  const { data: endpointsConfig } = useGetEndpointsQuery();
+  const { data: startupConfig } = useGetStartupConfig();
+  const hasAgentAccess = useHasAccess({
+    permissionType: PermissionTypes.AGENTS,
+    permission: Permissions.USE,
+  });
+
+  return useMemo(
+    () =>
+      getUserKeyEndpoints({
+        endpointsConfig,
+        modelSpecs: startupConfig?.modelSpecs,
+        hasAgentAccess: hasAgentAccess === true,
+      }),
+    [endpointsConfig, startupConfig?.modelSpecs, hasAgentAccess],
+  );
+}
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.spec.ts b/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.spec.ts
new file mode 100644
index 00000000000..7bc17f0e554
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.spec.ts
@@ -0,0 +1,105 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TConfig, TModelSpec, TEndpointsConfig } from 'librechat-data-provider';
+import { getUserKeyEndpoints, isUserProvidedEndpointConfig } from './utils';
+
+const cfg = (overrides: Partial<TConfig> = {}): TConfig => ({ order: 0, ...overrides });
+
+const spec = (endpoint: string): TModelSpec => ({
+  name: endpoint,
+  label: endpoint,
+  preset: { endpoint },
+});
+
+const endpointsConfig: TEndpointsConfig = {
+  openAI: cfg({ userProvide: true }),
+  anthropic: cfg({ userProvide: true }),
+  google: cfg({ userProvide: false }),
+  bedrock: cfg({ userProvideBearerToken: true }),
+  [EModelEndpoint.agents]: cfg({ allowedProviders: ['anthropic'] }),
+};
+
+describe('isUserProvidedEndpointConfig', () => {
+  it('returns false for nullish config', () => {
+    expect(isUserProvidedEndpointConfig(null)).toBe(false);
+    expect(isUserProvidedEndpointConfig(undefined)).toBe(false);
+  });
+
+  it('returns true for an API key endpoint', () => {
+    expect(isUserProvidedEndpointConfig(cfg({ userProvide: true }))).toBe(true);
+  });
+
+  it('returns true for a Bedrock credential endpoint', () => {
+    expect(isUserProvidedEndpointConfig(cfg({ userProvideSecretAccessKey: true }))).toBe(true);
+  });
+
+  it('returns false for a user-provided base URL alone', () => {
+    expect(isUserProvidedEndpointConfig(cfg({ userProvideURL: true }))).toBe(false);
+  });
+
+  it('returns false when no credential is user-provided', () => {
+    expect(isUserProvidedEndpointConfig(cfg())).toBe(false);
+  });
+});
+
+describe('getUserKeyEndpoints', () => {
+  it('returns an empty list when endpoints have not loaded', () => {
+    expect(getUserKeyEndpoints({ endpointsConfig: undefined, hasAgentAccess: true })).toEqual([]);
+  });
+
+  it('lists every user-provided endpoint when no modelSpecs are configured', () => {
+    expect(getUserKeyEndpoints({ endpointsConfig, hasAgentAccess: true })).toEqual([
+      'openAI',
+      'anthropic',
+      'bedrock',
+    ]);
+  });
+
+  it('limits to endpoints referenced by modelSpecs', () => {
+    const result = getUserKeyEndpoints({
+      endpointsConfig,
+      modelSpecs: { list: [spec('openAI')] },
+      hasAgentAccess: true,
+    });
+    expect(result).toEqual(['openAI']);
+  });
+
+  it('includes addedEndpoints alongside spec endpoints', () => {
+    const result = getUserKeyEndpoints({
+      endpointsConfig,
+      modelSpecs: { list: [spec('openAI')], addedEndpoints: ['bedrock'] },
+      hasAgentAccess: true,
+    });
+    expect(result).toEqual(['openAI', 'bedrock']);
+  });
+
+  it('expands a reachable agents endpoint to its allowedProviders', () => {
+    const result = getUserKeyEndpoints({
+      endpointsConfig,
+      modelSpecs: { list: [spec('openAI')], addedEndpoints: [EModelEndpoint.agents] },
+      hasAgentAccess: true,
+    });
+    expect(result).toEqual(['openAI', 'anthropic']);
+  });
+
+  it('expands a reachable agents endpoint with no allowedProviders to all providers', () => {
+    const unrestricted: TEndpointsConfig = {
+      ...endpointsConfig,
+      [EModelEndpoint.agents]: cfg(),
+    };
+    const result = getUserKeyEndpoints({
+      endpointsConfig: unrestricted,
+      modelSpecs: { list: [spec('openAI')], addedEndpoints: [EModelEndpoint.agents] },
+      hasAgentAccess: true,
+    });
+    expect(result).toEqual(['openAI', 'anthropic', 'bedrock']);
+  });
+
+  it('does not expand agent providers when the user lacks agent access', () => {
+    const result = getUserKeyEndpoints({
+      endpointsConfig,
+      modelSpecs: { list: [spec('openAI')], addedEndpoints: [EModelEndpoint.agents] },
+      hasAgentAccess: false,
+    });
+    expect(result).toEqual(['openAI']);
+  });
+});
diff --git a/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.ts b/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.ts
new file mode 100644
index 00000000000..ed28fb91dff
--- /dev/null
+++ b/client/src/components/Nav/SettingsTabs/ProviderKeys/utils.ts
@@ -0,0 +1,99 @@
+import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
+import type { TConfig, TSpecsConfig, TEndpointsConfig } from 'librechat-data-provider';
+
+/**
+ * Whether an endpoint config requires a user-provided credential — an API key or
+ * any Bedrock credential field. `userProvideURL` alone is excluded: a user-provided
+ * base URL does not imply a user-managed key.
+ */
+export const isUserProvidedEndpointConfig = (config?: TConfig | null): boolean => {
+  if (!config) {
+    return false;
+  }
+  return (
+    !!config.userProvide ||
+    !!config.userProvideAccessKeyId ||
+    !!config.userProvideSecretAccessKey ||
+    !!config.userProvideSessionToken ||
+    !!config.userProvideBearerToken
+  );
+};
+
+/**
+ * The endpoints a user can actually reach, mirroring the model selector and mention
+ * popover. With no modelSpecs every configured endpoint is reachable. When modelSpecs
+ * are configured the catalog is limited to the endpoints referenced by the specs plus
+ * `modelSpecs.addedEndpoints`; if agents are reachable the set additionally includes
+ * the agent `allowedProviders` (all providers when left unrestricted).
+ */
+const getReachableEndpoints = ({
+  endpointsConfig,
+  modelSpecs,
+  hasAgentAccess,
+}: {
+  endpointsConfig: NonNullable<TEndpointsConfig>;
+  modelSpecs?: Pick<TSpecsConfig, 'list' | 'addedEndpoints'> | null;
+  hasAgentAccess: boolean;
+}): Set<string> => {
+  const allEndpoints = Object.keys(endpointsConfig);
+  const specs = modelSpecs?.list ?? [];
+  if (specs.length === 0) {
+    return new Set(allEndpoints);
+  }
+
+  const reachable = new Set<string>();
+  for (const spec of specs) {
+    const specEndpoint = spec.preset?.endpoint;
+    if (specEndpoint) {
+      reachable.add(specEndpoint);
+    }
+  }
+  for (const endpoint of modelSpecs?.addedEndpoints ?? []) {
+    reachable.add(endpoint);
+  }
+
+  if (!hasAgentAccess || !reachable.has(EModelEndpoint.agents)) {
+    return reachable;
+  }
+
+  const allowedProviders = endpointsConfig[EModelEndpoint.agents]?.allowedProviders ?? [];
+  if (allowedProviders.length > 0) {
+    for (const provider of allowedProviders) {
+      reachable.add(provider);
+    }
+    return reachable;
+  }
+
+  for (const endpoint of allEndpoints) {
+    if (!isAgentsEndpoint(endpoint) && !isAssistantsEndpoint(endpoint)) {
+      reachable.add(endpoint);
+    }
+  }
+  return reachable;
+};
+
+/**
+ * Reachable endpoints that require a user-provided credential — the endpoints whose
+ * keys can be set or rotated from the API keys settings section.
+ */
+export const getUserKeyEndpoints = ({
+  endpointsConfig,
+  modelSpecs,
+  hasAgentAccess,
+}: {
+  endpointsConfig?: TEndpointsConfig | null;
+  modelSpecs?: Pick<TSpecsConfig, 'list' | 'addedEndpoints'> | null;
+  hasAgentAccess: boolean;
+}): string[] => {
+  if (!endpointsConfig) {
+    return [];
+  }
+  const reachable = getReachableEndpoints({ endpointsConfig, modelSpecs, hasAgentAccess });
+  const result: string[] = [];
+  for (const [endpoint, config] of Object.entries(endpointsConfig)) {
+    if (reachable.has(endpoint) && isUserProvidedEndpointConfig(config)) {
+      result.push(endpoint);
+    }
+  }
+  return result;
+};
diff --git a/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx b/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
index a033ed322c2..77565acb7f2 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
@@ -40,8 +40,9 @@ export default function AutoSendTextSelector() {
     }
   };
 
-  const handleInputChange = (value: number[] | null) => {
-    const newValue = value ? value[0] : 3;
+  const handleInputChange = (value: string | number | null) => {
+    const parsed = typeof value === 'number' ? value : parseInt(String(value ?? ''), 10);
+    const newValue = Number.isNaN(parsed) ? 3 : parsed;
     setDelayValue(newValue);
     if (isEnabled) {
       setAutoSendText(newValue);
diff --git a/client/src/components/Nav/SettingsTabs/Speech/STT/EngineSTTDropdown.tsx b/client/src/components/Nav/SettingsTabs/Speech/STT/EngineSTTDropdown.tsx
index 8fc3dd83523..e1602f4fd9c 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/STT/EngineSTTDropdown.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/STT/EngineSTTDropdown.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
-import { useRecoilState } from 'recoil';
 import { Dropdown } from '@librechat/client';
+import { useRecoilState, useRecoilValue } from 'recoil';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
@@ -11,6 +11,7 @@ interface EngineSTTDropdownProps {
 const EngineSTTDropdown: React.FC<EngineSTTDropdownProps> = ({ external }) => {
   const localize = useLocalize();
   const [engineSTT, setEngineSTT] = useRecoilState<string>(store.engineSTT);
+  const speechToText = useRecoilValue(store.speechToText);
 
   const endpointOptions = external
     ? [
@@ -36,6 +37,7 @@ const EngineSTTDropdown: React.FC<EngineSTTDropdownProps> = ({ external }) => {
         testId="EngineSTTDropdown"
         className="z-50"
         aria-labelledby={labelId}
+        disabled={!speechToText}
       />
     </div>
   );
diff --git a/client/src/components/Nav/SettingsTabs/Speech/STT/LanguageSTTDropdown.tsx b/client/src/components/Nav/SettingsTabs/Speech/STT/LanguageSTTDropdown.tsx
index 53da4e79891..617a6a275f4 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/STT/LanguageSTTDropdown.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/STT/LanguageSTTDropdown.tsx
@@ -1,11 +1,12 @@
-import { useRecoilState } from 'recoil';
 import { Dropdown } from '@librechat/client';
+import { useRecoilState, useRecoilValue } from 'recoil';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
 export default function LanguageSTTDropdown() {
   const localize = useLocalize();
   const [languageSTT, setLanguageSTT] = useRecoilState<string>(store.languageSTT);
+  const speechToText = useRecoilValue(store.speechToText);
 
   const languageOptions = [
     { value: 'af', label: 'Afrikaans' },
@@ -107,6 +108,7 @@ export default function LanguageSTTDropdown() {
         testId="LanguageSTTDropdown"
         className="z-50"
         aria-labelledby={labelId}
+        disabled={!speechToText}
       />
     </div>
   );
diff --git a/client/src/components/Nav/SettingsTabs/Speech/Speech.tsx b/client/src/components/Nav/SettingsTabs/Speech/Speech.tsx
deleted file mode 100644
index c3ea966e2d5..00000000000
--- a/client/src/components/Nav/SettingsTabs/Speech/Speech.tsx
+++ /dev/null
@@ -1,243 +0,0 @@
-import React, { useState, useRef, useEffect, useCallback } from 'react';
-import { useRecoilState } from 'recoil';
-import * as Tabs from '@radix-ui/react-tabs';
-import { Lightbulb, Cog } from 'lucide-react';
-import { useOnClickOutside, useMediaQuery } from '@librechat/client';
-import { useGetCustomConfigSpeechQuery } from 'librechat-data-provider/react-query';
-import {
-  CloudBrowserVoicesSwitch,
-  AutomaticPlaybackSwitch,
-  TextToSpeechSwitch,
-  EngineTTSDropdown,
-  CacheTTSSwitch,
-  VoiceDropdown,
-  PlaybackRate,
-} from './TTS';
-import {
-  AutoTranscribeAudioSwitch,
-  LanguageSTTDropdown,
-  SpeechToTextSwitch,
-  AutoSendTextSelector,
-  EngineSTTDropdown,
-  DecibelSelector,
-} from './STT';
-import ConversationModeSwitch from './ConversationModeSwitch';
-import { useLocalize } from '~/hooks';
-import { cn } from '~/utils';
-import store from '~/store';
-
-function Speech() {
-  const localize = useLocalize();
-
-  const [confirmClear, setConfirmClear] = useState(false);
-  const { data } = useGetCustomConfigSpeechQuery();
-  const isSmallScreen = useMediaQuery('(max-width: 767px)');
-
-  const [sttExternal, setSttExternal] = useState(false);
-  const [ttsExternal, setTtsExternal] = useState(false);
-  const [advancedMode, setAdvancedMode] = useRecoilState(store.advancedMode);
-  const [autoTranscribeAudio, setAutoTranscribeAudio] = useRecoilState(store.autoTranscribeAudio);
-  const [conversationMode, setConversationMode] = useRecoilState(store.conversationMode);
-  const [speechToText, setSpeechToText] = useRecoilState(store.speechToText);
-  const [textToSpeech, setTextToSpeech] = useRecoilState(store.textToSpeech);
-  const [cacheTTS, setCacheTTS] = useRecoilState(store.cacheTTS);
-  const [engineSTT, setEngineSTT] = useRecoilState<string>(store.engineSTT);
-  const [languageSTT, setLanguageSTT] = useRecoilState<string>(store.languageSTT);
-  const [decibelValue, setDecibelValue] = useRecoilState(store.decibelValue);
-  const [autoSendText, setAutoSendText] = useRecoilState(store.autoSendText);
-  const [engineTTS, setEngineTTS] = useRecoilState<string>(store.engineTTS);
-  const [voice, setVoice] = useRecoilState(store.voice);
-  const [cloudBrowserVoices, setCloudBrowserVoices] = useRecoilState<boolean>(
-    store.cloudBrowserVoices,
-  );
-  const [languageTTS, setLanguageTTS] = useRecoilState<string>(store.languageTTS);
-  const [automaticPlayback, setAutomaticPlayback] = useRecoilState(store.automaticPlayback);
-  const [playbackRate, setPlaybackRate] = useRecoilState(store.playbackRate);
-
-  const updateSetting = useCallback(
-    (key: string, newValue: string | number) => {
-      const settings = {
-        sttExternal: { value: sttExternal, setFunc: setSttExternal },
-        ttsExternal: { value: ttsExternal, setFunc: setTtsExternal },
-        conversationMode: { value: conversationMode, setFunc: setConversationMode },
-        advancedMode: { value: advancedMode, setFunc: setAdvancedMode },
-        speechToText: { value: speechToText, setFunc: setSpeechToText },
-        textToSpeech: { value: textToSpeech, setFunc: setTextToSpeech },
-        cacheTTS: { value: cacheTTS, setFunc: setCacheTTS },
-        engineSTT: { value: engineSTT, setFunc: setEngineSTT },
-        languageSTT: { value: languageSTT, setFunc: setLanguageSTT },
-        autoTranscribeAudio: { value: autoTranscribeAudio, setFunc: setAutoTranscribeAudio },
-        decibelValue: { value: decibelValue, setFunc: setDecibelValue },
-        autoSendText: { value: autoSendText, setFunc: setAutoSendText },
-        engineTTS: { value: engineTTS, setFunc: setEngineTTS },
-        voice: { value: voice, setFunc: setVoice },
-        cloudBrowserVoices: { value: cloudBrowserVoices, setFunc: setCloudBrowserVoices },
-        languageTTS: { value: languageTTS, setFunc: setLanguageTTS },
-        automaticPlayback: { value: automaticPlayback, setFunc: setAutomaticPlayback },
-        playbackRate: { value: playbackRate, setFunc: setPlaybackRate },
-      };
-
-      const setting = settings[key];
-      if (setting) {
-        setting.setFunc(newValue);
-      }
-    },
-    [
-      sttExternal,
-      ttsExternal,
-      conversationMode,
-      advancedMode,
-      speechToText,
-      textToSpeech,
-      cacheTTS,
-      engineSTT,
-      languageSTT,
-      autoTranscribeAudio,
-      decibelValue,
-      autoSendText,
-      engineTTS,
-      voice,
-      cloudBrowserVoices,
-      languageTTS,
-      automaticPlayback,
-      playbackRate,
-      setSttExternal,
-      setTtsExternal,
-      setConversationMode,
-      setAdvancedMode,
-      setSpeechToText,
-      setTextToSpeech,
-      setCacheTTS,
-      setEngineSTT,
-      setLanguageSTT,
-      setAutoTranscribeAudio,
-      setDecibelValue,
-      setAutoSendText,
-      setEngineTTS,
-      setVoice,
-      setCloudBrowserVoices,
-      setLanguageTTS,
-      setAutomaticPlayback,
-      setPlaybackRate,
-    ],
-  );
-
-  useEffect(() => {
-    if (data && data.message !== 'not_found') {
-      Object.entries(data).forEach(([key, value]) => {
-        // Only apply config values as defaults if no user preference exists in localStorage
-        const existingValue = localStorage.getItem(key);
-        if (existingValue === null && key !== 'sttExternal' && key !== 'ttsExternal') {
-          updateSetting(key, value);
-        } else if (key === 'sttExternal' || key === 'ttsExternal') {
-          updateSetting(key, value);
-        }
-      });
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [data]);
-
-  // Reset engineTTS if it is set to a removed/invalid value (e.g., 'edge')
-  // TODO: remove this once the 'edge' engine is fully deprecated
-  useEffect(() => {
-    const validEngines = ['browser', 'external'];
-    if (!validEngines.includes(engineTTS)) {
-      setEngineTTS('browser');
-    }
-  }, [engineTTS, setEngineTTS]);
-
-  const contentRef = useRef(null);
-  useOnClickOutside(contentRef, () => confirmClear && setConfirmClear(false), []);
-
-  return (
-    <Tabs.Root
-      defaultValue={'simple'}
-      orientation="horizontal"
-      value={advancedMode ? 'advanced' : 'simple'}
-    >
-      <div className="sticky -top-1 z-50 mb-4 bg-white dark:bg-gray-700">
-        <Tabs.List className="flex justify-center bg-background">
-          <Tabs.Trigger
-            onClick={() => setAdvancedMode(false)}
-            className={cn(
-              'group m-1 flex items-center justify-center gap-2 bg-transparent px-4 py-2 text-sm text-text-secondary transition-all duration-200 ease-in-out radix-state-active:bg-secondary radix-state-active:text-foreground radix-state-active:shadow-lg',
-              isSmallScreen ? 'flex-row rounded-lg' : 'rounded-xl',
-              'w-full',
-            )}
-            value="simple"
-            style={{ userSelect: 'none' }}
-          >
-            <Lightbulb aria-hidden="true" />
-            {localize('com_ui_simple')}
-          </Tabs.Trigger>
-          <Tabs.Trigger
-            onClick={() => setAdvancedMode(true)}
-            className={cn(
-              'group m-1 flex items-center justify-center gap-2 bg-transparent px-4 py-2 text-sm text-text-secondary transition-all duration-200 ease-in-out radix-state-active:bg-secondary radix-state-active:text-foreground radix-state-active:shadow-lg',
-              isSmallScreen ? 'flex-row rounded-lg' : 'rounded-xl',
-              'w-full',
-            )}
-            value="advanced"
-            style={{ userSelect: 'none' }}
-          >
-            <Cog aria-hidden="true" />
-            {localize('com_ui_advanced')}
-          </Tabs.Trigger>
-        </Tabs.List>
-      </div>
-
-      <Tabs.Content value={'simple'} tabIndex={-1}>
-        <div className="flex flex-col gap-3 text-sm text-text-primary">
-          <SpeechToTextSwitch />
-          <EngineSTTDropdown external={sttExternal} />
-          <LanguageSTTDropdown />
-          <div className="h-px bg-border-medium" role="none" />
-          <TextToSpeechSwitch />
-          <EngineTTSDropdown external={ttsExternal} />
-          <VoiceDropdown />
-        </div>
-      </Tabs.Content>
-
-      <Tabs.Content value={'advanced'} tabIndex={-1}>
-        <div className="flex flex-col gap-3 text-sm text-text-primary">
-          <ConversationModeSwitch />
-          <div className="mt-2 h-px bg-border-medium" role="none" />
-          <SpeechToTextSwitch />
-
-          <EngineSTTDropdown external={sttExternal} />
-
-          <LanguageSTTDropdown />
-          <div className="pb-2">
-            <AutoTranscribeAudioSwitch />
-          </div>
-          {autoTranscribeAudio && (
-            <div className="pb-2">
-              <DecibelSelector />
-            </div>
-          )}
-          <div className="pb-2">
-            <AutoSendTextSelector />
-          </div>
-          <div className="h-px bg-border-medium" role="none" />
-          <div className="pb-3">
-            <TextToSpeechSwitch />
-          </div>
-          <AutomaticPlaybackSwitch />
-          <EngineTTSDropdown external={ttsExternal} />
-          <VoiceDropdown />
-          {engineTTS === 'browser' && (
-            <div className="pb-2">
-              <CloudBrowserVoicesSwitch />
-            </div>
-          )}
-          <div className="pb-2">
-            <PlaybackRate />
-          </div>
-          <CacheTTSSwitch />
-        </div>
-      </Tabs.Content>
-    </Tabs.Root>
-  );
-}
-
-export default React.memo(Speech);
diff --git a/client/src/components/Nav/SettingsTabs/Speech/TTS/AutomaticPlaybackSwitch.tsx b/client/src/components/Nav/SettingsTabs/Speech/TTS/AutomaticPlaybackSwitch.tsx
index 916d38f5af3..31006a5d5c9 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/TTS/AutomaticPlaybackSwitch.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/TTS/AutomaticPlaybackSwitch.tsx
@@ -1,3 +1,4 @@
+import { useRecoilValue } from 'recoil';
 import ToggleSwitch from '../../ToggleSwitch';
 import store from '~/store';
 
@@ -6,12 +7,14 @@ export default function AutomaticPlaybackSwitch({
 }: {
   onCheckedChange?: (value: boolean) => void;
 }) {
+  const textToSpeech = useRecoilValue(store.textToSpeech);
   return (
     <ToggleSwitch
       stateAtom={store.automaticPlayback}
       localizationKey={'com_nav_automatic_playback' as const}
       switchId="AutomaticPlayback"
       onCheckedChange={onCheckedChange}
+      disabled={!textToSpeech}
     />
   );
 }
diff --git a/client/src/components/Nav/SettingsTabs/Speech/TTS/EngineTTSDropdown.tsx b/client/src/components/Nav/SettingsTabs/Speech/TTS/EngineTTSDropdown.tsx
index a5a576ba921..466a972a73f 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/TTS/EngineTTSDropdown.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/TTS/EngineTTSDropdown.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
-import { useRecoilState } from 'recoil';
 import { Dropdown } from '@librechat/client';
+import { useRecoilState, useRecoilValue } from 'recoil';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
@@ -11,6 +11,7 @@ interface EngineTTSDropdownProps {
 const EngineTTSDropdown: React.FC<EngineTTSDropdownProps> = ({ external }) => {
   const localize = useLocalize();
   const [engineTTS, setEngineTTS] = useRecoilState<string>(store.engineTTS);
+  const textToSpeech = useRecoilValue(store.textToSpeech);
 
   const endpointOptions = external
     ? [
@@ -36,6 +37,7 @@ const EngineTTSDropdown: React.FC<EngineTTSDropdownProps> = ({ external }) => {
         testId="EngineTTSDropdown"
         className="z-50"
         aria-labelledby={labelId}
+        disabled={!textToSpeech}
       />
     </div>
   );
diff --git a/client/src/components/Nav/SettingsTabs/Speech/TTS/VoiceDropdown.tsx b/client/src/components/Nav/SettingsTabs/Speech/TTS/VoiceDropdown.tsx
index 259400fb77b..5a9888b8a59 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/TTS/VoiceDropdown.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/TTS/VoiceDropdown.tsx
@@ -10,11 +10,12 @@ const voiceDropdownComponentsMap = {
 
 export default function VoiceDropdown() {
   const engineTTS = useRecoilValue<string>(store.engineTTS);
+  const textToSpeech = useRecoilValue(store.textToSpeech);
   const VoiceDropdownComponent = voiceDropdownComponentsMap[engineTTS];
 
   if (!VoiceDropdownComponent) {
     return null;
   }
 
-  return <VoiceDropdownComponent />;
+  return <VoiceDropdownComponent disabled={!textToSpeech} />;
 }
diff --git a/client/src/components/Nav/SettingsTabs/index.ts b/client/src/components/Nav/SettingsTabs/index.ts
index 911cbaa98a5..a220a2496c4 100644
--- a/client/src/components/Nav/SettingsTabs/index.ts
+++ b/client/src/components/Nav/SettingsTabs/index.ts
@@ -1,8 +1,2 @@
-export { default as Chat } from './Chat/Chat';
-export { default as Data } from './Data/Data';
-export { default as Speech } from './Speech/Speech';
-export { default as Balance } from './Balance/Balance';
-export { default as General } from './General/General';
-export { default as Account } from './Account/Account';
-export { default as Commands } from './Commands/Commands';
-export { default as Personalization } from './Personalization';
+export { default as About } from './About/About';
+export { ThemeSelector, LangSelector } from './General/Selectors';
diff --git a/client/src/components/Nav/ShortcutKeyCombo.tsx b/client/src/components/Nav/ShortcutKeyCombo.tsx
new file mode 100644
index 00000000000..c36b05daad3
--- /dev/null
+++ b/client/src/components/Nav/ShortcutKeyCombo.tsx
@@ -0,0 +1,43 @@
+import type { ReactNode } from 'react';
+import { cn } from '~/utils';
+
+export function parseShortcutKeys(display: string): string[] {
+  return display.split(/([+\s]+)/).filter((key) => key.trim().length > 0 && key !== '+');
+}
+
+function ShortcutKbd({ children, className = '' }: { children: ReactNode; className?: string }) {
+  return (
+    <kbd
+      className={cn(
+        'inline-flex h-[22px] min-w-[22px] items-center justify-center rounded-md border border-border-light bg-surface-primary-alt px-1.5 font-sans text-[11px] font-medium leading-none text-text-primary',
+        className,
+      )}
+    >
+      {children}
+    </kbd>
+  );
+}
+
+export default function ShortcutKeyCombo({
+  display,
+  keys,
+  className = '',
+  keyClassName = '',
+}: {
+  display?: string;
+  keys?: string[];
+  className?: string;
+  keyClassName?: string;
+}) {
+  const shortcutKeys = keys ?? parseShortcutKeys(display ?? '');
+
+  return (
+    <div className={cn('flex items-center gap-1', className)}>
+      {shortcutKeys.map((key, idx) => (
+        <ShortcutKbd key={`${key}-${idx}`} className={keyClassName}>
+          {key}
+        </ShortcutKbd>
+      ))}
+    </div>
+  );
+}
diff --git a/client/src/components/Nav/ShortcutRecorder.tsx b/client/src/components/Nav/ShortcutRecorder.tsx
new file mode 100644
index 00000000000..9c151482b05
--- /dev/null
+++ b/client/src/components/Nav/ShortcutRecorder.tsx
@@ -0,0 +1,267 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { X } from 'lucide-react';
+import type { RefObject } from 'react';
+import type { ShortcutBinding } from '~/utils/shortcuts';
+import {
+  bindingDisplayKeys,
+  bindingHash,
+  isCancelKey,
+  isModifierKey,
+  isValidBinding,
+  normalizeKey,
+} from '~/utils/shortcuts';
+import { isMac } from '~/hooks/useKeyboardShortcuts';
+import ShortcutKeyCombo from './ShortcutKeyCombo';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+type ConflictInfo = {
+  conflictId: string;
+  conflictLabel: string;
+  binding: ShortcutBinding;
+};
+
+type RecorderState = {
+  containerRef: RefObject<HTMLDivElement>;
+  boundaryRef: RefObject<HTMLDivElement>;
+  previewKeys: string[];
+  hasConflict: boolean;
+  conflict: ConflictInfo | null;
+  showInvalid: boolean;
+  showHint: boolean;
+  onKeyDown: (e: React.KeyboardEvent<HTMLDivElement>) => void;
+  onKeyUp: () => void;
+  onTryAgain: () => void;
+};
+
+type Options = {
+  initial: ShortcutBinding | null;
+  bindingMap: Map<string, string>;
+  ownerId: string;
+  getActionLabel: (id: string) => string;
+  onSave: (binding: ShortcutBinding) => void;
+  onCancel: () => void;
+};
+
+export function useShortcutRecorder({
+  initial,
+  bindingMap,
+  ownerId,
+  getActionLabel,
+  onSave,
+  onCancel,
+}: Options): RecorderState {
+  const containerRef = useRef<HTMLDivElement>(null);
+  const boundaryRef = useRef<HTMLDivElement>(null);
+  const [pending, setPending] = useState<ShortcutBinding | null>(null);
+  const [draft, setDraft] = useState<ShortcutBinding | null>(initial);
+  const [error, setError] = useState<'noModifier' | null>(null);
+  const [conflict, setConflict] = useState<ConflictInfo | null>(null);
+
+  const previewKeys = useMemo(() => {
+    const source = pending ?? draft;
+    if (!source) return [];
+    return bindingDisplayKeys(source, isMac);
+  }, [pending, draft]);
+
+  const onKeyDown = useCallback(
+    (e: React.KeyboardEvent<HTMLDivElement>) => {
+      e.preventDefault();
+      e.stopPropagation();
+
+      if (isCancelKey(e.nativeEvent)) {
+        onCancel();
+        return;
+      }
+
+      const previewBinding: ShortcutBinding = {
+        meta: e.metaKey,
+        ctrl: e.ctrlKey,
+        alt: e.altKey,
+        shift: e.shiftKey,
+        key: isModifierKey(e.key) ? '' : normalizeKey(e.key, e.shiftKey),
+      };
+
+      if (!previewBinding.key) {
+        setPending({ ...previewBinding, key: '…' });
+        return;
+      }
+
+      setPending(null);
+      const validation = isValidBinding(previewBinding);
+      if (!validation.valid) {
+        setDraft(previewBinding);
+        setError('noModifier');
+        setConflict(null);
+        return;
+      }
+      setError(null);
+      const hash = bindingHash(previewBinding);
+      const conflictId = bindingMap.get(hash);
+      if (conflictId && conflictId !== ownerId) {
+        setDraft(previewBinding);
+        setConflict({
+          conflictId,
+          conflictLabel: getActionLabel(conflictId),
+          binding: previewBinding,
+        });
+        return;
+      }
+      setConflict(null);
+      onSave(previewBinding);
+    },
+    [bindingMap, getActionLabel, onCancel, onSave, ownerId],
+  );
+
+  const onKeyUp = useCallback(() => {
+    setPending(null);
+  }, []);
+
+  const onTryAgain = useCallback(() => {
+    setDraft(initial);
+    setConflict(null);
+    setError(null);
+    containerRef.current?.focus();
+  }, [initial]);
+
+  useEffect(() => {
+    containerRef.current?.focus();
+  }, []);
+
+  useEffect(() => {
+    function onPointerDown(e: PointerEvent) {
+      const root = boundaryRef.current ?? containerRef.current;
+      if (root && !root.contains(e.target as Node)) {
+        onCancel();
+      }
+    }
+    document.addEventListener('pointerdown', onPointerDown);
+    return () => document.removeEventListener('pointerdown', onPointerDown);
+  }, [onCancel]);
+
+  return {
+    containerRef,
+    boundaryRef,
+    previewKeys,
+    hasConflict: !!conflict,
+    conflict,
+    showInvalid: error === 'noModifier',
+    showHint: previewKeys.length === 0,
+    onKeyDown,
+    onKeyUp,
+    onTryAgain,
+  };
+}
+
+export function RecorderPill({
+  state,
+  ariaLabel,
+  ownerId,
+}: {
+  state: RecorderState;
+  ariaLabel: string;
+  ownerId: string;
+}) {
+  const localize = useLocalize();
+  const { containerRef, previewKeys, hasConflict, showInvalid, showHint, onKeyDown, onKeyUp } =
+    state;
+  let stateBorder = 'border-border-medium';
+  if (hasConflict) {
+    stateBorder = 'border-amber-500/60';
+  } else if (showInvalid) {
+    stateBorder = 'animate-shortcut-shake border-red-500/60';
+  }
+  return (
+    <div
+      ref={containerRef}
+      role="textbox"
+      tabIndex={0}
+      aria-label={ariaLabel}
+      aria-describedby={`${ownerId}-recorder-hint`}
+      data-testid={`shortcut-recorder-${ownerId}`}
+      onKeyDown={onKeyDown}
+      onKeyUp={onKeyUp}
+      className={cn(
+        'flex h-[30px] items-center gap-1.5 rounded-md border bg-surface-primary px-2 outline-none transition-colors',
+        'focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-1 focus-visible:ring-offset-surface-primary-alt',
+        stateBorder,
+      )}
+    >
+      {showHint ? (
+        <span className="text-[11.5px] text-text-secondary">
+          {localize('com_shortcut_recorder_placeholder')}
+        </span>
+      ) : (
+        <ShortcutKeyCombo keys={previewKeys} />
+      )}
+    </div>
+  );
+}
+
+export function RecorderInfo({
+  state,
+  ownerId,
+  onCancel,
+  onSaveReplacing,
+}: {
+  state: RecorderState;
+  ownerId: string;
+  onCancel: () => void;
+  onSaveReplacing: (binding: ShortcutBinding, conflictId: string) => void;
+}) {
+  const localize = useLocalize();
+  const { hasConflict, conflict, showInvalid, onTryAgain } = state;
+
+  if (hasConflict && conflict) {
+    return (
+      <div
+        id={`${ownerId}-recorder-hint`}
+        className="flex flex-wrap items-center justify-end gap-x-2 gap-y-1 pl-1 text-[11.5px]"
+      >
+        <span className="text-text-secondary">
+          {localize('com_shortcut_recorder_conflict_prefix')}{' '}
+          <span className="font-medium text-text-primary">{conflict.conflictLabel}</span>
+        </span>
+        <div className="flex shrink-0 items-center gap-1">
+          <button
+            type="button"
+            onClick={onTryAgain}
+            className="whitespace-nowrap rounded-md px-1.5 py-0.5 text-text-secondary transition-colors hover:text-text-primary"
+          >
+            {localize('com_shortcut_recorder_try_again')}
+          </button>
+          <button
+            type="button"
+            onClick={() => onSaveReplacing(conflict.binding, conflict.conflictId)}
+            className="whitespace-nowrap rounded-md bg-surface-tertiary px-2 py-0.5 font-medium text-text-primary transition-colors hover:bg-surface-active-alt"
+          >
+            {localize('com_shortcut_recorder_replace')}
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div id={`${ownerId}-recorder-hint`} className="flex items-center justify-end gap-2 pl-1">
+      <span
+        className={cn(
+          'text-[11.5px]',
+          showInvalid ? 'text-red-600 dark:text-red-400' : 'text-text-secondary',
+        )}
+      >
+        {showInvalid
+          ? localize('com_shortcut_recorder_needs_modifier')
+          : localize('com_shortcut_recorder_hint')}
+      </span>
+      <button
+        type="button"
+        onClick={onCancel}
+        aria-label={localize('com_ui_cancel')}
+        className="inline-flex h-5 w-5 items-center justify-center rounded text-text-secondary transition-colors hover:bg-surface-active-alt hover:text-text-primary"
+      >
+        <X className="h-3 w-3" />
+      </button>
+    </div>
+  );
+}
diff --git a/client/src/components/Plugins/Store/PluginAuthForm.tsx b/client/src/components/Plugins/Store/PluginAuthForm.tsx
index d304b2eab77..effc3643c34 100644
--- a/client/src/components/Plugins/Store/PluginAuthForm.tsx
+++ b/client/src/components/Plugins/Store/PluginAuthForm.tsx
@@ -1,6 +1,6 @@
 import { Save } from 'lucide-react';
 import { useForm } from 'react-hook-form';
-import { HoverCard, HoverCardTrigger } from '@librechat/client';
+import { HoverCard, HoverCardTrigger, SecretInput } from '@librechat/client';
 import { TPlugin, TPluginAuthConfig, TPluginAction } from 'librechat-data-provider';
 import PluginTooltip from './PluginTooltip';
 import { useLocalize } from '~/hooks';
@@ -40,6 +40,31 @@ function PluginAuthForm({ plugin, onSubmit, isEntityTool }: TPluginAuthFormProps
           {authConfig.map((config: TPluginAuthConfig, i: number) => {
             const authField = config.authField.split('||')[0];
             const isOptional = config.optional === true;
+            const inputClassName =
+              'flex h-10 max-h-10 w-full resize-none rounded-md border border-gray-200 bg-transparent px-3 py-2 text-sm text-gray-700 shadow-[0_0_10px_rgba(0,0,0,0.05)] outline-none placeholder:text-gray-400 focus:border-gray-400 focus:bg-gray-50 focus:outline-none focus:ring-0 focus:ring-gray-400 focus:ring-opacity-0 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-500 dark:bg-gray-700 dark:text-gray-50 dark:shadow-[0_0_15px_rgba(0,0,0,0.10)] dark:focus:border-gray-400 focus:dark:bg-gray-600 dark:focus:outline-none dark:focus:ring-0 dark:focus:ring-gray-400 dark:focus:ring-offset-0';
+            const sharedProps = {
+              id: authField,
+              'aria-invalid': !!errors[authField],
+              'aria-describedby': `${authField}-error`,
+              'aria-label': config.label,
+              'aria-required': !isOptional,
+              /* autoFocus is generally disorienting, but here the required field must be navigated to
+               * anyway, and the form emulates a modal opening where users expect focus to shift. */
+              autoFocus: i === 0,
+              className: inputClassName,
+              ...register(
+                authField,
+                isOptional
+                  ? {}
+                  : {
+                      required: `${config.label} is required.`,
+                      minLength: {
+                        value: 1,
+                        message: `${config.label} must be at least 1 character long`,
+                      },
+                    },
+              ),
+            };
             return (
               <div key={`${authField}-${i}`} className="flex w-full flex-col gap-1">
                 <label
@@ -50,33 +75,17 @@ function PluginAuthForm({ plugin, onSubmit, isEntityTool }: TPluginAuthFormProps
                 </label>
                 <HoverCard openDelay={300}>
                   <HoverCardTrigger className="grid w-full items-center gap-2">
-                    <input
-                      type="text"
-                      autoComplete="off"
-                      id={authField}
-                      aria-invalid={!!errors[authField]}
-                      aria-describedby={`${authField}-error`}
-                      aria-label={config.label}
-                      aria-required={!isOptional}
-                      /* autoFocus is generally disabled due to the fact that it can disorient users,
-                       * but in this case, the required field must be navigated to anyways, and the component's functionality
-                       * emulates that of a new modal opening, where users would expect focus to be shifted to the new content */
-                      // eslint-disable-next-line jsx-a11y/no-autofocus
-                      autoFocus={i === 0}
-                      {...register(
-                        authField,
-                        isOptional
-                          ? {}
-                          : {
-                              required: `${config.label} is required.`,
-                              minLength: {
-                                value: 1,
-                                message: `${config.label} must be at least 1 character long`,
-                              },
-                            },
-                      )}
-                      className="flex h-10 max-h-10 w-full resize-none rounded-md border border-gray-200 bg-transparent px-3 py-2 text-sm text-gray-700 shadow-[0_0_10px_rgba(0,0,0,0.05)] outline-none placeholder:text-gray-400 focus:border-gray-400 focus:bg-gray-50 focus:outline-none focus:ring-0 focus:ring-gray-400 focus:ring-opacity-0 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-500 dark:bg-gray-700 dark:text-gray-50 dark:shadow-[0_0_15px_rgba(0,0,0,0.10)] dark:focus:border-gray-400 focus:dark:bg-gray-600 dark:focus:outline-none dark:focus:ring-0 dark:focus:ring-gray-400 dark:focus:ring-offset-0"
-                    />
+                    {config.sensitive === false ? (
+                      <input type="text" autoComplete="off" {...sharedProps} />
+                    ) : (
+                      <SecretInput
+                        autoComplete="new-password"
+                        data-lpignore="true"
+                        data-1p-ignore="true"
+                        controlsOnHover
+                        {...sharedProps}
+                      />
+                    )}
                   </HoverCardTrigger>
                   <PluginTooltip content={config.description} position="right" />
                 </HoverCard>
diff --git a/client/src/components/Plugins/Store/__tests__/PluginAuthForm.spec.tsx b/client/src/components/Plugins/Store/__tests__/PluginAuthForm.spec.tsx
index 7d9676d2485..d80e99e04ef 100644
--- a/client/src/components/Plugins/Store/__tests__/PluginAuthForm.spec.tsx
+++ b/client/src/components/Plugins/Store/__tests__/PluginAuthForm.spec.tsx
@@ -23,8 +23,29 @@ describe('PluginAuthForm', () => {
     //@ts-ignore - dont need all props of plugin
     render(<PluginAuthForm plugin={plugin} onSubmit={onSubmit} />);
 
-    expect(screen.getByLabelText('Key')).toBeInTheDocument();
-    expect(screen.getByLabelText('Secret')).toBeInTheDocument();
+    expect(screen.getByLabelText('Key')).toHaveAttribute('type', 'password');
+    expect(screen.getByLabelText('Secret')).toHaveAttribute('type', 'password');
+  });
+
+  it('masks fields by default and renders non-sensitive fields as plain text', () => {
+    const mixedPlugin = {
+      pluginKey: 'mixed-plugin',
+      authConfig: [
+        { authField: 'token', label: 'Token' },
+        { authField: 'secret', label: 'Secret', sensitive: true },
+        { authField: 'url', label: 'URL', sensitive: false },
+      ],
+    };
+
+    //@ts-ignore - dont need all props of plugin
+    render(<PluginAuthForm plugin={mixedPlugin} onSubmit={onSubmit} />);
+
+    expect(screen.getByLabelText('Token')).toHaveAttribute('type', 'password');
+    expect(screen.getByLabelText('Secret')).toHaveAttribute('type', 'password');
+
+    const urlField = screen.getByLabelText('URL');
+    expect(urlField).toHaveAttribute('type', 'text');
+    expect(urlField.parentElement?.querySelector('button')).toBeNull();
   });
 
   it('calls the onSubmit function with the form data when submitted', async () => {
diff --git a/client/src/components/Projects/ProjectChatList.tsx b/client/src/components/Projects/ProjectChatList.tsx
new file mode 100644
index 00000000000..fe1a8aa55a3
--- /dev/null
+++ b/client/src/components/Projects/ProjectChatList.tsx
@@ -0,0 +1,261 @@
+import {
+  memo,
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  type CSSProperties,
+  type FC,
+  type ReactNode,
+} from 'react';
+import throttle from 'lodash/throttle';
+import { Spinner } from '@librechat/client';
+import { AutoSizer, CellMeasurer, CellMeasurerCache, List } from 'react-virtualized';
+import type { TConversation } from 'librechat-data-provider';
+import type { MeasuredCellParent } from '~/components/Conversations/Conversations';
+import ConversationEndpointIcon from '~/components/Conversations/ConversationEndpointIcon';
+import { areConversationRenderPropsEqual } from '~/components/Conversations/utils';
+import { DateLabel } from '~/components/Conversations/Conversations';
+import { useLocalize, useNavigateToConvo } from '~/hooks';
+import { groupConversationsByDate, cn } from '~/utils';
+import { useActiveJobs } from '~/data-provider';
+
+type ChatSortField = 'updatedAt' | 'createdAt';
+
+type FlattenedItem =
+  | { type: 'date'; groupName: string }
+  | { type: 'convo'; convo: TConversation }
+  | { type: 'loading' }
+  | { type: 'empty' };
+
+interface ProjectChatListProps {
+  conversations: TConversation[];
+  isLoading: boolean;
+  isFetchingNextPage: boolean;
+  hasNextPage: boolean;
+  sortBy: ChatSortField;
+  emptyLabel: string;
+  loadMore: () => void;
+}
+
+interface MeasuredRowProps {
+  cache: CellMeasurerCache;
+  rowKey: string;
+  parent: MeasuredCellParent;
+  index: number;
+  style: CSSProperties;
+  children: ReactNode;
+}
+
+const MeasuredRow: FC<MeasuredRowProps> = memo(
+  ({ cache, rowKey, parent, index, style, children }) => (
+    <CellMeasurer cache={cache} columnIndex={0} key={rowKey} parent={parent} rowIndex={index}>
+      {({ registerChild }) => (
+        <div ref={registerChild as React.LegacyRef<HTMLDivElement>} style={style}>
+          {children}
+        </div>
+      )}
+    </CellMeasurer>
+  ),
+);
+
+MeasuredRow.displayName = 'ProjectWorkspaceMeasuredRow';
+
+const LoadingRow = memo(() => {
+  const localize = useLocalize();
+  return (
+    <div className="flex items-center justify-center gap-2 py-4 text-sm text-text-secondary">
+      <Spinner className="text-text-primary" />
+      <span>{localize('com_ui_loading')}</span>
+    </div>
+  );
+});
+
+LoadingRow.displayName = 'ProjectWorkspaceLoadingRow';
+
+const ConversationRow = memo(
+  ({ conversation, isGenerating }: { conversation: TConversation; isGenerating: boolean }) => {
+    const { navigateToConvo } = useNavigateToConvo();
+    const localize = useLocalize();
+    const title = conversation.title || localize('com_ui_untitled');
+    const updatedAt = conversation.updatedAt || conversation.createdAt;
+    const formattedDate = updatedAt ? new Date(updatedAt).toLocaleString() : '';
+
+    return (
+      <button
+        type="button"
+        className="flex w-full items-center gap-3 border-b border-border-light py-3 text-left outline-none transition-colors hover:bg-surface-hover focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring-primary"
+        onClick={() => navigateToConvo(conversation)}
+      >
+        <span className="flex h-8 w-8 shrink-0 items-center justify-center">
+          <ConversationEndpointIcon conversation={conversation} size={24} context="menu-item" />
+        </span>
+        <span className="min-w-0 flex-1">
+          <span className="block truncate text-sm font-medium text-text-primary">{title}</span>
+          <span className="block truncate text-xs text-text-secondary">{formattedDate}</span>
+        </span>
+        {isGenerating && (
+          <Spinner
+            className="h-4 w-4 shrink-0 text-text-primary"
+            aria-label={localize('com_ui_generating')}
+          />
+        )}
+      </button>
+    );
+  },
+  areConversationRenderPropsEqual,
+);
+
+ConversationRow.displayName = 'ProjectWorkspaceConversationRow';
+
+const ProjectChatList = ({
+  conversations,
+  isLoading,
+  isFetchingNextPage,
+  hasNextPage,
+  sortBy,
+  emptyLabel,
+  loadMore,
+}: ProjectChatListProps) => {
+  const { data: activeJobsData } = useActiveJobs();
+  const activeJobIds = useMemo(
+    () => new Set(activeJobsData?.activeJobIds ?? []),
+    [activeJobsData?.activeJobIds],
+  );
+  const flattenedItems = useMemo(() => {
+    if (isLoading) {
+      return [{ type: 'loading' as const }];
+    }
+    if (!conversations.length) {
+      return [{ type: 'empty' as const }];
+    }
+
+    const items: FlattenedItem[] = [];
+    groupConversationsByDate(conversations, sortBy).forEach(([groupName, convos]) => {
+      items.push({ type: 'date', groupName });
+      convos.forEach((convo) => items.push({ type: 'convo', convo }));
+    });
+    if (isFetchingNextPage) {
+      items.push({ type: 'loading' });
+    }
+    return items;
+  }, [conversations, isFetchingNextPage, isLoading, sortBy]);
+
+  const flattenedItemsRef = useRef(flattenedItems);
+  flattenedItemsRef.current = flattenedItems;
+
+  const cache = useMemo(
+    () =>
+      new CellMeasurerCache({
+        fixedWidth: true,
+        defaultHeight: 52,
+        keyMapper: (index) => {
+          const item = flattenedItemsRef.current[index];
+          if (!item) {
+            return `project-workspace-unknown-${index}`;
+          }
+          if (item.type === 'date') {
+            return `project-workspace-date-${item.groupName}`;
+          }
+          if (item.type === 'convo') {
+            return `project-workspace-convo-${item.convo.conversationId}`;
+          }
+          return `project-workspace-${item.type}`;
+        },
+      }),
+    [],
+  );
+
+  const listRef = useRef<List | null>(null);
+
+  useEffect(() => {
+    const frameId = requestAnimationFrame(() => {
+      cache.clearAll();
+      listRef.current?.recomputeRowHeights(0);
+    });
+    return () => cancelAnimationFrame(frameId);
+  }, [cache, conversations.length, sortBy]);
+
+  const throttledLoadMore = useMemo(() => throttle(loadMore, 300), [loadMore]);
+
+  const rowRenderer = useCallback(
+    ({ index, key, parent, style }) => {
+      const item = flattenedItems[index];
+      const rowProps = { cache, rowKey: key, parent, index, style };
+
+      if (item.type === 'loading') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <LoadingRow />
+          </MeasuredRow>
+        );
+      }
+
+      if (item.type === 'empty') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <div className="py-12 text-center text-sm text-text-secondary">{emptyLabel}</div>
+          </MeasuredRow>
+        );
+      }
+
+      if (item.type === 'date') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <DateLabel groupName={item.groupName} />
+          </MeasuredRow>
+        );
+      }
+
+      return (
+        <MeasuredRow key={key} {...rowProps}>
+          <ConversationRow
+            conversation={item.convo}
+            isGenerating={activeJobIds.has(item.convo.conversationId ?? '')}
+          />
+        </MeasuredRow>
+      );
+    },
+    [activeJobIds, cache, emptyLabel, flattenedItems],
+  );
+
+  const getRowHeight = useCallback(
+    ({ index }: { index: number }) => cache.getHeight(index, 0),
+    [cache],
+  );
+
+  const handleRowsRendered = useCallback(
+    ({ stopIndex }: { stopIndex: number }) => {
+      if (hasNextPage && stopIndex >= flattenedItems.length - 6) {
+        throttledLoadMore();
+      }
+    },
+    [flattenedItems.length, hasNextPage, throttledLoadMore],
+  );
+
+  return (
+    <div
+      className={cn('min-h-[280px] flex-1 overflow-hidden rounded-lg border border-border-light')}
+    >
+      <AutoSizer>
+        {({ width, height }) => (
+          <List
+            ref={listRef}
+            width={width}
+            height={height}
+            rowCount={flattenedItems.length}
+            rowHeight={getRowHeight}
+            rowRenderer={rowRenderer}
+            deferredMeasurementCache={cache}
+            overscanRowCount={8}
+            onRowsRendered={handleRowsRendered}
+            className="outline-none"
+            style={{ outline: 'none' }}
+          />
+        )}
+      </AutoSizer>
+    </div>
+  );
+};
+
+export default memo(ProjectChatList);
diff --git a/client/src/components/Projects/ProjectCreateDialog.tsx b/client/src/components/Projects/ProjectCreateDialog.tsx
new file mode 100644
index 00000000000..427e0246609
--- /dev/null
+++ b/client/src/components/Projects/ProjectCreateDialog.tsx
@@ -0,0 +1,120 @@
+import {
+  useEffect,
+  useId,
+  useRef,
+  useState,
+  type FormEvent,
+  type MutableRefObject,
+  type ReactNode,
+} from 'react';
+import type { TChatProject } from 'librechat-data-provider';
+import {
+  Button,
+  Input,
+  Label,
+  OGDialog,
+  OGDialogTemplate,
+  Spinner,
+  useToastContext,
+} from '@librechat/client';
+import { useCreateProjectMutation } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+
+type ProjectCreateDialogProps = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onCreated?: (project: TChatProject) => void;
+  children?: ReactNode;
+  triggerRef?: MutableRefObject<HTMLButtonElement | null>;
+};
+
+export default function ProjectCreateDialog({
+  open,
+  onOpenChange,
+  onCreated,
+  children,
+  triggerRef,
+}: ProjectCreateDialogProps) {
+  const localize = useLocalize();
+  const formId = useId();
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const [name, setName] = useState('');
+  const createProject = useCreateProjectMutation();
+  const { showToast } = useToastContext();
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+    const frameId = requestAnimationFrame(() => inputRef.current?.focus());
+    return () => cancelAnimationFrame(frameId);
+  }, [open]);
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    onOpenChange(nextOpen);
+    if (!nextOpen && !createProject.isLoading) {
+      setName('');
+    }
+  };
+
+  const handleCreate = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const trimmedName = name.trim();
+    if (!trimmedName || createProject.isLoading) {
+      return;
+    }
+
+    try {
+      const project = await createProject.mutateAsync({ name: trimmedName });
+      setName('');
+      onOpenChange(false);
+      onCreated?.(project);
+    } catch {
+      showToast({
+        message: localize('com_ui_project_create_error'),
+        status: 'error',
+      });
+    }
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={handleOpenChange} triggerRef={triggerRef}>
+      {children}
+      <OGDialogTemplate
+        title={localize('com_ui_create_project')}
+        showCloseButton={true}
+        className="w-11/12 max-w-lg bg-surface-primary text-text-primary"
+        main={
+          <form id={formId} onSubmit={handleCreate} className="space-y-2">
+            <Label htmlFor={`${formId}-name`} className="text-sm font-medium text-text-primary">
+              {localize('com_ui_project_name')}
+            </Label>
+            <Input
+              id={`${formId}-name`}
+              ref={inputRef}
+              value={name}
+              onChange={(event) => setName(event.target.value)}
+              placeholder={localize('com_ui_project_name_placeholder')}
+              className="w-full bg-transparent text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+            />
+          </form>
+        }
+        buttons={
+          <Button
+            type="submit"
+            form={formId}
+            variant="submit"
+            disabled={!name.trim() || createProject.isLoading}
+            aria-label={localize('com_ui_create_project')}
+          >
+            {createProject.isLoading ? (
+              <Spinner className="size-4" />
+            ) : (
+              localize('com_ui_create_project')
+            )}
+          </Button>
+        }
+      />
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Projects/ProjectWorkspace.tsx b/client/src/components/Projects/ProjectWorkspace.tsx
new file mode 100644
index 00000000000..e904029dff4
--- /dev/null
+++ b/client/src/components/Projects/ProjectWorkspace.tsx
@@ -0,0 +1,215 @@
+import { useCallback, useId, useMemo, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { useRecoilValue } from 'recoil';
+import { useQueryClient } from '@tanstack/react-query';
+import { ArrowLeft, ArrowUpDown, Check, Folder, Plus } from 'lucide-react';
+import { useNavigate, useParams } from 'react-router-dom';
+import { QueryKeys } from 'librechat-data-provider';
+import type { ConversationListResponse } from 'librechat-data-provider';
+import { Spinner, DropdownPopup } from '@librechat/client';
+import type { MenuItemProps, RenderProp } from '~/common';
+import { useConversationsInfiniteQuery, useProjectQuery } from '~/data-provider';
+import { useLocalize, useNewConvo } from '~/hooks';
+import { cn, clearMessagesCache } from '~/utils';
+import ProjectChatList from './ProjectChatList';
+import store from '~/store';
+
+type ChatSortField = 'updatedAt' | 'createdAt';
+
+function renderSortMenuItem(label: string, isSelected: boolean): RenderProp {
+  return function SortMenuItem({ className, ...props }) {
+    return (
+      <div {...props} className={cn(className, 'justify-between gap-5')}>
+        <span className="truncate">{label}</span>
+        {isSelected ? (
+          <Check className="h-4 w-4 shrink-0 text-text-primary" aria-hidden="true" />
+        ) : (
+          <span className="h-4 w-4 shrink-0" aria-hidden="true" />
+        )}
+      </div>
+    );
+  };
+}
+
+export default function ProjectWorkspace() {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const { projectId = '' } = useParams();
+  const [sortBy, setSortBy] = useState<ChatSortField>('updatedAt');
+  const sortMenuId = useId();
+  const [isSortMenuOpen, setIsSortMenuOpen] = useState(false);
+  const { data: project, isLoading: isProjectLoading } = useProjectQuery(projectId);
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+  const { newConversation } = useNewConvo();
+  const activeProjectId = project?._id;
+
+  const sortOptions = useMemo(
+    () => [
+      { value: 'updatedAt' as const, label: localize('com_ui_sort_updated') },
+      { value: 'createdAt' as const, label: localize('com_ui_sort_created') },
+    ],
+    [localize],
+  );
+  const selectedSortLabel =
+    sortOptions.find((option) => option.value === sortBy)?.label ?? localize('com_ui_sort_updated');
+  const sortMenuItems = useMemo<MenuItemProps[]>(
+    () =>
+      sortOptions.map((option) => {
+        const isSelected = sortBy === option.value;
+        return {
+          id: `project-chat-sort-${option.value}`,
+          ariaLabel: option.label,
+          ariaChecked: isSelected,
+          onClick: () => setSortBy(option.value),
+          render: renderSortMenuItem(option.label, isSelected),
+        };
+      }),
+    [sortBy, sortOptions],
+  );
+
+  const {
+    data,
+    fetchNextPage,
+    isFetchingNextPage,
+    isLoading: isConversationsLoading,
+  } = useConversationsInfiniteQuery(
+    {
+      projectId: activeProjectId,
+      sortBy,
+      sortDirection: 'desc',
+    },
+    {
+      enabled: Boolean(activeProjectId),
+      staleTime: 30000,
+      cacheTime: 300000,
+    },
+  );
+
+  const conversations = useMemo(
+    () => data?.pages.flatMap((page) => page.conversations) ?? [],
+    [data?.pages],
+  );
+
+  const hasNextPage = useMemo(() => {
+    const pages = data?.pages;
+    if (!pages?.length) {
+      return false;
+    }
+    const lastPage: ConversationListResponse = pages[pages.length - 1];
+    return lastPage.nextCursor !== null;
+  }, [data?.pages]);
+
+  const startProjectChat = useCallback(() => {
+    if (!activeProjectId) {
+      return;
+    }
+    clearMessagesCache(queryClient, conversation?.conversationId);
+    queryClient.invalidateQueries([QueryKeys.messages]);
+    newConversation({ template: { chatProjectId: activeProjectId } });
+  }, [activeProjectId, conversation?.conversationId, newConversation, queryClient]);
+
+  if (isProjectLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <Spinner className="text-text-primary" />
+      </div>
+    );
+  }
+
+  if (!project) {
+    return (
+      <div className="flex h-full items-center justify-center text-sm text-text-secondary">
+        {localize('com_ui_project_not_found')}
+      </div>
+    );
+  }
+
+  return (
+    <main className="flex h-full min-h-0 flex-col overflow-y-auto bg-surface-primary text-text-primary">
+      <div className="mx-auto flex w-full max-w-3xl flex-1 flex-col px-4 pb-10 pt-4 md:px-6 lg:pt-8">
+        <button
+          type="button"
+          onClick={() => navigate('/projects')}
+          className="-ml-1.5 inline-flex w-fit items-center gap-1.5 rounded-lg px-2 py-1 text-sm text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary"
+        >
+          <ArrowLeft className="h-4 w-4" aria-hidden="true" />
+          {localize('com_ui_all_projects')}
+        </button>
+
+        <header className="mt-5 flex items-start gap-3">
+          <span className="flex h-11 w-11 shrink-0 items-center justify-center rounded-2xl bg-surface-secondary text-text-secondary">
+            <Folder className="h-6 w-6" aria-hidden="true" />
+          </span>
+          <div className="min-w-0 flex-1 pt-0.5">
+            <h1 className="truncate text-2xl font-semibold tracking-tight text-text-primary">
+              {project.name}
+            </h1>
+            {project.description ? (
+              <p className="mt-0.5 line-clamp-2 text-sm text-text-secondary">
+                {project.description}
+              </p>
+            ) : null}
+          </div>
+        </header>
+
+        <button
+          type="button"
+          onClick={startProjectChat}
+          className={cn(
+            'mt-6 flex w-full items-center gap-3 rounded-[26px] border border-border-medium bg-surface-secondary px-3.5 py-3 text-left shadow-sm transition-colors',
+            'hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+          )}
+          aria-label={localize('com_ui_new_chat_in_project', { name: project.name })}
+        >
+          <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-surface-tertiary text-text-primary">
+            <Plus className="h-4 w-4" aria-hidden="true" />
+          </span>
+          <span className="min-w-0 flex-1 truncate text-text-secondary">
+            {localize('com_ui_new_chat_in_project', { name: project.name })}
+          </span>
+        </button>
+
+        <section className="mt-8 flex min-h-0 flex-1 flex-col">
+          <div className="mb-2 flex items-center justify-between gap-3">
+            <h2 className="flex items-baseline gap-2 text-sm font-medium text-text-primary">
+              {localize('com_ui_chats')}
+              <span className="text-text-secondary">{project.conversationCount}</span>
+            </h2>
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={sortMenuId}
+              isOpen={isSortMenuOpen}
+              setIsOpen={setIsSortMenuOpen}
+              className="z-[125] min-w-44"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_sort_chats_by')}
+                  className={cn(
+                    'inline-flex h-8 items-center justify-center gap-1.5 whitespace-nowrap rounded-lg px-2.5 text-sm font-medium text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+                    isSortMenuOpen && 'bg-surface-hover text-text-primary',
+                  )}
+                >
+                  <ArrowUpDown className="h-4 w-4" aria-hidden="true" />
+                  {selectedSortLabel}
+                </Ariakit.MenuButton>
+              }
+              items={sortMenuItems}
+            />
+          </div>
+          <ProjectChatList
+            conversations={conversations}
+            isLoading={isConversationsLoading}
+            isFetchingNextPage={isFetchingNextPage}
+            hasNextPage={hasNextPage}
+            sortBy={sortBy}
+            emptyLabel={localize('com_ui_no_project_chats')}
+            loadMore={() => fetchNextPage()}
+          />
+        </section>
+      </div>
+    </main>
+  );
+}
diff --git a/client/src/components/Projects/ProjectsView.tsx b/client/src/components/Projects/ProjectsView.tsx
new file mode 100644
index 00000000000..0cbbab14047
--- /dev/null
+++ b/client/src/components/Projects/ProjectsView.tsx
@@ -0,0 +1,244 @@
+import { useDeferredValue, useEffect, useId, useMemo, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { useNavigate, useSearchParams } from 'react-router-dom';
+import { ArrowUpDown, Check, Folder, Plus, Search } from 'lucide-react';
+import { Input, Button, Spinner, DropdownPopup, useMediaQuery } from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import type { MenuItemProps, RenderProp } from '~/common';
+import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
+import { useProjectsInfiniteQuery } from '~/data-provider';
+import ProjectCreateDialog from './ProjectCreateDialog';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+type ProjectSort = 'name' | 'createdAt' | 'lastConversationAt';
+
+function renderSortMenuItem(label: string, isSelected: boolean): RenderProp {
+  return function SortMenuItem({ className, ...props }) {
+    return (
+      <div {...props} className={cn(className, 'justify-between gap-5')}>
+        <span className="truncate">{label}</span>
+        {isSelected ? (
+          <Check className="h-4 w-4 shrink-0 text-text-primary" aria-hidden="true" />
+        ) : (
+          <span className="h-4 w-4 shrink-0" aria-hidden="true" />
+        )}
+      </div>
+    );
+  };
+}
+
+function formatActivity(project: TChatProject) {
+  const value = project.lastConversationAt ?? project.updatedAt ?? project.createdAt;
+  if (!value) {
+    return null;
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return null;
+  }
+  return date.toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' });
+}
+
+export default function ProjectsView() {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [search, setSearch] = useState('');
+  const [sortBy, setSortBy] = useState<ProjectSort>('lastConversationAt');
+  const [isCreating, setIsCreating] = useState(searchParams.get('new') === '1');
+  const sortMenuId = useId();
+  const [isSortMenuOpen, setIsSortMenuOpen] = useState(false);
+  const deferredSearch = useDeferredValue(search);
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
+
+  const { data, fetchNextPage, isFetchingNextPage, isLoading } = useProjectsInfiniteQuery({
+    search: deferredSearch || undefined,
+    sortBy,
+    sortDirection: sortBy === 'name' ? 'asc' : 'desc',
+  });
+
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const hasNextPage = data?.pages[data.pages.length - 1]?.nextCursor != null;
+  const sortOptions = useMemo(
+    () => [
+      { value: 'lastConversationAt' as const, label: localize('com_ui_latest_activity') },
+      { value: 'createdAt' as const, label: localize('com_ui_sort_created') },
+      { value: 'name' as const, label: localize('com_ui_name') },
+    ],
+    [localize],
+  );
+  const selectedSortLabel =
+    sortOptions.find((option) => option.value === sortBy)?.label ??
+    localize('com_ui_latest_activity');
+  const sortMenuItems = useMemo<MenuItemProps[]>(
+    () =>
+      sortOptions.map((option) => {
+        const isSelected = sortBy === option.value;
+        return {
+          id: `project-sort-${option.value}`,
+          ariaLabel: option.label,
+          ariaChecked: isSelected,
+          onClick: () => setSortBy(option.value),
+          render: renderSortMenuItem(option.label, isSelected),
+        };
+      }),
+    [sortBy, sortOptions],
+  );
+
+  useEffect(() => {
+    if (searchParams.get('new') === '1') {
+      setIsCreating(true);
+    }
+  }, [searchParams]);
+
+  const handleCreateDialogChange = (open: boolean) => {
+    setIsCreating(open);
+    if (!open && searchParams.get('new') === '1') {
+      const nextParams = new URLSearchParams(searchParams);
+      nextParams.delete('new');
+      setSearchParams(nextParams, { replace: true });
+    }
+  };
+
+  return (
+    <main className="flex h-full min-h-0 flex-col overflow-auto bg-surface-primary text-text-primary">
+      <div className="container mx-auto flex w-full max-w-4xl flex-1 flex-col gap-6 px-4 py-8 md:px-6 lg:pt-12">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <div className="flex min-w-0 items-center gap-2.5">
+            {isSmallScreen ? <OpenSidebar /> : null}
+            <h1 className="text-2xl font-bold tracking-tight text-text-primary md:text-3xl">
+              {localize('com_ui_projects')}
+            </h1>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="hidden text-sm text-text-secondary sm:inline">
+              {localize('com_ui_sort_by')}
+            </span>
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={sortMenuId}
+              isOpen={isSortMenuOpen}
+              setIsOpen={setIsSortMenuOpen}
+              className="z-[125] min-w-56"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_sort_projects_by')}
+                  className={cn(
+                    'inline-flex h-10 items-center justify-between gap-2 whitespace-nowrap rounded-lg border border-border-medium bg-surface-secondary px-3 text-sm font-medium text-text-primary transition-colors hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary disabled:pointer-events-none disabled:opacity-50 sm:w-44',
+                    isSortMenuOpen && 'bg-surface-hover text-text-primary',
+                  )}
+                >
+                  <span className="flex min-w-0 items-center gap-2">
+                    <ArrowUpDown
+                      className="h-4 w-4 shrink-0 text-text-secondary"
+                      aria-hidden="true"
+                    />
+                    <span className="truncate">{selectedSortLabel}</span>
+                  </span>
+                </Ariakit.MenuButton>
+              }
+              items={sortMenuItems}
+            />
+            <Button type="button" variant="submit" size="sm" onClick={() => setIsCreating(true)}>
+              <Plus className="h-4 w-4" aria-hidden="true" />
+              {localize('com_ui_new_project')}
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-5">
+          <label className="relative min-w-0 flex-1">
+            <span className="sr-only">{localize('com_ui_search_projects')}</span>
+            <Search
+              className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-text-secondary"
+              aria-hidden="true"
+            />
+            <Input
+              value={search}
+              onChange={(event) => setSearch(event.target.value)}
+              placeholder={localize('com_ui_search_projects')}
+              className="border-border-medium bg-surface-secondary pl-9 text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+            />
+          </label>
+          <div className="flex items-center">
+            <span className="rounded-full bg-surface-active-alt px-4 py-2 text-sm font-medium text-text-primary">
+              {localize('com_ui_your_projects')}
+            </span>
+          </div>
+        </div>
+
+        <ProjectCreateDialog
+          open={isCreating}
+          onOpenChange={handleCreateDialogChange}
+          onCreated={(project) => navigate(`/projects/${project._id}`)}
+        />
+
+        {isLoading ? (
+          <div className="flex flex-1 items-center justify-center">
+            <Spinner className="text-text-primary" />
+          </div>
+        ) : (
+          <div className="grid gap-3 md:grid-cols-2 md:gap-4">
+            {projects.map((project) => {
+              const activity = formatActivity(project);
+              return (
+                <button
+                  key={project._id}
+                  type="button"
+                  className={cn(
+                    'group/project flex min-h-[8.5rem] flex-col rounded-xl border border-border-medium bg-surface-secondary p-4 text-left transition-colors',
+                    'hover:border-border-heavy hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+                  )}
+                  onClick={() => navigate(`/projects/${project._id}`)}
+                >
+                  <span className="flex min-w-0 items-center gap-2">
+                    <Folder className="h-4 w-4 shrink-0 text-text-secondary" aria-hidden="true" />
+                    <span className="truncate text-base font-semibold text-text-primary">
+                      {project.name}
+                    </span>
+                  </span>
+                  {project.description ? (
+                    <span className="mt-2 line-clamp-2 text-sm leading-relaxed text-text-secondary">
+                      {project.description}
+                    </span>
+                  ) : null}
+                  <span className="mt-auto flex items-center justify-between gap-2 pt-4 text-xs text-text-secondary">
+                    <span>
+                      {project.conversationCount === 1
+                        ? localize('com_ui_project_chat_count_single')
+                        : localize('com_ui_project_chat_count', {
+                            count: project.conversationCount,
+                          })}
+                    </span>
+                    {activity ? <span className="shrink-0 truncate">{activity}</span> : null}
+                  </span>
+                </button>
+              );
+            })}
+          </div>
+        )}
+
+        {!isLoading && projects.length === 0 && (
+          <div className="rounded-lg border border-border-medium bg-transparent py-16 text-center text-sm text-text-secondary">
+            {localize('com_ui_no_projects')}
+          </div>
+        )}
+
+        {hasNextPage && (
+          <Button
+            type="button"
+            variant="outline"
+            className="mx-auto"
+            onClick={() => fetchNextPage()}
+            disabled={isFetchingNextPage}
+          >
+            {isFetchingNextPage ? localize('com_ui_loading') : localize('com_ui_load_more')}
+          </Button>
+        )}
+      </div>
+    </main>
+  );
+}
diff --git a/client/src/components/Projects/index.ts b/client/src/components/Projects/index.ts
new file mode 100644
index 00000000000..ce29a33470f
--- /dev/null
+++ b/client/src/components/Projects/index.ts
@@ -0,0 +1,2 @@
+export { default as ProjectsView } from './ProjectsView';
+export { default as ProjectWorkspace } from './ProjectWorkspace';
diff --git a/client/src/components/Prompts/buttons/AutoSendPrompt.tsx b/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
index 759c33739e7..21194e248eb 100644
--- a/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
+++ b/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
@@ -31,6 +31,7 @@ export default function AutoSendPrompt({
         checked={autoSendPrompts}
         tabIndex={-1}
         aria-hidden="true"
+        aria-label={localize('com_nav_auto_send_prompts')}
         className="pointer-events-none"
       />
       {localize('com_nav_auto_send_prompts')}
diff --git a/client/src/components/Prompts/forms/CreatePromptForm.tsx b/client/src/components/Prompts/forms/CreatePromptForm.tsx
index 183b5a5c831..7ce4954d1fc 100644
--- a/client/src/components/Prompts/forms/CreatePromptForm.tsx
+++ b/client/src/components/Prompts/forms/CreatePromptForm.tsx
@@ -1,18 +1,18 @@
 import { useEffect } from 'react';
 import { FileText } from 'lucide-react';
 import { useNavigate } from 'react-router-dom';
-import { Button, TextareaAutosize, Input } from '@librechat/client';
 import { useForm, Controller, FormProvider } from 'react-hook-form';
+import { Button, TextareaAutosize, Input, useMediaQuery } from '@librechat/client';
 import { LocalStorageKeys, PermissionTypes, Permissions } from 'librechat-data-provider';
 import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
-import CategorySelector from '../fields/CategorySelector';
 import VariablesDropdown from '../editor/VariablesDropdown';
+import CategorySelector from '../fields/CategorySelector';
 import PromptVariables from '../display/PromptVariables';
-import Description from '../fields/Description';
 import { usePromptGroupsContext } from '~/Providers';
 import { useLocalize, useHasAccess } from '~/hooks';
-import Command from '../fields/Command';
 import { useCreatePrompt } from '~/data-provider';
+import Description from '../fields/Description';
+import Command from '../fields/Command';
 import { cn } from '~/utils';
 
 type CreateFormValues = {
@@ -42,6 +42,7 @@ const CreatePromptForm = ({
 }) => {
   const localize = useLocalize();
   const navigate = useNavigate();
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const { hasAccess: hasUseAccess } = usePromptGroupsContext() ?? {};
   const hasCreateAccess = useHasAccess({
     permissionType: PermissionTypes.PROMPTS,
@@ -114,10 +115,12 @@ const CreatePromptForm = ({
     <FormProvider {...methods}>
       <form onSubmit={handleSubmit(onSubmit)} className="w-full px-4 py-2">
         <h1 className="sr-only">{localize('com_ui_create_prompt_page')}</h1>
-        <div className="mb-2 flex items-center justify-between gap-2 sm:hidden">
-          <OpenSidebar />
-          <CategorySelector />
-        </div>
+        {isSmallScreen ? (
+          <div className="mb-2 flex items-center justify-between gap-2">
+            <OpenSidebar />
+            <CategorySelector />
+          </div>
+        ) : null}
         <div className="mb-1 flex flex-col items-center justify-between font-bold sm:text-xl md:mb-0 md:text-2xl">
           <div className="flex w-full flex-col items-center justify-between sm:flex-row">
             <Controller
@@ -153,9 +156,11 @@ const CreatePromptForm = ({
                 </div>
               )}
             />
-            <div className="hidden sm:block">
-              <CategorySelector />
-            </div>
+            {!isSmallScreen && (
+              <div>
+                <CategorySelector />
+              </div>
+            )}
           </div>
         </div>
         <div className="flex w-full flex-col gap-4 md:mt-[1.075rem]">
diff --git a/client/src/components/Prompts/forms/PromptForm.tsx b/client/src/components/Prompts/forms/PromptForm.tsx
index 9407db43336..722498564c2 100644
--- a/client/src/components/Prompts/forms/PromptForm.tsx
+++ b/client/src/components/Prompts/forms/PromptForm.tsx
@@ -1,10 +1,10 @@
 import React, { useEffect, useState, useMemo, useCallback, useRef } from 'react';
 import debounce from 'lodash/debounce';
 import { useRecoilValue } from 'recoil';
-import { Menu, Rocket, X } from 'lucide-react';
 import { useParams } from 'react-router-dom';
+import { Menu, Rocket, X } from 'lucide-react';
 import { useForm, FormProvider } from 'react-hook-form';
-import { Button, Skeleton, useToastContext } from '@librechat/client';
+import { Button, Skeleton, useToastContext, useMediaQuery } from '@librechat/client';
 import {
   Permissions,
   ResourceType,
@@ -30,8 +30,8 @@ import DeletePrompt from '../dialogs/DeletePrompt';
 import NoPromptGroup from '../lists/NoPromptGroup';
 import PromptEditor from '../editor/PromptEditor';
 import SkeletonForm from '../utils/SkeletonForm';
-import Description from '../fields/Description';
 import SharePrompt from '../dialogs/SharePrompt';
+import Description from '../fields/Description';
 import PromptName from '../fields/PromptName';
 import { cn, findPromptGroup } from '~/utils';
 import { PromptsEditorMode } from '~/common';
@@ -187,6 +187,7 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
   const promptId = promptIdProp || params.promptId || '';
 
   const editorMode = useRecoilValue(store.promptsEditorMode);
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const [selectionIndex, setSelectionIndex] = useState<number>(0);
 
   const prevIsEditingRef = useRef(false);
@@ -437,7 +438,16 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
     }
 
     if (fetchedPrompt || group) {
-      return <PromptDetails group={fetchedPrompt || group} showActions={false} />;
+      return (
+        <div className="flex h-full w-full flex-col">
+          {isSmallScreen && (
+            <div className="flex shrink-0 items-center px-4 pt-3">
+              <OpenSidebar />
+            </div>
+          )}
+          <PromptDetails group={fetchedPrompt || group} showActions={false} />
+        </div>
+      );
     }
   }
 
@@ -462,8 +472,8 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
             <div className="flex h-full">
               <div className="flex-1 overflow-hidden px-4">
                 {/* Mobile Actions Row */}
-                {!isLoadingGroup && group && (
-                  <div className="mb-3 mt-2 flex items-center justify-between gap-2 sm:hidden">
+                {!isLoadingGroup && group && isSmallScreen && (
+                  <div className="mb-3 mt-2 flex items-center justify-between gap-2">
                     <OpenSidebar />
                     <HeaderActions
                       group={group}
@@ -510,15 +520,17 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
                           </Button>
                         )}
                       </div>
-                      <div className="hidden shrink-0 sm:block">
-                        <HeaderActions
-                          group={group}
-                          canEdit={canEdit}
-                          canDelete={canDelete}
-                          selectedPromptId={selectedPromptId}
-                          onCategoryChange={handleCategoryChange}
-                        />
-                      </div>
+                      {!isSmallScreen && (
+                        <div className="shrink-0">
+                          <HeaderActions
+                            group={group}
+                            canEdit={canEdit}
+                            canDelete={canDelete}
+                            selectedPromptId={selectedPromptId}
+                            onCategoryChange={handleCategoryChange}
+                          />
+                        </div>
+                      )}
                     </>
                   )}
                 </div>
diff --git a/client/src/components/QueryDevtoolsGate.tsx b/client/src/components/QueryDevtoolsGate.tsx
new file mode 100644
index 00000000000..ad794aca6f0
--- /dev/null
+++ b/client/src/components/QueryDevtoolsGate.tsx
@@ -0,0 +1,33 @@
+import { lazy, Suspense } from 'react';
+
+interface QueryDevtoolsConfig {
+  enableQueryDevtools?: boolean;
+}
+
+interface QueryDevtoolsGateProps {
+  config?: QueryDevtoolsConfig;
+  isDevelopment?: boolean;
+}
+
+const LazyReactQueryDevtools = lazy(() =>
+  import('@tanstack/react-query-devtools/production').then(({ ReactQueryDevtools }) => ({
+    default: ReactQueryDevtools,
+  })),
+);
+
+export const shouldEnableQueryDevtools = ({
+  isDevelopment = import.meta.env.DEV,
+  config = typeof window === 'undefined' ? undefined : window.__LIBRECHAT_CONFIG__,
+}: QueryDevtoolsGateProps = {}) => isDevelopment || config?.enableQueryDevtools === true;
+
+export default function QueryDevtoolsGate({ isDevelopment, config }: QueryDevtoolsGateProps = {}) {
+  if (!shouldEnableQueryDevtools({ isDevelopment, config })) {
+    return null;
+  }
+
+  return (
+    <Suspense fallback={null}>
+      <LazyReactQueryDevtools initialIsOpen={false} position="top-right" />
+    </Suspense>
+  );
+}
diff --git a/client/src/components/Share/Message.tsx b/client/src/components/Share/Message.tsx
index 8e2c7796e32..3492054698a 100644
--- a/client/src/components/Share/Message.tsx
+++ b/client/src/components/Share/Message.tsx
@@ -2,17 +2,16 @@ import { useAtomValue } from 'jotai';
 import type { TMessageProps } from '~/common';
 import MinimalHoverButtons from '~/components/Chat/Messages/MinimalHoverButtons';
 import MessageContent from '~/components/Chat/Messages/Content/MessageContent';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import SearchContent from '~/components/Chat/Messages/Content/SearchContent';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
 import SubRow from '~/components/Chat/Messages/SubRow';
 import { fontSizeAtom } from '~/store/fontSize';
 import { MessageContext } from '~/Providers';
-import { useAttachments } from '~/hooks';
-
 import MultiMessage from './MultiMessage';
-import { cn } from '~/utils';
-
+import { useAttachments } from '~/hooks';
 import Icon from './MessageIcon';
+import { cn } from '~/utils';
 export default function Message(props: TMessageProps) {
   const fontSize = useAtomValue(fontSizeAtom);
   const {
@@ -67,7 +66,10 @@ export default function Message(props: TMessageProps) {
             <div
               className={cn('relative flex w-11/12 flex-col', isCreatedByUser ? '' : 'agent-turn')}
             >
-              <div className={cn('select-none font-semibold', fontSize)}>{messageLabel}</div>
+              <div className={cn('select-none font-semibold', fontSize)}>
+                {messageLabel}
+                <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
+              </div>
               <div className="flex-col gap-1 md:gap-3">
                 <div className="flex min-h-[20px] max-w-full flex-grow flex-col gap-0">
                   <MessageContext.Provider
@@ -90,7 +92,7 @@ export default function Message(props: TMessageProps) {
                         edit={false}
                         error={error}
                         isLast={false}
-                        ask={() => ({})}
+                        ask={() => {}}
                         text={text || ''}
                         message={message}
                         isSubmitting={false}
diff --git a/client/src/components/Share/MessageIcon.tsx b/client/src/components/Share/MessageIcon.tsx
index b5c2585ab14..309d2367961 100644
--- a/client/src/components/Share/MessageIcon.tsx
+++ b/client/src/components/Share/MessageIcon.tsx
@@ -5,6 +5,7 @@ import type { TMessageProps } from '~/common';
 import MessageEndpointIcon from '../Endpoints/MessageEndpointIcon';
 import ConvoIconURL from '~/components/Endpoints/ConvoIconURL';
 import { getIconEndpoint, logger } from '~/utils';
+import { isImageURL } from '~/utils/icons';
 
 export default function MessageIcon(
   props: Pick<TMessageProps, 'message' | 'conversation'> & {
@@ -49,7 +50,7 @@ export default function MessageIcon(
     agentName,
     agentAvatar,
   });
-  if (message?.isCreatedByUser !== true && iconURL && iconURL.includes('http')) {
+  if (message?.isCreatedByUser !== true && isImageURL(iconURL)) {
     return (
       <ConvoIconURL
         iconURL={iconURL}
diff --git a/client/src/components/Share/MessagesView.tsx b/client/src/components/Share/MessagesView.tsx
index 0b2e7b1c2d2..0f10b8a95b7 100644
--- a/client/src/components/Share/MessagesView.tsx
+++ b/client/src/components/Share/MessagesView.tsx
@@ -13,7 +13,7 @@ export default function MessagesView({
   const localize = useLocalize();
   const [currentEditId, setCurrentEditId] = useState<number | string | null>(-1);
   return (
-    <div className="min-h-0 flex-1 overflow-hidden">
+    <div className="min-h-0 flex-1 overflow-hidden" data-testid="messages-view">
       <div className="dark:gpt-dark-gray relative h-full">
         <div
           style={{
diff --git a/client/src/components/Share/ShareMessagesProvider.tsx b/client/src/components/Share/ShareMessagesProvider.tsx
index e614aa891a5..cfaeff338c0 100644
--- a/client/src/components/Share/ShareMessagesProvider.tsx
+++ b/client/src/components/Share/ShareMessagesProvider.tsx
@@ -1,7 +1,7 @@
 import React, { useMemo } from 'react';
 import type { TMessage } from 'librechat-data-provider';
-import { MessagesViewContext } from '~/Providers/MessagesViewContext';
 import type { MessagesViewContextValue } from '~/Providers/MessagesViewContext';
+import { MessagesViewContext } from '~/Providers/MessagesViewContext';
 
 interface ShareMessagesProviderProps {
   messages: TMessage[];
@@ -22,7 +22,7 @@ export function ShareMessagesProvider({ messages, children }: ShareMessagesProvi
       conversation: null,
       conversationId: undefined,
       // These are required by the context but not used in share view
-      ask: () => Promise.resolve(),
+      ask: () => {},
       regenerate: () => {},
       handleContinue: () => {},
       latestMessageId: messages[messages.length - 1]?.messageId,
@@ -31,7 +31,6 @@ export function ShareMessagesProvider({ messages, children }: ShareMessagesProvi
       abortScroll: false,
       setAbortScroll: () => {},
       index: 0,
-      setLatestMessage: () => {},
       getMessages: () => messages,
       setMessages: () => {},
     }),
diff --git a/client/src/components/Share/ShareView.tsx b/client/src/components/Share/ShareView.tsx
index 00a0d363983..20a354742ab 100644
--- a/client/src/components/Share/ShareView.tsx
+++ b/client/src/components/Share/ShareView.tsx
@@ -16,12 +16,12 @@ import {
   OGDialogContent,
   OGDialogTrigger,
 } from '@librechat/client';
-import { ThemeSelector, LangSelector } from '~/components/Nav/SettingsTabs/General/General';
+import { ThemeSelector, LangSelector } from '~/components/Nav/SettingsTabs/General/Selectors';
+import { ShareMessagesProvider } from './ShareMessagesProvider';
+import { useGetSharedStartupConfig } from '~/data-provider';
 import { ShareArtifactsContainer } from './ShareArtifacts';
 import { useLocalize, useDocumentTitle } from '~/hooks';
-import { useGetStartupConfig } from '~/data-provider';
 import { ShareContext } from '~/Providers';
-import { ShareMessagesProvider } from './ShareMessagesProvider';
 import MessagesView from './MessagesView';
 import Footer from '../Chat/Footer';
 import { cn } from '~/utils';
@@ -29,9 +29,9 @@ import store from '~/store';
 
 function SharedView() {
   const localize = useLocalize();
-  const { data: config } = useGetStartupConfig();
   const { theme, setTheme } = useContext(ThemeContext);
   const { shareId } = useParams();
+  const { data: config } = useGetSharedStartupConfig(shareId);
   const { data, isLoading } = useGetSharedMessages(shareId ?? '');
   const dataTree = data && buildTree({ messages: data.messages });
   const messagesTree = dataTree?.length === 0 ? null : (dataTree ?? null);
@@ -80,10 +80,6 @@ function SharedView() {
             : null) ?? 'en-US';
       }
 
-      requestAnimationFrame(() => {
-        document.documentElement.lang = userLang;
-      });
-
       setLangcode(userLang);
       Cookies.set('lang', userLang, { expires: 365 });
     },
@@ -124,7 +120,10 @@ function SharedView() {
 
   const footer = (
     <div className="pointer-events-none absolute inset-x-0 bottom-0 z-10 bg-gradient-to-t from-surface-secondary from-40% to-transparent">
-      <Footer className="pointer-events-auto relative mx-auto flex max-w-[55rem] flex-wrap items-center justify-center gap-2 px-3 pb-4 pt-6 text-center text-xs text-text-secondary" />
+      <Footer
+        startupConfig={config ?? null}
+        className="pointer-events-auto relative mx-auto flex max-w-[55rem] flex-wrap items-center justify-center gap-2 px-3 pb-4 pt-6 text-center text-xs text-text-secondary"
+      />
     </div>
   );
 
@@ -149,7 +148,7 @@ function SharedView() {
     );
 
   return (
-    <ShareContext.Provider value={{ isSharedConvo: true }}>
+    <ShareContext.Provider value={{ isSharedConvo: true, shareId }}>
       <div className="relative flex h-screen w-full overflow-hidden dark:bg-surface-secondary">
         <main className="relative flex w-full grow overflow-hidden dark:bg-surface-secondary">
           {artifactsContainer}
diff --git a/client/src/components/Sharing/AccessRolesPicker.tsx b/client/src/components/Sharing/AccessRolesPicker.tsx
index 1e77bccac3f..c94f419d636 100644
--- a/client/src/components/Sharing/AccessRolesPicker.tsx
+++ b/client/src/components/Sharing/AccessRolesPicker.tsx
@@ -6,7 +6,7 @@ import { AccessRoleIds, ResourceType } from 'librechat-data-provider';
 import { useGetAccessRolesQuery } from 'librechat-data-provider/react-query';
 import type { AccessRole } from 'librechat-data-provider';
 import type * as t from '~/common';
-import { cn, getRoleLocalizationKeys } from '~/utils';
+import { cn, getRoleLocalizationKeys, RESOURCE_CONFIGS } from '~/utils';
 import { useLocalize } from '~/hooks';
 
 interface AccessRolesPickerProps {
@@ -37,6 +37,12 @@ export default function AccessRolesPicker({
     };
   };
 
+  const ownerRoleId = RESOURCE_CONFIGS[resourceType]?.defaultOwnerRoleId;
+  const filteredRoles =
+    resourceType === ResourceType.SHARED_LINK
+      ? (accessRoles || []).filter((role) => role.accessRoleId !== ownerRoleId)
+      : accessRoles || [];
+
   const selectedRole = accessRoles?.find((role) => role.accessRoleId === selectedRoleId);
   const selectedRoleInfo = selectedRole ? getLocalizedRoleInfo(selectedRole.accessRoleId) : null;
 
@@ -44,7 +50,7 @@ export default function AccessRolesPicker({
     return <Skeleton className="h-10 w-24 rounded-lg" />;
   }
 
-  const dropdownItems: t.MenuItemProps[] = accessRoles.map((role: AccessRole) => {
+  const dropdownItems: t.MenuItemProps[] = filteredRoles.map((role: AccessRole) => {
     const localizedInfo = getLocalizedRoleInfo(role.accessRoleId);
     return {
       id: role.accessRoleId,
diff --git a/client/src/components/Sharing/GenericGrantAccessDialog.tsx b/client/src/components/Sharing/GenericGrantAccessDialog.tsx
index ce7fdbdc143..e28d58a7ba3 100644
--- a/client/src/components/Sharing/GenericGrantAccessDialog.tsx
+++ b/client/src/components/Sharing/GenericGrantAccessDialog.tsx
@@ -1,6 +1,6 @@
 import React, { useState, useEffect } from 'react';
 import { AccessRoleIds, ResourceType } from 'librechat-data-provider';
-import { Share2Icon, Users, Link, CopyCheck, UserX, UserCheck } from 'lucide-react';
+import { Share2Icon, Users, Link, CopyCheck, UserX, UserCheck, AlertCircle } from 'lucide-react';
 import {
   Label,
   Button,
@@ -11,6 +11,7 @@ import {
   OGDialogClose,
   OGDialogContent,
   OGDialogTrigger,
+  TooltipAnchor,
   useToastContext,
 } from '@librechat/client';
 import type { TPrincipal } from 'librechat-data-provider';
@@ -60,7 +61,9 @@ export default function GenericGrantAccessDialog({
     config,
     permissionsData,
     isLoadingPermissions,
+    isFetchingPermissions,
     permissionsError,
+    refetchPermissions,
     updatePermissionsMutation,
     currentShares,
     currentIsPublic,
@@ -180,14 +183,18 @@ export default function GenericGrantAccessDialog({
         return !allSharesMap.has(key);
       });
 
+      const publicChanged = isPublic !== currentIsPublic;
+      const publicRoleChanged = isPublic && publicRole !== currentPublicRole;
+      const sendPublicUpdate = publicChanged || publicRoleChanged;
+
       await updatePermissionsMutation.mutateAsync({
         resourceType,
         resourceId: resourceDbId,
         data: {
           updated,
           removed,
-          public: isPublic,
-          publicAccessRoleId: isPublic ? publicRole : undefined,
+          ...(sendPublicUpdate ? { public: isPublic } : {}),
+          ...(sendPublicUpdate && isPublic ? { publicAccessRoleId: publicRole } : {}),
         },
       });
 
@@ -233,9 +240,35 @@ export default function GenericGrantAccessDialog({
   const hasPublicChanges = isPublic !== currentIsPublic || publicRole !== currentPublicRole;
   const submitButtonActive = hasChanges || hasPublicChanges;
 
-  // Error handling
+  // On permissions load failure, keep a compact trigger-sized button so the layout holds,
+  // surfacing the error (and a retry on click) through a tooltip.
   if (permissionsError) {
-    return <div className="text-sm text-red-600">{localize('com_ui_permissions_failed_load')}</div>;
+    return (
+      <TooltipAnchor
+        description={localize('com_ui_permissions_failed_load')}
+        render={
+          <Button
+            size="sm"
+            variant="outline"
+            type="button"
+            disabled={disabled}
+            onClick={() => refetchPermissions()}
+            aria-label={localize('com_ui_permissions_failed_load')}
+            className={cn('h-9', buttonClassName)}
+          >
+            <div className="flex min-w-[32px] items-center justify-center text-red-500">
+              <span className="flex h-6 w-6 items-center justify-center">
+                {isFetchingPermissions ? (
+                  <Spinner className="h-4 w-4" />
+                ) : (
+                  <AlertCircle className="icon-md h-4 w-4" aria-hidden="true" />
+                )}
+              </span>
+            </div>
+          </Button>
+        }
+      />
+    );
   }
 
   const TriggerComponent = children ? (
diff --git a/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx b/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
index b74b2126696..05ee3704a5c 100644
--- a/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
+++ b/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
@@ -5,6 +5,7 @@ import { ResourceType } from 'librechat-data-provider';
 import type { TPrincipal, AccessRoleIds } from 'librechat-data-provider';
 import AccessRolesPicker from '~/components/Sharing/AccessRolesPicker';
 import PrincipalAvatar from '~/components/Sharing/PrincipalAvatar';
+import { RESOURCE_CONFIGS } from '~/utils/resources';
 import { useLocalize } from '~/hooks';
 
 interface SelectedPrincipalsListProps {
@@ -50,6 +51,10 @@ export default function SelectedPrincipalsList({
       <div className="space-y-2">
         {principles.map((share) => {
           const { displayName, subtitle } = getPrincipalDisplayInfo(share);
+          const ownerRoleId = RESOURCE_CONFIGS[resourceType]?.defaultOwnerRoleId;
+          const isOwner = share.accessRoleId === ownerRoleId;
+          const isSharedLink = resourceType === ResourceType.SHARED_LINK;
+          const lockOwner = isSharedLink && isOwner;
           return (
             <div
               key={share.idOnTheSource + '-principalList'}
@@ -73,24 +78,33 @@ export default function SelectedPrincipalsList({
               </div>
 
               <div className="flex flex-shrink-0 items-center gap-2">
-                {!!share.accessRoleId && !!onRoleChange && (
-                  <AccessRolesPicker
-                    resourceType={resourceType}
-                    selectedRoleId={share.accessRoleId}
-                    onRoleChange={(newRole) => {
-                      onRoleChange?.(share.idOnTheSource!, newRole);
-                    }}
-                    className="min-w-0"
-                  />
+                {lockOwner ? (
+                  <span className="px-3 py-2 text-sm font-medium text-text-secondary">
+                    {localize('com_ui_role_owner')}
+                  </span>
+                ) : (
+                  !!share.accessRoleId &&
+                  !!onRoleChange && (
+                    <AccessRolesPicker
+                      resourceType={resourceType}
+                      selectedRoleId={share.accessRoleId}
+                      onRoleChange={(newRole) => {
+                        onRoleChange?.(share.idOnTheSource!, newRole);
+                      }}
+                      className="min-w-0"
+                    />
+                  )
+                )}
+                {!lockOwner && (
+                  <Button
+                    variant="outline"
+                    onClick={() => onRemoveHandler(share.idOnTheSource!)}
+                    className="h-9 w-9 p-0 hover:border-destructive/10 hover:bg-destructive/10 hover:text-destructive"
+                    aria-label={localize('com_ui_remove_user', { 0: displayName })}
+                  >
+                    <X className="h-4 w-4" aria-hidden="true" />
+                  </Button>
                 )}
-                <Button
-                  variant="outline"
-                  onClick={() => onRemoveHandler(share.idOnTheSource!)}
-                  className="h-9 w-9 p-0 hover:border-destructive/10 hover:bg-destructive/10 hover:text-destructive"
-                  aria-label={localize('com_ui_remove_user', { 0: displayName })}
-                >
-                  <X className="h-4 w-4" aria-hidden="true" />
-                </Button>
               </div>
             </div>
           );
diff --git a/client/src/components/Sharing/PeoplePickerAdminSettings.tsx b/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
index 5f334f3764d..ab3f9f5517c 100644
--- a/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
+++ b/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
@@ -140,7 +140,7 @@ const PeoplePickerAdminSettings = () => {
       <OGDialogTrigger asChild>
         <Button
           variant={'outline'}
-          className="btn btn-neutral border-token-border-light relative gap-1 rounded-lg font-medium"
+          className="btn btn-neutral border-token-border-light gap-1 rounded-lg font-medium"
           aria-label={localize('com_ui_admin_settings')}
         >
           <ShieldEllipsis className="cursor-pointer" aria-hidden="true" />
diff --git a/client/src/components/Sharing/PublicSharingToggle.tsx b/client/src/components/Sharing/PublicSharingToggle.tsx
index 87896cf8fd2..e93df4bf67d 100644
--- a/client/src/components/Sharing/PublicSharingToggle.tsx
+++ b/client/src/components/Sharing/PublicSharingToggle.tsx
@@ -18,13 +18,14 @@ interface PublicSharingToggleProps {
 
 const accessDescriptions: Record<
   ResourceType,
-  'com_ui_agent' | 'com_ui_prompt' | 'com_ui_mcp_server' | 'com_ui_skill'
+  'com_ui_agent' | 'com_ui_prompt' | 'com_ui_mcp_server' | 'com_ui_skill' | 'com_ui_shared_link'
 > = {
   [ResourceType.AGENT]: 'com_ui_agent',
   [ResourceType.PROMPTGROUP]: 'com_ui_prompt',
   [ResourceType.MCPSERVER]: 'com_ui_mcp_server',
   [ResourceType.REMOTE_AGENT]: 'com_ui_agent',
   [ResourceType.SKILL]: 'com_ui_skill',
+  [ResourceType.SHARED_LINK]: 'com_ui_shared_link',
 };
 
 export default function PublicSharingToggle({
diff --git a/client/src/components/Sharing/__tests__/GenericGrantAccessDialog.spec.tsx b/client/src/components/Sharing/__tests__/GenericGrantAccessDialog.spec.tsx
new file mode 100644
index 00000000000..f91667860d2
--- /dev/null
+++ b/client/src/components/Sharing/__tests__/GenericGrantAccessDialog.spec.tsx
@@ -0,0 +1,136 @@
+import React from 'react';
+import { ResourceType } from 'librechat-data-provider';
+import { render, screen, fireEvent } from '@testing-library/react';
+import '@testing-library/jest-dom/extend-expect';
+import GenericGrantAccessDialog from '../GenericGrantAccessDialog';
+
+const mockRefetchPermissions = jest.fn();
+const mockUseResourcePermissionState = jest.fn();
+
+const config = {
+  defaultViewerRoleId: 'viewer',
+  defaultOwnerRoleId: 'owner',
+  getShareMessage: () => 'Share Agent',
+  getResourceUrl: () => 'http://localhost/agent/1',
+  getCopyUrlMessage: () => 'Copied',
+};
+
+const baseState = (overrides: Record<string, unknown> = {}) => ({
+  config,
+  permissionsData: { principals: [], public: false },
+  isLoadingPermissions: false,
+  isFetchingPermissions: false,
+  permissionsError: null,
+  refetchPermissions: mockRefetchPermissions,
+  updatePermissionsMutation: { isLoading: false, mutateAsync: jest.fn() },
+  currentShares: [],
+  currentIsPublic: false,
+  currentPublicRole: 'viewer',
+  isPublic: false,
+  setIsPublic: jest.fn(),
+  publicRole: 'viewer',
+  setPublicRole: jest.fn(),
+  ...overrides,
+});
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+  useResourcePermissionState: () => mockUseResourcePermissionState(),
+  usePeoplePickerPermissions: () => ({ hasPeoplePickerAccess: true, peoplePickerTypeFilter: '' }),
+  useCanSharePublic: () => true,
+  useCopyToClipboard: () => jest.fn(),
+}));
+
+jest.mock('@librechat/client', () => ({
+  ...jest.requireActual('@librechat/client'),
+  useToastContext: () => ({ showToast: jest.fn() }),
+}));
+
+jest.mock('../PeoplePicker/UnifiedPeopleSearch', () => ({
+  __esModule: true,
+  default: () => <div data-testid="unified-people-search" />,
+}));
+jest.mock('../PeoplePickerAdminSettings', () => ({
+  __esModule: true,
+  default: () => <div data-testid="admin-settings" />,
+}));
+jest.mock('../PublicSharingToggle', () => ({
+  __esModule: true,
+  default: () => <div data-testid="public-toggle" />,
+}));
+jest.mock('../PeoplePicker', () => ({
+  __esModule: true,
+  SelectedPrincipalsList: () => <div data-testid="principals-list" />,
+}));
+
+const renderDialog = () =>
+  render(
+    <GenericGrantAccessDialog
+      resourceDbId="agent-db-1"
+      resourceId="agent-1"
+      resourceName="Test Agent"
+      resourceType={ResourceType.AGENT}
+    />,
+  );
+
+describe('GenericGrantAccessDialog - permissions load failure', () => {
+  beforeEach(() => {
+    mockUseResourcePermissionState.mockReset();
+    mockRefetchPermissions.mockReset();
+  });
+
+  it('renders a compact alert button (not the share trigger, not raw text) when permissions fail to load', () => {
+    mockUseResourcePermissionState.mockReturnValue(
+      baseState({ permissionsError: new Error('boom'), permissionsData: undefined }),
+    );
+
+    const { container } = renderDialog();
+
+    expect(
+      screen.getByRole('button', { name: 'com_ui_permissions_failed_load' }),
+    ).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: 'com_ui_share_var' })).not.toBeInTheDocument();
+    expect(container.querySelector('.spinner')).not.toBeInTheDocument();
+  });
+
+  it('retries the permissions fetch when the alert button is clicked', () => {
+    mockUseResourcePermissionState.mockReturnValue(
+      baseState({ permissionsError: new Error('boom'), permissionsData: undefined }),
+    );
+
+    renderDialog();
+
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_permissions_failed_load' }));
+    expect(mockRefetchPermissions).toHaveBeenCalledTimes(1);
+  });
+
+  it('shows a spinner instead of the alert icon while refetching', () => {
+    mockUseResourcePermissionState.mockReturnValue(
+      baseState({
+        permissionsError: new Error('boom'),
+        permissionsData: undefined,
+        isFetchingPermissions: true,
+      }),
+    );
+
+    const { container } = renderDialog();
+
+    expect(
+      screen.getByRole('button', { name: 'com_ui_permissions_failed_load' }),
+    ).toBeInTheDocument();
+    expect(container.querySelector('.spinner')).toBeInTheDocument();
+  });
+
+  it('renders the normal share trigger and dialog body when permissions load successfully', () => {
+    mockUseResourcePermissionState.mockReturnValue(baseState());
+
+    renderDialog();
+
+    expect(
+      screen.queryByRole('button', { name: 'com_ui_permissions_failed_load' }),
+    ).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_share_var' }));
+    expect(screen.getByTestId('unified-people-search')).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/SidePanel/Agents/AgentConfig.tsx b/client/src/components/SidePanel/Agents/AgentConfig.tsx
index 2ee88a59c83..bb8db1a7701 100644
--- a/client/src/components/SidePanel/Agents/AgentConfig.tsx
+++ b/client/src/components/SidePanel/Agents/AgentConfig.tsx
@@ -1,11 +1,14 @@
 import React, { useState, useMemo, useCallback } from 'react';
 import { X } from 'lucide-react';
+import { useQueries } from '@tanstack/react-query';
 import { Switch, useToastContext } from '@librechat/client';
 import { Controller, useWatch, useFormContext } from 'react-hook-form';
 import {
   EModelEndpoint,
   PermissionTypes,
   Permissions,
+  QueryKeys,
+  dataService,
   getEndpointField,
 } from 'librechat-data-provider';
 import type { AgentForm, IconComponentTypes } from '~/common';
@@ -18,14 +21,14 @@ import {
   cn,
 } from '~/utils';
 import { ToolSelectDialog, MCPToolSelectDialog } from '~/components/Tools';
-import { SkillSelectDialog } from '~/components/Skills/dialogs';
 import useAgentCapabilities from '~/hooks/Agents/useAgentCapabilities';
+import { useListSkillsQuery, useGetAgentFiles } from '~/data-provider';
 import { useFileMapContext, useAgentPanelContext } from '~/Providers';
+import { useLocalize, useVisibleTools, useHasAccess } from '~/hooks';
+import { SkillSelectDialog } from '~/components/Skills/dialogs';
 import AgentCategorySelector from './AgentCategorySelector';
 import Action from '~/components/SidePanel/Builder/Action';
-import { useLocalize, useVisibleTools, useHasAccess } from '~/hooks';
 import { Panel, isEphemeralAgent } from '~/common';
-import { useListSkillsQuery, useGetAgentFiles } from '~/data-provider';
 import { icons } from '~/hooks/Endpoint/Icons';
 import Instructions from './Instructions';
 import AgentAvatar from './AgentAvatar';
@@ -37,6 +40,14 @@ import AgentTool from './AgentTool';
 import CodeForm from './Code/Form';
 import MCPTools from './MCPTools';
 
+/** A skill lookup only counts as a confirmed miss on 404/403 — deleted or no
+ *  longer shared. Transient/network/server errors must not present a valid
+ *  configured skill as removable. */
+const isConfirmedSkillMiss = (error: unknown): boolean => {
+  const status = (error as { response?: { status?: number } } | null)?.response?.status;
+  return status === 404 || status === 403;
+};
+
 const labelClass = 'mb-2 text-token-text-primary block text-sm font-medium';
 const inputClass = cn(
   defaultTextProps,
@@ -111,6 +122,36 @@ export default function AgentConfig() {
     return map;
   }, [skillsData?.skills]);
 
+  /** Allowlist ids missing from the first catalog page (`limit: 100`) are
+   *  resolved individually — a cache miss alone must never present a valid
+   *  configured skill as unavailable and invite its removal. */
+  const unresolvedSkillIds = useMemo(
+    () => (skillsData === undefined ? [] : (skills ?? []).filter((id) => !skillsMap.has(id))),
+    [skills, skillsMap, skillsData],
+  );
+  const unresolvedSkillQueries = useQueries({
+    queries: unresolvedSkillIds.map((skillId) => ({
+      queryKey: [QueryKeys.skill, skillId],
+      queryFn: () => dataService.getSkill(skillId),
+      retry: false,
+      refetchOnMount: false,
+      refetchOnReconnect: false,
+      refetchOnWindowFocus: false,
+    })),
+  });
+  const unresolvedSkills = useMemo(() => {
+    const map = new Map<string, { name?: string; missing: boolean }>();
+    unresolvedSkillIds.forEach((skillId, index) => {
+      const query = unresolvedSkillQueries[index];
+      if (query?.isError === true && isConfirmedSkillMiss(query.error)) {
+        map.set(skillId, { missing: true });
+      } else if (query?.data?.name) {
+        map.set(skillId, { name: query.data.name, missing: false });
+      }
+    });
+    return map;
+  }, [unresolvedSkillIds, unresolvedSkillQueries]);
+
   const { data: agentFiles = [] } = useGetAgentFiles(agent_id);
 
   const mergedFileMap = useMemo(() => {
@@ -380,16 +421,31 @@ export default function AgentConfig() {
             >
               <div className="mb-1">
                 {(skills ?? []).map((skillId) => {
-                  const skillName = skillsMap.get(skillId);
-                  if (!skillName) {
+                  const skillName = skillsMap.get(skillId) ?? unresolvedSkills.get(skillId)?.name;
+                  /** Hide chips while the catalog page or per-id lookup is in
+                   *  flight. Once the backend confirms a miss (deleted or no
+                   *  longer shared), the id must stay visible and removable —
+                   *  otherwise the allowlist silently scopes the agent to
+                   *  zero skills with no way to fix it in the UI. */
+                  if (!skillName && unresolvedSkills.get(skillId)?.missing !== true) {
                     return null;
                   }
+                  const isUnavailable = !skillName;
                   return (
                     <div
                       key={skillId}
                       className="mb-1 flex items-center justify-between rounded-md border border-border-light px-3 py-2 text-sm"
                     >
-                      <span className="truncate text-text-primary">{skillName}</span>
+                      <span
+                        className={
+                          isUnavailable
+                            ? 'truncate italic text-text-secondary'
+                            : 'truncate text-text-primary'
+                        }
+                        title={isUnavailable ? skillId : undefined}
+                      >
+                        {skillName ?? localize('com_ui_skill_unavailable')}
+                      </span>
                       <button
                         type="button"
                         onClick={() => {
@@ -401,7 +457,9 @@ export default function AgentConfig() {
                           );
                         }}
                         className="ml-2 flex-shrink-0 text-text-secondary transition-colors hover:text-text-primary"
-                        aria-label={localize('com_ui_remove_skill_var', { 0: skillName })}
+                        aria-label={localize('com_ui_remove_skill_var', {
+                          0: skillName ?? skillId,
+                        })}
                         disabled={skillsActive !== true}
                       >
                         <X className="h-4 w-4" aria-hidden="true" />
diff --git a/client/src/components/SidePanel/Agents/AgentPanel.test.tsx b/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
index a3df6d52c46..e2899bf1e60 100644
--- a/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
+++ b/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
@@ -3,7 +3,6 @@
  */
 import * as React from 'react';
 import { render, waitFor, fireEvent } from '@testing-library/react';
-import { describe, it, expect, beforeEach, jest } from '@jest/globals';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { Agent } from 'librechat-data-provider';
 
diff --git a/client/src/components/SidePanel/Agents/ImageVision.tsx b/client/src/components/SidePanel/Agents/ImageVision.tsx
index bc4e1178966..7ac1be83f80 100644
--- a/client/src/components/SidePanel/Agents/ImageVision.tsx
+++ b/client/src/components/SidePanel/Agents/ImageVision.tsx
@@ -1,12 +1,12 @@
 import { Checkbox } from '@librechat/client';
 import { Capabilities } from 'librechat-data-provider';
 import { useFormContext, Controller } from 'react-hook-form';
-import type { AgentForm } from '~/common';
+import type { AssistantForm } from '~/common';
 import { useLocalize } from '~/hooks';
 
 export default function ImageVision() {
   const localize = useLocalize();
-  const methods = useFormContext<AgentForm>();
+  const methods = useFormContext<AssistantForm>();
   const { control, setValue, getValues } = methods;
 
   return (
@@ -21,10 +21,12 @@ export default function ImageVision() {
             onCheckedChange={field.onChange}
             className="relative float-left mr-2 inline-flex h-4 w-4 cursor-pointer"
             value={field.value?.toString()}
+            aria-labelledby="image-vision-label"
           />
         )}
       />
       <label
+        id="image-vision-label"
         className="form-check-label text-token-text-primary w-full cursor-pointer"
         htmlFor={Capabilities.image_vision}
         onClick={() =>
diff --git a/client/src/components/SidePanel/Agents/Images.tsx b/client/src/components/SidePanel/Agents/Images.tsx
index f899fdbbc8a..23ac59e2796 100644
--- a/client/src/components/SidePanel/Agents/Images.tsx
+++ b/client/src/components/SidePanel/Agents/Images.tsx
@@ -112,7 +112,6 @@ export function AvatarMenu({
         isOpen={isOpen}
         setIsOpen={setIsOpen}
         menuId="agent-avatar-menu"
-        placement="bottom"
         gutter={8}
         portal
         mountByState
diff --git a/client/src/components/SidePanel/Agents/MCPTool.tsx b/client/src/components/SidePanel/Agents/MCPTool.tsx
index ea3c38abfaa..127fe55e609 100644
--- a/client/src/components/SidePanel/Agents/MCPTool.tsx
+++ b/client/src/components/SidePanel/Agents/MCPTool.tsx
@@ -102,7 +102,7 @@ export default function MCPTool({ serverInfo }: { serverInfo?: MCPServerInfo })
       <Accordion type="single" value={accordionValue} onValueChange={setAccordionValue} collapsible>
         <AccordionItem value={currentServerName} className="group relative w-full border-none">
           <div
-            className="relative flex w-full items-center gap-1 rounded-lg p-1 text-sm hover:bg-surface-primary-alt"
+            className="relative flex w-full items-center gap-1 rounded-lg p-1 text-sm focus-within:bg-surface-primary-alt hover:bg-surface-primary-alt"
             onMouseEnter={() => setIsHovering(true)}
             onMouseLeave={() => setIsHovering(false)}
             onFocus={() => setIsFocused(true)}
@@ -140,7 +140,7 @@ export default function MCPTool({ serverInfo }: { serverInfo?: MCPServerInfo })
                   <div className="relative flex items-center">
                     <div
                       className={cn(
-                        'absolute right-0 transition-all duration-300',
+                        'absolute right-0 rounded-md bg-surface-primary-alt py-0.5 pl-1 transition-all duration-300',
                         isHovering || isFocused
                           ? 'translate-x-0 opacity-100'
                           : 'translate-x-8 opacity-0',
diff --git a/client/src/components/SidePanel/Agents/ModelPanel.tsx b/client/src/components/SidePanel/Agents/ModelPanel.tsx
index 312e2c52c5b..d1bf137505a 100644
--- a/client/src/components/SidePanel/Agents/ModelPanel.tsx
+++ b/client/src/components/SidePanel/Agents/ModelPanel.tsx
@@ -11,6 +11,7 @@ import {
   LocalStorageKeys,
   SettingDefinition,
   agentParamSettings,
+  applyModelAwareDefaults,
 } from 'librechat-data-provider';
 import type * as t from 'librechat-data-provider';
 import type { AgentForm, AgentModelPanelProps, StringOption } from '~/common';
@@ -82,9 +83,14 @@ export default function ModelPanel({
       agentParamSettings[combinedKey] ?? agentParamSettings[overriddenEndpointKey] ?? [];
     const overriddenParams = endpointsConfig[provider]?.customParams?.paramDefinitions ?? [];
     const overriddenParamsMap = keyBy(overriddenParams, 'key');
-    return defaultParams
-      .filter((param) => param != null)
-      .map((param) => (overriddenParamsMap[param.key] as SettingDefinition) ?? param);
+    const modelAwareParams = applyModelAwareDefaults(
+      defaultParams.filter((param) => param != null),
+      overriddenEndpointKey,
+      model ?? '',
+    );
+    return modelAwareParams.map(
+      (param) => (overriddenParamsMap[param.key] as SettingDefinition) ?? param,
+    );
   }, [endpointType, endpointsConfig, model, provider]);
 
   const setOption = (optionKey: keyof t.AgentModelParameters) => (value: t.AgentParameterValue) => {
diff --git a/client/src/components/SidePanel/Agents/Retrieval.tsx b/client/src/components/SidePanel/Agents/Retrieval.tsx
index c23797b4033..d4df0c3f467 100644
--- a/client/src/components/SidePanel/Agents/Retrieval.tsx
+++ b/client/src/components/SidePanel/Agents/Retrieval.tsx
@@ -9,15 +9,15 @@ import {
   HoverCardPortal,
   HoverCardTrigger,
 } from '@librechat/client';
+import type { AssistantForm } from '~/common';
 import OptionHover from '~/components/SidePanel/Parameters/OptionHover';
-import type { AgentForm } from '~/common';
 import { useLocalize } from '~/hooks';
 import { ESide } from '~/common';
 import { cn } from '~/utils/';
 
 export default function Retrieval({ retrievalModels }: { retrievalModels: Set<string> }) {
   const localize = useLocalize();
-  const methods = useFormContext<AgentForm>();
+  const methods = useFormContext<AssistantForm>();
   const { control, setValue, getValues } = methods;
   const model = useWatch({ control, name: 'model' });
 
@@ -44,11 +44,13 @@ export default function Retrieval({ retrievalModels }: { retrievalModels: Set<st
                 onCheckedChange={field.onChange}
                 className="relative float-left mr-2 inline-flex h-4 w-4 cursor-pointer"
                 value={field.value?.toString()}
+                aria-labelledby="retrieval-label"
               />
             )}
           />
           <div className="flex items-center space-x-2">
             <label
+              id="retrieval-label"
               className={cn(
                 'form-check-label text-token-text-primary w-full select-none',
                 isDisabled ? 'cursor-no-drop opacity-50' : 'cursor-pointer',
diff --git a/client/src/components/SidePanel/Agents/Search/InputSection.tsx b/client/src/components/SidePanel/Agents/Search/InputSection.tsx
index caeb5fb1bae..773e74b03d8 100644
--- a/client/src/components/SidePanel/Agents/Search/InputSection.tsx
+++ b/client/src/components/SidePanel/Agents/Search/InputSection.tsx
@@ -1,11 +1,9 @@
-import { useState } from 'react';
 import * as Menu from '@ariakit/react/menu';
-import { ChevronDown, Eye, EyeOff } from 'lucide-react';
-import { Input, Label, DropdownPopup } from '@librechat/client';
+import { ChevronDown } from 'lucide-react';
+import { Input, Label, SecretInput, DropdownPopup } from '@librechat/client';
 import type { SearchApiKeyFormData } from '~/hooks/Plugins/useAuthSearchTool';
 import type { UseFormRegister } from 'react-hook-form';
 import type { MenuItemProps } from '~/common';
-import { useLocalize } from '~/hooks';
 
 interface InputConfig {
   placeholder: string;
@@ -45,21 +43,12 @@ export default function InputSection({
   setDropdownOpen,
   dropdownKey,
 }: InputSectionProps) {
-  const localize = useLocalize();
-  const [passwordVisibility, setPasswordVisibility] = useState<Record<string, boolean>>({});
   const selectedOption = dropdownOptions.find((opt) => opt.key === selectedKey);
   const dropdownItems: MenuItemProps[] = dropdownOptions.map((option) => ({
     label: option.label,
     onClick: () => onSelectionChange(option.key),
   }));
 
-  const togglePasswordVisibility = (fieldName: string) => {
-    setPasswordVisibility((prev) => ({
-      ...prev,
-      [fieldName]: !prev[fieldName],
-    }));
-  };
-
   return (
     <div className="mb-6">
       <div className="mb-2 flex items-center justify-between">
@@ -85,47 +74,27 @@ export default function InputSection({
         )}
       </div>
       {selectedOption?.inputs &&
-        Object.entries(selectedOption.inputs).map(([name, config], index) => (
+        Object.entries(selectedOption.inputs).map(([name, config]) => (
           <div key={name}>
             <div className="relative">
-              <Input
-                type={'text'} // so password autofill doesn't show
-                placeholder={config.placeholder}
-                autoComplete={config.type === 'password' ? 'one-time-code' : 'off'}
-                readOnly={config.type === 'password'}
-                onFocus={
-                  config.type === 'password' ? (e) => (e.target.readOnly = false) : undefined
-                }
-                className={`${index > 0 ? 'mb-2' : 'mb-2'} ${
-                  config.type === 'password' ? 'pr-10' : ''
-                }`}
-                {...register(name as keyof SearchApiKeyFormData)}
-              />
-              {config.type === 'password' && (
-                <button
-                  type="button"
-                  onClick={() => togglePasswordVisibility(name)}
-                  className="absolute right-3 top-1/2 -translate-y-1/2 text-text-secondary transition-colors hover:text-text-primary"
-                  aria-label={
-                    passwordVisibility[name]
-                      ? localize('com_ui_hide_password')
-                      : localize('com_ui_show_password')
-                  }
-                >
-                  <div className="relative h-4 w-4">
-                    {passwordVisibility[name] ? (
-                      <EyeOff
-                        className="absolute inset-0 h-4 w-4 duration-200 animate-in fade-in"
-                        aria-hidden="true"
-                      />
-                    ) : (
-                      <Eye
-                        className="absolute inset-0 h-4 w-4 duration-200 animate-in fade-in"
-                        aria-hidden="true"
-                      />
-                    )}
-                  </div>
-                </button>
+              {config.type === 'password' ? (
+                <SecretInput
+                  placeholder={config.placeholder}
+                  autoComplete="one-time-code"
+                  data-lpignore="true"
+                  data-1p-ignore="true"
+                  controlsOnHover
+                  className="mb-2"
+                  {...register(name as keyof SearchApiKeyFormData)}
+                />
+              ) : (
+                <Input
+                  type="text"
+                  placeholder={config.placeholder}
+                  autoComplete="off"
+                  className="mb-2"
+                  {...register(name as keyof SearchApiKeyFormData)}
+                />
               )}
             </div>
             {config.link && (
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx b/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
index 3669fa75e07..6da7b04951d 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
@@ -1,7 +1,7 @@
 import '@testing-library/jest-dom/extend-expect';
 import { render, fireEvent } from '@testing-library/react';
+import type { VersionContext } from '../types';
 import VersionContent from '../VersionContent';
-import { VersionContext } from '../VersionPanel';
 
 const mockRestore = 'Restore';
 
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx b/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
index 053bf0f2249..f6798fd0257 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
@@ -1,7 +1,7 @@
 import '@testing-library/jest-dom/extend-expect';
 import { fireEvent, render, screen } from '@testing-library/react';
+import type { VersionRecord } from '../types';
 import VersionItem from '../VersionItem';
-import { VersionRecord } from '../VersionPanel';
 
 jest.mock('~/hooks', () => ({
   useLocalize: jest.fn().mockImplementation(() => (key, params) => {
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts b/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
index d6ef786d9c9..cf42c947128 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
@@ -1,5 +1,5 @@
+import type { AgentState, VersionRecord } from '../types';
 import { isActiveVersion } from '../isActiveVersion';
-import type { AgentState, VersionRecord } from '../VersionPanel';
 
 describe('isActiveVersion', () => {
   const createVersion = (overrides = {}): VersionRecord => ({
diff --git a/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx b/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
index c12caf42d42..0bee0e00bc4 100644
--- a/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
+++ b/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
@@ -2,7 +2,6 @@
  * @jest-environment jsdom
  */
 /* eslint-disable i18next/no-literal-string */
-import { describe, it, expect } from '@jest/globals';
 import { render, fireEvent } from '@testing-library/react';
 import { FormProvider, useForm, type UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
@@ -41,7 +40,15 @@ const defaultFormValues: AgentForm = {
   description: null,
   instructions: null,
   model: 'gpt-4',
-  model_parameters: {},
+  model_parameters: {
+    temperature: 1,
+    maxContextTokens: null,
+    max_context_tokens: null,
+    max_output_tokens: null,
+    top_p: 1,
+    frequency_penalty: 0,
+    presence_penalty: 0,
+  },
   tools: [],
   provider: 'openai',
   agent_ids: [],
@@ -62,7 +69,7 @@ const defaultFormValues: AgentForm = {
 
 describe('AgentAvatar reset menu', () => {
   it('clears preview and file state when reset is triggered', () => {
-    let methodsRef: UseFormReturn<AgentForm>;
+    let methodsRef: UseFormReturn<AgentForm> | undefined;
     const Wrapper = () => {
       methodsRef = useForm<AgentForm>({
         defaultValues: {
@@ -88,6 +95,10 @@ describe('AgentAvatar reset menu', () => {
     const { getByTestId } = render(<Wrapper />);
     fireEvent.click(getByTestId('reset-avatar'));
 
+    if (!methodsRef) {
+      throw new Error('Form methods were not initialized');
+    }
+
     expect(methodsRef.getValues('avatar_preview')).toBe('');
     expect(methodsRef.getValues('avatar_file')).toBeNull();
     expect(methodsRef.getValues('avatar_action')).toBe('reset');
diff --git a/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts b/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
index 988796cdc31..394fcac5d8c 100644
--- a/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
+++ b/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
@@ -1,7 +1,6 @@
 /**
  * @jest-environment jsdom
  */
-import { describe, it, expect, jest } from '@jest/globals';
 import { Constants, type Agent } from 'librechat-data-provider';
 import type { FieldNamesMarkedBoolean } from 'react-hook-form';
 import type { AgentForm } from '~/common';
@@ -18,7 +17,15 @@ const createForm = (): AgentForm => ({
   description: null,
   instructions: null,
   model: 'gpt-4',
-  model_parameters: {},
+  model_parameters: {
+    temperature: 1,
+    maxContextTokens: null,
+    max_context_tokens: null,
+    max_output_tokens: null,
+    top_p: 1,
+    frequency_penalty: 0,
+    presence_penalty: 0,
+  },
   tools: [],
   provider: 'openai',
   agent_ids: [],
@@ -70,7 +77,7 @@ describe('persistAvatarChanges', () => {
   it('returns false for ephemeral agents', async () => {
     const uploadAvatar = jest.fn();
     const result = await persistAvatarChanges({
-      agentId: Constants.EPHEMERAL_AGENT_ID,
+      agentId: String(Constants.EPHEMERAL_AGENT_ID),
       avatarActionState: 'upload',
       avatarFile: new File(['avatar'], 'avatar.png', { type: 'image/png' }),
       uploadAvatar,
diff --git a/client/src/components/SidePanel/Builder/ActionsAuth.tsx b/client/src/components/SidePanel/Builder/ActionsAuth.tsx
index 84b24bce6d8..46d1cbeaaa2 100644
--- a/client/src/components/SidePanel/Builder/ActionsAuth.tsx
+++ b/client/src/components/SidePanel/Builder/ActionsAuth.tsx
@@ -13,6 +13,7 @@ import {
   OGDialogHeader,
   OGDialogContent,
   OGDialogTrigger,
+  SecretInput,
 } from '@librechat/client';
 import { TranslationKeys, useLocalize } from '~/hooks';
 import { cn } from '~/utils';
@@ -23,6 +24,18 @@ export default function ActionsAuth({ disableOAuth }: { disableOAuth?: boolean }
   const { watch, setValue, trigger } = useFormContext();
   const type = watch('type');
 
+  const renderAuthFields = () => {
+    if (type === AuthTypeEnum.None) {
+      return null;
+    }
+
+    if (type === AuthTypeEnum.ServiceHttp) {
+      return <ApiKey />;
+    }
+
+    return <OAuth />;
+  };
+
   return (
     <OGDialog open={openAuthDialog} onOpenChange={setOpenAuthDialog}>
       <OGDialogTrigger asChild>
@@ -136,7 +149,7 @@ export default function ActionsAuth({ disableOAuth }: { disableOAuth?: boolean }
               </div>
             </RadioGroup.Root>
           </div>
-          {type === 'none' ? null : type === 'service_http' ? <ApiKey /> : <OAuth />}
+          {renderAuthFields()}
           {/* Cancel/Save */}
           <div className="mt-5 flex flex-col gap-3 sm:mt-4 sm:flex-row-reverse">
             <button
@@ -168,18 +181,20 @@ const ApiKey = () => {
   const { register, watch, setValue } = useFormContext();
   const authorization_type = watch('authorization_type');
   const type = watch('type');
+  const inputClasses = cn(
+    'mb-2 h-9 w-full resize-none overflow-y-auto rounded-lg border px-3 py-2 text-sm',
+    'border-border-medium bg-surface-primary outline-none',
+    'focus:ring-2 focus:ring-ring',
+  );
+
   return (
     <>
       <label className="mb-1 block text-sm font-medium">{localize('com_ui_api_key')}</label>
-      <input
+      <SecretInput
         placeholder="<HIDDEN>"
-        type="new-password"
         autoComplete="new-password"
-        className={cn(
-          'mb-2 h-9 w-full resize-none overflow-y-auto rounded-lg border px-3 py-2 text-sm',
-          'border-border-medium bg-surface-primary outline-none',
-          'focus:ring-2 focus:ring-ring',
-        )}
+        controlsOnHover
+        className={inputClasses}
         {...register('api_key', { required: type === AuthTypeEnum.ServiceHttp })}
       />
       <label className="mb-1 block text-sm font-medium">{localize('com_ui_auth_type')}</label>
@@ -294,18 +309,18 @@ const OAuth = () => {
   return (
     <>
       <label className="mb-1 block text-sm font-medium">{localize('com_ui_client_id')}</label>
-      <input
+      <SecretInput
         placeholder="<HIDDEN>"
-        type="password"
         autoComplete="new-password"
+        controlsOnHover
         className={inputClasses}
         {...register('oauth_client_id', { required: false })}
       />
       <label className="mb-1 block text-sm font-medium">{localize('com_ui_client_secret')}</label>
-      <input
+      <SecretInput
         placeholder="<HIDDEN>"
-        type="password"
         autoComplete="new-password"
+        controlsOnHover
         className={inputClasses}
         {...register('oauth_client_secret', { required: false })}
       />
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPAdminSettings.tsx b/client/src/components/SidePanel/MCPBuilder/MCPAdminSettings.tsx
index af677999bc4..617502a00d2 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPAdminSettings.tsx
+++ b/client/src/components/SidePanel/MCPBuilder/MCPAdminSettings.tsx
@@ -10,6 +10,10 @@ const permissions: PermissionConfig[] = [
   { permission: Permissions.CREATE, labelKey: 'com_ui_mcp_servers_allow_create' },
   { permission: Permissions.SHARE, labelKey: 'com_ui_mcp_servers_allow_share' },
   { permission: Permissions.SHARE_PUBLIC, labelKey: 'com_ui_mcp_servers_allow_share_public' },
+  {
+    permission: Permissions.CONFIGURE_OBO,
+    labelKey: 'com_ui_mcp_servers_allow_configure_obo',
+  },
 ];
 
 const MCPAdminSettings = () => {
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerCard.tsx b/client/src/components/SidePanel/MCPBuilder/MCPServerCard.tsx
index 1e538724fbd..5967088f56f 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPServerCard.tsx
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerCard.tsx
@@ -123,7 +123,7 @@ export default function MCPServerCard({
 
         {/* Server Info */}
         <div className="min-w-0 flex-1">
-          <span className="truncate text-sm font-medium text-text-primary">{displayName}</span>
+          <div className="truncate text-sm font-medium text-text-primary">{displayName}</div>
           {description && <p className="truncate text-xs text-text-secondary">{description}</p>}
         </div>
 
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/MCPServerForm.tsx b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/MCPServerForm.tsx
index d4096ea96a4..ac078cae6f8 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/MCPServerForm.tsx
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/MCPServerForm.tsx
@@ -1,5 +1,8 @@
-import { FormProvider } from 'react-hook-form';
-import type { useMCPServerForm } from './hooks/useMCPServerForm';
+import { FormProvider, useWatch } from 'react-hook-form';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
+import { useHasAccess } from '~/hooks';
+import type { useMCPServerForm, MCPServerFormData } from './hooks/useMCPServerForm';
+import { AuthTypeEnum } from './hooks/useMCPServerForm';
 import ConnectionSection from './sections/ConnectionSection';
 import BasicInfoSection from './sections/BasicInfoSection';
 import TransportSection from './sections/TransportSection';
@@ -13,18 +16,40 @@ interface MCPServerFormProps {
 export default function MCPServerForm({ formHook }: MCPServerFormProps) {
   const { methods, isEditMode, server } = formHook;
 
+  const canConfigureObo = useHasAccess({
+    permissionType: PermissionTypes.MCP_SERVERS,
+    permission: Permissions.CONFIGURE_OBO,
+  });
+
+  /**
+   * Lockdown applies when a user without CONFIGURE_OBO opens an OBO server in
+   * edit mode. Mirrors the backend allowlist policy: every field outside title,
+   * description, and iconPath is read-only (URL, transport, auth, trust). Any
+   * other change would let the user redirect OBO tokens to an arbitrary endpoint.
+   */
+  const authType = useWatch<MCPServerFormData, 'auth.auth_type'>({
+    control: methods.control,
+    name: 'auth.auth_type',
+  });
+  const isOboLockedReadOnly = isEditMode && authType === AuthTypeEnum.OBO && !canConfigureObo;
+
   return (
     <FormProvider {...methods}>
       <div className="space-y-4 px-1 py-1">
         <BasicInfoSection />
+        <fieldset
+          disabled={isOboLockedReadOnly}
+          className="contents space-y-4"
+          aria-disabled={isOboLockedReadOnly}
+        >
+          <ConnectionSection />
 
-        <ConnectionSection />
-
-        <TransportSection />
+          <TransportSection />
 
-        <AuthSection isEditMode={isEditMode} serverName={server?.serverName} />
+          <AuthSection isEditMode={isEditMode} serverName={server?.serverName} />
 
-        <TrustSection />
+          <TrustSection />
+        </fieldset>
       </div>
     </FormProvider>
   );
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/hooks/useMCPServerForm.ts b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/hooks/useMCPServerForm.ts
index 9522f450dff..7f42eee19b5 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/hooks/useMCPServerForm.ts
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/hooks/useMCPServerForm.ts
@@ -16,6 +16,7 @@ export enum AuthTypeEnum {
   None = 'none',
   ServiceHttp = 'service_http',
   OAuth = 'oauth',
+  OBO = 'obo',
 }
 
 // Authorization type enum
@@ -37,6 +38,7 @@ export interface AuthConfig {
   oauth_authorization_url?: string;
   oauth_token_url?: string;
   oauth_scope?: string;
+  obo_scopes?: string;
   server_id?: string;
 }
 
@@ -77,7 +79,9 @@ export function useMCPServerForm({ server, onSuccess, onClose }: UseMCPServerFor
   const defaultValues = useMemo<MCPServerFormData>(() => {
     if (server) {
       let authType = AuthTypeEnum.None;
-      if (server.config.oauth) {
+      if ('obo' in server.config && server.config.obo) {
+        authType = AuthTypeEnum.OBO;
+      } else if (server.config.oauth) {
         authType = AuthTypeEnum.OAuth;
       } else if ('apiKey' in server.config && server.config.apiKey) {
         authType = AuthTypeEnum.ServiceHttp;
@@ -104,6 +108,7 @@ export function useMCPServerForm({ server, onSuccess, onClose }: UseMCPServerFor
           oauth_authorization_url: server.config.oauth?.authorization_url || '',
           oauth_token_url: server.config.oauth?.token_url || '',
           oauth_scope: server.config.oauth?.scope || '',
+          obo_scopes: 'obo' in server.config && server.config.obo ? server.config.obo.scopes : '',
           server_id: server.serverName,
         },
         trust: true, // Pre-checked for existing servers
@@ -127,6 +132,7 @@ export function useMCPServerForm({ server, onSuccess, onClose }: UseMCPServerFor
         oauth_authorization_url: '',
         oauth_token_url: '',
         oauth_scope: '',
+        obo_scopes: '',
       },
       trust: false,
     };
@@ -142,7 +148,6 @@ export function useMCPServerForm({ server, onSuccess, onClose }: UseMCPServerFor
 
   // Watch URL for auto-fill
   const watchedUrl = watch('url');
-  const watchedTitle = watch('title');
 
   // Auto-fill title from URL when title is empty
   const handleUrlChange = useCallback(
@@ -221,6 +226,10 @@ export function useMCPServerForm({ server, onSuccess, onClose }: UseMCPServerFor
         };
       }
 
+      if (formData.auth.auth_type === AuthTypeEnum.OBO && formData.auth.obo_scopes) {
+        config.obo = { scopes: formData.auth.obo_scopes };
+      }
+
       const params: MCPServerCreateParams = { config };
 
       const result = server
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/AuthSection.tsx b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/AuthSection.tsx
index 6d18ccf15b0..fb31c95949c 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/AuthSection.tsx
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/AuthSection.tsx
@@ -1,10 +1,11 @@
 import { useMemo, useState } from 'react';
 import { Copy, CopyCheck } from 'lucide-react';
 import { useFormContext, useWatch } from 'react-hook-form';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
 import { Label, Input, Checkbox, SecretInput, Radio, useToastContext } from '@librechat/client';
 import { AuthTypeEnum, AuthorizationTypeEnum } from '../hooks/useMCPServerForm';
 import type { MCPServerFormData } from '../hooks/useMCPServerForm';
-import { useLocalize, useCopyToClipboard } from '~/hooks';
+import { useLocalize, useCopyToClipboard, useHasAccess } from '~/hooks';
 import { cn } from '~/utils';
 
 interface AuthSectionProps {
@@ -23,6 +24,11 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
 
   const [isCopying, setIsCopying] = useState(false);
 
+  const canConfigureObo = useHasAccess({
+    permissionType: PermissionTypes.MCP_SERVERS,
+    permission: Permissions.CONFIGURE_OBO,
+  });
+
   const authType = useWatch<MCPServerFormData, 'auth.auth_type'>({
     name: 'auth.auth_type',
   }) as AuthTypeEnum;
@@ -41,14 +47,31 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
 
   const copyLink = useCopyToClipboard({ text: redirectUri });
 
-  const authTypeOptions = useMemo(
-    () => [
+  /**
+   * Show OBO as a selectable auth option only when the caller has the permission.
+   * Edit-mode carve-out: if the form was loaded for a server that already uses OBO
+   * and the caller has since lost the permission, surface OBO in the radio so the
+   * current auth state is visible — but mark every OBO control disabled (and
+   * disable the radio itself, so the user can't switch away) since the backend
+   * also rejects modifying OBO without the permission.
+   */
+  const showOboOption = canConfigureObo || authType === AuthTypeEnum.OBO;
+  const isOboLockedReadOnly = !canConfigureObo && authType === AuthTypeEnum.OBO;
+
+  const authTypeOptions = useMemo(() => {
+    const options = [
       { value: AuthTypeEnum.None, label: localize('com_ui_no_auth') },
       { value: AuthTypeEnum.ServiceHttp, label: localize('com_ui_api_key') },
       { value: AuthTypeEnum.OAuth, label: 'OAuth' },
-    ],
-    [localize],
-  );
+    ];
+    if (showOboOption) {
+      options.push({
+        value: AuthTypeEnum.OBO,
+        label: localize('com_ui_obo'),
+      });
+    }
+    return options;
+  }, [localize, showOboOption]);
 
   const headerFormatOptions = useMemo(
     () => [
@@ -73,6 +96,7 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
           value={authType || AuthTypeEnum.None}
           onChange={(val) => setValue('auth.auth_type', val as AuthTypeEnum)}
           fullWidth
+          disabled={isOboLockedReadOnly}
           aria-labelledby="auth-type-label"
         />
       </fieldset>
@@ -105,7 +129,12 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
               <Label htmlFor="api_key" className="text-sm font-medium">
                 {localize('com_ui_api_key')}
               </Label>
-              <SecretInput id="api_key" placeholder="sk-..." {...register('auth.api_key')} />
+              <SecretInput
+                id="api_key"
+                placeholder="sk-..."
+                controlsOnHover
+                {...register('auth.api_key')}
+              />
             </div>
           )}
 
@@ -160,9 +189,12 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
                   </>
                 )}
               </Label>
-              <Input
+              <SecretInput
                 id="oauth_client_id"
-                autoComplete="off"
+                autoComplete="new-password"
+                data-lpignore="true"
+                data-1p-ignore="true"
+                controlsOnHover
                 placeholder={isEditMode ? localize('com_ui_leave_blank_to_keep') : ''}
                 aria-invalid={errors.auth?.oauth_client_id ? 'true' : 'false'}
                 aria-describedby={
@@ -183,35 +215,14 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
             </div>
             <div className="space-y-1.5">
               <Label htmlFor="oauth_client_secret" className="text-sm font-medium">
-                {localize('com_ui_client_secret')}{' '}
-                {!isEditMode && (
-                  <>
-                    <span aria-hidden="true" className="text-text-secondary">
-                      *
-                    </span>
-                    <span className="sr-only">{localize('com_ui_field_required')}</span>
-                  </>
-                )}
+                {localize('com_ui_client_secret')}
               </Label>
               <SecretInput
                 id="oauth_client_secret"
                 placeholder={isEditMode ? localize('com_ui_leave_blank_to_keep') : ''}
-                aria-invalid={errors.auth?.oauth_client_secret ? 'true' : 'false'}
-                aria-describedby={
-                  errors.auth?.oauth_client_secret ? 'oauth-client-secret-error' : undefined
-                }
-                {...register('auth.oauth_client_secret', { required: !isEditMode })}
-                className={cn(errors.auth?.oauth_client_secret && 'border-border-destructive')}
+                controlsOnHover
+                {...register('auth.oauth_client_secret')}
               />
-              {errors.auth?.oauth_client_secret && (
-                <p
-                  id="oauth-client-secret-error"
-                  role="alert"
-                  className="text-xs text-text-destructive"
-                >
-                  {localize('com_ui_field_required')}
-                </p>
-              )}
             </div>
           </div>
 
@@ -278,6 +289,48 @@ export default function AuthSection({ isEditMode, serverName }: AuthSectionProps
           )}
         </div>
       )}
+
+      {/* OBO Fields */}
+      {authType === AuthTypeEnum.OBO && (
+        <div className="space-y-3 rounded-lg border border-border-light p-3">
+          <div className="space-y-1.5">
+            <Label htmlFor="obo_scopes" className="text-sm font-medium">
+              {localize('com_ui_obo_scopes')}{' '}
+              <span aria-hidden="true" className="text-text-secondary">
+                *
+              </span>
+              <span className="sr-only">{localize('com_ui_field_required')}</span>
+            </Label>
+            <Input
+              id="obo_scopes"
+              placeholder="api://<client-id>/Mcp.Tools.ReadWrite"
+              disabled={!canConfigureObo}
+              aria-invalid={errors.auth?.obo_scopes ? 'true' : 'false'}
+              aria-describedby={
+                canConfigureObo ? 'obo-scopes-description' : 'obo-scopes-readonly-description'
+              }
+              {...register('auth.obo_scopes', {
+                required: canConfigureObo && authType === AuthTypeEnum.OBO,
+              })}
+              className={cn(errors.auth?.obo_scopes && 'border-border-destructive')}
+            />
+            {errors.auth?.obo_scopes && (
+              <p role="alert" className="text-xs text-text-destructive">
+                {localize('com_ui_field_required')}
+              </p>
+            )}
+            {canConfigureObo ? (
+              <p id="obo-scopes-description" className="text-xs text-text-secondary">
+                {localize('com_ui_obo_scopes_description')}
+              </p>
+            ) : (
+              <p id="obo-scopes-readonly-description" className="text-xs text-text-secondary">
+                {localize('com_ui_obo_readonly_no_permission')}
+              </p>
+            )}
+          </div>
+        </div>
+      )}
     </div>
   );
 }
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/TrustSection.tsx b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/TrustSection.tsx
index 36d8d73a499..7ac9d3a5232 100644
--- a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/TrustSection.tsx
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/TrustSection.tsx
@@ -1,17 +1,25 @@
+import { useMemo } from 'react';
 import { useFormContext, Controller } from 'react-hook-form';
 import { Checkbox, Label } from '@librechat/client';
 import { useLocalize, useLocalizedConfig } from '~/hooks';
 import { useGetStartupConfig } from '~/data-provider';
+import { createConfigHtmlSanitizer } from '~/utils/configHtml';
 import type { MCPServerFormData } from '../hooks/useMCPServerForm';
 
 export default function TrustSection() {
   const localize = useLocalize();
   const { data: startupConfig } = useGetStartupConfig();
   const getLocalizedValue = useLocalizedConfig();
+  const sanitize = useMemo(() => createConfigHtmlSanitizer(), []);
   const {
     control,
     formState: { errors },
   } = useFormContext<MCPServerFormData>();
+  const trustCheckbox = startupConfig?.interface?.mcpServers?.trustCheckbox;
+  const labelHTML = sanitize(getLocalizedValue(trustCheckbox?.label, localize('com_ui_trust_app')));
+  const subLabelHTML = sanitize(
+    getLocalizedValue(trustCheckbox?.subLabel, localize('com_agents_mcp_trust_subtext')),
+  );
 
   return (
     <div className="rounded-lg border border-border-light bg-surface-secondary p-2">
@@ -37,35 +45,13 @@ export default function TrustSection() {
         />
         <Label htmlFor="trust" className="flex cursor-pointer flex-col gap-0.5 text-sm">
           <span id="trust-label" className="font-medium text-text-primary">
-            {startupConfig?.interface?.mcpServers?.trustCheckbox?.label ? (
-              <span
-                dangerouslySetInnerHTML={{
-                  __html: getLocalizedValue(
-                    startupConfig.interface.mcpServers.trustCheckbox.label,
-                    localize('com_ui_trust_app'),
-                  ),
-                }}
-              />
-            ) : (
-              localize('com_ui_trust_app')
-            )}{' '}
+            <span dangerouslySetInnerHTML={{ __html: labelHTML }} />{' '}
             <span aria-hidden="true" className="text-text-secondary">
               *
             </span>
           </span>
           <span id="trust-description" className="text-xs font-normal text-text-secondary">
-            {startupConfig?.interface?.mcpServers?.trustCheckbox?.subLabel ? (
-              <span
-                dangerouslySetInnerHTML={{
-                  __html: getLocalizedValue(
-                    startupConfig.interface.mcpServers.trustCheckbox.subLabel,
-                    localize('com_agents_mcp_trust_subtext'),
-                  ),
-                }}
-              />
-            ) : (
-              localize('com_agents_mcp_trust_subtext')
-            )}
+            <span dangerouslySetInnerHTML={{ __html: subLabelHTML }} />
           </span>
         </Label>
       </div>
diff --git a/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/__tests__/TrustSection.spec.tsx b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/__tests__/TrustSection.spec.tsx
new file mode 100644
index 00000000000..f573d72465a
--- /dev/null
+++ b/client/src/components/SidePanel/MCPBuilder/MCPServerDialog/sections/__tests__/TrustSection.spec.tsx
@@ -0,0 +1,166 @@
+import { render, screen } from '@testing-library/react';
+import { FormProvider, useForm } from 'react-hook-form';
+import type { ChangeEvent, ReactNode } from 'react';
+import TrustSection from '../TrustSection';
+import type { MCPServerFormData } from '../../hooks/useMCPServerForm';
+
+type LocalizedValue = string | Record<string, string>;
+
+type StartupConfigMock = {
+  interface?: {
+    mcpServers?: {
+      trustCheckbox?: {
+        label?: LocalizedValue;
+        subLabel?: LocalizedValue;
+      };
+    };
+  };
+};
+
+let mockStartupConfig: StartupConfigMock | undefined;
+
+jest.mock('~/data-provider', () => ({
+  useGetStartupConfig: () => ({ data: mockStartupConfig }),
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => {
+    const translations: Record<string, string> = {
+      com_ui_trust_app: 'I trust this app',
+      com_agents_mcp_trust_subtext: 'Only continue if you trust this MCP server.',
+      com_ui_field_required: 'This field is required',
+    };
+    return translations[key] ?? key;
+  },
+  useLocalizedConfig: () => (value: LocalizedValue | undefined, fallback: string) => {
+    if (value === undefined) {
+      return fallback;
+    }
+    if (typeof value === 'string') {
+      return value;
+    }
+    return value.en ?? Object.values(value)[0] ?? fallback;
+  },
+}));
+
+jest.mock(
+  '@librechat/client',
+  () => {
+    const React = jest.requireActual<typeof import('react')>('react');
+    return {
+      Checkbox: ({
+        checked,
+        onCheckedChange,
+        ...props
+      }: {
+        checked: boolean;
+        onCheckedChange: (checked: boolean) => void;
+      }) =>
+        React.createElement('input', {
+          type: 'checkbox',
+          checked,
+          onChange: (event: ChangeEvent<HTMLInputElement>) => onCheckedChange(event.target.checked),
+          ...props,
+        }),
+      Label: ({ children, ...props }: { children: ReactNode }) =>
+        React.createElement('label', props, children),
+    };
+  },
+  { virtual: true },
+);
+
+function createDefaultValues(): MCPServerFormData {
+  return {
+    title: '',
+    description: '',
+    icon: '',
+    url: '',
+    type: 'streamable-http',
+    auth: {
+      auth_type: 'none' as MCPServerFormData['auth']['auth_type'],
+    },
+    trust: false,
+  };
+}
+
+function renderTrustSection() {
+  function Wrapper() {
+    const methods = useForm<MCPServerFormData>({
+      defaultValues: createDefaultValues(),
+    });
+    return (
+      <FormProvider {...methods}>
+        <TrustSection />
+      </FormProvider>
+    );
+  }
+
+  return render(<Wrapper />);
+}
+
+describe('TrustSection', () => {
+  beforeEach(() => {
+    mockStartupConfig = undefined;
+  });
+
+  it('sanitizes script-capable trust checkbox label and sub-label HTML', () => {
+    mockStartupConfig = {
+      interface: {
+        mcpServers: {
+          trustCheckbox: {
+            label:
+              '<img src=x onerror="window.__trustXss = true">Trust <script>alert(1)</script><strong>OK</strong>',
+            subLabel:
+              '<a href="javascript:alert(1)" onclick="window.__trustXss = true"><strong>Learn</strong></a><svg onload="alert(1)"></svg>',
+          },
+        },
+      },
+    };
+
+    const { container } = renderTrustSection();
+    const label = container.querySelector('#trust-label');
+    const description = container.querySelector('#trust-description');
+    const link = screen.getByText('Learn').closest('a');
+
+    expect(label).not.toBeNull();
+    expect(description).not.toBeNull();
+    expect(label?.innerHTML).not.toMatch(/onerror/i);
+    expect(description?.innerHTML).not.toMatch(/onclick/i);
+    expect(container.querySelector('img')).not.toBeInTheDocument();
+    expect(container.querySelector('script')).not.toBeInTheDocument();
+    expect(container.querySelector('svg')).not.toBeInTheDocument();
+    expect(link).not.toBeNull();
+    expect(link).not.toHaveAttribute('href');
+    expect(link).toHaveAttribute('target', '_blank');
+    expect(link).toHaveAttribute('rel', 'noopener noreferrer');
+  });
+
+  it('preserves documented formatting while normalizing links', () => {
+    mockStartupConfig = {
+      interface: {
+        mcpServers: {
+          trustCheckbox: {
+            label: { en: 'I <em>understand</em>' },
+            subLabel:
+              'Read <a href="https://example.com/docs" target="_self"><strong>Learn more.</strong></a><br><code>safe</code>',
+          },
+        },
+      },
+    };
+
+    const { container } = renderTrustSection();
+    const emphasis = screen.getByText('understand');
+    const strong = screen.getByText('Learn more.');
+    const code = screen.getByText('safe');
+    const link = strong.closest('a');
+
+    expect(emphasis.tagName).toBe('EM');
+    expect(strong.tagName).toBe('STRONG');
+    expect(code.tagName).toBe('CODE');
+    expect(container.querySelector('#trust-description br')).toBeInTheDocument();
+    expect(link).not.toBeNull();
+    expect(link).toHaveAttribute('href', 'https://example.com/docs');
+    expect(link).toHaveAttribute('target', '_blank');
+    expect(link).toHaveAttribute('rel', 'noopener noreferrer');
+  });
+});
diff --git a/client/src/components/SidePanel/MCPBuilder/index.ts b/client/src/components/SidePanel/MCPBuilder/index.ts
index 375ed0db858..074f579c3f1 100644
--- a/client/src/components/SidePanel/MCPBuilder/index.ts
+++ b/client/src/components/SidePanel/MCPBuilder/index.ts
@@ -5,4 +5,3 @@ export { default as MCPServerDialog } from './MCPServerDialog';
 export { default as MCPServerCard } from './MCPServerCard';
 export { default as MCPStatusBadge, getStatusDotColor } from './MCPStatusBadge';
 export { default as MCPCardActions } from './MCPCardActions';
-export { default as MCPAuth } from './MCPAuth';
diff --git a/client/src/components/SidePanel/Memories/MemoryPanel.tsx b/client/src/components/SidePanel/Memories/MemoryPanel.tsx
index 0b9c932547f..01ec7cb5621 100644
--- a/client/src/components/SidePanel/Memories/MemoryPanel.tsx
+++ b/client/src/components/SidePanel/Memories/MemoryPanel.tsx
@@ -182,6 +182,7 @@ export default function MemoryPanel() {
                   checked={referenceSavedMemories}
                   tabIndex={-1}
                   aria-hidden="true"
+                  aria-label={localize('com_ui_use_memory')}
                   className="pointer-events-none mr-2"
                 />
                 {localize('com_ui_use_memory')}
diff --git a/client/src/components/SidePanel/Parameters/Panel.tsx b/client/src/components/SidePanel/Parameters/Panel.tsx
index a62ca5834a5..cd33937af7d 100644
--- a/client/src/components/SidePanel/Parameters/Panel.tsx
+++ b/client/src/components/SidePanel/Parameters/Panel.tsx
@@ -8,6 +8,7 @@ import {
   getEndpointField,
   SettingDefinition,
   tConvoUpdateSchema,
+  applyModelAwareDefaults,
 } from 'librechat-data-provider';
 import type { TPreset } from 'librechat-data-provider';
 import { SaveAsPresetDialog } from '~/components/Endpoints';
@@ -45,9 +46,14 @@ export default function Parameters() {
     const defaultParams = paramSettings[combinedKey] ?? paramSettings[overriddenEndpointKey] ?? [];
     const overriddenParams = endpointsConfig[provider]?.customParams?.paramDefinitions ?? [];
     const overriddenParamsMap = keyBy(overriddenParams, 'key');
-    return defaultParams
-      .filter((param) => param != null)
-      .map((param) => (overriddenParamsMap[param.key] as SettingDefinition) ?? param);
+    const modelAwareParams = applyModelAwareDefaults(
+      defaultParams.filter((param) => param != null),
+      overriddenEndpointKey,
+      model,
+    );
+    return modelAwareParams.map(
+      (param) => (overriddenParamsMap[param.key] as SettingDefinition) ?? param,
+    );
   }, [endpointType, endpointsConfig, model, provider]);
 
   useEffect(() => {
diff --git a/client/src/components/Skills/dialogs/UploadSkillDialog.tsx b/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
index 3cd1fd54089..6ae501c83bd 100644
--- a/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
+++ b/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
@@ -27,7 +27,9 @@ export default function UploadSkillDialog({ isOpen, setIsOpen }: UploadSkillDial
   const { showToast } = useToastContext();
   const fileInputRef = useRef<HTMLInputElement>(null);
   const [isDragging, setIsDragging] = useState(false);
-  const { data: skillFileConfig = { fileConfig: defaultFileConfig } } = useGetFileConfig({
+  const {
+    data: skillFileConfig = { configuredSizeLimitMb: undefined, fileConfig: defaultFileConfig },
+  } = useGetFileConfig({
     select: (data) => ({
       configuredSizeLimitMb: data?.skills?.fileSizeLimit,
       fileConfig: mergeFileConfig(data),
diff --git a/client/src/components/Skills/index.ts b/client/src/components/Skills/index.ts
index dcf7a32137c..6adbdb28f85 100644
--- a/client/src/components/Skills/index.ts
+++ b/client/src/components/Skills/index.ts
@@ -2,7 +2,6 @@ export * from './buttons';
 export * from './dialogs';
 export * from './display';
 export * from './forms';
-export * from './layouts';
 export * from './lists';
 export * from './sidebar';
 export * from './tree';
diff --git a/client/src/components/Skills/layouts/SkillsView.tsx b/client/src/components/Skills/layouts/SkillsView.tsx
index 961a2751072..405953eac84 100644
--- a/client/src/components/Skills/layouts/SkillsView.tsx
+++ b/client/src/components/Skills/layouts/SkillsView.tsx
@@ -1,20 +1,21 @@
-import { Navigate, useNavigate, useParams, useLocation, useSearchParams } from 'react-router-dom';
-import { Spinner } from '@librechat/client';
+import { Spinner, useMediaQuery } from '@librechat/client';
 import { PermissionTypes, Permissions } from 'librechat-data-provider';
-import { useGetSkillByIdQuery } from '~/data-provider';
-import { useHasAccess, useAuthContext, useLocalize } from '~/hooks';
+import { Navigate, useNavigate, useParams, useLocation, useSearchParams } from 'react-router-dom';
 import SkillFileViewer from '~/components/Skills/display/SkillFileViewer';
+import { CreateSkillForm, SkillForm } from '~/components/Skills/forms';
+import { useHasAccess, useAuthContext, useLocalize } from '~/hooks';
 import SkillDetail from '~/components/Skills/display/SkillDetail';
 import SkillState from '~/components/Skills/display/SkillState';
-import { SkillForm } from '~/components/Skills/forms';
+import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
+import { useGetSkillByIdQuery } from '~/data-provider';
 
 /**
- * Skill detail / edit route content.
+ * Skill detail / edit / create route content.
  *
  * Reader-first: the default `/skills/:skillId` shows the read-only
  * `SkillDetail` view (rendered markdown, metadata, source toggle).
  * Edit is reached via `/skills/:skillId/edit` or the Edit button.
- * Create is a dialog triggered from the sidebar, not a route.
+ * Create is reached via `/skills/new`.
  */
 export default function SkillsView() {
   const { skillId } = useParams();
@@ -26,7 +27,12 @@ export default function SkillsView() {
     permissionType: PermissionTypes.SKILLS,
     permission: Permissions.USE,
   });
+  const hasCreateAccess = useHasAccess({
+    permissionType: PermissionTypes.SKILLS,
+    permission: Permissions.CREATE,
+  });
 
+  const isCreate = location.pathname.endsWith('/new');
   const isEdit = location.pathname.endsWith('/edit');
 
   const rolesLoaded = user?.role != null && roles?.[user.role] != null;
@@ -42,14 +48,25 @@ export default function SkillsView() {
     return <Navigate to="/c/new" replace />;
   }
 
+  if (isCreate && !hasCreateAccess) {
+    return <Navigate to="/skills" replace />;
+  }
+
+  if (isCreate) {
+    return <CreateView />;
+  }
+
   // No skill selected — empty state
   if (!skillId) {
     return (
-      <div className="flex h-full w-full flex-col items-center justify-center bg-presentation">
-        <SkillState
-          title={localize('com_ui_skill_no_selection')}
-          description={localize('com_ui_skill_no_selection_desc')}
-        />
+      <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
+        <div className="flex flex-1 flex-col items-center justify-center">
+          <SkillState
+            title={localize('com_ui_skill_no_selection')}
+            description={localize('com_ui_skill_no_selection_desc')}
+          />
+        </div>
       </div>
     );
   }
@@ -57,6 +74,15 @@ export default function SkillsView() {
   return isEdit ? <EditView skillId={skillId} /> : <DetailView skillId={skillId} />;
 }
 
+function CreateView() {
+  return (
+    <div className="flex h-full w-full flex-col overflow-y-auto bg-presentation">
+      <MobileSidebarToggle />
+      <CreateSkillForm />
+    </div>
+  );
+}
+
 /** Read-only detail view — the default when clicking a skill. */
 function DetailView({ skillId }: { skillId: string }) {
   const localize = useLocalize();
@@ -69,6 +95,7 @@ function DetailView({ skillId }: { skillId: string }) {
   if (activeFile) {
     return (
       <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
         <SkillFileViewer skillId={skillId} relativePath={activeFile} />
       </div>
     );
@@ -85,6 +112,7 @@ function DetailView({ skillId }: { skillId: string }) {
   if (skillQuery.isError || !skillQuery.data) {
     return (
       <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
         <SkillState
           variant="error"
           title={localize('com_ui_skill_not_found')}
@@ -96,6 +124,7 @@ function DetailView({ skillId }: { skillId: string }) {
 
   return (
     <div className="flex h-full w-full flex-col bg-presentation">
+      <MobileSidebarToggle />
       <SkillDetail
         skill={skillQuery.data}
         onEdit={() => navigate(`/skills/${skillId}/edit`)}
@@ -109,7 +138,21 @@ function DetailView({ skillId }: { skillId: string }) {
 function EditView({ skillId }: { skillId: string }) {
   return (
     <div className="flex h-full w-full flex-col overflow-y-auto bg-presentation">
+      <MobileSidebarToggle />
       <SkillForm skillId={skillId} />
     </div>
   );
 }
+
+/** Sidebar reopen affordance for small screens, where the drawer is the only navigation. */
+function MobileSidebarToggle() {
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
+  if (!isSmallScreen) {
+    return null;
+  }
+  return (
+    <div className="flex shrink-0 items-center px-4 pt-3">
+      <OpenSidebar />
+    </div>
+  );
+}
diff --git a/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx b/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx
new file mode 100644
index 00000000000..c5dc2c56b97
--- /dev/null
+++ b/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx
@@ -0,0 +1,102 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { createMemoryRouter, RouterProvider } from 'react-router-dom';
+import SkillsView from '../SkillsView';
+
+const mockUseHasAccess = jest.fn((..._args: unknown[]) => true);
+const mockUseMediaQuery = jest.fn((_query: string) => false);
+
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    PermissionTypes: { SKILLS: 'skills' },
+    Permissions: { USE: 'use', CREATE: 'create' },
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@librechat/client',
+  () => ({
+    Spinner: () => <div data-testid="spinner" />,
+    useMediaQuery: (query: string) => mockUseMediaQuery(query),
+  }),
+  { virtual: true },
+);
+
+jest.mock('~/components/Chat/Menus/OpenSidebar', () => ({
+  __esModule: true,
+  default: () => <div data-testid="open-sidebar" />,
+}));
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+  useHasAccess: (...args: unknown[]) => mockUseHasAccess(...args),
+  useAuthContext: () => ({
+    user: { role: 'admin' },
+    roles: { admin: {} },
+  }),
+}));
+
+jest.mock('~/data-provider', () => ({
+  useGetSkillByIdQuery: jest.fn(() => ({
+    isLoading: false,
+    isError: false,
+    data: null,
+  })),
+}));
+
+jest.mock('~/components/Skills/forms', () => ({
+  CreateSkillForm: () => <div data-testid="create-skill-form" />,
+  SkillForm: () => <div data-testid="skill-form" />,
+}));
+
+jest.mock('~/components/Skills/display/SkillFileViewer', () => () => (
+  <div data-testid="skill-file-viewer" />
+));
+jest.mock('~/components/Skills/display/SkillDetail', () => () => (
+  <div data-testid="skill-detail" />
+));
+jest.mock('~/components/Skills/display/SkillState', () => ({ title }: { title: string }) => (
+  <div>{title}</div>
+));
+
+describe('SkillsView', () => {
+  beforeEach(() => {
+    mockUseHasAccess.mockReset();
+    mockUseHasAccess.mockReturnValue(true);
+    mockUseMediaQuery.mockReset();
+    mockUseMediaQuery.mockReturnValue(false);
+  });
+
+  it('renders the create skill form for /skills/new', () => {
+    const router = createMemoryRouter([{ path: '/skills/new', element: <SkillsView /> }], {
+      initialEntries: ['/skills/new'],
+    });
+
+    render(<RouterProvider router={router} />);
+
+    expect(screen.getByTestId('create-skill-form')).toBeInTheDocument();
+  });
+
+  it('renders the sidebar toggle on small screens', () => {
+    mockUseMediaQuery.mockReturnValue(true);
+    const router = createMemoryRouter([{ path: '/skills', element: <SkillsView /> }], {
+      initialEntries: ['/skills'],
+    });
+
+    render(<RouterProvider router={router} />);
+
+    expect(screen.getByTestId('open-sidebar')).toBeInTheDocument();
+  });
+
+  it('does not render the sidebar toggle on large screens', () => {
+    const router = createMemoryRouter([{ path: '/skills', element: <SkillsView /> }], {
+      initialEntries: ['/skills'],
+    });
+
+    render(<RouterProvider router={router} />);
+
+    expect(screen.queryByTestId('open-sidebar')).not.toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/System/LanguageSync.tsx b/client/src/components/System/LanguageSync.tsx
new file mode 100644
index 00000000000..095192a6b21
--- /dev/null
+++ b/client/src/components/System/LanguageSync.tsx
@@ -0,0 +1,35 @@
+import { useEffect } from 'react';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
+import i18n, { changeLanguageSafely, normalizeLocale } from '~/locales/i18n';
+import store from '~/store';
+
+export default function LanguageSync() {
+  const lang = useRecoilValue(store.lang);
+  const setLanguageLoading = useSetRecoilState(store.languageLoading);
+
+  useEffect(() => {
+    if (i18n.language === normalizeLocale(lang)) {
+      setLanguageLoading(false);
+      return;
+    }
+
+    let isCurrentRequest = true;
+    setLanguageLoading(true);
+
+    changeLanguageSafely(lang)
+      .catch((error) => {
+        console.error('[i18n] Failed to change language', error);
+      })
+      .finally(() => {
+        if (isCurrentRequest) {
+          setLanguageLoading(false);
+        }
+      });
+
+    return () => {
+      isCurrentRequest = false;
+    };
+  }, [lang, setLanguageLoading]);
+
+  return null;
+}
diff --git a/client/src/components/UnifiedSidebar/ConversationsSection.tsx b/client/src/components/UnifiedSidebar/ConversationsSection.tsx
index 3d8183c4e23..74d4ed893c2 100644
--- a/client/src/components/UnifiedSidebar/ConversationsSection.tsx
+++ b/client/src/components/UnifiedSidebar/ConversationsSection.tsx
@@ -14,6 +14,8 @@ import {
 } from '~/hooks';
 import { useConversationsInfiniteQuery, useTitleGeneration } from '~/data-provider';
 import { Conversations } from '~/components/Conversations';
+import ProjectsSection from '~/components/Conversations/ProjectsSection';
+import FavoritesList from '~/components/Nav/Favorites/FavoritesList';
 import SearchBar from '~/components/Nav/SearchBar';
 import store from '~/store';
 
@@ -104,7 +106,7 @@ const ConversationsSection = memo(() => {
 
   return (
     <div
-      className="flex h-full min-h-0 flex-col overflow-hidden pb-3"
+      className="flex h-full min-h-0 flex-col overflow-hidden pb-3 pt-2"
       role="region"
       aria-label={localize('com_ui_chat_history')}
     >
@@ -116,6 +118,12 @@ const ConversationsSection = memo(() => {
         )}
         {search.enabled && <SearchBar isSmallScreen={isSmallScreen} />}
       </div>
+      {!search.query && (
+        <div className="px-3">
+          <FavoritesList isSmallScreen={isSmallScreen} toggleNav={toggleNav} />
+        </div>
+      )}
+      {!search.query && <ProjectsSection toggleNav={toggleNav} isAuthenticated={isAuthenticated} />}
       <div className="flex min-h-0 flex-grow flex-col overflow-hidden">
         <Conversations
           conversations={conversations}
@@ -127,6 +135,7 @@ const ConversationsSection = memo(() => {
           isSearchLoading={isSearchLoading}
           isChatsExpanded={isChatsExpanded}
           setIsChatsExpanded={setIsChatsExpanded}
+          showFavorites={false}
         />
       </div>
     </div>
diff --git a/client/src/components/UnifiedSidebar/ExpandedPanel.tsx b/client/src/components/UnifiedSidebar/ExpandedPanel.tsx
index a02355bb78a..b63e81a1887 100644
--- a/client/src/components/UnifiedSidebar/ExpandedPanel.tsx
+++ b/client/src/components/UnifiedSidebar/ExpandedPanel.tsx
@@ -1,12 +1,13 @@
 import { memo, useCallback, lazy, Suspense } from 'react';
-import { useQueryClient } from '@tanstack/react-query';
 import { useRecoilValue } from 'recoil';
 import { SquarePen } from 'lucide-react';
 import { QueryKeys } from 'librechat-data-provider';
+import { useQueryClient } from '@tanstack/react-query';
 import { Skeleton, Sidebar, Button, TooltipAnchor } from '@librechat/client';
 import type { NavLink } from '~/common';
-import { CLOSE_SIDEBAR_ID } from '~/components/Chat/Menus/OpenSidebar';
+import { useShortcutAriaKey, useShortcutHint } from '~/hooks/useKeyboardShortcuts';
 import { useActivePanel, resolveActivePanel, DEFAULT_PANEL } from '~/Providers';
+import { CLOSE_SIDEBAR_ID } from '~/components/Chat/Menus/OpenSidebar';
 import { useLocalize, useNewConvo } from '~/hooks';
 import { clearMessagesCache, cn } from '~/utils';
 import store from '~/store';
@@ -24,6 +25,8 @@ const NewChatButton = memo(function NewChatButton({
   const { newConversation } = useNewConvo();
   const conversation = useRecoilValue(store.conversationByIndex(0));
   const switchToHistory = useRecoilValue(store.newChatSwitchToHistory);
+  const tooltipDescription = useShortcutHint('newChat', localize('com_ui_new_chat'));
+  const ariaKey = useShortcutAriaKey('newChat');
 
   const handleClick = useCallback(
     (e: React.MouseEvent<HTMLAnchorElement>) => {
@@ -43,12 +46,13 @@ const NewChatButton = memo(function NewChatButton({
   return (
     <TooltipAnchor
       side="right"
-      description={localize('com_ui_new_chat')}
+      description={tooltipDescription}
       render={
         <a
           href="/c/new"
           data-testid="new-chat-button"
           aria-label={localize('com_ui_new_chat')}
+          aria-keyshortcuts={ariaKey}
           className="flex h-9 w-9 items-center justify-center rounded-lg transition-colors hover:bg-surface-hover"
           onClick={handleClick}
         >
@@ -106,6 +110,7 @@ const NavIconButton = memo(function NavIconButton({
           variant="ghost"
           aria-label={localize(link.title)}
           aria-pressed={isActive}
+          data-testid={`nav-panel-${link.id}`}
           className={cn(
             'h-9 w-9 rounded-lg',
             isActive ? 'bg-surface-active-alt text-text-primary' : 'text-text-secondary',
@@ -136,12 +141,14 @@ function ExpandedPanel({
 
   const toggleLabel = expanded ? 'com_nav_close_sidebar' : 'com_nav_open_sidebar';
   const toggleClick = expanded ? onCollapse : onExpand;
+  const toggleSidebarHint = useShortcutHint('toggleSidebar', localize(toggleLabel));
+  const toggleSidebarAriaKey = useShortcutAriaKey('toggleSidebar');
 
   return (
     <div className="flex h-full flex-shrink-0 flex-col gap-2 border-r border-border-light bg-surface-primary-alt px-2 py-2">
       <TooltipAnchor
         side="right"
-        description={localize(toggleLabel)}
+        description={toggleSidebarHint}
         render={
           <Button
             id={expanded ? CLOSE_SIDEBAR_ID : undefined}
@@ -150,6 +157,7 @@ function ExpandedPanel({
             variant="ghost"
             aria-label={localize(toggleLabel)}
             aria-expanded={expanded}
+            aria-keyshortcuts={toggleSidebarAriaKey}
             className="h-9 w-9 rounded-lg"
             onClick={toggleClick}
           >
diff --git a/client/src/components/UnifiedSidebar/__tests__/ExpandedPanel.spec.tsx b/client/src/components/UnifiedSidebar/__tests__/ExpandedPanel.spec.tsx
index a79ce80c817..73f17d35084 100644
--- a/client/src/components/UnifiedSidebar/__tests__/ExpandedPanel.spec.tsx
+++ b/client/src/components/UnifiedSidebar/__tests__/ExpandedPanel.spec.tsx
@@ -17,12 +17,17 @@ jest.mock('~/store', () => {
     key: 'mock-newChatSwitchToHistory',
     default: true,
   });
+  const customShortcutsAtom = atom({
+    key: 'mock-customShortcuts',
+    default: {},
+  });
   return {
     __esModule: true,
     default: {
       conversationByIndex: () =>
         atom({ key: `mock-conversationByIndex-${counter++}`, default: null }),
       newChatSwitchToHistory: switchAtom,
+      customShortcuts: customShortcutsAtom,
     },
   };
 });
diff --git a/client/src/components/Web/Citation.tsx b/client/src/components/Web/Citation.tsx
index 90a620bf7ea..d6661e62161 100644
--- a/client/src/components/Web/Citation.tsx
+++ b/client/src/components/Web/Citation.tsx
@@ -1,6 +1,7 @@
 import { memo, useState, useContext, useCallback } from 'react';
 import { Button } from '@librechat/client';
 import { ChevronLeft, ChevronRight, FileText } from 'lucide-react';
+import type { SourceData } from '~/components/Web/SourceHovercard';
 import type { CitationProps } from './types';
 import { SourceHovercard, FaviconImage, getCleanDomain } from '~/components/Web/SourceHovercard';
 import FilePreviewDialog from '~/components/Chat/Messages/Content/FilePreviewDialog';
@@ -40,6 +41,15 @@ function getFileCitationData(source?: FileCitationSource) {
   };
 }
 
+function toSourceData(source: FileCitationSource): SourceData {
+  return {
+    link: source.link ?? '',
+    title: source.title,
+    attribution: source.attribution,
+    snippet: source.snippet,
+  };
+}
+
 interface CompositeCitationProps {
   citationId?: string;
   node?: {
@@ -107,7 +117,7 @@ export function CompositeCitation(props: CompositeCitationProps) {
   return (
     <>
       <SourceHovercard
-        source={currentSource}
+        source={toSourceData(currentSource)}
         label={getCitationLabel()}
         onMouseEnter={() => setHoveredCitationId(citationId || null)}
         onMouseLeave={() => setHoveredCitationId(null)}
@@ -329,7 +339,7 @@ export function Citation(props: CitationComponentProps) {
   return (
     <>
       <SourceHovercard
-        source={refData}
+        source={toSourceData(refData)}
         label={getCitationLabel()}
         onMouseEnter={() => setHoveredCitationId(citationId || null)}
         onMouseLeave={() => setHoveredCitationId(null)}
diff --git a/client/src/components/Web/Sources.tsx b/client/src/components/Web/Sources.tsx
index 81467e4b2f1..a2681f822fe 100644
--- a/client/src/components/Web/Sources.tsx
+++ b/client/src/components/Web/Sources.tsx
@@ -18,8 +18,8 @@ import { FaviconImage, getCleanDomain } from '~/components/Web/SourceHovercard';
 import SourcesErrorBoundary from './SourcesErrorBoundary';
 import { useFileDownload } from '~/data-provider';
 import { useSearchContext } from '~/Providers';
-import { useLocalize } from '~/hooks';
 import { cn, triggerDownload } from '~/utils';
+import { useLocalize } from '~/hooks';
 import store from '~/store';
 
 interface SourceItemProps {
@@ -89,7 +89,6 @@ function SourceItem({ source, expanded = false }: SourceItemProps) {
           </Ariakit.HovercardDisclosure>
 
           <Ariakit.Hovercard
-            animated
             gutter={16}
             className={cn(
               'z-[999] w-[320px] max-w-[calc(100vw-2rem)] rounded-xl border border-border-medium bg-surface-secondary p-3 text-text-primary shadow-lg',
@@ -172,6 +171,7 @@ type AgentFileSource = {
   filename: string;
   bytes?: number;
   type?: string;
+  source?: string;
   pages?: number[];
   relevance?: number;
   pageRelevance?: Record<number, number>;
diff --git a/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx b/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx
new file mode 100644
index 00000000000..c952dcee063
--- /dev/null
+++ b/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx
@@ -0,0 +1,29 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import QueryDevtoolsGate, { shouldEnableQueryDevtools } from '../QueryDevtoolsGate';
+
+jest.mock('@tanstack/react-query-devtools/production', () => ({
+  ReactQueryDevtools: () => <div data-testid="query-devtools" />,
+}));
+
+describe('QueryDevtoolsGate', () => {
+  it('keeps query devtools disabled in production by default', () => {
+    expect(shouldEnableQueryDevtools({ isDevelopment: false, config: undefined })).toBe(false);
+
+    const { container } = render(<QueryDevtoolsGate isDevelopment={false} config={undefined} />);
+
+    expect(container).toBeEmptyDOMElement();
+    expect(screen.queryByTestId('query-devtools')).not.toBeInTheDocument();
+  });
+
+  it('enables query devtools in local development', async () => {
+    render(<QueryDevtoolsGate isDevelopment={true} config={undefined} />);
+
+    await waitFor(() => expect(screen.getByTestId('query-devtools')).toBeInTheDocument());
+  });
+
+  it('enables query devtools in production when the server-injected flag is true', async () => {
+    render(<QueryDevtoolsGate isDevelopment={false} config={{ enableQueryDevtools: true }} />);
+
+    await waitFor(() => expect(screen.getByTestId('query-devtools')).toBeInTheDocument());
+  });
+});
diff --git a/client/src/components/index.ts b/client/src/components/index.ts
index 63103fb13d8..5ecdd1f3443 100644
--- a/client/src/components/index.ts
+++ b/client/src/components/index.ts
@@ -1,2 +1 @@
 export * from './ui';
-export * from './Plugins';
diff --git a/client/src/components/ui/index.ts b/client/src/components/ui/index.ts
index d772738bcf3..1412cf4aff3 100644
--- a/client/src/components/ui/index.ts
+++ b/client/src/components/ui/index.ts
@@ -1,3 +1,4 @@
+export { Button } from '@librechat/client';
 export { default as TermsAndConditionsModal } from './TermsAndConditionsModal';
 export { default as AdminSettingsDialog } from './AdminSettingsDialog';
 export type { PermissionConfig, AdminSettingsDialogProps } from './AdminSettingsDialog';
diff --git a/client/src/data-provider/Agents/queries.ts b/client/src/data-provider/Agents/queries.ts
index 7387a3e1ff7..3040de4d9da 100644
--- a/client/src/data-provider/Agents/queries.ts
+++ b/client/src/data-provider/Agents/queries.ts
@@ -15,6 +15,31 @@ export const defaultAgentParams: t.AgentListParams = {
   limit: 10,
   requiredPermission: PermissionBits.EDIT,
 };
+
+/** Walk the cursor pagination and return all pages flattened into one `AgentListResponse`. */
+async function fetchAllAgentPages(params: t.AgentListParams): Promise<t.AgentListResponse> {
+  const pages: t.AgentListResponse[] = [];
+  let cursor: string | null | undefined = params.cursor;
+  do {
+    const page = await dataService.listAgents({
+      ...params,
+      ...(cursor ? { cursor } : {}),
+    });
+    pages.push(page);
+    cursor = page.after;
+  } while (cursor);
+
+  const lastPage = pages[pages.length - 1];
+  return {
+    object: 'list',
+    data: pages.flatMap((p) => p.data),
+    has_more: false,
+    after: undefined,
+    first_id: pages[0]?.first_id ?? '',
+    last_id: lastPage?.last_id ?? '',
+  };
+}
+
 /**
  * Hook for getting all available tools for A
  */
@@ -32,7 +57,9 @@ export const useAvailableAgentToolsQuery = (): QueryObserverResult<t.TPlugin[]>
 };
 
 /**
- * Hook for listing all Agents, with optional parameters provided for pagination and sorting
+ * Hook for listing all Agents the user has access to. Follows cursor
+ * pagination internally and resolves with every page concatenated.
+ * Cache key shape matches `allAgentViewAndEditQueryKeys` in `./mutations.ts`.
  */
 export const useListAgentsQuery = <TData = t.AgentListResponse>(
   params: t.AgentListParams = defaultAgentParams,
@@ -44,12 +71,8 @@ export const useListAgentsQuery = <TData = t.AgentListResponse>(
   const enabled = !!endpointsConfig?.[EModelEndpoint.agents];
   return useQuery<t.AgentListResponse, unknown, TData>(
     [QueryKeys.agents, params],
-    () => dataService.listAgents(params),
+    () => fetchAllAgentPages(params),
     {
-      // Example selector to sort them by created_at
-      // select: (res) => {
-      //   return res.data.sort((a, b) => a.created_at - b.created_at);
-      // },
       staleTime: 1000 * 5,
       refetchOnWindowFocus: false,
       refetchOnReconnect: false,
@@ -81,8 +104,8 @@ export const useGetAgentByIdQuery = (
       refetchOnReconnect: false,
       refetchOnMount: false,
       retry: false,
-      enabled: isValidAgentId && (config?.enabled ?? true),
       ...config,
+      enabled: isValidAgentId && (config?.enabled ?? true),
     },
   );
 };
diff --git a/client/src/data-provider/Auth/queries.ts b/client/src/data-provider/Auth/queries.ts
index ff34d05d0c8..f830e956008 100644
--- a/client/src/data-provider/Auth/queries.ts
+++ b/client/src/data-provider/Auth/queries.ts
@@ -1,6 +1,6 @@
 import { useRecoilValue } from 'recoil';
-import { QueryKeys, dataService } from 'librechat-data-provider';
 import { useQuery } from '@tanstack/react-query';
+import { QueryKeys, dataService } from 'librechat-data-provider';
 import type { QueryObserverResult, UseQueryOptions } from '@tanstack/react-query';
 import type t from 'librechat-data-provider';
 import store from '~/store';
@@ -32,7 +32,7 @@ export const useGraphTokenQuery = (
 
   return useQuery({
     queryKey: [QueryKeys.graphToken, scopes],
-    queryFn: () => dataService.getGraphApiToken({ scopes }),
+    queryFn: () => dataService.getGraphApiToken({ scopes: scopes ?? '' }),
     enabled,
     staleTime: 50 * 60 * 1000, // 50 minutes (tokens expire in 60 minutes)
     retry: 1,
diff --git a/client/src/data-provider/Endpoints/queries.ts b/client/src/data-provider/Endpoints/queries.ts
index 3ce3d351101..389a9c44cf9 100644
--- a/client/src/data-provider/Endpoints/queries.ts
+++ b/client/src/data-provider/Endpoints/queries.ts
@@ -1,6 +1,6 @@
 import { useRecoilValue } from 'recoil';
-import { QueryKeys, dataService } from 'librechat-data-provider';
 import { useQuery } from '@tanstack/react-query';
+import { QueryKeys, dataService } from 'librechat-data-provider';
 import type { QueryObserverResult, UseQueryOptions } from '@tanstack/react-query';
 import type t from 'librechat-data-provider';
 import store from '~/store';
@@ -23,22 +23,83 @@ export const useGetEndpointsQuery = <TData = t.TEndpointsConfig>(
   );
 };
 
+export const useTokenConfigQuery = (
+  config?: UseQueryOptions<t.TTokenConfigMap>,
+): QueryObserverResult<t.TTokenConfigMap> => {
+  const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
+  return useQuery<t.TTokenConfigMap>([QueryKeys.tokenConfig], () => dataService.getTokenConfig(), {
+    staleTime: Infinity,
+    refetchOnWindowFocus: false,
+    refetchOnReconnect: false,
+    /** Refetch on mount only when stale — with `staleTime: Infinity` that's
+     *  exclusively after a user-key change invalidates `tokenConfig`, so a
+     *  settings change made while the gauge is unmounted is picked up on
+     *  return instead of serving the prior key's resolved config */
+    refetchOnMount: true,
+    ...config,
+    enabled: (config?.enabled ?? true) === true && queriesEnabled,
+  });
+};
+
+/**
+ * Server-side context-usage projection for the viewed branch + resolved config
+ * (agents SDK, no model call). Keyed on the fields that change what the next
+ * call would send — branch tail, endpoint/model/agent, window — so a branch or
+ * model/window switch refetches. Disabled until a branch tail is known.
+ */
+export const useContextProjectionQuery = (
+  params: t.TContextProjectionRequest | null,
+  config?: UseQueryOptions<t.TContextUsageEvent | null>,
+): QueryObserverResult<t.TContextUsageEvent | null> => {
+  const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
+  return useQuery<t.TContextUsageEvent | null>(
+    [
+      QueryKeys.contextProjection,
+      params?.conversationId,
+      params?.messageId,
+      params?.endpoint,
+      params?.model,
+      params?.agentId,
+      params?.maxContextTokens,
+      params?.revision,
+    ],
+    () => dataService.getContextProjection(params as t.TContextProjectionRequest),
+    {
+      staleTime: Infinity,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+      refetchOnMount: false,
+      ...config,
+      enabled:
+        (config?.enabled ?? true) === true &&
+        queriesEnabled &&
+        params != null &&
+        (params.conversationId?.length ?? 0) > 0 &&
+        (params.messageId?.length ?? 0) > 0,
+    },
+  );
+};
+
 /**
  * Auth-aware query key so unauthenticated (login page) and authenticated
  * (chat page) configs are cached independently, preventing stale
  * unauthenticated config from persisting after login.
  */
-export const startupConfigKey = (isAuthenticated: boolean) =>
-  [QueryKeys.startupConfig, isAuthenticated] as const;
+export const startupConfigKey = (isAuthenticated: boolean, context?: t.StartupConfigContext) =>
+  [QueryKeys.startupConfig, isAuthenticated, context ?? 'default'] as const;
+
+export const sharedStartupConfigKey = (shareId?: string) =>
+  [QueryKeys.sharedStartupConfig, shareId ?? ''] as const;
 
 export const useGetStartupConfig = (
   config?: UseQueryOptions<t.TStartupConfig>,
+  options?: { context?: t.StartupConfigContext },
 ): QueryObserverResult<t.TStartupConfig> => {
   const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
   const user = useRecoilValue<t.TUser | undefined>(store.user);
   return useQuery<t.TStartupConfig>(
-    startupConfigKey(!!user),
-    () => dataService.getStartupConfig(),
+    startupConfigKey(!!user, options?.context),
+    () => dataService.getStartupConfig({ context: options?.context }),
     {
       staleTime: Infinity,
       refetchOnWindowFocus: false,
@@ -49,3 +110,26 @@ export const useGetStartupConfig = (
     },
   );
 };
+
+export const useGetSharedStartupConfig = (
+  shareId?: string,
+  config?: UseQueryOptions<t.TSharedLinkStartupConfig>,
+): QueryObserverResult<t.TSharedLinkStartupConfig> => {
+  const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
+  return useQuery<t.TSharedLinkStartupConfig>(
+    sharedStartupConfigKey(shareId),
+    () => dataService.getSharedStartupConfig(shareId ?? ''),
+    {
+      staleTime: Infinity,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+      refetchOnMount: false,
+      ...config,
+      enabled:
+        (config?.enabled ?? true) === true &&
+        queriesEnabled &&
+        typeof shareId === 'string' &&
+        shareId.length > 0,
+    },
+  );
+};
diff --git a/client/src/data-provider/Files/queries.ts b/client/src/data-provider/Files/queries.ts
index b287a1efba7..81f161d6280 100644
--- a/client/src/data-provider/Files/queries.ts
+++ b/client/src/data-provider/Files/queries.ts
@@ -38,10 +38,10 @@ export const useGetAgentFiles = <TData = t.TFile[]>(
   );
 };
 
-export const useGetFileConfig = <TData = t.FileConfig>(
-  config?: UseQueryOptions<t.FileConfig, unknown, TData>,
+export const useGetFileConfig = <TData = t.TFileConfig>(
+  config?: UseQueryOptions<t.TFileConfig, unknown, TData>,
 ): QueryObserverResult<TData, unknown> => {
-  return useQuery<t.FileConfig, unknown, TData>(
+  return useQuery<t.TFileConfig, unknown, TData>(
     [QueryKeys.fileConfig],
     () => dataService.getFileConfig(),
     {
@@ -118,6 +118,31 @@ export const useFileDownload = (
   );
 };
 
+/**
+ * Blob download for a snapshotted file served through a shared link. Authorized
+ * by shared-link view permission (public/ACL) rather than the owner's file ACL.
+ * Idle by default; call `refetch` to download.
+ */
+export const useSharedFileDownload = (
+  shareId?: string,
+  file_id?: string,
+): QueryObserverResult<string> => {
+  return useQuery(
+    [QueryKeys.fileDownload, 'share', shareId ?? '', file_id ?? ''],
+    async () => {
+      if (!shareId || !file_id) {
+        return;
+      }
+      const response = await dataService.getSharedFileDownload(shareId, file_id);
+      return window.URL.createObjectURL(response.data);
+    },
+    {
+      enabled: false,
+      retry: false,
+    },
+  );
+};
+
 export const useCodeOutputDownload = (url = ''): QueryObserverResult<string> => {
   return useQuery(
     [QueryKeys.fileDownload, url],
@@ -157,6 +182,21 @@ export const fetchFilePreview = async (fileId: string): Promise<t.TFilePreview>
   }
 };
 
+/** Preview fetch for a snapshotted file served through a shared link. */
+export const fetchSharedFilePreview = async (
+  shareId: string,
+  fileId: string,
+): Promise<t.TFilePreview> => {
+  try {
+    const data = await dataService.getSharedFilePreview(shareId, fileId);
+    consecutivePreviewErrors.delete(fileId);
+    return data;
+  } catch (err) {
+    consecutivePreviewErrors.set(fileId, (consecutivePreviewErrors.get(fileId) ?? 0) + 1);
+    throw err;
+  }
+};
+
 export const previewRefetchInterval = (
   data: t.TFilePreview | undefined,
   query: { queryKey: readonly unknown[] },
@@ -194,10 +234,12 @@ export const _resetPreviewErrorCounter = (fileId?: string): void => {
 export const useFilePreview = (
   file_id: string | undefined,
   config?: UseQueryOptions<t.TFilePreview, unknown, t.TFilePreview>,
+  shareId?: string,
 ): QueryObserverResult<t.TFilePreview, unknown> => {
   return useQuery<t.TFilePreview, unknown, t.TFilePreview>(
-    [QueryKeys.filePreview, file_id],
-    () => fetchFilePreview(file_id ?? ''),
+    shareId ? [QueryKeys.filePreview, file_id, shareId] : [QueryKeys.filePreview, file_id],
+    () =>
+      shareId ? fetchSharedFilePreview(shareId, file_id ?? '') : fetchFilePreview(file_id ?? ''),
     {
       refetchOnWindowFocus: false,
       refetchOnReconnect: false,
diff --git a/client/src/data-provider/MCP/mutations.ts b/client/src/data-provider/MCP/mutations.ts
index 19fa2c36530..5640d30595a 100644
--- a/client/src/data-provider/MCP/mutations.ts
+++ b/client/src/data-provider/MCP/mutations.ts
@@ -1,5 +1,5 @@
-import { useMutation, useQueryClient, UseMutationResult } from '@tanstack/react-query';
 import { dataService, QueryKeys, ResourceType } from 'librechat-data-provider';
+import { useMutation, useQueryClient, UseMutationResult } from '@tanstack/react-query';
 import type * as t from 'librechat-data-provider';
 
 /**
@@ -84,9 +84,12 @@ export const useUpdateMCPServerMutation = (options?: {
         // Update list cache
         const listRes = queryClient.getQueryData<t.MCPServersListResponse>([QueryKeys.mcpServers]);
         if (listRes) {
-          // eslint-disable-next-line @typescript-eslint/no-unused-vars
-          const { type, ...oldServer } = listRes[variables.serverName!];
-          listRes[variables.serverName!] = { ...oldServer, ...updatedServer };
+          const oldServer = listRes[variables.serverName];
+          listRes[variables.serverName] = {
+            ...updatedServer,
+            dbId: updatedServer.dbId ?? oldServer?.dbId,
+            consumeOnly: updatedServer.consumeOnly ?? oldServer?.consumeOnly,
+          };
 
           queryClient.setQueryData<t.MCPServersListResponse>([QueryKeys.mcpServers], {
             ...listRes,
diff --git a/client/src/data-provider/Messages/__tests__/queries.test.ts b/client/src/data-provider/Messages/__tests__/queries.test.ts
new file mode 100644
index 00000000000..393151a76f9
--- /dev/null
+++ b/client/src/data-provider/Messages/__tests__/queries.test.ts
@@ -0,0 +1,401 @@
+import { createElement } from 'react';
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { QueryKeys, dataService } from 'librechat-data-provider';
+import type { ReactNode } from 'react';
+import type { TMessage } from 'librechat-data-provider';
+import { logger } from '~/utils';
+import {
+  getStableMessages,
+  shouldPreserveMessagesOnNotFound,
+  useGetMessagesByConvoId,
+} from '../queries';
+
+jest.mock('librechat-data-provider', () => {
+  const actual = jest.requireActual('librechat-data-provider');
+  return {
+    ...actual,
+    dataService: {
+      ...actual.dataService,
+      getMessagesByConvoId: jest.fn(),
+    },
+  };
+});
+
+jest.mock('~/utils', () => {
+  const actual = jest.requireActual('~/utils');
+  return {
+    ...actual,
+    logger: {
+      ...actual.logger,
+      warn: jest.fn(),
+    },
+  };
+});
+
+const message = (overrides: Partial<TMessage>): TMessage =>
+  ({
+    messageId: 'message-id',
+    conversationId: 'convo-id',
+    parentMessageId: '00000000-0000-0000-0000-000000000000',
+    text: '',
+    sender: 'User',
+    isCreatedByUser: true,
+    createdAt: '2026-05-21T12:00:00.000Z',
+    updatedAt: '2026-05-21T12:00:00.000Z',
+    ...overrides,
+  }) as TMessage;
+
+function createWrapper(queryClient: QueryClient, initialEntry: string) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return createElement(
+      QueryClientProvider,
+      { client: queryClient },
+      createElement(MemoryRouter, { initialEntries: [initialEntry] }, children),
+    );
+  };
+}
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('getStableMessages', () => {
+  it('keeps cache when an empty result races with unhydrated stream messages', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'user-2', createdAt: undefined, updatedAt: undefined }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: [],
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(currentMessages);
+  });
+
+  it('keeps cache when a prefix result races with a pending assistant tail', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'user-2', createdAt: undefined, updatedAt: undefined }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: [currentMessages[0]],
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(currentMessages);
+  });
+
+  it('accepts a shorter result when the app is not streaming', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+    const serverMessages = [currentMessages[0]];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: serverMessages,
+      currentMessages,
+      isStreaming: false,
+    });
+
+    expect(result).toBe(serverMessages);
+  });
+
+  it('accepts a shorter result when an unhydrated message is not the assistant tail', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'old-unhydrated', createdAt: undefined, updatedAt: undefined }),
+      message({ messageId: 'persisted-3' }),
+    ];
+    const serverMessages = [currentMessages[0]];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: serverMessages,
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(serverMessages);
+  });
+
+  it('accepts a shorter result when the server result is not a prefix of cache', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'persisted-2' }),
+      message({
+        messageId: 'persisted-2_',
+        parentMessageId: 'persisted-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+    const serverMessages = [message({ messageId: 'different-1' })];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: serverMessages,
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(serverMessages);
+  });
+
+  it('accepts a shorter result when an unhydrated assistant tail has no parent turn', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({
+        messageId: 'orphaned-response_',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+    const serverMessages = [currentMessages[0]];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: serverMessages,
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(serverMessages);
+  });
+
+  it('accepts fewer persisted messages when the cache is fully hydrated', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'persisted-2' }),
+      message({ messageId: 'persisted-3' }),
+    ];
+    const serverMessages = [currentMessages[0], currentMessages[1]];
+
+    const result = getStableMessages({
+      pathname: '/c/convo-id',
+      result: serverMessages,
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toBe(serverMessages);
+  });
+
+  it('does not preserve cache on the new conversation route', () => {
+    const currentMessages = [message({ messageId: 'user-1', createdAt: undefined })];
+
+    const result = getStableMessages({
+      pathname: '/c/new',
+      result: [],
+      currentMessages,
+      isStreaming: true,
+    });
+
+    expect(result).toEqual([]);
+  });
+});
+
+describe('shouldPreserveMessagesOnNotFound', () => {
+  it('keeps cache when a transient 404 races with a pending assistant tail', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'user-2' }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+
+    expect(
+      shouldPreserveMessagesOnNotFound({
+        pathname: '/c/convo-id',
+        currentMessages,
+        isStreaming: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('does not preserve cache when no stream or active job is live', () => {
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'user-2' }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+
+    expect(
+      shouldPreserveMessagesOnNotFound({
+        pathname: '/c/convo-id',
+        currentMessages,
+        isStreaming: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('does not preserve cache on the new conversation route', () => {
+    const currentMessages = [
+      message({ messageId: 'user-1' }),
+      message({
+        messageId: 'user-1_',
+        parentMessageId: 'user-1',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+
+    expect(
+      shouldPreserveMessagesOnNotFound({
+        pathname: '/c/new',
+        currentMessages,
+        isStreaming: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('does not preserve cache when there is no pending assistant tail', () => {
+    const currentMessages = [message({ messageId: 'persisted-1' })];
+
+    expect(
+      shouldPreserveMessagesOnNotFound({
+        pathname: '/c/convo-id',
+        currentMessages,
+        isStreaming: true,
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('useGetMessagesByConvoId', () => {
+  it('keeps cache during submitting cleanup when active job cache still marks the stream active', async () => {
+    const conversationId = 'convo-id';
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({ messageId: 'user-2', createdAt: undefined, updatedAt: undefined }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+    const serverMessages = [currentMessages[0]];
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false } },
+    });
+    queryClient.setQueryData([QueryKeys.messages, conversationId], currentMessages);
+    queryClient.setQueryData([QueryKeys.activeJobs], { activeJobIds: [conversationId] });
+
+    const mockGetMessagesByConvoId = dataService.getMessagesByConvoId as jest.MockedFunction<
+      typeof dataService.getMessagesByConvoId
+    >;
+    mockGetMessagesByConvoId.mockResolvedValue(serverMessages);
+
+    const { result, unmount } = renderHook(
+      () => useGetMessagesByConvoId(conversationId, undefined, { isStreaming: false }),
+      { wrapper: createWrapper(queryClient, `/c/${conversationId}`) },
+    );
+
+    await act(async () => {
+      await result.current.refetch();
+    });
+
+    await waitFor(() => {
+      expect(result.current.data).toBe(currentMessages);
+    });
+    expect(dataService.getMessagesByConvoId).toHaveBeenCalledWith(conversationId);
+    expect(queryClient.getQueryData([QueryKeys.messages, conversationId])).toBe(currentMessages);
+
+    unmount();
+  });
+
+  it('keeps cache when a transient 404 races with a regenerated pending assistant tail', async () => {
+    const conversationId = 'convo-id';
+    const currentMessages = [
+      message({ messageId: 'persisted-1' }),
+      message({
+        messageId: 'user-2',
+        parentMessageId: 'persisted-1',
+      }),
+      message({
+        messageId: 'user-2_',
+        parentMessageId: 'user-2',
+        isCreatedByUser: false,
+        createdAt: undefined,
+        updatedAt: undefined,
+      }),
+    ];
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false } },
+    });
+    queryClient.setQueryData([QueryKeys.messages, conversationId], currentMessages);
+
+    const mockGetMessagesByConvoId = dataService.getMessagesByConvoId as jest.MockedFunction<
+      typeof dataService.getMessagesByConvoId
+    >;
+    mockGetMessagesByConvoId.mockRejectedValueOnce({ status: 404 });
+
+    const { result, unmount } = renderHook(
+      () => useGetMessagesByConvoId(conversationId, { enabled: false }, { isStreaming: true }),
+      { wrapper: createWrapper(queryClient, `/c/${conversationId}`) },
+    );
+
+    await act(async () => {
+      await result.current.refetch();
+    });
+
+    await waitFor(() => {
+      expect(result.current.data).toBe(currentMessages);
+    });
+    expect(dataService.getMessagesByConvoId).toHaveBeenCalledWith(conversationId);
+    expect(queryClient.getQueryData([QueryKeys.messages, conversationId])).toBe(currentMessages);
+    expect(logger.warn).toHaveBeenCalledWith(
+      'messages',
+      expect.stringContaining('returned 404 while cache has a pending assistant tail'),
+      currentMessages,
+    );
+
+    unmount();
+  });
+});
diff --git a/client/src/data-provider/Messages/queries.ts b/client/src/data-provider/Messages/queries.ts
index bf0df06b4b3..462bc6c5f2f 100644
--- a/client/src/data-provider/Messages/queries.ts
+++ b/client/src/data-provider/Messages/queries.ts
@@ -1,36 +1,148 @@
+import { useLayoutEffect, useRef } from 'react';
 import { useLocation } from 'react-router-dom';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
-import type { UseQueryOptions, QueryObserverResult } from '@tanstack/react-query';
-import { QueryKeys, dataService } from 'librechat-data-provider';
+import type { UseQueryOptions, QueryObserverResult, QueryClient } from '@tanstack/react-query';
+import { Constants, QueryKeys, dataService } from 'librechat-data-provider';
 import type * as t from 'librechat-data-provider';
-import { logger } from '~/utils';
+import { isNotFoundError, logger } from '~/utils';
+
+type StableMessagesParams = {
+  pathname: string;
+  result: t.TMessage[];
+  isStreaming?: boolean;
+  currentMessages?: t.TMessage[];
+};
+
+type ActiveJobs = {
+  activeJobIds?: string[];
+};
+
+function isUnhydratedMessage(message: t.TMessage) {
+  const messageId = message.messageId ?? '';
+  return message.createdAt == null || message.updatedAt == null || messageId.endsWith('_');
+}
+
+function hasPendingAssistantTail(messages: t.TMessage[]) {
+  const lastMessage = messages[messages.length - 1];
+  const parentMessageId = lastMessage?.parentMessageId ?? '';
+  return (
+    lastMessage?.isCreatedByUser !== true &&
+    parentMessageId !== '' &&
+    parentMessageId !== Constants.NO_PARENT &&
+    isUnhydratedMessage(lastMessage)
+  );
+}
+
+function isMessagePrefix(result: t.TMessage[], currentMessages: t.TMessage[]) {
+  return result.every((message, index) => message.messageId === currentMessages[index]?.messageId);
+}
+
+export function getStableMessages({
+  pathname,
+  result,
+  isStreaming = false,
+  currentMessages,
+}: StableMessagesParams): t.TMessage[] {
+  if (pathname.includes('/c/new') || !currentMessages?.length) {
+    return result;
+  }
+
+  if (result.length >= currentMessages.length) {
+    return result;
+  }
+
+  if (
+    isStreaming &&
+    hasPendingAssistantTail(currentMessages) &&
+    isMessagePrefix(result, currentMessages)
+  ) {
+    return currentMessages;
+  }
+
+  return result;
+}
+
+export function shouldPreserveMessagesOnNotFound({
+  pathname,
+  isStreaming = false,
+  currentMessages,
+}: Pick<StableMessagesParams, 'pathname' | 'isStreaming' | 'currentMessages'>): boolean {
+  if (!isStreaming || pathname.includes('/c/new') || !currentMessages?.length) {
+    return false;
+  }
+
+  return hasPendingAssistantTail(currentMessages);
+}
+
+function hasActiveJob(queryClient: QueryClient, id: string) {
+  if (!id) {
+    return false;
+  }
+  const activeJobs = queryClient.getQueryData<ActiveJobs>([QueryKeys.activeJobs]);
+  return activeJobs?.activeJobIds?.includes(id) === true;
+}
 
 export const useGetMessagesByConvoId = <TData = t.TMessage[]>(
   id: string,
   config?: UseQueryOptions<t.TMessage[], unknown, TData>,
+  options?: { isStreaming?: boolean },
 ): QueryObserverResult<TData> => {
   const location = useLocation();
   const queryClient = useQueryClient();
+  const isStreaming = options?.isStreaming === true;
+  const isStreamingRef = useRef(isStreaming);
+
+  useLayoutEffect(() => {
+    isStreamingRef.current = isStreaming;
+  }, [isStreaming]);
+
   return useQuery<t.TMessage[], unknown, TData>(
     [QueryKeys.messages, id],
     async () => {
-      const result = await dataService.getMessagesByConvoId(id);
-      if (!location.pathname.includes('/c/new') && result?.length === 1) {
+      let result: t.TMessage[];
+      try {
+        result = await dataService.getMessagesByConvoId(id);
+      } catch (error) {
         const currentMessages = queryClient.getQueryData<t.TMessage[]>([QueryKeys.messages, id]);
-        if (currentMessages?.length === 1) {
-          return result;
-        }
-        if (currentMessages && currentMessages?.length > 1) {
+        const hasLiveStream = isStreamingRef.current || hasActiveJob(queryClient, id);
+        if (
+          currentMessages &&
+          isNotFoundError(error) &&
+          shouldPreserveMessagesOnNotFound({
+            pathname: location.pathname,
+            currentMessages,
+            isStreaming: hasLiveStream,
+          })
+        ) {
           logger.warn(
             'messages',
-            `Messages query for convo ${id} returned fewer than cache; path: "${location.pathname}"`,
-            result,
+            `Messages query for convo ${id} returned 404 while cache has a pending assistant tail; path: "${location.pathname}"`,
             currentMessages,
           );
           return currentMessages;
         }
+
+        throw error;
+      }
+
+      const currentMessages = queryClient.getQueryData<t.TMessage[]>([QueryKeys.messages, id]);
+      const stableMessages = getStableMessages({
+        pathname: location.pathname,
+        result,
+        currentMessages,
+        isStreaming: isStreamingRef.current || hasActiveJob(queryClient, id),
+      });
+
+      if (stableMessages === currentMessages) {
+        logger.warn(
+          'messages',
+          `Messages query for convo ${id} returned fewer than cache; path: "${location.pathname}"`,
+          result,
+          currentMessages,
+        );
       }
-      return result;
+
+      return stableMessages;
     },
     {
       refetchOnWindowFocus: false,
diff --git a/client/src/data-provider/Projects/index.ts b/client/src/data-provider/Projects/index.ts
new file mode 100644
index 00000000000..d0720956a0e
--- /dev/null
+++ b/client/src/data-provider/Projects/index.ts
@@ -0,0 +1,2 @@
+export * from './queries';
+export * from './mutations';
diff --git a/client/src/data-provider/Projects/mutations.ts b/client/src/data-provider/Projects/mutations.ts
new file mode 100644
index 00000000000..a02f177d975
--- /dev/null
+++ b/client/src/data-provider/Projects/mutations.ts
@@ -0,0 +1,123 @@
+import { useRecoilCallback } from 'recoil';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { dataService, QueryKeys } from 'librechat-data-provider';
+import type { UseMutationResult } from '@tanstack/react-query';
+import type {
+  TChatProject,
+  TConversation,
+  TCreateChatProjectRequest,
+  TDeleteChatProjectResponse,
+  TUpdateChatProjectRequest,
+  TAssignConversationToProjectRequest,
+  TAssignConversationToProjectResponse,
+} from 'librechat-data-provider';
+import store from '~/store';
+
+export const useCreateProjectMutation = (): UseMutationResult<
+  TChatProject,
+  unknown,
+  TCreateChatProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  return useMutation((payload: TCreateChatProjectRequest) => dataService.createProject(payload), {
+    onSuccess: () => {
+      queryClient.invalidateQueries([QueryKeys.projects]);
+    },
+  });
+};
+
+export const useUpdateProjectMutation = (): UseMutationResult<
+  TChatProject,
+  unknown,
+  TUpdateChatProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  return useMutation((payload: TUpdateChatProjectRequest) => dataService.updateProject(payload), {
+    onSuccess: (project) => {
+      queryClient.setQueryData([QueryKeys.project, project._id], project);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+    },
+  });
+};
+
+export const useDeleteProjectMutation = (): UseMutationResult<
+  TDeleteChatProjectResponse,
+  unknown,
+  string,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  const clearActiveConversationProject = useRecoilCallback(
+    ({ snapshot, set }) =>
+      async (projectId: string) => {
+        const conversation = await snapshot.getPromise(store.conversationByIndex(0));
+        if (conversation?.conversationId && conversation.chatProjectId === projectId) {
+          set(store.updateConversationSelector(conversation.conversationId), {
+            ...conversation,
+            chatProjectId: null,
+          });
+        }
+      },
+    [],
+  );
+  return useMutation((projectId: string) => dataService.deleteProject(projectId), {
+    onSuccess: (_result, projectId) => {
+      clearActiveConversationProject(projectId);
+      // Invalidate so an *active* project-detail observer refetches and settles into a
+      // not-found state — consumers (e.g. ChatRoute) can then react to the deletion.
+      // (Removing it instead leaves observers stuck loading under `refetchOnMount: false`.)
+      queryClient.invalidateQueries([QueryKeys.project, projectId]);
+      // Drop any *inactive* cached detail so a later visit to the deleted project
+      // refetches (→ not-found) rather than rendering stale cache within `cacheTime`.
+      queryClient.removeQueries([QueryKeys.project, projectId], { type: 'inactive' });
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      queryClient.invalidateQueries([QueryKeys.allConversations]);
+    },
+  });
+};
+
+export const useAssignConversationToProjectMutation = (): UseMutationResult<
+  TAssignConversationToProjectResponse,
+  unknown,
+  TAssignConversationToProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  const updateActiveConversation = useRecoilCallback(
+    ({ set }) =>
+      (conversation: TConversation) => {
+        if (!conversation.conversationId) {
+          return;
+        }
+        set(store.updateConversationSelector(conversation.conversationId), {
+          ...conversation,
+          chatProjectId: conversation.chatProjectId ?? null,
+        });
+      },
+    [],
+  );
+
+  return useMutation(
+    (payload: TAssignConversationToProjectRequest) =>
+      dataService.assignConversationToProject(payload),
+    {
+      onSuccess: (result) => {
+        updateActiveConversation(result.conversation);
+        queryClient.setQueryData(
+          [QueryKeys.conversation, result.conversation.conversationId],
+          result.conversation,
+        );
+        [result.previousProjectId, result.projectId].forEach((projectId) => {
+          if (projectId) {
+            queryClient.invalidateQueries([QueryKeys.project, projectId]);
+          }
+        });
+        queryClient.invalidateQueries([QueryKeys.projects]);
+        queryClient.invalidateQueries([QueryKeys.allConversations]);
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      },
+    },
+  );
+};
diff --git a/client/src/data-provider/Projects/queries.ts b/client/src/data-provider/Projects/queries.ts
new file mode 100644
index 00000000000..6a8a4ccefde
--- /dev/null
+++ b/client/src/data-provider/Projects/queries.ts
@@ -0,0 +1,49 @@
+import { useInfiniteQuery, useQuery } from '@tanstack/react-query';
+import { dataService, QueryKeys } from 'librechat-data-provider';
+import type {
+  UseInfiniteQueryOptions,
+  QueryObserverResult,
+  UseQueryOptions,
+} from '@tanstack/react-query';
+import type { ProjectListParams, ProjectListResponse, TChatProject } from 'librechat-data-provider';
+
+export const useProjectsInfiniteQuery = (
+  params: ProjectListParams = {},
+  config?: UseInfiniteQueryOptions<ProjectListResponse, unknown>,
+) => {
+  const { sortBy, sortDirection, search, limit } = params;
+
+  return useInfiniteQuery<ProjectListResponse>({
+    queryKey: [QueryKeys.projects, { sortBy, sortDirection, search, limit }],
+    queryFn: ({ pageParam }) =>
+      dataService.listProjects({
+        sortBy,
+        sortDirection,
+        search,
+        limit,
+        cursor: pageParam?.toString(),
+      }),
+    getNextPageParam: (lastPage) => lastPage?.nextCursor ?? undefined,
+    keepPreviousData: true,
+    staleTime: 5 * 60 * 1000,
+    cacheTime: 30 * 60 * 1000,
+    ...config,
+  });
+};
+
+export const useProjectQuery = (
+  projectId?: string | null,
+  config?: UseQueryOptions<TChatProject>,
+): QueryObserverResult<TChatProject, unknown> => {
+  return useQuery<TChatProject>(
+    [QueryKeys.project, projectId],
+    () => dataService.getProjectById(projectId ?? ''),
+    {
+      enabled: Boolean(projectId),
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+      refetchOnMount: false,
+      ...config,
+    },
+  );
+};
diff --git a/client/src/data-provider/SSE/__tests__/queries.test.ts b/client/src/data-provider/SSE/__tests__/queries.test.ts
new file mode 100644
index 00000000000..d1e4526512b
--- /dev/null
+++ b/client/src/data-provider/SSE/__tests__/queries.test.ts
@@ -0,0 +1,149 @@
+/**
+ * `~/utils` re-exports from `@librechat/client`, which pulls in framer-motion (an
+ * external peer not present in the jsdom test env). Provide a minimal mock with the
+ * two symbols `queries.ts` uses. `isNotFoundError` mirrors the real axios-only
+ * implementation in `~/utils/errors`.
+ */
+jest.mock('~/utils', () => {
+  const isNotFoundError = (error: unknown): boolean => {
+    if (error != null && typeof error === 'object') {
+      const response = (error as { response?: { status?: number } }).response;
+      return response?.status === 404;
+    }
+    return false;
+  };
+  return { isNotFoundError, updateConvoInAllQueries: jest.fn() };
+});
+
+jest.mock('librechat-data-provider', () => ({
+  apiBaseUrl: () => '',
+  QueryKeys: { conversation: 'conversation', activeJobs: 'activeJobs' },
+  request: { get: jest.fn() },
+  dataService: { genTitle: jest.fn(), getActiveJobs: jest.fn() },
+}));
+
+jest.mock('@tanstack/react-query', () => ({
+  useQuery: jest.fn(() => ({ data: undefined })),
+  useQueries: jest.fn(() => []),
+  useQueryClient: jest.fn(() => ({ setQueryData: jest.fn(), removeQueries: jest.fn() })),
+}));
+
+/** `queries.ts` imports `useGetStartupConfig` from `../Endpoints` (i.e.
+ *  `data-provider/Endpoints`); from this test file that resolves to `../../Endpoints`.
+ *  Mock it so the module under test does not pull in the full data-provider barrel. */
+jest.mock('../../Endpoints', () => ({
+  useGetStartupConfig: jest.fn(() => ({ data: undefined })),
+}));
+
+import { genTitleQueryKey, queueTitleGeneration } from '../queries';
+
+/** Build a minimal Axios-shaped error with a given HTTP status. */
+function makeAxiosError(status: number): Error {
+  const err = new Error(`HTTP ${status}`) as Error & {
+    isAxiosError: boolean;
+    response: { status: number };
+  };
+  err.isAxiosError = true;
+  err.response = { status };
+  return err;
+}
+
+describe('genTitleQueryKey', () => {
+  it('returns a two-element tuple with the conversationId', () => {
+    expect(genTitleQueryKey('abc-123')).toEqual(['genTitle', 'abc-123']);
+  });
+
+  it('returns different keys for different conversation IDs', () => {
+    expect(genTitleQueryKey('conv-1')).not.toEqual(genTitleQueryKey('conv-2'));
+  });
+});
+
+describe('queueTitleGeneration', () => {
+  it('runs without throwing for a new conversation ID', () => {
+    expect(() => queueTitleGeneration('new-conv-queue-1')).not.toThrow();
+  });
+
+  it('is safe to call multiple times for the same conversation ID', () => {
+    expect(() => {
+      queueTitleGeneration('new-conv-queue-2');
+      queueTitleGeneration('new-conv-queue-2');
+    }).not.toThrow();
+  });
+});
+
+/**
+ * The title-fetch retry policy in `useTitleGeneration`:
+ *
+ *   retry: (failureCount, error) => isNotFoundError(error) && failureCount < 3
+ *   retryDelay: () => 5_000
+ *
+ * The server `/gen_title` route waits up to ~15.5s before returning 404 while the
+ * title is still generating. Retrying ONLY on 404 (never on 401/403/5xx/network)
+ * means a transient "still generating" response is never treated as final (#13318),
+ * while genuine errors stay terminal.
+ *
+ * These tests pin the classification contract and the failure cap so any future
+ * change to either is caught.
+ */
+describe('title fetch retry policy — error classification', () => {
+  const isNotFoundError = (error: unknown): boolean => {
+    if (error != null && typeof error === 'object') {
+      const response = (error as { response?: { status?: number } }).response;
+      return response?.status === 404;
+    }
+    return false;
+  };
+
+  it('returns true for a 404 (server still generating the title)', () => {
+    expect(isNotFoundError(makeAxiosError(404))).toBe(true);
+  });
+
+  it('returns false for a 401 (auth failure — do not retry)', () => {
+    expect(isNotFoundError(makeAxiosError(401))).toBe(false);
+  });
+
+  it('returns false for a 500 (server failure — do not retry)', () => {
+    expect(isNotFoundError(makeAxiosError(500))).toBe(false);
+  });
+
+  it('returns false for a plain network Error', () => {
+    expect(isNotFoundError(new Error('Network Error'))).toBe(false);
+  });
+
+  it('returns false for null/undefined', () => {
+    expect(isNotFoundError(null)).toBe(false);
+    expect(isNotFoundError(undefined)).toBe(false);
+  });
+});
+
+describe('title fetch retry policy — failure cap', () => {
+  const isNotFoundError = (error: unknown): boolean => {
+    if (error != null && typeof error === 'object') {
+      const response = (error as { response?: { status?: number } }).response;
+      return response?.status === 404;
+    }
+    return false;
+  };
+
+  const retryPredicate = (failureCount: number, error: unknown): boolean =>
+    isNotFoundError(error) && failureCount < 3;
+
+  const notFound = makeAxiosError(404);
+
+  it('retries the first three 404 failures', () => {
+    expect(retryPredicate(0, notFound)).toBe(true);
+    expect(retryPredicate(1, notFound)).toBe(true);
+    expect(retryPredicate(2, notFound)).toBe(true);
+  });
+
+  it('stops after the third 404 failure', () => {
+    expect(retryPredicate(3, notFound)).toBe(false);
+  });
+
+  it('never retries a non-404 regardless of attempt count', () => {
+    const authErr = makeAxiosError(401);
+    for (let i = 0; i < 5; i++) {
+      expect(retryPredicate(i, authErr)).toBe(false);
+    }
+  });
+});
diff --git a/client/src/data-provider/SSE/__tests__/useTitleGeneration.test.ts b/client/src/data-provider/SSE/__tests__/useTitleGeneration.test.ts
new file mode 100644
index 00000000000..2408a37ac81
--- /dev/null
+++ b/client/src/data-provider/SSE/__tests__/useTitleGeneration.test.ts
@@ -0,0 +1,178 @@
+/**
+ * White-box integration test for `useTitleGeneration`'s effect logic.
+ *
+ * Complements the helper unit tests in `queries.test.ts` by driving the REAL
+ * hook (real React state/effects) with a controllable react-query surface, so
+ * the stateful decisions — immediate-vs-final eligibility, success application,
+ * defer-while-active, and the post-completion `resetQueries` remount — are
+ * deterministically locked down without timer/async flakiness.
+ *
+ * `~/utils` re-exports from `@librechat/client` (framer-motion peer, absent in
+ * jsdom); mocked to the two symbols the hook uses. react-query is mocked so we
+ * control `activeJobIds`, the per-conversation query results, and spy the
+ * QueryClient — the hook's own React effects still run for real.
+ */
+let mockActiveJobIds: string[] = [];
+let mockTiming: 'immediate' | 'final' = 'immediate';
+let mockQueriesResults: Array<{
+  isSuccess?: boolean;
+  isError?: boolean;
+  data?: { title: string };
+  error?: unknown;
+}> = [];
+let mockCapturedQueries: Array<{ queryKey: unknown[] }> = [];
+
+const mockSetQueryData = jest.fn();
+const mockRemoveQueries = jest.fn();
+const mockResetQueries = jest.fn();
+const mockUpdateConvoInAllQueries = jest.fn();
+
+jest.mock('@tanstack/react-query', () => ({
+  useQuery: jest.fn(() => ({ data: { activeJobIds: mockActiveJobIds } })),
+  useQueries: jest.fn(({ queries }: { queries: Array<{ queryKey: unknown[] }> }) => {
+    mockCapturedQueries = queries;
+    return mockQueriesResults;
+  }),
+  useQueryClient: jest.fn(() => ({
+    setQueryData: mockSetQueryData,
+    removeQueries: mockRemoveQueries,
+    resetQueries: mockResetQueries,
+  })),
+}));
+
+jest.mock('../../Endpoints', () => ({
+  useGetStartupConfig: () => ({ data: { titleGenerationTiming: mockTiming } }),
+}));
+
+jest.mock('~/utils', () => ({
+  isNotFoundError: (error: unknown): boolean => {
+    if (error != null && typeof error === 'object') {
+      return (error as { response?: { status?: number } }).response?.status === 404;
+    }
+    return false;
+  },
+  updateConvoInAllQueries: (...args: unknown[]) => mockUpdateConvoInAllQueries(...args),
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  apiBaseUrl: () => '',
+  QueryKeys: { conversation: 'conversation', activeJobs: 'activeJobs' },
+  request: { get: jest.fn() },
+  dataService: { genTitle: jest.fn(), getActiveJobs: jest.fn() },
+}));
+
+import { renderHook, act } from '@testing-library/react';
+import {
+  useTitleGeneration,
+  genTitleQueryKey,
+  queueTitleGeneration,
+  markTitleGenerationProcessed,
+} from '../queries';
+
+const notFound = { response: { status: 404 } };
+
+/** queryKeys passed to the latest `useQueries` call (i.e. the ready-to-fetch set). */
+const eligibleKeys = () => mockCapturedQueries.map((q) => JSON.stringify(q.queryKey));
+const isEligible = (id: string) => eligibleKeys().includes(JSON.stringify(genTitleQueryKey(id)));
+
+beforeEach(() => {
+  mockActiveJobIds = [];
+  mockTiming = 'immediate';
+  mockQueriesResults = [];
+  mockCapturedQueries = [];
+  jest.clearAllMocks();
+});
+
+describe('useTitleGeneration — eligibility', () => {
+  it('immediate mode: fetches a queued conversation while its stream is still active', () => {
+    mockTiming = 'immediate';
+    mockActiveJobIds = ['conv-imm'];
+
+    renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-imm'));
+
+    expect(isEligible('conv-imm')).toBe(true);
+  });
+
+  it('final mode: gates a queued conversation until its stream completes', () => {
+    mockTiming = 'final';
+    mockActiveJobIds = ['conv-fin'];
+
+    const { rerender } = renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-fin'));
+    expect(isEligible('conv-fin')).toBe(false);
+
+    // Stream completes — the conversation leaves the active set.
+    mockActiveJobIds = [];
+    rerender();
+    expect(isEligible('conv-fin')).toBe(true);
+  });
+
+  it('stops polling when a title is completed by an SSE event', () => {
+    mockTiming = 'immediate';
+    mockActiveJobIds = ['conv-sse-title'];
+
+    const { rerender } = renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-sse-title'));
+    expect(isEligible('conv-sse-title')).toBe(true);
+
+    act(() => markTitleGenerationProcessed('conv-sse-title'));
+    rerender();
+
+    expect(isEligible('conv-sse-title')).toBe(false);
+  });
+});
+
+describe('useTitleGeneration — result handling', () => {
+  it('applies the fetched title to the conversation caches on success', () => {
+    mockTiming = 'immediate';
+    mockActiveJobIds = ['conv-ok'];
+
+    const { rerender } = renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-ok'));
+
+    mockQueriesResults = [{ isSuccess: true, isError: false, data: { title: 'Quantum Chat' } }];
+    rerender();
+
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      ['conversation', 'conv-ok'],
+      expect.any(Function),
+    );
+    expect(mockUpdateConvoInAllQueries).toHaveBeenCalled();
+
+    const call = mockSetQueryData.mock.calls.find(
+      ([key]) => JSON.stringify(key) === JSON.stringify(['conversation', 'conv-ok']),
+    );
+    const updater = call?.[1] as (c?: { title?: string }) => { title?: string };
+    expect(updater({ title: 'New Chat' })).toEqual(
+      expect.objectContaining({ title: 'Quantum Chat' }),
+    );
+  });
+
+  it('a 404 while the stream is active defers (removeQueries), not giving up', () => {
+    mockTiming = 'immediate';
+    mockActiveJobIds = ['conv-active404'];
+
+    const { rerender } = renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-active404'));
+
+    mockQueriesResults = [{ isError: true, isSuccess: false, error: notFound }];
+    rerender();
+
+    expect(mockRemoveQueries).toHaveBeenCalledWith(genTitleQueryKey('conv-active404'));
+    expect(mockResetQueries).not.toHaveBeenCalled();
+  });
+
+  it('a 404 after the stream completes forces a fresh fetch via resetQueries', () => {
+    mockTiming = 'immediate';
+    mockActiveJobIds = []; // stream already complete
+
+    const { rerender } = renderHook(() => useTitleGeneration(true));
+    act(() => queueTitleGeneration('conv-done404'));
+
+    mockQueriesResults = [{ isError: true, isSuccess: false, error: notFound }];
+    rerender();
+
+    expect(mockResetQueries).toHaveBeenCalledWith(genTitleQueryKey('conv-done404'));
+  });
+});
diff --git a/client/src/data-provider/SSE/queries.ts b/client/src/data-provider/SSE/queries.ts
index 76c500c5303..8cd116394be 100644
--- a/client/src/data-provider/SSE/queries.ts
+++ b/client/src/data-provider/SSE/queries.ts
@@ -2,7 +2,8 @@ import { useEffect, useMemo, useState } from 'react';
 import { apiBaseUrl, QueryKeys, request, dataService } from 'librechat-data-provider';
 import { useQuery, useQueries, useQueryClient } from '@tanstack/react-query';
 import type { Agents, TConversation } from 'librechat-data-provider';
-import { updateConvoInAllQueries } from '~/utils';
+import { isNotFoundError, updateConvoInAllQueries } from '~/utils';
+import { useGetStartupConfig } from '../Endpoints';
 
 export interface StreamStatusResponse {
   active: boolean;
@@ -45,6 +46,12 @@ export interface ActiveJobsResponse {
 const titleQueue = new Set<string>();
 const processedTitles = new Set<string>();
 
+/** Conversations whose eager (immediate-mode) title fetch 404'd while the stream
+ * was still active. They wait for stream completion before fetching again instead
+ * of busy-looping — covers a per-endpoint `final` override under a global
+ * `immediate` default. */
+const deferredTitles = new Set<string>();
+
 /** Listeners to notify when queue changes (for non-resumable streams like assistants) */
 const queueListeners = new Set<() => void>();
 
@@ -56,13 +63,31 @@ export function queueTitleGeneration(conversationId: string) {
   }
 }
 
+export function markTitleGenerationProcessed(conversationId: string) {
+  processedTitles.add(conversationId);
+  titleQueue.delete(conversationId);
+  deferredTitles.delete(conversationId);
+  queueListeners.forEach((listener) => listener());
+}
+
 /**
  * Hook to process the title generation queue.
- * Only fetches titles AFTER the job completes (not in activeJobIds).
+ *
+ * Timing is driven by the server's effective default (`titleGenerationTiming`):
+ * - `immediate` (default): fetch the title in parallel with the active stream so
+ *   it appears while the response is still streaming.
+ * - `final` (legacy): fetch only after the stream completes.
+ *
+ * The title query retries on 404 (server still generating) so a transient
+ * not-ready response is never treated as final (#13318).
  * Place this high in the component tree (e.g., Nav.tsx).
  */
 export function useTitleGeneration(enabled = true) {
   const queryClient = useQueryClient();
+  const { data: startupConfig } = useGetStartupConfig();
+  /** Defaults to immediate until startup config loads. */
+  const timing = startupConfig?.titleGenerationTiming ?? 'immediate';
+
   const [queueVersion, setQueueVersion] = useState(0);
   const [readyToFetch, setReadyToFetch] = useState<string[]>([]);
 
@@ -82,33 +107,54 @@ export function useTitleGeneration(enabled = true) {
 
   useEffect(() => {
     const activeSet = new Set(activeJobIds);
-    const completedJobs: string[] = [];
+    const eligible: string[] = [];
 
     for (const conversationId of titleQueue) {
-      if (!activeSet.has(conversationId) && !processedTitles.has(conversationId)) {
-        completedJobs.push(conversationId);
+      if (processedTitles.has(conversationId)) {
+        continue;
+      }
+      const eager = timing === 'immediate' && !deferredTitles.has(conversationId);
+      if (eager || !activeSet.has(conversationId)) {
+        eligible.push(conversationId);
       }
     }
 
-    if (completedJobs.length > 0) {
-      setReadyToFetch((prev) => [...new Set([...prev, ...completedJobs])]);
+    if (eligible.length > 0) {
+      setReadyToFetch((prev) => [...new Set([...prev, ...eligible])]);
     }
-  }, [activeJobIds, queueVersion]);
+  }, [activeJobIds, queueVersion, timing]);
+
+  useEffect(() => {
+    setReadyToFetch((prev) => {
+      const next = prev.filter((id) => !processedTitles.has(id));
+      return next.length === prev.length ? prev : next;
+    });
+  }, [queueVersion]);
 
-  // Fetch titles for ready conversations
+  // Fetch titles for ready conversations.
   const titleQueries = useQueries({
     queries: readyToFetch.map((conversationId) => ({
       queryKey: genTitleQueryKey(conversationId),
       queryFn: () => dataService.genTitle({ conversationId }),
+      // Gate on `enabled` so no /gen_title request fires while unauthenticated
+      // (e.g. after logout) even if the module-level queue still holds IDs.
+      enabled,
       staleTime: Infinity,
-      retry: false,
+      /** Retry only on 404 (title still generating server-side) so a transient
+       * not-ready response is never treated as final. All other errors are
+       * terminal. Bounded retry adapted from PR #13329. */
+      retry: (failureCount: number, error: unknown) => isNotFoundError(error) && failureCount < 3,
+      retryDelay: () => 5_000,
     })),
   });
 
   useEffect(() => {
+    const activeSet = new Set(activeJobIds);
     titleQueries.forEach((titleQuery, index) => {
       const conversationId = readyToFetch[index];
-      if (!conversationId || processedTitles.has(conversationId)) return;
+      if (!conversationId || processedTitles.has(conversationId)) {
+        return;
+      }
 
       if (titleQuery.isSuccess && titleQuery.data) {
         const { title } = titleQuery.data;
@@ -121,17 +167,34 @@ export function useTitleGeneration(enabled = true) {
         if (window.location.pathname.includes(conversationId)) {
           document.title = title;
         }
-        processedTitles.add(conversationId);
-        titleQueue.delete(conversationId);
+        markTitleGenerationProcessed(conversationId);
         setReadyToFetch((prev) => prev.filter((id) => id !== conversationId));
       } else if (titleQuery.isError) {
-        // Mark as processed even on error to avoid infinite retries
-        processedTitles.add(conversationId);
-        titleQueue.delete(conversationId);
-        setReadyToFetch((prev) => prev.filter((id) => id !== conversationId));
+        // Retries are exhausted here (the query only retries on 404). A title may
+        // still be generated *after* the stream completes (final mode generates
+        // only once the response ends), so don't treat the first 404 as final —
+        // guarantee one fresh, full-budget fetch cycle that runs post-completion.
+        if (activeSet.has(conversationId)) {
+          // Failed while still streaming: drop and clear so the completion
+          // transition re-promotes a fresh fetch (instead of busy-looping).
+          deferredTitles.add(conversationId);
+          queryClient.removeQueries(genTitleQueryKey(conversationId));
+          setReadyToFetch((prev) => prev.filter((id) => id !== conversationId));
+        } else if (!deferredTitles.has(conversationId)) {
+          // First failure at/after completion without a prior deferral: grant one
+          // fresh cycle. Polling has stopped (no re-promotion), so reset the query
+          // in place — `resetQueries` refetches active observers with a fresh retry
+          // budget, unlike `removeQueries`, which leaves the observer in error state.
+          deferredTitles.add(conversationId);
+          queryClient.resetQueries(genTitleQueryKey(conversationId));
+        } else {
+          // The post-completion fetch also failed — the title is genuinely absent.
+          markTitleGenerationProcessed(conversationId);
+          setReadyToFetch((prev) => prev.filter((id) => id !== conversationId));
+        }
       }
     });
-  }, [titleQueries, readyToFetch, queryClient]);
+  }, [titleQueries, readyToFetch, queryClient, activeJobIds]);
 }
 
 /**
diff --git a/client/src/data-provider/index.ts b/client/src/data-provider/index.ts
index 4a16792080e..e4be6aee0bc 100644
--- a/client/src/data-provider/index.ts
+++ b/client/src/data-provider/index.ts
@@ -7,6 +7,7 @@ export * from './Files';
 export * from './Memories';
 export * from './Messages';
 export * from './Misc';
+export * from './Projects';
 export * from './Tools';
 export * from './connection';
 export * from './Favorites';
diff --git a/client/src/data-provider/mutations.ts b/client/src/data-provider/mutations.ts
index e10aff030a7..f6aede97c81 100644
--- a/client/src/data-provider/mutations.ts
+++ b/client/src/data-provider/mutations.ts
@@ -1,16 +1,17 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { dataService, MutationKeys, QueryKeys, defaultOrderQuery } from 'librechat-data-provider';
 import {
   Constants,
   defaultAssistantsVersion,
   ConversationListResponse,
 } from 'librechat-data-provider';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { dataService, MutationKeys, QueryKeys, defaultOrderQuery } from 'librechat-data-provider';
 import type { InfiniteData, UseMutationResult } from '@tanstack/react-query';
 import type * as t from 'librechat-data-provider';
 import {
   logger,
   /* Conversations */
   addConvoToAllQueries,
+  findConversationInInfinite,
   updateConvoInAllQueries,
   removeConvoFromAllQueries,
 } from '~/utils';
@@ -34,6 +35,7 @@ export const useUpdateConversationMutation = (
         const targetId = payload.conversationId || id;
         queryClient.setQueryData([QueryKeys.conversation, targetId], updatedConvo);
         updateConvoInAllQueries(queryClient, targetId, () => updatedConvo);
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
       },
     },
   );
@@ -123,6 +125,9 @@ export const useArchiveConvoMutation = (
           [QueryKeys.conversation, vars.conversationId],
           isArchived ? null : _data,
         );
+        if (_data.chatProjectId) {
+          queryClient.invalidateQueries([QueryKeys.project, _data.chatProjectId]);
+        }
 
         onSuccess?.(_data, vars, context);
       },
@@ -136,33 +141,63 @@ export const useArchiveConvoMutation = (
           queryKey: archivedConvoQueryKey,
           refetchPage: (_, index) => index === 0,
         });
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+        queryClient.invalidateQueries([QueryKeys.projects]);
       },
       ..._options,
     },
   );
 };
 
+export const usePinConversationMutation = (
+  options?: t.PinConversationOptions,
+): UseMutationResult<t.TPinConversationResponse, unknown, t.TPinConversationRequest, unknown> => {
+  const queryClient = useQueryClient();
+  const { onSuccess, onError, ..._options } = options || {};
+
+  return useMutation(
+    [MutationKeys.convoPin],
+    (payload: t.TPinConversationRequest) => dataService.pinConversation(payload),
+    {
+      onSuccess: (data, vars, context) => {
+        updateConvoInAllQueries(queryClient, vars.conversationId, () => data);
+        onSuccess?.(data, vars, context);
+      },
+      onError,
+      ..._options,
+    },
+  );
+};
+
 export const useCreateSharedLinkMutation = (
   options?: t.MutationOptions<
     t.TCreateShareLinkRequest,
-    { conversationId: string; targetMessageId?: string }
+    { conversationId: string; targetMessageId?: string; snapshotFiles?: boolean }
   >,
 ): UseMutationResult<
   t.TSharedLinkResponse,
   unknown,
-  { conversationId: string; targetMessageId?: string },
+  { conversationId: string; targetMessageId?: string; snapshotFiles?: boolean },
   unknown
 > => {
   const queryClient = useQueryClient();
 
   const { onSuccess, ..._options } = options || {};
   return useMutation(
-    ({ conversationId, targetMessageId }: { conversationId: string; targetMessageId?: string }) => {
+    ({
+      conversationId,
+      targetMessageId,
+      snapshotFiles,
+    }: {
+      conversationId: string;
+      targetMessageId?: string;
+      snapshotFiles?: boolean;
+    }) => {
       if (!conversationId) {
         throw new Error('Conversation ID is required');
       }
 
-      return dataService.createSharedLink(conversationId, targetMessageId);
+      return dataService.createSharedLink(conversationId, targetMessageId, snapshotFiles);
     },
     {
       onSuccess: (_data: t.TSharedLinkResponse, vars, context) => {
@@ -176,17 +211,25 @@ export const useCreateSharedLinkMutation = (
 };
 
 export const useUpdateSharedLinkMutation = (
-  options?: t.MutationOptions<t.TUpdateShareLinkRequest, { shareId: string }>,
-): UseMutationResult<t.TSharedLinkResponse, unknown, { shareId: string }, unknown> => {
+  options?: t.MutationOptions<
+    t.TUpdateShareLinkRequest,
+    t.TUpdateShareLinkRequest & { snapshotFiles?: boolean }
+  >,
+): UseMutationResult<
+  t.TSharedLinkResponse,
+  unknown,
+  t.TUpdateShareLinkRequest & { snapshotFiles?: boolean },
+  unknown
+> => {
   const queryClient = useQueryClient();
 
   const { onSuccess, ..._options } = options || {};
   return useMutation(
-    ({ shareId }) => {
+    ({ shareId, targetMessageId, snapshotFiles }) => {
       if (!shareId) {
         throw new Error('Share ID is required');
       }
-      return dataService.updateSharedLink(shareId);
+      return dataService.updateSharedLink(shareId, targetMessageId, snapshotFiles);
     },
     {
       onSuccess: (_data: t.TSharedLinkResponse, vars, context) => {
@@ -475,6 +518,30 @@ export const useDeleteConversationMutation = (
         // TODO: CHECK THIS, no-op; restore if needed
       },
       onSuccess: (data, vars, context) => {
+        const deletedConversation = vars.conversationId
+          ? queryClient.getQueryData<t.TConversation>([QueryKeys.conversation, vars.conversationId])
+          : undefined;
+        let deletedProjectId = deletedConversation?.chatProjectId;
+        if (!deletedProjectId && vars.conversationId) {
+          const cacheKeys = [QueryKeys.allConversations, QueryKeys.projectConversations];
+          for (const cacheKey of cacheKeys) {
+            const queries = queryClient.getQueryCache().findAll([cacheKey], { exact: false });
+            for (const query of queries) {
+              const found = findConversationInInfinite(
+                queryClient.getQueryData<InfiniteData<ConversationListResponse>>(query.queryKey),
+                vars.conversationId,
+              );
+              if (found?.chatProjectId) {
+                deletedProjectId = found.chatProjectId;
+                break;
+              }
+            }
+            if (deletedProjectId) {
+              break;
+            }
+          }
+        }
+
         if (vars.conversationId) {
           removeConvoFromAllQueries(queryClient, vars.conversationId);
         }
@@ -519,6 +586,12 @@ export const useDeleteConversationMutation = (
           queryKey: [QueryKeys.archivedConversations],
           refetchPage: (_, index) => index === 0,
         });
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+        queryClient.invalidateQueries([QueryKeys.projects]);
+        queryClient.invalidateQueries([QueryKeys.conversationTags]);
+        if (deletedProjectId) {
+          queryClient.invalidateQueries([QueryKeys.project, deletedProjectId]);
+        }
 
         options?.onSuccess?.(data, vars, context);
       },
@@ -550,6 +623,11 @@ export const useDuplicateConversationMutation = (
         queryKey: [QueryKeys.allConversations],
         refetchPage: (_, index) => index === 0,
       });
+      queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      if (duplicatedConversation.chatProjectId) {
+        queryClient.invalidateQueries([QueryKeys.project, duplicatedConversation.chatProjectId]);
+      }
 
       if (duplicatedConversation.tags && duplicatedConversation.tags.length > 0) {
         queryClient.setQueryData<t.TConversationTag[]>([QueryKeys.conversationTags], (oldTags) => {
@@ -593,6 +671,11 @@ export const useForkConvoMutation = (
         queryKey: [QueryKeys.allConversations],
         refetchPage: (_, index) => index === 0,
       });
+      queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      if (forkedConversation.chatProjectId) {
+        queryClient.invalidateQueries([QueryKeys.project, forkedConversation.chatProjectId]);
+      }
 
       if (forkedConversation.tags && forkedConversation.tags.length > 0) {
         queryClient.setQueryData<t.TConversationTag[]>([QueryKeys.conversationTags], (oldTags) => {
diff --git a/client/src/data-provider/queries.ts b/client/src/data-provider/queries.ts
index 866e25a262c..de6c571c8bd 100644
--- a/client/src/data-provider/queries.ts
+++ b/client/src/data-provider/queries.ts
@@ -86,12 +86,12 @@ export const useConversationsInfiniteQuery = (
   params: ConversationListParams,
   config?: UseInfiniteQueryOptions<ConversationListResponse, unknown>,
 ) => {
-  const { isArchived, sortBy, sortDirection, tags, search } = params;
+  const { isArchived, sortBy, sortDirection, tags, search, projectId } = params;
 
   return useInfiniteQuery<ConversationListResponse>({
     queryKey: [
       isArchived ? QueryKeys.archivedConversations : QueryKeys.allConversations,
-      { isArchived, sortBy, sortDirection, tags, search },
+      { isArchived, sortBy, sortDirection, tags, search, projectId },
     ],
     queryFn: ({ pageParam }) =>
       dataService.listConversations({
@@ -100,6 +100,7 @@ export const useConversationsInfiniteQuery = (
         sortDirection,
         tags,
         search,
+        projectId,
         cursor: pageParam?.toString(),
       }),
     getNextPageParam: (lastPage) => lastPage?.nextCursor ?? undefined,
@@ -143,15 +144,14 @@ export const useSharedLinksQuery = (
   params: SharedLinksListParams,
   config?: UseInfiniteQueryOptions<SharedLinksResponse, unknown>,
 ) => {
-  const { pageSize, isPublic, search, sortBy, sortDirection } = params;
+  const { pageSize, search, sortBy, sortDirection } = params;
 
   return useInfiniteQuery<SharedLinksResponse>({
-    queryKey: [QueryKeys.sharedLinks, { pageSize, isPublic, search, sortBy, sortDirection }],
+    queryKey: [QueryKeys.sharedLinks, { pageSize, search, sortBy, sortDirection }],
     queryFn: ({ pageParam }) =>
       dataService.listSharedLinks({
         cursor: pageParam?.toString(),
         pageSize,
-        isPublic,
         search,
         sortBy,
         sortDirection,
diff --git a/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx b/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx
new file mode 100644
index 00000000000..ce68d560b32
--- /dev/null
+++ b/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx
@@ -0,0 +1,147 @@
+import React from 'react';
+import { RecoilRoot, useRecoilValue } from 'recoil';
+import { renderHook, act } from '@testing-library/react';
+import { Constants, EModelEndpoint } from 'librechat-data-provider';
+import type { TEphemeralAgent, TStartupConfig, TModelSpec } from 'librechat-data-provider';
+import { ephemeralAgentByConvoId, useUpdateEphemeralAgent } from '~/store/agents';
+import { useApplyModelSpecEffects } from '../useApplyModelSpecAgents';
+
+const NEW_CONVO = Constants.NEW_CONVO as string;
+
+const Wrapper = ({ children }: { children: React.ReactNode }) => (
+  <RecoilRoot>{children}</RecoilRoot>
+);
+
+const createModelSpec = (name: string): TModelSpec =>
+  ({
+    name,
+    label: name,
+    preset: {
+      endpoint: EModelEndpoint.openAI,
+      model: name,
+    },
+  }) as TModelSpec;
+
+const createStartupConfig = (list: TModelSpec[]): TStartupConfig =>
+  ({
+    modelSpecs: {
+      list,
+      prioritize: false,
+    },
+  }) as TStartupConfig;
+
+const specsConfig = () => createStartupConfig([createModelSpec('test-spec')]);
+
+const useHarness = (conversationId: string) => {
+  const applyModelSpecEffects = useApplyModelSpecEffects();
+  const updateEphemeralAgent = useUpdateEphemeralAgent();
+  const ephemeralAgent = useRecoilValue(ephemeralAgentByConvoId(conversationId));
+  return { applyModelSpecEffects, updateEphemeralAgent, ephemeralAgent };
+};
+
+describe('useApplyModelSpecEffects', () => {
+  it('preserves an existing conversation ephemeral agent on an in-place model switch', () => {
+    const conversationId = 'convo-123';
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(conversationId), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(conversationId, agent);
+    });
+    expect(result.current.ephemeralAgent).toEqual(agent);
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: conversationId,
+        specName: null,
+        prevConvoId: conversationId,
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+
+  it('preserves a new conversation ephemeral agent on an in-place model switch', () => {
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, agent);
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: NEW_CONVO,
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+
+  it('resets the ephemeral agent when switching away from a spec', () => {
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, { mcp: ['clickhouse'] });
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: NEW_CONVO,
+        prevSpecName: 'test-spec',
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toBeNull();
+  });
+
+  it('resets the new conversation ephemeral agent when leaving an existing conversation', () => {
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, { mcp: ['clickhouse'] });
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: 'convo-123',
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toBeNull();
+  });
+
+  it('leaves the ephemeral agent untouched when no specs are configured', () => {
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, agent);
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: 'convo-123',
+        prevSpecName: 'test-spec',
+        startupConfig: {} as TStartupConfig,
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+});
diff --git a/client/src/hooks/Agents/useApplyModelSpecAgents.ts b/client/src/hooks/Agents/useApplyModelSpecAgents.ts
index 2c677f85ca0..3b33968e865 100644
--- a/client/src/hooks/Agents/useApplyModelSpecAgents.ts
+++ b/client/src/hooks/Agents/useApplyModelSpecAgents.ts
@@ -10,7 +10,11 @@ import { getModelSpec, applyModelSpecEphemeralAgent } from '~/utils';
  *
  * When a spec is provided, its tool settings are applied to the ephemeral agent.
  * When no spec is provided but specs are configured, the ephemeral agent is reset
- * to null so BadgeRowContext can apply localStorage defaults (non-spec experience).
+ * to null on context transitions (leaving a spec, or moving to a different
+ * conversation key) so BadgeRowContext refills values from localStorage — both
+ * transitions re-trigger its init effect. In-place switches (same conversation,
+ * non-spec → non-spec) keep the ephemeral agent state (e.g. MCP selections),
+ * since no refill would follow the reset.
  */
 export function useApplyModelSpecEffects() {
   const updateEphemeralAgent = useUpdateEphemeralAgent();
@@ -18,17 +22,25 @@ export function useApplyModelSpecEffects() {
     ({
       convoId,
       specName,
+      prevConvoId,
+      prevSpecName,
       startupConfig,
     }: {
       convoId: string | null;
       specName?: string | null;
+      prevConvoId?: string | null;
+      prevSpecName?: string | null;
       startupConfig?: TStartupConfig;
     }) => {
       if (specName == null || !specName) {
-        if (startupConfig?.modelSpecs?.list?.length) {
-          /** Specs are configured but none selected — reset ephemeral agent to null
-           *  so BadgeRowContext fills all values (tool toggles + MCP) from localStorage. */
-          updateEphemeralAgent((convoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO, null);
+        if (!startupConfig?.modelSpecs?.list?.length) {
+          return;
+        }
+        const targetId = (convoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO;
+        const sourceId = (prevConvoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO;
+        const isContextSwitch = Boolean(prevSpecName) || targetId !== sourceId;
+        if (isContextSwitch) {
+          updateEphemeralAgent(targetId, null);
         }
         return;
       }
diff --git a/client/src/hooks/Agents/useSelectAgent.ts b/client/src/hooks/Agents/useSelectAgent.ts
index 30024c8f63b..756f67ff2b6 100644
--- a/client/src/hooks/Agents/useSelectAgent.ts
+++ b/client/src/hooks/Agents/useSelectAgent.ts
@@ -39,7 +39,6 @@ export default function useSelectAgent() {
       newConversation({
         template: currentConvo,
         preset: template as Partial<TPreset>,
-        keepLatestMessage: true,
       });
     },
     [getConversation, getDefaultConversation, newConversation],
diff --git a/client/src/hooks/Assistants/useSelectAssistant.ts b/client/src/hooks/Assistants/useSelectAssistant.ts
index c3710503e82..09240e20185 100644
--- a/client/src/hooks/Assistants/useSelectAssistant.ts
+++ b/client/src/hooks/Assistants/useSelectAssistant.ts
@@ -33,7 +33,6 @@ export default function useSelectAssistant(endpoint: AssistantsEndpoint) {
         newConversation({
           template: currentConvo,
           preset: template as Partial<TPreset>,
-          keepLatestMessage: true,
         });
         return;
       }
diff --git a/client/src/hooks/Audio/MediaSourceAppender.ts b/client/src/hooks/Audio/MediaSourceAppender.ts
index aef4f42edf5..38c88ff1881 100644
--- a/client/src/hooks/Audio/MediaSourceAppender.ts
+++ b/client/src/hooks/Audio/MediaSourceAppender.ts
@@ -21,7 +21,9 @@ export class MediaSourceAppender {
   }
 
   public addBase64Data(base64Data: string) {
-    this.addData(Uint8Array.from(atob(base64Data), (char) => char.charCodeAt(0)).buffer);
+    this.addData(
+      Uint8Array.from(atob(base64Data), (char) => char.charCodeAt(0)).buffer as ArrayBuffer,
+    );
   }
 
   public addData(data: ArrayBuffer) {
diff --git a/client/src/hooks/Chat/__tests__/cache.spec.ts b/client/src/hooks/Chat/__tests__/cache.spec.ts
new file mode 100644
index 00000000000..e3f7e8ebc5e
--- /dev/null
+++ b/client/src/hooks/Chat/__tests__/cache.spec.ts
@@ -0,0 +1,45 @@
+import { Constants } from 'librechat-data-provider';
+import type { TMessage } from 'librechat-data-provider';
+import { getMessageCacheIds, getMessagesConversationId } from '../cache';
+
+/** `Constants` is a heterogeneous enum (`string | number`); annotate as
+ *  `string` so the member is usable where a `string` field is expected. */
+const NEW_CONVO: string = Constants.NEW_CONVO;
+
+const message = (conversationId?: string | null): TMessage =>
+  ({
+    messageId: 'message-id',
+    conversationId,
+  }) as TMessage;
+
+describe('chat message cache helpers', () => {
+  it('uses the latest concrete conversation id from streamed messages', () => {
+    expect(
+      getMessagesConversationId([
+        message(Constants.NEW_CONVO),
+        message(null),
+        message('generated-convo-id'),
+      ]),
+    ).toBe('generated-convo-id');
+  });
+
+  it('mirrors new-chat messages into the generated conversation cache', () => {
+    expect(
+      getMessageCacheIds({
+        queryParam: NEW_CONVO,
+        conversationId: NEW_CONVO,
+        messages: [message('generated-convo-id')],
+      }),
+    ).toEqual([Constants.NEW_CONVO, 'generated-convo-id']);
+  });
+
+  it('keeps the current conversation cache id while avoiding duplicate ids', () => {
+    expect(
+      getMessageCacheIds({
+        queryParam: 'generated-convo-id',
+        conversationId: 'generated-convo-id',
+        messages: [message('generated-convo-id')],
+      }),
+    ).toEqual(['generated-convo-id']);
+  });
+});
diff --git a/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx b/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx
new file mode 100644
index 00000000000..ab5112f0e67
--- /dev/null
+++ b/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx
@@ -0,0 +1,145 @@
+import { renderHook, act } from '@testing-library/react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TConversation, TMessage, TSubmission } from 'librechat-data-provider';
+import useChatFunctions from '../useChatFunctions';
+
+const mockNavigate = jest.fn();
+const mockSetShowStopButton = jest.fn();
+const mockSetIsSubmitting = jest.fn();
+const mockGetEphemeralAgent = jest.fn(() => null);
+const mockSetFilesToDelete = jest.fn();
+const mockGetSender = jest.fn(() => 'Assistant');
+const mockGetExpiry = jest.fn(() => 'expiry-key');
+const mockGetQueryData = jest.fn(() => ({}));
+
+jest.mock('react-router-dom', () => ({
+  useNavigate: () => mockNavigate,
+}));
+
+jest.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    getQueryData: mockGetQueryData,
+  }),
+}));
+
+jest.mock('recoil', () => ({
+  useRecoilValue: () => false,
+  useSetRecoilState: (atom: unknown) =>
+    String(atom).includes('isSubmitting') ? mockSetIsSubmitting : mockSetShowStopButton,
+  useRecoilCallback: (factory: any) =>
+    factory({
+      snapshot: {
+        getLoadable: () => ({ state: 'hasValue', contents: [] }),
+      },
+      set: jest.fn(),
+      reset: jest.fn(),
+    }),
+}));
+
+jest.mock('~/hooks/Files/useSetFilesToDelete', () => () => mockSetFilesToDelete);
+jest.mock('~/hooks/Conversations/useGetSender', () => () => mockGetSender);
+jest.mock('~/hooks/Input/useUserKey', () => () => ({ getExpiry: mockGetExpiry }));
+jest.mock('~/hooks', () => ({
+  useAuthContext: () => ({ user: null }),
+}));
+jest.mock('~/store', () => ({
+  __esModule: true,
+  default: {
+    isTemporary: 'isTemporary',
+    isSubmittingFamily: () => 'isSubmitting',
+    showStopButtonByIndex: () => 'showStopButton',
+    pendingManualSkillsByConvoId: () => 'pendingManualSkills',
+    messagesSiblingIdxFamily: () => 'messagesSiblingIdx',
+  },
+  useGetEphemeralAgent: () => mockGetEphemeralAgent,
+}));
+jest.mock('~/utils', () => ({
+  logger: {
+    log: jest.fn(),
+    dir: jest.fn(),
+  },
+  createDualMessageContent: jest.fn(() => []),
+  getRouteChatProjectId: jest.fn(() => null),
+}));
+
+const userMessage = (messageId: string, parentMessageId = '00000000-0000-0000-0000-000000000000') =>
+  ({
+    messageId,
+    parentMessageId,
+    conversationId: 'conversation-1',
+    isCreatedByUser: true,
+    sender: 'User',
+    text: messageId,
+  }) as TMessage;
+
+const assistantMessage = (messageId: string, parentMessageId: string) =>
+  ({
+    messageId,
+    parentMessageId,
+    conversationId: 'conversation-1',
+    isCreatedByUser: false,
+    sender: 'Assistant',
+    text: messageId,
+  }) as TMessage;
+
+describe('useChatFunctions regenerate', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetQueryData.mockReturnValue({});
+  });
+
+  it('keys a non-tail regenerate to the selected assistant response', () => {
+    let messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+    const setMessages = jest.fn((nextMessages: TMessage[]) => {
+      messages = nextMessages;
+    });
+    const setSubmission = jest.fn();
+    const conversation = {
+      conversationId: 'conversation-1',
+      endpoint: EModelEndpoint.agents,
+      model: 'gpt-4o',
+      agent_id: 'agent-1',
+    } as TConversation;
+
+    const { result } = renderHook(() =>
+      useChatFunctions({
+        isSubmitting: false,
+        latestMessage: messages[5],
+        conversation,
+        getMessages: () => messages,
+        setMessages,
+        setSubmission,
+      }),
+    );
+
+    act(() => {
+      result.current.regenerate(messages[1]);
+    });
+
+    const submission = setSubmission.mock.calls.at(-1)?.[0] as TSubmission;
+    expect(submission.userMessage.overrideParentMessageId).toBe('user-1');
+    expect(submission.userMessage.responseMessageId).toBe('assistant-1_');
+    expect(submission.initialResponse?.messageId).toBe('assistant-1_');
+    expect(submission.initialResponse?.parentMessageId).toBe('user-1');
+    expect(submission.messages.map((message) => message.messageId)).toEqual(['user-1']);
+    expect(submission.regenerateMessages?.map((message) => message.messageId)).toEqual([
+      'user-1',
+      'assistant-1',
+      'user-2',
+      'assistant-2',
+      'user-3',
+      'assistant-3',
+    ]);
+    expect(
+      setMessages.mock.calls.at(-1)?.[0].map((message: TMessage) => message.messageId),
+    ).toEqual(['user-1', 'assistant-1_']);
+    expect(messages.at(-1)?.messageId).toBe('assistant-1_');
+  });
+});
diff --git a/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts b/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts
new file mode 100644
index 00000000000..0835cb43f4c
--- /dev/null
+++ b/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts
@@ -0,0 +1,129 @@
+import type { TMessage } from 'librechat-data-provider';
+import {
+  getRegenerateSubmissionMessages,
+  getPreliminaryRegenerateResponseMessageId,
+  getRegenerateTargetResponseMessage,
+} from '../useChatFunctions';
+
+const userMessage = (messageId: string, parentMessageId = '00000000-0000-0000-0000-000000000000') =>
+  ({
+    messageId,
+    parentMessageId,
+    isCreatedByUser: true,
+    sender: 'User',
+    text: messageId,
+  }) as TMessage;
+
+const assistantMessage = (messageId: string, parentMessageId: string) =>
+  ({
+    messageId,
+    parentMessageId,
+    isCreatedByUser: false,
+    sender: 'Assistant',
+    text: messageId,
+  }) as TMessage;
+
+describe('regenerate response targeting', () => {
+  it('uses the clicked assistant response instead of the conversation tail', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+
+    const targetResponse = getRegenerateTargetResponseMessage({
+      messages,
+      parentMessageId: 'user-1',
+      targetResponseMessageId: 'assistant-1',
+      latestMessage: messages[5],
+    });
+
+    expect(targetResponse?.messageId).toBe('assistant-1');
+    expect(getPreliminaryRegenerateResponseMessageId(targetResponse?.messageId)).toBe(
+      'assistant-1_',
+    );
+  });
+
+  it('only falls back to latestMessage when it belongs to the regenerated user turn', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+    ];
+
+    expect(
+      getRegenerateTargetResponseMessage({
+        messages,
+        parentMessageId: 'user-1',
+        latestMessage: messages[3],
+      })?.messageId,
+    ).toBe('assistant-1');
+
+    expect(
+      getRegenerateTargetResponseMessage({
+        messages,
+        parentMessageId: 'user-2',
+        latestMessage: messages[3],
+      })?.messageId,
+    ).toBe('assistant-2');
+  });
+
+  it('truncates regenerate history before the targeted assistant response', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[1],
+        initialResponseId: 'assistant-1_',
+      }).map((message) => message.messageId),
+    ).toEqual(['user-1']);
+  });
+
+  it('keeps unrelated sibling branches when regenerating (no flat-array drop)', () => {
+    // user-1 has two responses: the original chain (assistant-1 -> ... ) and a
+    // regenerated sibling (assistant-1b) that sits LATER in the flat array.
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      assistantMessage('assistant-1b', 'user-1'),
+    ];
+
+    // Regenerating the latest response on the original branch must drop only
+    // that response, NOT the unrelated assistant-1b branch.
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[3],
+        initialResponseId: 'assistant-2_',
+      })
+        .map((message) => message.messageId)
+        .sort(),
+    ).toEqual(['assistant-1', 'assistant-1b', 'user-1', 'user-2']);
+
+    // Regenerating an earlier response drops its subtree (user-2, assistant-2)
+    // but still keeps the unrelated assistant-1b branch.
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[1],
+        initialResponseId: 'assistant-1_',
+      })
+        .map((message) => message.messageId)
+        .sort(),
+    ).toEqual(['assistant-1b', 'user-1']);
+  });
+});
diff --git a/client/src/hooks/Chat/cache.ts b/client/src/hooks/Chat/cache.ts
new file mode 100644
index 00000000000..b07ab2398ca
--- /dev/null
+++ b/client/src/hooks/Chat/cache.ts
@@ -0,0 +1,44 @@
+import { Constants } from 'librechat-data-provider';
+import type { TMessage } from 'librechat-data-provider';
+
+type MessageCacheIdsParams = {
+  queryParam: string;
+  conversationId?: string | null;
+  messages: TMessage[];
+};
+
+function isConcreteConversationId(conversationId?: string | null): conversationId is string {
+  return (
+    !!conversationId &&
+    conversationId !== Constants.NEW_CONVO &&
+    conversationId !== Constants.PENDING_CONVO
+  );
+}
+
+export function getMessagesConversationId(messages: TMessage[]): string | undefined {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const conversationId = messages[i]?.conversationId;
+    if (isConcreteConversationId(conversationId)) {
+      return conversationId;
+    }
+  }
+}
+
+export function getMessageCacheIds({
+  queryParam,
+  conversationId,
+  messages,
+}: MessageCacheIdsParams): string[] {
+  const ids = [queryParam];
+  const messageConversationId = getMessagesConversationId(messages);
+
+  if (queryParam === Constants.NEW_CONVO && isConcreteConversationId(conversationId)) {
+    ids.push(conversationId);
+  }
+
+  if (isConcreteConversationId(messageConversationId) && !ids.includes(messageConversationId)) {
+    ids.push(messageConversationId);
+  }
+
+  return ids;
+}
diff --git a/client/src/hooks/Chat/index.ts b/client/src/hooks/Chat/index.ts
index 11754c6c5fe..9d9af790ce0 100644
--- a/client/src/hooks/Chat/index.ts
+++ b/client/src/hooks/Chat/index.ts
@@ -1,4 +1,6 @@
 export { default as useChatHelpers } from './useChatHelpers';
+export { default as useTokenLimits } from './useTokenLimits';
+export { default as useTokenUsage } from './useTokenUsage';
 export { default as useAddedResponse } from './useAddedResponse';
 export { default as useChatFunctions } from './useChatFunctions';
 export { default as useGetAddedConvo } from './useGetAddedConvo';
diff --git a/client/src/hooks/Chat/useChatFunctions.ts b/client/src/hooks/Chat/useChatFunctions.ts
index 36647908d28..50578ac428a 100644
--- a/client/src/hooks/Chat/useChatFunctions.ts
+++ b/client/src/hooks/Chat/useChatFunctions.ts
@@ -2,7 +2,7 @@ import { v4 } from 'uuid';
 import { cloneDeep } from 'lodash';
 import { useNavigate } from 'react-router-dom';
 import { useQueryClient } from '@tanstack/react-query';
-import { useSetRecoilState, useResetRecoilState, useRecoilValue, useRecoilCallback } from 'recoil';
+import { useSetRecoilState, useRecoilValue, useRecoilCallback } from 'recoil';
 import {
   Constants,
   QueryKeys,
@@ -26,9 +26,15 @@ import type {
 } from 'librechat-data-provider';
 import type { SetterOrUpdater } from 'recoil';
 import type { TAskFunction, ExtendedFile } from '~/common';
+import {
+  logger,
+  hasStreamStartFailed,
+  createDualMessageContent,
+  getRouteChatProjectId,
+} from '~/utils';
+import useFocusRegeneratedResponse from '~/hooks/Chat/useFocusRegeneratedResponse';
 import useSetFilesToDelete from '~/hooks/Files/useSetFilesToDelete';
 import useGetSender from '~/hooks/Conversations/useGetSender';
-import { logger, createDualMessageContent } from '~/utils';
 import store, { useGetEphemeralAgent } from '~/store';
 import { startupConfigKey } from '~/data-provider';
 import useUserKey from '~/hooks/Input/useUserKey';
@@ -40,6 +46,141 @@ const logChatRequest = (request: Record<string, unknown>) => {
   logger.log('=====================================');
 };
 
+const getAppendParentMessageId = ({
+  latestMessage,
+  currentMessages,
+}: {
+  latestMessage: TMessage | null;
+  currentMessages: TMessage[];
+}) => {
+  if (!latestMessage) {
+    return Constants.NO_PARENT;
+  }
+
+  if (!hasStreamStartFailed(latestMessage)) {
+    return latestMessage.messageId;
+  }
+
+  const failedUserMessage = currentMessages.find(
+    (message) => message.messageId === latestMessage.parentMessageId,
+  );
+  if (failedUserMessage?.isCreatedByUser !== true) {
+    return latestMessage.messageId;
+  }
+
+  return failedUserMessage.parentMessageId ?? Constants.NO_PARENT;
+};
+
+const hasPendingAssistantParent = (message: TMessage | null) =>
+  !!message?.messageId &&
+  message.isCreatedByUser !== true &&
+  message.messageId.endsWith('_') &&
+  message.createdAt == null &&
+  message.updatedAt == null &&
+  !hasStreamStartFailed(message);
+
+type RegenerateTargetResponseArgs = {
+  messages: TMessage[];
+  parentMessageId?: string | null;
+  targetResponseMessageId?: string | null;
+  latestMessage?: TMessage | null;
+};
+
+const isAssistantResponseForParent = (
+  message: TMessage | null | undefined,
+  parentMessageId?: string | null,
+): message is TMessage =>
+  !!message &&
+  !message.isCreatedByUser &&
+  !!parentMessageId &&
+  message.parentMessageId === parentMessageId;
+
+export function getPreliminaryRegenerateResponseMessageId(
+  responseMessageId?: string | null,
+): string | null {
+  if (typeof responseMessageId !== 'string' || responseMessageId.length === 0) {
+    return null;
+  }
+
+  return `${responseMessageId.replace(/_+$/, '')}_`;
+}
+
+export function getRegenerateTargetResponseMessage({
+  messages,
+  parentMessageId,
+  targetResponseMessageId,
+  latestMessage,
+}: RegenerateTargetResponseArgs): TMessage | null {
+  if (!parentMessageId) {
+    return null;
+  }
+
+  if (targetResponseMessageId) {
+    const targetResponse = messages.find(
+      (message) =>
+        message.messageId === targetResponseMessageId &&
+        isAssistantResponseForParent(message, parentMessageId),
+    );
+    if (targetResponse) {
+      return targetResponse;
+    }
+  }
+
+  if (isAssistantResponseForParent(latestMessage, parentMessageId)) {
+    return latestMessage;
+  }
+
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (isAssistantResponseForParent(message, parentMessageId)) {
+      return message;
+    }
+  }
+
+  return null;
+}
+
+export function getRegenerateSubmissionMessages({
+  messages,
+  targetResponseMessage,
+  initialResponseId,
+}: {
+  messages: TMessage[];
+  targetResponseMessage?: TMessage | null;
+  initialResponseId?: string | null;
+}): TMessage[] {
+  if (targetResponseMessage?.messageId) {
+    /**
+     * Remove the response being regenerated and its descendants only — NOT a
+     * flat `slice(0, targetIndex)`, which also drops unrelated sibling branches
+     * that merely sit later in the array. That collapse made the optimistic
+     * render briefly lose other branches mid-regenerate (visible flash, and the
+     * scroll jumping to the shrunken content). Keeping them holds the thread —
+     * and scroll — steady. This array is render-only; the server regenerates
+     * from `parentMessageId`, so removing by subtree never affects the payload.
+     */
+    const removed = new Set<string>([targetResponseMessage.messageId]);
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const message of messages) {
+        const parentMessageId = message.parentMessageId;
+        if (
+          parentMessageId != null &&
+          removed.has(parentMessageId) &&
+          !removed.has(message.messageId)
+        ) {
+          removed.add(message.messageId);
+          grew = true;
+        }
+      }
+    }
+    return messages.filter((message) => !removed.has(message.messageId));
+  }
+
+  return messages.filter((msg) => msg.messageId !== initialResponseId);
+}
+
 export default function useChatFunctions({
   index = 0,
   files,
@@ -49,7 +190,6 @@ export default function useChatFunctions({
   isSubmitting,
   latestMessage,
   setSubmission,
-  setLatestMessage,
   conversation: immutableConversation,
 }: {
   index?: number;
@@ -62,7 +202,6 @@ export default function useChatFunctions({
   files?: Map<string, ExtendedFile>;
   setFiles?: SetterOrUpdater<Map<string, ExtendedFile>>;
   setSubmission: SetterOrUpdater<TSubmission | null>;
-  setLatestMessage?: SetterOrUpdater<TMessage | null>;
 }) {
   const navigate = useNavigate();
   const getSender = useGetSender();
@@ -74,7 +213,7 @@ export default function useChatFunctions({
   const { getExpiry } = useUserKey(immutableConversation?.endpoint ?? '');
   const setIsSubmitting = useSetRecoilState(store.isSubmittingFamily(index));
   const setShowStopButton = useSetRecoilState(store.showStopButtonByIndex(index));
-  const resetLatestMultiMessage = useResetRecoilState(store.latestMessageFamily(index + 1));
+  const focusRegeneratedResponse = useFocusRegeneratedResponse();
 
   /**
    * Atomically read + reset the per-conversation queue of manually-invoked
@@ -100,6 +239,25 @@ export default function useChatFunctions({
     [],
   );
 
+  /**
+   * Atomically read + reset the per-conversation queue of quoted excerpts the
+   * user added via the "Add to chat" selection popup. Mirrors
+   * `drainPendingManualSkills`: a single snapshot read + reset so excerpts
+   * added between here and submission are never lost into a reset atom.
+   */
+  const drainPendingQuotes = useRecoilCallback(
+    ({ snapshot, reset }) =>
+      (convoId: string): string[] => {
+        const loadable = snapshot.getLoadable(store.pendingQuotesByConvoId(convoId));
+        const quotes = loadable.state === 'hasValue' ? (loadable.contents as string[]) : [];
+        if (quotes.length > 0) {
+          reset(store.pendingQuotesByConvoId(convoId));
+        }
+        return quotes;
+      },
+    [],
+  );
+
   const ask: TAskFunction = (
     {
       text,
@@ -117,12 +275,13 @@ export default function useChatFunctions({
       isEdited = false,
       overrideMessages,
       overrideFiles,
+      targetResponseMessageId,
       overrideManualSkills,
+      overrideQuotes,
       addedConvo,
     } = {},
   ) => {
     setShowStopButton(false);
-    resetLatestMultiMessage();
 
     text = text.trim();
     if (!!isSubmitting || text === '') {
@@ -148,6 +307,14 @@ export default function useChatFunctions({
       return;
     }
 
+    if (parentMessageId == null && hasPendingAssistantParent(latestMessage)) {
+      logger.warn(
+        '[useChatFunctions] Refusing to append to a preliminary assistant message',
+        latestMessage,
+      );
+      return false;
+    }
+
     const ephemeralAgent = getEphemeralAgent(conversationId ?? Constants.NEW_CONVO);
     /**
      * Manual skill selection resolution:
@@ -160,15 +327,37 @@ export default function useChatFunctions({
      *    a prior turn, not compose a new one).
      *  - Fresh submit → drain the per-convo atom into the message.
      */
-    const manualSkills =
-      overrideManualSkills != null
-        ? overrideManualSkills
-        : isRegenerate || isContinued || isEdited
+    let manualSkills = overrideManualSkills;
+    if (manualSkills == null) {
+      manualSkills =
+        isRegenerate || isContinued || isEdited
           ? []
           : drainPendingManualSkills(conversationId ?? Constants.NEW_CONVO);
+    }
+    /**
+     * Quoted-excerpt resolution mirrors manual skills, but is skipped entirely
+     * for Assistants endpoints: those bypass the `BaseClient` merge, so the
+     * quote UI is hidden there and a selection queued on another endpoint must
+     * not silently ride along on a fresh submit. The pending atom is left
+     * untouched so the queue survives if the user switches back.
+     *  - Explicit `overrideQuotes` wins (regenerate / resubmit replay the
+     *    original user message's persisted quotes so the same context is sent).
+     *  - Regenerate / continue / edit without an override → empty (those flows
+     *    replay a prior turn; the compose-time atom is left untouched).
+     *  - Fresh submit → drain the per-convo atom into the message.
+     */
+    const quotesSupported = !isAssistantsEndpoint(endpoint);
+    let quotes: string[] = [];
+    if (quotesSupported) {
+      if (overrideQuotes != null) {
+        quotes = overrideQuotes;
+      } else if (!isRegenerate && !isContinued && !isEdited) {
+        quotes = drainPendingQuotes(conversationId ?? Constants.NEW_CONVO);
+      }
+    }
     const isEditOrContinue = isEdited || isContinued;
 
-    let currentMessages: TMessage[] | null = overrideMessages ?? getMessages() ?? [];
+    let currentMessages: TMessage[] = overrideMessages ?? getMessages() ?? [];
 
     if (conversation?.promptPrefix) {
       conversation.promptPrefix = replaceSpecialVars({
@@ -177,10 +366,19 @@ export default function useChatFunctions({
       });
     }
 
+    const chatProjectId =
+      conversationId === Constants.NEW_CONVO
+        ? getRouteChatProjectId()
+        : (conversation?.chatProjectId ?? null);
+    const conversationForPayload =
+      chatProjectId != null ? { ...(conversation ?? {}), chatProjectId } : (conversation ?? {});
+
     // construct the query message
     // this is not a real messageId, it is used as placeholder before real messageId returned
     const intermediateId = overrideUserMessageId ?? v4();
-    parentMessageId = parentMessageId ?? latestMessage?.messageId ?? Constants.NO_PARENT;
+    if (parentMessageId == null) {
+      parentMessageId = getAppendParentMessageId({ latestMessage, currentMessages });
+    }
 
     logChatRequest({
       index,
@@ -196,7 +394,8 @@ export default function useChatFunctions({
       parentMessageId = Constants.NO_PARENT;
       currentMessages = [];
       conversationId = null;
-      navigate('/c/new', { state: { focusChat: true } });
+      const projectSearch = chatProjectId ? `?projectId=${encodeURIComponent(chatProjectId)}` : '';
+      navigate(`/c/new${projectSearch}`, { state: { focusChat: true } });
     }
 
     const targetParentMessageId = isRegenerate ? messageId : latestMessage?.parentMessageId;
@@ -208,6 +407,14 @@ export default function useChatFunctions({
     const targetParentMessage = currentMessages.find(
       (msg) => msg.messageId === targetParentMessageId,
     );
+    const targetResponseMessage = isRegenerate
+      ? getRegenerateTargetResponseMessage({
+          messages: currentMessages,
+          parentMessageId: messageId,
+          targetResponseMessageId,
+          latestMessage,
+        })
+      : null;
 
     let thread_id = targetParentMessage?.thread_id ?? latestMessage?.thread_id;
     if (thread_id == null) {
@@ -224,7 +431,7 @@ export default function useChatFunctions({
     const convo = parseCompactConvo({
       endpoint: endpoint as EndpointSchemaKey,
       endpointType: endpointType as EndpointSchemaKey,
-      conversation: conversation ?? {},
+      conversation: conversationForPayload,
       defaultParamsEndpoint,
     });
 
@@ -237,6 +444,7 @@ export default function useChatFunctions({
         overrideUserMessageId,
       },
       convo,
+      chatProjectId ? { chatProjectId } : {},
     ) as TEndpointOption;
     if (endpoint !== EModelEndpoint.agents) {
       endpointOption.key = getExpiry();
@@ -264,6 +472,13 @@ export default function useChatFunctions({
        * skill resolution reads the top-level `manualSkills` payload field.
        */
       manualSkills: manualSkills.length > 0 ? manualSkills : undefined,
+      /**
+       * Quoted excerpts the user referenced this turn. Persisted on the
+       * message (backend echoes it back on `req.body.quotes`) so `MessageQuotes`
+       * renders the references on the user bubble after reload. The backend
+       * also merges these into the model-facing user text at request time.
+       */
+      quotes: quotes.length > 0 ? quotes : undefined,
     };
 
     const submissionFiles = overrideFiles ?? targetParentMessage?.files;
@@ -290,8 +505,10 @@ export default function useChatFunctions({
 
     const responseMessageId =
       editedMessageId ??
-      (latestMessage?.messageId && isRegenerate
-        ? latestMessage.messageId.replace(/_+$/, '') + '_'
+      (isRegenerate
+        ? getPreliminaryRegenerateResponseMessageId(
+            targetResponseMessage?.messageId ?? targetResponseMessageId,
+          )
         : null) ??
       null;
     const initialResponseId =
@@ -370,10 +587,20 @@ export default function useChatFunctions({
       currentMessages = currentMessages.filter((msg) => msg.messageId !== responseMessageId);
     }
 
+    const submissionMessages = isRegenerate
+      ? getRegenerateSubmissionMessages({
+          messages: currentMessages,
+          targetResponseMessage,
+          initialResponseId: initialResponse.messageId,
+        })
+      : currentMessages;
+    const regenerateMessages = isRegenerate ? [...currentMessages] : undefined;
+
     logger.log('message_state', initialResponse);
     const submission: TSubmission = {
       conversation: {
         ...conversation,
+        ...(chatProjectId ? { chatProjectId } : {}),
         conversationId,
       },
       endpointOption,
@@ -382,7 +609,8 @@ export default function useChatFunctions({
         responseMessageId,
         overrideParentMessageId: isRegenerate ? messageId : null,
       },
-      messages: currentMessages,
+      messages: submissionMessages,
+      regenerateMessages,
       isEdited: isEditOrContinue,
       isContinued,
       isRegenerate,
@@ -395,20 +623,25 @@ export default function useChatFunctions({
     };
 
     if (isRegenerate) {
-      setMessages([...submission.messages, initialResponse]);
+      setMessages([...submissionMessages, initialResponse]);
+      focusRegeneratedResponse(initialResponse.parentMessageId);
     } else {
-      setMessages([...submission.messages, currentMsg, initialResponse]);
-    }
-    if (index === 0 && setLatestMessage) {
-      setLatestMessage(initialResponse);
+      setMessages([...submissionMessages, currentMsg, initialResponse]);
     }
 
     setSubmission(submission);
     logger.dir('message_stream', submission, { depth: null });
   };
 
-  const regenerate = ({ parentMessageId }, options?: { addedConvo?: TConversation | null }) => {
+  const regenerate = (
+    message: Partial<Pick<TMessage, 'messageId' | 'parentMessageId' | 'isCreatedByUser'>>,
+    options?: { addedConvo?: TConversation | null },
+  ) => {
     const messages = getMessages();
+    const parentMessageId =
+      message.isCreatedByUser === true ? message.messageId : message.parentMessageId;
+    const targetResponseMessageId =
+      message.isCreatedByUser === true ? undefined : message.messageId;
     const parentMessage = messages?.find((element) => element.messageId == parentMessageId);
 
     if (parentMessage && parentMessage.isCreatedByUser) {
@@ -417,12 +650,16 @@ export default function useChatFunctions({
         {
           isRegenerate: true,
           addedConvo: options?.addedConvo ?? undefined,
+          targetResponseMessageId,
           /** Carry the original user message's manual skill picks forward
            *  so the regenerated response is primed with the same skills.
            *  The compose-time atom was drained on the first submit; without
            *  this the model sees an unprimed turn even though the pills
            *  still show on the user bubble. */
           overrideManualSkills: parentMessage.manualSkills,
+          /** Carry the original user message's quoted excerpts forward so the
+           *  regenerated response is sent the same referenced context. */
+          overrideQuotes: parentMessage.quotes,
         },
       );
     } else {
diff --git a/client/src/hooks/Chat/useChatHelpers.ts b/client/src/hooks/Chat/useChatHelpers.ts
index 219c3704180..cc095f85b66 100644
--- a/client/src/hooks/Chat/useChatHelpers.ts
+++ b/client/src/hooks/Chat/useChatHelpers.ts
@@ -1,12 +1,14 @@
 import { useCallback, useMemo, useRef, useState } from 'react';
 import { QueryKeys, isAssistantsEndpoint } from 'librechat-data-provider';
 import { useQueryClient } from '@tanstack/react-query';
-import { useRecoilState, useResetRecoilState, useSetRecoilState } from 'recoil';
+import { useRecoilState, useSetRecoilState } from 'recoil';
 import type { TMessage } from 'librechat-data-provider';
 import type { ActiveJobsResponse } from '~/data-provider';
 import useChatFunctions from '~/hooks/Chat/useChatFunctions';
 import { useAbortStreamMutation } from '~/data-provider';
 import useNewConvo from '~/hooks/useNewConvo';
+import { useLatestMessage, useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
+import { getMessageCacheIds } from './cache';
 import store from '~/store';
 
 // this to be set somewhere else
@@ -27,11 +29,10 @@ export default function useChatHelpers(index = 0, paramId?: string) {
   Falling back to conversationId (Recoil) only if paramId is not available */
   const queryParam = paramId === 'new' ? paramId : (paramId ?? conversationId ?? '');
 
-  const resetLatestMessage = useResetRecoilState(store.latestMessageFamily(index));
   const [isSubmitting, setIsSubmitting] = useRecoilState(store.isSubmittingFamily(index));
-  const [latestMessage, setLatestMessage] = useRecoilState(store.latestMessageFamily(index));
+  const latestMessage = useLatestMessage(index, queryParam);
 
-  const latestMessageId = latestMessage?.messageId;
+  const latestMessageId = useLatestMessageId(index, queryParam) ?? undefined;
   const latestMessageDepth = latestMessage?.depth;
   const latestMessageRef = useRef(latestMessage);
   latestMessageRef.current = latestMessage;
@@ -42,9 +43,9 @@ export default function useChatHelpers(index = 0, paramId?: string) {
 
   const setMessages = useCallback(
     (messages: TMessage[]) => {
-      queryClient.setQueryData<TMessage[]>([QueryKeys.messages, queryParam], messages);
-      if (queryParam === 'new' && conversationId && conversationId !== 'new') {
-        queryClient.setQueryData<TMessage[]>([QueryKeys.messages, conversationId], messages);
+      const messageCacheIds = getMessageCacheIds({ queryParam, conversationId, messages });
+      for (const messageCacheId of messageCacheIds) {
+        queryClient.setQueryData<TMessage[]>([QueryKeys.messages, messageCacheId], messages);
       }
     },
     [queryParam, queryClient, conversationId],
@@ -85,7 +86,6 @@ export default function useChatHelpers(index = 0, paramId?: string) {
     conversation,
     latestMessage,
     setSubmission,
-    setLatestMessage,
   });
 
   const askRef = useRef(_ask);
@@ -210,8 +210,6 @@ export default function useChatHelpers(index = 0, paramId?: string) {
       setSiblingIdx,
       latestMessageId,
       latestMessageDepth,
-      setLatestMessage,
-      resetLatestMessage,
       ask,
       index,
       regenerate,
@@ -243,8 +241,6 @@ export default function useChatHelpers(index = 0, paramId?: string) {
       setSiblingIdx,
       latestMessageId,
       latestMessageDepth,
-      setLatestMessage,
-      resetLatestMessage,
       ask,
       index,
       regenerate,
diff --git a/client/src/hooks/Chat/useFocusRegeneratedResponse.ts b/client/src/hooks/Chat/useFocusRegeneratedResponse.ts
new file mode 100644
index 00000000000..5d5ad3abc09
--- /dev/null
+++ b/client/src/hooks/Chat/useFocusRegeneratedResponse.ts
@@ -0,0 +1,25 @@
+import { useRecoilCallback } from 'recoil';
+import store from '~/store';
+
+/**
+ * Focus a regenerated response's fork on its newest sibling. A regeneration
+ * appends the new response as the newest child of its parent, but when the
+ * parent already had multiple siblings the child count is unchanged (the slice
+ * keeps unrelated branches), so MultiMessage's length-change reset never fires
+ * and the view would otherwise stay on the kept sibling. Selecting reversed
+ * index 0 (newest = the appended response) makes the regenerating branch
+ * visible — applied at the optimistic render and reaffirmed on the `created`
+ * event so there is no flash on the kept sibling in between.
+ */
+export default function useFocusRegeneratedResponse() {
+  return useRecoilCallback(
+    ({ set }) =>
+      (parentMessageId?: string | null) => {
+        if (parentMessageId == null) {
+          return;
+        }
+        set(store.messagesSiblingIdxFamily(parentMessageId), 0);
+      },
+    [],
+  );
+}
diff --git a/client/src/hooks/Chat/useTokenLimits.ts b/client/src/hooks/Chat/useTokenLimits.ts
new file mode 100644
index 00000000000..e2454aae77f
--- /dev/null
+++ b/client/src/hooks/Chat/useTokenLimits.ts
@@ -0,0 +1,66 @@
+import { useMemo } from 'react';
+import { Providers, EModelEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
+import type { TConversation, TModelTokenomics } from 'librechat-data-provider';
+import { useGetStartupConfig, useTokenConfigQuery, useGetAgentByIdQuery } from '~/data-provider';
+import { getModelSpec } from '~/utils';
+
+/** Gemini tokenomics are advertised under the `google` endpoint, so a
+ *  Vertex-backed agent (`provider: 'vertexai'`) must look up there. */
+function normalizeTokenConfigKey(endpoint: string): string {
+  return endpoint === Providers.VERTEXAI ? EModelEndpoint.google : endpoint;
+}
+
+export interface TokenLimits {
+  /** Statically resolved max context; live snapshots override this at run time */
+  maxContextTokens?: number;
+  rates?: TModelTokenomics;
+  endpoint?: string;
+  model?: string;
+}
+
+function toNumber(value: unknown): number | undefined {
+  const num = typeof value === 'string' ? parseFloat(value) : value;
+  return typeof num === 'number' && Number.isFinite(num) && num > 0 ? num : undefined;
+}
+
+/**
+ * Mirrors the backend resolution chain (packages/api agents/initialize.ts):
+ * explicit conversation setting → agent params → model spec preset →
+ * server-resolved token config lookup.
+ */
+export default function useTokenLimits(conversation: TConversation | null): TokenLimits {
+  const { data: startupConfig } = useGetStartupConfig();
+  const { data: tokenConfig } = useTokenConfigQuery();
+
+  const endpoint = conversation?.endpoint ?? '';
+  const agentId = isAgentsEndpoint(endpoint) ? conversation?.agent_id : null;
+  const { data: agent } = useGetAgentByIdQuery(agentId);
+
+  const spec = conversation?.spec;
+  const model = conversation?.model;
+  const maxContextSetting = conversation?.maxContextTokens;
+
+  return useMemo(() => {
+    const specPreset = getModelSpec({ specName: spec, startupConfig })?.preset;
+
+    let lookupEndpoint = endpoint;
+    let lookupModel = model ?? '';
+    if (agent) {
+      lookupEndpoint = agent.provider ?? endpoint;
+      lookupModel = agent.model ?? lookupModel;
+    } else if (specPreset) {
+      lookupEndpoint = specPreset.endpoint ?? lookupEndpoint;
+      lookupModel = lookupModel || (specPreset.model ?? '');
+    }
+    lookupEndpoint = normalizeTokenConfigKey(lookupEndpoint);
+
+    const rates = tokenConfig?.[lookupEndpoint]?.[lookupModel];
+    const maxContextTokens =
+      toNumber(maxContextSetting) ??
+      toNumber(agent?.model_parameters?.maxContextTokens) ??
+      toNumber(specPreset?.maxContextTokens) ??
+      rates?.context;
+
+    return { maxContextTokens, rates, endpoint: lookupEndpoint, model: lookupModel };
+  }, [endpoint, model, spec, maxContextSetting, agent, startupConfig, tokenConfig]);
+}
diff --git a/client/src/hooks/Chat/useTokenUsage.ts b/client/src/hooks/Chat/useTokenUsage.ts
new file mode 100644
index 00000000000..6a6d4ff8459
--- /dev/null
+++ b/client/src/hooks/Chat/useTokenUsage.ts
@@ -0,0 +1,333 @@
+import { useEffect, useMemo, useRef } from 'react';
+import { useAtomValue, useSetAtom } from 'jotai';
+import { useQueryClient } from '@tanstack/react-query';
+import { Constants, QueryKeys } from 'librechat-data-provider';
+import type {
+  TMessage,
+  TConversation,
+  TModelTokenomics,
+  TContextUsageEvent,
+  TContextProjectionRequest,
+} from 'librechat-data-provider';
+import type { BranchTotals, BranchUsage } from '~/utils/tokens';
+import type { ContextSnapshot } from '~/store/usage';
+import {
+  liveTokensFamily,
+  totalUsageFamily,
+  removeUsageAtoms,
+  hydrateSnapshots,
+  pendingUsageFamily,
+  branchTotalsFamily,
+  contextSnapshotFamily,
+  snapshotsByAnchorFamily,
+} from '~/store/usage';
+import {
+  buildIndex,
+  sumBranch,
+  clearIndex,
+  mergeUsage,
+  sumTotalUsage,
+  findBranchSnapshotAnchor,
+} from '~/utils';
+import { useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
+import { useContextProjectionQuery } from '~/data-provider';
+import useTokenLimits from './useTokenLimits';
+
+export interface TokenUsageParams {
+  index: number;
+  conversation: TConversation | null;
+  isSubmitting: boolean;
+}
+
+export interface TokenUsageView {
+  usedTokens: number;
+  maxTokens?: number;
+  /** 0–100, clamped; 0 when max is unknown */
+  percent: number;
+  /** True when derived from per-message counts instead of a backend snapshot */
+  isEstimate: boolean;
+  snapshot: ContextSnapshot | null;
+  snapshotActive: boolean;
+  branchTotals: BranchTotals;
+  /** Provider usage along the active branch (matches the gauge), incl. in-flight */
+  branchUsage: BranchUsage;
+  /** Provider usage across all branches of the conversation */
+  totalUsage: BranchUsage;
+  /** Whether any usage is available to display (branch has token usage) */
+  hasUsage: boolean;
+  /** Authoritative branch cost; the cost row is gated on `interface.contextCost` at render */
+  branchCost: number;
+  /** Authoritative cost across all branches (shown when it differs from branch) */
+  totalCost: number;
+  liveTokens: number;
+  rates?: TModelTokenomics;
+}
+
+/**
+ * View-model for the context usage indicator. Mount only inside the
+ * indicator so its subscriptions never re-render the chat tree.
+ */
+export default function useTokenUsage({
+  index,
+  conversation,
+  isSubmitting,
+}: TokenUsageParams): TokenUsageView {
+  const queryClient = useQueryClient();
+  const conversationKey = conversation?.conversationId ?? Constants.NEW_CONVO;
+
+  const tailId = useLatestMessageId(index);
+  const snapshot = useAtomValue(contextSnapshotFamily(conversationKey));
+  const snapshotsByAnchor = useAtomValue(snapshotsByAnchorFamily(conversationKey));
+  const pendingUsage = useAtomValue(pendingUsageFamily(conversationKey));
+  const totalUsageBase = useAtomValue(totalUsageFamily(conversationKey));
+  const branchTotals = useAtomValue(branchTotalsFamily(conversationKey));
+  const liveTokens = useAtomValue(liveTokensFamily(conversationKey));
+  const setBranchTotals = useSetAtom(branchTotalsFamily(conversationKey));
+  const setTotalUsage = useSetAtom(totalUsageFamily(conversationKey));
+  const limits = useTokenLimits(conversation);
+
+  /** Deepest persisted/live snapshot on the viewed branch (present only for
+   *  turns generated with the feature on). Gates the projection fetch and is a
+   *  render source. */
+  const branchSnapshot = useMemo(() => {
+    if (snapshotsByAnchor.size === 0) {
+      return null;
+    }
+    const anchor = findBranchSnapshotAnchor(
+      conversationKey,
+      branchTotals.tailId,
+      snapshotsByAnchor,
+    );
+    return anchor != null ? (snapshotsByAnchor.get(anchor) ?? null) : null;
+  }, [conversationKey, branchTotals.tailId, snapshotsByAnchor]);
+
+  const resolvedMax = limits.maxContextTokens;
+
+  /** Project the branch (agents SDK, no model call) ONLY when no persisted/live
+   *  snapshot covers it — snapshot-less branches (G2: pre-feature history,
+   *  imports, never-generated branches). A present snapshot stays authoritative;
+   *  reliable window-switch (G1) detection needs the snapshot to carry its
+   *  model/window (deferred to the fidelity follow-up), and the SDK window
+   *  (reserve-derived) doesn't equal the client-resolved raw window, so we must
+   *  NOT mis-flag a valid snapshot as stale here. Cached + refetched by branch/
+   *  endpoint/model/window/revision. */
+  const projectionParams: TContextProjectionRequest | null =
+    !isSubmitting &&
+    branchSnapshot == null &&
+    conversation?.conversationId != null &&
+    conversation.conversationId !== Constants.NEW_CONVO &&
+    branchTotals.tailId != null &&
+    conversation.endpoint != null
+      ? {
+          conversationId: conversation.conversationId,
+          messageId: branchTotals.tailId,
+          /** Resolved provider/model (e.g. an agent's actual provider, not the
+           *  `agents` endpoint) so the server picks the right tokenizer. */
+          endpoint: limits.endpoint || conversation.endpoint,
+          model: limits.model || conversation.model || undefined,
+          agentId: conversation.agent_id ?? undefined,
+          spec: conversation.spec ?? undefined,
+          maxContextTokens: resolvedMax,
+          /** Content revision so an in-place message edit (same tail id) refetches. */
+          revision: branchTotals.input + branchTotals.output,
+        }
+      : null;
+  const { data: projectionData } = useContextProjectionQuery(projectionParams);
+  const projection = projectionData ?? null;
+
+  /** Branch/total provider usage is index-derived; the in-flight response is
+   *  the only live add (the pending holder), counted into both — it sits on the
+   *  active branch tail and inside the conversation. The backend prices each
+   *  call (premium tiers, cache rates), so cost sums authoritatively. */
+  const pendingAsUsage: BranchUsage = useMemo(
+    () => ({
+      input: pendingUsage.input,
+      output: pendingUsage.output,
+      cacheWrite: pendingUsage.cacheWrite,
+      cacheRead: pendingUsage.cacheRead,
+      cost: pendingUsage.costUSD,
+      costKnown: pendingUsage.costKnown,
+    }),
+    [pendingUsage],
+  );
+  const branchUsage = useMemo(
+    () => mergeUsage(branchTotals.usage, pendingAsUsage),
+    [branchTotals.usage, pendingAsUsage],
+  );
+  const totalUsage = useMemo(
+    () => mergeUsage(totalUsageBase, pendingAsUsage),
+    [totalUsageBase, pendingAsUsage],
+  );
+  const hasUsage =
+    branchUsage.input + branchUsage.output + branchUsage.cacheRead + branchUsage.cacheWrite > 0;
+
+  const isSubmittingRef = useRef(isSubmitting);
+  isSubmittingRef.current = isSubmitting;
+  const tailIdRef = useRef(tailId);
+  tailIdRef.current = tailId;
+  const anchorId = snapshot?.anchorMessageId ?? null;
+  const anchorIdRef = useRef(anchorId);
+  anchorIdRef.current = anchorId;
+
+  useEffect(() => {
+    /** Cache `updated` events fire on every state transition — rebuild the
+     *  O(n) index only when the data snapshot reference actually changed */
+    let lastIndexed: TMessage[] | undefined;
+    const rebuild = (messages?: TMessage[]) => {
+      if (messages === lastIndexed && messages !== undefined) {
+        return;
+      }
+      lastIndexed = messages;
+      buildIndex(conversationKey, messages);
+      /** Restore each branch's persisted breakdown (Part A) without clobbering
+       *  a live finalized snapshot for the same response id. */
+      hydrateSnapshots(conversationKey, messages);
+      setBranchTotals(sumBranch(conversationKey, tailIdRef.current, anchorIdRef.current));
+      setTotalUsage(sumTotalUsage(conversationKey));
+    };
+
+    rebuild(queryClient.getQueryData<TMessage[]>([QueryKeys.messages, conversationKey]));
+
+    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
+      if (isSubmittingRef.current || event.type !== 'updated') {
+        return;
+      }
+      const queryKey = event.query.queryKey;
+      if (
+        !Array.isArray(queryKey) ||
+        queryKey[0] !== QueryKeys.messages ||
+        queryKey[1] !== conversationKey
+      ) {
+        return;
+      }
+      rebuild(event.query.state.data as TMessage[] | undefined);
+    });
+    return () => {
+      unsubscribe();
+      /** Bound memory to open conversations — drop this one's token index and
+       *  usage atoms on switch/unmount; both rebuild from the query cache on
+       *  return. NEW_CONVO is migrated to its real id by finalizeUsage, so
+       *  leave it alone to avoid racing that handoff. */
+      if (conversationKey !== Constants.NEW_CONVO) {
+        clearIndex(conversationKey);
+        removeUsageAtoms(conversationKey);
+      }
+    };
+  }, [conversationKey, queryClient, setBranchTotals, setTotalUsage]);
+
+  useEffect(() => {
+    /** Re-index from the cache on every tail change (created/finalize during a
+     *  stream AND branch switches). Branch switches don't fire a cache `updated`
+     *  event, so the subscriber below can't catch them; without rebuilding here
+     *  the index stays on whatever the last stream left it — which may have
+     *  dropped the now-viewed branch's response, so sumBranch would find no
+     *  tokens/usage and the gauge + branch cost would blank out. Bounded: tailId
+     *  only shifts on created/finalize/branch-switch, never per chunk. Usage for
+     *  responses whose cache message lacks `metadata.usage` is restored from the
+     *  sticky history inside buildIndex. */
+    buildIndex(
+      conversationKey,
+      queryClient.getQueryData<TMessage[]>([QueryKeys.messages, conversationKey]),
+    );
+    setBranchTotals(sumBranch(conversationKey, tailId, anchorId));
+    setTotalUsage(sumTotalUsage(conversationKey));
+  }, [conversationKey, tailId, anchorId, setBranchTotals, setTotalUsage, queryClient]);
+
+  return useMemo(() => {
+    /** The granular snapshot is for one specific generation. Show the live one
+     *  while streaming, or when its (response-message) anchor is on the viewed
+     *  branch. A null-anchor snapshot must NOT match every branch — that leaked
+     *  one branch's breakdown onto its siblings. */
+    const currentActive =
+      snapshot != null &&
+      (isSubmitting || (snapshot.anchorMessageId != null && branchTotals.containsAnchor));
+
+    /** Precedence: live/active snapshot → persisted branch snapshot → server
+     *  projection (snapshot-less branches, G2) → per-message estimate. The first
+     *  two preserve the pre-projection behavior exactly; the projection only
+     *  slots in ahead of the estimate when no snapshot exists. Snapshot and
+     *  projection share the render-relevant fields, so they render uniformly. */
+    let effective: ContextSnapshot | TContextUsageEvent | null = null;
+    /** A server projection is the SDK's windowing but, in this first cut, omits
+     *  instruction/tool overhead — so it's surfaced as an ESTIMATE (a better one
+     *  than sumBranch), never a false-authoritative number. Real snapshots stay
+     *  authoritative. */
+    let projected = false;
+    if (currentActive) {
+      effective = snapshot;
+    } else if (branchSnapshot != null) {
+      effective = branchSnapshot;
+    } else if (projection != null) {
+      effective = projection;
+      projected = true;
+    }
+
+    if (effective != null) {
+      const breakdown = effective.breakdown;
+      const maxTokens = effective.contextBudget ?? breakdown.maxContextTokens;
+      const instructionTokens = effective.effectiveInstructionTokens ?? breakdown.instructionTokens;
+      const baseUsed =
+        effective.remainingContextTokens != null
+          ? maxTokens - effective.remainingContextTokens
+          : instructionTokens + breakdown.messageTokens;
+      /** The snapshot/projection is pre-invoke: in-flight output rides on
+       *  `liveTokens` (0 unless streaming this branch), the last call's finalized
+       *  output on `completedOutputTokens` (absent on a projection → 0). */
+      const usedTokens =
+        Math.max(0, baseUsed) + liveTokens + (effective.completedOutputTokens ?? 0);
+      return {
+        usedTokens,
+        maxTokens,
+        percent: maxTokens > 0 ? Math.min((usedTokens / maxTokens) * 100, 100) : 0,
+        isEstimate: projected,
+        snapshot: projected ? null : (effective as ContextSnapshot),
+        snapshotActive: !projected,
+        branchTotals,
+        branchUsage,
+        totalUsage,
+        hasUsage,
+        branchCost: branchUsage.cost,
+        totalCost: totalUsage.cost,
+        liveTokens,
+        rates: limits.rates,
+      };
+    }
+
+    /** `summaryBaseline` is the compacted-context size from the deepest
+     *  summarized response on the branch (0 if none). The branch walk stops
+     *  there, so input/output are post-summary only — adding the baseline keeps
+     *  the estimate from re-summing the discarded pre-summary history (which
+     *  otherwise pins the gauge at 100% forever after a compaction). */
+    const usedTokens =
+      branchTotals.input + branchTotals.output + branchTotals.summaryBaseline + liveTokens;
+    const maxTokens = limits.maxContextTokens;
+    return {
+      usedTokens,
+      maxTokens,
+      percent:
+        maxTokens != null && maxTokens > 0 ? Math.min((usedTokens / maxTokens) * 100, 100) : 0,
+      isEstimate: true,
+      snapshot: null,
+      snapshotActive: false,
+      branchTotals,
+      branchUsage,
+      totalUsage,
+      hasUsage,
+      branchCost: branchUsage.cost,
+      totalCost: totalUsage.cost,
+      liveTokens,
+      rates: limits.rates,
+    };
+  }, [
+    snapshot,
+    isSubmitting,
+    branchTotals,
+    branchUsage,
+    totalUsage,
+    hasUsage,
+    liveTokens,
+    limits,
+    branchSnapshot,
+    projection,
+  ]);
+}
diff --git a/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx b/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
index dd767260d8a..b5ad9afa696 100644
--- a/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
+++ b/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
@@ -4,14 +4,20 @@ import { renderHook } from '@testing-library/react';
 import { PermissionTypes, Permissions } from 'librechat-data-provider';
 import type { TUser } from 'librechat-data-provider';
 
+type CloudFrontRetryOptions = { getAuthorizationHeader: () => string | undefined };
+
 const mockUseHasAccess = jest.fn();
 const mockUseMCPServersQuery = jest.fn();
 const mockUseMCPToolsQuery = jest.fn();
-const mockInstallCloudFrontImageRetry = jest.fn(() => jest.fn());
+const mockInstallCloudFrontImageRetry = jest.fn(
+  (_startupConfig: unknown, _options: CloudFrontRetryOptions): (() => void) =>
+    () =>
+      undefined,
+);
 const mockGetTokenHeader = jest.fn();
 
 jest.mock('@librechat/client', () => ({
-  installCloudFrontImageRetry: (startupConfig: unknown, options: unknown) =>
+  installCloudFrontImageRetry: (startupConfig: unknown, options: CloudFrontRetryOptions) =>
     mockInstallCloudFrontImageRetry(startupConfig, options),
 }));
 
diff --git a/client/src/hooks/Config/useClearStates.ts b/client/src/hooks/Config/useClearStates.ts
index 46ec9476c7a..0303d3b558a 100644
--- a/client/src/hooks/Config/useClearStates.ts
+++ b/client/src/hooks/Config/useClearStates.ts
@@ -5,14 +5,12 @@ import store from '~/store';
 export default function useClearStates() {
   const clearConversations = store.useClearConvoState();
   const clearSubmissions = store.useClearSubmissionState();
-  const clearLatestMessages = store.useClearLatestMessages();
 
   const clearStates = useRecoilCallback(
     ({ reset, snapshot }) =>
       async (skipFirst?: boolean) => {
         await clearSubmissions(skipFirst);
         await clearConversations(skipFirst);
-        await clearLatestMessages(skipFirst);
 
         const keys = await snapshot.getPromise(store.conversationKeysAtom);
 
@@ -34,6 +32,18 @@ export default function useClearStates() {
           reset(store.showPromptsPopoverFamily(key));
           reset(store.showSkillsPopoverFamily(key));
           reset(store.pendingManualSkillsByConvoId(key.toString()));
+          reset(store.pendingQuotesByConvoId(key.toString()));
+          /**
+           * Pending skill/quote queues are keyed by the conversation id the
+           * composer wrote under, not this UI index — also clear by the resolved
+           * id so queued-but-unsent selections don't linger in Recoil.
+           */
+          const convoId = (await snapshot.getPromise(store.conversationByIndex(key)))
+            ?.conversationId;
+          if (convoId != null) {
+            reset(store.pendingManualSkillsByConvoId(convoId));
+            reset(store.pendingQuotesByConvoId(convoId));
+          }
           reset(store.activePromptByIndex(key));
           reset(store.globalAudioURLFamily(key));
           reset(store.globalAudioFetchingFamily(key));
diff --git a/client/src/hooks/Config/useSpeechSettingsInit.ts b/client/src/hooks/Config/useSpeechSettingsInit.ts
index a6ce69e52bc..9dab2c9e0d2 100644
--- a/client/src/hooks/Config/useSpeechSettingsInit.ts
+++ b/client/src/hooks/Config/useSpeechSettingsInit.ts
@@ -1,15 +1,19 @@
 import { useEffect, useRef } from 'react';
-import { useSetRecoilState } from 'recoil';
+import { useRecoilState, useSetRecoilState } from 'recoil';
 import { useGetCustomConfigSpeechQuery } from 'librechat-data-provider/react-query';
+import { TTSEndpoints } from '~/common';
 import { logger } from '~/utils';
 import store from '~/store';
 
+const VALID_TTS_ENGINES: string[] = [TTSEndpoints.browser, TTSEndpoints.external];
+
 /**
  * Initializes speech-related Recoil values from the server-side custom
  * configuration on first load (only when the user is authenticated)
  */
 export default function useSpeechSettingsInit(isAuthenticated: boolean) {
   const { data } = useGetCustomConfigSpeechQuery({ enabled: isAuthenticated });
+  const [engineTTS, setEngineTTS] = useRecoilState<string>(store.engineTTS);
 
   const setters = useRef({
     conversationMode: useSetRecoilState(store.conversationMode),
@@ -22,7 +26,7 @@ export default function useSpeechSettingsInit(isAuthenticated: boolean) {
     autoTranscribeAudio: useSetRecoilState(store.autoTranscribeAudio),
     decibelValue: useSetRecoilState(store.decibelValue),
     autoSendText: useSetRecoilState(store.autoSendText),
-    engineTTS: useSetRecoilState(store.engineTTS),
+    engineTTS: setEngineTTS,
     voice: useSetRecoilState(store.voice),
     cloudBrowserVoices: useSetRecoilState(store.cloudBrowserVoices),
     languageTTS: useSetRecoilState(store.languageTTS),
@@ -47,4 +51,10 @@ export default function useSpeechSettingsInit(isAuthenticated: boolean) {
       }
     });
   }, [isAuthenticated, data, setters]);
+
+  useEffect(() => {
+    if (VALID_TTS_ENGINES.includes(engineTTS)) return;
+    logger.log(`Resetting invalid TTS engine "${engineTTS}" to ${TTSEndpoints.browser}`);
+    setEngineTTS(TTSEndpoints.browser);
+  }, [engineTTS, setEngineTTS]);
 }
diff --git a/client/src/hooks/Conversations/useNavigateToConvo.tsx b/client/src/hooks/Conversations/useNavigateToConvo.tsx
index ddb2bac6c9d..390f5b77d78 100644
--- a/client/src/hooks/Conversations/useNavigateToConvo.tsx
+++ b/client/src/hooks/Conversations/useNavigateToConvo.tsx
@@ -32,7 +32,6 @@ const useNavigateToConvo = (index = 0) => {
   const clearAllConversations = store.useClearConvoState();
   const applyModelSpecEffects = useApplyModelSpecEffects();
   const setSubmission = useSetRecoilState(store.submissionByIndex(index));
-  const clearAllLatestMessages = store.useClearLatestMessages(`useNavigateToConvo ${index}`);
   const { hasSetConversation, setConversation: setConvo } = store.useCreateConversationAtom(index);
 
   const setConversation = useCallback(
@@ -79,7 +78,6 @@ const useNavigateToConvo = (index = 0) => {
   const navigateToConvo = (
     conversation?: TConversation | null,
     options?: {
-      resetLatestMessage?: boolean;
       currentConvoId?: string;
     },
   ) => {
@@ -87,14 +85,10 @@ const useNavigateToConvo = (index = 0) => {
       logger.warn('conversation', 'Conversation not provided to `navigateToConvo`');
       return;
     }
-    const { resetLatestMessage = true, currentConvoId } = options || {};
+    const { currentConvoId } = options || {};
     logger.log('conversation', 'Navigating to conversation', conversation);
     hasSetConversation.current = true;
     setSubmission(null);
-    if (resetLatestMessage) {
-      logger.log('latest_message', 'Clearing all latest messages');
-      clearAllLatestMessages();
-    }
 
     let convo = { ...conversation };
     const endpointsConfig = queryClient.getQueryData<TEndpointsConfig>([QueryKeys.endpoints]);
@@ -125,6 +119,14 @@ const useNavigateToConvo = (index = 0) => {
     clearAllConversations(true);
     clearMessagesCache(queryClient, currentConvoId);
     if (convo.conversationId !== Constants.NEW_CONVO && convo.conversationId) {
+      /**
+       * Remove (not just invalidate) the target's messages so a freshly-mounted
+       * ChatView refetches them. A prior `clearMessagesCache` can leave this
+       * conversation cached as `[]`, which the messages query's `refetchOnMount: false`
+       * would treat as valid — leaving the chat stuck on an empty cache with no
+       * request when navigating in from a non-chat route (e.g. /projects).
+       */
+      queryClient.removeQueries([QueryKeys.messages, convo.conversationId]);
       queryClient.invalidateQueries([QueryKeys.conversation, convo.conversationId]);
       fetchFreshData(convo);
     } else {
diff --git a/client/src/hooks/Conversations/usePresetIndexOptions.ts b/client/src/hooks/Conversations/usePresetIndexOptions.ts
index 9824adef8cd..fda972a6d36 100644
--- a/client/src/hooks/Conversations/usePresetIndexOptions.ts
+++ b/client/src/hooks/Conversations/usePresetIndexOptions.ts
@@ -41,7 +41,7 @@ const usePresetIndexOptions: TUsePresetOptions = (_preset) => {
   const setExample: TSetExample = (i, type, newValue = null) => {
     const update = {};
     const current = preset?.examples?.slice() || [];
-    const currentExample = { ...current[i] } || {};
+    const currentExample = { ...current[i] };
     currentExample[type] = { content: newValue };
     current[i] = currentExample;
     update['examples'] = current;
diff --git a/client/src/hooks/Conversations/usePresets.ts b/client/src/hooks/Conversations/usePresets.ts
index 2165e1966e8..5ead8990049 100644
--- a/client/src/hooks/Conversations/usePresets.ts
+++ b/client/src/hooks/Conversations/usePresets.ts
@@ -218,7 +218,6 @@ export default function usePresets(index = 0) {
       newConversation({
         template: currentConvo,
         preset: currentConvo,
-        keepLatestMessage: true,
         keepAddedConvos: true,
         disableParams,
       });
diff --git a/client/src/hooks/Endpoint/UnknownIcon.tsx b/client/src/hooks/Endpoint/UnknownIcon.tsx
index be7531a34a2..e7b245a797f 100644
--- a/client/src/hooks/Endpoint/UnknownIcon.tsx
+++ b/client/src/hooks/Endpoint/UnknownIcon.tsx
@@ -4,28 +4,49 @@ import { CustomMinimalIcon, XAIcon, MoonshotIcon } from '@librechat/client';
 import { IconContext } from '~/common';
 import { cn } from '~/utils';
 
-const knownEndpointAssets = {
+const knownEndpointAssets: Record<string, string> = {
   [KnownEndpoints.anyscale]: 'assets/anyscale.png',
   [KnownEndpoints.apipie]: 'assets/apipie.png',
   [KnownEndpoints.cohere]: 'assets/cohere.png',
   [KnownEndpoints.deepseek]: 'assets/deepseek.svg',
   [KnownEndpoints.fireworks]: 'assets/fireworks.png',
-  [KnownEndpoints.google]: 'assets/google.svg',
+  google: 'assets/google.svg',
   [KnownEndpoints.groq]: 'assets/groq.png',
-  [KnownEndpoints.helicone]: 'assets/helicone.png',
+  [KnownEndpoints.helicone]: 'assets/helicone.svg',
   [KnownEndpoints.huggingface]: 'assets/huggingface.svg',
   [KnownEndpoints.mistral]: 'assets/mistral.png',
   [KnownEndpoints.mlx]: 'assets/mlx.png',
   [KnownEndpoints.ollama]: 'assets/ollama.png',
-  [KnownEndpoints.openai]: 'assets/openai.svg',
+  openai: 'assets/openai.svg',
   [KnownEndpoints.openrouter]: 'assets/openrouter.png',
   [KnownEndpoints.perplexity]: 'assets/perplexity.png',
-  [KnownEndpoints.qwen]: 'assets/qwen.svg',
+  qwen: 'assets/qwen.svg',
   [KnownEndpoints.shuttleai]: 'assets/shuttleai.png',
   [KnownEndpoints['together.ai']]: 'assets/together.png',
   [KnownEndpoints.unify]: 'assets/unify.webp',
 };
 
+const knownEndpointComponents = new Set<string>([KnownEndpoints.moonshot, KnownEndpoints.xai]);
+
+export function getKnownEndpointAsset(endpoint?: string | null): string {
+  if (!endpoint) {
+    return '';
+  }
+
+  return knownEndpointAssets[endpoint.toLowerCase()] ?? '';
+}
+
+export function hasKnownEndpointIcon(endpoint?: string | null): boolean {
+  if (!endpoint) {
+    return false;
+  }
+
+  const currentEndpoint = endpoint.toLowerCase();
+  return (
+    getKnownEndpointAsset(currentEndpoint) !== '' || knownEndpointComponents.has(currentEndpoint)
+  );
+}
+
 const knownEndpointClasses = {
   [KnownEndpoints.cohere]: {
     [IconContext.landing]: 'p-2',
@@ -81,7 +102,7 @@ function UnknownIcon({
     return <img className={className} src={iconURL} alt={`${endpoint} Icon`} />;
   }
 
-  const assetPath: string = knownEndpointAssets[currentEndpoint] ?? '';
+  const assetPath = getKnownEndpointAsset(currentEndpoint);
 
   if (!assetPath) {
     return <CustomMinimalIcon className={className} />;
diff --git a/client/src/hooks/Endpoint/useEndpoints.ts b/client/src/hooks/Endpoint/useEndpoints.ts
index dc72c0ddec6..6cec38dc2fe 100644
--- a/client/src/hooks/Endpoint/useEndpoints.ts
+++ b/client/src/hooks/Endpoint/useEndpoints.ts
@@ -16,9 +16,9 @@ import type {
   Agent,
 } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
+import { useHasAccess, useShowMarketplace } from '~/hooks';
 import { useGetEndpointsQuery } from '~/data-provider';
 import { mapEndpoints, getIconKey } from '~/utils';
-import { useHasAccess } from '~/hooks';
 import { icons } from './Icons';
 
 const defaultInterface = getConfigDefaults().interface;
@@ -46,6 +46,7 @@ export const useEndpoints = ({
     permissionType: PermissionTypes.AGENTS,
     permission: Permissions.USE,
   });
+  const showAgentMarketplace = useShowMarketplace();
 
   const assistants: Assistant[] = useMemo(
     () => Object.values(assistantsMap?.[EModelEndpoint.assistants] ?? {}),
@@ -83,18 +84,22 @@ export const useEndpoints = ({
   );
 
   const mappedEndpoints: Endpoint[] = useMemo(() => {
-    return filteredEndpoints.map((ep) => {
+    return filteredEndpoints.reduce<Endpoint[]>((acc, ep) => {
       const endpointType = getEndpointField(endpointsConfig, ep, 'type');
       const iconKey = getIconKey({ endpoint: ep, endpointsConfig, endpointType });
       const Icon = icons[iconKey];
       const endpointIconURL = getEndpointField(endpointsConfig, ep, 'iconURL');
       const hasModels =
-        (ep === EModelEndpoint.agents && (agents?.length ?? 0) > 0) ||
+        (ep === EModelEndpoint.agents && ((agents?.length ?? 0) > 0 || showAgentMarketplace)) ||
         (ep === EModelEndpoint.assistants && assistants?.length > 0) ||
         (ep !== EModelEndpoint.assistants &&
           ep !== EModelEndpoint.agents &&
           (modelsQuery.data?.[ep]?.length ?? 0) > 0);
 
+      if (ep === EModelEndpoint.agents && !hasModels) {
+        return acc;
+      }
+
       // Base result object with formatted default icon
       const result: Endpoint = {
         value: ep,
@@ -110,6 +115,11 @@ export const useEndpoints = ({
           : null,
       };
 
+      if (ep === EModelEndpoint.agents && showAgentMarketplace) {
+        result.showMarketplace = true;
+        result.searchAliases = ['agent marketplace', 'marketplace'];
+      }
+
       // Handle agents case
       if (ep === EModelEndpoint.agents && (agents?.length ?? 0) > 0) {
         result.models = agents?.map((agent) => ({
@@ -179,9 +189,18 @@ export const useEndpoints = ({
         }));
       }
 
-      return result;
-    });
-  }, [filteredEndpoints, endpointsConfig, modelsQuery.data, agents, assistants, azureAssistants]);
+      acc.push(result);
+      return acc;
+    }, []);
+  }, [
+    agents,
+    assistants,
+    azureAssistants,
+    endpointsConfig,
+    filteredEndpoints,
+    modelsQuery.data,
+    showAgentMarketplace,
+  ]);
 
   return {
     mappedEndpoints,
diff --git a/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.loop.spec.tsx b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.loop.spec.tsx
new file mode 100644
index 00000000000..7927af68d08
--- /dev/null
+++ b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.loop.spec.tsx
@@ -0,0 +1,166 @@
+/**
+ * Regression for issue #13916: hard-refreshing a conversation that
+ * contains a large (>1MB) code-execution office file crashed the app
+ * with React error #185 ("Maximum update depth exceeded").
+ *
+ * The loop only manifests with the REAL consumer wiring, which the
+ * focused unit spec (sibling file) can't reproduce because it passes a
+ * fixed `attachment` prop:
+ *
+ *   ContentRender → useAttachments (re-derives `attachment` with a fresh
+ *   identity on every messageAttachmentsMap write) → … → FileAttachment
+ *   → useAttachmentPreviewSync (writes the resolved record back into
+ *   messageAttachmentsMap; `attachment` is in the effect's deps).
+ *
+ * On a loaded conversation the message's attachment is frozen at the
+ * immediate-persist snapshot `status: 'pending'`; polling resolves it to
+ * `ready`, the effect writes it into the map, useAttachments re-derives a
+ * new attachment identity, the effect re-fires, and so on without ever
+ * reaching a fixed point. This test reproduces that exact feedback path
+ * and asserts it settles instead of looping.
+ */
+
+import { RecoilRoot } from 'recoil';
+import { Tools } from 'librechat-data-provider';
+import { render } from '@testing-library/react';
+import type {
+  TFile,
+  TAttachment,
+  TFilePreview,
+  TAttachmentMetadata,
+} from 'librechat-data-provider';
+
+const mockUseFilePreview = jest.fn();
+jest.mock('~/data-provider', () => ({
+  useFilePreview: (...args: unknown[]) => mockUseFilePreview(...args),
+}));
+jest.mock('~/hooks/useLocalize', () => () => (key: string) => key);
+
+import useAttachments from '~/hooks/Messages/useAttachments';
+import useAttachmentPreviewSync from '../useAttachmentPreviewSync';
+
+const messageId = 'msg-1';
+const fileId = 'fid-1';
+
+/** DB-frozen, immediate-persist snapshot: status pending, no text yet. */
+const dbAttachment = {
+  user: 'user-1',
+  object: 'file',
+  bytes: 1256732,
+  embedded: false,
+  usage: 0,
+  file_id: fileId,
+  filename: 'repro-13916-large.docx',
+  filepath: '/uploads/repro-13916-large.docx',
+  type: Tools.execute_code,
+  messageId,
+  toolCallId: 'tc-1',
+  text: undefined,
+  textFormat: undefined,
+  status: 'pending',
+} as TFile & TAttachmentMetadata as TAttachment;
+
+/* Stable array identity so the only identity churn during the test comes
+ * from messageAttachmentsMap writes, not from re-creating this prop. */
+const dbAttachments: TAttachment[] = [dbAttachment];
+
+let renderCount = 0;
+
+function PreviewBridge({ attachment }: { attachment: TAttachment }) {
+  renderCount += 1;
+  useAttachmentPreviewSync(attachment);
+  return null;
+}
+
+/** Mirrors ContentRender: the rendered attachment is the merged value
+ * produced by useAttachments, re-derived from the live map on each write. */
+function Consumer() {
+  const { attachments } = useAttachments({ messageId, attachments: dbAttachments });
+  const attachment = attachments[0];
+  if (!attachment) {
+    return null;
+  }
+  return <PreviewBridge attachment={attachment} />;
+}
+
+describe('useAttachmentPreviewSync — #13916 infinite-loop regression', () => {
+  beforeEach(() => {
+    renderCount = 0;
+    mockUseFilePreview.mockReset();
+  });
+
+  it('settles (no React #185) when a pending code-exec preview resolves to ready on load', () => {
+    mockUseFilePreview.mockReturnValue({
+      data: {
+        file_id: fileId,
+        status: 'ready',
+        text: '<p>edited paragraph added</p>',
+        textFormat: 'html',
+      } as TFilePreview,
+      isFetching: false,
+    });
+
+    expect(() =>
+      render(
+        <RecoilRoot>
+          <Consumer />
+        </RecoilRoot>,
+      ),
+    ).not.toThrow();
+    /* A correct fixed point reaches the resolved state in a handful of
+     * renders. A regressed write-back would blow past React's nested
+     * update ceiling (50) and throw long before any sane bound. */
+    expect(renderCount).toBeLessThan(10);
+  });
+
+  it('still merges the resolved record into the map exactly once', () => {
+    let latestMap: Record<string, TAttachment[] | undefined> = {};
+    mockUseFilePreview.mockReturnValue({
+      data: {
+        file_id: fileId,
+        status: 'ready',
+        text: '<p>final</p>',
+        textFormat: 'html',
+      } as TFilePreview,
+      isFetching: false,
+    });
+
+    function MapProbe() {
+      const { attachments } = useAttachments({ messageId, attachments: dbAttachments });
+      latestMap = { [messageId]: attachments };
+      const attachment = attachments[0];
+      return attachment ? <PreviewBridge attachment={attachment} /> : null;
+    }
+
+    render(
+      <RecoilRoot>
+        <MapProbe />
+      </RecoilRoot>,
+    );
+
+    const resolved = latestMap[messageId]?.[0] as TFile & TAttachmentMetadata;
+    expect(resolved.status).toBe('ready');
+    expect(resolved.text).toBe('<p>final</p>');
+    expect(resolved.textFormat).toBe('html');
+  });
+
+  it('settles for a failed resolution too', () => {
+    mockUseFilePreview.mockReturnValue({
+      data: {
+        file_id: fileId,
+        status: 'failed',
+        previewError: 'render-timeout',
+      } as TFilePreview,
+      isFetching: false,
+    });
+
+    expect(() =>
+      render(
+        <RecoilRoot>
+          <Consumer />
+        </RecoilRoot>,
+      ),
+    ).not.toThrow();
+    expect(renderCount).toBeLessThan(10);
+  });
+});
diff --git a/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
index 096ec9fd832..85eb353bebd 100644
--- a/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
+++ b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
@@ -16,12 +16,20 @@
  */
 
 import { useEffect } from 'react';
+import { Tools } from 'librechat-data-provider';
 import { renderHook } from '@testing-library/react';
 import { RecoilRoot, useRecoilValue, useSetRecoilState } from 'recoil';
+import type {
+  TAttachment,
+  TFile,
+  TAttachmentMetadata,
+  TFilePreview,
+} from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment, TFilePreview } from 'librechat-data-provider';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 const mockUseFilePreview = jest.fn();
 jest.mock('~/data-provider', () => ({
   useFilePreview: (...args: unknown[]) => mockUseFilePreview(...args),
@@ -34,19 +42,24 @@ const wrapper = ({ children }: { children: ReactNode }) => <RecoilRoot>{children
 const messageId = 'msg-1';
 const fileId = 'fid-1';
 
-function makeAttachment(overrides: Partial<TAttachment> = {}): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture> = {}): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: fileId,
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 /** Read messageAttachmentsMap and bridge it out via a mutable ref. */
@@ -261,7 +274,7 @@ describe('useAttachmentPreviewSync', () => {
         textFormat: 'html',
       },
     });
-    const updated = ctx.map[messageId]?.[0] as TAttachment & { text?: string };
+    const updated = ctx.map[messageId]?.[0] as AttachmentFixture;
     expect(updated.status).toBe('ready');
     expect(updated.text).toBe('<table>final</table>');
     expect(ctx.result.current.status).toBe('ready');
@@ -277,7 +290,7 @@ describe('useAttachmentPreviewSync', () => {
         previewError: 'parser-error',
       },
     });
-    const updated = ctx.map[messageId]?.[0] as TAttachment & { previewError?: string };
+    const updated = ctx.map[messageId]?.[0] as AttachmentFixture;
     expect(updated.status).toBe('failed');
     expect(updated.previewError).toBe('parser-error');
     expect(ctx.result.current.status).toBe('failed');
@@ -293,7 +306,7 @@ describe('useAttachmentPreviewSync', () => {
     /* Map should be unchanged from the initial seed — no patch. */
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    expect((list[0] as TAttachment & { status?: string }).status).toBe('pending');
+    expect((list[0] as AttachmentFixture).status).toBe('pending');
   });
 
   it('reports isPolling true when the query is fetching and the gate is open', () => {
@@ -336,7 +349,7 @@ describe('useAttachmentPreviewSync', () => {
     });
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    const inserted = list[0] as TAttachment & { text?: string; textFormat?: string };
+    const inserted = list[0] as AttachmentFixture;
     expect(inserted.file_id).toBe(fileId);
     expect(inserted.status).toBe('ready');
     expect(inserted.text).toBe('<table>resolved-on-reload</table>');
@@ -361,7 +374,7 @@ describe('useAttachmentPreviewSync', () => {
     });
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    const inserted = list[0] as TAttachment & { previewError?: string };
+    const inserted = list[0] as AttachmentFixture;
     expect(inserted.status).toBe('failed');
     expect(inserted.previewError).toBe('render-timeout');
   });
diff --git a/client/src/hooks/Files/__tests__/useFileHandling.test.ts b/client/src/hooks/Files/__tests__/useFileHandling.test.ts
index 0a07c5f2b44..d7bd6eb7133 100644
--- a/client/src/hooks/Files/__tests__/useFileHandling.test.ts
+++ b/client/src/hooks/Files/__tests__/useFileHandling.test.ts
@@ -4,13 +4,30 @@ import { Constants, EModelEndpoint, getEndpointFileConfig } from 'librechat-data
 beforeAll(() => {
   global.URL.createObjectURL = jest.fn(() => 'blob:mock-url');
   global.URL.revokeObjectURL = jest.fn();
+  Object.defineProperty(global, 'Image', {
+    writable: true,
+    value: class {
+      width = 640;
+      height = 480;
+      onload: (() => void) | null = null;
+
+      set src(_src: string) {
+        queueMicrotask(() => this.onload?.());
+      }
+    },
+  });
 });
 
 const mockShowToast = jest.fn();
 const mockSetFilesLoading = jest.fn();
 const mockMutate = jest.fn();
+const mockProcessFileForUpload = jest.fn(
+  async (_file: File, _quality?: number, _onProgress?: (progress: number) => void) => _file,
+);
+const mockLocalize = jest.fn((key: string) => key);
 
 let mockConversation: Record<string, string | null | undefined> = {};
+let mockIsTemporary = false;
 
 jest.mock('~/Providers/ChatContext', () => ({
   useChatContext: jest.fn(() => ({
@@ -30,9 +47,12 @@ jest.mock('@librechat/client', () => ({
 jest.mock('recoil', () => ({
   ...jest.requireActual('recoil'),
   useSetRecoilState: jest.fn(() => jest.fn()),
+  useRecoilValue: jest.fn(() => mockIsTemporary),
 }));
 
 jest.mock('~/store', () => ({
+  __esModule: true,
+  default: { isTemporary: { key: 'isTemporary' } },
   ephemeralAgentByConvoId: jest.fn(() => ({ key: 'mock' })),
 }));
 
@@ -51,7 +71,7 @@ jest.mock('~/data-provider', () => ({
 }));
 
 jest.mock('~/hooks/useLocalize', () => {
-  const fn = jest.fn((key: string) => key) as jest.Mock & {
+  const fn = jest.fn(() => mockLocalize) as jest.Mock & {
     TranslationKeys: Record<string, never>;
   };
   fn.TranslationKeys = {};
@@ -66,7 +86,7 @@ jest.mock('../useDelayedUploadToast', () => ({
 }));
 
 jest.mock('~/utils/heicConverter', () => ({
-  processFileForUpload: jest.fn(async (file: File) => file),
+  processFileForUpload: mockProcessFileForUpload,
 }));
 
 jest.mock('../useClientResize', () => ({
@@ -98,12 +118,28 @@ const mockValidateFiles = jest.requireMock('~/utils').validateFiles;
 describe('useFileHandling', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockProcessFileForUpload.mockImplementation(async (file: File) => file);
     mockConversation = {};
+    mockIsTemporary = false;
   });
 
   const loadHook = async () => (await import('../useFileHandling')).default;
 
   describe('endpointOverride', () => {
+    it('uploads non-HEIC images without running HEIC conversion', async () => {
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() => useFileHandling());
+
+      const imageFile = new File(['maybe-heic'], 'photo.jpg', { type: 'image/jpeg' });
+
+      await act(async () => {
+        await result.current.handleFiles([imageFile]);
+      });
+
+      expect(mockProcessFileForUpload).not.toHaveBeenCalled();
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+    });
+
     it('uses conversation endpoint when no override is provided', async () => {
       mockConversation = {
         conversationId: 'convo-1',
@@ -209,6 +245,7 @@ describe('useFileHandling', () => {
       const formData: FormData = mockMutate.mock.calls[0][0];
       expect(formData.get('endpoint')).toBe(EModelEndpoint.agents);
       expect(formData.get('endpointType')).toBe(EModelEndpoint.agents);
+      expect(formData.get('conversationId')).toBeNull();
     });
 
     it('does not enter assistants upload path when override is agents', async () => {
@@ -284,6 +321,118 @@ describe('useFileHandling', () => {
       expect(mockMutate).toHaveBeenCalledTimes(1);
       const formData: FormData = mockMutate.mock.calls[0][0];
       expect(formData.get('endpoint')).toBe('default');
+      expect(formData.get('conversationId')).toBeNull();
+    });
+
+    it('sends temporary flag for temporary chat uploads', async () => {
+      mockIsTemporary = true;
+      mockConversation = {
+        conversationId: Constants.NEW_CONVO as string,
+        endpoint: 'openAI',
+        endpointType: 'custom',
+      };
+
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() => useFileHandling());
+
+      const textFile = new File(['hello'], 'test.txt', { type: 'text/plain' });
+
+      await act(async () => {
+        await result.current.handleFiles([textFile]);
+      });
+
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+      const formData: FormData = mockMutate.mock.calls[0][0];
+      expect(formData.get('conversationId')).toBeNull();
+      expect(formData.get('isTemporary')).toBe('true');
+    });
+
+    it('does not send temporary flag for assistant builder uploads', async () => {
+      mockIsTemporary = true;
+      mockConversation = {
+        conversationId: 'temporary-convo',
+        endpoint: 'openAI',
+        endpointType: 'custom',
+      };
+
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() =>
+        useFileHandling({
+          additionalMetadata: { assistant_id: 'asst-123' },
+        }),
+      );
+
+      const textFile = new File(['hello'], 'test.txt', { type: 'text/plain' });
+
+      await act(async () => {
+        await result.current.handleFiles([textFile]);
+      });
+
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+      const formData: FormData = mockMutate.mock.calls[0][0];
+      expect(formData.get('assistant_id')).toBe('asst-123');
+      expect(formData.get('conversationId')).toBeNull();
+      expect(formData.get('isTemporary')).toBeNull();
+    });
+
+    it('does not send temporary flag for agent builder uploads', async () => {
+      mockIsTemporary = true;
+      mockConversation = {
+        conversationId: 'temporary-convo',
+        endpoint: 'openAI',
+        endpointType: 'custom',
+      };
+
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() =>
+        useFileHandling({
+          endpointOverride: EModelEndpoint.agents,
+          additionalMetadata: { agent_id: 'agent-123' },
+        }),
+      );
+
+      const textFile = new File(['hello'], 'test.txt', { type: 'text/plain' });
+
+      await act(async () => {
+        await result.current.handleFiles([textFile]);
+      });
+
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+      const formData: FormData = mockMutate.mock.calls[0][0];
+      expect(formData.get('agent_id')).toBe('agent-123');
+      expect(formData.get('conversationId')).toBeNull();
+      expect(formData.get('isTemporary')).toBeNull();
+    });
+
+    it('awaits HEIC conversion before uploading the converted file', async () => {
+      const convertedFile = new File(['jpeg data'], 'photo.jpg', { type: 'image/jpeg' });
+      mockProcessFileForUpload.mockImplementationOnce(
+        async (_file: File, _quality?: number, onProgress?: (progress: number) => void) => {
+          onProgress?.(1);
+          return convertedFile;
+        },
+      );
+
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() => useFileHandling());
+
+      const heicFile = new File(['heic data'], 'photo.bin', { type: 'image/heic' });
+
+      await act(async () => {
+        await result.current.handleFiles([heicFile]);
+      });
+
+      expect(mockShowToast).toHaveBeenCalledWith({
+        message: 'com_info_heic_converting',
+        status: 'info',
+        duration: 3000,
+      });
+      expect(mockProcessFileForUpload).toHaveBeenCalledWith(heicFile, 0.9, expect.any(Function));
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+      const formData: FormData = mockMutate.mock.calls[0][0];
+      const uploadedFile = formData.get('file') as File;
+      expect(uploadedFile.name).toBe('photo.jpg');
+      expect(uploadedFile.type).toBe('image/jpeg');
     });
   });
 });
diff --git a/client/src/hooks/Files/useAttachmentPreviewSync.ts b/client/src/hooks/Files/useAttachmentPreviewSync.ts
index d339118c20f..483344ceea4 100644
--- a/client/src/hooks/Files/useAttachmentPreviewSync.ts
+++ b/client/src/hooks/Files/useAttachmentPreviewSync.ts
@@ -2,6 +2,7 @@ import { useEffect, useRef } from 'react';
 import { useRecoilCallback, useSetRecoilState } from 'recoil';
 import type { TAttachment, TFile, TFilePreview } from 'librechat-data-provider';
 import { useFilePreview } from '~/data-provider';
+import { useShareContext } from '~/Providers';
 import store from '~/store';
 
 interface UseAttachmentPreviewSyncResult {
@@ -99,9 +100,10 @@ export default function useAttachmentPreviewSync(
   const baseStatus: 'pending' | 'ready' | 'failed' = file?.status ?? 'ready';
   const messageId = (attachment as Partial<TAttachment> | undefined)?.messageId;
 
+  const { shareId } = useShareContext();
   const enabled = !!fileId && baseStatus === 'pending';
 
-  const previewQuery = useFilePreview(fileId, { enabled });
+  const previewQuery = useFilePreview(fileId, { enabled }, shareId);
 
   /* Effective status: prefer the polled record once it arrives, since
    * the SSE handler may have already moved the cache forward and the
@@ -161,6 +163,25 @@ export default function useAttachmentPreviewSync(
     if (!polled || polled.status === 'pending' || !messageId || !fileId || !attachment) {
       return;
     }
+    /* Idempotency gate. `useAttachments` re-derives `attachment` with a
+     * fresh object identity on every messageAttachmentsMap write, and
+     * `attachment` is in this effect's deps — so without a gate the
+     * write-back ping-pongs forever (setAttachmentsMap → re-derive →
+     * effect → setAttachmentsMap …), tripping React's "Maximum update
+     * depth exceeded" (#185) once the preview resolves on a loaded
+     * conversation. Once the merged attachment already carries the
+     * resolved fields, there's nothing to write — stop. */
+    const current = attachment as Partial<TFile> & TAttachment;
+    const nextText = polled.text ?? current.text ?? null;
+    const nextTextFormat = polled.textFormat ?? current.textFormat ?? null;
+    if (
+      current.status === polled.status &&
+      current.text === nextText &&
+      current.textFormat === nextTextFormat &&
+      current.previewError === polled.previewError
+    ) {
+      return;
+    }
     setAttachmentsMap((prevMap) => {
       const messageAttachments =
         (prevMap as Record<string, TAttachment[] | undefined>)[messageId] || [];
diff --git a/client/src/hooks/Files/useDragHelpers.ts b/client/src/hooks/Files/useDragHelpers.ts
index 7c6c3bd1557..847884c9882 100644
--- a/client/src/hooks/Files/useDragHelpers.ts
+++ b/client/src/hooks/Files/useDragHelpers.ts
@@ -83,7 +83,7 @@ export default function useDragHelpers() {
         currentEndpoint,
         agent?.provider,
       );
-      const cfg = queryClient.getQueryData<t.FileConfig>([QueryKeys.fileConfig]);
+      const cfg = queryClient.getQueryData<t.TFileConfig>([QueryKeys.fileConfig]);
       if (cfg) {
         const mergedCfg = mergeFileConfig(cfg);
         const endpointCfg = getEndpointFileConfig({
diff --git a/client/src/hooks/Files/useFileHandling.ts b/client/src/hooks/Files/useFileHandling.ts
index 635937a6fa4..2608a45e11f 100644
--- a/client/src/hooks/Files/useFileHandling.ts
+++ b/client/src/hooks/Files/useFileHandling.ts
@@ -1,8 +1,9 @@
 import React, { useCallback, useEffect, useRef, useMemo, useState } from 'react';
 import { v4 } from 'uuid';
-import { useSetRecoilState } from 'recoil';
+import debounce from 'lodash/debounce';
 import { useToastContext } from '@librechat/client';
 import { useQueryClient } from '@tanstack/react-query';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
 import {
   QueryKeys,
   Constants,
@@ -12,17 +13,15 @@ import {
   getEndpointFileConfig,
   defaultAssistantsVersion,
 } from 'librechat-data-provider';
-import debounce from 'lodash/debounce';
 import type { EModelEndpoint, TEndpointsConfig, TError } from 'librechat-data-provider';
-import type { ExtendedFile, FileSetter } from '~/common';
 import type { TConversation } from 'librechat-data-provider';
+import type { ExtendedFile, FileSetter } from '~/common';
 import { logger, validateFiles, cachePreview, getCachedPreview, removePreviewEntry } from '~/utils';
 import { useGetFileConfig, useUploadFileMutation } from '~/data-provider';
 import useLocalize, { TranslationKeys } from '~/hooks/useLocalize';
 import { useDelayedUploadToast } from './useDelayedUploadToast';
-import { processFileForUpload } from '~/utils/heicConverter';
 import { useChatContext } from '~/Providers/ChatContext';
-import { ephemeralAgentByConvoId } from '~/store';
+import store, { ephemeralAgentByConvoId } from '~/store';
 import useClientResize from './useClientResize';
 import useUpdateFiles from './useUpdateFiles';
 
@@ -57,6 +56,7 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
   const setEphemeralAgent = useSetRecoilState(
     ephemeralAgentByConvoId(conversation?.conversationId ?? Constants.NEW_CONVO),
   );
+  const isTemporary = useRecoilValue(store.isTemporary);
   const setError = (error: string) => setErrors((prevErrors) => [...prevErrors, error]);
   const { addFile, replaceFile, updateFileById, deleteFileById } = useUpdateFiles(
     params?.fileSetter ?? setFiles,
@@ -65,6 +65,7 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
 
   const agent_id = params?.additionalMetadata?.agent_id ?? '';
   const assistant_id = params?.additionalMetadata?.assistant_id ?? '';
+  const isConversationUpload = !agent_id && !assistant_id;
   const endpointOverride = params?.endpointOverride;
   const endpointTypeOverride = params?.endpointTypeOverride;
   const endpointType = useMemo(
@@ -192,6 +193,16 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
     formData.append('endpointType', endpointType ?? '');
     formData.append('file', extendedFile.file as File, encodeURIComponent(filename));
     formData.append('file_id', extendedFile.file_id);
+    if (
+      isConversationUpload &&
+      conversation?.conversationId &&
+      conversation.conversationId !== Constants.NEW_CONVO
+    ) {
+      formData.append('conversationId', conversation.conversationId);
+    }
+    if (isTemporary && isConversationUpload) {
+      formData.append('isTemporary', 'true');
+    }
 
     const width = extendedFile.width ?? 0;
     const height = extendedFile.height ?? 0;
@@ -327,11 +338,13 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
         // Add file immediately to show in UI
         addFile(initialExtendedFile);
 
+        const originalFileName = originalFile.name.toLowerCase();
+
         // Check if HEIC conversion is needed and show toast
         const isHEIC =
           originalFile.type === 'image/heic' ||
           originalFile.type === 'image/heif' ||
-          originalFile.name.toLowerCase().match(/\.(heic|heif)$/);
+          /\.(heic|heif)$/.test(originalFileName);
 
         if (isHEIC) {
           showToast({
@@ -341,19 +354,17 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
           });
         }
 
-        // Process file for HEIC conversion if needed
-        const heicProcessedFile = await processFileForUpload(
-          originalFile,
-          0.9,
-          (conversionProgress) => {
-            // Update progress during HEIC conversion (0.1 to 0.5 range for conversion)
-            const adjustedProgress = 0.1 + conversionProgress * 0.4;
-            replaceFile({
-              ...initialExtendedFile,
-              progress: adjustedProgress,
-            });
-          },
-        );
+        const heicProcessedFile = isHEIC
+          ? await import('~/utils/heicConverter').then(({ processFileForUpload }) =>
+              processFileForUpload(originalFile, 0.9, (conversionProgress) => {
+                const adjustedProgress = 0.1 + conversionProgress * 0.4;
+                replaceFile({
+                  ...initialExtendedFile,
+                  progress: adjustedProgress,
+                });
+              }),
+            )
+          : originalFile;
 
         let finalProcessedFile = heicProcessedFile;
 
diff --git a/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx b/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx
new file mode 100644
index 00000000000..57a08edc02d
--- /dev/null
+++ b/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx
@@ -0,0 +1,115 @@
+import { renderHook, act } from '@testing-library/react';
+import useElementSize from '../useElementSize';
+
+class MockResizeObserver {
+  static instances: MockResizeObserver[] = [];
+  callback: ResizeObserverCallback;
+  observed: Element[] = [];
+  disconnected = false;
+
+  constructor(callback: ResizeObserverCallback) {
+    this.callback = callback;
+    MockResizeObserver.instances.push(this);
+  }
+
+  observe(element: Element) {
+    this.observed.push(element);
+  }
+
+  unobserve() {}
+
+  disconnect() {
+    this.disconnected = true;
+  }
+
+  trigger(contentRect: { width: number; height: number }) {
+    this.callback(
+      [{ contentRect, target: this.observed[0] } as ResizeObserverEntry],
+      this as unknown as ResizeObserver,
+    );
+  }
+}
+
+describe('useElementSize', () => {
+  const originalResizeObserver = window.ResizeObserver;
+
+  beforeEach(() => {
+    MockResizeObserver.instances = [];
+    window.ResizeObserver = MockResizeObserver as unknown as typeof ResizeObserver;
+  });
+
+  afterAll(() => {
+    window.ResizeObserver = originalResizeObserver;
+  });
+
+  it('reports zero size before an element is attached', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    expect(result.current.width).toBe(0);
+    expect(result.current.height).toBe(0);
+  });
+
+  it('observes the attached element and reports floored content-box size', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+
+    act(() => result.current.ref(node));
+
+    const observer = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+    expect(observer.observed).toContain(node);
+
+    act(() => observer.trigger({ width: 320.6, height: 480.2 }));
+    expect(result.current.width).toBe(320);
+    expect(result.current.height).toBe(480);
+
+    act(() => observer.trigger({ width: 360, height: 480 }));
+    expect(result.current.width).toBe(360);
+  });
+
+  it('re-observes when the element remounts', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const first = document.createElement('div');
+    const second = document.createElement('div');
+
+    act(() => result.current.ref(first));
+    const firstObserver = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+
+    act(() => result.current.ref(null));
+    expect(firstObserver.disconnected).toBe(true);
+
+    act(() => result.current.ref(second));
+    const secondObserver = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+    expect(secondObserver).not.toBe(firstObserver);
+    expect(secondObserver.observed).toContain(second);
+  });
+
+  it('disconnects the observer on unmount', () => {
+    const { result, unmount } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+
+    act(() => result.current.ref(node));
+    const observer = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+
+    unmount();
+    expect(observer.disconnected).toBe(true);
+  });
+
+  it('falls back to offset measurements when ResizeObserver is unavailable', () => {
+    window.ResizeObserver = undefined as unknown as typeof ResizeObserver;
+
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+    let offsetWidth = 280;
+    Object.defineProperty(node, 'offsetWidth', { get: () => offsetWidth, configurable: true });
+    Object.defineProperty(node, 'offsetHeight', { value: 500 });
+
+    act(() => result.current.ref(node));
+    expect(result.current.width).toBe(280);
+    expect(result.current.height).toBe(500);
+
+    offsetWidth = 320;
+    act(() => {
+      window.dispatchEvent(new Event('resize'));
+    });
+    expect(result.current.width).toBe(320);
+  });
+});
diff --git a/client/src/hooks/Generic/index.ts b/client/src/hooks/Generic/index.ts
index 9674014afa2..2dc02f273b3 100644
--- a/client/src/hooks/Generic/index.ts
+++ b/client/src/hooks/Generic/index.ts
@@ -1,2 +1,3 @@
 export * from './useLazyEffect';
 export { default as useShiftKey } from './useShiftKey';
+export { default as useElementSize } from './useElementSize';
diff --git a/client/src/hooks/Generic/useElementSize.ts b/client/src/hooks/Generic/useElementSize.ts
new file mode 100644
index 00000000000..57587696b36
--- /dev/null
+++ b/client/src/hooks/Generic/useElementSize.ts
@@ -0,0 +1,51 @@
+import { useCallback, useLayoutEffect, useState } from 'react';
+
+interface ElementSize {
+  width: number;
+  height: number;
+}
+
+interface UseElementSizeResult<T extends HTMLElement> {
+  ref: (node: T | null) => void;
+  width: number;
+  height: number;
+}
+
+/**
+ * Tracks an element's content-box size via ResizeObserver. Returns a callback
+ * ref so conditionally rendered elements are re-observed when they remount.
+ */
+export default function useElementSize<T extends HTMLElement>(): UseElementSizeResult<T> {
+  const [node, setNode] = useState<T | null>(null);
+  const [size, setSize] = useState<ElementSize>({ width: 0, height: 0 });
+
+  const ref = useCallback((element: T | null) => setNode(element), []);
+
+  useLayoutEffect(() => {
+    if (!node) {
+      return;
+    }
+    const apply = (width: number, height: number) =>
+      setSize((prev) =>
+        prev.width === width && prev.height === height ? prev : { width, height },
+      );
+    const measure = () => apply(node.offsetWidth, node.offsetHeight);
+
+    measure();
+    if (typeof ResizeObserver === 'undefined') {
+      window.addEventListener('resize', measure);
+      return () => window.removeEventListener('resize', measure);
+    }
+    const observer = new ResizeObserver((entries) => {
+      const entry = entries[entries.length - 1];
+      if (!entry) {
+        return;
+      }
+      apply(Math.floor(entry.contentRect.width), Math.floor(entry.contentRect.height));
+    });
+    observer.observe(node);
+    return () => observer.disconnect();
+  }, [node]);
+
+  return { ref, width: size.width, height: size.height };
+}
diff --git a/client/src/hooks/Input/mentions.spec.ts b/client/src/hooks/Input/mentions.spec.ts
new file mode 100644
index 00000000000..4eefed12c5e
--- /dev/null
+++ b/client/src/hooks/Input/mentions.spec.ts
@@ -0,0 +1,50 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import { filterMentionEndpoints } from './mentions';
+
+describe('filterMentionEndpoints', () => {
+  const endpoints = [EModelEndpoint.anthropic, EModelEndpoint.bedrock, EModelEndpoint.agents];
+
+  it('limits mention endpoints to model spec addedEndpoints', () => {
+    const result = filterMentionEndpoints({
+      endpoints,
+      includedEndpoints: new Set([EModelEndpoint.agents]),
+      includeAssistants: true,
+      hasAgentAccess: true,
+    });
+
+    expect(result).toEqual([EModelEndpoint.agents]);
+  });
+
+  it('keeps provider endpoints when no model spec allow-list is configured', () => {
+    const result = filterMentionEndpoints({
+      endpoints,
+      includedEndpoints: new Set(),
+      includeAssistants: true,
+      hasAgentAccess: true,
+    });
+
+    expect(result).toEqual(endpoints);
+  });
+
+  it('excludes agents when the user lacks agent access', () => {
+    const result = filterMentionEndpoints({
+      endpoints,
+      includedEndpoints: new Set([EModelEndpoint.agents]),
+      includeAssistants: true,
+      hasAgentAccess: false,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it('excludes assistants when they are not included for the mention menu', () => {
+    const result = filterMentionEndpoints({
+      endpoints: [EModelEndpoint.assistants, EModelEndpoint.azureAssistants, EModelEndpoint.openAI],
+      includedEndpoints: new Set(),
+      includeAssistants: false,
+      hasAgentAccess: true,
+    });
+
+    expect(result).toEqual([EModelEndpoint.openAI]);
+  });
+});
diff --git a/client/src/hooks/Input/mentions.ts b/client/src/hooks/Input/mentions.ts
new file mode 100644
index 00000000000..7190b9ae352
--- /dev/null
+++ b/client/src/hooks/Input/mentions.ts
@@ -0,0 +1,31 @@
+import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
+
+export function filterMentionEndpoints({
+  endpoints,
+  includedEndpoints,
+  includeAssistants,
+  hasAgentAccess,
+}: {
+  endpoints: Array<EModelEndpoint | string>;
+  includedEndpoints: Set<string>;
+  includeAssistants: boolean;
+  hasAgentAccess: boolean;
+}) {
+  const hasEndpointAllowList = includedEndpoints.size > 0;
+
+  return endpoints.filter((endpoint) => {
+    if (!includeAssistants && isAssistantsEndpoint(endpoint)) {
+      return false;
+    }
+
+    if (isAgentsEndpoint(endpoint) && !hasAgentAccess) {
+      return false;
+    }
+
+    if (hasEndpointAllowList && !includedEndpoints.has(endpoint)) {
+      return false;
+    }
+
+    return true;
+  });
+}
diff --git a/client/src/hooks/Input/useHandleKeyUp.spec.ts b/client/src/hooks/Input/useHandleKeyUp.spec.ts
index 8148340e080..51b6cf85542 100644
--- a/client/src/hooks/Input/useHandleKeyUp.spec.ts
+++ b/client/src/hooks/Input/useHandleKeyUp.spec.ts
@@ -12,9 +12,6 @@ const mockCommandToggles = { at: true, plus: true, slash: true, dollar: true };
 jest.mock('recoil', () => ({
   ...jest.requireActual('recoil'),
   useRecoilValue: jest.fn((atom) => {
-    if (atom === 'latestMessageFamily-0') {
-      return null;
-    }
     if (atom === 'effectiveEndpointByIndex-0') {
       return mockEndpoint.current;
     }
@@ -55,7 +52,6 @@ jest.mock('~/store', () => ({
   showPlusPopoverFamily: (idx: number) => `showPlusPopoverFamily-${idx}`,
   showSkillsPopoverFamily: (idx: number) => `showSkillsPopoverFamily-${idx}`,
   effectiveEndpointByIndex: (idx: number) => `effectiveEndpointByIndex-${idx}`,
-  latestMessageFamily: (idx: number) => `latestMessageFamily-${idx}`,
   atCommand: 'atCommand',
   plusCommand: 'plusCommand',
   slashCommand: 'slashCommand',
@@ -87,6 +83,10 @@ jest.mock('~/hooks/Agents/useAgentCapabilities', () =>
   })),
 );
 
+jest.mock('~/hooks/Messages/useLatestMessage', () => ({
+  useLatestMessage: jest.fn(() => null),
+}));
+
 import React from 'react';
 import { renderHook, act } from '@testing-library/react';
 import useHandleKeyUp from './useHandleKeyUp';
diff --git a/client/src/hooks/Input/useHandleKeyUp.ts b/client/src/hooks/Input/useHandleKeyUp.ts
index e9af8b4a95a..fa94e68f076 100644
--- a/client/src/hooks/Input/useHandleKeyUp.ts
+++ b/client/src/hooks/Input/useHandleKeyUp.ts
@@ -4,6 +4,7 @@ import { PermissionTypes, Permissions, isAssistantsEndpoint } from 'librechat-da
 import useAgentCapabilities from '~/hooks/Agents/useAgentCapabilities';
 import useGetAgentsConfig from '~/hooks/Agents/useGetAgentsConfig';
 import useHasAccess from '~/hooks/Roles/useHasAccess';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import store from '~/store';
 
 /** Event keys that shouldn't trigger a command */
@@ -69,7 +70,7 @@ const useHandleKeyUp = ({
   });
   const { agentsConfig } = useGetAgentsConfig();
   const { skillsEnabled } = useAgentCapabilities(agentsConfig?.capabilities);
-  const latestMessage = useRecoilValue(store.latestMessageFamily(index));
+  const latestMessage = useLatestMessage(index);
   const endpoint = useRecoilValue(store.effectiveEndpointByIndex(index));
   const setShowMentionPopover = useSetRecoilState(store.showMentionPopoverFamily(index));
   const setShowPlusPopover = useSetRecoilState(store.showPlusPopoverFamily(index));
diff --git a/client/src/hooks/Input/useMentions.ts b/client/src/hooks/Input/useMentions.ts
index 0c16bcc1ce1..420f823e23d 100644
--- a/client/src/hooks/Input/useMentions.ts
+++ b/client/src/hooks/Input/useMentions.ts
@@ -23,6 +23,7 @@ import { useAgentsMapContext } from '~/Providers/AgentsMapContext';
 import { mapEndpoints, getPresetTitle } from '~/utils';
 import { EndpointIcon } from '~/components/Endpoints';
 import useHasAccess from '~/hooks/Roles/useHasAccess';
+import { filterMentionEndpoints } from './mentions';
 
 const defaultInterface = getConfigDefaults().interface;
 
@@ -82,7 +83,25 @@ export default function useMentions({
     () => startupConfig?.interface ?? defaultInterface,
     [startupConfig?.interface],
   );
-  const agentQueryEnabled = hasAgentAccess && interfaceConfig.modelSelect === true;
+  const includedEndpoints = useMemo(
+    () => new Set(startupConfig?.modelSpecs?.addedEndpoints ?? []),
+    [startupConfig?.modelSpecs?.addedEndpoints],
+  );
+  const validEndpoints = useMemo(
+    () =>
+      filterMentionEndpoints({
+        endpoints,
+        includedEndpoints,
+        includeAssistants,
+        hasAgentAccess,
+      }),
+    [endpoints, includedEndpoints, includeAssistants, hasAgentAccess],
+  );
+  const validEndpointSet = useMemo(() => new Set(validEndpoints), [validEndpoints]);
+  const agentQueryEnabled =
+    hasAgentAccess &&
+    interfaceConfig.modelSelect === true &&
+    (includedEndpoints.size === 0 || includedEndpoints.has(EModelEndpoint.agents));
   const { data: agentsList = null, isLoading: isLoadingAgents } = useListAgentsQuery(
     { requiredPermission: PermissionBits.VIEW },
     {
@@ -152,11 +171,6 @@ export default function useMentions({
   }, [startupConfig, agentsMap]);
 
   const options: MentionOption[] = useMemo(() => {
-    let validEndpoints = endpoints;
-    if (!includeAssistants) {
-      validEndpoints = endpoints.filter((endpoint) => !isAssistantsEndpoint(endpoint));
-    }
-
     const modelOptions = validEndpoints.flatMap((endpoint) => {
       if (isAssistantsEndpoint(endpoint) || isAgentsEndpoint(endpoint)) {
         return [];
@@ -207,14 +221,18 @@ export default function useMentions({
           size: 20,
         }),
       })),
-      ...(interfaceConfig.modelSelect === true ? (agentsList ?? []) : []),
+      ...(interfaceConfig.modelSelect === true && validEndpointSet.has(EModelEndpoint.agents)
+        ? (agentsList ?? [])
+        : []),
       ...(endpointsConfig?.[EModelEndpoint.assistants] &&
       includeAssistants &&
+      validEndpointSet.has(EModelEndpoint.assistants) &&
       interfaceConfig.modelSelect === true
         ? assistantListMap[EModelEndpoint.assistants] || []
         : []),
       ...(endpointsConfig?.[EModelEndpoint.azureAssistants] &&
       includeAssistants &&
+      validEndpointSet.has(EModelEndpoint.azureAssistants) &&
       interfaceConfig.modelSelect === true
         ? assistantListMap[EModelEndpoint.azureAssistants] || []
         : []),
@@ -241,11 +259,12 @@ export default function useMentions({
     return mentions;
   }, [
     presets,
-    endpoints,
     modelSpecs,
     agentsList,
     assistantMap,
     modelsConfig,
+    validEndpoints,
+    validEndpointSet,
     endpointsConfig,
     assistantListMap,
     includeAssistants,
diff --git a/client/src/hooks/Input/useQueryParams.ts b/client/src/hooks/Input/useQueryParams.ts
index 48d3da90c8a..4c13ddff2fc 100644
--- a/client/src/hooks/Input/useQueryParams.ts
+++ b/client/src/hooks/Input/useQueryParams.ts
@@ -23,6 +23,8 @@ import { startupConfigKey, useGetAgentByIdQuery } from '~/data-provider';
 import { useChatContext, useChatFormContext } from '~/Providers';
 import store from '~/store';
 
+const PROJECT_ID_SEARCH_PARAM = 'projectId';
+
 const injectAgentIntoAgentsMap = (queryClient: QueryClient, agent: any) => {
   const editCacheKey = [QueryKeys.agents, { requiredPermission: PermissionBits.EDIT }];
   const editCache = queryClient.getQueryData<AgentListResponse>(editCacheKey);
@@ -72,6 +74,15 @@ export default function useQueryParams({
   const urlAgentId = searchParams.get('agent_id') || '';
   const { data: urlAgent } = useGetAgentByIdQuery(urlAgentId);
 
+  const getPreservedSearchParams = useCallback(() => {
+    const preservedParams = new URLSearchParams();
+    const projectId = searchParams.get(PROJECT_ID_SEARCH_PARAM);
+    if (projectId) {
+      preservedParams.set(PROJECT_ID_SEARCH_PARAM, projectId);
+    }
+    return preservedParams;
+  }, [searchParams]);
+
   /**
    * Applies settings from URL query parameters to create a new conversation.
    * Handles model spec lookup, endpoint normalization, and conversation switching logic.
@@ -90,10 +101,11 @@ export default function useQueryParams({
         if (!spec) {
           return;
         }
-        const { preset } = spec;
-        preset.iconURL = getModelSpecIconURL(spec);
-        preset.spec = spec.name;
-        newPreset = preset;
+        newPreset = {
+          ...spec.preset,
+          iconURL: getModelSpecIconURL(spec),
+          spec: spec.name,
+        } as TPreset;
       }
 
       let newEndpoint = newPreset.endpoint ?? '';
@@ -161,13 +173,16 @@ export default function useQueryParams({
         newConversation({
           template: currentConvo,
           preset: newPreset,
-          keepLatestMessage: true,
           keepAddedConvos: true,
         });
         return;
       }
 
-      newConversation({ preset: newPreset, keepAddedConvos: true });
+      newConversation({
+        template: { chatProjectId: conversation?.chatProjectId ?? null },
+        preset: newPreset,
+        keepAddedConvos: true,
+      });
     },
     [
       queryClient,
@@ -223,8 +238,8 @@ export default function useQueryParams({
       }
     })();
 
-    setSearchParams(new URLSearchParams(), { replace: true });
-  }, [methods, submitMessage, setSearchParams]);
+    setSearchParams(getPreservedSearchParams(), { replace: true });
+  }, [methods, submitMessage, setSearchParams, getPreservedSearchParams]);
 
   useEffect(() => {
     const processQueryParams = () => {
@@ -239,6 +254,7 @@ export default function useQueryParams({
       delete queryParams.prompt;
       delete queryParams.q;
       delete queryParams.submit;
+      delete queryParams[PROJECT_ID_SEARCH_PARAM];
       const validSettings = processValidSettings(queryParams);
 
       return { decodedPrompt, validSettings, shouldAutoSubmit };
@@ -281,7 +297,7 @@ export default function useQueryParams({
 
         // Defer URL cleanup until after submission completes (processSubmission handles it)
         if (!pendingSubmitRef.current) {
-          setSearchParams(new URLSearchParams(), { replace: true });
+          setSearchParams(getPreservedSearchParams(), { replace: true });
         }
       };
 
@@ -349,6 +365,7 @@ export default function useQueryParams({
     newConversation,
     submitMessage,
     setSearchParams,
+    getPreservedSearchParams,
     queryClient,
     processSubmission,
     areSettingsApplied,
diff --git a/client/src/hooks/Input/useSelectMention.ts b/client/src/hooks/Input/useSelectMention.ts
index 00ba5095bba..62bd9fe13fe 100644
--- a/client/src/hooks/Input/useSelectMention.ts
+++ b/client/src/hooks/Input/useSelectMention.ts
@@ -1,5 +1,6 @@
-import { useCallback } from 'react';
+import { useCallback, useMemo } from 'react';
 import { useRecoilValue } from 'recoil';
+import { useSearchParams } from 'react-router-dom';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type {
   TPreset,
@@ -39,6 +40,16 @@ export default function useSelectMention({
   const getDefaultConversation = useDefaultConvo();
   const modularChat = useRecoilValue(store.modularChat);
   const availableTools = useRecoilValue(store.availableTools);
+  const [searchParams] = useSearchParams();
+  /**
+   * Project scope is read from React Router's search params (the same source the
+   * project chip reads), not window.location — new-chat params are written to the
+   * URL via raw history.pushState, so window.location can drift out of sync.
+   */
+  const routeChatProjectId = useMemo(() => {
+    const projectId = searchParams.get('projectId');
+    return projectId != null && /^[a-f\d]{24}$/i.test(projectId) ? projectId : null;
+  }, [searchParams]);
 
   const onSelectSpec = useCallback(
     (spec?: TModelSpec) => {
@@ -47,9 +58,11 @@ export default function useSelectMention({
       }
 
       const conversation = getConversation();
-      const { preset } = spec;
-      preset.iconURL = getModelSpecIconURL(spec);
-      preset.spec = spec.name;
+      const preset = {
+        ...spec.preset,
+        iconURL: getModelSpecIconURL(spec),
+        spec: spec.name,
+      } as TPreset;
       const { endpoint } = preset;
       const newEndpoint = endpoint ?? '';
       if (!newEndpoint) {
@@ -98,7 +111,6 @@ export default function useSelectMention({
         newConversation({
           template: currentConvo,
           preset,
-          keepLatestMessage: true,
           keepAddedConvos: true,
         });
         return;
@@ -106,7 +118,10 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new spec', conversation);
       newConversation({
-        template: { ...(template as Partial<TConversation>) },
+        template: {
+          ...(template as Partial<TConversation>),
+          chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null,
+        },
         preset,
         keepAddedConvos: isModular,
       });
@@ -118,6 +133,7 @@ export default function useSelectMention({
       newConversation,
       endpointsConfig,
       assistantsMap,
+      routeChatProjectId,
     ],
   );
 
@@ -193,7 +209,6 @@ export default function useSelectMention({
         newConversation({
           template: currentConvo,
           preset: currentConvo,
-          keepLatestMessage: true,
           keepAddedConvos: true,
         });
         return;
@@ -201,12 +216,22 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new endpoint/model', template);
       newConversation({
-        template: { ...(template as Partial<TConversation>) },
+        template: {
+          ...(template as Partial<TConversation>),
+          chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null,
+        },
         preset: { ...kwargs, spec: null, iconURL: null, modelLabel: null, endpoint: newEndpoint },
         keepAddedConvos: isNewModular,
       });
     },
-    [getConversation, getDefaultConversation, modularChat, newConversation, endpointsConfig],
+    [
+      getConversation,
+      getDefaultConversation,
+      modularChat,
+      newConversation,
+      endpointsConfig,
+      routeChatProjectId,
+    ],
   );
 
   const onSelectPreset = useCallback(
@@ -256,7 +281,6 @@ export default function useSelectMention({
         newConversation({
           template: currentConvo,
           preset: newPreset,
-          keepLatestMessage: true,
           keepAddedConvos: true,
           disableParams,
         });
@@ -265,6 +289,7 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new preset', template);
       newConversation({
+        template: { chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null },
         preset: newPreset,
         keepAddedConvos: isModular,
         disableParams,
@@ -277,6 +302,7 @@ export default function useSelectMention({
       newConversation,
       endpointsConfig,
       getDefaultConversation,
+      routeChatProjectId,
     ],
   );
 
diff --git a/client/src/hooks/Input/useSpeechToTextBrowser.ts b/client/src/hooks/Input/useSpeechToTextBrowser.ts
index 373c84d005f..5053e31d546 100644
--- a/client/src/hooks/Input/useSpeechToTextBrowser.ts
+++ b/client/src/hooks/Input/useSpeechToTextBrowser.ts
@@ -1,12 +1,31 @@
-import { useEffect, useRef, useMemo } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { useRecoilState } from 'recoil';
 import { useToastContext } from '@librechat/client';
-import SpeechRecognition, { useSpeechRecognition } from 'react-speech-recognition';
 import { useGetCustomConfigSpeechQuery } from 'librechat-data-provider/react-query';
+import SpeechRecognitionImport, { useSpeechRecognition } from 'react-speech-recognition';
 import useGetAudioSettings from './useGetAudioSettings';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
+type SpeechRecognitionController = Pick<
+  typeof SpeechRecognitionImport,
+  'startListening' | 'stopListening'
+>;
+type SpeechRecognitionModule = Partial<SpeechRecognitionController> & {
+  default?: Partial<SpeechRecognitionController>;
+};
+
+const hasSpeechRecognitionController = (
+  controller?: Partial<SpeechRecognitionController>,
+): controller is SpeechRecognitionController =>
+  typeof controller?.startListening === 'function' &&
+  typeof controller.stopListening === 'function';
+
+const speechRecognitionModule = SpeechRecognitionImport as SpeechRecognitionModule;
+const SpeechRecognition = hasSpeechRecognitionController(speechRecognitionModule)
+  ? speechRecognitionModule
+  : speechRecognitionModule.default;
+
 const useSpeechToTextBrowser = (
   setText: (text: string) => void,
   onTranscriptionComplete: (text: string) => void,
@@ -33,7 +52,7 @@ const useSpeechToTextBrowser = (
     isMicrophoneAvailable,
     browserSupportsSpeechRecognition,
   } = useSpeechRecognition();
-  const isListening = useMemo(() => listening, [listening]);
+  const isListening = listening;
 
   useEffect(() => {
     if (interimTranscript == null || interimTranscript === '') {
@@ -73,7 +92,7 @@ const useSpeechToTextBrowser = (
     };
   }, [setText, onTranscriptionComplete, resetTranscript, finalTranscript, autoSendText]);
 
-  const toggleListening = () => {
+  const toggleListening = useCallback(() => {
     if (!browserSupportsSpeechRecognition) {
       showToast({
         message: sttExternal
@@ -92,6 +111,16 @@ const useSpeechToTextBrowser = (
       return;
     }
 
+    if (!hasSpeechRecognitionController(SpeechRecognition)) {
+      showToast({
+        message: sttExternal
+          ? localize('com_ui_speech_not_supported_use_external')
+          : localize('com_ui_speech_not_supported'),
+        status: 'error',
+      });
+      return;
+    }
+
     if (isListening === true) {
       SpeechRecognition.stopListening();
     } else {
@@ -100,7 +129,16 @@ const useSpeechToTextBrowser = (
         continuous: autoTranscribeAudio,
       });
     }
-  };
+  }, [
+    autoTranscribeAudio,
+    browserSupportsSpeechRecognition,
+    isListening,
+    isMicrophoneAvailable,
+    languageSTT,
+    localize,
+    showToast,
+    sttExternal,
+  ]);
 
   useEffect(() => {
     const handleKeyDown = (e: KeyboardEvent) => {
@@ -111,7 +149,7 @@ const useSpeechToTextBrowser = (
 
     window.addEventListener('keydown', handleKeyDown);
     return () => window.removeEventListener('keydown', handleKeyDown);
-  }, []);
+  }, [isBrowserSTTEnabled, toggleListening]);
 
   return {
     isListening,
diff --git a/client/src/hooks/Input/useTextToSpeechBrowser.ts b/client/src/hooks/Input/useTextToSpeechBrowser.ts
index 8fb0eecd0b5..dbb59aa1e6c 100644
--- a/client/src/hooks/Input/useTextToSpeechBrowser.ts
+++ b/client/src/hooks/Input/useTextToSpeechBrowser.ts
@@ -1,5 +1,5 @@
-import { useRecoilValue } from 'recoil';
 import { useState, useEffect, useCallback } from 'react';
+import { useRecoilValue } from 'recoil';
 import type { VoiceOption } from '~/common';
 import store from '~/store';
 
@@ -89,6 +89,11 @@ function useTextToSpeechBrowser({
         setIsSpeaking(false);
       };
       utterance.onerror = (event) => {
+        if (event.error === 'interrupted' || event.error === 'canceled') {
+          setIsSpeaking(false);
+          return;
+        }
+
         console.error('Speech synthesis error:', event);
         setIsSpeaking(false);
       };
diff --git a/client/src/hooks/Input/useTextarea.ts b/client/src/hooks/Input/useTextarea.ts
index 15b415dabc2..0e542705ee7 100644
--- a/client/src/hooks/Input/useTextarea.ts
+++ b/client/src/hooks/Input/useTextarea.ts
@@ -1,8 +1,14 @@
+import { useEffect, useRef, useCallback, useMemo } from 'react';
 import debounce from 'lodash/debounce';
-import { useEffect, useRef, useCallback } from 'react';
 import { useRecoilValue, useRecoilState } from 'recoil';
 import type { TEndpointOption } from 'librechat-data-provider';
 import type { KeyboardEvent } from 'react';
+import {
+  parseBinding,
+  isMacPlatform,
+  bindingFromEvent,
+  resolveSubmitOverrideAction,
+} from '~/utils/shortcuts';
 import {
   forceResize,
   insertTextAtCursor,
@@ -11,6 +17,7 @@ import {
   checkIfScrollable,
 } from '~/utils';
 import { useAssistantsMapContext } from '~/Providers/AssistantsMapContext';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { useAgentsMapContext } from '~/Providers/AgentsMapContext';
 import useGetSender from '~/hooks/Conversations/useGetSender';
 import useFileHandling from '~/hooks/Files/useFileHandling';
@@ -27,11 +34,13 @@ export default function useTextarea({
   submitButtonRef,
   setIsScrollable,
   disabled = false,
+  placeholder,
 }: {
   textAreaRef: React.RefObject<HTMLTextAreaElement>;
   submitButtonRef: React.RefObject<HTMLButtonElement>;
   setIsScrollable: React.Dispatch<React.SetStateAction<boolean>>;
   disabled?: boolean;
+  placeholder?: string;
 }) {
   const localize = useLocalize();
   const getSender = useGetSender();
@@ -41,9 +50,24 @@ export default function useTextarea({
   const assistantMap = useAssistantsMapContext();
   const checkHealth = useInteractionHealthCheck();
   const enterToSend = useRecoilValue(store.enterToSend);
+  const customShortcuts = useRecoilValue(store.customShortcuts);
+
+  /**
+   * Effective `submitMessage` override: `undefined` when unset (default Ctrl/Cmd+Enter applies),
+   * `null` when explicitly unbound, otherwise the rebound chord. When present, the composer
+   * honors it instead of the hard-coded Ctrl/Cmd+Enter so the shortcut can be replaced or
+   * disabled in the main place it is used.
+   */
+  const submitOverride = useMemo(() => {
+    const override = customShortcuts['submitMessage'];
+    if (!override) {
+      return undefined;
+    }
+    return parseBinding(isMacPlatform ? override.mac : override.other);
+  }, [customShortcuts]);
 
   const { index, conversation, isSubmitting, filesLoading, setFilesLoading } = useChatContext();
-  const latestMessage = useRecoilValue(store.latestMessageFamily(index));
+  const latestMessage = useLatestMessage(index);
   const [activePrompt, setActivePrompt] = useRecoilState(store.activePromptByIndex(index));
 
   const { endpoint = '' } = conversation || {};
@@ -56,7 +80,8 @@ export default function useTextarea({
   });
   const entityName = entity?.name ?? '';
 
-  const isNotAppendable = latestMessage?.error === true && !isAssistant;
+  const isNotAppendable =
+    latestMessage?.error === true && latestMessage.isCreatedByUser === true && !isAssistant;
   // && (conversationId?.length ?? 0) > 6; // also ensures that we don't show the wrong placeholder
 
   useEffect(() => {
@@ -94,6 +119,10 @@ export default function useTextarea({
         return localize('com_endpoint_message_not_appendable');
       }
 
+      if (placeholder) {
+        return placeholder;
+      }
+
       const sender =
         isAssistant || isAgent
           ? getEntityName({ name: entityName, isAgent, localize })
@@ -104,17 +133,17 @@ export default function useTextarea({
       })}`;
     };
 
-    const placeholder = getPlaceholderText();
+    const placeholderText = getPlaceholderText();
 
-    if (textAreaRef.current?.getAttribute('placeholder') === placeholder) {
+    if (textAreaRef.current?.getAttribute('placeholder') === placeholderText) {
       return;
     }
 
     const setPlaceholder = () => {
-      const placeholder = getPlaceholderText();
+      const placeholderText = getPlaceholderText();
 
-      if (textAreaRef.current?.getAttribute('placeholder') !== placeholder) {
-        textAreaRef.current?.setAttribute('placeholder', placeholder);
+      if (textAreaRef.current?.getAttribute('placeholder') !== placeholderText) {
+        textAreaRef.current?.setAttribute('placeholder', placeholderText);
         forceResize(textAreaRef.current);
       }
     };
@@ -136,6 +165,7 @@ export default function useTextarea({
     conversation,
     latestMessage,
     isNotAppendable,
+    placeholder,
   ]);
 
   const handleKeyDown = useCallback(
@@ -156,6 +186,39 @@ export default function useTextarea({
       // NOTE: isComposing and e.key behave differently in Safari compared to other browsers, forcing us to use e.keyCode instead
       const isComposingInput = isComposing.current || e.key === 'Process' || e.keyCode === 229;
 
+      const submitMessage = () => {
+        const globalAudio = document.getElementById(globalAudioId) as HTMLAudioElement | undefined;
+        if (globalAudio) {
+          console.log('Unmuting global audio');
+          globalAudio.muted = false;
+        }
+        submitButtonRef.current?.click();
+      };
+
+      // A rebound (or unbound) submitMessage shortcut takes over Enter handling in the composer
+      // so the default Ctrl/Cmd+Enter no longer submits once the user has replaced or disabled it.
+      if (submitOverride !== undefined) {
+        if (isComposingInput) {
+          return;
+        }
+        const action = resolveSubmitOverrideAction(
+          bindingFromEvent(e.nativeEvent),
+          submitOverride,
+          enterToSend,
+        );
+        if (action === 'submit') {
+          e.preventDefault();
+          submitMessage();
+          return;
+        }
+        if (action === 'newline' && textAreaRef.current) {
+          e.preventDefault();
+          insertTextAtCursor(textAreaRef.current, '\n');
+          forceResize(textAreaRef.current);
+        }
+        return;
+      }
+
       if (isNonShiftEnter && filesLoading) {
         e.preventDefault();
       }
@@ -178,12 +241,7 @@ export default function useTextarea({
       }
 
       if ((isNonShiftEnter || isCtrlEnter) && !isComposingInput) {
-        const globalAudio = document.getElementById(globalAudioId) as HTMLAudioElement | undefined;
-        if (globalAudio) {
-          console.log('Unmuting global audio');
-          globalAudio.muted = false;
-        }
-        submitButtonRef.current?.click();
+        submitMessage();
       }
     },
     [
@@ -191,6 +249,7 @@ export default function useTextarea({
       checkHealth,
       filesLoading,
       enterToSend,
+      submitOverride,
       setIsScrollable,
       textAreaRef,
       submitButtonRef,
diff --git a/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx b/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
index 783f525b9c9..bbdace485e8 100644
--- a/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
+++ b/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
@@ -1,12 +1,12 @@
 import React from 'react';
 import { Provider, createStore } from 'jotai';
 import { renderHook, act, waitFor } from '@testing-library/react';
-import { RecoilRoot, useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
 import { Constants, LocalStorageKeys } from 'librechat-data-provider';
+import { RecoilRoot, useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
+import { MCPServerDefinition } from '../useMCPServerManager';
 import { ephemeralAgentByConvoId } from '~/store';
 import { setTimestamp } from '~/utils/timestamps';
 import { useMCPSelect } from '../useMCPSelect';
-import { MCPServerDefinition } from '../useMCPServerManager';
 
 // Mock dependencies
 jest.mock('~/utils/timestamps', () => ({
@@ -15,11 +15,20 @@ jest.mock('~/utils/timestamps', () => ({
 
 jest.mock('lodash/isEqual', () => jest.fn((a, b) => JSON.stringify(a) === JSON.stringify(b)));
 
+// Mutable startup config so tests can vary `interface.defaultPinnedTools`
+let mockStartupConfig: { interface?: { defaultPinnedTools?: string[] } } | undefined;
+
+jest.mock('~/data-provider', () => ({
+  ...jest.requireActual('~/data-provider'),
+  useGetStartupConfig: jest.fn(() => ({ data: mockStartupConfig })),
+}));
+
 // Helper to create MCPServerDefinition objects
 const createMCPServers = (serverNames: string[]): MCPServerDefinition[] => {
   return serverNames.map((serverName) => ({
     serverName,
     config: {
+      type: 'sse',
       url: 'http://mcp',
     },
     effectivePermissions: 15, // All permissions (VIEW=1, EDIT=2, DELETE=4, SHARE=8)
@@ -43,6 +52,7 @@ describe('useMCPSelect', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     localStorage.clear();
+    mockStartupConfig = undefined;
   });
 
   describe('Basic Functionality', () => {
@@ -859,4 +869,57 @@ describe('useMCPSelect', () => {
       expect(newResult.current.mcpValues).toBeDefined();
     });
   });
+
+  describe('defaultPinnedTools (admin-configured default pin)', () => {
+    it('keeps the MCP dropdown pinned by default when "mcp" is listed', async () => {
+      mockStartupConfig = { interface: { defaultPinnedTools: ['artifacts', 'mcp'] } };
+      const { Wrapper, servers } = createWrapper();
+      const { result } = renderHook(() => useMCPSelect({ servers }), { wrapper: Wrapper });
+
+      await waitFor(() => {
+        expect(result.current.isPinned).toBe(true);
+      });
+    });
+
+    it('unpins the MCP dropdown by default when configured without "mcp"', async () => {
+      mockStartupConfig = { interface: { defaultPinnedTools: ['artifacts'] } };
+      const { Wrapper, servers } = createWrapper(['serverA']);
+      const { result } = renderHook(() => useMCPSelect({ servers }), { wrapper: Wrapper });
+
+      await waitFor(() => {
+        expect(result.current.isPinned).toBe(false);
+      });
+    });
+
+    it('pins the MCP dropdown when a configured server name is listed', async () => {
+      mockStartupConfig = { interface: { defaultPinnedTools: ['serverA'] } };
+      const { Wrapper, servers } = createWrapper(['serverA', 'serverB']);
+      const { result } = renderHook(() => useMCPSelect({ servers }), { wrapper: Wrapper });
+
+      await waitFor(() => {
+        expect(result.current.isPinned).toBe(true);
+      });
+    });
+
+    it('keeps the legacy pinned default when defaultPinnedTools is not configured', async () => {
+      mockStartupConfig = { interface: {} };
+      const { Wrapper, servers } = createWrapper(['serverA']);
+      const { result } = renderHook(() => useMCPSelect({ servers }), { wrapper: Wrapper });
+
+      await waitFor(() => {
+        expect(result.current.isPinned).toBe(true);
+      });
+    });
+
+    it('respects a stored user preference over the configured default', async () => {
+      localStorage.setItem(LocalStorageKeys.PIN_MCP_, JSON.stringify(false));
+      mockStartupConfig = { interface: { defaultPinnedTools: ['mcp'] } };
+      const { Wrapper, servers } = createWrapper();
+      const { result } = renderHook(() => useMCPSelect({ servers }), { wrapper: Wrapper });
+
+      await waitFor(() => {
+        expect(result.current.isPinned).toBe(false);
+      });
+    });
+  });
 });
diff --git a/client/src/hooks/MCP/useMCPSelect.ts b/client/src/hooks/MCP/useMCPSelect.ts
index b15786f6787..1a5fd97b0af 100644
--- a/client/src/hooks/MCP/useMCPSelect.ts
+++ b/client/src/hooks/MCP/useMCPSelect.ts
@@ -1,11 +1,15 @@
-import { useCallback, useEffect, useMemo } from 'react';
+import { useCallback, useEffect, useMemo, useRef } from 'react';
 import { useAtom } from 'jotai';
 import isEqual from 'lodash/isEqual';
 import { useRecoilState } from 'recoil';
 import { Constants, LocalStorageKeys } from 'librechat-data-provider';
 import { ephemeralAgentByConvoId, mcpValuesAtomFamily, mcpPinnedAtom } from '~/store';
-import { setTimestamp } from '~/utils/timestamps';
 import { MCPServerDefinition } from './useMCPServerManager';
+import { useGetStartupConfig } from '~/data-provider';
+import { setTimestamp } from '~/utils/timestamps';
+
+/** Sentinel in `interface.defaultPinnedTools` that pins the MCP dropdown to the prompt bar. */
+const MCP_PIN_KEYWORD = 'mcp';
 
 export function useMCPSelect({
   conversationId,
@@ -29,9 +33,43 @@ export function useMCPSelect({
   const isNewConvo = key === Constants.NEW_CONVO;
   const mcpAtomKey = isNewConvo && storageContextKey ? storageContextKey : key;
 
+  const { data: startupConfig } = useGetStartupConfig();
   const [isPinned, setIsPinned] = useAtom(mcpPinnedAtom);
   const [mcpValues, setMCPValuesRaw] = useAtom(mcpValuesAtomFamily(mcpAtomKey));
   const [ephemeralAgent, setEphemeralAgent] = useRecoilState(ephemeralAgentByConvoId(key));
+  const hasAppliedDefaultPin = useRef(false);
+
+  /**
+   * Seed the MCP dropdown's pinned state from the admin-configured `defaultPinnedTools`:
+   * pin when the array includes the `'mcp'` keyword or any configured server name.
+   * Only applies on first load when the user has no stored preference; when the option
+   * is absent entirely, the legacy default (pinned) is kept.
+   */
+  useEffect(() => {
+    if (hasAppliedDefaultPin.current || !startupConfig) {
+      return;
+    }
+    const defaultPinnedTools = startupConfig.interface?.defaultPinnedTools;
+    if (!Array.isArray(defaultPinnedTools)) {
+      hasAppliedDefaultPin.current = true;
+      return;
+    }
+    if (localStorage.getItem(LocalStorageKeys.PIN_MCP_) != null) {
+      hasAppliedDefaultPin.current = true;
+      return;
+    }
+    const pinnedByKeyword = defaultPinnedTools.includes(MCP_PIN_KEYWORD);
+    /** Wait for servers before deciding so a configured server name isn't missed. */
+    if (!pinnedByKeyword && servers.length === 0) {
+      return;
+    }
+    hasAppliedDefaultPin.current = true;
+    const shouldPin =
+      pinnedByKeyword || servers.some((server) => defaultPinnedTools.includes(server.serverName));
+    if (shouldPin !== isPinned) {
+      setIsPinned(shouldPin);
+    }
+  }, [startupConfig, servers, isPinned, setIsPinned]);
 
   // Sync ephemeral agent MCP → Jotai atom (strip unconfigured servers)
   useEffect(() => {
diff --git a/client/src/hooks/MCP/useMCPServerManager.ts b/client/src/hooks/MCP/useMCPServerManager.ts
index 45c5bd6da8c..6126545c356 100644
--- a/client/src/hooks/MCP/useMCPServerManager.ts
+++ b/client/src/hooks/MCP/useMCPServerManager.ts
@@ -16,7 +16,12 @@ import {
   useReinitializeMCPServerMutation,
   useGetAllEffectivePermissionsQuery,
 } from 'librechat-data-provider/react-query';
-import type { TUpdateUserPlugins, TPlugin, MCPServersResponse } from 'librechat-data-provider';
+import type {
+  TUpdateUserPlugins,
+  TPlugin,
+  MCPServersResponse,
+  MCPConnectionStatusResponse,
+} from 'librechat-data-provider';
 import type { MCPServerInitState } from '~/store/mcp';
 import type { ConfigFieldDetail } from '~/common';
 import { useLocalize, useHasAccess, useMCPSelect, useMCPConnectionStatus } from '~/hooks';
@@ -197,29 +202,39 @@ export function useMCPServerManager({
       let pollAttempts = 0;
       let timeoutId: NodeJS.Timeout | null = null;
 
-      /** OAuth typically completes in 5 seconds to 3 minutes
-       * We enforce a strict 3-minute timeout with gradual backoff
+      /** OAuth can take several minutes if the user steps away from the consent screen.
+       * Poll for the full server-side handling window (MCP_OAUTH_HANDLING_TIMEOUT
+       * default = 10 minutes) with gradual backoff, so the button stays usable as long
+       * as the server will accept the callback.
        */
       const getPollInterval = (attempt: number): number => {
         if (attempt < 12) return 5000; // First minute: every 5s (12 polls)
         if (attempt < 22) return 6000; // Second minute: every 6s (10 polls)
-        return 7500; // Final minute: every 7.5s (8 polls)
+        return 7500; // Thereafter: every 7.5s
       };
 
-      const maxAttempts = 30; // Exactly 3 minutes (180 seconds) total
-      const OAUTH_TIMEOUT_MS = 180000; // 3 minutes in milliseconds
+      /** Honor the server's configured MCP_OAUTH_HANDLING_TIMEOUT (surfaced on the
+       * connection-status response) so a tuned deadline isn't capped at the default.
+       * The cache may be empty at start, so this is refreshed from the first status
+       * refetch below rather than captured once. */
+      const connectionData = queryClient.getQueryData<MCPConnectionStatusResponse>([
+        QueryKeys.mcpConnectionStatus,
+      ]);
+      let oauthTimeoutMs = connectionData?.oauthTimeout ?? 600000; // default 10 minutes
+      // Backstop only; the elapsed-time guard governs. Sized above the worst-case poll count.
+      let maxAttempts = Math.ceil(oauthTimeoutMs / 5000) + 5;
 
       const pollOnce = async () => {
         try {
           pollAttempts++;
           const state = getServerInitState(serverInitStates, serverName);
 
-          /** Stop polling after 3 minutes or max attempts */
+          /** Stop polling once the handling window or max attempts is exceeded */
           const elapsedTime = state?.oauthStartTime
             ? Date.now() - state.oauthStartTime
             : pollAttempts * 5000; // Rough estimate if no start time
 
-          if (pollAttempts > maxAttempts || elapsedTime > OAUTH_TIMEOUT_MS) {
+          if (pollAttempts > maxAttempts || elapsedTime > oauthTimeoutMs) {
             console.warn(
               `[MCP Manager] OAuth timeout for ${serverName} after ${(elapsedTime / 1000).toFixed(0)}s (attempt ${pollAttempts})`,
             );
@@ -236,9 +251,15 @@ export function useMCPServerManager({
 
           await queryClient.refetchQueries([QueryKeys.mcpConnectionStatus]);
 
-          const freshConnectionData = queryClient.getQueryData([
+          const freshConnectionData = queryClient.getQueryData<MCPConnectionStatusResponse>([
             QueryKeys.mcpConnectionStatus,
-          ]) as any;
+          ]);
+          // Pick up the configured timeout once the status response lands (cache may have
+          // been empty when polling started), so a tuned deadline is honored mid-flight.
+          if (typeof freshConnectionData?.oauthTimeout === 'number') {
+            oauthTimeoutMs = freshConnectionData.oauthTimeout;
+            maxAttempts = Math.ceil(oauthTimeoutMs / 5000) + 5;
+          }
           const freshConnectionStatus = freshConnectionData?.connectionStatus || {};
 
           const serverStatus = freshConnectionStatus[serverName];
@@ -269,7 +290,7 @@ export function useMCPServerManager({
           }
 
           // Check for OAuth timeout (should align with maxAttempts)
-          if (state?.oauthStartTime && Date.now() - state.oauthStartTime > OAUTH_TIMEOUT_MS) {
+          if (state?.oauthStartTime && Date.now() - state.oauthStartTime > oauthTimeoutMs) {
             showToast({
               message: localize('com_ui_mcp_oauth_timeout', { 0: serverName }),
               status: 'error',
@@ -562,6 +583,7 @@ export function useMCPServerManager({
                   authField: key,
                   label: config.title,
                   description: config.description,
+                  sensitive: config.sensitive,
                 }))
               : []),
           authenticated: serverData?.authenticated ?? false,
@@ -578,6 +600,9 @@ export function useMCPServerManager({
 
       const hasCustomUserVars =
         serverConfig?.customUserVars && Object.keys(serverConfig.customUserVars).length > 0;
+      const hasPendingOAuth =
+        serverStatus?.requiresOAuth === true && serverStatus.connectionState === 'connecting';
+      const canCancelOAuth = isCancellable(serverName) || hasPendingOAuth;
 
       return {
         serverName,
@@ -591,8 +616,8 @@ export function useMCPServerManager({
             } as TPlugin)
           : undefined,
         onConfigClick: handleConfigClick,
-        isInitializing: isInitializing(serverName),
-        canCancel: isCancellable(serverName),
+        isInitializing: isInitializing(serverName) || hasPendingOAuth,
+        canCancel: canCancelOAuth,
         onCancel: handleCancelClick,
         hasCustomUserVars,
       };
@@ -609,6 +634,7 @@ export function useMCPServerManager({
         fieldsSchema[field.authField] = {
           title: field.label || field.authField,
           description: field.description,
+          sensitive: field.sensitive,
         };
       });
     }
diff --git a/client/src/hooks/Messages/__tests__/messageLayout.spec.ts b/client/src/hooks/Messages/__tests__/messageLayout.spec.ts
new file mode 100644
index 00000000000..d2e365aac90
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/messageLayout.spec.ts
@@ -0,0 +1,42 @@
+import { reconcileMessageContentLayout } from '../messageLayout';
+
+function setRect(element: HTMLElement, rect: Partial<DOMRect>): void {
+  element.getBoundingClientRect = jest.fn(
+    () =>
+      ({
+        x: rect.x ?? 0,
+        y: rect.y ?? 0,
+        top: rect.top ?? 0,
+        left: rect.left ?? 0,
+        right: rect.right ?? 0,
+        bottom: rect.bottom ?? 0,
+        width: rect.width ?? 0,
+        height: rect.height ?? 0,
+        toJSON: () => ({}),
+      }) as DOMRect,
+  );
+}
+
+describe('message layout reconciliation', () => {
+  it('clamps to the rendered content bottom when the scroll container is still oversized', () => {
+    const scrollable = document.createElement('div');
+    const content = document.createElement('div');
+    const target = document.createElement('button');
+
+    scrollable.className = 'scrollbar-gutter-stable';
+    content.append(target);
+    scrollable.append(content);
+    document.body.append(scrollable);
+
+    Object.defineProperty(scrollable, 'scrollHeight', { value: 1000, configurable: true });
+    Object.defineProperty(scrollable, 'clientHeight', { value: 200, configurable: true });
+    scrollable.scrollTop = 700;
+    setRect(scrollable, { top: 0, bottom: 200, height: 200 });
+    setRect(content, { top: -700, bottom: -200, height: 500 });
+
+    expect(reconcileMessageContentLayout(target)).toBe(true);
+    expect(scrollable.scrollTop).toBe(300);
+
+    document.body.removeChild(scrollable);
+  });
+});
diff --git a/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx b/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
index 61ce0717281..c0d17ba7131 100644
--- a/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
+++ b/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
@@ -11,31 +11,39 @@
  */
 
 import { useEffect } from 'react';
+import { Tools } from 'librechat-data-provider';
 import { renderHook } from '@testing-library/react';
 import { RecoilRoot, useSetRecoilState } from 'recoil';
+import type { TAttachment, TFile, TAttachmentMetadata } from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment } from 'librechat-data-provider';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 jest.mock('~/hooks/useLocalize', () => () => (key: string) => key);
 
 import useAttachments from '../useAttachments';
 
 const messageId = 'msg-1';
 
-function makeAttachment(overrides: Partial<TAttachment> = {}): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture> = {}): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: 'fid-1',
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 function setup({
@@ -91,7 +99,7 @@ describe('useAttachments', () => {
      * immediate-persist snapshot; the polling layer fetched the
      * resolved record and inserted it into messageAttachmentsMap; the
      * merge here must surface the resolved fields to the renderer. */
-    const db = makeAttachment({ status: 'pending', text: null, textFormat: null });
+    const db = makeAttachment({ status: 'pending', text: undefined, textFormat: undefined });
     const live = makeAttachment({
       status: 'ready',
       text: '<table>resolved</table>',
@@ -102,10 +110,7 @@ describe('useAttachments', () => {
       liveMap: { [messageId]: [live] },
     });
     expect(result.current.attachments).toHaveLength(1);
-    const merged = result.current.attachments[0] as TAttachment & {
-      text?: string;
-      textFormat?: string;
-    };
+    const merged = result.current.attachments[0] as AttachmentFixture;
     expect(merged.status).toBe('ready');
     expect(merged.text).toBe('<table>resolved</table>');
     expect(merged.textFormat).toBe('html');
@@ -123,7 +128,7 @@ describe('useAttachments', () => {
     /* DB attachments are the authoritative list for THIS message — a
      * live entry without a matching file_id must NOT bleed in. */
     expect(result.current.attachments).toHaveLength(1);
-    expect((result.current.attachments[0] as TAttachment).file_id).toBe('fid-A');
-    expect((result.current.attachments[0] as TAttachment).status).toBe('pending');
+    expect((result.current.attachments[0] as AttachmentFixture).file_id).toBe('fid-A');
+    expect((result.current.attachments[0] as AttachmentFixture).status).toBe('pending');
   });
 });
diff --git a/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx b/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx
new file mode 100644
index 00000000000..391168e26c3
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx
@@ -0,0 +1,279 @@
+import React from 'react';
+import { act, renderHook } from '@testing-library/react';
+import { RecoilRoot, type MutableSnapshot } from 'recoil';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { QueryKeys, type TConversation, type TMessage } from 'librechat-data-provider';
+import { getBranchSiblingIndexesForTarget, getMessageBranchSiblingParentIds } from '~/utils';
+import { useLatestMessage, useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
+import store from '~/store';
+
+function createQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  });
+}
+
+const conversation = {
+  conversationId: 'conversation-1',
+  endpoint: 'openAI',
+  model: 'gpt-4',
+} as TConversation;
+
+const userMessage = {
+  messageId: 'user-message',
+  parentMessageId: '00000000-0000-0000-0000-000000000000',
+  conversationId: conversation.conversationId,
+  text: 'Hello',
+  isCreatedByUser: true,
+} as TMessage;
+
+const assistantMessage = {
+  messageId: 'assistant-message',
+  parentMessageId: userMessage.messageId,
+  conversationId: conversation.conversationId,
+  text: 'Hi there',
+  isCreatedByUser: false,
+} as TMessage;
+
+const olderAssistantMessage = {
+  ...assistantMessage,
+  messageId: 'assistant-older',
+  text: 'Older branch',
+} as TMessage;
+
+const olderFollowUpUserMessage = {
+  ...userMessage,
+  messageId: 'user-older-follow-up',
+  parentMessageId: olderAssistantMessage.messageId,
+  text: 'Follow up on older branch',
+} as TMessage;
+
+const olderFollowUpAssistantMessage = {
+  ...assistantMessage,
+  messageId: 'assistant-older-follow-up',
+  parentMessageId: olderFollowUpUserMessage.messageId,
+  text: 'Older branch tail',
+} as TMessage;
+
+function createWrapper(
+  queryClient = createQueryClient(),
+  initializeState?: (snapshot: MutableSnapshot) => void,
+  initialEntry = '/c/conversation-1',
+) {
+  return function Wrapper({ children }: { children: React.ReactNode }) {
+    return (
+      <QueryClientProvider client={queryClient}>
+        <RecoilRoot initializeState={initializeState}>
+          <MemoryRouter initialEntries={[initialEntry]}>
+            <Routes>
+              <Route path="/c/:conversationId?" element={children} />
+            </Routes>
+          </MemoryRouter>
+        </RecoilRoot>
+      </QueryClientProvider>
+    );
+  };
+}
+
+describe('useLatestMessage', () => {
+  it('returns null when there is no active conversation', () => {
+    const { result } = renderHook(() => useLatestMessage(0), {
+      wrapper: createWrapper(),
+    });
+
+    expect(result.current).toBeNull();
+  });
+
+  it('returns the tail message from the active conversation cache', () => {
+    const queryClient = createQueryClient();
+    queryClient.setQueryData<TMessage[]>(
+      [QueryKeys.messages, conversation.conversationId],
+      [userMessage, assistantMessage],
+    );
+
+    const { result } = renderHook(() => useLatestMessage(0), {
+      wrapper: createWrapper(queryClient, ({ set }) => {
+        set(store.conversationByIndex(0), conversation);
+      }),
+    });
+
+    expect(result.current).toEqual(
+      expect.objectContaining({
+        messageId: assistantMessage.messageId,
+        depth: 1,
+      }),
+    );
+  });
+
+  it('uses the new-conversation route cache while the conversation atom has the server id', () => {
+    const queryClient = createQueryClient();
+    const serverConversation = {
+      ...conversation,
+      conversationId: 'server-conversation',
+    } as TConversation;
+    queryClient.setQueryData<TMessage[]>(
+      [QueryKeys.messages, 'new'],
+      [
+        {
+          ...userMessage,
+          conversationId: serverConversation.conversationId,
+        },
+        {
+          ...assistantMessage,
+          conversationId: serverConversation.conversationId,
+        },
+      ],
+    );
+
+    const { result } = renderHook(() => useLatestMessage(0), {
+      wrapper: createWrapper(
+        queryClient,
+        ({ set }) => {
+          set(store.conversationByIndex(0), serverConversation);
+        },
+        '/c/new',
+      ),
+    });
+
+    expect(result.current).toEqual(
+      expect.objectContaining({
+        messageId: assistantMessage.messageId,
+        conversationId: serverConversation.conversationId,
+      }),
+    );
+  });
+
+  it('returns the active branch tail when sibling selection points at an older branch', () => {
+    const queryClient = createQueryClient();
+    queryClient.setQueryData<TMessage[]>(
+      [QueryKeys.messages, conversation.conversationId],
+      [
+        userMessage,
+        olderAssistantMessage,
+        olderFollowUpUserMessage,
+        olderFollowUpAssistantMessage,
+        assistantMessage,
+      ],
+    );
+
+    const { result } = renderHook(() => useLatestMessage(0), {
+      wrapper: createWrapper(queryClient, ({ set }) => {
+        set(store.conversationByIndex(0), conversation);
+        set(store.messagesSiblingIdxFamily(userMessage.messageId), 1);
+      }),
+    });
+
+    expect(result.current).toEqual(
+      expect.objectContaining({
+        messageId: olderFollowUpAssistantMessage.messageId,
+        depth: 3,
+      }),
+    );
+  });
+
+  it('falls back to the latest sibling when a stored sibling index is out of range', () => {
+    const queryClient = createQueryClient();
+    queryClient.setQueryData<TMessage[]>(
+      [QueryKeys.messages, conversation.conversationId],
+      [
+        userMessage,
+        olderAssistantMessage,
+        olderFollowUpUserMessage,
+        olderFollowUpAssistantMessage,
+        assistantMessage,
+      ],
+    );
+
+    const { result } = renderHook(() => useLatestMessage(0), {
+      wrapper: createWrapper(queryClient, ({ set }) => {
+        set(store.conversationByIndex(0), conversation);
+        set(store.messagesSiblingIdxFamily(userMessage.messageId), 99);
+      }),
+    });
+
+    expect(result.current).toEqual(
+      expect.objectContaining({
+        messageId: assistantMessage.messageId,
+        depth: 1,
+      }),
+    );
+  });
+
+  it('keeps latestMessageId stable across token-only cache writes', () => {
+    const queryClient = createQueryClient();
+    queryClient.setQueryData<TMessage[]>(
+      [QueryKeys.messages, conversation.conversationId],
+      [userMessage, assistantMessage],
+    );
+    let renderCount = 0;
+
+    const { result } = renderHook(
+      () => {
+        renderCount += 1;
+        return useLatestMessageId(0);
+      },
+      {
+        wrapper: createWrapper(queryClient, ({ set }) => {
+          set(store.conversationByIndex(0), conversation);
+        }),
+      },
+    );
+
+    const firstId = result.current;
+
+    act(() => {
+      queryClient.setQueryData<TMessage[]>(
+        [QueryKeys.messages, conversation.conversationId],
+        [userMessage, { ...assistantMessage, text: 'Hi there, still streaming' }],
+      );
+    });
+
+    expect(result.current).toBe(firstId);
+    expect(renderCount).toBe(1);
+  });
+});
+
+describe('getMessageBranchSiblingParentIds', () => {
+  it('returns only parent keys that have branch choices', () => {
+    expect(
+      getMessageBranchSiblingParentIds(
+        [
+          userMessage,
+          olderAssistantMessage,
+          olderFollowUpUserMessage,
+          olderFollowUpAssistantMessage,
+          assistantMessage,
+        ],
+        conversation.conversationId,
+      ),
+    ).toEqual([userMessage.messageId]);
+  });
+});
+
+describe('getBranchSiblingIndexesForTarget', () => {
+  it('returns sibling indexes that select the branch containing the target message', () => {
+    expect(
+      getBranchSiblingIndexesForTarget(
+        [
+          userMessage,
+          olderAssistantMessage,
+          olderFollowUpUserMessage,
+          olderFollowUpAssistantMessage,
+          assistantMessage,
+        ],
+        olderFollowUpAssistantMessage.messageId,
+        conversation.conversationId,
+      ),
+    ).toEqual([
+      {
+        parentMessageId: userMessage.messageId,
+        siblingIdx: 1,
+      },
+    ]);
+  });
+});
diff --git a/client/src/hooks/Messages/__tests__/useMemoizedChatContext.spec.tsx b/client/src/hooks/Messages/__tests__/useMemoizedChatContext.spec.tsx
new file mode 100644
index 00000000000..75b91929d51
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/useMemoizedChatContext.spec.tsx
@@ -0,0 +1,64 @@
+import { renderHook } from '@testing-library/react';
+import type { TConversation, TMessage } from 'librechat-data-provider';
+import { useChatContext } from '~/Providers';
+import useMemoizedChatContext from '../useMemoizedChatContext';
+
+jest.mock('~/Providers', () => ({
+  useChatContext: jest.fn(),
+}));
+
+const mockUseChatContext = useChatContext as jest.MockedFunction<typeof useChatContext>;
+
+const conversation = {
+  conversationId: 'convo-id',
+  endpoint: 'openAI',
+  model: 'gpt-4',
+} as TConversation;
+
+const message = (overrides: Partial<TMessage> = {}) =>
+  ({
+    messageId: 'assistant-response_',
+    parentMessageId: 'user-message',
+    conversationId: 'convo-id',
+    sender: 'Assistant',
+    text: '',
+    isCreatedByUser: false,
+    children: [],
+    ...overrides,
+  }) as TMessage;
+
+function mockChatContext(latestMessageId: string | undefined) {
+  mockUseChatContext.mockReturnValue({
+    ask: jest.fn(),
+    index: 0,
+    regenerate: jest.fn(),
+    conversation,
+    latestMessageId,
+    latestMessageDepth: -1,
+    handleContinue: jest.fn(),
+    isSubmitting: true,
+  } as unknown as ReturnType<typeof useChatContext>);
+}
+
+describe('useMemoizedChatContext', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('treats the latest message as submitting while streaming', () => {
+    mockChatContext('assistant-response_');
+
+    const { result } = renderHook(() => useMemoizedChatContext(message(), true));
+
+    expect(result.current.effectiveIsSubmitting).toBe(true);
+  });
+
+  it('requires latestMessageId alignment before marking a row as submitting', () => {
+    mockChatContext(undefined);
+
+    const { result } = renderHook(() => useMemoizedChatContext(message(), true));
+
+    expect(result.current.effectiveIsSubmitting).toBe(false);
+    expect(result.current.chatContext.isSubmitting).toBe(true);
+  });
+});
diff --git a/client/src/hooks/Messages/__tests__/useMessageScrolling.spec.tsx b/client/src/hooks/Messages/__tests__/useMessageScrolling.spec.tsx
new file mode 100644
index 00000000000..97f56e29436
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/useMessageScrolling.spec.tsx
@@ -0,0 +1,290 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import { act, fireEvent, render, screen } from '@testing-library/react';
+import type { TConversation, TMessage } from 'librechat-data-provider';
+import {
+  MessagesViewContext,
+  type MessagesViewContextValue,
+} from '~/Providers/MessagesViewContext';
+
+type MockScrollToBottom = jest.Mock & {
+  cancel: jest.Mock;
+  flush: jest.Mock;
+};
+
+const mockScrollToBottom = jest.fn() as MockScrollToBottom;
+mockScrollToBottom.cancel = jest.fn();
+mockScrollToBottom.flush = jest.fn();
+const mockHandleSmoothToRef = jest.fn();
+let mockScrollCallback: (() => void) | undefined;
+
+jest.mock('~/hooks/useScrollToRef', () => ({
+  __esModule: true,
+  default: ({ callback }: { callback: () => void }) => {
+    mockScrollCallback = callback;
+    return {
+      scrollToRef: mockScrollToBottom,
+      handleSmoothToRef: mockHandleSmoothToRef,
+    };
+  },
+}));
+
+jest.mock('../messageLayout', () => ({
+  reconcileMessageContentLayout: jest.fn(),
+}));
+
+import useMessageScrolling from '../useMessageScrolling';
+import { reconcileMessageContentLayout } from '../messageLayout';
+
+const mockReconcileMessageContentLayout = reconcileMessageContentLayout as jest.Mock;
+
+class MockResizeObserver {
+  static instances: MockResizeObserver[] = [];
+
+  static reset() {
+    MockResizeObserver.instances = [];
+  }
+
+  static last(): MockResizeObserver | undefined {
+    return MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+  }
+
+  readonly callback: ResizeObserverCallback;
+  observe = jest.fn();
+  unobserve = jest.fn();
+  disconnect = jest.fn();
+
+  constructor(callback: ResizeObserverCallback) {
+    this.callback = callback;
+    MockResizeObserver.instances.push(this);
+  }
+
+  trigger() {
+    this.callback([], this as unknown as ResizeObserver);
+  }
+}
+
+class MockIntersectionObserver {
+  static instances: MockIntersectionObserver[] = [];
+
+  static reset() {
+    MockIntersectionObserver.instances = [];
+  }
+
+  readonly callback: IntersectionObserverCallback;
+  observe = jest.fn();
+  unobserve = jest.fn();
+  disconnect = jest.fn();
+  takeRecords = jest.fn(() => []);
+
+  constructor(callback: IntersectionObserverCallback) {
+    this.callback = callback;
+    MockIntersectionObserver.instances.push(this);
+  }
+}
+
+const originalResizeObserver = global.ResizeObserver;
+const originalIntersectionObserver = global.IntersectionObserver;
+
+function setRect(element: HTMLElement, rect: Partial<DOMRect>): void {
+  element.getBoundingClientRect = jest.fn(
+    () =>
+      ({
+        x: rect.x ?? 0,
+        y: rect.y ?? 0,
+        top: rect.top ?? 0,
+        left: rect.left ?? 0,
+        right: rect.right ?? 0,
+        bottom: rect.bottom ?? 0,
+        width: rect.width ?? 0,
+        height: rect.height ?? 0,
+        toJSON: () => ({}),
+      }) as DOMRect,
+  );
+}
+
+const conversation = {
+  conversationId: 'conversation-1',
+  endpoint: 'openAI',
+  model: 'gpt-4',
+} as TConversation;
+
+const message = {
+  messageId: 'message-1',
+  conversationId: conversation.conversationId,
+  isCreatedByUser: false,
+} as TMessage;
+
+function createContextValue(
+  overrides: Partial<MessagesViewContextValue> = {},
+): MessagesViewContextValue {
+  return {
+    conversation,
+    conversationId: conversation.conversationId,
+    isSubmitting: true,
+    abortScroll: false,
+    setAbortScroll: jest.fn(),
+    ask: jest.fn(),
+    regenerate: jest.fn(),
+    handleContinue: jest.fn(),
+    index: 0,
+    latestMessageId: message.messageId,
+    latestMessageDepth: 0,
+    getMessages: jest.fn(),
+    setMessages: jest.fn(),
+    ...overrides,
+  } as MessagesViewContextValue;
+}
+
+function ScrollingHarness({ messagesTree }: { messagesTree?: TMessage[] | null }) {
+  const { contentRef, scrollableRef, messagesEndRef, debouncedHandleScroll } =
+    useMessageScrolling(messagesTree);
+
+  return (
+    <div ref={scrollableRef} onScroll={debouncedHandleScroll} data-testid="scrollable">
+      <div ref={contentRef} data-testid="content">
+        <div ref={messagesEndRef} data-testid="end" />
+      </div>
+    </div>
+  );
+}
+
+function renderScrolling({
+  contextOverrides,
+  messagesTree,
+}: {
+  contextOverrides?: Partial<MessagesViewContextValue>;
+  messagesTree?: TMessage[] | null;
+} = {}) {
+  return render(
+    <RecoilRoot>
+      <MessagesViewContext.Provider value={createContextValue(contextOverrides)}>
+        <ScrollingHarness messagesTree={messagesTree} />
+      </MessagesViewContext.Provider>
+    </RecoilRoot>,
+  );
+}
+
+describe('useMessageScrolling resize reconciliation', () => {
+  beforeEach(() => {
+    MockResizeObserver.reset();
+    MockIntersectionObserver.reset();
+    mockScrollToBottom.mockClear();
+    mockScrollToBottom.cancel.mockClear();
+    mockScrollToBottom.flush.mockClear();
+    mockHandleSmoothToRef.mockClear();
+    mockReconcileMessageContentLayout.mockClear();
+    mockScrollCallback = undefined;
+    (global as unknown as { ResizeObserver: typeof MockResizeObserver }).ResizeObserver =
+      MockResizeObserver;
+    (
+      global as unknown as { IntersectionObserver: typeof MockIntersectionObserver }
+    ).IntersectionObserver = MockIntersectionObserver;
+  });
+
+  afterEach(() => {
+    (global as unknown as { ResizeObserver: typeof ResizeObserver | undefined }).ResizeObserver =
+      originalResizeObserver;
+    (
+      global as unknown as { IntersectionObserver: typeof IntersectionObserver | undefined }
+    ).IntersectionObserver = originalIntersectionObserver;
+  });
+
+  it('scrolls to the bottom when streaming content resizes and auto-scroll is active', () => {
+    renderScrolling();
+
+    const observer = MockResizeObserver.last();
+    expect(observer?.observe).toHaveBeenCalledWith(screen.getByTestId('content'));
+
+    act(() => {
+      observer?.trigger();
+    });
+
+    expect(mockScrollToBottom).toHaveBeenCalledTimes(1);
+  });
+
+  it('reconciles message layout after an explicit scroll to bottom', () => {
+    renderScrolling();
+
+    const scrollable = screen.getByTestId('scrollable');
+    act(() => {
+      mockScrollCallback?.();
+    });
+
+    expect(mockReconcileMessageContentLayout).toHaveBeenCalledWith(scrollable);
+  });
+
+  it('does not follow resizes after the user aborts streaming auto-scroll', () => {
+    renderScrolling({ contextOverrides: { abortScroll: true } });
+
+    act(() => {
+      MockResizeObserver.last()?.trigger();
+    });
+
+    expect(mockScrollToBottom).not.toHaveBeenCalled();
+  });
+
+  it('does not follow resizes after the user scrolls away from the bottom', () => {
+    renderScrolling();
+
+    const scrollable = screen.getByTestId('scrollable');
+    Object.defineProperty(scrollable, 'scrollHeight', { value: 1000, configurable: true });
+    Object.defineProperty(scrollable, 'clientHeight', { value: 200, configurable: true });
+    scrollable.scrollTop = 100;
+
+    fireEvent.scroll(scrollable);
+
+    act(() => {
+      MockResizeObserver.last()?.trigger();
+    });
+
+    expect(mockScrollToBottom).not.toHaveBeenCalled();
+  });
+
+  it('does not follow the next resize after user interaction inside message content', () => {
+    renderScrolling();
+
+    fireEvent.pointerDown(screen.getByTestId('content'));
+
+    act(() => {
+      MockResizeObserver.last()?.trigger();
+    });
+
+    expect(mockScrollToBottom).not.toHaveBeenCalled();
+  });
+
+  it('clamps the scroll position back to content after a resize shrink', () => {
+    renderScrolling({ contextOverrides: { abortScroll: true } });
+
+    const scrollable = screen.getByTestId('scrollable');
+    Object.defineProperty(scrollable, 'scrollHeight', { value: 500, configurable: true });
+    Object.defineProperty(scrollable, 'clientHeight', { value: 200, configurable: true });
+    scrollable.scrollTop = 450;
+
+    act(() => {
+      MockResizeObserver.last()?.trigger();
+    });
+
+    expect(scrollable.scrollTop).toBe(300);
+    expect(mockScrollToBottom).not.toHaveBeenCalled();
+  });
+
+  it('does not clamp to rendered content bottom during general resize reconciliation', () => {
+    renderScrolling({ contextOverrides: { abortScroll: true } });
+
+    const scrollable = screen.getByTestId('scrollable');
+    const content = screen.getByTestId('content');
+    Object.defineProperty(scrollable, 'scrollHeight', { value: 1000, configurable: true });
+    Object.defineProperty(scrollable, 'clientHeight', { value: 200, configurable: true });
+    scrollable.scrollTop = 700;
+    setRect(scrollable, { top: 0, bottom: 200, height: 200 });
+    setRect(content, { top: -700, bottom: -200, height: 500 });
+
+    act(() => {
+      MockResizeObserver.last()?.trigger();
+    });
+
+    expect(scrollable.scrollTop).toBe(700);
+    expect(mockScrollToBottom).not.toHaveBeenCalled();
+  });
+});
diff --git a/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts b/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts
new file mode 100644
index 00000000000..3e99477aebb
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts
@@ -0,0 +1,85 @@
+import { act, renderHook } from '@testing-library/react';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
+import { useChatContext, useChatFormContext, useAddedChatContext } from '~/Providers';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
+import { useAuthContext } from '~/hooks/AuthContext';
+import useSubmitMessage from '../useSubmitMessage';
+
+const mockSetActivePrompt = jest.fn();
+
+jest.mock('recoil', () => ({
+  useRecoilValue: jest.fn(),
+  useSetRecoilState: jest.fn(),
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  replaceSpecialVars: jest.fn(({ text }) => text),
+}));
+
+jest.mock('~/Providers', () => ({
+  useChatContext: jest.fn(),
+  useChatFormContext: jest.fn(),
+  useAddedChatContext: jest.fn(),
+}));
+
+jest.mock('~/hooks/AuthContext', () => ({
+  useAuthContext: jest.fn(),
+}));
+
+jest.mock('~/hooks/Messages/useLatestMessage', () => ({
+  useLatestMessage: jest.fn(),
+}));
+
+jest.mock('~/store', () => ({
+  __esModule: true,
+  default: {
+    autoSendPrompts: 'autoSendPrompts',
+    activePromptByIndex: jest.fn(() => 'activePromptByIndex'),
+  },
+}));
+
+const mockUseRecoilValue = useRecoilValue as jest.Mock;
+const mockUseSetRecoilState = useSetRecoilState as jest.Mock;
+const mockUseChatContext = useChatContext as jest.Mock;
+const mockUseChatFormContext = useChatFormContext as jest.Mock;
+const mockUseAddedChatContext = useAddedChatContext as jest.Mock;
+const mockUseAuthContext = useAuthContext as jest.Mock;
+const mockUseLatestMessage = useLatestMessage as jest.Mock;
+
+describe('useSubmitMessage', () => {
+  const ask = jest.fn();
+  const reset = jest.fn();
+  const setMessages = jest.fn();
+  const getMessages = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUseRecoilValue.mockReturnValue(false);
+    mockUseSetRecoilState.mockReturnValue(mockSetActivePrompt);
+    mockUseAuthContext.mockReturnValue({ user: { id: 'user-1' } });
+    mockUseAddedChatContext.mockReturnValue({ conversation: null });
+    mockUseChatFormContext.mockReturnValue({ reset, getValues: jest.fn(() => '') });
+    mockUseLatestMessage.mockReturnValue({ messageId: 'assistant-message' });
+    getMessages.mockReturnValue([{ messageId: 'assistant-message' }]);
+    mockUseChatContext.mockReturnValue({
+      ask,
+      index: 0,
+      getMessages,
+      setMessages,
+    });
+  });
+
+  it('propagates blocked submits so direct callers can preserve their text', () => {
+    ask.mockReturnValue(false);
+
+    const { result } = renderHook(() => useSubmitMessage());
+
+    let submitted: false | void = undefined;
+    act(() => {
+      submitted = result.current.submitMessage({ text: 'dictated follow-up' });
+    });
+
+    expect(submitted).toBe(false);
+    expect(reset).not.toHaveBeenCalled();
+  });
+});
diff --git a/client/src/hooks/Messages/index.ts b/client/src/hooks/Messages/index.ts
index 439b7e152e8..ad93d910a1e 100644
--- a/client/src/hooks/Messages/index.ts
+++ b/client/src/hooks/Messages/index.ts
@@ -1,10 +1,18 @@
 export { default as useProgress } from './useProgress';
+export {
+  MESSAGE_CONTENT_LAYOUT_CHANGE_EVENT,
+  dispatchMessageContentLayoutChange,
+  getRenderedContentMaxScrollTop,
+  reconcileMessageContentLayout,
+  scheduleMessageContentLayoutReconcile,
+} from './messageLayout';
 export { EXPAND_TRANSITION } from './useExpandCollapse';
 export { default as useAttachments } from './useAttachments';
 export { default as useSubmitMessage } from './useSubmitMessage';
 export type { ContentMetadataResult } from './useContentMetadata';
 export { default as useExpandCollapse } from './useExpandCollapse';
 export { default as useMessageActions } from './useMessageActions';
+export { useLatestMessage, useLatestMessageId } from './useLatestMessage';
 export { default as useMemoizedChatContext } from './useMemoizedChatContext';
 export { default as useMessageProcess } from './useMessageProcess';
 export { default as useMessageHelpers } from './useMessageHelpers';
diff --git a/client/src/hooks/Messages/messageLayout.ts b/client/src/hooks/Messages/messageLayout.ts
new file mode 100644
index 00000000000..203e0c9e3f8
--- /dev/null
+++ b/client/src/hooks/Messages/messageLayout.ts
@@ -0,0 +1,87 @@
+export const MESSAGE_CONTENT_LAYOUT_CHANGE_EVENT = 'librechat:message-content-layout-change';
+const MESSAGE_SCROLL_CONTAINER_SELECTOR = '.scrollbar-gutter-stable';
+const MESSAGE_LAYOUT_RECONCILE_DURATION_MS = 350;
+
+function getNow(): number {
+  return typeof performance !== 'undefined' ? performance.now() : Date.now();
+}
+
+function getContentElement(scrollEl: HTMLElement): HTMLElement | null {
+  return scrollEl.firstElementChild instanceof HTMLElement ? scrollEl.firstElementChild : null;
+}
+
+export function getRenderedContentMaxScrollTop(scrollEl: HTMLElement): number {
+  const scrollHeightMax = Math.max(0, scrollEl.scrollHeight - scrollEl.clientHeight);
+  const contentEl = getContentElement(scrollEl);
+  if (!contentEl) {
+    return scrollHeightMax;
+  }
+
+  const scrollRect = scrollEl.getBoundingClientRect();
+  const contentRect = contentEl.getBoundingClientRect();
+  if (scrollRect.height === 0 && contentRect.height === 0 && scrollEl.clientHeight > 0) {
+    return scrollHeightMax;
+  }
+
+  const contentBottom = contentRect.bottom - scrollRect.top + scrollEl.scrollTop;
+  const renderedMax = Math.max(0, Math.ceil(contentBottom - scrollEl.clientHeight));
+
+  return Math.min(scrollHeightMax, renderedMax);
+}
+
+export function reconcileMessageContentLayout(target: HTMLElement | null): boolean {
+  const scrollEl = target?.closest<HTMLElement>(MESSAGE_SCROLL_CONTAINER_SELECTOR) ?? null;
+  if (!scrollEl) {
+    return false;
+  }
+
+  const maxScrollTop = getRenderedContentMaxScrollTop(scrollEl);
+  if (scrollEl.scrollTop <= maxScrollTop) {
+    return false;
+  }
+
+  scrollEl.scrollTop = maxScrollTop;
+  return true;
+}
+
+export function scheduleMessageContentLayoutReconcile(target: HTMLElement | null): () => void {
+  reconcileMessageContentLayout(target);
+  if (
+    !target ||
+    typeof window === 'undefined' ||
+    typeof window.requestAnimationFrame !== 'function'
+  ) {
+    return () => {};
+  }
+
+  const startedAt = getNow();
+  let animationFrameId: number | undefined;
+  const reconcile = () => {
+    reconcileMessageContentLayout(target);
+    if (getNow() - startedAt >= MESSAGE_LAYOUT_RECONCILE_DURATION_MS) {
+      animationFrameId = undefined;
+      return;
+    }
+    animationFrameId = window.requestAnimationFrame(reconcile);
+  };
+
+  animationFrameId = window.requestAnimationFrame(reconcile);
+  return () => {
+    if (animationFrameId !== undefined) {
+      window.cancelAnimationFrame(animationFrameId);
+    }
+  };
+}
+
+export function dispatchMessageContentLayoutChange(target: HTMLElement | null): void {
+  reconcileMessageContentLayout(target);
+  if (!target || typeof CustomEvent === 'undefined') {
+    return;
+  }
+
+  target.dispatchEvent(
+    new CustomEvent(MESSAGE_CONTENT_LAYOUT_CHANGE_EVENT, {
+      bubbles: true,
+    }),
+  );
+}
diff --git a/client/src/hooks/Messages/useCopyToClipboard.ts b/client/src/hooks/Messages/useCopyToClipboard.ts
index 501ac942032..f827d952005 100644
--- a/client/src/hooks/Messages/useCopyToClipboard.ts
+++ b/client/src/hooks/Messages/useCopyToClipboard.ts
@@ -56,7 +56,7 @@ export default function useCopyToClipboard({
       if (content) {
         messageText = content.reduce((acc, curr, i) => {
           if (curr.type === ContentTypes.TEXT) {
-            const text = typeof curr.text === 'string' ? curr.text : curr.text.value;
+            const text = typeof curr.text === 'string' ? curr.text : (curr.text?.value ?? '');
             return acc + text + (i === content.length - 1 ? '' : '\n');
           }
           return acc;
diff --git a/client/src/hooks/Messages/useLatestMessage.ts b/client/src/hooks/Messages/useLatestMessage.ts
new file mode 100644
index 00000000000..ef8fce1362f
--- /dev/null
+++ b/client/src/hooks/Messages/useLatestMessage.ts
@@ -0,0 +1,129 @@
+import { useCallback } from 'react';
+import { selectorFamily, useRecoilValue } from 'recoil';
+import { useParams } from 'react-router-dom';
+import { useQuery, useQueryClient } from '@tanstack/react-query';
+import { Constants, QueryKeys } from 'librechat-data-provider';
+import type { TMessage } from 'librechat-data-provider';
+import { getMessageBranchSiblingParentIds, selectActiveBranchTail } from '~/utils';
+import store from '~/store';
+
+const NULL_PARENT_KEY = '__null_parent__';
+const EMPTY_PARENT_IDS: (string | null)[] = [];
+
+const getParentLookupKey = (parentMessageId: string | null | undefined) =>
+  parentMessageId ?? NULL_PARENT_KEY;
+
+const siblingIndexesByParentSelector = selectorFamily<
+  Record<string, number>,
+  readonly (string | null)[]
+>({
+  key: 'latestMessageSiblingIndexesByParent',
+  get:
+    (parentIds) =>
+    ({ get }) => {
+      const indexes: Record<string, number> = {};
+
+      for (const parentId of parentIds) {
+        indexes[getParentLookupKey(parentId)] = get(store.messagesSiblingIdxFamily(parentId));
+      }
+
+      return indexes;
+    },
+});
+
+function useMessagesCacheSelect<TData>(
+  messagesQueryId: string | null | undefined,
+  select: (messages: TMessage[]) => TData,
+): TData | null {
+  const queryClient = useQueryClient();
+  const queryKey = [QueryKeys.messages, messagesQueryId ?? ''];
+
+  const { data } = useQuery<TMessage[], unknown, TData>(
+    queryKey,
+    async () => queryClient.getQueryData<TMessage[]>(queryKey) ?? [],
+    {
+      enabled: false,
+      select,
+    },
+  );
+
+  if (!messagesQueryId) {
+    return null;
+  }
+
+  return data ?? null;
+}
+
+function useLatestMessagesQueryId(
+  index: string | number,
+  conversationId: string | null,
+  messagesQueryId?: string | null,
+) {
+  const { conversationId: routeConversationId } = useParams();
+
+  if (!conversationId) {
+    return null;
+  }
+
+  if (messagesQueryId != null) {
+    return messagesQueryId;
+  }
+
+  if (index === 0 && routeConversationId) {
+    return routeConversationId === Constants.NEW_CONVO ? Constants.NEW_CONVO : routeConversationId;
+  }
+
+  return conversationId;
+}
+
+function useLatestMessageSiblingIndexes(
+  messagesQueryId: string | null | undefined,
+  rootSiblingKey: string | null,
+) {
+  const selectParentIds = useCallback(
+    (messages: TMessage[]) => getMessageBranchSiblingParentIds(messages, rootSiblingKey),
+    [rootSiblingKey],
+  );
+  const parentIds = useMessagesCacheSelect(messagesQueryId, selectParentIds) ?? EMPTY_PARENT_IDS;
+  return useRecoilValue(siblingIndexesByParentSelector(parentIds));
+}
+
+export function useLatestMessage(
+  index: string | number,
+  messagesQueryIdOverride?: string | null,
+): TMessage | null {
+  const conversationId = useRecoilValue(store.conversationIdByIndex(index));
+  const messagesQueryId = useLatestMessagesQueryId(index, conversationId, messagesQueryIdOverride);
+  const siblingIndexes = useLatestMessageSiblingIndexes(messagesQueryId, conversationId);
+  const select = useCallback(
+    (messages: TMessage[]) =>
+      selectActiveBranchTail(
+        messages,
+        conversationId,
+        (parentId) => siblingIndexes[getParentLookupKey(parentId)] ?? 0,
+      ),
+    [conversationId, siblingIndexes],
+  );
+
+  return useMessagesCacheSelect(messagesQueryId, select);
+}
+
+export function useLatestMessageId(
+  index: string | number,
+  messagesQueryIdOverride?: string | null,
+): string | null {
+  const conversationId = useRecoilValue(store.conversationIdByIndex(index));
+  const messagesQueryId = useLatestMessagesQueryId(index, conversationId, messagesQueryIdOverride);
+  const siblingIndexes = useLatestMessageSiblingIndexes(messagesQueryId, conversationId);
+  const select = useCallback(
+    (messages: TMessage[]) =>
+      selectActiveBranchTail(
+        messages,
+        conversationId,
+        (parentId) => siblingIndexes[getParentLookupKey(parentId)] ?? 0,
+      )?.messageId ?? null,
+    [conversationId, siblingIndexes],
+  );
+
+  return useMessagesCacheSelect(messagesQueryId, select);
+}
diff --git a/client/src/hooks/Messages/useMessageHelpers.tsx b/client/src/hooks/Messages/useMessageHelpers.tsx
index 0453e4a49c7..fb92c17e8e5 100644
--- a/client/src/hooks/Messages/useMessageHelpers.tsx
+++ b/client/src/hooks/Messages/useMessageHelpers.tsx
@@ -1,14 +1,13 @@
-import { useEffect, useRef, useCallback, useMemo } from 'react';
+import { useCallback, useMemo } from 'react';
 import throttle from 'lodash/throttle';
-import { Constants, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
+import { isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import type { TMessageProps } from '~/common';
 import { useMessagesViewContext, useAssistantsMapContext, useAgentsMapContext } from '~/Providers';
-import { getTextKey, TEXT_KEY_DIVIDER, logger } from '~/utils';
 import useCopyToClipboard from './useCopyToClipboard';
 import { useGetAddedConvo } from '~/hooks/Chat';
+import { logger } from '~/utils';
 
 export default function useMessageHelpers(props: TMessageProps) {
-  const latestText = useRef<string | number>('');
   const { message, currentEditId, setCurrentEditId } = props;
 
   const {
@@ -20,7 +19,6 @@ export default function useMessageHelpers(props: TMessageProps) {
     setAbortScroll,
     handleContinue,
     latestMessageId,
-    setLatestMessage,
   } = useMessagesViewContext();
   const agentsMap = useAgentsMapContext();
   const assistantMap = useAssistantsMapContext();
@@ -31,51 +29,6 @@ export default function useMessageHelpers(props: TMessageProps) {
   const edit = messageId === currentEditId;
   const isLast = children?.length === 0 || children?.length === undefined;
 
-  useEffect(() => {
-    const convoId = conversation?.conversationId;
-    if (convoId === Constants.NEW_CONVO) {
-      return;
-    }
-    if (!message) {
-      return;
-    }
-    if (!isLast) {
-      return;
-    }
-
-    const textKey = getTextKey(message, convoId);
-
-    // Check for text/conversation change
-    const logInfo = {
-      textKey,
-      'latestText.current': latestText.current,
-      messageId: message.messageId,
-      convoId,
-    };
-
-    /* Extracted convoId from previous textKey (format: messageId|||length|||lastChars|||convoId) */
-    let previousConvoId: string | null = null;
-    if (
-      latestText.current &&
-      typeof latestText.current === 'string' &&
-      latestText.current.length > 0
-    ) {
-      const parts = latestText.current.split(TEXT_KEY_DIVIDER);
-      previousConvoId = parts[parts.length - 1] || null;
-    }
-
-    if (
-      textKey !== latestText.current ||
-      (convoId != null && previousConvoId != null && convoId !== previousConvoId)
-    ) {
-      logger.log('latest_message', '[useMessageHelpers] Setting latest message: ', logInfo);
-      latestText.current = textKey;
-      setLatestMessage({ ...message });
-    } else {
-      logger.log('latest_message', 'No change in latest message', logInfo);
-    }
-  }, [isLast, message, setLatestMessage, conversation?.conversationId]);
-
   const enterEdit = useCallback(
     (cancel?: boolean) => setCurrentEditId && setCurrentEditId(cancel === true ? -1 : messageId),
     [messageId, setCurrentEditId],
diff --git a/client/src/hooks/Messages/useMessageProcess.tsx b/client/src/hooks/Messages/useMessageProcess.tsx
index bb49670a2fc..283926a4237 100644
--- a/client/src/hooks/Messages/useMessageProcess.tsx
+++ b/client/src/hooks/Messages/useMessageProcess.tsx
@@ -1,60 +1,11 @@
 import throttle from 'lodash/throttle';
-import { Constants } from 'librechat-data-provider';
 import { useEffect, useRef, useMemo } from 'react';
 import type { TMessage } from 'librechat-data-provider';
-import { getTextKey, TEXT_KEY_DIVIDER, logger } from '~/utils';
 import { useMessagesViewContext } from '~/Providers';
+import { logger } from '~/utils';
 
-export default function useMessageProcess({ message }: { message?: TMessage | null }) {
-  const latestText = useRef<string | number>('');
-  const hasNoChildren = useMemo(() => (message?.children?.length ?? 0) === 0, [message]);
-
-  const { conversation, setAbortScroll, setLatestMessage, isSubmitting } = useMessagesViewContext();
-
-  useEffect(() => {
-    const convoId = conversation?.conversationId;
-    if (convoId === Constants.NEW_CONVO) {
-      return;
-    }
-    if (!message) {
-      return;
-    }
-    if (!hasNoChildren) {
-      return;
-    }
-
-    const textKey = getTextKey(message, convoId);
-
-    // Check for text/conversation change
-    const logInfo = {
-      textKey,
-      'latestText.current': latestText.current,
-      messageId: message.messageId,
-      convoId,
-    };
-
-    /* Extracted convoId from previous textKey (format: messageId|||length|||lastChars|||convoId) */
-    let previousConvoId: string | null = null;
-    if (
-      latestText.current &&
-      typeof latestText.current === 'string' &&
-      latestText.current.length > 0
-    ) {
-      const parts = latestText.current.split(TEXT_KEY_DIVIDER);
-      previousConvoId = parts[parts.length - 1] || null;
-    }
-
-    if (
-      textKey !== latestText.current ||
-      (convoId != null && previousConvoId != null && convoId !== previousConvoId)
-    ) {
-      logger.log('latest_message', '[useMessageProcess] Setting latest message; logInfo:', logInfo);
-      latestText.current = textKey;
-      setLatestMessage({ ...message });
-    } else {
-      logger.log('latest_message', 'No change in latest message; logInfo', logInfo);
-    }
-  }, [hasNoChildren, message, setLatestMessage, conversation?.conversationId]);
+export default function useMessageProcess({ message: _message }: { message?: TMessage | null }) {
+  const { conversation, setAbortScroll, isSubmitting } = useMessagesViewContext();
 
   /** Use ref for isSubmitting to stabilize handleScroll across isSubmitting changes */
   const isSubmittingRef = useRef(isSubmitting);
diff --git a/client/src/hooks/Messages/useMessageScrolling.ts b/client/src/hooks/Messages/useMessageScrolling.ts
index 9fa51f0851b..84e420f848b 100644
--- a/client/src/hooks/Messages/useMessageScrolling.ts
+++ b/client/src/hooks/Messages/useMessageScrolling.ts
@@ -4,22 +4,36 @@ import { useState, useRef, useCallback, useEffect } from 'react';
 import type { TMessage } from 'librechat-data-provider';
 import { useMessagesConversation, useMessagesSubmission } from '~/Providers';
 import useScrollToRef from '~/hooks/useScrollToRef';
+import { reconcileMessageContentLayout } from './messageLayout';
 import store from '~/store';
 
 const threshold = 0.85;
 const debounceRate = 150;
+const resizeFollowThreshold = 120;
 
 export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
   const autoScroll = useRecoilValue(store.autoScroll);
 
   const scrollableRef = useRef<HTMLDivElement | null>(null);
+  const contentRef = useRef<HTMLDivElement | null>(null);
   const messagesEndRef = useRef<HTMLDivElement | null>(null);
+  const isNearBottomRef = useRef(true);
+  const suppressNextResizeFollowRef = useRef(false);
   const [showScrollButton, setShowScrollButton] = useState(false);
   const { conversation, conversationId } = useMessagesConversation();
   const { setAbortScroll, isSubmitting, abortScroll } = useMessagesSubmission();
 
   const timeoutIdRef = useRef<NodeJS.Timeout>();
 
+  const getIsNearBottom = useCallback(() => {
+    const scrollEl = scrollableRef.current;
+    if (!scrollEl) {
+      return true;
+    }
+    const distance = scrollEl.scrollHeight - scrollEl.scrollTop - scrollEl.clientHeight;
+    return distance <= resizeFollowThreshold;
+  }, []);
+
   const debouncedSetShowScrollButton = useCallback((value: boolean) => {
     clearTimeout(timeoutIdRef.current);
     timeoutIdRef.current = setTimeout(() => {
@@ -34,6 +48,7 @@ export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
 
     const observer = new IntersectionObserver(
       ([entry]) => {
+        isNearBottomRef.current = entry.isIntersecting;
         debouncedSetShowScrollButton(!entry.isIntersecting);
       },
       { root: scrollableRef.current, threshold },
@@ -48,9 +63,11 @@ export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
   }, [messagesEndRef, scrollableRef, debouncedSetShowScrollButton]);
 
   const debouncedHandleScroll = useCallback(() => {
+    isNearBottomRef.current = getIsNearBottom();
     if (messagesEndRef.current && scrollableRef.current) {
       const observer = new IntersectionObserver(
         ([entry]) => {
+          isNearBottomRef.current = entry.isIntersecting;
           debouncedSetShowScrollButton(!entry.isIntersecting);
         },
         { root: scrollableRef.current, threshold },
@@ -58,9 +75,13 @@ export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
       observer.observe(messagesEndRef.current);
       return () => observer.disconnect();
     }
-  }, [debouncedSetShowScrollButton]);
+  }, [debouncedSetShowScrollButton, getIsNearBottom]);
 
-  const scrollCallback = () => debouncedSetShowScrollButton(false);
+  const scrollCallback = () => {
+    reconcileMessageContentLayout(scrollableRef.current);
+    isNearBottomRef.current = true;
+    debouncedSetShowScrollButton(false);
+  };
 
   const { scrollToRef: scrollToBottom, handleSmoothToRef } = useScrollToRef({
     targetRef: messagesEndRef,
@@ -71,6 +92,70 @@ export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
     },
   });
 
+  const clampScrollToContent = useCallback(() => {
+    const scrollEl = scrollableRef.current;
+    if (!scrollEl) {
+      return false;
+    }
+
+    const maxScrollTop = Math.max(0, scrollEl.scrollHeight - scrollEl.clientHeight);
+    if (scrollEl.scrollTop <= maxScrollTop) {
+      return false;
+    }
+
+    scrollEl.scrollTop = maxScrollTop;
+    isNearBottomRef.current = getIsNearBottom();
+    return true;
+  }, [getIsNearBottom]);
+
+  const reconcileContentResize = useCallback(
+    (shouldFollowResize = true) => {
+      if (clampScrollToContent()) {
+        return;
+      }
+
+      if (suppressNextResizeFollowRef.current) {
+        suppressNextResizeFollowRef.current = false;
+        isNearBottomRef.current = getIsNearBottom();
+        return;
+      }
+
+      if (shouldFollowResize && isSubmitting && abortScroll !== true && isNearBottomRef.current) {
+        scrollToBottom?.();
+      }
+    },
+    [abortScroll, clampScrollToContent, getIsNearBottom, isSubmitting, scrollToBottom],
+  );
+
+  useEffect(() => {
+    const contentEl = contentRef.current;
+    if (!contentEl || typeof ResizeObserver === 'undefined') {
+      return;
+    }
+
+    const observer = new ResizeObserver(() => reconcileContentResize());
+    observer.observe(contentEl);
+    return () => observer.disconnect();
+  }, [reconcileContentResize]);
+
+  useEffect(() => {
+    const contentEl = contentRef.current;
+    if (!contentEl) {
+      return;
+    }
+
+    const suppressNextResizeFollow = () => {
+      suppressNextResizeFollowRef.current = true;
+    };
+
+    contentEl.addEventListener('pointerdown', suppressNextResizeFollow, true);
+    contentEl.addEventListener('keydown', suppressNextResizeFollow, true);
+    return () => {
+      contentEl.removeEventListener('pointerdown', suppressNextResizeFollow, true);
+      contentEl.removeEventListener('keydown', suppressNextResizeFollow, true);
+    };
+  }, []);
+
   useEffect(() => {
     if (!messagesTree || messagesTree.length === 0) {
       return;
@@ -103,6 +188,7 @@ export default function useMessageScrolling(messagesTree?: TMessage[] | null) {
 
   return {
     conversation,
+    contentRef,
     scrollableRef,
     messagesEndRef,
     scrollToBottom,
diff --git a/client/src/hooks/Messages/useSearchResultsByTurn.ts b/client/src/hooks/Messages/useSearchResultsByTurn.ts
index 5005fc48a9d..d7ec2c265b7 100644
--- a/client/src/hooks/Messages/useSearchResultsByTurn.ts
+++ b/client/src/hooks/Messages/useSearchResultsByTurn.ts
@@ -20,6 +20,17 @@ interface DeduplicatedSource {
   metadata?: any;
 }
 
+/**
+ * The `file_search` attachment is typed as {@link SearchResultData} in the
+ * shared schema, but at runtime the agent file-search tool emits a
+ * `{ sources: FileSource[] }` payload. Read the sources defensively.
+ */
+type FileSearchAttachmentData = SearchResultData & { sources?: FileSource[] };
+
+function getFileSearchSources(data: FileSearchAttachmentData): FileSource[] {
+  return Array.isArray(data.sources) ? data.sources : [];
+}
+
 /**
  * Hook that creates a map of turn numbers to SearchResultData from web search and agent file search attachments
  * @param attachments Array of attachment metadata
@@ -42,7 +53,7 @@ export function useSearchResultsByTurn(attachments?: TAttachment[]) {
 
       // Handle agent file search attachments (following web search pattern)
       if (attachment.type === Tools.file_search && attachment[Tools.file_search]) {
-        const sources = attachment[Tools.file_search].sources;
+        const sources = getFileSearchSources(attachment[Tools.file_search]);
 
         // Deduplicate sources by fileId and merge pages
         const deduplicatedSources = new Map<string, DeduplicatedSource>();
diff --git a/client/src/hooks/Messages/useSubmitMessage.ts b/client/src/hooks/Messages/useSubmitMessage.ts
index 8fd06e6003d..7a683e80ad1 100644
--- a/client/src/hooks/Messages/useSubmitMessage.ts
+++ b/client/src/hooks/Messages/useSubmitMessage.ts
@@ -2,6 +2,7 @@ import { useCallback } from 'react';
 import { useRecoilValue, useSetRecoilState } from 'recoil';
 import { replaceSpecialVars } from 'librechat-data-provider';
 import { useChatContext, useChatFormContext, useAddedChatContext } from '~/Providers';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { useAuthContext } from '~/hooks/AuthContext';
 import { mainTextareaId } from '~/common';
 import store from '~/store';
@@ -11,7 +12,7 @@ export default function useSubmitMessage() {
   const methods = useChatFormContext();
   const { conversation: addedConvo } = useAddedChatContext();
   const { ask, index, getMessages, setMessages } = useChatContext();
-  const latestMessage = useRecoilValue(store.latestMessageFamily(index));
+  const latestMessage = useLatestMessage(index);
 
   const autoSendPrompts = useRecoilValue(store.autoSendPrompts);
   const setActivePrompt = useSetRecoilState(store.activePromptByIndex(index));
@@ -29,7 +30,7 @@ export default function useSubmitMessage() {
         setMessages([...(rootMessages || []), latestMessage]);
       }
 
-      ask(
+      const submitted = ask(
         {
           text: data.text,
         },
@@ -37,6 +38,9 @@ export default function useSubmitMessage() {
           addedConvo: addedConvo ?? undefined,
         },
       );
+      if (submitted === false) {
+        return false;
+      }
       methods.reset();
     },
     [ask, methods, addedConvo, setMessages, getMessages, latestMessage],
diff --git a/client/src/hooks/Plugins/__tests__/useToolToggle.pinDefault.test.tsx b/client/src/hooks/Plugins/__tests__/useToolToggle.pinDefault.test.tsx
new file mode 100644
index 00000000000..d2a13b3f706
--- /dev/null
+++ b/client/src/hooks/Plugins/__tests__/useToolToggle.pinDefault.test.tsx
@@ -0,0 +1,108 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import { renderHook, act, waitFor } from '@testing-library/react';
+import { LocalStorageKeys, Tools } from 'librechat-data-provider';
+import { useToolToggle } from '../useToolToggle';
+
+/**
+ * Integration tests for the `defaultPinnedTools` pin-seeding logic in useToolToggle,
+ * exercising the REAL useLocalStorageAlt + jsdom localStorage (not mocked).
+ *
+ * Focus: the cold-load race where startupConfig resolves AFTER the hook mounts, and
+ * the guarantee that an existing stored pin preference is never overridden.
+ */
+
+let mockStartupConfig: { interface?: { defaultPinnedTools?: string[] } } | undefined;
+
+jest.mock('~/data-provider', () => ({
+  useVerifyAgentToolAuth: jest.fn(() => ({ data: { authenticated: true } })),
+  useGetStartupConfig: jest.fn(() => ({ data: mockStartupConfig })),
+}));
+
+jest.mock('~/utils/timestamps', () => ({
+  setTimestamp: jest.fn(),
+}));
+
+const Wrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <RecoilRoot>{children}</RecoilRoot>
+);
+
+const pinKey = `${LocalStorageKeys.LAST_CODE_TOGGLE_}pinned`;
+
+const renderCodeToggle = () =>
+  renderHook(
+    () =>
+      useToolToggle({
+        toolKey: Tools.execute_code,
+        localStorageKey: LocalStorageKeys.LAST_CODE_TOGGLE_,
+        isAuthenticated: true,
+      }),
+    { wrapper: Wrapper },
+  );
+
+describe('useToolToggle — defaultPinnedTools seeding (real localStorage)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    localStorage.clear();
+    mockStartupConfig = undefined;
+  });
+
+  it('applies the configured default once startupConfig resolves after mount (cold load)', async () => {
+    // Cold load: config not yet available when the hook mounts.
+    mockStartupConfig = undefined;
+    const { result, rerender } = renderCodeToggle();
+
+    // No stored preference + config unresolved → unpinned.
+    await waitFor(() => expect(result.current.isPinned).toBe(false));
+
+    // Startup config arrives listing this tool.
+    mockStartupConfig = { interface: { defaultPinnedTools: ['execute_code'] } };
+    rerender();
+
+    await waitFor(() => expect(result.current.isPinned).toBe(true));
+    expect(localStorage.getItem(pinKey)).toBe(JSON.stringify(true));
+  });
+
+  it('pins immediately when config is already cached at mount', async () => {
+    mockStartupConfig = { interface: { defaultPinnedTools: ['execute_code'] } };
+    const { result } = renderCodeToggle();
+
+    await waitFor(() => expect(result.current.isPinned).toBe(true));
+  });
+
+  it('does not override an existing stored unpin preference (conservative)', async () => {
+    localStorage.setItem(pinKey, JSON.stringify(false));
+    mockStartupConfig = { interface: { defaultPinnedTools: ['execute_code'] } };
+    const { result } = renderCodeToggle();
+
+    // Give the apply-default effect a chance to (incorrectly) fire.
+    await waitFor(() => expect(result.current.isPinned).toBe(false));
+    expect(localStorage.getItem(pinKey)).toBe(JSON.stringify(false));
+  });
+
+  it('leaves a tool unpinned by default when it is not listed', async () => {
+    mockStartupConfig = { interface: { defaultPinnedTools: ['artifacts'] } };
+    const { result } = renderCodeToggle();
+
+    await waitFor(() => expect(result.current.isPinned).toBe(false));
+  });
+
+  it('preserves a pin toggled before startupConfig resolves', async () => {
+    // Cold load: user pins the tool before the config query resolves.
+    mockStartupConfig = undefined;
+    const { result, rerender } = renderCodeToggle();
+    await waitFor(() => expect(result.current.isPinned).toBe(false));
+
+    act(() => {
+      result.current.setIsPinned(true);
+    });
+    await waitFor(() => expect(result.current.isPinned).toBe(true));
+
+    // Config arrives WITHOUT this tool listed — the user's click must not be overwritten.
+    mockStartupConfig = { interface: { defaultPinnedTools: ['artifacts'] } };
+    rerender();
+
+    await waitFor(() => expect(result.current.isPinned).toBe(true));
+    expect(localStorage.getItem(pinKey)).toBe(JSON.stringify(true));
+  });
+});
diff --git a/client/src/hooks/Plugins/__tests__/useToolToggle.test.tsx b/client/src/hooks/Plugins/__tests__/useToolToggle.test.tsx
index f617db22499..057cee9b9c1 100644
--- a/client/src/hooks/Plugins/__tests__/useToolToggle.test.tsx
+++ b/client/src/hooks/Plugins/__tests__/useToolToggle.test.tsx
@@ -2,6 +2,7 @@ import React from 'react';
 import { renderHook, act, waitFor } from '@testing-library/react';
 import { LocalStorageKeys, Tools } from 'librechat-data-provider';
 import { RecoilRoot, useRecoilValue, useSetRecoilState } from 'recoil';
+import useLocalStorage from '~/hooks/useLocalStorageAlt';
 import { ephemeralAgentByConvoId } from '~/store';
 import { useToolToggle } from '../useToolToggle';
 
@@ -17,11 +18,15 @@ import { useToolToggle } from '../useToolToggle';
  * - The hook reflects the current ephemeral agent state
  */
 
-// Mock data-provider auth query
+// Mutable startup config so tests can vary `interface.defaultPinnedTools`
+let mockStartupConfig: { interface?: { defaultPinnedTools?: string[] } } | undefined;
+
+// Mock data-provider auth query + startup config
 jest.mock('~/data-provider', () => ({
   useVerifyAgentToolAuth: jest.fn().mockReturnValue({
     data: { authenticated: true },
   }),
+  useGetStartupConfig: jest.fn(() => ({ data: mockStartupConfig })),
 }));
 
 // Mock timestamps (track calls without actual localStorage timestamp logic)
@@ -40,6 +45,7 @@ describe('useToolToggle', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     localStorage.clear();
+    mockStartupConfig = undefined;
   });
 
   // ─── Dual-Write Behavior ───────────────────────────────────────────
@@ -325,4 +331,46 @@ describe('useToolToggle', () => {
       });
     });
   });
+
+  // ─── Default pinned state from interface.defaultPinnedTools ─────────
+
+  describe('defaultPinnedTools (admin-configured default pin)', () => {
+    const renderToolToggle = () =>
+      renderHook(
+        () =>
+          useToolToggle({
+            toolKey: Tools.execute_code,
+            localStorageKey: LocalStorageKeys.LAST_CODE_TOGGLE_,
+            isAuthenticated: true,
+          }),
+        { wrapper: Wrapper },
+      );
+
+    it('seeds the pinned state to true when the tool key is listed', () => {
+      mockStartupConfig = { interface: { defaultPinnedTools: ['execute_code', 'mcp'] } };
+      renderToolToggle();
+      expect(useLocalStorage).toHaveBeenCalledWith(
+        `${LocalStorageKeys.LAST_CODE_TOGGLE_}pinned`,
+        true,
+      );
+    });
+
+    it('seeds the pinned state to false when the tool key is not listed', () => {
+      mockStartupConfig = { interface: { defaultPinnedTools: ['artifacts'] } };
+      renderToolToggle();
+      expect(useLocalStorage).toHaveBeenCalledWith(
+        `${LocalStorageKeys.LAST_CODE_TOGGLE_}pinned`,
+        false,
+      );
+    });
+
+    it('seeds the pinned state to false when defaultPinnedTools is not configured', () => {
+      mockStartupConfig = undefined;
+      renderToolToggle();
+      expect(useLocalStorage).toHaveBeenCalledWith(
+        `${LocalStorageKeys.LAST_CODE_TOGGLE_}pinned`,
+        false,
+      );
+    });
+  });
 });
diff --git a/client/src/hooks/Plugins/useToolToggle.ts b/client/src/hooks/Plugins/useToolToggle.ts
index d8026cad1c0..72f3674908f 100644
--- a/client/src/hooks/Plugins/useToolToggle.ts
+++ b/client/src/hooks/Plugins/useToolToggle.ts
@@ -1,12 +1,12 @@
-import { useCallback, useMemo, useEffect } from 'react';
+import { useState, useRef, useCallback, useMemo, useEffect } from 'react';
 import debounce from 'lodash/debounce';
 import { useRecoilState } from 'recoil';
 import { Constants, LocalStorageKeys } from 'librechat-data-provider';
 import type { VerifyToolAuthResponse } from 'librechat-data-provider';
 import type { UseQueryOptions } from '@tanstack/react-query';
-import { useVerifyAgentToolAuth } from '~/data-provider';
-import { setTimestamp } from '~/utils/timestamps';
+import { useVerifyAgentToolAuth, useGetStartupConfig } from '~/data-provider';
 import useLocalStorage from '~/hooks/useLocalStorageAlt';
+import { setTimestamp } from '~/utils/timestamps';
 import { ephemeralAgentByConvoId } from '~/store';
 
 type ToolValue = boolean | string;
@@ -36,6 +36,7 @@ export function useToolToggle({
 }: UseToolToggleOptions) {
   const key = conversationId ?? Constants.NEW_CONVO;
   const [ephemeralAgent, setEphemeralAgent] = useRecoilState(ephemeralAgentByConvoId(key));
+  const { data: startupConfig } = useGetStartupConfig();
 
   const authQuery = useVerifyAgentToolAuth(
     { toolId: authConfig?.toolId || '' },
@@ -76,7 +77,50 @@ export function useToolToggle({
     }
   }, [ephemeralAgent, toolKey, storageKey]);
 
-  const [isPinned, setIsPinned] = useLocalStorage<boolean>(`${localStorageKey}pinned`, false);
+  /** Admin-configured default: pin this tool when its key is listed in `defaultPinnedTools`.
+   *  Only seeds the initial state — a user's stored pin preference always takes precedence. */
+  const defaultPinned = useMemo(() => {
+    const defaultPinnedTools = startupConfig?.interface?.defaultPinnedTools;
+    return Array.isArray(defaultPinnedTools) && defaultPinnedTools.includes(toolKey);
+  }, [startupConfig?.interface?.defaultPinnedTools, toolKey]);
+
+  /** Captured before mount (pre-seed): did the user already have a stored pin preference?
+   *  Distinguishes a real choice from `useLocalStorage`'s eager default-seed below. Legacy
+   *  auto-seeded values count as a preference, so existing users keep their state. */
+  const [hadStoredPin] = useState(() => localStorage.getItem(`${localStorageKey}pinned`) != null);
+
+  const [isPinned, setIsPinnedRaw] = useLocalStorage<boolean>(
+    `${localStorageKey}pinned`,
+    defaultPinned,
+  );
+
+  /** Mark explicit pin toggles so a click made before `startupConfig` resolves is never
+   *  clobbered by the admin-default effect below. */
+  const userSetPin = useRef(false);
+  const setIsPinned = useCallback(
+    (value: boolean) => {
+      userSetPin.current = true;
+      setIsPinnedRaw(value);
+    },
+    [setIsPinnedRaw],
+  );
+
+  /** Cold load: `startupConfig` can resolve after mount, so `defaultPinned` starts `false`
+   *  and gets eagerly persisted. Once config arrives, apply the real default for users who
+   *  have neither a stored preference nor an in-session pin click — runs once. */
+  const appliedDefaultPin = useRef(false);
+  useEffect(() => {
+    if (appliedDefaultPin.current || startupConfig == null) {
+      return;
+    }
+    appliedDefaultPin.current = true;
+    if (hadStoredPin || userSetPin.current) {
+      return;
+    }
+    if (defaultPinned !== isPinned) {
+      setIsPinnedRaw(defaultPinned);
+    }
+  }, [startupConfig, hadStoredPin, defaultPinned, isPinned, setIsPinnedRaw]);
 
   const handleChange = useCallback(
     ({ e, value }: { e?: React.ChangeEvent<HTMLInputElement>; value: ToolValue }) => {
diff --git a/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx b/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
index 5a4b68e79ed..9f922ef266e 100644
--- a/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
+++ b/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
@@ -14,33 +14,45 @@
  * unrelated citations both show up.
  */
 
-import { renderHook, act } from '@testing-library/react';
+import { Tools } from 'librechat-data-provider';
 import { RecoilRoot, useRecoilValue } from 'recoil';
 import { QueryClient } from '@tanstack/react-query';
-import { Tools } from 'librechat-data-provider';
+import { renderHook, act } from '@testing-library/react';
+import type {
+  TFile,
+  TAttachment,
+  EventSubmission,
+  TAttachmentMetadata,
+} from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment, EventSubmission } from 'librechat-data-provider';
 import useAttachmentHandler from '../useAttachmentHandler';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 const wrapper = ({ children }: { children: ReactNode }) => <RecoilRoot>{children}</RecoilRoot>;
 
 const submission = {} as EventSubmission;
 const messageId = 'msg-1';
 
-function makeAttachment(overrides: Partial<TAttachment>): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture>): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: 'fid-1',
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 /* Co-mount the handler and a reader of the messageAttachmentsMap atom in
@@ -162,7 +174,7 @@ describe('useAttachmentHandler upsert-by-file_id', () => {
      * downgrade it. Otherwise the chip flickers back to "pending" and
      * polling restarts until the lazy sweep catches up. (Codex P1.) */
     const ctx = setup();
-    ctx.handle(makeAttachment({ status: 'pending', text: null }));
+    ctx.handle(makeAttachment({ status: 'pending', text: undefined }));
     ctx.handle({
       file_id: 'fid-1',
       messageId,
@@ -171,7 +183,7 @@ describe('useAttachmentHandler upsert-by-file_id', () => {
       textFormat: 'html',
     } as unknown as TAttachment);
     /* Phase-1 replay arrives last (finalHandler at stream end). */
-    ctx.handle(makeAttachment({ status: 'pending', text: null }));
+    ctx.handle(makeAttachment({ status: 'pending', text: undefined }));
     expect(ctx.list).toHaveLength(1);
     expect(ctx.list[0]).toMatchObject({
       status: 'ready',
diff --git a/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts b/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts
new file mode 100644
index 00000000000..bd33eacebbd
--- /dev/null
+++ b/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts
@@ -0,0 +1,175 @@
+import { Constants } from 'librechat-data-provider';
+import type { EventSubmission, TMessage } from 'librechat-data-provider';
+import {
+  buildCreatedInitialResponse,
+  getExistingConversationAbortMessages,
+  isInitialNewConversationSubmission,
+  mergeRegenerateFinalMessages,
+} from '~/hooks/SSE/useEventHandlers';
+
+describe('buildCreatedInitialResponse', () => {
+  const userMessage = {
+    messageId: 'server-user-message',
+    conversationId: 'conversation-1',
+    isCreatedByUser: true,
+    text: 'Hello',
+    sender: 'User',
+  } as TMessage;
+
+  const initialResponse = {
+    messageId: 'prelim-response',
+    parentMessageId: 'original-user-message',
+    conversationId: 'conversation-1',
+    isCreatedByUser: false,
+    text: '',
+    sender: 'Assistant',
+  } as TMessage;
+
+  it('uses the created user message id for new turns', () => {
+    expect(
+      buildCreatedInitialResponse({
+        initialResponse,
+        userMessage,
+        isRegenerate: false,
+      }),
+    ).toEqual(
+      expect.objectContaining({
+        messageId: 'server-user-message_',
+        parentMessageId: 'server-user-message',
+      }),
+    );
+  });
+
+  it('preserves the regenerated prelim response id and parent', () => {
+    expect(
+      buildCreatedInitialResponse({
+        initialResponse,
+        userMessage,
+        isRegenerate: true,
+      }),
+    ).toEqual(
+      expect.objectContaining({
+        messageId: 'prelim-response',
+        parentMessageId: 'original-user-message',
+      }),
+    );
+  });
+});
+
+describe('isInitialNewConversationSubmission', () => {
+  it('treats a root user message as an optimistic new chat', () => {
+    expect(
+      isInitialNewConversationSubmission({
+        userMessage: {
+          messageId: 'user-1',
+          parentMessageId: Constants.NO_PARENT,
+        } as TMessage,
+      } as EventSubmission),
+    ).toBe(true);
+  });
+
+  it('does not treat follow-up turns as optimistic new chats', () => {
+    expect(
+      isInitialNewConversationSubmission({
+        userMessage: {
+          messageId: 'user-2',
+          parentMessageId: 'assistant-1',
+        } as TMessage,
+      } as EventSubmission),
+    ).toBe(false);
+  });
+});
+
+describe('mergeRegenerateFinalMessages', () => {
+  const userMessage = (messageId: string, parentMessageId: string = Constants.NO_PARENT) =>
+    ({
+      messageId,
+      parentMessageId,
+      conversationId: 'conversation-1',
+      isCreatedByUser: true,
+      sender: 'User',
+      text: messageId,
+    }) as TMessage;
+
+  const assistantMessage = (messageId: string, parentMessageId: string) =>
+    ({
+      messageId,
+      parentMessageId,
+      conversationId: 'conversation-1',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      text: messageId,
+    }) as TMessage;
+
+  it('keeps the original branch siblings when a non-tail regenerate finalizes', () => {
+    const rootUser = userMessage('user-1');
+    const originalResponse = assistantMessage('assistant-1', rootUser.messageId);
+    const followUpUser = userMessage('user-2', originalResponse.messageId);
+    const followUpResponse = assistantMessage('assistant-2', followUpUser.messageId);
+    const finalResponse = assistantMessage('assistant-3', rootUser.messageId);
+
+    expect(
+      mergeRegenerateFinalMessages({
+        messages: [rootUser, originalResponse, followUpUser, followUpResponse],
+        responseMessage: finalResponse,
+        initialResponseId: 'assistant-1_',
+      }).map((message) => message.messageId),
+    ).toEqual([
+      rootUser.messageId,
+      originalResponse.messageId,
+      followUpUser.messageId,
+      followUpResponse.messageId,
+      finalResponse.messageId,
+    ]);
+  });
+
+  it('replaces the streamed preliminary response when it is present', () => {
+    const rootUser = userMessage('user-1');
+    const preliminaryResponse = assistantMessage('assistant-1_', rootUser.messageId);
+    const finalResponse = assistantMessage('assistant-3', rootUser.messageId);
+
+    expect(
+      mergeRegenerateFinalMessages({
+        messages: [rootUser, preliminaryResponse],
+        responseMessage: finalResponse,
+        initialResponseId: preliminaryResponse.messageId,
+      }).map((message) => message.messageId),
+    ).toEqual([rootUser.messageId, finalResponse.messageId]);
+  });
+});
+
+describe('getExistingConversationAbortMessages', () => {
+  const message = (messageId: string) =>
+    ({
+      messageId,
+      conversationId: 'conversation-1',
+      text: messageId,
+    }) as TMessage;
+
+  it('restores the full pre-regenerate branch on early abort', () => {
+    const originalMessages = [message('user-1'), message('assistant-1'), message('user-2')];
+    const scopedRegenerateMessages = [message('user-1')];
+    const currentStreamMessages = [message('user-1'), message('assistant-1_')];
+
+    expect(
+      getExistingConversationAbortMessages({
+        messages: scopedRegenerateMessages,
+        currentMessages: currentStreamMessages,
+        regenerateMessages: originalMessages,
+        isRegenerate: true,
+      }).map(({ messageId }) => messageId),
+    ).toEqual(['user-1', 'assistant-1', 'user-2']);
+  });
+
+  it('keeps the existing non-regenerate abort rollback behavior', () => {
+    const submissionMessages = [message('user-1')];
+    const currentMessages = [message('user-1'), message('assistant-1')];
+
+    expect(
+      getExistingConversationAbortMessages({
+        messages: submissionMessages,
+        currentMessages,
+      }).map(({ messageId }) => messageId),
+    ).toEqual(['user-1']);
+  });
+});
diff --git a/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts b/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
index 269f38c8655..695fffa3f5a 100644
--- a/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
+++ b/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
@@ -1,6 +1,12 @@
-import { renderHook, act } from '@testing-library/react';
-import { Constants, LocalStorageKeys } from 'librechat-data-provider';
-import type { TSubmission } from 'librechat-data-provider';
+import { renderHook, act, waitFor } from '@testing-library/react';
+import {
+  Constants,
+  LocalStorageKeys,
+  QueryKeys,
+  StepEvents,
+  request,
+} from 'librechat-data-provider';
+import type { TMessage, TSubmission } from 'librechat-data-provider';
 
 type SSEEventListener = (e: Partial<MessageEvent> & { responseCode?: number }) => void;
 
@@ -34,14 +40,47 @@ jest.mock('sse.js', () => ({
 }));
 
 const mockSetQueryData = jest.fn();
+const mockGetQueryData = jest.fn();
 const mockInvalidateQueries = jest.fn();
 const mockRemoveQueries = jest.fn();
+const mockFindAll = jest.fn((): Array<{ queryKey: unknown[] }> => []);
 const mockQueryClient = {
   setQueryData: mockSetQueryData,
+  getQueryData: mockGetQueryData,
   invalidateQueries: mockInvalidateQueries,
   removeQueries: mockRemoveQueries,
+  getQueryCache: () => ({
+    findAll: mockFindAll,
+  }),
 };
 
+const mockActiveRunAtom = { key: 'activeRun' };
+const mockAbortScrollAtom = { key: 'abortScroll' };
+const mockSubmissionAtom = { key: 'submission' };
+const mockShowStopButtonAtom = { key: 'showStopButton' };
+const mockSetActiveRun = jest.fn();
+const mockSetAbortScroll = jest.fn();
+const mockSetSubmission = jest.fn();
+const mockSetShowStopButton = jest.fn();
+const mockUseSetRecoilStateMock = jest.fn((atom: unknown) => {
+  if (atom === mockActiveRunAtom) {
+    return mockSetActiveRun;
+  }
+  if (atom === mockAbortScrollAtom) {
+    return mockSetAbortScroll;
+  }
+  if (atom === mockSubmissionAtom) {
+    return mockSetSubmission;
+  }
+  if (atom === mockShowStopButtonAtom) {
+    return mockSetShowStopButton;
+  }
+  return jest.fn();
+});
+function mockUseSetRecoilState(atom: unknown) {
+  return mockUseSetRecoilStateMock(atom);
+}
+
 jest.mock('@tanstack/react-query', () => ({
   ...jest.requireActual('@tanstack/react-query'),
   useQueryClient: () => mockQueryClient,
@@ -49,15 +88,16 @@ jest.mock('@tanstack/react-query', () => ({
 
 jest.mock('recoil', () => ({
   ...jest.requireActual('recoil'),
-  useSetRecoilState: () => jest.fn(),
+  useSetRecoilState: mockUseSetRecoilState,
 }));
 
 jest.mock('~/store', () => ({
   __esModule: true,
   default: {
-    activeRunFamily: jest.fn(),
-    abortScrollFamily: jest.fn(),
-    showStopButtonByIndex: jest.fn(),
+    activeRunFamily: jest.fn(() => mockActiveRunAtom),
+    abortScrollFamily: jest.fn(() => mockAbortScrollAtom),
+    submissionByIndex: jest.fn(() => mockSubmissionAtom),
+    showStopButtonByIndex: jest.fn(() => mockShowStopButtonAtom),
   },
 }));
 
@@ -73,25 +113,35 @@ jest.mock('~/data-provider', () => ({
 }));
 
 const mockErrorHandler = jest.fn();
+const mockFinalHandler = jest.fn();
+const mockCreatedHandler = jest.fn();
+const mockStepHandler = jest.fn();
+const mockTitleHandler = jest.fn();
 const mockSetIsSubmitting = jest.fn();
 const mockClearStepMaps = jest.fn();
 
-jest.mock('~/hooks/SSE/useEventHandlers', () =>
-  jest.fn(() => ({
-    errorHandler: mockErrorHandler,
-    finalHandler: jest.fn(),
-    createdHandler: jest.fn(),
-    attachmentHandler: jest.fn(),
-    stepHandler: jest.fn(),
-    contentHandler: jest.fn(),
-    resetContentHandler: jest.fn(),
-    syncStepMessage: jest.fn(),
-    clearStepMaps: mockClearStepMaps,
-    messageHandler: jest.fn(),
-    setIsSubmitting: mockSetIsSubmitting,
-    setShowStopButton: jest.fn(),
-  })),
-);
+jest.mock('~/hooks/SSE/useEventHandlers', () => {
+  const actual = jest.requireActual('~/hooks/SSE/useEventHandlers');
+  return {
+    __esModule: true,
+    ...actual,
+    default: jest.fn(() => ({
+      errorHandler: mockErrorHandler,
+      finalHandler: mockFinalHandler,
+      createdHandler: mockCreatedHandler,
+      attachmentHandler: jest.fn(),
+      stepHandler: mockStepHandler,
+      titleHandler: mockTitleHandler,
+      contentHandler: jest.fn(),
+      resetContentHandler: jest.fn(),
+      syncStepMessage: jest.fn(),
+      clearStepMaps: mockClearStepMaps,
+      messageHandler: jest.fn(),
+      setIsSubmitting: mockSetIsSubmitting,
+      setShowStopButton: jest.fn(),
+    })),
+  };
+});
 
 jest.mock('librechat-data-provider', () => {
   const actual = jest.requireActual('librechat-data-provider');
@@ -118,7 +168,7 @@ const CONV_ID = 'conv-abc-123';
 type PartialSubmission = {
   conversation: { conversationId?: string };
   userMessage: Record<string, unknown>;
-  messages: never[];
+  messages: TMessage[];
   isTemporary: boolean;
   initialResponse: Record<string, unknown>;
   endpointOption: { endpoint: string };
@@ -152,11 +202,10 @@ const buildSubmission = (overrides: Partial<PartialSubmission> = {}): TSubmissio
 
 const buildChatHelpers = () => ({
   setMessages: jest.fn(),
-  getMessages: jest.fn(() => []),
+  getMessages: jest.fn<TMessage[], []>(() => []),
   setConversation: jest.fn(),
   setIsSubmitting: mockSetIsSubmitting,
   newConversation: jest.fn(),
-  resetLatestMessage: jest.fn(),
 });
 
 const getLastSSE = (): MockSSEInstance => {
@@ -165,15 +214,55 @@ const getLastSSE = (): MockSSEInstance => {
   return sse;
 };
 
+const serverNotReadyError = (retryAfter = '0') => ({
+  response: {
+    status: 503,
+    data: { code: 'SERVER_NOT_READY' },
+    headers: { 'retry-after': retryAfter },
+  },
+});
+
+const flushMicrotasks = async () => {
+  await act(async () => {
+    await Promise.resolve();
+  });
+};
+
+const advanceRetryTimer = async (ms: number) => {
+  await act(async () => {
+    jest.advanceTimersByTime(ms);
+    await Promise.resolve();
+  });
+  await flushMicrotasks();
+};
+
 describe('useResumableSSE - 404 error path', () => {
   beforeEach(() => {
     mockSSEInstances.length = 0;
     localStorage.clear();
     mockErrorHandler.mockClear();
+    mockFinalHandler.mockClear();
+    mockCreatedHandler.mockClear();
+    mockStepHandler.mockClear();
+    mockTitleHandler.mockClear();
     mockClearStepMaps.mockClear();
     mockSetIsSubmitting.mockClear();
+    mockSetQueryData.mockClear();
+    mockGetQueryData.mockClear();
     mockInvalidateQueries.mockClear();
     mockRemoveQueries.mockClear();
+    mockFindAll.mockClear();
+    mockUseSetRecoilStateMock.mockClear();
+    mockSetActiveRun.mockClear();
+    mockSetAbortScroll.mockClear();
+    mockSetSubmission.mockClear();
+    mockSetShowStopButton.mockClear();
+    (request.post as jest.Mock).mockReset();
+    (request.post as jest.Mock).mockResolvedValue({ streamId: 'stream-123' });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
   });
 
   const seedDraft = (conversationId: string) => {
@@ -252,6 +341,68 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('invalidates the stream conversation id on 404 for a new conversation', async () => {
+    mockFindAll.mockReturnValue([{ queryKey: [QueryKeys.allConversations] }]);
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('error', { responseCode: 404 });
+    });
+
+    expect(mockInvalidateQueries).toHaveBeenCalledWith({
+      queryKey: [QueryKeys.messages, 'stream-123'],
+    });
+    expect(mockRemoveQueries).toHaveBeenCalledWith({
+      queryKey: ['streamStatus', 'stream-123'],
+    });
+
+    const allConversationWrites = mockSetQueryData.mock.calls.filter(
+      ([queryKey]) => Array.isArray(queryKey) && queryKey[0] === QueryKeys.allConversations,
+    );
+    expect(allConversationWrites).toHaveLength(2);
+
+    const removeUpdater = allConversationWrites[1][1] as (data: {
+      pages: { conversations: { conversationId: string }[]; nextCursor: null }[];
+      pageParams: never[];
+    }) => { pages: { conversations: { conversationId: string }[] }[] };
+    const result = removeUpdater({
+      pages: [
+        {
+          conversations: [{ conversationId: 'stream-123' }, { conversationId: 'other' }],
+          nextCursor: null,
+        },
+      ],
+      pageParams: [],
+    });
+    expect(result.pages[0].conversations).toEqual([{ conversationId: 'other' }]);
+    unmount();
+  });
+
   it('closes the SSE connection on 404', async () => {
     const { sse, unmount } = await render404Scenario();
 
@@ -259,6 +410,1076 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('seeds sidebar and message caches for a new conversation once the stream id is known', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      [QueryKeys.conversation, 'stream-123'],
+      expect.any(Function),
+    );
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      [QueryKeys.messages, 'stream-123'],
+      expect.arrayContaining([
+        expect.objectContaining({ messageId: 'msg-1', conversationId: 'stream-123' }),
+        expect.objectContaining({ messageId: 'msg-1_', conversationId: 'stream-123' }),
+      ]),
+    );
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      [QueryKeys.messages, Constants.NEW_CONVO],
+      expect.arrayContaining([
+        expect.objectContaining({ messageId: 'msg-1', conversationId: 'stream-123' }),
+      ]),
+    );
+    expect(mockFindAll).toHaveBeenCalledWith([QueryKeys.allConversations], { exact: false });
+
+    unmount();
+  });
+
+  it('replaces the new-chat URL when the stream id is known despite a stale parent id', async () => {
+    window.history.pushState({}, '', '/c/new');
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: 'stale-parent-message',
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(window.location.pathname).toBe('/c/stream-123');
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      [QueryKeys.messages, 'stream-123'],
+      expect.arrayContaining([
+        expect.objectContaining({ messageId: 'msg-1', conversationId: 'stream-123' }),
+      ]),
+    );
+
+    unmount();
+    window.history.pushState({}, '', '/');
+  });
+
+  it('hydrates the submission conversation id before created handlers run', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          created: true,
+          message: {
+            messageId: 'msg-1',
+            conversationId: 'stream-123',
+          },
+        }),
+      });
+    });
+
+    expect(mockCreatedHandler).toHaveBeenCalledWith(
+      expect.any(Object),
+      expect.objectContaining({
+        conversation: expect.objectContaining({ conversationId: 'stream-123' }),
+        userMessage: expect.objectContaining({ conversationId: 'stream-123' }),
+      }),
+    );
+    unmount();
+  });
+
+  it('queues run step events until created hydrates the submission', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: 'msg-1_',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'Google-Workspace', args: '' }],
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+    });
+
+    expect(mockStepHandler).not.toHaveBeenCalled();
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          created: true,
+          message: {
+            messageId: 'msg-1',
+            conversationId: 'stream-123',
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledWith(
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    unmount();
+  });
+
+  it('renders OAuth run step events before created while retaining replay after hydration', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    };
+    const runStepDeltaEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+      sse._emit('message', { data: JSON.stringify(runStepDeltaEvent) });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(2);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      runStepDeltaEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          created: true,
+          message: {
+            messageId: 'msg-1',
+            conversationId: 'stream-123',
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(4);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      3,
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      4,
+      runStepDeltaEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    unmount();
+  });
+
+  it('replays pre-created OAuth completion against the hydrated response id', async () => {
+    const previousUser = {
+      messageId: 'previous-user',
+      conversationId: CONV_ID,
+      text: 'hi',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: Constants.NO_PARENT,
+    } as TMessage;
+    const previousResponse = {
+      messageId: 'previous-response',
+      conversationId: CONV_ID,
+      text: 'hello',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: previousUser.messageId,
+    } as TMessage;
+    const submission = buildSubmission({
+      conversation: { conversationId: CONV_ID },
+      userMessage: {
+        messageId: 'optimistic-user',
+        conversationId: CONV_ID,
+        text: 'thanks!',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: previousResponse.messageId,
+      },
+      messages: [previousUser, previousResponse],
+      initialResponse: {
+        messageId: 'optimistic-user_',
+        conversationId: CONV_ID,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+        parentMessageId: 'optimistic-user',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        type: 'tool_calls',
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    };
+    const runStepDeltaEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+    const completedEvent = {
+      event: StepEvents.ON_RUN_STEP_COMPLETED,
+      data: {
+        result: {
+          id: 'step-oauth',
+          index: 0,
+          tool_call: {
+            id: 'call-oauth',
+            name: 'oauth_mcp_Google-Workspace',
+            args: '',
+            output: 'OAuth authentication completed',
+            type: 'tool_call',
+          },
+        },
+      },
+    };
+    const createdEvent = {
+      created: true,
+      message: {
+        messageId: 'server-user',
+        parentMessageId: previousResponse.messageId,
+        conversationId: CONV_ID,
+        sender: 'User',
+        text: 'thanks!',
+        isCreatedByUser: true,
+      },
+      streamId: CONV_ID,
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+      sse._emit('message', { data: JSON.stringify(runStepDeltaEvent) });
+      sse._emit('message', { data: JSON.stringify(completedEvent) });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(3);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      3,
+      completedEvent,
+      expect.objectContaining({
+        initialResponse: expect.objectContaining({
+          messageId: 'optimistic-user_',
+          parentMessageId: 'optimistic-user',
+        }),
+      }),
+    );
+
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(createdEvent) });
+    });
+
+    expect(mockCreatedHandler).toHaveBeenCalledWith(
+      createdEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'server-user',
+          parentMessageId: previousResponse.messageId,
+        }),
+        initialResponse: expect.objectContaining({
+          messageId: 'server-user_',
+          parentMessageId: 'server-user',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenCalledTimes(6);
+    for (let callIndex = 4; callIndex <= 6; callIndex++) {
+      expect(mockStepHandler).toHaveBeenNthCalledWith(
+        callIndex,
+        expect.any(Object),
+        expect.objectContaining({
+          userMessage: expect.objectContaining({
+            messageId: 'server-user',
+            parentMessageId: previousResponse.messageId,
+          }),
+          initialResponse: expect.objectContaining({
+            messageId: 'server-user_',
+            parentMessageId: 'server-user',
+          }),
+        }),
+      );
+    }
+
+    unmount();
+  });
+
+  it('routes title stream events to the title handler', async () => {
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const titleEvent = {
+      event: 'title',
+      data: {
+        conversationId: CONV_ID,
+        title: 'Streamed Title',
+      },
+    };
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(titleEvent) });
+    });
+
+    expect(mockTitleHandler).toHaveBeenCalledWith(titleEvent);
+    expect(mockStepHandler).not.toHaveBeenCalled();
+    unmount();
+  });
+
+  it('continues retrying chat start while the server reports startup readiness pending', async () => {
+    jest.useFakeTimers();
+    for (let i = 0; i < 9; i++) {
+      (request.post as jest.Mock).mockRejectedValueOnce(serverNotReadyError('1'));
+    }
+    (request.post as jest.Mock).mockResolvedValueOnce({ streamId: 'stream-ready' });
+
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await flushMicrotasks();
+
+    for (let i = 0; i < 9; i++) {
+      await advanceRetryTimer(1000);
+    }
+
+    expect(request.post).toHaveBeenCalledTimes(10);
+    expect(mockSSEInstances).toHaveLength(1);
+    expect(mockSSEInstances[0].stream).toHaveBeenCalledTimes(1);
+    expect(mockErrorHandler).not.toHaveBeenCalled();
+    unmount();
+    jest.useRealTimers();
+  });
+
+  it('cancels startup readiness retries on cleanup before opening a stream', async () => {
+    jest.useFakeTimers();
+    (request.post as jest.Mock)
+      .mockRejectedValueOnce(serverNotReadyError('1'))
+      .mockResolvedValueOnce({ streamId: 'stale-stream' });
+
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await flushMicrotasks();
+    unmount();
+    await advanceRetryTimer(1000);
+
+    expect(request.post).toHaveBeenCalledTimes(1);
+    expect(mockSSEInstances).toHaveLength(0);
+    expect(mockErrorHandler).not.toHaveBeenCalled();
+    jest.useRealTimers();
+  });
+
+  it('clears submission and stop state when starting generation fails', async () => {
+    (request.post as jest.Mock).mockRejectedValueOnce({
+      response: {
+        status: 500,
+        data: { message: 'failed to start' },
+      },
+    });
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await waitFor(() => {
+      expect(mockSetSubmission).toHaveBeenCalledWith(null);
+    });
+
+    expect(mockSSEInstances).toHaveLength(0);
+    expect(mockErrorHandler).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: {
+          text: JSON.stringify({ message: 'failed to start' }),
+          metadata: { streamStartFailed: true },
+        },
+        submission,
+      }),
+    );
+    expect(mockSetIsSubmitting).toHaveBeenCalledWith(true);
+    expect(mockSetIsSubmitting).toHaveBeenCalledWith(false);
+    expect(mockSetShowStopButton).toHaveBeenCalledWith(true);
+    expect(mockSetShowStopButton).toHaveBeenCalledWith(false);
+    unmount();
+  });
+
+  it('replays title events from resume state sync', async () => {
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const titleEvent = {
+      event: 'title',
+      data: {
+        conversationId: CONV_ID,
+        title: 'Resumed Title',
+      },
+    };
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            titleEvent,
+          },
+        }),
+      });
+    });
+
+    expect(mockTitleHandler).toHaveBeenCalledWith(titleEvent);
+    unmount();
+  });
+
+  it('replays OAuth run step delta events from resume state sync', async () => {
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStep = {
+      id: 'step-oauth',
+      runId: 'resp-1',
+      index: 0,
+      stepDetails: {
+        type: 'tool_calls',
+        tool_calls: [{ id: 'call-oauth', name: 'Google-Workspace', args: '' }],
+      },
+    };
+    const replayEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [runStep],
+            replayEvents: [replayEvent],
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      { event: StepEvents.ON_RUN_STEP, data: runStep },
+      expect.objectContaining({ userMessage: expect.objectContaining({ messageId: 'msg-1' }) }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      replayEvent,
+      expect.objectContaining({ userMessage: expect.objectContaining({ messageId: 'msg-1' }) }),
+    );
+
+    unmount();
+  });
+
+  it('anchors preliminary OAuth replay events to the response message from resume state sync', async () => {
+    const submission = buildSubmission({
+      userMessage: {
+        messageId: 'original-user',
+        conversationId: CONV_ID,
+        text: 'Original prompt',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Original response',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+        parentMessageId: 'original-user',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStep = {
+      id: 'step-oauth',
+      runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+      index: 0,
+      stepDetails: {
+        type: 'tool_calls',
+        tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+      },
+    };
+    const replayEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [runStep],
+            replayEvents: [replayEvent],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            iconURL: 'https://example.com/spec-icon.png',
+            model: 'gpt-4.1',
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      { event: StepEvents.ON_RUN_STEP, data: runStep },
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      replayEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
+  it('merges resumed user and response messages into loaded conversation history', async () => {
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: '00000000-0000-0000-0000-000000000000',
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            aggregatedContent: [
+              {
+                type: 'tool_call',
+                tool_call: {
+                  id: 'call-oauth',
+                  name: 'oauth_mcp_Google-Workspace',
+                  args: '',
+                },
+              },
+            ],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            iconURL: 'https://example.com/spec-icon.png',
+            model: 'gpt-4.1',
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    const lastMessages = chatHelpers.setMessages.mock.calls.at(-1)?.[0];
+    expect(lastMessages.map((message: { messageId: string }) => message.messageId)).toEqual([
+      'original-user',
+      'original-response',
+      'follow-up-user',
+      'follow-up-response',
+    ]);
+    expect(lastMessages[2]).toEqual(
+      expect.objectContaining({
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        text: 'Follow-up prompt',
+      }),
+    );
+    expect(lastMessages[3]).toEqual(
+      expect.objectContaining({
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        content: expect.any(Array),
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+      }),
+    );
+
+    unmount();
+  });
+
+  it('uses the resumed submission for final events after sync', async () => {
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: String(Constants.NO_PARENT),
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    const finalPayload = {
+      final: true,
+      conversation: { conversationId: CONV_ID },
+      requestMessage: {
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Follow-up prompt',
+        isCreatedByUser: true,
+      },
+      responseMessage: {
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        conversationId: CONV_ID,
+        text: 'Done',
+        isCreatedByUser: false,
+      },
+    };
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify(finalPayload),
+      });
+    });
+
+    expect(mockFinalHandler).toHaveBeenCalledWith(
+      finalPayload,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
+  it('uses the resumed submission for final events after reconnecting from sync', async () => {
+    jest.useFakeTimers();
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: String(Constants.NO_PARENT),
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const initialSSE = getLastSSE();
+    await act(async () => {
+      initialSSE._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    await act(async () => {
+      initialSSE._emit('error');
+    });
+    await advanceRetryTimer(1000);
+
+    expect(mockSSEInstances).toHaveLength(2);
+    const reconnectedSSE = getLastSSE();
+    const finalPayload = {
+      final: true,
+      conversation: { conversationId: CONV_ID },
+      requestMessage: {
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Follow-up prompt',
+        isCreatedByUser: true,
+      },
+      responseMessage: {
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        conversationId: CONV_ID,
+        text: 'Done',
+        isCreatedByUser: false,
+      },
+    };
+
+    await act(async () => {
+      reconnectedSSE._emit('message', {
+        data: JSON.stringify(finalPayload),
+      });
+    });
+
+    expect(mockFinalHandler).toHaveBeenLastCalledWith(
+      finalPayload,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
   it.each([undefined, 500, 503])(
     'does not call errorHandler for responseCode %s (reconnect path)',
     async (responseCode) => {
@@ -328,4 +1549,66 @@ describe('useResumableSSE - 404 error path', () => {
     expect(mockErrorHandler).toHaveBeenCalledTimes(1);
     unmount();
   });
+
+  it('removes the optimistic sidebar row when a new conversation errors before created', async () => {
+    mockFindAll.mockReturnValue([{ queryKey: [QueryKeys.allConversations] }]);
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('error', { data: JSON.stringify({ error: 'failed before created' }) });
+    });
+
+    const allConversationWrites = mockSetQueryData.mock.calls.filter(
+      ([queryKey]) => Array.isArray(queryKey) && queryKey[0] === QueryKeys.allConversations,
+    );
+    expect(allConversationWrites).toHaveLength(2);
+
+    const removeUpdater = allConversationWrites[1][1] as (data: {
+      pages: { conversations: { conversationId: string }[]; nextCursor: null }[];
+      pageParams: never[];
+    }) => { pages: { conversations: { conversationId: string }[] }[] };
+    const result = removeUpdater({
+      pages: [
+        {
+          conversations: [{ conversationId: 'stream-123' }, { conversationId: 'other' }],
+          nextCursor: null,
+        },
+      ],
+      pageParams: [],
+    });
+    expect(result.pages[0].conversations).toEqual([{ conversationId: 'other' }]);
+    expect(mockErrorHandler).toHaveBeenCalledWith(
+      expect.objectContaining({
+        submission: expect.objectContaining({
+          conversation: expect.objectContaining({ conversationId: 'stream-123' }),
+        }),
+      }),
+    );
+    unmount();
+  });
 });
diff --git a/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx b/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx
new file mode 100644
index 00000000000..fdb6d79c9f9
--- /dev/null
+++ b/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx
@@ -0,0 +1,380 @@
+import { RecoilRoot, useRecoilValue } from 'recoil';
+import { Constants } from 'librechat-data-provider';
+import { renderHook, act } from '@testing-library/react';
+
+import type { TMessage, TConversation, TSubmission } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
+import type { ReactNode } from 'react';
+
+import useResumeOnLoad from '../useResumeOnLoad';
+import store from '~/store';
+
+const mockUseStreamStatus = jest.fn();
+
+jest.mock('~/data-provider', () => ({
+  useStreamStatus: (conversationId: string | undefined, enabled: boolean) =>
+    mockUseStreamStatus(conversationId, enabled),
+}));
+
+const CONVERSATION_ID = 'conv-current';
+const STALE_CONVERSATION_ID = 'conv-stale';
+const USER_MESSAGE_ID = 'user-message-1';
+const RESPONSE_MESSAGE_ID = 'user-message-1_';
+
+function buildConversation(conversationId = CONVERSATION_ID): TConversation {
+  return {
+    conversationId,
+    endpoint: 'agents',
+  } as TConversation;
+}
+
+function buildUserMessage(
+  conversationId: string | null = CONVERSATION_ID,
+  messageId = USER_MESSAGE_ID,
+): TMessage {
+  return {
+    text: 'Hello',
+    sender: 'User',
+    messageId,
+    conversationId,
+    isCreatedByUser: true,
+    parentMessageId: Constants.NO_PARENT,
+  } as TMessage;
+}
+
+function buildSubmission(conversationId: string | null | undefined): TSubmission {
+  return {
+    messages: [],
+    isTemporary: false,
+    endpointOption: { endpoint: 'agents' },
+    conversation: { conversationId },
+    userMessage: buildUserMessage(null),
+    initialResponse: {
+      text: '',
+      sender: 'Assistant',
+      messageId: RESPONSE_MESSAGE_ID,
+      conversationId,
+      isCreatedByUser: false,
+      parentMessageId: USER_MESSAGE_ID,
+    } as TMessage,
+  } as unknown as TSubmission;
+}
+
+function renderUseResumeOnLoad({
+  messages = [],
+  getMessages: getMessagesOverride,
+  submission = null,
+  conversationId = CONVERSATION_ID,
+  messagesLoaded = true,
+  onSubmission,
+  siblingIndexParentId,
+  onSiblingIndex,
+}: {
+  messages?: TMessage[];
+  getMessages?: () => TMessage[] | undefined;
+  submission?: TSubmission | null;
+  conversationId?: string;
+  messagesLoaded?: boolean;
+  onSubmission?: (submission: TSubmission | null) => void;
+  siblingIndexParentId?: string;
+  onSiblingIndex?: (siblingIndex: number) => void;
+}) {
+  const getMessages = jest.fn(getMessagesOverride ?? (() => messages));
+  const initializeState = (snapshot: MutableSnapshot) => {
+    snapshot.set(store.conversationByIndex(0), buildConversation(conversationId));
+    snapshot.set(store.submissionByIndex(0), submission);
+  };
+
+  const SubmissionProbe = () => {
+    const currentSubmission = useRecoilValue(store.submissionByIndex(0));
+    onSubmission?.(currentSubmission);
+    return null;
+  };
+  const SiblingIndexProbe = () => {
+    const siblingIndex = useRecoilValue(store.messagesSiblingIdxFamily(siblingIndexParentId));
+    if (siblingIndexParentId) {
+      onSiblingIndex?.(siblingIndex);
+    }
+    return null;
+  };
+
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <RecoilRoot initializeState={initializeState}>
+      <SubmissionProbe />
+      <SiblingIndexProbe />
+      {children}
+    </RecoilRoot>
+  );
+
+  return {
+    getMessages,
+    ...renderHook(() => useResumeOnLoad(conversationId, getMessages, 0, messagesLoaded), {
+      wrapper,
+    }),
+  };
+}
+
+describe('useResumeOnLoad', () => {
+  beforeEach(() => {
+    jest.spyOn(console, 'log').mockImplementation(() => undefined);
+    mockUseStreamStatus.mockReset();
+    mockUseStreamStatus.mockReturnValue({
+      data: undefined,
+      isSuccess: false,
+      isFetching: false,
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('does not check for resume when a null-conversation submission matches a loaded user message', () => {
+    renderUseResumeOnLoad({
+      submission: buildSubmission(null),
+      messages: [buildUserMessage(CONVERSATION_ID)],
+    });
+
+    expect(mockUseStreamStatus).toHaveBeenCalledWith(CONVERSATION_ID, false);
+  });
+
+  it('checks for resume when the active submission belongs to a different conversation', () => {
+    renderUseResumeOnLoad({
+      submission: buildSubmission(STALE_CONVERSATION_ID),
+      messages: [buildUserMessage(CONVERSATION_ID)],
+    });
+
+    expect(mockUseStreamStatus).toHaveBeenCalledWith(CONVERSATION_ID, true);
+  });
+
+  it('checks for resume when a null-conversation submission cannot be matched to loaded messages', () => {
+    renderUseResumeOnLoad({
+      submission: buildSubmission(null),
+      messages: [buildUserMessage(CONVERSATION_ID, 'different-user-message')],
+    });
+
+    expect(mockUseStreamStatus).toHaveBeenCalledWith(CONVERSATION_ID, true);
+  });
+
+  it('stops checking for resume after loaded messages prove a null-conversation submission belongs to the route', () => {
+    const submission = buildSubmission(null);
+    let messages: TMessage[] = [];
+    const { rerender } = renderUseResumeOnLoad({
+      submission,
+      getMessages: () => messages,
+    });
+
+    expect(mockUseStreamStatus).toHaveBeenLastCalledWith(CONVERSATION_ID, true);
+
+    messages = [buildUserMessage(CONVERSATION_ID)];
+    rerender();
+
+    expect(mockUseStreamStatus).toHaveBeenLastCalledWith(CONVERSATION_ID, false);
+  });
+
+  it('does not replace a null-conversation submission when stream status matches its resume state', async () => {
+    const submission = buildSubmission(null);
+    const observedSubmissions: Array<TSubmission | null> = [];
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: 'stream-1',
+        resumeState: {
+          aggregatedContent: [],
+          responseMessageId: RESPONSE_MESSAGE_ID,
+          userMessage: { messageId: USER_MESSAGE_ID },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      submission,
+      messages: [],
+      onSubmission: (currentSubmission) => observedSubmissions.push(currentSubmission),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(mockUseStreamStatus).toHaveBeenCalledWith(CONVERSATION_ID, true);
+    expect(observedSubmissions[observedSubmissions.length - 1]).toBe(submission);
+  });
+
+  it('restores model spec icon metadata on the resumed assistant placeholder', async () => {
+    const observedSubmissions: Array<TSubmission | null> = [];
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [{ type: 'text', text: 'Streaming...' }],
+          responseMessageId: RESPONSE_MESSAGE_ID,
+          conversationId: CONVERSATION_ID,
+          sender: 'Spec Agent',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
+          userMessage: {
+            messageId: USER_MESSAGE_ID,
+            parentMessageId: Constants.NO_PARENT,
+            conversationId: CONVERSATION_ID,
+            text: 'Hello',
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [
+        buildUserMessage(CONVERSATION_ID),
+        {
+          messageId: RESPONSE_MESSAGE_ID,
+          parentMessageId: USER_MESSAGE_ID,
+          conversationId: CONVERSATION_ID,
+          text: '',
+          isCreatedByUser: false,
+          iconURL: '',
+          model: '',
+        } as TMessage,
+      ],
+      onSubmission: (currentSubmission) => observedSubmissions.push(currentSubmission),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSubmissions[observedSubmissions.length - 1]?.initialResponse).toEqual(
+      expect.objectContaining({
+        messageId: RESPONSE_MESSAGE_ID,
+        sender: 'Spec Agent',
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+      }),
+    );
+  });
+
+  it('restores the branch that owns a pending OAuth resume user message', async () => {
+    const rootUser = buildUserMessage(CONVERSATION_ID, 'root-user');
+    const branchOneResponse = {
+      messageId: 'branch-one-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch one response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const branchOneFollowUp = buildUserMessage(CONVERSATION_ID, 'branch-one-follow-up');
+    branchOneFollowUp.parentMessageId = branchOneResponse.messageId;
+    const branchOneTail = {
+      messageId: 'branch-one-tail',
+      parentMessageId: branchOneFollowUp.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch one tail',
+      isCreatedByUser: false,
+    } as TMessage;
+    const branchTwoResponse = {
+      messageId: 'branch-two-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch two response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const observedSiblingIndexes: number[] = [];
+
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [],
+          replayEvents: [],
+          responseMessageId: 'pending-user_',
+          conversationId: CONVERSATION_ID,
+          userMessage: {
+            messageId: 'pending-user',
+            parentMessageId: branchOneTail.messageId,
+            conversationId: CONVERSATION_ID,
+            text: 'Use OAuth tool on branch one',
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [rootUser, branchOneResponse, branchOneFollowUp, branchOneTail, branchTwoResponse],
+      siblingIndexParentId: rootUser.messageId,
+      onSiblingIndex: (siblingIndex) => observedSiblingIndexes.push(siblingIndex),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSiblingIndexes[observedSiblingIndexes.length - 1]).toBe(1);
+  });
+
+  it('restores the assistant sibling selected by a pending regenerate response', async () => {
+    const rootUser = buildUserMessage(CONVERSATION_ID, 'root-user');
+    const olderResponse = {
+      messageId: 'older-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Older response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const newerResponse = {
+      messageId: 'newer-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Newer response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const observedSiblingIndexes: number[] = [];
+
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [],
+          replayEvents: [],
+          responseMessageId: `${olderResponse.messageId}_`,
+          conversationId: CONVERSATION_ID,
+          userMessage: {
+            messageId: rootUser.messageId,
+            parentMessageId: rootUser.parentMessageId,
+            conversationId: CONVERSATION_ID,
+            text: rootUser.text,
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [rootUser, olderResponse, newerResponse],
+      siblingIndexParentId: rootUser.messageId,
+      onSiblingIndex: (siblingIndex) => observedSiblingIndexes.push(siblingIndex),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSiblingIndexes[observedSiblingIndexes.length - 1]).toBe(1);
+  });
+});
diff --git a/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts b/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
index ae28a9e6f19..0e04fb43c65 100644
--- a/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
+++ b/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
@@ -1,5 +1,5 @@
-import { renderHook, act } from '@testing-library/react';
 import { RecoilRoot, useRecoilCallback } from 'recoil';
+import { renderHook, act } from '@testing-library/react';
 import {
   Constants,
   StepTypes,
@@ -17,8 +17,20 @@ import type {
   SubagentUpdateEvent,
   Agents,
 } from 'librechat-data-provider';
-import useStepHandler from '~/hooks/SSE/useStepHandler';
 import { subagentProgressByToolCallId } from '~/store/subagents';
+import useStepHandler from '~/hooks/SSE/useStepHandler';
+
+/** `Constants` is a heterogeneous enum (`string | number`); annotate as
+ *  `string` so the member is usable where a `string` field is expected. */
+const USE_PRELIM_RESPONSE_MESSAGE_ID: string = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID;
+
+const getToolCallName = (part?: TMessageContentParts): string | undefined => {
+  if (part?.type !== ContentTypes.TOOL_CALL) {
+    return undefined;
+  }
+  const { tool_call: toolCall } = part;
+  return 'name' in toolCall ? toolCall.name : undefined;
+};
 
 type TSubmissionForTest = {
   userMessage: TMessage;
@@ -37,6 +49,7 @@ describe('useStepHandler', () => {
   const mockSetMessages = jest.fn();
   const mockGetMessages = jest.fn();
   const mockAnnouncePolite = jest.fn();
+  const mockOnSkillAuthoringComplete = jest.fn();
   const mockLastAnnouncementTimeRef = { current: 0 };
 
   const createHookParams = () => ({
@@ -44,6 +57,7 @@ describe('useStepHandler', () => {
     getMessages: mockGetMessages,
     announcePolite: mockAnnouncePolite,
     lastAnnouncementTimeRef: mockLastAnnouncementTimeRef,
+    onSkillAuthoringComplete: mockOnSkillAuthoringComplete,
   });
 
   const createUserMessage = (overrides: Partial<TMessage> = {}): TMessage => ({
@@ -234,6 +248,182 @@ describe('useStepHandler', () => {
       );
     });
 
+    it('should preserve multiple tool call steps for the same preliminary response', () => {
+      const responseMessage = createResponseMessage();
+      let currentMessages = [responseMessage];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({ initialResponse: responseMessage });
+
+      const firstRunStep = createToolCallRunStep({
+        id: 'step-oauth-eli',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const secondRunStep = createToolCallRunStep({
+        id: 'step-oauth-vespa',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 1,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-vespa',
+              name: `oauth${Constants.mcp_delimiter}Vespa`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: firstRunStep },
+          submission,
+        );
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: secondRunStep },
+          submission,
+        );
+      });
+
+      const responseMsg = currentMessages.find((m) => !m.isCreatedByUser);
+      expect(responseMsg?.content).toHaveLength(2);
+      expect(getToolCallName(responseMsg?.content?.[0])).toBe(`oauth${Constants.mcp_delimiter}ELI`);
+      expect(getToolCallName(responseMsg?.content?.[1])).toBe(
+        `oauth${Constants.mcp_delimiter}Vespa`,
+      );
+    });
+
+    it('should clear OAuth prompt slots when one occupies the real response slot', () => {
+      const responseMessage = createResponseMessage();
+      let currentMessages = [responseMessage];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({ initialResponse: responseMessage });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-eli',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-eli',
+                    name: `oauth${Constants.mcp_delimiter}ELI`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-vespa',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 1,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-vespa',
+                    name: `oauth${Constants.mcp_delimiter}Vespa`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      const responseMsg = currentMessages.find((m) => !m.isCreatedByUser);
+      expect(responseMsg?.content).toEqual([{ type: ContentTypes.TEXT, text: 'Ready' }]);
+    });
+
+    it('should not replace the message list from a shorter refresh during tool call steps', () => {
+      const userMessage = createUserMessage();
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValueOnce([userMessage, responseMessage]).mockReturnValueOnce([]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        runId: responseMessage.messageId,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: runStep },
+          createSubmission({ userMessage, initialResponse: responseMessage }),
+        );
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      expect(lastCall.map((message: TMessage) => message.messageId)).toEqual([
+        userMessage.messageId,
+        responseMessage.messageId,
+      ]);
+    });
+
     it('should replay buffered deltas after registering step', () => {
       const responseMessage = createResponseMessage();
       mockGetMessages.mockReturnValue([responseMessage]);
@@ -286,6 +476,541 @@ describe('useStepHandler', () => {
       );
     });
 
+    it('keeps the pending user message when replayed OAuth tool calls merge immediately', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const selectedResponse = createResponseMessage({
+        messageId: 'selected-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const followUpUser = createUserMessage({
+        messageId: 'follow-up-user',
+        parentMessageId: selectedResponse.messageId,
+      });
+      const followUpResponse = createResponseMessage({
+        messageId: 'follow-up-response',
+        parentMessageId: followUpUser.messageId,
+      });
+      const siblingResponse = createResponseMessage({
+        messageId: 'sibling-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: followUpResponse.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [
+        rootUser,
+        selectedResponse,
+        followUpUser,
+        followUpResponse,
+        siblingResponse,
+      ];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: currentMessages,
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        selectedResponse.messageId,
+        followUpUser.messageId,
+        followUpResponse.messageId,
+        siblingResponse.messageId,
+        pendingUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          messageId: initialResponse.messageId,
+          parentMessageId: pendingUser.messageId,
+          content: expect.arrayContaining([
+            expect.objectContaining({
+              type: ContentTypes.TOOL_CALL,
+              tool_call: expect.objectContaining({
+                name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              }),
+            }),
+          ]),
+        }),
+      );
+    });
+
+    it('keeps pending OAuth ancestry when content arrives after an orphaned refresh', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const existingResponse = createResponseMessage({
+        messageId: 'existing-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: existingResponse.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [rootUser, existingResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: [rootUser, existingResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-login',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-oauth',
+                    name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+      });
+
+      currentMessages = [initialResponse];
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          parentMessageId: pendingUser.messageId,
+          content: [{ type: ContentTypes.TEXT, text: 'Ready' }],
+        }),
+      );
+    });
+
+    it('replaces the preliminary OAuth response when post-auth streaming uses a stable response id', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const existingResponse = createResponseMessage({
+        messageId: 'existing-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: existingResponse.messageId,
+      });
+      const preliminaryResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TOOL_CALL,
+            tool_call: {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              type: ToolCallTypes.TOOL_CALL,
+              args: '',
+            },
+          },
+        ],
+      });
+      const stableResponse = createResponseMessage({
+        messageId: 'stable-response',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [rootUser, existingResponse, preliminaryResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: [rootUser, existingResponse],
+        initialResponse: preliminaryResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: stableResponse.messageId,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        stableResponse.messageId,
+      ]);
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        stableResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          messageId: stableResponse.messageId,
+          parentMessageId: pendingUser.messageId,
+          content: [{ type: ContentTypes.TEXT, text: 'Ready' }],
+        }),
+      );
+    });
+
+    it('should not insert regenerate transport userMessage before preliminary OAuth steps', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'synthetic-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      let currentMessages = [originalUser];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser, originalResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages).toHaveLength(2);
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages).not.toContainEqual(
+        expect.objectContaining({ messageId: regenerateUserMessage.messageId }),
+      );
+      expect(currentMessages[1]?.content).toContainEqual(
+        expect.objectContaining({
+          type: ContentTypes.TOOL_CALL,
+          tool_call: expect.objectContaining({
+            name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+          }),
+        }),
+      );
+    });
+
+    it('should preserve regenerate history when OAuth steps arrive before optimistic state commits', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'synthetic-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      mockGetMessages.mockReturnValue([]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      expect(lastCall).toHaveLength(2);
+      expect(lastCall.map((message: TMessage) => message.messageId)).toEqual([
+        originalUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(lastCall).not.toContainEqual(
+        expect.objectContaining({ messageId: regenerateUserMessage.messageId }),
+      );
+      expect(lastCall[1]?.content).toContainEqual(
+        expect.objectContaining({
+          type: ContentTypes.TOOL_CALL,
+          tool_call: expect.objectContaining({
+            name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+          }),
+        }),
+      );
+    });
+
+    it('does not seed non-tail regenerate run steps from the latest assistant message', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Original response',
+          },
+        ],
+      });
+      const followUpUser = createUserMessage({
+        messageId: 'follow-up-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+      const latestResponse = createResponseMessage({
+        messageId: 'latest-response-message',
+        parentMessageId: followUpUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Latest response content must not leak into regenerate',
+          },
+        ],
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+        content: [],
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'server-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      let currentMessages = [originalUser, originalResponse, followUpUser, latestResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createRunStep({
+        id: 'step-message-create',
+        runId: 'server-regenerated-response-message',
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const regeneratedResponse = currentMessages.find(
+        (message) => message.messageId === 'server-regenerated-response-message',
+      );
+      expect(regeneratedResponse).toEqual(
+        expect.objectContaining({
+          parentMessageId: originalUser.messageId,
+          content: [],
+        }),
+      );
+      expect(regeneratedResponse?.content).not.toEqual(latestResponse.content);
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        'server-regenerated-response-message',
+      ]);
+    });
+
+    it('preserves sibling assistant responses when regenerating one response', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const selectedResponse = createResponseMessage({
+        messageId: 'selected-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Selected response',
+          },
+        ],
+      });
+      const siblingResponse = createResponseMessage({
+        messageId: 'sibling-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Sibling response should stay visible',
+          },
+        ],
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'selected-response-message_',
+        parentMessageId: originalUser.messageId,
+        content: [],
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'server-regenerate-user-message',
+        parentMessageId: selectedResponse.messageId,
+        responseMessageId: initialResponse.messageId,
+      });
+
+      let currentMessages = [originalUser, selectedResponse, siblingResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createRunStep({
+        id: 'step-message-create',
+        runId: 'server-regenerated-response-message',
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser, selectedResponse, siblingResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        siblingResponse.messageId,
+        'server-regenerated-response-message',
+      ]);
+      expect(currentMessages).not.toContainEqual(
+        expect.objectContaining({ messageId: selectedResponse.messageId }),
+      );
+    });
+
     it('should propagate step metadata (agentId, groupId) for parallel rendering', () => {
       const responseMessage = createResponseMessage();
       mockGetMessages.mockReturnValue([responseMessage]);
@@ -722,6 +1447,86 @@ describe('useStepHandler', () => {
       expect(toolCallContent?.tool_call?.progress).toBe(1);
     });
 
+    it('signals skill authoring when a completed create_file call targets a skill path', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep();
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const completedEvent = {
+        result: {
+          id: 'step-tool-1',
+          index: 0,
+          tool_call: {
+            id: 'tool-call-1',
+            name: 'create_file',
+            args: JSON.stringify({ file_path: 'skills/demo/SKILL.md', content: '# Demo' }),
+            output: 'Updated skills/demo/SKILL.md (6 chars).',
+            type: ToolCallTypes.TOOL_CALL,
+          },
+        },
+      };
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: completedEvent as { result: Agents.ToolEndEvent },
+          },
+          submission,
+        );
+      });
+
+      expect(mockOnSkillAuthoringComplete).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not signal skill authoring for non-skill file authoring calls', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep();
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const completedEvent = {
+        result: {
+          id: 'step-tool-1',
+          index: 0,
+          tool_call: {
+            id: 'tool-call-1',
+            name: 'create_file',
+            args: JSON.stringify({ file_path: '/mnt/data/report.md', content: '# Report' }),
+            output: 'Created /mnt/data/report.md (8 chars).',
+            type: ToolCallTypes.TOOL_CALL,
+          },
+        },
+      };
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: completedEvent as { result: Agents.ToolEndEvent },
+          },
+          submission,
+        );
+      });
+
+      expect(mockOnSkillAuthoringComplete).not.toHaveBeenCalled();
+    });
+
     it('should warn when step not found for completed event', () => {
       const consoleSpy = jest.spyOn(console, 'warn').mockImplementation();
 
@@ -756,6 +1561,59 @@ describe('useStepHandler', () => {
       );
       consoleSpy.mockRestore();
     });
+
+    it('should mark completed OAuth prompts as finished', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-eli',
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: {
+              result: {
+                id: 'step-oauth-eli',
+                index: 0,
+                tool_call: {
+                  id: 'tool-call-eli',
+                  name: `oauth${Constants.mcp_delimiter}ELI`,
+                  args: '',
+                  output: 'OAuth authentication completed',
+                  type: ToolCallTypes.TOOL_CALL,
+                },
+              },
+            },
+          },
+          submission,
+        );
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      const responseMsg = lastCall.find((m: TMessage) => !m.isCreatedByUser);
+      expect(responseMsg?.content?.[0]?.tool_call?.progress).toBe(1);
+    });
   });
 
   describe('clearStepMaps', () => {
diff --git a/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx b/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx
new file mode 100644
index 00000000000..41ba9e35110
--- /dev/null
+++ b/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx
@@ -0,0 +1,116 @@
+import { getDefaultStore } from 'jotai';
+import { renderHook } from '@testing-library/react';
+import type { TContextUsageEvent, TTokenUsageEvent } from 'librechat-data-provider';
+import useUsageHandler from '~/hooks/SSE/useUsageHandler';
+import { contextSnapshotFamily } from '~/store/usage';
+
+/** Mirrors a real web-search + summarization turn: calibration pinned at 5
+ *  inflated messageTokens to 187471 (used 213375), while the call's true prompt
+ *  was 53702 + 2071 cache = 55773. */
+const inflatedSnapshot = (over?: Partial<TContextUsageEvent>): TContextUsageEvent => ({
+  runId: 'run-1',
+  breakdown: {
+    maxContextTokens: 250000,
+    instructionTokens: 4205,
+    systemMessageTokens: 384,
+    dynamicInstructionTokens: 1525,
+    toolSchemaTokens: 2296,
+    summaryTokens: 1938,
+    toolCount: 1,
+    messageCount: 2,
+    messageTokens: 187471,
+    availableForMessages: 233295,
+  },
+  contextBudget: 237500,
+  remainingContextTokens: 24125,
+  calibrationRatio: 5,
+  ...over,
+});
+
+const primaryUsage = (over?: Partial<TTokenUsageEvent>): TTokenUsageEvent => ({
+  input_tokens: 55773, // Anthropic input_tokens is cache-inclusive (53702 fresh + 2071 read)
+  output_tokens: 3780,
+  total_tokens: 59553,
+  input_token_details: { cache_read: 2071, cache_creation: 0 },
+  provider: 'anthropic',
+  runId: 'run-1',
+  seq: 1,
+  ...over,
+});
+
+describe('useUsageHandler — live snapshot reconciliation', () => {
+  it('reconciles the live snapshot to the primary call’s actual prompt tokens', () => {
+    const convo = 'convo-recon-1';
+    const submission = {
+      userMessage: { messageId: 'u1', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+
+    result.current.usageHandler(primaryUsage(), submission);
+
+    const snap = store.get(contextSnapshotFamily(convo));
+    /** used = budget − remaining = real prompt (55773), down from 213375 */
+    expect(237500 - (snap?.remainingContextTokens ?? 0)).toBe(55773);
+    expect(snap?.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    /** instructions/summary stay raw; the anchor is preserved */
+    expect(snap?.breakdown.instructionTokens).toBe(4205);
+    expect(snap?.anchorMessageId).toBe('u1');
+  });
+
+  it('does not reconcile a replayed (already-folded) primary usage', () => {
+    /** On resume, backfill marks the run's collected usages folded; a replayed
+     *  `on_token_usage` then arrives folded=false. Since tool-loop calls share the
+     *  run id, reconciling with such a duplicate could overwrite the latest
+     *  snapshot with an earlier call's prompt — so it must be skipped. */
+    const convo = 'convo-recon-replay';
+    const submission = {
+      userMessage: { messageId: 'ur', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    /** Mark the usage folded (as resume backfill would), then replay it live. */
+    result.current.backfillUsage([primaryUsage()], submission);
+    result.current.usageHandler(primaryUsage(), submission);
+
+    /** Duplicate (folded=false) → no reconcile → snapshot stays the raw estimate. */
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+
+  it('does not reconcile when the usage belongs to a different run', () => {
+    const convo = 'convo-recon-2';
+    const submission = {
+      userMessage: { messageId: 'u2', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot({ runId: 'run-A' }), submission);
+    result.current.usageHandler(primaryUsage({ runId: 'run-Z', seq: 9 }), submission);
+
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+
+  it('does not let a tagged (summarization) usage touch the gauge', () => {
+    const convo = 'convo-recon-3';
+    const submission = {
+      userMessage: { messageId: 'u3', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    result.current.usageHandler(primaryUsage({ usage_type: 'summarization', seq: 2 }), submission);
+
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+});
diff --git a/client/src/hooks/SSE/index.ts b/client/src/hooks/SSE/index.ts
index 2829db76f6c..5de4866d49f 100644
--- a/client/src/hooks/SSE/index.ts
+++ b/client/src/hooks/SSE/index.ts
@@ -3,5 +3,6 @@ export { default as useResumableSSE } from './useResumableSSE';
 export { default as useAdaptiveSSE } from './useAdaptiveSSE';
 export { default as useResumeOnLoad } from './useResumeOnLoad';
 export { default as useStepHandler } from './useStepHandler';
+export { default as useUsageHandler } from './useUsageHandler';
 export { default as useContentHandler } from './useContentHandler';
 export { default as useAttachmentHandler } from './useAttachmentHandler';
diff --git a/client/src/hooks/SSE/useAdaptiveSSE.ts b/client/src/hooks/SSE/useAdaptiveSSE.ts
index e8c2de08e07..b1d6862718f 100644
--- a/client/src/hooks/SSE/useAdaptiveSSE.ts
+++ b/client/src/hooks/SSE/useAdaptiveSSE.ts
@@ -6,12 +6,7 @@ import useSSE from './useSSE';
 
 type ChatHelpers = Pick<
   EventHandlerParams,
-  | 'setMessages'
-  | 'getMessages'
-  | 'setConversation'
-  | 'setIsSubmitting'
-  | 'newConversation'
-  | 'resetLatestMessage'
+  'setMessages' | 'getMessages' | 'setConversation' | 'setIsSubmitting' | 'newConversation'
 >;
 
 /**
diff --git a/client/src/hooks/SSE/useEventHandlers.ts b/client/src/hooks/SSE/useEventHandlers.ts
index e55bd6261c8..2d6a0bb822c 100644
--- a/client/src/hooks/SSE/useEventHandlers.ts
+++ b/client/src/hooks/SSE/useEventHandlers.ts
@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useRef } from 'react';
 import { v4 } from 'uuid';
-import { useSetRecoilState } from 'recoil';
 import { useQueryClient } from '@tanstack/react-query';
+import { useSetRecoilState, useRecoilCallback } from 'recoil';
 import { useParams, useNavigate, useLocation } from 'react-router-dom';
 import {
   QueryKeys,
@@ -19,21 +19,27 @@ import type {
   EventSubmission,
   TStartupConfig,
 } from 'librechat-data-provider';
-import type { TResData, TFinalResData, ConvoGenerator } from '~/common';
 import type { InfiniteData } from '@tanstack/react-query';
-import type { SetterOrUpdater, Resetter } from 'recoil';
+import type { SetterOrUpdater } from 'recoil';
+import type { TResData, TFinalResData, ConvoGenerator } from '~/common';
 import type { ConversationCursorData } from '~/utils';
 import {
   logger,
   setDraft,
   scrollToEnd,
   getAllContentText,
-  addConvoToAllQueries,
+  upsertConvoInAllQueries,
   updateConvoInAllQueries,
   removeConvoFromAllQueries,
   findConversationInInfinite,
 } from '~/utils';
-import { startupConfigKey, queueTitleGeneration } from '~/data-provider';
+import {
+  startupConfigKey,
+  queueTitleGeneration,
+  markTitleGenerationProcessed,
+} from '~/data-provider';
+import useFocusRegeneratedResponse from '~/hooks/Chat/useFocusRegeneratedResponse';
+import { shouldResetSubagentAtomsOnConversationChange } from './cleanup';
 import useAttachmentHandler from '~/hooks/SSE/useAttachmentHandler';
 import useContentHandler from '~/hooks/SSE/useContentHandler';
 import useStepHandler from '~/hooks/SSE/useStepHandler';
@@ -41,7 +47,6 @@ import { useApplyAgentTemplate } from '~/hooks/Agents';
 import { useAuthContext } from '~/hooks/AuthContext';
 import { MESSAGE_UPDATE_INTERVAL } from '~/common';
 import { useLiveAnnouncer } from '~/Providers';
-import { shouldResetSubagentAtomsOnConversationChange } from './cleanup';
 import store from '~/store';
 
 type TSyncData = {
@@ -53,6 +58,102 @@ type TSyncData = {
   conversationId: string;
 };
 
+type TTitleEvent = {
+  event: 'title';
+  data?: {
+    conversationId?: string;
+    title?: string;
+  };
+};
+
+const hasRealTitle = (title?: string | null): title is string =>
+  title != null && title !== '' && title !== 'New Chat';
+
+/** Skill caches refreshed when a chat turn authors a skill via `create_file`/`edit_file`. */
+const SKILL_QUERY_KEYS = [
+  QueryKeys.skills,
+  QueryKeys.skill,
+  QueryKeys.skillFiles,
+  QueryKeys.skillFileContent,
+  QueryKeys.skillTree,
+  QueryKeys.skillNodeContent,
+] as const;
+
+export const buildCreatedInitialResponse = ({
+  initialResponse,
+  userMessage,
+  isRegenerate = false,
+}: Pick<EventSubmission, 'initialResponse' | 'userMessage' | 'isRegenerate'>): TMessage => ({
+  ...initialResponse,
+  parentMessageId:
+    isRegenerate && initialResponse.parentMessageId
+      ? initialResponse.parentMessageId
+      : userMessage.messageId,
+  messageId:
+    isRegenerate && initialResponse.messageId
+      ? initialResponse.messageId
+      : `${userMessage.messageId}_`,
+  conversationId: userMessage.conversationId ?? initialResponse.conversationId,
+});
+
+export const isInitialNewConversationSubmission = ({
+  userMessage,
+}: Pick<EventSubmission, 'userMessage'>): boolean =>
+  userMessage?.parentMessageId === Constants.NO_PARENT;
+
+export const mergeRegenerateFinalMessages = ({
+  messages,
+  responseMessage,
+  initialResponseId,
+}: {
+  messages: TMessage[];
+  responseMessage: TMessage;
+  initialResponseId?: string | null;
+}): TMessage[] => {
+  const finalMessages: TMessage[] = [];
+  let inserted = false;
+
+  for (const message of messages) {
+    if (!message?.messageId || message.messageId === initialResponseId) {
+      continue;
+    }
+
+    if (message.messageId === responseMessage.messageId) {
+      finalMessages.push(responseMessage);
+      inserted = true;
+      continue;
+    }
+
+    finalMessages.push(message);
+  }
+
+  if (!inserted) {
+    finalMessages.push(responseMessage);
+  }
+
+  return finalMessages;
+};
+
+export const getExistingConversationAbortMessages = ({
+  messages,
+  currentMessages,
+  regenerateMessages,
+  isRegenerate = false,
+}: Pick<EventSubmission, 'messages' | 'regenerateMessages' | 'isRegenerate'> & {
+  currentMessages?: TMessage[];
+}): TMessage[] => {
+  if (!isRegenerate) {
+    return [...messages];
+  }
+
+  if (regenerateMessages?.length) {
+    return [...regenerateMessages];
+  }
+
+  const sourceMessages = currentMessages?.length ? currentMessages : messages;
+  return [...sourceMessages];
+};
+
 export type EventHandlerParams = {
   isAddedRequest?: boolean;
   setCompleted: React.Dispatch<React.SetStateAction<Set<unknown>>>;
@@ -62,7 +163,6 @@ export type EventHandlerParams = {
   setConversation?: SetterOrUpdater<TConversation | null>;
   newConversation?: ConvoGenerator;
   setShowStopButton: SetterOrUpdater<boolean>;
-  resetLatestMessage?: Resetter;
 };
 
 const createErrorMessage = ({
@@ -175,7 +275,6 @@ export default function useEventHandlers({
   setIsSubmitting,
   newConversation,
   setShowStopButton,
-  resetLatestMessage,
 }: EventHandlerParams) {
   const queryClient = useQueryClient();
   const { announcePolite } = useLiveAnnouncer();
@@ -184,17 +283,39 @@ export default function useEventHandlers({
   const navigate = useNavigate();
   const location = useLocation();
 
+  /** Re-queue the turn's quoted excerpts when an early abort restores the draft,
+   *  so retrying the restored message still sends the references — the pending
+   *  queue was already drained on submit. */
+  const restorePendingQuotes = useRecoilCallback(
+    ({ set }) =>
+      (convoId: string, quotes?: string[]) => {
+        if (Array.isArray(quotes) && quotes.length > 0) {
+          set(store.pendingQuotesByConvoId(convoId), quotes);
+        }
+      },
+    [],
+  );
+
   const lastAnnouncementTimeRef = useRef(Date.now());
   const { conversationId: paramId } = useParams();
   const { token } = useAuthContext();
 
   const { contentHandler, resetContentHandler } = useContentHandler({ setMessages, getMessages });
+  /** `refetchType: 'all'` so cached-but-unmounted skill queries refresh too —
+   *  they opt out of `refetchOnMount`, so a plain invalidation would leave
+   *  the Skills panel stale until a manual refresh. */
+  const onSkillAuthoringComplete = useCallback(() => {
+    for (const key of SKILL_QUERY_KEYS) {
+      queryClient.invalidateQueries({ queryKey: [key], refetchType: 'all' });
+    }
+  }, [queryClient]);
   const { stepHandler, clearStepMaps, resetSubagentAtoms, syncStepMessage } = useStepHandler({
     setMessages,
     getMessages,
     announcePolite,
     setIsSubmitting,
     lastAnnouncementTimeRef,
+    onSkillAuthoringComplete,
   });
   const attachmentHandler = useAttachmentHandler(queryClient);
 
@@ -323,14 +444,12 @@ export default function useEventHandlers({
       const { initialResponse, messages: _messages, userMessage } = submission;
       const messages = _messages.filter((msg) => msg.messageId !== userMessage.messageId);
 
-      setMessages([
-        ...messages,
-        requestMessage,
-        {
-          ...initialResponse,
-          ...responseMessage,
-        },
-      ]);
+      const nextResponseMessage = {
+        ...initialResponse,
+        ...responseMessage,
+      };
+
+      setMessages([...messages, requestMessage, nextResponseMessage]);
 
       announcePolite({
         message: 'start',
@@ -358,10 +477,14 @@ export default function useEventHandlers({
         });
 
         if (requestMessage.parentMessageId === Constants.NO_PARENT) {
-          addConvoToAllQueries(queryClient, update);
+          upsertConvoInAllQueries(queryClient, update);
         } else {
           updateConvoInAllQueries(queryClient, update.conversationId!, (_c) => update, true);
         }
+        if (update.chatProjectId) {
+          queryClient.invalidateQueries([QueryKeys.projects]);
+          queryClient.invalidateQueries([QueryKeys.project, update.chatProjectId]);
+        }
       } else if (setConversation) {
         setConversation((prevState) => {
           update = tConvoUpdateSchema.parse({
@@ -375,22 +498,12 @@ export default function useEventHandlers({
       }
 
       setShowStopButton(true);
-      if (resetLatestMessage) {
-        logger.log('latest_message', 'syncHandler: resetting latest message');
-        resetLatestMessage();
-      }
     },
-    [
-      queryClient,
-      setMessages,
-      isAddedRequest,
-      announcePolite,
-      setConversation,
-      setShowStopButton,
-      resetLatestMessage,
-    ],
+    [queryClient, setMessages, isAddedRequest, announcePolite, setConversation, setShowStopButton],
   );
 
+  const focusRegeneratedResponse = useFocusRegeneratedResponse();
+
   const createdHandler = useCallback(
     (data: TResData, submission: EventSubmission) => {
       queryClient.invalidateQueries([QueryKeys.mcpConnectionStatus]);
@@ -406,13 +519,14 @@ export default function useEventHandlers({
        * drops it, which is the right behavior: by finalize the real
        * `skill` tool_call is in `content` and takes over rendering.
        */
-      const initialResponse = {
-        ...submission.initialResponse,
-        parentMessageId: userMessage.messageId,
-        messageId: userMessage.messageId + '_',
-      };
+      const initialResponse = buildCreatedInitialResponse({
+        initialResponse: submission.initialResponse,
+        userMessage,
+        isRegenerate,
+      });
       if (isRegenerate) {
         setMessages([...messages, initialResponse]);
+        focusRegeneratedResponse(initialResponse.parentMessageId);
       } else {
         setMessages([...messages, userMessage, initialResponse]);
       }
@@ -444,10 +558,14 @@ export default function useEventHandlers({
 
         if (!isTemporary) {
           if (parentMessageId === Constants.NO_PARENT) {
-            addConvoToAllQueries(queryClient, update);
+            upsertConvoInAllQueries(queryClient, update);
           } else {
             updateConvoInAllQueries(queryClient, update.conversationId!, (_c) => update, true);
           }
+          if (update.chatProjectId) {
+            queryClient.invalidateQueries([QueryKeys.projects]);
+            queryClient.invalidateQueries([QueryKeys.project, update.chatProjectId]);
+          }
         }
       } else if (setConversation) {
         setConversation((prevState) => {
@@ -469,10 +587,6 @@ export default function useEventHandlers({
         });
       }
 
-      if (resetLatestMessage) {
-        logger.log('latest_message', 'createdHandler: resetting latest message');
-        resetLatestMessage();
-      }
       scrollToEnd(() => setAbortScroll(false));
     },
     [
@@ -482,11 +596,47 @@ export default function useEventHandlers({
       isAddedRequest,
       announcePolite,
       setConversation,
-      resetLatestMessage,
       applyAgentTemplate,
+      focusRegeneratedResponse,
     ],
   );
 
+  const titleHandler = useCallback(
+    (event: TTitleEvent) => {
+      const { conversationId, title } = event.data ?? {};
+      if (!conversationId || !hasRealTitle(title)) {
+        return;
+      }
+
+      queryClient.setQueryData<TConversation>([QueryKeys.conversation, conversationId], (convo) =>
+        convo ? { ...convo, title } : convo,
+      );
+      updateConvoInAllQueries(queryClient, conversationId, (convo) => ({ ...convo, title }));
+      markTitleGenerationProcessed(conversationId);
+
+      if (location.pathname.includes(conversationId)) {
+        document.title = title;
+      }
+
+      if (setConversation && !isAddedRequest) {
+        setConversation((prevState) => {
+          if (!prevState) {
+            return prevState;
+          }
+          if (prevState.conversationId && prevState.conversationId !== conversationId) {
+            return prevState;
+          }
+          return {
+            ...prevState,
+            conversationId,
+            title,
+          };
+        });
+      }
+    },
+    [queryClient, location.pathname, setConversation, isAddedRequest],
+  );
+
   const finalHandler = useCallback(
     (data: TFinalResData, submission: EventSubmission) => {
       const { requestMessage, responseMessage, conversation, runMessages } = data;
@@ -496,17 +646,45 @@ export default function useEventHandlers({
         isRegenerate = false,
         isTemporary: _isTemporary = false,
       } = submission;
+      const serverConversation = conversation as TConversation;
 
       try {
-        // Handle early abort - aborted during tool loading before any messages saved
-        // Don't update conversation state, just reset UI and stay on new chat
+        // Handle early abort - aborted before any response message was saved.
         if ((data as Record<string, unknown>).earlyAbort) {
-          console.log(
-            '[finalHandler] Early abort detected - no messages saved, staying on new chat',
-          );
+          console.log('[finalHandler] Early abort detected - no response message saved');
           setShowStopButton(false);
           setIsSubmitting(false);
-          // Navigate to new chat if not already there
+
+          const currentConvoId = submissionConvo.conversationId;
+          const isInitialNewConvo = isInitialNewConversationSubmission(submission);
+          const isExistingConvo =
+            currentConvoId && currentConvoId !== Constants.NEW_CONVO && !isInitialNewConvo;
+          if (isExistingConvo) {
+            const abortMessages = getExistingConversationAbortMessages({
+              messages,
+              isRegenerate,
+              currentMessages: getMessages(),
+              regenerateMessages: submission.regenerateMessages,
+            });
+            setMessages(abortMessages);
+            queryClient.setQueryData<TMessage[]>(
+              [QueryKeys.messages, currentConvoId],
+              abortMessages,
+            );
+            setDraft({ id: currentConvoId, value: requestMessage?.text });
+            restorePendingQuotes(currentConvoId, requestMessage?.quotes);
+            return;
+          }
+
+          if (currentConvoId && currentConvoId !== Constants.NEW_CONVO) {
+            removeConvoFromAllQueries(queryClient, currentConvoId);
+            queryClient.removeQueries({ queryKey: [QueryKeys.conversation, currentConvoId] });
+            queryClient.removeQueries({ queryKey: [QueryKeys.messages, currentConvoId] });
+          }
+          setMessages([]);
+          queryClient.setQueryData<TMessage[]>([QueryKeys.messages, Constants.NEW_CONVO], []);
+          setDraft({ id: String(Constants.NEW_CONVO), value: requestMessage?.text });
+          restorePendingQuotes(String(Constants.NEW_CONVO), requestMessage?.quotes);
           if (location.pathname !== `/c/${Constants.NEW_CONVO}`) {
             navigate(`/c/${Constants.NEW_CONVO}`, { replace: true });
           }
@@ -542,7 +720,8 @@ export default function useEventHandlers({
 
         const isNewConvo = conversation.conversationId !== submissionConvo.conversationId;
 
-        if (isNewConvo && conversation.conversationId) {
+        // Skip temporary conversations — the server never generates titles for them.
+        if (isNewConvo && conversation.conversationId && !_isTemporary) {
           queueTitleGeneration(conversation.conversationId);
         }
 
@@ -570,6 +749,7 @@ export default function useEventHandlers({
 
           setFinalMessages(currentConvoId, isNewChat ? [] : [...messages]);
           setDraft({ id: currentConvoId, value: requestMessage?.text });
+          restorePendingQuotes(currentConvoId, requestMessage?.quotes);
           if (isNewChat) {
             navigate(`/c/${Constants.NEW_CONVO}`, { replace: true, state: { focusChat: true } });
           }
@@ -581,7 +761,11 @@ export default function useEventHandlers({
         if (runMessages) {
           finalMessages = [...runMessages];
         } else if (isRegenerate && responseMessage) {
-          finalMessages = [...messages, responseMessage];
+          finalMessages = mergeRegenerateFinalMessages({
+            messages: submission.regenerateMessages ?? currentMessages ?? messages,
+            responseMessage,
+            initialResponseId: submission.initialResponse.messageId,
+          });
         } else if (requestMessage != null && responseMessage != null) {
           finalMessages = [...messages, requestMessage, responseMessage];
         }
@@ -619,6 +803,12 @@ export default function useEventHandlers({
           removeConvoFromAllQueries(queryClient, submissionConvo.conversationId);
         }
 
+        /** A title applied locally (e.g. an immediate-mode title fetched while the
+         *  response was still streaming) must survive the final event, whose
+         *  `conversation` was built before the title was saved and so carries no
+         *  title yet — otherwise the chat reverts to "New Chat" until reload. This
+         *  holds for a stopped turn too: the server persists a title that finished
+         *  generating before the Stop, so the local one stays in sync. */
         if (setConversation && isAddedRequest !== true) {
           setConversation((prevState) => {
             const update = {
@@ -628,14 +818,24 @@ export default function useEventHandlers({
             if (prevState?.model != null && prevState.model !== submissionConvo.model) {
               update.model = prevState.model;
             }
-            const cachedConvo = queryClient.getQueryData<TConversation>([
-              QueryKeys.conversation,
-              conversation.conversationId,
-            ]);
-            if (!cachedConvo) {
-              queryClient.setQueryData(
+            const prevTitle = prevState?.title;
+            if (!hasRealTitle(conversation.title) && hasRealTitle(prevTitle)) {
+              update.title = prevTitle;
+            }
+            if (conversation.conversationId) {
+              queryClient.setQueryData<TConversation>(
                 [QueryKeys.conversation, conversation.conversationId],
-                update,
+                (cachedConvo) => {
+                  const merged = {
+                    ...cachedConvo,
+                    ...serverConversation,
+                  } as TConversation;
+                  const cachedTitle = cachedConvo?.title;
+                  if (!hasRealTitle(serverConversation.title) && hasRealTitle(cachedTitle)) {
+                    merged.title = cachedTitle;
+                  }
+                  return merged;
+                },
               );
             }
             return update;
@@ -651,6 +851,11 @@ export default function useEventHandlers({
             });
           }
 
+          if (conversation.chatProjectId) {
+            queryClient.invalidateQueries([QueryKeys.projects]);
+            queryClient.invalidateQueries([QueryKeys.project, conversation.chatProjectId]);
+          }
+
           if (location.pathname === `/c/${Constants.NEW_CONVO}`) {
             preserveSubagentAtomsForNewConvoIdRef.current = conversation.conversationId;
             navigate(`/c/${conversation.conversationId}`, { replace: true });
@@ -675,6 +880,7 @@ export default function useEventHandlers({
       location.pathname,
       applyAgentTemplate,
       attachmentHandler,
+      restorePendingQuotes,
     ],
   );
 
@@ -909,6 +1115,7 @@ export default function useEventHandlers({
     messageHandler,
     contentHandler,
     createdHandler,
+    titleHandler,
     syncStepMessage,
     attachmentHandler,
     abortConversation,
diff --git a/client/src/hooks/SSE/useResumableSSE.ts b/client/src/hooks/SSE/useResumableSSE.ts
index f0ee12ecc16..1eb72670448 100644
--- a/client/src/hooks/SSE/useResumableSSE.ts
+++ b/client/src/hooks/SSE/useResumableSSE.ts
@@ -10,35 +10,351 @@ import {
   ErrorTypes,
   StepEvents,
   apiBaseUrl,
+  UsageEvents,
   createPayload,
   ViolationTypes,
   removeNullishValues,
 } from 'librechat-data-provider';
-import type { TMessage, TPayload, TSubmission, EventSubmission } from 'librechat-data-provider';
+import type {
+  Agents,
+  TMessage,
+  TPayload,
+  TSubmission,
+  TConversation,
+  EventSubmission,
+} from 'librechat-data-provider';
 import type { EventHandlerParams } from './useEventHandlers';
+import type { ActiveJobsResponse } from '~/data-provider';
+import type { TResData } from '~/common';
+import {
+  clearAllDrafts,
+  removeConvoFromAllQueries,
+  upsertConvoInAllQueries,
+  countTrailingOutputChars,
+  markStreamStartFailedMetadata,
+} from '~/utils';
 import {
   useGetUserBalance,
   useGetStartupConfig,
   queueTitleGeneration,
   streamStatusQueryKey,
 } from '~/data-provider';
-import type { ActiveJobsResponse } from '~/data-provider';
+import useEventHandlers, { buildCreatedInitialResponse } from './useEventHandlers';
 import { useAuthContext } from '~/hooks/AuthContext';
-import useEventHandlers from './useEventHandlers';
-import { clearAllDrafts } from '~/utils';
+import useUsageHandler from './useUsageHandler';
 import store from '~/store';
 
 type ChatHelpers = Pick<
   EventHandlerParams,
-  | 'setMessages'
-  | 'getMessages'
-  | 'setConversation'
-  | 'setIsSubmitting'
-  | 'newConversation'
-  | 'resetLatestMessage'
+  'setMessages' | 'getMessages' | 'setConversation' | 'setIsSubmitting' | 'newConversation'
 >;
 
+const getStreamStartFailureData = (errorData?: Record<string, unknown>): TResData =>
+  ({
+    text: errorData
+      ? JSON.stringify(errorData)
+      : 'Error connecting to server, try refreshing the page.',
+    metadata: markStreamStartFailedMetadata(),
+  }) as unknown as TResData;
+
 const MAX_RETRIES = 5;
+const START_GENERATION_NETWORK_RETRIES = 3;
+const START_GENERATION_READINESS_TIMEOUT_MS = 120000;
+const SERVER_NOT_READY_CODE = 'SERVER_NOT_READY';
+
+type StartGenerationError = {
+  code?: string;
+  response?: {
+    status?: number;
+    data?: {
+      code?: string;
+    };
+    headers?: Record<string, string | number | string[] | undefined>;
+  };
+};
+
+const toStartGenerationError = (error: unknown): StartGenerationError | undefined =>
+  error != null && typeof error === 'object' ? (error as StartGenerationError) : undefined;
+
+const isRetryableNetworkError = (error: unknown) => {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const { code } = toStartGenerationError(error) ?? {};
+  return code === 'ERR_NETWORK' || code === 'ERR_INTERNET_DISCONNECTED';
+};
+
+const isServerNotReadyError = (error: unknown) => {
+  const candidate = toStartGenerationError(error);
+  return (
+    candidate?.response?.status === 503 && candidate.response?.data?.code === SERVER_NOT_READY_CODE
+  );
+};
+
+const getRetryAfterDelay = (error: unknown, fallbackDelay: number) => {
+  const headers = toStartGenerationError(error)?.response?.headers;
+  const rawValue = headers?.['retry-after'] ?? headers?.['Retry-After'];
+  const retryAfter = Array.isArray(rawValue) ? rawValue[0] : rawValue;
+  const seconds = typeof retryAfter === 'number' ? retryAfter : Number(retryAfter);
+
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    return fallbackDelay;
+  }
+
+  return Math.min(seconds * 1000, 30000);
+};
+
+const waitForRetryDelay = (delay: number, signal?: AbortSignal): Promise<boolean> =>
+  new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve(false);
+      return;
+    }
+
+    function cleanup() {
+      signal?.removeEventListener('abort', onAbort);
+    }
+    function onAbort() {
+      clearTimeout(timeout);
+      cleanup();
+      resolve(false);
+    }
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve(true);
+    }, delay);
+
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
+
+const hasConcreteConversationId = (conversationId?: string | null) =>
+  !!conversationId &&
+  conversationId !== Constants.NEW_CONVO &&
+  conversationId !== Constants.PENDING_CONVO;
+
+const isInitialNewConversation = (submission: TSubmission) => {
+  const conversationId = submission.conversation?.conversationId;
+  return !hasConcreteConversationId(conversationId);
+};
+
+const getToolCallName = (toolCall: unknown) =>
+  toolCall != null && typeof toolCall === 'object' && 'name' in toolCall
+    ? (toolCall.name as unknown)
+    : undefined;
+
+const isOAuthToolCallName = (name: unknown) =>
+  typeof name === 'string' && name.startsWith(`oauth${Constants.mcp_delimiter}`);
+
+const hasOAuthToolCall = (toolCalls: unknown) =>
+  Array.isArray(toolCalls) &&
+  toolCalls.some((toolCall) => isOAuthToolCallName(getToolCallName(toolCall)));
+
+const isOAuthStepEvent = (data: unknown) => {
+  if (data == null || typeof data !== 'object' || !('event' in data)) {
+    return false;
+  }
+
+  const event = data.event;
+  const payload = 'data' in data ? data.data : undefined;
+  if (payload == null || typeof payload !== 'object') {
+    return false;
+  }
+
+  if (event === StepEvents.ON_RUN_STEP) {
+    const stepDetails = 'stepDetails' in payload ? payload.stepDetails : undefined;
+    return (
+      stepDetails != null &&
+      typeof stepDetails === 'object' &&
+      'tool_calls' in stepDetails &&
+      hasOAuthToolCall(stepDetails.tool_calls)
+    );
+  }
+
+  if (event === StepEvents.ON_RUN_STEP_DELTA) {
+    const delta = 'delta' in payload ? payload.delta : undefined;
+    if (delta == null || typeof delta !== 'object') {
+      return false;
+    }
+    return (
+      ('auth' in delta && delta.auth != null) ||
+      ('tool_calls' in delta && hasOAuthToolCall(delta.tool_calls))
+    );
+  }
+
+  if (event === StepEvents.ON_RUN_STEP_COMPLETED) {
+    const result = 'result' in payload ? payload.result : undefined;
+    if (result == null || typeof result !== 'object' || !('tool_call' in result)) {
+      return false;
+    }
+    return isOAuthToolCallName(getToolCallName(result.tool_call));
+  }
+
+  return false;
+};
+
+const replaceNewConversationUrl = (conversationId: string) => {
+  if (window.location.pathname !== `/c/${Constants.NEW_CONVO}`) {
+    return;
+  }
+
+  window.history.replaceState(
+    window.history.state,
+    '',
+    `/c/${conversationId}${window.location.search}`,
+  );
+};
+
+const shouldHydrateMessage = (message: TMessage) =>
+  !hasConcreteConversationId(message.conversationId);
+
+const hydrateMessageConversationId = (message: TMessage, conversationId: string): TMessage =>
+  shouldHydrateMessage(message) ? { ...message, conversationId } : message;
+
+const preferDefinedString = (value?: string | null, fallback?: string): string | undefined =>
+  value != null && value !== '' ? value : fallback;
+
+const getOptimisticMessages = (
+  submission: TSubmission,
+  conversationId: string,
+  messages?: TMessage[],
+): TMessage[] => {
+  const sourceMessages =
+    messages && messages.length > 0
+      ? messages
+      : [submission.userMessage, submission.initialResponse].filter(
+          (message): message is TMessage => message != null,
+        );
+
+  return sourceMessages.map((message) => hydrateMessageConversationId(message, conversationId));
+};
+
+const buildOptimisticConversation = (
+  submission: TSubmission,
+  conversationId: string,
+): TConversation => {
+  const now = new Date().toISOString();
+  const messageIds = [
+    submission.userMessage?.messageId,
+    submission.initialResponse?.messageId,
+  ].filter((messageId): messageId is string => typeof messageId === 'string' && messageId !== '');
+
+  return {
+    ...submission.conversation,
+    conversationId,
+    endpoint: submission.conversation.endpoint ?? null,
+    title: submission.conversation.title ?? 'New Chat',
+    messages: messageIds.length > 0 ? messageIds : submission.conversation.messages,
+    createdAt: submission.conversation.createdAt ?? now,
+    updatedAt: now,
+  } as TConversation;
+};
+
+const hydrateSubmissionMessages = (
+  submission: TSubmission,
+  conversationId: string,
+): TSubmission => ({
+  ...submission,
+  conversation: {
+    ...submission.conversation,
+    conversationId,
+  },
+  userMessage: hydrateMessageConversationId(submission.userMessage, conversationId),
+  initialResponse: submission.initialResponse
+    ? hydrateMessageConversationId(submission.initialResponse, conversationId)
+    : submission.initialResponse,
+});
+
+const buildResumeEventSubmission = (
+  currentSubmission: TSubmission,
+  currentUserMessage: TMessage,
+  resumeState?: Agents.ResumeState | null,
+): EventSubmission => {
+  if (!resumeState) {
+    return { ...currentSubmission, userMessage: currentUserMessage } as EventSubmission;
+  }
+
+  const conversationId =
+    resumeState.conversationId ??
+    resumeState.userMessage?.conversationId ??
+    currentUserMessage.conversationId ??
+    currentSubmission.conversation?.conversationId;
+
+  const userMessage = {
+    ...currentUserMessage,
+    ...resumeState.userMessage,
+    conversationId,
+    isCreatedByUser: true,
+  } as TMessage;
+
+  const responseMessageId =
+    resumeState.responseMessageId ??
+    currentSubmission.initialResponse?.messageId ??
+    `${userMessage.messageId}_`;
+
+  const initialResponse = {
+    ...(currentSubmission.initialResponse as TMessage),
+    messageId: responseMessageId,
+    parentMessageId: userMessage.messageId,
+    conversationId,
+    content:
+      resumeState.aggregatedContent ??
+      (currentSubmission.initialResponse as TMessage | undefined)?.content,
+    sender: resumeState.sender ?? currentSubmission.initialResponse?.sender,
+    iconURL: preferDefinedString(currentSubmission.initialResponse?.iconURL, resumeState.iconURL),
+    model: preferDefinedString(currentSubmission.initialResponse?.model, resumeState.model),
+    isCreatedByUser: false,
+  } as TMessage;
+
+  return {
+    ...currentSubmission,
+    conversation: {
+      ...currentSubmission.conversation,
+      conversationId,
+    },
+    userMessage,
+    initialResponse,
+  } as EventSubmission;
+};
+
+const mergeResumeMessages = (
+  messages: TMessage[],
+  userMessage: TMessage,
+  responseMessage: TMessage,
+): TMessage[] => {
+  const nextMessages = [...messages];
+  const userIndex = nextMessages.findIndex(
+    (message) => message.messageId === userMessage.messageId,
+  );
+  const responseIndex = nextMessages.findIndex(
+    (message) => message.messageId === responseMessage.messageId,
+  );
+
+  if (userIndex >= 0) {
+    nextMessages[userIndex] = { ...nextMessages[userIndex], ...userMessage };
+  }
+
+  if (responseIndex >= 0) {
+    nextMessages[responseIndex] = { ...nextMessages[responseIndex], ...responseMessage };
+  }
+
+  if (userIndex >= 0 && responseIndex >= 0) {
+    return nextMessages;
+  }
+
+  if (userIndex >= 0) {
+    const insertAt = userIndex + 1;
+    nextMessages.splice(insertAt, 0, responseMessage);
+    return nextMessages;
+  }
+
+  if (responseIndex >= 0) {
+    nextMessages.splice(responseIndex, 0, userMessage);
+    return nextMessages;
+  }
+
+  return [...nextMessages, userMessage, responseMessage];
+};
 
 /**
  * Hook for resumable SSE streams.
@@ -60,6 +376,8 @@ export default function useResumableSSE(
   const setActiveRunId = useSetRecoilState(store.activeRunFamily(runIndex));
 
   const { token, isAuthenticated } = useAuthContext();
+  const { setMessages, getMessages, setConversation, setIsSubmitting, newConversation } =
+    chatHelpers;
 
   /**
    * Optimistically add a job ID to the active jobs cache.
@@ -86,24 +404,50 @@ export default function useResumableSSE(
     },
     [queryClient],
   );
+
+  const addOptimisticConversation = useCallback(
+    (conversationId: string, currentSubmission: TSubmission): TSubmission => {
+      if (!isInitialNewConversation(currentSubmission)) {
+        return currentSubmission;
+      }
+
+      const optimisticConversation = buildOptimisticConversation(currentSubmission, conversationId);
+      const optimisticMessages = getOptimisticMessages(
+        currentSubmission,
+        conversationId,
+        getMessages(),
+      );
+
+      queryClient.setQueryData<TConversation>(
+        [QueryKeys.conversation, conversationId],
+        (current) => current ?? optimisticConversation,
+      );
+      queryClient.setQueryData<TMessage[]>(
+        [QueryKeys.messages, conversationId],
+        optimisticMessages,
+      );
+      queryClient.setQueryData<TMessage[]>(
+        [QueryKeys.messages, Constants.NEW_CONVO],
+        optimisticMessages,
+      );
+      upsertConvoInAllQueries(queryClient, optimisticConversation);
+
+      return hydrateSubmissionMessages(currentSubmission, conversationId);
+    },
+    [getMessages, queryClient],
+  );
   const [_completed, setCompleted] = useState(new Set());
   const [streamId, setStreamId] = useState<string | null>(null);
   const setAbortScroll = useSetRecoilState(store.abortScrollFamily(runIndex));
+  const setSubmission = useSetRecoilState(store.submissionByIndex(runIndex));
   const setShowStopButton = useSetRecoilState(store.showStopButtonByIndex(runIndex));
 
   const sseRef = useRef<SSE | null>(null);
   const reconnectAttemptRef = useRef(0);
   const reconnectTimeoutRef = useRef<NodeJS.Timeout | null>(null);
   const submissionRef = useRef<TSubmission | null>(null);
-
-  const {
-    setMessages,
-    getMessages,
-    setConversation,
-    setIsSubmitting,
-    newConversation,
-    resetLatestMessage,
-  } = chatHelpers;
+  const optimisticStreamIdsRef = useRef(new Set<string>());
+  const createdStreamIdsRef = useRef(new Set<string>());
 
   const {
     stepHandler,
@@ -113,6 +457,7 @@ export default function useResumableSSE(
     messageHandler,
     contentHandler,
     createdHandler,
+    titleHandler,
     syncStepMessage,
     attachmentHandler,
     resetContentHandler,
@@ -125,13 +470,22 @@ export default function useResumableSSE(
     setIsSubmitting,
     newConversation,
     setShowStopButton,
-    resetLatestMessage,
   });
 
   const { data: startupConfig } = useGetStartupConfig();
   const balanceQuery = useGetUserBalance({
     enabled: !!isAuthenticated && startupConfig?.balance?.enabled,
   });
+  const {
+    contextHandler,
+    usageHandler,
+    tapStream,
+    tapContent,
+    finalizeUsage,
+    backfillUsage,
+    resetLive,
+    seedLive,
+  } = useUsageHandler();
 
   /**
    * Subscribe to stream via SSE library (supports custom headers)
@@ -142,6 +496,17 @@ export default function useResumableSSE(
     (currentStreamId: string, currentSubmission: TSubmission, isResume = false) => {
       let { userMessage } = currentSubmission;
       let textIndex: number | null = null;
+      const preCreatedStepEvents: Array<Parameters<typeof stepHandler>[0]> = [];
+      const replayPreCreatedStepEvents = () => {
+        if (preCreatedStepEvents.length === 0) {
+          return;
+        }
+
+        const submission = { ...currentSubmission, userMessage } as EventSubmission;
+        for (const event of preCreatedStepEvents.splice(0)) {
+          stepHandler(event, submission);
+        }
+      };
 
       const baseUrl = `${apiBaseUrl()}/api/agents/chat/stream/${encodeURIComponent(currentStreamId)}`;
       const url = isResume ? `${baseUrl}?resume=true` : baseUrl;
@@ -173,8 +538,12 @@ export default function useResumableSSE(
               hasResponseMessage: !!data.responseMessage,
             });
             clearAllDrafts(currentSubmission.conversation?.conversationId);
+            if (optimisticStreamIdsRef.current.has(currentStreamId)) {
+              clearAllDrafts(Constants.NEW_CONVO);
+            }
             try {
               finalHandler(data, currentSubmission as EventSubmission);
+              finalizeUsage(data, { ...currentSubmission, userMessage });
             } catch (error) {
               console.error('[ResumableSSE] Error in finalHandler:', error);
               setIsSubmitting(false);
@@ -187,6 +556,8 @@ export default function useResumableSSE(
             (startupConfig?.balance?.enabled ?? false) && balanceQuery.refetch();
             sse.close();
             setStreamId(null);
+            optimisticStreamIdsRef.current.delete(currentStreamId);
+            createdStreamIdsRef.current.delete(currentStreamId);
             return;
           }
 
@@ -195,6 +566,7 @@ export default function useResumableSSE(
               messageId: data.message?.messageId,
               conversationId: data.message?.conversationId,
             });
+            createdStreamIdsRef.current.add(currentStreamId);
             const runId = v4();
             setActiveRunId(runId);
             userMessage = {
@@ -202,7 +574,19 @@ export default function useResumableSSE(
               ...data.message,
               overrideParentMessageId: userMessage.overrideParentMessageId,
             };
-            createdHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
+            const createdInitialResponse = buildCreatedInitialResponse({
+              initialResponse: currentSubmission.initialResponse as TMessage,
+              userMessage,
+              isRegenerate: currentSubmission.isRegenerate,
+            });
+            currentSubmission = {
+              ...currentSubmission,
+              userMessage,
+              initialResponse: createdInitialResponse,
+            };
+            submissionRef.current = currentSubmission;
+            createdHandler(data, currentSubmission as EventSubmission);
+            replayPreCreatedStepEvents();
             return;
           }
 
@@ -214,7 +598,37 @@ export default function useResumableSSE(
             return;
           }
 
+          if (data.event === 'title') {
+            titleHandler(data);
+            return;
+          }
+
+          if (data.event === UsageEvents.ON_CONTEXT_USAGE) {
+            contextHandler(data.data, { ...currentSubmission, userMessage });
+            return;
+          }
+
+          if (data.event === UsageEvents.ON_TOKEN_USAGE) {
+            usageHandler(data.data, { ...currentSubmission, userMessage });
+            return;
+          }
+
           if (data.event != null) {
+            if (
+              data.event === StepEvents.ON_MESSAGE_DELTA ||
+              data.event === StepEvents.ON_REASONING_DELTA
+            ) {
+              tapStream(data.data, { ...currentSubmission, userMessage });
+            }
+            if (!isResume && !createdStreamIdsRef.current.has(currentStreamId)) {
+              if (isOAuthStepEvent(data)) {
+                preCreatedStepEvents.push(data);
+                stepHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
+                return;
+              }
+              preCreatedStepEvents.push(data);
+              return;
+            }
             stepHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
             return;
           }
@@ -227,13 +641,45 @@ export default function useResumableSSE(
 
             const runId = v4();
             setActiveRunId(runId);
+            const resumeSubmission = buildResumeEventSubmission(
+              currentSubmission,
+              userMessage,
+              data.resumeState,
+            );
+            currentSubmission = resumeSubmission;
+            submissionRef.current = resumeSubmission;
+            userMessage = resumeSubmission.userMessage;
+            /**
+             * Totals rebuild from the persisted backfill at sync. Replayed or
+             * gap usage events already represented in the snapshot are skipped
+             * via multiset matching; events that raced past the snapshot read
+             * still fold so multi-call runs don't undercount.
+             */
+            /** Fold the run's persisted usage; events also replayed below are
+             *  deduped by (runId, seq) inside the handler, so prior prompts in
+             *  this conversation keep their usage and gap events still count */
+            backfillUsage(data.resumeState?.collectedUsage ?? [], resumeSubmission);
+            if (data.resumeState?.contextUsage) {
+              /** Already reconciled to the call's real prompt tokens server-side
+               *  (GenerationJobManager.persistTokenUsage) when the snapshot's call
+               *  completed, so install it as-is — no client backfill reconcile. */
+              contextHandler(data.resumeState.contextUsage, resumeSubmission);
+            }
+            /** Output streamed before this resume is not re-delivered as deltas
+             *  — estimate it from the trailing aggregated content. This is
+             *  needed even with a snapshot: the snapshot is pre-invoke, so the
+             *  in-flight output it precedes rides on the live estimate.
+             *  countTrailingOutputChars only counts output at the very end (0
+             *  when paused at a tool call), so a snapshot's budget is never
+             *  double-counted. */
+            seedLive(
+              countTrailingOutputChars(data.resumeState?.aggregatedContent),
+              resumeSubmission,
+            );
 
             if (data.resumeState?.runSteps) {
               for (const runStep of data.resumeState.runSteps) {
-                stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, {
-                  ...currentSubmission,
-                  userMessage,
-                } as EventSubmission);
+                stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, resumeSubmission);
               }
             }
 
@@ -264,20 +710,25 @@ export default function useResumableSSE(
               });
 
               if (responseIdx >= 0) {
-                const updated = [...messages];
-                const oldContent = updated[responseIdx]?.content;
-                updated[responseIdx] = {
-                  ...updated[responseIdx],
+                const oldContent = messages[responseIdx]?.content;
+                const responseMessage = {
+                  ...messages[responseIdx],
                   content: data.resumeState.aggregatedContent,
-                };
+                  iconURL: preferDefinedString(
+                    messages[responseIdx]?.iconURL,
+                    data.resumeState.iconURL,
+                  ),
+                  model: preferDefinedString(messages[responseIdx]?.model, data.resumeState.model),
+                } as TMessage;
+                const updated = mergeResumeMessages(messages, userMessage, responseMessage);
                 console.log('[ResumableSSE] SYNC updating message', {
-                  messageId: updated[responseIdx]?.messageId,
+                  messageId: responseMessage.messageId,
                   oldContentLength: Array.isArray(oldContent) ? oldContent.length : 0,
                   newContentLength: data.resumeState.aggregatedContent?.length,
                 });
                 setMessages(updated);
                 resetContentHandler();
-                syncStepMessage(updated[responseIdx]);
+                syncStepMessage(responseMessage);
                 console.log('[ResumableSSE] SYNC complete, handlers synced');
               } else {
                 const responseId = serverResponseId ?? `${userMsgId}_`;
@@ -288,21 +739,62 @@ export default function useResumableSSE(
                   text: '',
                   content: data.resumeState.aggregatedContent,
                   isCreatedByUser: false,
+                  iconURL: data.resumeState.iconURL,
+                  model: data.resumeState.model,
                 } as TMessage;
-                setMessages([...messages, newMessage]);
+                setMessages(mergeResumeMessages(messages, userMessage, newMessage));
                 resetContentHandler();
                 syncStepMessage(newMessage);
               }
             }
 
+            if (data.resumeState?.titleEvent) {
+              titleHandler(data.resumeState.titleEvent);
+            }
+
+            if (data.resumeState?.replayEvents?.length > 0) {
+              console.log(
+                `[ResumableSSE] Replaying ${data.resumeState.replayEvents.length} resume events`,
+              );
+              for (const replayEvent of data.resumeState.replayEvents) {
+                if (replayEvent.event === UsageEvents.ON_CONTEXT_USAGE) {
+                  contextHandler(replayEvent.data, resumeSubmission);
+                } else if (replayEvent.event === UsageEvents.ON_TOKEN_USAGE) {
+                  usageHandler(replayEvent.data, resumeSubmission);
+                } else if (replayEvent.event != null) {
+                  if (
+                    replayEvent.event === StepEvents.ON_MESSAGE_DELTA ||
+                    replayEvent.event === StepEvents.ON_REASONING_DELTA
+                  ) {
+                    tapStream(replayEvent.data, resumeSubmission);
+                  }
+                  stepHandler(replayEvent, resumeSubmission);
+                }
+              }
+            }
+
             if (data.pendingEvents?.length > 0) {
               console.log(`[ResumableSSE] Replaying ${data.pendingEvents.length} pending events`);
-              const submission = { ...currentSubmission, userMessage } as EventSubmission;
               for (const pendingEvent of data.pendingEvents) {
-                if (pendingEvent.event != null) {
-                  stepHandler(pendingEvent, submission);
+                if (pendingEvent.event === 'title') {
+                  titleHandler(pendingEvent);
+                } else if (pendingEvent.event === UsageEvents.ON_CONTEXT_USAGE) {
+                  contextHandler(pendingEvent.data, resumeSubmission);
+                } else if (pendingEvent.event === UsageEvents.ON_TOKEN_USAGE) {
+                  usageHandler(pendingEvent.data, resumeSubmission);
+                } else if (pendingEvent.event != null) {
+                  if (
+                    pendingEvent.event === StepEvents.ON_MESSAGE_DELTA ||
+                    pendingEvent.event === StepEvents.ON_REASONING_DELTA
+                  ) {
+                    tapStream(pendingEvent.data, resumeSubmission);
+                  }
+                  stepHandler(pendingEvent, resumeSubmission);
                 } else if (pendingEvent.type != null) {
-                  contentHandler({ data: pendingEvent, submission });
+                  /** Gap output streamed past the resume snapshot must reach the
+                   *  live estimate too, not just the message UI */
+                  tapContent(pendingEvent.text, resumeSubmission);
+                  contentHandler({ data: pendingEvent, submission: resumeSubmission });
                 }
               }
             }
@@ -317,6 +809,7 @@ export default function useResumableSSE(
             if (text != null && index !== textIndex) {
               textIndex = index;
             }
+            tapContent(text, { ...currentSubmission, userMessage });
             contentHandler({ data, submission: currentSubmission as EventSubmission });
             return;
           }
@@ -328,6 +821,9 @@ export default function useResumableSSE(
               parentMessageId: data.parentMessageId,
               messageId: data.messageId,
             };
+            /** Legacy non-agent streams send cumulative text here — feed the
+             *  live estimate like the content path above */
+            tapContent(text, { ...currentSubmission, userMessage });
             messageHandler(text, { ...currentSubmission, userMessage, initialResponse });
           }
         } catch (error) {
@@ -355,15 +851,29 @@ export default function useResumableSSE(
           console.log('[ResumableSSE] Stream 404, invalidating messages for:', convoId);
           sse.close();
           removeActiveJob(currentStreamId);
+          /** Terminal: drop any in-flight live estimate so the gauge doesn't
+           *  keep counting stale streamed output after the stream ends */
+          resetLive({ ...currentSubmission, userMessage });
           clearAllDrafts(convoId);
+          if (optimisticStreamIdsRef.current.has(currentStreamId)) {
+            clearAllDrafts(Constants.NEW_CONVO);
+          }
           clearStepMaps();
           if (convoId) {
             queryClient.invalidateQueries({ queryKey: [QueryKeys.messages, convoId] });
             queryClient.removeQueries({ queryKey: streamStatusQueryKey(convoId) });
           }
+          if (
+            !createdStreamIdsRef.current.has(currentStreamId) &&
+            optimisticStreamIdsRef.current.has(currentStreamId)
+          ) {
+            removeConvoFromAllQueries(queryClient, currentStreamId);
+          }
           setIsSubmitting(false);
           setShowStopButton(false);
           setStreamId(null);
+          optimisticStreamIdsRef.current.delete(currentStreamId);
+          createdStreamIdsRef.current.delete(currentStreamId);
           reconnectAttemptRef.current = 0;
           return;
         }
@@ -398,6 +908,13 @@ export default function useResumableSSE(
           console.log('[ResumableSSE] Server-sent error event received:', e.data);
           sse.close();
           removeActiveJob(currentStreamId);
+          resetLive({ ...currentSubmission, userMessage });
+          if (
+            !createdStreamIdsRef.current.has(currentStreamId) &&
+            optimisticStreamIdsRef.current.has(currentStreamId)
+          ) {
+            removeConvoFromAllQueries(queryClient, currentStreamId);
+          }
 
           try {
             const errorData = JSON.parse(e.data);
@@ -437,6 +954,8 @@ export default function useResumableSSE(
           setIsSubmitting(false);
           setShowStopButton(false);
           setStreamId(null);
+          optimisticStreamIdsRef.current.delete(currentStreamId);
+          createdStreamIdsRef.current.delete(currentStreamId);
           reconnectAttemptRef.current = 0;
           return;
         }
@@ -473,11 +992,22 @@ export default function useResumableSSE(
           console.error('[ResumableSSE] Max reconnect attempts reached');
           sse.close();
           errorHandler({ data: undefined, submission: currentSubmission as EventSubmission });
+          /** Terminal: clear the in-flight live estimate like the other
+           *  stop-reconnecting paths so the gauge doesn't show stale tokens */
+          resetLive({ ...currentSubmission, userMessage });
           // Optimistically remove from active jobs on max retries
           removeActiveJob(currentStreamId);
+          if (
+            !createdStreamIdsRef.current.has(currentStreamId) &&
+            optimisticStreamIdsRef.current.has(currentStreamId)
+          ) {
+            removeConvoFromAllQueries(queryClient, currentStreamId);
+          }
           setIsSubmitting(false);
           setShowStopButton(false);
           setStreamId(null);
+          optimisticStreamIdsRef.current.delete(currentStreamId);
+          createdStreamIdsRef.current.delete(currentStreamId);
         }
       });
 
@@ -504,6 +1034,11 @@ export default function useResumableSSE(
         setIsSubmitting(false);
         setShowStopButton(false);
         setStreamId(null);
+        /** Intentional close without a final event (explicit stop, or navigation
+         *  while generating): discard the in-flight pending usage so it can't
+         *  merge into the next response in this conversation. On a resume the
+         *  collected usage is re-folded via backfillUsage, so nothing is lost. */
+        resetLive({ ...currentSubmission, userMessage });
       });
 
       // Start the SSE connection
@@ -540,6 +1075,7 @@ export default function useResumableSSE(
       finalHandler,
       createdHandler,
       attachmentHandler,
+      titleHandler,
       stepHandler,
       contentHandler,
       resetContentHandler,
@@ -554,16 +1090,25 @@ export default function useResumableSSE(
       balanceQuery,
       removeActiveJob,
       queryClient,
+      contextHandler,
+      usageHandler,
+      tapStream,
+      tapContent,
+      finalizeUsage,
+      backfillUsage,
+      resetLive,
+      seedLive,
     ],
   );
 
   /**
    * Start generation (POST request that returns streamId)
    * Uses request.post which has axios interceptors for automatic token refresh.
-   * Retries up to 3 times on network errors with exponential backoff.
+   * Retries transient network failures and startup readiness responses.
+   * Readiness retries honor Retry-After until cleanup or the readiness window expires.
    */
   const startGeneration = useCallback(
-    async (currentSubmission: TSubmission): Promise<string | null> => {
+    async (currentSubmission: TSubmission, signal?: AbortSignal): Promise<string | null> => {
       const payloadData = createPayload(currentSubmission);
       let { payload } = payloadData;
       payload = removeNullishValues(payload) as TPayload;
@@ -572,29 +1117,54 @@ export default function useResumableSSE(
 
       const url = payloadData.server;
 
-      const maxRetries = 3;
       let lastError: unknown = null;
+      let requestAttempts = 0;
+      let networkAttempts = 0;
+      let readinessAttempts = 0;
+      const readinessDeadline = Date.now() + START_GENERATION_READINESS_TIMEOUT_MS;
 
-      for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      while (!signal?.aborted) {
+        requestAttempts += 1;
         try {
           // Use request.post which handles auth token refresh via axios interceptors
           const data = (await request.post(url, payload)) as { streamId: string };
+          if (signal?.aborted) {
+            return null;
+          }
           console.log('[ResumableSSE] Generation started:', { streamId: data.streamId });
           return data.streamId;
         } catch (error) {
+          if (signal?.aborted) {
+            return null;
+          }
+
           lastError = error;
-          // Check if it's a network error (retry) vs server error (don't retry)
-          const isNetworkError =
-            error instanceof Error &&
-            'code' in error &&
-            (error.code === 'ERR_NETWORK' || error.code === 'ERR_INTERNET_DISCONNECTED');
-
-          if (isNetworkError && attempt < maxRetries) {
-            const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
+          const isNetworkError = isRetryableNetworkError(error);
+          const isServerNotReady = isServerNotReadyError(error);
+          const remainingReadinessMs = readinessDeadline - Date.now();
+          const shouldRetryNetwork =
+            isNetworkError && networkAttempts < START_GENERATION_NETWORK_RETRIES - 1;
+          const shouldRetryServerNotReady = isServerNotReady && remainingReadinessMs > 0;
+
+          if (shouldRetryNetwork || shouldRetryServerNotReady) {
+            networkAttempts += isNetworkError ? 1 : 0;
+            readinessAttempts += isServerNotReady ? 1 : 0;
+            const fallbackDelay = Math.min(1000 * Math.pow(2, requestAttempts - 1), 8000);
+            const retryDelay = isServerNotReady
+              ? Math.min(getRetryAfterDelay(error, fallbackDelay), remainingReadinessMs)
+              : fallbackDelay;
+            const reason = isServerNotReady ? 'Server not ready' : 'Network error';
+            const attempt = isServerNotReady ? readinessAttempts : networkAttempts;
+            const limit = isServerNotReady
+              ? `${Math.ceil(START_GENERATION_READINESS_TIMEOUT_MS / 1000)}s readiness window`
+              : `${START_GENERATION_NETWORK_RETRIES}`;
             console.log(
-              `[ResumableSSE] Network error starting generation, retrying in ${delay}ms (attempt ${attempt}/${maxRetries})`,
+              `[ResumableSSE] ${reason} starting generation, retrying in ${retryDelay}ms (attempt ${attempt}/${limit})`,
             );
-            await new Promise((resolve) => setTimeout(resolve, delay));
+            const shouldContinue = await waitForRetryDelay(retryDelay, signal);
+            if (!shouldContinue) {
+              return null;
+            }
             continue;
           }
 
@@ -603,24 +1173,24 @@ export default function useResumableSSE(
         }
       }
 
+      if (signal?.aborted) {
+        return null;
+      }
+
       console.error('[ResumableSSE] Error starting generation:', lastError);
 
       const axiosError = lastError as { response?: { data?: Record<string, unknown> } };
       const errorData = axiosError?.response?.data;
-      if (errorData) {
-        errorHandler({
-          data: { text: JSON.stringify(errorData) } as unknown as Parameters<
-            typeof errorHandler
-          >[0]['data'],
-          submission: currentSubmission as EventSubmission,
-        });
-      } else {
-        errorHandler({ data: undefined, submission: currentSubmission as EventSubmission });
-      }
+      errorHandler({
+        data: getStreamStartFailureData(errorData),
+        submission: currentSubmission as EventSubmission,
+      });
+      setShowStopButton(false);
       setIsSubmitting(false);
+      setSubmission(null);
       return null;
     },
-    [clearStepMaps, errorHandler, setIsSubmitting],
+    [clearStepMaps, errorHandler, setIsSubmitting, setShowStopButton, setSubmission],
   );
 
   useEffect(() => {
@@ -651,12 +1221,21 @@ export default function useResumableSSE(
     });
 
     submissionRef.current = submission;
+    const startController = new AbortController();
+    const { signal } = startController;
 
     const initStream = async () => {
+      if (signal.aborted) {
+        return;
+      }
+
       setIsSubmitting(true);
       setShowStopButton(true);
 
       if (resumeStreamId) {
+        if (signal.aborted) {
+          return;
+        }
         // Resume: just subscribe to existing stream, don't start new generation
         console.log('[ResumableSSE] Resuming existing stream:', resumeStreamId);
         setStreamId(resumeStreamId);
@@ -666,17 +1245,28 @@ export default function useResumableSSE(
       } else {
         // New generation: start and then subscribe
         console.log('[ResumableSSE] Starting NEW generation');
-        const newStreamId = await startGeneration(submission);
+        const newStreamId = await startGeneration(submission, signal);
+        if (signal.aborted) {
+          return;
+        }
         if (newStreamId) {
           setStreamId(newStreamId);
           // Optimistically add to active jobs
           addActiveJob(newStreamId);
-          // Queue title generation if this is a new conversation (first message)
-          const isNewConvo = submission.userMessage?.parentMessageId === Constants.NO_PARENT;
-          if (isNewConvo) {
+          // Queue title generation if this is a new conversation (first message).
+          // Skip temporary conversations — the server never generates titles for
+          // them, so polling would 404 indefinitely.
+          const isNewConvo = isInitialNewConversation(submission);
+          if (isNewConvo && !submission.isTemporary) {
             queueTitleGeneration(newStreamId);
           }
-          subscribeToStream(newStreamId, submission);
+          if (isInitialNewConversation(submission)) {
+            optimisticStreamIdsRef.current.add(newStreamId);
+            replaceNewConversationUrl(newStreamId);
+          }
+          const streamSubmission = addOptimisticConversation(newStreamId, submission);
+          submissionRef.current = streamSubmission;
+          subscribeToStream(newStreamId, streamSubmission);
         } else {
           console.error('[ResumableSSE] Failed to get streamId from startGeneration');
         }
@@ -687,6 +1277,7 @@ export default function useResumableSSE(
 
     return () => {
       console.log('[ResumableSSE] Cleanup - closing SSE, resetting UI state');
+      startController.abort();
       // Cleanup on unmount/navigation - close connection but DO NOT abort backend
       // Reset UI state so it doesn't leak to other conversations
       // If user returns to this conversation, useResumeOnLoad will restore the state
diff --git a/client/src/hooks/SSE/useResumeOnLoad.ts b/client/src/hooks/SSE/useResumeOnLoad.ts
index 5f0f6917876..97c1bc91c0e 100644
--- a/client/src/hooks/SSE/useResumeOnLoad.ts
+++ b/client/src/hooks/SSE/useResumeOnLoad.ts
@@ -1,10 +1,87 @@
 import { useEffect, useRef } from 'react';
-import { useSetRecoilState, useRecoilValue } from 'recoil';
+import { useSetRecoilState, useRecoilValue, useRecoilCallback } from 'recoil';
 import { Constants, tMessageSchema, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TMessage, TConversation, TSubmission, Agents } from 'librechat-data-provider';
+import type { StreamStatusResponse } from '~/data-provider';
+import { getBranchSiblingIndexesForTarget } from '~/utils';
 import { useStreamStatus } from '~/data-provider';
 import store from '~/store';
 
+function hasSubmissionUserMessage(
+  submission: TSubmission | null,
+  messages: TMessage[] | undefined,
+  conversationId: string | undefined,
+): boolean {
+  const userMessageId = submission?.userMessage?.messageId;
+  if (!userMessageId || !conversationId || !messages?.length) {
+    return false;
+  }
+
+  return messages.some(
+    (message) =>
+      message.isCreatedByUser === true &&
+      message.messageId === userMessageId &&
+      message.conversationId === conversationId,
+  );
+}
+
+function resumeStateMatchesSubmission(
+  streamStatus: StreamStatusResponse | undefined,
+  submission: TSubmission | null,
+): boolean {
+  const resumeState = streamStatus?.resumeState;
+  if (!resumeState || !submission) {
+    return false;
+  }
+
+  const userMessageId = submission.userMessage?.messageId;
+  if (userMessageId && resumeState.userMessage?.messageId === userMessageId) {
+    return true;
+  }
+
+  const responseMessageId = submission.initialResponse?.messageId;
+  return !!responseMessageId && resumeState.responseMessageId === responseMessageId;
+}
+
+function getResumeBranchTargetMessageId(
+  resumeState: Agents.ResumeState,
+  messages: TMessage[],
+): string | null | undefined {
+  const responseMessageId = resumeState.responseMessageId;
+  if (!responseMessageId) {
+    return resumeState.userMessage?.parentMessageId;
+  }
+
+  const unpaddedResponseMessageId = responseMessageId.replace(/_+$/, '');
+  let hasResponseMessage = false;
+  let hasUnpaddedResponseMessage = false;
+
+  for (const message of messages) {
+    if (message.messageId === responseMessageId) {
+      hasResponseMessage = true;
+      break;
+    }
+
+    if (message.messageId === unpaddedResponseMessageId) {
+      hasUnpaddedResponseMessage = true;
+    }
+  }
+
+  if (hasResponseMessage) {
+    return responseMessageId;
+  }
+
+  if (hasUnpaddedResponseMessage) {
+    return unpaddedResponseMessageId;
+  }
+
+  return resumeState.userMessage?.parentMessageId;
+}
+
+function preferDefinedString(value?: string | null, fallback?: string): string | undefined {
+  return value != null && value !== '' ? value : fallback;
+}
+
 /**
  * Build a submission object from resume state for reconnected streams.
  * This provides the minimum data needed for useResumableSSE to subscribe.
@@ -63,7 +140,8 @@ function buildSubmissionFromResumeState(
     isCreatedByUser: false,
     role: 'assistant',
     sender: existingResponseMessage?.sender ?? resumeState.sender,
-    model: existingResponseMessage?.model,
+    model: preferDefinedString(existingResponseMessage?.model, resumeState.model),
+    iconURL: preferDefinedString(existingResponseMessage?.iconURL, resumeState.iconURL),
   } as TMessage;
 
   const conversation: TConversation = {
@@ -111,16 +189,39 @@ export default function useResumeOnLoad(
   const resumableEnabled = !isAssistantsEndpoint(actualEndpoint);
   // Track conversations we've already processed (either resumed or skipped)
   const processedConvoRef = useRef<string | null>(null);
+  const restoreResumeBranch = useRecoilCallback(
+    ({ set }) =>
+      (resumeState: Agents.ResumeState, messages: TMessage[], activeConversationId: string) => {
+        const targetMessageId = getResumeBranchTargetMessageId(resumeState, messages);
+        const branchIndexes = getBranchSiblingIndexesForTarget(
+          messages,
+          targetMessageId,
+          activeConversationId,
+        );
+
+        for (const { parentMessageId, siblingIdx } of branchIndexes) {
+          set(store.messagesSiblingIdxFamily(parentMessageId), siblingIdx);
+        }
+      },
+    [],
+  );
 
   // Check for active stream when conversation changes
-  // Allow check if no submission OR submission is for a different conversation (stale)
   const submissionConvoId = currentSubmission?.conversation?.conversationId;
-  const hasActiveSubmissionForThisConvo = currentSubmission && submissionConvoId === conversationId;
+  const loadedMessages = messagesLoaded ? getMessages() : undefined;
+  const hasExplicitSubmissionMatch = !!conversationId && submissionConvoId === conversationId;
+  const hasHydratedMessageMatch =
+    submissionConvoId == null &&
+    hasSubmissionUserMessage(currentSubmission, loadedMessages, conversationId);
+  const hasActiveSubmissionForThisConvo =
+    !!currentSubmission && (hasExplicitSubmissionMatch || hasHydratedMessageMatch);
+  const hasStaleSubmissionForDifferentConvo =
+    !!currentSubmission && submissionConvoId != null && submissionConvoId !== conversationId;
 
   const shouldCheck =
     resumableEnabled &&
     messagesLoaded && // Wait for messages to load before checking
-    !hasActiveSubmissionForThisConvo && // Allow if no submission or stale submission
+    !hasActiveSubmissionForThisConvo && // Allow if no submission or a confirmed stale submission
     !!conversationId &&
     conversationId !== Constants.NEW_CONVO &&
     processedConvoRef.current !== conversationId; // Don't re-check processed convos
@@ -166,7 +267,7 @@ export default function useResumeOnLoad(
     }
 
     // If there's a stale submission for a different conversation, log it but continue
-    if (currentSubmission && submissionConvoId !== conversationId) {
+    if (hasStaleSubmissionForDifferentConvo) {
       console.log(
         '[ResumeOnLoad] Found stale submission for different conversation, will check for resume',
         {
@@ -183,6 +284,21 @@ export default function useResumeOnLoad(
       return;
     }
 
+    if (
+      streamStatus.active &&
+      streamStatus.streamId &&
+      submissionConvoId == null &&
+      resumeStateMatchesSubmission(streamStatus, currentSubmission)
+    ) {
+      console.log('[ResumeOnLoad] Skipping - active submission matches stream status', {
+        streamId: streamStatus.streamId,
+        currentConvoId: conversationId,
+        userMessageId: currentSubmission?.userMessage?.messageId,
+      });
+      processedConvoRef.current = conversationId;
+      return;
+    }
+
     // Don't process the same conversation twice
     if (processedConvoRef.current === conversationId) {
       console.log('[ResumeOnLoad] Skipping - already processed this conversation');
@@ -207,6 +323,7 @@ export default function useResumeOnLoad(
 
     // Build submission from resume state if available
     if (streamStatus.resumeState) {
+      restoreResumeBranch(streamStatus.resumeState, messages, conversationId);
       const submission = buildSubmissionFromResumeState(
         streamStatus.resumeState,
         streamStatus.streamId,
@@ -242,12 +359,14 @@ export default function useResumeOnLoad(
     messagesLoaded,
     hasActiveSubmissionForThisConvo,
     submissionConvoId,
+    hasStaleSubmissionForDifferentConvo,
     currentSubmission,
     isSuccess,
     isFetching,
     streamStatus,
     getMessages,
     setSubmission,
+    restoreResumeBranch,
   ]);
 
   // Reset processedConvoRef when conversation changes to allow re-checking
diff --git a/client/src/hooks/SSE/useSSE.ts b/client/src/hooks/SSE/useSSE.ts
index 78835f5729f..8f18f1d556b 100644
--- a/client/src/hooks/SSE/useSSE.ts
+++ b/client/src/hooks/SSE/useSSE.ts
@@ -2,24 +2,26 @@ import { useEffect, useState } from 'react';
 import { v4 } from 'uuid';
 import { SSE } from 'sse.js';
 import { useSetRecoilState } from 'recoil';
-import { request, createPayload, removeNullishValues } from 'librechat-data-provider';
+import {
+  request,
+  UsageEvents,
+  StepEvents,
+  createPayload,
+  removeNullishValues,
+} from 'librechat-data-provider';
 import type { TMessage, TPayload, TSubmission, EventSubmission } from 'librechat-data-provider';
 import type { EventHandlerParams } from './useEventHandlers';
 import type { TResData } from '~/common';
 import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
 import { useAuthContext } from '~/hooks/AuthContext';
 import useEventHandlers from './useEventHandlers';
+import useUsageHandler from './useUsageHandler';
 import { clearAllDrafts } from '~/utils';
 import store from '~/store';
 
 type ChatHelpers = Pick<
   EventHandlerParams,
-  | 'setMessages'
-  | 'getMessages'
-  | 'setConversation'
-  | 'setIsSubmitting'
-  | 'newConversation'
-  | 'resetLatestMessage'
+  'setMessages' | 'getMessages' | 'setConversation' | 'setIsSubmitting' | 'newConversation'
 >;
 
 export default function useSSE(
@@ -35,14 +37,8 @@ export default function useSSE(
   const setAbortScroll = useSetRecoilState(store.abortScrollFamily(runIndex));
   const setShowStopButton = useSetRecoilState(store.showStopButtonByIndex(runIndex));
 
-  const {
-    setMessages,
-    getMessages,
-    setConversation,
-    setIsSubmitting,
-    newConversation,
-    resetLatestMessage,
-  } = chatHelpers;
+  const { setMessages, getMessages, setConversation, setIsSubmitting, newConversation } =
+    chatHelpers;
 
   const {
     clearStepMaps,
@@ -53,6 +49,7 @@ export default function useSSE(
     messageHandler,
     contentHandler,
     createdHandler,
+    titleHandler,
     attachmentHandler,
     abortConversation,
   } = useEventHandlers({
@@ -64,13 +61,21 @@ export default function useSSE(
     setIsSubmitting,
     newConversation,
     setShowStopButton,
-    resetLatestMessage,
   });
 
   const { data: startupConfig } = useGetStartupConfig();
   const balanceQuery = useGetUserBalance({
     enabled: !!isAuthenticated && startupConfig?.balance?.enabled,
   });
+  const {
+    contextHandler,
+    usageHandler,
+    tapStream,
+    tapContent,
+    finalizeUsage,
+    resetLive,
+    attributePending,
+  } = useUsageHandler();
 
   useEffect(() => {
     if (submission == null || Object.keys(submission).length === 0) {
@@ -107,6 +112,7 @@ export default function useSSE(
         clearAllDrafts(submission.conversation?.conversationId);
         try {
           finalHandler(data, submission as EventSubmission);
+          finalizeUsage(data, { ...submission, userMessage });
         } catch (error) {
           console.error('Error in finalHandler:', error);
           setIsSubmitting(false);
@@ -125,7 +131,19 @@ export default function useSSE(
         };
 
         createdHandler(data, { ...submission, userMessage } as EventSubmission);
+      } else if (data.event === 'title') {
+        titleHandler(data);
+      } else if (data.event === UsageEvents.ON_CONTEXT_USAGE) {
+        contextHandler(data.data, { ...submission, userMessage });
+      } else if (data.event === UsageEvents.ON_TOKEN_USAGE) {
+        usageHandler(data.data, { ...submission, userMessage });
       } else if (data.event != null) {
+        if (
+          data.event === StepEvents.ON_MESSAGE_DELTA ||
+          data.event === StepEvents.ON_REASONING_DELTA
+        ) {
+          tapStream(data.data, { ...submission, userMessage });
+        }
         stepHandler(data, { ...submission, userMessage } as EventSubmission);
       } else if (data.sync != null) {
         const runId = v4();
@@ -138,6 +156,7 @@ export default function useSSE(
           textIndex = index;
         }
 
+        tapContent(text, { ...submission, userMessage });
         contentHandler({ data, submission: submission as EventSubmission });
       } else {
         const text = data.text ?? data.response;
@@ -149,6 +168,9 @@ export default function useSSE(
         };
 
         if (data.message != null) {
+          /** Legacy non-agent streams (handleText) send cumulative text here,
+           *  not via the content path — feed it to the live estimate too */
+          tapContent(text, { ...submission, userMessage });
           messageHandler(text, { ...submission, userMessage, initialResponse });
         }
       }
@@ -173,6 +195,13 @@ export default function useSSE(
       setCompleted((prev) => new Set(prev.add(streamKey)));
       const latestMessages = getMessages();
       const conversationId = latestMessages?.[latestMessages.length - 1]?.conversationId;
+      /** Attribute usage billed before the stop to the partial response (the
+       *  branch tail), then reset pending — so it neither drops nor leaks into
+       *  the next response. Falls back to a plain reset when no response exists. */
+      const tail = latestMessages?.[latestMessages.length - 1];
+      const partialResponseId =
+        tail != null && tail.isCreatedByUser === false ? tail.messageId : null;
+      attributePending(partialResponseId, { ...submission, userMessage });
       try {
         await abortConversation(
           conversationId ??
@@ -215,6 +244,7 @@ export default function useSSE(
 
       console.log('error in server stream.');
       (startupConfig?.balance?.enabled ?? false) && balanceQuery.refetch();
+      resetLive({ ...submission, userMessage });
 
       let data: TResData | undefined = undefined;
       try {
diff --git a/client/src/hooks/SSE/useStepHandler.ts b/client/src/hooks/SSE/useStepHandler.ts
index e4c62832692..e9ef6e3227a 100644
--- a/client/src/hooks/SSE/useStepHandler.ts
+++ b/client/src/hooks/SSE/useStepHandler.ts
@@ -20,14 +20,14 @@ import type {
 } from 'librechat-data-provider';
 import type { SetterOrUpdater } from 'recoil';
 import type { AnnounceOptions } from '~/common';
-import { MESSAGE_UPDATE_INTERVAL } from '~/common';
-import { subagentProgressByToolCallId } from '~/store';
 import {
   foldSubagentEvent,
   foldSubagentEventIntoTicker,
   initSubagentAggregatorState,
   initSubagentTickerState,
 } from '~/utils/subagentContent';
+import { subagentProgressByToolCallId } from '~/store';
+import { MESSAGE_UPDATE_INTERVAL } from '~/common';
 
 type TUseStepHandler = {
   announcePolite: (options: AnnounceOptions) => void;
@@ -36,6 +36,12 @@ type TUseStepHandler = {
   /** @deprecated - isSubmitting should be derived from submission state */
   setIsSubmitting?: SetterOrUpdater<boolean>;
   lastAnnouncementTimeRef: React.MutableRefObject<number>;
+  /**
+   * Fired when a completed `create_file`/`edit_file` call targeted a
+   * `skills/...` path. The caller owns the side effect (skill query cache
+   * invalidation) so this hook stays free of query-client coupling.
+   */
+  onSkillAuthoringComplete?: () => void;
 };
 
 type TStepEvent =
@@ -63,11 +69,52 @@ type AllContentTypes =
   | ContentTypes.SUMMARY
   | ContentTypes.ERROR;
 
+/** Mirrors `SKILL_FILE_PREFIX` in `@librechat/api` file-authoring handlers. */
+const SKILL_FILE_PREFIX = 'skills/';
+const FILE_AUTHORING_TOOLS = new Set(['create_file', 'edit_file']);
+
+/**
+ * True when a completed tool call authored a skill file (`create_file` /
+ * `edit_file` targeting a `skills/...` path). Skills created or edited
+ * mid-chat must invalidate the cached skill queries, or the Skills panel
+ * and builder keep showing the pre-authoring catalog.
+ */
+function isSkillAuthoringToolCall(toolCall?: Agents.ToolCall): boolean {
+  if (!toolCall?.name || !FILE_AUTHORING_TOOLS.has(toolCall.name)) {
+    return false;
+  }
+  const { args } = toolCall;
+  let filePath: unknown;
+  if (typeof args === 'object' && args !== null) {
+    filePath = (args as { file_path?: unknown }).file_path;
+  } else if (typeof args === 'string') {
+    try {
+      filePath = (JSON.parse(args) as { file_path?: unknown }).file_path;
+    } catch {
+      return false;
+    }
+  }
+  return typeof filePath === 'string' && filePath.startsWith(SKILL_FILE_PREFIX);
+}
+
+const isOAuthToolCallName = (name?: string) =>
+  typeof name === 'string' && name.startsWith(`oauth${Constants.mcp_delimiter}`);
+
+const isOAuthToolCallContent = (part?: Partial<TMessageContentParts>) => {
+  if (part?.type !== ContentTypes.TOOL_CALL || !('tool_call' in part)) {
+    return false;
+  }
+  const { tool_call: toolCall } = part;
+  const name = toolCall != null && 'name' in toolCall ? toolCall.name : undefined;
+  return isOAuthToolCallName(name);
+};
+
 export default function useStepHandler({
   setMessages,
   getMessages,
   announcePolite,
   lastAnnouncementTimeRef,
+  onSkillAuthoringComplete,
 }: TUseStepHandler) {
   const toolCallIdMap = useRef(new Map<string, string | undefined>());
   const messageMap = useRef(new Map<string, TMessage>());
@@ -100,6 +147,14 @@ export default function useStepHandler({
    */
   const knownSubagentAtomKeys = useRef(new Set<string>());
 
+  const getCurrentMessages = useCallback(
+    (messages: TMessage[]) => {
+      const freshMessages = getMessages();
+      return freshMessages && freshMessages.length >= messages.length ? freshMessages : messages;
+    },
+    [getMessages],
+  );
+
   /** Both content parts and ticker lines are aggregated incrementally
    *  into the atom as each `ON_SUBAGENT_UPDATE` arrives — we never
    *  retain the raw event array, so no rolling window is needed. A
@@ -270,9 +325,20 @@ export default function useStepHandler({
       return message;
     }
 
-    const updatedContent = [...(message.content || [])] as Array<
+    const incomingOAuthToolCall =
+      contentType === ContentTypes.TOOL_CALL &&
+      'tool_call' in contentPart &&
+      isOAuthToolCallName(contentPart.tool_call?.name);
+
+    let updatedContent = [...(message.content || [])] as Array<
       Partial<TMessageContentParts> | undefined
     >;
+
+    const oauthPromptOccupiesSlot = isOAuthToolCallContent(updatedContent[index]);
+    if (!incomingOAuthToolCall && oauthPromptOccupiesSlot) {
+      updatedContent = updatedContent.filter((part) => !isOAuthToolCallContent(part));
+    }
+
     if (!updatedContent[index] && contentType !== ContentTypes.TOOL_CALL) {
       updatedContent[index] = { type: contentPart.type as AllContentTypes };
     }
@@ -413,9 +479,105 @@ export default function useStepHandler({
 
   const stepHandler = useCallback(
     (stepEvent: TStepEvent, submission: EventSubmission) => {
-      const messages = getMessages() || [];
+      const submissionMessages = submission.messages ?? [];
+      const getEventMessages = (candidateMessages: TMessage[]) =>
+        submission.isRegenerate ? candidateMessages : getCurrentMessages(candidateMessages);
+      const messages = getEventMessages(submissionMessages);
       const { userMessage } = submission;
-      let parentMessageId = userMessage.messageId;
+      const getRegenerateResponseIds = (responseMessageId: string) => {
+        const ids = new Set<string>();
+        const addId = (id?: string | null) => {
+          if (!id) {
+            return;
+          }
+          ids.add(id);
+          ids.add(id.replace(/_+$/, ''));
+        };
+        addId(responseMessageId);
+        addId(submission.initialResponse?.messageId);
+        addId(submission.userMessage?.responseMessageId);
+        return ids;
+      };
+      const shouldRemoveRegenerateResponse = (message: TMessage, responseMessageId: string) =>
+        submission.isRegenerate &&
+        !message.isCreatedByUser &&
+        getRegenerateResponseIds(responseMessageId).has(message.messageId);
+      const shouldRemoveInitialResponse = (message: TMessage, responseMessageId: string) => {
+        const initialResponseId = submission.initialResponse?.messageId;
+        return (
+          !submission.isRegenerate &&
+          !message.isCreatedByUser &&
+          initialResponseId != null &&
+          initialResponseId !== responseMessageId &&
+          message.messageId === initialResponseId &&
+          message.parentMessageId === userMessage.messageId
+        );
+      };
+      const ensureUserMessagePresent = (
+        candidateMessages: TMessage[],
+        responseMessageId: string,
+      ) => {
+        if (
+          submission.isRegenerate ||
+          !userMessage?.messageId ||
+          candidateMessages.some((message) => message.messageId === userMessage.messageId)
+        ) {
+          return candidateMessages;
+        }
+
+        const responseIndex = candidateMessages.findIndex(
+          (message) => message.messageId === responseMessageId,
+        );
+        if (responseIndex < 0) {
+          return [...candidateMessages, userMessage as TMessage];
+        }
+
+        const nextMessages = [...candidateMessages];
+        nextMessages.splice(responseIndex, 0, userMessage as TMessage);
+        return nextMessages;
+      };
+      const getResponseBaseMessages = (
+        candidateMessages: TMessage[],
+        responseMessageId: string,
+        ensureUserMessage = false,
+      ) => {
+        const currentMessages = getEventMessages(candidateMessages);
+        if (!submission.isRegenerate) {
+          const nextMessages = currentMessages.filter(
+            (message) => !shouldRemoveInitialResponse(message, responseMessageId),
+          );
+          return ensureUserMessage
+            ? ensureUserMessagePresent(nextMessages, responseMessageId)
+            : nextMessages;
+        }
+        return currentMessages.filter(
+          (message) => !shouldRemoveRegenerateResponse(message, responseMessageId),
+        );
+      };
+      const mergeResponseMessage = (
+        candidateMessages: TMessage[],
+        updatedResponse: TMessage,
+        responseMessageId: string,
+        options?: { ensureUserMessage?: boolean },
+      ) => {
+        const currentMessages = getResponseBaseMessages(
+          candidateMessages,
+          responseMessageId,
+          options?.ensureUserMessage === true,
+        );
+        const hasResponseMessage = currentMessages.some(
+          (msg) => msg.messageId === responseMessageId,
+        );
+        return hasResponseMessage
+          ? currentMessages.map((msg) =>
+              msg.messageId === responseMessageId ? updatedResponse : msg,
+            )
+          : [...currentMessages, updatedResponse];
+      };
+      let parentMessageId =
+        submission.isRegenerate && submission.initialResponse?.parentMessageId
+          ? submission.initialResponse.parentMessageId
+          : userMessage.messageId;
 
       const currentTime = Date.now();
       if (currentTime - lastAnnouncementTimeRef.current > MESSAGE_UPDATE_INTERVAL) {
@@ -449,10 +611,13 @@ export default function useStepHandler({
         let response = messageMap.current.get(responseMessageId);
 
         if (!response) {
-          // Find the actual response message - check if last message is a response, otherwise use initialResponse
+          // Find the actual response message. Regenerate submissions can target
+          // an earlier branch while the visible history still ends at a later
+          // assistant message, so never seed a regenerated response from the
+          // conversation tail.
           const lastMessage = messages[messages.length - 1] as TMessage;
           const responseMessage =
-            lastMessage && !lastMessage.isCreatedByUser
+            !submission.isRegenerate && lastMessage && !lastMessage.isCreatedByUser
               ? lastMessage
               : (submission?.initialResponse as TMessage);
 
@@ -474,14 +639,23 @@ export default function useStepHandler({
 
           // Get fresh messages to handle multi-tab scenarios where messages may have loaded
           // after this handler started (Tab 2 may have more complete history now)
-          const freshMessages = getMessages() || [];
-          const currentMessages = freshMessages.length > messages.length ? freshMessages : messages;
+          const currentMessages = getResponseBaseMessages(messages, responseMessageId, true);
 
           // Remove any existing response placeholder
-          let updatedMessages = currentMessages.filter((m) => m.messageId !== responseMessageId);
+          let updatedMessages = currentMessages.filter(
+            (message) =>
+              message.messageId !== responseMessageId &&
+              !shouldRemoveRegenerateResponse(message, responseMessageId) &&
+              !shouldRemoveInitialResponse(message, responseMessageId),
+          );
 
-          // Ensure userMessage is present (multi-tab: Tab 2 may not have it yet)
-          if (!updatedMessages.some((m) => m.messageId === userMessage.messageId)) {
+          // Ensure userMessage is present (multi-tab: Tab 2 may not have it yet).
+          // Regenerate reuses an existing user turn; its submission userMessage is only
+          // a transport placeholder and must not become a new visible branch.
+          if (
+            !submission.isRegenerate &&
+            !updatedMessages.some((m) => m.messageId === userMessage.messageId)
+          ) {
             updatedMessages = [...updatedMessages, userMessage as TMessage];
           }
 
@@ -517,11 +691,11 @@ export default function useStepHandler({
           });
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
 
         if (runStep.summary != null) {
@@ -543,8 +717,11 @@ export default function useStepHandler({
           );
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
 
         const bufferedDeltas = pendingDeltaBuffer.current.get(runStep.id);
@@ -582,8 +759,11 @@ export default function useStepHandler({
             agentUpdateMeta,
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_MESSAGE_DELTA) {
         const messageDelta = stepEvent.data;
@@ -625,8 +805,11 @@ export default function useStepHandler({
             getStepMetadata(runStep),
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_REASONING_DELTA) {
         const reasoningDelta = stepEvent.data;
@@ -668,8 +851,11 @@ export default function useStepHandler({
             getStepMetadata(runStep),
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_RUN_STEP_DELTA) {
         const runStepDelta = stepEvent.data;
@@ -724,11 +910,11 @@ export default function useStepHandler({
           });
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
       } else if (stepEvent.event === StepEvents.ON_RUN_STEP_COMPLETED) {
         const { result } = stepEvent.data;
@@ -747,6 +933,10 @@ export default function useStepHandler({
           return;
         }
 
+        if (isSkillAuthoringToolCall(result.tool_call)) {
+          onSkillAuthoringComplete?.();
+        }
+
         const response = messageMap.current.get(responseMessageId);
         if (response) {
           let updatedResponse = { ...response };
@@ -767,11 +957,11 @@ export default function useStepHandler({
           );
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
       } else if (stepEvent.event === StepEvents.ON_SUBAGENT_UPDATE) {
         applySubagentUpdate(stepEvent.data);
@@ -814,8 +1004,8 @@ export default function useStepHandler({
               summarizeDeltaRaf.current = null;
               const latest = messageMap.current.get(responseMessageId);
               if (latest) {
-                const msgs = getMessages() || [];
-                setMessages([...msgs.slice(0, -1), latest]);
+                const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
+                setMessages(mergeResponseMessage(currentMessages, latest, responseMessageId));
               }
             });
           }
@@ -833,9 +1023,6 @@ export default function useStepHandler({
           return;
         }
 
-        const currentMessages = getMessages() || [];
-        const targetIndex = currentMessages.findIndex((m) => m.messageId === completeMessageId);
-
         if (completeData.error) {
           const filtered = targetMessage.content.filter(
             (part) =>
@@ -844,12 +1031,9 @@ export default function useStepHandler({
           if (filtered.length !== targetMessage.content.length) {
             announcePolite({ message: 'summarize_failed', isStatus: true });
             const cleaned = { ...targetMessage, content: filtered };
+            const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
             messageMap.current.set(completeMessageId, cleaned);
-            if (targetIndex >= 0) {
-              const updated = [...currentMessages];
-              updated[targetIndex] = cleaned;
-              setMessages(updated);
-            }
+            setMessages(mergeResponseMessage(currentMessages, cleaned, completeMessageId));
           }
         } else {
           let didFinalize = false;
@@ -863,13 +1047,12 @@ export default function useStepHandler({
             }
             return part;
           });
-          if (didFinalize && targetIndex >= 0) {
+          if (didFinalize) {
             announcePolite({ message: 'summarize_completed', isStatus: true });
             const finalized = { ...targetMessage, content: updatedContent };
+            const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
             messageMap.current.set(completeMessageId, finalized);
-            const updated = [...currentMessages];
-            updated[targetIndex] = finalized;
-            setMessages(updated);
+            setMessages(mergeResponseMessage(currentMessages, finalized, completeMessageId));
           }
         }
       } else {
@@ -883,7 +1066,9 @@ export default function useStepHandler({
       announcePolite,
       setMessages,
       calculateContentIndex,
+      getCurrentMessages,
       applySubagentUpdate,
+      onSkillAuthoringComplete,
     ],
   );
 
diff --git a/client/src/hooks/SSE/useUsageHandler.ts b/client/src/hooks/SSE/useUsageHandler.ts
new file mode 100644
index 00000000000..46252826445
--- /dev/null
+++ b/client/src/hooks/SSE/useUsageHandler.ts
@@ -0,0 +1,400 @@
+import { useRef, useMemo } from 'react';
+import { getDefaultStore } from 'jotai';
+import { Constants, reconcileContextUsage, promptTokensFromUsage } from 'librechat-data-provider';
+import type {
+  TMessage,
+  TConversation,
+  TTokenUsageEvent,
+  TContextUsageEvent,
+} from 'librechat-data-provider';
+import type { ContextSnapshot } from '~/store/usage';
+import {
+  markUsageFolded,
+  liveTokensFamily,
+  totalUsageFamily,
+  removeUsageAtoms,
+  clearUsageFolded,
+  calibrationFamily,
+  pendingUsageFamily,
+  branchTotalsFamily,
+  migrateUsageFolded,
+  EMPTY_USAGE_TOTALS,
+  contextSnapshotFamily,
+  snapshotsByAnchorFamily,
+} from '~/store/usage';
+import {
+  sumBranch,
+  setEntryUsage,
+  upsertEntries,
+  migrateIndex,
+  sumTotalUsage,
+  estimateTokens,
+  normalizeUsageUnits,
+} from '~/utils';
+
+const FLUSH_INTERVAL_MS = 250;
+
+interface UsageSubmissionLike {
+  userMessage?: Pick<TMessage, 'messageId' | 'conversationId'> | null;
+  conversation?: Partial<Pick<TConversation, 'conversationId' | 'endpoint' | 'model'>> | null;
+}
+
+interface FinalDataLike {
+  requestMessage?: Partial<TMessage> | null;
+  responseMessage?: Partial<TMessage> | null;
+  conversation?: Partial<TConversation> | null;
+}
+
+export interface UsageHandlers {
+  contextHandler: (data: TContextUsageEvent, submission: UsageSubmissionLike) => void;
+  usageHandler: (data: TTokenUsageEvent, submission: UsageSubmissionLike) => void;
+  tapStream: (data: { delta?: { content?: unknown } }, submission: UsageSubmissionLike) => void;
+  /** Live estimate for the legacy content path, which streams cumulative
+   *  (not incremental) text per part — sets rather than accumulates */
+  tapContent: (text: unknown, submission: UsageSubmissionLike) => void;
+  finalizeUsage: (data: FinalDataLike, submission: UsageSubmissionLike) => void;
+  resetLive: (submission: UsageSubmissionLike) => void;
+  /** Terminal stop: attribute the in-flight pending usage to the stopped partial
+   *  response (so its billed tokens aren't dropped), then reset pending so it
+   *  can't leak into the next response. Discards when no response id is known. */
+  attributePending: (responseId: string | null, submission: UsageSubmissionLike) => void;
+  /** Idempotently folds the resumed run's collected usage into the totals */
+  backfillUsage: (entries: TTokenUsageEvent[], submission: UsageSubmissionLike) => void;
+  /** Seeds the live estimate from already-streamed output chars on resume */
+  seedLive: (chars: number, submission: UsageSubmissionLike) => void;
+}
+
+function getConvoKey(submission: UsageSubmissionLike): string {
+  /** On a new chat's first turn the `created` event stamps the real id onto
+   *  the user message while the submission's conversation is still `new`;
+   *  prefer the real id so live writes land where TokenUsage is subscribed */
+  const fromUserMessage = submission.userMessage?.conversationId;
+  if (fromUserMessage != null && fromUserMessage !== Constants.NEW_CONVO) {
+    return fromUserMessage;
+  }
+  return submission.conversation?.conversationId ?? Constants.NEW_CONVO;
+}
+
+/** Cumulative text of a content-path part: a raw string or a `{ value }` part */
+function extractContentText(text: unknown): string {
+  if (typeof text === 'string') {
+    return text;
+  }
+  const value = (text as { value?: unknown })?.value;
+  return typeof value === 'string' ? value : '';
+}
+
+function countDeltaChars(content: unknown): number {
+  const parts = Array.isArray(content) ? content : [content];
+  let chars = 0;
+  for (const part of parts) {
+    if (part == null || typeof part !== 'object') {
+      continue;
+    }
+    const { text, think } = part as { text?: unknown; think?: unknown };
+    if (typeof text === 'string') {
+      chars += text.length;
+    } else if (typeof think === 'string') {
+      chars += think.length;
+    }
+  }
+  return chars;
+}
+
+/**
+ * Imperative writers for the per-conversation token usage atoms, driven by
+ * SSE events. All state lives in refs/atoms — the returned handlers are
+ * stable and never cause re-renders themselves.
+ */
+export default function useUsageHandler(): UsageHandlers {
+  /** Streamed chars since the last snapshot or model end (current call only) */
+  const streamCharsRef = useRef(0);
+  /** Provider-confirmed output tokens since the last snapshot (current run) */
+  const confirmedRef = useRef(0);
+  const lastFlushRef = useRef(0);
+
+  return useMemo<UsageHandlers>(() => {
+    const jotai = getDefaultStore();
+
+    const setLive = (convoKey: string, value: number) => {
+      jotai.set(liveTokensFamily(convoKey), value);
+    };
+
+    /** Flush the in-flight pending usage into a response's index entry, then
+     *  reset pending. Only flushes when events were actually folded this session
+     *  (eventCount > 0), so a finalize that carries persisted `metadata.usage`
+     *  but folded nothing — a late/second resumable subscriber — keeps the entry
+     *  loaded by `upsertEntries` instead of overwriting it with an empty record. */
+    const flushPendingInto = (convoKey: string, responseId: string | null) => {
+      const pendingAtom = pendingUsageFamily(convoKey);
+      const pending = jotai.get(pendingAtom);
+      if (responseId != null && pending.eventCount > 0) {
+        setEntryUsage(convoKey, responseId, {
+          input: pending.input,
+          output: pending.output,
+          cacheWrite: pending.cacheWrite,
+          cacheRead: pending.cacheRead,
+          cost: pending.costUSD,
+          costKnown: pending.costKnown,
+        });
+      }
+      jotai.set(pendingAtom, EMPTY_USAGE_TOTALS);
+    };
+
+    const contextHandler: UsageHandlers['contextHandler'] = (data, submission) => {
+      const convoKey = getConvoKey(submission);
+      jotai.set(contextSnapshotFamily(convoKey), {
+        ...data,
+        anchorMessageId: submission.userMessage?.messageId ?? null,
+      });
+      if (data.calibrationRatio != null && data.calibrationRatio > 0) {
+        jotai.set(calibrationFamily(convoKey), data.calibrationRatio);
+      }
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(convoKey, 0);
+    };
+
+    /** Folds one usage event into the in-flight pending holder exactly once per
+     *  conversation. Returns false when the event was already counted (live then
+     *  replayed on resume), so callers can skip the live-estimate bump too.
+     *  `finalizeUsage` flushes the accumulated pending into the per-message index
+     *  and resets it, so branch/total stay index-derived (no double count). */
+    const foldUsage = (data: TTokenUsageEvent, submission: UsageSubmissionLike): boolean => {
+      const convoKey = getConvoKey(submission);
+      /** runId+seq is unique per model call; fall back to the payload when a
+       *  source predates the sequence tag */
+      const usageKey =
+        data.runId != null && data.seq != null ? `${data.runId}:${data.seq}` : JSON.stringify(data);
+      if (!markUsageFolded(convoKey, usageKey)) {
+        return false;
+      }
+
+      /** Displayed counts use the same normalized units billing does: input is
+       *  the uncached portion, output includes repaired completion tokens */
+      const units = normalizeUsageUnits(data);
+
+      const pendingAtom = pendingUsageFamily(convoKey);
+      const prev = jotai.get(pendingAtom);
+      jotai.set(pendingAtom, {
+        input: prev.input + units.input,
+        output: prev.output + units.output,
+        cacheWrite: prev.cacheWrite + units.cacheWrite,
+        cacheRead: prev.cacheRead + units.cacheRead,
+        eventCount: prev.eventCount + 1,
+        /** Authoritative per-event cost from the backend (premium tiers, cache
+         *  rates); absent when contextCost is disabled — sums to 0 then */
+        costUSD: prev.costUSD + (data.cost ?? 0),
+        /** Coverage is complete only if EVERY folded event carried a cost */
+        costKnown: prev.costKnown && data.cost != null,
+      });
+      return true;
+    };
+
+    /** Reconcile the live snapshot's calibrated estimate to a primary call's
+     *  ACTUAL prompt tokens. The snapshot is pre-invoke for that call; this usage
+     *  is its post-invoke truth, so the gauge stops showing the SDK multiplier's
+     *  inflation (severe when a provider injects server-side content like web
+     *  search). Resume is handled server-side (the job-store snapshot is reconciled
+     *  when the call's usage is persisted), so no backfill reconcile is needed. */
+    const reconcileLiveSnapshot = (data: TTokenUsageEvent, submission: UsageSubmissionLike) => {
+      const convoKey = getConvoKey(submission);
+      const snapshotAtom = contextSnapshotFamily(convoKey);
+      const snapshot = jotai.get(snapshotAtom);
+      if (snapshot == null) {
+        return;
+      }
+      /** The snapshot precedes this call, so it must belong to the same run */
+      if (snapshot.runId != null && data.runId != null && snapshot.runId !== data.runId) {
+        return;
+      }
+      const reconciled = reconcileContextUsage(snapshot, promptTokensFromUsage(data));
+      jotai.set(snapshotAtom, { ...reconciled, anchorMessageId: snapshot.anchorMessageId });
+    };
+
+    const usageHandler: UsageHandlers['usageHandler'] = (data, submission) => {
+      const folded = foldUsage(data, submission);
+
+      /** Only a NEWLY folded primary call drives the live gauge. A replayed
+       *  duplicate (folded=false on resume) can be an EARLIER tool-loop call that
+       *  shares this run's id — reconciling with it would overwrite the latest
+       *  snapshot with an earlier, smaller prompt. Tagged buckets (summarization,
+       *  subagent) never touch the context gauge. */
+      if (!folded || data.usage_type != null) {
+        return;
+      }
+      /** This primary's provider-reported prompt is the post-invoke truth for the
+       *  call the latest snapshot precedes — reconcile the gauge to it. */
+      reconcileLiveSnapshot(data, submission);
+      /** Use the repaired completion count (not raw output_tokens) so the
+       *  snapshot gauge keeps the full response for under-reporting providers */
+      confirmedRef.current += normalizeUsageUnits(data).output;
+      streamCharsRef.current = 0;
+      setLive(getConvoKey(submission), confirmedRef.current);
+    };
+
+    const tapStream: UsageHandlers['tapStream'] = (data, submission) => {
+      const chars = countDeltaChars(data?.delta?.content);
+      if (chars <= 0) {
+        return;
+      }
+      streamCharsRef.current += chars;
+      const now = Date.now();
+      if (now - lastFlushRef.current < FLUSH_INTERVAL_MS) {
+        return;
+      }
+      lastFlushRef.current = now;
+      const convoKey = getConvoKey(submission);
+      const ratio = jotai.get(calibrationFamily(convoKey));
+      setLive(convoKey, confirmedRef.current + estimateTokens(streamCharsRef.current, ratio));
+    };
+
+    const tapContent: UsageHandlers['tapContent'] = (text, submission) => {
+      const value = extractContentText(text);
+      if (value.length === 0) {
+        return;
+      }
+      /** Cumulative per part — replace the running char count, don't add */
+      streamCharsRef.current = value.length;
+      const now = Date.now();
+      if (now - lastFlushRef.current < FLUSH_INTERVAL_MS) {
+        return;
+      }
+      lastFlushRef.current = now;
+      const convoKey = getConvoKey(submission);
+      const ratio = jotai.get(calibrationFamily(convoKey));
+      setLive(convoKey, confirmedRef.current + estimateTokens(streamCharsRef.current, ratio));
+    };
+
+    const resetLive: UsageHandlers['resetLive'] = (submission) => {
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      const convoKey = getConvoKey(submission);
+      setLive(convoKey, 0);
+      /** Terminal path with no salvageable response (stream error / intentional
+       *  close): discard the in-flight pending usage so it can't merge into the
+       *  next response. The user-stop path uses `attributePending` to keep it on
+       *  the partial reply. Also forget the folded-event identities so a resume's
+       *  `backfillUsage` can rebuild pending — otherwise it sees them as already
+       *  folded and the response's usage stays missing until a full reload. */
+      jotai.set(pendingUsageFamily(convoKey), EMPTY_USAGE_TOTALS);
+      clearUsageFolded(convoKey);
+    };
+
+    const attributePending: UsageHandlers['attributePending'] = (responseId, submission) => {
+      const convoKey = getConvoKey(submission);
+      /** Flush the billed-but-uncommitted usage onto the stopped partial reply
+       *  (when its id is known and events were folded), then reset pending and
+       *  the live estimate. Index-derived branch/total then reflect it. */
+      flushPendingInto(convoKey, responseId);
+      if (responseId != null) {
+        jotai.set(branchTotalsFamily(convoKey), sumBranch(convoKey, responseId, responseId));
+        jotai.set(totalUsageFamily(convoKey), sumTotalUsage(convoKey));
+      }
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(convoKey, 0);
+    };
+
+    const backfillUsage: UsageHandlers['backfillUsage'] = (entries, submission) => {
+      /** Fold the resumed run's persisted events idempotently — never reset
+       *  the conversation totals, or a reconnect mid-stream would drop the
+       *  usage of prompts already completed earlier in the session */
+      for (const entry of entries) {
+        foldUsage(entry, submission);
+      }
+    };
+
+    const seedLive: UsageHandlers['seedLive'] = (chars, submission) => {
+      if (chars <= 0) {
+        return;
+      }
+      const convoKey = getConvoKey(submission);
+      streamCharsRef.current = chars;
+      confirmedRef.current = 0;
+      setLive(convoKey, estimateTokens(chars, jotai.get(calibrationFamily(convoKey))));
+    };
+
+    const finalizeUsage: UsageHandlers['finalizeUsage'] = (data, submission) => {
+      const fromKey = getConvoKey(submission);
+      const realId = data.conversation?.conversationId ?? fromKey;
+      /** From the refs, not the atom — the throttle may not have flushed */
+      const liveAtFinalize =
+        confirmedRef.current +
+        estimateTokens(streamCharsRef.current, jotai.get(calibrationFamily(fromKey)));
+
+      upsertEntries(fromKey, [data.requestMessage, data.responseMessage]);
+
+      if (realId !== fromKey) {
+        migrateIndex(fromKey, realId);
+        migrateUsageFolded(fromKey, realId);
+        jotai.set(contextSnapshotFamily(realId), jotai.get(contextSnapshotFamily(fromKey)));
+        jotai.set(snapshotsByAnchorFamily(realId), jotai.get(snapshotsByAnchorFamily(fromKey)));
+        jotai.set(pendingUsageFamily(realId), jotai.get(pendingUsageFamily(fromKey)));
+        jotai.set(calibrationFamily(realId), jotai.get(calibrationFamily(fromKey)));
+        removeUsageAtoms(fromKey);
+      }
+
+      const responseMeta = data.responseMessage?.contextMeta;
+      if (responseMeta?.calibrationRatio != null && responseMeta.calibrationRatio > 0) {
+        jotai.set(calibrationFamily(realId), responseMeta.calibrationRatio);
+      }
+
+      const userMsgId = submission.userMessage?.messageId ?? null;
+      const responseId = data.responseMessage?.messageId ?? null;
+
+      /** Flush the in-flight response's pending usage into its index entry, then
+       *  reset pending. Branch/total are summed from the index, so this single
+       *  add is counted exactly once; the persisted `metadata.usage` reproduces
+       *  it on reload. */
+      flushPendingInto(realId, responseId);
+
+      const tailId = responseId ?? data.requestMessage?.messageId ?? null;
+      if (tailId) {
+        jotai.set(branchTotalsFamily(realId), sumBranch(realId, tailId, responseId ?? userMsgId));
+      }
+      jotai.set(totalUsageFamily(realId), sumTotalUsage(realId));
+
+      const snapshotAtom = contextSnapshotFamily(realId);
+      const snapshot = jotai.get(snapshotAtom);
+      /** Re-anchor the snapshot from the user message — shared by both branches
+       *  when a response is regenerated — to the branch-unique response message,
+       *  so switching to a sibling branch falls back to that branch's own
+       *  totals instead of showing this generation's snapshot. Also carry the
+       *  output streamed since the pre-invoke snapshot, kept after live resets. */
+      if (snapshot != null && snapshot.anchorMessageId === userMsgId) {
+        const finalized: ContextSnapshot = {
+          ...snapshot,
+          anchorMessageId: responseId ?? snapshot.anchorMessageId,
+          ...(liveAtFinalize > 0 && { completedOutputTokens: liveAtFinalize }),
+        };
+        jotai.set(snapshotAtom, finalized);
+        /** Retain this generation's breakdown keyed by the branch-unique
+         *  response id so a later run on a sibling branch (which overwrites the
+         *  live snapshot) doesn't strip this branch's granular rows. */
+        if (responseId != null) {
+          const historyAtom = snapshotsByAnchorFamily(realId);
+          const next = new Map(jotai.get(historyAtom));
+          next.set(responseId, finalized);
+          jotai.set(historyAtom, next);
+        }
+      }
+
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(realId, 0);
+    };
+
+    return {
+      contextHandler,
+      usageHandler,
+      tapStream,
+      tapContent,
+      finalizeUsage,
+      resetLive,
+      attributePending,
+      backfillUsage,
+      seedLive,
+    };
+  }, []);
+}
diff --git a/client/src/hooks/Sharing/useCanSharePublic.ts b/client/src/hooks/Sharing/useCanSharePublic.ts
index e93a3dcc82c..521dd1ef4e7 100644
--- a/client/src/hooks/Sharing/useCanSharePublic.ts
+++ b/client/src/hooks/Sharing/useCanSharePublic.ts
@@ -7,6 +7,7 @@ const resourceToPermissionMap: Partial<Record<ResourceType, PermissionTypes>> =
   [ResourceType.MCPSERVER]: PermissionTypes.MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: PermissionTypes.REMOTE_AGENTS,
   [ResourceType.SKILL]: PermissionTypes.SKILLS,
+  [ResourceType.SHARED_LINK]: PermissionTypes.SHARED_LINKS,
 };
 
 /**
@@ -17,7 +18,7 @@ const resourceToPermissionMap: Partial<Record<ResourceType, PermissionTypes>> =
 export const useCanSharePublic = (resourceType: ResourceType): boolean => {
   const permissionType = resourceToPermissionMap[resourceType];
   const hasAccess = useHasAccess({
-    permissionType,
+    permissionType: permissionType as PermissionTypes,
     permission: Permissions.SHARE_PUBLIC,
   });
   return hasAccess;
diff --git a/client/src/hooks/Sharing/useResourcePermissionState.ts b/client/src/hooks/Sharing/useResourcePermissionState.ts
index 0a9f8ce386f..875fe17832a 100644
--- a/client/src/hooks/Sharing/useResourcePermissionState.ts
+++ b/client/src/hooks/Sharing/useResourcePermissionState.ts
@@ -26,7 +26,9 @@ export const useResourcePermissionState = (
   const {
     data: permissionsData,
     isLoading: isLoadingPermissions,
+    isFetching: isFetchingPermissions,
     error: permissionsError,
+    refetch: refetchPermissions,
   } = useGetResourcePermissionsQuery(resourceType, resourceDbId || '', {
     enabled: isValidResourceId,
   });
@@ -68,7 +70,9 @@ export const useResourcePermissionState = (
     config,
     permissionsData,
     isLoadingPermissions,
+    isFetchingPermissions,
     permissionsError,
+    refetchPermissions,
     updatePermissionsMutation,
     currentShares,
     currentIsPublic,
diff --git a/client/src/hooks/useKeyboardShortcuts.spec.tsx b/client/src/hooks/useKeyboardShortcuts.spec.tsx
new file mode 100644
index 00000000000..9826962b180
--- /dev/null
+++ b/client/src/hooks/useKeyboardShortcuts.spec.tsx
@@ -0,0 +1,341 @@
+import copy from 'copy-to-clipboard';
+import { MemoryRouter } from 'react-router-dom';
+import { RecoilRoot, useRecoilValue } from 'recoil';
+import { render, act, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { TConversation } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
+import type { ReactNode } from 'react';
+import useKeyboardShortcuts, {
+  isOverridden,
+  effectiveBinding,
+  getShortcutDisplay,
+  getShortcutAriaKey,
+} from './useKeyboardShortcuts';
+import store from '~/store';
+
+jest.mock('copy-to-clipboard', () => ({
+  __esModule: true,
+  default: jest.fn(() => true),
+}));
+
+jest.mock('./useNewConvo', () => ({
+  __esModule: true,
+  default: () => ({ newConversation: jest.fn() }),
+}));
+
+const STORAGE_KEY = 'customKeyboardShortcuts';
+const copyMock = copy as jest.MockedFunction<typeof copy>;
+
+function buildConversation(conversationId: string, title: string): TConversation {
+  return { conversationId, title, endpoint: 'agents' } as TConversation;
+}
+
+function dispatchKey(init: KeyboardEventInit, target: EventTarget = document): KeyboardEvent {
+  const event = new KeyboardEvent('keydown', { bubbles: true, cancelable: true, ...init });
+  act(() => {
+    target.dispatchEvent(event);
+  });
+  return event;
+}
+
+function Harness() {
+  useKeyboardShortcuts();
+  const deleteTarget = useRecoilValue(store.keyboardDeleteTarget);
+  const sidebarExpanded = useRecoilValue(store.sidebarExpanded);
+  return (
+    <>
+      <span data-testid="delete-target">{deleteTarget?.conversationId ?? 'none'}</span>
+      <span data-testid="sidebar">{String(sidebarExpanded)}</span>
+    </>
+  );
+}
+
+function renderHarness(conversation?: TConversation, route = '/c/test-convo') {
+  const initializeState = (snapshot: MutableSnapshot) => {
+    if (conversation) {
+      snapshot.set(store.conversationByIndex(0), conversation);
+    }
+  };
+  return render(<Harness />, {
+    wrapper: ({ children }: { children: ReactNode }) => (
+      <QueryClientProvider client={new QueryClient()}>
+        <RecoilRoot initializeState={initializeState}>
+          <MemoryRouter initialEntries={[route]}>{children}</MemoryRouter>
+        </RecoilRoot>
+      </QueryClientProvider>
+    ),
+  });
+}
+
+beforeEach(() => {
+  window.localStorage.clear();
+  copyMock.mockClear();
+});
+
+afterEach(() => {
+  cleanup();
+  document.body.replaceChildren();
+});
+
+function appendCodeBlock(code: string) {
+  const turn = document.createElement('div');
+  turn.className = 'agent-turn';
+  const pre = document.createElement('pre');
+  const codeEl = document.createElement('code');
+  codeEl.textContent = code;
+  pre.appendChild(codeEl);
+  turn.appendChild(pre);
+  document.body.appendChild(turn);
+}
+
+function appendResponseCopyButton(onClick: () => void) {
+  const button = document.createElement('button');
+  button.dataset.testid = 'copy-response-button';
+  button.addEventListener('click', onClick);
+  document.body.appendChild(button);
+}
+
+describe('binding resolution helpers', () => {
+  it('falls back to the default binding when there is no override', () => {
+    const binding = effectiveBinding('newChat');
+    expect(binding).toMatchObject({ ctrl: true, shift: true, key: 'O' });
+    expect(getShortcutDisplay('newChat')).toBe('Ctrl+Shift+O');
+    expect(getShortcutAriaKey('newChat')).toBe('Control+Shift+O');
+  });
+
+  it('honors a stored custom binding for the current platform', () => {
+    window.localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify({ newChat: { mac: 'Meta+Shift+P', other: 'Control+Shift+P' } }),
+    );
+    expect(effectiveBinding('newChat')).toMatchObject({ ctrl: true, shift: true, key: 'P' });
+    expect(getShortcutAriaKey('newChat')).toBe('Control+Shift+P');
+  });
+
+  it('treats a null platform override as an unbound shortcut', () => {
+    window.localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify({ newChat: { mac: null, other: null } }),
+    );
+    expect(effectiveBinding('newChat')).toBeNull();
+    expect(getShortcutDisplay('newChat')).toBe('');
+  });
+
+  it('detects whether an override diverges from the default', () => {
+    expect(isOverridden('newChat', undefined)).toBe(false);
+    expect(isOverridden('newChat', { mac: 'Meta+Shift+O', other: 'Control+Shift+O' })).toBe(false);
+    expect(isOverridden('newChat', { mac: null, other: null })).toBe(true);
+    expect(isOverridden('newChat', { mac: 'Meta+Shift+P', other: 'Control+Shift+P' })).toBe(true);
+  });
+});
+
+describe('global shortcut dispatch', () => {
+  it('runs the matched action and prevents the native event', () => {
+    const { getByTestId } = renderHarness();
+    const before = getByTestId('sidebar').textContent;
+
+    const event = dispatchKey({ key: 's', ctrlKey: true, shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(true);
+    expect(getByTestId('sidebar').textContent).not.toBe(before);
+  });
+
+  it('ignores shortcuts while a modal dialog is open', () => {
+    renderHarness();
+    const dialog = document.createElement('div');
+    dialog.setAttribute('role', 'dialog');
+    document.body.appendChild(dialog);
+
+    const event = dispatchKey({ key: 's', ctrlKey: true, shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('ignores non-allowed shortcuts while typing in an input', () => {
+    renderHarness();
+    const input = document.createElement('input');
+    document.body.appendChild(input);
+
+    const event = dispatchKey({ key: 's', ctrlKey: true, shiftKey: true }, input);
+
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('ignores shortcuts while focus is inside an open menu overlay', () => {
+    const { getByTestId } = renderHarness();
+    const before = getByTestId('sidebar').textContent;
+    const menu = document.createElement('div');
+    menu.setAttribute('role', 'menu');
+    const item = document.createElement('button');
+    item.setAttribute('role', 'menuitem');
+    menu.appendChild(item);
+    document.body.appendChild(menu);
+
+    const event = dispatchKey({ key: 's', ctrlKey: true, shiftKey: true }, item);
+
+    expect(event.defaultPrevented).toBe(false);
+    expect(getByTestId('sidebar').textContent).toBe(before);
+  });
+
+  it('does not prevent the native event when the action is a no-op', () => {
+    renderHarness();
+
+    // focusChat (Shift+Escape) with no chat textarea present is a no-op.
+    const event = dispatchKey({ key: 'Escape', shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('focuses the chat input and prevents the event when the textarea exists', () => {
+    renderHarness();
+    const textarea = document.createElement('textarea');
+    textarea.id = 'prompt-textarea';
+    document.body.appendChild(textarea);
+
+    const event = dispatchKey({ key: 'Escape', shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(true);
+    expect(document.activeElement).toBe(textarea);
+  });
+});
+
+describe('clipboard shortcuts', () => {
+  it('copies the last response through the existing message copy button', () => {
+    const firstCopy = jest.fn();
+    const secondCopy = jest.fn();
+    renderHarness();
+    appendResponseCopyButton(firstCopy);
+    appendResponseCopyButton(secondCopy);
+
+    const event = dispatchKey({ key: ';', ctrlKey: true, shiftKey: true });
+
+    expect(firstCopy).not.toHaveBeenCalled();
+    expect(secondCopy).toHaveBeenCalledTimes(1);
+    expect(copyMock).not.toHaveBeenCalled();
+    expect(event.defaultPrevented).toBe(true);
+  });
+
+  it('copies the last code block through the clipboard fallback helper', () => {
+    renderHarness();
+    appendCodeBlock('const x = 1;');
+
+    const event = dispatchKey({ key: 'k', ctrlKey: true, shiftKey: true });
+
+    expect(copyMock).toHaveBeenCalledWith('const x = 1;', { format: 'text/plain' });
+    expect(event.defaultPrevented).toBe(true);
+  });
+
+  it('does not copy or prevent the event when there is no code to copy', () => {
+    renderHarness();
+
+    const event = dispatchKey({ key: 'k', ctrlKey: true, shiftKey: true });
+
+    expect(copyMock).not.toHaveBeenCalled();
+    expect(event.defaultPrevented).toBe(false);
+  });
+});
+
+describe('no-op shortcuts', () => {
+  it('does not prevent submit shortcut when the send button is unavailable', () => {
+    renderHarness();
+
+    const event = dispatchKey({ key: 'Enter', ctrlKey: true });
+
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('does not prevent submit shortcut when the send button is disabled', () => {
+    renderHarness();
+    const button = document.createElement('button');
+    button.dataset.testid = 'send-button';
+    button.disabled = true;
+    document.body.appendChild(button);
+
+    const event = dispatchKey({ key: 'Enter', ctrlKey: true });
+
+    expect(event.defaultPrevented).toBe(false);
+  });
+});
+
+function appendSendButton(): jest.Mock {
+  const onClick = jest.fn();
+  const button = document.createElement('button');
+  button.dataset.testid = 'send-button';
+  button.addEventListener('click', onClick);
+  document.body.appendChild(button);
+  return onClick;
+}
+
+function appendMainTextarea(): HTMLTextAreaElement {
+  const textarea = document.createElement('textarea');
+  textarea.id = 'prompt-textarea';
+  document.body.appendChild(textarea);
+  return textarea;
+}
+
+function bindSubmitMessage(binding: string) {
+  window.localStorage.setItem(
+    STORAGE_KEY,
+    JSON.stringify({ submitMessage: { mac: binding, other: binding } }),
+  );
+}
+
+describe('composer submit shortcuts', () => {
+  it('defers a custom Alt+Enter submit binding in the composer to the textarea', () => {
+    window.localStorage.setItem('enterToSend', 'false');
+    bindSubmitMessage('Alt+Enter');
+    renderHarness();
+    const sendClick = appendSendButton();
+    const textarea = appendMainTextarea();
+
+    const event = dispatchKey({ key: 'Enter', altKey: true }, textarea);
+
+    expect(sendClick).not.toHaveBeenCalled();
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('defers Ctrl/Cmd+Enter in the composer to the native textarea submit', () => {
+    renderHarness();
+    const sendClick = appendSendButton();
+    const textarea = appendMainTextarea();
+
+    const event = dispatchKey({ key: 'Enter', ctrlKey: true }, textarea);
+
+    expect(sendClick).not.toHaveBeenCalled();
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it('runs a custom Alt+Enter submit binding outside the composer', () => {
+    bindSubmitMessage('Alt+Enter');
+    renderHarness();
+    const sendClick = appendSendButton();
+
+    const event = dispatchKey({ key: 'Enter', altKey: true });
+
+    expect(sendClick).toHaveBeenCalledTimes(1);
+    expect(event.defaultPrevented).toBe(true);
+  });
+});
+
+describe('delete shortcut confirmation', () => {
+  it('opens the delete confirmation instead of deleting immediately', () => {
+    const conversation = buildConversation('test-convo', 'My Chat');
+    const { getByTestId } = renderHarness(conversation, '/c/test-convo');
+
+    const event = dispatchKey({ key: 'Backspace', ctrlKey: true, shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(true);
+    expect(getByTestId('delete-target').textContent).toBe('test-convo');
+  });
+
+  it('is a no-op when the active conversation is not the routed one', () => {
+    const conversation = buildConversation('other-convo', 'Other');
+    const { getByTestId } = renderHarness(conversation, '/c/test-convo');
+
+    const event = dispatchKey({ key: 'Backspace', ctrlKey: true, shiftKey: true });
+
+    expect(event.defaultPrevented).toBe(false);
+    expect(getByTestId('delete-target').textContent).toBe('none');
+  });
+});
diff --git a/client/src/hooks/useKeyboardShortcuts.ts b/client/src/hooks/useKeyboardShortcuts.ts
new file mode 100644
index 00000000000..203efb77209
--- /dev/null
+++ b/client/src/hooks/useKeyboardShortcuts.ts
@@ -0,0 +1,1009 @@
+import { useCallback, useEffect, useMemo } from 'react';
+import copy from 'copy-to-clipboard';
+import { useToastContext } from '@librechat/client';
+import { useQueryClient } from '@tanstack/react-query';
+import { useMatch, useNavigate } from 'react-router-dom';
+import { useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
+import { PermissionTypes, Permissions, QueryKeys } from 'librechat-data-provider';
+import type { ShortcutBinding } from '~/utils/shortcuts';
+import type { ShortcutOverride } from '~/store/misc';
+import {
+  bindingDisplayString,
+  bindingFromEvent,
+  bindingHash,
+  bindingToString,
+  isMacPlatform,
+  parseBinding,
+} from '~/utils/shortcuts';
+import { mainTextareaId, NotificationSeverity } from '~/common';
+import { useArchiveConvoMutation } from '~/data-provider';
+import { useHasAccess, useLocalize } from '~/hooks';
+import { clearMessagesCache } from '~/utils';
+import useNewConvo from './useNewConvo';
+import store from '~/store';
+
+const isMac = isMacPlatform;
+const CUSTOM_STORAGE_KEY = 'customKeyboardShortcuts';
+
+export type ShortcutDefinition = {
+  labelKey: string;
+  groupKey: string;
+  displayMac: string;
+  displayOther: string;
+  ariaMac: string;
+  ariaOther: string;
+};
+
+export const shortcutDefinitions = {
+  showShortcuts: {
+    labelKey: 'com_shortcut_show_shortcuts',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⌘ ⇧ /',
+    displayOther: 'Ctrl+Shift+/',
+    ariaMac: 'Meta+Shift+/',
+    ariaOther: 'Control+Shift+/',
+  },
+  newChat: {
+    labelKey: 'com_ui_new_chat',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⌘ ⇧ O',
+    displayOther: 'Ctrl+Shift+O',
+    ariaMac: 'Meta+Shift+O',
+    ariaOther: 'Control+Shift+O',
+  },
+  focusChat: {
+    labelKey: 'com_shortcut_focus_chat_input',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⇧ Esc',
+    displayOther: 'Shift+Esc',
+    ariaMac: 'Shift+Escape',
+    ariaOther: 'Shift+Escape',
+  },
+  copyLastResponse: {
+    labelKey: 'com_shortcut_copy_last_response',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⌘ ⇧ ;',
+    displayOther: 'Ctrl+Shift+;',
+    ariaMac: 'Meta+Shift+;',
+    ariaOther: 'Control+Shift+;',
+  },
+  uploadFile: {
+    labelKey: 'com_shortcut_upload_file',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⌘ ⇧ U',
+    displayOther: 'Ctrl+Shift+U',
+    ariaMac: 'Meta+Shift+U',
+    ariaOther: 'Control+Shift+U',
+  },
+  toggleSidebar: {
+    labelKey: 'com_shortcut_toggle_sidebar',
+    groupKey: 'com_shortcut_group_navigation',
+    displayMac: '⌘ ⇧ S',
+    displayOther: 'Ctrl+Shift+S',
+    ariaMac: 'Meta+Shift+S',
+    ariaOther: 'Control+Shift+S',
+  },
+  openModelSelector: {
+    labelKey: 'com_shortcut_open_model_selector',
+    groupKey: 'com_shortcut_group_navigation',
+    displayMac: '⌘ ⇧ M',
+    displayOther: 'Ctrl+Shift+M',
+    ariaMac: 'Meta+Shift+M',
+    ariaOther: 'Control+Shift+M',
+  },
+  focusSearch: {
+    labelKey: 'com_shortcut_focus_search',
+    groupKey: 'com_shortcut_group_navigation',
+    displayMac: '⌘ /',
+    displayOther: 'Ctrl+/',
+    ariaMac: 'Meta+/',
+    ariaOther: 'Control+/',
+  },
+  openSettings: {
+    labelKey: 'com_nav_settings',
+    groupKey: 'com_shortcut_group_navigation',
+    displayMac: '⌘ ⇧ ,',
+    displayOther: 'Ctrl+Shift+,',
+    ariaMac: 'Meta+Shift+,',
+    ariaOther: 'Control+Shift+,',
+  },
+  stopGenerating: {
+    labelKey: 'com_nav_stop_generating',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ X',
+    displayOther: 'Ctrl+Shift+X',
+    ariaMac: 'Meta+Shift+X',
+    ariaOther: 'Control+Shift+X',
+  },
+  regenerateResponse: {
+    labelKey: 'com_shortcut_regenerate_response',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ E',
+    displayOther: 'Ctrl+Shift+E',
+    ariaMac: 'Meta+Shift+E',
+    ariaOther: 'Control+Shift+E',
+  },
+  editLastMessage: {
+    labelKey: 'com_shortcut_edit_last_message',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ I',
+    displayOther: 'Ctrl+Shift+I',
+    ariaMac: 'Meta+Shift+I',
+    ariaOther: 'Control+Shift+I',
+  },
+  copyLastCode: {
+    labelKey: 'com_shortcut_copy_last_code',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ K',
+    displayOther: 'Ctrl+Shift+K',
+    ariaMac: 'Meta+Shift+K',
+    ariaOther: 'Control+Shift+K',
+  },
+  scrollToTop: {
+    labelKey: 'com_shortcut_scroll_to_top',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ ↑',
+    displayOther: 'Ctrl+Shift+↑',
+    ariaMac: 'Meta+Shift+ArrowUp',
+    ariaOther: 'Control+Shift+ArrowUp',
+  },
+  scrollToBottom: {
+    labelKey: 'com_shortcut_scroll_to_bottom',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ ↓',
+    displayOther: 'Ctrl+Shift+↓',
+    ariaMac: 'Meta+Shift+ArrowDown',
+    ariaOther: 'Control+Shift+ArrowDown',
+  },
+  toggleTemporaryChat: {
+    labelKey: 'com_ui_temporary',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ Y',
+    displayOther: 'Ctrl+Shift+Y',
+    ariaMac: 'Meta+Shift+Y',
+    ariaOther: 'Control+Shift+Y',
+  },
+  archiveConversation: {
+    labelKey: 'com_shortcut_archive_conversation',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ L',
+    displayOther: 'Ctrl+Shift+L',
+    ariaMac: 'Meta+Shift+L',
+    ariaOther: 'Control+Shift+L',
+  },
+  deleteConversation: {
+    labelKey: 'com_shortcut_delete_conversation',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ ⌫',
+    displayOther: 'Ctrl+Shift+Backspace',
+    ariaMac: 'Meta+Shift+Backspace',
+    ariaOther: 'Control+Shift+Backspace',
+  },
+  submitMessage: {
+    labelKey: 'com_shortcut_submit_message',
+    groupKey: 'com_shortcut_group_general',
+    displayMac: '⌘ ↵',
+    displayOther: 'Ctrl+Enter',
+    ariaMac: 'Meta+Enter',
+    ariaOther: 'Control+Enter',
+  },
+  bookmarkConversation: {
+    labelKey: 'com_shortcut_bookmark_conversation',
+    groupKey: 'com_shortcut_group_navigation',
+    displayMac: '⌘ ⇧ B',
+    displayOther: 'Ctrl+Shift+B',
+    ariaMac: 'Meta+Shift+B',
+    ariaOther: 'Control+Shift+B',
+  },
+  continueResponse: {
+    labelKey: 'com_shortcut_continue_response',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ C',
+    displayOther: 'Ctrl+Shift+C',
+    ariaMac: 'Meta+Shift+C',
+    ariaOther: 'Control+Shift+C',
+  },
+  readAloudLastResponse: {
+    labelKey: 'com_shortcut_read_aloud',
+    groupKey: 'com_shortcut_group_chat',
+    displayMac: '⌘ ⇧ V',
+    displayOther: 'Ctrl+Shift+V',
+    ariaMac: 'Meta+Shift+V',
+    ariaOther: 'Control+Shift+V',
+  },
+  openAssistants: {
+    labelKey: 'com_shortcut_open_assistants',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openAgents: {
+    labelKey: 'com_shortcut_open_agents',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openPrompts: {
+    labelKey: 'com_shortcut_open_prompts',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openMemories: {
+    labelKey: 'com_shortcut_open_memories',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openParameters: {
+    labelKey: 'com_shortcut_open_parameters',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openFiles: {
+    labelKey: 'com_shortcut_open_files',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openBookmarks: {
+    labelKey: 'com_shortcut_open_bookmarks',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+  openMCP: {
+    labelKey: 'com_shortcut_open_mcp',
+    groupKey: 'com_shortcut_group_panels',
+    displayMac: '',
+    displayOther: '',
+    ariaMac: '',
+    ariaOther: '',
+  },
+} as const satisfies Record<string, ShortcutDefinition>;
+
+export type ShortcutActionId = keyof typeof shortcutDefinitions;
+export type ShortcutAction = ShortcutDefinition & {
+  id: ShortcutActionId;
+  /** Returns `false` when the action was a no-op so the native key event is not prevented. */
+  run: () => boolean | void;
+};
+
+const shortcutActionIds = Object.keys(shortcutDefinitions) as ShortcutActionId[];
+
+function getMainScrollContainer(): Element | null {
+  const end = document.getElementById('messages-end');
+  let node: HTMLElement | null = end?.parentElement ?? null;
+  while (node) {
+    const overflowY = getComputedStyle(node).overflowY;
+    if ((overflowY === 'auto' || overflowY === 'scroll') && node.scrollHeight > node.clientHeight) {
+      return node;
+    }
+    node = node.parentElement;
+  }
+  return document.querySelector('main[role="main"]');
+}
+
+function anyModalOpen(): boolean {
+  const dialogs = document.querySelectorAll('[role="dialog"], [role="alertdialog"]');
+  for (let i = 0; i < dialogs.length; i++) {
+    const dialog = dialogs[i];
+    if (dialog.hasAttribute('inert')) {
+      continue;
+    }
+    if (dialog.getAttribute('data-state') === 'closed') {
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Ariakit menus/popovers render a focus-trapped `role="menu"`/`role="listbox"` overlay rather
+ * than a dialog, so they slip past {@link anyModalOpen}. When one is open its focused item is
+ * the key event target, so checking the target's ancestry catches it without false positives
+ * from hidden menus elsewhere in the tree.
+ */
+function isWithinOpenMenu(target: HTMLElement | null): boolean {
+  return target instanceof Element && target.closest('[role="menu"], [role="listbox"]') != null;
+}
+
+function isUnavailableElement(el: HTMLElement): boolean {
+  return (
+    el.getAttribute('aria-disabled') === 'true' ||
+    (el instanceof HTMLButtonElement && el.disabled) ||
+    (el instanceof HTMLInputElement && el.disabled)
+  );
+}
+
+function clickTarget(el: HTMLElement | null | undefined): boolean {
+  if (!el || isUnavailableElement(el)) {
+    return false;
+  }
+  el.click();
+  return true;
+}
+
+function clickElement(selector: string): boolean {
+  return clickTarget(document.querySelector<HTMLElement>(selector));
+}
+
+function clickLastElement(selector: string): boolean {
+  const elements = document.querySelectorAll<HTMLElement>(selector);
+  return clickTarget(elements[elements.length - 1]);
+}
+
+function defaultAria(actionId: ShortcutActionId): string {
+  const def = shortcutDefinitions[actionId];
+  return isMac ? def.ariaMac : def.ariaOther;
+}
+
+function readOverridesFromStorage(): Record<string, ShortcutOverride> {
+  if (typeof window === 'undefined') {
+    return {};
+  }
+  try {
+    const raw = window.localStorage.getItem(CUSTOM_STORAGE_KEY);
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    return typeof parsed === 'object' && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function effectiveBindingString(
+  actionId: ShortcutActionId,
+  overrides: Record<string, ShortcutOverride>,
+): string | null {
+  const override = overrides[actionId];
+  if (override) {
+    const platformValue = isMac ? override.mac : override.other;
+    if (platformValue === null) {
+      return null;
+    }
+    if (typeof platformValue === 'string') {
+      return platformValue;
+    }
+  }
+  return defaultAria(actionId);
+}
+
+export function effectiveBinding(
+  actionId: ShortcutActionId,
+  overrides?: Record<string, ShortcutOverride>,
+): ShortcutBinding | null {
+  const map = overrides ?? readOverridesFromStorage();
+  return parseBinding(effectiveBindingString(actionId, map));
+}
+
+export function getShortcutDisplay(actionId: ShortcutActionId): string {
+  const binding = effectiveBinding(actionId);
+  if (!binding) {
+    return '';
+  }
+  return bindingDisplayString(binding, isMac);
+}
+
+export function getShortcutAriaKey(actionId: ShortcutActionId): string {
+  const binding = effectiveBinding(actionId);
+  if (!binding) {
+    return '';
+  }
+  return bindingToString(binding) ?? '';
+}
+
+export function getShortcutHint(actionId: ShortcutActionId, label: string): string {
+  const display = getShortcutDisplay(actionId);
+  return display ? `${label} (${display})` : label;
+}
+
+export function isOverridden(actionId: ShortcutActionId, override?: ShortcutOverride): boolean {
+  if (!override) return false;
+  const platformValue = isMac ? override.mac : override.other;
+  if (platformValue === null) return true;
+  if (typeof platformValue !== 'string') return false;
+  return platformValue !== defaultAria(actionId);
+}
+
+export function useShortcutActions(): ShortcutAction[] {
+  const navigate = useNavigate();
+  const localize = useLocalize();
+  const queryClient = useQueryClient();
+  const { newConversation } = useNewConvo();
+  const { showToast } = useToastContext();
+  const routeMatch = useMatch('/c/:conversationId');
+  const routeConvoId = routeMatch?.params.conversationId ?? null;
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+  const isSubmitting = useRecoilValue(store.isSubmittingFamily(0));
+  const [sidebarExpanded, setSidebarExpanded] = useRecoilState(store.sidebarExpanded);
+  const setShowShortcutsDialog = useSetRecoilState(store.showShortcutsDialog);
+  const setIsTemporary = useSetRecoilState(store.isTemporary);
+  const setDeleteTarget = useSetRecoilState(store.keyboardDeleteTarget);
+  const hasAccessToTemporaryChat = useHasAccess({
+    permissionType: PermissionTypes.TEMPORARY_CHAT,
+    permission: Permissions.USE,
+  });
+
+  const archiveMutation = useArchiveConvoMutation();
+
+  const handleShowShortcuts = useCallback(() => {
+    setShowShortcutsDialog((prev) => !prev);
+    return true;
+  }, [setShowShortcutsDialog]);
+
+  const handleNewChat = useCallback(() => {
+    clearMessagesCache(queryClient, conversation?.conversationId);
+    queryClient.invalidateQueries([QueryKeys.messages]);
+    newConversation();
+    return true;
+  }, [queryClient, conversation?.conversationId, newConversation]);
+
+  const handleFocusChatInput = useCallback(() => {
+    const textarea = document.getElementById(mainTextareaId) as HTMLTextAreaElement | null;
+    if (!textarea) {
+      return false;
+    }
+    textarea.focus();
+    return true;
+  }, []);
+
+  const handleToggleSidebar = useCallback(() => {
+    setSidebarExpanded((prev) => !prev);
+    return true;
+  }, [setSidebarExpanded]);
+
+  const handleOpenModelSelector = useCallback(
+    () => clickElement('[data-testid="model-selector-button"]'),
+    [],
+  );
+
+  const handleFocusSearch = useCallback(() => {
+    const focusSearchInput = () => {
+      const input = document.querySelector<HTMLInputElement>(
+        'input[data-testid="nav-search-input"]',
+      );
+      if (!input) {
+        return false;
+      }
+      input.focus();
+      return true;
+    };
+
+    const panelButton = document.querySelector<HTMLButtonElement>(
+      '[data-testid="nav-panel-conversations"]',
+    );
+    let switchedPanel = false;
+    if (
+      panelButton &&
+      !isUnavailableElement(panelButton) &&
+      panelButton.getAttribute('aria-pressed') !== 'true'
+    ) {
+      switchedPanel = true;
+      panelButton.click();
+    }
+
+    if (!sidebarExpanded) {
+      setSidebarExpanded(true);
+    }
+
+    if (!sidebarExpanded || switchedPanel) {
+      setTimeout(focusSearchInput, 350);
+      return true;
+    }
+
+    return focusSearchInput();
+  }, [sidebarExpanded, setSidebarExpanded]);
+
+  const handleCopyLastResponse = useCallback(() => {
+    return clickLastElement('[data-testid="copy-response-button"]');
+  }, []);
+
+  const handleCopyLastCode = useCallback(() => {
+    const blocks = document.querySelectorAll('.agent-turn pre code');
+    if (blocks.length === 0) {
+      return false;
+    }
+    const last = blocks[blocks.length - 1];
+    const text = last.textContent ?? '';
+    if (!text.trim()) {
+      return false;
+    }
+    return copy(text.trim(), { format: 'text/plain' });
+  }, []);
+
+  const handleStopGenerating = useCallback(
+    () => clickElement('[data-testid="stop-generation-button"]'),
+    [],
+  );
+
+  const handleRegenerateResponse = useCallback(
+    () => clickElement('[data-testid="regenerate-generation-button"]'),
+    [],
+  );
+
+  const handleEditLastMessage = useCallback(() => {
+    const userTurns = document.querySelectorAll('.user-turn');
+    if (userTurns.length === 0) {
+      return false;
+    }
+    const last = userTurns[userTurns.length - 1];
+    const editBtn = last.querySelector<HTMLButtonElement>('button[id^="edit-"]');
+    if (!editBtn) {
+      return false;
+    }
+    editBtn.click();
+    return true;
+  }, []);
+
+  const handleScrollToTop = useCallback(() => {
+    const container = getMainScrollContainer();
+    if (container) {
+      container.scrollTo({ top: 0, behavior: 'smooth' });
+      return true;
+    }
+    window.scrollTo({ top: 0, behavior: 'smooth' });
+    return true;
+  }, []);
+
+  const handleScrollToBottom = useCallback(() => {
+    const container = getMainScrollContainer();
+    if (container) {
+      container.scrollTo({ top: container.scrollHeight, behavior: 'smooth' });
+      return true;
+    }
+    window.scrollTo({ top: document.body.scrollHeight, behavior: 'smooth' });
+    return true;
+  }, []);
+
+  const handleOpenSettings = useCallback(() => {
+    const btn = document.querySelector<HTMLElement>('[data-testid="nav-user"]');
+    if (!btn || isUnavailableElement(btn)) {
+      return false;
+    }
+    const openSettingsItem = () => {
+      const settingsItem = document.querySelector<HTMLElement>('[data-testid="nav-settings"]');
+      return clickTarget(settingsItem);
+    };
+    if (btn.getAttribute('aria-expanded') === 'true') {
+      return openSettingsItem();
+    }
+    btn.click();
+    setTimeout(openSettingsItem, 150);
+    return true;
+  }, []);
+
+  const handleToggleTemporaryChat = useCallback(() => {
+    if (hasAccessToTemporaryChat !== true) {
+      return false;
+    }
+    if (!routeConvoId) {
+      return false;
+    }
+    const hasMessages = Array.isArray(conversation?.messages) && conversation.messages.length >= 1;
+    if (hasMessages || isSubmitting) {
+      return false;
+    }
+    setIsTemporary((prev) => !prev);
+    return true;
+  }, [
+    hasAccessToTemporaryChat,
+    routeConvoId,
+    conversation?.messages,
+    isSubmitting,
+    setIsTemporary,
+  ]);
+
+  const handleUploadFile = useCallback(() => {
+    const btn =
+      document.querySelector<HTMLButtonElement>('#attach-file-menu-button') ??
+      document.querySelector<HTMLButtonElement>('#attach-file');
+    return clickTarget(btn);
+  }, []);
+
+  const handleArchiveConversation = useCallback(() => {
+    const convoId = conversation?.conversationId;
+    if (!convoId || convoId === 'new') {
+      return false;
+    }
+    if (routeConvoId !== convoId) {
+      return false;
+    }
+    if (archiveMutation.isLoading) {
+      return false;
+    }
+    archiveMutation.mutate(
+      { conversationId: convoId, isArchived: true },
+      {
+        onSuccess: () => {
+          newConversation();
+          navigate('/c/new', { replace: true });
+        },
+        onError: () => {
+          showToast({
+            message: localize('com_ui_archive_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+    return true;
+  }, [
+    localize,
+    showToast,
+    routeConvoId,
+    archiveMutation,
+    newConversation,
+    navigate,
+    conversation?.conversationId,
+  ]);
+
+  const handleDeleteConversation = useCallback(() => {
+    const convoId = conversation?.conversationId;
+    if (!convoId || convoId === 'new') {
+      return false;
+    }
+    if (routeConvoId !== convoId) {
+      return false;
+    }
+    setDeleteTarget({ conversationId: convoId, title: conversation?.title ?? '' });
+    return true;
+  }, [conversation?.conversationId, conversation?.title, routeConvoId, setDeleteTarget]);
+
+  const handleSubmitMessage = useCallback(() => {
+    const btn = document.querySelector<HTMLButtonElement>('[data-testid="send-button"]');
+    return clickTarget(btn);
+  }, []);
+
+  const handleContinueResponse = useCallback(
+    () => clickElement('[data-testid="continue-generation-button"]'),
+    [],
+  );
+
+  const handleReadAloudLastResponse = useCallback(
+    () => clickElement('[data-testid="read-aloud-button"]'),
+    [],
+  );
+
+  const handleBookmarkConversation = useCallback(() => clickElement('#bookmark-menu-button'), []);
+
+  const handleOpenPanel = useCallback(
+    (panelId: string) => {
+      const activatePanel = () => {
+        const btn = document.querySelector<HTMLButtonElement>(
+          `[data-testid="nav-panel-${panelId}"]`,
+        );
+        if (!btn || isUnavailableElement(btn)) {
+          return false;
+        }
+        if (btn.getAttribute('aria-pressed') !== 'true') {
+          btn.click();
+          return true;
+        }
+        return false;
+      };
+
+      const btn = document.querySelector<HTMLButtonElement>(`[data-testid="nav-panel-${panelId}"]`);
+      if (!btn || isUnavailableElement(btn)) {
+        return false;
+      }
+
+      if (!sidebarExpanded) {
+        setSidebarExpanded(true);
+        setTimeout(activatePanel, 350);
+        return true;
+      }
+
+      return activatePanel();
+    },
+    [sidebarExpanded, setSidebarExpanded],
+  );
+
+  const handleOpenAssistants = useCallback(() => handleOpenPanel('assistants'), [handleOpenPanel]);
+  const handleOpenAgents = useCallback(() => handleOpenPanel('agents'), [handleOpenPanel]);
+  const handleOpenPrompts = useCallback(() => handleOpenPanel('prompts'), [handleOpenPanel]);
+  const handleOpenMemories = useCallback(() => handleOpenPanel('memories'), [handleOpenPanel]);
+  const handleOpenParameters = useCallback(() => handleOpenPanel('parameters'), [handleOpenPanel]);
+  const handleOpenFiles = useCallback(() => handleOpenPanel('files'), [handleOpenPanel]);
+  const handleOpenBookmarks = useCallback(() => handleOpenPanel('bookmarks'), [handleOpenPanel]);
+  const handleOpenMCP = useCallback(() => handleOpenPanel('mcp-builder'), [handleOpenPanel]);
+
+  const handlers = useMemo<Record<ShortcutActionId, () => boolean | void>>(
+    () => ({
+      showShortcuts: handleShowShortcuts,
+      newChat: handleNewChat,
+      focusChat: handleFocusChatInput,
+      copyLastResponse: handleCopyLastResponse,
+      uploadFile: handleUploadFile,
+      toggleSidebar: handleToggleSidebar,
+      openModelSelector: handleOpenModelSelector,
+      focusSearch: handleFocusSearch,
+      openSettings: handleOpenSettings,
+      stopGenerating: handleStopGenerating,
+      regenerateResponse: handleRegenerateResponse,
+      editLastMessage: handleEditLastMessage,
+      copyLastCode: handleCopyLastCode,
+      scrollToTop: handleScrollToTop,
+      scrollToBottom: handleScrollToBottom,
+      toggleTemporaryChat: handleToggleTemporaryChat,
+      archiveConversation: handleArchiveConversation,
+      deleteConversation: handleDeleteConversation,
+      submitMessage: handleSubmitMessage,
+      bookmarkConversation: handleBookmarkConversation,
+      continueResponse: handleContinueResponse,
+      readAloudLastResponse: handleReadAloudLastResponse,
+      openAssistants: handleOpenAssistants,
+      openAgents: handleOpenAgents,
+      openPrompts: handleOpenPrompts,
+      openMemories: handleOpenMemories,
+      openParameters: handleOpenParameters,
+      openFiles: handleOpenFiles,
+      openBookmarks: handleOpenBookmarks,
+      openMCP: handleOpenMCP,
+    }),
+    [
+      handleShowShortcuts,
+      handleNewChat,
+      handleFocusChatInput,
+      handleCopyLastResponse,
+      handleUploadFile,
+      handleToggleSidebar,
+      handleOpenModelSelector,
+      handleFocusSearch,
+      handleOpenSettings,
+      handleStopGenerating,
+      handleRegenerateResponse,
+      handleEditLastMessage,
+      handleCopyLastCode,
+      handleScrollToTop,
+      handleScrollToBottom,
+      handleToggleTemporaryChat,
+      handleArchiveConversation,
+      handleDeleteConversation,
+      handleSubmitMessage,
+      handleBookmarkConversation,
+      handleContinueResponse,
+      handleReadAloudLastResponse,
+      handleOpenAssistants,
+      handleOpenAgents,
+      handleOpenPrompts,
+      handleOpenMemories,
+      handleOpenParameters,
+      handleOpenFiles,
+      handleOpenBookmarks,
+      handleOpenMCP,
+    ],
+  );
+
+  return useMemo(
+    () =>
+      shortcutActionIds.map((id) => ({
+        id,
+        ...shortcutDefinitions[id],
+        run: handlers[id],
+      })),
+    [handlers],
+  );
+}
+
+export function useShortcutDisplay(actionId?: ShortcutActionId): string {
+  const overrides = useRecoilValue(store.customShortcuts);
+  return useMemo(() => {
+    if (!actionId) return '';
+    const binding = parseBinding(effectiveBindingString(actionId, overrides));
+    return binding ? bindingDisplayString(binding, isMac) : '';
+  }, [actionId, overrides]);
+}
+
+export function useShortcutAriaKey(actionId?: ShortcutActionId): string | undefined {
+  const overrides = useRecoilValue(store.customShortcuts);
+  return useMemo(() => {
+    if (!actionId) return undefined;
+    const binding = parseBinding(effectiveBindingString(actionId, overrides));
+    return binding ? (bindingToString(binding) ?? undefined) : undefined;
+  }, [actionId, overrides]);
+}
+
+export function useShortcutHint(actionId: ShortcutActionId | undefined, label: string): string {
+  const display = useShortcutDisplay(actionId);
+  return display ? `${label} (${display})` : label;
+}
+
+export type ShortcutBindingInfo = {
+  id: ShortcutActionId;
+  binding: ShortcutBinding | null;
+  isCustom: boolean;
+  groupKey: string;
+  labelKey: string;
+};
+
+export function useShortcutBindings(): {
+  bindings: ShortcutBindingInfo[];
+  bindingMap: Map<string, ShortcutActionId>;
+  setBinding: (id: ShortcutActionId, binding: ShortcutBinding | null) => void;
+  resetBinding: (id: ShortcutActionId) => void;
+  resetAll: () => void;
+} {
+  const [overrides, setOverrides] = useRecoilState(store.customShortcuts);
+
+  const bindings = useMemo<ShortcutBindingInfo[]>(
+    () =>
+      shortcutActionIds.map((id) => {
+        const def = shortcutDefinitions[id];
+        const override = overrides[id];
+        const binding = parseBinding(effectiveBindingString(id, overrides));
+        return {
+          id,
+          binding,
+          isCustom: isOverridden(id, override),
+          groupKey: def.groupKey,
+          labelKey: def.labelKey,
+        };
+      }),
+    [overrides],
+  );
+
+  const bindingMap = useMemo<Map<string, ShortcutActionId>>(() => {
+    const map = new Map<string, ShortcutActionId>();
+    for (const info of bindings) {
+      if (info.binding) {
+        map.set(bindingHash(info.binding), info.id);
+      }
+    }
+    return map;
+  }, [bindings]);
+
+  const setBinding = useCallback(
+    (id: ShortcutActionId, binding: ShortcutBinding | null) => {
+      setOverrides((prev) => {
+        const next = { ...prev };
+        const def = shortcutDefinitions[id];
+        const platformKey: keyof ShortcutOverride = isMac ? 'mac' : 'other';
+        const existing = next[id] ?? { mac: def.ariaMac, other: def.ariaOther };
+        const updated: ShortcutOverride = { ...existing };
+        updated[platformKey] = binding ? bindingToString(binding) : null;
+
+        const matchesDefault = updated.mac === def.ariaMac && updated.other === def.ariaOther;
+
+        if (matchesDefault) {
+          delete next[id];
+        } else {
+          next[id] = updated;
+        }
+        return next;
+      });
+    },
+    [setOverrides],
+  );
+
+  const resetBinding = useCallback(
+    (id: ShortcutActionId) => {
+      setOverrides((prev) => {
+        if (!prev[id]) return prev;
+        const next = { ...prev };
+        delete next[id];
+
+        const restored = parseBinding(effectiveBindingString(id, next));
+        if (restored) {
+          const restoredHash = bindingHash(restored);
+          const platformKey: keyof ShortcutOverride = isMac ? 'mac' : 'other';
+          for (const otherId of Object.keys(next) as ShortcutActionId[]) {
+            const otherBinding = parseBinding(effectiveBindingString(otherId, next));
+            if (otherBinding && bindingHash(otherBinding) === restoredHash) {
+              next[otherId] = { ...next[otherId], [platformKey]: null };
+            }
+          }
+        }
+        return next;
+      });
+    },
+    [setOverrides],
+  );
+
+  const resetAll = useCallback(() => {
+    setOverrides({});
+  }, [setOverrides]);
+
+  return { bindings, bindingMap, setBinding, resetBinding, resetAll };
+}
+
+export default function useKeyboardShortcuts() {
+  const actions = useShortcutActions();
+  const overrides = useRecoilValue(store.customShortcuts);
+  const shortcutsDialogOpen = useRecoilValue(store.showShortcutsDialog);
+
+  const actionMap = useMemo(() => new Map(actions.map((action) => [action.id, action])), [actions]);
+
+  const bindingMap = useMemo<Map<string, ShortcutActionId>>(() => {
+    const map = new Map<string, ShortcutActionId>();
+    for (const id of shortcutActionIds) {
+      const binding = parseBinding(effectiveBindingString(id, overrides));
+      if (binding) {
+        map.set(bindingHash(binding), id);
+      }
+    }
+    return map;
+  }, [overrides]);
+
+  const handler = useCallback(
+    (e: KeyboardEvent) => {
+      if (e.repeat) {
+        return;
+      }
+
+      const binding = bindingFromEvent(e);
+      if (!binding) {
+        return;
+      }
+
+      const matchedId = bindingMap.get(bindingHash(binding));
+      if (!matchedId) {
+        return;
+      }
+
+      const target = e.target as HTMLElement | null;
+
+      if (shortcutsDialogOpen) {
+        if (matchedId !== 'showShortcuts') {
+          return;
+        }
+      } else if (anyModalOpen() || isWithinOpenMenu(target)) {
+        return;
+      }
+
+      const tagName = target?.tagName;
+      const isEditing =
+        tagName === 'INPUT' || tagName === 'TEXTAREA' || target?.isContentEditable === true;
+      const isMainTextarea = target?.id === mainTextareaId;
+
+      // The composer owns every Enter-based submit chord (native and custom), so defer all
+      // Enter presses there; other editing contexts handle their own submit too.
+      if (
+        matchedId === 'submitMessage' &&
+        ((isMainTextarea && e.key === 'Enter') || (isEditing && !isMainTextarea))
+      ) {
+        return;
+      }
+
+      const allowedWhileEditing: ShortcutActionId[] = [
+        'focusChat',
+        'focusSearch',
+        'showShortcuts',
+        'submitMessage',
+      ];
+      if (isEditing && !allowedWhileEditing.includes(matchedId)) {
+        return;
+      }
+
+      const handled = actionMap.get(matchedId)?.run();
+      if (handled !== false) {
+        e.preventDefault();
+      }
+    },
+    [actionMap, bindingMap, shortcutsDialogOpen],
+  );
+
+  useEffect(() => {
+    document.addEventListener('keydown', handler);
+    return () => document.removeEventListener('keydown', handler);
+  }, [handler]);
+}
+
+export { isMac };
diff --git a/client/src/hooks/useLocalize.ts b/client/src/hooks/useLocalize.ts
index f87ee5932b5..4e2384f6c01 100644
--- a/client/src/hooks/useLocalize.ts
+++ b/client/src/hooks/useLocalize.ts
@@ -1,21 +1,12 @@
-import { useCallback, useEffect } from 'react';
+import { useCallback } from 'react';
 import { TOptions } from 'i18next';
-import { useRecoilValue } from 'recoil';
 import { useTranslation } from 'react-i18next';
-import { resources } from '~/locales/i18n';
-import store from '~/store';
+import translationEn from '~/locales/en/translation.json';
 
-export type TranslationKeys = keyof typeof resources.en.translation;
+export type TranslationKeys = keyof typeof translationEn;
 
 export default function useLocalize() {
-  const lang = useRecoilValue(store.lang);
-  const { t, i18n } = useTranslation();
-
-  useEffect(() => {
-    if (i18n.language !== lang) {
-      i18n.changeLanguage(lang);
-    }
-  }, [lang, i18n]);
+  const { t } = useTranslation();
 
   return useCallback(
     (phraseKey: TranslationKeys, options?: TOptions) => t(phraseKey, options),
diff --git a/client/src/hooks/useNewConvo.ts b/client/src/hooks/useNewConvo.ts
index f2879cb0923..fb34897a228 100644
--- a/client/src/hooks/useNewConvo.ts
+++ b/client/src/hooks/useNewConvo.ts
@@ -30,10 +30,12 @@ import {
   getDefaultModelSpec,
   getDefaultEndpoint,
   getModelSpecPreset,
+  hasModelSelection,
   buildDefaultConvo,
   logger,
 } from '~/utils';
 import { useDeleteFilesMutation, useGetEndpointsQuery, useGetStartupConfig } from '~/data-provider';
+import useGetConversation from './Conversations/useGetConversation';
 import useAssistantListMap from './Assistants/useAssistantListMap';
 import { useResetChatBadges } from './useChatBadges';
 import { useApplyModelSpecEffects } from './Agents';
@@ -45,13 +47,13 @@ const useNewConvo = (index = 0) => {
   const navigate = useNavigate();
   const [searchParams] = useSearchParams();
   const { data: startupConfig } = useGetStartupConfig();
+  const getConversation = useGetConversation(index);
   const applyModelSpecEffects = useApplyModelSpecEffects();
   const clearAllConversations = store.useClearConvoState();
   const defaultPreset = useRecoilValue(store.defaultPreset);
   const { setConversation } = store.useSetConversationAtom(index);
   const [files, setFiles] = useRecoilState(store.filesByIndex(index));
   const saveBadgesState = useRecoilValue<boolean>(store.saveBadgesState);
-  const clearAllLatestMessages = store.useClearLatestMessages(`useNewConvo ${index}`);
   const setSubmission = useSetRecoilState<TSubmission | null>(store.submissionByIndex(index));
   const { data: endpointsConfig = {} as TEndpointsConfig } = useGetEndpointsQuery();
 
@@ -82,7 +84,6 @@ const useNewConvo = (index = 0) => {
         preset: Partial<TPreset> | null = null,
         modelsData?: TModelsConfig,
         buildDefault?: boolean,
-        keepLatestMessage?: boolean,
         keepAddedConvos?: boolean,
         disableFocus?: boolean,
         _disableParams?: boolean,
@@ -90,6 +91,11 @@ const useNewConvo = (index = 0) => {
         const modelsConfig = modelsData ?? modelsQuery.data;
         const { endpoint = null } = conversation;
         const buildDefaultConversation = (endpoint === null || buildDefault) ?? false;
+        const hasExplicitChatProjectId = Object.prototype.hasOwnProperty.call(
+          conversation,
+          'chatProjectId',
+        );
+        const explicitChatProjectId = conversation.chatProjectId;
         const activePreset =
           // use default preset only when it's defined,
           // preset is not provided,
@@ -200,6 +206,12 @@ const useNewConvo = (index = 0) => {
             models,
             defaultParamsEndpoint,
           });
+
+          if (hasExplicitChatProjectId) {
+            conversation.chatProjectId = explicitChatProjectId ?? null;
+          } else {
+            delete conversation.chatProjectId;
+          }
         }
 
         if (disableParams === true) {
@@ -225,34 +237,48 @@ const useNewConvo = (index = 0) => {
           setConversation(conversation);
         }
         setSubmission({} as TSubmission);
-        if (!(keepLatestMessage ?? false)) {
-          logger.log('latest_message', 'Clearing all latest messages');
-          clearAllLatestMessages();
-        }
         if (isCancelled) {
           return;
         }
 
-        const searchParamsString = searchParams?.toString();
-        const getParams = () => (searchParamsString ? `?${searchParamsString}` : '');
+        const getParams = (nextConversation: TConversation) => {
+          const nextParams = new URLSearchParams(searchParams);
+          nextParams.delete('projectId');
+          if (
+            nextConversation.conversationId === Constants.NEW_CONVO &&
+            nextConversation.chatProjectId
+          ) {
+            nextParams.set('projectId', nextConversation.chatProjectId);
+          }
+
+          const searchParamsString = nextParams.toString();
+          return searchParamsString ? `?${searchParamsString}` : '';
+        };
 
         if (conversation.conversationId === Constants.NEW_CONVO && !modelsData) {
           const appTitle = localStorage.getItem(LocalStorageKeys.APP_TITLE) ?? '';
           if (appTitle) {
             document.title = appTitle;
           }
-          const path = `/c/${Constants.NEW_CONVO}${getParams()}`;
+          const path = `/c/${Constants.NEW_CONVO}${getParams(conversation)}`;
           navigate(path, { state: { focusChat: true } });
           return;
         }
 
-        const path = `/c/${conversation.conversationId}${getParams()}`;
+        const path = `/c/${conversation.conversationId}${getParams(conversation)}`;
         navigate(path, {
           replace: true,
           state: disableFocus ? {} : { focusChat: true },
         });
       },
-    [endpointsConfig, defaultPreset, assistantsListMap, modelsQuery.data, hasAgentAccess],
+    [
+      endpointsConfig,
+      defaultPreset,
+      assistantsListMap,
+      modelsQuery.data,
+      hasAgentAccess,
+      searchParams,
+    ],
   );
 
   const newConversation = useCallback(
@@ -262,7 +288,6 @@ const useNewConvo = (index = 0) => {
       modelsData,
       disableFocus,
       buildDefault = true,
-      keepLatestMessage = false,
       keepAddedConvos = false,
       disableParams,
     }: {
@@ -271,7 +296,6 @@ const useNewConvo = (index = 0) => {
       modelsData?: TModelsConfig;
       buildDefault?: boolean;
       disableFocus?: boolean;
-      keepLatestMessage?: boolean;
       keepAddedConvos?: boolean;
       disableParams?: boolean;
     } = {}) {
@@ -286,7 +310,7 @@ const useNewConvo = (index = 0) => {
         isParamEndpoint(_preset?.endpoint ?? '', _preset?.endpointType ?? '');
       const template =
         paramEndpoint === true && templateConvoId && templateConvoId === Constants.NEW_CONVO
-          ? { endpoint: _template.endpoint }
+          ? { endpoint: _template.endpoint, chatProjectId: _template.chatProjectId }
           : _template;
 
       const conversation = {
@@ -299,23 +323,26 @@ const useNewConvo = (index = 0) => {
       };
 
       let preset = _preset;
-      const result = getDefaultModelSpec(startupConfig);
-      const defaultModelSpec = result?.default ?? result?.last;
-      if (
-        !preset &&
-        startupConfig &&
-        (startupConfig.modelSpecs?.prioritize === true ||
-          (startupConfig.interface?.modelSelect ?? true) !== true ||
-          (result?.last != null && Object.keys(_template).length === 0)) &&
-        defaultModelSpec
-      ) {
+      const result = getDefaultModelSpec(startupConfig, endpointsConfig);
+      const defaultModelSpec = result?.default ?? result?.last ?? result?.softDefault;
+      const shouldApplyModelSpec =
+        result?.softDefault != null
+          ? !hasModelSelection(_template)
+          : startupConfig?.modelSpecs?.prioritize === true ||
+            (startupConfig?.interface?.modelSelect ?? true) !== true ||
+            (result?.last != null &&
+              Object.keys(_template).filter((key) => key !== 'chatProjectId').length === 0);
+      if (!preset && startupConfig && shouldApplyModelSpec && defaultModelSpec) {
         preset = getModelSpecPreset(defaultModelSpec);
       }
 
+      const prevConversation = getConversation();
       applyModelSpecEffects({
         startupConfig,
         specName: preset?.spec,
         convoId: conversation.conversationId,
+        prevConvoId: prevConversation?.conversationId,
+        prevSpecName: prevConversation?.spec,
       });
 
       if (conversation.conversationId === Constants.NEW_CONVO && !modelsData) {
@@ -348,7 +375,6 @@ const useNewConvo = (index = 0) => {
         preset,
         modelsData,
         buildDefault,
-        keepLatestMessage,
         keepAddedConvos,
         disableFocus,
         disableParams,
@@ -362,6 +388,8 @@ const useNewConvo = (index = 0) => {
       resetBadges,
       startupConfig,
       saveBadgesState,
+      endpointsConfig,
+      getConversation,
       pauseGlobalAudio,
       switchToConversation,
       applyModelSpecEffects,
diff --git a/client/src/hooks/useTimeTick.ts b/client/src/hooks/useTimeTick.ts
new file mode 100644
index 00000000000..1528ffe83ec
--- /dev/null
+++ b/client/src/hooks/useTimeTick.ts
@@ -0,0 +1,33 @@
+import { useSyncExternalStore } from 'react';
+
+const listeners = new Set<() => void>();
+let tick = 0;
+let intervalId: ReturnType<typeof setInterval> | null = null;
+
+const subscribe = (onStoreChange: () => void): (() => void) => {
+  listeners.add(onStoreChange);
+  if (intervalId === null) {
+    intervalId = setInterval(() => {
+      tick += 1;
+      listeners.forEach((listener) => listener());
+    }, 60_000);
+  }
+  return () => {
+    listeners.delete(onStoreChange);
+    if (listeners.size === 0 && intervalId !== null) {
+      clearInterval(intervalId);
+      intervalId = null;
+    }
+  };
+};
+
+const getSnapshot = (): number => tick;
+
+/**
+ * Subscribes to a shared, ref-counted ticker that fires once a minute, so components
+ * displaying relative time stay current while a view is left open. A single interval
+ * is shared across all subscribers and is cleared when the last one unsubscribes.
+ */
+export default function useTimeTick(): number {
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}
diff --git a/client/src/lib/rum/WithRum.tsx b/client/src/lib/rum/WithRum.tsx
new file mode 100644
index 00000000000..59beb35c48a
--- /dev/null
+++ b/client/src/lib/rum/WithRum.tsx
@@ -0,0 +1,8 @@
+import type { ReactNode } from 'react';
+import useRum from './useRum';
+
+export default function WithRum({ children }: { children: ReactNode }) {
+  useRum();
+
+  return <>{children}</>;
+}
diff --git a/client/src/lib/rum/routes.spec.ts b/client/src/lib/rum/routes.spec.ts
new file mode 100644
index 00000000000..c1777aa80a1
--- /dev/null
+++ b/client/src/lib/rum/routes.spec.ts
@@ -0,0 +1,19 @@
+import { normalizeRumPath } from './routes';
+
+describe('normalizeRumPath', () => {
+  it('normalizes dynamic LibreChat route identifiers', () => {
+    expect(normalizeRumPath('/c/65a5e0a7d1c2b3a4f5e6d789')).toBe('/c/:conversationId');
+    expect(normalizeRumPath('/share/65a5e0a7d1c2b3a4f5e6d789')).toBe('/share/:shareId');
+    expect(normalizeRumPath('/assistants/asst_123')).toBe('/assistants/:assistantId');
+  });
+
+  it('normalizes generic UUID and ObjectId path segments', () => {
+    expect(normalizeRumPath('/files/550e8400-e29b-41d4-a716-446655440000')).toBe('/files/:id');
+    expect(normalizeRumPath('/files/65a5e0a7d1c2b3a4f5e6d789/preview')).toBe('/files/:id/preview');
+  });
+
+  it('preserves static routes', () => {
+    expect(normalizeRumPath('/search')).toBe('/search');
+    expect(normalizeRumPath('/')).toBe('/');
+  });
+});
diff --git a/client/src/lib/rum/routes.ts b/client/src/lib/rum/routes.ts
new file mode 100644
index 00000000000..2388d72f0ef
--- /dev/null
+++ b/client/src/lib/rum/routes.ts
@@ -0,0 +1,31 @@
+const OBJECT_ID = /^[0-9a-f]{24}$/i;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function normalizeSegment(segment: string, previous: string | undefined): string {
+  if (previous === 'c') {
+    return ':conversationId';
+  }
+
+  if (previous === 'share') {
+    return ':shareId';
+  }
+
+  if (previous === 'assistants') {
+    return ':assistantId';
+  }
+
+  if (UUID.test(segment) || OBJECT_ID.test(segment)) {
+    return ':id';
+  }
+
+  return segment;
+}
+
+export function normalizeRumPath(pathname: string): string {
+  const segments = pathname.split('/').filter(Boolean);
+  if (segments.length === 0) {
+    return '/';
+  }
+
+  return `/${segments.map((segment, index) => normalizeSegment(segment, segments[index - 1])).join('/')}`;
+}
diff --git a/client/src/lib/rum/useRum.spec.tsx b/client/src/lib/rum/useRum.spec.tsx
new file mode 100644
index 00000000000..431c20829ef
--- /dev/null
+++ b/client/src/lib/rum/useRum.spec.tsx
@@ -0,0 +1,168 @@
+import { renderHook, waitFor } from '@testing-library/react';
+import useRum from './useRum';
+
+const mockInit = jest.fn();
+const mockSetGlobalAttributes = jest.fn();
+const mockUseGetStartupConfig = jest.fn();
+const mockUseAuthContext = jest.fn();
+const mockUseLocation = jest.fn();
+
+jest.mock('@hyperdx/browser', () => ({
+  __esModule: true,
+  default: {
+    init: (...args: unknown[]) => mockInit(...args),
+    setGlobalAttributes: (...args: unknown[]) => mockSetGlobalAttributes(...args),
+  },
+}));
+
+jest.mock('~/data-provider', () => ({
+  useGetStartupConfig: () => mockUseGetStartupConfig(),
+}));
+
+jest.mock('~/hooks/AuthContext', () => ({
+  useAuthContext: () => mockUseAuthContext(),
+}));
+
+jest.mock('react-router-dom', () => ({
+  ...jest.requireActual('react-router-dom'),
+  useLocation: () => mockUseLocation(),
+}));
+
+describe('useRum', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUseLocation.mockReturnValue({ pathname: '/c/conversation-123' });
+    mockUseAuthContext.mockReturnValue({
+      isAuthenticated: true,
+      token: 'jwt-token',
+      user: {
+        id: 'user-123',
+        role: 'USER',
+        tenantId: 'org-123',
+        email: 'user@example.com',
+      },
+    });
+  });
+
+  it('initializes HyperDX public-token RUM with privacy defaults and safe attributes', async () => {
+    mockUseGetStartupConfig.mockReturnValue({
+      data: {
+        rum: {
+          provider: 'hyperdx',
+          enabled: true,
+          url: 'https://rum.example.com',
+          serviceName: 'librechat-web',
+          authMode: 'publicToken',
+          publicToken: 'public-token',
+          tracePropagationTargets: ['https://librechat.example.com'],
+        },
+      },
+    });
+
+    renderHook(() => useRum());
+
+    await waitFor(() => {
+      expect(mockInit).toHaveBeenCalledWith({
+        advancedNetworkCapture: false,
+        apiKey: 'public-token',
+        consoleCapture: false,
+        disableReplay: true,
+        service: 'librechat-web',
+        tracePropagationTargets: ['https://librechat.example.com'],
+        url: 'https://rum.example.com',
+      });
+    });
+
+    expect(mockSetGlobalAttributes).toHaveBeenCalledWith({
+      route: '/c/:conversationId',
+      role: 'USER',
+      userId: 'user-123',
+      orgId: 'org-123',
+      serviceName: 'librechat-web',
+    });
+    expect(mockSetGlobalAttributes).not.toHaveBeenCalledWith(
+      expect.objectContaining({ email: 'user@example.com' }),
+    );
+  });
+
+  it('does not initialize RUM for unsupported auth modes', async () => {
+    mockUseGetStartupConfig.mockReturnValue({
+      data: {
+        rum: {
+          provider: 'hyperdx',
+          enabled: true,
+          url: 'https://rum.example.com/ingest',
+          serviceName: 'librechat-web',
+          authMode: 'userJwt',
+          publicToken: 'public-token',
+        },
+      },
+    });
+
+    renderHook(() => useRum());
+
+    expect(mockInit).not.toHaveBeenCalled();
+  });
+
+  it('initializes proxy RUM with the LibreChat bearer token for same-origin ingest', async () => {
+    const fetchMock = jest.fn(
+      (_input: RequestInfo | URL, _init?: RequestInit): Promise<Response> =>
+        Promise.resolve({ ok: true, status: 200 } as Response),
+    );
+    window.fetch = Object.assign(fetchMock, { preconnect: () => undefined });
+    mockUseGetStartupConfig.mockReturnValue({
+      data: {
+        rum: {
+          provider: 'hyperdx',
+          enabled: true,
+          url: '/api/rum',
+          serviceName: 'librechat-web',
+          authMode: 'proxy',
+        },
+      },
+    });
+
+    renderHook(() => useRum());
+
+    await waitFor(() => {
+      expect(mockInit).toHaveBeenCalledWith({
+        advancedNetworkCapture: false,
+        apiKey: 'librechat-rum-proxy',
+        consoleCapture: false,
+        disableReplay: true,
+        service: 'librechat-web',
+        tracePropagationTargets: undefined,
+        url: '/api/rum',
+      });
+    });
+
+    await window.fetch('/api/rum/v1/traces', { method: 'POST' });
+
+    const headers = fetchMock.mock.calls[0]?.[1]?.headers;
+    expect(headers).toBeInstanceOf(Headers);
+    expect((headers as Headers).get('authorization')).toBe('Bearer jwt-token');
+  });
+
+  it('does not initialize proxy RUM without an authenticated token', async () => {
+    mockUseAuthContext.mockReturnValue({
+      isAuthenticated: false,
+      token: undefined,
+      user: undefined,
+    });
+    mockUseGetStartupConfig.mockReturnValue({
+      data: {
+        rum: {
+          provider: 'hyperdx',
+          enabled: true,
+          url: '/api/rum',
+          serviceName: 'librechat-web',
+          authMode: 'proxy',
+        },
+      },
+    });
+
+    renderHook(() => useRum());
+
+    expect(mockInit).not.toHaveBeenCalled();
+  });
+});
diff --git a/client/src/lib/rum/useRum.ts b/client/src/lib/rum/useRum.ts
new file mode 100644
index 00000000000..937e809d13a
--- /dev/null
+++ b/client/src/lib/rum/useRum.ts
@@ -0,0 +1,200 @@
+import { useEffect, useMemo, useRef } from 'react';
+import { useLocation } from 'react-router-dom';
+import type { TRumConfig, TUser } from 'librechat-data-provider';
+import { useGetStartupConfig } from '~/data-provider';
+import { useAuthContext } from '~/hooks/AuthContext';
+import { normalizeRumPath } from './routes';
+
+const PROXY_API_KEY = 'librechat-rum-proxy';
+
+let rumProxyToken: string | undefined;
+let rumProxyFetchPatched = false;
+
+type HyperDXBrowser = {
+  init: (config: {
+    advancedNetworkCapture: boolean;
+    apiKey: string;
+    consoleCapture: boolean;
+    disableReplay: boolean;
+    service: string;
+    tracePropagationTargets?: string[];
+    url: string;
+  }) => void;
+  setGlobalAttributes: (attributes: Record<string, string>) => void;
+};
+
+function shouldInitializeRum(config: TRumConfig | undefined, token: string | undefined): boolean {
+  if (!config?.enabled || config.provider !== 'hyperdx' || !config.url || !config.serviceName) {
+    return false;
+  }
+
+  if (config.authMode === 'publicToken') {
+    return !!config.publicToken;
+  }
+
+  return config.authMode === 'proxy' && !!token && !config.publicToken;
+}
+
+function getApiKey(config: TRumConfig, token: string | undefined): string {
+  if (config.authMode === 'proxy') {
+    return token ? PROXY_API_KEY : '';
+  }
+
+  return config.publicToken ?? '';
+}
+
+function isRumProxyRequest(input: RequestInfo | URL, proxyUrl: string): boolean {
+  const rawUrl =
+    typeof Request !== 'undefined' && input instanceof Request ? input.url : input.toString();
+  const url = new URL(rawUrl, window.location.origin);
+  const proxy = new URL(proxyUrl, window.location.origin);
+
+  return url.origin === window.location.origin && url.pathname.startsWith(`${proxy.pathname}/`);
+}
+
+function withAuthorization(
+  input: RequestInfo | URL,
+  init: RequestInit | undefined,
+  token: string,
+): [RequestInfo | URL, RequestInit | undefined] {
+  const headers = new Headers(
+    init?.headers ??
+      (typeof Request !== 'undefined' && input instanceof Request ? input.headers : undefined),
+  );
+  headers.set('authorization', `Bearer ${token}`);
+
+  if (typeof Request !== 'undefined' && input instanceof Request) {
+    return [new Request(input, { ...init, headers }), undefined];
+  }
+
+  return [input, { ...init, headers }];
+}
+
+function ensureRumProxyAuth(proxyUrl: string): void {
+  if (rumProxyFetchPatched || typeof window === 'undefined' || typeof window.fetch !== 'function') {
+    return;
+  }
+
+  const originalFetch = window.fetch.bind(window);
+  const patchedFetch = (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    if (rumProxyToken && isRumProxyRequest(input, proxyUrl)) {
+      const [authorizedInput, authorizedInit] = withAuthorization(input, init, rumProxyToken);
+      return originalFetch(authorizedInput, authorizedInit);
+    }
+
+    return originalFetch(input, init);
+  };
+  window.fetch = Object.assign(patchedFetch, { preconnect: window.fetch.preconnect });
+  rumProxyFetchPatched = true;
+}
+
+function buildGlobalAttributes(
+  user: TUser | undefined,
+  config: TRumConfig,
+  route: string,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries({
+      route,
+      role: user?.role,
+      userId: user?.id,
+      orgId: user?.tenantId,
+      serviceName: config.serviceName,
+      environment: config.environment,
+    }).filter(
+      (entry): entry is [string, string] => typeof entry[1] === 'string' && entry[1] !== '',
+    ),
+  );
+}
+
+async function loadHyperDX(): Promise<HyperDXBrowser> {
+  const module = await import('@hyperdx/browser');
+  return module.default;
+}
+
+export default function useRum(): void {
+  const { data: startupConfig } = useGetStartupConfig();
+  const { token, user } = useAuthContext();
+  const location = useLocation();
+  const initializedKeyRef = useRef<string | undefined>(undefined);
+  const sampledInitKeyRef = useRef<string | undefined>(undefined);
+  const sampledInRef = useRef<boolean>(true);
+  const hyperDxRef = useRef<HyperDXBrowser | undefined>(undefined);
+  const rumConfig = startupConfig?.rum;
+  const route = useMemo(() => normalizeRumPath(location.pathname), [location.pathname]);
+  const routeRef = useRef<string>(route);
+
+  useEffect(() => {
+    routeRef.current = route;
+  }, [route]);
+
+  useEffect(() => {
+    if (!rumConfig) {
+      return;
+    }
+
+    if (!shouldInitializeRum(rumConfig, token)) {
+      if (rumConfig?.authMode === 'proxy') {
+        rumProxyToken = undefined;
+      }
+      return;
+    }
+
+    const config = rumConfig;
+    const apiKey = getApiKey(config, token);
+    if (config.authMode === 'proxy') {
+      rumProxyToken = token;
+      ensureRumProxyAuth(config.url);
+    }
+
+    const initKey = [config.url, config.serviceName, config.authMode, apiKey].join(':');
+
+    if (initializedKeyRef.current === initKey) {
+      return;
+    }
+
+    if (sampledInitKeyRef.current !== initKey) {
+      sampledInitKeyRef.current = initKey;
+      sampledInRef.current =
+        typeof config.sampleRate === 'number' ? Math.random() < config.sampleRate : true;
+    }
+
+    if (!sampledInRef.current) {
+      return;
+    }
+
+    let cancelled = false;
+
+    loadHyperDX()
+      .then((HyperDX) => {
+        if (cancelled || initializedKeyRef.current === initKey) {
+          return;
+        }
+
+        HyperDX.init({
+          advancedNetworkCapture: config.advancedNetworkCapture ?? false,
+          apiKey,
+          consoleCapture: config.consoleCapture ?? false,
+          disableReplay: config.disableReplay ?? true,
+          service: config.serviceName,
+          tracePropagationTargets: config.tracePropagationTargets,
+          url: config.url,
+        });
+
+        hyperDxRef.current = HyperDX;
+        initializedKeyRef.current = initKey;
+        HyperDX.setGlobalAttributes(buildGlobalAttributes(user, config, routeRef.current));
+      })
+      .catch(() => undefined);
+
+    return () => {
+      cancelled = true;
+    };
+  }, [rumConfig, token, user]);
+
+  useEffect(() => {
+    hyperDxRef.current?.setGlobalAttributes(
+      rumConfig ? buildGlobalAttributes(user, rumConfig, route) : { route },
+    );
+  }, [route, rumConfig, user]);
+}
diff --git a/client/src/locales/README.md b/client/src/locales/README.md
index aa40db0f42d..d387a55a8c3 100644
--- a/client/src/locales/README.md
+++ b/client/src/locales/README.md
@@ -13,7 +13,7 @@ To add a new language to LibreChat, follow these steps:
 
 ### 2. Update the Language Selector Component
 
-Edit `client/src/components/Nav/SettingsTabs/General/General.tsx` and add your new language option to the `languageOptions` array:
+Edit `client/src/components/Nav/SettingsTabs/General/Selectors.tsx` and add your new language option to the `languageOptions` array:
 
 ```typescript
 { value: 'language-code', label: localize('com_nav_lang_language_name') },
diff --git a/client/src/locales/Translation.spec.ts b/client/src/locales/Translation.spec.ts
index 6c6e1b7ac83..994edf41662 100644
--- a/client/src/locales/Translation.spec.ts
+++ b/client/src/locales/Translation.spec.ts
@@ -1,48 +1,193 @@
-import i18n from './i18n';
+import type { TranslationResource } from './i18n';
+import {
+  __resetLocaleForTests,
+  __setLocaleLoaderForTests,
+  changeLanguageSafely,
+  ensureLocale,
+  initializeI18n,
+  normalizeLocale,
+} from './i18n';
 import English from './en/translation.json';
-import French from './fr/translation.json';
 import Spanish from './es/translation.json';
+import French from './fr/translation.json';
 import { TranslationKeys } from '~/hooks';
+import i18n from './i18n';
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((promiseResolve, promiseReject) => {
+    resolve = promiseResolve;
+    reject = promiseReject;
+  });
+
+  return { promise, resolve, reject };
+}
 
 describe('i18next translation tests', () => {
   // Ensure i18next is initialized before any tests run
   beforeAll(async () => {
-    if (!i18n.isInitialized) {
-      await i18n.init();
-    }
+    await initializeI18n();
   });
 
-  it('should return the correct translation for a valid key in English', () => {
-    i18n.changeLanguage('en');
+  afterEach(async () => {
+    await changeLanguageSafely('en');
+  });
+
+  it('should return the correct translation for a valid key in English', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('com_ui_examples')).toBe(English.com_ui_examples);
   });
 
-  it('should return the correct translation for a valid key in French', () => {
-    i18n.changeLanguage('fr');
+  it('should return the correct translation for a valid key in French', async () => {
+    await changeLanguageSafely('fr');
     expect(i18n.t('com_ui_examples')).toBe(French.com_ui_examples);
   });
 
-  it('should return the correct translation for a valid key in Spanish', () => {
-    i18n.changeLanguage('es');
+  it('should return the correct translation for a valid key in Spanish', async () => {
+    await changeLanguageSafely('es');
     expect(i18n.t('com_ui_examples')).toBe(Spanish.com_ui_examples);
   });
 
-  it('should fallback to English for an invalid language code', () => {
+  it('should fallback to English for an invalid language code', async () => {
     // When an invalid language is provided, i18next should fallback to English
-    i18n.changeLanguage('invalid-code');
+    await changeLanguageSafely('invalid-code');
     expect(i18n.t('com_ui_examples')).toBe(English.com_ui_examples);
   });
 
-  it('should return the key itself for an invalid key', () => {
-    i18n.changeLanguage('en');
+  it('should return the key itself for an invalid key', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('invalid-key' as TranslationKeys)).toBe('invalid-key'); // Returns the key itself
   });
 
-  it('should correctly format placeholders in the translation', () => {
-    i18n.changeLanguage('en');
+  it('should correctly format placeholders in the translation', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('com_endpoint_default_with_num', { 0: 'John' })).toBe('default: John');
 
-    i18n.changeLanguage('fr');
+    await changeLanguageSafely('fr');
     expect(i18n.t('com_endpoint_default_with_num', { 0: 'Marie' })).toBe('par défaut : Marie');
   });
+
+  it('should normalize language selector values to locale files', () => {
+    expect(normalizeLocale('en-US')).toBe('en');
+    expect(normalizeLocale('de-DE')).toBe('de');
+    expect(normalizeLocale('fr-FR')).toBe('fr');
+    expect(normalizeLocale('ar-EG')).toBe('ar');
+    expect(normalizeLocale('he-IL')).toBe('he');
+    expect(normalizeLocale('nl-NL')).toBe('nl');
+    expect(normalizeLocale('pl-PL')).toBe('pl');
+    expect(normalizeLocale('uk-UA')).toBe('uk');
+    expect(normalizeLocale('zh-Hans')).toBe('zh-Hans');
+    expect(normalizeLocale('zh-Hant')).toBe('zh-Hant');
+    expect(normalizeLocale('pt-BR')).toBe('pt-BR');
+    expect(normalizeLocale('pt-PT')).toBe('pt-PT');
+  });
+
+  it('should reuse an in-flight locale load', async () => {
+    __resetLocaleForTests('sv');
+    const pendingLocale = deferred<{ default: TranslationResource }>();
+    const loadLocale = jest.fn(() => pendingLocale.promise);
+    const restoreLoader = __setLocaleLoaderForTests('sv', loadLocale);
+
+    const firstLoad = ensureLocale('sv-SE');
+    const secondLoad = ensureLocale('sv-SE');
+
+    expect(loadLocale).toHaveBeenCalledTimes(1);
+
+    pendingLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+
+    await expect(Promise.all([firstLoad, secondLoad])).resolves.toEqual(['sv', 'sv']);
+    expect(i18n.getResource('sv', 'translation', 'com_ui_examples')).toBe('svenska exempel');
+
+    restoreLoader();
+    __resetLocaleForTests('sv');
+  });
+
+  it('should retry a locale load after a transient failure', async () => {
+    __resetLocaleForTests('ka');
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+    let callCount = 0;
+    const restoreLoader = __setLocaleLoaderForTests('ka', async () => {
+      callCount += 1;
+      if (callCount === 1) {
+        throw new Error('temporary chunk failure');
+      }
+
+      return { default: { com_ui_examples: 'ქართული მაგალითები' } };
+    });
+
+    await expect(ensureLocale('ka-GE')).resolves.toBe('en');
+    await expect(ensureLocale('ka-GE')).resolves.toBe('ka');
+
+    expect(callCount).toBe(2);
+    expect(i18n.getResource('ka', 'translation', 'com_ui_examples')).toBe('ქართული მაგალითები');
+
+    restoreLoader();
+    __resetLocaleForTests('ka');
+    consoleErrorSpy.mockRestore();
+  });
+
+  it('should only apply the newest rapid language switch', async () => {
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('ka');
+    __resetLocaleForTests('sl');
+
+    const svLocale = deferred<{ default: TranslationResource }>();
+    const kaLocale = deferred<{ default: TranslationResource }>();
+    const slLocale = deferred<{ default: TranslationResource }>();
+    const restoreSv = __setLocaleLoaderForTests('sv', () => svLocale.promise);
+    const restoreKa = __setLocaleLoaderForTests('ka', () => kaLocale.promise);
+    const restoreSl = __setLocaleLoaderForTests('sl', () => slLocale.promise);
+
+    const firstSwitch = changeLanguageSafely('sv-SE');
+    const secondSwitch = changeLanguageSafely('ka-GE');
+    const latestSwitch = changeLanguageSafely('sl');
+
+    svLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+    await firstSwitch;
+    expect(i18n.language).not.toBe('sv');
+
+    kaLocale.resolve({ default: { com_ui_examples: 'ქართული მაგალითები' } });
+    await secondSwitch;
+    expect(i18n.language).not.toBe('ka');
+
+    slLocale.resolve({ default: { com_ui_examples: 'slovenski primeri' } });
+    await expect(latestSwitch).resolves.toBe('sl');
+    expect(i18n.language).toBe('sl');
+    expect(document.documentElement.lang).toBe('sl');
+
+    restoreSv();
+    restoreKa();
+    restoreSl();
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('ka');
+    __resetLocaleForTests('sl');
+  });
+
+  it('should restore the newest language if an older change finishes late', async () => {
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('sl');
+
+    const svLocale = deferred<{ default: TranslationResource }>();
+    const slLocale = deferred<{ default: TranslationResource }>();
+    const restoreSv = __setLocaleLoaderForTests('sv', () => svLocale.promise);
+    const restoreSl = __setLocaleLoaderForTests('sl', () => slLocale.promise);
+
+    const firstSwitch = changeLanguageSafely('sv-SE');
+    const latestSwitch = changeLanguageSafely('sl');
+
+    slLocale.resolve({ default: { com_ui_examples: 'slovenski primeri' } });
+    await expect(latestSwitch).resolves.toBe('sl');
+    expect(i18n.language).toBe('sl');
+
+    svLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+    await firstSwitch;
+    expect(i18n.language).toBe('sl');
+    expect(document.documentElement.lang).toBe('sl');
+
+    restoreSv();
+    restoreSl();
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('sl');
+  });
 });
diff --git a/client/src/locales/ar/translation.json b/client/src/locales/ar/translation.json
index fe9ff280f34..773dba937eb 100644
--- a/client/src/locales/ar/translation.json
+++ b/client/src/locales/ar/translation.json
@@ -264,9 +264,8 @@
   "com_nav_balance_day": "يوم",
   "com_nav_balance_days": "أيام",
   "com_nav_balance_every": "كل",
-  "com_nav_balance_hour": "ساع",
   "com_nav_balance_hours": "ساعات",
-  "com_nav_balance_interval": "الفترة",
+  "com_nav_balance_interval": "المدة",
   "com_nav_balance_minute": "دقيقة",
   "com_nav_balance_minutes": "دقائق",
   "com_nav_balance_month": "شهر",
@@ -277,15 +276,12 @@
   "com_nav_balance_weeks": "أسابيع",
   "com_nav_browser": "المتصفح",
   "com_nav_change_picture": "تغيير الصورة",
-  "com_nav_chat_commands": "أوامر الدردشة",
-  "com_nav_chat_commands_info": "يتم تفعيل هذه الأوامر عن طريق كتابة رموز محددة في بداية رسالتك. يتم تشغيل كل أمر بواسطة البادئة المخصصة له. يمكنك تعطيلها إذا كنت تستخدم هذه الرموز بشكل متكرر في بداية رسائلك.",
   "com_nav_chat_direction": "اتجاه الدردشة",
   "com_nav_clear_all_chats": "مسح كل الدردشات",
   "com_nav_clear_cache_confirm_message": "هل أنت متأكد أنك تريد مسح ذاكرة التخزين المؤقت؟",
   "com_nav_clear_conversation": "مسح المحادثات",
   "com_nav_clear_conversation_confirm_message": "هل أنت متأكد أنك تريد مسح جميع المحادثات؟ هذا لا يمكن التراجع عنه.",
   "com_nav_close_sidebar": "إغلاق القائمة الجانبية",
-  "com_nav_commands": "الأوامر",
   "com_nav_confirm_clear": "تأكيد المسح",
   "com_nav_control_panel": "لوحة التحكم",
   "com_nav_conversation_mode": "وضع المحادثة",
@@ -379,7 +375,6 @@
   "com_nav_send_message": "إرسال رسالة",
   "com_nav_setting_account": "الحساب",
   "com_nav_setting_chat": "دردشة",
-  "com_nav_setting_data": "تحكم في البيانات",
   "com_nav_setting_general": "عام",
   "com_nav_setting_speech": "الكلام",
   "com_nav_settings": "الإعدادات",
@@ -670,7 +665,6 @@
   "com_ui_show_image_details": "إظهار تفاصيل الصورة",
   "com_ui_show_qr": "إظهار رمز الـ QR",
   "com_ui_sign_in_to_domain": "تسجيل الدخول الى {{0}}",
-  "com_ui_simple": "بسيط",
   "com_ui_size": "الحجم",
   "com_ui_special_var_current_date": "التاريخ الآن",
   "com_ui_special_var_current_datetime": "التاريخ والوقت الآن",
diff --git a/client/src/locales/ca/translation.json b/client/src/locales/ca/translation.json
index 06d5c449509..faf7850836d 100644
--- a/client/src/locales/ca/translation.json
+++ b/client/src/locales/ca/translation.json
@@ -300,15 +300,12 @@
   "com_nav_browser": "Navegador",
   "com_nav_center_chat_input": "Centra la entrada del xat a la pantalla de benvinguda",
   "com_nav_change_picture": "Canvia la imatge",
-  "com_nav_chat_commands": "Comandes de xat",
-  "com_nav_chat_commands_info": "Aquestes comandes s'activen escrivint caràcters específics a l'inici del missatge. Cada comanda es dispara pel seu prefix. Pots desactivar-les si sovint comences missatges amb aquests caràcters.",
   "com_nav_chat_direction": "Direcció del xat",
   "com_nav_clear_all_chats": "Esborra tots els xats",
   "com_nav_clear_cache_confirm_message": "Segur que vols esborrar la memòria cau?",
   "com_nav_clear_conversation": "Esborra converses",
   "com_nav_clear_conversation_confirm_message": "Segur que vols esborrar totes les converses? Aquesta acció és irreversible.",
   "com_nav_close_sidebar": "Tanca la barra lateral",
-  "com_nav_commands": "Comandes",
   "com_nav_confirm_clear": "Confirma l'esborrat",
   "com_nav_conversation_mode": "Mode de conversa",
   "com_nav_convo_menu_options": "Opcions del menú de conversa",
@@ -404,7 +401,6 @@
   "com_nav_send_message": "Envia missatge",
   "com_nav_setting_account": "Compte",
   "com_nav_setting_chat": "Xat",
-  "com_nav_setting_data": "Controls de dades",
   "com_nav_setting_general": "General",
   "com_nav_setting_speech": "Veu",
   "com_nav_settings": "Configuració",
@@ -780,7 +776,6 @@
   "com_ui_show_all": "Mostra-ho tot",
   "com_ui_show_qr": "Mostra el codi QR",
   "com_ui_sign_in_to_domain": "Inicia sessió a {{0}}",
-  "com_ui_simple": "Simple",
   "com_ui_size": "Mida",
   "com_ui_special_var_current_date": "Data actual",
   "com_ui_special_var_current_datetime": "Data i hora actuals",
diff --git a/client/src/locales/cs/translation.json b/client/src/locales/cs/translation.json
index b8ccb07d85c..a78dba4f78e 100644
--- a/client/src/locales/cs/translation.json
+++ b/client/src/locales/cs/translation.json
@@ -12,6 +12,7 @@
   "com_agents_instructions_placeholder": "Systémové instrukce, které agent používá",
   "com_agents_link_copied": "Odkaz zkopírován",
   "com_agents_link_copy_failed": "Kopírování odkazu se nezdařilo",
+  "com_agents_marketplace": "Tržiště agentů",
   "com_agents_missing_provider_model": "Před vytvořením agenta vyberte poskytovatele a model.",
   "com_agents_name_placeholder": "Volitelné: Název agenta",
   "com_agents_no_access": "Nemáte oprávnění upravovat tohoto agenta.",
@@ -208,15 +209,12 @@
   "com_nav_balance": "Zůstatek",
   "com_nav_browser": "Prohlížeč",
   "com_nav_change_picture": "Změnit obrázek",
-  "com_nav_chat_commands": "Příkazy chatu",
-  "com_nav_chat_commands_info": "Tyto příkazy se aktivují zadáním specifických znaků na začátku vaší zprávy. Každý příkaz je spuštěn svým určeným prefixem. Můžete je deaktivovat, pokud tyto znaky často používáte na začátku zpráv.",
   "com_nav_chat_direction": "Směr chatu",
   "com_nav_clear_all_chats": "Vymazat všechny chaty",
   "com_nav_clear_cache_confirm_message": "Opravdu chcete vymazat mezipaměť?",
   "com_nav_clear_conversation": "Vymazat konverzace",
   "com_nav_clear_conversation_confirm_message": "Opravdu chcete vymazat všechny konverzace? Tuto akci nelze vrátit zpět.",
   "com_nav_close_sidebar": "Zavřít boční panel",
-  "com_nav_commands": "Příkazy",
   "com_nav_confirm_clear": "Potvrdit vymazání",
   "com_nav_conversation_mode": "Režim konverzace",
   "com_nav_convo_menu_options": "Možnosti menu konverzace",
@@ -298,7 +296,6 @@
   "com_nav_send_message": "Odeslat zprávu",
   "com_nav_setting_account": "Účet",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Ovládání dat",
   "com_nav_setting_general": "Obecné",
   "com_nav_setting_speech": "Hlas",
   "com_nav_settings": "Nastavení",
@@ -548,6 +545,7 @@
   "com_ui_locked": "Zamčeno",
   "com_ui_logo": "Logo {{0}}",
   "com_ui_manage": "Spravovat",
+  "com_ui_marketplace": "Tržiště",
   "com_ui_max_tags": "Maximální povolený počet je {{0}}, používám nejnovější hodnoty.",
   "com_ui_mention": "Zmiňte koncový bod, asistenta nebo předvolbu pro rychlé přepnutí",
   "com_ui_min_tags": "Nelze odebrat další hodnoty, minimální počet je {{0}}.",
@@ -638,7 +636,6 @@
   "com_ui_show_all": "Zobrazit vše",
   "com_ui_show_qr": "Zobrazit QR kód",
   "com_ui_sign_in_to_domain": "Přihlásit se do {{0}}",
-  "com_ui_simple": "Jednoduché",
   "com_ui_size": "Velikost",
   "com_ui_special_variables": "Speciální proměnné:",
   "com_ui_speech_while_submitting": "Nelze odeslat hlasový vstup, zatímco se generuje odpověď",
diff --git a/client/src/locales/da/translation.json b/client/src/locales/da/translation.json
index 1a62720d15d..4d29b3cd4d9 100644
--- a/client/src/locales/da/translation.json
+++ b/client/src/locales/da/translation.json
@@ -303,15 +303,12 @@
   "com_nav_browser": "Browser",
   "com_nav_center_chat_input": "Center Chat Input på velkomstskærmen",
   "com_nav_change_picture": "Skift billede",
-  "com_nav_chat_commands": "Chat-kommandoer",
-  "com_nav_chat_commands_info": "Disse kommandoer aktiveres ved at skrive bestemte tegn i begyndelsen af din besked. Hver kommando udløses af det angivne præfiks. Du kan deaktivere dem, hvis du ofte bruger disse tegn til at starte beskeder.",
   "com_nav_chat_direction": "Chat-retning",
   "com_nav_clear_all_chats": "Ryd alle chats",
   "com_nav_clear_cache_confirm_message": "Er du sikker på, at du vil rydde cachen?",
   "com_nav_clear_conversation": "Ryd samtaler",
   "com_nav_clear_conversation_confirm_message": "Er du sikker på, at du vil slette alle samtaler? Dette kan ikke fortrydes.",
   "com_nav_close_sidebar": "Luk sidepanelet",
-  "com_nav_commands": "Kommandoer",
   "com_nav_confirm_clear": "Bekræft Ryd",
   "com_nav_conversation_mode": "Samtaletilstand",
   "com_nav_convo_menu_options": "Menuindstillinger for samtale",
@@ -406,9 +403,7 @@
   "com_nav_search_placeholder": "Søg efter beskeder",
   "com_nav_send_message": "Send besked",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Balance",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Datakontrol",
   "com_nav_setting_general": "Generel",
   "com_nav_setting_speech": "Tale",
   "com_nav_settings": "Indstillinger",
@@ -801,7 +796,6 @@
   "com_ui_show_all": "Vis alle",
   "com_ui_show_qr": "Vis QR-kode",
   "com_ui_sign_in_to_domain": "Log ind på {{0}}",
-  "com_ui_simple": "Enkel",
   "com_ui_size": "Størrelse",
   "com_ui_special_var_current_date": "Aktuel dato",
   "com_ui_special_var_current_datetime": "Aktuel dato og tid",
diff --git a/client/src/locales/de/translation.json b/client/src/locales/de/translation.json
index 6514037d99d..4d3a34f5590 100644
--- a/client/src/locales/de/translation.json
+++ b/client/src/locales/de/translation.json
@@ -2,9 +2,13 @@
   "chat_direction_left_to_right": "Links nach Rechts",
   "chat_direction_right_to_left": "Rechts nach Links",
   "com_a11y_ai_composing": "Die KI erstellt noch ihre Antwort.\n",
+  "com_a11y_chats_date_section": "Chats vom {{date}}",
   "com_a11y_end": "Die KI hat die Antwort fertiggestellt.",
   "com_a11y_selected": "ausgewählt",
   "com_a11y_start": "Die KI hat mit ihrer Antwort begonnen. ",
+  "com_a11y_summarize_completed": "Kontext zusammengefasst.",
+  "com_a11y_summarize_failed": "Zusammenfassung fehlgeschlagen, fahre mit vorhandenem Kontext fort.",
+  "com_a11y_summarize_started": "Kontext wird zusammengefasst.",
   "com_agents_agent_card_label": "{{name}} Agent. {{description}}",
   "com_agents_all": "Alle Agenten",
   "com_agents_all_category": "Alle",
@@ -86,6 +90,8 @@
   "com_agents_not_available": "Agent nicht verfügbar",
   "com_agents_recommended": "Unsere empfohlenen Agenten",
   "com_agents_results_for": "Ergebnisse für '{{query}}'",
+  "com_agents_run_code_files": "Die folgenden Dateien sind nur für die Code-Umgebung bestimmt:",
+  "com_agents_run_code_info": "Wenn aktiviert, kann dein Agent generierten Code sicher ausführen, einschließlich Dateiverarbeitung.",
   "com_agents_search_aria": "Nach Agenten suchen",
   "com_agents_search_empty_heading": "Keine Suchergebnisse",
   "com_agents_search_info": "Wenn diese Funktion aktiviert ist, kann der Agent im Internet nach aktuellen Informationen suchen. Erfordert einen gültigen API-Schlüssel.",
@@ -217,12 +223,15 @@
   "com_endpoint_agent": "Agent",
   "com_endpoint_agent_placeholder": "Bitte wähle einen Agenten aus",
   "com_endpoint_ai": "KI",
-  "com_endpoint_anthropic_effort": "Steuert, wie viel Rechenaufwand Claude betreibt. Ein geringerer Aufwand spart Token und verringert die Latenz; ein höherer Aufwand führt zu gründlicheren Antworten. ‚Max‘ ermöglicht das tiefste Reasoning (nur Opus 4.6).",
+  "com_endpoint_anthropic_effort": "Steuert, wie viel Rechenaufwand Claude aufbringt. Ein geringerer Aufwand spart Token und verkürzt die Latenzzeit; ein höherer Aufwand führt zu gründlicheren Antworten. 'Max' ermöglicht die tiefste Denkleistung bei unterstützten Modellen mit adaptivem Denken.",
   "com_endpoint_anthropic_maxoutputtokens": "Maximale Anzahl von Token, die in der Antwort erzeugt werden können. Gib einen niedrigeren Wert für kürzere Antworten und einen höheren Wert für längere Antworten an. Hinweis: Die Modelle können auch vor Erreichen dieses Maximums stoppen.",
   "com_endpoint_anthropic_prompt_cache": "Prompt-Caching ermöglicht die Wiederverwendung von umfangreichen Kontexten oder Anweisungen über mehrere API-Aufrufe hinweg, wodurch Kosten und Latenzzeiten reduziert werden",
+  "com_endpoint_anthropic_prompt_cache_ttl": "Wie lange ein zwischengespeicherter Prompt-Präfix zwischen Anfragen warm bleibt. Leer lassen, um den Standard des Anbieters zu verwenden (1 Stunde). Der 1-Stunden-Cache hält den Präfix auch über längere Pausen hinweg warm, verursacht aber einmalig höhere Schreibkosten. Wähle 5 Minuten für das bisherige Verhalten.",
   "com_endpoint_anthropic_temp": "Reicht von 0 bis 1. Verwende Temperaturen näher an 0 für analytische / Multiple-Choice-Aufgaben und näher an 1 für kreative und generative Aufgaben. Wir empfehlen, entweder dies oder Top P zu ändern, aber nicht beides.",
   "com_endpoint_anthropic_thinking": "Aktiviert das interne Reasoning für unterstützte Claude-Modelle. Bei neueren Modellen (Opus 4.6+) wird adaptives Denken genutzt, das über den Parameter „Aufwand“ gesteuert wird. Bei älteren Modellen muss ein „Thinking Budget“ festgelegt werden, das unter den „Max Output Tokens“ liegt.",
   "com_endpoint_anthropic_thinking_budget": "Bestimmt die maximale Anzahl an Token, die Claude für seinen internen Denkprozess verwenden darf. Ein höheres Budget kann die Antwortqualität verbessern, indem es eine gründlichere Analyse bei komplexen Problemen ermöglicht. Claude nutzt jedoch möglicherweise nicht das gesamte zugewiesene Budget, insbesondere bei Werten über 32.000. Diese Einstellung muss niedriger sein als \"Max. Ausgabe-Token\".",
+  "com_endpoint_anthropic_thinking_display": "Sichtbarkeit des Denkprozesses",
+  "com_endpoint_anthropic_thinking_display_desc": "Steuert, ob Claudes Denkprozess zurückgegeben wird. „Auto“ aktiviert zusammengefasste Gedankengänge für Modelle, die sie standardmäßig ausblenden (Opus 4.7+). „Zusammengefasst“ zeigt sie immer an. „Ausgeblendet“ blendet sie immer aus und sorgt für etwas geringere Latenz.",
   "com_endpoint_anthropic_topk": "Top-k ändert, wie das Modell Token für die Ausgabe auswählt. Ein Top-k von 1 bedeutet, dass das ausgewählte Token das wahrscheinlichste unter allen Token im Vokabular des Modells ist (auch \"Greedy Decoding\" genannt), während ein Top-k von 3 bedeutet, dass das nächste Token aus den 3 wahrscheinlichsten Token ausgewählt wird (unter Verwendung der Temperatur).",
   "com_endpoint_anthropic_topp": "Top-p ändert, wie das Modell Token für die Ausgabe auswählt. Token werden von den wahrscheinlichsten K (siehe topK-Parameter) bis zu den am wenigsten wahrscheinlichen ausgewählt, bis die Summe ihrer Wahrscheinlichkeiten dem Top-p-Wert entspricht.",
   "com_endpoint_anthropic_use_web_search": "Ermöglichen Sie die Websuche über die integrierten Suchfähigkeiten von Anthropic. Das Modell kann so das Web nach aktuellen Informationen durchsuchen und präzisere, aktuellere Antworten geben.",
@@ -230,6 +239,11 @@
   "com_endpoint_assistant_model": "Assistentenmodell",
   "com_endpoint_assistant_placeholder": "Bitte wähle einen Assistenten aus dem rechten Seitenpanel aus",
   "com_endpoint_bedrock_reasoning_effort": "Steuert die Intensität des Nachdenkens für unterstützte Bedrock-Modelle (z. B. Kimi K2.5, GLM). Höhere Stufen führen zu gründlicherem Nachdenken auf Kosten von erhöhter Latenz und mehr Tokens.",
+  "com_endpoint_config_bedrock_access_key_id": "AWS Access Key ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API-Schlüssel",
+  "com_endpoint_config_bedrock_credentials_required": "Bitte gib entweder einen AWS Bedrock API-Schlüssel oder AWS-Zugangsschlüssel an (Access Key ID + Secret Access Key).",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS Secret Access Key",
+  "com_endpoint_config_bedrock_session_token": "AWS Session Token",
   "com_endpoint_config_click_here": "Klicke hier",
   "com_endpoint_config_google_api_info": "Um deinen Generative Language API-Key (für Gemini) zu erhalten,",
   "com_endpoint_config_google_api_key": "Google API-Key",
@@ -250,6 +264,7 @@
   "com_endpoint_config_key_name": "API-Key",
   "com_endpoint_config_key_never_expires": "Dein API-Key läuft nie ab",
   "com_endpoint_config_placeholder": "Lege deinen API-Key im Kopfzeilenmenü fest, um zu chatten.",
+  "com_endpoint_config_required_fields": "Die folgenden Felder sind erforderlich:",
   "com_endpoint_config_value": "Wert eingeben für",
   "com_endpoint_context": "Kontext",
   "com_endpoint_context_info": "Die maximale Anzahl von Token, die für den Kontext verwendet werden können. Verwende dies zur Kontrolle, wie viele Token pro Anfrage gesendet werden. Wenn nicht angegeben, werden Systemstandards basierend auf der bekannten Kontextgröße der Modelle verwendet. Das Setzen höherer Werte kann zu Fehlern und/oder höheren Token-Kosten führen.",
@@ -322,6 +337,8 @@
   "com_endpoint_presets": "Voreinstellungen",
   "com_endpoint_presets_clear_warning": "Bist du sicher, dass du alle Voreinstellungen löschen möchtest? Dies ist nicht rückgängig zu machen.",
   "com_endpoint_prompt_cache": "Prompt-Zwischenspeicherung verwenden",
+  "com_endpoint_prompt_cache_ttl": "Prompt Cache Dauer",
+  "com_endpoint_prompt_cache_ttl_default": "Standard (1 Stunde)",
   "com_endpoint_prompt_prefix": "Benutzerdefinierte Anweisungen",
   "com_endpoint_prompt_prefix_assistants": "Zusätzliche Anweisungen",
   "com_endpoint_prompt_prefix_assistants_placeholder": "Lege zusätzliche Anweisungen oder Kontext zusätzlich zu den Hauptanweisungen des Assistenten fest. Wird ignoriert, wenn leer.",
@@ -368,6 +385,7 @@
   "com_error_no_base_url": "Keine Basis-URL gefunden. Bitte gebe eine ein und versuche es erneut.",
   "com_error_no_user_key": "Kein API-Key gefunden. Bitte gebe einen API-Key ein und versuche es erneut.",
   "com_error_refusal": "Antwort von Sicherheitsfiltern verweigert. Formulieren Sie Ihre Nachricht um und versuchen Sie es erneut. Sollte dies bei der Verwendung von Claude Sonnet 4.5 oder Opus 4.1 häufig auftreten, versuchen Sie es mit Sonnet 4, da hier andere Nutzungsbeschränkungen gelten.",
+  "com_error_stream_expired": "Der Antwort-Stream ist abgelaufen oder wurde bereits abgeschlossen. Bitte versuche es erneut.",
   "com_file_pages": "Seiten: {{pages}}",
   "com_file_source": "Datei",
   "com_file_unknown": "Unbekannte Datei",
@@ -390,8 +408,17 @@
   "com_hide_examples": "Beispiele ausblenden",
   "com_info_heic_converting": "HEIC-Bild wird in JPEG konventiert...",
   "com_nav_2fa": "Zwei-Faktor-Authentifizierung (2FA)",
+  "com_nav_about_branch": "Branch",
+  "com_nav_about_build_date": "Erstellt",
+  "com_nav_about_commit": "Commit",
+  "com_nav_about_diagnostics_copied": "In die Ablage kopiert",
+  "com_nav_about_diagnostics_copy": "Diagnoseinformationen kopieren",
+  "com_nav_about_diagnostics_description": "Diesen Abschnitt kopieren, damit Maintainer den konkreten Build identifizieren können",
+  "com_nav_about_version": "Version",
   "com_nav_account_settings": "Kontoeinstellungen",
-  "com_nav_always_make_prod": "Neue Versionen direkt produktiv nehmen",
+  "com_nav_advanced_prompts": "Erweiterter Prompt-Editor",
+  "com_nav_advanced_prompts_desc": "Aktiviere Versionierung und Produktionskontrolle für Prompts.",
+  "com_nav_always_make_prod": "Übernehme neue Prompt Versionen immer auf Produktiv",
   "com_nav_archive_created_at": "Archivierungsdatum",
   "com_nav_archive_name": "Name",
   "com_nav_archived_chats": "Archivierte Chats",
@@ -399,8 +426,10 @@
   "com_nav_at_command_description": "Schaltet den Befehl \"@\" zum Wechseln von Endpunkten, Modellen, Voreinstellungen usw. um.",
   "com_nav_audio_play_error": "Fehler beim Abspielen des Audios: {{0}}",
   "com_nav_audio_process_error": "Fehler bei der Verarbeitung des Audios: {{0}}",
+  "com_nav_auto_expand_tools": "Tool-Details automatisch aufklappen",
   "com_nav_auto_scroll": "Automatisch zur neuesten Nachricht scrollen, wenn der Chat geöffnet wird",
-  "com_nav_auto_send_prompts": "Prompts automatisch senden",
+  "com_nav_auto_send_prompts": "Prompts beim Auswählen automatisch senden",
+  "com_nav_auto_send_prompts_desc": "Ausgewählten Prompt automatisch an den Chat senden.",
   "com_nav_auto_send_text": "Text automatisch senden",
   "com_nav_auto_transcribe_audio": "Audio automatisch transkribieren",
   "com_nav_automatic_playback": "Automatische Wiedergabe der neuesten Nachricht",
@@ -429,8 +458,6 @@
   "com_nav_browser": "Browser",
   "com_nav_center_chat_input": "Chat-Eingabe im Willkommensbildschirm zentrieren",
   "com_nav_change_picture": "Bild ändern",
-  "com_nav_chat_commands": "Chat-Befehle",
-  "com_nav_chat_commands_info": "Diese Befehle werden aktiviert, indem du bestimmte Zeichen am Anfang deiner Nachricht eingibst. Jeder Befehl wird durch sein festgelegtes Präfix ausgelöst. Du kannst sie deaktivieren, wenn du diese Zeichen häufig zum Beginn deiner Nachrichten verwendest.",
   "com_nav_chat_direction": "Chat-Richtung",
   "com_nav_chat_direction_selected": "Chat-Richtung: {{direction}}",
   "com_nav_clear_all_chats": "Alle Chats löschen",
@@ -438,7 +465,6 @@
   "com_nav_clear_conversation": "Konversationen löschen",
   "com_nav_clear_conversation_confirm_message": "Bist du sicher, dass du alle Konversationen löschen möchtest? Dies ist nicht rückgängig zu machen.",
   "com_nav_close_sidebar": "Seitenleiste schließen",
-  "com_nav_commands": "Befehle",
   "com_nav_confirm_clear": "Löschen bestätigen",
   "com_nav_control_panel": "Kontrollzentrum",
   "com_nav_conversation_mode": "Konversationsmodus",
@@ -551,6 +577,7 @@
   "com_nav_mcp_vars_updated": "Die MCP-Benutzervariablen wurden erfolgreich aktualisiert.",
   "com_nav_modular_chat": "Ermöglicht das Wechseln der Endpunkte mitten im Gespräch",
   "com_nav_my_files": "Meine Dateien",
+  "com_nav_new_chat_switch_to_history": "Bei neuem Chat zum Chatverlauf wechseln",
   "com_nav_not_supported": "Nicht unterstützt",
   "com_nav_open_sidebar": "Seitenleiste öffnen",
   "com_nav_playback_rate": "Audio-Wiedergabegeschwindigkeit",
@@ -563,14 +590,12 @@
   "com_nav_scroll_button": "Zum Ende scrollen Button",
   "com_nav_search_placeholder": "Nachrichten durchsuchen",
   "com_nav_send_message": "Nachricht senden",
+  "com_nav_setting_about": "Über",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Datensteuerung",
   "com_nav_setting_delay": "Verzögerung (s)",
   "com_nav_setting_general": "Allgemein",
   "com_nav_setting_mcp": "MCP Einstellungen",
-  "com_nav_setting_personalization": "Personalisierung",
   "com_nav_setting_speech": "Sprache",
   "com_nav_settings": "Einstellungen",
   "com_nav_shared_links": "Geteilte Links",
@@ -638,23 +663,26 @@
   "com_ui_add_first_bookmark": "Klicke auf einen Chat, um ihn hinzuzufügen",
   "com_ui_add_first_mcp_server": "Erstelle deinen ersten MCP-Server, um loszulegen",
   "com_ui_add_first_prompt": "Erstelle deinen ersten Prompt, um zu starten",
+  "com_ui_add_labels": "Labels hinzufügen",
   "com_ui_add_mcp": "MCP hinzufügen",
   "com_ui_add_mcp_server": "MCP Server hinzufügen",
   "com_ui_add_model_preset": "Ein KI-Modell oder eine Voreinstellung für eine zusätzliche Antwort hinzufügen",
   "com_ui_add_multi_conversation": "Mehrere Chats hinzufügen",
+  "com_ui_add_skills": "Skills hinzufügen",
   "com_ui_add_special_variables": "Spezielle Variablen hinzufügen",
+  "com_ui_add_to_chat": "Zum Chat hinzufügen",
   "com_ui_add_web_search_api_keys": "Web-Suche API-Schlüssel hinzufügen",
   "com_ui_adding_details": "Hinzufügen von Details\n",
   "com_ui_additional_details": "Zusätzliche Details",
   "com_ui_admin": "Admin",
   "com_ui_admin_access_warning": "Das Deaktivieren des Admin-Zugriffs auf diese Funktion kann zu unerwarteten Problemen in der Benutzeroberfläche führen, die ein Neuladen erfordern. Nach dem Speichern kann dies nur über die Schnittstelleneinstellung in der librechat.yaml-Konfiguration rückgängig gemacht werden, was sich auf alle Rollen auswirkt.",
+  "com_ui_admin_panel": "Adminbereich",
   "com_ui_admin_settings": "Admin-Einstellungen",
   "com_ui_admin_settings_section": "Admin-Einstellungen - {{section}}",
   "com_ui_advanced": "Erweitert",
   "com_ui_advanced_settings": "Erweiterte Einstellungen",
   "com_ui_agent": "Agent",
   "com_ui_agent_api_keys": "Agenten-API-Schlüssel",
-  "com_ui_agent_api_keys_description": "Erstelle API-Schlüssel, um per API remote auf Agenten zuzugreifen.",
   "com_ui_agent_category_aftersales": "Kundendienst",
   "com_ui_agent_category_finance": "Finanzen",
   "com_ui_agent_category_general": "Allgemein",
@@ -668,6 +696,7 @@
   "com_ui_agent_chain_max": "Du hast die maximale Anzahl von {{0}} Agenten erreicht.",
   "com_ui_agent_delete_error": "Beim Löschen des Assistenten ist ein Fehler aufgetreten",
   "com_ui_agent_deleted": "Agent erfolgreich gelöscht",
+  "com_ui_agent_description": "Agentenbeschreibung",
   "com_ui_agent_duplicate_error": "Beim Duplizieren des Assistenten ist ein Fehler aufgetreten",
   "com_ui_agent_duplicated": "Agent wurde erfolgreich dupliziert",
   "com_ui_agent_handoff_add": "Übergabe-Agent hinzufügen",
@@ -681,9 +710,21 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "Benenne den übergebenen Inhalt (Standard: 'instructions')\n",
   "com_ui_agent_handoff_prompt_placeholder": "Sag diesem Agenten, welchen Inhalt er generieren und an den Übergabe-Agenten weiterleiten soll. Du musst hier etwas eingeben, um diese Funktion zu aktivieren.",
   "com_ui_agent_handoffs": "Agenten-Übergaben",
+  "com_ui_agent_name": "Agentenname",
   "com_ui_agent_name_is_required": "Ein Agentenname ist erforderlich.",
   "com_ui_agent_recursion_limit": "Maximale Agenten-Schritte",
   "com_ui_agent_recursion_limit_info": "Begrenzt, wie viele Schritte der Agent in einem Durchlauf ausführen kann, bevor er eine endgültige Antwort gibt. Der Standardwert ist 25 Schritte. Ein Schritt ist entweder eine KI-API-Anfrage oder eine Werkzeugnutzungsrunde. Eine einfache Werkzeuginteraktion umfasst beispielsweise 3 Schritte: die ursprüngliche Anfrage, die Werkzeugnutzung und die Folgeanfrage.",
+  "com_ui_agent_subagents": "Unteragenten",
+  "com_ui_agent_subagents_add": "Unteragent hinzufügen",
+  "com_ui_agent_subagents_agents": "Zusätzliche Unteragenten",
+  "com_ui_agent_subagents_allow_self": "Selbstaufruf erlauben",
+  "com_ui_agent_subagents_allow_self_info": "Erlaube diesem Agenten, fokussierte Teilaufgaben an eine Kopie von sich selbst in einem isolierten Kontextfenster zu delegieren.",
+  "com_ui_agent_subagents_empty": "Keine Subagenten verfügbar: Erlaube den Selbstaufruf oder füge mindestens einen Agenten hinzu.",
+  "com_ui_agent_subagents_enable": "Unteragenten aktivieren",
+  "com_ui_agent_subagents_info": "Subagenten laufen in isolierten Kontextfenstern. Ausführliche Tool-Ausgaben bleiben auf den untergeordneten Agenten beschränkt; an diesen Agenten wird nur eine Zusammenfassung zurückgegeben.",
+  "com_ui_agent_subagents_info_2": "Auch ohne aufgelistete Agenten erlaubt die Aktivierung weiterhin den Selbstaufruf, sodass dieser Agent fokussierte Teilaufgaben an eine neue Kopie von sich selbst delegieren kann.",
+  "com_ui_agent_subagents_max": "Maximale Anzahl von {{0}} Subagenten erreicht.",
+  "com_ui_agent_subagents_remove": "{{0}} aus den Subagenten entfernen",
   "com_ui_agent_url_copied": "Agenten-URL in die Zwischenablage kopiert",
   "com_ui_agent_var": "{{0}} Agent",
   "com_ui_agent_version": "Version",
@@ -705,24 +746,44 @@
   "com_ui_agents_allow_share_public": "Öffentliches Teilen von Agenten erlauben",
   "com_ui_agents_allow_use": "Verwendung von Agenten erlauben",
   "com_ui_all": "alle",
+  "com_ui_all_projects": "Alle Projekte",
   "com_ui_all_proper": "Alle",
   "com_ui_analyzing": "Analyse läuft",
   "com_ui_analyzing_finished": "Analyse abgeschlossen",
   "com_ui_api_key": "API-Schlüssel",
-  "com_ui_api_key_copied": "API-Schlüssel in die Zwischenablage kopiert",
   "com_ui_api_key_create_error": "Fehler beim Erstellen des API-Schlüssels",
   "com_ui_api_key_created": "API-Schlüssel erfolgreich erstellt",
+  "com_ui_api_key_delete_confirm": "\"{{0}}\" löschen? Diese Aktion kann nicht rückgängig gemacht werden.",
   "com_ui_api_key_delete_error": "Fehler beim Löschen des API-Schlüssels",
+  "com_ui_api_key_delete_name": "API-Schlüssel {{0}} löschen",
+  "com_ui_api_key_delete_warning": "Anwendungen, die diesen Schlüssel verwenden, verlieren sofort den Zugriff.",
   "com_ui_api_key_deleted": "API-Schlüssel erfolgreich gelöscht",
+  "com_ui_api_key_expiration": "Ablaufdatum",
+  "com_ui_api_key_expire_1y": "1 Jahr",
+  "com_ui_api_key_expire_30d": "30 Tage",
+  "com_ui_api_key_expire_7d": "7 Tage",
+  "com_ui_api_key_expire_90d": "90 Tage",
+  "com_ui_api_key_expire_never": "Nie",
+  "com_ui_api_key_expired": "Abgelaufen",
+  "com_ui_api_key_expires_in_day": "Läuft in 1 Tag ab",
+  "com_ui_api_key_expires_in_days": "Läuft in {{0}} Tagen ab",
+  "com_ui_api_key_expires_on": "Läuft ab am {{0}}",
+  "com_ui_api_key_last_used": "Zuletzt benutzt {{0}}",
   "com_ui_api_key_name": "Schlüsselname",
   "com_ui_api_key_name_placeholder": "Mein API-Schlüssel",
   "com_ui_api_key_name_required": "API-Schlüsselname ist erforderlich",
+  "com_ui_api_key_never_used": "Nie benutzt",
+  "com_ui_api_key_no_expiration": "Kein Ablaufzeitraum",
   "com_ui_api_key_warning": "Kopiere deinen API-Schlüssel jetzt. Du wirst ihn später nicht mehr sehen können!",
+  "com_ui_api_keys_description": "API-Schlüssel ermöglichen externen Apps und Tools, deine Agenten über die OpenAI-kompatible API von LibreChat auszuführen. Behandle jeden Schlüssel wie ein Passwort: Wer ihn hat, kann in deinem Namen handeln. Widerrufe daher alle Schlüssel, die du nicht mehr verwendest.",
+  "com_ui_api_keys_empty_text": "API-Schlüssel ermöglichen externen Anwendungen, deine Agenten über die OpenAI-kompatible API auszuführen. Erstelle einen Schlüssel, um loszulegen.",
+  "com_ui_api_keys_empty_title": "Verbinde deine Agenten mit externen Apps",
   "com_ui_api_keys_load_error": "API-Schlüssel konnten nicht geladen werden",
   "com_ui_archive": "Archivieren",
   "com_ui_archive_delete_error": "Archivierter Chat konnte nicht gelöscht werden.",
   "com_ui_archive_error": "Konversation konnte nicht archiviert werden",
   "com_ui_artifact_click": "Zum Öffnen klicken",
+  "com_ui_artifact_preview_pending": "Vorschau noch nicht verfügbar — klicke auf Herunterladen, um die Datei anzusehen.",
   "com_ui_artifacts": "Artefakte",
   "com_ui_artifacts_options": "Artefakt Optionen",
   "com_ui_artifacts_toggle": "Artefakte-Funktion einschalten",
@@ -750,6 +811,7 @@
   "com_ui_authentication": "Authentifizierung",
   "com_ui_authentication_type": "Authentifizierungstyp",
   "com_ui_auto": "Auto",
+  "com_ui_available_options": "Verfügbare Optionen",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "Entra ID",
@@ -789,10 +851,13 @@
   "com_ui_branch_error": "Erstellen der Abzweigung fehlgeschlagen",
   "com_ui_branch_message": "Abzweigung aus dieser Antwort erstellen",
   "com_ui_by_author": "von {{0}}",
+  "com_ui_cache_read": "Cache-Lesevorgang",
+  "com_ui_cache_write": "Cache-Schreibvorgang",
   "com_ui_callback_url": "Callback-URL",
   "com_ui_cancel": "Abbrechen",
   "com_ui_cancelled": "Abgebrochen",
   "com_ui_category": "Kategorie\n",
+  "com_ui_change_project": "Projekt wechseln",
   "com_ui_change_version": "Version ändern",
   "com_ui_chat": "Chat",
   "com_ui_chat_history": "Chatverlauf",
@@ -804,6 +869,7 @@
   "com_ui_clear_presets": "Voreinstellungen löschen",
   "com_ui_clear_search": "Suche löschen",
   "com_ui_click_to_close": "Zum Schließen klicken",
+  "com_ui_click_to_edit": "Klicken zum Bearbeiten",
   "com_ui_click_to_view_var": "Klicken, um {{0}} anzusehen",
   "com_ui_client_id": "Client-ID",
   "com_ui_client_secret": "Client Secret",
@@ -815,9 +881,12 @@
   "com_ui_code": "Code",
   "com_ui_collapse": "Einklappen",
   "com_ui_collapse_chat": "Chat einklappen",
+  "com_ui_collapse_summary": "Zusammenfassung einklappen",
   "com_ui_collapse_thoughts": "Gedanken einklappen",
+  "com_ui_command_finished": "Ausführung abgeschlossen",
   "com_ui_command_placeholder": "Optional: Gib einen speziellen Befehl ein, sonst wird der Name des Prompts verwendet.",
   "com_ui_command_usage_placeholder": "Wähle einen Prompt nach Befehl oder Name aus",
+  "com_ui_complete": "Fertig!",
   "com_ui_complete_setup": "Einrichtung abschließen",
   "com_ui_concise": "Prägnant",
   "com_ui_configure": "Konfigurieren",
@@ -829,13 +898,34 @@
   "com_ui_connecting": "Verbinde...",
   "com_ui_contact_admin_if_issue_persists": "Kontaktiere den Admin, falls das Problem weiterhin besteht",
   "com_ui_context": "Kontext",
+  "com_ui_context_cost": "Kosten",
+  "com_ui_context_cost_branch": "Kosten für diesen Branch",
+  "com_ui_context_cost_total": "Alle Branches",
   "com_ui_context_filter_sort": "Nach Kontext filtern und sortieren",
+  "com_ui_context_free": "Freier Kontext",
+  "com_ui_context_messages": "Nachrichten",
+  "com_ui_context_subagents": "Subagenten",
+  "com_ui_context_summary": "Zusammenfassung",
+  "com_ui_context_system": "System-Prompt",
+  "com_ui_context_tools": "Tool-Schemas",
+  "com_ui_context_tools_mcp": "MCP-Tools",
+  "com_ui_context_tools_mcp_deferred": "MCP-Tools (zurückgestellt)",
+  "com_ui_context_tools_system": "System-Tools",
+  "com_ui_context_tools_system_deferred": "System-Tools (zurückgestellt)",
+  "com_ui_context_unknown": "Kontextgröße unbekannt",
+  "com_ui_context_usage": "Kontextnutzung",
+  "com_ui_context_usage_label": "Kontextfenster: {{0}} von {{1}} Tokens verwendet ({{2}} %)",
+  "com_ui_context_usage_label_unknown": "Kontextnutzung: {{0}} Tokens verwendet",
+  "com_ui_context_usage_snapshot": "Kontext {{0}} / {{1}} ({{2}} %)",
+  "com_ui_context_usage_snapshot_unknown": "Kontext {{0}}",
+  "com_ui_context_window": "Kontextfenster",
   "com_ui_continue": "Fortfahren",
   "com_ui_continue_oauth": "Mit OAuth fortfahren",
   "com_ui_control_bar": "Kontrollleiste",
   "com_ui_conversation": "Konversation",
   "com_ui_conversation_label": "{{title}} Konversation",
   "com_ui_conversation_not_found": "Chat nicht gefunden",
+  "com_ui_conversation_summarized": "Konversation zusammengefasst",
   "com_ui_conversations": "Konversationen",
   "com_ui_convo_archived": "Konversation archiviert",
   "com_ui_convo_delete_error": "Unterhaltung konnte nicht gelöscht werden.",
@@ -844,8 +934,10 @@
   "com_ui_copied_to_clipboard": "In die Zwischenablage kopiert",
   "com_ui_copy": "Kopieren",
   "com_ui_copy_code": "Code kopieren",
+  "com_ui_copy_failed": "Kopieren in die Zwischenablage fehlgeschlagen",
   "com_ui_copy_link": "Link kopieren",
   "com_ui_copy_stack_trace": "Stack-Trace kopieren",
+  "com_ui_copy_summary": "Zusammenfassung in die Zwischenablage kopieren",
   "com_ui_copy_thoughts_to_clipboard": "Gedanken in die Zwischenablage kopieren",
   "com_ui_copy_to_clipboard": "In die Zwischenablage kopieren",
   "com_ui_copy_url_to_clipboard": "URL in die Zwischenablage kopieren",
@@ -856,10 +948,16 @@
   "com_ui_create_mcp_server": "MCP-Server erstellen",
   "com_ui_create_memory": "Erinnerung erstellen",
   "com_ui_create_new_agent": "Neuen Agenten erstellen",
+  "com_ui_create_project": "Projekt erstellen",
   "com_ui_create_prompt": "Prompt erstellen",
   "com_ui_create_prompt_page": "Neue Prompt-Konfigurationsseite",
+  "com_ui_create_skill": "Skill erstellen",
+  "com_ui_create_skill_upload": "SKILL.md hochladen",
+  "com_ui_create_skill_upload_error": "Die hochgeladene Datei konnte nicht gelesen werden",
   "com_ui_created": "Erstellt",
+  "com_ui_created_file": "{{0}} erstellt",
   "com_ui_creating": "Wird erstellt...",
+  "com_ui_creating_file": "{{0}} wird erstellt",
   "com_ui_creating_image": "Bild wird erstellt. Kann einen Moment dauern",
   "com_ui_current": "Aktuell",
   "com_ui_currently_production": "Aktuell im Produktivbetrieb",
@@ -892,6 +990,7 @@
   "com_ui_delete_action_confirm": "Bist du sicher, dass du diese Aktion löschen möchtest?",
   "com_ui_delete_agent": "Agent löschen",
   "com_ui_delete_agent_confirm": "Bist du sicher, dass du diesen Agenten löschen möchtest?",
+  "com_ui_delete_api_key": "API-Schlüssel löschen",
   "com_ui_delete_assistant": "Assistent löschen",
   "com_ui_delete_assistant_confirm": "Bist du sicher, dass du diesen Assistenten löschen möchtest? Dies kann nicht rückgängig gemacht werden.",
   "com_ui_delete_confirm": "Dies wird löschen:",
@@ -904,6 +1003,8 @@
   "com_ui_delete_memory": "Erinnerung löschen",
   "com_ui_delete_not_allowed": "Löschvorgang ist nicht erlaubt",
   "com_ui_delete_preset": "Voreinstellung löschen?",
+  "com_ui_delete_project": "Projekt löschen?",
+  "com_ui_delete_project_confirm": "„{{name}}“ löschen? Die Chats darin werden nicht gelöscht.",
   "com_ui_delete_prompt": "Prompt löschen?",
   "com_ui_delete_shared_link": "Geteilten Link löschen?",
   "com_ui_delete_shared_link_heading": "Geteilten Link löschen",
@@ -914,11 +1015,13 @@
   "com_ui_deleted": "Gelöscht",
   "com_ui_deleting": "Wird gelöscht...",
   "com_ui_deleting_file": "Lösche Datei...",
+  "com_ui_deploy": "Bereitstellen",
   "com_ui_descending": "Absteigend",
   "com_ui_description": "Beschreibung",
   "com_ui_description_placeholder": "Optional: Gib eine Beschreibung für den Prompt ein",
   "com_ui_deselect_all": "Alle abwählen",
   "com_ui_detailed": "Detailliert",
+  "com_ui_details": "Details",
   "com_ui_disabling": "Deaktiviere …",
   "com_ui_done": "Erledigt",
   "com_ui_download": "Herunterladen",
@@ -941,7 +1044,10 @@
   "com_ui_edit_memory": "Erinnerung bearbeiten",
   "com_ui_edit_preset_title": "Voreinstellung bearbeiten - {{title}}",
   "com_ui_edit_prompt_page": "Prompt-Seite bearbeiten",
+  "com_ui_edit_skill": "Skill bearbeiten",
   "com_ui_editable_message": "Bearbeitbare Nachricht",
+  "com_ui_edited_file": "{{0}} bearbeitet",
+  "com_ui_editing_file": "{{0}} wird bearbeitet",
   "com_ui_editor_instructions": "Zieh das Bild, um es neu zu positionieren • Nutze den Zoom-Regler oder die Schaltflächen zur Größenanpassung.",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Endpunkt",
@@ -960,12 +1066,16 @@
   "com_ui_error_try_following_prefix": "Bitte versuche Folgendes",
   "com_ui_error_unexpected": "Hoppla! Ein unerwarteter Fehler ist aufgetreten",
   "com_ui_error_updating_preferences": "Fehler beim Aktualisieren der Einstellungen",
+  "com_ui_estimated": "Aus dem Nachrichtenverlauf geschätzt",
   "com_ui_everyone_permission_level": "Berechtigungsstufe für Alle",
   "com_ui_examples": "Beispiele",
   "com_ui_expand": "Ausklappen",
   "com_ui_expand_chat": "Chat erweitern",
   "com_ui_expand_thoughts": "Gedanken ausklappen",
   "com_ui_export_convo_modal": "Konversation exportieren",
+  "com_ui_failed": "Fehlgeschlagen",
+  "com_ui_favorite": "Zu Favoriten hinzufügen",
+  "com_ui_favorites": "Favoriten",
   "com_ui_feedback_more": "Mehr ...",
   "com_ui_feedback_more_information": "Zusätzliches Feedback",
   "com_ui_feedback_negative": "Muss verbessert werden",
@@ -984,14 +1094,18 @@
   "com_ui_feedback_tag_unjustified_refusal": "Mit anderer Begründung abgelehnt",
   "com_ui_field_max_length": "{{field}} darf maximal {{length}} Zeichen haben",
   "com_ui_field_required": "Dieses Feld ist erforderlich",
+  "com_ui_file": "Datei",
   "com_ui_file_input_avatar_label": "Dateiauswahl für Avatar",
+  "com_ui_file_modified": "Geändert",
   "com_ui_file_size": "Dateigröße",
   "com_ui_file_token_limit": "Datei-Token-Limit",
   "com_ui_file_token_limit_desc": "Lege ein maximales Token-Limit für die Dateiverarbeitung fest, um Kosten und Ressourcenverbrauch zu steuern.",
   "com_ui_files": "Dateien\n",
+  "com_ui_files_count_size": "{{0}} Dateien ({{1}} KB)",
   "com_ui_filter_mcp_servers": "MCP-Server nach Namen filtern",
   "com_ui_filter_prompts": "Prompts filtern",
   "com_ui_filter_prompts_name": "Prompts nach Namen filtern",
+  "com_ui_filter_skills_name": "Filtere Skills nach Namen",
   "com_ui_final_touch": "Letzter Schliff\n",
   "com_ui_finance": "Finanzen",
   "com_ui_fork": "Abzweigen",
@@ -1023,6 +1137,7 @@
   "com_ui_fork_visible": "Nur sichtbare Nachrichten",
   "com_ui_generate_qrcode": "QR-Code generieren",
   "com_ui_generating": "Generiere …",
+  "com_ui_generating_image": "Generiere Bild...",
   "com_ui_generation_settings": "Einstellungen für die Generierung",
   "com_ui_getting_started": "Erste Schritte\n",
   "com_ui_go_back": "Zurück",
@@ -1037,7 +1152,7 @@
   "com_ui_hide": "Verstecken",
   "com_ui_hide_code": "Code verbergen",
   "com_ui_hide_image_details": "Details zum Bild ausblenden",
-  "com_ui_hide_password": "Passwort verbergen",
+  "com_ui_hide_n_files": "{{0}} Dateien ausblenden",
   "com_ui_hide_qr": "QR-Code ausblenden",
   "com_ui_high": "Hoch",
   "com_ui_host": "Host",
@@ -1047,6 +1162,7 @@
   "com_ui_image_details": "Details zum Bild",
   "com_ui_image_edited": "Bild bearbeitet\n",
   "com_ui_image_gen": "Bildgenerierung",
+  "com_ui_image_gen_failed": "Bildgenerierung fehlgeschlagen",
   "com_ui_import": "Importieren",
   "com_ui_import_conversation_error": "Beim Importieren Ihrer Konversationen ist ein Fehler aufgetreten",
   "com_ui_import_conversation_file_type_error": "Nicht unterstützter Importtyp",
@@ -1058,20 +1174,35 @@
   "com_ui_initializing": "Initialisiere...",
   "com_ui_input": "Eingabe",
   "com_ui_instructions": "Anweisungen",
+  "com_ui_invocation_auto": "Auto",
+  "com_ui_invocation_auto_info": "Der Skill wird vom Agenten automatisch angewendet, wenn er für die Unterhaltung relevant ist.",
+  "com_ui_invocation_both": "Beide",
+  "com_ui_invocation_both_info": "Der Skill kann automatisch ausgelöst oder manuell von dir aufgerufen werden.",
+  "com_ui_invocation_manual": "Manuell",
+  "com_ui_invocation_manual_info": "Der Skill wird nur verwendet, wenn du ihn ausdrücklich aufrufst.",
+  "com_ui_invocation_mode": "Aufrufmodus",
+  "com_ui_invoked_by": "Aufgerufen von",
   "com_ui_key": "Schlüssel",
   "com_ui_key_required": "API-Schlüssel ist erforderlich",
-  "com_ui_last_used": "Zuletzt verwendet",
+  "com_ui_labels": "Labels",
   "com_ui_late_night": "Schöne späte Nacht",
+  "com_ui_latest": "neueste",
+  "com_ui_latest_activity": "Letzte Aktivität",
   "com_ui_latest_footer": "Alle KIs für alle.",
   "com_ui_latest_version": "Neueste Version",
   "com_ui_leave_blank_to_keep": "Leer lassen, um beizubehalten",
   "com_ui_light_theme_enabled": "Helles Design aktiviert",
+  "com_ui_line_count": "{0} Zeile",
+  "com_ui_lines_count": "{0} Zeilen",
   "com_ui_link_copied": "Link kopiert",
   "com_ui_link_refreshed": "Link aktualisiert",
+  "com_ui_live": "live",
+  "com_ui_load_more": "Mehr laden",
   "com_ui_loading": "Lade …",
   "com_ui_locked": "Gesperrt",
   "com_ui_logo": "{{0}} Logo",
   "com_ui_low": "Niedrig",
+  "com_ui_make_production": "Zur Produktionsversion machen",
   "com_ui_manage": "Verwalten",
   "com_ui_marketplace": "Marktplatz",
   "com_ui_marketplace_allow_use": "Nutzung des Marktplatzes erlauben",
@@ -1113,6 +1244,7 @@
   "com_ui_mcp_server_updated": "MCP-Server erfolgreich aktualisiert",
   "com_ui_mcp_server_url_placeholder": "https://mcp.beispiel.com",
   "com_ui_mcp_servers": "MCP Server",
+  "com_ui_mcp_servers_allow_configure_obo": "Nutzern erlauben, On-Behalf-Of (OBO) für MCP-Server zu konfigurieren",
   "com_ui_mcp_servers_allow_create": "Benutzern das Erstellen von MCP-Servern erlauben",
   "com_ui_mcp_servers_allow_share": "Benutzern das Teilen von MCP-Servern erlauben",
   "com_ui_mcp_servers_allow_share_public": "Nutzern das öffentliche Teilen von MCP-Servern erlauben",
@@ -1153,6 +1285,11 @@
   "com_ui_mermaid_failed": "Diagramm konnte nicht gerendert werden:",
   "com_ui_mermaid_source": "Quellcode:",
   "com_ui_message_input": "Nachrichteneingabe",
+  "com_ui_message_nav": "Nachrichtennavigation",
+  "com_ui_message_nav_go_to_assistant": "Zur KI-Nachricht springen: {{0}}",
+  "com_ui_message_nav_go_to_user": "Zur Nutzernachricht springen: {{0}}",
+  "com_ui_message_nav_next": "Zur nächsten Nachricht springen",
+  "com_ui_message_nav_previous": "Zur vorherigen Nachricht springen",
   "com_ui_microphone_unavailable": "Mikrofon ist nicht verfügbar",
   "com_ui_min_tags": "Es können nicht mehr Werte entfernt werden, mindestens {{0}} sind erforderlich.",
   "com_ui_minimal": "Minimal",
@@ -1161,16 +1298,24 @@
   "com_ui_model_parameters": "Modell-Parameter",
   "com_ui_model_parameters_reset": "Modellparameter wurden zurückgesetzt.",
   "com_ui_model_selected": "{{0}} ausgewählt",
+  "com_ui_model_spec": "Modellspezifikation",
+  "com_ui_more_count": "{{0}} weitere",
   "com_ui_more_info": "Mehr Infos",
+  "com_ui_more_options": "Weitere Optionen",
   "com_ui_my_prompts": "Meine Prompts",
+  "com_ui_my_skills": "Meine Skills",
+  "com_ui_n_files": "{{0}} Dateien",
   "com_ui_name": "Name",
   "com_ui_name_sort": "Nach Namen sortieren",
+  "com_ui_navigate_results": "Ergebnisse durchsuchen",
   "com_ui_new": "Neu",
   "com_ui_new_chat": "Neuer Chat",
+  "com_ui_new_chat_in_project": "Neuer Chat in {{name}}",
   "com_ui_new_conversation_title": "Neuer Titel des Chats",
+  "com_ui_new_project": "Neues Projekt",
   "com_ui_next": "Weiter",
+  "com_ui_next_result": "Nächstes Ergebnis",
   "com_ui_no": "Nein",
-  "com_ui_no_api_keys": "Noch keine API-Schlüssel vorhanden. Erstelle einen, um loszulegen.",
   "com_ui_no_auth": "Keine (Automatische Erkennung)",
   "com_ui_no_bookmarks": "Du hast noch keine Lesezeichen. Klicke auf einen Chat und füge ein neues hinzu",
   "com_ui_no_bookmarks_match": "Keine Lesezeichen entsprechen deiner Suche",
@@ -1179,15 +1324,18 @@
   "com_ui_no_category": "Keine Kategorie",
   "com_ui_no_changes": "Es wurden keine Änderungen vorgenommen",
   "com_ui_no_individual_access": "Keine einzelnen Benutzer oder Gruppen haben Zugriff auf diesen Agenten.",
+  "com_ui_no_labels": "Keine Labels",
   "com_ui_no_mcp_servers": "Noch keine MCP-Server",
   "com_ui_no_mcp_servers_match": "Keine MCP-Server entsprechen deinem Filter",
   "com_ui_no_memories": "Keine Erinnerungen. Erstelle sie manuell oder fordere die KI auf, sich etwas zu merken.\n",
   "com_ui_no_memories_match": "Keine Erinnerungen entsprechen deiner Suche",
   "com_ui_no_memories_title": "Noch keine Erinnerungen",
-  "com_ui_no_personalization_available": "Derzeit sind keine Personalisierungsoptionen verfügbar.",
+  "com_ui_no_project_chats": "Noch keine Chats",
+  "com_ui_no_projects": "Noch keine Projekte",
   "com_ui_no_prompts_title": "Noch keine Prompts",
   "com_ui_no_read_access": "Du hast keine Berechtigung, Erinnerungen anzuzeigen.",
   "com_ui_no_results_found": "Keine Ergebnisse gefunden",
+  "com_ui_no_skills_found": "Keine Skills gefunden",
   "com_ui_no_terms_content": "Keine Inhalte der Allgemeinen Geschäftsbedingungen zum Anzeigen",
   "com_ui_none": "Keine",
   "com_ui_not_used": "Nicht verwendet",
@@ -1202,17 +1350,27 @@
   "com_ui_oauth_error_title": "Authentifizierung fehlgeschlagen",
   "com_ui_oauth_success_description": "Ihre Authentifizierung war erfolgreich. Dieses Fenster schliesst sich in",
   "com_ui_oauth_success_title": "Authentifizierung erfolgreich",
+  "com_ui_obo": "On-Behalf-Of (OBO)",
+  "com_ui_obo_readonly_no_permission": "OBO ist für diesen Server konfiguriert, aber deine Rolle hat keine Berechtigung mehr, es zu ändern. Wende dich an einen Administrator, um Änderungen vorzunehmen.",
+  "com_ui_obo_scopes": "OBO-Scopes",
+  "com_ui_obo_scopes_description": "Scopes, die über den On-Behalf-Of-Flow für den nachgelagerten MCP-Server angefordert werden. Erfordert OpenID-Connect-Authentifizierung, z. B. Entra ID.",
   "com_ui_of": "von",
   "com_ui_off": "Aus",
   "com_ui_offline": "Offline",
+  "com_ui_omitted": "Ausgeblendet",
   "com_ui_on": "An",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (öffnet in neuem Tab)",
+  "com_ui_open_project": "Projekt öffnen",
   "com_ui_open_source_chat_new_tab": "Quell-Chat in neuem Tab öffnen",
   "com_ui_open_source_chat_new_tab_title": "Quell-Chat in neuem Tab öffnen - {{title}}",
   "com_ui_open_var": "{{0}} öffnen",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "(Optional)",
+  "com_ui_options": "Optionen",
+  "com_ui_output": "Ausgabe",
   "com_ui_page": "Seite",
+  "com_ui_pagination": "Seitennavigation",
+  "com_ui_parameters": "Parameter",
   "com_ui_people": "Personen",
   "com_ui_people_picker": "Personenauswahl",
   "com_ui_people_picker_allow_view_groups": "Anzeigen von Gruppen erlauben",
@@ -1222,12 +1380,36 @@
   "com_ui_permissions_failed_update": "Berechtigungen konnten nicht aktualisiert werden. Bitte versuche es erneut.",
   "com_ui_permissions_updated_success": "Berechtigungen wurden erfolgreich aktualisiert",
   "com_ui_pin": "Anpinnen",
+  "com_ui_pin_error": "Chat konnte nicht angepinnt werden",
+  "com_ui_pinned": "Angepinnt",
+  "com_ui_plus_n_more": "+{{0}} weitere",
   "com_ui_preferences_updated": "Einstellungen erfolgreich aktualisiert",
   "com_ui_prev": "Zurück",
+  "com_ui_prev_result": "Vorheriges Ergebnis",
   "com_ui_preview": "Vorschau",
+  "com_ui_preview_failed": "Vorschau nicht verfügbar",
+  "com_ui_preview_preparing": "Vorschau wird vorbereitet...",
+  "com_ui_preview_unavailable": "Vorschau ist für diesen Dateityp nicht verfügbar",
   "com_ui_privacy_policy": "Datenschutzerklärung",
   "com_ui_privacy_policy_url": "Datenschutzrichtlinie-URL",
+  "com_ui_production": "Produktiv",
+  "com_ui_project_chat_count": "{{count}} Chats",
+  "com_ui_project_chat_count_single": "1 Chat",
+  "com_ui_project_create_error": "Projekt konnte nicht erstellt werden",
+  "com_ui_project_delete_error": "Projekt konnte nicht gelöscht werden",
+  "com_ui_project_name": "Projektname",
+  "com_ui_project_name_placeholder": "Neues Projekt",
+  "com_ui_project_not_found": "Projekt nicht gefunden",
+  "com_ui_project_rename_error": "Projekt konnte nicht umbenannt werden",
+  "com_ui_project_update_error": "Projektzuordnung konnte nicht aktualisiert werden",
+  "com_ui_project_updated": "Projektzuordnung aktualisiert",
+  "com_ui_projects": "Projekte",
   "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Kategorieauswahl des Prompts",
+  "com_ui_prompt_delete_confirm": "Möchtest du den Prompt „{{0}}“ wirklich löschen?",
+  "com_ui_prompt_delete_error": "Beim Löschen des Prompts ist ein Fehler aufgetreten",
+  "com_ui_prompt_deleted_group": "Prompt-Gruppe \"{{0}}\" gelöscht",
+  "com_ui_prompt_details": "Prompt-Details für {{name}}",
   "com_ui_prompt_group_button": "{{name}}-Prompt, Kategorie {{category}}",
   "com_ui_prompt_group_button_no_category": "{{name}}-Prompt",
   "com_ui_prompt_groups": "Prompt-Gruppenliste",
@@ -1239,19 +1421,28 @@
   "com_ui_prompt_text": "Text",
   "com_ui_prompt_text_required": "Text ist erforderlich",
   "com_ui_prompt_update_error": "Beim Aktualisieren des Prompts ist ein Fehler aufgetreten",
+  "com_ui_prompt_variables_list": "Liste der Prompt-Variablen",
   "com_ui_prompts": "Prompts",
   "com_ui_prompts_allow_create": "Erstellung von Prompts erlauben",
   "com_ui_prompts_allow_share": "Teilen von Prompts erlauben",
   "com_ui_prompts_allow_share_public": "Öffentliches Teilen von Prompts erlauben",
   "com_ui_prompts_allow_use": "Verwendung von Prompts erlauben",
   "com_ui_provider": "Anbieter",
+  "com_ui_provider_api_keys_description": "Verwalte API-Schlüssel für Endpunkte, die einen von dir bereitgestellten Schlüssel verwenden.",
+  "com_ui_provider_api_keys_not_set": "Kein Schlüssel hinterlegt",
   "com_ui_quality": "Qualität",
+  "com_ui_quote_selections": "{{0}} Auswahlen",
+  "com_ui_quotes_queued": "Zitate für deine nächste Nachricht hinzugefügt",
+  "com_ui_ran_n_agents": "{{0}} Agenten ausgeführt",
   "com_ui_read_aloud": "Vorlesen",
+  "com_ui_read_file": "{{0}} gelesen",
+  "com_ui_reading_file": "{{0}} wird gelesen",
   "com_ui_redirect_uri": "Weiterleitungs-URI",
   "com_ui_redirect_uri_instructions": "Kopiere diese Weiterleitungs-URI und konfiguriere sie in deinen OAuth-Anbietereinstellungen.",
   "com_ui_redirecting_to_provider": "Weiterleitung zu {{0}}, einen Moment bitte...",
   "com_ui_reference_saved_memories": "Gespeicherte Erinnerungen verwenden",
   "com_ui_reference_saved_memories_description": "Erlaube der KI bei den Antworten auf deine gespeicherten Erinnerungen zuzugreifen und sie zu verwenden.",
+  "com_ui_referenced_quotes": "Referenzierte Zitate",
   "com_ui_refresh": "Aktualisieren",
   "com_ui_refresh_link": "Link aktualisieren",
   "com_ui_refresh_page": "Seite aktualisieren",
@@ -1260,6 +1451,7 @@
   "com_ui_regenerating": "Generiere neu ...",
   "com_ui_region": "Region",
   "com_ui_reinitialize": "Neu initialisieren",
+  "com_ui_relevance": "Relevanz",
   "com_ui_remote_access": "Remote-Zugriff",
   "com_ui_remote_agent_role_editor": "Editor",
   "com_ui_remote_agent_role_editor_desc": "Kann den Agent über die API ansehen und bearbeiten",
@@ -1273,10 +1465,15 @@
   "com_ui_remote_agents_allow_share_public": "Nutzern erlauben, allen Usern API-Zugriff auf Agents zu gewähren",
   "com_ui_remote_agents_allow_use": "Nutzern erlauben, API-Schlüssel zu erstellen und Agents remote abzufragen",
   "com_ui_remove_agent_from_chain": "{{0}} aus der Kette entfernen",
+  "com_ui_remove_all_quotes": "Alle Auswahlen entfernen",
+  "com_ui_remove_from_project": "Aus Projekt entfernen",
+  "com_ui_remove_quote": "Zitat entfernen",
+  "com_ui_remove_skill_var": "{{0}} entfernen",
   "com_ui_remove_user": "{{0}} entfernen",
   "com_ui_rename": "Umbenennen",
   "com_ui_rename_conversation": "Chat umbenennen",
   "com_ui_rename_failed": "Chat konnte nicht umbenannt werden.",
+  "com_ui_rename_project": "Projekt umbenennen",
   "com_ui_requires_auth": "Authentifizierung erforderlich",
   "com_ui_reset": "Zurücksetzen",
   "com_ui_reset_adjustments": "Anpassungen zurücksetzen",
@@ -1287,6 +1484,7 @@
   "com_ui_result": "Ergebnis",
   "com_ui_result_found": "{{count}} Ergebnis gefunden",
   "com_ui_results_found": "{{count}} Ergebnisse gefunden",
+  "com_ui_retrieved_files": "Deine Dateien wurden durchsucht",
   "com_ui_retry": "Erneut versuchen",
   "com_ui_revoke": "Widerrufen",
   "com_ui_revoke_info": "Benutzer-API-Keys widerrufen",
@@ -1311,6 +1509,9 @@
   "com_ui_rotate_90": "Um 90 Grad drehen",
   "com_ui_run_code": "Code ausführen",
   "com_ui_run_code_error": "Bei der Ausführung des Codes ist ein Fehler aufgetreten",
+  "com_ui_running": "Läuft...",
+  "com_ui_running_command": "Befehl wird ausgeführt",
+  "com_ui_running_n_agents": "{{0}} Agenten werden ausgeführt",
   "com_ui_save": "Speichern",
   "com_ui_save_badge_changes": "Änderungen an Badges speichern?",
   "com_ui_save_changes": "Änderungen speichern",
@@ -1321,13 +1522,20 @@
   "com_ui_saving": "Sicherung läuft...",
   "com_ui_schema": "Schema",
   "com_ui_scope": "Umfang",
+  "com_ui_scroll_to_bottom": "Nach unten scrollen",
   "com_ui_search": "Suche",
   "com_ui_search_above_to_add": "Suche oben, um Benutzer oder Gruppen hinzuzufügen",
   "com_ui_search_above_to_add_all": "Suche oben, um Benutzer, Gruppen oder Rollen hinzuzufügen",
   "com_ui_search_above_to_add_people": "Suche oben, um Personen hinzuzufügen",
   "com_ui_search_agent_category": "Kategorien suchen...",
   "com_ui_search_default_placeholder": "Suche nach Name oder E-Mail (min. 2 Zeichen)",
+  "com_ui_search_language": "Sprachen suchen...",
   "com_ui_search_people_placeholder": "Suche nach Personen oder Gruppen per Name oder E-Mail",
+  "com_ui_search_projects": "Projekte suchen",
+  "com_ui_search_result_count": "{{count}} Ergebnis gefunden",
+  "com_ui_search_results_count": "{{count}} Ergebnisse gefunden",
+  "com_ui_search_skills": "Skills suchen...",
+  "com_ui_searching_files": "Durchsuche deine Dateien...",
   "com_ui_seconds": "Sekunden",
   "com_ui_secret_key": "Geheimschlüssel",
   "com_ui_select": "Auswählen",
@@ -1337,6 +1545,7 @@
   "com_ui_select_model": "Ein KI-Modell auswählen",
   "com_ui_select_options": "Optionen auswählen",
   "com_ui_select_or_create_prompt": "Wähle oder erstelle einen Prompt",
+  "com_ui_select_project": "Projekt auswählen",
   "com_ui_select_provider": "Wähle einen Anbieter",
   "com_ui_select_provider_first": "Wähle zuerst einen Anbieter",
   "com_ui_select_region": "Wähle eine Region",
@@ -1345,17 +1554,63 @@
   "com_ui_select_search_provider": "Provider nach Name suchen",
   "com_ui_select_search_region": "Region nach Name suchen",
   "com_ui_set": "Setzen",
+  "com_ui_settings_label_2fa": "Zwei-Faktor-Authentifizierung",
+  "com_ui_settings_label_agent_api_keys": "API-Schlüssel für Agenten",
+  "com_ui_settings_label_auto_refill": "Automatische Aufladung",
+  "com_ui_settings_label_avatar": "Avatar",
+  "com_ui_settings_label_backup_codes": "Backup-Codes",
+  "com_ui_settings_label_clear_chats": "Alle Chats löschen",
+  "com_ui_settings_label_conversation_mode": "Unterhaltungsmodus",
+  "com_ui_settings_label_credits": "Token-Guthaben",
+  "com_ui_settings_label_decibel": "Dezibel-Schwellenwert",
+  "com_ui_settings_label_delete_account": "Konto löschen",
+  "com_ui_settings_label_delete_cache": "Cache löschen",
+  "com_ui_settings_label_engine_stt": "Engine für Sprache-zu-Text",
+  "com_ui_settings_label_engine_tts": "Engine für Text-zu-Sprache",
+  "com_ui_settings_label_import": "Chats importieren",
+  "com_ui_settings_label_language_stt": "Sprache für Sprache-zu-Text",
+  "com_ui_settings_label_playback_rate": "Wiedergabegeschwindigkeit",
+  "com_ui_settings_label_provider_api_keys": "API-Schlüssel des Anbieters",
+  "com_ui_settings_label_revoke_keys": "Schlüssel widerrufen",
+  "com_ui_settings_label_shared_links": "Geteilte Links",
+  "com_ui_settings_label_voice": "Stimme",
+  "com_ui_settings_no_results": "Keine passenden Einstellungen gefunden",
+  "com_ui_settings_results_aria": "Suchergebnisse",
+  "com_ui_settings_search_placeholder": "Einstellungen suchen",
+  "com_ui_settings_section_accessibility": "Barrierefreiheit",
+  "com_ui_settings_section_api_keys": "API-Schlüssel",
+  "com_ui_settings_section_appearance": "Darstellung",
+  "com_ui_settings_section_billing": "Abrechnung",
+  "com_ui_settings_section_commands": "Befehle",
+  "com_ui_settings_section_conversations": "Chats",
+  "com_ui_settings_section_danger_zone": "Gefahrenbereich",
+  "com_ui_settings_section_data": "Deine Daten",
+  "com_ui_settings_section_layout": "Layout",
+  "com_ui_settings_section_memory": "Erinnerungen",
+  "com_ui_settings_section_messages": "Nachrichten",
+  "com_ui_settings_section_profile": "Profil",
+  "com_ui_settings_section_prompts": "Prompts",
+  "com_ui_settings_section_security": "Sicherheit",
+  "com_ui_settings_section_sending": "Senden",
+  "com_ui_settings_section_stt": "Sprache zu Text",
+  "com_ui_settings_section_tts": "Text zu Sprache",
+  "com_ui_settings_tab_data": "Datenschutz & Sicherheit",
   "com_ui_share": "Teilen",
   "com_ui_share_create_message": "Ihr Name und alle Nachrichten, die du nach dem Teilen hinzufügst, bleiben privat.",
   "com_ui_share_delete_error": "Beim Löschen des geteilten Links ist ein Fehler aufgetreten",
   "com_ui_share_error": "Beim Teilen des Chat-Links ist ein Fehler aufgetreten",
   "com_ui_share_everyone": "Mit allen teilen",
   "com_ui_share_everyone_description_var": "{{resource}} wird für alle verfügbar sein. Bitte stelle sicher, dass {{resource}} wirklich für alle freigegeben werden soll. Sei vorsichtig mit deinen Daten.",
+  "com_ui_share_files": "Dateien in diesem Chat teilen",
+  "com_ui_share_files_description": "Bilder und Dateien in diesem Chat sind für andere nicht sichtbar, es sei denn, du aktivierst diese Option.",
+  "com_ui_share_files_refresh_note": "Aktualisiere den Link, um diese Änderung anzuwenden – Dateien werden beim Aktualisieren des Links als Momentaufnahme übernommen.",
   "com_ui_share_link_to_chat": "Link zum Chat teilen",
   "com_ui_share_qr_code_description": "QR-Code zum Teilen dieses Konversationslinks",
   "com_ui_share_update_message": "Ihr Name, benutzerdefinierte Anweisungen und alle Nachrichten, die du nach dem Teilen hinzufügen, bleiben privat.",
   "com_ui_share_var": "{{0}} teilen",
+  "com_ui_shared_link": "geteilter Link",
   "com_ui_shared_link_delete_success": "Geteilter Link erfolgreich gelöscht",
+  "com_ui_shared_link_manage_access": "Zugriff verwalten",
   "com_ui_shared_link_not_found": "Geteilter Link nicht gefunden",
   "com_ui_shared_prompts": "Geteilte Prompts",
   "com_ui_shop": "Einkaufen",
@@ -1363,28 +1618,130 @@
   "com_ui_show_all": "Alle anzeigen",
   "com_ui_show_code": "Code anzeigen",
   "com_ui_show_image_details": "Details zum Bild anzeigen",
-  "com_ui_show_password": "Passwort anzeigen",
+  "com_ui_show_less": "Weniger anzeigen",
+  "com_ui_show_more": "Mehr anzeigen",
+  "com_ui_show_n_files": "{{0}} Dateien anzeigen",
   "com_ui_show_qr": "QR-Code anzeigen",
   "com_ui_sign_in_to_domain": "Anmelden bei {{0}}",
-  "com_ui_simple": "Einfach",
   "com_ui_size": "Größe",
   "com_ui_size_sort": "Nach Größe sortieren",
+  "com_ui_skill": "Skill",
+  "com_ui_skill_content": "Skill-Inhalt",
+  "com_ui_skill_content_placeholder": "Gib deine Skill-Anweisungen in Markdown ein …",
+  "com_ui_skill_create_error": "Skill konnte nicht erstellt werden",
+  "com_ui_skill_create_title": "Skill erstellen",
+  "com_ui_skill_created": "Skill erstellt",
+  "com_ui_skill_delete_confirm": "Möchtest du „{{0}}“ wirklich löschen? Diese Aktion kann nicht rückgängig gemacht werden.",
+  "com_ui_skill_delete_error": "Skill konnte nicht gelöscht werden",
+  "com_ui_skill_deleted": "Skill gelöscht",
+  "com_ui_skill_description_field_hint": "Beschreibe genau, wann dieser Skill angewendet werden soll.",
+  "com_ui_skill_description_placeholder": "Abcd-Corp-Markenrichtlinien auf Präsentationen und Dokumente anwenden …",
+  "com_ui_skill_description_required": "Beschreibung ist erforderlich",
+  "com_ui_skill_description_too_long": "Die Beschreibung darf höchstens {{0}} Zeichen lang sein",
+  "com_ui_skill_edit_title": "Skill bearbeiten",
+  "com_ui_skill_file_binary": "Binärdatei — Inline-Vorschau nicht möglich",
+  "com_ui_skill_file_download": "Herunterladen",
+  "com_ui_skill_file_load_error": "Dateiinhalt konnte nicht geladen werden",
+  "com_ui_skill_finished": "{{0}} ausgeführt",
+  "com_ui_skill_instructions": "Anleitung",
+  "com_ui_skill_instructions_placeholder": "Gib deine Skill-Anweisungen in Markdown ein …",
+  "com_ui_skill_name_invalid": "Verwende nur Kleinbuchstaben, Ziffern und Bindestriche (kebab-case)",
+  "com_ui_skill_name_placeholder": "markenrichtlinien-vorgaben",
+  "com_ui_skill_name_required": "Name ist erforderlich",
+  "com_ui_skill_name_too_long": "Der Name darf höchstens {{0}} Zeichen lang sein",
+  "com_ui_skill_new_file": "Neue Datei",
+  "com_ui_skill_new_folder": "Neuer Ordner",
+  "com_ui_skill_no_edit_permission": "Du hast keine Berechtigung, diesen Skill zu bearbeiten",
+  "com_ui_skill_no_selection": "Skill wählen",
+  "com_ui_skill_no_selection_desc": "Wähle einen Skill aus der Seitenleiste aus, um die Details anzuzeigen.",
+  "com_ui_skill_not_found": "Skill nicht gefunden",
+  "com_ui_skill_not_found_description": "Der Skill wurde möglicherweise gelöscht oder du hast keinen Zugriff mehr darauf.",
+  "com_ui_skill_role_editor_desc": "Kann den Skill ansehen und bearbeiten",
+  "com_ui_skill_role_owner_desc": "Voller Zugriff auf den Skill, einschließlich Teilen und Löschen",
+  "com_ui_skill_role_viewer_desc": "Kann die Ansicht ansehen und nutzen aber nicht bearbeiten",
+  "com_ui_skill_running": "Läuft {{0}}",
+  "com_ui_skill_sr_public": "Öffentlicher Skill",
+  "com_ui_skill_states_limit": "Du hast das Limit von {{0}} aktiven/inaktiven Skill-Overrides erreicht. Entferne einige Overrides, um neue Skills umzuschalten.",
+  "com_ui_skill_toggle_active": "Aktivstatus des Skills umschalten",
+  "com_ui_skill_unavailable": "Nicht verfügbarer Skill",
+  "com_ui_skill_update_conflict": "Eine andere Änderung wurde vor deiner gespeichert. Die neueste Version wird geladen.",
+  "com_ui_skill_update_error": "Speichern des Skills fehlgeschlagen",
+  "com_ui_skill_updated": "Skill gespeichert",
+  "com_ui_skill_upload": "Skill hochladen",
+  "com_ui_skill_upload_drag": "Zum Hochladen per Drag-and-drop ablegen oder klicken",
+  "com_ui_skill_upload_file": "Datei hochladen",
+  "com_ui_skill_upload_req_md": "Die .md-Datei muss Skill-Namen und Beschreibung im YAML-Format enthalten",
+  "com_ui_skill_upload_req_size": "Dateigröße darf {{0}} MB nicht überschreiten.",
+  "com_ui_skill_upload_req_zip": ".zip- oder .skill-Dateien müssen eine SKILL.md-Datei beinhalten",
+  "com_ui_skill_upload_requirements": "Dateianforderungen",
+  "com_ui_skill_upload_size_error": "Der Skill-Import darf {{0}} MB nicht überschreiten",
+  "com_ui_skill_upload_title": "Skill hochladen",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "Gerenderte Ansicht anzeigen",
+  "com_ui_skill_view_source": "Quelle ansehen",
+  "com_ui_skill_warnings": "Hinweis",
+  "com_ui_skill_write_instructions": "Skill-Anweisungen schreiben",
+  "com_ui_skills": "Skills",
+  "com_ui_skills_allow_create": "Erlaube das Erstellen von Skills",
+  "com_ui_skills_allow_share": "Erlaube das Teilen von Skills",
+  "com_ui_skills_allow_share_public": "Erlaube das öffentliche Teilen von Skills",
+  "com_ui_skills_allow_use": "Erlaube das Benutzen von Skills",
+  "com_ui_skills_always_apply_invoked": "Automatisch angewendete Skills",
+  "com_ui_skills_always_apply_pin_title": "Immer angewendeter Skill (bei jeder Anfrage automatisch vorbereitet)",
+  "com_ui_skills_command_placeholder": "Skill nach Namen auswählen",
+  "com_ui_skills_disabled_hint": "Skills sind für diesen Agenten deaktiviert. Aktiviere sie, damit das KI-Modell deinen Skill-Katalog verwenden kann.",
+  "com_ui_skills_empty": "Noch keine Skills",
+  "com_ui_skills_enable_toggle": "Aktiviere Skills für diesen Agenten",
+  "com_ui_skills_enabled_all_hint": "Aktiviert. Der gesamte verfügbare Katalog ist verfügbar. Du kannst ihn unten einschränken, wenn du begrenzen möchtest, welche Skills dieser Agent verwenden kann.",
+  "com_ui_skills_enabled_allowlist_hint": "Aktiviert. Auf die unten ausgewählten Skills beschränkt.",
+  "com_ui_skills_load_error": "Fehler beim Laden der Skills",
+  "com_ui_skills_manual_invoked": "Manuell aufgerufene Skills",
+  "com_ui_skills_queued": "Skills für die nächste Anfrage vorgemerkt",
+  "com_ui_sort_by": "Sortieren nach",
+  "com_ui_sort_chats_by": "Chats sortieren nach",
+  "com_ui_sort_created": "Erstellt",
+  "com_ui_sort_projects_by": "Projekte sortieren nach",
+  "com_ui_sort_updated": "Aktualisiert",
+  "com_ui_special": "Spezial",
   "com_ui_special_var_current_date": "Aktuelles Datum",
   "com_ui_special_var_current_datetime": "Aktuelles Datum & Uhrzeit",
   "com_ui_special_var_current_user": "Aktueller Nutzer",
+  "com_ui_special_var_desc_current_date": "Das heutige Datum und der Wochentag",
+  "com_ui_special_var_desc_current_datetime": "Lokales Datum und Uhrzeit in deiner Zeitzone",
+  "com_ui_special_var_desc_current_user": "Dein Anzeigename",
+  "com_ui_special_var_desc_iso_datetime": "UTC-Zeitangabe im ISO 8601-Format",
   "com_ui_special_var_iso_datetime": "UTC ISO Datum/Zeit",
   "com_ui_special_variable_added": "Spezialvariable {{0}} hinzugefügt.",
-  "com_ui_special_variables": "Spezielle Variablen:",
+  "com_ui_special_variables": "Besonder Variablen:",
   "com_ui_speech_not_supported": "Ihr Browser unterstützt keine Spracherkennung",
   "com_ui_speech_not_supported_use_external": "Dein Browser unterstützt keine Spracherkennung. Versuche in den Einstellungen unter „Sprache“ zu „Externes STT“ zu wechseln.",
   "com_ui_speech_while_submitting": "Spracheingabe nicht möglich während eine Antwort generiert wird",
   "com_ui_sr_global_prompt": "Globale Prompt-Gruppe",
+  "com_ui_sr_public_skill": "Öffentlicher Skill",
   "com_ui_stack_trace": "Stack Trace",
   "com_ui_status_prefix": "Status:",
   "com_ui_stop": "Stopp",
   "com_ui_storage": "Speicher",
   "com_ui_storage_filter_sort": "Nach Speicher filtern und sortieren",
+  "com_ui_subagent_cancelled": "Agent abgebrochen",
+  "com_ui_subagent_complete": "Agent gestartet",
+  "com_ui_subagent_dialog_description": "Untergeordneter Lauf mit isoliertem Kontext. Aktivität und Endergebnis findest du unten.",
+  "com_ui_subagent_dialog_title": "„{{0}}“-Agent",
+  "com_ui_subagent_dialog_title_self": "Agent",
+  "com_ui_subagent_empty_result": "Keine Antwort erhalten.",
+  "com_ui_subagent_errored": "Agent-Fehler aufgetreten",
+  "com_ui_subagent_no_result_yet": "Läuft noch - bisher kein Endergebnis.",
+  "com_ui_subagent_running": "Agent arbeitet",
+  "com_ui_subagent_scroll_to_bottom": "Scrolle zum Neuesten",
+  "com_ui_subagent_ticker_error": "Fehler",
+  "com_ui_subagent_ticker_reasoning": "Nachdenken",
+  "com_ui_subagent_ticker_tool_done": "Fertig",
+  "com_ui_subagent_ticker_using": "Nutze",
+  "com_ui_subagent_ticker_writing": "Schreibe",
+  "com_ui_subagent_waiting": "Warte auf das erste Update …",
   "com_ui_submit": "Absenden",
+  "com_ui_summarized": "Zusammengefasst",
+  "com_ui_summarizing": "Wird zusammengefasst...",
   "com_ui_support_contact": "Ansprechpartner-Kontakt",
   "com_ui_support_contact_email": "E-Mail",
   "com_ui_support_contact_email_invalid": "Bitte gib eine gültige E-Mail-Adresse ein",
@@ -1396,6 +1753,7 @@
   "com_ui_temporary": "Privater Chat",
   "com_ui_terms_and_conditions": "Allgemeine Geschäftsbedingungen",
   "com_ui_terms_of_service": "Nutzungsbedingungen",
+  "com_ui_text_variables": "Textvariablen",
   "com_ui_thinking": "Nachdenken...",
   "com_ui_thoughts": "Gedanken",
   "com_ui_toggle_theme": "Design umschalten",
@@ -1404,8 +1762,15 @@
   "com_ui_token_url": "Token-URL",
   "com_ui_tokens": "Tokens",
   "com_ui_tool_collection_prefix": "Eine Tools Sammlung von",
+  "com_ui_tool_failed": "fehlgeschlagen",
   "com_ui_tool_list_collapse": "Werkzeugliste von {{serverName}} einklappen",
   "com_ui_tool_list_expand": "Werkzeugliste von {{serverName}} ausklappen",
+  "com_ui_tool_name_code": "Code",
+  "com_ui_tool_name_code_analysis": "Codeanalyse",
+  "com_ui_tool_name_file_search": "Dateisuche",
+  "com_ui_tool_name_image_edit": "Bild bearbeiten",
+  "com_ui_tool_name_image_gen": "Bildgenerierung",
+  "com_ui_tool_name_web_search": "Web-Suche",
   "com_ui_tools": "Werkzeuge",
   "com_ui_tools_and_actions": "Werkzeuge und Aktionen",
   "com_ui_transferred_to": "Übergeben an",
@@ -1417,18 +1782,24 @@
   "com_ui_unarchive": "Aus Archiv holen",
   "com_ui_unarchive_conversation": "Unterhaltung dearchivieren",
   "com_ui_unarchive_error": "Konversation konnte nicht aus dem Archiv geholt werden",
+  "com_ui_unassigned": "Nicht zugewiesen",
   "com_ui_unavailable": "Nicht verfügbar",
+  "com_ui_unfavorite": "Aus Favoriten entfernen",
   "com_ui_unknown": "Unbekannt",
+  "com_ui_unknown_file_type": "Unbekannter Dateityp",
   "com_ui_unpin": "Loslösen",
+  "com_ui_unpin_error": "Konversation konnte nicht gelöst werden",
   "com_ui_unset": "Aufheben",
   "com_ui_untitled": "Unbenannt",
   "com_ui_update": "Aktualisieren",
   "com_ui_update_mcp_server": "MCP-Server aktualisieren",
+  "com_ui_updated_file": "{{0}} aktualisiert",
   "com_ui_updating": "Aktualisieren...",
   "com_ui_upload": "Hochladen",
   "com_ui_upload_agent_avatar": "Agenten-Avatar erfolgreich aktualisiert",
   "com_ui_upload_agent_avatar_label": "Avatarbild des Agenten hochladen",
   "com_ui_upload_avatar_label": "Avatarbild hochladen",
+  "com_ui_upload_code_environment": "In die Code-Umgebung hochladen",
   "com_ui_upload_delay": "Das Hochladen von \"{{0}}\" dauert etwas länger. Bitte warte, während die Datei für den Abruf indexiert wird.",
   "com_ui_upload_error": "Beim Hochladen Ihrer Datei ist ein Fehler aufgetreten",
   "com_ui_upload_file_context": "Kontext der Datei hochladen",
@@ -1448,15 +1819,19 @@
   "com_ui_use_backup_code": "Stattdessen Backup-Code verwenden",
   "com_ui_use_memory": "Erinnerung nutzen",
   "com_ui_use_micrphone": "Mikrofon verwenden",
+  "com_ui_use_prompt": "Prompt verwenden",
   "com_ui_used": "Verwendet",
+  "com_ui_used_n_tools": "{{0}} Tools benutzt",
   "com_ui_user": "Benutzer",
   "com_ui_user_group_permissions": "Benutzer- & Gruppenberechtigungen",
   "com_ui_user_provides_key": "Benutzer gibt eigenen Schlüssel an",
   "com_ui_value": "Wert",
+  "com_ui_variable_with_options": "Variable {{name}} mit {{count}} Optionen",
   "com_ui_variables": "Variablen",
   "com_ui_verify": "Überprüfen",
   "com_ui_version_var": "Version {{0}}",
   "com_ui_versions": "Versionen",
+  "com_ui_via_server": "in {{0}}",
   "com_ui_view_memory": "Erinnerung anzeigen",
   "com_ui_web_search": "Web-Suche\n",
   "com_ui_web_search_cohere_key": "Cohere API-Key eingeben",
@@ -1468,6 +1843,8 @@
   "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "Serper API\n",
   "com_ui_web_search_provider_serper_key": "Einen Serper API Schlüssel holen",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Hole dir deinen Tavily API-Schlüssel",
   "com_ui_web_search_reading": "Lesen der Suchergebnisse",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1480,16 +1857,24 @@
   "com_ui_web_search_scraper_firecrawl_key": "Einen Firecrawl API Schlüssel holen",
   "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "Hole einen Serper API Schlüssel",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Hole dir deinen Tavily API-Schlüssel",
   "com_ui_web_search_searxng_api_key": "SearXNG API Key (optional) einfügen",
   "com_ui_web_search_searxng_instance_url": "SearXNG Instanz URL",
+  "com_ui_web_search_source": "{{count}} Quelle",
+  "com_ui_web_search_sources": "{{count}} Quellen",
+  "com_ui_web_searched": "Im Internet gesucht",
   "com_ui_web_searching": "Internetsuche läuft",
   "com_ui_web_searching_again": "Sucht erneut im Internet",
   "com_ui_weekend_morning": "Schönes Wochenende",
   "com_ui_write": "Schreiben",
+  "com_ui_writing_command": "Schreibbefehl",
   "com_ui_x_selected": "{{0}} ausgewählt",
   "com_ui_xhigh": "Extra hoch",
   "com_ui_yes": "Ja",
+  "com_ui_you": "Du",
   "com_ui_your_api_key": "Dein API Key",
+  "com_ui_your_projects": "Deine Projekte",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Heranzoomen",
   "com_ui_zoom_level": "Zoomstufe",
diff --git a/client/src/locales/en/translation.json b/client/src/locales/en/translation.json
index 79b26d7e5aa..a45ebfd3b51 100644
--- a/client/src/locales/en/translation.json
+++ b/client/src/locales/en/translation.json
@@ -223,9 +223,10 @@
   "com_endpoint_agent": "Agent",
   "com_endpoint_agent_placeholder": "Please select an Agent",
   "com_endpoint_ai": "AI",
-  "com_endpoint_anthropic_effort": "Controls how much computational effort Claude applies. Lower effort saves tokens and reduces latency; higher effort produces more thorough responses. 'Max' enables the deepest reasoning (Opus 4.6 only).",
+  "com_endpoint_anthropic_effort": "Controls how much computational effort Claude applies. Lower effort saves tokens and reduces latency; higher effort produces more thorough responses. 'Max' enables the deepest reasoning on supported adaptive-thinking models.",
   "com_endpoint_anthropic_maxoutputtokens": "Maximum number of tokens that can be generated in the response. Specify a lower value for shorter responses and a higher value for longer responses. Note: models may stop before reaching this maximum.",
   "com_endpoint_anthropic_prompt_cache": "Prompt caching allows reusing large context or instructions across API calls, reducing costs and latency",
+  "com_endpoint_anthropic_prompt_cache_ttl": "How long a cached prompt prefix stays warm between requests. Leave unset to use the provider default (1 hour). The 1-hour cache keeps the prefix warm across longer gaps at a higher one-time write cost; choose 5 minutes for the legacy behavior.",
   "com_endpoint_anthropic_temp": "Ranges from 0 to 1. Use temp closer to 0 for analytical / multiple choice, and closer to 1 for creative and generative tasks. We recommend altering this or Top P but not both.",
   "com_endpoint_anthropic_thinking": "Enables internal reasoning for supported Claude models. For newer models (Opus 4.6+), uses adaptive thinking controlled by the Effort parameter. For legacy models, requires \"Thinking Budget\" to be set and lower than \"Max Output Tokens\".",
   "com_endpoint_anthropic_thinking_budget": "Determines the max number of tokens Claude is allowed use for its internal reasoning process. Larger budgets can improve response quality by enabling more thorough analysis for complex problems, although Claude may not use the entire budget allocated, especially at ranges above 32K. This setting must be lower than \"Max Output Tokens.\"",
@@ -238,6 +239,11 @@
   "com_endpoint_assistant_model": "Assistant Model",
   "com_endpoint_assistant_placeholder": "Please select an Assistant from the right-hand Side Panel",
   "com_endpoint_bedrock_reasoning_effort": "Controls the reasoning level for supported Bedrock models (e.g. Kimi K2.5, GLM). Higher levels produce more thorough reasoning at the cost of increased latency and tokens.",
+  "com_endpoint_config_bedrock_access_key_id": "AWS Access Key ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API Key",
+  "com_endpoint_config_bedrock_credentials_required": "Please provide either an AWS Bedrock API key or AWS access keys (Access Key ID + Secret Access Key)",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS Secret Access Key",
+  "com_endpoint_config_bedrock_session_token": "AWS Session Token",
   "com_endpoint_config_click_here": "Click Here",
   "com_endpoint_config_google_api_info": "To get your Generative Language API key (for Gemini),",
   "com_endpoint_config_google_api_key": "Google API Key",
@@ -258,6 +264,7 @@
   "com_endpoint_config_key_name": "Key",
   "com_endpoint_config_key_never_expires": "Your key will never expire",
   "com_endpoint_config_placeholder": "Set your Key in the Header menu to chat.",
+  "com_endpoint_config_required_fields": "The following fields are required:",
   "com_endpoint_config_value": "Enter value for",
   "com_endpoint_context": "Context",
   "com_endpoint_context_info": "The maximum number of tokens that can be used for context. Use this for control of how many tokens are sent per request. If unspecified, will use system defaults based on known models' context size. Setting higher values may result in errors and/or higher token cost.",
@@ -282,6 +289,7 @@
   "com_endpoint_google_topk": "Top-k changes how the model selects tokens for output. A top-k of 1 means the selected token is the most probable among all tokens in the model's vocabulary (also called greedy decoding), while a top-k of 3 means that the next token is selected from among the 3 most probable tokens (using temperature).",
   "com_endpoint_google_topp": "Top-p changes how the model selects tokens for output. Tokens are selected from most K (see topK parameter) probable to least until the sum of their probabilities equals the top-p value.",
   "com_endpoint_google_use_search_grounding": "Use Google's search grounding feature to enhance responses with real-time web search results. This enables models to access current information and provide more accurate, up-to-date answers.",
+  "com_endpoint_google_use_url_context": "Let the model read URLs you include in your message using Google's URL Context tool (web pages, images, and PDFs). YouTube links are handled separately via native video understanding, since the URL Context tool does not support YouTube.",
   "com_endpoint_instructions_assistants": "Override Instructions",
   "com_endpoint_instructions_assistants_placeholder": "Overrides the instructions of the assistant. This is useful for modifying the behavior on a per-run basis.",
   "com_endpoint_max_output_tokens": "Max Output Tokens",
@@ -330,6 +338,8 @@
   "com_endpoint_presets": "presets",
   "com_endpoint_presets_clear_warning": "Are you sure you want to clear all presets? This is irreversible.",
   "com_endpoint_prompt_cache": "Use Prompt Caching",
+  "com_endpoint_prompt_cache_ttl": "Prompt Cache Duration",
+  "com_endpoint_prompt_cache_ttl_default": "Default (1 hour)",
   "com_endpoint_prompt_prefix": "Custom Instructions",
   "com_endpoint_prompt_prefix_assistants": "Additional Instructions",
   "com_endpoint_prompt_prefix_assistants_placeholder": "Set additional instructions or context on top of the Assistant's main instructions. Ignored if empty.",
@@ -353,6 +363,7 @@
   "com_endpoint_use_active_assistant": "Use Active Assistant",
   "com_endpoint_use_responses_api": "Use Responses API",
   "com_endpoint_use_search_grounding": "Grounding with Google Search",
+  "com_endpoint_use_url_context": "URL Context",
   "com_endpoint_verbosity": "Verbosity",
   "com_error_endpoint_models_not_loaded": "Models for {{0}} could not be loaded. Please refresh the page and try again.",
   "com_error_expired_user_key": "Provided key for {{0}} expired at {{1}}. Please provide a new key and try again.",
@@ -399,6 +410,13 @@
   "com_hide_examples": "Hide Examples",
   "com_info_heic_converting": "Converting HEIC image to JPEG...",
   "com_nav_2fa": "Two-Factor Authentication (2FA)",
+  "com_nav_about_branch": "Branch",
+  "com_nav_about_build_date": "Built",
+  "com_nav_about_commit": "Commit",
+  "com_nav_about_diagnostics_copied": "Copied to clipboard",
+  "com_nav_about_diagnostics_copy": "Copy diagnostics",
+  "com_nav_about_diagnostics_description": "Copy this block when opening a support issue so maintainers can identify the exact build you're running.",
+  "com_nav_about_version": "Version",
   "com_nav_account_settings": "Account Settings",
   "com_nav_advanced_prompts": "Advanced prompts editor",
   "com_nav_advanced_prompts_desc": "Enable versioning and production control for prompts",
@@ -442,8 +460,6 @@
   "com_nav_browser": "Browser",
   "com_nav_center_chat_input": "Center Chat Input on Welcome Screen",
   "com_nav_change_picture": "Change picture",
-  "com_nav_chat_commands": "Chat Commands",
-  "com_nav_chat_commands_info": "These commands are activated by typing specific characters at the beginning of your message. Each command is triggered by its designated prefix. You can disable them if you frequently use these characters to start messages.",
   "com_nav_chat_direction": "Chat direction",
   "com_nav_chat_direction_selected": "Chat direction: {{direction}}",
   "com_nav_clear_all_chats": "Clear all chats",
@@ -451,7 +467,6 @@
   "com_nav_clear_conversation": "Clear conversations",
   "com_nav_clear_conversation_confirm_message": "Are you sure you want to clear all conversations? This is irreversible.",
   "com_nav_close_sidebar": "Close sidebar",
-  "com_nav_commands": "Commands",
   "com_nav_confirm_clear": "Confirm Clear",
   "com_nav_control_panel": "Control Panel",
   "com_nav_conversation_mode": "Conversation Mode",
@@ -485,6 +500,7 @@
   "com_nav_font_size_sm": "Small",
   "com_nav_font_size_xl": "Extra Large",
   "com_nav_font_size_xs": "Extra Small",
+  "com_nav_help": "Help",
   "com_nav_help_faq": "Help & FAQ",
   "com_nav_info_balance": "Balance shows how many token credits you have left to use. Token credits translate to monetary value (e.g., 1000 credits = $0.001 USD)",
   "com_nav_info_code_artifacts": "Enables the display of experimental code artifacts next to the chat",
@@ -577,14 +593,12 @@
   "com_nav_scroll_button": "Scroll to the end button",
   "com_nav_search_placeholder": "Search messages",
   "com_nav_send_message": "Send message",
+  "com_nav_setting_about": "About",
   "com_nav_setting_account": "Account",
-  "com_nav_setting_balance": "Balance",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Data controls",
   "com_nav_setting_delay": "Delay (s)",
   "com_nav_setting_general": "General",
   "com_nav_setting_mcp": "MCP Settings",
-  "com_nav_setting_personalization": "Personalization",
   "com_nav_setting_speech": "Speech",
   "com_nav_settings": "Settings",
   "com_nav_shared_links": "Shared links",
@@ -608,6 +622,49 @@
   "com_nav_user_msg_markdown": "Render user messages as markdown",
   "com_nav_user_name_display": "Display username in messages",
   "com_nav_voice_select": "Voice",
+  "com_shortcut_archive_conversation": "Archive conversation",
+  "com_shortcut_bookmark_conversation": "Bookmark conversation",
+  "com_shortcut_continue_response": "Continue response",
+  "com_shortcut_copy_last_code": "Copy last code block",
+  "com_shortcut_copy_last_response": "Copy last response",
+  "com_shortcut_delete_conversation": "Delete conversation",
+  "com_shortcut_edit_aria": "Customize shortcut for {{0}}",
+  "com_shortcut_edit_last_message": "Edit last message",
+  "com_shortcut_focus_chat_input": "Focus chat input",
+  "com_shortcut_focus_search": "Focus search",
+  "com_shortcut_group_chat": "Chat",
+  "com_shortcut_group_general": "General",
+  "com_shortcut_group_navigation": "Navigation",
+  "com_shortcut_group_panels": "Open panels",
+  "com_shortcut_group_panels_hint": "Click any row to assign",
+  "com_shortcut_keyboard_shortcuts": "Keyboard Shortcuts",
+  "com_shortcut_open_agents": "Open agents",
+  "com_shortcut_open_assistants": "Open assistants",
+  "com_shortcut_open_bookmarks": "Open bookmarks",
+  "com_shortcut_open_files": "Open files",
+  "com_shortcut_open_mcp": "Open MCP settings",
+  "com_shortcut_open_memories": "Open memories",
+  "com_shortcut_open_model_selector": "Open model selector",
+  "com_shortcut_open_parameters": "Open parameters",
+  "com_shortcut_open_prompts": "Open prompts",
+  "com_shortcut_read_aloud": "Read last response aloud",
+  "com_shortcut_recorder_conflict": "Already used by \"{{0}}\".",
+  "com_shortcut_recorder_conflict_prefix": "Conflicts with",
+  "com_shortcut_recorder_hint": "Press a combination — Esc to cancel",
+  "com_shortcut_recorder_needs_modifier": "Add Cmd, Ctrl, or Alt to your combo",
+  "com_shortcut_recorder_placeholder": "Press a combination…",
+  "com_shortcut_recorder_replace": "Replace",
+  "com_shortcut_recorder_try_again": "Try again",
+  "com_shortcut_regenerate_response": "Regenerate response",
+  "com_shortcut_reset": "Reset",
+  "com_shortcut_reset_all": "Reset all to defaults",
+  "com_shortcut_scroll_to_bottom": "Scroll to bottom",
+  "com_shortcut_scroll_to_top": "Scroll to top",
+  "com_shortcut_set": "Set shortcut",
+  "com_shortcut_show_shortcuts": "Show keyboard shortcuts",
+  "com_shortcut_submit_message": "Submit message",
+  "com_shortcut_toggle_sidebar": "Toggle sidebar",
+  "com_shortcut_upload_file": "Upload file",
   "com_show_examples": "Show Examples",
   "com_sidepanel_agent_builder": "Agent Builder",
   "com_sidepanel_assistant_builder": "Assistant Builder",
@@ -659,11 +716,13 @@
   "com_ui_add_multi_conversation": "Add multi-conversation",
   "com_ui_add_skills": "Add Skills",
   "com_ui_add_special_variables": "Add Special Variables",
+  "com_ui_add_to_chat": "Add to chat",
   "com_ui_add_web_search_api_keys": "Add Web Search API Keys",
   "com_ui_adding_details": "Adding details",
   "com_ui_additional_details": "Additional Details",
   "com_ui_admin": "Admin",
   "com_ui_admin_access_warning": "Disabling Admin access to this feature may cause unexpected UI issues requiring refresh. If saved, the only way to revert is via the interface setting in librechat.yaml config which affects all roles.",
+  "com_ui_admin_panel": "Admin Panel",
   "com_ui_admin_access_denied": "Access Denied",
   "com_ui_admin_access_denied_message": "You do not have permission to access the admin panel.",
   "com_ui_admin_back_to_chat": "Back to chat",
@@ -703,7 +762,6 @@
   "com_ui_advanced_settings": "Advanced Settings",
   "com_ui_agent": "Agent",
   "com_ui_agent_api_keys": "Agent API Keys",
-  "com_ui_agent_api_keys_description": "Create API keys to access agents remotely via the API",
   "com_ui_agent_category_aftersales": "After Sales",
   "com_ui_agent_category_finance": "Finance",
   "com_ui_agent_category_general": "General",
@@ -767,19 +825,38 @@
   "com_ui_agents_allow_share_public": "Allow sharing Agents publicly",
   "com_ui_agents_allow_use": "Allow using Agents",
   "com_ui_all": "all",
+  "com_ui_all_projects": "All projects",
   "com_ui_all_proper": "All",
   "com_ui_analyzing": "Analyzing",
   "com_ui_analyzing_finished": "Finished analyzing",
   "com_ui_api_key": "API Key",
-  "com_ui_api_key_copied": "API key copied to clipboard",
   "com_ui_api_key_create_error": "Failed to create API key",
   "com_ui_api_key_created": "API key created successfully",
+  "com_ui_api_key_delete_confirm": "Delete \"{{0}}\"? This action cannot be undone.",
   "com_ui_api_key_delete_error": "Failed to delete API key",
+  "com_ui_api_key_delete_name": "Delete API key {{0}}",
+  "com_ui_api_key_delete_warning": "Applications using this key will immediately lose access.",
   "com_ui_api_key_deleted": "API key deleted successfully",
+  "com_ui_api_key_expiration": "Expiration",
+  "com_ui_api_key_expire_1y": "1 year",
+  "com_ui_api_key_expire_30d": "30 days",
+  "com_ui_api_key_expire_7d": "7 days",
+  "com_ui_api_key_expire_90d": "90 days",
+  "com_ui_api_key_expire_never": "Never",
+  "com_ui_api_key_expired": "Expired",
+  "com_ui_api_key_expires_in_day": "Expires in 1 day",
+  "com_ui_api_key_expires_in_days": "Expires in {{0}} days",
+  "com_ui_api_key_expires_on": "Expires on {{0}}",
+  "com_ui_api_key_last_used": "Last used {{0}}",
   "com_ui_api_key_name": "Key Name",
   "com_ui_api_key_name_placeholder": "My API Key",
   "com_ui_api_key_name_required": "API key name is required",
+  "com_ui_api_key_never_used": "Never used",
+  "com_ui_api_key_no_expiration": "No expiration",
   "com_ui_api_key_warning": "Make sure to copy your API key now. You won't be able to see it again!",
+  "com_ui_api_keys_description": "API keys let external apps and tools run your agents through LibreChat's OpenAI-compatible API. Treat each one like a password: anyone who has it can act as you, so revoke any keys you no longer use.",
+  "com_ui_api_keys_empty_text": "API keys let external applications run your agents through the OpenAI-compatible API. Create a key to get started.",
+  "com_ui_api_keys_empty_title": "Connect your agents to external apps",
   "com_ui_api_keys_load_error": "Failed to load API keys",
   "com_ui_archive": "Archive",
   "com_ui_archive_delete_error": "Failed to delete archived conversation",
@@ -853,10 +930,13 @@
   "com_ui_branch_error": "Failed to create branch",
   "com_ui_branch_message": "Create branch from this response",
   "com_ui_by_author": "by {{0}}",
+  "com_ui_cache_read": "Cache read",
+  "com_ui_cache_write": "Cache write",
   "com_ui_callback_url": "Callback URL",
   "com_ui_cancel": "Cancel",
   "com_ui_cancelled": "Cancelled",
   "com_ui_category": "Category",
+  "com_ui_change_project": "Change project",
   "com_ui_change_version": "Change Version",
   "com_ui_chat": "Chat",
   "com_ui_chat_history": "Chat History",
@@ -897,7 +977,27 @@
   "com_ui_connecting": "Connecting",
   "com_ui_contact_admin_if_issue_persists": "Contact the Admin if the issue persists",
   "com_ui_context": "Context",
+  "com_ui_context_cost": "Cost",
+  "com_ui_context_cost_branch": "Cost (this branch)",
+  "com_ui_context_cost_total": "All branches",
   "com_ui_context_filter_sort": "Filter and Sort by Context",
+  "com_ui_context_free": "Free space",
+  "com_ui_context_messages": "Messages",
+  "com_ui_context_subagents": "Subagents",
+  "com_ui_context_summary": "Summary",
+  "com_ui_context_system": "System prompt",
+  "com_ui_context_tools": "Tool schemas",
+  "com_ui_context_tools_mcp": "MCP tools",
+  "com_ui_context_tools_mcp_deferred": "MCP tools (deferred)",
+  "com_ui_context_tools_system": "System tools",
+  "com_ui_context_tools_system_deferred": "System tools (deferred)",
+  "com_ui_context_unknown": "Context size unknown",
+  "com_ui_context_usage": "Context usage",
+  "com_ui_context_usage_label": "Context window: {{0}} of {{1}} tokens used ({{2}}%)",
+  "com_ui_context_usage_label_unknown": "Context usage: {{0}} tokens used",
+  "com_ui_context_usage_snapshot": "Context {{0}} / {{1}} ({{2}}%)",
+  "com_ui_context_usage_snapshot_unknown": "Context {{0}}",
+  "com_ui_context_window": "Context window",
   "com_ui_continue": "Continue",
   "com_ui_continue_oauth": "Continue with OAuth",
   "com_ui_control_bar": "Control bar",
@@ -927,13 +1027,16 @@
   "com_ui_create_mcp_server": "Create MCP server",
   "com_ui_create_memory": "Create Memory",
   "com_ui_create_new_agent": "Create New Agent",
+  "com_ui_create_project": "Create project",
   "com_ui_create_prompt": "Create Prompt",
   "com_ui_create_prompt_page": "New Prompt Configuration Page",
   "com_ui_create_skill": "Create Skill",
   "com_ui_create_skill_upload": "Upload SKILL.md",
   "com_ui_create_skill_upload_error": "Failed to read the uploaded file",
   "com_ui_created": "Created",
+  "com_ui_created_file": "Created {{0}}",
   "com_ui_creating": "Creating...",
+  "com_ui_creating_file": "Creating {{0}}",
   "com_ui_creating_image": "Creating image. May take a moment",
   "com_ui_current": "Current",
   "com_ui_currently_production": "Currently in production",
@@ -966,6 +1069,7 @@
   "com_ui_delete_action_confirm": "Are you sure you want to delete this action?",
   "com_ui_delete_agent": "Delete Agent",
   "com_ui_delete_agent_confirm": "Are you sure you want to delete this agent?",
+  "com_ui_delete_api_key": "Delete API Key",
   "com_ui_delete_assistant": "Delete Assistant",
   "com_ui_delete_assistant_confirm": "Are you sure you want to delete this Assistant? This cannot be undone.",
   "com_ui_delete_confirm": "This will delete",
@@ -978,6 +1082,8 @@
   "com_ui_delete_memory": "Delete Memory",
   "com_ui_delete_not_allowed": "Delete operation is not allowed",
   "com_ui_delete_preset": "Delete Preset?",
+  "com_ui_delete_project": "Delete project?",
+  "com_ui_delete_project_confirm": "Delete \"{{name}}\"? The chats inside won't be deleted.",
   "com_ui_delete_prompt": "Delete Prompt?",
   "com_ui_delete_shared_link": "Delete shared link?",
   "com_ui_delete_shared_link_heading": "Delete Shared Link",
@@ -1019,6 +1125,8 @@
   "com_ui_edit_prompt_page": "Edit Prompt Page",
   "com_ui_edit_skill": "Edit Skill",
   "com_ui_editable_message": "Editable Message",
+  "com_ui_edited_file": "Edited {{0}}",
+  "com_ui_editing_file": "Editing {{0}}",
   "com_ui_editor_instructions": "Drag the image to reposition • Use zoom slider or buttons to adjust size",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Endpoint",
@@ -1037,6 +1145,7 @@
   "com_ui_error_try_following_prefix": "Please try one of the following",
   "com_ui_error_unexpected": "Oops! Something Unexpected Occurred",
   "com_ui_error_updating_preferences": "Error updating preferences",
+  "com_ui_estimated": "Estimated from message history",
   "com_ui_everyone_permission_level": "Everyone's permission level",
   "com_ui_examples": "Examples",
   "com_ui_expand": "Expand",
@@ -1071,6 +1180,7 @@
   "com_ui_file_token_limit": "File Token Limit",
   "com_ui_file_token_limit_desc": "Set maximum token limit for file processing to control costs and resource usage",
   "com_ui_files": "Files",
+  "com_ui_files_count_size": "{{0}} Files ({{1}}KB)",
   "com_ui_filter_mcp_servers": "Filter MCP servers by name",
   "com_ui_filter_prompts": "Filter Prompts",
   "com_ui_filter_prompts_name": "Filter prompts by name",
@@ -1120,7 +1230,7 @@
   "com_ui_hide": "Hide",
   "com_ui_hide_code": "Hide Code",
   "com_ui_hide_image_details": "Hide Image Details",
-  "com_ui_hide_password": "Hide password",
+  "com_ui_hide_n_files": "Hide {{0}} files",
   "com_ui_hide_qr": "Hide QR Code",
   "com_ui_high": "High",
   "com_ui_host": "Host",
@@ -1152,9 +1262,9 @@
   "com_ui_key": "Key",
   "com_ui_key_required": "API key is required",
   "com_ui_labels": "Labels",
-  "com_ui_last_used": "Last used",
   "com_ui_late_night": "Happy late night",
   "com_ui_latest": "latest",
+  "com_ui_latest_activity": "Latest activity",
   "com_ui_latest_footer": "Every AI for Everyone.",
   "com_ui_latest_version": "Latest version",
   "com_ui_leave_blank_to_keep": "Leave blank to keep existing",
@@ -1164,6 +1274,7 @@
   "com_ui_link_copied": "Link copied",
   "com_ui_link_refreshed": "Link refreshed",
   "com_ui_live": "live",
+  "com_ui_load_more": "Load more",
   "com_ui_loading": "Loading...",
   "com_ui_locked": "Locked",
   "com_ui_logo": "{{0}} Logo",
@@ -1210,6 +1321,7 @@
   "com_ui_mcp_server_updated": "MCP server updated successfully",
   "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
   "com_ui_mcp_servers": "MCP Servers",
+  "com_ui_mcp_servers_allow_configure_obo": "Allow users to configure On-Behalf-Of (OBO) on MCP servers",
   "com_ui_mcp_servers_allow_create": "Allow users to create MCP servers",
   "com_ui_mcp_servers_allow_share": "Allow users to share MCP servers",
   "com_ui_mcp_servers_allow_share_public": "Allow users to share MCP servers publicly",
@@ -1263,19 +1375,23 @@
   "com_ui_model_parameters_reset": "Model Parameters have been reset.",
   "com_ui_model_selected": "{{0}} selected",
   "com_ui_model_spec": "Model Spec",
+  "com_ui_more_count": "{{0}} more",
   "com_ui_more_info": "More info",
+  "com_ui_more_options": "More options",
   "com_ui_my_prompts": "My Prompts",
   "com_ui_my_skills": "My Skills",
+  "com_ui_n_files": "{{0}} files",
   "com_ui_name": "Name",
   "com_ui_name_sort": "Sort by Name",
   "com_ui_navigate_results": "Navigate results",
   "com_ui_new": "New",
   "com_ui_new_chat": "New chat",
+  "com_ui_new_chat_in_project": "New chat in {{name}}",
   "com_ui_new_conversation_title": "New Conversation Title",
+  "com_ui_new_project": "New project",
   "com_ui_next": "Next",
   "com_ui_next_result": "Next result",
   "com_ui_no": "No",
-  "com_ui_no_api_keys": "No API keys yet. Create one to get started.",
   "com_ui_no_auth": "None (Auto-detect)",
   "com_ui_no_bookmarks": "it seems like you have no bookmarks yet. Click on a chat and add a new one",
   "com_ui_no_bookmarks_match": "No bookmarks match your search",
@@ -1290,7 +1406,8 @@
   "com_ui_no_memories": "No memories. Create them manually or prompt the AI to remember something",
   "com_ui_no_memories_match": "No memories match your search",
   "com_ui_no_memories_title": "No memories yet",
-  "com_ui_no_personalization_available": "No personalization options are currently available",
+  "com_ui_no_project_chats": "No chats yet",
+  "com_ui_no_projects": "No projects yet",
   "com_ui_no_prompts_title": "No prompts yet",
   "com_ui_no_read_access": "You don't have permission to view memories",
   "com_ui_no_results_found": "No results found",
@@ -1309,12 +1426,17 @@
   "com_ui_oauth_error_title": "Authentication Failed",
   "com_ui_oauth_success_description": "Your authentication was successful. This window will close in",
   "com_ui_oauth_success_title": "Authentication Successful",
+  "com_ui_obo": "On-Behalf-Of (OBO)",
+  "com_ui_obo_readonly_no_permission": "OBO is configured for this server but your role no longer has permission to modify it. Contact an administrator to make changes.",
+  "com_ui_obo_scopes": "OBO Scopes",
+  "com_ui_obo_scopes_description": "Scopes to request for the downstream MCP server via the On-Behalf-Of flow. Requires OpenID Connect authentication (e.g., Entra ID).",
   "com_ui_of": "of",
   "com_ui_off": "Off",
   "com_ui_offline": "Offline",
   "com_ui_omitted": "Omitted",
   "com_ui_on": "On",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (opens in new tab)",
+  "com_ui_open_project": "Open project",
   "com_ui_open_source_chat_new_tab": "Open Source Chat in New Tab",
   "com_ui_open_source_chat_new_tab_title": "Open Source Chat in New Tab - {{title}}",
   "com_ui_open_var": "Open {{0}}",
@@ -1334,6 +1456,9 @@
   "com_ui_permissions_failed_update": "Failed to update permissions. Please try again.",
   "com_ui_permissions_updated_success": "Permissions updated successfully",
   "com_ui_pin": "Pin",
+  "com_ui_pin_error": "Failed to pin conversation",
+  "com_ui_pinned": "Pinned",
+  "com_ui_plus_n_more": "+{{0}} more",
   "com_ui_preferences_updated": "Preferences updated successfully",
   "com_ui_prev": "Prev",
   "com_ui_prev_result": "Previous result",
@@ -1344,6 +1469,17 @@
   "com_ui_privacy_policy": "Privacy policy",
   "com_ui_privacy_policy_url": "Privacy Policy URL",
   "com_ui_production": "Production",
+  "com_ui_project_chat_count": "{{count}} chats",
+  "com_ui_project_chat_count_single": "1 chat",
+  "com_ui_project_create_error": "Failed to create project",
+  "com_ui_project_delete_error": "Failed to delete project",
+  "com_ui_project_name": "Project name",
+  "com_ui_project_name_placeholder": "New project",
+  "com_ui_project_not_found": "Project not found",
+  "com_ui_project_rename_error": "Failed to rename project",
+  "com_ui_project_update_error": "Failed to update project assignment",
+  "com_ui_project_updated": "Project assignment updated",
+  "com_ui_projects": "Projects",
   "com_ui_prompt": "Prompt",
   "com_ui_prompt_category_selector_aria": "Prompt's category selector",
   "com_ui_prompt_delete_confirm": "Are you sure you want to delete the '{{0}}' prompt?",
@@ -1368,7 +1504,11 @@
   "com_ui_prompts_allow_share_public": "Allow sharing Prompts publicly",
   "com_ui_prompts_allow_use": "Allow using Prompts",
   "com_ui_provider": "Provider",
+  "com_ui_provider_api_keys_description": "Manage API keys for endpoints configured to use a user-provided key.",
+  "com_ui_provider_api_keys_not_set": "No key set",
   "com_ui_quality": "Quality",
+  "com_ui_quote_selections": "{{0}} selections",
+  "com_ui_quotes_queued": "Quotes added for your next message",
   "com_ui_ran_n_agents": "Ran {{0}} agents",
   "com_ui_read_aloud": "Read aloud",
   "com_ui_read_file": "Read {{0}}",
@@ -1378,6 +1518,7 @@
   "com_ui_redirecting_to_provider": "Redirecting to {{0}}, please wait...",
   "com_ui_reference_saved_memories": "Reference saved memories",
   "com_ui_reference_saved_memories_description": "Allow the assistant to reference and use your saved memories when responding",
+  "com_ui_referenced_quotes": "Referenced quotes",
   "com_ui_refresh": "Refresh",
   "com_ui_refresh_link": "Refresh link",
   "com_ui_refresh_page": "Refresh page",
@@ -1400,11 +1541,15 @@
   "com_ui_remote_agents_allow_share_public": "Allow users to grant API access to agents to all users",
   "com_ui_remote_agents_allow_use": "Allow users to create API keys and query agents remotely",
   "com_ui_remove_agent_from_chain": "Remove {{0}} from chain",
+  "com_ui_remove_all_quotes": "Remove all selections",
+  "com_ui_remove_from_project": "Remove from project",
+  "com_ui_remove_quote": "Remove quote",
   "com_ui_remove_skill_var": "Remove {{0}}",
   "com_ui_remove_user": "Remove {{0}}",
   "com_ui_rename": "Rename",
   "com_ui_rename_conversation": "Rename Conversation",
   "com_ui_rename_failed": "Failed to rename conversation",
+  "com_ui_rename_project": "Rename project",
   "com_ui_requires_auth": "Requires Authentication",
   "com_ui_reset": "Reset",
   "com_ui_reset_adjustments": "Reset adjustments",
@@ -1459,7 +1604,9 @@
   "com_ui_search_above_to_add_people": "Search above to add people",
   "com_ui_search_agent_category": "Search categories...",
   "com_ui_search_default_placeholder": "Search by name or email (min 2 chars)",
+  "com_ui_search_language": "Search languages...",
   "com_ui_search_people_placeholder": "Search for people or groups by name or email",
+  "com_ui_search_projects": "Search projects",
   "com_ui_search_result_count": "{{count}} result found",
   "com_ui_search_results_count": "{{count}} results found",
   "com_ui_search_skills": "Search skills...",
@@ -1473,6 +1620,7 @@
   "com_ui_select_model": "Select a model",
   "com_ui_select_options": "Select options...",
   "com_ui_select_or_create_prompt": "Select or Create a Prompt",
+  "com_ui_select_project": "Select project",
   "com_ui_select_provider": "Select a provider",
   "com_ui_select_provider_first": "Select a provider first",
   "com_ui_select_region": "Select a region",
@@ -1481,17 +1629,63 @@
   "com_ui_select_search_provider": "Search provider by name",
   "com_ui_select_search_region": "Search region by name",
   "com_ui_set": "Set",
+  "com_ui_settings_label_2fa": "Two-factor authentication",
+  "com_ui_settings_label_agent_api_keys": "Agent API keys",
+  "com_ui_settings_label_auto_refill": "Auto-refill",
+  "com_ui_settings_label_avatar": "Avatar",
+  "com_ui_settings_label_backup_codes": "Backup codes",
+  "com_ui_settings_label_clear_chats": "Clear all chats",
+  "com_ui_settings_label_conversation_mode": "Conversation mode",
+  "com_ui_settings_label_credits": "Token balance",
+  "com_ui_settings_label_decibel": "Decibel threshold",
+  "com_ui_settings_label_delete_account": "Delete account",
+  "com_ui_settings_label_delete_cache": "Delete cache",
+  "com_ui_settings_label_engine_stt": "Speech-to-text engine",
+  "com_ui_settings_label_engine_tts": "Text-to-speech engine",
+  "com_ui_settings_label_import": "Import conversations",
+  "com_ui_settings_label_language_stt": "Speech-to-text language",
+  "com_ui_settings_label_playback_rate": "Playback rate",
+  "com_ui_settings_label_provider_api_keys": "Provider API keys",
+  "com_ui_settings_label_revoke_keys": "Revoke keys",
+  "com_ui_settings_label_shared_links": "Shared links",
+  "com_ui_settings_label_voice": "Voice",
+  "com_ui_settings_no_results": "No settings match your search",
+  "com_ui_settings_results_aria": "Search results",
+  "com_ui_settings_search_placeholder": "Search settings",
+  "com_ui_settings_section_accessibility": "Accessibility",
+  "com_ui_settings_section_api_keys": "API keys",
+  "com_ui_settings_section_appearance": "Appearance",
+  "com_ui_settings_section_billing": "Billing",
+  "com_ui_settings_section_commands": "Commands",
+  "com_ui_settings_section_conversations": "Conversations",
+  "com_ui_settings_section_danger_zone": "Danger zone",
+  "com_ui_settings_section_data": "Your data",
+  "com_ui_settings_section_layout": "Layout",
+  "com_ui_settings_section_memory": "Memory",
+  "com_ui_settings_section_messages": "Messages",
+  "com_ui_settings_section_profile": "Profile",
+  "com_ui_settings_section_prompts": "Prompts",
+  "com_ui_settings_section_security": "Security",
+  "com_ui_settings_section_sending": "Sending",
+  "com_ui_settings_section_stt": "Speech to text",
+  "com_ui_settings_section_tts": "Text to speech",
+  "com_ui_settings_tab_data": "Data & Privacy",
   "com_ui_share": "Share",
   "com_ui_share_create_message": "Your name and any messages you add after sharing stay private.",
   "com_ui_share_delete_error": "There was an error deleting the shared link",
   "com_ui_share_error": "There was an error sharing the chat link",
   "com_ui_share_everyone": "Share with everyone",
   "com_ui_share_everyone_description_var": "This {{resource}} will be available to everyone. Please make sure the {{resource}} is really meant to be shared with everyone. Be careful with your data.",
+  "com_ui_share_files": "Share files in this conversation",
+  "com_ui_share_files_description": "Images and files in this conversation won't be visible to viewers unless this is enabled.",
+  "com_ui_share_files_refresh_note": "Refresh the link to apply this change — files are snapshotted when the link is refreshed.",
   "com_ui_share_link_to_chat": "Share link to chat",
   "com_ui_share_qr_code_description": "QR code for sharing this conversation link",
   "com_ui_share_update_message": "Your name, custom instructions, and any messages you add after sharing stay private.",
   "com_ui_share_var": "Share {{0}}",
+  "com_ui_shared_link": "shared link",
   "com_ui_shared_link_delete_success": "Successfully deleted shared link",
+  "com_ui_shared_link_manage_access": "Manage Access",
   "com_ui_shared_link_not_found": "Shared link not found",
   "com_ui_shared_prompts": "Shared Prompts",
   "com_ui_show": "Show",
@@ -1500,10 +1694,9 @@
   "com_ui_show_image_details": "Show Image Details",
   "com_ui_show_less": "Show less",
   "com_ui_show_more": "Show more",
-  "com_ui_show_password": "Show password",
+  "com_ui_show_n_files": "Show {{0}} files",
   "com_ui_show_qr": "Show QR Code",
   "com_ui_sign_in_to_domain": "Sign-in to {{0}}",
-  "com_ui_simple": "Simple",
   "com_ui_size": "Size",
   "com_ui_size_sort": "Sort by Size",
   "com_ui_skill": "Skill",
@@ -1544,6 +1737,7 @@
   "com_ui_skill_sr_public": "Public skill",
   "com_ui_skill_states_limit": "You've reached the limit of {{0}} active/inactive skill overrides. Remove some overrides to toggle new skills.",
   "com_ui_skill_toggle_active": "Toggle skill active state",
+  "com_ui_skill_unavailable": "Unavailable skill",
   "com_ui_skill_update_conflict": "Another edit was saved before yours. Reloading the latest version.",
   "com_ui_skill_update_error": "Failed to save skill",
   "com_ui_skill_updated": "Skill saved",
@@ -1577,6 +1771,11 @@
   "com_ui_skills_load_error": "Failed to load skills",
   "com_ui_skills_manual_invoked": "Manually invoked skills",
   "com_ui_skills_queued": "Skills queued for next submission",
+  "com_ui_sort_by": "Sort by",
+  "com_ui_sort_chats_by": "Sort chats by",
+  "com_ui_sort_created": "Created",
+  "com_ui_sort_projects_by": "Sort projects by",
+  "com_ui_sort_updated": "Updated",
   "com_ui_special": "special",
   "com_ui_special_var_current_date": "Current Date",
   "com_ui_special_var_current_datetime": "Current Date & Time",
@@ -1655,15 +1854,18 @@
   "com_ui_unarchive": "Unarchive",
   "com_ui_unarchive_conversation": "Unarchive conversation",
   "com_ui_unarchive_error": "Failed to unarchive conversation",
+  "com_ui_unassigned": "Unassigned",
   "com_ui_unavailable": "Unavailable",
   "com_ui_unfavorite": "Remove from favorites",
   "com_ui_unknown": "Unknown",
   "com_ui_unknown_file_type": "Unknown file type",
   "com_ui_unpin": "Unpin",
+  "com_ui_unpin_error": "Failed to unpin conversation",
   "com_ui_unset": "Unset",
   "com_ui_untitled": "Untitled",
   "com_ui_update": "Update",
   "com_ui_update_mcp_server": "Update MCP server",
+  "com_ui_updated_file": "Updated {{0}}",
   "com_ui_updating": "Updating...",
   "com_ui_upload": "Upload",
   "com_ui_upload_agent_avatar": "Successfully updated agent avatar",
@@ -1744,6 +1946,7 @@
   "com_ui_yes": "Yes",
   "com_ui_you": "You",
   "com_ui_your_api_key": "Your API Key",
+  "com_ui_your_projects": "Your projects",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Zoom in",
   "com_ui_zoom_level": "Zoom level",
diff --git a/client/src/locales/es/translation.json b/client/src/locales/es/translation.json
index 2c45563b055..41f28865572 100644
--- a/client/src/locales/es/translation.json
+++ b/client/src/locales/es/translation.json
@@ -1,14 +1,19 @@
 {
-  "chat_direction_left_to_right": "Izquierda a Derecha",
+  "chat_direction_left_to_right": "De izquierda a derecha",
   "chat_direction_right_to_left": "Derecha a Izquierda",
-  "com_a11y_ai_composing": "La IA está componiendo la respuesta ",
-  "com_a11y_end": "La IA ha finalizado su respuesta ",
-  "com_a11y_selected": "Seleccionado",
+  "com_a11y_ai_composing": "La IA está redactando una respuesta.",
+  "com_a11y_chats_date_section": "Chats del {{date}}",
+  "com_a11y_end": "La IA ha finalizado su respuesta",
+  "com_a11y_selected": "seleccionado",
   "com_a11y_start": "La IA ha comenzado su respuesta",
+  "com_a11y_summarize_completed": "Contexto resumido.",
+  "com_a11y_summarize_failed": "Error al resumir, continuando con el contexto disponible.",
+  "com_a11y_summarize_started": "Resumiendo contexto.",
   "com_agents_agent_card_label": "{{name}} agente. {{description}}",
-  "com_agents_all": "Todos los agentes",
+  "com_agents_all": "Todos los Agentes",
   "com_agents_all_category": "Todos",
   "com_agents_all_description": "Explora todos los agentes compartidos en todas las categorías",
+  "com_agents_avatar_upload_error": "Error al subir el avatar del agente",
   "com_agents_category_aftersales": "Posventa",
   "com_agents_category_aftersales_description": "Agentes especializados en soporte postventa, mantenimiento y atención al cliente",
   "com_agents_category_empty": "No se encontraron agentes en la categoría {{category}}",
@@ -23,11 +28,11 @@
   "com_agents_category_rd": "Investigación y desarrollo",
   "com_agents_category_rd_description": "Agentes centrados en procesos de I+D, innovación e investigación técnica",
   "com_agents_category_sales": "Ventas",
-  "com_agents_category_sales_description": "Agentes enfocados en procesos de venta, relaciones con el client",
+  "com_agents_category_sales_description": "Agentes enfocados en procesos de venta, relaciones con el cliente",
   "com_agents_category_tab_label": "{{category}} categoría, {{position}} de {{total}}",
   "com_agents_category_tabs_label": "Categorías de agentes",
   "com_agents_chat_with": "Chatear con {{name}}",
-  "com_agents_clear_search": "Limpiar Busqueda",
+  "com_agents_clear_search": "Limpiar búsqueda",
   "com_agents_contact": "Contacto",
   "com_agents_copy_link": "Copiar enlace",
   "com_agents_create_error": "Hubo un error al crear su agente.",
@@ -36,11 +41,11 @@
   "com_agents_description_placeholder": "Opcional: Describa su Agente aquí",
   "com_agents_empty_state_heading": "No se encontró ningún agente",
   "com_agents_enable_file_search": "Habilitar búsqueda de archivos",
-  "com_agents_error_bad_request_message": "No se ha podido procesar la solicitud.",
+  "com_agents_error_bad_request_message": "No se pudo procesar la solicitud.",
   "com_agents_error_category_title": "Error de categoría",
   "com_agents_error_generic": "Hemos encontrado un problema al cargar el contenido.",
   "com_agents_error_invalid_request": "Petición inválida",
-  "com_agents_error_loading": "Error al cargar los agente",
+  "com_agents_error_loading": "Error al cargar los agentes",
   "com_agents_error_network_message": "No se puede conectar con el servidor.",
   "com_agents_error_network_suggestion": "Comprueba tu conexión a Internet y vuelve a intentarlo.",
   "com_agents_error_network_title": "Problema de conexión",
@@ -65,36 +70,36 @@
   "com_agents_link_copied": "Enlace copiado",
   "com_agents_link_copy_failed": "No se pudo copiar el enlace",
   "com_agents_loading": "Cargando...",
-  "com_agents_marketplace": "Marketplace de Agentes",
+  "com_agents_marketplace": "Tienda de Agentes",
   "com_agents_marketplace_subtitle": "Descubre y usa el poder de los agentes de inteligencia artificial para mejorar tu productividad y tus flujos de trabajo",
-  "com_agents_mcp_description_placeholder": "Explica que hace en pocas palabras",
-  "com_agents_mcp_icon_size": "Tamaño minimo 128 x128 px",
-  "com_agents_mcp_name_placeholder": "Herramienta Personalizada",
-  "com_agents_mcp_trust_subtext": "LibreChat no verifica los conectores personalizado",
+  "com_agents_mcp_description_placeholder": "Explica brevemente qué hace",
+  "com_agents_mcp_icon_size": "Tamaño mínimo 128 x 128 px",
+  "com_agents_mcp_name_placeholder": "Herramienta personalizada",
+  "com_agents_mcp_trust_subtext": "LibreChat no verifica los conectores personalizados",
   "com_agents_missing_name": "Por favor, escriba un nombre antes de crear un agente.",
   "com_agents_missing_provider_model": "Por favor, seleccione un proveedor y un modelo antes de crear un agente.",
   "com_agents_name_placeholder": "Opcional: El nombre del agente",
-  "com_agents_no_access": "No tiene acceso para editar este agente",
-  "com_agents_no_agent_id_error": "No se encontró ningún ID de agente. Asegúrese de crear primero el agente.",
-  "com_agents_no_more_results": "Ha llegado al final de los resultados.",
+  "com_agents_no_access": "No tienes acceso para editar este agente.",
+  "com_agents_no_agent_id_error": "No se encontró ID de agente. Asegúrese de que el agente esté creado primero.",
+  "com_agents_no_more_results": "Ha llegado al final de los resultados",
   "com_agents_not_available": "Agente no disponible",
   "com_agents_recommended": "Nuestros agentes recomendados",
   "com_agents_results_for": "Resultados para '{{query}}'",
   "com_agents_search_aria": "Buscar agentes",
   "com_agents_search_empty_heading": "Sin resultados de búsqueda",
   "com_agents_search_name": "Buscar agentes por nombre",
-  "com_agents_search_no_results": "No se han encontrado agentes para \"{{query}}\".",
+  "com_agents_search_no_results": "No se encontraron agentes para \"{{query}}\"",
   "com_agents_search_placeholder": "Buscar agentes...",
-  "com_agents_see_more": "Mostrar más",
+  "com_agents_see_more": "Ver más",
   "com_agents_start_chat": "Iniciar Chat",
-  "com_agents_top_picks": "Selección destacada",
+  "com_agents_top_picks": "Los más destacados",
   "com_agents_update_error": "Hubo un error al actualizar su agente.",
   "com_assistants_actions": "Acciones",
   "com_assistants_actions_disabled": "Necesita crear un asistente antes de añadir acciones.",
   "com_assistants_actions_info": "Permita que su Asistente recupere información o realice acciones a través de API's",
   "com_assistants_add_actions": "Añadir Acciones",
-  "com_assistants_add_mcp_server_tools": "Añadir herramientas de servidor MCP",
-  "com_assistants_add_tools": "Añadir herramientas",
+  "com_assistants_add_mcp_server_tools": "Agregar herramientas de servidor MCP",
+  "com_assistants_add_tools": "Añadir Herramientas",
   "com_assistants_allow_sites_you_trust": "Solo permite sitios en los que confíes.",
   "com_assistants_append_date": "Añadir Fecha y Hora Actual",
   "com_assistants_append_date_tooltip": "Cuando está habilitado, la fecha y hora actual del cliente se adjuntarán a las instrucciones del sistema del asistente.",
@@ -113,13 +118,13 @@
   "com_assistants_delete_actions_success": "Acción eliminada del Asistente con éxito",
   "com_assistants_description_placeholder": "Opcional: Describa su Asistente aquí",
   "com_assistants_file_search": "Búsqueda de Archivos",
-  "com_assistants_file_search_info": "La búsqueda de archivos permite que el asistente utilice conocimiento proveniente de archivos que tú o tus usuarios suban. Una vez que se sube un archivo, el asistente decide automáticamente cuándo recuperar contenido según las solicitudes del usuario. Adjuntar vector stores para la búsqueda de archivos aún no está disponible. Puedes adjuntarlos desde el Provider Playground o adjuntar archivos a los mensajes para usar la búsqueda de archivos a nivel de hilo de conversación.",
+  "com_assistants_file_search_info": "La búsqueda de archivos permite al asistente acceder al conocimiento de los archivos que usted o sus usuarios suban. Una vez subido un archivo, el asistente decide automáticamente cuándo recuperar su contenido según las solicitudes del usuario. Adjuntar almacenes vectoriales para la Búsqueda de Archivos aún no está soportado. Puede adjuntarlos desde el Área de Pruebas del Proveedor o adjuntar archivos a los mensajes para la búsqueda de archivos por conversación.",
   "com_assistants_function_use": "El Asistente usó {{0}}",
   "com_assistants_image_vision": "Visión de Imagen",
   "com_assistants_instructions_placeholder": "Las instrucciones del sistema que utiliza el asistente",
   "com_assistants_knowledge": "Conocimiento",
   "com_assistants_knowledge_disabled": "El Asistente debe ser creado, y el Intérprete de Código o la Recuperación deben estar habilitados y guardados antes de subir archivos como Conocimiento.",
-  "com_assistants_knowledge_info": "Si sube archivos en el Conocimiento, las conversaciones con su Asistente pueden incluir el contenido de los archivos.",
+  "com_assistants_knowledge_info": "Si sube archivos en Conocimiento, las conversaciones con su Asistente pueden incluir el contenido de los archivos.",
   "com_assistants_max_starters_reached": "Se alcanzó el número máximo de iniciadores de conversación",
   "com_assistants_name_placeholder": "Opcional: El nombre del asistente",
   "com_assistants_non_retrieval_model": "La búsqueda de archivos no está habilitada en este modelo. Por favor, seleccione otro modelo.",
@@ -131,14 +136,14 @@
   "com_assistants_update_actions_success": "Acción creada o actualizada con éxito",
   "com_assistants_update_error": "Hubo un error al actualizar su asistente.",
   "com_assistants_update_success": "Actualizado con éxito",
-  "com_assistants_update_success_name": "Actualización correcta de {{name}}.",
-  "com_auth_already_have_account": "¿Ya tienes una cuenta?",
+  "com_assistants_update_success_name": "{{name}} actualizado con éxito",
+  "com_auth_already_have_account": "¿Ya tiene una cuenta?",
   "com_auth_apple_login": "Inicia con Apple",
   "com_auth_back_to_login": "Volver al inicio de sesión",
-  "com_auth_click": "Haz clic",
+  "com_auth_click": "Haga clic",
   "com_auth_click_here": "Haz clic aquí",
   "com_auth_continue": "Continuar",
-  "com_auth_create_account": "Crear tu cuenta",
+  "com_auth_create_account": "Crear su cuenta",
   "com_auth_discord_login": "Continuar con Discord",
   "com_auth_email": "Correo electrónico",
   "com_auth_email_address": "Dirección de correo electrónico",
@@ -154,48 +159,48 @@
   "com_auth_email_verification_in_progress": "Verificando su correo electrónico, por favor espere",
   "com_auth_email_verification_invalid": "Verificación de correo electrónico no válida",
   "com_auth_email_verification_redirecting": "Redirigiendo en {{0}} segundos...",
-  "com_auth_email_verification_resend_prompt": "¿No recibiste el correo electrónico?",
+  "com_auth_email_verification_resend_prompt": "¿No recibió el correo electrónico?",
   "com_auth_email_verification_success": "Correo electrónico verificado exitosamente",
   "com_auth_email_verifying_ellipsis": "Verificando...",
-  "com_auth_error_create": "Hubo un error al intentar registrar tu cuenta. Inténtalo de nuevo.",
+  "com_auth_error_create": "Hubo un error al intentar registrar su cuenta. Inténtelo de nuevo.",
   "com_auth_error_invalid_reset_token": "Este token de restablecimiento de contraseña ya no es válido.",
   "com_auth_error_login": "No se puede iniciar sesión con la información proporcionada. Verifique sus credenciales y vuelva a intentarlo.",
-  "com_auth_error_login_ban": "Tu cuenta ha sido bloqueada temporalmente debido a violaciones de nuestro servicio.",
-  "com_auth_error_login_rl": "Demasiados intentos de inicio de sesión en un corto período de tiempo. Inténtalo de nuevo más tarde.",
-  "com_auth_error_login_server": "Hubo un error interno del servidor. Espera unos momentos y vuelva a intentarlo.",
-  "com_auth_error_login_unverified": "Tu cuenta no ha sido verificada. Por favor, revisa tu correo electrónico para encontrar el enlace de verificación.",
-  "com_auth_error_oauth_failed": "Error en la autenticación. Comprueba tu método de inicio de sesión e intenta de nuevo.",
+  "com_auth_error_login_ban": "Su cuenta ha sido suspendida temporalmente por incumplimiento de nuestras condiciones de servicio.",
+  "com_auth_error_login_rl": "Demasiados intentos de inicio de sesión en un corto período de tiempo. Inténtelo de nuevo más tarde.",
+  "com_auth_error_login_server": "Hubo un error interno del servidor. Espere unos momentos y vuelva a intentarlo.",
+  "com_auth_error_login_unverified": "Su cuenta no ha sido verificada. Por favor, revise su correo electrónico para encontrar el enlace de verificación.",
+  "com_auth_error_oauth_failed": "La autenticación falló. Por favor, verifique su método de inicio de sesión e inténtelo de nuevo.",
   "com_auth_facebook_login": "Continuar con Facebook",
   "com_auth_full_name": "Nombre completo",
   "com_auth_github_login": "Continuar con Github",
   "com_auth_google_login": "Continuar con Google",
   "com_auth_here": "AQUÍ",
   "com_auth_login": "Iniciar sesión",
-  "com_auth_login_with_new_password": "Ahora puedes iniciar sesión con tu nueva contraseña.",
+  "com_auth_login_with_new_password": "Ahora puede iniciar sesión con su nueva contraseña.",
   "com_auth_name_max_length": "El nombre debe tener menos de 80 caracteres",
   "com_auth_name_min_length": "El nombre debe tener al menos 3 caracteres",
   "com_auth_name_required": "Se requiere nombre",
-  "com_auth_no_account": "¿No tienes una cuenta?",
+  "com_auth_no_account": "¿No tiene una cuenta?",
   "com_auth_password": "Contraseña",
   "com_auth_password_confirm": "Confirmar contraseña",
-  "com_auth_password_forgot": "¿Olvidaste tu contraseña?",
+  "com_auth_password_forgot": "¿Olvidó su contraseña?",
   "com_auth_password_max_length": "La contraseña debe tener menos de 128 caracteres",
   "com_auth_password_min_length": "La contraseña debe tener al menos 8 caracteres",
   "com_auth_password_not_match": "Las contraseñas no coinciden",
   "com_auth_password_required": "Se requiere contraseña",
-  "com_auth_registration_success_generic": "Por favor, revisa tu correo electrónico para verificar tu dirección de correo.",
+  "com_auth_registration_success_generic": "Por favor, revise su correo electrónico para verificar su dirección.",
   "com_auth_registration_success_insecure": "Registro completado exitosamente.",
   "com_auth_reset_password": "Restablecer su contraseña",
-  "com_auth_reset_password_if_email_exists": "Si existe una cuenta con ese correo electrónico, se le ha enviado un mensaje con instrucciones para restablecer su contraseña. Por favor, asegúrate de revisar tu carpeta de correo no deseado.",
+  "com_auth_reset_password_if_email_exists": "Si existe una cuenta con ese correo electrónico, se le ha enviado un mensaje con instrucciones para restablecer su contraseña. Por favor, asegúrese de revisar su carpeta de correo no deseado.",
   "com_auth_reset_password_link_sent": "Correo electrónico enviado",
   "com_auth_reset_password_success": "Éxito al restablecer la contraseña",
-  "com_auth_saml_login": "Continua con SAML",
+  "com_auth_saml_login": "Continuar con SAML",
   "com_auth_sign_in": "Iniciar sesión",
   "com_auth_sign_up": "Regístrese",
   "com_auth_submit_registration": "Enviar registro",
   "com_auth_to_reset_your_password": "para restablecer su contraseña.",
-  "com_auth_to_try_again": "para intentarlo de nuevo.",
-  "com_auth_two_factor": "Revisa tu aplicación preferida de OTP para obtener el código",
+  "com_auth_to_try_again": "para intentar de nuevo.",
+  "com_auth_two_factor": "Consulta tu aplicación de contraseña de un solo uso para obtener el código",
   "com_auth_username": "Nombre de usuario (opcional)",
   "com_auth_username_max_length": "El nombre de usuario debe tener menos de 20 caracteres",
   "com_auth_username_min_length": "El nombre de usuario debe tener al menos 2 caracteres",
@@ -210,9 +215,9 @@
   "com_endpoint_ai": "IA",
   "com_endpoint_anthropic_maxoutputtokens": "Número máximo de tokens que se pueden generar en la respuesta. Especifique un valor más bajo para respuestas más cortas y un valor más alto para respuestas más largas.",
   "com_endpoint_anthropic_prompt_cache": "El almacenamiento en caché de instrucciones permite reutilizar contextos o instrucciones extensas entre llamadas a la API, reduciendo costos y tiempo de respuesta",
-  "com_endpoint_anthropic_temp": "Rango de 0 a 1. Utilice una temperatura más cercana a 0 para tareas analíticas/de opción múltiple y más cercana a 1 para tareas creativas y generativas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_anthropic_topk": "Top-k cambia la forma en que el modelo selecciona tokens para la salida. Un top-k de 1 significa que el token seleccionado es el más probable entre todos los tokens en el vocabulario del modelo (también llamado decodificación codiciosa), mientras que un top-k de 3 significa que el siguiente token se selecciona entre los 3 tokens más probables (usando temperatura).",
-  "com_endpoint_anthropic_topp": "Top-p cambia la forma en que el modelo selecciona tokens para la salida. Los tokens se seleccionan desde los más K (ver parámetro topK) probables hasta los menos probables hasta que la suma de sus probabilidades sea igual al valor top-p.",
+  "com_endpoint_anthropic_temp": "Rango de 0 a 1. Use valores cercanos a 0 para tareas analíticas o de opción múltiple, y cercanos a 1 para tareas creativas y generativas. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_anthropic_topk": "Top-k cambia cómo el modelo selecciona tokens en la salida. Con top-k de 1, se elige el token más probable del vocabulario (decodificación voraz); con top-k de 3, el siguiente token se elige entre los 3 más probables (usando la temperatura).",
+  "com_endpoint_anthropic_topp": "Top-p cambia cómo el modelo selecciona tokens en la salida. Los tokens se seleccionan desde los más probables hasta que la suma de sus probabilidades iguale el valor de top-p.",
   "com_endpoint_assistant": "Asistente",
   "com_endpoint_assistant_model": "Modelo de asistente",
   "com_endpoint_assistant_placeholder": "Por favor, seleccione un Asistente desde el panel lateral derecho",
@@ -250,9 +255,9 @@
   "com_endpoint_frequency_penalty": "Penalización de frecuencia",
   "com_endpoint_google_custom_name_placeholder": "Establecer un nombre personalizado para Google",
   "com_endpoint_google_maxoutputtokens": "Número máximo de tokens que se pueden generar en la respuesta. Especifique un valor más bajo para respuestas más cortas y un valor más alto para respuestas más largas.",
-  "com_endpoint_google_temp": "Los valores más altos = más aleatorios, mientras que los valores más bajos = más enfocados y deterministas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_google_topk": "Top-k cambia la forma en que el modelo selecciona tokens para la salida. Un top-k de 1 significa que el token seleccionado es el más probable entre todos los tokens en el vocabulario del modelo (también llamado decodificación codiciosa), mientras que un top-k de 3 significa que el siguiente token se selecciona entre los 3 tokens más probables (usando temperatura).",
-  "com_endpoint_google_topp": "Top-p cambia la forma en que el modelo selecciona tokens para la salida. Los tokens se seleccionan desde los más K (ver parámetro topK) probables hasta los menos probables hasta que la suma de sus probabilidades sea igual al valor top-p.",
+  "com_endpoint_google_temp": "Valores más altos = más aleatorio; valores más bajos = más enfocado y determinista. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_google_topk": "Top-k cambia cómo el modelo selecciona tokens en la salida. Con top-k de 1, se elige el token más probable del vocabulario (decodificación voraz); con top-k de 3, el siguiente token se elige entre los 3 más probables (usando la temperatura).",
+  "com_endpoint_google_topp": "Top-p cambia cómo el modelo selecciona tokens en la salida. Los tokens se seleccionan desde los más probables hasta que la suma de sus probabilidades iguale el valor de top-p.",
   "com_endpoint_instructions_assistants": "Anular instrucciones",
   "com_endpoint_instructions_assistants_placeholder": "Anula las instrucciones del asistente. Esto es útil para modificar el comportamiento por ejecución.",
   "com_endpoint_max_output_tokens": "Tokens de Salida Máximos",
@@ -263,16 +268,16 @@
   "com_endpoint_no_presets": "Aún no hay configuraciones preestablecidas, utiliza el botón de configuración para crear una",
   "com_endpoint_openai_custom_name_placeholder": "Establecer un nombre personalizado para ChatGPT",
   "com_endpoint_openai_detail": "La resolución para las solicitudes de Vision. \"Baja\" es más económica y rápida, \"Alta\" es más detallada y costosa, y \"Automática\" elegirá automáticamente entre las dos en función de la resolución de la imagen.",
-  "com_endpoint_openai_freq": "Número entre -2.0 y 2.0. Los valores positivos penalizan los nuevos tokens basados en su frecuencia existente en el texto hasta el momento, disminuyendo la probabilidad del modelo de repetir la misma línea textualmente.",
+  "com_endpoint_openai_freq": "Número entre -2.0 y 2.0. Los valores positivos penalizan los tokens nuevos según su frecuencia en el texto hasta el momento, reduciendo la probabilidad de que el modelo repita la misma línea literalmente.",
   "com_endpoint_openai_max": "Los tokens máximos a generar. La longitud total de los tokens de entrada y los tokens generados está limitada por la longitud del contexto del modelo.",
   "com_endpoint_openai_max_tokens": "Campo opcional `max_tokens`, que representa el número máximo de tokens que se pueden generar en la finalización del chat.\n\nLa longitud total de los tokens de entrada y los tokens generados está limitada por la longitud del contexto del modelo. Puede experimentar errores si este número excede los tokens máximos de contexto.",
-  "com_endpoint_openai_pres": "Número entre -2.0 y 2.0. Los valores positivos penalizan los nuevos tokens basados en si aparecen o no en el texto hasta el momento, aumentando la probabilidad del modelo de hablar sobre nuevos temas.",
+  "com_endpoint_openai_pres": "Número entre -2.0 y 2.0. Los valores positivos penalizan los tokens nuevos si ya aparecieron en el texto, incentivando al modelo a hablar sobre temas nuevos.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Establecer instrucciones personalizadas para incluir en el Mensaje del sistema. Predeterminado: ninguno",
   "com_endpoint_openai_resend": "Reenviar todas las imágenes adjuntas previamente. Nota: esto puede aumentar significativamente el costo de tokens y puede experimentar errores con muchos archivos adjuntos de imágenes.",
   "com_endpoint_openai_resend_files": "Reenviar todos los archivos adjuntos anteriormente. Nota: esto aumentará el costo de tokens y puede experimentar errores con muchos archivos adjuntos.",
   "com_endpoint_openai_stop": "Hasta 4 secuencias donde la API dejará de generar más tokens.",
-  "com_endpoint_openai_temp": "Los valores más altos = más aleatorios, mientras que los valores más bajos = más enfocados y deterministas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_openai_topp": "Una alternativa al muestreo con temperatura, llamada muestreo de núcleo, donde el modelo considera los resultados de los tokens con la masa de probabilidad superior al top_p. Entonces, 0.1 significa que solo se consideran los tokens que comprenden la masa de probabilidad superior al 10%. Recomendamos alterar esto o la temperatura, pero no ambos.",
+  "com_endpoint_openai_temp": "Valores más altos = más aleatorio; valores más bajos = más enfocado y determinista. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_openai_topp": "Alternativa al muestreo por temperatura. Con nucleus sampling, el modelo considera solo los tokens cuya probabilidad acumulada llega al valor top_p. Por ejemplo, 0.1 significa que solo se consideran los tokens que componen el 10% más probable. Se recomienda ajustar este parámetro o la temperatura, pero no ambos.",
   "com_endpoint_output": "Salida",
   "com_endpoint_plug_image_detail": "Detalle de imagen",
   "com_endpoint_plug_resend_files": "Reenviar archivos",
@@ -283,11 +288,11 @@
   "com_endpoint_preset_default_none": "No hay configuración preestablecida predeterminada activa.",
   "com_endpoint_preset_default_removed": "ya no es la configuración preestablecida predeterminada.",
   "com_endpoint_preset_delete_confirm": "¿Estás seguro de que quieres eliminar esta configuración preestablecida?",
-  "com_endpoint_preset_delete_error": "Hubo un error al eliminar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_delete_error": "Hubo un error al eliminar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_import": "¡Configuración preestablecida importada!",
-  "com_endpoint_preset_import_error": "Hubo un error al importar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_import_error": "Hubo un error al importar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_name": "Nombre de la configuración preestablecida",
-  "com_endpoint_preset_save_error": "Hubo un error al guardar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_save_error": "Hubo un error al guardar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_selected": "¡Configuración preestablecida activa!",
   "com_endpoint_preset_selected_title": "¡Activo!",
   "com_endpoint_preset_title": "Configuración preestablecida",
@@ -303,7 +308,7 @@
   "com_endpoint_search": "Buscar punto de conexión por nombre",
   "com_endpoint_search_models": "Buscar modelos...",
   "com_endpoint_search_var": "Buscar {{0}}...",
-  "com_endpoint_set_custom_name": "Establece un nombre personalizado, en caso de que puedas encontrar esta configuración preestablecida",
+  "com_endpoint_set_custom_name": "Establezca un nombre personalizado para identificar esta configuración preestablecida",
   "com_endpoint_stop": "Secuencias de detención",
   "com_endpoint_stop_placeholder": "Separe los valores presionando `Intro`",
   "com_endpoint_temperature": "Temperatura",
@@ -312,18 +317,20 @@
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Utilizar asistente activo",
   "com_error_expired_user_key": "La clave proporcionada para {{0}} expiró en {{1}}. Por favor, proporcione una clave nueva e inténtelo de nuevo.",
-  "com_error_files_dupe": "Se detectó un archivo duplicado",
+  "com_error_files_dupe": "Se detectó un archivo duplicado.",
   "com_error_files_empty": "No se permiten archivos vacíos.",
   "com_error_files_process": "Se produjo un error al procesar el archivo.",
-  "com_error_files_upload": "Se produjo un error durante la subida del archivo",
+  "com_error_files_upload": "Ocurrió un error al subir el archivo.",
   "com_error_files_upload_canceled": "La solicitud de carga del archivo fue cancelada. Nota: es posible que la carga del archivo aún esté en proceso y necesite ser eliminada manualmente.",
   "com_error_files_validation": "Se produjo un error durante la validación del archivo.",
-  "com_error_input_length": "El recuento de tokens del último mensaje es demasiado largo, supera el límite de tokens o los parámetros de límite de tokens están mal configurados, lo que afecta negativamente a la ventana de contexto. Más información: {{0}}. Reduce la longitud de tu mensaje, ajusta el tamaño máximo de contexto en los parámetros de la conversación o bifurca la conversación para continuar.",
+  "com_error_input_length": "El último mensaje excede el límite de tokens o los parámetros de contexto están mal configurados. Más información: {{0}}. Acorte su mensaje, ajuste el tamaño máximo de contexto en los parámetros de la conversación, o bifurque la conversación para continuar.",
   "com_error_invalid_agent_provider": "El proveedor \"{{0}}\" no está disponible para el uso con Agentes. Por favor, ve a las configuraciones de tu agente y selecciona un proveedor que se encuentre disponible.",
+  "com_error_invalid_base_url": "La URL base proporcionada apunta a una dirección restringida. Use una URL externa válida e inténtelo de nuevo.",
   "com_error_invalid_user_key": "Clave proporcionada no válida. Por favor proporcione una clave válida e inténtelo de nuevo.",
-  "com_error_moderation": "Parece que el contenido enviado ha sido marcado por nuestro sistema de moderación por no estar alineado con nuestras pautas comunitarias. No podemos proceder con este tema específico. Si tiene alguna otra pregunta o tema que le gustaría explorar, por favor edite su mensaje o cree una nueva conversación.",
+  "com_error_moderation": "El contenido enviado fue marcado por nuestro sistema de moderación por no alinearse con nuestras normas comunitarias. No es posible continuar con este tema. Si tiene otras preguntas o temas que desee explorar, edite su mensaje o inicie una nueva conversación.",
   "com_error_no_base_url": "No se encontró URL base. Por favor proporcione una y vuelva a intentarlo.",
   "com_error_no_user_key": "No se encontró ninguna clave. Por favor, proporcione una clave e inténtelo de nuevo.",
+  "com_error_stream_expired": "El flujo de respuesta ha expirado o ya se completó. Por favor, inténtelo de nuevo.",
   "com_files_filter": "Filtrar archivos...",
   "com_files_no_results": "Sin resultados.",
   "com_files_number_selected": "{{0}} de {{1}} archivo(s) seleccionado(s)",
@@ -332,15 +339,17 @@
   "com_nav_2fa": "Autenticación en dos pasos",
   "com_nav_account_settings": "Configuración de la cuenta",
   "com_nav_always_make_prod": "Convertir siempre las nuevas versiones en producción",
-  "com_nav_archive_created_at": "CreadoEn",
+  "com_nav_archive_created_at": "Fecha de archivo",
   "com_nav_archive_name": "Nombre",
   "com_nav_archived_chats": "Conversaciones archivadas",
   "com_nav_at_command": "Comando @",
-  "com_nav_at_command_description": "Alternar comando \"@\" para cambiar entre puntos de conexión, modelos, ajustes predefinidos, etc.",
+  "com_nav_at_command_description": "Activa el comando \"@\" para cambiar entre endpoints, modelos, configuraciones preestablecidas, etc.",
   "com_nav_audio_play_error": "Error al reproducir el audio: {{0}}",
   "com_nav_audio_process_error": "Error al procesar el audio: {{0}}",
-  "com_nav_auto_scroll": "Desplazamiento automático al más reciente al abrir",
+  "com_nav_auto_expand_tools": "Expandir detalles de herramientas automáticamente",
+  "com_nav_auto_scroll": "Desplazamiento automático al mensaje más reciente al abrir el chat",
   "com_nav_auto_send_prompts": "Envío automático de mensajes",
+  "com_nav_auto_send_prompts_desc": "Enviar el prompt al chat automáticamente al seleccionarlo",
   "com_nav_auto_send_text": "Envío automático de texto",
   "com_nav_auto_transcribe_audio": "Transcribir audio automáticamente",
   "com_nav_automatic_playback": "Reproducción automática del último mensaje",
@@ -350,16 +359,13 @@
   "com_nav_balance_months": "meses",
   "com_nav_browser": "Navegador",
   "com_nav_change_picture": "Cambiar imagen",
-  "com_nav_chat_commands": "Comandos de chat",
-  "com_nav_chat_commands_info": "Estos comandos se activan al escribir caracteres específicos al inicio de su mensaje. Cada comando se activa mediante su prefijo designado. Puede desactivarlos si utiliza frecuentemente estos caracteres para comenzar mensajes.",
-  "com_nav_chat_direction": "Dirección del chat",
+  "com_nav_chat_direction": "Dirección del texto",
   "com_nav_clear_all_chats": "Borrar todos los chats",
   "com_nav_clear_cache_confirm_message": "¿Está seguro de que desea borrar el caché?",
   "com_nav_clear_conversation": "Borrar conversaciones",
-  "com_nav_clear_conversation_confirm_message": "¿Estás seguro de que quieres borrar todas las conversaciones? Esta acción es irreversible.",
+  "com_nav_clear_conversation_confirm_message": "¿Está seguro de que desea borrar todas las conversaciones? Esta acción es irreversible.",
   "com_nav_close_sidebar": "Cerrar barra lateral",
-  "com_nav_commands": "Comandos",
-  "com_nav_confirm_clear": "Confirmar borrado",
+  "com_nav_confirm_clear": "Confirmar limpieza",
   "com_nav_conversation_mode": "Modo de conversación",
   "com_nav_convo_menu_options": "Opciones del menú de conversación",
   "com_nav_db_sensitivity": "Sensibilidad en decibelios",
@@ -368,7 +374,7 @@
   "com_nav_delete_account_confirm": "Eliminar cuenta - ¿Está seguro?",
   "com_nav_delete_account_email_placeholder": "Por favor ingrese el correo electrónico de su cuenta",
   "com_nav_delete_cache_storage": "Eliminar almacenamiento caché de TTS",
-  "com_nav_delete_data_info": "Se eliminarán todos sus datos",
+  "com_nav_delete_data_info": "Todos sus datos serán eliminados.",
   "com_nav_delete_warning": "ADVERTENCIA: Esta acción eliminará su cuenta de forma permanente.",
   "com_nav_enable_cache_tts": "Habilitar caché de texto a voz",
   "com_nav_enable_cloud_browser_voice": "Usar voces basadas en la nube",
@@ -379,12 +385,12 @@
   "com_nav_export_conversation": "Exportar conversación",
   "com_nav_export_filename": "Nombre de archivo",
   "com_nav_export_filename_placeholder": "Establecer el nombre de archivo",
-  "com_nav_export_include_endpoint_options": "Incluir opciones de punto final",
+  "com_nav_export_include_endpoint_options": "Incluir opciones del endpoint",
   "com_nav_export_recursive": "Recursivo",
   "com_nav_export_recursive_or_sequential": "¿Recursivo o secuencial?",
   "com_nav_export_type": "Tipo",
   "com_nav_external": "Externo",
-  "com_nav_font_size": "Tamaño de fuente",
+  "com_nav_font_size": "Tamaño de fuente del mensaje",
   "com_nav_font_size_base": "Mediano",
   "com_nav_font_size_lg": "Grande",
   "com_nav_font_size_sm": "Pequeño",
@@ -392,15 +398,15 @@
   "com_nav_font_size_xs": "Extra pequeño",
   "com_nav_help_faq": "Ayuda y preguntas frecuentes",
   "com_nav_info_code_artifacts": "Permite mostrar artefactos de código experimentales junto al chat",
-  "com_nav_info_code_artifacts_agent": "Habilita el uso de artefactos de código para este agente. De forma predeterminada, instrucciones adicionales específicas para el uso de artefactos son añadidas, a menos que \"Modo personalizado de indicación\" esté habilitado.",
+  "com_nav_info_code_artifacts_agent": "Habilita el uso de artefactos de código para este agente. De forma predeterminada, se añaden instrucciones adicionales para el uso de artefactos, a menos que el \"Modo de Prompt Personalizado\" esté habilitado.",
   "com_nav_info_custom_prompt_mode": "Cuando está habilitado, no se incluirá el mensaje del sistema predeterminado para artefactos. En este modo, todas las instrucciones para generar artefactos deberán proporcionarse manualmente.",
   "com_nav_info_enter_to_send": "Cuando está habilitado, al presionar `ENTER` se enviará su mensaje. Cuando está deshabilitado, al presionar Enter se agregará una nueva línea, y necesitará presionar `CTRL + ENTER` / `⌘ + ENTER` para enviar su mensaje.",
-  "com_nav_info_fork_change_default": "\"Mostrar únicamente mensajes visibles\" incluye solo la ruta directa hacia el mensaje seleccionado. \"Incluir ramas relacionadas\" añade las ramificaciones a lo largo de la ruta. \"Incluir todo desde/hacia aquí\" incluye todos los mensajes y ramificaciones conectados.",
+  "com_nav_info_fork_change_default": "\"Solo mensajes visibles\" incluye únicamente la ruta directa al mensaje seleccionado. \"Incluir ramas relacionadas\" añade las bifurcaciones a lo largo de esa ruta. \"Incluir todo desde/hacia aquí\" incluye todos los mensajes y bifurcaciones conectados.",
   "com_nav_info_fork_split_target_setting": "Cuando está habilitado, la bifurcación comenzará desde el mensaje objetivo hasta el último mensaje de la conversación, según el comportamiento seleccionado.",
   "com_nav_info_include_shadcnui": "Cuando está habilitado, se incluirán instrucciones para el uso de los componentes de shadcn/ui. shadcn/ui es una colección de componentes reutilizables construidos utilizando Radix UI y Tailwind CSS. Nota: estas son instrucciones extensas, debe habilitarlas solo si es importante para usted informar al LLM sobre las importaciones y componentes correctos. Para más información sobre estos componentes, visite: https://ui.shadcn.com/",
-  "com_nav_info_latex_parsing": "Cuando está habilitado, el código LaTeX en los mensajes se mostrará como ecuaciones matemáticas. Si usted no necesita el renderizado de LaTeX, puede deshabilitarlo para mejorar el rendimiento.",
+  "com_nav_info_latex_parsing": "Cuando está habilitado, el código LaTeX en los mensajes se renderiza como ecuaciones matemáticas. Desactívelo si no necesita renderizado LaTeX para mejorar el rendimiento.",
   "com_nav_info_save_badges_state": "Al habilitar esta opción, se guardará el estado de las insignias del chat. Esto significa que si crea un nuevo chat, las insignias permanecerán en el mismo estado que el chat anterior. Si desactiva esta opción, las insignias se restablecerán a su estado predeterminado cada vez que cree un nuevo chat.",
-  "com_nav_info_save_draft": "Cuando está habilitado, el texto y los archivos adjuntos que ingrese en el formulario de chat se guardarán automáticamente como borradores en su dispositivo local. Estos borradores estarán disponibles incluso si recarga la página o cambia a una conversación diferente. Los borradores se almacenan localmente en su dispositivo y se eliminan una vez que el mensaje es enviado.",
+  "com_nav_info_save_draft": "Cuando está habilitado, el texto y los archivos adjuntos del campo de chat se guardan automáticamente como borradores en su dispositivo. Los borradores persisten al recargar la página o cambiar de conversación, y se eliminan al enviar el mensaje.",
   "com_nav_info_user_name_display": "Cuando está habilitado, se mostrará su nombre de usuario sobre cada mensaje que envíe. Cuando está deshabilitado, solo verá \"Usted\" sobre sus mensajes.",
   "com_nav_lang_arabic": "العربية",
   "com_nav_lang_auto": "Detección automática",
@@ -432,27 +438,26 @@
   "com_nav_log_out": "Cerrar sesión",
   "com_nav_long_audio_warning": "Los textos más extensos tomarán más tiempo en procesarse.",
   "com_nav_maximize_chat_space": "Maximizar espacio del chat",
-  "com_nav_modular_chat": "Habilitar el cambio de puntos finales en medio de una conversación",
+  "com_nav_modular_chat": "Permitir cambiar de endpoint a mitad de una conversación",
   "com_nav_my_files": "Mis archivos",
   "com_nav_not_supported": "No soportado",
   "com_nav_open_sidebar": "Abrir barra lateral",
   "com_nav_playback_rate": "Velocidad de reproducción de audio",
   "com_nav_plugin_auth_error": "Hubo un error al intentar autenticar este plugin. Por favor, inténtalo de nuevo.",
-  "com_nav_plus_command": "+ Comando",
-  "com_nav_plus_command_description": "Alternar comando ' + ' para agregar una configuración de respuestas múltiples",
+  "com_nav_plus_command": "Comando +",
+  "com_nav_plus_command_description": "Activa el comando \"+\" para agregar una configuración de respuestas múltiples",
   "com_nav_profile_picture": "Imagen de perfil",
   "com_nav_save_drafts": "Guardar borradores localmente",
   "com_nav_search_placeholder": "Buscar mensajes",
   "com_nav_send_message": "Enviar mensaje",
   "com_nav_setting_account": "Cuenta",
-  "com_nav_setting_chat": "Configuración del chat",
-  "com_nav_setting_data": "Controles de datos",
+  "com_nav_setting_chat": "Chat",
   "com_nav_setting_general": "General",
   "com_nav_setting_speech": "Voz y habla",
   "com_nav_settings": "Configuración",
-  "com_nav_shared_links": "Links Compartidos",
+  "com_nav_shared_links": "Enlaces compartidos",
   "com_nav_slash_command": "Comando /",
-  "com_nav_slash_command_description": "Alternar comando '/' para seleccionar un mensaje predefinido mediante el teclado",
+  "com_nav_slash_command_description": "Activa el comando \"/\" para seleccionar un prompt desde el teclado",
   "com_nav_speech_to_text": "Voz a texto",
   "com_nav_stop_generating": "Detener generación",
   "com_nav_text_to_speech": "Texto a voz",
@@ -462,7 +467,7 @@
   "com_nav_theme_system": "Sistema",
   "com_nav_tool_dialog": "Herramientas del asistente",
   "com_nav_tool_dialog_agents": "Herramientas del agente",
-  "com_nav_tool_dialog_description": "El asistente debe guardarse para que las selecciones de herramientas persistan.",
+  "com_nav_tool_dialog_description": "Guarde el asistente para que la selección de herramientas persista.",
   "com_nav_tool_remove": "Eliminar",
   "com_nav_tool_search": "Buscar herramientas",
   "com_nav_user": "USUARIO",
@@ -478,13 +483,15 @@
   "com_sidepanel_manage_files": "Administrar Archivos",
   "com_sidepanel_parameters": "Parámetros",
   "com_ui_2fa_disable": "Deshabilitar 2FA",
-  "com_ui_2fa_disable_error": "Hubo en error deshabilitando la autenticación en dos pasos",
-  "com_ui_2fa_enable": "Activa 2FA",
-  "com_ui_2fa_enabled": "2FA ha sido activada",
+  "com_ui_2fa_disable_error": "Hubo un error al deshabilitar la autenticación de dos factores",
+  "com_ui_2fa_enable": "Habilitar 2FA",
+  "com_ui_2fa_enabled": "2FA habilitado",
+  "com_ui_2fa_verification_required": "Ingrese su código 2FA para continuar",
   "com_ui_accept": "Acepto",
   "com_ui_add": "Agregar",
+  "com_ui_add_labels": "Agregar etiquetas",
   "com_ui_add_model_preset": "Agregar un modelo o configuración preestablecida para una respuesta adicional",
-  "com_ui_add_multi_conversation": "Agregar múltiples conversaciones",
+  "com_ui_add_multi_conversation": "Agregar conversación múltiple",
   "com_ui_admin": "Administrador",
   "com_ui_admin_access_warning": "Deshabilitar el acceso de Administrador a esta función puede causar problemas inesperados en la interfaz que requieran actualizar la página. Si se guarda este cambio, la única forma de revertirlo es mediante la configuración de interfaz en el archivo librechat.yaml, lo cual afectará a todos los roles.",
   "com_ui_admin_settings": "Configuración de Administrador",
@@ -492,8 +499,8 @@
   "com_ui_advanced_settings": "Configuración avanzada",
   "com_ui_agent": "Agente",
   "com_ui_agent_delete_error": "Se produjo un error al eliminar el agente",
-  "com_ui_agent_deleted": "Asistente eliminado exitosamente",
-  "com_ui_agent_duplicate_error": "Se produjo un error al duplicar el asistente",
+  "com_ui_agent_deleted": "Agente eliminado con éxito",
+  "com_ui_agent_duplicate_error": "Hubo un error al duplicar el agente",
   "com_ui_agent_duplicated": "Agente duplicado exitosamente",
   "com_ui_agent_var": "{{0}} agente",
   "com_ui_agent_version_restore_success": "Versión restaurada correctamente",
@@ -505,7 +512,7 @@
   "com_ui_all": "todas",
   "com_ui_all_proper": "Todos",
   "com_ui_analyzing": "Analizando",
-  "com_ui_analyzing_finished": "Acabando el análisis",
+  "com_ui_analyzing_finished": "Análisis completado",
   "com_ui_api_key": "Clave API",
   "com_ui_archive": "Archivar",
   "com_ui_archive_delete_error": "Error al borrar conversación archivada",
@@ -513,7 +520,7 @@
   "com_ui_artifact_click": "Haga clic para abrir",
   "com_ui_artifacts": "Artefactos",
   "com_ui_artifacts_options": "Opciones de artefactos",
-  "com_ui_artifacts_toggle": "Alternar Interfaz de Artefactos",
+  "com_ui_artifacts_toggle": "Mostrar/ocultar interfaz de artefactos",
   "com_ui_artifacts_toggle_agent": "Habilitar artefactos",
   "com_ui_ascending": "Asc",
   "com_ui_assistant": "Asistente",
@@ -523,16 +530,19 @@
   "com_ui_assistants_output": "Salida de Asistentes",
   "com_ui_at_least_one_owner_required": "Se requiere al menos un propietario",
   "com_ui_attach_error": "No se puede adjuntar el archivo. Cree o seleccione una conversación, o intente actualizar la página.",
+  "com_ui_attach_error_limit": "Límite de archivos alcanzado:",
   "com_ui_attach_error_openai": "No se pueden adjuntar archivos del Asistente a otros puntos de conexión",
-  "com_ui_attach_error_size": "Se excedió el límite de tamaño de archivo para el endpoint:",
-  "com_ui_attach_error_type": "Tipo de archivo no admitido para el endpoint:",
+  "com_ui_attach_error_size": "Se superó el límite de tamaño de archivo para el endpoint:",
+  "com_ui_attach_error_total_size": "Se superó el límite de tamaño total de archivos para el endpoint:",
+  "com_ui_attach_error_type": "Tipo de archivo no compatible con el endpoint:",
   "com_ui_attach_remove": "Eliminar archivo",
-  "com_ui_attach_warn_endpoint": "Es posible que los archivos no compatibles con la herramienta sean ignorados",
+  "com_ui_attach_warn_endpoint": "Los archivos sin herramienta compatible podrían ser ignorados",
   "com_ui_attachment": "Adjunto",
-  "com_ui_auth_type": "Tipo de autorización",
+  "com_ui_auth_type": "Tipo de autenticación",
   "com_ui_authentication": "Autenticación",
+  "com_ui_available_options": "Opciones disponibles",
   "com_ui_avatar": "Avatar",
-  "com_ui_back_to_prompts": "Volver a las Indicaciones",
+  "com_ui_back_to_prompts": "Volver a Prompts",
   "com_ui_bookmark_delete_confirm": "¿Está seguro de que desea eliminar este marcador?",
   "com_ui_bookmarks": "Marcadores",
   "com_ui_bookmarks_add": "Agregar Marcadores",
@@ -555,25 +565,31 @@
   "com_ui_chat_history": "Historial de Chat",
   "com_ui_clear": "Limpiar",
   "com_ui_clear_all": "Limpiar todo",
+  "com_ui_click_to_edit": "Haga clic para editar",
   "com_ui_close": "Cerrar",
   "com_ui_close_menu": "Cerrar menú",
   "com_ui_code": "Código",
-  "com_ui_collapse_chat": "Contraer Chat",
-  "com_ui_command_placeholder": "Opcional: Ingrese un comando para la indicación o se utilizará el nombre",
-  "com_ui_command_usage_placeholder": "Seleccione una indicación por comando o nombre",
+  "com_ui_collapse_chat": "Contraer chat",
+  "com_ui_collapse_summary": "Contraer resumen",
+  "com_ui_command_placeholder": "Opcional: Ingrese un comando para el prompt o se utilizará el nombre",
+  "com_ui_command_usage_placeholder": "Seleccione un Prompt por comando o nombre",
+  "com_ui_complete": "¡Completado!",
   "com_ui_confirm_action": "Confirmar Acción",
   "com_ui_confirm_change": "Confirmar cambio",
   "com_ui_context": "Contexto",
   "com_ui_continue": "Continuar",
+  "com_ui_conversation_summarized": "Conversación resumida",
   "com_ui_copied": "¡Copiado!",
   "com_ui_copied_to_clipboard": "Copiado al portapapeles",
   "com_ui_copy_code": "Copiar código",
+  "com_ui_copy_failed": "Error al copiar al portapapeles",
   "com_ui_copy_link": "Copiar enlace",
+  "com_ui_copy_summary": "Copiar resumen al portapapeles",
   "com_ui_copy_to_clipboard": "Copiar al portapapeles",
   "com_ui_create": "Crear",
   "com_ui_create_link": "Crear enlace",
-  "com_ui_create_prompt": "Crear Indicación",
-  "com_ui_custom_prompt_mode": "Modo de Indicación Personalizado",
+  "com_ui_create_prompt": "Crear Prompt",
+  "com_ui_custom_prompt_mode": "Modo de prompt personalizado",
   "com_ui_date": "Fecha",
   "com_ui_date_april": "Abril",
   "com_ui_date_august": "Agosto",
@@ -598,15 +614,17 @@
   "com_ui_delete_agent_confirm": "¿Está seguro de que desea eliminar este agente?",
   "com_ui_delete_assistant_confirm": "¿Está seguro de que desea eliminar este Asistente? Esta acción no se puede deshacer.",
   "com_ui_delete_confirm": "Esto eliminará",
-  "com_ui_delete_confirm_prompt_version_var": "Esto eliminará la versión seleccionada para \"{{0}}\". Si no existen otras versiones, la indicación será eliminada.",
+  "com_ui_delete_confirm_prompt_version_var": "Esto eliminará la versión seleccionada para \"{{0}}\". Si no existen otras versiones, el prompt será eliminado.",
   "com_ui_delete_conversation": "¿Eliminar Chat?",
-  "com_ui_delete_prompt": "¿Eliminar Indicación?",
+  "com_ui_delete_prompt": "¿Eliminar Prompt?",
   "com_ui_delete_shared_link": "¿Eliminar enlace compartido?",
   "com_ui_delete_tool": "Eliminar Herramienta",
   "com_ui_delete_tool_confirm": "¿Está seguro de que desea eliminar esta herramienta?",
+  "com_ui_deploy": "Publicar",
   "com_ui_descending": "Desc",
   "com_ui_description": "Descripción",
-  "com_ui_description_placeholder": "Opcional: Ingrese una descripción para mostrar en la indicación",
+  "com_ui_description_placeholder": "Opcional: Ingrese una descripción para mostrar en el prompt",
+  "com_ui_details": "Detalles",
   "com_ui_download": "Descargar",
   "com_ui_download_error": "Hubo un error al descargar el archivo. Es posible que el archivo haya sido eliminado.",
   "com_ui_dropdown_variables": "Variables desplegables:",
@@ -616,19 +634,21 @@
   "com_ui_duplication_success": "Conversación duplicada exitosamente",
   "com_ui_edit": "Editar",
   "com_ui_endpoint": "Punto de conexión",
-  "com_ui_endpoint_menu": "Menú de Punto de Conexión LLM",
+  "com_ui_endpoint_menu": "Menú de endpoints LLM",
   "com_ui_enter": "Intro",
   "com_ui_enter_api_key": "Ingrese la clave API",
   "com_ui_enter_openapi_schema": "Ingrese su esquema OpenAPI aquí",
   "com_ui_error": "Error",
-  "com_ui_error_connection": "Error al conectarse al servidor. Intente actualizar la página.",
+  "com_ui_error_connection": "Error al conectar con el servidor. Intente recargar la página.",
   "com_ui_error_save_admin_settings": "Se produjo un error al guardar su configuración de administrador.",
   "com_ui_examples": "Ejemplos",
   "com_ui_export_convo_modal": "Exportar Conversación",
-  "com_ui_feedback_more": "Más....",
+  "com_ui_failed": "Fallido",
+  "com_ui_feedback_more": "Más...",
   "com_ui_field_required": "Este campo es obligatorio",
-  "com_ui_filter_prompts": "Filtrar Indicaciones",
-  "com_ui_filter_prompts_name": "Filtrar indicaciones por nombre",
+  "com_ui_file": "Archivo",
+  "com_ui_filter_prompts": "Filtrar Prompts",
+  "com_ui_filter_prompts_name": "Filtrar prompts por nombre",
   "com_ui_finance": "Finanzas",
   "com_ui_fork": "Bifurcar",
   "com_ui_fork_all_target": "Incluir todo desde/hacia aquí",
@@ -637,7 +657,7 @@
   "com_ui_fork_default": "Utilizar opción de bifurcación predeterminada",
   "com_ui_fork_error": "Hubo un error al bifurcar la conversación",
   "com_ui_fork_from_message": "Seleccione una opción de bifurcación",
-  "com_ui_fork_info_1": "com_ui_fork_info_1: 'Utilice esta configuración para bifurcar los mensajes con el comportamiento deseado.'",
+  "com_ui_fork_info_1": "Use esta configuración para bifurcar mensajes con el comportamiento deseado.",
   "com_ui_fork_info_2": "\"Bifurcar\" se refiere a crear una nueva conversación que comienza/termina desde mensajes específicos en la conversación actual, creando una copia según las opciones seleccionadas.",
   "com_ui_fork_info_3": "El término \"mensaje objetivo\" se refiere ya sea al mensaje desde el cual se abrió este popup, o, si marca \"{{0}}\", al último mensaje en la conversación.",
   "com_ui_fork_info_branches": "Esta opción bifurca los mensajes visibles, junto con las ramas relacionadas; en otras palabras, la ruta directa hacia el mensaje objetivo, incluyendo las ramas a lo largo de esa ruta.",
@@ -651,8 +671,9 @@
   "com_ui_fork_split_target": "Iniciar bifurcación aquí",
   "com_ui_fork_split_target_setting": "Iniciar bifurcación desde el mensaje objetivo de forma predeterminada",
   "com_ui_fork_success": "Se ha bifurcado la conversación con éxito",
-  "com_ui_fork_visible": "Mostrar únicamente mensajes visibles",
+  "com_ui_fork_visible": "Solo mensajes visibles",
   "com_ui_generating": "Generando...",
+  "com_ui_generating_image": "Generando imagen...",
   "com_ui_go_back": "Volver",
   "com_ui_go_to_conversation": "Ir a la conversación",
   "com_ui_good_afternoon": "Buenas tardes",
@@ -662,64 +683,90 @@
   "com_ui_host": "Host",
   "com_ui_idea": "Ideas",
   "com_ui_image_gen": "Gen Imágenes",
-  "com_ui_import_conversation_error": "Hubo un error al importar tus chats",
-  "com_ui_import_conversation_file_type_error": "com_ui_import_conversation_file_type_error: Tipo de archivo no compatible para importar",
-  "com_ui_import_conversation_info": "Importar chats de un archivo JSON",
-  "com_ui_import_conversation_success": "Chats importados exitosamente",
+  "com_ui_image_gen_failed": "Error al generar la imagen",
+  "com_ui_import_conversation_error": "Hubo un error al importar las conversaciones",
+  "com_ui_import_conversation_file_type_error": "Tipo de archivo no compatible para importar",
+  "com_ui_import_conversation_info": "Importar conversaciones desde un archivo JSON",
+  "com_ui_import_conversation_success": "Conversaciones importadas con éxito",
   "com_ui_include_shadcnui": "Incluir instrucciones de componentes shadcn/ui",
   "com_ui_input": "Entrada",
   "com_ui_instructions": "Instrucciones",
+  "com_ui_labels": "Etiquetas",
+  "com_ui_latest": "más reciente",
   "com_ui_latest_footer": "IA para todos.",
   "com_ui_latest_version": "Última versión",
+  "com_ui_live": "en vivo",
   "com_ui_loading": "Cargando...",
   "com_ui_locked": "Bloqueado",
   "com_ui_logo": "Logotipo de {{0}}",
+  "com_ui_make_production": "Establecer como producción",
   "com_ui_manage": "Administrar",
+  "com_ui_marketplace": "Tienda",
+  "com_ui_marketplace_allow_use": "Permitir el uso de la Tienda",
+  "com_ui_max": "Máximo",
   "com_ui_max_tags": "El número máximo permitido es {{0}}, utilizando los valores más recientes.",
-  "com_ui_mention": "Menciona un punto de conexión, asistente o preconfiguración para cambiar rápidamente a él.",
+  "com_ui_mention": "Mencione un endpoint, asistente o configuración preestablecida para cambiar rápidamente",
   "com_ui_min_tags": "No se pueden eliminar más valores, se requiere un mínimo de {{0}}.",
   "com_ui_model": "Modelo",
-  "com_ui_model_parameters": "Parámetros del Modelo",
+  "com_ui_model_parameters": "Parámetros del modelo",
   "com_ui_more_info": "Más información",
-  "com_ui_my_prompts": "Mis Indicaciones",
+  "com_ui_my_prompts": "Mis Prompts",
   "com_ui_name": "Nombre",
+  "com_ui_navigate_results": "Navegar por los resultados",
   "com_ui_new": "Nuevo",
-  "com_ui_new_chat": "Nuevo Chat",
-  "com_ui_new_conversation_title": "Título de Nueva Conversación",
+  "com_ui_new_chat": "Nuevo chat",
+  "com_ui_new_conversation_title": "Título de nueva conversación",
   "com_ui_next": "Sig",
+  "com_ui_next_result": "Resultado siguiente",
   "com_ui_no": "No",
-  "com_ui_no_bookmarks": "Parece que aún no tiene marcadores. Haga clic en un chat y agregue uno nuevo",
+  "com_ui_no_bookmarks": "Parece que aún no tiene marcadores. Haga clic en un chat y agregue uno.",
   "com_ui_no_category": "Sin categoría",
+  "com_ui_no_labels": "Sin etiquetas",
   "com_ui_no_terms_content": "No hay contenido de términos y condiciones para mostrar",
   "com_ui_none": "Ninguno",
   "com_ui_nothing_found": "No se encontró nada",
   "com_ui_of": "de",
   "com_ui_off": "Desactivado",
-  "com_ui_on": "Encendido",
+  "com_ui_on": "Activado",
+  "com_ui_options": "opciones",
+  "com_ui_output": "Salida",
   "com_ui_page": "Página",
+  "com_ui_pagination": "Paginación",
+  "com_ui_parameters": "Parámetros",
+  "com_ui_pin": "Anclar",
   "com_ui_prev": "Ant",
+  "com_ui_prev_result": "Resultado anterior",
   "com_ui_preview": "Previsualizar",
+  "com_ui_preview_unavailable": "Vista previa no disponible para este tipo de archivo",
   "com_ui_privacy_policy": "Política de privacidad",
   "com_ui_privacy_policy_url": "URL de la Política de Privacidad",
-  "com_ui_prompt": "Indicación",
-  "com_ui_prompt_name": "Nombre de la Indicación",
-  "com_ui_prompt_name_required": "El nombre de la indicación es obligatorio",
-  "com_ui_prompt_preview_not_shared": "El autor no ha permitido la colaboración para esta indicación",
+  "com_ui_production": "Producción",
+  "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Selector de categoría del prompt",
+  "com_ui_prompt_delete_confirm": "¿Está seguro de que desea eliminar el prompt '{{0}}'?",
+  "com_ui_prompt_deleted_group": "Grupo de prompts \"{{0}}\" eliminado",
+  "com_ui_prompt_details": "Detalles del prompt {{name}}",
+  "com_ui_prompt_name": "Nombre del Prompt",
+  "com_ui_prompt_name_required": "El nombre del prompt es obligatorio",
+  "com_ui_prompt_preview_not_shared": "El autor no ha permitido la colaboración para este prompt",
   "com_ui_prompt_text": "Texto",
   "com_ui_prompt_text_required": "El texto es obligatorio",
-  "com_ui_prompt_update_error": "Hubo un error al actualizar la indicación",
-  "com_ui_prompts": "Indicaciones",
-  "com_ui_prompts_allow_create": "Permitir crear Indicaciones",
-  "com_ui_prompts_allow_use": "Permitir uso de Indicaciones",
+  "com_ui_prompt_update_error": "Hubo un error al actualizar el prompt",
+  "com_ui_prompt_variables_list": "Lista de variables del prompt",
+  "com_ui_prompts": "Prompts",
+  "com_ui_prompts_allow_create": "Permitir crear prompts",
+  "com_ui_prompts_allow_use": "Permitir usar prompts",
   "com_ui_provider": "Proveedor",
   "com_ui_read_aloud": "Leer en voz alta",
   "com_ui_regenerate": "Regenerar",
   "com_ui_regenerating": "Regenerando...",
   "com_ui_region": "Región",
+  "com_ui_relevance": "Relevancia",
   "com_ui_rename": "Renombrar",
   "com_ui_rename_conversation": "Renombrar conversación",
   "com_ui_reset_var": "Restablecer {{0}}",
   "com_ui_result": "Resultado",
+  "com_ui_retrieved_files": "Se buscó en sus archivos",
   "com_ui_revoke": "Revocar",
   "com_ui_revoke_info": "Revocar todas las credenciales proporcionadas por el usuario",
   "com_ui_revoke_key_confirm": "¿Está seguro de que desea revocar esta clave?",
@@ -729,12 +776,17 @@
   "com_ui_role_select": "Rol",
   "com_ui_run_code": "Ejecutar código",
   "com_ui_run_code_error": "Se produjo un error al ejecutar el código",
+  "com_ui_running": "Ejecutando...",
   "com_ui_save": "Guardar",
   "com_ui_save_submit": "Guardar y Enviar",
   "com_ui_saved": "¡Guardado!",
   "com_ui_schema": "Esquema",
   "com_ui_search": "Buscar",
   "com_ui_search_agent_category": "Buscar categorías...",
+  "com_ui_search_result_count": "{{count}} resultado encontrado",
+  "com_ui_search_results_count": "{{count}} resultados encontrados",
+  "com_ui_searching_files": "Buscando en sus archivos",
+  "com_ui_seconds": "segundos",
   "com_ui_select": "Seleccionar",
   "com_ui_select_file": "Seleccionar un archivo",
   "com_ui_select_model": "Seleccionar un modelo",
@@ -744,62 +796,112 @@
   "com_ui_select_search_model": "Buscar modelo por nombre",
   "com_ui_select_search_provider": "Buscar proveedor por nombre",
   "com_ui_select_search_region": "Buscar región por nombre",
+  "com_ui_set": "Set",
   "com_ui_share": "Compartir",
   "com_ui_share_create_message": "Tu nombre y cualquier mensaje que agregues después de compartir se mantendrán privados.",
   "com_ui_share_delete_error": "Hubo un error al eliminar el enlace compartido.",
   "com_ui_share_error": "Hubo un error al compartir el enlace del chat",
-  "com_ui_share_link_to_chat": "Compartir enlace en el chat",
+  "com_ui_share_link_to_chat": "Compartir enlace del chat",
   "com_ui_share_update_message": "Tu nombre, instrucciones personalizadas y cualquier mensaje que agregues después de compartir se mantendrán privados.",
   "com_ui_share_var": "Compartir {{0}}",
   "com_ui_shared_link_not_found": "Enlace compartido no encontrado",
-  "com_ui_shared_prompts": "Indicaciones Compartidas",
+  "com_ui_shared_prompts": "Prompts compartidos",
   "com_ui_shop": "Compras",
+  "com_ui_show": "Mostrar",
   "com_ui_show_all": "Mostrar Todo",
-  "com_ui_simple": "Simple",
+  "com_ui_show_less": "Mostrar menos",
+  "com_ui_show_more": "Mostrar más",
   "com_ui_size": "Tamaño",
-  "com_ui_special_variables": "Variables especiales:",
+  "com_ui_size_sort": "Ordenar por Tamaño",
+  "com_ui_special": "especial",
+  "com_ui_special_var_current_date": "Fecha actual",
+  "com_ui_special_var_current_user": "Usuario actual",
+  "com_ui_special_var_desc_current_date": "Fecha actual y día de la semana",
+  "com_ui_special_var_desc_current_datetime": "Fecha y hora local en su zona horaria",
+  "com_ui_special_var_desc_current_user": "Nombre de visualización de su cuenta",
+  "com_ui_special_var_desc_iso_datetime": "Fecha y hora UTC en formato ISO 8601",
+  "com_ui_special_variables": "Variables especiales",
   "com_ui_speech_while_submitting": "No se puede enviar un mensaje de voz mientras se está generando una respuesta",
+  "com_ui_status_prefix": "Estado:",
   "com_ui_stop": "Detener",
   "com_ui_storage": "Almacenamiento",
   "com_ui_submit": "Enviar",
+  "com_ui_summarizing": "Resumiendo...",
+  "com_ui_support_contact_email_placeholder": "support@example.com",
+  "com_ui_support_contact_name": "Nombre",
   "com_ui_teach_or_explain": "Aprendizaje",
   "com_ui_terms_and_conditions": "Términos y Condiciones",
   "com_ui_terms_of_service": "Términos de servicio",
+  "com_ui_text_variables": "Variables de texto",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensamientos",
+  "com_ui_token": "token",
+  "com_ui_tokens": "tokens",
+  "com_ui_tool_failed": "falló",
+  "com_ui_tool_name_code": "Código",
+  "com_ui_tool_name_code_analysis": "Análisis de código",
+  "com_ui_tool_name_file_search": "Búsqueda de archivos",
+  "com_ui_tool_name_image_edit": "Edición de imagen",
+  "com_ui_tool_name_image_gen": "Generación de imagen",
+  "com_ui_tool_name_web_search": "Búsqueda web",
   "com_ui_tools": "Herramientas",
   "com_ui_travel": "Viaje",
   "com_ui_unarchive": "Desarchivar",
+  "com_ui_unarchive_conversation": "Desarchivar conversacion",
   "com_ui_unarchive_error": "Error al desarchivar la conversación",
+  "com_ui_unavailable": "No disponible",
   "com_ui_unknown": "Desconocido",
+  "com_ui_unpin": "Desanclar",
+  "com_ui_untitled": "Sin Titulo",
   "com_ui_update": "Actualizar",
+  "com_ui_update_mcp_server": "Actualizar servidor de MCP",
+  "com_ui_updating": "Actualizando…",
   "com_ui_upload": "Subir",
+  "com_ui_upload_agent_avatar_label": "Subir imagen de Avatar de agente",
   "com_ui_upload_delay": "La carga de \"{{0}}\" está tomando más tiempo del esperado. Espere mientras el archivo termina de indexarse para su recuperación.",
   "com_ui_upload_error": "Hubo un error al subir su archivo",
   "com_ui_upload_file_search": "Subir para búsqueda de archivos",
   "com_ui_upload_files": "Subir archivos",
+  "com_ui_upload_icon": "Subir imagen de ícono",
   "com_ui_upload_image": "Subir una imagen",
   "com_ui_upload_image_input": "Subir imagen",
   "com_ui_upload_invalid": "Archivo no válido para subir. Debe ser una imagen que no exceda el límite",
   "com_ui_upload_invalid_var": "Archivo inválido para subir. Debe ser una imagen que no exceda los {{0}} MB",
+  "com_ui_upload_ocr_text": "Subir como texto",
   "com_ui_upload_success": "Archivo subido con éxito",
   "com_ui_upload_type": "Seleccionar tipo de carga",
+  "com_ui_usage": "Uso",
+  "com_ui_use_memory": "Usar Memoria",
   "com_ui_use_micrphone": "Usar micrófono",
+  "com_ui_use_prompt": "Usar Prompt",
+  "com_ui_used": "Usado",
+  "com_ui_used_n_tools": "Se usaron {{0}} herramientas",
+  "com_ui_user": "Usuarios",
+  "com_ui_user_provides_key": "Cada usuario provee su propia key",
+  "com_ui_value": "Valores",
+  "com_ui_variable_with_options": "Variable {{name}} con {{count}} opciones",
   "com_ui_variables": "Variables",
   "com_ui_verify": "Verificar",
   "com_ui_version_var": "Versión {{0}}",
   "com_ui_versions": "Versiones",
-  "com_ui_web_searching": "Buscando en internet",
-  "com_ui_web_searching_again": "Buscando en internet nuevamente",
+  "com_ui_via_server": "en {{0}}",
+  "com_ui_view_memory": "Ver memoria",
+  "com_ui_web_search_reranker_cohere_key": "Obtén tu clave API de Cohere",
+  "com_ui_web_search_searxng_instance_url": "URL de la instancia de SearXNG",
+  "com_ui_web_search_source": "{{count}} fuente",
+  "com_ui_web_search_sources": "{{count}} fuentes",
+  "com_ui_web_searched": "Se buscó en la web",
+  "com_ui_web_searching": "Buscando en la web",
+  "com_ui_web_searching_again": "Buscando en la web nuevamente",
   "com_ui_weekend_morning": "Feliz fin de semana",
   "com_ui_write": "Escribiendo",
   "com_ui_x_selected": "{{0}} seleccionado",
-  "com_ui_xhigh": "Extra High",
+  "com_ui_xhigh": "Extra alto",
   "com_ui_yes": "Sí",
-  "com_ui_your_api_key": "Tu API Key",
+  "com_ui_your_api_key": "Su clave API",
   "com_ui_zoom": "Zoom",
-  "com_ui_zoom_in": "Menos Zoom",
-  "com_ui_zoom_level": "Nivelar Zoom",
-  "com_ui_zoom_out": "Mas Zoom",
+  "com_ui_zoom_in": "Acercar",
+  "com_ui_zoom_level": "Nivel de zoom",
+  "com_ui_zoom_out": "Alejar",
   "com_user_message": "Usted"
 }
diff --git a/client/src/locales/et/translation.json b/client/src/locales/et/translation.json
index db7ddf0d1eb..47c60f61b8d 100644
--- a/client/src/locales/et/translation.json
+++ b/client/src/locales/et/translation.json
@@ -303,15 +303,12 @@
   "com_nav_browser": "Brauser",
   "com_nav_center_chat_input": "Kuva ",
   "com_nav_change_picture": "Muuda pilti",
-  "com_nav_chat_commands": "Vestluskäsud",
-  "com_nav_chat_commands_info": "Need käsud aktiveeritakse konkreetsete märkide sisestamisel sõnumi alguses. Iga käsk käivitatakse sellele määratud eesliitega. Saate need keelata, kui kasutate neid märke sageli sõnumite alustamiseks.",
   "com_nav_chat_direction": "Vestluse suund",
   "com_nav_clear_all_chats": "Tühjenda kõik vestlused",
   "com_nav_clear_cache_confirm_message": "Oled sa kindel, et sa soovid vahemälu tühjendada?",
   "com_nav_clear_conversation": "Tühjenda vestlused",
   "com_nav_clear_conversation_confirm_message": "Oled sa kindel, et sa soovid kõik vestlused tühjendada? See on pöördumatu.",
   "com_nav_close_sidebar": "Sulge külgriba",
-  "com_nav_commands": "Käsud",
   "com_nav_confirm_clear": "Kinnita tühjendamine",
   "com_nav_conversation_mode": "Vestlusrežiim",
   "com_nav_convo_menu_options": "Vestluse menüü valikud",
@@ -407,9 +404,7 @@
   "com_nav_search_placeholder": "Otsi sõnumeid",
   "com_nav_send_message": "Saada sõnum",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Vestlus",
-  "com_nav_setting_data": "Andmekontroll",
   "com_nav_setting_general": "Üldine",
   "com_nav_setting_speech": "Kõne",
   "com_nav_settings": "Seaded",
@@ -823,7 +818,6 @@
   "com_ui_show_image_details": "Näita pildi üksikasju",
   "com_ui_show_qr": "Näita QR-koodi",
   "com_ui_sign_in_to_domain": "Logi sisse {{0}}",
-  "com_ui_simple": "Lihtne",
   "com_ui_size": "Suurus",
   "com_ui_special_var_current_date": "Praegune kuupäev",
   "com_ui_special_var_current_datetime": "Praegune kuupäev ja kellaaeg",
diff --git a/client/src/locales/fa/translation.json b/client/src/locales/fa/translation.json
index 9d906a35c39..c0303129237 100644
--- a/client/src/locales/fa/translation.json
+++ b/client/src/locales/fa/translation.json
@@ -425,8 +425,6 @@
   "com_nav_browser": "مرورگر",
   "com_nav_center_chat_input": "مرکز ورودی چت در صفحه خوش آمدید",
   "com_nav_change_picture": "تغییر تصویر",
-  "com_nav_chat_commands": "دستورات چت",
-  "com_nav_chat_commands_info": "این دستورات با تایپ کاراکترهای خاص در ابتدای پیام شما فعال می شوند. هر فرمان با پیشوند تعیین شده خود راه اندازی می شود. اگر مرتباً از این کاراکترها برای شروع پیام ها استفاده می کنید، می توانید آنها را غیرفعال کنید.",
   "com_nav_chat_direction": "جهت چت",
   "com_nav_chat_direction_selected": "جهت چت: {{direction}}",
   "com_nav_clear_all_chats": "تمام چت ها را پاک کنید",
@@ -434,7 +432,6 @@
   "com_nav_clear_conversation": "مکالمات را پاک کنید",
   "com_nav_clear_conversation_confirm_message": "آیا مطمئن هستید که می خواهید همه مکالمات را پاک کنید؟ این غیر قابل برگشت است.",
   "com_nav_close_sidebar": "نوار کناری را ببندید",
-  "com_nav_commands": "دستورات",
   "com_nav_confirm_clear": "پاک کردن را تایید کنید",
   "com_nav_control_panel": "کنترل پنل",
   "com_nav_conversation_mode": "حالت مکالمه",
@@ -560,13 +557,10 @@
   "com_nav_search_placeholder": "جستجوی پیام ها",
   "com_nav_send_message": "ارسال پیام",
   "com_nav_setting_account": "حساب",
-  "com_nav_setting_balance": "موجودی",
   "com_nav_setting_chat": "چت کنید",
-  "com_nav_setting_data": "کنترل های داده",
   "com_nav_setting_delay": "تأخیر (ثانیه)",
   "com_nav_setting_general": "ژنرال",
   "com_nav_setting_mcp": "تنظیمات MCP",
-  "com_nav_setting_personalization": "شخصی‌سازی",
   "com_nav_setting_speech": "گفتار",
   "com_nav_settings": "تنظیمات",
   "com_nav_shared_links": "پیوندهای مشترک",
@@ -649,7 +643,6 @@
   "com_ui_advanced_settings": "تنظیمات پیشرفته",
   "com_ui_agent": "کارگزار",
   "com_ui_agent_api_keys": "کلیدهای API عامل",
-  "com_ui_agent_api_keys_description": "ایجاد کلیدهای API برای دسترسی به عامل‌ها از راه دور از طریق API",
   "com_ui_agent_category_aftersales": "خدمات پس از فروش",
   "com_ui_agent_category_finance": "مالی",
   "com_ui_agent_category_general": "عمومی",
@@ -704,7 +697,6 @@
   "com_ui_analyzing": "در حال تجزیه و تحلیل",
   "com_ui_analyzing_finished": "تجزیه و تحلیل را به پایان رساند",
   "com_ui_api_key": "کلید API",
-  "com_ui_api_key_copied": "کلید API در کلیپ‌بورد کپی شد",
   "com_ui_api_key_create_error": "ایجاد کلید API ناموفق بود",
   "com_ui_api_key_created": "کلید API با موفقیت ایجاد شد",
   "com_ui_api_key_delete_error": "حذف کلید API ناموفق بود",
@@ -1024,7 +1016,6 @@
   "com_ui_hide": "پنهان کردن",
   "com_ui_hide_code": "پنهان کردن کد",
   "com_ui_hide_image_details": "پنهان کردن جزئیات تصویر",
-  "com_ui_hide_password": "پنهان کردن رمز عبور",
   "com_ui_hide_qr": "کد QR را مخفی کنید",
   "com_ui_high": "زیاد",
   "com_ui_host": "میزبان",
@@ -1047,7 +1038,6 @@
   "com_ui_instructions": "دستورالعمل ها",
   "com_ui_key": "کلید",
   "com_ui_key_required": "کلید API الزامی است",
-  "com_ui_last_used": "آخرین استفاده",
   "com_ui_late_night": "آخر شب مبارک",
   "com_ui_latest_footer": "هر هوش مصنوعی برای همه",
   "com_ui_latest_version": "آخرین نسخه",
@@ -1157,7 +1147,6 @@
   "com_ui_new_conversation_title": "عنوان مکالمه جدید",
   "com_ui_next": "بعدی",
   "com_ui_no": "خیر",
-  "com_ui_no_api_keys": "هنوز کلید API وجود ندارد. برای شروع یکی ایجاد کنید.",
   "com_ui_no_auth": "بدون احراز هویت",
   "com_ui_no_bookmarks": "به نظر می رسد هنوز هیچ نشانکی ندارید. روی یک چت کلیک کنید و یک چت جدید اضافه کنید",
   "com_ui_no_bookmarks_match": "هیچ بوک‌مارکی با جستجوی شما مطابقت ندارد",
@@ -1171,7 +1160,6 @@
   "com_ui_no_memories": "هیچ خاطره‌ای وجود ندارد. آنها را دستی ایجاد کنید یا به هوش مصنوعی بگویید چیزی را به خاطر بسپارد",
   "com_ui_no_memories_match": "هیچ خاطره‌ای با جستجوی شما مطابقت ندارد",
   "com_ui_no_memories_title": "هنوز خاطره‌ای وجود ندارد",
-  "com_ui_no_personalization_available": "در حال حاضر گزینه‌های شخصی‌سازی موجود نیست",
   "com_ui_no_prompts_title": "هنوز پرامپتی وجود ندارد",
   "com_ui_no_read_access": "شما اجازه مشاهده خاطرات را ندارید",
   "com_ui_no_results_found": "نتیجه‌ای یافت نشد",
@@ -1350,10 +1338,8 @@
   "com_ui_show_all": "نمایش همه",
   "com_ui_show_code": "نمایش کد",
   "com_ui_show_image_details": "نمایش جزئیات تصویر",
-  "com_ui_show_password": "نمایش رمز عبور",
   "com_ui_show_qr": "نمایش کد QR",
   "com_ui_sign_in_to_domain": "به سیستم وارد شوید {{0}}",
-  "com_ui_simple": "ساده",
   "com_ui_size": "اندازه",
   "com_ui_size_sort": "مرتب‌سازی بر اساس اندازه",
   "com_ui_special_var_current_date": "تاریخ جاری",
diff --git a/client/src/locales/fi/translation.json b/client/src/locales/fi/translation.json
index f8a8b974192..6f6c40d6f73 100644
--- a/client/src/locales/fi/translation.json
+++ b/client/src/locales/fi/translation.json
@@ -341,7 +341,6 @@
   "com_nav_search_placeholder": "Etsi keskusteluista",
   "com_nav_send_message": "Lähetä viesti",
   "com_nav_setting_account": "Käyttäjätili",
-  "com_nav_setting_data": "Datakontrollit",
   "com_nav_setting_general": "Yleiset",
   "com_nav_setting_speech": "Puhe",
   "com_nav_settings": "Asetukset",
@@ -541,7 +540,6 @@
   "com_ui_shared_link_not_found": "Jakolinkki ei löytynyt",
   "com_ui_shared_prompts": "Jaetut syötteet",
   "com_ui_show_all": "Näytä kaikki",
-  "com_ui_simple": "Yksinkertainen",
   "com_ui_size": "Koko",
   "com_ui_special_variables": "Erikoismuuttujat: Käytä {{current_date}} kuluvaa päivämäärää varten, ja {{current_user}} käyttäjätunnustasi varten.",
   "com_ui_stop": "Pysäytä",
diff --git a/client/src/locales/fr/translation.json b/client/src/locales/fr/translation.json
index a4d5afaff1f..86379906ee6 100644
--- a/client/src/locales/fr/translation.json
+++ b/client/src/locales/fr/translation.json
@@ -1,9 +1,13 @@
 {
-  "chat_direction_left_to_right": "il faut mettre quelque chose ici. c'était vide.",
-  "chat_direction_right_to_left": "Il faut mettre quelque chose ici. C'était vide.",
+  "chat_direction_left_to_right": "De gauche à droite",
+  "chat_direction_right_to_left": "De droite à gauche",
   "com_a11y_ai_composing": "L'IA est en train de réfléchir",
+  "com_a11y_chats_date_section": "Conversations du {{date}}",
   "com_a11y_end": "L'IA a terminé sa réponse",
+  "com_a11y_selected": "sélectionné",
   "com_a11y_start": "L'IA a commencé sa réponse",
+  "com_a11y_summarize_completed": "Contexte résumé.",
+  "com_a11y_summarize_failed": "Le résumé a échoué, poursuite avec le contexte disponible.",
   "com_agents_agent_card_label": "{{nom}} agent. {{description}}",
   "com_agents_all": "Tous les agents",
   "com_agents_all_category": "Tous",
@@ -14,7 +18,7 @@
   "com_agents_category_empty": "Aucun agent trouvé dans la catégorie {{category}}",
   "com_agents_category_finance": "Finance",
   "com_agents_category_finance_description": "Agents spécialisés dans l'analyse financière, la budgétisation et la comptabilité",
-  "com_agents_category_general": "Générale",
+  "com_agents_category_general": "Général",
   "com_agents_category_general_description": "Agents génériques pour tâches et requêtes standards",
   "com_agents_category_hr": "Ressources Humaines",
   "com_agents_category_hr_description": "Agents spécialisés dans les procédures RH, les politiques et le soutien aux employés",
@@ -28,9 +32,11 @@
   "com_agents_category_tabs_label": "Catégories d'agent",
   "com_agents_chat_with": "Chatter avec {{name}}",
   "com_agents_clear_search": "Effacer la recherche",
+  "com_agents_contact": "Contact",
   "com_agents_copy_link": "Copier le lien",
   "com_agents_create_error": "Une erreur s'est produite lors de la création de votre agent.",
   "com_agents_created_by": "par",
+  "com_agents_description_card": "Description : {{description}}",
   "com_agents_description_placeholder": "Décrivez votre Agent ici (facultatif)",
   "com_agents_empty_state_heading": "Aucun agent trouvé",
   "com_agents_enable_file_search": "Activer la recherche de fichiers",
@@ -60,7 +66,7 @@
   "com_agents_file_context_description": "Les fichiers uploadés comme \"Contexte\" sont traités en tant que texte pour compléter les instructions de l'agent. Si l'OCR est configuré pour le type de fichier uploadé, il est utilisé pour extraire le texte. Parfait pour les documents, les images avec du texte ou les PDF où vous avez besoin du contenu textuel complet d'un fichier.",
   "com_agents_file_context_disabled": "L'agent doit être créé avant de charger des fichiers pour le contexte de fichiers.",
   "com_agents_file_context_label": "Contexte de fichiers",
-  "com_agents_file_search_disabled": "L'agent doit être créé avant de pouvoir télécharger des fichiers pour la Recherche de Fichiers.",
+  "com_agents_file_search_disabled": "L'agent doit être créé avant de pouvoir téléverser des fichiers pour la Recherche de fichiers.",
   "com_agents_file_search_info": "Lorsque cette option est activée, l'agent sera informé des noms exacts des fichiers listés ci-dessous, lui permettant d'extraire le contexte pertinent de ces fichiers.",
   "com_agents_grid_announcement": "{{count}} agents affichés dans la catégorie {{category}}",
   "com_agents_instructions_placeholder": "Les instructions système que l'agent utilise",
@@ -69,7 +75,7 @@
   "com_agents_load_more_label": "Afficher plus d'agents de la catégorie {{category}}",
   "com_agents_loading": "Chargement...",
   "com_agents_marketplace": "Marketplace d'Agents",
-  "com_agents_marketplace_subtitle": "Découvres et profites d'agents IA puissants pour améliorer tes processus et ta productivité",
+  "com_agents_marketplace_subtitle": "Découvrez et profitez d'agents IA puissants pour améliorer vos processus et votre productivité.",
   "com_agents_mcp_description_placeholder": "Décrivez ce qu'il fait en quelques mots",
   "com_agents_mcp_icon_size": "Taille minimale de 128 x 128 pixels",
   "com_agents_mcp_name_placeholder": "Outil personnalisé",
@@ -136,6 +142,7 @@
   "com_assistants_update_actions_success": "Action créée ou mise à jour avec succès",
   "com_assistants_update_error": "Une erreur s'est produite lors de la mise à jour de votre assistant.",
   "com_assistants_update_success": "Mise à jour réussie",
+  "com_assistants_update_success_name": "{{name}} mis à jour avec succès",
   "com_auth_already_have_account": "Vous avez déjà un compte ?",
   "com_auth_apple_login": "S'identifier avec Apple",
   "com_auth_back_to_login": "Retour à la connexion",
@@ -213,10 +220,11 @@
   "com_endpoint_agent": "Agent",
   "com_endpoint_agent_placeholder": "Veuillez sélectionner un Agent",
   "com_endpoint_ai": "IA",
+  "com_endpoint_anthropic_effort": "Contrôle la puissance de calcul que Claude utilise. Un effort réduit économise des jetons et réduit la latence ; un effort élevé produit des réponses plus approfondies. « Max » active le raisonnement le plus profond (Opus 4.6 uniquement).",
   "com_endpoint_anthropic_maxoutputtokens": "Nombre maximum de jetons qui peuvent être générés dans la réponse. Spécifiez une valeur plus faible pour des réponses plus courtes et une valeur plus élevée pour des réponses plus longues.",
   "com_endpoint_anthropic_prompt_cache": "La mise en cache des prompts permet de réutiliser les contextes ou instructions volumineux entre les appels API, réduisant ainsi les coûts et la latence",
   "com_endpoint_anthropic_temp": "Varie de 0 à 1. Utilisez une température proche de 0 pour l'analyse / le choix multiple, et proche de 1 pour les tâches créatives et génératives. Nous vous recommandons de modifier ceci ou Top P mais pas les deux.",
-  "com_endpoint_anthropic_thinking": "Activez le raisonnement pour les modèles Claude pris en charge (3.7 Sonnet). Note : nécessite que le \"l'option de réflexion\" soit activée et inférieur au \"nombre maximum de jetons de sortie\".",
+  "com_endpoint_anthropic_thinking": "Active le raisonnement interne pour les modèles Claude pris en charge. Pour les modèles récents (Opus 4.6+), utilise une réflexion adaptative contrôlée par le paramètre Effort. Pour les modèles antérieurs, nécessite que le \"Budget de réflexion\" soit défini et inférieur au \"Nombre maximum de jetons de sortie\".",
   "com_endpoint_anthropic_thinking_budget": "Détermine le nombre maximum de jetons que Claude est autorisé à utiliser pour son processus de raisonnement interne. Des budgets plus importants peuvent améliorer la qualité des réponses en permettant une analyse plus approfondie des problèmes complexes, bien que Claude puisse ne pas utiliser la totalité du budget alloué, en particulier dans les plages supérieures à 32K. Ce paramètre doit être inférieur à \"Max Output Tokens\".",
   "com_endpoint_anthropic_topk": "Top-k change la façon dont le modèle sélectionne les jetons pour la sortie. Un top-k de 1 signifie que le jeton sélectionné est le plus probable parmi tous les jetons du vocabulaire du modèle (également appelé décodage glouton), tandis qu'un top-k de 3 signifie que le jeton suivant est sélectionné parmi les 3 jetons les plus probables (en utilisant la température).",
   "com_endpoint_anthropic_topp": "Top-p change la façon dont le modèle sélectionne les jetons pour la sortie. Les jetons sont sélectionnés du plus K (voir le paramètre topK) probable au moins jusqu'à ce que la somme de leurs probabilités égale la valeur top-p.",
@@ -224,6 +232,7 @@
   "com_endpoint_assistant": "Assistant de point de terminaison",
   "com_endpoint_assistant_model": "Modèle d'assistant",
   "com_endpoint_assistant_placeholder": "Veuillez sélectionner un assistant dans le panneau latéral droit",
+  "com_endpoint_bedrock_reasoning_effort": "Contrôle le niveau de raisonnement pour les modèles Bedrock compatibles (ex. Kimi K2.5, GLM). Des niveaux plus élevés produisent un raisonnement plus approfondi au prix d'une latence et d'une consommation de jetons accrues.",
   "com_endpoint_config_click_here": "Cliquez ici",
   "com_endpoint_config_google_api_info": "Pour obtenir votre clé API de langage génératif (pour Gemini),",
   "com_endpoint_config_google_api_key": "Clé API Google",
@@ -252,7 +261,9 @@
   "com_endpoint_default": "par défaut",
   "com_endpoint_default_blank": "par défaut : vide",
   "com_endpoint_default_with_num": "par défaut : {{0}}",
+  "com_endpoint_disable_streaming": "Désactiver le streaming des réponses et recevoir la réponse complète en une seule fois. Utile pour les modèles comme o3 qui nécessitent une vérification d'organisation pour le streaming.",
   "com_endpoint_disable_streaming_label": "Désactiver le streaming",
+  "com_endpoint_effort": "Effort",
   "com_endpoint_examples": " Exemples",
   "com_endpoint_export": "Exporter",
   "com_endpoint_export_share": "Exporter/Partager",
@@ -260,8 +271,9 @@
   "com_endpoint_google_custom_name_placeholder": "Définir un nom personnalisé pour Google",
   "com_endpoint_google_maxoutputtokens": "Nombre maximum de jetons qui peuvent être générés dans la réponse. Spécifiez une valeur plus faible pour des réponses plus courtes et une valeur plus élevée pour des réponses plus longues.",
   "com_endpoint_google_temp": "Des valeurs plus élevées = plus aléatoires, tandis que des valeurs plus faibles = plus concentrées et déterministes. Nous vous recommandons de modifier ceci ou Top P mais pas les deux.",
-  "com_endpoint_google_thinking": "Active / désactive le raisonnement. Ce réglage n'est pris en charge que par certains modèles (de la série des 2.5). Pour les modèles plus anciens, ce réglage peut n'avoir aucun effet ou l'empêcher de fonctionner.",
-  "com_endpoint_google_thinking_budget": "Indique au modèle sur le nombre de jetons à utiliser pour la réflexion. Selon le message, le nombre de jetons effectivement consommés peut être supérieur ou inférieur à la valeur spécifiée.\n\nCe réglage n'est pris en charge que par certains modèles (de la série des 2.5). Gemini 2.5 Pro accepte une valeur comprise entre 128 et 32 768 jetons. Gemini 2.5 Flash accepte entre 0 et 24 576 jetons. Gemini 2.5 Flash Lite accepte entre 512 et 24 576 jetons.\n\nLaissez vide ou avec une valeur de \"-1\" pour laisser le model décider seul s'il doit réfléchir et à quel point il doit réfléchir. Par défaut, Gemini 2.5 Flash Lite ne réfléchit pas.",
+  "com_endpoint_google_thinking": "Active ou désactive le raisonnement. Pris en charge par les séries Gemini 2.5 et 3. Remarque : Gemini 3 Pro ne peut pas désactiver complètement la réflexion.",
+  "com_endpoint_google_thinking_budget": "Indique le nombre de jetons de réflexion que le modèle utilise. Le nombre effectif peut être supérieur ou inférieur à cette valeur selon le prompt.\n\nCe réglage ne s'applique qu'aux modèles Gemini 2.5 et antérieurs. Pour Gemini 3 et les versions suivantes, utilisez plutôt le paramètre Niveau de réflexion.\n\nGemini 2.5 Pro accepte entre 128 et 32 768 jetons. Gemini 2.5 Flash accepte entre 0 et 24 576 jetons. Gemini 2.5 Flash Lite accepte entre 512 et 24 576 jetons.\n\nLaissez vide ou saisissez \"-1\" pour laisser le modèle décider automatiquement quand et combien réfléchir. Par défaut, Gemini 2.5 Flash Lite ne réfléchit pas.",
+  "com_endpoint_google_thinking_level": "Contrôle la profondeur de raisonnement pour les modèles Gemini 3 et ultérieurs. N'a aucun effet sur Gemini 2.5 et les versions antérieures, utilisez le budget de réflexion pour ceux-ci.\n\nLaissez sur Auto pour utiliser la valeur par défaut du modèle.",
   "com_endpoint_google_topk": "Top-k change la façon dont le modèle sélectionne les jetons pour la sortie. Un top-k de 1 signifie que le jeton sélectionné est le plus probable parmi tous les jetons du vocabulaire du modèle (également appelé décodage glouton), tandis qu'un top-k de 3 signifie que le jeton suivant est sélectionné parmi les 3 jetons les plus probables (en utilisant la température).",
   "com_endpoint_google_topp": "Top-p change la façon dont le modèle sélectionne les jetons pour la sortie. Les jetons sont sélectionnés du plus K (voir le paramètre topK) probable au moins jusqu'à ce que la somme de leurs probabilités égale la valeur top-p.",
   "com_endpoint_google_use_search_grounding": "Utilise la fonctionnalité d'ancrage aux recherches de google pour ajouter des résultats de recherches web en temps réels aux réponses. Cela permet aux modèles d'accéder aux informations récentes et de fournir une réponse plus précise et à jour.",
@@ -289,6 +301,7 @@
   "com_endpoint_openai_topp": "Une alternative à l'échantillonnage avec température, appelée échantillonnage du noyau, où le modèle considère les résultats des jetons avec une masse de probabilité top_p. Ainsi, 0,1 signifie que seuls les jetons représentant les 10 % de masse de probabilité les plus élevés sont pris en compte. Nous vous recommandons de modifier ceci ou la température mais pas les deux.",
   "com_endpoint_openai_use_responses_api": "Utilise l'API de Réponses plutôt que la completion de messages, ce qui offre plus de fonctionnalités auprès d'OpenAI. Obligatoire pour o1-pro, o3-pro et pour activer la synthèse du raisonnement",
   "com_endpoint_openai_use_web_search": "Activer l'utilisation des capacités de recherche de OpenAI pour faire des recherches web. Cela permet au modèle de chercher des informations récentes sur internet et de fournir des réponses plus précises.",
+  "com_endpoint_openai_verbosity": "Contrôle la verbosité de la réponse du modèle. Des valeurs plus basses produisent des réponses plus concises, tandis que des valeurs plus élevées produisent des réponses plus détaillées. Les valeurs actuellement prises en charge sont faible, moyen et élevé.",
   "com_endpoint_output": "Sortie",
   "com_endpoint_plug_image_detail": "Détail de l'image",
   "com_endpoint_plug_resend_files": "Renvoyer les fichiers",
@@ -301,6 +314,7 @@
   "com_endpoint_preset_default_removed": "n'est plus le préréglage par défaut.",
   "com_endpoint_preset_delete_confirm": "Êtes-vous sûr de vouloir supprimer ce préréglage?",
   "com_endpoint_preset_delete_error": "Il y a eu une erreur lors de la suppression de votre préréglage. Veuillez réessayer.",
+  "com_endpoint_preset_delete_success": "Préréglage supprimé avec succès",
   "com_endpoint_preset_import": "Préréglage importé!",
   "com_endpoint_preset_import_error": "Il y a eu une erreur lors de l'importation de votre préréglage. Veuillez réessayer.",
   "com_endpoint_preset_name": "Nom du préréglage",
@@ -328,6 +342,7 @@
   "com_endpoint_temperature": "Température",
   "com_endpoint_thinking": "Je réfléchi",
   "com_endpoint_thinking_budget": "Budget de réflexion",
+  "com_endpoint_thinking_level": "Niveau de réflexion",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Utiliser l'assistant actif",
@@ -341,19 +356,22 @@
   "com_error_files_process": "Une erreur s'est produite lors du traitement du fichier.",
   "com_error_files_upload": "Une erreur s'est produite lors du téléversement du fichier",
   "com_error_files_upload_canceled": "La demande de téléversement du fichier a été annulée. Remarque : le téléversement peut être toujours en cours de traitement et devra être supprimé manuellement.",
-  "com_error_files_upload_too_large": "Le fichier est trop volumineux. Veuillez télécharger un fichier de moins de {{0}} Mo.",
+  "com_error_files_upload_too_large": "Le fichier est trop volumineux. Veuillez téléverser un fichier de moins de {{0}} Mo.",
   "com_error_files_validation": "Une erreur s'est produite lors de la validation du fichier.",
   "com_error_google_tool_conflict": "L'utilisation combinée des outils intégrés de Google et d'outils externes n'est pas prise en charge. Veuillez désactiver soit les outils intégrés soit les outils externes.",
   "com_error_heic_conversion": "La conversion de l'image HEIC en JPEG a échoué. Essayez de convertir l'image manuellement ou utilisez un autre format.",
   "com_error_illegal_model_request": "Le modèle \"{{0}}\" n'est pas disponible pour {{1}}. Veuillez sélectionner un autre modèle.",
   "com_error_input_length": "Le nombre de jetons du dernier message est trop élevé et dépasse la limite autorisée ({{0}}). Veuillez raccourcir votre message, ajuster la taille maximale du contexte dans les paramètres de conversation, ou créer une nouvelle conversation pour continuer.",
   "com_error_invalid_agent_provider": "Le \"fournisseur {{0}} \" n'est pas disponible pour les agents. Veuillez vous rendre dans les paramètres de votre agent et sélectionner un fournisseur actuellement disponible.",
+  "com_error_invalid_base_url": "L'URL de base fournie cible une adresse restreinte. Veuillez utiliser une URL externe valide et réessayer.",
   "com_error_invalid_user_key": "Clé fournie non valide. Veuillez fournir une clé valide et réessayer.",
   "com_error_missing_model": "Aucun modele pour {{0}}, Veuillez sélectionner un modèle et réessayer. ",
   "com_error_models_not_loaded": "Impossible de charger la configuration des modèles. Rafraîchissez la page et essayez à nouveau.",
   "com_error_moderation": "Il semble que le contenu soumis ait été signalé par notre système de modération pour ne pas être conforme à nos lignes directrices communautaires. Nous ne pouvons pas procéder avec ce sujet spécifique. Si vous avez d'autres questions ou sujets que vous souhaitez explorer, veuillez modifier votre message ou créer une nouvelle conversation.",
   "com_error_no_base_url": "Aucune URL de base trouvée. Veuillez en fournir une et réessayer.",
   "com_error_no_user_key": "Aucune clé trouvée. Veuillez fournir une clé et réessayer.",
+  "com_error_refusal": "Réponse refusée par les filtres de sécurité. Reformulez votre message et réessayez. Si vous rencontrez cela fréquemment avec Claude Sonnet 4.5 ou Opus 4.1, vous pouvez essayer Sonnet 4, qui a des restrictions d'utilisation différentes.",
+  "com_error_stream_expired": "Le flux de réponse a expiré ou est déjà terminé. Veuillez réessayer.",
   "com_file_pages": "Pages: {{pages}}",
   "com_file_source": "Fichier",
   "com_file_unknown": "Fichier Inconnu\n",
@@ -366,8 +384,10 @@
   "com_files_no_results": "Aucun résultat.",
   "com_files_number_selected": "{{0}} sur {{1}} fichier(s) sélectionné(s)",
   "com_files_preparing_download": "Préparation du téléchargement",
+  "com_files_result_found": "{{count}} résultat trouvé",
+  "com_files_results_found": "{{count}} résultats trouvés",
   "com_files_sharepoint_picker_title": "Sélectionner un fichier",
-  "com_files_table": "quelquechose doit être renseigné ici. c'était vide",
+  "com_files_table": "Tableau des fichiers",
   "com_files_upload_local_machine": "Depuis ordinateur local",
   "com_files_upload_sharepoint": "Depuis Sharepoint",
   "com_generated_files": "Fichiers générés :",
@@ -375,7 +395,7 @@
   "com_info_heic_converting": "Convertir les images HEIC en JPEG...",
   "com_nav_2fa": "Authentification à deux facteurs (2FA)",
   "com_nav_account_settings": "Paramètres du compte",
-  "com_nav_always_make_prod": "Rendre toujours les nouvelles versions en production",
+  "com_nav_always_make_prod": "Toujours mettre les nouvelles versions de prompts en production",
   "com_nav_archive_created_at": "Créé Le",
   "com_nav_archive_name": "Nom",
   "com_nav_archived_chats": "Conversations archivées",
@@ -384,7 +404,8 @@
   "com_nav_audio_play_error": "Erreur de lecture audio : {{0}}",
   "com_nav_audio_process_error": "Erreur de traitement audio : {{0}}",
   "com_nav_auto_scroll": "Défilement automatique jusqu'au plus récent à l'ouverture",
-  "com_nav_auto_send_prompts": "Envoi automatique des prompts",
+  "com_nav_auto_send_prompts": "Envoyer les prompts à la sélection",
+  "com_nav_auto_send_prompts_desc": "Envoyer automatiquement le prompt dans la conversation lorsqu'il est sélectionné",
   "com_nav_auto_send_text": "Envoi automatique du texte (après 3 sec)",
   "com_nav_auto_transcribe_audio": "Transcription audio automatique",
   "com_nav_automatic_playback": "Lecture automatique du dernier message (externe seulement)",
@@ -413,19 +434,19 @@
   "com_nav_browser": "Navigateur",
   "com_nav_center_chat_input": "Centrer la zone de saisie avec l'écran d'accueil",
   "com_nav_change_picture": "Changer de photo",
-  "com_nav_chat_commands": "Commandes de chat",
-  "com_nav_chat_commands_info": "Ces commandes sont activées en tapant des caractères spécifiques au début de votre message. Chaque commande est déclenchée par son préfixe désigné. Vous pouvez les désactiver si vous utilisez fréquemment ces caractères pour commencer vos messages.",
   "com_nav_chat_direction": "Direction de la conversation",
+  "com_nav_chat_direction_selected": "Direction de la conversation : {{direction}}",
   "com_nav_clear_all_chats": "Effacer toutes les conversations",
   "com_nav_clear_cache_confirm_message": "Êtes-vous sûr de vouloir vider le cache ?",
   "com_nav_clear_conversation": "Effacer les conversations",
   "com_nav_clear_conversation_confirm_message": "Êtes-vous sûr de vouloir effacer toutes les conversations ? Ceci est irréversible.",
   "com_nav_close_sidebar": "Fermer la barre latérale",
-  "com_nav_commands": "Commandes",
   "com_nav_confirm_clear": "Confirmer l'effacement",
+  "com_nav_control_panel": "Panneau de contrôle",
   "com_nav_conversation_mode": "Mode conversation",
   "com_nav_convo_menu_options": "Options du menu de conversation",
   "com_nav_db_sensitivity": "Sensibilité en décibels",
+  "com_nav_default_temporary_chat": "Conversation temporaire par défaut",
   "com_nav_delete_account": "Supprimer le compte",
   "com_nav_delete_account_button": "Supprimer définitivement mon compte",
   "com_nav_delete_account_confirm": "Supprimer le compte - êtes-vous sûr?",
@@ -458,6 +479,7 @@
   "com_nav_info_code_artifacts": "Active l'affichage des artéfacts de code expérimentaux à côté du chat",
   "com_nav_info_code_artifacts_agent": "Active l'utilisation d'artefacts de code pour cet agent. Par défaut, des instructions supplémentaires spécifiques à l'utilisation des artefacts sont ajoutées, à moins que le \"Mode d'invite personnalisé\" ne soit activé.",
   "com_nav_info_custom_prompt_mode": "Lorsqu'activé, le prompt système par défaut pour les artéfacts ne sera pas inclus. Toutes les instructions de génération d'artéfacts doivent être fournies manuellement dans ce mode.",
+  "com_nav_info_default_temporary_chat": "Lorsque cette option est activée, les nouvelles conversations démarrent en mode temporaire par défaut. Les conversations temporaires ne sont pas enregistrées dans votre historique.",
   "com_nav_info_enter_to_send": "Lorsqu'activée, appuyez sur la touche ENTRÉE pour envoyer votre message. Lorsque désactivée, appuyez sur Entrée ajoutera une nouvelle ligne, et vous devrez appuyer sur CTRL + ENTRÉE pour envoyer votre message.",
   "com_nav_info_fork_change_default": "Messages visibles uniquement, inclut uniquement le chemin direct vers le message sélectionné. Inclure les branches liées, ajoute des branches tout au long du chemin. Inclure tous depuis/jusque là, inclut tous les messages et branches connectés.",
   "com_nav_info_fork_split_target_setting": "Lorsqu'activé, le forking commencera du message cible jusqu'au dernier message de la conversation, selon le comportement sélectionné.",
@@ -486,16 +508,20 @@
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "Hongrois",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
   "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
   "com_nav_lang_norwegian_bokmal": "Norvegien",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
   "com_nav_lang_persian": "Persan",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
   "com_nav_lang_slovenian": "Slovène",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
@@ -511,8 +537,18 @@
   "com_nav_log_out": "Se déconnecter",
   "com_nav_long_audio_warning": "Les textes plus longs prendront plus de temps à traiter.",
   "com_nav_maximize_chat_space": "Maximiser l'espace de discussion",
+  "com_nav_mcp_access_revoked": "Accès au serveur MCP révoqué avec succès.",
   "com_nav_mcp_configure_server": "Configurer {{0}}",
+  "com_nav_mcp_connect": "Connecter",
+  "com_nav_mcp_connect_server": "Connecter {{0}}",
+  "com_nav_mcp_reconnect": "Reconnecter",
+  "com_nav_mcp_status_connected": "Connecté",
   "com_nav_mcp_status_connecting": "{{0}} - Connexion en cours",
+  "com_nav_mcp_status_disconnected": "Déconnecté",
+  "com_nav_mcp_status_error": "Erreur",
+  "com_nav_mcp_status_initializing": "Initialisation",
+  "com_nav_mcp_status_needs_auth": "Authentification requise",
+  "com_nav_mcp_status_unknown": "Inconnu",
   "com_nav_mcp_vars_update_error": "Erreur lors de l'actualisation des variables MCP de l'utilisateur",
   "com_nav_mcp_vars_updated": "Actualisation réussie des variables de l'utilisateur MCP personnalisé.",
   "com_nav_modular_chat": "Activer le changement de points de terminaison en cours de conversation",
@@ -530,13 +566,10 @@
   "com_nav_search_placeholder": "Rechercher des messages",
   "com_nav_send_message": "Envoyer un message",
   "com_nav_setting_account": "Compte",
-  "com_nav_setting_balance": "Solde",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Contrôles des données",
   "com_nav_setting_delay": "Délai(s)",
   "com_nav_setting_general": "Général",
   "com_nav_setting_mcp": "Réglages MCP",
-  "com_nav_setting_personalization": "Personnalisation",
   "com_nav_setting_speech": "Parole",
   "com_nav_settings": "Paramètres",
   "com_nav_shared_links": "Liens partagés",
@@ -595,28 +628,39 @@
   "com_ui_2fa_generate_error": "Une erreur s'est produite lors de la génération des paramètres d'authentification à deux facteurs",
   "com_ui_2fa_invalid": "Code d'authentification à deux facteurs invalide",
   "com_ui_2fa_setup": "Configuration de l'authentification à deux facteurs (2FA)",
+  "com_ui_2fa_verification_required": "Entrez votre code 2FA pour continuer",
   "com_ui_2fa_verified": "Vérification de l'authentification à deux facteurs réussie",
   "com_ui_accept": "J'accepte",
   "com_ui_action_button": "Bouton d'action",
   "com_ui_active": "Actif",
   "com_ui_add": "Ajouter",
+  "com_ui_add_first_bookmark": "Cliquez sur une conversation pour en ajouter un",
+  "com_ui_add_first_mcp_server": "Créez votre premier serveur MCP pour commencer",
+  "com_ui_add_first_prompt": "Créez votre premier prompt pour commencer",
+  "com_ui_add_labels": "Ajouter des étiquettes",
   "com_ui_add_mcp": "Ajouter MCP",
   "com_ui_add_mcp_server": "Ajouter un server MCP",
   "com_ui_add_model_preset": "Ajouter un modèle ou un préréglage pour une réponse supplémentaire",
   "com_ui_add_multi_conversation": "Ajouter plusieurs conversations",
+  "com_ui_add_special_variables": "Ajouter des variables spéciales",
+  "com_ui_add_web_search_api_keys": "Ajouter des clés API de recherche web",
   "com_ui_adding_details": "Ajouter des détails",
+  "com_ui_additional_details": "Détails supplémentaires",
   "com_ui_admin": "Administrateur",
   "com_ui_admin_access_warning": "La désactivation de l'accès administrateur à cette fonctionnalité peut entraîner des problèmes d'interface imprévus nécessitant une actualisation. Une fois sauvegardé, le seul moyen de rétablir l'accès est via le paramètre d'interface dans la configuration librechat.yaml, ce qui affecte tous les rôles.",
   "com_ui_admin_settings": "Paramètres administratifs",
+  "com_ui_admin_settings_section": "Paramètres administrateur - {{section}}",
   "com_ui_advanced": "Avancé",
   "com_ui_advanced_settings": "Réglages avancés",
   "com_ui_agent": "Agent",
+  "com_ui_agent_api_keys": "Clés API des agents",
   "com_ui_agent_category_aftersales": "Après-Vente",
   "com_ui_agent_category_finance": "Finance",
   "com_ui_agent_category_general": "Général",
   "com_ui_agent_category_hr": "RH",
   "com_ui_agent_category_it": "IT",
   "com_ui_agent_category_rd": "R&D",
+  "com_ui_agent_category_sales": "Ventes",
   "com_ui_agent_category_selector_aria": "Sélecteur de catégorie de l'agent",
   "com_ui_agent_chain": "Chaîne d'agents (mélange d'agents)",
   "com_ui_agent_chain_info": "Active la création des séquences d'agents. Chaque agent peut accéder aux résultats des agents précédents de la chaîne. Basé sur l'architecture \"mélange d'agents\" où les agents utilisent les résultats précédents comme information auxiliaire.",
@@ -625,8 +669,17 @@
   "com_ui_agent_deleted": "Agent supprimé avec succès",
   "com_ui_agent_duplicate_error": "Une erreur s'est produite lors de la duplication de l'agent",
   "com_ui_agent_duplicated": "Agent dupliqué avec succès",
+  "com_ui_agent_handoff_add": "Ajouter un agent de transfert",
+  "com_ui_agent_handoff_description": "Description du transfert",
   "com_ui_agent_handoff_description_placeholder": "ex. : Transfert à un data analyste pour analyse statistique",
   "com_ui_agent_handoff_info": "Configurer les agents vers lesquels cet agent peut transférer les conversations lorsqu'une expertise spécifique est nécessaire.",
+  "com_ui_agent_handoff_info_2": "Chaque transfert crée un outil de routage permettant une redirection fluide vers des agents spécialisés avec le contexte approprié.",
+  "com_ui_agent_handoff_max": "Nombre maximum de {{0}} agents de transfert atteint.",
+  "com_ui_agent_handoff_prompt": "Contenu transmis",
+  "com_ui_agent_handoff_prompt_key": "Nom du paramètre de contenu (par défaut : 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Nommez le contenu transmis (par défaut : 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Indiquez à cet agent quel contenu générer et transmettre à l'agent de transfert. Vous devez ajouter quelque chose ici pour activer cette fonctionnalité",
+  "com_ui_agent_handoffs": "Transferts d'agent",
   "com_ui_agent_name_is_required": "Le nom de l'agent est obligatoire.",
   "com_ui_agent_recursion_limit": "Nombre maximal d'étapes de l'agent",
   "com_ui_agent_recursion_limit_info": "Limite le nombre d'étapes que l'agent peut exécuter avant de donner son résultat final. Par défaut, la limite est de 25 étapes. Une étape est soit une requête API soit une utilisation d'un outil. Par exemple, une utilisation simple d'un outil demande 3 étapes : requête initiale, utilisation de l'outil et envoi de la réponse.",
@@ -648,12 +701,22 @@
   "com_ui_agents": "Agents",
   "com_ui_agents_allow_create": "Autoriser la création d'Agents",
   "com_ui_agents_allow_share": "Autoriser le partage Agents",
+  "com_ui_agents_allow_share_public": "Autoriser le partage public d'agents",
   "com_ui_agents_allow_use": "Autoriser l'utilisation des Agents",
   "com_ui_all": "tout",
   "com_ui_all_proper": "Tout",
   "com_ui_analyzing": "Analyse en cours",
   "com_ui_analyzing_finished": "Analyse terminée",
   "com_ui_api_key": "Clé API",
+  "com_ui_api_key_create_error": "Échec de la création de la clé API",
+  "com_ui_api_key_created": "Clé API créée avec succès",
+  "com_ui_api_key_delete_error": "Échec de la suppression de la clé API",
+  "com_ui_api_key_deleted": "Clé API supprimée avec succès",
+  "com_ui_api_key_name": "Nom de la clé",
+  "com_ui_api_key_name_placeholder": "Ma clé API",
+  "com_ui_api_key_name_required": "Le nom de la clé API est requis",
+  "com_ui_api_key_warning": "Copiez votre clé API maintenant. Vous ne pourrez plus la voir ensuite !",
+  "com_ui_api_keys_load_error": "Échec du chargement des clés API",
   "com_ui_archive": "Archiver",
   "com_ui_archive_delete_error": "Suppression de la conversation archivée échouée",
   "com_ui_archive_error": "échec de l'archivage de la conversation",
@@ -671,8 +734,10 @@
   "com_ui_at_least_one_owner_required": "Au moins un propriétaire est requis.",
   "com_ui_attach_error": "Impossible de joindre le fichier. Créez ou sélectionnez une conversation, ou essayez d'actualiser la page.",
   "com_ui_attach_error_disabled": "Les téléchargements de fichiers sont désactivés pour cet endpoint",
+  "com_ui_attach_error_limit": "Limite de fichiers atteinte :",
   "com_ui_attach_error_openai": "Impossible de joindre les fichiers de l'Assistant à d'autres points d'accès",
   "com_ui_attach_error_size": "Limite de taille de fichier dépassée pour le point de terminaison :",
+  "com_ui_attach_error_total_size": "Taille totale des fichiers dépassée pour le endpoint :",
   "com_ui_attach_error_type": "Type de fichier non pris en charge pour ce point d'accès :",
   "com_ui_attach_remove": "Supprimer le fichier",
   "com_ui_attach_warn_endpoint": "Les fichiers non compatibles avec l'outil peuvent être ignorés",
@@ -683,6 +748,7 @@
   "com_ui_authentication": "Authentification",
   "com_ui_authentication_type": "Type d'authentification",
   "com_ui_auto": "Automatique",
+  "com_ui_available_options": "Options disponibles",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "Entra ID",
@@ -703,6 +769,7 @@
   "com_ui_bookmarks": "Signets",
   "com_ui_bookmarks_add": "Ajouter des signets",
   "com_ui_bookmarks_add_to_conversation": "Ajouter à la conversation en cours",
+  "com_ui_bookmarks_count_selected": "Signets, {{count}} sélectionnés",
   "com_ui_bookmarks_create_error": "Une erreur est survenue lors de la création du signet",
   "com_ui_bookmarks_create_exists": "Ce signet existe déjà",
   "com_ui_bookmarks_create_success": "Signet créé avec succès",
@@ -717,6 +784,10 @@
   "com_ui_bookmarks_title": "Titre",
   "com_ui_bookmarks_update_error": "Une erreur est survenue lors de la mise à jour du signet",
   "com_ui_bookmarks_update_success": "Signet mis à jour avec succès",
+  "com_ui_branch_created": "Branche créée avec succès",
+  "com_ui_branch_error": "Échec de la création de la branche",
+  "com_ui_branch_message": "Créer une branche à partir de cette réponse",
+  "com_ui_by_author": "par {{0}}",
   "com_ui_callback_url": "Adresse URL de callback",
   "com_ui_cancel": "Annuler",
   "com_ui_cancelled": "Annulé",
@@ -724,50 +795,82 @@
   "com_ui_change_version": "Changer la version",
   "com_ui_chat": "Discussion",
   "com_ui_chat_history": "Historique des discussions",
+  "com_ui_chats": "Conversations",
+  "com_ui_check_internet": "Vérifiez votre connexion internet",
   "com_ui_clear": "Effacer",
   "com_ui_clear_all": "Tout effacer",
+  "com_ui_clear_browser_cache": "Videz le cache de votre navigateur",
+  "com_ui_clear_presets": "Effacer les préréglages",
+  "com_ui_clear_search": "Effacer la recherche",
   "com_ui_click_to_close": "Cliquer pour fermer",
+  "com_ui_click_to_edit": "Cliquez pour modifier",
+  "com_ui_click_to_view_var": "Cliquez pour afficher {{0}}",
   "com_ui_client_id": "Identifiant (ID) du client",
   "com_ui_client_secret": "Secret du client",
   "com_ui_close": "Fermer",
   "com_ui_close_menu": "Fermer le menu",
   "com_ui_close_settings": "Fermer les paramètres",
+  "com_ui_close_var": "Fermer {{0}}",
   "com_ui_close_window": "Fermer la fenêtre",
   "com_ui_code": "Code",
+  "com_ui_collapse": "Réduire",
   "com_ui_collapse_chat": "Réduire la discussion",
+  "com_ui_collapse_summary": "Réduire le résumé",
+  "com_ui_collapse_thoughts": "Réduire les pensées",
   "com_ui_command_placeholder": "Facultatif : Saisissez une commande pour l'invite ou le nom sera utilisé",
   "com_ui_command_usage_placeholder": "Sélectionnez un prompt par commande ou par nom",
   "com_ui_complete_setup": "Configuration complete",
   "com_ui_concise": "Concis",
+  "com_ui_configure": "Configurer",
   "com_ui_configure_mcp_variables_for": "Configurer les variables pour {{0}}",
   "com_ui_confirm": "Confirmer",
   "com_ui_confirm_action": "Confirmer l'action",
   "com_ui_confirm_admin_use_change": "La modification de ce paramètre bloquera l'accès aux administrateurs, y compris vous-même. Êtes-vous sûr de vouloir continuer ?",
   "com_ui_confirm_change": "Confirmer la modification",
   "com_ui_connecting": "Connexion en cours",
+  "com_ui_contact_admin_if_issue_persists": "Contactez l'administrateur si le problème persiste",
   "com_ui_context": "Contexte",
+  "com_ui_context_filter_sort": "Filtrer et trier par contexte",
   "com_ui_continue": "Continuer",
   "com_ui_continue_oauth": "Continuer avec OAuth",
+  "com_ui_control_bar": "Barre de contrôle",
+  "com_ui_conversation": "conversation",
+  "com_ui_conversation_label": "Conversation {{title}}",
+  "com_ui_conversation_not_found": "Conversation introuvable",
+  "com_ui_conversation_summarized": "Conversation résumée",
+  "com_ui_conversations": "conversations",
+  "com_ui_convo_archived": "Conversation archivée",
   "com_ui_convo_delete_error": "Suppression de conversation échouée",
   "com_ui_convo_delete_success": "Conversation supprimée avec succès",
   "com_ui_copied": "Copié !",
   "com_ui_copied_to_clipboard": "Copié dans le presse-papier",
+  "com_ui_copy": "Copier",
   "com_ui_copy_code": "Copier le code",
+  "com_ui_copy_failed": "Échec de la copie dans le presse-papiers",
   "com_ui_copy_link": "Copier le lien",
   "com_ui_copy_stack_trace": "Copier la stack trace",
+  "com_ui_copy_summary": "Copier le résumé dans le presse-papiers",
   "com_ui_copy_thoughts_to_clipboard": "Copier les pensées dans le presse-papiers",
   "com_ui_copy_to_clipboard": "Copier dans le presse-papier",
   "com_ui_copy_url_to_clipboard": "Copier l'URL dans le presse-papiers",
   "com_ui_create": "Créer",
+  "com_ui_create_api_key": "Créer une clé API",
+  "com_ui_create_assistant": "Créer un assistant",
   "com_ui_create_link": "Créer un lien",
+  "com_ui_create_mcp_server": "Créer un serveur MCP",
   "com_ui_create_memory": "Créer une Mémoire",
+  "com_ui_create_new_agent": "Créer un nouvel agent",
   "com_ui_create_prompt": "Créer un prompt",
+  "com_ui_create_prompt_page": "Page de configuration d'un nouveau prompt",
+  "com_ui_created": "Créé",
+  "com_ui_creating": "Création...",
   "com_ui_creating_image": "Création de l'image en cours. Cela peut prendre un moment",
   "com_ui_current": "Actuel",
   "com_ui_currently_production": "En cours de production",
   "com_ui_custom": "Personnalisé",
   "com_ui_custom_header_name": "Nom d'en-tête personnalisé",
   "com_ui_custom_prompt_mode": "Mode de prompt personnalisé",
+  "com_ui_dark_theme_enabled": "Thème sombre activé",
   "com_ui_date": "Date",
   "com_ui_date_april": "Avril",
   "com_ui_date_august": "Août",
@@ -783,6 +886,7 @@
   "com_ui_date_previous_30_days": "30 derniers jours",
   "com_ui_date_previous_7_days": "7 derniers jours",
   "com_ui_date_september": "Septembre",
+  "com_ui_date_sort": "Trier par date",
   "com_ui_date_today": "Aujourd'hui",
   "com_ui_date_yesterday": "Hier",
   "com_ui_decline": "Je n'accepte pas",
@@ -790,27 +894,38 @@
   "com_ui_delete": "Supprimer",
   "com_ui_delete_action": "Supprimer l'action",
   "com_ui_delete_action_confirm": "Êtes-vous sûr de vouloir supprimer cette action ?",
+  "com_ui_delete_agent": "Supprimer l'agent",
   "com_ui_delete_agent_confirm": "Êtes-vous sûr de vouloir supprimer cet agent ?",
+  "com_ui_delete_assistant": "Supprimer l'assistant",
   "com_ui_delete_assistant_confirm": "Êtes-vous sûr de vouloir supprimer cet Assistant ? Cette action est irréversible.",
   "com_ui_delete_confirm": "Cela supprimera",
   "com_ui_delete_confirm_prompt_version_var": "Cela supprimera la version sélectionnée pour \"{{0}}.\" S'il n'existe aucune autre version, le prompt sera supprimé.",
+  "com_ui_delete_confirm_strong": "Cela supprimera <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "Supprimer la discussion?",
+  "com_ui_delete_conversation_tooltip": "Supprimer la conversation",
+  "com_ui_delete_mcp_server": "Supprimer le serveur MCP ?",
+  "com_ui_delete_mcp_server_name": "Supprimer le serveur MCP {{0}}",
   "com_ui_delete_memory": "Supprimer les données mémorisées ",
   "com_ui_delete_not_allowed": "La suppression n'est pas permise",
+  "com_ui_delete_preset": "Supprimer le préréglage ?",
   "com_ui_delete_prompt": "Supprimer le Prompt?",
   "com_ui_delete_shared_link": "Supprimer le lien partagé ?",
+  "com_ui_delete_shared_link_heading": "Supprimer le lien partagé",
   "com_ui_delete_success": "Supprimé avec succès",
   "com_ui_delete_tool": "Supprimer l'outil",
   "com_ui_delete_tool_confirm": "Êtes-vous sûr de vouloir supprimer cet outil ?",
   "com_ui_delete_tool_save_reminder": "Outil supprimé. Sauvegardez l'agent pour appliquer les modifications.",
   "com_ui_deleted": "Supprimé",
+  "com_ui_deleting": "Suppression...",
   "com_ui_deleting_file": "Suppression du fichier en cours...",
+  "com_ui_deploy": "Déployer",
   "com_ui_descending": "Décroissant",
   "com_ui_description": "Description",
   "com_ui_description_placeholder": "Optionnel : Entrez une description à afficher dans le prompt",
   "com_ui_deselect_all": "Tout désélectionner ",
   "com_ui_detailed": "Détaillée",
   "com_ui_disabling": "Désactivation en cours...",
+  "com_ui_done": "Terminé",
   "com_ui_download": "Télécharger",
   "com_ui_download_artifact": "Télécharger Artifact",
   "com_ui_download_backup": "Télécharger les codes de sauvegarde",
@@ -820,13 +935,17 @@
   "com_ui_drag_drop": "Déposer des fichiers ici afin de les ajouter à la conversation",
   "com_ui_dropdown_variables": "Variables déroulantes :",
   "com_ui_duplicate": "Dupliquer",
+  "com_ui_duplicate_agent": "Dupliquer l'agent",
   "com_ui_duplication_error": "Une erreur s'est produite lors de la duplication de la conversation",
   "com_ui_duplication_processing": "Duplication de la conversation en cours...",
   "com_ui_duplication_success": "Conversation dupliquée avec succès",
   "com_ui_edit": "Modifier",
   "com_ui_edit_editing_image": "Edition de l'image",
   "com_ui_edit_mcp_server": "Editer le serveur MCP",
+  "com_ui_edit_mcp_server_dialog_description": "Identifiant unique du serveur : {{serverName}}",
   "com_ui_edit_memory": "Editer la Mémoire",
+  "com_ui_edit_preset_title": "Modifier le préréglage - {{title}}",
+  "com_ui_edit_prompt_page": "Modifier la page du prompt",
   "com_ui_editable_message": "Message modifiable",
   "com_ui_editor_instructions": "Faites glisser l'image pour la repositionner • Utilisez le curseur de zoom ou les boutons pour ajuster la taille",
   "com_ui_empty_category": "-",
@@ -834,16 +953,23 @@
   "com_ui_endpoint_menu": "Menu des points de terminaison LLM",
   "com_ui_enter": "Entrer",
   "com_ui_enter_api_key": "Saisir la clé API",
+  "com_ui_enter_description": "Entrez une description (facultatif)",
   "com_ui_enter_key": "Entrez la clé",
+  "com_ui_enter_name": "Entrez un nom",
   "com_ui_enter_openapi_schema": "Saisissez votre schéma OpenAPI ici",
   "com_ui_enter_value": "Entrez la valeur",
   "com_ui_error": "Erreur",
   "com_ui_error_connection": "Erreur de connexion au serveur, essayez de rafraîchir la page.",
+  "com_ui_error_message_prefix": "Message d'erreur :",
   "com_ui_error_save_admin_settings": "Une erreur est survenue lors de la sauvegarde de vos paramètres administratifs.",
+  "com_ui_error_try_following_prefix": "Veuillez essayer l'une des solutions suivantes",
+  "com_ui_error_unexpected": "Oups ! Une erreur inattendue s'est produite",
   "com_ui_error_updating_preferences": "Une erreur est survenue lors de l'édition des préférences",
   "com_ui_everyone_permission_level": "Niveau de permission de tout le monde",
   "com_ui_examples": "Exemples",
+  "com_ui_expand": "Développer",
   "com_ui_expand_chat": "Etendre le message",
+  "com_ui_expand_thoughts": "Développer les pensées",
   "com_ui_export_convo_modal": "Exporter la conversation",
   "com_ui_feedback_more": "Plus...",
   "com_ui_feedback_more_information": "Envoyer des retours supplémentaires",
@@ -865,8 +991,12 @@
   "com_ui_feedback_tag_unjustified_refusal": "A refusé sans raison",
   "com_ui_field_max_length": "{{field}} doit contenir moins de {{length}} caractères",
   "com_ui_field_required": "Ce champ est obligatoire",
+  "com_ui_file_input_avatar_label": "Champ de fichier pour l'avatar",
   "com_ui_file_size": "Taille du fichier",
+  "com_ui_file_token_limit": "Limite de jetons par fichier",
+  "com_ui_file_token_limit_desc": "Définir la limite maximale de jetons pour le traitement des fichiers afin de contrôler les coûts et l'utilisation des ressources",
   "com_ui_files": "Fichiers",
+  "com_ui_filter_mcp_servers": "Filtrer les serveurs MCP par nom",
   "com_ui_filter_prompts": "Filtrer les messages",
   "com_ui_filter_prompts_name": "Filtrer les prompts par nom",
   "com_ui_final_touch": "Touche finale",
@@ -890,6 +1020,7 @@
   "com_ui_fork_info_visible": "Cette option permet de diviser uniquement les messages visibles ; en d'autres termes, le chemin direct vers le message cible, sans aucune branche.",
   "com_ui_fork_more_details_about": "Voir plus d'informations sur l'option de fouche \"{{0}}",
   "com_ui_fork_more_info_options": "Voir des explications détaillées sur toutes les options de fourches et leurs effets",
+  "com_ui_fork_open_menu": "Ouvrir le menu de fork",
   "com_ui_fork_processing": "Bifurquer la conversation...",
   "com_ui_fork_remember": "Se souvenir",
   "com_ui_fork_remember_checked": "Votre sélection sera mémorisée après utilisation. Vous pouvez la modifier à tout moment dans les paramètres.",
@@ -907,9 +1038,12 @@
   "com_ui_good_evening": "Bonsoir",
   "com_ui_good_morning": "Bonjour",
   "com_ui_group": "Groupe",
+  "com_ui_handoff_instructions": "Instructions de transfert",
   "com_ui_happy_birthday": "C'est mon premier anniversaire !",
+  "com_ui_header_format": "Format d'en-tête",
+  "com_ui_hide": "Masquer",
+  "com_ui_hide_code": "Masquer le code",
   "com_ui_hide_image_details": "Cacher les informations de l'images",
-  "com_ui_hide_password": "Cacher le mot de passe",
   "com_ui_hide_qr": "Cacher le QR code",
   "com_ui_high": "Elevé",
   "com_ui_host": "Hôte",
@@ -925,34 +1059,81 @@
   "com_ui_import_conversation_info": "Importer des conversations à partir d'un fichier JSON",
   "com_ui_import_conversation_success": "Conversations importées avec succès",
   "com_ui_import_conversation_upload_error": "Erreur lors du téléchargement du fichier. Veuillez réessayer.",
+  "com_ui_importing": "Importation",
   "com_ui_include_shadcnui": "Inclure les instructions des composants shadcn/ui",
   "com_ui_initializing": "Initialisation...",
   "com_ui_input": "Entrée",
   "com_ui_instructions": "Instructions",
   "com_ui_key": "Clé",
   "com_ui_key_required": "Une clé API est requise",
+  "com_ui_labels": "Étiquettes",
   "com_ui_late_night": "Bonne fin de nuit",
+  "com_ui_latest": "dernière",
   "com_ui_latest_footer": "Chaque IA pour tout le monde.",
   "com_ui_latest_version": "Dernière version",
+  "com_ui_leave_blank_to_keep": "Laissez vide pour conserver l'existant",
+  "com_ui_light_theme_enabled": "Thème clair activé",
+  "com_ui_link_copied": "Lien copié",
+  "com_ui_link_refreshed": "Lien actualisé",
+  "com_ui_live": "live",
   "com_ui_loading": "Chargement en cours...",
   "com_ui_locked": "Verrouillé",
   "com_ui_logo": "Logo {{0}}",
   "com_ui_low": "Faible",
+  "com_ui_make_production": "Mettre en production",
   "com_ui_manage": "Gérer",
   "com_ui_marketplace": "Marketplace",
   "com_ui_marketplace_allow_use": "Autoriser l'utilisation de la Marketplace",
+  "com_ui_max": "Max",
+  "com_ui_max_favorites_reached": "Nombre maximum d'éléments épinglés atteint ({{0}}). Détachez un élément pour en ajouter d'autres.",
   "com_ui_max_file_size": "PNG, JPG ou JPEG (max {{0}})",
   "com_ui_max_tags": "Le nombre maximum autorisé est {{0}}, en utilisant les dernières valeurs.",
   "com_ui_mcp_authenticated_success": "Serveur MCP '{{0}}' authentifié avec succès",
+  "com_ui_mcp_click_to_defer": "Cliquez pour différer - l'outil sera découvrable via la recherche mais ne sera chargé qu'en cas de besoin",
+  "com_ui_mcp_click_to_programmatic": "Activer l'appel programmatique - l'outil ne peut être invoqué que via l'exécution de code",
   "com_ui_mcp_configure_server": "Configurer {{0}}",
   "com_ui_mcp_configure_server_description": "Configurer des variables personnalisées pour {{0}}",
+  "com_ui_mcp_defer": "Différer",
+  "com_ui_mcp_defer_all": "Différer tous les outils",
+  "com_ui_mcp_defer_loading": "Différer le chargement",
+  "com_ui_mcp_dialog_title": "Configurer les variables pour {{serverName}}. Statut du serveur : {{status}}",
+  "com_ui_mcp_domain_not_allowed": "Le domaine du serveur MCP ne figure pas dans la liste des domaines autorisés. Veuillez contacter votre administrateur.",
   "com_ui_mcp_enter_var": "Saisissez la valeur de {{0}}",
   "com_ui_mcp_init_failed": "Échec de l'initialisation du serveur MCP",
   "com_ui_mcp_initialize": "Initialiser",
   "com_ui_mcp_initialized_success": "Serveur MCP '{{0}}' initialisé avec succès",
+  "com_ui_mcp_invalid_url": "Veuillez entrer une URL valide",
+  "com_ui_mcp_no_description": "Aucune description disponible",
   "com_ui_mcp_oauth_cancelled": "Authentification OAuth annulée pour {{0}}",
   "com_ui_mcp_oauth_timeout": "Délai d'authentification OAuth dépassé pour {{0}}",
+  "com_ui_mcp_programmatic": "Programmatique",
+  "com_ui_mcp_programmatic_all": "Marquer tous comme programmatiques",
+  "com_ui_mcp_server": "Serveur MCP",
+  "com_ui_mcp_server_connection_failed": "La connexion au serveur MCP fourni a échoué. Vérifiez que l'URL, le type de serveur et la configuration d'authentification sont corrects, puis réessayez. Assurez-vous également que l'URL est accessible.",
+  "com_ui_mcp_server_created": "Serveur MCP créé avec succès",
+  "com_ui_mcp_server_delete_confirm": "Êtes-vous sûr de vouloir supprimer ce serveur MCP ?",
+  "com_ui_mcp_server_deleted": "Serveur MCP supprimé avec succès",
+  "com_ui_mcp_server_role_editor": "Éditeur de serveur MCP",
+  "com_ui_mcp_server_role_editor_desc": "Peut afficher, utiliser et modifier les serveurs MCP",
+  "com_ui_mcp_server_role_owner": "Propriétaire de serveur MCP",
+  "com_ui_mcp_server_role_owner_desc": "Contrôle total sur les serveurs MCP",
+  "com_ui_mcp_server_role_viewer": "Observateur de serveur MCP",
+  "com_ui_mcp_server_role_viewer_desc": "Peut afficher et utiliser les serveurs MCP",
+  "com_ui_mcp_server_updated": "Serveur MCP mis à jour avec succès",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
   "com_ui_mcp_servers": "Serveurs MCP",
+  "com_ui_mcp_servers_allow_create": "Autoriser les utilisateurs à créer des serveurs MCP",
+  "com_ui_mcp_servers_allow_share": "Autoriser les utilisateurs à partager des serveurs MCP",
+  "com_ui_mcp_servers_allow_share_public": "Autoriser les utilisateurs à partager publiquement des serveurs MCP",
+  "com_ui_mcp_servers_allow_use": "Autoriser les utilisateurs à utiliser des serveurs MCP",
+  "com_ui_mcp_title_invalid": "Le titre ne peut contenir que des lettres, des chiffres et des espaces",
+  "com_ui_mcp_tool_options": "Options des outils",
+  "com_ui_mcp_transport": "Transport",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "HTTPS Streamable",
+  "com_ui_mcp_undefer": "Activer",
+  "com_ui_mcp_undefer_all": "Activer tous les outils",
+  "com_ui_mcp_unprogrammatic_all": "Retirer le marquage programmatique de tous",
   "com_ui_mcp_update_var": "Modifier {{0}}",
   "com_ui_mcp_url": "Adresse URL du serveur MCP",
   "com_ui_medium": "Modéré",
@@ -970,32 +1151,49 @@
   "com_ui_memory_deleted_items": "Mémoires supprimées",
   "com_ui_memory_error": "Erreur de mémoire",
   "com_ui_memory_key_exists": "Une Mémoire existe déjà avec cette clé. Veuillez utiliser une autre clé.",
+  "com_ui_memory_key_hint": "Utilisez uniquement des lettres minuscules et des underscores",
   "com_ui_memory_key_validation": "La clé mémoire ne doit comporter que des lettres minuscules et des underscores.",
   "com_ui_memory_storage_full": "Stockage memory plein",
   "com_ui_memory_updated": "Actualiser la Mémoire",
   "com_ui_memory_updated_items": "Souvenirs enregistrés",
   "com_ui_memory_would_exceed": "Enregistrement impossible - excédent de {{tokens}} jetons. Effacez des mémoires existantes pour libérer de la place.",
   "com_ui_mention": "Mentionnez un point de terminaison, un assistant ou un préréglage pour basculer rapidement vers celui-ci",
+  "com_ui_mermaid": "mermaid",
+  "com_ui_mermaid_failed": "Échec du rendu du diagramme :",
+  "com_ui_mermaid_source": "Code source :",
+  "com_ui_message_input": "Saisie du message",
+  "com_ui_microphone_unavailable": "Le microphone n'est pas disponible",
   "com_ui_min_tags": "Impossible de supprimer plus de valeurs, un minimum de {{0}} est requis.",
   "com_ui_minimal": "Minimal",
   "com_ui_misc": "Divers",
   "com_ui_model": "Modèle",
   "com_ui_model_parameters": "Paramètres du modèle",
+  "com_ui_model_parameters_reset": "Les paramètres du modèle ont été réinitialisés.",
+  "com_ui_model_selected": "{{0}} sélectionné",
   "com_ui_more_info": "Plus d'informations",
   "com_ui_my_prompts": "Mes Prompts",
   "com_ui_name": "Nom",
+  "com_ui_name_sort": "Trier par nom",
   "com_ui_new": "Nouveau",
   "com_ui_new_chat": "Nouvelle conversation",
   "com_ui_new_conversation_title": "Nouveau titre de conversation",
   "com_ui_next": "Suivant",
   "com_ui_no": "Non",
+  "com_ui_no_auth": "Aucune (Détection automatique)",
   "com_ui_no_bookmarks": "Il semble que vous n'ayez pas encore de favoris. Cliquez sur une discussion pour en ajouter un",
+  "com_ui_no_bookmarks_match": "Aucun signet ne correspond à votre recherche",
+  "com_ui_no_bookmarks_title": "Aucun signet pour le moment",
   "com_ui_no_categories": "Aucune catégorie disponible",
   "com_ui_no_category": "Aucune catégorie",
   "com_ui_no_changes": "Aucune modification n'a été réalisée",
   "com_ui_no_individual_access": "Aucun utilisateur ou groupe n'a accès à cet agent",
+  "com_ui_no_labels": "Aucune étiquette",
+  "com_ui_no_mcp_servers": "Aucun serveur MCP pour le moment",
+  "com_ui_no_mcp_servers_match": "Aucun serveur MCP ne correspond à votre filtre",
   "com_ui_no_memories": "Aucune mémoire. Créez-les manuellement ou incitez l'IA de se mémoriser quelque chose",
-  "com_ui_no_personalization_available": "Aucune personnalisation disponible",
+  "com_ui_no_memories_match": "Aucun souvenir ne correspond à votre recherche",
+  "com_ui_no_memories_title": "Aucun souvenir pour le moment",
+  "com_ui_no_prompts_title": "Aucun prompt pour le moment",
   "com_ui_no_read_access": "Vous n'avez pas l'autorisation de voir les données mémorisées.",
   "com_ui_no_results_found": "Aucun résultat trouvé",
   "com_ui_no_terms_content": "Aucun contenu de conditions d'utilisation à afficher",
@@ -1014,37 +1212,59 @@
   "com_ui_oauth_success_title": "Authentification réussie",
   "com_ui_of": "des",
   "com_ui_off": "Désactivé",
+  "com_ui_offline": "Hors ligne",
   "com_ui_on": "Activé",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (ouvrir dans un nouvel onglet)",
+  "com_ui_open_source_chat_new_tab": "Ouvrir la conversation source dans un nouvel onglet",
+  "com_ui_open_source_chat_new_tab_title": "Ouvrir la conversation source dans un nouvel onglet - {{title}}",
+  "com_ui_open_var": "Ouvrir {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "(optionnel)",
+  "com_ui_options": "options",
   "com_ui_page": "Page",
+  "com_ui_pagination": "Pagination",
   "com_ui_people": "utilisateur",
   "com_ui_people_picker": "Sélecteur d'utilisateurs",
   "com_ui_people_picker_allow_view_groups": "Autoriser la visualisation des groupes",
   "com_ui_people_picker_allow_view_roles": "Autoriser la visualisation des rôles",
   "com_ui_people_picker_allow_view_users": "Autoriser la visualisation des utilisateurs",
+  "com_ui_permissions_failed_load": "Échec du chargement des permissions. Veuillez réessayer.",
   "com_ui_permissions_failed_update": "Échec du chargement des permissions. Veuillez réessayer.",
   "com_ui_permissions_updated_success": "Permissions mises à jour avec succès",
+  "com_ui_pin": "Épingler",
   "com_ui_preferences_updated": "Préférences enregistrées avec succès",
   "com_ui_prev": "Précédent",
   "com_ui_preview": "Aperçu",
   "com_ui_privacy_policy": "Politique de confidentialité",
   "com_ui_privacy_policy_url": "URL de la politique de confidentialité",
+  "com_ui_production": "Production",
   "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Sélecteur de catégorie du prompt",
+  "com_ui_prompt_delete_confirm": "Êtes-vous sûr de vouloir supprimer le prompt « {{0}} » ?",
+  "com_ui_prompt_deleted_group": "Groupe de prompts « {{0}} » supprimé",
+  "com_ui_prompt_details": "Détails du prompt {{name}}",
+  "com_ui_prompt_group_button": "Prompt {{name}}, catégorie {{category}}",
+  "com_ui_prompt_group_button_no_category": "Prompt {{name}}",
   "com_ui_prompt_groups": "Liste des groupes de prompts",
+  "com_ui_prompt_input": "Saisie du prompt",
+  "com_ui_prompt_input_field": "Champ de saisie du texte du prompt",
   "com_ui_prompt_name": "Nom du Prompt",
   "com_ui_prompt_name_required": "Un nom pour le Prompt est requis",
   "com_ui_prompt_preview_not_shared": "L'auteur n'a pas autorisé la collaboration pour ce prompt.",
   "com_ui_prompt_text": "Texte",
   "com_ui_prompt_text_required": "Un texte est requis",
   "com_ui_prompt_update_error": "Une erreur s'est produite lors de la mise à jour du prompt",
+  "com_ui_prompt_variables_list": "Liste des variables du prompt",
   "com_ui_prompts": "Prompts",
   "com_ui_prompts_allow_create": "Autoriser la création de Prompts",
   "com_ui_prompts_allow_share": "Autoriser le partage de prompts",
+  "com_ui_prompts_allow_share_public": "Autoriser le partage public de prompts",
   "com_ui_prompts_allow_use": "Autoriser l'utilisation de Prompts",
   "com_ui_provider": "Fournisseur",
   "com_ui_quality": "Qualité",
   "com_ui_read_aloud": "Lire à haute voix",
+  "com_ui_redirect_uri": "URI de redirection",
+  "com_ui_redirect_uri_instructions": "Copiez cette URI de redirection et configurez-la dans les paramètres de votre fournisseur OAuth.",
   "com_ui_redirecting_to_provider": "Redirection en cours vers {{0}}, veuillez patienter...",
   "com_ui_reference_saved_memories": "Indexer les Souvenirs enregistrés",
   "com_ui_reference_saved_memories_description": "Autoriser l'assistant à accéder aux index des données mémorisées enregistrées et à les utiliser pour répondre",
@@ -1056,6 +1276,18 @@
   "com_ui_regenerating": "Régénération en cours...",
   "com_ui_region": "Région",
   "com_ui_reinitialize": "Réinitialiser",
+  "com_ui_remote_access": "Accès distant",
+  "com_ui_remote_agent_role_editor": "Éditeur",
+  "com_ui_remote_agent_role_editor_desc": "Peut afficher et modifier l'agent via l'API",
+  "com_ui_remote_agent_role_owner": "Propriétaire API",
+  "com_ui_remote_agent_role_owner_desc": "Accès API complet et peut accorder l'accès distant à d'autres utilisateurs",
+  "com_ui_remote_agent_role_viewer": "Observateur API",
+  "com_ui_remote_agent_role_viewer_desc": "Peut interroger l'agent via l'API",
+  "com_ui_remote_agents": "Agents distants (API)",
+  "com_ui_remote_agents_allow_create": "Autoriser les utilisateurs à créer des agents via l'API",
+  "com_ui_remote_agents_allow_share": "Autoriser les utilisateurs à accorder l'accès API aux agents à d'autres utilisateurs",
+  "com_ui_remote_agents_allow_share_public": "Autoriser les utilisateurs à accorder l'accès API aux agents à tous les utilisateurs",
+  "com_ui_remote_agents_allow_use": "Autoriser les utilisateurs à créer des clés API et à interroger les agents à distance",
   "com_ui_remove_agent_from_chain": "Retirer {{0}} de la chaîne",
   "com_ui_remove_user": "Retirer {{0}}",
   "com_ui_rename": "Renommer",
@@ -1069,10 +1301,15 @@
   "com_ui_resource": "Ressource",
   "com_ui_response": "Réponse",
   "com_ui_result": "Résultat",
+  "com_ui_result_found": "{{count}} résultat trouvé",
+  "com_ui_results_found": "{{count}} résultats trouvés",
+  "com_ui_retry": "Réessayer",
   "com_ui_revoke": "Révoquer",
   "com_ui_revoke_info": "Révoquer toutes les informations d'identification fournies par l'utilisateur",
   "com_ui_revoke_key_confirm": "Êtes-vous sûr de vouloir révoquer cette clé ?",
   "com_ui_revoke_key_endpoint": "Révoquer la clé pour {{0}}",
+  "com_ui_revoke_key_error": "Échec de la révocation de la clé API. Veuillez réessayer.",
+  "com_ui_revoke_key_success": "Clé API révoquée avec succès",
   "com_ui_revoke_keys": "Révoquer les clés",
   "com_ui_revoke_keys_confirm": "Êtes-vous sûr de vouloir révoquer toutes les clés ?",
   "com_ui_role": "Rôle",
@@ -1107,9 +1344,12 @@
   "com_ui_search_agent_category": "Recherche de catégories...",
   "com_ui_search_default_placeholder": "Rechercher par nom ou email (min 2 caractères)",
   "com_ui_search_people_placeholder": "Rechercher des utilisateurs ou des groupes par nom ou email",
+  "com_ui_search_result_count": "{{count}} résultat trouvé",
+  "com_ui_search_results_count": "{{count}} résultats trouvés",
   "com_ui_seconds": "secondes",
   "com_ui_secret_key": "Clé secrète",
   "com_ui_select": "Sélectionner",
+  "com_ui_select_agent": "Sélectionner un agent",
   "com_ui_select_all": "Tout sélectionner",
   "com_ui_select_file": "Sélectionner un fichier",
   "com_ui_select_model": "Sélectionner un modèle",
@@ -1118,6 +1358,7 @@
   "com_ui_select_provider": "Sélectionner un fournisseur",
   "com_ui_select_provider_first": "Sélectionnez d'abord un fournisseur",
   "com_ui_select_region": "Sélectionner une région",
+  "com_ui_select_row": "Sélectionner la ligne",
   "com_ui_select_search_model": "Rechercher un modèle par nom",
   "com_ui_select_search_provider": "Rechercher un fournisseur par nom",
   "com_ui_select_search_region": "Rechercher une région par nom",
@@ -1136,22 +1377,36 @@
   "com_ui_shared_link_not_found": "Lien partagé introuvable",
   "com_ui_shared_prompts": "Prompts partagés",
   "com_ui_shop": "Faire des achats",
+  "com_ui_show": "Afficher",
   "com_ui_show_all": "Tout afficher",
+  "com_ui_show_code": "Afficher le code",
   "com_ui_show_image_details": "Montrer les informations de l'image",
-  "com_ui_show_password": "Afficher le mot de passe",
   "com_ui_show_qr": "Afficher le QR code",
   "com_ui_sign_in_to_domain": "S'identifier à {{0}}",
-  "com_ui_simple": "Simple",
   "com_ui_size": "Taille",
+  "com_ui_size_sort": "Trier par taille",
+  "com_ui_special": "spécial",
   "com_ui_special_var_current_date": "Date actuelle",
   "com_ui_special_var_current_datetime": "Date et heure actuelle",
   "com_ui_special_var_current_user": "Utilisateur actuel",
+  "com_ui_special_var_desc_current_date": "Date du jour et jour de la semaine",
+  "com_ui_special_var_desc_current_datetime": "Date et heure locales dans votre fuseau horaire",
+  "com_ui_special_var_desc_current_user": "Votre nom d'affichage de compte",
+  "com_ui_special_var_desc_iso_datetime": "Date et heure UTC au format ISO 8601",
   "com_ui_special_var_iso_datetime": "Date et heure ISO UTC",
-  "com_ui_special_variables": "Variables spéciales : Utilisez {{current_date}} pour la date actuelle, et {{current_user}} pour le nom de votre compte donné.",
+  "com_ui_special_variable_added": "Variable spéciale {{0}} ajoutée.",
+  "com_ui_special_variables": "Variables spéciales",
+  "com_ui_speech_not_supported": "Votre navigateur ne prend pas en charge la reconnaissance vocale",
+  "com_ui_speech_not_supported_use_external": "Votre navigateur ne prend pas en charge la reconnaissance vocale. Essayez de passer au STT externe dans Paramètres > Parole.",
   "com_ui_speech_while_submitting": "Impossible de soumettre un message vocal pendant la génération d'une réponse",
+  "com_ui_sr_global_prompt": "Groupe de prompts global",
+  "com_ui_stack_trace": "Stack Trace",
+  "com_ui_status_prefix": "Statut :",
   "com_ui_stop": "Arrêt ",
   "com_ui_storage": "Stockage",
+  "com_ui_storage_filter_sort": "Filtrer et trier par stockage",
   "com_ui_submit": "Soumettre",
+  "com_ui_summarizing": "Résumé en cours...",
   "com_ui_support_contact": "Contact d'assistance",
   "com_ui_support_contact_email": "Email",
   "com_ui_support_contact_email_invalid": "Veuillez entrer un email valide",
@@ -1163,40 +1418,52 @@
   "com_ui_temporary": "Message éphémère",
   "com_ui_terms_and_conditions": "Conditions d'utilisation",
   "com_ui_terms_of_service": "Conditions d'utilisation",
+  "com_ui_text_variables": "Variables texte",
   "com_ui_thinking": "Réflexion en cours...",
   "com_ui_thoughts": "Pensées",
+  "com_ui_toggle_theme": "Changer de thème",
   "com_ui_token": "jeton",
   "com_ui_token_exchange_method": "Méthode d'échange de jetons",
   "com_ui_token_url": "Adresse URL du jeton",
   "com_ui_tokens": "jetons",
   "com_ui_tool_collection_prefix": "Une collection d'outils de",
+  "com_ui_tool_list_collapse": "Réduire la liste d'outils de {{serverName}}",
+  "com_ui_tool_list_expand": "Développer la liste d'outils de {{serverName}}",
   "com_ui_tools": "Outils",
+  "com_ui_tools_and_actions": "Outils et actions",
   "com_ui_transferred_to": "Transféré à",
   "com_ui_travel": "Voyage",
   "com_ui_trust_app": "J'ai confiance en cette application",
   "com_ui_try_adjusting_search": "Essayez d'ajuster vos termes de recherche",
+  "com_ui_ui_resource_error": "Erreur de ressource d'interface ({{0}})",
+  "com_ui_ui_resource_not_found": "Ressource d'interface introuvable (index : {{0}})",
   "com_ui_unarchive": "Désarchiver",
+  "com_ui_unarchive_conversation": "Désarchiver la conversation",
   "com_ui_unarchive_error": "Échec du désarchivage de la conversation",
   "com_ui_unavailable": "Indisponible",
   "com_ui_unknown": "Inconnu",
+  "com_ui_unpin": "Détacher",
   "com_ui_unset": "Non défini",
   "com_ui_untitled": "Sans titre",
   "com_ui_update": "Mettre à jour",
-  "com_ui_upload": "Télécharger",
+  "com_ui_update_mcp_server": "Mettre à jour le serveur MCP",
+  "com_ui_updating": "Mise à jour...",
+  "com_ui_upload": "Téléverser",
   "com_ui_upload_agent_avatar": "Avatar de l'agent mis à jour avec succès",
-  "com_ui_upload_agent_avatar_label": "Télécharger l'image d'avatar de l'agent",
-  "com_ui_upload_avatar_label": "Télécharger l'image d'avatar",
+  "com_ui_upload_agent_avatar_label": "Téléverser l'image d'avatar de l'agent",
+  "com_ui_upload_avatar_label": "Téléverser l'image d'avatar",
   "com_ui_upload_delay": "Le téléversement de \"{{0}}\" prend plus de temps que prévu. Veuillez patienter pendant que le fichier termine son indexation pour la récupération.",
   "com_ui_upload_error": "Une erreur s'est produite lors du téléversement de votre fichier",
-  "com_ui_upload_file_context": "Télécharger le contexte du fichier",
-  "com_ui_upload_file_search": "Télécharger pour la recherche dans un fichier",
-  "com_ui_upload_files": "Télécharger des fichiers",
-  "com_ui_upload_image": "Télécharger une image",
+  "com_ui_upload_file_context": "Téléverser le contexte du fichier",
+  "com_ui_upload_file_search": "Téléverser pour la recherche dans un fichier",
+  "com_ui_upload_files": "Téléverser des fichiers",
+  "com_ui_upload_icon": "Téléverser une image d'icône",
+  "com_ui_upload_image": "Téléverser une image",
   "com_ui_upload_image_input": "Téléverser une image",
   "com_ui_upload_invalid": "Fichier non valide pour le téléchargement. L'image ne doit pas dépasser la limite",
   "com_ui_upload_invalid_var": "Fichier non valide pour le téléchargement. L'image ne doit pas dépasser {{0}} Mo",
-  "com_ui_upload_ocr_text": "Télécharger en tant que texte",
-  "com_ui_upload_provider": "Télécharger vers le fournisseur",
+  "com_ui_upload_ocr_text": "Téléverser en tant que texte",
+  "com_ui_upload_provider": "Téléverser vers le fournisseur",
   "com_ui_upload_success": "Fichier téléversé avec succès",
   "com_ui_upload_type": "Sélectionner le type de téléversement",
   "com_ui_usage": "Utilisation",
@@ -1204,10 +1471,13 @@
   "com_ui_use_backup_code": "Utiliser un code de sauvegarde à la place",
   "com_ui_use_memory": "Utiliser le Souvenir",
   "com_ui_use_micrphone": "Utiliser le microphone",
+  "com_ui_use_prompt": "Utiliser le prompt",
   "com_ui_used": "Déjà utilisé",
   "com_ui_user": "Utilisateur",
   "com_ui_user_group_permissions": "Permissions utilisateur et groupe",
+  "com_ui_user_provides_key": "Chaque utilisateur fournit sa propre clé",
   "com_ui_value": "Valeur",
+  "com_ui_variable_with_options": "Variable {{name}} avec {{count}} options",
   "com_ui_variables": "Variables",
   "com_ui_verify": "Vérifier",
   "com_ui_version_var": "Version {{0}}",
@@ -1242,7 +1512,9 @@
   "com_ui_weekend_morning": "Joyeux week-end",
   "com_ui_write": "Ecriture",
   "com_ui_x_selected": "{{0}} sélectionné",
+  "com_ui_xhigh": "Très élevé",
   "com_ui_yes": "Oui",
+  "com_ui_your_api_key": "Votre clé API",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Zoomer",
   "com_ui_zoom_level": "Niveau de zoom",
diff --git a/client/src/locales/he/translation.json b/client/src/locales/he/translation.json
index 07ecdceee4f..8aa9ce8e34a 100644
--- a/client/src/locales/he/translation.json
+++ b/client/src/locales/he/translation.json
@@ -2,12 +2,18 @@
   "chat_direction_left_to_right": "משמאל לימין",
   "chat_direction_right_to_left": "מימין לשמאל",
   "com_a11y_ai_composing": "הבינה המלאכותית (AI) עדיין יוצרת",
+  "com_a11y_chats_date_section": "\"צ'אטים מ-{{date}}",
   "com_a11y_end": "הבינה המלאכותית (AI) סיימה להשיב.",
+  "com_a11y_selected": "נבחרו",
   "com_a11y_start": "הבינה המלאכותית (AI) מתחילה להשיב.",
+  "com_a11y_summarize_completed": "ההקשר סוכם בהצלחה",
+  "com_a11y_summarize_failed": "שגיאה בסיכום ההקשר, ממשיך עם ההקשר הקיים",
+  "com_a11y_summarize_started": "מסכם את ההקשר",
   "com_agents_agent_card_label": "{{name}} סוכן. {{description}}",
   "com_agents_all": "כל הסוכנים",
   "com_agents_all_category": "כל",
   "com_agents_all_description": "צפה בכל הסוכנים המשותפים מכל הקטגוריות",
+  "com_agents_avatar_upload_error": "העלאת האווטר של הסוכן נכשלה",
   "com_agents_category_aftersales": "אחרי המכירה",
   "com_agents_category_aftersales_description": "סוכנים המתמחים בתמיכה, תחזוקה ושירות לקוחות לאחר המכירה",
   "com_agents_category_empty": "לא נמצאו סוכנים בקטגוריה {{category}}",
@@ -31,6 +37,7 @@
   "com_agents_copy_link": "העתק קישור",
   "com_agents_create_error": "אירעה שגיאה ביצירת הסוכן שלך.",
   "com_agents_created_by": "מאת",
+  "com_agents_description_card": "תיאור: {{description}}",
   "com_agents_description_placeholder": "אופציונלי: תאר את הסוכן שלך כאן",
   "com_agents_empty_state_heading": "לא נמצאו סוכנים",
   "com_agents_enable_file_search": "אפשר חיפוש בקבצים",
@@ -83,13 +90,15 @@
   "com_agents_not_available": "הסוכן לא זמין",
   "com_agents_recommended": "הסוכנים המומלצים שלנו",
   "com_agents_results_for": "תוצאות עבור '{{query}}'",
+  "com_agents_run_code_files": "הקבצים למטה מיועדים לסביבת קוד בלבד:",
+  "com_agents_run_code_info": "כאשר מופעל, מאפשר לסוכן שלך להריץ קוד שנוצר בצורה מאובטחת, כולל עיבוד קבצים.",
   "com_agents_search_aria": "חפש סוכנים",
   "com_agents_search_empty_heading": "אין תוצאות לחיפוש",
   "com_agents_search_info": "כאשר מופעל, מאפשר לסוכן שלך לחפש באינטרנט מידע עדכני. דורש מפתח API תקף.",
   "com_agents_search_instructions": "הקלד כדי לחפש סוכנים לפי שם או תיאור",
   "com_agents_search_name": "חפש סוכן לפי שם",
   "com_agents_search_no_results": "לא נמצאו סוכנים עבור \"{{query}}\"",
-  "com_agents_search_placeholder": "מחפש סוכנים...",
+  "com_agents_search_placeholder": "חפש סוכנים...",
   "com_agents_see_more": "ראה יותר",
   "com_agents_start_chat": "התחל צ'אט",
   "com_agents_top_picks": "הבחירות המובילות",
@@ -117,7 +126,7 @@
   "com_assistants_delete_actions_error": "אירעה שגיאה במחיקת הפעולה.",
   "com_assistants_delete_actions_success": "הפעולה נמחקה בהצלחה מהסייען",
   "com_assistants_description_placeholder": "אופציונלי: תאר את הסייען שלך כאן",
-  "com_assistants_file_search": "חיפוש קבצים",
+  "com_assistants_file_search": "חיפוש בקבצים",
   "com_assistants_file_search_info": "חיפוש קבצים מאפשר לסייען לקבל ידע מהקבצים שאתה או המשתמשים שלך מעלים. לאחר העלאת קובץ, העוזר מחליט באופן אוטומטי מתי לאחזר תוכן על סמך בקשות המשתמש. אין תמיכה בצירוף מאגרי וקטורים לחיפוש קבצים. אתה יכול לצרף אותם ממגרש החול או לצרף קבצים להודעות לחיפוש קבצים על בסיס שרשור.",
   "com_assistants_function_use": "הסייען השתמש ב{{0}}",
   "com_assistants_image_vision": "מציג תמונות",
@@ -136,6 +145,7 @@
   "com_assistants_update_actions_success": "הפעולה נוצרה או עודכנה בהצלחה",
   "com_assistants_update_error": "אירעה שגיאה בעדכון הסייען שלך.",
   "com_assistants_update_success": "עודכן בהצלחה",
+  "com_assistants_update_success_name": "{{name}} עודכן בהצלחה",
   "com_auth_already_have_account": "כבר יש לך חשבון?",
   "com_auth_apple_login": "היכנס באמצעות חשבון אפל",
   "com_auth_back_to_login": "חזור להתחברות",
@@ -216,14 +226,22 @@
   "com_endpoint_anthropic_maxoutputtokens": "מספר האסימונים המרבי שניתן להפיק בתגובה. ציין ערך נמוך יותר עבור תגובות קצרות יותר וערך גבוה יותר עבור תגובות ארוכות יותר.",
   "com_endpoint_anthropic_prompt_cache": "שמירת מטמון מהירה מאפשרת שימוש חוזר בהקשר גדול או בהוראות בקריאות API, תוך הפחתת העלויות וההשהייה",
   "com_endpoint_anthropic_temp": "נע בין 0 ל-1. השתמש בטמפ' הקרובה יותר ל-0 עבור בחירה אנליטית / מרובה, וקרוב יותר ל-1 עבור משימות יצירתיות ויצירתיות. אנו ממליצים לשנות את זה או את Top P אבל לא את שניהם.",
-  "com_endpoint_anthropic_thinking": "מאפשר חשיבה פנימית עבור דגמי Claude נתמכים (3.7 Sonnet). הערה: דורש שההגדרה של 'תקציב חשיבה' תהיה נמוכה מ'מקסימום טוקנים לפלט'",
+  "com_endpoint_anthropic_thinking": "מפעיל חשיבה פנימית עבור מודלי Claude נתמכים. עבור מודלים חדשים (Opus 4.6 ומעלה), נעשה שימוש בחשיבה אדפטיבית הנשלטת על ידי פרמטר המאמץ. עבור מודלים ישנים, יש להגדיר את \"תקציב החשיבה\" לערך נמוך מ\"מקסימום טוקני פלט\".",
   "com_endpoint_anthropic_thinking_budget": "קובע את מספר הטוקנים המקסימלי שקלוד רשאי להשתמש בו עבור תהליך החשיבה הפנימי. תקציב גבוה יותר עשוי לשפר את איכות התשובה על ידי מתן אפשרות לניתוח מעמיק יותר של בעיות מורכבות, אם כי קלוד לא בהכרח ישתמש בכל התקציב שהוקצה, במיוחד בטווחים שמעל 32K. הגדרה זו חייבת להיות נמוכה מ'מקסימום טוקנים לפלט'.",
+  "com_endpoint_anthropic_thinking_display": "הצגת תהליך החשיבה",
+  "com_endpoint_anthropic_thinking_display_desc": "קובע האם תהליך החשיבה של Claude מוצג. 'אוטומטי' מציג מחשבות מסוכמות עבור מודלים שמסתירים אותן כברירת מחדל (Opus 4.7 ומעלה); 'מסוכם' תמיד מציג אותן; 'מוסתר' תמיד מסתיר אותן לזמן תגובה מעט מהיר יותר.",
   "com_endpoint_anthropic_topk": "Top-k משנה את האופן שבו המודל בוחר אסימונים לפלט. Top-k של 1 פירושו שהאסימון שנבחר הוא הסביר ביותר מבין כל האסימונים באוצר המילים של הדגם (נקרא גם פענוח חמדן), בעוד ש-top-k של 3 פירושו שהאסימון הבא נבחר מבין 3 הכי הרבה. אסימונים סבירים (באמצעות טמפרטורה).",
   "com_endpoint_anthropic_topp": "Top-p משנה את האופן שבו המודל בוחר אסימונים לפלט. אסימונים נבחרים מבין רוב K (ראה פרמטר topK) הסביר לפחות עד שסכום ההסתברויות שלהם שווה לערך העליון-p.",
   "com_endpoint_anthropic_use_web_search": "הפעל אפשרות חיפוש ברשת באמצעות יכולות החיפוש המובנות של קלוד. זה מאפשר למודל לחפש באינטרנט מידע עדכני ולספק תשובות מדויקות ועדכניות יותר.",
   "com_endpoint_assistant": "סייען",
   "com_endpoint_assistant_model": "מודל סייען",
   "com_endpoint_assistant_placeholder": "אנא בחר סייען מלוח הצד הימני",
+  "com_endpoint_bedrock_reasoning_effort": "קובע את רמת החשיבה עבור מודלי Bedrock נתמכים (לדוגמה Kimi K2.5, GLM). רמות גבוהות יותר מייצרות חשיבה מעמיקה יותר, אך דורשות זמן תגובה וטוקנים רבים יותר.",
+  "com_endpoint_config_bedrock_access_key_id": "מזהה מפתח גישה AWS (Access Key ID)",
+  "com_endpoint_config_bedrock_bearer_token": "מפתח API של AWS Bedrock",
+  "com_endpoint_config_bedrock_credentials_required": "יש לספק מפתח API של AWS Bedrock או מפתחות גישה של AWS (במקרה של מפתחות גישה יש לספק: Access Key ID + Secret Access Key)",
+  "com_endpoint_config_bedrock_secret_access_key": "מפתח גישה סודי (Secret Access Key) AWS",
+  "com_endpoint_config_bedrock_session_token": "אסימון הפעלה (Session Token) AWS",
   "com_endpoint_config_click_here": "לחץ כאן",
   "com_endpoint_config_google_api_info": "כדי לקבל את מפתח ה-API של Generative Language (עבור תאומים),",
   "com_endpoint_config_google_api_key": "מפתח Google API",
@@ -244,6 +262,7 @@
   "com_endpoint_config_key_name": "מפתח",
   "com_endpoint_config_key_never_expires": "המפתח שלך לא יפוג לעולם",
   "com_endpoint_config_placeholder": "הגדר את המפתח שלך בתפריט הכותרת לצאט.",
+  "com_endpoint_config_required_fields": "יש למלא את השדות הבאים:",
   "com_endpoint_config_value": "הזן ערך עבור",
   "com_endpoint_context": "הקשר",
   "com_endpoint_context_info": "המספר המרבי של הטוקנים שניתן להשתמש בהם בחלון ההקשר. השתמש בזה כדי לשלוט בכמה טוקנים ישלחו בכל בקשה. אם לא צוין, יתבצע שימוש בברירת המחדל של המערכת המבוססות על גודל חלון ההקשר ברירת המחדל של המודלים. הגדרת ערכים גבוהים יותר עלולה לגרום לשגיאות ו/או עלות טוקנים גבוהה יותר.",
@@ -254,6 +273,7 @@
   "com_endpoint_default_with_num": "ברירת מחדל: {{0}}",
   "com_endpoint_disable_streaming": "השבתת תגובות סטרימינג וקבלת התגובה המלאה בבת אחת. שימושי עבור דגמים כמו o3 הדורשים ארגון מאומת כדי לאפשר סטרימינג",
   "com_endpoint_disable_streaming_label": "השבתת סטרימינג",
+  "com_endpoint_effort": "רמת המאמץ",
   "com_endpoint_examples": "הגדרות קבועות מראש",
   "com_endpoint_export": "ייצוא",
   "com_endpoint_export_share": "ייצא/שתף",
@@ -261,8 +281,9 @@
   "com_endpoint_google_custom_name_placeholder": "הגדר שם מותאם אישית עבור Google",
   "com_endpoint_google_maxoutputtokens": " המספר המרבי של אסימונים שניתן להפיק בתגובה. ציין ערך נמוך יותר עבור תגובות קצרות יותר וערך גבוה יותר עבור תגובות ארוכות יותר.",
   "com_endpoint_google_temp": "ערכים גבוהים יותר = יותר אקראיים, בעוד שערכים נמוכים יותר = יותר ממוקד ודטרמיניסטי. אנו ממליצים לשנות את זה או את Top P אבל לא את שניהם.",
-  "com_endpoint_google_thinking": "מאפשר או מבטל את החשיבה. הגדרה זו נתמכת רק על ידי דגמים מסוימים (סדרה 2.5). עבור דגמים ישנים יותר, ייתכן שלהגדרה זו לא תהיה השפעה.",
-  "com_endpoint_google_thinking_budget": "מנחה את מספר טוקני החשיבה שהמודל משתמש בהם. הכמות בפועל עלולה לחרוג או להיות נמוכה מערך זה בהתאם לפרומפט.\n\nהגדרה זו נתמכת רק על ידי מודלים מסוימים (סדרת 2.5). Gemini 2.5 Pro תומך ב-128-32,768 טוקנים. Gemini 2.5 Flash תומך ב-0-24,576 טוקנים. Gemini 2.5 Flash Lite תומך ב-512-24,576 טוקנים.\n\nהשאירו ריק או הגדירו ל-\"-1\" כדי לאפשר למודל להחליט באופן אוטומטי מתי וכמה לחשוב. כברירת מחדל, Gemini 2.5 Flash Lite לא חושב.",
+  "com_endpoint_google_thinking": "מפעיל או משבית חשיבה. נתמך על ידי סדרות Gemini 2.5 ו-3. הערה: לא ניתן להשבית את החשיבה במלואה ב-Gemini 3 Pro",
+  "com_endpoint_google_thinking_budget": "מנחה את מספר טוקני החשיבה שבהם משתמש המודל. הכמות בפועל עשויה להיות גבוהה או נמוכה מערך זה, בהתאם להנחיה.\n\nהגדרה זו חלה רק על Gemini 2.5 ומודלים ישנים יותר. עבור Gemini 3 ואילך, השתמש בהגדרת \"רמת החשיבה\".\n\nGemini 2.5 Pro תומך ב-128 עד 32,768 טוקנים. Gemini 2.5 Flash תומך ב-0 עד 24,576 טוקנים. Gemini 2.5 Flash Lite תומך ב-512 עד 24,576 טוקנים.\n\nהשאר ריק או הגדר ל-\"-1\" כדי לאפשר למודל להחליט באופן אוטומטי מתי וכמה לחשוב. כברירת מחדל, Gemini 2.5 Flash Lite אינו חושב.",
+  "com_endpoint_google_thinking_level": "קובע את עומק החשיבה עבור Gemini 3 ואילך. אין לו השפעה על Gemini 2.5 וקודמים - עבורם השתמש ב'תקציב חשיבה'.\n\nהשאר על 'אוטומטי' לברירת מחדל של המודל.",
   "com_endpoint_google_topk": "Top-k משנה את האופן שבו המודל בוחר אסימונים לפלט. Top-k של 1 פירושו שהאסימון שנבחר הוא הסביר ביותר מבין כל האסימונים באוצר המילים של הדגם (נקרא גם פענוח חמדן), בעוד ש-top-k של 3 פירושו שהאסימון הבא נבחר מבין 3 הכי הרבה. אסימונים סבירים (באמצעות טמפרטורה).",
   "com_endpoint_google_topp": "Top-p משנה את האופן שבו המודל בוחר אסימונים לפלט. אסימונים נבחרים מרוב K (ראה פרמטר topK) ככל הנראה לפחות עד ה-sum של ההסתברויות שלהם שווה לערך ה-p העליון.",
   "com_endpoint_google_use_search_grounding": "השתמשו בחיפוש גוגל כדי לשפר את התגובות עם תוצאות חיפוש בזמן אמת. זה מאפשר למודלים לגשת למידע עדכני ולספק תשובות מדויקות ועדכניות יותר",
@@ -303,6 +324,7 @@
   "com_endpoint_preset_default_removed": "איננו עוד ברירת המחדל המוגדרת מראש.",
   "com_endpoint_preset_delete_confirm": "האם אתה בטוח שברצונך למחוק את הקביעה המוגדרת מראש הזו?",
   "com_endpoint_preset_delete_error": "אירעה שגיאה במחיקת הקביעה המוגדרת מראש שלך. בבקשה נסה שוב.",
+  "com_endpoint_preset_delete_success": "ההגדרה השמורה נמחקה בהצלחה",
   "com_endpoint_preset_import": "הגדרה מראש מיובאת!",
   "com_endpoint_preset_import_error": "אירעה שגיאה בייבוא הקביעה המוגדרת מראש שלך. בבקשה נסה שוב.",
   "com_endpoint_preset_name": "שם מוגדר מראש",
@@ -322,7 +344,7 @@
   "com_endpoint_save_as_preset": "שמור כתבנית",
   "com_endpoint_search": "חפש נקודת קצה לפי שם",
   "com_endpoint_search_endpoint_models": "חפש מודלים של {{0}}...",
-  "com_endpoint_search_models": "חפש מו",
+  "com_endpoint_search_models": "חפש מודלים...",
   "com_endpoint_search_var": "חפש {{0}}...",
   "com_endpoint_set_custom_name": "הגדר שם מותאם אישית, למקרה שתוכל למצוא את הקביעה המוגדרת מראש",
   "com_endpoint_stop": "רצף לעצירה",
@@ -330,6 +352,7 @@
   "com_endpoint_temperature": "טמפרטורה",
   "com_endpoint_thinking": "חשיבה",
   "com_endpoint_thinking_budget": "תקציב חשיבה",
+  "com_endpoint_thinking_level": "רמת חשיבה",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "השתמש ב-סייען פעיל",
@@ -350,12 +373,15 @@
   "com_error_illegal_model_request": "המודל \"{{0}}\" אינו זמין עבור {{1}}. אנא בחר מודל אחר",
   "com_error_input_length": "מספר הטוקנים של ההודעות האחרונות גבוה מדי, והוא חורג ממגבלת האסימונים ({{0}} בהתאמה. אנא קצר את ההודעה שלך, שנה את גודל ההקשר המקסימלי בפרמטרי השיחה, או התחל שיחה חדשה.",
   "com_error_invalid_agent_provider": "המודלים של \"{{0}}\" אינם זמינים לשימוש עם סוכנים. אנא עבור להגדרות הסוכן שלך ובחר ספק הזמין כרגע.",
+  "com_error_invalid_base_url": "כתובת ה-URL שסיפקת מכוונת לכתובת מוגבלת. אנא השתמש בכתובת URL חיצונית תקינה ונסה שוב.",
   "com_error_invalid_user_key": "מפתח שסופק אינו חוקי. אנא ספק מפתח חוקי ונסה שוב.",
   "com_error_missing_model": "לא נבחר מודל עבור {{0}}. אנא בחר מודל ונסה שוב",
   "com_error_models_not_loaded": "לא ניתן היה לטעון את תצורת המודלים. אנא רענן את העמוד ונסה שוב",
   "com_error_moderation": "נראה שהתוכן שנשלח סומן על ידי מערכת הניהול שלנו בגלל שהוא אינו תואם את הנחיות הקהילה שלנו. אנחנו לא יכולים להמשיך עם הנושא הספציפי הזה. אם יש לך שאלות או נושאים אחרים שתרצה לחקור, אנא ערוך את ההודעה שלך, או צור שיחה חדשה.",
   "com_error_no_base_url": "לא נמצאה כתובת URL. אנא ספק כתובת ונסה שוב.",
   "com_error_no_user_key": "לא נמצא מפתח. אנא ספק מפתח ונסה שוב.",
+  "com_error_refusal": "התשובה נחסמה על ידי מסנני בטיחות. נסח מחדש את ההודעה שלך ונסה שוב. אם אתה נתקל בבעיה זו לעתים קרובות בשימוש ב-Claude Sonnet 4.5 או Opus 4.1, אתה יכול לנסות את Sonnet 4, שיש לו מגבלות שימוש שונות.",
+  "com_error_stream_expired": "החיבור לתגובה פג או הסתיים. נא לנסות שוב.",
   "com_file_pages": "עמודים: {{דפים}}",
   "com_file_source": "קובץ",
   "com_file_unknown": "קובץ לא ידוע",
@@ -364,19 +390,30 @@
   "com_files_download_progress": "{{0}} מתוך {{1}} קבצים",
   "com_files_downloading": "הורדת קבצים",
   "com_files_filter": "סינון קבצים...",
+  "com_files_filter_by": "סנן קבצים לפי...",
   "com_files_no_results": "אין תוצאות",
   "com_files_number_selected": "{{0}} מתוך {{1}} פריטים נבחרו",
   "com_files_preparing_download": "מכין את ההורדה...",
+  "com_files_results_found": "נמצאו {{count}} תוצאות",
   "com_files_sharepoint_picker_title": "בחירת קבצים",
-  "com_files_table": "השדה חייב להכיל תוכן, הוא אינו יכול להישאר ריק",
+  "com_files_table": "רשימת קבצים",
   "com_files_upload_local_machine": "מהמחשב המקומי",
   "com_files_upload_sharepoint": "מ-SharePoint",
   "com_generated_files": "קבצים שנוצרו:",
   "com_hide_examples": "הסתר דוגמאות",
   "com_info_heic_converting": "המרת התמונה מפורמט HEIC לפורמט JPEG...",
   "com_nav_2fa": "אימות דו-שלבי (2FA)",
+  "com_nav_about_branch": "ענף (Branch)",
+  "com_nav_about_build_date": "תאריך בנייה",
+  "com_nav_about_commit": "קומיט (Commit)",
+  "com_nav_about_diagnostics_copied": "הועתק ללוח",
+  "com_nav_about_diagnostics_copy": "העתק אבחון",
+  "com_nav_about_diagnostics_description": "העתק את המידע הזה כשאתה פונה לתמיכה, כדי שנוכל לדעת בדיוק איזו גרסה אתה משתמש.",
+  "com_nav_about_version": "גרסה",
   "com_nav_account_settings": "הגדרות חשבון",
-  "com_nav_always_make_prod": "ייצר תמיד גרסאות חדשות",
+  "com_nav_advanced_prompts": "עורך הנחיות (פרומפטים - Prompts) מתקדם",
+  "com_nav_advanced_prompts_desc": "הפעל ניהול גרסאות ובקרת ייצור עבור הנחיות (פרומפטים - Prompts)",
+  "com_nav_always_make_prod": "הגדר תמיד גרסאות פרומפט חדשות כגרסת ייצור",
   "com_nav_archive_created_at": "תאריך ייצור",
   "com_nav_archive_name": "שם",
   "com_nav_archived_chats": "שיחות בארכיון",
@@ -384,8 +421,10 @@
   "com_nav_at_command_description": "הפקודה \"@\" משמשת כמנגנון הפעלה/החלפה של נקודות קצה, מודלים, הגדרות קבועות מראש וכו'.",
   "com_nav_audio_play_error": "שגיאה בהפעלת אודיו: {{0}}",
   "com_nav_audio_process_error": "שגיאה בעיבוד האודיו: {{0}}",
+  "com_nav_auto_expand_tools": "הצג פרטי כלים באופן אוטומטי",
   "com_nav_auto_scroll": "בפתיחת צ׳אט גלול אוטומטית להודעה האחרונה",
-  "com_nav_auto_send_prompts": "שליחת הנחיות (פרומפטים) אוטומטית",
+  "com_nav_auto_send_prompts": "שלח פרומפטים אוטומטית בעת בחירה",
+  "com_nav_auto_send_prompts_desc": "שלח את ההנחיות (פרומפטים - Prompts) אוטומטית לצ'אט עם הבחירה",
   "com_nav_auto_send_text": "טקסט לשליחה אוטומטית",
   "com_nav_auto_transcribe_audio": "תמלול אוטומטי של אודיו",
   "com_nav_automatic_playback": "הפעלה אוטומטית של ההודעה האחרונה",
@@ -414,16 +453,15 @@
   "com_nav_browser": "דפדפן",
   "com_nav_center_chat_input": "מרכז תיבת הצ'אט במסך ברוכים הבאים",
   "com_nav_change_picture": "שנה תמונה",
-  "com_nav_chat_commands": "פקודות צ'אט",
-  "com_nav_chat_commands_info": "פקודות אלו מופעלות על ידי הקלדת תווים ספציפיים בתחילת ההודעה. כל פקודה מופעלת על ידי הקידומת המיועדת לה. אתה יכול להשבית אותם אם אתה משתמש בתווים אלה לעתים קרובות כדי להתחיל הודעות.",
   "com_nav_chat_direction": "כיוון הכתיבה",
+  "com_nav_chat_direction_selected": "כיוון הצ'אט: {{direction}}",
   "com_nav_clear_all_chats": "נקה את כל השיחות",
   "com_nav_clear_cache_confirm_message": "האם אתה בטוח שברצונך לנקות את המטמון?",
   "com_nav_clear_conversation": "נקה שיחות",
   "com_nav_clear_conversation_confirm_message": "אתה בטוח שאתה רוצה לנקות את כל השיחות? זה בלתי הפיך.",
   "com_nav_close_sidebar": "סגור סרגל צד",
-  "com_nav_commands": "פקודות",
   "com_nav_confirm_clear": "אשר ניקוי",
+  "com_nav_control_panel": "לוח בקרה",
   "com_nav_conversation_mode": "מצב שיחה ",
   "com_nav_convo_menu_options": "אפשרויות מצב שיחה",
   "com_nav_db_sensitivity": "רגישות דציבלים",
@@ -459,6 +497,7 @@
   "com_nav_info_code_artifacts": "אפשר הצגה של רכיבי תצוגת קוד ניסיוניים לצד הצ'אט",
   "com_nav_info_code_artifacts_agent": "אפשר שימוש ברכיבי תצוגת קוד עבור סוכן זה כברירת מחדל, מתווספות הוראות נוספות ספציפיות לשימוש ברכיבי התצוגה אלא אם \"מצב הנחיה מותאם אישית\" מופעל.",
   "com_nav_info_custom_prompt_mode": "כאשר אפשרות זו מופעלת, הנחיית ברירת המחדל של מערכת רכיבי תצוגה לא תיכלל. כל ההוראות ליצירת רכיבי תצוגה יהיו חייבות להינתן באופן ידני במצב זה.",
+  "com_nav_info_default_temporary_chat": "כאשר מופעל, כל שיחה חדשה תתחיל כצ'אט זמני אוטומטית. צ'אטים זמניים לא נשמרים בהיסטוריה",
   "com_nav_info_enter_to_send": "כאשר מופעל, לחיצה על \"ENTER\" תשלח את ההודעה שלך, כאשר מושבת לחיצה על \"Enter\" תוסיף שורה חדשה, ותצטרך ללחוץ על \"CTRL + ENTER\" כדי לשלוח את ההודעה.",
   "com_nav_info_fork_change_default": "'הודעות ישירות בלבד' כולל רק את הנתיב הישיר להודעה שנבחרה. 'כלול הסתעפויות קשורות' מוסיף את כל ההסתעפויות הקשורות לאורך הנתיב. 'כלול הכל עד כאן/מכאן' כולל את כל ההודעות וההסתעפויות המחוברות.",
   "com_nav_info_fork_split_target_setting": "כאשר אפשרות זו מופעלת, הפיצול יתחיל מהודעת היעד ועד להודעה האחרונה בשיחה, בהתאם להתנהגות שנבחרה",
@@ -468,6 +507,7 @@
   "com_nav_info_save_draft": "כאשר אפשרות זו מופעלת, הטקסט והקבצים המצורפים שאתה מזין בטופס הצ'אט יישמרו באופן אוטומטי כטיוטות במכשיר שלך. טיוטות אלו יהיו זמינות גם אם תטען מחדש את הדף או תעבור לשיחה אחרת. הטיוטות נשמרות באופן מקומי במכשיר שלך ונמחקות לאחר שליחת ההודעה.",
   "com_nav_info_show_thinking": "כאשר אפשרות זו מופעלת, תיבות תצוגה שמציגות את תהליך החשיבה של הבינה המלאכותית יופיעו פתוחות כברירת מחדל, כך שתוכל לראות את תהליך הניתוח בזמן אמת. כאשר האפשרות מושבתת, תיבות הבחירה יישארו סגורות כברירת מחדל, מה שיוצר ממשק נקי וזורם יותר.",
   "com_nav_info_user_name_display": "כאשר אפשרות זו מופעלת, שם המשתמש של השולח יוצג מעל כל הודעה שאתה שולח. כאשר האפשרות מושבתת, יוצג רק הכיתוב \"אתה\" מעל ההודעות שלך.",
+  "com_nav_keep_screen_awake": "מנע את כיבוי המסך בזמן יצירת תשובה",
   "com_nav_lang_arabic": "ערבית (العربية)",
   "com_nav_lang_armenian": "ארמנית (Հայերեն)",
   "com_nav_lang_auto": "זיהוי באופן אוטומטי",
@@ -486,16 +526,20 @@
   "com_nav_lang_german": "גרמנית (Deutsch)",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "הונגרית",
+  "com_nav_lang_icelandic": "איסלנדית (Íslenska)",
   "com_nav_lang_indonesia": "אינדונזית (Indonesia)",
   "com_nav_lang_italian": "איטלקית (Italiano)",
   "com_nav_lang_japanese": "יפנית (日本語)",
   "com_nav_lang_korean": "קוראנית (한국어)",
   "com_nav_lang_latvian": "לטבית (Latviski)",
+  "com_nav_lang_lithuanian": "ליטאית (Lietuvių)",
   "com_nav_lang_norwegian_bokmal": "נורווגית (Norsk Bokmål)",
+  "com_nav_lang_norwegian_nynorsk": "נורווגית ניינורסק (Norsk Nynorsk)",
   "com_nav_lang_persian": "פרסית",
   "com_nav_lang_polish": "פולנית (Polski)",
   "com_nav_lang_portuguese": "פורטוגזית (Português)",
   "com_nav_lang_russian": "רוסית (Русский)",
+  "com_nav_lang_slovak": "סלובקית (Slovenčina)",
   "com_nav_lang_slovenian": "סלובנית (Slovenščina)",
   "com_nav_lang_spanish": "ספרדית (Español)",
   "com_nav_lang_swedish": "שוודית (Svenska)",
@@ -511,12 +555,23 @@
   "com_nav_log_out": "צא",
   "com_nav_long_audio_warning": "העיבוד של טקסטים ארוכים ייקח יותר זמן.",
   "com_nav_maximize_chat_space": "הגדל את שטח הצ'אט",
+  "com_nav_mcp_access_revoked": "הגישה לשרת MCP בוטלה בהצלחה",
   "com_nav_mcp_configure_server": "הגדרת {{0}}",
+  "com_nav_mcp_connect": "חבר",
+  "com_nav_mcp_connect_server": "חבר את {{0}}",
+  "com_nav_mcp_reconnect": "חבר מחדש",
+  "com_nav_mcp_status_connected": "מחובר",
   "com_nav_mcp_status_connecting": "{{0}} - חיבור",
+  "com_nav_mcp_status_disconnected": "מנותק",
+  "com_nav_mcp_status_error": "שגיאה",
+  "com_nav_mcp_status_initializing": "מאתחל",
+  "com_nav_mcp_status_needs_auth": "דורש אימות",
+  "com_nav_mcp_status_unknown": "לא ידוע",
   "com_nav_mcp_vars_update_error": "שגיאה בעדכון משתנה משתמש מותאם אישית של MCP",
   "com_nav_mcp_vars_updated": "משתני משתמש מותאמים אישית של MCP עודכנו בהצלחה.",
   "com_nav_modular_chat": "אפשר החלפת נקודות קצה באמצע שיחה",
   "com_nav_my_files": "הקבצים שלי",
+  "com_nav_new_chat_switch_to_history": "הצג היסטוריית צ'אט כשנוצרת שיחה חדשה",
   "com_nav_not_supported": "לא נתמך",
   "com_nav_open_sidebar": "פתח סרגל צד",
   "com_nav_playback_rate": "קצב השמעת האודיו",
@@ -529,14 +584,12 @@
   "com_nav_scroll_button": "לחצן לגלילה עד הסוף",
   "com_nav_search_placeholder": "חפש הודעות",
   "com_nav_send_message": "שלח הודעה",
+  "com_nav_setting_about": "אודות",
   "com_nav_setting_account": "חשבון",
-  "com_nav_setting_balance": "לאזן",
   "com_nav_setting_chat": "צ'אט",
-  "com_nav_setting_data": "בקרות נתונים",
   "com_nav_setting_delay": "השהיה (שניות)",
   "com_nav_setting_general": "כללי",
   "com_nav_setting_mcp": "הגדרות MCP",
-  "com_nav_setting_personalization": "התאמה אישית",
   "com_nav_setting_speech": "דיבור",
   "com_nav_settings": "הגדרות",
   "com_nav_shared_links": "קישורים משותפים",
@@ -561,7 +614,7 @@
   "com_nav_user_name_display": "הצג שם משתמש בהודעות",
   "com_nav_voice_select": "קול",
   "com_show_examples": "הצג דוגמאות",
-  "com_sidepanel_agent_builder": "בניית סוכן",
+  "com_sidepanel_agent_builder": "בניית ועריכת סוכנים",
   "com_sidepanel_assistant_builder": "בניית סייען",
   "com_sidepanel_attach_files": "צרף קבצים",
   "com_sidepanel_conversation_tags": "סימניות",
@@ -595,22 +648,33 @@
   "com_ui_2fa_generate_error": "תרחשה שגיאה בעת יצירת הגדרות האימות הדו-שלבי (2FA)",
   "com_ui_2fa_invalid": "קוד האימות הדו-שלבי שגוי",
   "com_ui_2fa_setup": "הגדר אימות דו-שלבי (2FA)",
+  "com_ui_2fa_verification_required": "הזן את קוד האימות הדו-שלבי (2FA) שלך כדי להמשיך",
   "com_ui_2fa_verified": "האימות הדו-שלבי אומת בהצלחה",
   "com_ui_accept": "אני מקבל",
   "com_ui_action_button": "לחצן פעולה",
   "com_ui_active": "פעיל",
   "com_ui_add": "הוסף",
+  "com_ui_add_first_bookmark": "לחץ על שיחה כדי להוסיף",
+  "com_ui_add_first_mcp_server": "צור את שרת ה-MCP הראשון שלך כדי להתחיל",
+  "com_ui_add_first_prompt": "צור את ההנחיה (פרומפט - prompt) הראשונה שלך כדי להתחיל",
+  "com_ui_add_labels": "הוסף תוויות",
   "com_ui_add_mcp": "הוסף MCP",
   "com_ui_add_mcp_server": "הוסף שרת MCP",
   "com_ui_add_model_preset": "הוספת מודל או הגדרה קבועה לתגובה נוספת",
   "com_ui_add_multi_conversation": "הוספת תמיכה בשיחות מרובות",
+  "com_ui_add_skills": "הוסף מיומנויות (Skills)",
+  "com_ui_add_special_variables": "הוסף משתנים מיוחדים",
+  "com_ui_add_web_search_api_keys": "הוסף מפתחות API לחיפוש ברשת",
   "com_ui_adding_details": "הוספת פרטים",
+  "com_ui_additional_details": "פרטים נוספים",
   "com_ui_admin": "אדמין",
   "com_ui_admin_access_warning": "השבתת גישת המנהל לתכונה זו עלולה לגרום לבעיות בלתי צפויות בממשק המשתמש שידרשו רענון. אם השינוי נשמר, הדרך היחידה להחזיר את ההגדרה היא דרך הגדרת הממשק בקובץ librechat.yaml, שמשפיעה על כל התפקידים.",
   "com_ui_admin_settings": "הגדרות אדמין",
+  "com_ui_admin_settings_section": "הגדרות ניהול - {{section}}",
   "com_ui_advanced": "מתקדם",
   "com_ui_advanced_settings": "הגדרות מתקדמות",
   "com_ui_agent": "סוכן",
+  "com_ui_agent_api_keys": "מפתחות API של סוכנים",
   "com_ui_agent_category_aftersales": "אחרי המכירה",
   "com_ui_agent_category_finance": "פיננסי",
   "com_ui_agent_category_general": "כללי",
@@ -624,11 +688,35 @@
   "com_ui_agent_chain_max": "הגעת למקסימום של {{0}} סוכנים.",
   "com_ui_agent_delete_error": "אירעה שגיאה בעת מחיקת הסוכן.",
   "com_ui_agent_deleted": "הסוכן נמחק בהצלחה.",
+  "com_ui_agent_description": "תיאור הסוכן",
   "com_ui_agent_duplicate_error": "אירעה שגיאה בעת שכפול הסוכן",
   "com_ui_agent_duplicated": "הסוכן שוכפל בהצלחה",
+  "com_ui_agent_handoff_add": "הוסף סוכן להעברת שיחה",
+  "com_ui_agent_handoff_description": "תיאור ההעברה",
+  "com_ui_agent_handoff_description_placeholder": "לדוגמה, העברה לאנליסט נתונים לניתוח סטטיסטי",
+  "com_ui_agent_handoff_info": "הגדר סוכנים שסוכן זה יכול להעביר אליהם שיחות כשנדרשת מומחיות ספציפית.",
+  "com_ui_agent_handoff_info_2": "כל העברה יוצרת כלי שמאפשר ניתוב חלק לסוכנים מומחים יחד עם ההקשר.",
+  "com_ui_agent_handoff_max": "הגעת למספר המקסימלי של {{0}} סוכני העברה.",
+  "com_ui_agent_handoff_prompt": "תוכן מועבר",
+  "com_ui_agent_handoff_prompt_key": "שם משתנה התוכן (ברירת מחדל: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "תן תווית לתוכן המועבר (ברירת מחדל: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "ציין לסוכן זה איזה תוכן ליצור ולהעביר לסוכן היעד. עליך להוסיף משהו כאן כדי להפעיל תכונה זו",
+  "com_ui_agent_handoffs": "העברות סוכנים",
+  "com_ui_agent_name": "שם הסוכן",
   "com_ui_agent_name_is_required": "שם הסוכן הוא שדה חובה",
   "com_ui_agent_recursion_limit": "מספר מרבי של שלבי סוכן",
   "com_ui_agent_recursion_limit_info": "מגביל את מספר השלבים שהסוכן יכול לבצע בריצה לפני מתן תגובה סופית. ברירת המחדל היא 25 שלבים. שלב הוא בקשת API של בינה מלאכותית או סבב שימוש בכלי. לדוגמה, אינטראקציה בסיסית עם כלי לוקחת 3 שלבים: בקשה ראשונית, שימוש בכלי, ובקשת המשך.",
+  "com_ui_agent_subagents": "תת-סוכנים",
+  "com_ui_agent_subagents_add": "הוסף תת-סוכן",
+  "com_ui_agent_subagents_agents": "תת-סוכנים נוספים",
+  "com_ui_agent_subagents_allow_self": "אפשר הפעלה עצמאית",
+  "com_ui_agent_subagents_allow_self_info": "אפשר לסוכן זה להאציל משימות-משנה ממוקדות להעתק של עצמו בחלון הקשר מבודד.",
+  "com_ui_agent_subagents_empty": "אין תת-סוכנים זמינים: הפעל יצירה עצמית או הוסף לפחות סוכן אחד.",
+  "com_ui_agent_subagents_enable": "הפעל תת-סוכנים",
+  "com_ui_agent_subagents_info": "תת-סוכנים רצים בחלונות הקשר מבודדים. פלט מפורט של כלים נשאר מוגבל לתת-הסוכן; רק סיכום חוזר לסוכן זה.",
+  "com_ui_agent_subagents_info_2": "הפעלה ללא סוכנים ברשימה עדיין מאפשרת יצירה עצמית, כך שהסוכן יכול להאציל משימות-משנה ממוקדות לעותק חדש של עצמו.",
+  "com_ui_agent_subagents_max": "הגעת למספר המקסימלי של {{0}} תת-סוכנים.",
+  "com_ui_agent_subagents_remove": "הסר את {{0}} מתת-הסוכנים",
   "com_ui_agent_url_copied": "כתובת ה-URL של הסוכן הועתקה ללוח",
   "com_ui_agent_var": "{{0}} סוכנים",
   "com_ui_agent_version": "גרסה",
@@ -647,16 +735,27 @@
   "com_ui_agents": "סוכנים",
   "com_ui_agents_allow_create": "אפשר יצירת סוכנים",
   "com_ui_agents_allow_share": "אפשר שיתוף סוכנים",
+  "com_ui_agents_allow_share_public": "אפשר שיתוף סוכנים באופן ציבורי",
   "com_ui_agents_allow_use": "אפשר שימוש בסוכנים",
   "com_ui_all": "הכל",
   "com_ui_all_proper": "הכל",
   "com_ui_analyzing": "ניתוח",
   "com_ui_analyzing_finished": "סיים ניתוח",
   "com_ui_api_key": "מפתח API",
+  "com_ui_api_key_create_error": "יצירת מפתח API נכשלה",
+  "com_ui_api_key_created": "מפתח API נוצר בהצלחה",
+  "com_ui_api_key_delete_error": "מחיקת מפתח API נכשלה",
+  "com_ui_api_key_deleted": "מפתח API נמחק בהצלחה",
+  "com_ui_api_key_name": "שם המפתח",
+  "com_ui_api_key_name_placeholder": "מפתח ה-API שלי",
+  "com_ui_api_key_name_required": "שם מפתח API הוא שדה חובה",
+  "com_ui_api_key_warning": "הקפד להעתיק את מפתח ה-API עכשיו. לא תוכל לראות אותו שוב!",
+  "com_ui_api_keys_load_error": "טעינת מפתחות API נכשלה",
   "com_ui_archive": "לארכיון",
   "com_ui_archive_delete_error": "מחיקת השיחה מהארכיון נכשלה",
   "com_ui_archive_error": "אירעה שגיאה באירכוב השיחה",
   "com_ui_artifact_click": "לחץ לפתיחה",
+  "com_ui_artifact_preview_pending": "_התצוגה המקדימה עדיין לא זמינה — לחץ על **הורדה** כדי לצפות בקובץ._",
   "com_ui_artifacts": "רכיבי תצוגה",
   "com_ui_artifacts_options": "אפשרויות ארטיפקטים",
   "com_ui_artifacts_toggle": "הפעל/כבה רכיבי תצוגה",
@@ -669,8 +768,11 @@
   "com_ui_assistants_output": "פלט סייענים",
   "com_ui_at_least_one_owner_required": "נדרש לפחות בעלים אחד",
   "com_ui_attach_error": "לא ניתן לצרף קובץ. צור או בחר שיחה, או נסה לרענן את הדף.",
+  "com_ui_attach_error_disabled": "העלאת קבצים מושבתת עבור נקודת קצה זו",
+  "com_ui_attach_error_limit": "הגעת למגבלת הקבצים:",
   "com_ui_attach_error_openai": "לא ניתן לצרף את קבצי הסייען לנקודות קצה אחרות",
   "com_ui_attach_error_size": "חרגת ממגבלת גודל הקובץ עבור נקודת הקצה:",
+  "com_ui_attach_error_total_size": "חריגה ממגבלת הגודל הכולל של קבצים עבור נקודת קצה:",
   "com_ui_attach_error_type": "סוג קובץ לא נתמך עבור נקודת קצה:",
   "com_ui_attach_remove": "הסר את הקובץ",
   "com_ui_attach_warn_endpoint": "עשוי להתעלם מקבצים שאינם של הסייען שאין להם כלי תואם",
@@ -681,10 +783,12 @@
   "com_ui_authentication": "אימות",
   "com_ui_authentication_type": "סוג אימות",
   "com_ui_auto": "אוטומטי",
+  "com_ui_available_options": "אפשרויות זמינות",
   "com_ui_avatar": "אווטאר",
   "com_ui_azure": "אז'ור (Azure)",
   "com_ui_azure_ad": "שירות ניהול זהויות וגישה של מיקרוסופט (Entra ID)",
   "com_ui_back": "חזור",
+  "com_ui_back_to_builder": "חזרה לבונה",
   "com_ui_back_to_prompts": "חזור להנחיות (פרומפטים)",
   "com_ui_backup_code_number": "קוד {{number}}#",
   "com_ui_backup_codes": "קודי גיבוי",
@@ -695,10 +799,12 @@
   "com_ui_basic": "בסיסי",
   "com_ui_basic_auth_header": "כותרת אימות בסיסי",
   "com_ui_bearer": "נושא הרשאה",
+  "com_ui_beta": "בטא",
   "com_ui_bookmark_delete_confirm": "האם אתה בטוח שברצונך למחוק את הסימניה הזו?",
   "com_ui_bookmarks": "סימניות",
   "com_ui_bookmarks_add": "הוסף סימניות",
   "com_ui_bookmarks_add_to_conversation": "הוסף לשיחה הנוכחית",
+  "com_ui_bookmarks_count_selected": "{{count}} סימניות נבחרו",
   "com_ui_bookmarks_create_error": "אירעה שגיאה בעת יצירת הסימניה",
   "com_ui_bookmarks_create_exists": "סימניה זו כבר קיימת",
   "com_ui_bookmarks_create_success": "הסימניה נוצרה בהצלחה",
@@ -713,52 +819,98 @@
   "com_ui_bookmarks_title": "כותרת",
   "com_ui_bookmarks_update_error": "אירעה שגיאה בעת עדכון הסימניה",
   "com_ui_bookmarks_update_success": "הסימניה עודכנה בהצלחה",
+  "com_ui_branch_created": "הענף נוצר בהצלחה",
+  "com_ui_branch_error": "יצירת הענף נכשלה",
+  "com_ui_branch_message": "צור ענף מתגובה זו",
+  "com_ui_by_author": "מאת {{0}}",
   "com_ui_callback_url": "כתובת URL להחזרת המידע",
   "com_ui_cancel": "בטל",
   "com_ui_cancelled": "בוטל",
   "com_ui_category": "קָטֵגוֹרִיָה",
+  "com_ui_change_version": "שנה גרסה",
   "com_ui_chat": "צ'אט",
-  "com_ui_chat_history": "נקה היסטוריה",
+  "com_ui_chat_history": "היסטוריית הצ׳אטים",
+  "com_ui_chats": "צ'אטים",
+  "com_ui_check_internet": "בדוק את חיבור האינטרנט שלך",
   "com_ui_clear": "נקה",
   "com_ui_clear_all": "נקה הכל",
+  "com_ui_clear_browser_cache": "נקה את המטמון של הדפדפן",
+  "com_ui_clear_presets": "נקה הגדרות קבועות",
+  "com_ui_clear_search": "נקה חיפוש",
+  "com_ui_click_to_close": "לחץ כדי לסגור",
+  "com_ui_click_to_edit": "לחץ כדי לערוך",
+  "com_ui_click_to_view_var": "לחץ כדי לראות את {{0}}",
   "com_ui_client_id": "מזהה לקוח",
   "com_ui_client_secret": "ב",
   "com_ui_close": "סגור",
   "com_ui_close_menu": "סגור תפריט",
   "com_ui_close_settings": "סגור הגדרות",
+  "com_ui_close_var": "סגור את {{0}}",
   "com_ui_close_window": "סגור חלון",
   "com_ui_code": "קוד",
+  "com_ui_collapse": "כווץ",
   "com_ui_collapse_chat": "כווץ צ'אט",
+  "com_ui_collapse_summary": "כווץ סיכום",
+  "com_ui_collapse_thoughts": "כווץ מחשבות",
+  "com_ui_command_finished": "הריצה הושלמה",
   "com_ui_command_placeholder": "אופציונלי: הזן פקודה להנחיה (פרומפט), או שיעשה שימוש בשם",
   "com_ui_command_usage_placeholder": "בחר הנחיה (פרומפט) לפי פקודה או שם",
+  "com_ui_complete": "הושלם!",
   "com_ui_complete_setup": "ההגדרה הושלמה",
   "com_ui_concise": "תמציתי",
+  "com_ui_configure": "הגדר",
   "com_ui_configure_mcp_variables_for": "הגדרת משתנים עבור {{0}}",
   "com_ui_confirm": "אישור",
   "com_ui_confirm_action": "אשר פעולה",
   "com_ui_confirm_admin_use_change": "שינוי הגדרה זו יחסום גישה למנהלים, כולל אותך. האם אתה בטוח שברצונך להמשיך?",
   "com_ui_confirm_change": "אשר את השינוי",
   "com_ui_connecting": "חיבור",
+  "com_ui_contact_admin_if_issue_persists": "צור קשר עם המנהל אם הבעיה ממשיכה",
   "com_ui_context": "הקשר",
+  "com_ui_context_filter_sort": "סנן ומיין לפי הקשר",
   "com_ui_continue": "המשך",
   "com_ui_continue_oauth": "המשך עם OAuth",
+  "com_ui_control_bar": "סרגל בקרה",
+  "com_ui_conversation": "שיחה",
+  "com_ui_conversation_label": "שיחת {{title}}",
+  "com_ui_conversation_not_found": "השיחה לא נמצאה",
+  "com_ui_conversation_summarized": "השיחה סוכמה בהצלחה",
+  "com_ui_conversations": "שיחות",
+  "com_ui_convo_archived": "השיחה הועברה לארכיון",
   "com_ui_convo_delete_error": "מחיקת הצ'אט נכשלה",
+  "com_ui_convo_delete_success": "השיחה נמחקה",
   "com_ui_copied": "הועתק!",
   "com_ui_copied_to_clipboard": "הועתק ללוח",
+  "com_ui_copy": "הועתק",
   "com_ui_copy_code": "העתק קוד",
+  "com_ui_copy_failed": "לא ניתן להעתיק ללוח",
   "com_ui_copy_link": "העתק קישור",
+  "com_ui_copy_stack_trace": "העתק פרטי שגיאה",
+  "com_ui_copy_summary": "העתק סיכום ללוח",
+  "com_ui_copy_thoughts_to_clipboard": "העתק את המחשבות ללוח",
   "com_ui_copy_to_clipboard": "העתק ללוח",
   "com_ui_copy_url_to_clipboard": "העתקת כתובת URL ללוח",
   "com_ui_create": "צור",
+  "com_ui_create_api_key": "העתק מפתח API",
+  "com_ui_create_assistant": "צור עוזר (Assistant)",
   "com_ui_create_link": "צור קישור",
+  "com_ui_create_mcp_server": "צור שרת MCP",
   "com_ui_create_memory": "צור זכרון",
+  "com_ui_create_new_agent": "צור סוכן חדש",
   "com_ui_create_prompt": "צור הנחיה (פרומפט)",
+  "com_ui_create_prompt_page": "דף הגדרות הנחיה (פרומפט - Prompt) חדש",
+  "com_ui_create_skill": "צור מיומנות (Skill)",
+  "com_ui_create_skill_upload": "העלה קובץ מיומנות (SKILL.md)",
+  "com_ui_create_skill_upload_error": "לא ניתן לקרוא את הקובץ",
+  "com_ui_created": "נוצר",
+  "com_ui_creating": "יוצר...",
   "com_ui_creating_image": "יוצר תמונה. ייתכן שייקח מספר רגעים.",
   "com_ui_current": "נוכחי",
   "com_ui_currently_production": "נוצר עכשיו",
   "com_ui_custom": "מותאם אישית",
   "com_ui_custom_header_name": "שם כותרת מותאם אישית",
   "com_ui_custom_prompt_mode": "מצב הנחיה (פרומפט) מותאם אישית",
+  "com_ui_dark_theme_enabled": "ערכת נושא כהה הופעלה",
   "com_ui_date": "תאריך",
   "com_ui_date_april": "אפריל",
   "com_ui_date_august": "אוגוסט",
@@ -774,6 +926,7 @@
   "com_ui_date_previous_30_days": "30 ימים אחרונים",
   "com_ui_date_previous_7_days": "7 ימים אחרונים",
   "com_ui_date_september": "ספטמבר",
+  "com_ui_date_sort": "מיין לפי תאריך",
   "com_ui_date_today": "היום",
   "com_ui_date_yesterday": "אתמול",
   "com_ui_decline": "אני לא מקבל",
@@ -781,59 +934,88 @@
   "com_ui_delete": "מחק",
   "com_ui_delete_action": "מחק פעולה",
   "com_ui_delete_action_confirm": "האם אתה בטוח שברצונך למחוק פעולה זו?",
+  "com_ui_delete_agent": "מחק סוכן",
   "com_ui_delete_agent_confirm": "האם אתה בטוח שברצונך למחוק את הסייען הזה?",
+  "com_ui_delete_assistant": "מחק עוזר (Assistant)",
   "com_ui_delete_assistant_confirm": "האם אתה בטוח שאתה רוצה למחוק את הסייען הזה? אי אפשר לבטל את זה.",
   "com_ui_delete_confirm": "זה ימחק",
   "com_ui_delete_confirm_prompt_version_var": "פעולה זו תמחק את הגרסה שנבחרה עבור \"{{0}}\". אם לא קיימות גרסאות נוספות, ההנחיה תימחק.",
+  "com_ui_delete_confirm_strong": "פעולה זו תמחק את <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "למחוק את השיחה (צאט)?",
+  "com_ui_delete_conversation_tooltip": "מחק שיחה",
+  "com_ui_delete_mcp_server": "מחק שרת MCP",
+  "com_ui_delete_mcp_server_name": "מחק שרת MCP {{0}}",
   "com_ui_delete_memory": "מחק זיכרון",
   "com_ui_delete_not_allowed": "פעולת המחיקה אינה אפשרית",
+  "com_ui_delete_preset": "למחוק את ההגדרה הקבועה מראש?",
   "com_ui_delete_prompt": "מחק הנחיה (פרומפט)",
   "com_ui_delete_shared_link": "מחק קישור שיתוף",
+  "com_ui_delete_shared_link_heading": "מחק קישור משותף",
   "com_ui_delete_success": "נמחק בהצלחה",
   "com_ui_delete_tool": "מחק כלי",
   "com_ui_delete_tool_confirm": "האת אתה בטוח שאתה רוצה למחוק את הכלי הזה?",
   "com_ui_delete_tool_save_reminder": "הכלי הוסר. שמור את הסוכן כדי להחיל את השינויים",
   "com_ui_deleted": "נמחק",
+  "com_ui_deleting": "מוחק...",
   "com_ui_deleting_file": "מוחק קובץ...",
+  "com_ui_deploy": "פרוס",
   "com_ui_descending": "תיאור",
   "com_ui_description": "תיאור",
   "com_ui_description_placeholder": "אופציונלי: הזן תיאור שיוצג עבור ההנחיה (פרומפט)",
   "com_ui_deselect_all": "בטל את הבחירה של הכל",
   "com_ui_detailed": "מפורט",
+  "com_ui_details": "פרטים",
   "com_ui_disabling": "מבטל הפעלה...",
+  "com_ui_done": "הסתיים",
   "com_ui_download": "הורדות",
   "com_ui_download_artifact": "רכיב תצוגת הורדות",
   "com_ui_download_backup": "הורד קודי גיבוי",
   "com_ui_download_backup_tooltip": "לפני שתמשיך, הורד את קודי הגיבוי שלך. תזדקק להם כדי לשחזר גישה במקרה שתאבד את מכשיר האימות שלך",
   "com_ui_download_error": "וזה: שגיאה בהורדת הקובץ. ייתכן שהקובץ נמחק",
+  "com_ui_download_error_logs": "הורד יומני שגיאות",
   "com_ui_drag_drop": "גרור קובץ לכאן כדי להוסיף אותו לשיחה",
   "com_ui_dropdown_variables": "רשימה נפתחת של משתנים",
   "com_ui_duplicate": "שכפל",
+  "com_ui_duplicate_agent": "שכפל סוכן",
   "com_ui_duplication_error": "אירעה שגיאה בעת שכפול השיחה",
   "com_ui_duplication_processing": "משכפל את השיחה...",
   "com_ui_duplication_success": "השיחה שוכפלה בהצלחה",
   "com_ui_edit": "ערוך",
   "com_ui_edit_editing_image": "עורך את התמונה",
   "com_ui_edit_mcp_server": "עריכת שרת MCP",
+  "com_ui_edit_mcp_server_dialog_description": "מזהה שרת ייחודי: {{serverName}}",
   "com_ui_edit_memory": "ערוך זכרון",
+  "com_ui_edit_preset_title": "עריכת הגדרה קבועה מראש - {{title}}",
+  "com_ui_edit_prompt_page": "ערוך דף הנחיה (פרומפט)",
+  "com_ui_edit_skill": "ערוך מיומנות (Skill)",
+  "com_ui_editable_message": "הודעה ניתנת לעריכה",
   "com_ui_editor_instructions": "גרור את התמונה כדי למקם אותה מחדש • השתמש במחוון הזום או בלחצנים כדי להתאים את הגודל",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "נקודת קצה",
   "com_ui_endpoint_menu": "תפריט נקודת קצה LLM",
   "com_ui_enter": "Enter",
   "com_ui_enter_api_key": "הכנס מפתח API",
+  "com_ui_enter_description": "הזן תיאור (אופציונלי)",
   "com_ui_enter_key": "מקש Enter",
+  "com_ui_enter_name": "הזן שם",
   "com_ui_enter_openapi_schema": "הזן כאן את סכימת OpenAPI שלך",
   "com_ui_enter_value": "הזן ערך",
   "com_ui_error": "שגיאה",
   "com_ui_error_connection": "שגיאה בחיבור לשרת, נסה לרענן את הדף",
+  "com_ui_error_message_prefix": "הודעת שגיאה:",
   "com_ui_error_save_admin_settings": "אירעה שגיאה בשמירת הגדרות הניהול שלך",
+  "com_ui_error_try_following_prefix": "אנא נסה אחת מהאפשרויות הבאות",
+  "com_ui_error_unexpected": "אופס! אירעה שגיאה בלתי צפויה",
   "com_ui_error_updating_preferences": "אירעה שגיאה בעדכון העדפות",
   "com_ui_everyone_permission_level": "רמת ההרשאה של כולם",
   "com_ui_examples": "דוגמאות",
+  "com_ui_expand": "הרחב",
   "com_ui_expand_chat": "הרחב צ'אט",
+  "com_ui_expand_thoughts": "הרחב את המחשבות",
   "com_ui_export_convo_modal": "חלון ייצוא שיחה",
+  "com_ui_failed": "נכשל",
+  "com_ui_favorite": "הוסף למועדפים",
+  "com_ui_favorites": "מועדפים",
   "com_ui_feedback_more": "יותר...",
   "com_ui_feedback_more_information": "ספק משוב נוסף",
   "com_ui_feedback_negative": "טעון שיפור",
@@ -852,13 +1034,17 @@
   "com_ui_feedback_tag_unjustified_refusal": "סורב ללא סיבה",
   "com_ui_field_max_length": "{{field}} חייב להיות קצר מ-{{length}} תווים",
   "com_ui_field_required": "שדה זה נדרש",
+  "com_ui_file": "קובץ",
   "com_ui_file_input_avatar_label": "קובץ קלט לאווטאר",
+  "com_ui_file_modified": "תאריך שינוי",
   "com_ui_file_size": "גודל הקובץ",
   "com_ui_file_token_limit": "מגבלת טוקנים לקובץ",
   "com_ui_file_token_limit_desc": "הגדר מגבלת טוקנים מקסימלית לעיבוד קבצים כדי לשלוט בעלויות ובשימוש במשאבים",
   "com_ui_files": "קבצים",
+  "com_ui_filter_mcp_servers": "סנן שרתי MCP לפי שם",
   "com_ui_filter_prompts": "סינון הנחיות (פרומפטים)",
   "com_ui_filter_prompts_name": "סינון הנחיות (פרומפטים) לפי שם",
+  "com_ui_filter_skills_name": "סנן מיומניות (skills) לפי שם",
   "com_ui_final_touch": "גימור סופי",
   "com_ui_finance": "פיננסי",
   "com_ui_fork": "הסתעפות",
@@ -880,6 +1066,7 @@
   "com_ui_fork_info_visible": "אפשרות זו תיצור הסתעפות רק של ההודעות הגלויות; במילים אחרות, רק את המסלול הישיר להודעת היעד, ללא הסתעפויות נוספות.",
   "com_ui_fork_more_details_about": "הצג מידע ופרטים נוספים על אפשרות פורק \"{{0}}\"",
   "com_ui_fork_more_info_options": "הצג הסבר מפורט על כל אפשרויות המזלג והתנהגויותיהן",
+  "com_ui_fork_open_menu": "פתח את תפריט הפיצול (Fork)",
   "com_ui_fork_processing": "יוצר הסתעפות בשיחה...",
   "com_ui_fork_remember": "זכור",
   "com_ui_fork_remember_checked": "הבחירה שלך תישמר אחרי השימוש. תוכל לשנות זאת בכל זמן בהגדרות.",
@@ -889,6 +1076,7 @@
   "com_ui_fork_visible": "הודעות גלויות בלבד",
   "com_ui_generate_qrcode": "צור קוד QR",
   "com_ui_generating": "יוצר...",
+  "com_ui_generating_image": "יוצר תמונה...",
   "com_ui_generation_settings": "הגדרות יצירה",
   "com_ui_getting_started": "תחילת העבודה",
   "com_ui_go_back": "חזור",
@@ -897,9 +1085,13 @@
   "com_ui_good_evening": "ערב טוב",
   "com_ui_good_morning": "בוקר טוב",
   "com_ui_group": "קבוצה",
+  "com_ui_handoff_instructions": "הוראות העברה",
   "com_ui_happy_birthday": "זה יום ההולדת הראשון שלי!",
+  "com_ui_header_format": "פורמט כותרת",
+  "com_ui_hide": "הסתר",
+  "com_ui_hide_code": "הסתר קוד",
   "com_ui_hide_image_details": "הסתר פרטי תמונה",
-  "com_ui_hide_password": "הסתר סיסמה",
+  "com_ui_hide_n_files": "הסתר {{0}} קבצים",
   "com_ui_hide_qr": "הסתר קוד QR",
   "com_ui_high": "גבוה",
   "com_ui_host": "מארח",
@@ -909,40 +1101,95 @@
   "com_ui_image_details": "פרטי התמונה",
   "com_ui_image_edited": "התמונה נערכה",
   "com_ui_image_gen": "מחולל תמונות",
+  "com_ui_image_gen_failed": "יצירת התמונה נכשלה",
   "com_ui_import": "ייבוא",
   "com_ui_import_conversation_error": "אירעה שגיאה בעת ייבוא השיחות שלך",
   "com_ui_import_conversation_file_type_error": "סוג ייבוא לא נתמך",
   "com_ui_import_conversation_info": "ייבא שיחות מקובץ JSON",
   "com_ui_import_conversation_success": "השיחות יובאו בהצלחה",
   "com_ui_import_conversation_upload_error": "שגיאה בהעלאת הקובץ. אנא נסה שוב.",
+  "com_ui_importing": "מייבא",
   "com_ui_include_shadcnui": "יש לכלול הוראות לשימוש ברכיבי ממשק המשתמש של shadcn/ui",
   "com_ui_initializing": "מאתחל...",
   "com_ui_input": "קלט",
   "com_ui_instructions": "הוראות",
+  "com_ui_invocation_auto": "אוטומטי",
+  "com_ui_invocation_auto_info": "המיומנות (skill) מופעלת אוטומטית על ידי הסוכן כאשר היא רלוונטית לשיחה",
+  "com_ui_invocation_both": "שניהם",
+  "com_ui_invocation_both_info": "המיומנות (skill) יכולה להיות מופעלת אוטומטית או ידנית על ידי המשתמש",
+  "com_ui_invocation_manual": "ידני",
+  "com_ui_invocation_manual_info": "המיומנות (skill) משמשת רק כאשר המשתמש מפעיל אותה במפורש",
+  "com_ui_invocation_mode": "מצב הפעלה",
+  "com_ui_invoked_by": "הופעל על ידי",
   "com_ui_key": "מפתח",
   "com_ui_key_required": "נדרש מפתח API",
+  "com_ui_labels": "תוויות",
   "com_ui_late_night": "לילה טוב",
+  "com_ui_latest": "העדכני ביותר",
   "com_ui_latest_footer": "גישה לכל הבינות המלאכותיות (AI) לכולם",
   "com_ui_latest_version": "גרסה אחרונה",
+  "com_ui_leave_blank_to_keep": "השאר ריק כדי לשמור את הערך הקיים",
+  "com_ui_light_theme_enabled": "ערכת נושא בהירה מופעלת",
+  "com_ui_line_count": "שורה {0}",
+  "com_ui_lines_count": "{0} שורות",
+  "com_ui_link_copied": "הקישור הועתק",
+  "com_ui_link_refreshed": "הקישור עודכן",
+  "com_ui_live": "פעיל",
   "com_ui_loading": "טוען...",
   "com_ui_locked": "נעול",
   "com_ui_logo": "\"לוגו {{0}}\"",
   "com_ui_low": "נמוך",
+  "com_ui_make_production": "העבר לייצור",
   "com_ui_manage": "נהל",
   "com_ui_marketplace": "מרכז הסוכנים",
   "com_ui_marketplace_allow_use": "אפשר שימוש במרכז הסוכנים",
+  "com_ui_max": "מקסימום",
+  "com_ui_max_favorites_reached": "הגעת למגבלת הפריטים המוצמדים ({{0}}). הסר הצמדה מפריט כדי להוסיף עוד.",
   "com_ui_max_file_size": "PNG, JPG או JPEG (מקסימום {{0}})",
   "com_ui_max_tags": "המספר המקסימלי המותר על פי הערכים העדכניים הוא {{0}}.",
   "com_ui_mcp_authenticated_success": "{{0}} שרתי MCP אומתו בהצלחה",
+  "com_ui_mcp_click_to_defer": "לחץ כדי לדחות את הטעינה – הכלי יהיה נגיש דרך החיפוש אך לא ייטען עד שיידרש",
+  "com_ui_mcp_click_to_programmatic": "אפשר קריאה פרוגרמטית – הכלי יופעל רק באמצעות הרצת קוד",
   "com_ui_mcp_configure_server": "הגדר את {{0}}",
   "com_ui_mcp_configure_server_description": "הגדר משתנים מותאמים אישית עבור {{0}}",
+  "com_ui_mcp_defer": "דחה",
+  "com_ui_mcp_defer_all": "דחה את כל הכלים",
+  "com_ui_mcp_defer_loading": "דחה את הטעינה",
+  "com_ui_mcp_dialog_title": "הגדר משתנים עבור {{serverName}}. סטטוס שרת: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "הדומיין של שרת ה-MCP אינו ברשימת הדומיינים המורשים. אנא פנה למנהל המערכת.",
   "com_ui_mcp_enter_var": "הזן ערך עבור {{0}}",
   "com_ui_mcp_init_failed": "אתחול שרת MCP נכשל",
   "com_ui_mcp_initialize": "אתחול",
   "com_ui_mcp_initialized_success": "{{0}} שרתי MCP אותחלו בהצלחה",
+  "com_ui_mcp_invalid_url": "אנא הזן כתובת URL תקינה",
+  "com_ui_mcp_no_description": "אין תיאור זמין",
   "com_ui_mcp_oauth_cancelled": "התחברות באמצעות OAuth בוטלה עבור {{0}}",
   "com_ui_mcp_oauth_timeout": "תם הזמן שהוקצב להתחברות OAuth עבור {{0}}",
+  "com_ui_mcp_programmatic": "פרוגרמטי",
+  "com_ui_mcp_programmatic_all": "סמן הכל כפרוגרמטי",
+  "com_ui_mcp_server": "שרת MCP",
+  "com_ui_mcp_server_connection_failed": "ניסיון החיבור לשרת ה-MCP נכשל. אנא ודא שכתובת ה-URL, סוג השרת וכל הגדרות האימות נכונות, ונסה שוב. כמו כן, ודא שכתובת ה-URL נגישה.",
+  "com_ui_mcp_server_created": "שרת ה-MCP נוצר בהצלחה",
+  "com_ui_mcp_server_delete_confirm": "אתה בטוח שברצונך למחוק את שרת ה-MCP הזה?",
+  "com_ui_mcp_server_deleted": "שרת ה-MCP נמחק בהצלחה",
+  "com_ui_mcp_server_role_editor": "עורך שרת MCP",
+  "com_ui_mcp_server_role_editor_desc": "יכול לצפות, להשתמש ולערוך שרתי MCP",
+  "com_ui_mcp_server_role_owner": "בעלים של שרת MCP",
+  "com_ui_mcp_server_role_owner_desc": "שליטה מלאה על שרתי MCP",
+  "com_ui_mcp_server_role_viewer": "צופה בשרת MCP",
+  "com_ui_mcp_server_role_viewer_desc": "יכול לצפות ולהשתמש בשרתי MCP",
+  "com_ui_mcp_server_updated": "שרת ה-MCP עודכן בהצלחה",
   "com_ui_mcp_servers": "שרתי MCP",
+  "com_ui_mcp_servers_allow_create": "אפשר למשתמשים ליצור שרתי MCP",
+  "com_ui_mcp_servers_allow_share": "אפשר למשתמשים לשתף שרתי MCP",
+  "com_ui_mcp_servers_allow_share_public": "אפשר למשתמשים לשתף שרתי MCP באופן ציבור",
+  "com_ui_mcp_servers_allow_use": "אפשר למשתמשים להשתמש בשרתי MCP",
+  "com_ui_mcp_title_invalid": "הכותרת יכולה להכיל רק אותיות, מספרים ורווחים",
+  "com_ui_mcp_tool_options": "אפשרויות הכלי",
+  "com_ui_mcp_transport": "תעבורה",
+  "com_ui_mcp_undefer": "בטל את דחיית הטעינה",
+  "com_ui_mcp_undefer_all": "בטל את דחיית הטעינה של כל הכלים",
+  "com_ui_mcp_unprogrammatic_all": "בטל את הסימון של הכול כפרוגרמטי",
   "com_ui_mcp_update_var": "עדכון {{0}}",
   "com_ui_mcp_url": "קישור לשרת ה-MCP",
   "com_ui_medium": "בינוני",
@@ -960,34 +1207,61 @@
   "com_ui_memory_deleted_items": "זכרונות שנמחקו",
   "com_ui_memory_error": "שגיאת זיכרון",
   "com_ui_memory_key_exists": "זיכרון עם מפתח זה כבר קיים. אנא השתמש במפתח אחר.",
+  "com_ui_memory_key_hint": "השתמש באותיות קטנות ובקווים תחתונים בלבד",
   "com_ui_memory_key_validation": "מפתח הזיכרון חייב להכיל רק אותיות קטנות או קו תחתון.",
   "com_ui_memory_storage_full": "אחסון הזיכרונות מלא",
   "com_ui_memory_updated": "זיכרון שמור מעודכן",
   "com_ui_memory_updated_items": "זיכרונות מעודכנים",
   "com_ui_memory_would_exceed": "לא ניתן לשמור - זה יעבור את המגבלה ב-{{tokens}} אסימונים. מחק זיכרונות קיימים כדי לפנות מקום לזיכרונות חדשים.",
   "com_ui_mention": "ציין נקודת קצה, סייען, או הנחייה (פרופמט) כדי לעבור אליה במהירות",
+  "com_ui_mermaid_failed": "עיבוד התרשים נכשל:",
+  "com_ui_mermaid_source": "קוד מקור:",
+  "com_ui_message_input": "שדה הקלדת הודעה",
+  "com_ui_message_nav": "ניווט בין הודעות",
+  "com_ui_message_nav_go_to_assistant": "עבור להודעת העוזר: {{0}}",
+  "com_ui_message_nav_go_to_user": "עבור להודעת המשתמש: {{0}}\t",
+  "com_ui_message_nav_next": "עבור להודעה הבאה",
+  "com_ui_message_nav_previous": "עבור להודעה הקודמת",
+  "com_ui_microphone_unavailable": "המיקרופון אינו זמין",
   "com_ui_min_tags": "לא ניתן למחוק ערכים נוספים, יש צורך במינימום {{0}} ערכים.",
   "com_ui_minimal": "מינימלי",
   "com_ui_misc": "כללי",
   "com_ui_model": "דגם",
   "com_ui_model_parameters": "הגדרות המודל",
+  "com_ui_model_parameters_reset": "פרמטרי המודל אופסו.",
+  "com_ui_model_selected": "{{0}} נבחרו",
+  "com_ui_model_spec": "מפרט המודל",
   "com_ui_more_info": "מידע נוסף",
   "com_ui_my_prompts": "ההנחיות (פרומפטים) שלי",
+  "com_ui_my_skills": "המיומניות (Skills) שלי",
+  "com_ui_n_files": "{{0}} קבצים",
   "com_ui_name": "שם",
+  "com_ui_name_sort": "מיין לפי שם",
+  "com_ui_navigate_results": "ניווט בין תוצאות",
   "com_ui_new": "חדש",
   "com_ui_new_chat": "שיחה חדשה",
   "com_ui_new_conversation_title": "כותרת חדשה לצ'אט",
   "com_ui_next": "הבא",
+  "com_ui_next_result": "התוצאה הבאה",
   "com_ui_no": "לא",
+  "com_ui_no_auth": "ללא (זיהוי אוטומטי)",
   "com_ui_no_bookmarks": "עדיין אין לך סימניות. בחר שיחה והוסף סימניה חדשה",
+  "com_ui_no_bookmarks_match": "לא נמצאו סימניות התואמות את החיפוש",
+  "com_ui_no_bookmarks_title": "אין סימניות עדיין",
   "com_ui_no_categories": "אין קטגוריות זמינות",
   "com_ui_no_category": "אין קטגוריה",
   "com_ui_no_changes": "לא בוצע שום שינוי",
   "com_ui_no_individual_access": "אין גישה לסוכן זה למשתמשים או לקבוצות בודדות",
+  "com_ui_no_labels": "אין תוויות",
+  "com_ui_no_mcp_servers": "אין שרתי MCP עדיין",
+  "com_ui_no_mcp_servers_match": "לא נמצאו שרתי MCP התואמים את הסינון",
   "com_ui_no_memories": "אין זיכרונות. ניתן ליצור אותם ידנית או לבקש מה-AI לזכור משהו",
-  "com_ui_no_personalization_available": "אין אפשרויות התאמה אישית זמינות כרגע",
+  "com_ui_no_memories_match": "לא נמצאו זיכרונות התואמים את החיפוש",
+  "com_ui_no_memories_title": "אין זכרונות עדיין",
+  "com_ui_no_prompts_title": "אין הנחיות (prompts) עדיין",
   "com_ui_no_read_access": "אין לך הרשאה לצפות בזיכרונות",
   "com_ui_no_results_found": "לא נמצאו תוצאות",
+  "com_ui_no_skills_found": "לא נמצאו מיומניות (skills)",
   "com_ui_no_terms_content": "אין תוכן תנאים והגבלות להצגה",
   "com_ui_none": "אף אחד",
   "com_ui_not_used": "לא בשימוש",
@@ -1005,10 +1279,19 @@
   "com_ui_of": "של",
   "com_ui_off": "של",
   "com_ui_offline": "לא מקוון",
+  "com_ui_omitted": "לא כלול",
   "com_ui_on": "פעיל",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (נפתח בלשונית חדשה)",
+  "com_ui_open_source_chat_new_tab": "פתח את הצ'אט המקורי בלשונית חדשה",
+  "com_ui_open_source_chat_new_tab_title": "פתח את הצ'אט המקורי בלשונית חדשה - {{title}}",
+  "com_ui_open_var": "פתח את {{0}}",
   "com_ui_openai": "אופן אֵי-אַיי (OpenAI)",
   "com_ui_optional": "(אופציונלי)",
+  "com_ui_options": "אפשרויות",
+  "com_ui_output": "פלט",
   "com_ui_page": "עמוד",
+  "com_ui_pagination": "עימוד",
+  "com_ui_parameters": "פרמטרים",
   "com_ui_people": "אנשים",
   "com_ui_people_picker": "בורר אנשים",
   "com_ui_people_picker_allow_view_groups": "אפשר צפייה בקבוצות",
@@ -1017,36 +1300,75 @@
   "com_ui_permissions_failed_load": "טעינת ההרשאות נכשלה. אנא נסה שוב",
   "com_ui_permissions_failed_update": "עדכון ההרשאות נכשל. אנא נסה שוב",
   "com_ui_permissions_updated_success": "ההרשאות עודכנו בהצלחה",
+  "com_ui_pin": "הצמד",
+  "com_ui_plus_n_more": "+{{0}} נוספים",
   "com_ui_preferences_updated": "ההעדפות עודכנו בהצלחה",
   "com_ui_prev": "הקודם",
+  "com_ui_prev_result": "התוצאה הקודמת",
   "com_ui_preview": "תצוגה מקדימה",
+  "com_ui_preview_failed": "התצוגה המקדימה אינה זמינה",
+  "com_ui_preview_preparing": "מכין את התצוגה המקדימה...",
+  "com_ui_preview_unavailable": "התצוגה המקדימה אינה זמינה עבור סוג קובץ זה",
   "com_ui_privacy_policy": "מדיניות פרטיות",
   "com_ui_privacy_policy_url": "קישור למדיניות הפרטיות",
+  "com_ui_production": "ייצור",
   "com_ui_prompt": "הנחיה (פרומפט)",
+  "com_ui_prompt_category_selector_aria": "בחירת קטגוריה להנחיה (פרומפט)",
+  "com_ui_prompt_delete_confirm": "האם אתה בטוח שברצונך למחוק את ההנחיה (פרומפט) '{{0}}'?",
+  "com_ui_prompt_delete_error": "אירעה שגיאה במחיקת ההנחיה (פרומפט)",
+  "com_ui_prompt_deleted_group": "קבוצת ההנחיות (פרומפטים) \"{{0}}\" נמחקה",
+  "com_ui_prompt_details": "פרטי הפרומפט {{name}}",
+  "com_ui_prompt_group_button": "פרומפט {{name}}, קטגוריה {{category}}",
+  "com_ui_prompt_group_button_no_category": "פרומפט {{name}}",
   "com_ui_prompt_groups": "רשימת קבוצות הנחיות (פרומפטים)",
+  "com_ui_prompt_input": "שדה הזנת הפרומפט",
+  "com_ui_prompt_input_field": "שדה הזנת טקסט לפרומפט",
   "com_ui_prompt_name": "שם הנחיה (פרומפט)",
   "com_ui_prompt_name_required": "נדרש שם הנחיה (פרומפט)",
   "com_ui_prompt_preview_not_shared": "היוצר לא אפשר שיתוף פעולה להנחיה זו",
   "com_ui_prompt_text": "טקסט",
   "com_ui_prompt_text_required": "נדרש טקסט",
   "com_ui_prompt_update_error": "אירעה שגיאה בעדכון ההנחיה (פרומפט)",
+  "com_ui_prompt_variables_list": "רשימת משתני הפרומפט",
   "com_ui_prompts": "הנחיות (פרומפטים)",
   "com_ui_prompts_allow_create": "אפשר יצירת הנחיות",
   "com_ui_prompts_allow_share": "אפשר שיתוף הנחיות",
+  "com_ui_prompts_allow_share_public": "אפשר שיתוף פרומפטים באופן ציבורי",
   "com_ui_prompts_allow_use": "אפשר שימוש בהנחיות (פרומפטים)",
   "com_ui_provider": "ספק",
   "com_ui_quality": "איכות",
+  "com_ui_ran_n_agents": "הריץ {{0}} סוכנים",
   "com_ui_read_aloud": "הקראה",
+  "com_ui_read_file": "קרא את {{0}}",
+  "com_ui_reading_file": "קורא את {{0}}",
+  "com_ui_redirect_uri": "כתובת הפניה מחדש (Redirect URI)",
+  "com_ui_redirect_uri_instructions": "העתק את ה־URI להפניה מחדש והגדר אותו בהגדרות ספק ה־OAuth שלך.",
   "com_ui_redirecting_to_provider": "מבצע הפניה ל-{{0}}, אנא המתן...",
   "com_ui_reference_saved_memories": "הפניה לזכרונות שמורים",
   "com_ui_reference_saved_memories_description": "אפשר לסוכן להתייחס ולהשתמש בזיכרונות השמורים שלך בעת התגובה",
   "com_ui_refresh": "רענן",
   "com_ui_refresh_link": "רענון קישור",
+  "com_ui_refresh_page": "רענן עמוד",
   "com_ui_regenerate": "לחדש",
   "com_ui_regenerate_backup": "צור קודי גיבוי מחדש",
   "com_ui_regenerating": "יוצר מחדש...",
   "com_ui_region": "איזור",
   "com_ui_reinitialize": "אתחול מחדש",
+  "com_ui_relevance": "רלוונטיות",
+  "com_ui_remote_access": "גישה מרחוק",
+  "com_ui_remote_agent_role_editor": "עורך",
+  "com_ui_remote_agent_role_editor_desc": "יכול לצפות ולשנות את הסוכן דרך API",
+  "com_ui_remote_agent_role_owner": "הבעלים של ה-API",
+  "com_ui_remote_agent_role_owner_desc": "גישת API מלאה ויכולת להעניק גישה מרחוק לאחרים",
+  "com_ui_remote_agent_role_viewer": "צופה ב-API",
+  "com_ui_remote_agent_role_viewer_desc": "יכול לשלוח שאילתות לסוכן דרך API",
+  "com_ui_remote_agents": "סוכנים מרוחקים (API)",
+  "com_ui_remote_agents_allow_create": "אפשר למשתמשים ליצור סוכנים דרך API",
+  "com_ui_remote_agents_allow_share": "אפשר למשתמשים להעניק גישת API לסוכנים לאחרים",
+  "com_ui_remote_agents_allow_share_public": "אפשר למשתמשים להעניק גישת API לסוכנים לכלל המשתמשים",
+  "com_ui_remote_agents_allow_use": "אפשר למשתמשים ליצור מפתחות API ולשלוח שאילתות לסוכנים מרחוק",
+  "com_ui_remove_agent_from_chain": "הסר את {{0}} מהשרשור",
+  "com_ui_remove_skill_var": "הסר את {{0}}",
   "com_ui_remove_user": "הסר את {{0}}",
   "com_ui_rename": "שנה שם",
   "com_ui_rename_conversation": "החלפת שם הצ'אט",
@@ -1057,7 +1379,11 @@
   "com_ui_reset_var": "איפוס {{0}}",
   "com_ui_reset_zoom": "איפוס זום",
   "com_ui_resource": "משאב",
+  "com_ui_response": "תגובה",
   "com_ui_result": "תוצאה",
+  "com_ui_results_found": "נמצאו {{count}} תגובות",
+  "com_ui_retrieved_files": "חיפש בקבצים שלך",
+  "com_ui_retry": "נסה שנית",
   "com_ui_revoke": "בטל",
   "com_ui_revoke_info": "בטל את כל האישורים שסופקו על ידי המשתמש",
   "com_ui_revoke_key_confirm": "האם אתה בטוח שברצונך לבטל את המפתח הזה?",
@@ -1081,6 +1407,9 @@
   "com_ui_rotate_90": "סיבוב ב-90 מעלות",
   "com_ui_run_code": "הרץ קוד",
   "com_ui_run_code_error": "אירעה שגיאה בהרצת הקוד",
+  "com_ui_running": "רץ...",
+  "com_ui_running_command": "מריץ פקודה",
+  "com_ui_running_n_agents": "מריץ {{0}} סוכנים",
   "com_ui_save": "שמור",
   "com_ui_save_badge_changes": "האם לשמור את השינויים בתגים?",
   "com_ui_save_changes": "שמור שינויים",
@@ -1091,6 +1420,7 @@
   "com_ui_saving": "שומר...",
   "com_ui_schema": "סכמה",
   "com_ui_scope": "תחום",
+  "com_ui_scroll_to_bottom": "גלול לתחתית",
   "com_ui_search": "חיפוש",
   "com_ui_search_above_to_add": "חפש למעלה כדי להוסיף משתמשים או קבוצות",
   "com_ui_search_above_to_add_all": "חפש למעלה כדי להוסיף משתמשים, קבוצות או תפקידים",
@@ -1098,9 +1428,14 @@
   "com_ui_search_agent_category": "חיפוש קטגוריות...",
   "com_ui_search_default_placeholder": "חיפוש לפי שם או דוא\"ל (מינימום 2 תווים)",
   "com_ui_search_people_placeholder": "חיפוש אנשים או קבוצות לפי שם או דוא\"ל",
+  "com_ui_search_result_count": "נמצאה תוצאה {{count}}",
+  "com_ui_search_results_count": "נמצאו {{count}} תוצאות",
+  "com_ui_search_skills": "חפס מיומניות (Skills)...",
+  "com_ui_searching_files": "\tמחפש בקבצים שלך",
   "com_ui_seconds": "שניות",
   "com_ui_secret_key": "מפתח סודי",
   "com_ui_select": "בחר",
+  "com_ui_select_agent": "בחר סוכן",
   "com_ui_select_all": "בחר הכל",
   "com_ui_select_file": "בחר קובץ",
   "com_ui_select_model": "בחר מודל",
@@ -1109,6 +1444,7 @@
   "com_ui_select_provider": "בחר ספק",
   "com_ui_select_provider_first": "ראשית בחר ספק",
   "com_ui_select_region": "בחר איזור",
+  "com_ui_select_row": "בחר שורה",
   "com_ui_select_search_model": "חפש מודל לפי שם",
   "com_ui_select_search_provider": "חפש ספק לפי שם",
   "com_ui_select_search_region": "חפש איזור לפי שם",
@@ -1120,28 +1456,134 @@
   "com_ui_share_everyone": "שתף עם כולם",
   "com_ui_share_everyone_description_var": "{{resource}} זה יהיה זמין לכולם. אנא ודא שה-{{resource}} באמת נועד להיות משותף עם כולם. היזהר עם הנתונים שלך.",
   "com_ui_share_link_to_chat": "שתף קישור בצ'אט",
+  "com_ui_share_qr_code_description": "קוד QR לשיתוף קישור לשיחה זו",
   "com_ui_share_update_message": "השם שלך, ההוראות המותאמות אישית וכל ההודעות שתוסיף לאחר השיתוף יישארו פרטיים.",
   "com_ui_share_var": "שתף {{0}}",
   "com_ui_shared_link_delete_success": "הקישור המשותף נמחק בהצלחה",
   "com_ui_shared_link_not_found": "הקישור המשותף לא נמצא",
   "com_ui_shared_prompts": "הנחיות (פרומפטים) משותפות",
   "com_ui_shop": "קניות",
+  "com_ui_show": "הצג",
   "com_ui_show_all": "הראה הכל",
+  "com_ui_show_code": "הצג קוד",
   "com_ui_show_image_details": "הצג את פרטי התמונה",
-  "com_ui_show_password": "הראה סיסמה",
+  "com_ui_show_less": "הצג פחות",
+  "com_ui_show_more": "הצג יותר",
+  "com_ui_show_n_files": "הצג {{0}} קבצים",
   "com_ui_show_qr": "הראה קוד QR",
   "com_ui_sign_in_to_domain": "היכנס אל {{0}}",
-  "com_ui_simple": "פשוט",
   "com_ui_size": "סוג",
+  "com_ui_size_sort": "מיין לפי גודל",
+  "com_ui_skill": "מיומנות (skill)",
+  "com_ui_skill_content": "תוכן המיומנות (skill)",
+  "com_ui_skill_content_placeholder": "הזן את הוראות המיומנות (skill) בפורמט מרקדאון...",
+  "com_ui_skill_create_error": "יצירת המיומנות (skill) נכשלה",
+  "com_ui_skill_create_title": "צור מיומנות (skill)",
+  "com_ui_skill_created": "המיומנות (skill) נוצרה",
+  "com_ui_skill_delete_confirm": "האם אתה בטוח שברצונך למחוק את \"{{0}}\"? לא ניתן לבטל פעולה זו.",
+  "com_ui_skill_delete_error": "מחיקת המיומנות (skill) נכשלה",
+  "com_ui_skill_deleted": "המיומנות (skill) נמחקה",
+  "com_ui_skill_description_field_hint": "תהיה ספציפי לגבי מתי המיומנות (skill) זו אמורה להיות מופעלת.",
+  "com_ui_skill_description_placeholder": "החל את הנחיות המיתוג של Acme Corp על מצגות ומסמכים...",
+  "com_ui_skill_description_required": "תיאור הוא שדה חובה",
+  "com_ui_skill_description_too_long": "התיאור לא יעלה על {{0}} תווים",
+  "com_ui_skill_edit_title": "ערוך מיומנות (skill)",
+  "com_ui_skill_file_binary": "קובץ בינארי — לא ניתן להציג תצוגה מקדימה",
+  "com_ui_skill_file_download": "הורדה",
+  "com_ui_skill_file_load_error": "טעינת תוכן הקובץ נכשלה",
+  "com_ui_skill_finished": "הרץ את {{0}}",
+  "com_ui_skill_instructions": "הוראות",
+  "com_ui_skill_instructions_placeholder": "הזן את הוראות המיומנות (skill) בפורמט מרקדאון...",
+  "com_ui_skill_name_invalid": "השתמש באותיות קטנות, ספרות ומקפים בלבד (kebab-case)",
+  "com_ui_skill_name_placeholder": "brand-guidelines",
+  "com_ui_skill_name_required": "שם הוא שדה חובה",
+  "com_ui_skill_name_too_long": "השם לא יעלה על {{0}} תווים",
+  "com_ui_skill_new_file": "קובץ חדש",
+  "com_ui_skill_new_folder": "תיקייה חדשה",
+  "com_ui_skill_no_edit_permission": "אין לך הרשאה לערוך את המיומנות (skill) הזו",
+  "com_ui_skill_no_selection": "בחר מיומנות (skill)",
+  "com_ui_skill_no_selection_desc": "בחר מיומנות (skill) מסרגל הצד כדי לצפות בפרטים שלה.",
+  "com_ui_skill_not_found": "המיומנות (skill) לא נמצאה",
+  "com_ui_skill_not_found_description": "ייתכן שהיא נמחקה או שאין לך גישה אליה יותר.",
+  "com_ui_skill_role_editor_desc": "יכול לצפות ולערוך את המיומנות (skill)",
+  "com_ui_skill_role_owner_desc": "שליטה מלאה במיומנות (skill) כולל שיתוף ומחיקה",
+  "com_ui_skill_role_viewer_desc": "יכול לצפות ולהשתמש במיומנות (skill) אך לא לערוך אותה",
+  "com_ui_skill_running": "מריץ את {{0}}",
+  "com_ui_skill_sr_public": "מיומנות (skill) ציבורית",
+  "com_ui_skill_states_limit": "הגעת למגבלה של {{0}} עקיפות מיומניות (skills) פעילות/לא פעילות. הסר חלק מהעקיפות כדי להפעיל או לכבות מיומניות נוספות.",
+  "com_ui_skill_toggle_active": "שנה את מצב הפעילות של המיומנות (skill)",
+  "com_ui_skill_update_conflict": "עריכה אחרת נשמרה לפני העריכה שלך. טוען את הגרסה העדכנית.",
+  "com_ui_skill_update_error": "שמירת המיומנות (skill) נכשלה",
+  "com_ui_skill_updated": "המיומנות (skill) נשמרה",
+  "com_ui_skill_upload": "העלה מיומנות (skill)",
+  "com_ui_skill_upload_drag": "גרור ושחרר או לחץ להעלאה",
+  "com_ui_skill_upload_file": "העלה קובץ",
+  "com_ui_skill_upload_req_md": "קובץ ‎.md חייב להכיל שם ותיאור של המיומנות (skill) בפורמט YAML",
+  "com_ui_skill_upload_req_size": "גודל הקובץ לא יעלה על {{0}} MB",
+  "com_ui_skill_upload_req_zip": "קובץ ‎.zip או ‎.skill חייב לכלול קובץ SKILL.md",
+  "com_ui_skill_upload_requirements": "דרישות קובץ",
+  "com_ui_skill_upload_size_error": "ייבוא מיומנות (skill) לא יעלה על {{0}} MB",
+  "com_ui_skill_upload_title": "העלה מיומנות (skill)",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "הצג אחרי עיבוד",
+  "com_ui_skill_view_source": "הצג מקור",
+  "com_ui_skill_warnings": "שים לב",
+  "com_ui_skill_write_instructions": "כתוב את הוראות המיומנות (skill)",
+  "com_ui_skills": "מיומניות (Skills)",
+  "com_ui_skills_allow_create": "אפשר יצירת מיומניות (Skills)",
+  "com_ui_skills_allow_share": "אפשר שיתוף מיומניות (Skills)",
+  "com_ui_skills_allow_share_public": "אפשר שיתוף מיומניות (Skills) באופן ציבורי",
+  "com_ui_skills_allow_use": "אפשר שימוש במיומניות (Skills)",
+  "com_ui_skills_always_apply_invoked": "מיומניות (skills) המוחלות אוטומטית",
+  "com_ui_skills_always_apply_pin_title": "מיומנות (skill) המוחלת תמיד (מופעלת אוטומטית בכל תור)",
+  "com_ui_skills_command_placeholder": "בחר מיומנות (Skill) לפי שם",
+  "com_ui_skills_disabled_hint": "המיומניות (Skills) מושבתות עבור סוכן זה. הפעל כדי לאפשר למודל להשתמש בקטלוג המיומניות (Skills) שלך.",
+  "com_ui_skills_empty": "אין עדיין מיומניות (Skills)",
+  "com_ui_skills_enable_toggle": "הפעל את המיומניות (skills) עבור הסוכן הזה",
+  "com_ui_skills_enabled_all_hint": "מופעל. הקטלוג המלא זמין; צמצם למטה אם ברצונך להגביל באילו מיומניות (skills) הסוכן הזה יוכל להשתמש.",
+  "com_ui_skills_enabled_allowlist_hint": "מופעל. מוגבל למיומניות (skills) שנבחרו מקודם.",
+  "com_ui_skills_load_error": "טעינת המיומניות (skills) נכשלה",
+  "com_ui_skills_manual_invoked": "מיומניות (skills) שהופעלו ידנית",
+  "com_ui_skills_queued": "המיומניות (Skills) בהמתנה לשליחה הבאה",
+  "com_ui_special": "מיוחד",
   "com_ui_special_var_current_date": "תאריך נוכחי",
   "com_ui_special_var_current_datetime": "תאריך ושעה נוכחיים",
   "com_ui_special_var_current_user": "משתמש נוכחי",
+  "com_ui_special_var_desc_current_date": "התאריך והיום בשבוע הנוכחיים",
+  "com_ui_special_var_desc_current_datetime": "התאריך והשעה המקומיים לפי אזור הזמן שלך",
+  "com_ui_special_var_desc_current_user": "שם התצוגה של החשבון שלך",
+  "com_ui_special_var_desc_iso_datetime": "תאריך ושעה UTC בפורמט ISO 8601",
   "com_ui_special_var_iso_datetime": "תאריך ושעה ISO UTC",
-  "com_ui_special_variables": "משתנים מיוחדים:",
+  "com_ui_special_variable_added": "נוסף משתנה מיוחד {{0}}.",
+  "com_ui_special_variables": "משתנים מיוחדים",
+  "com_ui_speech_not_supported": "הדפדפן שלך אינו תומך בזיהוי דיבור",
+  "com_ui_speech_not_supported_use_external": "הדפדפן שלך אינו תומך בזיהוי דיבור. נסה לעבור ל־STT חיצוני בהגדרות > דיבור.",
   "com_ui_speech_while_submitting": "לא ניתן לשלוח אודיו בזמן שנוצרת תגובה",
+  "com_ui_sr_global_prompt": "קבוצת הנחיות גלובלית",
+  "com_ui_sr_public_skill": "מיומנות (skill) ציבורית",
+  "com_ui_stack_trace": "מעקב ערימה",
+  "com_ui_status_prefix": "סטטוס:",
   "com_ui_stop": "עצור",
   "com_ui_storage": "אחסון",
+  "com_ui_storage_filter_sort": "סנן ומיין לפי אחסון",
+  "com_ui_subagent_cancelled": "בטל סוכן",
+  "com_ui_subagent_complete": "הרץ סוכן",
+  "com_ui_subagent_dialog_description": "הרצת תת-תהליך בהקשר מבודד. פעילות ותוצאה סופית מוצגות למטה.",
+  "com_ui_subagent_dialog_title": "סוכן \"{{0}}\"",
+  "com_ui_subagent_dialog_title_self": "סוכן",
+  "com_ui_subagent_empty_result": "לא הוחזר טקסט.",
+  "com_ui_subagent_errored": "הסוכן נתקל בשגיאה",
+  "com_ui_subagent_no_result_yet": "עדיין פועל — אין תוצאה סופית עדיין.",
+  "com_ui_subagent_running": "מריץ סוכן",
+  "com_ui_subagent_ticker_error": "שגיאה",
+  "com_ui_subagent_ticker_reasoning": "מסיק",
+  "com_ui_subagent_ticker_tool_done": "הושלם",
+  "com_ui_subagent_ticker_using": "משתמש",
+  "com_ui_subagent_ticker_writing": "כותב",
+  "com_ui_subagent_waiting": "ממתין לעדכון ראשון…",
   "com_ui_submit": "שלח",
+  "com_ui_summarized": "סוכם",
+  "com_ui_summarizing": "מסכם...",
   "com_ui_support_contact": "פניה לתמיכה",
   "com_ui_support_contact_email": "דוא\"ל",
   "com_ui_support_contact_email_invalid": "אנא הזן כתובת דוא\"ל חוקית",
@@ -1152,32 +1594,56 @@
   "com_ui_temporary": "צ'אט זמני",
   "com_ui_terms_and_conditions": "תנאים והגבלות",
   "com_ui_terms_of_service": "תנאי השירות",
+  "com_ui_text_variables": "משתני טקסט",
   "com_ui_thinking": "חושב...",
-  "com_ui_thoughts": "מחשבות",
+  "com_ui_thoughts": "הצגת תהליך החשיבה של המודל",
+  "com_ui_toggle_theme": "החלף ערכת נושא",
   "com_ui_token": "טוקן",
   "com_ui_token_exchange_method": "שיטת החלפת טוקנים",
   "com_ui_token_url": "קישור URL לטוקן",
   "com_ui_tokens": "טוקנים",
   "com_ui_tool_collection_prefix": "אוסף כלים מבית",
+  "com_ui_tool_failed": "נכשל",
+  "com_ui_tool_list_collapse": "כווץ רשימת כלים של {{serverName}}",
+  "com_ui_tool_list_expand": "הרחב רשימת כלים של {{serverName}}",
+  "com_ui_tool_name_code": "קוד",
+  "com_ui_tool_name_code_analysis": "ניתוח קוד",
+  "com_ui_tool_name_file_search": "חיפוש קבצים",
+  "com_ui_tool_name_image_edit": "עריכת תמונה",
+  "com_ui_tool_name_image_gen": "יצירת תמונה",
+  "com_ui_tool_name_web_search": "חיפוש באינטרנט",
   "com_ui_tools": "כלים",
+  "com_ui_tools_and_actions": "כלים ופעולות",
+  "com_ui_transferred_to": "הועבר אל",
   "com_ui_travel": "מסע",
   "com_ui_trust_app": "אני סומך על האפליקציה הזו",
   "com_ui_try_adjusting_search": "נסה להתאים את מונחי החיפוש שלך",
+  "com_ui_ui_resource_error": "שגיאת משאב ממשק ({{0}})",
+  "com_ui_ui_resource_not_found": "משאב ממשק לא נמצא (אינדקס: {{0}})",
   "com_ui_unarchive": "הוצא מהארכיון",
+  "com_ui_unarchive_conversation": "הוצא את השיחה מהארכיון",
   "com_ui_unarchive_error": "הוצאת השיחה מהארכיון נכשלה",
   "com_ui_unavailable": "לא זמין",
+  "com_ui_unfavorite": "הסר מהמועדפים",
   "com_ui_unknown": "לא ידוע",
+  "com_ui_unknown_file_type": "סוג קובץ לא ידוע",
+  "com_ui_unpin": "בטל את ההצמדה",
   "com_ui_unset": "בטל הגדרה",
   "com_ui_untitled": "ללא כותר",
   "com_ui_update": "עדכון",
+  "com_ui_update_mcp_server": "עדכן שרת MCP",
+  "com_ui_updating": "מעדכן...",
   "com_ui_upload": "העלה",
   "com_ui_upload_agent_avatar": "האווטר של הסוכן עודכן בהצלחה",
+  "com_ui_upload_agent_avatar_label": "העלה תמונת אווטאר לסוכן",
   "com_ui_upload_avatar_label": "העלה תמונת אווטאר",
+  "com_ui_upload_code_environment": "העלה לסביבת הקוד",
   "com_ui_upload_delay": "העלאת \"{{0}}\" לוקחת יותר זמן מהצפוי. אנא המתן בזמן שהקובץ מסיים את האינדוקס לאחזור.",
   "com_ui_upload_error": "אירעה שגיאה בהעלאת הקובץ שלך",
   "com_ui_upload_file_context": "העלה קובץ כקובץ הקשר",
   "com_ui_upload_file_search": "העלאה לחיפוש בקבצים",
   "com_ui_upload_files": "העלה קבצים",
+  "com_ui_upload_icon": "העלה תמונת אייקון",
   "com_ui_upload_image": "העלה תמונה",
   "com_ui_upload_image_input": "העלה תמונה",
   "com_ui_upload_invalid": "אין אפשרות להעלות את הקובץ. התמונה חורגת מהמגבלה",
@@ -1191,14 +1657,19 @@
   "com_ui_use_backup_code": "השתמש בקוד גיבוי במקום",
   "com_ui_use_memory": "השתמש בזיכרון",
   "com_ui_use_micrphone": "שימוש במיקורפון",
+  "com_ui_use_prompt": "השתמש בהנחיה (פרומפט)",
   "com_ui_used": "נוצל",
+  "com_ui_used_n_tools": "נעשה שימוש ב־{{0}} כלים",
   "com_ui_user": "משתמש",
   "com_ui_user_group_permissions": "הרשאות משתמשים וקבוצות",
+  "com_ui_user_provides_key": "כל משתמש מספק מפתח משלו",
   "com_ui_value": "ערך",
+  "com_ui_variable_with_options": "משתנה {{name}} עם {{count}} אפשרויות",
   "com_ui_variables": "משתנים",
   "com_ui_verify": "אמת",
   "com_ui_version_var": "גרסה {{0}}",
   "com_ui_versions": "גרסה",
+  "com_ui_via_server": "ב־{{0}}",
   "com_ui_view_memory": "הצג זיכרון",
   "com_ui_web_search": "חיפוש ברשת",
   "com_ui_web_search_cohere_key": "הכנס מפתח API של Cohere",
@@ -1207,24 +1678,39 @@
   "com_ui_web_search_jina_url": "כתובת URL של מפתח API של Jina (אופציונלי)",
   "com_ui_web_search_processing": "עיבוד התוצאות",
   "com_ui_web_search_provider": "ספק החיפוש",
+  "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "ממשק ה-API של Serper",
   "com_ui_web_search_provider_serper_key": "קבל מפתח API של Serper ",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "קבל את מפתח ה־API של Tavily",
   "com_ui_web_search_reading": "קריאת התוצאות",
   "com_ui_web_search_reranker": "למד עוד על דירוג מחדש באמצעות Jina",
   "com_ui_web_search_reranker_cohere": "קוֹהִיר (Cohere)",
   "com_ui_web_search_reranker_cohere_key": "קבל מפתח API של Cohere",
+  "com_ui_web_search_reranker_jina": "Jina AI",
   "com_ui_web_search_reranker_jina_key": "קבל מפתח API של Jina",
   "com_ui_web_search_reranker_jina_url_help": "למד עוד על דירוג מחדש באמצעות Jina",
+  "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
   "com_ui_web_search_scraper_firecrawl_key": "קבל מפתח API של Firecrawl",
+  "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "השג מפתח API של Serper",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "קבל את מפתח ה־API של Tavily",
   "com_ui_web_search_searxng_api_key": "הזן מפתח API של SearXNG (אופציונלי)",
   "com_ui_web_search_searxng_instance_url": "כתובת URL של מופע SearXNG",
+  "com_ui_web_search_source": "מקור {{count}}",
+  "com_ui_web_search_sources": "{{count}} מקורות",
+  "com_ui_web_searched": "חיפוש באינטרנט",
   "com_ui_web_searching": "חיפוש ברשת",
   "com_ui_web_searching_again": "חיפוש נוסף ברשת",
   "com_ui_weekend_morning": "סוף שבוע נעים!",
   "com_ui_write": "כתיבה",
+  "com_ui_writing_command": "כתיבת פקודה",
   "com_ui_x_selected": "{{0}} נבחר",
+  "com_ui_xhigh": "מאוד גבוה",
   "com_ui_yes": "כן",
+  "com_ui_you": "אתה",
+  "com_ui_your_api_key": "מפתח ה־API שלך",
   "com_ui_zoom": "זום",
   "com_ui_zoom_in": "להתקרב (זום אין)",
   "com_ui_zoom_level": "רמת זום",
diff --git a/client/src/locales/hu/translation.json b/client/src/locales/hu/translation.json
index 9ae7c86e326..79e27a8f67f 100644
--- a/client/src/locales/hu/translation.json
+++ b/client/src/locales/hu/translation.json
@@ -277,15 +277,12 @@
   "com_nav_browser": "Böngésző",
   "com_nav_center_chat_input": "Csevegőbevitel középre helyezése az üdvözlőképernyőn",
   "com_nav_change_picture": "Kép módosítása",
-  "com_nav_chat_commands": "Csevegőparancsok",
-  "com_nav_chat_commands_info": "Ezek a parancsok az üzenet elején megadott speciális karakterekkel aktiválhatók. Minden parancs a kijelölt előtaggal indul. Letilthatja őket, ha gyakran használja ezeket a karaktereket üzenetek kezdetén.",
   "com_nav_chat_direction": "Csevegés iránya",
   "com_nav_clear_all_chats": "Összes csevegés törlése",
   "com_nav_clear_cache_confirm_message": "Biztosan törölni szeretné a gyorsítótárat?",
   "com_nav_clear_conversation": "Beszélgetések törlése",
   "com_nav_clear_conversation_confirm_message": "Biztosan törölni szeretné az összes beszélgetést? Ez visszafordíthatatlan.",
   "com_nav_close_sidebar": "Oldalsáv bezárása",
-  "com_nav_commands": "Parancsok",
   "com_nav_confirm_clear": "Törlés megerősítése",
   "com_nav_conversation_mode": "Beszélgetési mód",
   "com_nav_convo_menu_options": "Beszélgetési menü opciók",
@@ -378,7 +375,6 @@
   "com_nav_send_message": "Üzenet küldése",
   "com_nav_setting_account": "Fiók",
   "com_nav_setting_chat": "Csevegés",
-  "com_nav_setting_data": "Adatvezérlők",
   "com_nav_setting_general": "Általános",
   "com_nav_setting_speech": "Beszéd",
   "com_nav_settings": "Beállítások",
@@ -733,7 +729,6 @@
   "com_ui_show_all": "Összes megjelenítése",
   "com_ui_show_qr": "QR-kód megjelenítése",
   "com_ui_sign_in_to_domain": "Bejelentkezés {{0}}-ra",
-  "com_ui_simple": "Egyszerű",
   "com_ui_size": "Méret",
   "com_ui_special_variables": "Speciális változók:",
   "com_ui_speech_while_submitting": "Nem lehet beszédet beküldeni, amíg válasz generálódik",
diff --git a/client/src/locales/hy/translation.json b/client/src/locales/hy/translation.json
index d9ee1019966..64a02750663 100644
--- a/client/src/locales/hy/translation.json
+++ b/client/src/locales/hy/translation.json
@@ -129,7 +129,6 @@
   "com_nav_balance_refill_amount": "Լիցքավորման գումարը՝",
   "com_nav_browser": "Բրաուզեր",
   "com_nav_close_sidebar": "Փակել կողային վահանակը",
-  "com_nav_commands": "Հրամաններ",
   "com_nav_delete_account": "Ջնջել ակաունթը",
   "com_nav_delete_account_confirm": "Ջնջե՞լ ակաունթը։ Հաստատո՞ւմ եք։",
   "com_nav_export": "Արտահանել",
@@ -162,7 +161,6 @@
   "com_nav_not_supported": "Չի աջակցվում",
   "com_nav_open_sidebar": "Բացել կողային վահանակը",
   "com_nav_setting_account": "Ակաունթ",
-  "com_nav_setting_balance": "Հաշվեկշիռ",
   "com_nav_setting_chat": "Զրույց",
   "com_nav_settings": "Կարգավորումներ",
   "com_nav_tool_remove": "Հեռացնել",
diff --git a/client/src/locales/i18n.ts b/client/src/locales/i18n.ts
index cbebd4d5e38..02f1d0e6913 100644
--- a/client/src/locales/i18n.ts
+++ b/client/src/locales/i18n.ts
@@ -1,112 +1,337 @@
 import i18n from 'i18next';
 import { initReactI18next } from 'react-i18next';
-import LanguageDetector from 'i18next-browser-languagedetector';
 
-// Import your JSON translations
 import translationEn from './en/translation.json';
-import translationAr from './ar/translation.json';
-import translationCa from './ca/translation.json';
-import translationCs from './cs/translation.json';
-import translationDa from './da/translation.json';
-import translationDe from './de/translation.json';
-import translationEs from './es/translation.json';
-import translationEt from './et/translation.json';
-import translationFa from './fa/translation.json';
-import translationFr from './fr/translation.json';
-import translationIt from './it/translation.json';
-import translationPl from './pl/translation.json';
-import translationPt_BR from './pt-BR/translation.json';
-import translationPt_PT from './pt-PT/translation.json';
-import translationRu from './ru/translation.json';
-import translationJa from './ja/translation.json';
-import translationKa from './ka/translation.json';
-import translationSv from './sv/translation.json';
-import translationKo from './ko/translation.json';
-import translationLt from './lt/translation.json';
-import translationLv from './lv/translation.json';
-import translationTh from './th/translation.json';
-import translationTr from './tr/translation.json';
-import translationUg from './ug/translation.json';
-import translationVi from './vi/translation.json';
-import translationNl from './nl/translation.json';
-import translationNn from './nn/translation.json';
-import translationId from './id/translation.json';
-import translationIs from './is/translation.json';
-import translationHe from './he/translation.json';
-import translationHu from './hu/translation.json';
-import translationHy from './hy/translation.json';
-import translationFi from './fi/translation.json';
-import translationZh_Hans from './zh-Hans/translation.json';
-import translationZh_Hant from './zh-Hant/translation.json';
-import translationSk from './sk/translation.json';
-import translationBo from './bo/translation.json';
-import translationUk from './uk/translation.json';
-import translationBs from './bs/translation.json';
-import translationNb from './nb/translation.json';
-import translationSl from './sl/translation.json';
 
 export const defaultNS = 'translation';
 
+export const supportedLocales = [
+  'ar',
+  'bo',
+  'bs',
+  'ca',
+  'cs',
+  'da',
+  'de',
+  'en',
+  'es',
+  'et',
+  'fa',
+  'fi',
+  'fr',
+  'he',
+  'hu',
+  'hy',
+  'id',
+  'is',
+  'it',
+  'ja',
+  'ka',
+  'ko',
+  'lt',
+  'lv',
+  'nb',
+  'nl',
+  'nn',
+  'pl',
+  'pt-BR',
+  'pt-PT',
+  'ru',
+  'sk',
+  'sl',
+  'sv',
+  'th',
+  'tr',
+  'ug',
+  'uk',
+  'vi',
+  'zh-Hans',
+  'zh-Hant',
+] as const;
+
+export type SupportedLocale = (typeof supportedLocales)[number];
+export type TranslationResource = Record<string, string>;
+
 export const resources = {
   en: { translation: translationEn },
-  ar: { translation: translationAr },
-  bs: { translation: translationBs },
-  ca: { translation: translationCa },
-  cs: { translation: translationCs },
-  'zh-Hans': { translation: translationZh_Hans },
-  'zh-Hant': { translation: translationZh_Hant },
-  da: { translation: translationDa },
-  de: { translation: translationDe },
-  es: { translation: translationEs },
-  et: { translation: translationEt },
-  fa: { translation: translationFa },
-  fr: { translation: translationFr },
-  it: { translation: translationIt },
-  nb: { translation: translationNb },
-  pl: { translation: translationPl },
-  'pt-BR': { translation: translationPt_BR },
-  'pt-PT': { translation: translationPt_PT },
-  ru: { translation: translationRu },
-  ja: { translation: translationJa },
-  ka: { translation: translationKa },
-  sv: { translation: translationSv },
-  ko: { translation: translationKo },
-  lt: { translation: translationLt },
-  lv: { translation: translationLv },
-  th: { translation: translationTh },
-  tr: { translation: translationTr },
-  ug: { translation: translationUg },
-  vi: { translation: translationVi },
-  nl: { translation: translationNl },
-  nn: { translation: translationNn },
-  id: { translation: translationId },
-  is: { translation: translationIs },
-  he: { translation: translationHe },
-  hu: { translation: translationHu },
-  hy: { translation: translationHy },
-  fi: { translation: translationFi },
-  sk: { translation: translationSk },
-  bo: { translation: translationBo },
-  sl: { translation: translationSl },
-  uk: { translation: translationUk },
 } as const;
 
-i18n
-  .use(LanguageDetector)
-  .use(initReactI18next)
-  .init({
-    fallbackLng: {
-      'zh-TW': ['zh-Hant', 'en'],
-      'zh-HK': ['zh-Hant', 'en'],
-      zh: ['zh-Hans', 'en'],
-      default: ['en'],
-    },
-    fallbackNS: 'translation',
-    ns: ['translation'],
-    debug: false,
-    defaultNS,
-    resources,
-    interpolation: { escapeValue: false },
-  });
+const localeLoaders: Record<
+  Exclude<SupportedLocale, 'en'>,
+  () => Promise<{ default: TranslationResource }>
+> = {
+  ar: () => import('./ar/translation.json'),
+  bo: () => import('./bo/translation.json'),
+  bs: () => import('./bs/translation.json'),
+  ca: () => import('./ca/translation.json'),
+  cs: () => import('./cs/translation.json'),
+  da: () => import('./da/translation.json'),
+  de: () => import('./de/translation.json'),
+  es: () => import('./es/translation.json'),
+  et: () => import('./et/translation.json'),
+  fa: () => import('./fa/translation.json'),
+  fi: () => import('./fi/translation.json'),
+  fr: () => import('./fr/translation.json'),
+  he: () => import('./he/translation.json'),
+  hu: () => import('./hu/translation.json'),
+  hy: () => import('./hy/translation.json'),
+  id: () => import('./id/translation.json'),
+  is: () => import('./is/translation.json'),
+  it: () => import('./it/translation.json'),
+  ja: () => import('./ja/translation.json'),
+  ka: () => import('./ka/translation.json'),
+  ko: () => import('./ko/translation.json'),
+  lt: () => import('./lt/translation.json'),
+  lv: () => import('./lv/translation.json'),
+  nb: () => import('./nb/translation.json'),
+  nl: () => import('./nl/translation.json'),
+  nn: () => import('./nn/translation.json'),
+  pl: () => import('./pl/translation.json'),
+  'pt-BR': () => import('./pt-BR/translation.json'),
+  'pt-PT': () => import('./pt-PT/translation.json'),
+  ru: () => import('./ru/translation.json'),
+  sk: () => import('./sk/translation.json'),
+  sl: () => import('./sl/translation.json'),
+  sv: () => import('./sv/translation.json'),
+  th: () => import('./th/translation.json'),
+  tr: () => import('./tr/translation.json'),
+  ug: () => import('./ug/translation.json'),
+  uk: () => import('./uk/translation.json'),
+  vi: () => import('./vi/translation.json'),
+  'zh-Hans': () => import('./zh-Hans/translation.json'),
+  'zh-Hant': () => import('./zh-Hant/translation.json'),
+};
+
+const localeByLowercase = supportedLocales.reduce<Record<string, SupportedLocale>>(
+  (acc, locale) => {
+    acc[locale.toLowerCase()] = locale;
+    return acc;
+  },
+  {},
+);
+
+const localeAliases: Record<string, SupportedLocale> = {
+  'ar-eg': 'ar',
+  'ca-es': 'ca',
+  'cs-cz': 'cs',
+  'da-dk': 'da',
+  'de-de': 'de',
+  'en-us': 'en',
+  'es-es': 'es',
+  'et-ee': 'et',
+  'fa-ir': 'fa',
+  'fi-fi': 'fi',
+  'fr-fr': 'fr',
+  'he-he': 'he',
+  'he-il': 'he',
+  'hu-hu': 'hu',
+  'hy-am': 'hy',
+  'id-id': 'id',
+  'it-it': 'it',
+  'ja-jp': 'ja',
+  'ka-ge': 'ka',
+  'ko-kr': 'ko',
+  'lt-lt': 'lt',
+  'lv-lv': 'lv',
+  'nl-nl': 'nl',
+  'pl-pl': 'pl',
+  pt: 'pt-PT',
+  'ru-ru': 'ru',
+  'sv-se': 'sv',
+  'th-th': 'th',
+  'tr-tr': 'tr',
+  'uk-ua': 'uk',
+  'vi-vn': 'vi',
+  zh: 'zh-Hans',
+  'zh-cn': 'zh-Hans',
+  'zh-sg': 'zh-Hans',
+  'zh-tw': 'zh-Hant',
+  'zh-hk': 'zh-Hant',
+  'zh-mo': 'zh-Hant',
+};
+
+const loadedLocales = new Set<SupportedLocale>(['en']);
+const loadingLocales: Partial<Record<SupportedLocale, Promise<SupportedLocale>>> = {};
+let languageRequestId = 0;
+let latestRequestedLocale: SupportedLocale = 'en';
+
+function readCookie(name: string) {
+  if (typeof document === 'undefined') {
+    return undefined;
+  }
+
+  const prefix = `${name}=`;
+  return document.cookie
+    .split(';')
+    .map((cookie) => cookie.trim())
+    .find((cookie) => cookie.startsWith(prefix))
+    ?.slice(prefix.length);
+}
+
+function readStoredLanguage() {
+  if (typeof localStorage === 'undefined') {
+    return undefined;
+  }
+
+  const raw = localStorage.getItem('lang');
+  if (!raw) {
+    return undefined;
+  }
+
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === 'string' ? parsed : raw;
+  } catch {
+    return raw;
+  }
+}
+
+function getNavigatorLanguage() {
+  if (typeof navigator === 'undefined') {
+    return 'en';
+  }
+
+  return navigator.language || navigator.languages?.[0] || 'en';
+}
+
+export function normalizeLocale(locale?: string | null): SupportedLocale {
+  const requested = locale === 'auto' ? getNavigatorLanguage() : locale;
+  if (!requested) {
+    return 'en';
+  }
+
+  const normalized = requested.replace(/_/g, '-').toLowerCase();
+  const exact = localeByLowercase[normalized];
+  if (exact) {
+    return exact;
+  }
+
+  const alias = localeAliases[normalized];
+  if (alias) {
+    return alias;
+  }
+
+  const base = normalized.split('-')[0];
+  return localeByLowercase[base] ?? localeAliases[base] ?? 'en';
+}
+
+export function detectInitialLanguage() {
+  const cookieLang = readCookie('lang');
+  const storedLang = readStoredLanguage();
+  return normalizeLocale(cookieLang || storedLang || getNavigatorLanguage());
+}
+
+export async function ensureLocale(locale?: string | null): Promise<SupportedLocale> {
+  const normalized = normalizeLocale(locale);
+
+  if (normalized === 'en') {
+    return normalized;
+  }
+
+  if (loadedLocales.has(normalized)) {
+    return normalized;
+  }
+
+  if (i18n.hasResourceBundle(normalized, defaultNS)) {
+    loadedLocales.add(normalized);
+    return normalized;
+  }
+
+  if (!loadingLocales[normalized]) {
+    const loader = localeLoaders[normalized];
+    loadingLocales[normalized] = loader()
+      .then((module) => {
+        i18n.addResourceBundle(normalized, defaultNS, module.default, true, true);
+        loadedLocales.add(normalized);
+        return normalized;
+      })
+      .catch((error): SupportedLocale => {
+        console.error(`[i18n] Failed to load locale "${normalized}"`, error);
+        return 'en';
+      })
+      .finally(() => {
+        delete loadingLocales[normalized];
+      });
+  }
+
+  return loadingLocales[normalized] ?? Promise.resolve('en');
+}
+
+export function __setLocaleLoaderForTests(
+  locale: Exclude<SupportedLocale, 'en'>,
+  loader: () => Promise<{ default: TranslationResource }>,
+) {
+  const previousLoader = localeLoaders[locale];
+  localeLoaders[locale] = loader;
+  return () => {
+    localeLoaders[locale] = previousLoader;
+  };
+}
+
+export function __resetLocaleForTests(locale: Exclude<SupportedLocale, 'en'>) {
+  delete loadingLocales[locale];
+  loadedLocales.delete(locale);
+  if (i18n.hasResourceBundle(locale, defaultNS)) {
+    i18n.removeResourceBundle(locale, defaultNS);
+  }
+}
+
+export function syncDocumentLanguage(locale: SupportedLocale) {
+  if (typeof document === 'undefined') {
+    return;
+  }
+
+  document.documentElement.lang = locale;
+  document.documentElement.dir = i18n.dir(locale);
+}
+
+export const i18nInitPromise = i18n.use(initReactI18next).init({
+  lng: 'en',
+  fallbackLng: {
+    'zh-TW': ['zh-Hant', 'en'],
+    'zh-HK': ['zh-Hant', 'en'],
+    zh: ['zh-Hans', 'en'],
+    default: ['en'],
+  },
+  fallbackNS: defaultNS,
+  ns: [defaultNS],
+  debug: false,
+  defaultNS,
+  resources,
+  supportedLngs: [...supportedLocales],
+  partialBundledLanguages: true,
+  load: 'currentOnly',
+  react: { useSuspense: false },
+  interpolation: { escapeValue: false },
+});
+
+export async function changeLanguageSafely(locale?: string | null) {
+  const requestId = ++languageRequestId;
+  const requestedLocale = normalizeLocale(locale);
+  latestRequestedLocale = requestedLocale;
+  await i18nInitPromise;
+
+  const loadedLocale = await ensureLocale(requestedLocale);
+  if (requestId !== languageRequestId) {
+    return i18n.language;
+  }
+
+  await i18n.changeLanguage(loadedLocale);
+  if (requestId !== languageRequestId) {
+    const latestLocale = await ensureLocale(latestRequestedLocale);
+    await i18n.changeLanguage(latestLocale);
+    syncDocumentLanguage(latestLocale);
+    return i18n.language;
+  }
+
+  syncDocumentLanguage(loadedLocale);
+  return loadedLocale;
+}
+
+export async function initializeI18n() {
+  const initialLanguage = detectInitialLanguage();
+  await changeLanguageSafely(initialLanguage);
+  return initialLanguage;
+}
 
 export default i18n;
diff --git a/client/src/locales/id/translation.json b/client/src/locales/id/translation.json
index 2f9eda812de..25b432a694b 100644
--- a/client/src/locales/id/translation.json
+++ b/client/src/locales/id/translation.json
@@ -191,7 +191,6 @@
   "com_nav_search_placeholder": "Cari pesan",
   "com_nav_send_message": "Kirim pesan",
   "com_nav_setting_account": "Akun",
-  "com_nav_setting_data": "Kontrol data",
   "com_nav_setting_general": "Umum",
   "com_nav_settings": "Pengaturan",
   "com_nav_shared_links": "Link berbagi",
diff --git a/client/src/locales/it/translation.json b/client/src/locales/it/translation.json
index 9ce51f0b1dc..af76dae2414 100644
--- a/client/src/locales/it/translation.json
+++ b/client/src/locales/it/translation.json
@@ -2,19 +2,26 @@
   "chat_direction_left_to_right": "Da Sinistra a Destra",
   "chat_direction_right_to_left": "Da destra a sinistra\n",
   "com_a11y_ai_composing": "L'IA sta ancora componendo",
+  "com_a11y_chats_date_section": "Chat del {{date}}",
   "com_a11y_end": "L'IA ha terminato la sua risposta",
   "com_a11y_selected": "Selezionato",
   "com_a11y_start": "L'IA ha iniziato la sua risposta",
-  "com_agents_agent_card_label": "{{nome}} agente. {{descrizione}}",
+  "com_a11y_summarize_completed": "Contesto riassunto",
+  "com_a11y_summarize_failed": "procedura di riassunto fallita, continuo con il contesto disponibilie",
+  "com_agents_agent_card_label": "Agente {{name}}. {{description}}",
+  "com_agents_all": "Tutti gli agenti",
   "com_agents_all_category": "Tutti",
   "com_agents_all_description": "Sfoglia tutti gli agenti condivisi in tutte le categorie",
   "com_agents_avatar_upload_error": "Il caricamento dell'avatar d'agente è fallito",
+  "com_agents_category_aftersales": "Post vendita",
+  "com_agents_category_aftersales_description": "Agenti specializzati nell'assistenza post-vendita, nella manutenzione e nel servizio clienti",
   "com_agents_category_empty": "Non sono stati trovati agenti nella categoria {{category}}",
   "com_agents_category_finance": "Finanza",
   "com_agents_category_finance_description": "Agenti specializzati in analisi finanziaria, budgeting e contabilità",
   "com_agents_category_general": "Generale",
   "com_agents_category_general_description": "Agenti di uso generale per compiti e richieste comuni",
   "com_agents_category_hr": "Risorse Umane",
+  "com_agents_category_hr_description": "Agenti specializzati nei processi, nelle politiche e nell'assistenza ai dipendenti in ambito HR",
   "com_agents_category_it": "IT",
   "com_agents_category_it_description": "Agenti per supporto IT, risoluzione dei problemi tecnici e amministrazione del sistema",
   "com_agents_category_rd": "Ricerca e sviluppo",
@@ -29,7 +36,7 @@
   "com_agents_copy_link": "Copia Link",
   "com_agents_create_error": "Si è verificato un errore durante la creazione del tuo agente.",
   "com_agents_created_by": "da",
-  "com_agents_description_card": "Descrizione: {{descrizione}}",
+  "com_agents_description_card": "Descrizione: {{description}}",
   "com_agents_description_placeholder": "Opzionale: Descrivi qui il tuo Agente",
   "com_agents_empty_state_heading": "Nessun agente trovato",
   "com_agents_enable_file_search": "Abilita Ricerca File",
@@ -82,6 +89,7 @@
   "com_agents_not_available": "Agente Non Disponibile",
   "com_agents_recommended": "I nostri agenti consigliati",
   "com_agents_results_for": "Risultati per '{{query}}'",
+  "com_agents_run_code_files": "I file qui sotto sono solo per il Code Environment",
   "com_agents_search_aria": "Cerca agenti",
   "com_agents_search_empty_heading": "Nessun risultato di ricerca",
   "com_agents_search_info": "Se abilitato, consente all'agente di cercare informazioni aggiornate sul web. Richiede una chiave API valida.",
@@ -213,12 +221,13 @@
   "com_endpoint_agent": "Agente",
   "com_endpoint_agent_placeholder": "Seleziona un Agente",
   "com_endpoint_ai": "IA",
-  "com_endpoint_anthropic_effort": "Controlla la quantità di sforzo computazionale applicato da Claude. Uno sforzo minore fa risparmiare gettoni e riduce la latenza; uno sforzo maggiore produce risposte più approfondite. 'Max' consente il ragionamento più approfondito (solo Opus 4.6).",
+  "com_endpoint_anthropic_effort": "Controlla lo sforzo computazionale di Claude. Minore sforzo consuma meno token e riduce la latenza; un maggiore sforzo produce risposte più accurate. \"Max\" abilita lo sforzo di ragionamento maggiore nei modelli con ragionamento adattivo",
   "com_endpoint_anthropic_maxoutputtokens": "Numero massimo di token che possono essere generati nella risposta. Specifica un valore più basso per risposte più brevi e un valore più alto per risposte più lunghe.",
   "com_endpoint_anthropic_prompt_cache": "La cache dei prompt permette di riutilizzare contesti o istruzioni estese tra le chiamate API, riducendo costi e latenza",
   "com_endpoint_anthropic_temp": "Varia da 0 a 1. Usa temp più vicino a 0 per analitica / scelta multipla, e più vicino a 1 per compiti creativi e generativi. Consigliamo di modificare questo o Top P ma non entrambi.",
-  "com_endpoint_anthropic_thinking": "Abilita il ragionamento interno per i modelli Claude supportati (3.7 Sonnet). Nota: richiede che \"Thinking Budget\" sia impostato e inferiore a \"Massimo Output Token\"",
+  "com_endpoint_anthropic_thinking": "Abilita il ragionamento interno per i modelli Claude supportati. Per modelli più nuovi (Opus 4.6+), utilizza \"Adaptive Thinking\" controllato dal parametro Effort. Per modelli legacy, richiede che \"Thinking Budget\" sia impostato e inferiore a \"Massimo Output Token\"",
   "com_endpoint_anthropic_thinking_budget": "Determina il numero massimo di token che Claude può utilizzare per il suo processo di ragionamento interno. Un budget maggiore può migliorare la qualità della risposta, consentendo un'analisi più approfondita di problemi complessi, anche se Claude potrebbe non utilizzare l'intero budget assegnato, soprattutto con intervalli superiori a 32K. Questa impostazione deve essere inferiore a \"Massimo Output Token\".",
+  "com_endpoint_anthropic_thinking_display_desc": "Decide se restituire il ragionamento di Claude. 'Auto' abilita i pensieri riassunti per modelli che li nascondono di default (Opus 4.7+); 'Summarized' li mostra sempre; 'Omitted' li nasconde sempre per avere una latenza leggermente ridotta.",
   "com_endpoint_anthropic_topk": "Top-k cambia il modo in cui il modello seleziona i token per l'output. Un top-k di 1 significa che il token selezionato è il più probabile tra tutti i token nel vocabolario del modello (anche chiamato greedy decoding), mentre un top-k di 3 significa che il prossimo token è selezionato tra i 3 più probabili (usando la temperatura).",
   "com_endpoint_anthropic_topp": "Top-p cambia il modo in cui il modello seleziona i token per l'output. I token vengono selezionati dai più probabili K (vedi parametro topK) ai meno probabili fino a quando la somma delle loro probabilità eguaglia il valore top-p.",
   "com_endpoint_anthropic_use_web_search": "Abilitare la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di Anthropic. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
@@ -263,8 +272,8 @@
   "com_endpoint_google_custom_name_placeholder": "Imposta un nome personalizzato per Google",
   "com_endpoint_google_maxoutputtokens": "Numero massimo di token che possono essere generati nella risposta. Specifica un valore più basso per risposte più brevi e un valore più alto per risposte più lunghe.",
   "com_endpoint_google_temp": "Valori più alti = più casualità, mentre valori più bassi = più focalizzati e deterministici. Consigliamo di modificare questo o Top P ma non entrambi.",
-  "com_endpoint_google_thinking": "Abilita o disabilita il ragionamento. Questa impostazione è supportata solo da alcuni modelli (serie 2.5). Per i modelli più vecchi, questa impostazione potrebbe non avere alcun effetto.",
-  "com_endpoint_google_thinking_budget": "Indica il numero di token di riflessione utilizzati dal modello. La quantità effettiva può essere superiore o inferiore a questo valore, a seconda della richiesta.\n\nQuesta impostazione è supportata solo da alcuni modelli (serie 2.5). Gemini 2.5 Pro supporta 128-32.768 token. Gemini 2.5 Flash supporta 0-24.576 token. Gemini 2.5 Flash Lite supporta 512-24.576 token.\n\nLasciare vuoto o impostare \"-1\" per lasciare che il modello decida automaticamente quando e quanto pensare. Per impostazione predefinita, Gemini 2.5 Flash Lite non pensa.",
+  "com_endpoint_google_thinking": "Abilita o disabilita il ragionamento. Questa impostazione è supportata solo dai modelli delle serie Gemini 2.5 e 3. Nota: Gemini 3 pro non può disattivare completamente la modalità thinking.",
+  "com_endpoint_google_thinking_budget": "Guida il numero di token di pensiero (thinking tokens) utilizzati dal modello. La quantità effettiva può essere superiore o inferiore a questo valore in base al prompt.\n\nQuesta impostazione si applica solo a Gemini 2.5 e versioni precedenti. Per Gemini 3 e versioni successive, utilizza invece l'impostazione 'Thinking Level'.\n\nGemini 2.5 Pro supporta 128-32.768 token. Gemini 2.5 Flash supporta 0-24.576 token. Gemini 2.5 Flash Lite supporta 512-24.576 token.\n\nLascia vuoto o imposta a '-1' per permettere al modello di decidere automaticamente quando e quanto ragionare. Per impostazione predefinita, Gemini 2.5 Flash Lite non utilizza il ragionamento.",
   "com_endpoint_google_topk": "Top-k cambia il modo in cui il modello seleziona i token per l'output. Un top-k di 1 significa che il token selezionato è il più probabile tra tutti i token nel vocabolario del modello (anche chiamato greedy decoding), mentre un top-k di 3 significa che il prossimo token è selezionato tra i 3 più probabili (usando la temperatura).",
   "com_endpoint_google_topp": "Top-p cambia il modo in cui il modello seleziona i token per l'output. I token vengono selezionati dai più probabili K (vedi parametro topK) ai meno probabili fino a quando la somma delle loro probabilità eguaglia il valore top-p.",
   "com_endpoint_google_use_search_grounding": "Utilizzate la funzione di messa a terra della ricerca di Google per migliorare le risposte con risultati di ricerca sul Web in tempo reale. Ciò consente ai modelli di accedere alle informazioni attuali e di fornire risposte più precise e aggiornate.",
@@ -283,7 +292,7 @@
   "com_endpoint_openai_max_tokens": "Campo `max_tokens` opzionale, che rappresenta il numero massimo di token che possono essere generati nel completamento della chat.\n\nLa lunghezza totale dei token di input e dei token generati è limitata dalla lunghezza del contesto del modello. Potresti riscontrare errori se questo numero supera il massimo dei token di contesto.",
   "com_endpoint_openai_pres": "Numero compreso tra -2.0 e 2.0. Valori positivi penalizzano i nuovi token in base a se compaiono nel testo fino a quel momento, aumentando la probabilità del modello di parlare di nuovi argomenti.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Imposta istruzioni personalizzate da includere nel Messaggio di Sistema. Predefinito: nessuno",
-  "com_endpoint_openai_reasoning_effort": "solo per modelli o1: limita lo sforzo sul ragionamento per i modelli di ragionamento. Ridurre lo sforzo di ragionamento può portare a risposte più veloci e a un minor numero di token utilizzati per il ragionamento in una risposta",
+  "com_endpoint_openai_reasoning_effort": "Solo per modelli di ragionamento: limita lo sforzo sul ragionamento. Ridurre lo sforzo può portare a risposte più veloci e a un minor numero di token utilizzati. \"Minimale\" produce pochissimi token di ragionamento per il time-to-first-token più rapido, particolarmente indicato per programmazione e seguire istruzioni.",
   "com_endpoint_openai_reasoning_summary": "Solo per Responses API: Un riassunto del ragionamento eseguito dal modello. Può essere utile per il debug e la comprensione del processo di ragionamento del modello. Impostare su nessuno, auto, conciso o dettagliato.",
   "com_endpoint_openai_resend": "Invia nuovamente tutte le immagini allegate in precedenza. Nota: questo può aumentare significativamente il costo dei token e potresti incontrare errori con molti allegati di immagini.",
   "com_endpoint_openai_resend_files": "Invia nuovamente tutti i file allegati in precedenza. Nota: questo aumenterà il costo dei token e potresti incontrare errori con molti allegati.",
@@ -291,7 +300,7 @@
   "com_endpoint_openai_temp": "Valori più alti = più casualità, mentre valori più bassi = più focalizzati e deterministici. Consigliamo di modificare questo o Top P ma non entrambi.",
   "com_endpoint_openai_topp": "Un'alternativa al campionamento con temperatura, chiamata nucleus sampling, in cui il modello considera i risultati dei token con probabilità di massa top_p. Quindi 0,1 significa che vengono considerati solo i token che compongono la massa di probabilità superiore al 10%. Consigliamo di modificare questo o la temperatura ma non entrambi.",
   "com_endpoint_openai_use_responses_api": "Utilizzare il Responses API invece di Chat Completions, che include funzioni estese di OpenAI. Richiesto per o1-pro, o3-pro e per abilitare i riassunti dei ragionamenti.",
-  "com_endpoint_openai_use_web_search": "Abilitare la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di OpenAI. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
+  "com_endpoint_openai_use_web_search": "Abilita la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di OpenAI. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
   "com_endpoint_openai_verbosity": "Limita la verbosità della risposta del modello. I valori più bassi daranno luogo a risposte più concise, mentre i valori più alti daranno luogo a risposte più verbose. I valori attualmente supportati sono basso, medio e alto.",
   "com_endpoint_output": "Output",
   "com_endpoint_plug_image_detail": "Dettaglio immagine",
@@ -333,13 +342,14 @@
   "com_endpoint_temperature": "Temperatura",
   "com_endpoint_thinking": "Ragionando",
   "com_endpoint_thinking_budget": "Budget Ragionamento",
+  "com_endpoint_thinking_level": "Livello di thinking",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Usa Assistente Attivo",
   "com_endpoint_use_responses_api": "Utilizzare le risposte API",
   "com_endpoint_use_search_grounding": "Messa a terra con la ricerca su Google",
   "com_endpoint_verbosity": "Verbosità",
-  "com_error_endpoint_models_not_loaded": "Modelli per {{0}} non è stato possibile caricarlo. Aggiornare la pagina e riprovare.",
+  "com_error_endpoint_models_not_loaded": "Non è stato possibile caricare modelli per {{0}}. Aggiornare la pagina e riprovare.",
   "com_error_expired_user_key": "La chiave fornita per {{0}} è scaduta il {{1}}. Fornisci una chiave e riprova.",
   "com_error_files_dupe": "File duplicato rilevato.",
   "com_error_files_empty": "I file vuoti non sono consentiti.",
@@ -351,7 +361,7 @@
   "com_error_google_tool_conflict": "L'uso degli strumenti integrati di Google non è supportato da strumenti esterni. Disattivare gli strumenti integrati o quelli esterni.",
   "com_error_heic_conversion": "Impossibile convertire l'immagine HEIC in JPEG. Provare a convertire l'immagine manualmente o utilizzare un altro formato.",
   "com_error_illegal_model_request": "Il modello \"{{0}}\" non è disponibile per {{1}}. Selezionare un modello diverso.",
-  "com_error_input_length": "Il conteggio dei token dell'ultimo messaggio è troppo lungo e supera il limite consentito ({{0}}). Per favore, accorcia il tuo messaggio, modifica la dimensione massima del contesto dai parametri della conversazione, oppure crea una diramazione della conversazione per continuare.",
+  "com_error_input_length": "Il conteggio dei token dell'ultimo messaggio è troppo elevato e supera il limite consentito, oppure i parametri del limite di token sono configurati in modo errato, compromettendo la finestra di contesto. Maggiori informazioni: {{0}}. Accorcia il messaggio, regola la dimensione massima del contesto dai parametri della conversazione o esegui un fork della conversazione per continuare.",
   "com_error_invalid_agent_provider": "Il \"{{0}}Il provider \" non è disponibile per l'uso con gli agenti. Accedere alle impostazioni dell'agente e selezionare un provider attualmente disponibile.",
   "com_error_invalid_user_key": "Chiave fornita non valida. Fornisci una chiave e riprova.",
   "com_error_missing_model": "Nessun modello selezionato per {{0}}. Selezionare un modello e riprovare.",
@@ -374,7 +384,7 @@
   "com_files_preparing_download": "Preparazione del download...",
   "com_files_result_found": "{{count}} risultato trovato",
   "com_files_results_found": "{{count}} risultati trovati",
-  "com_files_sharepoint_picker_title": "File di prelievo",
+  "com_files_sharepoint_picker_title": "Seleziona file",
   "com_files_table": "Tabella dei file",
   "com_files_upload_local_machine": "Dal computer locale",
   "com_files_upload_sharepoint": "Da SharePoint",
@@ -383,7 +393,8 @@
   "com_info_heic_converting": "Conversione dell'immagine HEIC in JPEG...",
   "com_nav_2fa": "Autenticazione a due fattori (2FA)",
   "com_nav_account_settings": "Impostazioni account",
-  "com_nav_always_make_prod": "Rendi sempre produttive le nuove versioni",
+  "com_nav_advanced_prompts": "Editor avanzato di prompt",
+  "com_nav_always_make_prod": "Imposta sempre le nuove versioni del prompt come 'production'",
   "com_nav_archive_created_at": "DateCreated",
   "com_nav_archive_name": "Nome",
   "com_nav_archived_chats": "Chat archiviate",
@@ -392,7 +403,7 @@
   "com_nav_audio_play_error": "Errore durante la riproduzione audio: {{0}}",
   "com_nav_audio_process_error": "Errore durante l'elaborazione dell'audio: {{0}}",
   "com_nav_auto_scroll": "Scorri automaticamente ai nuovi messaggi all'apertura",
-  "com_nav_auto_send_prompts": "Invio automatico dei prompt",
+  "com_nav_auto_send_prompts": "Invio dei prompt alla selezione",
   "com_nav_auto_send_text": "Invio automatico del testo",
   "com_nav_auto_transcribe_audio": "Trascrivi audio automaticamente",
   "com_nav_automatic_playback": "Riproduzione automatica ultimo messaggio",
@@ -421,8 +432,6 @@
   "com_nav_browser": "Browser",
   "com_nav_center_chat_input": "Input chat centrale nella schermata di benvenuto",
   "com_nav_change_picture": "Cambia immagine",
-  "com_nav_chat_commands": "Comandi Chat",
-  "com_nav_chat_commands_info": "Questi comandi vengono attivati digitando caratteri specifici all'inizio del tuo messaggio. Ogni comando viene attivato dal suo prefisso designato. Puoi disabilitarli se usi frequentemente questi caratteri per iniziare i messaggi.",
   "com_nav_chat_direction": "Direzione della chat",
   "com_nav_chat_direction_selected": "Direzione della chat: {{direction}}",
   "com_nav_clear_all_chats": "Cancella tutte le chat",
@@ -430,7 +439,6 @@
   "com_nav_clear_conversation": "Cancella conversazioni",
   "com_nav_clear_conversation_confirm_message": "Sei sicuro di voler cancellare tutte le conversazioni? Questa azione è irreversibile.",
   "com_nav_close_sidebar": "Chiudi barra laterale",
-  "com_nav_commands": "Comandi",
   "com_nav_confirm_clear": "Conferma cancellazione",
   "com_nav_control_panel": "Pannello di controllo",
   "com_nav_conversation_mode": "Modalità Conversazione",
@@ -533,11 +541,11 @@
   "com_nav_mcp_connect_server": "Collegare {{0}}",
   "com_nav_mcp_reconnect": "Ricollegarsi",
   "com_nav_mcp_status_connected": "Collegato",
-  "com_nav_mcp_status_connecting": "{{0}} - Collegamento",
+  "com_nav_mcp_status_connecting": "{{0}} - Collegamento in corso",
   "com_nav_mcp_status_disconnected": "Disconnesso",
   "com_nav_mcp_status_error": "Errore",
   "com_nav_mcp_status_initializing": "Inizializzazione",
-  "com_nav_mcp_status_needs_auth": "Necessità di autorizzazione",
+  "com_nav_mcp_status_needs_auth": "Necessita autorizzazione",
   "com_nav_mcp_status_unknown": "Sconosciuto",
   "com_nav_mcp_vars_update_error": "Errore nell'aggiornamento delle variabili utente personalizzate di MCP",
   "com_nav_mcp_vars_updated": "Le variabili utente personalizzate di MCP sono state aggiornate con successo.",
@@ -556,13 +564,10 @@
   "com_nav_search_placeholder": "Cerca messaggi",
   "com_nav_send_message": "Invia messaggio",
   "com_nav_setting_account": "Account",
-  "com_nav_setting_balance": "Bilancio",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Controlli dati",
   "com_nav_setting_delay": "Ritardo (s)",
   "com_nav_setting_general": "Generale",
   "com_nav_setting_mcp": "Impostazioni MCP",
-  "com_nav_setting_personalization": "Personalizzazione",
   "com_nav_setting_speech": "Voce",
   "com_nav_settings": "Impostazioni",
   "com_nav_shared_links": "Link condivisi",
@@ -633,6 +638,7 @@
   "com_ui_add_mcp_server": "Aggiungere il server MCP",
   "com_ui_add_model_preset": "Aggiungi un modello o una preimpostazione per una risposta aggiuntiva",
   "com_ui_add_multi_conversation": "Aggiungi conversazioni multiple",
+  "com_ui_add_skills": "Aggiungi skill",
   "com_ui_add_special_variables": "Aggiungere variabili speciali",
   "com_ui_add_web_search_api_keys": "Aggiungere le chiavi API di ricerca web",
   "com_ui_adding_details": "Aggiunta di dettagli",
@@ -645,20 +651,20 @@
   "com_ui_advanced_settings": "Impostazioni avanzate",
   "com_ui_agent": "Agente",
   "com_ui_agent_api_keys": "Chiavi API dell'agente",
-  "com_ui_agent_api_keys_description": "Creare chiavi API per accedere agli agenti in remoto tramite l'API.",
   "com_ui_agent_category_aftersales": "Post-vendita",
   "com_ui_agent_category_finance": "Finanza",
   "com_ui_agent_category_general": "Generale",
   "com_ui_agent_category_hr": "HR",
   "com_ui_agent_category_it": "IT",
   "com_ui_agent_category_rd": "R&S",
-  "com_ui_agent_category_sales": "Saldi",
+  "com_ui_agent_category_sales": "Vendita",
   "com_ui_agent_category_selector_aria": "Selettore di categoria dell'agente",
   "com_ui_agent_chain": "Catena di agenti (Mixture-of-Agents)",
   "com_ui_agent_chain_info": "Consente di creare sequenze di agenti. Ogni agente può accedere agli output degli agenti precedenti nella catena. Si basa sull'architettura \"Mixture-of-Agents\", in cui gli agenti utilizzano le uscite precedenti come informazioni ausiliarie.",
   "com_ui_agent_chain_max": "Avete raggiunto il massimo di {{0}} agenti.",
   "com_ui_agent_delete_error": "Si è verificato un errore durante l'eliminazione dell'agente",
   "com_ui_agent_deleted": "Agente eliminato con successo",
+  "com_ui_agent_description": "Descrizione dell agente",
   "com_ui_agent_duplicate_error": "Si è verificato un errore durante la duplicazione dell'assistente",
   "com_ui_agent_duplicated": "Agente duplicato con successo",
   "com_ui_agent_handoff_add": "Aggiungere l'agente di handoff",
@@ -672,9 +678,16 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "Etichetta del contenuto passato (predefinito: 'istruzioni')",
   "com_ui_agent_handoff_prompt_placeholder": "Indica a questo agente quale contenuto generare e passare all'agente di handoff. È necessario aggiungere qualcosa qui per abilitare questa funzione",
   "com_ui_agent_handoffs": "Passaggio dell'agente",
+  "com_ui_agent_name": "Nome dell'agente",
   "com_ui_agent_name_is_required": "Il nome dell'agente è obbligatorio",
   "com_ui_agent_recursion_limit": "Passi massimi dell'agente",
   "com_ui_agent_recursion_limit_info": "Limita il numero di passaggi che l'agente può effettuare in un'esecuzione prima di fornire una risposta finale. Il valore predefinito è 25 passaggi. Un passaggio è una richiesta API AI o un round di utilizzo dello strumento. Ad esempio, un'interazione di base con uno strumento richiede 3 passaggi: richiesta iniziale, utilizzo dello strumento e richiesta di follow-up",
+  "com_ui_agent_subagents": "Sottoagenti",
+  "com_ui_agent_subagents_add": "A",
+  "com_ui_agent_subagents_agents": "Aggiunti sottoagenti",
+  "com_ui_agent_subagents_enable": "Abilita sottoagenti",
+  "com_ui_agent_subagents_max": "Massimo di {{0}} sottoagenti raggiunto",
+  "com_ui_agent_subagents_remove": "Rimuovi {{0}} dai sottoagenti",
   "com_ui_agent_url_copied": "URL agente copiato negli appunti",
   "com_ui_agent_var": "{{0}} agente",
   "com_ui_agent_version": "Versione",
@@ -700,7 +713,6 @@
   "com_ui_analyzing": "Analizzando",
   "com_ui_analyzing_finished": "Analisi completata",
   "com_ui_api_key": "Chiave API",
-  "com_ui_api_key_copied": "Chiave API copiata negli appunti",
   "com_ui_api_key_create_error": "Impossibile creare la chiave API",
   "com_ui_api_key_created": "Chiave API creata con successo",
   "com_ui_api_key_delete_error": "Cancellazione non riuscita della chiave API",
@@ -727,8 +739,10 @@
   "com_ui_at_least_one_owner_required": "È necessario almeno un proprietario",
   "com_ui_attach_error": "Impossibile allegare il file. Crea o seleziona una conversazione, oppure prova a ricaricare la pagina.",
   "com_ui_attach_error_disabled": "Il caricamento dei file è disabilitato per questo endpoint",
+  "com_ui_attach_error_limit": "Limite di file raggiunto:",
   "com_ui_attach_error_openai": "Non è possibile allegare file dell'Assistente ad altri endpoint",
   "com_ui_attach_error_size": "Limite dimensione file superato per l'endpoint:",
+  "com_ui_attach_error_total_size": "Totale della taglia dei file raggiunto per l'endpoint:",
   "com_ui_attach_error_type": "Tipo di file non supportato per l'endpoint:",
   "com_ui_attach_remove": "Rimuovere il file",
   "com_ui_attach_warn_endpoint": "Attenzione: i file non compatibili con lo strumento potrebbero essere ignorati",
@@ -739,6 +753,7 @@
   "com_ui_authentication": "Autenticazione",
   "com_ui_authentication_type": "Tipo di autenticazione",
   "com_ui_auto": "Auto",
+  "com_ui_available_options": "Opzioni disponibili",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "ID Entra",
@@ -793,6 +808,7 @@
   "com_ui_clear_presets": "Cancella le preimpostazioni",
   "com_ui_clear_search": "Pulisci ricerca",
   "com_ui_click_to_close": "Fare clic per chiudere",
+  "com_ui_click_to_edit": "Clicca per modificare",
   "com_ui_click_to_view_var": "Clicca per vedere {{0}}",
   "com_ui_client_id": "Client ID",
   "com_ui_client_secret": "Client Secret",
@@ -804,9 +820,11 @@
   "com_ui_code": "Codice",
   "com_ui_collapse": "Crollo",
   "com_ui_collapse_chat": "Comprimi Chat",
+  "com_ui_collapse_summary": "Comprimi il riassunto",
   "com_ui_collapse_thoughts": "Pensieri al collasso",
   "com_ui_command_placeholder": "Opzionale: Inserisci un comando per il prompt o verrà utilizzato il nome",
   "com_ui_command_usage_placeholder": "Seleziona un prompt tramite comando o nome",
+  "com_ui_complete": "Completato!",
   "com_ui_complete_setup": "Completa Setup",
   "com_ui_concise": "Conciso",
   "com_ui_configure": "Configurare",
@@ -825,6 +843,7 @@
   "com_ui_conversation": "conversazione",
   "com_ui_conversation_label": "{{title}} conversazione",
   "com_ui_conversation_not_found": "Conversazione non trovata",
+  "com_ui_conversation_summarized": "Conversazione riassunta",
   "com_ui_conversations": "conversazioni",
   "com_ui_convo_archived": "Conversazione archiviata",
   "com_ui_convo_delete_error": "Eliminazione fallita della conversazione",
@@ -847,6 +866,8 @@
   "com_ui_create_new_agent": "Creare un nuovo agente",
   "com_ui_create_prompt": "Crea prompt",
   "com_ui_create_prompt_page": "Pagina di configurazione del nuovo prompt",
+  "com_ui_create_skill": "Crea Skill",
+  "com_ui_create_skill_upload": "Carica SKILL.md",
   "com_ui_created": "Creato",
   "com_ui_creating": "Creare...",
   "com_ui_creating_image": "Creazione dell'immagine. Può richiedere un momento",
@@ -903,11 +924,13 @@
   "com_ui_deleted": "Soppresso",
   "com_ui_deleting": "Eliminazione...",
   "com_ui_deleting_file": "Eliminazione del file...",
+  "com_ui_deploy": "Rilascia",
   "com_ui_descending": "Decrescente",
   "com_ui_description": "Descrizione",
   "com_ui_description_placeholder": "Opzionale: Inserisci una descrizione da mostrare per il prompt",
   "com_ui_deselect_all": "Deselezionare tutto",
   "com_ui_detailed": "Dettagliato",
+  "com_ui_details": "Dettagli",
   "com_ui_disabling": "Disattivazione...",
   "com_ui_done": "Fatto",
   "com_ui_download": "Scarica",
@@ -930,6 +953,7 @@
   "com_ui_edit_memory": "Modifica della memoria",
   "com_ui_edit_preset_title": "Modifica della preimpostazione - {{title}}",
   "com_ui_edit_prompt_page": "Modifica della pagina di prompt",
+  "com_ui_edit_skill": "Modifica skill",
   "com_ui_editable_message": "Messaggio modificabile",
   "com_ui_editor_instructions": "Trascinare l'immagine per riposizionarla - Usare il cursore dello zoom o i pulsanti per regolare le dimensioni",
   "com_ui_empty_category": "-",
@@ -955,6 +979,8 @@
   "com_ui_expand_chat": "Espandi Chat",
   "com_ui_expand_thoughts": "Espandere i pensieri",
   "com_ui_export_convo_modal": "Esporta Conversazione",
+  "com_ui_favorite": "Aggiung",
+  "com_ui_favorites": "Preferiti",
   "com_ui_feedback_more": "Altro...",
   "com_ui_feedback_more_information": "Fornire un ulteriore feedback",
   "com_ui_feedback_negative": "Necessità di miglioramento",
@@ -975,7 +1001,9 @@
   "com_ui_feedback_tag_unjustified_refusal": "Rifiutato senza motivo",
   "com_ui_field_max_length": "{{field}} deve essere inferiore a {{length}} caratteri",
   "com_ui_field_required": "Questo campo è obbligatorio",
+  "com_ui_file": "File",
   "com_ui_file_input_avatar_label": "Inserimento del file per l'avatar",
+  "com_ui_file_modified": "Modif",
   "com_ui_file_size": "Dimensione del file",
   "com_ui_file_token_limit": "Limite del token del file",
   "com_ui_file_token_limit_desc": "Impostare il limite massimo di token per l'elaborazione dei file per controllare i costi e l'utilizzo delle risorse.",
@@ -983,6 +1011,7 @@
   "com_ui_filter_mcp_servers": "Filtrare i server MCP per nome",
   "com_ui_filter_prompts": "Filtra Prompt",
   "com_ui_filter_prompts_name": "Filtra prompt per nome",
+  "com_ui_filter_skills_name": "Modificato",
   "com_ui_final_touch": "Tocco finale",
   "com_ui_finance": "Finanza",
   "com_ui_fork": "Duplica",
@@ -1028,7 +1057,6 @@
   "com_ui_hide": "Nascondere",
   "com_ui_hide_code": "Nascondi Codice",
   "com_ui_hide_image_details": "Nascondi dettagli immagine",
-  "com_ui_hide_password": "Nascondere la password",
   "com_ui_hide_qr": "Nascondi codice QR",
   "com_ui_high": "Alto",
   "com_ui_host": "Host",
@@ -1038,6 +1066,7 @@
   "com_ui_image_details": "Dettagli immagine",
   "com_ui_image_edited": "Immagine modificata",
   "com_ui_image_gen": "Generazione immagine",
+  "com_ui_image_gen_failed": "Generazione dell'immagine fallita",
   "com_ui_import": "Importa",
   "com_ui_import_conversation_error": "Si è verificato un errore durante l'importazione delle conversazioni",
   "com_ui_import_conversation_file_type_error": "Tipo di importazione non supportato",
@@ -1049,16 +1078,23 @@
   "com_ui_initializing": "Inizializzazione...",
   "com_ui_input": "Input",
   "com_ui_instructions": "Istruzioni",
+  "com_ui_invocation_auto": "A",
+  "com_ui_invocation_both": "Entrambi",
+  "com_ui_invocation_manual": "Manuale",
+  "com_ui_invocation_mode": "M",
+  "com_ui_invoked_by": "Chiamato da",
   "com_ui_key": "Chiave",
   "com_ui_key_required": "È richiesta la chiave API",
-  "com_ui_last_used": "Ultimo utilizzo",
   "com_ui_late_night": "Buona tarda serata",
   "com_ui_latest_footer": "L'intelligenza artificiale per tutti.",
   "com_ui_latest_version": "Ultima versione",
   "com_ui_leave_blank_to_keep": "Lasciare in bianco per mantenere l'esistente",
   "com_ui_light_theme_enabled": "Tema luminoso abilitato",
+  "com_ui_line_count": "linea {0}",
+  "com_ui_lines_count": "{0} linee",
   "com_ui_link_copied": "Link copiato",
   "com_ui_link_refreshed": "Link aggiornato",
+  "com_ui_live": "live",
   "com_ui_loading": "Caricamento...",
   "com_ui_locked": "Bloccato",
   "com_ui_logo": "{{0}} Logo",
@@ -1144,6 +1180,7 @@
   "com_ui_mermaid_failed": "Impossibile eseguire il rendering del diagramma:",
   "com_ui_mermaid_source": "Codice sorgente:",
   "com_ui_message_input": "Inserimento del messaggio",
+  "com_ui_message_nav": "Na",
   "com_ui_microphone_unavailable": "Il microfono non è disponibile",
   "com_ui_min_tags": "Impossibile rimuovere altri valori, è richiesto un minimo di {{0}}.",
   "com_ui_minimal": "Minimo",
@@ -1161,7 +1198,6 @@
   "com_ui_new_conversation_title": "Titolo della nuova conversazione",
   "com_ui_next": "Succ",
   "com_ui_no": "No",
-  "com_ui_no_api_keys": "Non ci sono ancora chiavi API. Createne una per iniziare.",
   "com_ui_no_auth": "Nessuna autorizzazione",
   "com_ui_no_bookmarks": "Sembra che tu non abbia ancora segnalibri. Clicca su una chat e aggiungine uno nuovo",
   "com_ui_no_bookmarks_match": "Nessun segnalibro corrispondente alla ricerca",
@@ -1175,7 +1211,6 @@
   "com_ui_no_memories": "Nessun ricordo. Crearli manualmente o chiedere all'IA di ricordare qualcosa.",
   "com_ui_no_memories_match": "Nessun ricordo corrisponde alla tua ricerca",
   "com_ui_no_memories_title": "Non ci sono ancora ricordi",
-  "com_ui_no_personalization_available": "Al momento non sono disponibili opzioni di personalizzazione",
   "com_ui_no_prompts_title": "Non ci sono ancora suggerimenti",
   "com_ui_no_read_access": "Non hai il permesso di visualizzare i ricordi",
   "com_ui_no_results_found": "Nessun risultato trovato",
@@ -1196,6 +1231,7 @@
   "com_ui_of": "di",
   "com_ui_off": "Disattivo",
   "com_ui_offline": "Non in linea",
+  "com_ui_omitted": "Omesso",
   "com_ui_on": "Attivo",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (si apre in una nuova scheda)",
   "com_ui_open_source_chat_new_tab": "Chat Open Source in una nuova scheda",
@@ -1203,7 +1239,11 @@
   "com_ui_open_var": "Aperto {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "(opzionale)",
+  "com_ui_options": "opzioni",
+  "com_ui_output": "Output",
   "com_ui_page": "Pagina",
+  "com_ui_pagination": "paginazione",
+  "com_ui_parameters": "Paramet",
   "com_ui_people": "persone",
   "com_ui_people_picker": "Picker per le persone",
   "com_ui_people_picker_allow_view_groups": "Consentire la visualizzazione di gruppi",
@@ -1215,9 +1255,12 @@
   "com_ui_pin": "Spillo",
   "com_ui_preferences_updated": "Le preferenze sono state aggiornate con successo",
   "com_ui_prev": "Prec",
+  "com_ui_prev_result": "Risultato precedente",
   "com_ui_preview": "Anteprima",
+  "com_ui_preview_failed": "Anteprima non disponibile",
   "com_ui_privacy_policy": "Informativa sulla privacy",
   "com_ui_privacy_policy_url": "URL Informativa Privacy",
+  "com_ui_production": "Produzione",
   "com_ui_prompt": "Prompt",
   "com_ui_prompt_group_button": "{{name}} richiesta, {{category}} categoria",
   "com_ui_prompt_group_button_no_category": "{{name}} tempestivamente",
@@ -1237,7 +1280,10 @@
   "com_ui_prompts_allow_use": "Consenti uso dei prompt",
   "com_ui_provider": "Fornitore",
   "com_ui_quality": "Qualità",
+  "com_ui_ran_n_agents": "Lanciato {{0}} agenti",
   "com_ui_read_aloud": "Leggi ad alta voce",
+  "com_ui_read_file": "Le",
+  "com_ui_reading_file": "Leggendo  {{0}}",
   "com_ui_redirect_uri": "Reindirizzamento URI",
   "com_ui_redirect_uri_instructions": "Copia questo URI di reindirizzamento e configuralo nelle impostazioni del tuo provider OAuth.",
   "com_ui_redirecting_to_provider": "Reindirizzamento a {{0}}, attendere prego...",
@@ -1264,6 +1310,7 @@
   "com_ui_remote_agents_allow_share_public": "Consentire agli utenti di concedere l'accesso API agli agenti a tutti gli utenti",
   "com_ui_remote_agents_allow_use": "Consentire agli utenti di creare chiavi API e interrogare gli agenti da remoto.",
   "com_ui_remove_agent_from_chain": "Rimuovere {{0}} dalla catena",
+  "com_ui_remove_skill_var": "Elimina {{0}}",
   "com_ui_remove_user": "Rimuovere {{0}}",
   "com_ui_rename": "Rinomina",
   "com_ui_rename_conversation": "Rinominare la conversazione",
@@ -1302,6 +1349,9 @@
   "com_ui_rotate_90": "Ruota di 90 gradi",
   "com_ui_run_code": "Esegui Codice",
   "com_ui_run_code_error": "Si è verificato un errore durante l'esecuzione del codice",
+  "com_ui_running": "Eseguendo...",
+  "com_ui_running_command": "Lanciando il comando",
+  "com_ui_running_n_agents": "Lanciando {{0}} agenti",
   "com_ui_save": "Salva",
   "com_ui_save_badge_changes": "Salvare le modifiche ai badge?",
   "com_ui_save_changes": "Salva le modifiche",
@@ -1312,6 +1362,7 @@
   "com_ui_saving": "Risparmio...",
   "com_ui_schema": "Schema",
   "com_ui_scope": "Ambito",
+  "com_ui_scroll_to_bottom": "Scorri in fondo",
   "com_ui_search": "Cerca",
   "com_ui_search_above_to_add": "Cercare sopra per aggiungere utenti o gruppi",
   "com_ui_search_above_to_add_all": "Ricerca in alto per aggiungere utenti, gruppi o ruoli",
@@ -1319,6 +1370,9 @@
   "com_ui_search_agent_category": "Ricerca per categorie...",
   "com_ui_search_default_placeholder": "Ricerca per nome o e-mail (minimo 2 caratteri)",
   "com_ui_search_people_placeholder": "Ricerca di persone o gruppi per nome o e-mail",
+  "com_ui_search_result_count": "{",
+  "com_ui_search_results_count": "{{count}} risultati trovati",
+  "com_ui_search_skills": "Cerca skill",
   "com_ui_seconds": "secondi",
   "com_ui_secret_key": "Chiave segreta",
   "com_ui_select": "Seleziona",
@@ -1354,18 +1408,45 @@
   "com_ui_show_all": "Mostra Tutto",
   "com_ui_show_code": "Mostra il codice",
   "com_ui_show_image_details": "Mostra dettagli immagine",
-  "com_ui_show_password": "Mostra password",
   "com_ui_show_qr": "Mostra codice QR",
   "com_ui_sign_in_to_domain": "Accedi a {{0}}",
-  "com_ui_simple": "Semplice",
   "com_ui_size": "Dimensione",
   "com_ui_size_sort": "Ordina per dimensione",
+  "com_ui_skill": "Skill",
+  "com_ui_skill_content": "Conte",
+  "com_ui_skill_create_error": "Impossibile creare skill",
+  "com_ui_skill_create_title": "Crea skill",
+  "com_ui_skill_created": "Skill creata",
+  "com_ui_skill_delete_error": "Impossibile eliminare skill",
+  "com_ui_skill_deleted": "Skill eliminata",
+  "com_ui_skill_description_required": "Descrizione obbligatoria",
+  "com_ui_skill_edit_title": "Modifica skill",
+  "com_ui_skill_instructions": "Istruzioni",
+  "com_ui_skill_name_required": "Nome è obbligatorio",
+  "com_ui_skill_new_file": "Nuovo File",
+  "com_ui_skill_new_folder": "Nu",
+  "com_ui_skill_no_edit_permission": "Non hai i permessi per modificare questa skill",
+  "com_ui_skill_no_selection": "Seleziona una skill",
+  "com_ui_skill_no_selection_desc": "Scegli una skill dalla barra laterale per vederne i dettagli.",
+  "com_ui_skill_not_found": "Skill non trovata",
+  "com_ui_skill_sr_public": "Skill pubblica",
+  "com_ui_skill_update_error": "Impossibil salvare skill",
+  "com_ui_skill_updated": "Skill salvata",
+  "com_ui_skill_upload": "Carica una skill",
+  "com_ui_skill_upload_file": "Carica File",
+  "com_ui_skill_upload_req_zip": "I file .zip o .skill devono includere un file SKILL.md",
+  "com_ui_skill_view_source": "Vedi fonte",
+  "com_ui_skills": "Skills",
+  "com_ui_skills_enable_toggle": "Abilita skills per questo agente",
+  "com_ui_skills_load_error": "Impossibile caricare skill",
+  "com_ui_skills_manual_invoked": "Skill invocate manualmente",
+  "com_ui_special": "speciale",
   "com_ui_special_var_current_date": "Data attuale",
   "com_ui_special_var_current_datetime": "Data e ora corrente",
   "com_ui_special_var_current_user": "Utente corrente",
   "com_ui_special_var_iso_datetime": "Ora solare UTC ISO",
   "com_ui_special_variable_added": "{{0}} aggiunta di una variabile speciale.",
-  "com_ui_special_variables": "Variabili speciali:",
+  "com_ui_special_variables": "Variabili speciali",
   "com_ui_speech_not_supported": "Il tuo browser non supporta il riconoscimento vocale",
   "com_ui_speech_not_supported_use_external": "Il browser non supporta il riconoscimento vocale. Provare a passare a STT esterno in Impostazioni > Parlato.",
   "com_ui_speech_while_submitting": "Impossibile inviare il messaggio mentre è in corso la generazione di una risposta",
@@ -1375,7 +1456,21 @@
   "com_ui_stop": "Ferma",
   "com_ui_storage": "Archiviazione",
   "com_ui_storage_filter_sort": "Filtrare e ordinare per stoccaggio",
+  "com_ui_subagent_cancelled": "Agente cancellato",
+  "com_ui_subagent_complete": "Eseguito l'agente",
+  "com_ui_subagent_dialog_title": "agente \"{{0}}\"",
+  "com_ui_subagent_dialog_title_self": "Agente",
+  "com_ui_subagent_empty_result": "Nessun testo restituito",
+  "com_ui_subagent_scroll_to_bottom": "Scorri al più recente",
+  "com_ui_subagent_ticker_error": "Errore",
+  "com_ui_subagent_ticker_reasoning": "Ragionamento",
+  "com_ui_subagent_ticker_tool_done": "fi",
+  "com_ui_subagent_ticker_using": "finito",
+  "com_ui_subagent_ticker_writing": "Scrivendo...",
+  "com_ui_subagent_waiting": "In attesa del primo aggiornamento",
   "com_ui_submit": "Invia",
+  "com_ui_summarized": "Riassunto",
+  "com_ui_summarizing": "Riassumendo...",
   "com_ui_support_contact": "Contatto di supporto",
   "com_ui_support_contact_email": "Email",
   "com_ui_support_contact_email_invalid": "Inserire un indirizzo e-mail valido",
@@ -1387,6 +1482,7 @@
   "com_ui_temporary": "Chat temporanea",
   "com_ui_terms_and_conditions": "Termini d'uso",
   "com_ui_terms_of_service": "Termini di servizio",
+  "com_ui_text_variables": "Variabili testuali",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensieri",
   "com_ui_toggle_theme": "Toggle theme",
@@ -1395,8 +1491,13 @@
   "com_ui_token_url": "URL del token",
   "com_ui_tokens": "gettoni",
   "com_ui_tool_collection_prefix": "Una raccolta di strumenti da",
+  "com_ui_tool_failed": "fallito",
   "com_ui_tool_list_collapse": "Crollo {{serverName}} elenco degli strumenti",
   "com_ui_tool_list_expand": "Espandi {{serverName}} elenco degli strumenti",
+  "com_ui_tool_name_code": "Codice",
+  "com_ui_tool_name_code_analysis": "Analisi del Codice",
+  "com_ui_tool_name_image_gen": "Generazione immagine",
+  "com_ui_tool_name_web_search": "Ricerca Web",
   "com_ui_tools": "Strumenti",
   "com_ui_tools_and_actions": "Strumenti e azioni",
   "com_ui_transferred_to": "Trasferito a",
@@ -1410,6 +1511,7 @@
   "com_ui_unarchive_error": "Impossibile disarchiviare la conversazione",
   "com_ui_unavailable": "Non disponibile",
   "com_ui_unknown": "Sconosciuto",
+  "com_ui_unknown_file_type": "Tipo di file sconosciuto",
   "com_ui_unpin": "Spillare",
   "com_ui_unset": "Non impostato",
   "com_ui_untitled": "Senza titolo",
@@ -1439,6 +1541,7 @@
   "com_ui_use_backup_code": "Usa invece il codice di backup",
   "com_ui_use_memory": "Usa la memoria",
   "com_ui_use_micrphone": "Usa microfono",
+  "com_ui_use_prompt": "Usa Prompt",
   "com_ui_used": "Usato",
   "com_ui_user": "Utente",
   "com_ui_user_group_permissions": "Autorizzazioni per utenti e gruppi",
@@ -1459,6 +1562,8 @@
   "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "API Serper",
   "com_ui_web_search_provider_serper_key": "Ottenere la chiave API di Serper",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Ottieni la tua API key Tavily",
   "com_ui_web_search_reading": "Risultati della lettura",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1471,19 +1576,26 @@
   "com_ui_web_search_scraper_firecrawl_key": "Ottieni la tua chiave API Firecrawl",
   "com_ui_web_search_scraper_serper": "API di raschiamento Serper",
   "com_ui_web_search_scraper_serper_key": "Ottenere la chiave API di Serper",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Ottieni la tua API key Tavily",
   "com_ui_web_search_searxng_api_key": "Inserire la chiave API di SearXNG (facoltativa)",
   "com_ui_web_search_searxng_instance_url": "URL dell'istanza SearXNG",
+  "com_ui_web_search_source": "{{count}} fonte",
+  "com_ui_web_search_sources": "{{count}} fonti",
+  "com_ui_web_searched": "Cercato sul web",
   "com_ui_web_searching": "Ricerca sul web",
   "com_ui_web_searching_again": "Cercare di nuovo sul web",
   "com_ui_weekend_morning": "Buon fine settimana",
   "com_ui_write": "Scrittura",
+  "com_ui_writing_command": "Scrivendo il comando",
   "com_ui_x_selected": "{{0}} selezionato",
   "com_ui_xhigh": "Extra alto",
   "com_ui_yes": "Sì",
+  "com_ui_you": "Tu",
   "com_ui_your_api_key": "La vostra chiave API",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Ingrandisci",
   "com_ui_zoom_level": "Livello di zoom",
   "com_ui_zoom_out": "Zoom out",
-  "com_user_message": "Mostra nome utente nei messaggi"
+  "com_user_message": "Tu"
 }
diff --git a/client/src/locales/ja/translation.json b/client/src/locales/ja/translation.json
index b5e38c6095f..51ce936113e 100644
--- a/client/src/locales/ja/translation.json
+++ b/client/src/locales/ja/translation.json
@@ -2,9 +2,13 @@
   "chat_direction_left_to_right": "左から右へ",
   "chat_direction_right_to_left": "右から左へ",
   "com_a11y_ai_composing": "AIはまだ作成中です。",
+  "com_a11y_chats_date_section": "{{date}} からのチャット",
   "com_a11y_end": "AIは返信を完了しました。",
   "com_a11y_selected": "選択済み",
   "com_a11y_start": "AIが返信を開始しました。",
+  "com_a11y_summarize_completed": "コンテキストを要約しました。",
+  "com_a11y_summarize_failed": "要約に失敗しました。利用可能なコンテキストで続行します。",
+  "com_a11y_summarize_started": "コンテキストの要約。",
   "com_agents_agent_card_label": "{{name}} エージェント。 {{description}}",
   "com_agents_all": "すべてのエージェント",
   "com_agents_all_category": "全て",
@@ -12,7 +16,7 @@
   "com_agents_avatar_upload_error": "エージェントのアバターをアップロードできませんでした",
   "com_agents_category_aftersales": "アフターセールス",
   "com_agents_category_aftersales_description": "販売後のサポート、メンテナンス、顧客サービスに特化したエージェント",
-  "com_agents_category_empty": "エージェントは見つかりませんでした {{category}} カテゴリ",
+  "com_agents_category_empty": "{{category}} カテゴリ内からエージェントが見つかりませんでした ",
   "com_agents_category_finance": "財務",
   "com_agents_category_finance_description": "財務分析、予算編成、会計を専門とするエージェント",
   "com_agents_category_general": "一般",
@@ -25,7 +29,7 @@
   "com_agents_category_rd_description": "研究開発プロセス、イノベーション、技術研究に焦点を当てたエージェント",
   "com_agents_category_sales": "販売",
   "com_agents_category_sales_description": "販売プロセス、顧客関係に重点を置くエージェント",
-  "com_agents_category_tab_label": "{{category}} カテゴリ、 {{total}} の{{position}} ",
+  "com_agents_category_tab_label": "{{category}} カテゴリ。 {{total}} 分の {{position}} ",
   "com_agents_category_tabs_label": "エージェントのカテゴリー",
   "com_agents_chat_with": "{{name}}とチャットする ",
   "com_agents_clear_search": "検索をクリア",
@@ -47,7 +51,7 @@
   "com_agents_error_network_suggestion": "インターネット接続を確認して、もう一度お試しください。",
   "com_agents_error_network_title": "接続の問題",
   "com_agents_error_not_found_message": "要求されたコンテンツが見つかりません。",
-  "com_agents_error_not_found_suggestion": "他のオプションを見てみるか、マーケットプレイスに戻る。",
+  "com_agents_error_not_found_suggestion": "他のオプションを参照してみるか、マーケットプレイスに戻ってください。",
   "com_agents_error_not_found_title": "見つかりません",
   "com_agents_error_retry": "もう一度やり直してください",
   "com_agents_error_search_title": "検索エラー",
@@ -99,7 +103,7 @@
   "com_agents_update_error": "エージェントの更新中にエラーが発生しました。",
   "com_assistants_actions": "アクション",
   "com_assistants_actions_disabled": "アクションを追加する前にアシスタントを作成する必要があります。",
-  "com_assistants_actions_info": "アシスタントが API を介して情報を取得したり、アクションを実行したりできるようにします's",
+  "com_assistants_actions_info": "アシスタントが API を介して情報を取得したり、アクションを実行したりできるようにします",
   "com_assistants_add_actions": "アクションを追加",
   "com_assistants_add_mcp_server_tools": "MCPサーバーツールの追加",
   "com_assistants_add_tools": "ツールを追加",
@@ -221,7 +225,7 @@
   "com_endpoint_anthropic_maxoutputtokens": "レスポンスで生成できるトークンの最大数。短い応答には低い値を、長い応答には高い値を指定します。注：モデルはこの最大値に達する前に停止することがあります。",
   "com_endpoint_anthropic_prompt_cache": "プロンプトキャッシュを使用すると、API呼び出し間で大きなコンテキストや指示を再利用でき、コストとレイテンシを削減できます",
   "com_endpoint_anthropic_temp": "0から1の値。分析的・多岐の選択になる課題には0に近い値を入力する。創造的・生成的な課題には1に近い値を入力する。この値か Top P の変更をおすすめしますが、両方の変更はおすすめしません。",
-  "com_endpoint_anthropic_thinking": "サポートされているClaudeモデル（3.7 Sonnet）の内部推論を有効にします。注：「思考予算」が「最大出力トークン」よりも低く設定されている必要があります。",
+  "com_endpoint_anthropic_thinking": "サポートされているClaudeモデルの内部推論を有効にします。新しいモデル（Opus 4.6+）では、Effortパラメーターで制御される「Adaptive Thinking」を使用します。レガシーモデルでは、「Thinking Budget」を設定し、「最大出力トークン」より低くする必要があります。",
   "com_endpoint_anthropic_thinking_budget": "Claude が内部推論プロセスで使用できるトークンの最大数を指定します。予算を大きくすると、複雑な問題に対するより徹底的な分析が可能になり、応答品質が向上します。ただし、特に 32K を超える範囲では、Claude は割り当てられた予算をすべて使用できない可能性があります。この設定は「最大出力トークン」よりも小さくする必要があります。",
   "com_endpoint_anthropic_topk": "Top-k はモデルがトークンをどのように選択して出力するかを変更します。top-kが1の場合はモデルの語彙に含まれるすべてのトークンの中で最も確率が高い1つが選択されます(greedy decodingと呼ばれている)。top-kが3の場合は上位3つのトークンの中から選択されます。(temperatureを使用)",
   "com_endpoint_anthropic_topp": "Top-p はモデルがトークンをどのように選択して出力するかを変更します。K(topKを参照)の確率の合計がtop-pの確率と等しくなるまでのトークンが選択されます。",
@@ -368,6 +372,7 @@
   "com_error_no_base_url": "ベースURLが見つかりません。ベースURLを入力して再試行してください。",
   "com_error_no_user_key": "キーが見つかりません。キーを入力して再試行してください。",
   "com_error_refusal": "安全フィルターにより応答が拒否されました。メッセージを書き直し、再度お試しください。Claude Sonnet 4.5またはOpus 4.1使用中にこの現象が頻繁に発生する場合は、使用制限が異なるSonnet 4をお試しください。",
+  "com_error_stream_expired": "Claudeの推論が返されるかどうかを制御します。「自動」は、デフォルトでそれらを非表示にするモデルの要約された考えにオプトインします（ Opus 4.7以降）。「要約」は常にそれらを表示します。「省略」は、レイテンシをわずかに低くするために常にそれらを非表示にします。",
   "com_file_pages": "ページ： {{pages}}",
   "com_file_source": "ファイル",
   "com_file_unknown": "不明ファイル",
@@ -382,7 +387,7 @@
   "com_files_preparing_download": "ダウンロードの準備...",
   "com_files_results_found": "{{count}} 件の結果が見つかりました",
   "com_files_sharepoint_picker_title": "ファイルを選択",
-  "com_files_table": "ここに何かを入れる必要があります。空でした",
+  "com_files_table": "ファイルテーブル",
   "com_files_upload_local_machine": "ローカルコンピュータから",
   "com_files_upload_sharepoint": "SharePointから",
   "com_generated_files": "生成されたファイル:",
@@ -428,8 +433,6 @@
   "com_nav_browser": "ブラウザ",
   "com_nav_center_chat_input": "ようこそ画面の中央にチャット入力を配置",
   "com_nav_change_picture": "画像を変更",
-  "com_nav_chat_commands": "チャットコマンド",
-  "com_nav_chat_commands_info": "メッセージの先頭に特定の文字を入力することで、これらのコマンドが有効になります。各コマンドは、決められた文字（プレフィックス）で起動します。メッセージの先頭にこれらの文字をよく使用する場合は、コマンド機能を無効にすることができます。",
   "com_nav_chat_direction": "チャットの方向",
   "com_nav_chat_direction_selected": "チャットの方向: {{direction}}",
   "com_nav_clear_all_chats": "すべてのチャットを削除する",
@@ -437,7 +440,6 @@
   "com_nav_clear_conversation": "会話を削除する",
   "com_nav_clear_conversation_confirm_message": "本当にすべての会話を削除しますか？ この操作は取り消せません。",
   "com_nav_close_sidebar": "サイドバーを閉じる",
-  "com_nav_commands": "Commands",
   "com_nav_confirm_clear": "削除を確定",
   "com_nav_control_panel": "コントロールパネル",
   "com_nav_conversation_mode": "会話モード",
@@ -549,6 +551,7 @@
   "com_nav_mcp_vars_updated": "MCP カスタムユーザー変数が正常に更新されました。",
   "com_nav_modular_chat": "会話の途中でのエンドポイント切替を有効化",
   "com_nav_my_files": "自分のファイル",
+  "com_nav_new_chat_switch_to_history": "新規チャットでチャット履歴に切り替える",
   "com_nav_not_supported": "サポートされていません",
   "com_nav_open_sidebar": "サイドバーを開く",
   "com_nav_playback_rate": "オーディオ再生速度",
@@ -562,13 +565,10 @@
   "com_nav_search_placeholder": "メッセージ検索",
   "com_nav_send_message": "メッセージを送信する",
   "com_nav_setting_account": "アカウント",
-  "com_nav_setting_balance": "残高",
   "com_nav_setting_chat": "チャット",
-  "com_nav_setting_data": "データ管理",
   "com_nav_setting_delay": "遅延（秒）",
   "com_nav_setting_general": "一般",
   "com_nav_setting_mcp": "MCP設定",
-  "com_nav_setting_personalization": "パーソナライゼーション",
   "com_nav_setting_speech": "スピーチ",
   "com_nav_settings": "設定",
   "com_nav_shared_links": "共有リンク",
@@ -636,10 +636,12 @@
   "com_ui_add_first_bookmark": "チャットを追加するにはクリックしてください",
   "com_ui_add_first_mcp_server": "最初のMCPサーバーを作成して始めましょう",
   "com_ui_add_first_prompt": "始めるにはプロンプトを作成してください",
+  "com_ui_add_labels": "ラベルの追加",
   "com_ui_add_mcp": "MCPの追加",
   "com_ui_add_mcp_server": "MCPサーバーの追加",
   "com_ui_add_model_preset": "追加の応答のためのモデルまたはプリセットを追加する",
   "com_ui_add_multi_conversation": "複数のチャットを追加",
+  "com_ui_add_skills": "スキルを追加",
   "com_ui_add_special_variables": "特別な変数を追加",
   "com_ui_add_web_search_api_keys": "Web検索APIキーを追加する",
   "com_ui_adding_details": "詳細を追加する",
@@ -652,7 +654,6 @@
   "com_ui_advanced_settings": "詳細設定",
   "com_ui_agent": "エージェント",
   "com_ui_agent_api_keys": "エージェントAPIキー",
-  "com_ui_agent_api_keys_description": "API 経由でリモートからエージェントにアクセスするための API キーを作成する",
   "com_ui_agent_category_aftersales": "アフターセールス",
   "com_ui_agent_category_finance": "ファイナンス",
   "com_ui_agent_category_general": "一般",
@@ -666,6 +667,7 @@
   "com_ui_agent_chain_max": "{{0}} エージェントの上限に達しました。",
   "com_ui_agent_delete_error": "エージェントの削除中にエラーが発生しました",
   "com_ui_agent_deleted": "エージェントを正常に削除しました",
+  "com_ui_agent_description": "エージェントの説明",
   "com_ui_agent_duplicate_error": "アシスタントの複製中にエラーが発生しました",
   "com_ui_agent_duplicated": "アシスタントを複製しました",
   "com_ui_agent_handoff_add": "ハンドオフ・エージェントの追加",
@@ -679,9 +681,21 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "渡されたコンテンツにラベルを付ける (デフォルト: 'instructions')",
   "com_ui_agent_handoff_prompt_placeholder": "このエージェントに、どのコンテンツを生成してハンドオフエージェントに渡すかを伝えます。この機能を有効にするには、ここに何かを追加する必要があります。",
   "com_ui_agent_handoffs": "エージェント・ハンドオフ",
+  "com_ui_agent_name": "エージェント名",
   "com_ui_agent_name_is_required": "エージェント名は必須",
   "com_ui_agent_recursion_limit": "最大エージェントステップ数",
   "com_ui_agent_recursion_limit_info": "エージェントが最終応答を返す前に実行できるステップ数を制限します。デフォルトは25ステップです。ステップとは、AI APIリクエストまたはツール使用ラウンドのいずれかです。例えば、基本的なツールインタラクションは、最初のリクエスト、ツール使用、そしてフォローアップリクエストの3ステップで構成されます。",
+  "com_ui_agent_subagents": "サブエージェント",
+  "com_ui_agent_subagents_add": "サブエージェントの追加",
+  "com_ui_agent_subagents_agents": "追加のサブエージェント",
+  "com_ui_agent_subagents_allow_self": "セルフスポーンを許可する",
+  "com_ui_agent_subagents_allow_self_info": "このエージェントが、隔離されたコンテキストウィンドウ内で、自分自身のコピーに集中したサブタスクを委任できるようにする。",
+  "com_ui_agent_subagents_empty": "サブエージェントがいません：セルフスポーンを有効にするか、少なくとも1人のエージェントを追加してください。",
+  "com_ui_agent_subagents_enable": "サブエージェントを有効にする",
+  "com_ui_agent_subagents_info": "サブエージェントは隔離されたコンテキストウィンドウ内で実行される。\n詳細なツール出力は子エージェントの内部にとどまり、このエージェントには要約だけが返ってくる。",
+  "com_ui_agent_subagents_info_2": "エージェントを一つも指定せずにこの機能を有効化しても、self‑spawn は依然として可能である。\nつまり、このエージェントは自分自身の新しいコピーを生成し、集中したサブタスクをそのコピーに委任できる。",
+  "com_ui_agent_subagents_max": "最大 {{0}} サブエージェントに到達しました。",
+  "com_ui_agent_subagents_remove": "サブエージェントより {{0}} を削除",
   "com_ui_agent_url_copied": "エージェントのURLをクリップボードにコピー",
   "com_ui_agent_var": "{{0}}エージェント",
   "com_ui_agent_version": "バージョン",
@@ -707,12 +721,12 @@
   "com_ui_analyzing": "分析中",
   "com_ui_analyzing_finished": "分析終了",
   "com_ui_api_key": "APIキー",
-  "com_ui_api_key_copied": "APIキーをクリップボードにコピーしました",
   "com_ui_api_key_create_error": "APIキーの作成に失敗しました",
   "com_ui_api_key_created": "APIキーの作成に成功しました",
   "com_ui_api_key_delete_error": "APIキーの削除に失敗しました",
   "com_ui_api_key_deleted": "APIキーの削除に成功しました",
   "com_ui_api_key_name": "キー名",
+  "com_ui_api_key_name_placeholder": "私のAPIキー",
   "com_ui_api_key_name_required": "APIキー名は必須",
   "com_ui_api_key_warning": "APIキーをコピーしてください。二度と見ることができなくなります！",
   "com_ui_api_keys_load_error": "APIキーのロードに失敗しました",
@@ -720,6 +734,7 @@
   "com_ui_archive_delete_error": "アーカイブされた会話の削除に失敗しました",
   "com_ui_archive_error": "アーカイブに失敗しました。",
   "com_ui_artifact_click": "クリックして開く",
+  "com_ui_artifact_preview_pending": "プレビューはまだ利用できません - ファイルを表示するには**ダウンロード**をクリックしてください。",
   "com_ui_artifacts": "アーティファクト",
   "com_ui_artifacts_options": "アーティファクト・オプション",
   "com_ui_artifacts_toggle": "アーティファクト UI の切替",
@@ -747,6 +762,7 @@
   "com_ui_authentication": "認証",
   "com_ui_authentication_type": "認証タイプ",
   "com_ui_auto": "自動",
+  "com_ui_available_options": "利用可能なオプション",
   "com_ui_avatar": "アバター",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "Entra ID",
@@ -801,6 +817,7 @@
   "com_ui_clear_presets": "プリセットをクリア",
   "com_ui_clear_search": "検索をクリア",
   "com_ui_click_to_close": "クリックして閉じる",
+  "com_ui_click_to_edit": "クリックして編集する",
   "com_ui_click_to_view_var": "クリックして表示 {{0}}",
   "com_ui_client_id": "クライアントID",
   "com_ui_client_secret": "クライアントシークレット",
@@ -812,9 +829,12 @@
   "com_ui_code": "コード",
   "com_ui_collapse": "折りたたむ",
   "com_ui_collapse_chat": "チャットを折りたたむ",
+  "com_ui_collapse_summary": "概要を折りたたむ",
   "com_ui_collapse_thoughts": "思考を折りたたむ",
+  "com_ui_command_finished": "実行を終了しました",
   "com_ui_command_placeholder": "オプション:プロンプトのコマンドまたは名前を入力",
   "com_ui_command_usage_placeholder": "コマンドまたは名前でプロンプトを選択してください",
+  "com_ui_complete": "完了！",
   "com_ui_complete_setup": "セットアップ完了",
   "com_ui_concise": "簡潔",
   "com_ui_configure": "設定",
@@ -824,6 +844,7 @@
   "com_ui_confirm_admin_use_change": "この設定を変更すると、あなた自身を含む管理者のアクセスがブロックされます。本当によろしいですか？",
   "com_ui_confirm_change": "変更の確認",
   "com_ui_connecting": "接続中",
+  "com_ui_contact_admin_if_issue_persists": "問題が解決しない場合は、管理者に連絡してください。",
   "com_ui_context": "コンテキスト",
   "com_ui_context_filter_sort": "コンテキストによるフィルターと並べ替え",
   "com_ui_continue": "続ける",
@@ -842,6 +863,7 @@
   "com_ui_copy_code": "コードをコピーする",
   "com_ui_copy_link": "リンクをコピー",
   "com_ui_copy_stack_trace": "スタックトレースをコピーする",
+  "com_ui_copy_summary": "要約をクリップボードにコピー",
   "com_ui_copy_thoughts_to_clipboard": "考えをクリップボードにコピーする",
   "com_ui_copy_to_clipboard": "クリップボードへコピー",
   "com_ui_copy_url_to_clipboard": "URLをクリップボードにコピー",
@@ -854,6 +876,9 @@
   "com_ui_create_new_agent": "新しいエージェントを作成",
   "com_ui_create_prompt": "プロンプトを作成する",
   "com_ui_create_prompt_page": "新しいプロンプト設定ページ",
+  "com_ui_create_skill": "スキルを作成",
+  "com_ui_create_skill_upload": "SKILL.md をアップロード",
+  "com_ui_create_skill_upload_error": "アップロードされたファイルが読めませんでした。",
   "com_ui_created": "作成済",
   "com_ui_creating": "作成...",
   "com_ui_creating_image": "画像を作成しています。しばらく時間がかかる場合があります",
@@ -896,6 +921,7 @@
   "com_ui_delete_conversation": "チャットを削除しますか？",
   "com_ui_delete_conversation_tooltip": "会話の削除",
   "com_ui_delete_mcp_server": "MCPサーバーを削除しますか？",
+  "com_ui_delete_mcp_server_name": "MCPサーバーを削除する {{0}}",
   "com_ui_delete_memory": "メモリの削除",
   "com_ui_delete_not_allowed": "削除操作は許可されていません",
   "com_ui_delete_preset": "プリセットを削除しますか?",
@@ -909,11 +935,13 @@
   "com_ui_deleted": "削除済み",
   "com_ui_deleting": "削除しています...",
   "com_ui_deleting_file": "ファイルの削除...",
+  "com_ui_deploy": "展開する",
   "com_ui_descending": "降順",
   "com_ui_description": "説明",
   "com_ui_description_placeholder": "オプション:プロンプトを表示するときの説明を入力",
   "com_ui_deselect_all": "すべて選択解除",
   "com_ui_detailed": "詳細",
+  "com_ui_details": "詳細",
   "com_ui_disabling": "無効化...",
   "com_ui_done": "完了",
   "com_ui_download": "ダウンロード",
@@ -936,6 +964,7 @@
   "com_ui_edit_memory": "メモリ編集",
   "com_ui_edit_preset_title": "プリセットの編集 - {{title}}",
   "com_ui_edit_prompt_page": "プロンプトページを編集",
+  "com_ui_edit_skill": "スキルを編集",
   "com_ui_editable_message": "編集可能なメッセージ",
   "com_ui_editor_instructions": "画像をドラッグして位置を変更 - ズームスライダーまたはボタンでサイズを調整",
   "com_ui_empty_category": "-",
@@ -961,6 +990,9 @@
   "com_ui_expand_chat": "チャットを展開",
   "com_ui_expand_thoughts": "思考を展開",
   "com_ui_export_convo_modal": "エクスポート",
+  "com_ui_failed": "失敗",
+  "com_ui_favorite": "お気に入りに追加",
+  "com_ui_favorites": "お気に入り",
   "com_ui_feedback_more": "もっと...",
   "com_ui_feedback_more_information": "追加フィードバックの提供",
   "com_ui_feedback_negative": "改善が必要",
@@ -979,7 +1011,9 @@
   "com_ui_feedback_tag_unjustified_refusal": "理由もなく拒否された",
   "com_ui_field_max_length": "{{field}} 以下でなければならない。 {{length}} 文字",
   "com_ui_field_required": "必須入力項目です",
+  "com_ui_file": "ファイル",
   "com_ui_file_input_avatar_label": "アバター用ファイル入力",
+  "com_ui_file_modified": "修正済み",
   "com_ui_file_size": "ファイルサイズ",
   "com_ui_file_token_limit": "ファイル・トークンの制限",
   "com_ui_file_token_limit_desc": "ファイル処理のトークン上限を設定し、コストとリソースの使用量を管理する。",
@@ -987,6 +1021,7 @@
   "com_ui_filter_mcp_servers": "名前でMCPサーバーをフィルタリング",
   "com_ui_filter_prompts": "フィルタープロンプト",
   "com_ui_filter_prompts_name": "名前でプロンプトをフィルタ",
+  "com_ui_filter_skills_name": "スキルを名前でフィルタリングする",
   "com_ui_final_touch": "最後の仕上げ",
   "com_ui_finance": "財務",
   "com_ui_fork": "分岐",
@@ -1018,6 +1053,7 @@
   "com_ui_fork_visible": "表示メッセージのみ",
   "com_ui_generate_qrcode": "QRコードを生成する",
   "com_ui_generating": "生成中...",
+  "com_ui_generating_image": "画像を生成中...",
   "com_ui_generation_settings": "生成設定",
   "com_ui_getting_started": "はじめに",
   "com_ui_go_back": "戻る",
@@ -1032,7 +1068,7 @@
   "com_ui_hide": "隠す",
   "com_ui_hide_code": "コードを隠す",
   "com_ui_hide_image_details": "画像の詳細を隠す",
-  "com_ui_hide_password": "パスワードを隠す",
+  "com_ui_hide_n_files": " {{0}} ファイルを隠す",
   "com_ui_hide_qr": "QRコードを非表示にする",
   "com_ui_high": "高い",
   "com_ui_host": "ホスト",
@@ -1042,6 +1078,7 @@
   "com_ui_image_details": "画像詳細",
   "com_ui_image_edited": "画像編集済み",
   "com_ui_image_gen": "画像生成",
+  "com_ui_image_gen_failed": "画像生成に失敗",
   "com_ui_import": "読み込む",
   "com_ui_import_conversation_error": "会話のインポート時にエラーが発生しました",
   "com_ui_import_conversation_file_type_error": "サポートされていないインポート形式です",
@@ -1053,20 +1090,32 @@
   "com_ui_initializing": "初期化中...",
   "com_ui_input": "入力",
   "com_ui_instructions": "指示文",
+  "com_ui_invocation_auto": "自動",
+  "com_ui_invocation_auto_info": "スキルは、会話に関連する場合、エージェントによって自動的に適用されます",
+  "com_ui_invocation_both": "両方",
+  "com_ui_invocation_both_info": "スキルは自動的にトリガーすることも、ユーザーが手動で呼び出すこともできます",
+  "com_ui_invocation_manual": "手動",
+  "com_ui_invocation_manual_info": "スキルは、ユーザーによって明示的に呼び出された場合にのみ使用されます",
+  "com_ui_invocation_mode": "呼び出しモード",
+  "com_ui_invoked_by": "呼び出し元",
   "com_ui_key": "キー",
   "com_ui_key_required": "APIキーが必要です。",
-  "com_ui_last_used": "前回使用",
+  "com_ui_labels": "ラベル",
   "com_ui_late_night": "遅い夜を楽しんで",
+  "com_ui_latest": "最新",
   "com_ui_latest_footer": "Every AI for Everyone.",
   "com_ui_latest_version": "最新バージョン",
   "com_ui_leave_blank_to_keep": "既存を維持する場合は空白のままにして下さい",
   "com_ui_light_theme_enabled": "ライトテーマが有効",
+  "com_ui_line_count": "{0}行",
+  "com_ui_lines_count": "{0}行",
   "com_ui_link_copied": "リンクをコピーしました",
   "com_ui_link_refreshed": "リンクを更新しました",
   "com_ui_loading": "読み込み中...",
   "com_ui_locked": "ロック",
   "com_ui_logo": "{{0}}のロゴ",
   "com_ui_low": "低い",
+  "com_ui_make_production": "制作を行う",
   "com_ui_manage": "管理",
   "com_ui_marketplace": "マーケットプレイス",
   "com_ui_marketplace_allow_use": "マーケットプレイスの利用を許可する",
@@ -1148,6 +1197,11 @@
   "com_ui_mermaid_failed": "図のレンダリングに失敗しました :",
   "com_ui_mermaid_source": "ソースコード:",
   "com_ui_message_input": "メッセージ入力",
+  "com_ui_message_nav": "メッセージナビゲーション",
+  "com_ui_message_nav_go_to_assistant": "アシスタント メッセージに移動します: {{0}}",
+  "com_ui_message_nav_go_to_user": "ユーザーメッセージに移動します: {{0}}",
+  "com_ui_message_nav_next": "次のメッセージに移動する",
+  "com_ui_message_nav_previous": "前のメッセージに移動する",
   "com_ui_microphone_unavailable": "マイクを使用できません",
   "com_ui_min_tags": "これ以上の値を削除できません。少なくとも {{0}} が必要です。",
   "com_ui_minimal": "最小限",
@@ -1156,16 +1210,19 @@
   "com_ui_model_parameters": "モデルパラメータ",
   "com_ui_model_parameters_reset": "モデルパラメータがリセットされました。",
   "com_ui_model_selected": "{{0}} 選択された",
+  "com_ui_model_spec": "モデル仕様",
   "com_ui_more_info": "詳細",
   "com_ui_my_prompts": "マイ プロンプト",
+  "com_ui_my_skills": "マイ スキル",
+  "com_ui_n_files": "{{0}} ファイル",
   "com_ui_name": "名前",
   "com_ui_name_sort": "名前順",
   "com_ui_new": "New",
   "com_ui_new_chat": "新規チャット",
   "com_ui_new_conversation_title": "新しい会話タイトル",
   "com_ui_next": "次",
+  "com_ui_next_result": "次の結果",
   "com_ui_no": "いいえ",
-  "com_ui_no_api_keys": "APIキーはまだありません。APIキーを作成してください。",
   "com_ui_no_auth": "認証なし",
   "com_ui_no_bookmarks": "ブックマークがまだないようです。チャットをクリックして新しいブックマークを追加してください",
   "com_ui_no_bookmarks_match": "検索に一致するブックマークはありません",
@@ -1174,15 +1231,16 @@
   "com_ui_no_category": "カテゴリなし",
   "com_ui_no_changes": "変更なし",
   "com_ui_no_individual_access": "個々のユーザーやグループがこのエージェントにアクセスすることはできません。",
+  "com_ui_no_labels": "ラベルなし",
   "com_ui_no_mcp_servers": "MCPサーバーはまだありません",
   "com_ui_no_mcp_servers_match": "フィルターに一致するMCPサーバーはありません",
   "com_ui_no_memories": "メモリ登録はありません。新規に作成するか、AIに覚えるよう指示してください。",
   "com_ui_no_memories_match": "検索に一致するメモリはありません",
   "com_ui_no_memories_title": "まだメモリがありません",
-  "com_ui_no_personalization_available": "現在、パーソナライズオプションはありません",
   "com_ui_no_prompts_title": "まだプロンプトはありません",
   "com_ui_no_read_access": "メモリを見る権限がありません",
   "com_ui_no_results_found": "結果は見つかりませんでした",
+  "com_ui_no_skills_found": "スキルが見つかりません",
   "com_ui_no_terms_content": "表示する利用規約の内容はありません",
   "com_ui_none": "なし",
   "com_ui_not_used": "未使用",
@@ -1200,13 +1258,18 @@
   "com_ui_of": "of",
   "com_ui_off": "オフ",
   "com_ui_offline": "オフライン",
+  "com_ui_omitted": "省略",
   "com_ui_on": "オン",
   "com_ui_open_source_chat_new_tab": "新しいタブでチャットを開く",
   "com_ui_open_source_chat_new_tab_title": "新しいタブでチャットを開く- {{title}}",
   "com_ui_open_var": "開く {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "（任意）",
+  "com_ui_options": "オプション",
+  "com_ui_output": "出力",
   "com_ui_page": "ページ",
+  "com_ui_pagination": "ページネーション",
+  "com_ui_parameters": "パラメータ",
   "com_ui_people": "人々",
   "com_ui_people_picker": "ピープルピッカー",
   "com_ui_people_picker_allow_view_groups": "グループの閲覧を許可する",
@@ -1216,12 +1279,23 @@
   "com_ui_permissions_failed_update": "権限の更新に失敗しました。再試行してください。",
   "com_ui_permissions_updated_success": "パーミッションの更新に成功",
   "com_ui_pin": "ピン留め",
+  "com_ui_plus_n_more": "+{{0}} もっと",
   "com_ui_preferences_updated": "環境設定が正常に更新されました",
   "com_ui_prev": "前",
+  "com_ui_prev_result": "前回の結果",
   "com_ui_preview": "プレビュー",
+  "com_ui_preview_failed": "プレビュー不可",
+  "com_ui_preview_preparing": "プレビューを準備しています…",
+  "com_ui_preview_unavailable": "このファイルタイプではプレビューは利用できません",
   "com_ui_privacy_policy": "プライバシーポリシー",
   "com_ui_privacy_policy_url": "プライバシーポリシーURL",
+  "com_ui_production": "プロダクション",
   "com_ui_prompt": "プロンプト",
+  "com_ui_prompt_category_selector_aria": "プロンプトのカテゴリー・セレクタ",
+  "com_ui_prompt_delete_confirm": "プロンプト「{{0}}」を削除してもよろしいですか？",
+  "com_ui_prompt_delete_error": "プロンプトの削除でエラーが発生しました",
+  "com_ui_prompt_deleted_group": "プロンプトグループ {{0}} 削除されました",
+  "com_ui_prompt_details": "{{name}} プロンプトの詳細",
   "com_ui_prompt_group_button": "{{name}} プロンプト、 {{category}} カテゴリ",
   "com_ui_prompt_group_button_no_category": "{{name}} プロンプト",
   "com_ui_prompt_groups": "プロンプトグループリスト",
@@ -1233,13 +1307,18 @@
   "com_ui_prompt_text": "テキスト",
   "com_ui_prompt_text_required": "テキストは必須です",
   "com_ui_prompt_update_error": "プロンプトの更新中にエラーが発生しました",
+  "com_ui_prompt_variables_list": "プロンプト変数リスト",
   "com_ui_prompts": "プロンプト",
   "com_ui_prompts_allow_create": "プロンプトの作成を許可",
   "com_ui_prompts_allow_share": "プロンプトの共有を許可する",
+  "com_ui_prompts_allow_share_public": "プロンプトの公開共有を許可する",
   "com_ui_prompts_allow_use": "プロンプトの使用を許可",
   "com_ui_provider": "プロバイダ",
   "com_ui_quality": "品質",
+  "com_ui_ran_n_agents": "{{0}} 個のエージェントを実行しました。",
   "com_ui_read_aloud": "読み上げる",
+  "com_ui_read_file": "読む {{0}}",
+  "com_ui_reading_file": "読む {{0}}",
   "com_ui_redirect_uri": "リダイレクトURI",
   "com_ui_redirecting_to_provider": "{{0}}にリダイレクト、 お待ちください...",
   "com_ui_reference_saved_memories": "保存されたメモリを参照",
@@ -1252,8 +1331,10 @@
   "com_ui_regenerating": "再生成中...",
   "com_ui_region": "地域",
   "com_ui_reinitialize": "再初期化",
+  "com_ui_relevance": "関連性",
   "com_ui_remote_access": "リモートアクセス",
   "com_ui_remote_agent_role_editor": "エディター",
+  "com_ui_remote_agent_role_editor_desc": "API経由でエージェントを表示および変更できます",
   "com_ui_remote_agent_role_owner": "APIオーナー",
   "com_ui_remote_agent_role_owner_desc": "APIへのフルアクセス、他者へのリモートアクセスの許可",
   "com_ui_remote_agent_role_viewer": "APIビューア",
@@ -1264,6 +1345,7 @@
   "com_ui_remote_agents_allow_share_public": "エージェントへのAPIアクセスをすべてのユーザーに許可する",
   "com_ui_remote_agents_allow_use": "ユーザーがリモートでAPIキーを作成し、エージェントに問い合わせができるようにする。",
   "com_ui_remove_agent_from_chain": "チェーンから {{0}} を取り除く",
+  "com_ui_remove_skill_var": "取り除く {{0}}",
   "com_ui_remove_user": "削除 {{0}}",
   "com_ui_rename": "タイトル変更",
   "com_ui_rename_conversation": "会話の名前を変更する",
@@ -1278,6 +1360,7 @@
   "com_ui_result": "結果",
   "com_ui_result_found": "{{count}} 件の結果が見つかりました",
   "com_ui_results_found": "{{count}} 件の結果が見つかりました",
+  "com_ui_retrieved_files": "ファイルを検索しました",
   "com_ui_retry": "リトライ",
   "com_ui_revoke": "無効にする",
   "com_ui_revoke_info": "ユーザへ発行した認証情報をすべて無効にする。",
@@ -1302,6 +1385,9 @@
   "com_ui_rotate_90": "90度回転",
   "com_ui_run_code": "コードを実行",
   "com_ui_run_code_error": "コードの実行中にエラーが発生しました",
+  "com_ui_running": "実行中…",
+  "com_ui_running_command": "コマンドを実行しています",
+  "com_ui_running_n_agents": "{{0}} 個のエージェントを実行中",
   "com_ui_save": "保存",
   "com_ui_save_badge_changes": "バッジの変更を保存しますか？",
   "com_ui_save_changes": "変更を保存する",
@@ -1312,6 +1398,7 @@
   "com_ui_saving": "保存中...",
   "com_ui_schema": "スキーマ",
   "com_ui_scope": "範囲",
+  "com_ui_scroll_to_bottom": "一番下までスクロール",
   "com_ui_search": "検索",
   "com_ui_search_above_to_add": "上記の検索でユーザーまたはグループを追加",
   "com_ui_search_above_to_add_all": "上記の検索でユーザー、グループ、ロールを追加する",
@@ -1319,6 +1406,10 @@
   "com_ui_search_agent_category": "カテゴリを検索...",
   "com_ui_search_default_placeholder": "名前またはEメールで検索（2文字以上）",
   "com_ui_search_people_placeholder": "名前またはEメールから人やグループを検索",
+  "com_ui_search_result_count": "{{count}} 結果が見つかりました",
+  "com_ui_search_results_count": "{{count}} 結果が見つかりました",
+  "com_ui_search_skills": "スキルを検索",
+  "com_ui_searching_files": "ファイルの検索",
   "com_ui_seconds": "秒",
   "com_ui_secret_key": "秘密鍵",
   "com_ui_select": "選択",
@@ -1354,28 +1445,122 @@
   "com_ui_show_all": "すべて表示",
   "com_ui_show_code": "コード表示",
   "com_ui_show_image_details": "画像の詳細を表示",
-  "com_ui_show_password": "パスワードを表示する",
+  "com_ui_show_less": "表示を少なくする",
+  "com_ui_show_more": "もっと見る",
+  "com_ui_show_n_files": "{{0}} 個のファイルを表示",
   "com_ui_show_qr": "QR コードを表示",
   "com_ui_sign_in_to_domain": "{{0}}にサインインする",
-  "com_ui_simple": "シンプル",
   "com_ui_size": "サイズ",
   "com_ui_size_sort": "サイズ順",
+  "com_ui_skill": "スキル",
+  "com_ui_skill_content": "スキルコンテンツ",
+  "com_ui_skill_create_error": "スキルの作成に失敗しました",
+  "com_ui_skill_create_title": "スキルの作成",
+  "com_ui_skill_delete_confirm": "次の項目を本当に削除しますか？{{0}}この操作を取り消すことはできません。",
+  "com_ui_skill_delete_error": "スキルの削除に失敗しました",
+  "com_ui_skill_deleted": "スキルが削除されました",
+  "com_ui_skill_description_field_hint": "このスキルがいつ適用されるかについて具体的に記述してください。",
+  "com_ui_skill_description_placeholder": "プレゼンテーションやドキュメントにACME Corpのブランドガイドラインを適用する...",
+  "com_ui_skill_description_required": "説明は必須です",
+  "com_ui_skill_description_too_long": "説明は {{0}} 文字以下にする必要があります",
+  "com_ui_skill_edit_title": "スキルの編集",
+  "com_ui_skill_file_binary": "バイナリ ファイル — インラインでプレビューできません",
+  "com_ui_skill_file_download": "ダウンロード",
+  "com_ui_skill_file_load_error": "コンテンツを読み込めませんでした。",
+  "com_ui_skill_finished": "実行 {{0}}",
+  "com_ui_skill_instructions": "手順",
+  "com_ui_skill_instructions_placeholder": "スキルの指示をマークダウンで入力します...",
+  "com_ui_skill_name_invalid": "小文字、数字、ハイフンのみを使用してください (ケバブケース)",
+  "com_ui_skill_name_placeholder": "ブランドガイドライン",
+  "com_ui_skill_name_required": "名前は必須です",
+  "com_ui_skill_name_too_long": "名前は次のとおりでなければなりません {{0}} 文字以下",
+  "com_ui_skill_new_file": "新しいファイル",
+  "com_ui_skill_new_folder": "新しいフォルダー",
+  "com_ui_skill_no_edit_permission": "このスキルを編集する権限がありません",
+  "com_ui_skill_no_selection": "スキルを選択してください",
+  "com_ui_skill_no_selection_desc": "サイドバーからスキルを選択すると、その詳細が表示されます。",
+  "com_ui_skill_not_found": "スキルが見つかりません",
+  "com_ui_skill_not_found_description": "削除されているか、アクセスできなくなっている可能性があります。",
+  "com_ui_skill_role_editor_desc": "スキルの表示と編集が可能",
+  "com_ui_skill_role_owner_desc": "共有や削除を含むスキルの完全なコントロール",
+  "com_ui_skill_role_viewer_desc": "スキルの表示と使用は可能ですが、編集はできません",
+  "com_ui_skill_running": "実行中 {{0}}",
+  "com_ui_skill_sr_public": "パブリックスキル",
+  "com_ui_skill_states_limit": "上限に達しました {{0}} アクティブ/非アクティブなスキルの上書き。いくつかのオーバーライドを削除して、新しいスキルを切り替えます。",
+  "com_ui_skill_toggle_active": "スキルのアクティブ状態を切り替えます",
+  "com_ui_skill_update_conflict": "あなたの前に別の編集が保存されました。最新バージョンを再読み込みしています。",
+  "com_ui_skill_update_error": "スキルの保存に失敗しました",
+  "com_ui_skill_updated": "スキルを保存しました",
+  "com_ui_skill_upload": "スキルをアップロードする",
+  "com_ui_skill_upload_drag": "ドラッグアンドドロップまたはクリックしてアップロード",
+  "com_ui_skill_upload_file": "ファイルをアップロード",
+  "com_ui_skill_upload_req_md": ".md ファイルには、YAML 形式のスキル名と説明が含まれている必要があります",
+  "com_ui_skill_upload_req_size": "ファイルサイズは以下を超えてはなりません {{0}} MB",
+  "com_ui_skill_upload_req_zip": ".zipまたは.skillファイルには、SKILL.mdファイルを含める必要があります",
+  "com_ui_skill_upload_requirements": "ファイル要件",
+  "com_ui_skill_upload_size_error": "スキルのインポートは次を超えてはなりません {{0}} MB",
+  "com_ui_skill_upload_title": "スキルをアップロード",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "レンダリングされたビュー",
+  "com_ui_skill_view_source": "出処を確認",
+  "com_ui_skill_warnings": "注意喚起",
+  "com_ui_skill_write_instructions": "スキルに関する指示を書く",
+  "com_ui_skills": "スキル",
+  "com_ui_skills_allow_create": "スキルの作成を許可する",
+  "com_ui_skills_allow_share": "スキルの共有を許可する",
+  "com_ui_skills_allow_share_public": "スキルの共有を許可",
+  "com_ui_skills_allow_use": "スキルの使用を許可する",
+  "com_ui_skills_always_apply_invoked": "自動適用されるスキル",
+  "com_ui_skills_always_apply_pin_title": "常に適用されるスキル (ターンごとに自動発動)",
+  "com_ui_skills_command_placeholder": "名前でスキルを選択",
+  "com_ui_skills_disabled_hint": "このエージェントのスキルはオフになっています。有効にすると、モデルがスキルカタログを使用できるようになります。",
+  "com_ui_skills_empty": "まだスキルがありません",
+  "com_ui_skills_enable_toggle": "このエージェントのスキルを有効にする",
+  "com_ui_skills_enabled_all_hint": "有効。完全にアクセス可能なカタログが利用可能です。このエージェントが使用できるスキルを制限する場合は、以下に絞り込みます。",
+  "com_ui_skills_enabled_allowlist_hint": "有効。以下で選択したスキルに限定されます。",
+  "com_ui_skills_load_error": "スキルの読み込みに失敗しました",
+  "com_ui_skills_manual_invoked": "手動で呼び出されたスキル",
+  "com_ui_skills_queued": "次のサブミッションのためにキューに入れられたスキル",
+  "com_ui_special": "特別",
   "com_ui_special_var_current_date": "現在の日付",
   "com_ui_special_var_current_datetime": "現在の日時",
   "com_ui_special_var_current_user": "現在のユーザー",
+  "com_ui_special_var_desc_current_date": "今日の日付と曜日",
+  "com_ui_special_var_desc_current_datetime": "あなたのタイムゾーンの現地日付と時刻",
+  "com_ui_special_var_desc_current_user": "アカウントの表示名",
+  "com_ui_special_var_desc_iso_datetime": "ISO 8601形式のUTC日付時刻",
   "com_ui_special_var_iso_datetime": "UTC ISO 日時",
   "com_ui_special_variable_added": "{{0}} 特殊変数が追加された。",
-  "com_ui_special_variables": "特殊変数:",
+  "com_ui_special_variables": "特殊変数",
   "com_ui_speech_not_supported": "お使いのブラウザは音声認識をサポートしていません",
   "com_ui_speech_not_supported_use_external": "お使いのブラウザは音声認識をサポートしていません。[設定] > [音声]で[外部STT]に切り替えてみてください。",
   "com_ui_speech_while_submitting": "応答の生成中は音声を送信できません",
   "com_ui_sr_global_prompt": "グローバルプロンプトグループ",
+  "com_ui_sr_public_skill": "共有スキル",
   "com_ui_stack_trace": "スタックトレース",
   "com_ui_status_prefix": "ステータス:",
   "com_ui_stop": "止める",
   "com_ui_storage": "ストレージ",
   "com_ui_storage_filter_sort": "ストレージによるフィルタリングと並べ替え",
+  "com_ui_subagent_cancelled": "キャンセルされたエージェント",
+  "com_ui_subagent_complete": "エージェントを実行した",
+  "com_ui_subagent_dialog_description": "隔離コンテキストでの子エージェント実行。アクティビティと最終結果は以下に示す。",
+  "com_ui_subagent_dialog_title": "{{0}}エージェント",
+  "com_ui_subagent_dialog_title_self": "エージェント",
+  "com_ui_subagent_empty_result": "テキストは返されませんでした。",
+  "com_ui_subagent_errored": "エージェントにエラーが発生しました",
+  "com_ui_subagent_no_result_yet": "まだ実行中です - 最終的な結果はまだありません。",
+  "com_ui_subagent_running": "実行中のエージェント",
+  "com_ui_subagent_scroll_to_bottom": "最新までスクロール",
+  "com_ui_subagent_ticker_error": "エラー",
+  "com_ui_subagent_ticker_reasoning": "推論",
+  "com_ui_subagent_ticker_tool_done": "完了",
+  "com_ui_subagent_ticker_using": "使用する",
+  "com_ui_subagent_ticker_writing": "書き込み",
+  "com_ui_subagent_waiting": "最初の更新を待っています…",
   "com_ui_submit": "送信する",
+  "com_ui_summarized": "要約した",
+  "com_ui_summarizing": "要約中…",
   "com_ui_support_contact": "サポート窓口",
   "com_ui_support_contact_email": "電子メール",
   "com_ui_support_contact_email_invalid": "有効なEメールアドレスを入力してください。",
@@ -1387,6 +1572,7 @@
   "com_ui_temporary": "一時チャット",
   "com_ui_terms_and_conditions": "利用規約",
   "com_ui_terms_of_service": "利用規約",
+  "com_ui_text_variables": "テキスト変数",
   "com_ui_thinking": "考え中...",
   "com_ui_thoughts": "推論",
   "com_ui_toggle_theme": "テーマを切り替える",
@@ -1397,6 +1583,12 @@
   "com_ui_tool_collection_prefix": "ツールのコレクション",
   "com_ui_tool_list_collapse": "折りたたむ {{serverName}} ツールリスト",
   "com_ui_tool_list_expand": "展開 {{serverName}} ツールリスト",
+  "com_ui_tool_name_code": "コード",
+  "com_ui_tool_name_code_analysis": "コード解析",
+  "com_ui_tool_name_file_search": "ファイル検索",
+  "com_ui_tool_name_image_edit": "画像編集",
+  "com_ui_tool_name_image_gen": "画像生成",
+  "com_ui_tool_name_web_search": "ウェブ検索",
   "com_ui_tools": "ツール",
   "com_ui_tools_and_actions": "ツールとアクション",
   "com_ui_transferred_to": "転送先",
@@ -1409,7 +1601,10 @@
   "com_ui_unarchive_conversation": "会話のアーカイブ解除",
   "com_ui_unarchive_error": "アーカイブ解除に失敗しました。",
   "com_ui_unavailable": "使用不可",
+  "com_ui_unfavorite": "お気に入りから削除する",
   "com_ui_unknown": "不明",
+  "com_ui_unknown_file_type": "不明なファイルタイプ",
+  "com_ui_unpin": "ピンを解除する",
   "com_ui_unset": "設定解除",
   "com_ui_untitled": "無題",
   "com_ui_update": "更新",
@@ -1419,6 +1614,7 @@
   "com_ui_upload_agent_avatar": "エージェントアバターの更新に成功",
   "com_ui_upload_agent_avatar_label": "エージェントのアバター画像をアップロードする",
   "com_ui_upload_avatar_label": "アバター画像のアップロード",
+  "com_ui_upload_code_environment": "コード環境へのアップロード",
   "com_ui_upload_delay": "ファイル \"{{0}}\"のアップロードに時間がかかっています。ファイルの検索のためのインデックス作成が完了するまでお待ちください。",
   "com_ui_upload_error": "ファイルのアップロード中にエラーが発生しました。",
   "com_ui_upload_file_context": "ファイルコンテキストをアップロード",
@@ -1438,15 +1634,19 @@
   "com_ui_use_backup_code": "代わりにバックアップコードを使用する",
   "com_ui_use_memory": "メモリを使用する",
   "com_ui_use_micrphone": "マイクを使用する",
+  "com_ui_use_prompt": "プロンプトを使用",
   "com_ui_used": "使用済み",
+  "com_ui_used_n_tools": "使用済み {{0}} ツール",
   "com_ui_user": "ユーザー",
   "com_ui_user_group_permissions": "ユーザーとグループの権限",
   "com_ui_user_provides_key": "ユーザーは個人キーを登録する",
   "com_ui_value": "値",
+  "com_ui_variable_with_options": "{{name}} 変数付き {{count}} オプション",
   "com_ui_variables": "変数",
   "com_ui_verify": "確認する",
   "com_ui_version_var": "バージョン {{0}}",
   "com_ui_versions": "バージョン",
+  "com_ui_via_server": "で {{0}}",
   "com_ui_view_memory": "メモリを表示",
   "com_ui_web_search": "ウェブ検索",
   "com_ui_web_search_cohere_key": "Cohere API キーの入力",
@@ -1458,6 +1658,8 @@
   "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "Serper API",
   "com_ui_web_search_provider_serper_key": "Serper APIキーを取得する",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Tavily API キーを取得する",
   "com_ui_web_search_reading": "読み取り結果",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1470,15 +1672,22 @@
   "com_ui_web_search_scraper_firecrawl_key": "FirecrawlのAPIキーを取得する",
   "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "SerperのAPIキーを取得する",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Tavily API キーを取得する",
   "com_ui_web_search_searxng_api_key": "SearXNG APIキーを入力（オプション）",
   "com_ui_web_search_searxng_instance_url": "SearXNGインスタンスURL",
+  "com_ui_web_search_source": "{{count}} ソース",
+  "com_ui_web_search_sources": "{{count}} ソース",
+  "com_ui_web_searched": "ウェブで検索した",
   "com_ui_web_searching": "ウェブ検索",
   "com_ui_web_searching_again": "もう一度ウェブを検索します",
   "com_ui_weekend_morning": "楽しい週末を",
   "com_ui_write": "執筆",
+  "com_ui_writing_command": "書き込みコマンド",
   "com_ui_x_selected": "{{0}}が選択された",
   "com_ui_xhigh": "最上位",
   "com_ui_yes": "はい",
+  "com_ui_you": "あなた",
   "com_ui_your_api_key": "API キー",
   "com_ui_zoom": "ズーム",
   "com_ui_zoom_in": "ズームイン",
diff --git a/client/src/locales/ko/translation.json b/client/src/locales/ko/translation.json
index 60491f1c8c6..db8f1ca933c 100644
--- a/client/src/locales/ko/translation.json
+++ b/client/src/locales/ko/translation.json
@@ -1,6 +1,6 @@
 {
-  "chat_direction_left_to_right": "왼쪽에서 오른쪽으로의 채팅 방향입니다. 내용이 비어 있었습니다.",
-  "chat_direction_right_to_left": "오른쪽에서 왼쪽으로의 채팅 방향입니다. 내용이 비어 있었습니다.",
+  "chat_direction_left_to_right": "왼쪽에서 오른쪽",
+  "chat_direction_right_to_left": "오른쪽에서 왼쪽",
   "com_a11y_ai_composing": "AI가 응답을 작성 중입니다",
   "com_a11y_end": "AI의 답변이 끝났습니다.",
   "com_a11y_start": "AI가 응답 중입니다",
@@ -285,7 +285,7 @@
   "com_files_filter": "파일 필터링...",
   "com_files_no_results": "결과가 없습니다.",
   "com_files_number_selected": "{{0}}개의 파일({{1}}개 중)이 선택되었습니다",
-  "com_files_table": "내용이 비어 있었습니다.",
+  "com_files_table": "파일 테이블",
   "com_generated_files": "생성된 파일:",
   "com_hide_examples": "예시 숨기기",
   "com_info_heic_converting": "HEIC 이미지를 JPEG로 변환 중...",
@@ -329,15 +329,12 @@
   "com_nav_browser": "브라우저",
   "com_nav_center_chat_input": "환영 화면에서 채팅 입력 중앙 정렬",
   "com_nav_change_picture": "프로필 사진 변경",
-  "com_nav_chat_commands": "채팅 명령어",
-  "com_nav_chat_commands_info": "이 명령어들은 메시지 시작 부분에 특정 문자를 입력하면 활성화됩니다. 각 명령어는 지정된 접두사로 실행됩니다. 메시지 작성 시 이러한 문자들을 자주 사용하신다면 명령어 기능을 비활성화할 수 있습니다.",
   "com_nav_chat_direction": "채팅 표시 방향",
   "com_nav_clear_all_chats": "모든 채팅 지우기",
   "com_nav_clear_cache_confirm_message": "캐시를 지우시겠습니까?",
   "com_nav_clear_conversation": "대화 지우기",
   "com_nav_clear_conversation_confirm_message": "모든 대화를 지우시겠습니까? 이 작업은 되돌릴 수 없습니다.",
   "com_nav_close_sidebar": "사이드바 닫기",
-  "com_nav_commands": "명령어",
   "com_nav_confirm_clear": "지우기 확인",
   "com_nav_conversation_mode": "대화 모드",
   "com_nav_convo_menu_options": "대화 메뉴 옵션",
@@ -440,12 +437,9 @@
   "com_nav_search_placeholder": "메시지 검색",
   "com_nav_send_message": "메시지 보내기",
   "com_nav_setting_account": "계정",
-  "com_nav_setting_balance": "잔액",
   "com_nav_setting_chat": "채팅",
-  "com_nav_setting_data": "데이터 제어",
   "com_nav_setting_general": "일반",
   "com_nav_setting_mcp": "MCP 설정",
-  "com_nav_setting_personalization": "개인화",
   "com_nav_setting_speech": "음성",
   "com_nav_settings": "설정",
   "com_nav_shared_links": "공유 링크",
@@ -772,7 +766,6 @@
   "com_ui_good_morning": "좋은 아침입니다",
   "com_ui_happy_birthday": "내 첫 생일이야!",
   "com_ui_hide_image_details": "이미지 세부정보 숨기기",
-  "com_ui_hide_password": "비밀번호 숨기기",
   "com_ui_hide_qr": "QR 코드 숨기기",
   "com_ui_high": "높음",
   "com_ui_host": "호스트",
@@ -845,7 +838,6 @@
   "com_ui_no": "아니요",
   "com_ui_no_bookmarks": "아직 북마크가 없는 것 같습니다. 채팅을 선택하고 새 북마크를 추가해보세요",
   "com_ui_no_category": "카테고리 없음",
-  "com_ui_no_personalization_available": "현재 개인화 설정을 사용할 수 없습니다",
   "com_ui_no_read_access": "메모리를 확인할 수 있는 권한이 없습니다",
   "com_ui_no_terms_content": "이용 약관 내용이 없습니다",
   "com_ui_none": "없음",
@@ -946,10 +938,8 @@
   "com_ui_shop": "쇼핑",
   "com_ui_show_all": "전체 보기",
   "com_ui_show_image_details": "이미지 세부사항 보기",
-  "com_ui_show_password": "비밀번호 표시",
   "com_ui_show_qr": "QR 코드 보기",
   "com_ui_sign_in_to_domain": "{{0}}에 로그인",
-  "com_ui_simple": "간단",
   "com_ui_size": "크기",
   "com_ui_special_var_current_date": "현재 날짜",
   "com_ui_special_var_current_datetime": "현재 날짜와 시간",
diff --git a/client/src/locales/lt/translation.json b/client/src/locales/lt/translation.json
index 0967ef424bc..9f31731b502 100644
--- a/client/src/locales/lt/translation.json
+++ b/client/src/locales/lt/translation.json
@@ -1 +1,1930 @@
-{}
+{
+  "chat_direction_left_to_right": "Iš kairės į dešinę",
+  "chat_direction_right_to_left": "Iš dešinės į kairę",
+  "com_a11y_ai_composing": "AI vis dar rašo.",
+  "com_a11y_chats_date_section": "Pokalbiai nuo {{date}}",
+  "com_a11y_end": "AI baigė atsakyti.",
+  "com_a11y_selected": "pasirinkta",
+  "com_a11y_start": "AI pradėjo atsakyti.",
+  "com_a11y_summarize_completed": "Kontekstas apibendrinta.",
+  "com_a11y_summarize_failed": "Apibendrinimas nepavyko, tęsiama su turimu kontekstu.",
+  "com_a11y_summarize_started": "Kontekstas apibendrinamas.",
+  "com_agents_agent_card_label": "{{name}} agentas. {{description}}",
+  "com_agents_all": "Visi agentai",
+  "com_agents_all_category": "Visi",
+  "com_agents_all_description": "Naršyti visus bendrinamus agentus visose kategorijose",
+  "com_agents_avatar_upload_error": "Nepavyko įkelti agento avataro",
+  "com_agents_category_aftersales": "Aptarnavimas po pardavimo",
+  "com_agents_category_aftersales_description": "Agentai, specializuoti poparduotuviniame palaikyme, priežiūroje ir klientų aptarnavime",
+  "com_agents_category_empty": "Kategorijoje {{category}} agentų nerasta",
+  "com_agents_category_finance": "Finansai",
+  "com_agents_category_finance_description": "Agentai, specializuoti finansų analizėje, biudžeto planavime ir apskaitoje",
+  "com_agents_category_general": "Bendrasis",
+  "com_agents_category_general_description": "Bendrosios paskirties agentai įprastoms užduotims ir užklausoms",
+  "com_agents_category_hr": "Žmogiškieji ištekliai",
+  "com_agents_category_hr_description": "Agentai, specializuoti personalo procesų, politikos ir darbuotojų palaikymo srityse",
+  "com_agents_category_it": "IT",
+  "com_agents_category_it_description": "Agentai IT palaikymui, techninių problemų sprendimui ir sistemų administravimui",
+  "com_agents_category_rd": "Moksliniai tyrimai ir plėtra",
+  "com_agents_category_rd_description": "Agentai, orientuoti į mokslinių tyrimų ir plėtros procesus, inovacijas ir techninius tyrimus",
+  "com_agents_category_sales": "Pardavimai",
+  "com_agents_category_sales_description": "Agentai, orientuoti į pardavimų procesus ir ryšius su klientais",
+  "com_agents_category_tab_label": "{{category}} kategorija, {{position}} iš {{total}}",
+  "com_agents_category_tabs_label": "Agentų kategorijos",
+  "com_agents_chat_with": "Pokalbis su {{name}}",
+  "com_agents_clear_search": "Išvalyti paiešką",
+  "com_agents_contact": "Kontaktas",
+  "com_agents_copy_link": "Kopijuoti nuorodą",
+  "com_agents_create_error": "Kuriant agentą įvyko klaida.",
+  "com_agents_created_by": "autorius",
+  "com_agents_description_card": "Aprašymas: {{description}}",
+  "com_agents_description_placeholder": "Neprivaloma: aprašykite savo agentą čia",
+  "com_agents_empty_state_heading": "Agentų nerasta",
+  "com_agents_enable_file_search": "Įjungti failų paiešką",
+  "com_agents_error_bad_request_message": "Užklausos apdoroti nepavyko.",
+  "com_agents_error_bad_request_suggestion": "Patikrinkite įvestį ir bandykite dar kartą.",
+  "com_agents_error_category_title": "Kategorijos klaida",
+  "com_agents_error_generic": "Įkeliant turinį įvyko klaida.",
+  "com_agents_error_invalid_request": "Neteisinga užklausa",
+  "com_agents_error_loading": "Klaida įkeliant agentus",
+  "com_agents_error_network_message": "Nepavyko prisijungti prie serverio.",
+  "com_agents_error_network_suggestion": "Patikrinkite interneto ryšį ir bandykite dar kartą.",
+  "com_agents_error_network_title": "Ryšio problema",
+  "com_agents_error_not_found_message": "Prašomo turinio nepavyko rasti.",
+  "com_agents_error_not_found_suggestion": "Pabandykite naršyti kitas parinktis arba grįžkite į prekyvietę.",
+  "com_agents_error_not_found_title": "Nerasta",
+  "com_agents_error_retry": "Bandyti dar kartą",
+  "com_agents_error_search_title": "Paieškos klaida",
+  "com_agents_error_searching": "Klaida ieškant agentų",
+  "com_agents_error_server_message": "Serveris laikinai nepasiekiamas.",
+  "com_agents_error_server_suggestion": "Bandykite dar kartą po kelių akimirkų.",
+  "com_agents_error_server_title": "Serverio klaida",
+  "com_agents_error_suggestion_generic": "Pabandykite atnaujinti puslapį arba bandykite dar kartą vėliau.",
+  "com_agents_error_timeout_message": "Užklausa užtruko per ilgai.",
+  "com_agents_error_timeout_suggestion": "Patikrinkite interneto ryšį ir bandykite dar kartą.",
+  "com_agents_error_timeout_title": "Baigėsi ryšiui skirtas laikas",
+  "com_agents_error_title": "Kažkas nutiko neteisingai",
+  "com_agents_file_context_description": "Failai, įkelti kaip \"Kontekstas\", yra analizuojami kaip tekstas, papildantis Agento instrukcijas. Jei OCR yra prieinamas arba sukonfigūruotas įkeltam failo tipui, tekstas išgaunamas naudojant šį procesą. Idealiai tinka dokumentams, paveikslėliams su tekstu arba PDF failams, kai reikia pilno failo teksto turinio",
+  "com_agents_file_context_disabled": "Agentas turi būti sukurtas prieš įkeliant failus failų kontekstui.",
+  "com_agents_file_context_label": "Failo kontekstas",
+  "com_agents_file_search_disabled": "Agentas turi būti sukurtas, prieš įkeliant failus failų paieškai",
+  "com_agents_file_search_info": "Kai įjungta, agentas bus informuotas apie žemiau išvardytus failų pavadinimus, todėl galės gauti atitinkamą kontekstą iš šių failų.",
+  "com_agents_grid_announcement": "Rodoma {{count}} agentų kategorijoje {{category}}",
+  "com_agents_instructions_placeholder": "Sisteminės instrukcijos, kurias naudoja agentas",
+  "com_agents_link_copied": "Nuoroda nukopijuota",
+  "com_agents_link_copy_failed": "Nepavyko nukopijuoti nuorodos",
+  "com_agents_load_more_label": "Įkelti daugiau agentų iš kategorijos {{category}}",
+  "com_agents_loading": "Kraunama...",
+  "com_agents_marketplace": "Agentų prekyvietė",
+  "com_agents_marketplace_subtitle": "Atraskite ir naudokite galingus AI agentus, kad pagerintumėte savo darbo eigą ir produktyvumą",
+  "com_agents_mcp_description_placeholder": "Trumpai paaiškinkite, ką tai daro",
+  "com_agents_mcp_icon_size": "Minimalus dydis 128 x 128 px",
+  "com_agents_mcp_name_placeholder": "Pasirinktinis įrankis",
+  "com_agents_mcp_trust_subtext": "Pasirinktinės jungtys nėra patikrintos LibreChat",
+  "com_agents_missing_name": "Prieš kuriant agentą, įveskite pavadinimą.",
+  "com_agents_missing_provider_model": "Prieš kurdami agentą, pasirinkite tiekėją ir modelį.",
+  "com_agents_name_placeholder": "Neprivaloma: agento pavadinimas",
+  "com_agents_no_access": "Jūs neturite prieigos redaguoti šio agento.",
+  "com_agents_no_agent_id_error": "Agento ID nerastas. Įsitikinkite, kad agentas buvo sukurtas.",
+  "com_agents_no_more_results": "Pasiekėte rezultatų pabaigą",
+  "com_agents_not_available": "Agentas nepasiekiamas",
+  "com_agents_recommended": "Mūsų rekomenduojami agentai",
+  "com_agents_results_for": "Rezultatai pagal '{{query}}'",
+  "com_agents_run_code_files": "Toliau pateikti failai skirti tik kodo aplinkai:",
+  "com_agents_run_code_info": "Kai įjungta, leidžia agentui saugiai vykdyti sugeneruotą kodą, įskaitant failų apdorojimą.",
+  "com_agents_search_aria": "Ieškoti agentų",
+  "com_agents_search_empty_heading": "Paieškos rezultatų nėra",
+  "com_agents_search_info": "Kai įjungta, leidžia jūsų agentui ieškoti naujausios informacijos internete. Reikalingas galiojantis API raktas.",
+  "com_agents_search_instructions": "Įveskite tekstą, kad ieškotumėte agentų pagal pavadinimą ar aprašymą",
+  "com_agents_search_name": "Ieškoti agentų pagal pavadinimą",
+  "com_agents_search_no_results": "Agentų pagal \"{{query}}\" nerasta",
+  "com_agents_search_placeholder": "Ieškoti agentų...",
+  "com_agents_see_more": "Rodyti daugiau",
+  "com_agents_start_chat": "Pradėti pokalbį",
+  "com_agents_top_picks": "Geriausi pasirinkimai",
+  "com_agents_update_error": "Įvyko klaida atnaujinant jūsų agentą.",
+  "com_assistants_actions": "Veiksmai",
+  "com_assistants_actions_disabled": "Prieš pridedant veiksmus, turite sukurti asistentą.",
+  "com_assistants_actions_info": "Leiskite savo asistentui gauti informaciją arba atlikti veiksmus per API",
+  "com_assistants_add_actions": "Pridėti veiksmus",
+  "com_assistants_add_mcp_server_tools": "Pridėti MCP serverio įrankius",
+  "com_assistants_add_tools": "Pridėti įrankius",
+  "com_assistants_allow_sites_you_trust": "Leiskite tik patikimoms svetainėms.",
+  "com_assistants_append_date": "Pridėti dabartinę datą ir laiką",
+  "com_assistants_append_date_tooltip": "Kai įjungta, esama kliento data ir laikas bus pridėti prie asistento sistemos instrukcijų.",
+  "com_assistants_available_actions": "Galimi veiksmai",
+  "com_assistants_capabilities": "Galimybės",
+  "com_assistants_code_interpreter": "Kodo interpretatorius",
+  "com_assistants_code_interpreter_files": "Žemiau esantys failai skirti tik kodo interpreteriui:",
+  "com_assistants_code_interpreter_info": "Kodo interpretatorius leidžia asistentui rašyti ir vykdyti kodą. Šis įrankis gali apdoroti failus su įvairiais duomenimis ir formatais bei generuoti failus, pavyzdžiui, grafikus.",
+  "com_assistants_completed_action": "Kalbėtasi su {{0}}",
+  "com_assistants_completed_function": "Paleista {{0}}",
+  "com_assistants_conversation_starters": "Pokalbio pradžios frazės",
+  "com_assistants_conversation_starters_placeholder": "Įveskite pokalbio pradžios frazę",
+  "com_assistants_create_error": "Kuriant asistentą įvyko klaida.",
+  "com_assistants_create_success": "Sėkmingai sukurta",
+  "com_assistants_delete_actions_error": "Trinant veiksmą įvyko klaida.",
+  "com_assistants_delete_actions_success": "Veiksmas sėkmingai ištrintas iš asistento",
+  "com_assistants_description_placeholder": "Neprivaloma: aprašykite savo asistentą čia",
+  "com_assistants_file_search": "Failų paieška",
+  "com_assistants_file_search_info": "Failų paieška suteikia asistentui žinių iš jūsų arba jūsų naudotojų įkeltų failų. Kai failas įkeliamas, asistentas automatiškai nusprendžia, kada gauti turinį pagal naudotojo užklausas. Vektorinių saugyklų pridėjimas failų paieškai dar nepalaikomas. Galite jas pridėti per tiekėjo platformą arba pridėti failus prie žinučių failų paieškai pagal sriegį.",
+  "com_assistants_function_use": "Asistentas naudojo {{0}}",
+  "com_assistants_image_vision": "Vaizdo vizija",
+  "com_assistants_instructions_placeholder": "Sisteminės instrukcijos, kurias naudoja asistentas",
+  "com_assistants_knowledge": "Žinios",
+  "com_assistants_knowledge_disabled": "Asistentas turi būti sukurtas, o kodo interpretatorius arba gavimas turi būti įjungtas ir išsaugotas prieš įkeliant failus kaip žinias.",
+  "com_assistants_knowledge_info": "Jei įkeliate failus į žinias, pokalbiai su jūsų asistentu gali apimti failų turinį.",
+  "com_assistants_max_starters_reached": "Pasiektas maksimalus pokalbio pradžios frazių skaičius",
+  "com_assistants_name_placeholder": "Neprivaloma: asistento pavadinimas",
+  "com_assistants_non_retrieval_model": "Šiame modelyje failų paieška neįjungta. Pasirinkite kitą modelį.",
+  "com_assistants_retrieval": "Gavimas",
+  "com_assistants_running_action": "Vykdomas veiksmas",
+  "com_assistants_running_var": "Vykdoma {{0}}",
+  "com_assistants_search_name": "Ieškoti asistentų pagal pavadinimą",
+  "com_assistants_update_actions_error": "Kuriant arba atnaujinant veiksmą įvyko klaida.",
+  "com_assistants_update_actions_success": "Veiksmas sėkmingai sukurtas arba atnaujintas",
+  "com_assistants_update_error": "Atnaujinant asistentą įvyko klaida.",
+  "com_assistants_update_success": "Sėkmingai atnaujinta",
+  "com_assistants_update_success_name": "Sėkmingai atnaujinta {{name}}",
+  "com_auth_already_have_account": "Jau turite paskyrą?",
+  "com_auth_apple_login": "Prisijungti su Apple",
+  "com_auth_back_to_login": "Grįžti į prisijungimą",
+  "com_auth_click": "Spustelėkite",
+  "com_auth_click_here": "Spustelėkite čia",
+  "com_auth_continue": "Tęsti",
+  "com_auth_create_account": "Sukurkite paskyrą",
+  "com_auth_discord_login": "Tęsti su Discord",
+  "com_auth_email": "El. paštas",
+  "com_auth_email_address": "El. pašto adresas",
+  "com_auth_email_max_length": "El. paštas negali būti ilgesnis nei 120 simbolių",
+  "com_auth_email_min_length": "El. paštas turi būti bent 6 simbolių",
+  "com_auth_email_pattern": "Turite įvesti galiojantį el. pašto adresą",
+  "com_auth_email_required": "El. paštas yra privalomas",
+  "com_auth_email_resend_link": "Siųsti el. laišką pakartotinai",
+  "com_auth_email_resent_failed": "Nepavyko pakartotinai išsiųsti patvirtinimo el. laiško",
+  "com_auth_email_resent_success": "Patvirtinimo el. laiškas sėkmingai išsiųstas pakartotinai",
+  "com_auth_email_verification_failed": "El. pašto patvirtinimas nepavyko",
+  "com_auth_email_verification_failed_token_missing": "Patvirtinimas nepavyko, trūksta žetono",
+  "com_auth_email_verification_in_progress": "Tvirtinamas jūsų el. paštas, prašome palaukti",
+  "com_auth_email_verification_invalid": "Netinkamas el. pašto patvirtinimas",
+  "com_auth_email_verification_redirecting": "Nukreipiama po {{0}} sekundžių...",
+  "com_auth_email_verification_resend_prompt": "Negavote el. laiško?",
+  "com_auth_email_verification_success": "El. paštas sėkmingai patvirtintas",
+  "com_auth_email_verifying_ellipsis": "Tvirtinama...",
+  "com_auth_error_create": "Registruojant paskyrą įvyko klaida. Prašome bandyti dar kartą.",
+  "com_auth_error_invalid_reset_token": "Šis slaptažodžio atstatymo žetonas nebegalioja.",
+  "com_auth_error_login": "Nepavyko prisijungti su pateiktais duomenimis. Patikrinkite prisijungimo informaciją ir bandykite dar kartą.",
+  "com_auth_error_login_ban": "Jūsų paskyra laikinai užblokuota dėl paslaugų naudojimo taisyklių pažeidimų.",
+  "com_auth_error_login_rl": "Per daug prisijungimo bandymų per trumpą laiką. Prašome bandyti vėliau.",
+  "com_auth_error_login_server": "Įvyko vidinė serverio klaida. Palaukite kelias akimirkas ir bandykite dar kartą.",
+  "com_auth_error_login_unverified": "Jūsų paskyra nepatvirtinta. Patikrinkite el. paštą ir suraskite patvirtinimo nuorodą.",
+  "com_auth_error_oauth_failed": "Autentifikacija nepavyko. Patikrinkite prisijungimo metodą ir bandykite dar kartą.",
+  "com_auth_facebook_login": "Tęsti su Facebook",
+  "com_auth_full_name": "Vardas ir pavardė",
+  "com_auth_github_login": "Tęsti su Github",
+  "com_auth_google_login": "Tęsti su Google",
+  "com_auth_here": "ČIA",
+  "com_auth_login": "Prisijungti",
+  "com_auth_login_with_new_password": "Dabar galite prisijungti su nauju slaptažodžiu.",
+  "com_auth_name_max_length": "Vardas turi būti trumpesnis nei 80 simbolių",
+  "com_auth_name_min_length": "Vardas turi būti bent 3 simbolių ilgio",
+  "com_auth_name_required": "Vardas yra privalomas",
+  "com_auth_no_account": "Neturite paskyros?",
+  "com_auth_password": "Slaptažodis",
+  "com_auth_password_confirm": "Patvirtinti slaptažodį",
+  "com_auth_password_forgot": "Pamiršote slaptažodį?",
+  "com_auth_password_max_length": "Slaptažodis turi būti trumpesnis nei 128 simbolių",
+  "com_auth_password_min_length": "Slaptažodis turi būti bent 8 simbolių ilgio",
+  "com_auth_password_not_match": "Slaptažodžiai nesutampa",
+  "com_auth_password_required": "Slaptažodis yra privalomas",
+  "com_auth_registration_success_generic": "Patikrinkite el. paštą, kad patvirtintumėte savo el. pašto adresą.",
+  "com_auth_registration_success_insecure": "Registracija sėkminga.",
+  "com_auth_reset_password": "Iš naujo nustatykite slaptažodį",
+  "com_auth_reset_password_if_email_exists": "Jei paskyra su tokiu el. pašto adresu egzistuoja, buvo išsiųstas el. laiškas su slaptažodžio nustatymo iš naujo instrukcijomis. Nepamirškite patikrinti šlamšto aplanko.",
+  "com_auth_reset_password_link_sent": "El. laiškas išsiųstas",
+  "com_auth_reset_password_success": "Slaptažodis sėkmingai atstatytas",
+  "com_auth_saml_login": "Prisijungti su SAML",
+  "com_auth_sign_in": "Prisijungti",
+  "com_auth_sign_up": "Registruotis",
+  "com_auth_submit_registration": "Pateikti registraciją",
+  "com_auth_to_reset_your_password": "iš naujo nustatyti slaptažodį.",
+  "com_auth_to_try_again": "bandyti dar kartą.",
+  "com_auth_two_factor": "Vienkartinio slaptažodžio kodą rasite savo pasirinktoje programoje",
+  "com_auth_username": "Vartotojo vardas (neprivalomas)",
+  "com_auth_username_max_length": "Vartotojo vardas turi būti trumpesnis nei 20 simbolių",
+  "com_auth_username_min_length": "Vartotojo vardas turi būti bent 2 simbolių ilgio",
+  "com_auth_verify_your_identity": "Patvirtinkite savo tapatybę",
+  "com_auth_welcome_back": "Sveiki sugrįžę",
+  "com_citation_more_details": "Daugiau informacijos apie {{label}}",
+  "com_citation_source": "Šaltinis",
+  "com_click_to_download": "(spustelėkite čia, kad atsisiųstumėte)",
+  "com_download_expired": "(atsisiuntimo laikas baigėsi)",
+  "com_endpoint": "Galinis taškas",
+  "com_endpoint_agent": "Agentas",
+  "com_endpoint_agent_placeholder": "Pasirinkite agentą",
+  "com_endpoint_ai": "AI",
+  "com_endpoint_anthropic_effort": "Valdo, kiek skaičiavimo pastangų taiko Claude. Mažesnės pastangos taupo žetonus ir mažina delsą; didesnės pastangos duoda išsamesnius atsakymus. „Max\" įgalina giliausią samprotavimą palaikomuose adaptyviojo mąstymo modeliuose.",
+  "com_endpoint_anthropic_maxoutputtokens": "Didžiausias žetonų skaičius, kurį galima sugeneruoti atsakyme. Nurodykite mažesnę reikšmę trumpesniems atsakymams ir didesnę – ilgesniems. Pastaba: modeliai gali sustoti nepassiekę šio maksimumo.",
+  "com_endpoint_anthropic_prompt_cache": "Raginimų talpykla leidžia pakartotinai naudoti didelį kontekstą ar instrukcijas API iškvietimuose, mažinant išlaidas ir delsą",
+  "com_endpoint_anthropic_prompt_cache_ttl": "Kiek laiko talpykloje saugomas raginimo prefiksas tarp užklausų. Palikite nenustatyta, kad būtų naudojama teikėjo numatytoji reikšmė (1 valanda). 1 valandos talpykla išlaiko prefiksą šiltą ilgesniais intervalais, tačiau vienkartinė rašymo kaina yra didesnė; pasirinkite 5 minutes, jei norite senesnio veikimo būdo.",
+  "com_endpoint_anthropic_temp": "Reikšmė nuo 0 iki 1. Naudokite temperatūrą arčiau 0 analitinėms / pasirinkimo užduotims, o arčiau 1 – kūrybinėms ir generatyvinėms užduotims. Rekomenduojame keisti šį parametrą arba Top P, bet ne abu.",
+  "com_endpoint_anthropic_thinking": "Įgalina vidinį samprotavimą palaikomiems Claude modeliams. Naujesniems modeliams (Opus 4.6+) naudoja adaptyvinį mąstymą, valdomą pastangų parametro. Senesniems modeliams reikia nustatyti „Mąstymo biudžetą\", kuris turi būti mažesnis nei „Didžiausias išvesties žetonų skaičius\".",
+  "com_endpoint_anthropic_thinking_budget": "Nustato didžiausią žetonų skaičių, kurį Claude gali naudoti savo vidinio samprotavimo procesui. Didesni biudžetai gali pagerinti atsakymų kokybę, nes leidžia atlikti išsamesnę sudėtingų problemų analizę, nors Claude gali nenaudoti viso skirto biudžeto, ypač kai reikšmės viršija 32K. Šis parametras turi būti mažesnis nei „Didžiausias išvesties žetonų skaičius\".",
+  "com_endpoint_anthropic_thinking_display": "Minčių matomumas",
+  "com_endpoint_anthropic_thinking_display_desc": "Valdo, ar Claude samprotavimas yra grąžinamas. „Auto\" pasirenka apibendrintas mintis modeliams, kurie jas slepia pagal numatytuosius nustatymus (Opus 4.7+); „Summarized\" visada jas rodo; „Omitted\" visada jas slepia, šiek tiek sumažindamas delsą.",
+  "com_endpoint_anthropic_topk": "Top-k keičia tai, kaip modelis parenka žetonus išvestiai. Top-k reikšmė 1 reiškia, kad pasirinktas žetonas yra labiausiai tikėtinas iš visų modelio žodyno žetonų (dar vadinamas gobšiuoju dekodavimu), o top-k reikšmė 3 reiškia, kad kitas žetonas parenkamas iš 3 labiausiai tikėtinų žetonų (naudojant temperatūrą).",
+  "com_endpoint_anthropic_topp": "Top-p keičia tai, kaip modelis parenka žetonus išvestiai. Žetonai renkami nuo labiausiai tikėtinų K (žr. topK parametrą) iki mažiausiai tikėtinų, kol jų tikimybių suma lygsi top-p reikšmei.",
+  "com_endpoint_anthropic_use_web_search": "Įgalinti žiniatinklio paieškos funkciją naudojant integruotas Anthropic paieškos galimybes. Tai leidžia modeliui ieškoti naujausios informacijos internete ir teikti tikslesnius, aktualesnius atsakymus.",
+  "com_endpoint_assistant": "Asistentas",
+  "com_endpoint_assistant_model": "Asistento modelis",
+  "com_endpoint_assistant_placeholder": "Pasirinkite asistentą iš dešinės šoninio skydelio",
+  "com_endpoint_bedrock_reasoning_effort": "Valdo samprotavimo lygį palaikomiems Bedrock modeliams (pvz., Kimi K2.5, GLM). Aukštesni lygiai duoda išsamesnį samprotavimą, tačiau padidina delsą ir žetonų skaičių.",
+  "com_endpoint_config_bedrock_access_key_id": "AWS prieigos rakto ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API raktas",
+  "com_endpoint_config_bedrock_credentials_required": "Pateikite arba AWS Bedrock API raktą, arba AWS prieigos raktus (prieigos rakto ID + slaptasis prieigos raktas)",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS slaptasis prieigos raktas",
+  "com_endpoint_config_bedrock_session_token": "AWS sesijos žetonas",
+  "com_endpoint_config_click_here": "Spustelėkite čia",
+  "com_endpoint_config_google_api_info": "Norėdami gauti savo Generative Language API raktą (Gemini),",
+  "com_endpoint_config_google_api_key": "Google API raktas",
+  "com_endpoint_config_google_cloud_platform": "(iš Google Cloud Platform)",
+  "com_endpoint_config_google_gemini_api": "(Gemini API)",
+  "com_endpoint_config_google_service_key": "Google paskyros paslaugos raktas",
+  "com_endpoint_config_key": "Nustatyti API raktą",
+  "com_endpoint_config_key_encryption": "Jūsų raktas bus užšifruotas ir ištrintas",
+  "com_endpoint_config_key_for": "Nustatyti API raktą, skirtą",
+  "com_endpoint_config_key_google_need_to": "Jums reikia",
+  "com_endpoint_config_key_google_service_account": "Sukurti paslaugos paskyrą",
+  "com_endpoint_config_key_google_vertex_ai": "Įjungti Vertex AI",
+  "com_endpoint_config_key_google_vertex_api": "API Google Cloud, tada",
+  "com_endpoint_config_key_google_vertex_api_role": "Pasirūpinkite, kad spustelėtumėte „Sukurti ir tęsti\", kad suteiktumėte bent „Vertex AI naudotojo\" vaidmenį. Galiausiai sukurkite JSON raktą, kurį importuosite čia.",
+  "com_endpoint_config_key_import_json_key": "Importuoti paslaugos paskyros JSON raktą.",
+  "com_endpoint_config_key_import_json_key_invalid": "Neteisingas paslaugos paskyros JSON raktas. Ar importavote tinkamą failą?",
+  "com_endpoint_config_key_import_json_key_success": "Paslaugos paskyros JSON raktas sėkmingai importuotas",
+  "com_endpoint_config_key_name": "Raktas",
+  "com_endpoint_config_key_never_expires": "Jūsų raktas niekada nebaigia galioti",
+  "com_endpoint_config_placeholder": "Nustatykite savo raktą antraštės meniu, kad galėtumėte kalbėtis.",
+  "com_endpoint_config_required_fields": "Šie laukai yra privalomi:",
+  "com_endpoint_config_value": "Įveskite reikšmę",
+  "com_endpoint_context": "Kontekstas",
+  "com_endpoint_context_info": "Didžiausias žetonų skaičius, kurį galima naudoti kontekstui. Naudokite tai, kad kontroliuotumėte, kiek žetonų siunčiama per vieną užklausą. Jei nenurodyta, bus naudojamos sistemos numatytosios reikšmės, pagrįstos žinomų modelių konteksto dydžiu. Nustačius didesnes reikšmes, gali atsirasti klaidų ir (arba) padidėti žetonų kaina.",
+  "com_endpoint_context_tokens": "Maks. konteksto žetonai",
+  "com_endpoint_custom_name": "Pasirinktinis pavadinimas",
+  "com_endpoint_default": "numatytasis",
+  "com_endpoint_default_blank": "numatytasis: tuščia",
+  "com_endpoint_default_with_num": "numatytasis: {{0}}",
+  "com_endpoint_disable_streaming": "Išjungti srautinį atsakymų perdavimą ir gauti visą atsakymą iš karto. Naudinga modeliams, pvz., o3, kuriems reikalingas organizacijos patvirtinimas srautiniam perdavimui",
+  "com_endpoint_disable_streaming_label": "Išjungti srautinį perdavimą",
+  "com_endpoint_effort": "Pastangos",
+  "com_endpoint_examples": "Išankstiniai nustatymai",
+  "com_endpoint_export": "Eksportuoti",
+  "com_endpoint_export_share": "Eksportuoti / bendrinti",
+  "com_endpoint_frequency_penalty": "Dažnumo bausmė",
+  "com_endpoint_google_custom_name_placeholder": "Nustatyti pasirinktinį pavadinimą Google",
+  "com_endpoint_google_maxoutputtokens": "Maksimalus žetonų skaičius, kurį galima sugeneruoti atsakyme. Nurodykite mažesnę reikšmę trumpesniems atsakymams ir didesnę – ilgesniems. Pastaba: modeliai gali sustoti nepasiekę šio maksimumo.",
+  "com_endpoint_google_temp": "Didesnės reikšmės = atsitiktingesnis rezultatas, mažesnės = labiau susikoncentruotas ir deterministinis. Rekomenduojame keisti šį parametrą arba Top P, bet ne abu vienu metu.",
+  "com_endpoint_google_thinking": "Įjungia arba išjungia samprotavimą. Palaiko Gemini 2.5 ir 3 serija. Pastaba: Gemini 3 Pro negali visiškai išjungti mąstymo.",
+  "com_endpoint_google_thinking_budget": "Nurodo mąstymo žetonų skaičių, kurį modelis naudoja. Tikrasis kiekis gali viršyti arba nesiekti šios reikšmės, priklausomai nuo užklausos.",
+  "com_endpoint_google_thinking_level": "Valdo samprotavimo gylį Gemini 3 ir naujesnėse versijose. Neturi poveikio Gemini 2.5 ir senesnėse – joms naudokite mąstymo biudžeto parametrą.",
+  "com_endpoint_google_topk": "Top-k keičia tai, kaip modelis parenka žetonus išvestiai. Top-k reikšmė 1 reiškia, kad pasirinktas žetonas yra labiausiai tikėtinas iš visų modelio žodyno žetonų (dar vadinamas godžiuoju dekodavimu), o top-k reikšmė 3 reiškia, kad kitas žetonas parenkamas iš 3 labiausiai tikėtinų žetonų (naudojant temperatūrą).",
+  "com_endpoint_google_topp": "Top-p keičia tai, kaip modelis parenka žetonus išvestiai. Žetonai renkami nuo labiausiai tikėtinų K (žr. topK parametrą) iki mažiausiai tikėtinų, kol jų tikimybių suma pasiekia top-p reikšmę.",
+  "com_endpoint_google_use_search_grounding": "Naudokite Google paieškos pagrindimo funkciją, kad pagerintumėte atsakymus realaus laiko žiniatinklio paieškos rezultatais. Tai leidžia modeliams pasiekti aktualią informaciją ir teikti tikslesnius, naujausius atsakymus.",
+  "com_endpoint_instructions_assistants": "Nepaisyti instrukcijų",
+  "com_endpoint_instructions_assistants_placeholder": "Nepaisoma asistento instrukcijų. Tai naudinga norint pakeisti elgesį kiekvienam paleidimui atskirai.",
+  "com_endpoint_max_output_tokens": "Maks. išvesties žetonai",
+  "com_endpoint_message": "Žinutė",
+  "com_endpoint_message_new": "Žinutė {{0}}",
+  "com_endpoint_message_not_appendable": "Redaguokite žinutę arba sugeneruokite iš naujo.",
+  "com_endpoint_my_preset": "Mano išankstinis nustatymas",
+  "com_endpoint_no_presets": "Dar nėra išankstinių nustatymų – naudokite nustatymų mygtuką, kad sukurtumėte",
+  "com_endpoint_openai_custom_name_placeholder": "Nustatyti pasirinktinį pavadinimą AI",
+  "com_endpoint_openai_detail": "Vaizdo užklausų rezoliucija. „Žema\" yra pigesnė ir greitesnė, „Aukšta\" – detalesnė ir brangesnė, o „Automatinė\" automatiškai pasirenka tarp jų pagal vaizdo rezoliuciją.",
+  "com_endpoint_openai_freq": "Skaičius nuo -2,0 iki 2,0. Teigiamos reikšmės baudžia naujus žetonus pagal jų esamo dažnumo tekste dažnumą, mažindamos modelio polinkį kartoti tą patį tekstą pažodžiui.",
+  "com_endpoint_openai_max": "Maks. sugeneruojamų žetonų skaičius. Bendrą įvesties ir sugeneruotų žetonų ilgį riboja modelio konteksto ilgis.",
+  "com_endpoint_openai_max_tokens": "Neprivalomas laukas „max_tokens\", nurodantis maksimalų žetonų skaičių, kurį galima sugeneruoti pokalbio užbaigime. Bendrą įvesties ir sugeneruotų žetonų ilgį riboja modelio konteksto ilgis. Gali pasirodyti klaidų, jei šis skaičius viršija maks. konteksto žetonų skaičių.",
+  "com_endpoint_openai_pres": "Skaičius nuo -2,0 iki 2,0. Teigiamos reikšmės baudžia naujus žetonus pagal tai, ar jie jau pasirodo tekste, didindamos modelio polinkį kalbėti apie naujas temas.",
+  "com_endpoint_openai_prompt_prefix_placeholder": "Nustatyti pasirinktines instrukcijas, įtraukiamas į sisteminį pranešimą. Numatytoji reikšmė: nėra",
+  "com_endpoint_openai_reasoning_effort": "Tik samprotavimo modeliams: riboja samprotavimo pastangas. Sumažinus samprotavimo pastangas galima gauti greitesnius atsakymus ir naudoti mažiau žetonų samprotavimui. „Minimalus\" sugeneruoja labai mažai samprotavimo žetonų, kad pirmas atsakymo žetonas pasirodytų greičiausiai – ypač tinka kodavimui ir instrukcijų vykdymui.",
+  "com_endpoint_openai_reasoning_summary": "Tik Responses API: modelio atlikto samprotavimo santrauka. Tai gali būti naudinga derinant ir suprantant modelio samprotavimo procesą. Nustatykite kaip none, auto, concise arba detailed.",
+  "com_endpoint_openai_resend": "Iš naujo siųsti visus anksčiau pridėtus vaizdus. Pastaba: tai gali žymiai padidinti žetonų sąnaudas ir gali pasirodyti klaidų su daugybe vaizdų priedų.",
+  "com_endpoint_openai_resend_files": "Iš naujo siųsti visus anksčiau pridėtus failus. Pastaba: tai padidins žetonų sąnaudas ir gali pasirodyti klaidų su daugybe priedų.",
+  "com_endpoint_openai_stop": "Iki 4 sekų, kuriose API nustos generuoti tolesnius žetonus.",
+  "com_endpoint_openai_temp": "Didesnės reikšmės = atsitiktingesnis rezultatas, mažesnės = labiau susikoncentruotas ir deterministinis. Rekomenduojame keisti šį parametrą arba Top P, bet ne abu vienu metu.",
+  "com_endpoint_openai_topp": "Alternatyva atrankai pagal temperatūrą, vadinama branduolinė atranka, kai modelis atsižvelgia į žetonų su top_p tikimybių mase rezultatus. Taigi 0,1 reiškia, kad atsižvelgiama tik į žetonus, sudarančius viršutinį 10 % tikimybių masės. Rekomenduojame keisti šį parametrą arba temperatūrą, bet ne abu vienu metu.",
+  "com_endpoint_openai_use_responses_api": "Naudoti Responses API vietoj pokalbių užbaigimų – joje yra papildomų OpenAI funkcijų. Būtina o1-pro, o3-pro ir norint įjungti samprotavimo santraukas.",
+  "com_endpoint_openai_use_web_search": "Įjungti žiniatinklio paieškos funkciją naudojant integruotas OpenAI paieškos galimybes. Tai leidžia modeliui ieškoti žiniatinklyje naujausios informacijos ir pateikti tikslesnius, aktualius atsakymus.",
+  "com_endpoint_openai_verbosity": "Riboja modelio atsakymo išsamumą. Mažesnės reikšmės duos glaustesnius atsakymus, o didesnės – išsamesnius. Šiuo metu palaikomos reikšmės: low, medium ir high.",
+  "com_endpoint_output": "Išvestis",
+  "com_endpoint_plug_image_detail": "Vaizdo detalumas",
+  "com_endpoint_plug_resend_files": "Iš naujo siųsti failus",
+  "com_endpoint_presence_penalty": "Buvimo bausmė",
+  "com_endpoint_preset": "išankstinis nustatymas",
+  "com_endpoint_preset_custom_name_placeholder": "čia turi kažkas būti . buvo tuščia",
+  "com_endpoint_preset_default": "dabar yra numatytasis išankstinis nustatymas.",
+  "com_endpoint_preset_default_item": "Numatytasis:",
+  "com_endpoint_preset_default_none": "nėra aktyvaus numatytojo išankstinio nustatymo.",
+  "com_endpoint_preset_default_removed": "nebėra numatytasis išankstinis nustatymas.",
+  "com_endpoint_preset_delete_confirm": "Ar tikrai norite ištrinti šį išankstinį nustatymą?",
+  "com_endpoint_preset_delete_error": "Ištrinti išankstinį nustatymą nepavyko. Bandykite dar kartą.",
+  "com_endpoint_preset_delete_success": "Išankstinis nustatymas sėkmingai ištrintas",
+  "com_endpoint_preset_import": "Išankstinis nustatymas importuotas!",
+  "com_endpoint_preset_import_error": "Importuoti išankstinį nustatymą nepavyko. Bandykite dar kartą.",
+  "com_endpoint_preset_name": "Išankstinio nustatymo pavadinimas",
+  "com_endpoint_preset_save_error": "Išsaugoti išankstinį nustatymą nepavyko. Bandykite dar kartą.",
+  "com_endpoint_preset_selected": "Išankstinis nustatymas aktyvus!",
+  "com_endpoint_preset_selected_title": "Aktyvus!",
+  "com_endpoint_preset_title": "Išankstinis nustatymas",
+  "com_endpoint_presets": "išankstiniai nustatymai",
+  "com_endpoint_presets_clear_warning": "Ar tikrai norite išvalyti visus išankstinius nustatymus? Šio veiksmo atšaukti neįmanoma.",
+  "com_endpoint_prompt_cache": "Naudoti greičio spartinimą",
+  "com_endpoint_prompt_cache_ttl": "Spartinimo trukmė",
+  "com_endpoint_prompt_cache_ttl_default": "Numatytoji (1 valanda)",
+  "com_endpoint_prompt_prefix": "Pasirinktinės instrukcijos",
+  "com_endpoint_prompt_prefix_assistants": "Papildomos instrukcijos",
+  "com_endpoint_prompt_prefix_assistants_placeholder": "Nustatykite papildomas instrukcijas arba kontekstą virš pagrindinių asistento instrukcijų. Ignoruojama, jei tuščia.",
+  "com_endpoint_prompt_prefix_placeholder": "Nustatykite pasirinktines instrukcijas arba kontekstą. Ignoruojama, jei tuščia.",
+  "com_endpoint_reasoning_effort": "Samprotavimo pastangos",
+  "com_endpoint_reasoning_summary": "Samprotavimo santrauka",
+  "com_endpoint_save_as_preset": "Išsaugoti kaip išankstinį nustatymą",
+  "com_endpoint_search": "Ieškoti galinio taško pagal pavadinimą",
+  "com_endpoint_search_endpoint_models": "Ieškoti {{0}} modelių...",
+  "com_endpoint_search_models": "Ieškoti modelių...",
+  "com_endpoint_search_var": "Ieškoti {{0}}...",
+  "com_endpoint_set_custom_name": "Nustatykite pasirinktinį pavadinimą, kad galėtumėte rasti šį išankstinį nustatymą",
+  "com_endpoint_stop": "Sustabdymo sekos",
+  "com_endpoint_stop_placeholder": "Atskirkite reikšmes paspausdami „Enter\"",
+  "com_endpoint_temperature": "Temperatūra",
+  "com_endpoint_thinking": "Mąstymas",
+  "com_endpoint_thinking_budget": "Mąstymo biudžetas",
+  "com_endpoint_thinking_level": "Mąstymo lygis",
+  "com_endpoint_top_k": "Top K",
+  "com_endpoint_top_p": "Top P",
+  "com_endpoint_use_active_assistant": "Naudoti aktyvų asistentą",
+  "com_endpoint_use_responses_api": "Naudoti Responses API",
+  "com_endpoint_use_search_grounding": "Pagrindimas su Google paieška",
+  "com_endpoint_verbosity": "Išsamumas",
+  "com_error_endpoint_models_not_loaded": "{{0}} modelių nepavyko įkelti. Atnaujinkite puslapį ir bandykite dar kartą.",
+  "com_error_expired_user_key": "Pateiktas {{0}} raktas baigė galioti {{1}}. Pateikite naują raktą ir bandykite dar kartą.",
+  "com_error_files_dupe": "Aptiktas besiduplikuojantis failas.",
+  "com_error_files_empty": "Tušti failai neleidžiami.",
+  "com_error_files_process": "Apdorojant failą įvyko klaida.",
+  "com_error_files_upload": "Įkeliant failą įvyko klaida.",
+  "com_error_files_upload_canceled": "Failo įkėlimo užklausa buvo atšaukta. Pastaba: failo įkėlimas gali vis dar vykti ir jį reikės ištrinti rankiniu būdu.",
+  "com_error_files_upload_too_large": "Failas per didelis. Įkelkite failą, mažesnį nei {{0}} MB.",
+  "com_error_files_validation": "Tikrinant failą įvyko klaida.",
+  "com_error_google_tool_conflict": "Integruotų Google įrankių naudojimas su išoriniais įrankiais nepalaikomas. Išjunkite integruotus įrankius arba išorinius įrankius.",
+  "com_error_heic_conversion": "Nepavyko konvertuoti HEIC vaizdo į JPEG. Pabandykite konvertuoti vaizdą rankiniu būdu arba naudokite kitą formatą.",
+  "com_error_illegal_model_request": "Modelis „{{0}}\" nepasiekiamas {{1}}. Pasirinkite kitą modelį.",
+  "com_error_input_length": "Paskutinės žinutės tokenų skaičius per didelis, viršija tokenų limitą arba jūsų tokenų limito parametrai sukonfigūruoti neteisingai, neigiamai veikdami konteksto langą. Daugiau informacijos: {{0}}. Sutrumpinkite žinutę, pakoreguokite maksimalų konteksto dydį pokalbio parametruose arba šakokite pokalbį, kad galėtumėte tęsti.",
+  "com_error_invalid_agent_provider": "„{{0}}\" tiekėjas nepasiekiamas naudojimui su agentais. Eikite į agento nustatymus ir pasirinkite šiuo metu prieinamą tiekėją.",
+  "com_error_invalid_base_url": "Jūsų pateiktas pagrindinis URL nurodo ribotą adresą. Naudokite tinkamą išorinį URL ir bandykite dar kartą.",
+  "com_error_invalid_user_key": "Pateiktas netinkamas raktas. Pateikite tinkamą raktą ir bandykite dar kartą.",
+  "com_error_missing_model": "{{0}} nepasirinktas modelis. Pasirinkite modelį ir bandykite dar kartą.",
+  "com_error_models_not_loaded": "Modelių konfigūracijos nepavyko įkelti. Atnaujinkite puslapį ir bandykite dar kartą.",
+  "com_error_moderation": "Atrodo, kad pateiktas turinys buvo pažymėtas mūsų moderavimo sistemos kaip neatitinkantis mūsų bendruomenės gairių. Negalime tęsti šia konkrečia tema. Jei turite kitų klausimų ar temų, kurias norėtumėte nagrinėti, redaguokite savo žinutę arba pradėkite naują pokalbį.",
+  "com_error_no_base_url": "Pagrindinis URL nerastas. Pateikite jį ir bandykite dar kartą.",
+  "com_error_no_user_key": "Raktas nerastas. Pateikite raktą ir bandykite dar kartą.",
+  "com_error_refusal": "Atsakymą atmetė saugos filtrai. Perrašykite žinutę ir bandykite dar kartą. Jei su tuo dažnai susiduriate naudodami Claude Sonnet 4.5 arba Opus 4.1, galite išbandyti Sonnet 4, kuris turi kitokius naudojimo apribojimus.",
+  "com_error_stream_expired": "Atsakymo srautas baigė galioti arba jau baigtas. Bandykite dar kartą.",
+  "com_file_pages": "Puslapiai: {{pages}}",
+  "com_file_source": "Failas",
+  "com_file_unknown": "Nežinomas failas",
+  "com_files_download_failed": "{{0}} failų nepavyko",
+  "com_files_download_percent_complete": "{{0}}% atlikta",
+  "com_files_download_progress": "{{0}} iš {{1}} failų",
+  "com_files_downloading": "Atsiunčiami failai",
+  "com_files_filter": "Filtruoti failus...",
+  "com_files_filter_by": "Filtruoti failus pagal...",
+  "com_files_no_results": "Rezultatų nėra.",
+  "com_files_number_selected": "Pasirinkta {{0}} iš {{1}} elementų",
+  "com_files_preparing_download": "Ruošiamas atsisiuntimas...",
+  "com_files_result_found": "Rastas {{count}} rezultatas",
+  "com_files_results_found": "Rasta {{count}} rezultatų",
+  "com_files_sharepoint_picker_title": "Pasirinkti failus",
+  "com_files_table": "Failų lentelė",
+  "com_files_upload_local_machine": "Iš vietinio kompiuterio",
+  "com_files_upload_sharepoint": "Iš SharePoint",
+  "com_generated_files": "Sugeneruoti failai:",
+  "com_hide_examples": "Slėpti pavyzdžius",
+  "com_info_heic_converting": "HEIC vaizdas konvertuojamas į JPEG...",
+  "com_nav_2fa": "Dviejų veiksnių autentifikavimas (2FA)",
+  "com_nav_about_branch": "Šaka",
+  "com_nav_about_build_date": "Sukurta",
+  "com_nav_about_commit": "Įsipareigojimas",
+  "com_nav_about_diagnostics_copied": "Nukopijuota į iškarpinę",
+  "com_nav_about_diagnostics_copy": "Kopijuoti diagnostikos duomenis",
+  "com_nav_about_diagnostics_description": "Kopijuokite šį bloką atidarydami palaikymo užklausą, kad prižiūrėtojai galėtų nustatyti tikslią naudojamą versiją.",
+  "com_nav_about_version": "Versija",
+  "com_nav_account_settings": "Paskyros nustatymai",
+  "com_nav_advanced_prompts": "Išplėstinis užklausų redaktorius",
+  "com_nav_advanced_prompts_desc": "Įgalinti užklausų versijų kūrimą ir gamybinę kontrolę",
+  "com_nav_always_make_prod": "Visada kurti naują užklausos versiją kaip gamybinę",
+  "com_nav_archive_created_at": "Archyvavimo data",
+  "com_nav_archive_name": "Pavadinimas",
+  "com_nav_archived_chats": "Archyvuoti pokalbiai",
+  "com_nav_at_command": "Komanda „@\"",
+  "com_nav_at_command_description": "Įjungti komandą „@\", skirtą perjungti galutinius taškus, modelius, išankstinius nustatymus ir kt.",
+  "com_nav_audio_play_error": "Klaida atkuriant garsą: {{0}}",
+  "com_nav_audio_process_error": "Klaida apdorojant garsą: {{0}}",
+  "com_nav_auto_expand_tools": "Automatiškai išplėsti įrankių informaciją",
+  "com_nav_auto_scroll": "Automatiškai slinkti iki naujausios žinutės atidarius pokalbį",
+  "com_nav_auto_send_prompts": "Siųsti užklausas pasirinkus",
+  "com_nav_auto_send_prompts_desc": "Automatiškai pateikti užklausą į pokalbį, kai ji pasirenkama",
+  "com_nav_auto_send_text": "Automatiškai siųsti tekstą",
+  "com_nav_auto_transcribe_audio": "Automatiškai transkribuoti garsą",
+  "com_nav_automatic_playback": "Automatiškai leisti naujausią žinutę",
+  "com_nav_balance": "Balansas",
+  "com_nav_balance_auto_refill_disabled": "Automatinis papildymas išjungtas.",
+  "com_nav_balance_auto_refill_error": "Klaida įkeliant automatinio papildymo nustatymus.",
+  "com_nav_balance_auto_refill_settings": "Automatinio papildymo nustatymai",
+  "com_nav_balance_day": "diena",
+  "com_nav_balance_days": "dienos",
+  "com_nav_balance_every": "Kiekvienas",
+  "com_nav_balance_hour": "valanda",
+  "com_nav_balance_hours": "valandos",
+  "com_nav_balance_interval": "Intervalas:",
+  "com_nav_balance_last_refill": "Paskutinis papildymas:",
+  "com_nav_balance_minute": "minutė",
+  "com_nav_balance_minutes": "minutės",
+  "com_nav_balance_month": "mėnuo",
+  "com_nav_balance_months": "mėnesiai",
+  "com_nav_balance_next_refill": "Kitas papildymas:",
+  "com_nav_balance_next_refill_info": "Kitas papildymas įvyks automatiškai tik tada, kai bus įvykdytos abi sąlygos: praėjo nustatytas laiko intervalas nuo paskutinio papildymo ir siunčiant užklausą jūsų balansas nukristų žemiau nulio.",
+  "com_nav_balance_refill_amount": "Papildymo suma:",
+  "com_nav_balance_second": "sekundė",
+  "com_nav_balance_seconds": "sekundės",
+  "com_nav_balance_week": "savaitė",
+  "com_nav_balance_weeks": "savaitės",
+  "com_nav_browser": "Naršyklė",
+  "com_nav_center_chat_input": "Centruoti pokalbio įvestį sveiknamų ekrane",
+  "com_nav_change_picture": "Keisti nuotrauką",
+  "com_nav_chat_direction": "Pokalbio kryptis",
+  "com_nav_chat_direction_selected": "Pokalbio kryptis: {{direction}}",
+  "com_nav_clear_all_chats": "Išvalyti visus pokalbius",
+  "com_nav_clear_cache_confirm_message": "Ar tikrai norite išvalyti talpyklą?",
+  "com_nav_clear_conversation": "Išvalyti pokalbius",
+  "com_nav_clear_conversation_confirm_message": "Ar tikrai norite išvalyti visus pokalbius? Šio veiksmo negalima atšaukti.",
+  "com_nav_close_sidebar": "Uždaryti šoninę juostą",
+  "com_nav_confirm_clear": "Patvirtinti išvalymą",
+  "com_nav_control_panel": "Valdymo skydelis",
+  "com_nav_conversation_mode": "Pokalbio režimas",
+  "com_nav_convo_menu_options": "Pokalbio meniu parinktys",
+  "com_nav_db_sensitivity": "Decibelų jautrumas",
+  "com_nav_default_temporary_chat": "Laikinas pokalbis pagal nutylėjimą",
+  "com_nav_delete_account": "Ištrinti paskyrą",
+  "com_nav_delete_account_button": "Visam laikui ištrinti mano paskyrą",
+  "com_nav_delete_account_confirm": "Ištrinti paskyrą – ar tikrai?",
+  "com_nav_delete_account_email_placeholder": "Įveskite savo paskyros el. pašto adresą",
+  "com_nav_delete_cache_storage": "Ištrinti TTS talpyklos saugyklą",
+  "com_nav_delete_data_info": "Visi jūsų duomenys bus ištrinti.",
+  "com_nav_delete_warning": "ĮSPĖJIMAS: Tai visam laikui ištrins jūsų paskyrą.",
+  "com_nav_enable_cache_tts": "Įjungti TTS talpyklą",
+  "com_nav_enable_cloud_browser_voice": "Naudoti debesų pagrindu veikiančius balsus",
+  "com_nav_engine": "Variklis",
+  "com_nav_enter_to_send": "Paspauskite Enter, kad išsiųstumėte žinutes",
+  "com_nav_export": "Eksportuoti",
+  "com_nav_export_all_message_branches": "Eksportuoti visas žinučių šakas",
+  "com_nav_export_conversation": "Eksportuoti pokalbį",
+  "com_nav_export_filename": "Failo pavadinimas",
+  "com_nav_export_filename_placeholder": "Nustatyti failo pavadinimą",
+  "com_nav_export_include_endpoint_options": "Įtraukti galutinio taško parinktis",
+  "com_nav_export_recursive": "Rekursyvus",
+  "com_nav_export_recursive_or_sequential": "Rekursyvus ar nuoseklus?",
+  "com_nav_export_type": "Tipas",
+  "com_nav_external": "Išorinis",
+  "com_nav_font_size": "Žinučių šrifto dydis",
+  "com_nav_font_size_base": "Vidutinis",
+  "com_nav_font_size_lg": "Didelis",
+  "com_nav_font_size_sm": "Mažas",
+  "com_nav_font_size_xl": "Labai didelis",
+  "com_nav_font_size_xs": "Labai mažas",
+  "com_nav_help": "Pagalba",
+  "com_nav_help_faq": "Pagalba ir DUK",
+  "com_nav_info_balance": "Balansas rodo, kiek tuokenų kreditų jums liko naudoti. Tokenų kreditai atitinka piniginę vertę (pvz., 1000 kreditų = 0,001 USD)",
+  "com_nav_info_code_artifacts": "Įjungia eksperimentinių kodo artefaktų rodymą šalia pokalbio",
+  "com_nav_info_code_artifacts_agent": "Įjungia kodo artefaktų naudojimą šiam agentui. Pagal numatytuosius nustatymus pridedamos papildomos instrukcijos, susijusios su artefaktų naudojimu, nebent įjungtas „Pasirinktinis raginimo režimas\".",
+  "com_nav_info_custom_prompt_mode": "Kai įjungta, numatytasis artefaktų sistemos raginimas nebus įtrauktas. Šiame režime visos artefaktus generuojančios instrukcijos turi būti pateiktos rankiniu būdu.",
+  "com_nav_info_default_temporary_chat": "Kai įjungta, nauji pokalbiai pagal numatytuosius nustatymus prasidės su įjungtu laikinojo pokalbio režimu. Laikinieji pokalbiai neišsaugomi jūsų istorijoje.",
+  "com_nav_info_enter_to_send": "Kai įjungta, paspaudus `ENTER` žinutė bus išsiųsta. Kai išjungta, paspaudus Enter bus pridėta nauja eilutė, o žinutei išsiųsti reikės paspausti `CTRL + ENTER` / `⌘ + ENTER`.",
+  "com_nav_info_fork_change_default": "`Tik matomos žinutės` apima tik tiesioginį kelią iki pasirinktos žinutės. `Įtraukti susijusias šakas` prideda šakas išilgai kelio. `Įtraukti visas į/iš čia` apima visas sujungtas žinutes ir šakas.",
+  "com_nav_info_fork_split_target_setting": "Kai įjungta, šakojimas prasidės nuo tikslinės žinutės iki naujausios pokalbio žinutės, pagal pasirinktą elgseną.",
+  "com_nav_info_include_shadcnui": "Kai įjungta, bus įtrauktos instrukcijos, skirtos shadcn/ui komponentų naudojimui. shadcn/ui yra daugkartinio naudojimo komponentų rinkinys, sukurtas naudojant Radix UI ir Tailwind CSS. Pastaba: tai išsamios instrukcijos, jas turėtumėte įjungti tik tuo atveju, jei jums svarbu informuoti LLM apie tinkamus importus ir komponentus. Daugiau informacijos apie šiuos komponentus rasite: https://ui.shadcn.com/",
+  "com_nav_info_latex_parsing": "Kai įjungta, žinutėse esantis LaTeX kodas bus atvaizduotas kaip matematinės lygtys. Išjungus šią funkciją, našumas gali pagerėti, jei jums nereikia LaTeX atvaizdavimo.",
+  "com_nav_info_save_badges_state": "Kai įjungta, pokalbio ženklelių būsena bus išsaugota. Tai reiškia, kad kuriant naują pokalbį ženkleliai išliks tokios pačios būsenos kaip ir ankstesniame pokalbyje. Išjungus šią parinktį, ženkleliai bus grąžinti į numatytąją būseną kiekvieną kartą kuriant naują pokalbį.",
+  "com_nav_info_save_draft": "Kai įjungta, pokalbio formoje įvestas tekstas ir priedai bus automatiškai išsaugoti vietoje kaip juodraščiai. Šie juodraščiai bus pasiekiami net ir perkrovus puslapį arba persijungus į kitą pokalbį. Juodraščiai saugomi vietoje jūsų įrenginyje ir ištrinami išsiuntus žinutę.",
+  "com_nav_info_show_thinking": "Kai įjungta, pokalbis pagal numatytuosius nustatymus rodys mąstymo išskleidžiamuosius sąrašus atvertus, kad galėtumėte peržiūrėti AI samprotavimus realiu laiku. Kai išjungta, mąstymo išskleidžiamieji sąrašai pagal numatytuosius nustatymus liks uždaryti, suteikiant švaresnę ir supaprastintą sąsają.",
+  "com_nav_info_user_name_display": "Kai įjungta, siuntėjo vartotojo vardas bus rodomas virš kiekvienos jūsų siunčiamos žinutės. Kai išjungta, virš savo žinučių matysite tik „Jūs\".",
+  "com_nav_keep_screen_awake": "Neleisti ekranui užgesti generuojant atsakymą",
+  "com_nav_lang_arabic": "العربية",
+  "com_nav_lang_armenian": "Հայերեն",
+  "com_nav_lang_auto": "Aptikti automatiškai",
+  "com_nav_lang_bosnian": "Босански",
+  "com_nav_lang_brazilian_portuguese": "Português Brasileiro",
+  "com_nav_lang_catalan": "Català",
+  "com_nav_lang_chinese": "中文",
+  "com_nav_lang_czech": "Čeština",
+  "com_nav_lang_danish": "Dansk",
+  "com_nav_lang_dutch": "Nederlands",
+  "com_nav_lang_english": "English",
+  "com_nav_lang_estonian": "Eesti keel",
+  "com_nav_lang_finnish": "Suomi",
+  "com_nav_lang_french": "Français",
+  "com_nav_lang_georgian": "ქართული",
+  "com_nav_lang_german": "Deutsch",
+  "com_nav_lang_hebrew": "עברית",
+  "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "Íslenska",
+  "com_nav_lang_indonesia": "Indonesia",
+  "com_nav_lang_italian": "Italiano",
+  "com_nav_lang_japanese": "日本語",
+  "com_nav_lang_korean": "한국어",
+  "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
+  "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
+  "com_nav_lang_persian": "فارسی",
+  "com_nav_lang_polish": "Polski",
+  "com_nav_lang_portuguese": "Português",
+  "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
+  "com_nav_lang_slovenian": "Slovenščina",
+  "com_nav_lang_spanish": "Español",
+  "com_nav_lang_swedish": "Svenska",
+  "com_nav_lang_thai": "ไทย",
+  "com_nav_lang_tibetan": "བོད་སྐད་",
+  "com_nav_lang_traditional_chinese": "繁體中文",
+  "com_nav_lang_turkish": "Türkçe",
+  "com_nav_lang_ukrainian": "Українська",
+  "com_nav_lang_uyghur": "Uyƣur tili",
+  "com_nav_lang_vietnamese": "Tiếng Việt",
+  "com_nav_language": "Kalba",
+  "com_nav_latex_parsing": "LaTeX analizavimas pranešimuose (gali turėti įtakos našumui)",
+  "com_nav_log_out": "Atsijungti",
+  "com_nav_long_audio_warning": "Ilgesni tekstai bus apdorojami ilgiau.",
+  "com_nav_maximize_chat_space": "Padidinti pokalbio erdvę",
+  "com_nav_mcp_access_revoked": "MCP serverio prieiga sėkmingai atšaukta.",
+  "com_nav_mcp_configure_server": "Konfigūruoti {{0}}",
+  "com_nav_mcp_connect": "Prisijungti",
+  "com_nav_mcp_connect_server": "Prisijungti prie {{0}}",
+  "com_nav_mcp_reconnect": "Prisijungti iš naujo",
+  "com_nav_mcp_status_connected": "Prisijungta",
+  "com_nav_mcp_status_connecting": "{{0}} – jungiamasi",
+  "com_nav_mcp_status_disconnected": "Atjungta",
+  "com_nav_mcp_status_error": "Klaida",
+  "com_nav_mcp_status_initializing": "Inicializuojama",
+  "com_nav_mcp_status_needs_auth": "Reikalingas autentifikavimas",
+  "com_nav_mcp_status_unknown": "Nežinoma",
+  "com_nav_mcp_vars_update_error": "Klaida atnaujinant MCP vartotojo kintamuosius",
+  "com_nav_mcp_vars_updated": "MCP vartotojo kintamieji sėkmingai atnaujinti.",
+  "com_nav_modular_chat": "Įjungti galutinių taškų keitimą pokalbio metu",
+  "com_nav_my_files": "Mano failai",
+  "com_nav_new_chat_switch_to_history": "Perjungti į pokalbių istoriją pradedant naują pokalbį",
+  "com_nav_not_supported": "Nepalaikoma",
+  "com_nav_open_sidebar": "Atidaryti šoninę juostą",
+  "com_nav_playback_rate": "Garso atkūrimo greitis",
+  "com_nav_plugin_auth_error": "Bandant autentifikuoti šį papildinį įvyko klaida. Bandykite dar kartą.",
+  "com_nav_plus_command": "+-Komanda",
+  "com_nav_plus_command_description": "Perjungti komandą „+\" daugelio atsakymų nustatymui pridėti",
+  "com_nav_profile_picture": "Profilio nuotrauka",
+  "com_nav_save_badges_state": "Išsaugoti ženklelių būseną",
+  "com_nav_save_drafts": "Išsaugoti juodraščius vietoje",
+  "com_nav_scroll_button": "Slinkti į pabaigą mygtukas",
+  "com_nav_search_placeholder": "Ieškoti žinučių",
+  "com_nav_send_message": "Siųsti žinutę",
+  "com_nav_setting_about": "Apie",
+  "com_nav_setting_account": "Paskyra",
+  "com_nav_setting_chat": "Pokalbis",
+  "com_nav_setting_delay": "Delsa (s)",
+  "com_nav_setting_general": "Bendra",
+  "com_nav_setting_mcp": "MCP nustatymai",
+  "com_nav_setting_speech": "Kalba",
+  "com_nav_settings": "Nustatymai",
+  "com_nav_shared_links": "Bendrinamos nuorodos",
+  "com_nav_show_thinking": "Atidaryti mąstymo išskleidžiamuosius meniu pagal numatytąją reikšmę",
+  "com_nav_slash_command": "/-Komanda",
+  "com_nav_slash_command_description": "Perjungti komandą „/\" prompt'o pasirinkimui klaviatūra",
+  "com_nav_speech_to_text": "Kalba į tekstą",
+  "com_nav_stop_generating": "Sustabdyti generavimą",
+  "com_nav_text_to_speech": "Tekstas į kalbą",
+  "com_nav_theme": "Tema",
+  "com_nav_theme_dark": "Tamsi",
+  "com_nav_theme_light": "Šviesi",
+  "com_nav_theme_system": "Sistema",
+  "com_nav_tool_dialog": "Asistento įrankiai",
+  "com_nav_tool_dialog_agents": "Agento įrankiai",
+  "com_nav_tool_dialog_description": "Asistentas turi būti išsaugotas, kad įrankių pasirinkimai išliktų.",
+  "com_nav_tool_dialog_mcp_server_tools": "MCP serverio įrankiai",
+  "com_nav_tool_remove": "Pašalinti",
+  "com_nav_tool_search": "Ieškoti įrankių",
+  "com_nav_user": "VARTOTOJAS",
+  "com_nav_user_msg_markdown": "Rodyti vartotojo žinutes kaip markdown",
+  "com_nav_user_name_display": "Rodyti vartotojo vardą žinutėse",
+  "com_nav_voice_select": "Balsas",
+  "com_shortcut_archive_conversation": "Archyvuoti pokalbį",
+  "com_shortcut_bookmark_conversation": "Pridėti pokalbį prie žymių",
+  "com_shortcut_continue_response": "Tęsti atsakymą",
+  "com_shortcut_copy_last_code": "Kopijuoti paskutinį kodo bloką",
+  "com_shortcut_copy_last_response": "Kopijuoti paskutinį atsakymą",
+  "com_shortcut_delete_conversation": "Ištrinti pokalbį",
+  "com_shortcut_edit_aria": "Tinkinti spartųjį klavišą {{0}}",
+  "com_shortcut_edit_last_message": "Redaguoti paskutinę žinutę",
+  "com_shortcut_focus_chat_input": "Aktyvuoti pokalbio įvesties lauką",
+  "com_shortcut_focus_search": "Aktyvuoti paiešką",
+  "com_shortcut_group_chat": "Pokalbis",
+  "com_shortcut_group_general": "Bendri",
+  "com_shortcut_group_navigation": "Navigacija",
+  "com_shortcut_group_panels": "Atidaryti skydelius",
+  "com_shortcut_group_panels_hint": "Spustelėkite eilutę, kad priskirtumėte",
+  "com_shortcut_keyboard_shortcuts": "Klaviatūros spartieji klavišai",
+  "com_shortcut_open_agents": "Atidaryti agentus",
+  "com_shortcut_open_assistants": "Atidaryti asistentus",
+  "com_shortcut_open_bookmarks": "Atidaryti žymes",
+  "com_shortcut_open_files": "Atidaryti failus",
+  "com_shortcut_open_mcp": "Atidaryti MCP nustatymus",
+  "com_shortcut_open_memories": "Atidaryti atsiminimus",
+  "com_shortcut_open_model_selector": "Atidaryti modelio pasirinkimą",
+  "com_shortcut_open_parameters": "Atidaryti parametrus",
+  "com_shortcut_open_prompts": "Atidaryti užklausų šablonus",
+  "com_shortcut_read_aloud": "Perskaityti paskutinį atsakymą balsu",
+  "com_shortcut_recorder_conflict": "Jau naudoja \"{{0}}\".",
+  "com_shortcut_recorder_conflict_prefix": "Konfliktuoja su",
+  "com_shortcut_recorder_hint": "Paspauskite kombinaciją — Esc, kad atšauktumėte",
+  "com_shortcut_recorder_needs_modifier": "Pridėkite Cmd, Ctrl arba Alt prie kombinacijos",
+  "com_shortcut_recorder_placeholder": "Paspauskite kombinaciją…",
+  "com_shortcut_recorder_replace": "Pakeisti",
+  "com_shortcut_recorder_try_again": "Bandyti dar kartą",
+  "com_shortcut_regenerate_response": "Generuoti atsakymą iš naujo",
+  "com_shortcut_reset": "Atstatyti",
+  "com_shortcut_reset_all": "Atstatyti visus į numatytuosius",
+  "com_shortcut_scroll_to_bottom": "Slinkti į apačią",
+  "com_shortcut_scroll_to_top": "Slinkti į viršų",
+  "com_shortcut_set": "Nustatyti spartųjį klavišą",
+  "com_shortcut_show_shortcuts": "Rodyti klaviatūros sparčiuosius klavišus",
+  "com_shortcut_submit_message": "Pateikti žinutę",
+  "com_shortcut_toggle_sidebar": "Rodyti/slėpti šoninę juostą",
+  "com_shortcut_upload_file": "Įkelti failą",
+  "com_show_examples": "Rodyti pavyzdžius",
+  "com_sidepanel_agent_builder": "Agento kūrėjas",
+  "com_sidepanel_assistant_builder": "Asistento kūrėjas",
+  "com_sidepanel_attach_files": "Pridėti failus",
+  "com_sidepanel_conversation_tags": "Žymelės",
+  "com_sidepanel_hide_panel": "Slėpti skydelį",
+  "com_sidepanel_manage_files": "Tvarkyti failus",
+  "com_sidepanel_parameters": "Parametrai",
+  "com_sources_agent_file": "Šaltinio dokumentas",
+  "com_sources_agent_files": "Agento failai",
+  "com_sources_download_aria_label": "Atsisiųsti {{filename}}{{status}}",
+  "com_sources_download_failed": "Atsisiuntimas nepavyko",
+  "com_sources_download_local_unavailable": "Nepavyko atsisiųsti: failas neišsaugotas",
+  "com_sources_downloading_status": "(atsisiunčiama...)",
+  "com_sources_error_fallback": "Nepavyko įkelti šaltinių",
+  "com_sources_image_alt": "Paieškos rezultato vaizdas",
+  "com_sources_more_files": "+{{count}} failų",
+  "com_sources_more_sources": "+{{count}} šaltinių",
+  "com_sources_pages": "Puslapiai",
+  "com_sources_region_label": "Paieškos rezultatai ir šaltiniai",
+  "com_sources_reload_page": "Perkrauti puslapį",
+  "com_sources_tab_all": "Visi",
+  "com_sources_tab_files": "Failai",
+  "com_sources_tab_images": "Vaizdai",
+  "com_sources_tab_news": "Naujienos",
+  "com_sources_title": "Šaltiniai",
+  "com_ui_2fa_account_security": "Dviejų veiksnių autentifikacija suteikia papildomą apsaugos lygį jūsų paskyrai",
+  "com_ui_2fa_disable": "Išjungti 2FA",
+  "com_ui_2fa_disable_error": "Įvyko klaida išjungiant dviejų veiksnių autentifikaciją",
+  "com_ui_2fa_disabled": "2FA išjungta",
+  "com_ui_2fa_enable": "Įjungti 2FA",
+  "com_ui_2fa_enabled": "2FA įjungta",
+  "com_ui_2fa_generate_error": "Įvyko klaida generuojant dviejų veiksnių autentifikacijos nustatymus",
+  "com_ui_2fa_invalid": "Neteisingas dviejų veiksnių autentifikacijos kodas",
+  "com_ui_2fa_setup": "Nustatyti 2FA",
+  "com_ui_2fa_verification_required": "Įveskite savo 2FA kodą, kad tęstumėte",
+  "com_ui_2fa_verified": "Dviejų veiksnių autentifikacija sėkmingai patvirtinta",
+  "com_ui_accept": "Sutinku",
+  "com_ui_action_button": "Veiksmų mygtukas",
+  "com_ui_active": "Aktyvus",
+  "com_ui_add": "Pridėti",
+  "com_ui_add_first_bookmark": "Spustelėkite pokalbį, kad pridėtumėte",
+  "com_ui_add_first_mcp_server": "Sukurkite pirmąjį MCP serverį, kad pradėtumėte",
+  "com_ui_add_first_prompt": "Sukurkite pirmąją užklausą, kad pradėtumėte",
+  "com_ui_add_labels": "Pridėti žymes",
+  "com_ui_add_mcp": "Pridėti MCP",
+  "com_ui_add_mcp_server": "Pridėti MCP serverį",
+  "com_ui_add_model_preset": "Pridėti modelį arba išankstinį nustatymą papildomam atsakymui",
+  "com_ui_add_multi_conversation": "Pridėti kelių pokalbių režimą",
+  "com_ui_add_skills": "Pridėti įgūdžius",
+  "com_ui_add_special_variables": "Pridėti specialius kintamuosius",
+  "com_ui_add_to_chat": "Pridėti į pokalbį",
+  "com_ui_add_web_search_api_keys": "Pridėti žiniatinklio paieškos API raktus",
+  "com_ui_adding_details": "Papildomos detalės pridedamos",
+  "com_ui_additional_details": "Papildomos detalės",
+  "com_ui_admin": "Administratorius",
+  "com_ui_admin_access_warning": "Išjungus administratoriaus prieigą prie šios funkcijos gali atsirasti netikėtų UI problemų, reikalaujančių puslapio perkrovimo. Jei įrašyta, vienintelis būdas grįžti atgal – naudoti sąsajos nustatymą librechat.yaml konfigūracijos faile, kuris veikia visas roles.",
+  "com_ui_admin_panel": "Administratoriaus skydelis",
+  "com_ui_admin_settings": "Administratoriaus nustatymai",
+  "com_ui_admin_settings_section": "Administratoriaus nustatymai – {{section}}",
+  "com_ui_advanced": "Išplėstinė",
+  "com_ui_advanced_settings": "Išplėstiniai nustatymai",
+  "com_ui_agent": "Agentas",
+  "com_ui_agent_api_keys": "Agento API raktai",
+  "com_ui_agent_category_aftersales": "Aptarnavimas po pardavimo",
+  "com_ui_agent_category_finance": "Finansai",
+  "com_ui_agent_category_general": "Bendroji",
+  "com_ui_agent_category_hr": "Personalo skyrius",
+  "com_ui_agent_category_it": "IT",
+  "com_ui_agent_category_rd": "Tyrimai ir plėtra",
+  "com_ui_agent_category_sales": "Pardavimai",
+  "com_ui_agent_category_selector_aria": "Agento kategorijos parinkiklis",
+  "com_ui_agent_chain": "Agentų grandinė (agentų mišinys)",
+  "com_ui_agent_chain_info": "Leidžia kurti agentų sekas. Kiekvienas agentas gali pasiekti ankstesnių grandinės agentų rezultatus. Grindžiama „agentų mišinio\" architektūra, kurioje agentai naudoja ankstesnius rezultatus kaip pagalbinę informaciją.",
+  "com_ui_agent_chain_max": "Pasiektas maksimalus {{0}} agentų skaičius.",
+  "com_ui_agent_delete_error": "Klaida trinant agentą",
+  "com_ui_agent_deleted": "Agentas sėkmingai ištrintas",
+  "com_ui_agent_description": "Agento aprašymas",
+  "com_ui_agent_duplicate_error": "Klaida dublikuojant agentą",
+  "com_ui_agent_duplicated": "Agentas sėkmingai dublikuotas",
+  "com_ui_agent_handoff_add": "Pridėti perdavimo agentą",
+  "com_ui_agent_handoff_description": "Perdavimo aprašymas",
+  "com_ui_agent_handoff_description_placeholder": "pvz., Perduoti duomenų analitikui statistinei analizei",
+  "com_ui_agent_handoff_info": "Konfigūruokite agentus, kuriems šis agentas gali perduoti pokalbius, kai reikalingos konkrečios žinios.",
+  "com_ui_agent_handoff_info_2": "Kiekvienas perdavimas sukuria perdavimo įrankį, kuris leidžia sklandžiai nukreipti pokalbius į specializuotus agentus kartu su kontekstu.",
+  "com_ui_agent_handoff_max": "Pasiektas maksimalus {{0}} perdavimo agentų skaičius.",
+  "com_ui_agent_handoff_prompt": "Perduodamas turinys",
+  "com_ui_agent_handoff_prompt_key": "Turinio parametro pavadinimas (numatytasis: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Pažymėkite perduodamą turinį (numatytasis: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Nurodykite šiam agentui, kokį turinį generuoti ir perduoti perdavimo agentui. Norėdami įjungti šią funkciją, turite čia ką nors įvesti.",
+  "com_ui_agent_handoffs": "Agentų perdavimai",
+  "com_ui_agent_name": "Agento pavadinimas",
+  "com_ui_agent_name_is_required": "Agento pavadinimas yra būtinas",
+  "com_ui_agent_recursion_limit": "Maksimalus agento žingsnių skaičius",
+  "com_ui_agent_recursion_limit_info": "Riboja, kiek žingsnių agentas gali atlikti per vieną paleidimą prieš pateikdamas galutinį atsakymą. Numatytasis skaičius – 25 žingsniai. Žingsnis – tai AI API užklausa arba įrankio naudojimo etapas. Pavyzdžiui, paprastas sąveikos su įrankiu procesas užima 3 žingsnius: pradinė užklausa, įrankio naudojimas ir pakartotinė užklausa.",
+  "com_ui_agent_subagents": "Subagentai",
+  "com_ui_agent_subagents_add": "Pridėti subagentą",
+  "com_ui_agent_subagents_agents": "Papildomi subagentai",
+  "com_ui_agent_subagents_allow_self": "Leisti kurti savo kopijas",
+  "com_ui_agent_subagents_allow_self_info": "Leisti šiam agentui deleguoti konkrečias užduotis savo kopijai izoliuotame konteksto lange.",
+  "com_ui_agent_subagents_empty": "Nėra galimų subagentų: įgalinkite savęs kūrimą arba pridėkite bent vieną agentą.",
+  "com_ui_agent_subagents_enable": "Įgalinti subagentus",
+  "com_ui_agent_subagents_info": "Subagentai veikia izoliuotuose konteksto languose. Išsamus įrankių išvestis lieka vaikinio agento srityje; tik santrauka grąžinama šiam agentui.",
+  "com_ui_agent_subagents_info_2": "Įgalinus be nurodytų agentų vis tiek leidžiamas savęs kūrimas, todėl šis agentas gali perduoti susikoncentruotas užduotis naujam savo kopijai.",
+  "com_ui_agent_subagents_max": "Pasiektas maksimalus {{0}} subagentų skaičius.",
+  "com_ui_agent_subagents_remove": "Pašalinti {{0}} iš subagentų",
+  "com_ui_agent_url_copied": "Agento URL nukopijuotas į iškarpinę",
+  "com_ui_agent_var": "{{0}} agentas",
+  "com_ui_agent_version": "Versija",
+  "com_ui_agent_version_active": "Aktyvi versija",
+  "com_ui_agent_version_empty": "Nėra galimų versijų",
+  "com_ui_agent_version_error": "Klaida gaunant versijas",
+  "com_ui_agent_version_history": "Versijų istorija",
+  "com_ui_agent_version_no_agent": "Nepasirinktas joks agentas. Pasirinkite agentą, kad peržiūrėtumėte versijų istoriją.",
+  "com_ui_agent_version_no_date": "Data nepasiekiama",
+  "com_ui_agent_version_restore": "Atkurti",
+  "com_ui_agent_version_restore_confirm": "Ar tikrai norite atkurti šią versiją?",
+  "com_ui_agent_version_restore_error": "Nepavyko atkurti versijos",
+  "com_ui_agent_version_restore_success": "Versija sėkmingai atkurta",
+  "com_ui_agent_version_title": "Versija {{versionNumber}}",
+  "com_ui_agent_version_unknown_date": "Nežinoma data",
+  "com_ui_agents": "Agentai",
+  "com_ui_agents_allow_create": "Leisti kurti agentus",
+  "com_ui_agents_allow_share": "Leisti dalytis agentais",
+  "com_ui_agents_allow_share_public": "Leisti viešai dalytis agentais",
+  "com_ui_agents_allow_use": "Leisti naudoti agentus",
+  "com_ui_all": "visi",
+  "com_ui_all_projects": "Visi projektai",
+  "com_ui_all_proper": "Visi",
+  "com_ui_analyzing": "Analizuojama",
+  "com_ui_analyzing_finished": "Analizė baigta",
+  "com_ui_api_key": "API raktas",
+  "com_ui_api_key_create_error": "Nepavyko sukurti API rakto",
+  "com_ui_api_key_created": "API raktas sėkmingai sukurtas",
+  "com_ui_api_key_delete_confirm": "Ištrinti „{{0}}\"? Šio veiksmo negalima atšaukti.",
+  "com_ui_api_key_delete_error": "Nepavyko ištrinti API rakto",
+  "com_ui_api_key_delete_name": "Ištrinti API raktą {{0}}",
+  "com_ui_api_key_delete_warning": "Programos, naudojančios šį raktą, iš karto praras prieigą.",
+  "com_ui_api_key_deleted": "API raktas sėkmingai ištrintas",
+  "com_ui_api_key_expiration": "Galiojimo laikas",
+  "com_ui_api_key_expire_1y": "1 metai",
+  "com_ui_api_key_expire_30d": "30 dienų",
+  "com_ui_api_key_expire_7d": "7 dienos",
+  "com_ui_api_key_expire_90d": "90 dienų",
+  "com_ui_api_key_expire_never": "Niekada",
+  "com_ui_api_key_expired": "Pasibaigė",
+  "com_ui_api_key_expires_in_day": "Baigiasi po 1 dienos",
+  "com_ui_api_key_expires_in_days": "Baigiasi po {{0}} dienų",
+  "com_ui_api_key_expires_on": "Baigiasi {{0}}",
+  "com_ui_api_key_last_used": "Paskutinį kartą naudota {{0}}",
+  "com_ui_api_key_name": "Rakto pavadinimas",
+  "com_ui_api_key_name_placeholder": "Mano API raktas",
+  "com_ui_api_key_name_required": "API rakto pavadinimas yra privalomas",
+  "com_ui_api_key_never_used": "Nenaudota",
+  "com_ui_api_key_no_expiration": "Be galiojimo laiko",
+  "com_ui_api_key_warning": "Būtinai nukopijuokite savo API raktą dabar. Vėliau jo nebegalėsite matyti!",
+  "com_ui_api_keys_description": "API raktai leidžia išorinėms programoms ir įrankiams paleisti jūsų agentus per LibreChat OpenAI suderinamą API. Elkitės su kiekvienu iš jų kaip su slaptažodžiu: kas jį turi, gali veikti jūsų vardu, todėl panaikinkite raktus, kurių nebenaudo jate.",
+  "com_ui_api_keys_empty_text": "API raktai leidžia išorinėms programoms paleisti jūsų agentus per OpenAI suderinamą API. Sukurkite raktą, kad pradėtumėte.",
+  "com_ui_api_keys_empty_title": "Sujunkite agentus su išorinėmis programomis",
+  "com_ui_api_keys_load_error": "Nepavyko įkelti API raktų",
+  "com_ui_archive": "Archyvuoti",
+  "com_ui_archive_delete_error": "Nepavyko ištrinti archyvuoto pokalbio",
+  "com_ui_archive_error": "Nepavyko archyvuoti pokalbio",
+  "com_ui_artifact_click": "Spustelėkite, kad atidarytumėte",
+  "com_ui_artifact_preview_pending": "_Peržiūra dar nepasiekiama — spustelėkite **Atsisiųsti**, kad peržiūrėtumėte failą._",
+  "com_ui_artifacts": "Artefaktai",
+  "com_ui_artifacts_options": "Artefaktų parinktys",
+  "com_ui_artifacts_toggle": "Perjungti artefaktų sąsają",
+  "com_ui_artifacts_toggle_agent": "Įjungti artefaktus",
+  "com_ui_ascending": "Didėjančia tvarka",
+  "com_ui_assistant": "Asistentas",
+  "com_ui_assistant_delete_error": "Įvyko klaida trinant asistentą",
+  "com_ui_assistant_deleted": "Asistentas sėkmingai ištrintas",
+  "com_ui_assistants": "Asistentai",
+  "com_ui_assistants_output": "Asistentų išvestis",
+  "com_ui_at_least_one_owner_required": "Reikalingas bent vienas savininkas",
+  "com_ui_attach_error": "Nepavyko pridėti failo. Sukurkite arba pasirinkite pokalbį arba pabandykite atnaujinti puslapį.",
+  "com_ui_attach_error_disabled": "Failų įkėlimas šiam galiniam taškui išjungtas",
+  "com_ui_attach_error_limit": "Pasiektas failų limitas:",
+  "com_ui_attach_error_openai": "Negalima pridėti asistento failų prie kitų galinių taškų",
+  "com_ui_attach_error_size": "Failo dydžio riba viršyta galutiniam taškui:",
+  "com_ui_attach_error_total_size": "Bendro failo dydžio riba viršyta galutiniam taškui:",
+  "com_ui_attach_error_type": "Nepalaikomas failo tipas galutiniam taškui:",
+  "com_ui_attach_remove": "Pašalinti failą",
+  "com_ui_attach_warn_endpoint": "Ne asistento failai gali būti ignoruojami be suderinamo įrankio",
+  "com_ui_attachment": "Priedas",
+  "com_ui_auth_type": "Autentifikavimo tipas",
+  "com_ui_auth_url": "Autorizacijos URL",
+  "com_ui_authenticate": "Autentifikuoti",
+  "com_ui_authentication": "Autentifikavimas",
+  "com_ui_authentication_type": "Autentifikavimo tipas",
+  "com_ui_auto": "Automatinis",
+  "com_ui_available_options": "Galimi pasirinkimai",
+  "com_ui_avatar": "Avataras",
+  "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
+  "com_ui_back": "Atgal",
+  "com_ui_back_to_builder": "Grįžti į kūrimo priemonę",
+  "com_ui_back_to_prompts": "Grįžti į raginimus",
+  "com_ui_backup_code_number": "Kodas #{{number}}",
+  "com_ui_backup_codes": "Atsarginiai kodai",
+  "com_ui_backup_codes_regenerate_error": "Įvyko klaida regeneruojant atsarginius kodus",
+  "com_ui_backup_codes_regenerated": "Atsarginiai kodai sėkmingai regeneruoti",
+  "com_ui_backup_codes_security_info": "Dėl saugumo priežasčių atsarginiai kodai rodomi tik vieną kartą juos sugeneravus. Išsaugokite juos saugioje vietoje.",
+  "com_ui_backup_codes_status": "Atsarginių kodų būsena",
+  "com_ui_basic": "Pagrindinis",
+  "com_ui_basic_auth_header": "Pagrindinio autorizavimo antraštė",
+  "com_ui_bearer": "Bearer",
+  "com_ui_beta": "Beta",
+  "com_ui_bookmark_delete_confirm": "Ar tikrai norite ištrinti šią žymelę?",
+  "com_ui_bookmarks": "Žymelės",
+  "com_ui_bookmarks_add": "Pridėti žymeles",
+  "com_ui_bookmarks_add_to_conversation": "Pridėti prie esamo pokalbio",
+  "com_ui_bookmarks_count_selected": "Žymelės, pasirinkta: {{count}}",
+  "com_ui_bookmarks_create_error": "Įvyko klaida kuriant žymelę",
+  "com_ui_bookmarks_create_exists": "Ši žymelė jau egzistuoja",
+  "com_ui_bookmarks_create_success": "Žymelė sėkmingai sukurta",
+  "com_ui_bookmarks_delete": "Ištrinti žymelę",
+  "com_ui_bookmarks_delete_error": "Įvyko klaida ištrinant žymelę",
+  "com_ui_bookmarks_delete_success": "Žymė sėkmingai ištrinta",
+  "com_ui_bookmarks_description": "Aprašymas",
+  "com_ui_bookmarks_edit": "Redaguoti žymę",
+  "com_ui_bookmarks_filter": "Filtruoti žymes...",
+  "com_ui_bookmarks_new": "Nauja žymė",
+  "com_ui_bookmarks_tag_exists": "Žymė su tokiu pavadinimu jau egzistuoja",
+  "com_ui_bookmarks_title": "Pavadinimas",
+  "com_ui_bookmarks_update_error": "Įvyko klaida atnaujinant žymę",
+  "com_ui_bookmarks_update_success": "Žymė sėkmingai atnaujinta",
+  "com_ui_branch_created": "Šaka sėkmingai sukurta",
+  "com_ui_branch_error": "Nepavyko sukurti šakos",
+  "com_ui_branch_message": "Sukurti šaką iš šio atsakymo",
+  "com_ui_by_author": "autorius: {{0}}",
+  "com_ui_cache_read": "Talpyklos skaitymas",
+  "com_ui_cache_write": "Talpyklos rašymas",
+  "com_ui_callback_url": "Atgalinio skambučio URL",
+  "com_ui_cancel": "Atšaukti",
+  "com_ui_cancelled": "Atšaukta",
+  "com_ui_category": "Kategorija",
+  "com_ui_change_project": "Keisti projektą",
+  "com_ui_change_version": "Keisti versiją",
+  "com_ui_chat": "Pokalbis",
+  "com_ui_chat_history": "Pokalbių istorija",
+  "com_ui_chats": "Pokalbiai",
+  "com_ui_check_internet": "Patikrinkite interneto ryšį",
+  "com_ui_clear": "Išvalyti",
+  "com_ui_clear_all": "Išvalyti viską",
+  "com_ui_clear_browser_cache": "Išvalykite naršyklės talpyklą",
+  "com_ui_clear_presets": "Išvalyti išankstinius nustatymus",
+  "com_ui_clear_search": "Išvalyti paiešką",
+  "com_ui_click_to_close": "Spustelėkite, kad uždarytumėte",
+  "com_ui_click_to_edit": "Spustelėkite, kad redaguotumėte",
+  "com_ui_click_to_view_var": "Spustelėkite, kad peržiūrėtumėte {{0}}",
+  "com_ui_client_id": "Kliento ID",
+  "com_ui_client_secret": "Kliento slaptasis raktas",
+  "com_ui_close": "Uždaryti",
+  "com_ui_close_menu": "Uždaryti meniu",
+  "com_ui_close_settings": "Uždaryti nustatymus",
+  "com_ui_close_var": "Uždaryti {{0}}",
+  "com_ui_close_window": "Uždaryti langą",
+  "com_ui_code": "Kodas",
+  "com_ui_collapse": "Sutraukti",
+  "com_ui_collapse_chat": "Sutraukti pokalbį",
+  "com_ui_collapse_summary": "Sutraukti santrauką",
+  "com_ui_collapse_thoughts": "Sutraukti mintis",
+  "com_ui_command_finished": "Vykdymas baigtas",
+  "com_ui_command_placeholder": "Neprivaloma: įveskite komandą – jei nenurodyta, bus naudojamas pavadinimas",
+  "com_ui_command_usage_placeholder": "Pasirinkite raginimą pagal komandą arba pavadinimą",
+  "com_ui_complete": "Atlikta!",
+  "com_ui_complete_setup": "Užbaigti sąranką",
+  "com_ui_concise": "Glaustai",
+  "com_ui_configure": "Konfigūruoti",
+  "com_ui_configure_mcp_variables_for": "Konfigūruoti kintamuosius: {{0}}",
+  "com_ui_confirm": "Patvirtinti",
+  "com_ui_confirm_action": "Patvirtinti veiksmą",
+  "com_ui_confirm_admin_use_change": "Pakeitus šį nustatymą, administratoriai, įskaitant jus, praras prieigą. Ar tikrai norite tęsti?",
+  "com_ui_confirm_change": "Patvirtinti pakeitimą",
+  "com_ui_connecting": "Jungiamasi",
+  "com_ui_contact_admin_if_issue_persists": "Jei problema išlieka, susisiekite su administratoriumi",
+  "com_ui_context": "Kontekstas",
+  "com_ui_context_cost": "Kaina",
+  "com_ui_context_cost_branch": "Kaina (šioje šakoje)",
+  "com_ui_context_cost_total": "Visos šakos",
+  "com_ui_context_filter_sort": "Filtruoti ir rūšiuoti pagal kontekstą",
+  "com_ui_context_free": "Laisva vieta",
+  "com_ui_context_messages": "Žinutės",
+  "com_ui_context_subagents": "Subagentai",
+  "com_ui_context_summary": "Santrauka",
+  "com_ui_context_system": "Sistemos raginimas",
+  "com_ui_context_tools": "Įrankių schemos",
+  "com_ui_context_tools_mcp": "MCP įrankiai",
+  "com_ui_context_tools_mcp_deferred": "MCP įrankiai (atidėti)",
+  "com_ui_context_tools_system": "Sistemos įrankiai",
+  "com_ui_context_tools_system_deferred": "Sistemos įrankiai (atidėti)",
+  "com_ui_context_unknown": "Konteksto dydis nežinomas",
+  "com_ui_context_usage": "Konteksto naudojimas",
+  "com_ui_context_usage_label": "Konteksto langas: naudojama {{0}} iš {{1}} ženklų ({{2}}%)",
+  "com_ui_context_usage_label_unknown": "Konteksto naudojimas: naudojama {{0}} ženklų",
+  "com_ui_context_usage_snapshot": "Kontekstas {{0}} / {{1}} ({{2}}%)",
+  "com_ui_context_usage_snapshot_unknown": "Kontekstas {{0}}",
+  "com_ui_context_window": "Konteksto langas",
+  "com_ui_continue": "Tęsti",
+  "com_ui_continue_oauth": "Tęsti su OAuth",
+  "com_ui_control_bar": "Valdymo juosta",
+  "com_ui_conversation": "pokalbis",
+  "com_ui_conversation_label": "{{title}} pokalbis",
+  "com_ui_conversation_not_found": "Pokalbis nerastas",
+  "com_ui_conversation_summarized": "Pokalbis apibendrinta",
+  "com_ui_conversations": "pokalbiai",
+  "com_ui_convo_archived": "Pokalbis suarchyvuotas",
+  "com_ui_convo_delete_error": "Nepavyko ištrinti pokalbio",
+  "com_ui_convo_delete_success": "Pokalbis sėkmingai ištrintas",
+  "com_ui_copied": "Nukopijuota!",
+  "com_ui_copied_to_clipboard": "Nukopijuota į iškarpinę",
+  "com_ui_copy": "Kopijuoti",
+  "com_ui_copy_code": "Kopijuoti kodą",
+  "com_ui_copy_failed": "Nepavyko nukopijuoti į iškarpinę",
+  "com_ui_copy_link": "Kopijuoti nuorodą",
+  "com_ui_copy_stack_trace": "Kopijuoti paklaidos sekimą",
+  "com_ui_copy_summary": "Kopijuoti santrauką į iškarpinę",
+  "com_ui_copy_thoughts_to_clipboard": "Kopijuoti mintis į iškarpinę",
+  "com_ui_copy_to_clipboard": "Kopijuoti į iškarpinę",
+  "com_ui_copy_url_to_clipboard": "Kopijuoti URL į iškarpinę",
+  "com_ui_create": "Kurti",
+  "com_ui_create_api_key": "Kurti API raktą",
+  "com_ui_create_assistant": "Kurti asistentą",
+  "com_ui_create_link": "Kurti nuorodą",
+  "com_ui_create_mcp_server": "Kurti MCP serverį",
+  "com_ui_create_memory": "Kurti atmintį",
+  "com_ui_create_new_agent": "Kurti naują agentą",
+  "com_ui_create_project": "Kurti projektą",
+  "com_ui_create_prompt": "Kurti užklausą",
+  "com_ui_create_prompt_page": "Naujos užklausos konfigūracijos puslapis",
+  "com_ui_create_skill": "Kurti įgūdį",
+  "com_ui_create_skill_upload": "Įkelti SKILL.md",
+  "com_ui_create_skill_upload_error": "Nepavyko perskaityti įkelto failo",
+  "com_ui_created": "Sukurta",
+  "com_ui_created_file": "Sukurta {{0}}",
+  "com_ui_creating": "Kuriama...",
+  "com_ui_creating_file": "Kuriama {{0}}",
+  "com_ui_creating_image": "Kuriamas vaizdas. Tai gali užtrukti",
+  "com_ui_current": "Dabartinis",
+  "com_ui_currently_production": "Šiuo metu gamyboje",
+  "com_ui_custom": "Pasirinktinis",
+  "com_ui_custom_header_name": "Pasirinktinis antraštės pavadinimas",
+  "com_ui_custom_prompt_mode": "Pasirinktinis raginimo režimas",
+  "com_ui_dark_theme_enabled": "Įjungta tamsioji tema",
+  "com_ui_date": "Data",
+  "com_ui_date_april": "Balandis",
+  "com_ui_date_august": "Rugpjūtis",
+  "com_ui_date_december": "Gruodis",
+  "com_ui_date_february": "Vasaris",
+  "com_ui_date_january": "Sausis",
+  "com_ui_date_july": "Liepa",
+  "com_ui_date_june": "Birželis",
+  "com_ui_date_march": "Kovas",
+  "com_ui_date_may": "Gegužė",
+  "com_ui_date_november": "Lapkritis",
+  "com_ui_date_october": "Spalis",
+  "com_ui_date_previous_30_days": "Paskutinės 30 dienų",
+  "com_ui_date_previous_7_days": "Paskutinės 7 dienos",
+  "com_ui_date_september": "Rugsėjis",
+  "com_ui_date_sort": "Rikiuoti pagal datą",
+  "com_ui_date_today": "Šiandien",
+  "com_ui_date_yesterday": "Vakar",
+  "com_ui_decline": "Nesutinku",
+  "com_ui_default_post_request": "Numatytasis (POST užklausa)",
+  "com_ui_delete": "Ištrinti",
+  "com_ui_delete_action": "Ištrinti veiksmą",
+  "com_ui_delete_action_confirm": "Ar tikrai norite ištrinti šį veiksmą?",
+  "com_ui_delete_agent": "Ištrinti agentą",
+  "com_ui_delete_agent_confirm": "Ar tikrai norite ištrinti šį agentą?",
+  "com_ui_delete_api_key": "Ištrinti API raktą",
+  "com_ui_delete_assistant": "Ištrinti asistentą",
+  "com_ui_delete_assistant_confirm": "Ar tikrai norite ištrinti šį asistentą? Šio veiksmo negalima atšaukti.",
+  "com_ui_delete_confirm": "Tai ištrins",
+  "com_ui_delete_confirm_prompt_version_var": "Tai ištrins pasirinktą „{{0}}\" versiją. Jei kitų versijų nėra, raginimas bus ištrintas.",
+  "com_ui_delete_confirm_strong": "Tai ištrins <strong>{{title}}</strong>",
+  "com_ui_delete_conversation": "Ištrinti pokalbį?",
+  "com_ui_delete_conversation_tooltip": "Ištrinti pokalbį",
+  "com_ui_delete_mcp_server": "Ištrinti MCP serverį?",
+  "com_ui_delete_mcp_server_name": "Ištrinti MCP serverį {{0}}",
+  "com_ui_delete_memory": "Ištrinti atmintį",
+  "com_ui_delete_not_allowed": "Ištrinti operacijos neleidžiama",
+  "com_ui_delete_preset": "Ištrinti išankstinį nustatymą?",
+  "com_ui_delete_project": "Ištrinti projektą?",
+  "com_ui_delete_project_confirm": "Ištrinti „{{name}}\"? Pokalbiai viduje nebus ištrinti.",
+  "com_ui_delete_prompt": "Ištrinti raginimą?",
+  "com_ui_delete_shared_link": "Ištrinti bendrą nuorodą?",
+  "com_ui_delete_shared_link_heading": "Ištrinti bendrą nuorodą",
+  "com_ui_delete_success": "Sėkmingai ištrinta",
+  "com_ui_delete_tool": "Ištrinti įrankį",
+  "com_ui_delete_tool_confirm": "Ar tikrai norite ištrinti šį įrankį?",
+  "com_ui_delete_tool_save_reminder": "Įrankis pašalintas. Išsaugokite agentą, kad pritaikytumėte pakeitimus.",
+  "com_ui_deleted": "Ištrinta",
+  "com_ui_deleting": "Trinama...",
+  "com_ui_deleting_file": "Trinamas failas...",
+  "com_ui_deploy": "Įdiegti",
+  "com_ui_descending": "Aprašymas",
+  "com_ui_description": "Aprašymas",
+  "com_ui_description_placeholder": "Neprivaloma: įveskite aprašymą, kuris bus rodomas šiam raginimui",
+  "com_ui_deselect_all": "Panaikinti visų žymėjimą",
+  "com_ui_detailed": "Išsamus",
+  "com_ui_details": "Išsamiau",
+  "com_ui_disabling": "Išjungiama...",
+  "com_ui_done": "Atlikta",
+  "com_ui_download": "Atsisiųsti",
+  "com_ui_download_artifact": "Atsisiųsti artefaktą",
+  "com_ui_download_backup": "Atsisiųsti atsargines kodus",
+  "com_ui_download_backup_tooltip": "Prieš tęsdami, atsisiųskite savo atsarginius kodus. Jų prireiks, jei prarasite prieigą prie autentifikatoriaus įrenginio",
+  "com_ui_download_error": "Klaida atsisiunčiant failą. Failas gali būti ištrintas.",
+  "com_ui_download_error_logs": "Atsisiųsti klaidų žurnalus",
+  "com_ui_drag_drop": "Numeskite bet kokį failą čia, kad pridėtumėte jį prie pokalbio",
+  "com_ui_dropdown_variables": "Išskleidžiamojo sąrašo kintamieji:",
+  "com_ui_duplicate": "Dublikuoti",
+  "com_ui_duplicate_agent": "Dublikuoti agentą",
+  "com_ui_duplication_error": "Dublikuojant pokalbį įvyko klaida",
+  "com_ui_duplication_processing": "Dublikuojamas pokalbis...",
+  "com_ui_duplication_success": "Pokalbis sėkmingai dublikuotas",
+  "com_ui_edit": "Redaguoti",
+  "com_ui_edit_editing_image": "Redaguojamas vaizdas",
+  "com_ui_edit_mcp_server": "Redaguoti MCP serverį",
+  "com_ui_edit_mcp_server_dialog_description": "Unikalus serverio identifikatorius: {{serverName}}",
+  "com_ui_edit_memory": "Redaguoti atmintį",
+  "com_ui_edit_preset_title": "Redaguoti išankstinį nustatymą – {{title}}",
+  "com_ui_edit_prompt_page": "Redaguoti raginimo puslapį",
+  "com_ui_edit_skill": "Redaguoti įgūdį",
+  "com_ui_editable_message": "Redaguojama žinutė",
+  "com_ui_edited_file": "Redaguota {{0}}",
+  "com_ui_editing_file": "Redaguojama {{0}}",
+  "com_ui_editor_instructions": "Vilkite vaizdą, kad pakeistumėte padėtį • Naudokite mastelio slankiklį arba mygtukus dydžiui reguliuoti",
+  "com_ui_empty_category": "-",
+  "com_ui_endpoint": "Galinis taškas",
+  "com_ui_endpoint_menu": "LLM galinio taško meniu",
+  "com_ui_enter": "Įvesti",
+  "com_ui_enter_api_key": "Įvesti API raktą",
+  "com_ui_enter_description": "Įveskite aprašymą (neprivaloma)",
+  "com_ui_enter_key": "Įvesti raktą",
+  "com_ui_enter_name": "Įvesti pavadinimą",
+  "com_ui_enter_openapi_schema": "Įveskite savo OpenAPI schemą čia",
+  "com_ui_enter_value": "Įvesti reikšmę",
+  "com_ui_error": "Klaida",
+  "com_ui_error_connection": "Klaida jungiantis prie serverio, pabandykite atnaujinti puslapį.",
+  "com_ui_error_message_prefix": "Klaidos pranešimas:",
+  "com_ui_error_save_admin_settings": "Įvyko klaida išsaugant administratoriaus nustatymus.",
+  "com_ui_error_try_following_prefix": "Pabandykite vieną iš šių variantų",
+  "com_ui_error_unexpected": "Oj! Įvyko netikėta klaida",
+  "com_ui_error_updating_preferences": "Klaida atnaujinant nuostatas",
+  "com_ui_estimated": "Apskaičiuota pagal žinučių istoriją",
+  "com_ui_everyone_permission_level": "Visų leidimų lygis",
+  "com_ui_examples": "Pavyzdžiai",
+  "com_ui_expand": "Išplėsti",
+  "com_ui_expand_chat": "Išplėsti pokalbį",
+  "com_ui_expand_thoughts": "Išplėsti mintis",
+  "com_ui_export_convo_modal": "Pokalbio eksportavimo langas",
+  "com_ui_failed": "Nepavyko",
+  "com_ui_favorite": "Pridėti prie mėgstamiausių",
+  "com_ui_favorites": "Mėgstamiausi",
+  "com_ui_feedback_more": "Daugiau...",
+  "com_ui_feedback_more_information": "Pateikti papildomą atsiliepimą",
+  "com_ui_feedback_negative": "Reikia tobulinti",
+  "com_ui_feedback_placeholder": "Pateikite papildomų atsiliepimų čia",
+  "com_ui_feedback_positive": "Patinka",
+  "com_ui_feedback_tag_accurate_reliable": "Tikslus ir patikimas",
+  "com_ui_feedback_tag_attention_to_detail": "Dėmesys detalėms",
+  "com_ui_feedback_tag_bad_style": "Blogas stilius arba tonas",
+  "com_ui_feedback_tag_clear_well_written": "Aiškus ir gerai parašytas",
+  "com_ui_feedback_tag_creative_solution": "Kūrybiškas sprendimas",
+  "com_ui_feedback_tag_few": "Keli",
+  "com_ui_feedback_tag_inaccurate": "Netikslus arba klaidingas atsakymas",
+  "com_ui_feedback_tag_many": "Keletas",
+  "com_ui_feedback_tag_missing_image": "Tikėtasi vaizdo",
+  "com_ui_feedback_tag_not_helpful": "Trūko naudingos informacijos",
+  "com_ui_feedback_tag_not_matched": "Neatitiko mano užklausos",
+  "com_ui_feedback_tag_one": "Vienas",
+  "com_ui_feedback_tag_other": "Kita problema",
+  "com_ui_feedback_tag_unjustified_refusal": "Atsisakė be priežasties",
+  "com_ui_field_max_length": "{{field}} turi būti trumpesnis nei {{length}} simbolių",
+  "com_ui_field_required": "Šis laukas yra privalomas",
+  "com_ui_file": "Failas",
+  "com_ui_file_input_avatar_label": "Failo įvestis avatarui",
+  "com_ui_file_modified": "Pakeista",
+  "com_ui_file_size": "Failo dydis",
+  "com_ui_file_token_limit": "Failo prieigos raktų limitas",
+  "com_ui_file_token_limit_desc": "Nustatykite maksimalų prieigos raktų limitą failų apdorojimui, kad kontroliuotumėte išlaidas ir išteklių naudojimą",
+  "com_ui_files": "Failai",
+  "com_ui_files_count_size": "{{0}} failai ({{1}}KB)",
+  "com_ui_filter_mcp_servers": "Filtruoti MCP serverius pagal pavadinimą",
+  "com_ui_filter_prompts": "Filtruoti raginimus",
+  "com_ui_filter_prompts_name": "Filtruoti raginimus pagal pavadinimą",
+  "com_ui_filter_skills_name": "Filtruoti įgūdžius pagal pavadinimą",
+  "com_ui_final_touch": "Paskutinis prisilietimas",
+  "com_ui_finance": "Finansai",
+  "com_ui_fork": "Šaka",
+  "com_ui_fork_all_target": "Įtraukti viską iki/nuo čia",
+  "com_ui_fork_branches": "Įtraukti susijusias šakas",
+  "com_ui_fork_change_default": "Numatytoji šakojimo parinktis",
+  "com_ui_fork_default": "Naudoti numatytąją šakojimo parinktį",
+  "com_ui_fork_error": "Šakojant pokalbį įvyko klaida",
+  "com_ui_fork_error_rate_limit": "Per daug šakojimo užklausų. Bandykite dar kartą vėliau",
+  "com_ui_fork_from_message": "Pasirinkite šakojimo parinktį",
+  "com_ui_fork_info_1": "Naudokite šį nustatymą, kad šakotumėte žinutes su norima elgsena.",
+  "com_ui_fork_info_2": "„Šakojimas\" reiškia naujo pokalbio kūrimą, kuris prasideda/baigiasi nuo konkrečių žinučių esamame pokalbyje, sukuriant kopiją pagal pasirinktas parinktis.",
+  "com_ui_fork_info_3": "„Tikslinė žinutė\" reiškia arba žinutę, iš kurios buvo atidarytas šis iššokantis langas, arba, jei pažymėsite „{{0}}\", paskutinę pokalbio žinutę.",
+  "com_ui_fork_info_branches": "Ši parinktis išskaido matomus pranešimus kartu su susijusiomis šakomis; kitaip tariant, tiesioginį kelią iki tikslinio pranešimo, įskaitant šakas palei kelią.",
+  "com_ui_fork_info_button_label": "Peržiūrėti informaciją apie pokalbių išsišakojimą",
+  "com_ui_fork_info_remember": "Pažymėkite, kad išsaugotumėte pasirinktas parinktis būsimam naudojimui, kad pokalbių išsišakojimas būtų greitesnis pagal pageidavimą.",
+  "com_ui_fork_info_start": "Jei pažymėta, išsišakojimas prasidės nuo šio pranešimo iki paskutinio pokalbio pranešimo pagal aukščiau pasirinktą veikseną.",
+  "com_ui_fork_info_target": "Ši parinktis išskaido visus pranešimus iki tikslinio pranešimo, įskaitant jo kaimyninius; kitaip tariant, įtraukiamos visos pranešimų šakos, nepriklausomai nuo to, ar jos matomos, ar eina tuo pačiu keliu.",
+  "com_ui_fork_info_visible": "Ši parinktis išskaido tik matomus pranešimus; kitaip tariant, tiesioginį kelią iki tikslinio pranešimo be jokių šakų.",
+  "com_ui_fork_more_details_about": "Peržiūrėti papildomą informaciją ir išsamią informaciją apie išsišakojimo parinktį „{{0}}\"",
+  "com_ui_fork_more_info_options": "Peržiūrėti išsamų visų išsišakojimo parinkčių ir jų veiksenų paaiškinimą",
+  "com_ui_fork_open_menu": "Atidaryti išsišakojimo meniu",
+  "com_ui_fork_processing": "Pokalbis išsišakojamas...",
+  "com_ui_fork_remember": "Prisiminti",
+  "com_ui_fork_remember_checked": "Jūsų pasirinkimas bus išsaugotas po naudojimo. Tai galite pakeisti bet kada nustatymuose.",
+  "com_ui_fork_split_target": "Pradėti išsišakojimą čia",
+  "com_ui_fork_split_target_setting": "Pradėti išsišakojimą nuo tikslinio pranešimo pagal numatytuosius nustatymus",
+  "com_ui_fork_success": "Pokalbis sėkmingai išsišakojo",
+  "com_ui_fork_visible": "Tik matomi pranešimai",
+  "com_ui_generate_qrcode": "Generuoti QR kodą",
+  "com_ui_generating": "Generuojama...",
+  "com_ui_generating_image": "Vaizdas generuojamas...",
+  "com_ui_generation_settings": "Generavimo nustatymai",
+  "com_ui_getting_started": "Pradžia",
+  "com_ui_go_back": "Grįžti atgal",
+  "com_ui_go_to_conversation": "Eiti į pokalbį",
+  "com_ui_good_afternoon": "Laba diena",
+  "com_ui_good_evening": "Labas vakaras",
+  "com_ui_good_morning": "Labas rytas",
+  "com_ui_group": "Grupė",
+  "com_ui_handoff_instructions": "Perdavimo instrukcijos",
+  "com_ui_happy_birthday": "Man sukanka 1-eri metai!",
+  "com_ui_header_format": "Antraštės formatas",
+  "com_ui_hide": "Slėpti",
+  "com_ui_hide_code": "Slėpti kodą",
+  "com_ui_hide_image_details": "Slėpti vaizdo informaciją",
+  "com_ui_hide_n_files": "Slėpti {{0}} failus",
+  "com_ui_hide_qr": "Slėpti QR kodą",
+  "com_ui_high": "Aukštas",
+  "com_ui_host": "Serveris",
+  "com_ui_icon": "Piktograma",
+  "com_ui_idea": "Idėjos",
+  "com_ui_image_created": "Vaizdas sukurtas",
+  "com_ui_image_details": "Vaizdo informacija",
+  "com_ui_image_edited": "Vaizdas redaguotas",
+  "com_ui_image_gen": "Vaizdų generavimas",
+  "com_ui_image_gen_failed": "Vaizdo generavimas nepavyko",
+  "com_ui_import": "Importuoti",
+  "com_ui_import_conversation_error": "Importuojant pokalbius įvyko klaida",
+  "com_ui_import_conversation_file_type_error": "Nepalaikomas importavimo tipas",
+  "com_ui_import_conversation_info": "Importuoti pokalbius iš JSON failo",
+  "com_ui_import_conversation_success": "Pokalbiai sėkmingai importuoti",
+  "com_ui_import_conversation_upload_error": "Klaida įkeliant failą. Bandykite dar kartą.",
+  "com_ui_importing": "Importuojama",
+  "com_ui_include_shadcnui": "Įtraukti shadcn/ui komponentų instrukcijas",
+  "com_ui_initializing": "Inicializuojama...",
+  "com_ui_input": "Įvestis",
+  "com_ui_instructions": "Instrukcijos",
+  "com_ui_invocation_auto": "Automatinis",
+  "com_ui_invocation_auto_info": "Įgūdis automatiškai taikomas agento, kai aktualus pokalbiui",
+  "com_ui_invocation_both": "Abu",
+  "com_ui_invocation_both_info": "Įgūdis gali būti suaktyvintas automatiškai arba rankiniu būdu vartotojo",
+  "com_ui_invocation_manual": "Rankinis",
+  "com_ui_invocation_manual_info": "Įgūdis naudojamas tik tada, kai vartotojas jį tiesiogiai iškviečia",
+  "com_ui_invocation_mode": "Iškvietimo režimas",
+  "com_ui_invoked_by": "Iškviečia",
+  "com_ui_key": "Raktas",
+  "com_ui_key_required": "API raktas yra būtinas",
+  "com_ui_labels": "Etiketės",
+  "com_ui_late_night": "Geros vėlyvos nakties",
+  "com_ui_latest": "naujausia",
+  "com_ui_latest_activity": "Paskutinis aktyvumas",
+  "com_ui_latest_footer": "Kiekvienas AI kiekvienam.",
+  "com_ui_latest_version": "Naujausia versija",
+  "com_ui_leave_blank_to_keep": "Palikite tuščią, kad išlaikytumėte esamą",
+  "com_ui_light_theme_enabled": "Šviesi tema įjungta",
+  "com_ui_line_count": "{0} eilutė",
+  "com_ui_lines_count": "{0} eilutės",
+  "com_ui_link_copied": "Nuoroda nukopijuota",
+  "com_ui_link_refreshed": "Nuoroda atnaujinta",
+  "com_ui_live": "tiesiogiai",
+  "com_ui_load_more": "Įkelti daugiau",
+  "com_ui_loading": "Įkeliama...",
+  "com_ui_locked": "Užrakinta",
+  "com_ui_logo": "{{0}} logotipas",
+  "com_ui_low": "Žemas",
+  "com_ui_make_production": "Padaryti gamybiniu",
+  "com_ui_manage": "Tvarkyti",
+  "com_ui_marketplace": "Rinka",
+  "com_ui_marketplace_allow_use": "Leisti naudoti rinką",
+  "com_ui_max": "Maks.",
+  "com_ui_max_favorites_reached": "Pasiektas maksimalus prisegamų elementų skaičius ({{0}}). Atsegkite elementą, kad galėtumėte pridėti daugiau.",
+  "com_ui_max_file_size": "PNG, JPG arba JPEG (maks. {{0}})",
+  "com_ui_max_tags": "Didžiausias leidžiamas skaičius yra {{0}}, naudojamos naujausios reikšmės.",
+  "com_ui_mcp_authenticated_success": "MCP serveris „{{0}}\" sėkmingai autentifikuotas",
+  "com_ui_mcp_click_to_defer": "Spustelėkite, kad atidėtumėte – įrankis bus aptinkamas per paiešką, bet nebus įkeltas, kol neprireiks",
+  "com_ui_mcp_click_to_programmatic": "Įjungti programinį iškvietimą – įrankį galima iškviesti tik vykdant kodą",
+  "com_ui_mcp_configure_server": "Konfigūruoti {{0}}",
+  "com_ui_mcp_configure_server_description": "Konfigūruoti pasirinktinius kintamuosius, skirtus {{0}}",
+  "com_ui_mcp_defer": "Atidėti",
+  "com_ui_mcp_defer_all": "Atidėti visus įrankius",
+  "com_ui_mcp_defer_loading": "Atidėti įkėlimą",
+  "com_ui_mcp_dialog_title": "Konfigūruoti kintamuosius, skirtus {{serverName}}. Serverio būsena: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "MCP serverio domenas nėra leidžiamų domenų sąraše. Susisiekite su administratoriumi.",
+  "com_ui_mcp_enter_var": "Įveskite reikšmę {{0}}",
+  "com_ui_mcp_init_failed": "Nepavyko inicializuoti MCP serverio",
+  "com_ui_mcp_initialize": "Inicializuoti",
+  "com_ui_mcp_initialized_success": "MCP serveris „{{0}}\" sėkmingai inicializuotas",
+  "com_ui_mcp_invalid_url": "Įveskite tinkamą URL",
+  "com_ui_mcp_no_description": "Aprašymas nepateiktas",
+  "com_ui_mcp_oauth_cancelled": "OAuth prisijungimas atšauktas: {{0}}",
+  "com_ui_mcp_oauth_timeout": "OAuth prisijungimo laikas baigėsi: {{0}}",
+  "com_ui_mcp_programmatic": "Programinis",
+  "com_ui_mcp_programmatic_all": "Pažymėti visus kaip programinius",
+  "com_ui_mcp_server": "MCP serveris",
+  "com_ui_mcp_server_connection_failed": "Nepavyko prisijungti prie nurodyto MCP serverio. Įsitikinkite, kad URL, serverio tipas ir autentifikavimo konfigūracija yra teisingi, ir bandykite dar kartą. Taip pat patikrinkite, ar URL yra pasiekiamas.",
+  "com_ui_mcp_server_created": "MCP serveris sėkmingai sukurtas",
+  "com_ui_mcp_server_delete_confirm": "Ar tikrai norite ištrinti šį MCP serverį?",
+  "com_ui_mcp_server_deleted": "MCP serveris sėkmingai ištrintas",
+  "com_ui_mcp_server_role_editor": "MCP serverio redaktorius",
+  "com_ui_mcp_server_role_editor_desc": "Gali peržiūrėti, naudoti ir redaguoti MCP serverius",
+  "com_ui_mcp_server_role_owner": "MCP serverio savininkas",
+  "com_ui_mcp_server_role_owner_desc": "Visiškas valdymas MCP serverių",
+  "com_ui_mcp_server_role_viewer": "MCP serverio peržiūrėtojas",
+  "com_ui_mcp_server_role_viewer_desc": "Gali peržiūrėti ir naudoti MCP serverius",
+  "com_ui_mcp_server_updated": "MCP serveris sėkmingai atnaujintas",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
+  "com_ui_mcp_servers": "MCP serveriai",
+  "com_ui_mcp_servers_allow_configure_obo": "Leisti vartotojams konfigūruoti „On-Behalf-Of\" (OBO) MCP serveriuose",
+  "com_ui_mcp_servers_allow_create": "Leisti vartotojams kurti MCP serverius",
+  "com_ui_mcp_servers_allow_share": "Leisti vartotojams bendrinti MCP serverius",
+  "com_ui_mcp_servers_allow_share_public": "Leisti vartotojams viešai bendrinti MCP serverius",
+  "com_ui_mcp_servers_allow_use": "Leisti vartotojams naudoti MCP serverius",
+  "com_ui_mcp_title_invalid": "Pavadinime gali būti tik raidės, skaičiai ir tarpai",
+  "com_ui_mcp_tool_options": "Įrankio parinktys",
+  "com_ui_mcp_transport": "Transportas",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "Srautinis HTTPS",
+  "com_ui_mcp_undefer": "Atšaukti atidėjimą",
+  "com_ui_mcp_undefer_all": "Atšaukti visų įrankių atidėjimą",
+  "com_ui_mcp_unprogrammatic_all": "Pažymėti visus kaip neprograminius",
+  "com_ui_mcp_update_var": "Atnaujinti {{0}}",
+  "com_ui_mcp_url": "MCP serverio URL",
+  "com_ui_medium": "Vidutinis",
+  "com_ui_memories": "Prisiminimai",
+  "com_ui_memories_allow_create": "Leisti kurti prisiminimus",
+  "com_ui_memories_allow_opt_out": "Leisti vartotojams atsisakyti atminčių",
+  "com_ui_memories_allow_read": "Leisti skaityti atmintis",
+  "com_ui_memories_allow_update": "Leisti atnaujinti atmintis",
+  "com_ui_memories_allow_use": "Leisti naudoti atmintis",
+  "com_ui_memories_filter": "Filtruoti atmintis...",
+  "com_ui_memory": "Atmintis",
+  "com_ui_memory_already_exceeded": "Atminties saugykla jau pilna – viršyta {{tokens}} žetonų. Prieš pridedant naujų, ištrinkite esamus prisiminimus.",
+  "com_ui_memory_created": "Prisiminimas sėkmingai sukurtas",
+  "com_ui_memory_deleted": "Prisiminimas ištrintas",
+  "com_ui_memory_deleted_items": "Ištrinti prisiminimai",
+  "com_ui_memory_error": "Atminties klaida",
+  "com_ui_memory_key_exists": "Prisiminimas su šiuo raktu jau egzistuoja. Naudokite kitą raktą.",
+  "com_ui_memory_key_hint": "Naudokite tik mažąsias raides ir pabraukimo simbolius",
+  "com_ui_memory_key_validation": "Atminties raktas gali būti sudarytas tik iš mažųjų raidžių ir pabraukimo simbolių.",
+  "com_ui_memory_storage_full": "Atminties saugykla pilna",
+  "com_ui_memory_updated": "Išsaugotas prisiminimas atnaujintas",
+  "com_ui_memory_updated_items": "Atnaujinti prisiminimai",
+  "com_ui_memory_would_exceed": "Nepavyksta išsaugoti – bus viršyta riba {{tokens}} žetonų. Ištrinkite esamus prisiminimus, kad atlaisvintumėte vietos.",
+  "com_ui_mention": "Paminėkite galinį punktą, asistentą ar išankstinį nustatymą, kad greitai perjungtumėte",
+  "com_ui_mermaid": "mermaid",
+  "com_ui_mermaid_failed": "Nepavyko atvaizduoti diagramos:",
+  "com_ui_mermaid_source": "Išeities kodas:",
+  "com_ui_message_input": "Žinutės įvestis",
+  "com_ui_message_nav": "Žinučių naršymas",
+  "com_ui_message_nav_go_to_assistant": "Eiti į asistento žinutę: {{0}}",
+  "com_ui_message_nav_go_to_user": "Eiti į vartotojo žinutę: {{0}}",
+  "com_ui_message_nav_next": "Eiti į kitą žinutę",
+  "com_ui_message_nav_previous": "Eiti į ankstesnę žinutę",
+  "com_ui_microphone_unavailable": "Mikrofonas nepasiekiamas",
+  "com_ui_min_tags": "Negalima pašalinti daugiau reikšmių, būtinas minimumas – {{0}}.",
+  "com_ui_minimal": "Minimalus",
+  "com_ui_misc": "Kita",
+  "com_ui_model": "Modelis",
+  "com_ui_model_parameters": "Modelio parametrai",
+  "com_ui_model_parameters_reset": "Modelio parametrai buvo atstatyti.",
+  "com_ui_model_selected": "{{0}} pasirinkta",
+  "com_ui_model_spec": "Modelio specifikacija",
+  "com_ui_more_count": "{{0}} daugiau",
+  "com_ui_more_info": "Daugiau informacijos",
+  "com_ui_more_options": "Daugiau parinkčių",
+  "com_ui_my_prompts": "Mano užklausos",
+  "com_ui_my_skills": "Mano įgūdžiai",
+  "com_ui_n_files": "{{0}} failų",
+  "com_ui_name": "Pavadinimas",
+  "com_ui_name_sort": "Rikiuoti pagal pavadinimą",
+  "com_ui_navigate_results": "Naršyti rezultatus",
+  "com_ui_new": "Naujas",
+  "com_ui_new_chat": "Naujas pokalbis",
+  "com_ui_new_chat_in_project": "Naujas pokalbis – {{name}}",
+  "com_ui_new_conversation_title": "Naujo pokalbio pavadinimas",
+  "com_ui_new_project": "Naujas projektas",
+  "com_ui_next": "Kitas",
+  "com_ui_next_result": "Kitas rezultatas",
+  "com_ui_no": "Ne",
+  "com_ui_no_auth": "Nėra (automatinis aptikimas)",
+  "com_ui_no_bookmarks": "Atrodo, kad dar neturite žymių. Spustelėkite pokalbį ir pridėkite naują",
+  "com_ui_no_bookmarks_match": "Nė viena žymė neatitinka jūsų paieškos",
+  "com_ui_no_bookmarks_title": "Dar nėra žymių",
+  "com_ui_no_categories": "Nėra galimų kategorijų",
+  "com_ui_no_category": "Nėra kategorijos",
+  "com_ui_no_changes": "Jokie pakeitimai nebuvo atlikti",
+  "com_ui_no_individual_access": "Nė vienas atskiras vartotojas ar grupė neturi prieigos prie šio agento",
+  "com_ui_no_labels": "Nėra etikečių",
+  "com_ui_no_mcp_servers": "Dar nėra MCP serverių",
+  "com_ui_no_mcp_servers_match": "Nė vienas MCP serveris neatitinka jūsų filtro",
+  "com_ui_no_memories": "Nėra atsiminimų. Sukurkite juos rankiniu būdu arba paprašykite AI ką nors įsiminti",
+  "com_ui_no_memories_match": "Nė vienas atsiminimas neatitinka jūsų paieškos",
+  "com_ui_no_memories_title": "Dar nėra atsiminimų",
+  "com_ui_no_project_chats": "Dar nėra pokalbių",
+  "com_ui_no_projects": "Dar nėra projektų",
+  "com_ui_no_prompts_title": "Dar nėra raginimų",
+  "com_ui_no_read_access": "Jūs neturite leidimo peržiūrėti atsiminimų",
+  "com_ui_no_results_found": "Rezultatų nerasta",
+  "com_ui_no_skills_found": "Įgūdžių nerasta",
+  "com_ui_no_terms_content": "Nėra taisyklių ir sąlygų turinio, kurį būtų galima rodyti",
+  "com_ui_none": "Nėra",
+  "com_ui_not_used": "Nenaudojama",
+  "com_ui_nothing_found": "Nieko nerasta",
+  "com_ui_oauth": "OAuth",
+  "com_ui_oauth_connected_to": "Prisijungta prie",
+  "com_ui_oauth_error_callback_failed": "Autentifikavimo atgalinio iškvietimo klaida. Bandykite dar kartą.",
+  "com_ui_oauth_error_generic": "Autentifikavimas nepavyko. Bandykite dar kartą.",
+  "com_ui_oauth_error_invalid_state": "Neteisingas būsenos parametras. Bandykite dar kartą.",
+  "com_ui_oauth_error_missing_code": "Trūksta autorizacijos kodo. Bandykite dar kartą.",
+  "com_ui_oauth_error_missing_state": "Trūksta būsenos parametro. Bandykite dar kartą.",
+  "com_ui_oauth_error_title": "Autentifikavimas nepavyko",
+  "com_ui_oauth_success_description": "Jūsų autentifikavimas sėkmingas. Šis langas užsidarys po",
+  "com_ui_oauth_success_title": "Autentifikavimas sėkmingas",
+  "com_ui_obo": "On-Behalf-Of (OBO)",
+  "com_ui_obo_readonly_no_permission": "OBO sukonfigūruotas šiam serveriui, tačiau jūsų vaidmuo nebeturi leidimo jo keisti. Kreipkitės į administratorių dėl pakeitimų.",
+  "com_ui_obo_scopes": "OBO apimtys",
+  "com_ui_obo_scopes_description": "Apimtys, kurių reikia prašyti tolesniam MCP serveriui per On-Behalf-Of srautą. Reikalingas OpenID Connect autentifikavimas (pvz., Entra ID).",
+  "com_ui_of": "iš",
+  "com_ui_off": "Išjungta",
+  "com_ui_offline": "Neprisijungęs",
+  "com_ui_omitted": "Praleista",
+  "com_ui_on": "Įjungta",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (atsidaro naujame skirtuke)",
+  "com_ui_open_project": "Atidaryti projektą",
+  "com_ui_open_source_chat_new_tab": "Atidaryti pokalbį naujame skirtuke",
+  "com_ui_open_source_chat_new_tab_title": "Atidaryti pokalbį naujame skirtuke – {{title}}",
+  "com_ui_open_var": "Atidaryti {{0}}",
+  "com_ui_openai": "OpenAI",
+  "com_ui_optional": "(neprivaloma)",
+  "com_ui_options": "parinktys",
+  "com_ui_output": "Išvestis",
+  "com_ui_page": "Puslapis",
+  "com_ui_pagination": "Puslapiavimas",
+  "com_ui_parameters": "Parametrai",
+  "com_ui_people": "žmonės",
+  "com_ui_people_picker": "Žmonių parinkiklis",
+  "com_ui_people_picker_allow_view_groups": "Leisti peržiūrėti grupes",
+  "com_ui_people_picker_allow_view_roles": "Leisti peržiūrėti vaidmenis",
+  "com_ui_people_picker_allow_view_users": "Leisti peržiūrėti vartotojus",
+  "com_ui_permissions_failed_load": "Nepavyko įkelti leidimų. Bandykite dar kartą.",
+  "com_ui_permissions_failed_update": "Nepavyko atnaujinti leidimų. Bandykite dar kartą.",
+  "com_ui_permissions_updated_success": "Leidimai sėkmingai atnaujinti",
+  "com_ui_pin": "Prisegti",
+  "com_ui_pin_error": "Nepavyko prisegti pokalbio",
+  "com_ui_pinned": "Prisegta",
+  "com_ui_plus_n_more": "+{{0}} daugiau",
+  "com_ui_preferences_updated": "Nuostatos sėkmingai atnaujintos",
+  "com_ui_prev": "Ankstesnis",
+  "com_ui_prev_result": "Ankstesnis rezultatas",
+  "com_ui_preview": "Peržiūra",
+  "com_ui_preview_failed": "Peržiūra nepasiekiama",
+  "com_ui_preview_preparing": "Ruošiama peržiūra…",
+  "com_ui_preview_unavailable": "Šio failo tipo peržiūra nepasiekiama",
+  "com_ui_privacy_policy": "Privatumo politika",
+  "com_ui_privacy_policy_url": "Privatumo politikos URL",
+  "com_ui_production": "Gamybinė aplinka",
+  "com_ui_project_chat_count": "{{count}} pokalbių",
+  "com_ui_project_chat_count_single": "1 pokalbis",
+  "com_ui_project_create_error": "Nepavyko sukurti projekto",
+  "com_ui_project_delete_error": "Nepavyko ištrinti projekto",
+  "com_ui_project_name": "Projekto pavadinimas",
+  "com_ui_project_name_placeholder": "Naujas projektas",
+  "com_ui_project_not_found": "Projektas nerastas",
+  "com_ui_project_rename_error": "Nepavyko pervadinti projekto",
+  "com_ui_project_update_error": "Nepavyko atnaujinti projekto priskyrimo",
+  "com_ui_project_updated": "Projekto priskyrimas atnaujintas",
+  "com_ui_projects": "Projektai",
+  "com_ui_prompt": "Užklausa",
+  "com_ui_prompt_category_selector_aria": "Užklausos kategorijos parinkiklis",
+  "com_ui_prompt_delete_confirm": "Ar tikrai norite ištrinti užklausą „{{0}}\"?",
+  "com_ui_prompt_delete_error": "Ištrinant užklausą įvyko klaida",
+  "com_ui_prompt_deleted_group": "Užklausų grupė „{{0}}\" ištrinta",
+  "com_ui_prompt_details": "{{name}} užklausos informacija",
+  "com_ui_prompt_group_button": "{{name}} užklausa, {{category}} kategorija",
+  "com_ui_prompt_group_button_no_category": "{{name}} užklausa",
+  "com_ui_prompt_groups": "Užklausų grupių sąrašas",
+  "com_ui_prompt_input": "Užklausos įvestis",
+  "com_ui_prompt_input_field": "Užklausos teksto įvesties laukas",
+  "com_ui_prompt_name": "Užklausos pavadinimas",
+  "com_ui_prompt_name_required": "Užklausos pavadinimas yra privalomas",
+  "com_ui_prompt_preview_not_shared": "Autorius neleido bendradarbiauti su šia užklausa.",
+  "com_ui_prompt_text": "Tekstas",
+  "com_ui_prompt_text_required": "Tekstas yra privalomas",
+  "com_ui_prompt_update_error": "Atnaujinant užklausą įvyko klaida",
+  "com_ui_prompt_variables_list": "Užklausos kintamųjų sąrašas",
+  "com_ui_prompts": "Užklausos",
+  "com_ui_prompts_allow_create": "Leisti kurti užklausas",
+  "com_ui_prompts_allow_share": "Leisti dalintis užklausomis",
+  "com_ui_prompts_allow_share_public": "Leisti viešai dalintis užklausomis",
+  "com_ui_prompts_allow_use": "Leisti naudoti užklausas",
+  "com_ui_provider": "Tiekėjas",
+  "com_ui_provider_api_keys_description": "Valdykite API raktus galutiniams taškams, sukonfigūruotiems naudoti vartotojo pateiktą raktą.",
+  "com_ui_provider_api_keys_not_set": "Raktas nenustatytas",
+  "com_ui_quality": "Kokybė",
+  "com_ui_quote_selections": "{{0}} pasirinkimai",
+  "com_ui_quotes_queued": "Citatos pridėtos jūsų kitai žinutei",
+  "com_ui_ran_n_agents": "Paleista {{0}} agentų",
+  "com_ui_read_aloud": "Skaityti garsiai",
+  "com_ui_read_file": "Skaityti {{0}}",
+  "com_ui_reading_file": "Skaitoma {{0}}",
+  "com_ui_redirect_uri": "Peradresavimo URI",
+  "com_ui_redirect_uri_instructions": "Nukopijuokite šį peradresavimo URI ir sukonfigūruokite jį savo OAuth tiekėjo nustatymuose.",
+  "com_ui_redirecting_to_provider": "Peradresuojama į {{0}}, palaukite...",
+  "com_ui_reference_saved_memories": "Naudoti išsaugotas atmintis",
+  "com_ui_reference_saved_memories_description": "Leisti asistentui naudoti jūsų išsaugotas atmintis atsakant",
+  "com_ui_referenced_quotes": "Cituojamos ištraukos",
+  "com_ui_refresh": "Atnaujinti",
+  "com_ui_refresh_link": "Atnaujinti nuorodą",
+  "com_ui_refresh_page": "Atnaujinti puslapį",
+  "com_ui_regenerate": "Generuoti iš naujo",
+  "com_ui_regenerate_backup": "Generuoti atsargines kopijas iš naujo",
+  "com_ui_regenerating": "Generuojama iš naujo...",
+  "com_ui_region": "Regionas",
+  "com_ui_reinitialize": "Reinicializuoti",
+  "com_ui_relevance": "Aktualumas",
+  "com_ui_remote_access": "Nuotolinė prieiga",
+  "com_ui_remote_agent_role_editor": "Redaktorius",
+  "com_ui_remote_agent_role_editor_desc": "Gali peržiūrėti ir keisti agentą per API",
+  "com_ui_remote_agent_role_owner": "API savininkas",
+  "com_ui_remote_agent_role_owner_desc": "Pilna API prieiga ir galimybė suteikti nuotolinę prieigą kitiems",
+  "com_ui_remote_agent_role_viewer": "API peržiūrėtojas",
+  "com_ui_remote_agent_role_viewer_desc": "Gali teikti užklausas agentui per API",
+  "com_ui_remote_agents": "Nuotoliniai agentai (API)",
+  "com_ui_remote_agents_allow_create": "Leisti vartotojams kurti agentus per API",
+  "com_ui_remote_agents_allow_share": "Leisti vartotojams suteikti API prieigą prie agentų kitiems",
+  "com_ui_remote_agents_allow_share_public": "Leisti vartotojams suteikti API prieigą prie agentų visiems vartotojams",
+  "com_ui_remote_agents_allow_use": "Leisti vartotojams kurti API raktus ir teikti užklausas agentams nuotoliniu būdu",
+  "com_ui_remove_agent_from_chain": "Pašalinti {{0}} iš grandinės",
+  "com_ui_remove_all_quotes": "Pašalinti visus pasirinkimus",
+  "com_ui_remove_from_project": "Pašalinti iš projekto",
+  "com_ui_remove_quote": "Pašalinti citatą",
+  "com_ui_remove_skill_var": "Pašalinti {{0}}",
+  "com_ui_remove_user": "Pašalinti {{0}}",
+  "com_ui_rename": "Pervadinti",
+  "com_ui_rename_conversation": "Pervadinti pokalbį",
+  "com_ui_rename_failed": "Nepavyko pervadinti pokalbio",
+  "com_ui_rename_project": "Pervadinti projektą",
+  "com_ui_requires_auth": "Reikalingas autentifikavimas",
+  "com_ui_reset": "Atstatyti",
+  "com_ui_reset_adjustments": "Atstatyti koregavimus",
+  "com_ui_reset_var": "Atstatyti {{0}}",
+  "com_ui_reset_zoom": "Atstatyti mastelį",
+  "com_ui_resource": "išteklius",
+  "com_ui_response": "Atsakymas",
+  "com_ui_result": "Rezultatas",
+  "com_ui_result_found": "Rasta {{count}} rezultatas",
+  "com_ui_results_found": "Rasta {{count}} rezultatų",
+  "com_ui_retrieved_files": "Ieškota jūsų failuose",
+  "com_ui_retry": "Bandyti dar kartą",
+  "com_ui_revoke": "Panaikinti",
+  "com_ui_revoke_info": "Panaikinti visus vartotojo pateiktus kredencialus",
+  "com_ui_revoke_key_confirm": "Ar tikrai norite panaikinti šį raktą?",
+  "com_ui_revoke_key_endpoint": "Panaikinti raktą, skirtą {{0}}",
+  "com_ui_revoke_key_error": "Nepavyko panaikinti API rakto. Bandykite dar kartą.",
+  "com_ui_revoke_key_success": "API raktas sėkmingai panaikintas",
+  "com_ui_revoke_keys": "Panaikinti raktus",
+  "com_ui_revoke_keys_confirm": "Ar tikrai norite panaikinti visus raktus?",
+  "com_ui_role": "Vaidmuo",
+  "com_ui_role_editor": "Redaktorius",
+  "com_ui_role_editor_desc": "Gali peržiūrėti ir keisti agentą",
+  "com_ui_role_manager": "Valdytojas",
+  "com_ui_role_manager_desc": "Gali peržiūrėti, keisti ir ištrinti agentą",
+  "com_ui_role_owner": "Savininkas",
+  "com_ui_role_owner_desc": "Turi visišką valdymą agento atžvilgiu, įskaitant jo bendrinimą",
+  "com_ui_role_select": "Vaidmuo",
+  "com_ui_role_viewer": "Stebėtojas",
+  "com_ui_role_viewer_desc": "Gali peržiūrėti ir naudoti agentą, bet negali jo keisti",
+  "com_ui_roleplay": "Vaidmenų žaidimas",
+  "com_ui_rotate": "Pasukti",
+  "com_ui_rotate_90": "Pasukti 90 laipsnių",
+  "com_ui_run_code": "Vykdyti kodą",
+  "com_ui_run_code_error": "Vykdant kodą įvyko klaida",
+  "com_ui_running": "Vykdoma...",
+  "com_ui_running_command": "Vykdoma komanda",
+  "com_ui_running_n_agents": "Vykdomi {{0}} agentai",
+  "com_ui_save": "Išsaugoti",
+  "com_ui_save_badge_changes": "Išsaugoti ženklelio pakeitimus?",
+  "com_ui_save_changes": "Išsaugoti pakeitimus",
+  "com_ui_save_key_error": "Nepavyko išsaugoti API rakto. Bandykite dar kartą.",
+  "com_ui_save_key_success": "API raktas sėkmingai išsaugotas",
+  "com_ui_save_submit": "Išsaugoti ir pateikti",
+  "com_ui_saved": "Išsaugota!",
+  "com_ui_saving": "Išsaugoma...",
+  "com_ui_schema": "Schema",
+  "com_ui_scope": "Apimtis",
+  "com_ui_scroll_to_bottom": "Slinkti į apačią",
+  "com_ui_search": "Ieškoti",
+  "com_ui_search_above_to_add": "Ieškokite aukščiau, kad pridėtumėte vartotojus ar grupes",
+  "com_ui_search_above_to_add_all": "Ieškokite aukščiau, kad pridėtumėte vartotojus, grupes ar roles",
+  "com_ui_search_above_to_add_people": "Ieškokite aukščiau, kad pridėtumėte žmones",
+  "com_ui_search_agent_category": "Ieškoti kategorijų...",
+  "com_ui_search_default_placeholder": "Ieškoti pagal vardą arba el. paštą (min. 2 simboliai)",
+  "com_ui_search_language": "Ieškoti kalbų...",
+  "com_ui_search_people_placeholder": "Ieškoti žmonių ar grupių pagal vardą arba el. paštą",
+  "com_ui_search_projects": "Ieškoti projektų",
+  "com_ui_search_result_count": "Rastas {{count}} rezultatas",
+  "com_ui_search_results_count": "Rasta {{count}} rezultatų",
+  "com_ui_search_skills": "Ieškoti įgūdžių...",
+  "com_ui_searching_files": "Ieškoma jūsų failuose",
+  "com_ui_seconds": "sekundės",
+  "com_ui_secret_key": "Slaptas raktas",
+  "com_ui_select": "Pasirinkti",
+  "com_ui_select_agent": "Pasirinkti agentą",
+  "com_ui_select_all": "Pasirinkti viską",
+  "com_ui_select_file": "Pasirinkti failą",
+  "com_ui_select_model": "Pasirinkti modelį",
+  "com_ui_select_options": "Pasirinkti parinktis...",
+  "com_ui_select_or_create_prompt": "Pasirinkti arba sukurti užklausą",
+  "com_ui_select_project": "Pasirinkti projektą",
+  "com_ui_select_provider": "Pasirinkti tiekėją",
+  "com_ui_select_provider_first": "Pirmiausia pasirinkite tiekėją",
+  "com_ui_select_region": "Pasirinkti regioną",
+  "com_ui_select_row": "Pasirinkti eilutę",
+  "com_ui_select_search_model": "Ieškoti modelio pagal pavadinimą",
+  "com_ui_select_search_provider": "Ieškoti tiekėjo pagal pavadinimą",
+  "com_ui_select_search_region": "Ieškoti regiono pagal pavadinimą",
+  "com_ui_set": "Nustatyti",
+  "com_ui_settings_label_2fa": "Dviejų veiksnių autentifikavimas",
+  "com_ui_settings_label_agent_api_keys": "Agento API raktai",
+  "com_ui_settings_label_auto_refill": "Automatinis papildymas",
+  "com_ui_settings_label_avatar": "Avataro nuotrauka",
+  "com_ui_settings_label_backup_codes": "Atsarginiai kodai",
+  "com_ui_settings_label_clear_chats": "Išvalyti visus pokalbius",
+  "com_ui_settings_label_conversation_mode": "Pokalbio režimas",
+  "com_ui_settings_label_credits": "Prieigos raktų balansas",
+  "com_ui_settings_label_decibel": "Decibelų slenkstis",
+  "com_ui_settings_label_delete_account": "Ištrinti paskyrą",
+  "com_ui_settings_label_delete_cache": "Išvalyti talpyklą",
+  "com_ui_settings_label_engine_stt": "Kalbos į tekstą variklis",
+  "com_ui_settings_label_engine_tts": "Teksto į kalbą variklis",
+  "com_ui_settings_label_import": "Importuoti pokalbius",
+  "com_ui_settings_label_language_stt": "Kalbos į tekstą kalba",
+  "com_ui_settings_label_playback_rate": "Atkūrimo greitis",
+  "com_ui_settings_label_provider_api_keys": "Paslaugų teikėjo API raktai",
+  "com_ui_settings_label_revoke_keys": "Atšaukti raktus",
+  "com_ui_settings_label_shared_links": "Bendrinamos nuorodos",
+  "com_ui_settings_label_voice": "Balsas",
+  "com_ui_settings_no_results": "Jokių nustatymų nerasta pagal jūsų paiešką",
+  "com_ui_settings_results_aria": "Paieškos rezultatai",
+  "com_ui_settings_search_placeholder": "Ieškoti nustatymų",
+  "com_ui_settings_section_accessibility": "Pritaikymas neįgaliesiems",
+  "com_ui_settings_section_api_keys": "API raktai",
+  "com_ui_settings_section_appearance": "Išvaizda",
+  "com_ui_settings_section_billing": "Sąskaitos",
+  "com_ui_settings_section_commands": "Komandos",
+  "com_ui_settings_section_conversations": "Pokalbiai",
+  "com_ui_settings_section_danger_zone": "Pavojinga zona",
+  "com_ui_settings_section_data": "Jūsų duomenys",
+  "com_ui_settings_section_layout": "Išdėstymas",
+  "com_ui_settings_section_memory": "Atmintis",
+  "com_ui_settings_section_messages": "Žinutės",
+  "com_ui_settings_section_profile": "Profilis",
+  "com_ui_settings_section_prompts": "Raginimai",
+  "com_ui_settings_section_security": "Saugumas",
+  "com_ui_settings_section_sending": "Siuntimas",
+  "com_ui_settings_section_stt": "Kalba į tekstą",
+  "com_ui_settings_section_tts": "Tekstas į kalbą",
+  "com_ui_settings_tab_data": "Duomenys ir privatumas",
+  "com_ui_share": "Dalintis",
+  "com_ui_share_create_message": "Jūsų vardas ir bet kokios žinutės, kurias pridėsite po bendrinimo, lieka privačios.",
+  "com_ui_share_delete_error": "Įvyko klaida trinant bendrą nuorodą",
+  "com_ui_share_error": "Įvyko klaida dalinantis pokalbio nuoroda",
+  "com_ui_share_everyone": "Dalintis su visais",
+  "com_ui_share_everyone_description_var": "Šis {{resource}} bus prieinamas visiems. Įsitikinkite, kad {{resource}} tikrai skirtas dalintis su visais. Būkite atsargūs su savo duomenimis.",
+  "com_ui_share_files": "Dalintis failais šiame pokalbyje",
+  "com_ui_share_files_description": "Vaizdai ir failai šiame pokalbyje nebus matomi žiūrovams, nebent tai bus įjungta.",
+  "com_ui_share_files_refresh_note": "Atnaujinkite nuorodą, kad pritaikytumėte šį pakeitimą – failai įrašomi atnaujinus nuorodą.",
+  "com_ui_share_link_to_chat": "Dalintis pokalbio nuoroda",
+  "com_ui_share_qr_code_description": "QR kodas šio pokalbio nuorodai dalintis",
+  "com_ui_share_update_message": "Jūsų vardas, pasirinktinės instrukcijos ir bet kokios žinutės, kurias pridėsite po bendrinimo, lieka privačios.",
+  "com_ui_share_var": "Dalintis {{0}}",
+  "com_ui_shared_link": "bendra nuoroda",
+  "com_ui_shared_link_delete_success": "Bendra nuoroda sėkmingai ištrinta",
+  "com_ui_shared_link_manage_access": "Valdyti prieigą",
+  "com_ui_shared_link_not_found": "Bendra nuoroda nerasta",
+  "com_ui_shared_prompts": "Bendrinami raginimai",
+  "com_ui_shop": "Apsipirkimas",
+  "com_ui_show": "Rodyti",
+  "com_ui_show_all": "Rodyti viską",
+  "com_ui_show_code": "Rodyti kodą",
+  "com_ui_show_image_details": "Rodyti vaizdo informaciją",
+  "com_ui_show_less": "Rodyti mažiau",
+  "com_ui_show_more": "Rodyti daugiau",
+  "com_ui_show_n_files": "Rodyti {{0}} failus",
+  "com_ui_show_qr": "Rodyti QR kodą",
+  "com_ui_sign_in_to_domain": "Prisijungti prie {{0}}",
+  "com_ui_size": "Dydis",
+  "com_ui_size_sort": "Rūšiuoti pagal dydį",
+  "com_ui_skill": "Įgūdis",
+  "com_ui_skill_content": "Įgūdžio turinys",
+  "com_ui_skill_content_placeholder": "Įveskite įgūdžio instrukcijas markdown formatu...",
+  "com_ui_skill_create_error": "Nepavyko sukurti įgūdžio",
+  "com_ui_skill_create_title": "Sukurti įgūdį",
+  "com_ui_skill_created": "Įgūdis sukurtas",
+  "com_ui_skill_delete_confirm": "Ar tikrai norite ištrinti „{{0}}\"? Šio veiksmo anuliuoti neįmanoma.",
+  "com_ui_skill_delete_error": "Nepavyko ištrinti įgūdžio",
+  "com_ui_skill_deleted": "Įgūdis ištrintas",
+  "com_ui_skill_description_field_hint": "Tiksliai nurodykite, kada šis įgūdis turėtų būti taikomas.",
+  "com_ui_skill_description_placeholder": "Taikyti „Acme Corp\" prekės ženklo gaires pristatymams ir dokumentams...",
+  "com_ui_skill_description_required": "Aprašymas yra būtinas",
+  "com_ui_skill_description_too_long": "Aprašymas turi būti ne ilgesnis nei {{0}} simbolių",
+  "com_ui_skill_edit_title": "Redaguoti įgūdį",
+  "com_ui_skill_file_binary": "Dvejetainis failas – negalima peržiūrėti eilutėje",
+  "com_ui_skill_file_download": "Atsisiųsti",
+  "com_ui_skill_file_load_error": "Nepavyko įkelti failo turinio",
+  "com_ui_skill_finished": "Paleista {{0}}",
+  "com_ui_skill_instructions": "Instrukcijos",
+  "com_ui_skill_instructions_placeholder": "Įveskite įgūdžio instrukcijas markdown formatu...",
+  "com_ui_skill_name_invalid": "Naudokite tik mažąsias raides, skaitmenis ir brūkšnelius (kebab-case)",
+  "com_ui_skill_name_placeholder": "brand-guidelines",
+  "com_ui_skill_name_required": "Pavadinimas yra būtinas",
+  "com_ui_skill_name_too_long": "Pavadinimas turi būti ne ilgesnis nei {{0}} simbolių",
+  "com_ui_skill_new_file": "Naujas failas",
+  "com_ui_skill_new_folder": "Naujas aplankas",
+  "com_ui_skill_no_edit_permission": "Neturite leidimo redaguoti šio įgūdžio",
+  "com_ui_skill_no_selection": "Pasirinkti įgūdį",
+  "com_ui_skill_no_selection_desc": "Pasirinkite įgūdį iš šoninės juostos, kad peržiūrėtumėte jo informaciją.",
+  "com_ui_skill_not_found": "Įgūdis nerastas",
+  "com_ui_skill_not_found_description": "Jis galėjo būti ištrintas arba jūs nebeturite prieigos prie jo.",
+  "com_ui_skill_role_editor_desc": "Gali peržiūrėti ir redaguoti įgūdį",
+  "com_ui_skill_role_owner_desc": "Visapusiška įgūdžio kontrolė, įskaitant bendrinimą ir ištrynimą",
+  "com_ui_skill_role_viewer_desc": "Gali peržiūrėti ir naudoti įgūdį, bet negali jo redaguoti",
+  "com_ui_skill_running": "Vykdoma {{0}}",
+  "com_ui_skill_sr_public": "Viešas įgūdis",
+  "com_ui_skill_states_limit": "Pasiekėte {{0}} aktyvių / neaktyvių įgūdžių perrašymų limitą. Pašalinkite kai kuriuos perrašymus, kad galėtumėte įjungti naujus įgūdžius.",
+  "com_ui_skill_toggle_active": "Perjungti įgūdžio aktyvumo būseną",
+  "com_ui_skill_unavailable": "Nepasiekiamas įgūdis",
+  "com_ui_skill_update_conflict": "Prieš jūsų pakeitimus buvo išsaugotas kitas redagavimas. Įkeliama naujausia versija.",
+  "com_ui_skill_update_error": "Nepavyko išsaugoti įgūdžio",
+  "com_ui_skill_updated": "Įgūdis išsaugotas",
+  "com_ui_skill_upload": "Įkelti įgūdį",
+  "com_ui_skill_upload_drag": "Vilkite ir numeskite arba spustelėkite, kad įkeltumėte",
+  "com_ui_skill_upload_file": "Įkelti failą",
+  "com_ui_skill_upload_req_md": ".md faile turi būti įgūdžio pavadinimas ir aprašymas YAML formatu",
+  "com_ui_skill_upload_req_size": "Failo dydis neturi viršyti {{0}} MB",
+  "com_ui_skill_upload_req_zip": ".zip arba .skill faile turi būti SKILL.md failas",
+  "com_ui_skill_upload_requirements": "Failo reikalavimai",
+  "com_ui_skill_upload_size_error": "Įgūdžio importas neturi viršyti {{0}} MB",
+  "com_ui_skill_upload_title": "Įkelti įgūdį",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "Peržiūrėti atvaizduotą",
+  "com_ui_skill_view_source": "Peržiūrėti šaltinį",
+  "com_ui_skill_warnings": "Atkreipkite dėmesį",
+  "com_ui_skill_write_instructions": "Rašyti įgūdžio instrukcijas",
+  "com_ui_skills": "Įgūdžiai",
+  "com_ui_skills_allow_create": "Leisti kurti įgūdžius",
+  "com_ui_skills_allow_share": "Leisti dalytis įgūdžiais",
+  "com_ui_skills_allow_share_public": "Leisti viešai dalytis įgūdžiais",
+  "com_ui_skills_allow_use": "Leisti naudoti įgūdžius",
+  "com_ui_skills_always_apply_invoked": "Automatiškai taikomi įgūdžiai",
+  "com_ui_skills_always_apply_pin_title": "Visada taikomas įgūdis (automatiškai aktyvuojamas kiekvieną kartą)",
+  "com_ui_skills_command_placeholder": "Pasirinkite įgūdį pagal pavadinimą",
+  "com_ui_skills_disabled_hint": "Šiam agentui įgūdžiai išjungti. Įjunkite, kad modelis galėtų naudoti jūsų įgūdžių katalogą.",
+  "com_ui_skills_empty": "Kol kas nėra įgūdžių",
+  "com_ui_skills_enable_toggle": "Įjungti įgūdžius šiam agentui",
+  "com_ui_skills_enabled_all_hint": "Įjungta. Prieinamas visas katalogas; apribokite jį žemiau, jei norite nurodyti, kuriuos įgūdžius gali naudoti šis agentas.",
+  "com_ui_skills_enabled_allowlist_hint": "Įjungta. Apribota žemiau pasirinktais įgūdžiais.",
+  "com_ui_skills_load_error": "Nepavyko įkelti įgūdžių",
+  "com_ui_skills_manual_invoked": "Rankiniu būdu iškviečiami įgūdžiai",
+  "com_ui_skills_queued": "Įgūdžiai, laukiantys kito pateikimo",
+  "com_ui_sort_by": "Rikiuoti pagal",
+  "com_ui_sort_chats_by": "Rikiuoti pokalbius pagal",
+  "com_ui_sort_created": "Sukurta",
+  "com_ui_sort_projects_by": "Rikiuoti projektus pagal",
+  "com_ui_sort_updated": "Atnaujinta",
+  "com_ui_special": "specialus",
+  "com_ui_special_var_current_date": "Dabartinė data",
+  "com_ui_special_var_current_datetime": "Dabartinė data ir laikas",
+  "com_ui_special_var_current_user": "Dabartinis vartotojas",
+  "com_ui_special_var_desc_current_date": "Šiandienos data ir savaitės diena",
+  "com_ui_special_var_desc_current_datetime": "Vietinė data ir laikas jūsų laiko juostoje",
+  "com_ui_special_var_desc_current_user": "Jūsų paskyros rodomas vardas",
+  "com_ui_special_var_desc_iso_datetime": "UTC data ir laikas ISO 8601 formatu",
+  "com_ui_special_var_iso_datetime": "UTC ISO data ir laikas",
+  "com_ui_special_variable_added": "{{0}} specialus kintamasis pridėtas.",
+  "com_ui_special_variables": "Specialūs kintamieji",
+  "com_ui_speech_not_supported": "Jūsų naršyklė nepalaiko kalbos atpažinimo",
+  "com_ui_speech_not_supported_use_external": "Jūsų naršyklė nepalaiko kalbos atpažinimo. Pabandykite perjungti į išorinį STT nustatymuose: Kalba > Kalba.",
+  "com_ui_speech_while_submitting": "Negalima pateikti kalbos, kol generuojamas atsakymas",
+  "com_ui_sr_global_prompt": "Visuotinė užklausos grupė",
+  "com_ui_sr_public_skill": "Vieša funkcija",
+  "com_ui_stack_trace": "Steko atsekimas",
+  "com_ui_status_prefix": "Būsena:",
+  "com_ui_stop": "Sustabdyti",
+  "com_ui_storage": "Saugykla",
+  "com_ui_storage_filter_sort": "Filtruoti ir rūšiuoti pagal saugyklą",
+  "com_ui_subagent_cancelled": "Atšauktas agentas",
+  "com_ui_subagent_complete": "Agentas paleistas",
+  "com_ui_subagent_dialog_description": "Izoliuoto konteksto antrinis vykdymas. Veikla ir galutinis rezultatas žemiau.",
+  "com_ui_subagent_dialog_title": "„{{0}}\" agentas",
+  "com_ui_subagent_dialog_title_self": "Agentas",
+  "com_ui_subagent_empty_result": "Tekstas negrąžintas.",
+  "com_ui_subagent_errored": "Agento klaida",
+  "com_ui_subagent_no_result_yet": "Vis dar vykdoma – galutinio rezultato dar nėra.",
+  "com_ui_subagent_running": "Vykdomas agentas",
+  "com_ui_subagent_scroll_to_bottom": "Slinkti į naujausią",
+  "com_ui_subagent_ticker_error": "Klaida",
+  "com_ui_subagent_ticker_reasoning": "Samprotavimas",
+  "com_ui_subagent_ticker_tool_done": "atlikta",
+  "com_ui_subagent_ticker_using": "Naudojama",
+  "com_ui_subagent_ticker_writing": "Rašoma",
+  "com_ui_subagent_waiting": "Laukiama pirmojo atnaujinimo…",
+  "com_ui_submit": "Pateikti",
+  "com_ui_summarized": "Apibendrinta",
+  "com_ui_summarizing": "Apibendrinamas...",
+  "com_ui_support_contact": "Palaikymo kontaktas",
+  "com_ui_support_contact_email": "El. paštas",
+  "com_ui_support_contact_email_invalid": "Įveskite galiojantį el. pašto adresą",
+  "com_ui_support_contact_email_placeholder": "support@example.com",
+  "com_ui_support_contact_name": "Vardas",
+  "com_ui_support_contact_name_min_length": "Pavadinimas turi būti bent {{minLength}} simbolių",
+  "com_ui_support_contact_name_placeholder": "Palaikymo kontakto vardas",
+  "com_ui_teach_or_explain": "Mokymasis",
+  "com_ui_temporary": "Laikinas pokalbis",
+  "com_ui_terms_and_conditions": "Taisyklės ir sąlygos",
+  "com_ui_terms_of_service": "Paslaugų teikimo sąlygos",
+  "com_ui_text_variables": "Teksto kintamieji",
+  "com_ui_thinking": "Galvojama...",
+  "com_ui_thoughts": "Mintys",
+  "com_ui_toggle_theme": "Perjungti temą",
+  "com_ui_token": "žetonas",
+  "com_ui_token_exchange_method": "Žetono keitimo metodas",
+  "com_ui_token_url": "Žetono URL",
+  "com_ui_tokens": "žetonai",
+  "com_ui_tool_collection_prefix": "Įrankių rinkinys iš",
+  "com_ui_tool_failed": "nepavyko",
+  "com_ui_tool_list_collapse": "Sutraukti {{serverName}} įrankių sąrašą",
+  "com_ui_tool_list_expand": "Išskleisti {{serverName}} įrankių sąrašą",
+  "com_ui_tool_name_code": "Kodas",
+  "com_ui_tool_name_code_analysis": "Kodo analizė",
+  "com_ui_tool_name_file_search": "Failų paieška",
+  "com_ui_tool_name_image_edit": "Vaizdo redagavimas",
+  "com_ui_tool_name_image_gen": "Vaizdo generavimas",
+  "com_ui_tool_name_web_search": "Žiniatinklio paieška",
+  "com_ui_tools": "Įrankiai",
+  "com_ui_tools_and_actions": "Įrankiai ir veiksmai",
+  "com_ui_transferred_to": "Perduota",
+  "com_ui_travel": "Kelionės",
+  "com_ui_trust_app": "Pasitikiu šia programa",
+  "com_ui_try_adjusting_search": "Pabandykite koreguoti paieškos terminus",
+  "com_ui_ui_resource_error": "UI išteklių klaida ({{0}})",
+  "com_ui_ui_resource_not_found": "UI išteklius nerastas (indeksas: {{0}})",
+  "com_ui_unarchive": "Išarchyvuoti",
+  "com_ui_unarchive_conversation": "Išarchyvuoti pokalbį",
+  "com_ui_unarchive_error": "Nepavyko išarchyvuoti pokalbio",
+  "com_ui_unassigned": "Nepriskirtas",
+  "com_ui_unavailable": "Nepasiekiama",
+  "com_ui_unfavorite": "Pašalinti iš mėgstamiausių",
+  "com_ui_unknown": "Nežinoma",
+  "com_ui_unknown_file_type": "Nežinomas failo tipas",
+  "com_ui_unpin": "Atsegti",
+  "com_ui_unpin_error": "Nepavyko atsegti pokalbio",
+  "com_ui_unset": "Nenustatyta",
+  "com_ui_untitled": "Be pavadinimo",
+  "com_ui_update": "Atnaujinti",
+  "com_ui_update_mcp_server": "Atnaujinti MCP serverį",
+  "com_ui_updated_file": "Atnaujinta {{0}}",
+  "com_ui_updating": "Atnaujinama...",
+  "com_ui_upload": "Įkelti",
+  "com_ui_upload_agent_avatar": "Agento avataro nuotrauka sėkmingai atnaujinta",
+  "com_ui_upload_agent_avatar_label": "Įkelti agento avataro paveikslėlį",
+  "com_ui_upload_avatar_label": "Įkelti avataro paveikslėlį",
+  "com_ui_upload_code_environment": "Įkelti į kodo aplinką",
+  "com_ui_upload_delay": "„{{0}}\" įkėlimas užtrunka ilgiau nei tikėtasi. Palaukite, kol failas bus indeksuotas paieškai.",
+  "com_ui_upload_error": "Įkeliant failą įvyko klaida",
+  "com_ui_upload_file_context": "Failo konteksto įkėlimas",
+  "com_ui_upload_file_search": "Įkelti failų paieškai",
+  "com_ui_upload_files": "Įkelti failus",
+  "com_ui_upload_icon": "Įkelti piktogramos paveikslėlį",
+  "com_ui_upload_image": "Įkelti paveikslėlį",
+  "com_ui_upload_image_input": "Įkelti paveikslėlį",
+  "com_ui_upload_invalid": "Netinkamas failas įkėlimui. Turi būti paveikslėlis, neviršijantis leistino dydžio",
+  "com_ui_upload_invalid_var": "Netinkamas failas įkėlimui. Turi būti paveikslėlis, neviršijantis {{0}} MB",
+  "com_ui_upload_ocr_text": "Įkelti kaip tekstą",
+  "com_ui_upload_provider": "Įkelti į tiekėją",
+  "com_ui_upload_success": "Failas sėkmingai įkeltas",
+  "com_ui_upload_type": "Pasirinkite įkėlimo tipą",
+  "com_ui_usage": "Naudojimas",
+  "com_ui_use_2fa_code": "Naudoti 2FA kodą",
+  "com_ui_use_backup_code": "Naudoti atsarginį kodą",
+  "com_ui_use_memory": "Naudoti atmintį",
+  "com_ui_use_micrphone": "Naudoti mikrofoną",
+  "com_ui_use_prompt": "Naudoti užklausą",
+  "com_ui_used": "Naudota",
+  "com_ui_used_n_tools": "Naudota {{0}} įrankių",
+  "com_ui_user": "Vartotojas",
+  "com_ui_user_group_permissions": "Vartotojų ir grupių teisės",
+  "com_ui_user_provides_key": "Kiekvienas vartotojas pateikia savo raktą",
+  "com_ui_value": "Reikšmė",
+  "com_ui_variable_with_options": "{{name}} kintamasis su {{count}} parinkčių",
+  "com_ui_variables": "Kintamieji",
+  "com_ui_verify": "Patvirtinti",
+  "com_ui_version_var": "{{0}} versija",
+  "com_ui_versions": "Versijos",
+  "com_ui_via_server": "per {{0}}",
+  "com_ui_view_memory": "Peržiūrėti atmintį",
+  "com_ui_web_search": "Žiniatinklio paieška",
+  "com_ui_web_search_cohere_key": "Įveskite Cohere API raktą",
+  "com_ui_web_search_firecrawl_url": "Firecrawl API URL (neprivaloma)",
+  "com_ui_web_search_jina_key": "Įveskite Jina API raktą",
+  "com_ui_web_search_jina_url": "Jina API URL (neprivaloma)",
+  "com_ui_web_search_processing": "Apdorojami rezultatai",
+  "com_ui_web_search_provider": "Paieškos tiekėjas",
+  "com_ui_web_search_provider_searxng": "SearXNG",
+  "com_ui_web_search_provider_serper": "Serper API",
+  "com_ui_web_search_provider_serper_key": "Gaukite savo Serper API raktą",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Gaukite savo Tavily API raktą",
+  "com_ui_web_search_reading": "Skaitomi rezultatai",
+  "com_ui_web_search_reranker": "Perranker",
+  "com_ui_web_search_reranker_cohere": "Cohere",
+  "com_ui_web_search_reranker_cohere_key": "Gaukite savo Cohere API raktą",
+  "com_ui_web_search_reranker_jina": "Jina AI",
+  "com_ui_web_search_reranker_jina_key": "Gaukite savo Jina API raktą",
+  "com_ui_web_search_reranker_jina_url_help": "Sužinokite apie Jina Rerank API",
+  "com_ui_web_search_scraper": "Duomenų rinkiklis",
+  "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
+  "com_ui_web_search_scraper_firecrawl_key": "Gaukite savo Firecrawl API raktą",
+  "com_ui_web_search_scraper_serper": "Serper Scrape API",
+  "com_ui_web_search_scraper_serper_key": "Gaukite savo Serper API raktą",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Gaukite savo Tavily API raktą",
+  "com_ui_web_search_searxng_api_key": "Įveskite SearXNG API raktą (neprivaloma)",
+  "com_ui_web_search_searxng_instance_url": "SearXNG egzemplioriaus URL",
+  "com_ui_web_search_source": "{{count}} šaltinis",
+  "com_ui_web_search_sources": "{{count}} šaltiniai",
+  "com_ui_web_searched": "Ieškota internete",
+  "com_ui_web_searching": "Ieškoma internete",
+  "com_ui_web_searching_again": "Ieškoma internete dar kartą",
+  "com_ui_weekend_morning": "Puikaus savaitgalio",
+  "com_ui_write": "Rašymas",
+  "com_ui_writing_command": "Rašymo komanda",
+  "com_ui_x_selected": "{{0}} pasirinkta",
+  "com_ui_xhigh": "Labai didelis",
+  "com_ui_yes": "Taip",
+  "com_ui_you": "Jūs",
+  "com_ui_your_api_key": "Jūsų API raktas",
+  "com_ui_your_projects": "Jūsų projektai",
+  "com_ui_zoom": "Mastelis",
+  "com_ui_zoom_in": "Padidinti",
+  "com_ui_zoom_level": "Mastelio lygis",
+  "com_ui_zoom_out": "Sumažinti",
+  "com_user_message": "Jūs"
+}
diff --git a/client/src/locales/lv/translation.json b/client/src/locales/lv/translation.json
index 5a5857f9d2a..d4726241314 100644
--- a/client/src/locales/lv/translation.json
+++ b/client/src/locales/lv/translation.json
@@ -90,6 +90,8 @@
   "com_agents_not_available": "Aģents nav pieejams",
   "com_agents_recommended": "Mūsu rekomendētie aģenti",
   "com_agents_results_for": "Rezultāti par '{{query}}'",
+  "com_agents_run_code_files": "Tālāk esošie faili ir paredzēti tikai koda videi:",
+  "com_agents_run_code_info": "Ja iespējots, ļauj aģentam droši palaist ģenerēto kodu, tostarp failu apstrādi.",
   "com_agents_search_aria": "Meklēt aģentus",
   "com_agents_search_empty_heading": "Nav meklēšanas rezultātu",
   "com_agents_search_info": "Ja šī opcija ir iespējota, jūsu aģents var meklēt jaunāko informāciju tīmeklī. Nepieciešama derīga API atslēga.",
@@ -236,6 +238,11 @@
   "com_endpoint_assistant_model": "Asistenta modelis",
   "com_endpoint_assistant_placeholder": "Lūdzu, labajā sānu panelī atlasiet asistentu.",
   "com_endpoint_bedrock_reasoning_effort": "Kontrolē spriešanas līmeni atbalstītajiem Bedrock modeļiem (piemēram, Kimi K2.5, GLM). Augstāki līmeņi nodrošina pamatīgāku argumentāciju, taču tas maksā ar lielāku kavēšanos un lielākiem tokeniem.",
+  "com_endpoint_config_bedrock_access_key_id": "AWS piekļuves atslēgas ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API atslēga",
+  "com_endpoint_config_bedrock_credentials_required": "Lūdzu, norādiet AWS Bedrock API atslēgu vai AWS piekļuves atslēgas (piekļuves atslēgas ID + slepenās piekļuves atslēga).",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS slepenā piekļuves atslēga",
+  "com_endpoint_config_bedrock_session_token": "AWS sesijas tokens",
   "com_endpoint_config_click_here": "Noklikšķiniet šeit",
   "com_endpoint_config_google_api_info": "Lai iegūtu savu Ģeneratīvās valodas API atslēgu (Gemini),",
   "com_endpoint_config_google_api_key": "Google API atslēga",
@@ -256,6 +263,7 @@
   "com_endpoint_config_key_name": "Atslēga",
   "com_endpoint_config_key_never_expires": "Jūsu atslēgas derīguma termiņš nekad nebeigsies",
   "com_endpoint_config_placeholder": "Iestatiet savu atslēgu galvenes izvēlnē, lai izveidotu sarunu.",
+  "com_endpoint_config_required_fields": "Obligāti aizpildāmi šādi lauki:",
   "com_endpoint_config_value": "Ievadiet vērtību",
   "com_endpoint_context": "Konteksts",
   "com_endpoint_context_info": "Maksimālais tokenu skaits, ko var izmantot kontekstam. Izmanto to, lai kontrolētu, cik tokenu tiek nosūtīti katrā pieprasījumā. Ja tas nav norādīts, tiks izmantoti sistēmas noklusējuma iestatījumi, pamatojoties uz zināmo modeļu konteksta lielumu. Augstāku vērtību iestatīšana var izraisīt kļūdas un/vai augstākas tokenu izmaksas.",
@@ -397,6 +405,13 @@
   "com_hide_examples": "Slēpt piemērus",
   "com_info_heic_converting": "Konvertēju HEIC attēlu uz JPEG...",
   "com_nav_2fa": "Divfaktoru autentifikācija (2FA)",
+  "com_nav_about_branch": "Branch",
+  "com_nav_about_build_date": "Built",
+  "com_nav_about_commit": "Commit",
+  "com_nav_about_diagnostics_copied": "Kopēts uz starpliktuvi",
+  "com_nav_about_diagnostics_copy": "Kopēt diagnostiku",
+  "com_nav_about_diagnostics_description": "Atverot atbalsta problēmu, kopējiet šo bloku, lai uzturētāji varētu noteikt precīzu jūsu darbināto versiju.",
+  "com_nav_about_version": "Versija",
   "com_nav_account_settings": "Konta iestatījumi",
   "com_nav_advanced_prompts": "Paplašinātais uzvedņu redaktors",
   "com_nav_advanced_prompts_desc": "Iespējot versiju izveidi un produkcijas kontroli uzvednēm",
@@ -440,8 +455,6 @@
   "com_nav_browser": "Pārlūkprogramma",
   "com_nav_center_chat_input": "Centrēt sarunas ievadi sveiciena ekrānā",
   "com_nav_change_picture": "Mainīt attēlu",
-  "com_nav_chat_commands": "Sarunu komandas",
-  "com_nav_chat_commands_info": "Šīs komandas tiek aktivizētas, ierakstot noteiktas rakstzīmes ziņas sākumā. Katru komandu aktivizē tai norādītais prefikss. Varat tās atspējot, ja bieži izmantojat šīs rakstzīmes ziņojumu sākumā.",
   "com_nav_chat_direction": "Sarunas virziens",
   "com_nav_chat_direction_selected": "Sarunas virziens: {{direction}}",
   "com_nav_clear_all_chats": "Dzēst visas saglabātās sarunas",
@@ -449,7 +462,6 @@
   "com_nav_clear_conversation": "Skaidras sarunas",
   "com_nav_clear_conversation_confirm_message": "Vai tiešām vēlaties dzēst visas saglabātās sarunas? Šī darbība ir neatgriezeniska.",
   "com_nav_close_sidebar": "Aizvērt sāna joslu",
-  "com_nav_commands": "Komandas",
   "com_nav_confirm_clear": "Apstiprināt dzēšanu",
   "com_nav_control_panel": "Vadības panelis",
   "com_nav_conversation_mode": "Sarunas režīms",
@@ -483,7 +495,7 @@
   "com_nav_font_size_sm": "Mazs",
   "com_nav_font_size_xl": "Īpaši liels",
   "com_nav_font_size_xs": "Īpaši mazs",
-  "com_nav_help_faq": "Palīdzība un bieži uzdotie jautājumi",
+  "com_nav_help_faq": "Lietošanas instrukcija un palīdzība",
   "com_nav_info_balance": "Bilance parāda, cik daudz tokenu kredītu jums ir atlicis izmantot. Tokenu kredīti tiek pārvērsti naudas vērtībā (piemēram, 1000 kredīti = 0,001 USD).",
   "com_nav_info_code_artifacts": "Iespējo eksperimentāla koda artefaktu rādīšanu blakus sarunai",
   "com_nav_info_code_artifacts_agent": "Iespējo koda artefaktu izmantošanu šim aģentam. Pēc noklusējuma tiek pievienotas papildu instrukcijas, kas attiecas uz artefaktu izmantošanu, ja vien nav iespējots \"Pielāgots uzvednes režīms\".",
@@ -575,14 +587,12 @@
   "com_nav_scroll_button": "Rādīt pogu: pāriet uz pēdējo ierakstu",
   "com_nav_search_placeholder": "Meklēt ziņas",
   "com_nav_send_message": "Sūtīt ziņu",
+  "com_nav_setting_about": "Par",
   "com_nav_setting_account": "Konts",
-  "com_nav_setting_balance": "Bilance",
   "com_nav_setting_chat": "Saruna",
-  "com_nav_setting_data": "Datu kontrole",
   "com_nav_setting_delay": "Aizkave (-es)",
   "com_nav_setting_general": "Vispārīgi",
   "com_nav_setting_mcp": "MCP iestatījumi",
-  "com_nav_setting_personalization": "Personalizācija",
   "com_nav_setting_speech": "Runa",
   "com_nav_settings": "Iestatījumi",
   "com_nav_shared_links": "Kopīgotās saites",
@@ -595,7 +605,7 @@
   "com_nav_theme": "Tēma",
   "com_nav_theme_dark": "Tumšs",
   "com_nav_theme_light": "Gaišs",
-  "com_nav_theme_system": "Sistēmas uzstādījums",
+  "com_nav_theme_system": "Sistēmas",
   "com_nav_tool_dialog": "Asistenta rīki",
   "com_nav_tool_dialog_agents": "Aģenta rīki",
   "com_nav_tool_dialog_description": "Lai saglabātu rīku atlasi, ir jāsaglabā asistents.",
@@ -668,7 +678,6 @@
   "com_ui_advanced_settings": "Advancētie iestatījumi",
   "com_ui_agent": "Aģents",
   "com_ui_agent_api_keys": "Aģenta API atslēgas",
-  "com_ui_agent_api_keys_description": "Izveidot API atslēgas, lai attālināti piekļūtu aģentiem, izmantojot API",
   "com_ui_agent_category_aftersales": "Pēcpārdošanas pakalpojumi",
   "com_ui_agent_category_finance": "Finanses",
   "com_ui_agent_category_general": "Vispārīgi",
@@ -707,12 +716,12 @@
   "com_ui_agent_subagents_allow_self_info": "Ļaujiet šim aģentam deleģēt fokusētos apakšuzdevumus paša kopijai izolētā konteksta logā.",
   "com_ui_agent_subagents_empty": "Nav pieejami apakšaģenti: iespējojiet paš-izveidi vai pievienojiet vismaz vienu aģentu.",
   "com_ui_agent_subagents_enable": "Iespējot apakšaģentus",
-  "com_ui_agent_subagents_info": "Apakšaģenti darbojas izolētos konteksta logos. Izvērstā rīka izvade paliek pieejama bērnam; tikai kopsavilkums atgriežas pie šī aģenta.",
+  "com_ui_agent_subagents_info": "Apakšaģenti darbojas izolētos konteksta logos. Izvērstā rīka izvade paliek pieejama apakšaģentam; tikai kopsavilkums atgriežas pie šī aģenta.",
   "com_ui_agent_subagents_info_2": "Iespējojot bez uzskaitītajiem aģentiem, joprojām ir iespējams veikt paš-izveidi, tāpēc šis aģents var deleģēt fokusētus apakšuzdevumus svaigai savai kopijai.",
   "com_ui_agent_subagents_max": "Maksimums {{0}} apakšaģentu ir sasniegts.",
   "com_ui_agent_subagents_remove": "Noņemt {{0}} no apakšaģentiem",
   "com_ui_agent_url_copied": "Aģenta URL kopēts starpliktuvē",
-  "com_ui_agent_var": "{{0}} aģents",
+  "com_ui_agent_var": "{{0}} aģentu",
   "com_ui_agent_version": "Versija",
   "com_ui_agent_version_active": "Aktīvā versija",
   "com_ui_agent_version_empty": "Nav pieejamu versiju",
@@ -732,11 +741,11 @@
   "com_ui_agents_allow_share_public": "Atļaut koplietot aģentus publiski",
   "com_ui_agents_allow_use": "Atļaut aģentu izmantošanu",
   "com_ui_all": "visu",
+  "com_ui_all_projects": "Visi projekti",
   "com_ui_all_proper": "Visi",
   "com_ui_analyzing": "Analīze",
   "com_ui_analyzing_finished": "Analīze pabeigta",
   "com_ui_api_key": "API atslēga",
-  "com_ui_api_key_copied": "API atslēga kopēta starpliktuvē",
   "com_ui_api_key_create_error": "Neizdevās izveidot API atslēgu",
   "com_ui_api_key_created": "API atslēga veiksmīgi saglabāta",
   "com_ui_api_key_delete_error": "Neizdevās izdzēst API atslēgu",
@@ -818,10 +827,13 @@
   "com_ui_branch_error": "Neizdevās izveidot atzaru",
   "com_ui_branch_message": "Izveidot atzaru no šīs atbildes",
   "com_ui_by_author": "līdz {{0}}",
+  "com_ui_cache_read": "Kešatmiņa lasīta",
+  "com_ui_cache_write": "Rakstīšana kešatmiņā",
   "com_ui_callback_url": "Atzvanīšanas URL",
   "com_ui_cancel": "Atcelt",
   "com_ui_cancelled": "Atcelts",
   "com_ui_category": "Kategorija",
+  "com_ui_change_project": "Mainīt projektu",
   "com_ui_change_version": "Mainīt versiju",
   "com_ui_chat": "Saruna",
   "com_ui_chat_history": "Sarunu vēsture",
@@ -862,7 +874,27 @@
   "com_ui_connecting": "Savienojas",
   "com_ui_contact_admin_if_issue_persists": "Sazinieties ar administratoru, ja problēma turpina pastāvēt",
   "com_ui_context": "Konteksts",
+  "com_ui_context_cost": "Izmaksa",
+  "com_ui_context_cost_branch": "Izmaksa (šis zars)",
+  "com_ui_context_cost_total": "Visi zari",
   "com_ui_context_filter_sort": "Filtrēšana un šķirošana pēc konteksta",
+  "com_ui_context_free": "Brīva vieta",
+  "com_ui_context_messages": "Ziņas",
+  "com_ui_context_subagents": "Apakšagenti",
+  "com_ui_context_summary": "Kopsavilkums",
+  "com_ui_context_system": "Sistēmas uzvedne",
+  "com_ui_context_tools": "Rīku shēmas",
+  "com_ui_context_tools_mcp": "MCP rīki",
+  "com_ui_context_tools_mcp_deferred": "MCP rīki (atliktie)",
+  "com_ui_context_tools_system": "Sistēmas rīki",
+  "com_ui_context_tools_system_deferred": "Sistēmas rīki (atliktie)",
+  "com_ui_context_unknown": "Konteksta izmērs nav zināms",
+  "com_ui_context_usage": "Konteksta lietojums",
+  "com_ui_context_usage_label": "Konteksta logs: {{0}} no {{1}} izmantotie tokeni ({{2}}%)",
+  "com_ui_context_usage_label_unknown": "Konteksta lietojums: {{0}} tokeni izmantoti",
+  "com_ui_context_usage_snapshot": "Konteksts {{0}} / {{1}} ({{2}}%)",
+  "com_ui_context_usage_snapshot_unknown": "Konteksts {{0}}",
+  "com_ui_context_window": "Konteksta logs",
   "com_ui_continue": "Turpināt",
   "com_ui_continue_oauth": "Turpināt ar OAuth",
   "com_ui_control_bar": "Vadības josla",
@@ -892,13 +924,16 @@
   "com_ui_create_mcp_server": "Izveidot MCP serveri",
   "com_ui_create_memory": "Izveidot atmiņu",
   "com_ui_create_new_agent": "Izveidot jaunu aģentu",
+  "com_ui_create_project": "Izveidot projektu",
   "com_ui_create_prompt": "Izveidot uzvedni",
   "com_ui_create_prompt_page": "Jauna uzvedņu konfigurācijas lapa",
   "com_ui_create_skill": "Izveidot prasmi",
   "com_ui_create_skill_upload": "Augšupielādēt SKILL.md",
   "com_ui_create_skill_upload_error": "Neizdevās nolasīt augšupielādēto failu",
   "com_ui_created": "Izveidots",
+  "com_ui_created_file": "Izveidots {{0}}",
   "com_ui_creating": "Notiek izveide...",
+  "com_ui_creating_file": "Izveido {{0}}",
   "com_ui_creating_image": "Attēla izveide. Var aizņemt brīdi.",
   "com_ui_current": "Pašreizējais",
   "com_ui_currently_production": "Pašlaik produkcijā",
@@ -943,6 +978,8 @@
   "com_ui_delete_memory": "Dzēst atmiņu",
   "com_ui_delete_not_allowed": "Dzēšanas darbība nav atļauta",
   "com_ui_delete_preset": "Vai dzēst iestatījumu?",
+  "com_ui_delete_project": "Vai dzēst projektu?",
+  "com_ui_delete_project_confirm": "Dzēst \"{{name}}\"? Iekšā esošās sarunas netiks dzēstas.",
   "com_ui_delete_prompt": "Vai dzēst uzvedni?",
   "com_ui_delete_shared_link": "Vai dzēst kopīgoto saiti?",
   "com_ui_delete_shared_link_heading": "Dzēst koplietoto saiti",
@@ -984,6 +1021,8 @@
   "com_ui_edit_prompt_page": "Rediģēt uzvedņu lapu",
   "com_ui_edit_skill": "Rediģēt prasmi",
   "com_ui_editable_message": "Rediģējams ziņojums",
+  "com_ui_edited_file": "Rediģēts {{0}}",
+  "com_ui_editing_file": "Rediģē {{0}}",
   "com_ui_editor_instructions": "Velciet attēlu, lai mainītu tā atrašanās vietu - Izmantojiet tālummaiņas slīdni vai pogas, lai pielāgotu izmēru.",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Galapunkts",
@@ -1002,6 +1041,7 @@
   "com_ui_error_try_following_prefix": "Lūdzu, izmēģiniet kādu no šīm iespējām",
   "com_ui_error_unexpected": "Ak! Notika kaut kas neparedzēts",
   "com_ui_error_updating_preferences": "Kļūda, atjauninot preferences",
+  "com_ui_estimated": "Aprēķināts no ziņojumu vēstures",
   "com_ui_everyone_permission_level": "Visu lietotāju atļaujas līmenis",
   "com_ui_examples": "Piemēri",
   "com_ui_expand": "Izvērst",
@@ -1038,6 +1078,7 @@
   "com_ui_file_token_limit": "Failu tokenu ierobežojums",
   "com_ui_file_token_limit_desc": "Iestatiet maksimālo tokenu ierobežojumu failu apstrādei, lai kontrolētu izmaksas un resursu izmantošanu",
   "com_ui_files": "Faili",
+  "com_ui_files_count_size": "{{0}} Faili ({{1}}KB)",
   "com_ui_filter_mcp_servers": "MCP serveru filtrēšana pēc nosaukuma",
   "com_ui_filter_prompts": "Filtrēt uzvednes",
   "com_ui_filter_prompts_name": "Filtrēt uzvednes pēc nosaukuma",
@@ -1088,7 +1129,7 @@
   "com_ui_hide": "Paslēpt",
   "com_ui_hide_code": "Slēpt kodu",
   "com_ui_hide_image_details": "Slēpt attēla detaļas",
-  "com_ui_hide_password": "Paslēpt paroli",
+  "com_ui_hide_n_files": "Paslēpt {{0}} Failus",
   "com_ui_hide_qr": "Slēpt QR kodu",
   "com_ui_high": "Augsts",
   "com_ui_host": "Serveris",
@@ -1121,9 +1162,9 @@
   "com_ui_key": "Atslēga",
   "com_ui_key_required": "Nepieciešama API atslēga",
   "com_ui_labels": "Etiķetes",
-  "com_ui_last_used": "Pēdējais izmantotais",
   "com_ui_late_night": "Priecīgu vēlu nakti",
   "com_ui_latest": "jaunākais",
+  "com_ui_latest_activity": "Pēdējā aktivitāte",
   "com_ui_latest_footer": "Mākslīgais intelekts ikvienam.",
   "com_ui_latest_version": "Jaunākā versija",
   "com_ui_leave_blank_to_keep": "Atstājiet tukšu, lai saglabātu esošo",
@@ -1133,6 +1174,7 @@
   "com_ui_link_copied": "Saite nokopēta",
   "com_ui_link_refreshed": "Saites atsvaidzināta",
   "com_ui_live": "aktuālais",
+  "com_ui_load_more": "Ielādēt vairāk",
   "com_ui_loading": "Notiek ielāde...",
   "com_ui_locked": "Bloķēts",
   "com_ui_logo": "{{0}} Logotips",
@@ -1179,6 +1221,7 @@
   "com_ui_mcp_server_updated": "MCP serveris veiksmīgi atjaunināts",
   "com_ui_mcp_server_url_placeholder": "https://mcp.piemers.lv",
   "com_ui_mcp_servers": "MCP serveri",
+  "com_ui_mcp_servers_allow_configure_obo": "Ļaut lietotājiem konfigurēt On-Behalf-Of (OBO) MCP serveros",
   "com_ui_mcp_servers_allow_create": "Atļaut lietotājiem izveidot MCP serverus",
   "com_ui_mcp_servers_allow_share": "Atļaut lietotājiem koplietot MCP serverus",
   "com_ui_mcp_servers_allow_share_public": "Ļaujiet lietotājiem publiski koplietot MCP serverus",
@@ -1233,19 +1276,23 @@
   "com_ui_model_parameters_reset": "Modeļa parametri ir atiestatīti.",
   "com_ui_model_selected": "{{0}} atlasīts",
   "com_ui_model_spec": "Modeļa specifikācija",
+  "com_ui_more_count": "{{0}} vairāk",
   "com_ui_more_info": "Vairāk informācijas",
+  "com_ui_more_options": "Vairāk opciju",
   "com_ui_my_prompts": "Manas uzvednes",
   "com_ui_my_skills": "Manas prasmes",
+  "com_ui_n_files": "{{0}} faili",
   "com_ui_name": "Vārds",
   "com_ui_name_sort": "Kārtot pēc nosaukuma",
   "com_ui_navigate_results": "Pārskatīt rezultātus",
   "com_ui_new": "Jauns",
   "com_ui_new_chat": "Jauna saruna",
+  "com_ui_new_chat_in_project": "Jauna saruna iekš {{name}}",
   "com_ui_new_conversation_title": "Jaunas sarunas nosaukums",
+  "com_ui_new_project": "Jauns projekts",
   "com_ui_next": "Nākamais",
   "com_ui_next_result": "Nākamais rezultāts",
   "com_ui_no": "Nē",
-  "com_ui_no_api_keys": "Vēl nav API atslēgu. Izveidojiet vienu, lai sāktu.",
   "com_ui_no_auth": "Nav autorizācijas",
   "com_ui_no_bookmarks": "Šķiet, ka jums vēl nav grāmatzīmju. Noklikšķiniet uz sarunas un pievienojiet jaunu.",
   "com_ui_no_bookmarks_match": "Nav atbilstošu grāmatzīmju meklēšanas vaicājumam",
@@ -1260,7 +1307,8 @@
   "com_ui_no_memories": "Nav atmiņu. Izveidojiet tās manuāli vai palūdziet mākslīgajam intelektam kaut ko atcerēties.",
   "com_ui_no_memories_match": "Nav atmiņu, kas atbilstu jūsu meklēšanas vaicājumam",
   "com_ui_no_memories_title": "Vēl nav atmiņu",
-  "com_ui_no_personalization_available": "Pašlaik nav pieejamas personalizācijas opcijas",
+  "com_ui_no_project_chats": "Vēl nav sarunu",
+  "com_ui_no_projects": "Vēl nav projektu",
   "com_ui_no_prompts_title": "Vēl nav uzvedņu",
   "com_ui_no_read_access": "Jums nav atļaujas skatīt atmiņas",
   "com_ui_no_results_found": "Nav atrastu rezultātu",
@@ -1279,12 +1327,17 @@
   "com_ui_oauth_error_title": "Autentifikācija neizdevās",
   "com_ui_oauth_success_description": "Jūsu autentifikācija bija veiksmīga. Šis logs aizvērsies pēc",
   "com_ui_oauth_success_title": "Autentifikācija veiksmīga",
+  "com_ui_obo": "On-Behalf-Of (OBO)",
+  "com_ui_obo_readonly_no_permission": "OBO ir konfigurēts šim serverim, bet jūsu lomai vairs nav atļaujas to modificēt. Sazinieties ar administratoru, lai veiktu izmaiņas.",
+  "com_ui_obo_scopes": "OBO darbības jomas",
+  "com_ui_obo_scopes_description": "Jomas, kas jāpieprasa lejupstraumes MCP serverim, izmantojot On-Behalf-Of plūsmu. Nepieciešama OpenID Connect autentifikācija (piemēram, Entra ID).",
   "com_ui_of": "no",
   "com_ui_off": "Izslēgts",
   "com_ui_offline": "Bezsaistē",
   "com_ui_omitted": "Izlaists",
   "com_ui_on": "Ieslēgts",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (atveras jaunā cilnē)",
+  "com_ui_open_project": "Atvērt projektu",
   "com_ui_open_source_chat_new_tab": "Atvērtā koda saruna jaunā cilnē",
   "com_ui_open_source_chat_new_tab_title": "Atvērtā koda saruna jaunā cilnē - {{title}}",
   "com_ui_open_var": "Atvērt {{0}}",
@@ -1304,6 +1357,7 @@
   "com_ui_permissions_failed_update": "Neizdevās atjaunināt pieejas tiesības. Lūdzu, mēģiniet vēlreiz.",
   "com_ui_permissions_updated_success": "Pieejas tiesības ir veiksmīgi atjauninātas.",
   "com_ui_pin": "Piespraust",
+  "com_ui_plus_n_more": "+{{0}} vairāk",
   "com_ui_preferences_updated": "Preferences veiksmīgi atjauninātas",
   "com_ui_prev": "Iepriekšējais",
   "com_ui_prev_result": "Iepriekšējais rezultāts",
@@ -1314,6 +1368,17 @@
   "com_ui_privacy_policy": "Privātuma politika",
   "com_ui_privacy_policy_url": "Privātuma politika web adrese",
   "com_ui_production": "Produkcija",
+  "com_ui_project_chat_count": "{{count}} sarunas",
+  "com_ui_project_chat_count_single": "1 saruna",
+  "com_ui_project_create_error": "Neizdevās izveidot projektu",
+  "com_ui_project_delete_error": "Neizdevās dzēst projektu",
+  "com_ui_project_name": "Projekta nosaukums",
+  "com_ui_project_name_placeholder": "Jauns projekts",
+  "com_ui_project_not_found": "Projekts nav atrasts",
+  "com_ui_project_rename_error": "Neizdevās pārdēvēt projektu",
+  "com_ui_project_update_error": "Neizdevās atjaunināt projekta uzdevumu",
+  "com_ui_project_updated": "Projekta uzdevums atjaunināts",
+  "com_ui_projects": "Projekti",
   "com_ui_prompt": "Uzvedne",
   "com_ui_prompt_category_selector_aria": "Uzvednes kategorijas atlasītājs",
   "com_ui_prompt_delete_confirm": "Vai esat pārliecināts, ka vēlaties dzēst '{{0}}' uzvedni?",
@@ -1370,11 +1435,13 @@
   "com_ui_remote_agents_allow_share_public": "Atļaut lietotājiem piešķirt API piekļuvi aģentiem visiem lietotājiem",
   "com_ui_remote_agents_allow_use": "Atļaut lietotājiem attālināti izveidot API atslēgas un vaicājumu aģentus",
   "com_ui_remove_agent_from_chain": "Noņemt {{0}} no ķēdes",
+  "com_ui_remove_from_project": "Izņemt no projekta",
   "com_ui_remove_skill_var": "Noņemt {{0}}",
   "com_ui_remove_user": "Noņemt {{0}}",
   "com_ui_rename": "Pārdēvēt",
   "com_ui_rename_conversation": "Pārdēvēt sarunu",
   "com_ui_rename_failed": "Neizdevās pārdēvēt sarunu",
+  "com_ui_rename_project": "Pārdēvēt projektu",
   "com_ui_requires_auth": "Nepieciešama autentifikācija",
   "com_ui_reset": "Attiestatīt",
   "com_ui_reset_adjustments": "Atiestatīt korekcijas",
@@ -1431,6 +1498,7 @@
   "com_ui_search_agent_category": "Meklēt kategorijas...",
   "com_ui_search_default_placeholder": "Meklēt pēc vārda vai e-pasta adreses (vismaz 2 rakstu zīmes)",
   "com_ui_search_people_placeholder": "Meklēt personas vai grupas pēc vārda vai e-pasta adreses",
+  "com_ui_search_projects": "Meklēt projektus",
   "com_ui_search_result_count": "{{count}} atrasts rezultāts",
   "com_ui_search_results_count": "{{count}} Atrastie rezultāti",
   "com_ui_search_skills": "Meklēt prasmes...",
@@ -1444,6 +1512,7 @@
   "com_ui_select_model": "Izvēlieties modeli",
   "com_ui_select_options": "Izvēlieties opcijas...",
   "com_ui_select_or_create_prompt": "Izvēlieties vai izveidot uzvedni",
+  "com_ui_select_project": "Izvēlēties projektu",
   "com_ui_select_provider": "Izvēlieties pakalpojumu sniedzēju",
   "com_ui_select_provider_first": "Vispirms izvēlieties pakalpojumu sniedzēju",
   "com_ui_select_region": "Izvēlieties reģionu",
@@ -1462,7 +1531,9 @@
   "com_ui_share_qr_code_description": "QR kods šīs sarunas saites kopīgošanai",
   "com_ui_share_update_message": "Jūsu vārds, pielāgotie norādījumi un visas ziņas, ko pievienojat pēc kopīgošanas, paliek privātas.",
   "com_ui_share_var": "Kopīgot {{0}}",
+  "com_ui_shared_link": "koplietota saite",
   "com_ui_shared_link_delete_success": "Kopīgotā saite ir veiksmīgi dzēsta.",
+  "com_ui_shared_link_manage_access": "Pārvaldīt piekļuvi",
   "com_ui_shared_link_not_found": "Kopīgotā saite nav atrasta",
   "com_ui_shared_prompts": "Kopīgotas uzvednes",
   "com_ui_shop": "Iepirkšanās",
@@ -1472,10 +1543,9 @@
   "com_ui_show_image_details": "Rādīt attēla detaļas",
   "com_ui_show_less": "Rādīt mazāk",
   "com_ui_show_more": "Rādīt vairāk",
-  "com_ui_show_password": "Rādīt paroli",
+  "com_ui_show_n_files": "Rādīt {{0}} failus",
   "com_ui_show_qr": "Rādīt QR kodu",
   "com_ui_sign_in_to_domain": "Pierakstīties {{0}}",
-  "com_ui_simple": "Uzstādījumi",
   "com_ui_size": "Izmērs",
   "com_ui_size_sort": "Atlasīt pēc izmēra",
   "com_ui_skill": "Prasme",
@@ -1516,6 +1586,7 @@
   "com_ui_skill_sr_public": "Publiskā prasme",
   "com_ui_skill_states_limit": "Jūs esat sasniedzis šādu ierobežojumu: {{0}} aktīva/neaktīva prasmju ignorēšana. Noņemiet dažas ignorēšanas iespējas, lai pārslēgtu jaunas prasmes.",
   "com_ui_skill_toggle_active": "Pārslēgt prasmju aktīvo stāvokli",
+  "com_ui_skill_unavailable": "Nepieejama prasme",
   "com_ui_skill_update_conflict": "Cits labojums tika saglabāts pirms jūsu. Jaunākās versijas atkārtota ielāde.",
   "com_ui_skill_update_error": "Neizdevās saglabāt prasmi",
   "com_ui_skill_updated": "Prasme saglabāta",
@@ -1523,8 +1594,10 @@
   "com_ui_skill_upload_drag": "Velciet un nometiet vai noklikšķiniet, lai augšupielādētu",
   "com_ui_skill_upload_file": "Augšupielādēt Failu",
   "com_ui_skill_upload_req_md": ".md failā jābūt prasmes nosaukumam un aprakstam, kas formatēts YAML",
+  "com_ui_skill_upload_req_size": "Faila lielums nedrīkst pārsniegt {{0}} MB",
   "com_ui_skill_upload_req_zip": ".zip vai .skill failā jābūt SKILL.md failam",
   "com_ui_skill_upload_requirements": "Failu prasības",
+  "com_ui_skill_upload_size_error": "Prasmju imports nedrīkst pārsniegt {{0}} MB",
   "com_ui_skill_upload_title": "Augšupielādes prasme",
   "com_ui_skill_version": "v{{0}}",
   "com_ui_skill_view_rendered": "Skatīt atveidoto",
@@ -1547,6 +1620,11 @@
   "com_ui_skills_load_error": "Neizdevās ielādēt prasmes",
   "com_ui_skills_manual_invoked": "Manuāli izsauktas prasmes",
   "com_ui_skills_queued": "Prasmes, kas ierindotas nākamajai iesniegšanai",
+  "com_ui_sort_by": "Kārtot pēc",
+  "com_ui_sort_chats_by": "Kārtot sarunas pēc",
+  "com_ui_sort_created": "Izveidots",
+  "com_ui_sort_projects_by": "Kārtot projektus pēc",
+  "com_ui_sort_updated": "Atjaunināts",
   "com_ui_special": "īpašs",
   "com_ui_special_var_current_date": "Pašreizējais datums",
   "com_ui_special_var_current_datetime": "Pašreizējais datums un laiks",
@@ -1627,6 +1705,7 @@
   "com_ui_unarchive": "Atarhivēt",
   "com_ui_unarchive_conversation": "Atarhivēt sarunu",
   "com_ui_unarchive_error": "Neizdevās atarhivēt sarunu",
+  "com_ui_unassigned": "Nav piešķirts",
   "com_ui_unavailable": "Nav pieejams",
   "com_ui_unfavorite": "Noņemt no izlases",
   "com_ui_unknown": "Nezināms",
@@ -1636,11 +1715,13 @@
   "com_ui_untitled": "Bez nosaukuma",
   "com_ui_update": "Atjauninājums",
   "com_ui_update_mcp_server": "Atjaunināt MCP serveri",
+  "com_ui_updated_file": "Atjaunināts {{0}}",
   "com_ui_updating": "Atjaunina...",
   "com_ui_upload": "Augšupielādēt",
   "com_ui_upload_agent_avatar": "Aģenta avatars veiksmīgi atjaunināts",
   "com_ui_upload_agent_avatar_label": "Augšupielādēt aģenta avatāra attēlu",
   "com_ui_upload_avatar_label": "Augšupielādēt avatāra attēlu",
+  "com_ui_upload_code_environment": "Augšupielādēt Code vidē",
   "com_ui_upload_delay": "Augšupielāde \"{{0}}\" aizņem vairāk laika nekā paredzēts. Lūdzu, uzgaidiet, kamēr faila indeksēšana ir pabeigta izguvei.",
   "com_ui_upload_error": "Augšupielādējot failu, radās kļūda.",
   "com_ui_upload_file_context": "Augšupielādēt failu kā kontekstu",
@@ -1715,6 +1796,7 @@
   "com_ui_yes": "Jā",
   "com_ui_you": "Tu",
   "com_ui_your_api_key": "Tava API atslēga",
+  "com_ui_your_projects": "Jūsu projekti",
   "com_ui_zoom": "Tālummaiņa",
   "com_ui_zoom_in": "Pietuvināt",
   "com_ui_zoom_level": "Pietuvināšanas līmenis",
diff --git a/client/src/locales/nb/translation.json b/client/src/locales/nb/translation.json
index e02b8dc6a1b..70509c0c18d 100644
--- a/client/src/locales/nb/translation.json
+++ b/client/src/locales/nb/translation.json
@@ -425,8 +425,6 @@
   "com_nav_browser": "Nettleser",
   "com_nav_center_chat_input": "Sentrer samtaleinndata på velkomstskjermen",
   "com_nav_change_picture": "Endre bilde",
-  "com_nav_chat_commands": "Samtalekommandoer",
-  "com_nav_chat_commands_info": "Disse kommandoene aktiveres ved å skrive bestemte tegn i begynnelsen av meldingen din. Hver kommando utløses av sitt angitte prefiks. Du kan deaktivere dem hvis du ofte bruker disse tegnene til å starte meldinger.",
   "com_nav_chat_direction": "Samtaleretning",
   "com_nav_chat_direction_selected": "Chat retning: {{direction}}",
   "com_nav_clear_all_chats": "Fjern alle samtaler",
@@ -434,7 +432,6 @@
   "com_nav_clear_conversation": "Fjern samtaler",
   "com_nav_clear_conversation_confirm_message": "Er du sikker på at du vil fjerne alle samtaler? Dette kan ikke angres.",
   "com_nav_close_sidebar": "Lukk sidefelt",
-  "com_nav_commands": "Kommandoer",
   "com_nav_confirm_clear": "Bekreft fjerning",
   "com_nav_control_panel": "Kontrollpanel",
   "com_nav_conversation_mode": "Samtalemodus",
@@ -560,13 +557,10 @@
   "com_nav_search_placeholder": "Søk i meldinger",
   "com_nav_send_message": "Send melding",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Samtale",
-  "com_nav_setting_data": "Datakontroll",
   "com_nav_setting_delay": "Forsinkelse (s)",
   "com_nav_setting_general": "Generelt",
   "com_nav_setting_mcp": "MCP-innstillinger",
-  "com_nav_setting_personalization": "Personalisering",
   "com_nav_setting_speech": "Tale",
   "com_nav_settings": "Innstillinger",
   "com_nav_shared_links": "Delte lenker",
@@ -649,7 +643,6 @@
   "com_ui_advanced_settings": "Avanserte innstillinger",
   "com_ui_agent": "Agent",
   "com_ui_agent_api_keys": "Agent API-nøkler",
-  "com_ui_agent_api_keys_description": "Lag API-nøkler for å få tilgang til agenter via API",
   "com_ui_agent_category_aftersales": "Ettersalg",
   "com_ui_agent_category_finance": "Finans",
   "com_ui_agent_category_general": "Generelt",
@@ -704,7 +697,6 @@
   "com_ui_analyzing": "Analyserer",
   "com_ui_analyzing_finished": "Ferdig med å analysere",
   "com_ui_api_key": "API-nøkkel",
-  "com_ui_api_key_copied": "API-nøkler kopiert til utklippstavlen",
   "com_ui_api_key_create_error": "Kunne ikke lage API-nøkkel",
   "com_ui_api_key_created": "Oppretting av API-nøkkel vellykket",
   "com_ui_api_key_delete_error": "Kunne ikke slette API-nøkkel",
@@ -847,7 +839,7 @@
   "com_ui_create_link": "Opprett lenke",
   "com_ui_create_mcp_server": "Lag MCP-server",
   "com_ui_create_memory": "Opprett minne",
-  "com_ui_create_new_agent": "L",
+  "com_ui_create_new_agent": "Lag ny agent",
   "com_ui_create_prompt": "Opprett prompt",
   "com_ui_create_prompt_page": "ag ",
   "com_ui_created": "Opprettet",
@@ -1029,7 +1021,6 @@
   "com_ui_hide": "Skjul",
   "com_ui_hide_code": "Skjul kode",
   "com_ui_hide_image_details": "Skjul bildedetaljer",
-  "com_ui_hide_password": "Skjul passord",
   "com_ui_hide_qr": "Skjul QR-kode",
   "com_ui_high": "Høy",
   "com_ui_host": "Vert",
@@ -1052,7 +1043,6 @@
   "com_ui_instructions": "Instruksjoner",
   "com_ui_key": "Nøkkel",
   "com_ui_key_required": "API-nøkkel påkrevd",
-  "com_ui_last_used": "Sist brukt",
   "com_ui_late_night": "God senkveld",
   "com_ui_latest_footer": "Én KI for alle.",
   "com_ui_latest_version": "Siste versjon",
@@ -1123,7 +1113,6 @@
   "com_ui_no_category": "Ingen kategori",
   "com_ui_no_changes": "Ingen endringer ble utført",
   "com_ui_no_individual_access": "Ingen enkeltbrukere eller grupper har tilgang til denne agenten.",
-  "com_ui_no_personalization_available": "Ingen personaliseringsalternativer er tilgjengelige for øyeblikket.",
   "com_ui_no_read_access": "Du har ikke tillatelse til å se minner.",
   "com_ui_no_results_found": "Ingen resultater funnet.",
   "com_ui_no_terms_content": "Ikke noe innhold for vilkår og betingelser å vise.",
@@ -1257,10 +1246,8 @@
   "com_ui_shop": "Shopping",
   "com_ui_show_all": "Vis alle",
   "com_ui_show_image_details": "Vis bildedetaljer",
-  "com_ui_show_password": "Vis passord",
   "com_ui_show_qr": "Vis QR-kode",
   "com_ui_sign_in_to_domain": "Logg inn på {{0}}",
-  "com_ui_simple": "Enkel",
   "com_ui_size": "Størrelse",
   "com_ui_special_var_current_date": "Gjeldende dato",
   "com_ui_special_var_current_datetime": "Gjeldende dato og tid",
diff --git a/client/src/locales/nl/translation.json b/client/src/locales/nl/translation.json
index 94491523bba..ad04886cdb7 100644
--- a/client/src/locales/nl/translation.json
+++ b/client/src/locales/nl/translation.json
@@ -383,7 +383,6 @@
   "com_nav_plugin_auth_error": "Er trad een fout op bij het authenticeren van deze plugin. Probeer het opnieuw.",
   "com_nav_search_placeholder": "Berichten doorzoeken",
   "com_nav_send_message": "Bericht verzenden",
-  "com_nav_setting_data": "Gegevensbesturing",
   "com_nav_setting_delay": "Vertraging (s)",
   "com_nav_setting_general": "Algemeen",
   "com_nav_settings": "Instellingen",
@@ -638,10 +637,8 @@
   "com_ui_shop": "Winkelen",
   "com_ui_show_all": "Alles Weergeven",
   "com_ui_show_image_details": "Afbeeldingsdetails Weergeven",
-  "com_ui_show_password": "Wachtwoord weergeven",
   "com_ui_show_qr": "QR Code Weergeven",
   "com_ui_sign_in_to_domain": "Inloggen op {{0}}",
-  "com_ui_simple": "Eenvoudig",
   "com_ui_size": "Grootte",
   "com_ui_special_var_current_date": "Huidige Datum",
   "com_ui_special_var_current_datetime": "Huidige Datum & Tijd",
diff --git a/client/src/locales/nn/translation.json b/client/src/locales/nn/translation.json
index f67b8a1780a..b49f3e42d62 100644
--- a/client/src/locales/nn/translation.json
+++ b/client/src/locales/nn/translation.json
@@ -440,8 +440,6 @@
   "com_nav_browser": "Nettlesar",
   "com_nav_center_chat_input": "Sentrer chat-inngang på velkomstskjermen",
   "com_nav_change_picture": "Endre bilde",
-  "com_nav_chat_commands": "Samtalekommandoar",
-  "com_nav_chat_commands_info": "Desse kommandoane blir aktiverte ved å skrive bestemte teikn i starten av meldinga di. Kvar kommando blir utløyst av det tildelte prefikset. Du kan deaktivere dei viss du ofte brukar desse teikna til å starte meldingar.",
   "com_nav_chat_direction": "Samtaleretning",
   "com_nav_chat_direction_selected": "Samtaleretning: {{retning}}",
   "com_nav_clear_all_chats": "Fjern alle samtalar",
@@ -449,7 +447,6 @@
   "com_nav_clear_conversation": "Fjern samtalar",
   "com_nav_clear_conversation_confirm_message": "Er du sikker på at du vil slette alle samtalar? Du kan ikkje angre slettinga.",
   "com_nav_close_sidebar": "Lukk sidefelt",
-  "com_nav_commands": "Kommandoar",
   "com_nav_confirm_clear": "Stadfest sletting",
   "com_nav_control_panel": "Kontrollpanel",
   "com_nav_conversation_mode": "Samtalemodus",
@@ -576,13 +573,10 @@
   "com_nav_search_placeholder": "Søk i meldingar",
   "com_nav_send_message": "Send melding",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Samtale",
-  "com_nav_setting_data": "Datakontroll",
   "com_nav_setting_delay": "Forseinking (s)",
   "com_nav_setting_general": "Generelt",
   "com_nav_setting_mcp": "MCP-innstillingar",
-  "com_nav_setting_personalization": "Personalisering",
   "com_nav_setting_speech": "Tale",
   "com_nav_settings": "Innstillingar",
   "com_nav_shared_links": "Delte lenker",
@@ -667,7 +661,6 @@
   "com_ui_advanced_settings": "Avanserte innstillingar",
   "com_ui_agent": "Agent",
   "com_ui_agent_api_keys": "API-nøklar for agent",
-  "com_ui_agent_api_keys_description": "Lag API-nøklar for å få tilgang til agentar via API",
   "com_ui_agent_category_aftersales": "Ettersal",
   "com_ui_agent_category_finance": "Finans",
   "com_ui_agent_category_general": "Generelt",
@@ -722,7 +715,6 @@
   "com_ui_analyzing": "Analyserer",
   "com_ui_analyzing_finished": "Ferdig med å analysere",
   "com_ui_api_key": "API-nøkkel",
-  "com_ui_api_key_copied": "API-nøkkelen er kopiert til utklippstavla",
   "com_ui_api_key_create_error": "Klarte ikkje lage API-nøkkel",
   "com_ui_api_key_created": "Oppretting av API-nøkkel var vellukka",
   "com_ui_api_key_delete_error": "Klarte ikkje slette API-nøkkel",
@@ -875,7 +867,7 @@
   "com_ui_create_link": "Opprett lenke",
   "com_ui_create_mcp_server": "Opprett MCP-server",
   "com_ui_create_memory": "Opprett minne",
-  "com_ui_create_new_agent": "L",
+  "com_ui_create_new_agent": "Lag ny agent",
   "com_ui_create_prompt": "Opprett prompt",
   "com_ui_create_prompt_page": "ag",
   "com_ui_created": "Oppretta",
@@ -1062,7 +1054,6 @@
   "com_ui_hide": "Skjul",
   "com_ui_hide_code": "Skjul kode",
   "com_ui_hide_image_details": "Skjul bildedetaljer",
-  "com_ui_hide_password": "Skjul passord",
   "com_ui_hide_qr": "Skjul QR-kode",
   "com_ui_high": "Høg",
   "com_ui_host": "Vert",
@@ -1087,7 +1078,6 @@
   "com_ui_key": "Nøkkel",
   "com_ui_key_required": "API-nøkkel påkravd",
   "com_ui_labels": "Etikettar",
-  "com_ui_last_used": "Sist brukt",
   "com_ui_late_night": "God seinkveld",
   "com_ui_latest": "siste",
   "com_ui_latest_footer": "Éin KI for alle.",
@@ -1203,7 +1193,6 @@
   "com_ui_next": "Neste",
   "com_ui_next_result": "Neste resultat",
   "com_ui_no": "Nei",
-  "com_ui_no_api_keys": "Ingen API-nøklar enno. Opprett ein for å kome i gang.",
   "com_ui_no_auth": "Ingen (automatisk oppdaging)",
   "com_ui_no_bookmarks": "Du har ingen bokmerke enno. Klikk på ei samtale og legg til eitt.",
   "com_ui_no_bookmarks_match": "Ingen bokmerke samsvarer med søket ditt",
@@ -1218,7 +1207,6 @@
   "com_ui_no_memories": "Ingen minne. Opprett dei manuelt eller be KI-en om å hugse noko",
   "com_ui_no_memories_match": "Ingen minne samsvarer med søket ditt",
   "com_ui_no_memories_title": "Ingen minne enno",
-  "com_ui_no_personalization_available": "Ingen personaliseringsalternativ er tilgjengelege akkurat no.",
   "com_ui_no_prompts_title": "Ingen promptar enno",
   "com_ui_no_read_access": "Du har ikkje tilgang til å sjå minne.",
   "com_ui_no_results_found": "Ingen resultat funne.",
@@ -1419,10 +1407,8 @@
   "com_ui_show_image_details": "Vis bildedetaljer",
   "com_ui_show_less": "Vis mindre",
   "com_ui_show_more": "Vis meir",
-  "com_ui_show_password": "Vis passord",
   "com_ui_show_qr": "Vis QR-kode",
   "com_ui_sign_in_to_domain": "Logg inn på {{0}}",
-  "com_ui_simple": "Enkel",
   "com_ui_size": "Storleik",
   "com_ui_size_sort": "Sorter etter storleik",
   "com_ui_special": "spesiell",
diff --git a/client/src/locales/pl/translation.json b/client/src/locales/pl/translation.json
index 338e58da713..3c331fd602d 100644
--- a/client/src/locales/pl/translation.json
+++ b/client/src/locales/pl/translation.json
@@ -74,7 +74,7 @@
   "com_agents_loading": "Ładowanie...",
   "com_agents_marketplace": "Agent Marketplace",
   "com_agents_marketplace_subtitle": "Odkrywaj i używaj potężnych agentów AI, aby ulepszyć swoje przepływy pracy i wydajność",
-  "com_agents_mcp_description_placeholder": "MCP pozwala na wyposażenie twojego agenta w niestandardowe narzędzia i funkcje poprzez integrację z serwerami MCP. Skonfiguruj niestandardowe zmienne dla każdego serwera, aby umożliwić agentowi korzystanie z tych narzędzi.",
+  "com_agents_mcp_description_placeholder": "Wyjaśnij, co to robi, w kilku słowach",
   "com_agents_mcp_icon_size": "Minimalny rozmiar: 128 x 128 px",
   "com_agents_mcp_name_placeholder": "Niestandardowe Narzędzie",
   "com_agents_mcp_trust_subtext": "Niestandardowe konektory MCP nie są weryfikowane przez LibreChat",
@@ -429,8 +429,6 @@
   "com_nav_browser": "Przeglądarka",
   "com_nav_center_chat_input": "Wyśrodkuj pole czatu na ekranie powitalnym",
   "com_nav_change_picture": "Zmień zdjęcie",
-  "com_nav_chat_commands": "Polecenia czatu",
-  "com_nav_chat_commands_info": "Te polecenia są aktywowane przez wpisanie określonych znaków na początku twojej wiadomości. Każde polecenie jest uruchamiane przez wyznaczony prefiks. Możesz je wyłączyć, jeśli często używasz tych znaków do rozpoczynania wiadomości.",
   "com_nav_chat_direction": "Kierunek czatu",
   "com_nav_chat_direction_selected": "Kierunek czatu: {{direction}}",
   "com_nav_clear_all_chats": "Usuń wszystkie konwersacje",
@@ -438,7 +436,6 @@
   "com_nav_clear_conversation": "Wyczyść rozmowę",
   "com_nav_clear_conversation_confirm_message": "Czy na pewno chcesz usunąć wszystkie konwersacje? Tej operacji nie można cofnąć.",
   "com_nav_close_sidebar": "Zamknij pasek boczny",
-  "com_nav_commands": "Polecenia",
   "com_nav_confirm_clear": "Potwierdź usunięcie",
   "com_nav_control_panel": "Panel Sterowania",
   "com_nav_conversation_mode": "Tryb konwersacji",
@@ -564,13 +561,10 @@
   "com_nav_search_placeholder": "Szukaj wiadomości",
   "com_nav_send_message": "Wyślij wiadomość",
   "com_nav_setting_account": "Konto",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Czat",
-  "com_nav_setting_data": "Kontrola danych",
   "com_nav_setting_delay": "Opóźnienie (s)",
   "com_nav_setting_general": "Ogólne",
   "com_nav_setting_mcp": "Ustawienia MCP",
-  "com_nav_setting_personalization": "Personalizacja",
   "com_nav_setting_speech": "Mowa",
   "com_nav_settings": "Ustawienia",
   "com_nav_shared_links": "Linki udostępnione",
@@ -653,7 +647,6 @@
   "com_ui_advanced_settings": "Ustawienia zaawansowane",
   "com_ui_agent": "Agent",
   "com_ui_agent_api_keys": "Klucze API agenta",
-  "com_ui_agent_api_keys_description": "Utwórz klucze API, aby uzyskać zdalny dostęp do agentów",
   "com_ui_agent_category_aftersales": "Obsługa posprzedażowa",
   "com_ui_agent_category_finance": "Finanse",
   "com_ui_agent_category_general": "Ogólne",
@@ -708,7 +701,6 @@
   "com_ui_analyzing": "Analizowanie",
   "com_ui_analyzing_finished": "Zakończono analizę",
   "com_ui_api_key": "Klucz API",
-  "com_ui_api_key_copied": "Skopiowano klucz API do schowka",
   "com_ui_api_key_create_error": "Nie udało się utworzyć klucza API",
   "com_ui_api_key_created": "Klucz API utworzony pomyślnie",
   "com_ui_api_key_delete_error": "Nie udało się usunąć klucza API",
@@ -1034,7 +1026,6 @@
   "com_ui_hide": "Ukryj",
   "com_ui_hide_code": "Ukryj kod",
   "com_ui_hide_image_details": "Ukryj szczegóły obrazu",
-  "com_ui_hide_password": "Ukryj hasło",
   "com_ui_hide_qr": "Ukryj kod QR",
   "com_ui_high": "Wysoki",
   "com_ui_host": "Host",
@@ -1057,7 +1048,6 @@
   "com_ui_instructions": "Instrukcje",
   "com_ui_key": "Klucz",
   "com_ui_key_required": "Klucz API jest wymagany",
-  "com_ui_last_used": "Ostatnio używane",
   "com_ui_late_night": "Dobrej nocy",
   "com_ui_latest_footer": "Każde AI. Dla każdego.",
   "com_ui_latest_version": "Najnowsza wersja",
@@ -1167,7 +1157,6 @@
   "com_ui_new_conversation_title": "Tytuł nowej rozmowy",
   "com_ui_next": "Następny",
   "com_ui_no": "Nie",
-  "com_ui_no_api_keys": "Brak kluczy API. Utwórz klucz, aby rozpocząć.",
   "com_ui_no_auth": "Brak (Auto-wykrywanie)",
   "com_ui_no_bookmarks": "Wygląda na to, że nie masz jeszcze żadnych zakładek. Kliknij na czat i dodaj nową",
   "com_ui_no_bookmarks_match": "Brak zakładek pasujących do wyszukiwania",
@@ -1181,7 +1170,6 @@
   "com_ui_no_memories": "Brak wspomnień. Utwórz je ręcznie lub poproś AI o zapamiętanie czegoś",
   "com_ui_no_memories_match": "Brak wspomnień pasujących do wyszukiwania",
   "com_ui_no_memories_title": "Brak wspomnień",
-  "com_ui_no_personalization_available": "Obecnie brak dostępnych opcji personalizacji",
   "com_ui_no_prompts_title": "Brak promptów",
   "com_ui_no_read_access": "Nie masz uprawnień do przeglądania wspomnień",
   "com_ui_no_results_found": "Nie znaleziono wyników",
@@ -1360,10 +1348,8 @@
   "com_ui_show_all": "Pokaż wszystko",
   "com_ui_show_code": "Pokaż Kod",
   "com_ui_show_image_details": "Pokaż Szczegóły Obrazu",
-  "com_ui_show_password": "Pokaż hasło",
   "com_ui_show_qr": "Pokaż kod QR",
   "com_ui_sign_in_to_domain": "Zaloguj się do {{0}}",
-  "com_ui_simple": "Prosty",
   "com_ui_size": "Rozmiar",
   "com_ui_size_sort": "Sortuj według rozmiaru",
   "com_ui_special_var_current_date": "Obecna data",
diff --git a/client/src/locales/pt-BR/translation.json b/client/src/locales/pt-BR/translation.json
index 863c27e5413..784d94ba094 100644
--- a/client/src/locales/pt-BR/translation.json
+++ b/client/src/locales/pt-BR/translation.json
@@ -2,13 +2,18 @@
   "chat_direction_left_to_right": "algo precisa ir aqui. Está vazio",
   "chat_direction_right_to_left": "algo precisa ir aqui. esta vazio",
   "com_a11y_ai_composing": "A IA ainda está compondo.",
+  "com_a11y_chats_date_section": "Chats de {{date}}",
   "com_a11y_end": "A IA terminou de responder.",
   "com_a11y_selected": "selecionado",
   "com_a11y_start": "A IA começou a responder.",
+  "com_a11y_summarize_completed": "Contexto resumido.",
+  "com_a11y_summarize_failed": "Falha no resumo, continuando com o contexto disponível.",
+  "com_a11y_summarize_started": "Resumindo o contexto.",
   "com_agents_agent_card_label": "Agente {{name}}. {{description}}",
   "com_agents_all": "Todos os Agentes",
   "com_agents_all_category": "Todos",
   "com_agents_all_description": "Navegar por todos os agentes compartilhados em todas as categorias",
+  "com_agents_avatar_upload_error": "Falha ao enviar o avatar do agente",
   "com_agents_category_aftersales": "Pós-vendas",
   "com_agents_category_aftersales_description": "Agentes especializados em atendimento pós-venda, manutenção e atendimento ao cliente",
   "com_agents_category_empty": "Não foram encontrados agentes na categoria {{category}}",
@@ -26,11 +31,13 @@
   "com_agents_category_sales_description": "Agentes focados em processos de vendas, relações com o cliente",
   "com_agents_category_tab_label": "Categoria {{category}}, {{position}} de {{total}}",
   "com_agents_category_tabs_label": "Categorias de Agentes",
+  "com_agents_chat_with": "Conversar com {{name}}",
   "com_agents_clear_search": "Limpar pesquisa",
   "com_agents_contact": "Contato",
   "com_agents_copy_link": "Copiar link",
   "com_agents_create_error": "Houve um erro ao criar seu agente.",
   "com_agents_created_by": "por",
+  "com_agents_description_card": "Descrição: {{description}}",
   "com_agents_description_placeholder": "Opcional: Descreva seu Agente aqui",
   "com_agents_empty_state_heading": "Nenhum agente encontrado",
   "com_agents_enable_file_search": "Permitir Pesquisa de Ficheiros",
@@ -57,7 +64,9 @@
   "com_agents_error_timeout_suggestion": "Por favor verifique sua conexão com a internet e tente novamente.",
   "com_agents_error_timeout_title": "A conexão expirou",
   "com_agents_error_title": "Algo deu errado",
+  "com_agents_file_context_description": "Arquivos enviados como \"Contexto\" são processados como texto para complementar as instruções do agente. Se OCR estiver disponível, ou se estiver configurado para o tipo de arquivo enviado, o processo será usado para extrair texto. Ideal para documentos, imagens com texto ou PDFs em que você precisa do conteúdo textual completo de um arquivo",
   "com_agents_file_context_disabled": "O agente deve ser criado antes de carregar arquivos para o Contexto de Arquivo.",
+  "com_agents_file_context_label": "Contexto do arquivo",
   "com_agents_file_search_disabled": "O agente deve ser criado antes de carregar arquivos para Pesquisa de Arquivos.",
   "com_agents_file_search_info": "Quando ativado, o agente será informado dos nomes exatos dos arquivos listados abaixo, permitindo que ele recupere o contexto relevante desses arquivos.",
   "com_agents_grid_announcement": "Mostrando {{count}} agentes na categoria {{category}}",
@@ -133,6 +142,7 @@
   "com_assistants_update_actions_success": "Ação criada ou atualizada com sucesso",
   "com_assistants_update_error": "Houve um erro ao atualizar seu assistente.",
   "com_assistants_update_success": "Atualizado com sucesso",
+  "com_assistants_update_success_name": "{{name}} atualizado com sucesso",
   "com_auth_already_have_account": "Já tem uma conta?",
   "com_auth_apple_login": "Iniciar sessão com a Apple",
   "com_auth_back_to_login": "Voltar para Login",
@@ -210,17 +220,21 @@
   "com_endpoint_agent": "Agente",
   "com_endpoint_agent_placeholder": "Selecione um agente",
   "com_endpoint_ai": "AI",
+  "com_endpoint_anthropic_effort": "Controla quanto esforço computacional Claude aplica. Esforço menor economiza tokens e reduz a latência; esforço maior produz respostas mais completas. 'Max' ativa o raciocínio mais profundo (somente Opus 4.6).",
   "com_endpoint_anthropic_maxoutputtokens": "Número máximo de tokens que podem ser gerados na resposta. Especifique um valor mais baixo para respostas mais curtas e um valor mais alto para respostas mais longas. Nota: os modelos podem parar antes de atingir esse máximo.",
   "com_endpoint_anthropic_prompt_cache": "O cache de prompt permite reutilizar um grande contexto ou instruções em chamadas de API, reduzindo custos e latência",
   "com_endpoint_anthropic_temp": "Varia de 0 a 1. Use temperatura mais próxima de 0 para tarefas analíticas / de múltipla escolha, e mais próxima de 1 para tarefas criativas e generativas. Recomendamos alterar isso ou Top P, mas não ambos.",
   "com_endpoint_anthropic_thinking": "Permite o raciocínio interno para os modelos Claude suportados (3.7 Sonnet). Nota: requer que o \"Orçamento de raciocínio\" esteja definido e seja inferior ao \"Máximo de tokens de saída\"",
   "com_endpoint_anthropic_thinking_budget": "Determina o número máximo de tokens que o Claude pode utilizar para o seu processo de raciocínio interno. Orçamentos maiores podem melhorar a qualidade da resposta, permitindo uma análise mais completa para problemas complexos, embora o Claude possa não usar todo o orçamento alocado, especialmente em intervalos acima de 32K. Essa configuração deve ser menor que \"Máximo de tokens de saída\".",
+  "com_endpoint_anthropic_thinking_display": "Visibilidade do raciocínio",
+  "com_endpoint_anthropic_thinking_display_desc": "Controla se o raciocínio de Claude é retornado. 'Auto' ativa raciocínios resumidos para modelos que os ocultam por padrão (Opus 4.7+); 'Resumido' sempre os mostra; 'Omitido' sempre os oculta para uma latência um pouco menor.",
   "com_endpoint_anthropic_topk": "Top-k altera como o modelo seleciona tokens para saída. Um top-k de 1 significa que o token selecionado é o mais provável entre todos os tokens no vocabulário do modelo (também chamado de decodificação gananciosa), enquanto um top-k de 3 significa que o próximo token é selecionado entre os 3 tokens mais prováveis (usando temperatura).",
   "com_endpoint_anthropic_topp": "Top-p altera como o modelo seleciona tokens para saída. Os tokens são selecionados dos mais prováveis (veja o parâmetro topK) até os menos prováveis até que a soma de suas probabilidades atinja o valor top-p.",
   "com_endpoint_anthropic_use_web_search": "Habilita a funcionalidade de pesquisa na web usando o recurso integrado da Anthropic. Isso permite que o modelo pesquise informações atualizadas na web e forneça respostas mais precisas e atuais.",
   "com_endpoint_assistant": "Assistente",
   "com_endpoint_assistant_model": "Modelo de Assistente",
   "com_endpoint_assistant_placeholder": "Por favor, selecione um Assistente no Painel Lateral Direito",
+  "com_endpoint_bedrock_reasoning_effort": "Controla o nível de raciocínio para modelos Bedrock suportados (por exemplo, Kimi K2.5, GLM). Níveis mais altos produzem um raciocínio mais completo ao custo de maior latência e tokens.",
   "com_endpoint_config_click_here": "Clique Aqui",
   "com_endpoint_config_google_api_info": "Para obter sua chave API de Linguagem Generativa (para Gemini),",
   "com_endpoint_config_google_api_key": "Chave API do Google",
@@ -251,6 +265,7 @@
   "com_endpoint_default_with_num": "padrão: {{0}}",
   "com_endpoint_disable_streaming": "Desativar o streaming de respostas e receber a resposta de uma vez. Útil para modelos como o GPT-o3 que precisam de verificação da organização para streaming",
   "com_endpoint_disable_streaming_label": "Desativar Streaming",
+  "com_endpoint_effort": "Esforço",
   "com_endpoint_examples": "Presets",
   "com_endpoint_export": "Exportar",
   "com_endpoint_export_share": "Exportar/Compartilhar",
@@ -260,6 +275,7 @@
   "com_endpoint_google_temp": "Valores mais altos = mais aleatório, enquanto valores mais baixos = mais focado e determinístico. Recomendamos alterar isso ou Top P, mas não ambos.",
   "com_endpoint_google_thinking": "Habilita ou desabilita o pensamento. Essa opção é suportada apenas por certos modelos (série 2.5). Para modelos antigos, esta opção pode não ter efeito.",
   "com_endpoint_google_thinking_budget": "Dita o número de tokens de pensamento que o modelo usa. A quantidade atual pode exceder ou ficar abaixo desse valor dependendo do prompt.\n\nEssa configuração é suportada apenas por certos modelos (2.5 series). Gemini 2.5 Pro suporta 128-32,768 tokens. Gemini 2.5 Flash suporta 0-24,576 tokens. Gemini 2.5 Flash Lite suporta 512-24,576 tokens.\n\nDeixe em branco ou defina como \"-1\" para deixar que o modelo decida automaticamente quando e quanto pensar. Por padrão, o Gemini 2.5 Flash Lite não pensa.",
+  "com_endpoint_google_thinking_level": "Controla a profundidade do raciocínio para Gemini 3 e modelos posteriores. Não tem efeito no Gemini 2.5 e anteriores; use Thinking Budget para esses modelos.\n\nDeixe em Automático para usar o padrão do modelo.",
   "com_endpoint_google_topk": "Top-k altera como o modelo seleciona tokens para saída. Um top-k de 1 significa que o token selecionado é o mais provável entre todos os tokens no vocabulário do modelo (também chamado de decodificação gananciosa), enquanto um top-k de 3 significa que o próximo token é selecionado entre os 3 tokens mais prováveis (usando temperatura).",
   "com_endpoint_google_topp": "Top-p altera como o modelo seleciona tokens para saída. Os tokens são selecionados dos mais prováveis (veja o parâmetro topK) até os menos prováveis até que a soma de suas probabilidades atinja o valor top-p.",
   "com_endpoint_google_use_search_grounding": "Use o recurso de base de pesquisa do Google para aprimorar as respostas com resultados de pesquisa na web em tempo real. Isso permite que os modelos acessem informações atuais e forneçam respostas mais precisas e atualizadas.",
@@ -300,6 +316,7 @@
   "com_endpoint_preset_default_removed": "não é mais o preset padrão.",
   "com_endpoint_preset_delete_confirm": "Tem certeza de que deseja excluir este preset?",
   "com_endpoint_preset_delete_error": "Houve um erro ao excluir seu preset. Por favor, tente novamente.",
+  "com_endpoint_preset_delete_success": "Predefinição excluída com sucesso",
   "com_endpoint_preset_import": "Preset Importado!",
   "com_endpoint_preset_import_error": "Houve um erro ao importar seu preset. Por favor, tente novamente.",
   "com_endpoint_preset_name": "Nome do Preset",
@@ -318,37 +335,70 @@
   "com_endpoint_reasoning_summary": "Resumo do raciocínio",
   "com_endpoint_save_as_preset": "Salvar Como Preset",
   "com_endpoint_search": "Procurar endpoint por nome",
+  "com_endpoint_search_endpoint_models": "Pesquisar modelos de {{0}}...",
   "com_endpoint_search_models": "Buscar modelos...",
+  "com_endpoint_search_var": "Procurar {{0}}...",
   "com_endpoint_set_custom_name": "Defina um nome personalizado, caso você possa encontrar este preset",
   "com_endpoint_stop": "Sequências de Parada",
   "com_endpoint_stop_placeholder": "Separe os valores pressionando `Enter`",
   "com_endpoint_temperature": "Temperatura",
   "com_endpoint_thinking": "Pensamento",
   "com_endpoint_thinking_budget": "Pensar no orçamento",
+  "com_endpoint_thinking_level": "Nível de raciocínio",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Usar Assistente Ativo",
   "com_endpoint_use_responses_api": "Usar Responses API",
+  "com_endpoint_use_search_grounding": "Grounding com Pesquisa Google",
+  "com_endpoint_verbosity": "Verbosidade",
+  "com_error_endpoint_models_not_loaded": "Não foi possível carregar modelos para {{0}}. Atualize a página e tente novamente.",
   "com_error_expired_user_key": "A chave fornecida para {{0}} expirou em {{1}}. Por favor, forneça uma nova chave e tente novamente.",
   "com_error_files_dupe": "Foi detectado um arquivo duplicado.",
   "com_error_files_empty": "Pensamento",
   "com_error_files_process": "Ocorreu um erro ao processar o arquivo.",
   "com_error_files_upload": "Ocorreu um erro ao carregar o arquivo.",
   "com_error_files_upload_canceled": "O pedido de carregamento de arquivos foi cancelado. Nota: o carregamento de arquivo pode ainda estar a ser processado e terá de ser eliminado manualmente.",
+  "com_error_files_upload_too_large": "O arquivo é muito grande. Envie um arquivo menor que {{0}} MB",
   "com_error_files_validation": "Ocorreu um erro durante a validação do arquivo.",
+  "com_error_google_tool_conflict": "O uso de ferramentas integradas do Google não é compatível com ferramentas externas. Desative as ferramentas integradas ou as ferramentas externas.",
+  "com_error_heic_conversion": "Falha ao converter a imagem HEIC em JPEG. Tente converter a imagem manualmente ou use um formato diferente.",
+  "com_error_illegal_model_request": "O modelo \"{{0}}\" não está disponível para {{1}}. Selecione um modelo diferente.",
   "com_error_input_length": "A contagem de tokens da última mensagem é muito longa, excedendo o limite de tokens, ou seus parâmetros de limite de tokens estão configurados incorretamente, afetando negativamente a janela de contexto. Mais informações: {{0}}. Encurte sua mensagem, ajuste o tamanho máximo do contexto nos parâmetros da conversa ou bifurque a conversa para continuar.",
+  "com_error_invalid_agent_provider": "O provedor \"{{0}}\" não está disponível para uso com Agentes. Acesse as configurações do seu agente e selecione um provedor disponível no momento.",
+  "com_error_invalid_base_url": "O URL base que você forneceu tem como alvo um endereço restrito. Use um URL externo válido e tente novamente.",
   "com_error_invalid_user_key": "Chave fornecida inválida. Por favor, forneça uma chave válida e tente novamente.",
+  "com_error_missing_model": "Nenhum modelo selecionado para {{0}}. Selecione um modelo e tente novamente.",
+  "com_error_models_not_loaded": "A configuração dos modelos não pôde ser carregada. Atualize a página e tente novamente.",
   "com_error_moderation": "Parece que o conteúdo enviado foi sinalizado pelo nosso sistema de moderação por não estar alinhado com nossas diretrizes da comunidade. Não podemos prosseguir com este tópico específico. Se você tiver outras perguntas ou tópicos que gostaria de explorar, edite sua mensagem ou crie uma nova conversa.",
   "com_error_no_base_url": "Nenhuma URL base encontrada. Por favor, forneça uma e tente novamente.",
   "com_error_no_user_key": "Nenhuma chave encontrada. Por favor, forneça uma chave e tente novamente.",
+  "com_error_refusal": "Resposta recusada por filtros de segurança. Reescreva sua mensagem e tente novamente. Se você encontrar isso com frequência ao usar o Claude Sonnet 4.5 ou Opus 4.1, você pode tentar o Sonnet 4, que tem diferentes restrições de uso.",
+  "com_error_stream_expired": "O fluxo de resposta expirou ou já foi concluído. Por favor, tente novamente.",
+  "com_file_pages": "Páginas: {{pages}}",
+  "com_file_source": "Arquivo",
+  "com_file_unknown": "Arquivo desconhecido",
+  "com_files_download_failed": "Falha em {{0}} arquivos",
+  "com_files_download_percent_complete": "{{0}}% concluído",
+  "com_files_download_progress": "{{0}} de {{1}} arquivos",
+  "com_files_downloading": "Baixando arquivos",
   "com_files_filter": "Filtrar arquivos...",
+  "com_files_filter_by": "Filtrar arquivos por...",
   "com_files_no_results": "Nenhum resultado.",
   "com_files_number_selected": "{{0}} de {{1}} arquivo(s) selecionado(s)",
+  "com_files_preparing_download": "Preparando download...",
+  "com_files_result_found": "{{count}} resultado encontrado",
+  "com_files_results_found": "{{count}} resultados encontrados",
+  "com_files_sharepoint_picker_title": "Escolher arquivos",
   "com_files_table": "algo precisa ir aqui. esta vazio",
+  "com_files_upload_local_machine": "Do computador local",
+  "com_files_upload_sharepoint": "De SharePoint",
   "com_generated_files": "Arquivos gerados:",
   "com_hide_examples": "Ocultar Exemplos",
+  "com_info_heic_converting": "Convertendo imagem HEIC em JPEG...",
   "com_nav_2fa": "Autenticação de dois fatores (2FA)",
   "com_nav_account_settings": "Configurações da Conta",
+  "com_nav_advanced_prompts": "Editor de prompts avançados",
+  "com_nav_advanced_prompts_desc": "Habilite o controle de versão e produção para prompts",
   "com_nav_always_make_prod": "Sempre tornar novas versões produção",
   "com_nav_archive_created_at": "Data de Arquivamento",
   "com_nav_archive_name": "Nome",
@@ -357,38 +407,51 @@
   "com_nav_at_command_description": "Alternar comando \"@\" para alternar endpoints, modelos, predefinições, etc.",
   "com_nav_audio_play_error": "Erro ao reproduzir áudio: {{0}}",
   "com_nav_audio_process_error": "Erro ao processar áudio: {{0}}",
+  "com_nav_auto_expand_tools": "Expandir automaticamente detalhes das ferramentas",
   "com_nav_auto_scroll": "Rolagem Automática para a última mensagem ao abrir o chat",
   "com_nav_auto_send_prompts": "Enviar prompts automaticamente",
+  "com_nav_auto_send_prompts_desc": "Enviar prompt automaticamente para o chat quando selecionado",
   "com_nav_auto_send_text": "Enviar texto automaticamente",
   "com_nav_auto_transcribe_audio": "Transcrever áudio automaticamente",
   "com_nav_automatic_playback": "Reprodução Automática da Última Mensagem",
   "com_nav_balance": "Crédito",
+  "com_nav_balance_auto_refill_disabled": "A recarga automática está desativada.",
+  "com_nav_balance_auto_refill_error": "Erro ao carregar as configurações de recarga automática.",
+  "com_nav_balance_auto_refill_settings": "Configurações de recarga automática",
   "com_nav_balance_day": "dia",
   "com_nav_balance_days": "dias",
+  "com_nav_balance_every": "A cada",
   "com_nav_balance_hour": "hora",
   "com_nav_balance_hours": "horas",
+  "com_nav_balance_interval": "Intervalo:",
+  "com_nav_balance_last_refill": "Última recarga:",
   "com_nav_balance_minute": "minuto",
   "com_nav_balance_minutes": "minutos",
   "com_nav_balance_month": "mês",
   "com_nav_balance_months": "meses",
   "com_nav_balance_next_refill": "Próximo Reabastecimento:",
+  "com_nav_balance_next_refill_info": "A próxima recarga ocorrerá automaticamente somente quando ambas as condições forem atendidas: o intervalo definido tiver passado desde a última recarga e o envio de um prompt faria seu saldo cair abaixo de zero.",
+  "com_nav_balance_refill_amount": "Quantidade de recarga:",
   "com_nav_balance_second": "segundo",
   "com_nav_balance_seconds": "segundos",
+  "com_nav_balance_week": "semana",
+  "com_nav_balance_weeks": "semanas",
   "com_nav_browser": "Navegador",
+  "com_nav_center_chat_input": "Centralizar entrada do chat na tela de boas-vindas",
   "com_nav_change_picture": "Mudar foto",
-  "com_nav_chat_commands": "Comandos do chat",
-  "com_nav_chat_commands_info": "Estes comandos são ativados digitando caracteres específicos no início da sua mensagem. Cada comando é acionado pelo seu prefixo designado. Pode desativá-los se utilizar frequentemente estes caracteres para iniciar mensagens.",
   "com_nav_chat_direction": "Direção do chat",
+  "com_nav_chat_direction_selected": "Direção do chat: {{direction}}",
   "com_nav_clear_all_chats": "Limpar todos os chats",
   "com_nav_clear_cache_confirm_message": "Tem a certeza de que quer limpar a cache?",
   "com_nav_clear_conversation": "Limpar conversas",
   "com_nav_clear_conversation_confirm_message": "Tem certeza de que deseja limpar todas as conversas? Isso é irreversível.",
   "com_nav_close_sidebar": "Fechar barra lateral",
-  "com_nav_commands": "Comandos",
   "com_nav_confirm_clear": "Confirmar Limpeza",
+  "com_nav_control_panel": "Painel de controle",
   "com_nav_conversation_mode": "Modo de Conversa",
   "com_nav_convo_menu_options": "Opções do Menu de Conversa",
   "com_nav_db_sensitivity": "Sensibilidade de decibéis",
+  "com_nav_default_temporary_chat": "Chat temporário por padrão",
   "com_nav_delete_account": "Excluir conta",
   "com_nav_delete_account_button": "Excluir minha conta permanentemente",
   "com_nav_delete_account_confirm": "Excluir conta - você tem certeza?",
@@ -417,22 +480,29 @@
   "com_nav_font_size_xl": "Extra Grande",
   "com_nav_font_size_xs": "Extra Pequeno",
   "com_nav_help_faq": "Ajuda & FAQ",
+  "com_nav_info_balance": "O saldo mostra quantos créditos de token você ainda tem para usar. Os créditos de token são convertidos em valor monetário (por exemplo, 1.000 créditos = US$ 0,001)",
   "com_nav_info_code_artifacts": "Habilita a exibição de artefatos de código experimental ao lado do chat",
   "com_nav_info_code_artifacts_agent": "Ativa a utilização de artefatos de código para este agente. Por predefinição, são adicionadas instruções adicionais específicas para a utilização de artefatos, a menos que o \"Modo de aviso personalizado\" esteja ativado.",
   "com_nav_info_custom_prompt_mode": "Quando habilitado, o prompt padrão do sistema de artefatos não será incluído. Todas as instruções de geração de artefatos devem ser fornecidas manualmente neste modo.",
+  "com_nav_info_default_temporary_chat": "Quando ativado, novos chats começarão com o modo de chat temporário ativado por padrão. Os chats temporários não são salvos no seu histórico.",
   "com_nav_info_enter_to_send": "Quando habilitado, pressionar `ENTER` enviará sua mensagem. Quando desabilitado, pressionar Enter adicionará uma nova linha, e você precisará pressionar `CTRL + ENTER` / `⌘ + ENTER` para enviar sua mensagem.",
   "com_nav_info_fork_change_default": "`Apenas mensagens visíveis` inclui apenas o caminho direto para a mensagem selecionada. `Incluir ramos relacionados` adiciona ramos ao longo do caminho. `Incluir tudo de/para aqui` inclui todas as mensagens e ramos conectados.",
   "com_nav_info_fork_split_target_setting": "Quando habilitado, a bifurcação começará da mensagem alvo até a última mensagem na conversa, de acordo com o comportamento selecionado.",
   "com_nav_info_include_shadcnui": "Quando habilitado, as instruções para usar componentes shadcn/ui serão incluídas. shadcn/ui é uma coleção de componentes reutilizáveis construídos usando Radix UI e Tailwind CSS. Nota: estas são instruções longas, você deve habilitar apenas se for importante informar o LLM sobre as importações e componentes corretos. Para mais informações sobre esses componentes, visite: https://ui.shadcn.com/",
   "com_nav_info_latex_parsing": "Quando habilitado, o código LaTeX nas mensagens será renderizado como equações matemáticas. Desabilitar isso pode melhorar o desempenho se você não precisar de renderização LaTeX.",
+  "com_nav_info_save_badges_state": "Quando ativado, o estado dos emblemas do chat será salvo. Isso significa que se você criar um novo chat, os emblemas permanecerão no mesmo estado do chat anterior. Se você desabilitar esta opção, os emblemas serão redefinidos para o estado padrão sempre que você criar um novo chat",
   "com_nav_info_save_draft": "Quando habilitado, o texto e os anexos que você inserir no formulário de chat serão salvos automaticamente localmente como rascunhos. Esses rascunhos estarão disponíveis mesmo se você recarregar a página ou mudar para uma conversa diferente. Os rascunhos são armazenados localmente no seu dispositivo e são excluídos uma vez que a mensagem é enviada.",
   "com_nav_info_show_thinking": "Quando ativado, o chat apresentará os menus pendentes de raciocínio abertos por predefinição, permitindo-lhe ver o raciocínio da IA em tempo real. Quando desativado, os menus suspensos de raciocínio permanecerão fechados por predefinição para uma interface mais limpa e simplificada",
   "com_nav_info_user_name_display": "Quando habilitado, o nome de usuário do remetente será mostrado acima de cada mensagem que você enviar. Quando desabilitado, você verá apenas \"Você\" acima de suas mensagens.",
+  "com_nav_keep_screen_awake": "Manter a tela acordada durante a geração da resposta",
   "com_nav_lang_arabic": "العربية",
   "com_nav_lang_armenian": "Armênio",
   "com_nav_lang_auto": "Detecção automática",
+  "com_nav_lang_bosnian": "Босански",
   "com_nav_lang_brazilian_portuguese": "Português Brasileiro",
+  "com_nav_lang_catalan": "Català",
   "com_nav_lang_chinese": "中文",
+  "com_nav_lang_czech": "Čeština",
   "com_nav_lang_danish": "Dinamarquês",
   "com_nav_lang_dutch": "Nederlands",
   "com_nav_lang_english": "English",
@@ -442,26 +512,53 @@
   "com_nav_lang_georgian": "Georgiano",
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
+  "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
+  "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
+  "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
+  "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
+  "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
   "com_nav_lang_thai": "Tailandês",
+  "com_nav_lang_tibetan": "བོད་སྐད་",
   "com_nav_lang_traditional_chinese": "繁體中文",
   "com_nav_lang_turkish": "Türkçe",
+  "com_nav_lang_ukrainian": "Українська",
+  "com_nav_lang_uyghur": "Uyƣur tili",
   "com_nav_lang_vietnamese": "Tiếng Việt",
   "com_nav_language": "Idioma",
   "com_nav_latex_parsing": "Análise de LaTeX em mensagens (pode afetar o desempenho)",
   "com_nav_log_out": "Sair",
   "com_nav_long_audio_warning": "Textos mais longos levarão mais tempo para processar.",
   "com_nav_maximize_chat_space": "Maximizar o espaço de conversa",
+  "com_nav_mcp_access_revoked": "Acesso ao servidor MCP revogado com sucesso.",
+  "com_nav_mcp_configure_server": "Configurar {{0}}",
+  "com_nav_mcp_connect": "Conectar",
+  "com_nav_mcp_connect_server": "Conectar {{0}}",
+  "com_nav_mcp_reconnect": "Reconectar",
+  "com_nav_mcp_status_connected": "Conectado",
+  "com_nav_mcp_status_connecting": "{{0}} - Conectando",
+  "com_nav_mcp_status_disconnected": "Desconectado",
+  "com_nav_mcp_status_error": "Erro",
+  "com_nav_mcp_status_initializing": "Inicializando",
+  "com_nav_mcp_status_needs_auth": "Precisa de autenticação",
+  "com_nav_mcp_status_unknown": "Desconhecido",
+  "com_nav_mcp_vars_update_error": "Erro ao atualizar variáveis personalizadas de usuário do MCP",
+  "com_nav_mcp_vars_updated": "Variáveis personalizadas de usuário do MCP atualizadas com sucesso.",
   "com_nav_modular_chat": "Habilitar troca de Endpoints no meio da conversa",
   "com_nav_my_files": "Meus Arquivos",
+  "com_nav_new_chat_switch_to_history": "Mudar para o histórico de chat em um novo chat",
   "com_nav_not_supported": "Não Suportado",
   "com_nav_open_sidebar": "Abrir barra lateral",
   "com_nav_playback_rate": "Taxa de Reprodução de Áudio",
@@ -469,15 +566,16 @@
   "com_nav_plus_command": "Comando +",
   "com_nav_plus_command_description": "Alternar comando \"+\" para adicionar uma configuração de resposta múltipla",
   "com_nav_profile_picture": "Foto de Perfil",
+  "com_nav_save_badges_state": "Salvar estado dos emblemas",
   "com_nav_save_drafts": "Salvar rascunhos localmente",
   "com_nav_scroll_button": "Ir para o botão final",
   "com_nav_search_placeholder": "Buscar mensagens",
   "com_nav_send_message": "Enviar mensagem",
   "com_nav_setting_account": "Conta",
-  "com_nav_setting_balance": "Créditos",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Controles de dados",
+  "com_nav_setting_delay": "Atraso(s)",
   "com_nav_setting_general": "Geral",
+  "com_nav_setting_mcp": "Configurações MCP",
   "com_nav_setting_speech": "Fala",
   "com_nav_settings": "Configurações",
   "com_nav_shared_links": "Links compartilhados",
@@ -494,6 +592,7 @@
   "com_nav_tool_dialog": "Ferramentas do Assistente",
   "com_nav_tool_dialog_agents": "Ferramentas do agente",
   "com_nav_tool_dialog_description": "O assistente deve ser salvo para persistir as seleções de ferramentas.",
+  "com_nav_tool_dialog_mcp_server_tools": "Ferramentas do servidor MCP",
   "com_nav_tool_remove": "Remover",
   "com_nav_tool_search": "Buscar ferramentas",
   "com_nav_user": "USUÁRIO",
@@ -508,7 +607,24 @@
   "com_sidepanel_hide_panel": "Ocultar Painel",
   "com_sidepanel_manage_files": "Gerenciar Arquivos",
   "com_sidepanel_parameters": "Parâmetros",
+  "com_sources_agent_file": "Documento de origem",
+  "com_sources_agent_files": "Arquivos do agente",
+  "com_sources_download_aria_label": "Baixar {{filename}}{{status}}",
+  "com_sources_download_failed": "Falha no download",
+  "com_sources_download_local_unavailable": "Não é possível baixar: o arquivo não foi salvo",
+  "com_sources_downloading_status": "(baixando...)",
+  "com_sources_error_fallback": "Não foi possível carregar fontes",
+  "com_sources_image_alt": "Imagem do resultado da pesquisa",
+  "com_sources_more_files": "+{{count}} arquivos",
+  "com_sources_more_sources": "+{{count}} fontes",
+  "com_sources_pages": "Páginas",
+  "com_sources_region_label": "Resultados e fontes da pesquisa",
+  "com_sources_reload_page": "Recarregar página",
+  "com_sources_tab_all": "Todos",
+  "com_sources_tab_files": "Arquivos",
   "com_sources_tab_images": "Imagens",
+  "com_sources_tab_news": "Notícias",
+  "com_sources_title": "Fontes",
   "com_ui_2fa_account_security": "A autenticação de dois fatores acrescenta uma camada extra de segurança à sua conta",
   "com_ui_2fa_disable": "Desabilitar 2FA",
   "com_ui_2fa_disable_error": "Ocorreu um erro ao desativar a autenticação de dois fatores",
@@ -518,42 +634,101 @@
   "com_ui_2fa_generate_error": "Ocorreu um erro ao gerar as configurações de autenticação de dois fatores",
   "com_ui_2fa_invalid": "Código de autenticação de dois fatores inválido",
   "com_ui_2fa_setup": "Configurar 2FA",
+  "com_ui_2fa_verification_required": "Digite seu código 2FA para continuar",
   "com_ui_2fa_verified": "Autenticação de dois fatores verificada com sucesso",
   "com_ui_accept": "Eu aceito",
+  "com_ui_action_button": "Botão de ação",
   "com_ui_active": "Ativo",
   "com_ui_add": "Adicionar",
+  "com_ui_add_first_bookmark": "Clique em um chat para adicionar um",
+  "com_ui_add_first_mcp_server": "Crie seu primeiro servidor MCP para começar",
+  "com_ui_add_first_prompt": "Crie seu primeiro prompt para começar",
+  "com_ui_add_labels": "Adicionar rótulos",
   "com_ui_add_mcp": "Adicionar MCP",
   "com_ui_add_mcp_server": "Adicionar Servidor MCP",
   "com_ui_add_model_preset": "Adicionar um modelo ou predefinição para uma resposta adicional",
   "com_ui_add_multi_conversation": "Adicionar multi-conversação",
+  "com_ui_add_special_variables": "Adicionar variáveis especiais",
+  "com_ui_add_web_search_api_keys": "Adicionar chaves de API de pesquisa na web",
+  "com_ui_adding_details": "Adicionando detalhes",
+  "com_ui_additional_details": "Detalhes adicionais",
   "com_ui_admin": "Admin",
   "com_ui_admin_access_warning": "Desabilitar o acesso de Admin a esse recurso pode causar problemas inesperados na IU que exigem atualização. Se salvo, a única maneira de reverter é por meio da configuração de interface na configuração librechat.yaml que afeta todas as funções.",
   "com_ui_admin_settings": "Configurações de Admin",
+  "com_ui_admin_settings_section": "Configurações de administrador - {{section}}",
   "com_ui_advanced": "Avançado",
   "com_ui_advanced_settings": "Opções Avançadas",
   "com_ui_agent": "Agente",
+  "com_ui_agent_api_keys": "Chaves de API do agente",
+  "com_ui_agent_category_aftersales": "Pós-venda",
+  "com_ui_agent_category_finance": "Finanças",
+  "com_ui_agent_category_general": "Geral",
+  "com_ui_agent_category_hr": "RH",
+  "com_ui_agent_category_it": "TI",
+  "com_ui_agent_category_rd": "P&D",
+  "com_ui_agent_category_sales": "Vendas",
+  "com_ui_agent_category_selector_aria": "Seletor de categoria do agente",
+  "com_ui_agent_chain": "Cadeia de Agentes (Mixture-of-Agents)",
+  "com_ui_agent_chain_info": "Permite criar sequências de agentes. Cada agente pode acessar saídas dos agentes anteriores na cadeia. Baseado na arquitetura \"Mixture-of-Agents\", em que agentes usam saídas anteriores como informações auxiliares.",
+  "com_ui_agent_chain_max": "Você atingiu o máximo de {{0}} agentes.",
   "com_ui_agent_delete_error": "Houve um erro ao excluir o agente",
   "com_ui_agent_deleted": "Agente excluído com sucesso",
   "com_ui_agent_duplicate_error": "Ocorreu um erro ao duplicar o agente",
   "com_ui_agent_duplicated": "Agente duplicado com sucesso",
+  "com_ui_agent_handoff_add": "Adicionar agente de transferência",
+  "com_ui_agent_handoff_description": "Descrição da transferência",
+  "com_ui_agent_handoff_description_placeholder": "ex.: Transferir para analista de dados para análise estatística",
+  "com_ui_agent_handoff_info": "Configure agentes para os quais esse agente possa transferir conversas quando for necessária experiência específica.",
+  "com_ui_agent_handoff_info_2": "Cada transferência cria uma ferramenta de transferência que permite o roteamento contínuo para agentes especializados com contexto.",
+  "com_ui_agent_handoff_max": "Máximo de agentes de transferência {{0}} atingido.",
+  "com_ui_agent_handoff_prompt": "Conteúdo repassado",
+  "com_ui_agent_handoff_prompt_key": "Nome do parâmetro de conteúdo (padrão: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Nomeie o conteúdo repassado (padrão: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Diga a este agente qual conteúdo gerar e passar para o agente de transferência. Você precisa adicionar algo aqui para ativar este recurso",
+  "com_ui_agent_handoffs": "Transferências de agente",
+  "com_ui_agent_name_is_required": "O nome do agente é obrigatório",
+  "com_ui_agent_recursion_limit": "Máximo de etapas do agente",
+  "com_ui_agent_recursion_limit_info": "Limita quantas etapas o agente pode executar em uma rodada antes de fornecer uma resposta final. O padrão é 25 etapas. Uma etapa é uma solicitação à API de IA ou uma rodada de uso de ferramenta. Por exemplo, uma interação básica com ferramenta usa 3 etapas: solicitação inicial, uso da ferramenta e solicitação de acompanhamento.",
+  "com_ui_agent_url_copied": "URL do agente copiada para a área de transferência",
+  "com_ui_agent_var": "Agente {{0}}",
   "com_ui_agent_version": "Versão",
   "com_ui_agent_version_active": "Versão Ativa",
   "com_ui_agent_version_empty": "Não há versões disponíveis",
+  "com_ui_agent_version_error": "Erro ao buscar versões",
   "com_ui_agent_version_history": "Histórico de Versões",
+  "com_ui_agent_version_no_agent": "Nenhum agente selecionado. Selecione um agente para visualizar o histórico de versões.",
   "com_ui_agent_version_no_date": "Data não disponível",
+  "com_ui_agent_version_restore": "Restaurar",
+  "com_ui_agent_version_restore_confirm": "Tem certeza de que deseja restaurar esta versão?",
+  "com_ui_agent_version_restore_error": "Falha ao restaurar a versão",
+  "com_ui_agent_version_restore_success": "Versão restaurada com sucesso",
+  "com_ui_agent_version_title": "Versão {{versionNumber}}",
   "com_ui_agent_version_unknown_date": "Data desconhecida",
   "com_ui_agents": "Agentes",
   "com_ui_agents_allow_create": "Permitir a criação de agentes",
+  "com_ui_agents_allow_share": "Permitir compartilhamento de agentes",
+  "com_ui_agents_allow_share_public": "Permitir o compartilhamento público de Agentes",
   "com_ui_agents_allow_use": "Permitir o uso de agentes",
   "com_ui_all": "todos",
   "com_ui_all_proper": "Todos",
   "com_ui_analyzing": "Analisando",
   "com_ui_analyzing_finished": "Análise concluída",
   "com_ui_api_key": "Chave API",
+  "com_ui_api_key_create_error": "Falha ao criar a chave de API",
+  "com_ui_api_key_created": "Chave de API criada com sucesso",
+  "com_ui_api_key_delete_error": "Falha ao excluir a chave de API",
+  "com_ui_api_key_deleted": "Chave de API excluída com sucesso",
+  "com_ui_api_key_name": "Nome da chave",
+  "com_ui_api_key_name_placeholder": "Minha chave de API",
+  "com_ui_api_key_name_required": "O nome da chave de API é obrigatório",
+  "com_ui_api_key_warning": "Copie sua chave de API agora. Você não poderá vê-la novamente!",
+  "com_ui_api_keys_load_error": "Falha ao carregar chaves de API",
   "com_ui_archive": "Arquivar",
+  "com_ui_archive_delete_error": "Falha ao excluir conversa arquivada",
   "com_ui_archive_error": "Falha ao arquivar conversa",
   "com_ui_artifact_click": "Clique para abrir",
   "com_ui_artifacts": "Artefatos",
+  "com_ui_artifacts_options": "Opções de artefatos",
   "com_ui_artifacts_toggle": "Alternar UI de Artefatos",
   "com_ui_artifacts_toggle_agent": "Habilitar artefatos",
   "com_ui_ascending": "Asc",
@@ -562,9 +737,13 @@
   "com_ui_assistant_deleted": "Assistente excluído com sucesso",
   "com_ui_assistants": "Assistentes",
   "com_ui_assistants_output": "Saída dos Assistentes",
+  "com_ui_at_least_one_owner_required": "É necessário pelo menos um proprietário",
   "com_ui_attach_error": "Não é possível anexar o arquivo. Crie ou selecione uma conversa, ou tente atualizar a página.",
+  "com_ui_attach_error_disabled": "Os uploads de arquivos estão desativados para este endpoint",
+  "com_ui_attach_error_limit": "Limite de arquivos atingido:",
   "com_ui_attach_error_openai": "Não é possível anexar arquivos de Assistente a outros endpoints",
   "com_ui_attach_error_size": "Limite de tamanho de arquivo excedido para o endpoint:",
+  "com_ui_attach_error_total_size": "Limite total de tamanho de arquivo excedido para endpoint:",
   "com_ui_attach_error_type": "Tipo de arquivo não suportado para o endpoint:",
   "com_ui_attach_remove": "Remover arquivo",
   "com_ui_attach_warn_endpoint": "Arquivos não compatíveis podem ser ignorados sem uma ferramenta compatível",
@@ -574,19 +753,29 @@
   "com_ui_authenticate": "Autenticar",
   "com_ui_authentication": "Autenticação",
   "com_ui_authentication_type": "Tipo de Autenticação",
+  "com_ui_auto": "Auto",
+  "com_ui_available_options": "Opções disponíveis",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
+  "com_ui_back": "Voltar",
+  "com_ui_back_to_builder": "Voltar ao construtor",
   "com_ui_back_to_prompts": "Voltar aos Prompts",
+  "com_ui_backup_code_number": "Código #{{number}}",
   "com_ui_backup_codes": "Códigos de Backup",
   "com_ui_backup_codes_regenerate_error": "Ocorreu um erro ao regerar os códigos de backup",
   "com_ui_backup_codes_regenerated": "Os códigos de backup foram regerados com sucesso",
+  "com_ui_backup_codes_security_info": "Por motivos de segurança, os códigos de backup são exibidos apenas uma vez quando gerados. Guarde-os em um local seguro.",
+  "com_ui_backup_codes_status": "Status dos códigos de backup",
   "com_ui_basic": "Básico",
   "com_ui_basic_auth_header": "Cabeçalho de autorização básico",
   "com_ui_bearer": "Portador",
+  "com_ui_beta": "Beta",
   "com_ui_bookmark_delete_confirm": "Tem certeza de que deseja excluir este favorito?",
   "com_ui_bookmarks": "Favoritos",
   "com_ui_bookmarks_add": "Adicionar marcadores",
   "com_ui_bookmarks_add_to_conversation": "Adicionar à conversa atual",
+  "com_ui_bookmarks_count_selected": "Favoritos, {{count}} selecionados",
   "com_ui_bookmarks_create_error": "Houve um erro ao criar o favorito",
   "com_ui_bookmarks_create_exists": "Este favorito já existe",
   "com_ui_bookmarks_create_success": "Favorito criado com sucesso",
@@ -597,49 +786,98 @@
   "com_ui_bookmarks_edit": "Editar marcadores",
   "com_ui_bookmarks_filter": "Filtrar favoritos...",
   "com_ui_bookmarks_new": "Novo Favorito",
+  "com_ui_bookmarks_tag_exists": "Já existe um marcador com este título",
   "com_ui_bookmarks_title": "Título",
   "com_ui_bookmarks_update_error": "Houve um erro ao atualizar o favorito",
   "com_ui_bookmarks_update_success": "Favorito atualizado com sucesso",
+  "com_ui_branch_created": "Branch criado com sucesso",
+  "com_ui_branch_error": "Falha ao criar branch",
+  "com_ui_branch_message": "Criar branch a partir desta resposta",
+  "com_ui_by_author": "por {{0}}",
   "com_ui_callback_url": "URL de retorno de chamada",
   "com_ui_cancel": "Cancelar",
   "com_ui_cancelled": "Cancelado",
   "com_ui_category": "Categoria",
+  "com_ui_change_version": "Alterar versão",
   "com_ui_chat": "Chat",
   "com_ui_chat_history": "Histórico de Chat",
+  "com_ui_chats": "Chats",
+  "com_ui_check_internet": "Verifique sua conexão com a internet",
   "com_ui_clear": "Limpar",
   "com_ui_clear_all": "Limpar tudo",
+  "com_ui_clear_browser_cache": "Limpe o cache do seu navegador",
+  "com_ui_clear_presets": "Limpar predefinições",
+  "com_ui_clear_search": "Limpar pesquisa",
+  "com_ui_click_to_close": "Clique para fechar",
+  "com_ui_click_to_edit": "Clique para editar",
+  "com_ui_click_to_view_var": "Clique para visualizar {{0}}",
   "com_ui_client_id": "ID do cliente",
   "com_ui_client_secret": "Segredo do cliente",
   "com_ui_close": "Fechar",
   "com_ui_close_menu": "Fechar Menu",
+  "com_ui_close_settings": "Fechar configurações",
+  "com_ui_close_var": "Fechar {{0}}",
   "com_ui_close_window": "Fechar Janela",
   "com_ui_code": "Código",
+  "com_ui_collapse": "Recolher",
   "com_ui_collapse_chat": "Recolher bate-papo",
+  "com_ui_collapse_summary": "Recolher Resumo",
+  "com_ui_collapse_thoughts": "Recolher pensamentos",
   "com_ui_command_placeholder": "Opcional: Insira um comando para o prompt ou o nome será usado.",
   "com_ui_command_usage_placeholder": "Selecione um Prompt por comando ou nome",
+  "com_ui_complete": "Concluído!",
   "com_ui_complete_setup": "Configuração completa",
+  "com_ui_concise": "Conciso",
+  "com_ui_configure": "Configurar",
+  "com_ui_configure_mcp_variables_for": "Configurar variáveis para {{0}}",
+  "com_ui_confirm": "Confirmar",
   "com_ui_confirm_action": "Confirmar Ação",
   "com_ui_confirm_admin_use_change": "Alterar esta configuração bloqueará o acesso para administradores, incluindo você. Tem certeza de que deseja prosseguir?",
   "com_ui_confirm_change": "Confirmar alteração",
   "com_ui_connecting": "Conectando",
+  "com_ui_contact_admin_if_issue_persists": "Entre em contato com o administrador se o problema persistir",
   "com_ui_context": "Contexto",
+  "com_ui_context_filter_sort": "Filtrar e classificar por contexto",
   "com_ui_continue": "Continuar",
   "com_ui_continue_oauth": "Continuar com OAuth",
+  "com_ui_control_bar": "Barra de controle",
+  "com_ui_conversation": "conversa",
+  "com_ui_conversation_label": "Conversa {{title}}",
+  "com_ui_conversation_not_found": "Conversa não encontrada",
+  "com_ui_conversation_summarized": "Conversa resumida",
+  "com_ui_conversations": "conversas",
+  "com_ui_convo_archived": "Conversa arquivada",
   "com_ui_convo_delete_error": "Falha ao excluir conversa",
+  "com_ui_convo_delete_success": "Conversa excluída com sucesso",
   "com_ui_copied": "Copiado!",
   "com_ui_copied_to_clipboard": "Copiado para a área de transferência",
+  "com_ui_copy": "Copiar",
   "com_ui_copy_code": "Copiar código",
+  "com_ui_copy_failed": "Falha ao copiar para a área de transferência",
   "com_ui_copy_link": "Copiar link",
+  "com_ui_copy_stack_trace": "Copiar rastreamento de pilha",
+  "com_ui_copy_summary": "Copiar resumo para a área de transferência",
+  "com_ui_copy_thoughts_to_clipboard": "Copiar raciocínios para a área de transferência",
   "com_ui_copy_to_clipboard": "Copiar para a área de transferência",
+  "com_ui_copy_url_to_clipboard": "Copiar URL para a área de transferência",
   "com_ui_create": "Criar",
+  "com_ui_create_api_key": "Criar chave de API",
+  "com_ui_create_assistant": "Criar assistente",
   "com_ui_create_link": "Criar link",
+  "com_ui_create_mcp_server": "Criar servidor MCP",
   "com_ui_create_memory": "Criar Memória",
+  "com_ui_create_new_agent": "Criar novo agente",
   "com_ui_create_prompt": "Criar Prompt",
+  "com_ui_create_prompt_page": "Nova página de configuração de prompt",
+  "com_ui_created": "Criado",
+  "com_ui_creating": "Criando...",
   "com_ui_creating_image": "Criando a imagem. Pode levar algum tempo",
+  "com_ui_current": "Atual",
   "com_ui_currently_production": "Atualmente em produção",
   "com_ui_custom": "Personalizado",
   "com_ui_custom_header_name": "Nome do cabeçalho personalizado",
   "com_ui_custom_prompt_mode": "Modo de Prompt Personalizado",
+  "com_ui_dark_theme_enabled": "Tema escuro ativado",
   "com_ui_date": "Data",
   "com_ui_date_april": "Abril",
   "com_ui_date_august": "Agosto",
@@ -655,6 +893,7 @@
   "com_ui_date_previous_30_days": "Últimos 30 dias",
   "com_ui_date_previous_7_days": "Últimos 7 dias",
   "com_ui_date_september": "Setembro",
+  "com_ui_date_sort": "Classificar por data",
   "com_ui_date_today": "Hoje",
   "com_ui_date_yesterday": "Ontem",
   "com_ui_decline": "Eu não aceito",
@@ -662,67 +901,113 @@
   "com_ui_delete": "Excluir",
   "com_ui_delete_action": "Excluir Ação",
   "com_ui_delete_action_confirm": "Tem certeza de que deseja excluir esta ação?",
+  "com_ui_delete_agent": "Excluir agente",
   "com_ui_delete_agent_confirm": "Tem certeza de que deseja excluir este agente?",
+  "com_ui_delete_assistant": "Excluir assistente",
   "com_ui_delete_assistant_confirm": "Tem certeza de que deseja excluir este Assistente? Isso não pode ser desfeito.",
   "com_ui_delete_confirm": "Isso excluirá",
   "com_ui_delete_confirm_prompt_version_var": "Isso excluirá a versão selecionada para \"{{0}}\". Se não houver outras versões, o prompt será excluído.",
+  "com_ui_delete_confirm_strong": "Isso excluirá <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "Excluir chat?",
+  "com_ui_delete_conversation_tooltip": "Excluir conversa",
+  "com_ui_delete_mcp_server": "Excluir servidor MCP?",
+  "com_ui_delete_mcp_server_name": "Excluir servidor MCP {{0}}",
   "com_ui_delete_memory": "Remover Memória",
+  "com_ui_delete_not_allowed": "A operação de exclusão não é permitida",
+  "com_ui_delete_preset": "Excluir predefinição?",
   "com_ui_delete_prompt": "Excluir Prompt?",
   "com_ui_delete_shared_link": "Excluir link compartilhado?",
+  "com_ui_delete_shared_link_heading": "Excluir link compartilhado",
   "com_ui_delete_success": "Removido com sucesso",
   "com_ui_delete_tool": "Excluir Ferramenta",
   "com_ui_delete_tool_confirm": "Tem certeza de que deseja excluir esta ferramenta?",
+  "com_ui_delete_tool_save_reminder": "Ferramenta removida. Salve o agente para aplicar as alterações.",
   "com_ui_deleted": "Removido",
+  "com_ui_deleting": "Excluindo...",
   "com_ui_deleting_file": "Removendo arquivo...",
+  "com_ui_deploy": "Implantar",
   "com_ui_descending": "Desc",
   "com_ui_description": "Descrição",
   "com_ui_description_placeholder": "Opcional: Insira uma descrição para exibir para o prompt",
+  "com_ui_deselect_all": "Desmarcar tudo",
   "com_ui_detailed": "Detalhado",
+  "com_ui_details": "Detalhes",
   "com_ui_disabling": "Desativando...",
+  "com_ui_done": "Feito",
   "com_ui_download": "Download",
   "com_ui_download_artifact": "Download artefato",
   "com_ui_download_backup": "Baixar códigos de backup",
   "com_ui_download_backup_tooltip": "Antes de continuar, baixe seus códigos de backup. Você precisará deles para recuperar o acesso se perder seu dispositivo autenticador",
   "com_ui_download_error": "Erro ao baixar o arquivo. O arquivo pode ter sido excluído.",
+  "com_ui_download_error_logs": "Baixar registros de erros",
   "com_ui_drag_drop": "Arraste arquivos aqui para anexá-los",
   "com_ui_dropdown_variables": "Variáveis de dropdown:",
   "com_ui_duplicate": "Duplicado",
+  "com_ui_duplicate_agent": "Agente duplicado",
   "com_ui_duplication_error": "Ocorreu um erro ao duplicar a conversa",
   "com_ui_duplication_processing": "Duplicando conversa...",
   "com_ui_duplication_success": "Conversa duplicada com sucesso",
   "com_ui_edit": "Editar",
+  "com_ui_edit_editing_image": "Editando imagem",
   "com_ui_edit_mcp_server": "Editar Servidor MCP",
+  "com_ui_edit_mcp_server_dialog_description": "Identificador exclusivo do servidor: {{serverName}}",
   "com_ui_edit_memory": "Editar Memória",
+  "com_ui_edit_preset_title": "Editar predefinição - {{title}}",
+  "com_ui_edit_prompt_page": "Editar página de prompt",
+  "com_ui_editable_message": "Mensagem editável",
+  "com_ui_editor_instructions": "Arraste a imagem para reposicionar • Use o controle deslizante de zoom ou botões para ajustar o tamanho",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Endpoint",
   "com_ui_endpoint_menu": "Menu endpoint LLM",
   "com_ui_enter": "Entrar",
   "com_ui_enter_api_key": "Insira a chave da API",
+  "com_ui_enter_description": "Insira a descrição (opcional)",
   "com_ui_enter_key": "Inserir chave",
+  "com_ui_enter_name": "Digite o nome",
   "com_ui_enter_openapi_schema": "Insira seu esquema OpenAPI aqui",
   "com_ui_enter_value": "Inserir valor",
   "com_ui_error": "Erro",
   "com_ui_error_connection": "Erro ao conectar ao servidor, tente atualizar a página.",
+  "com_ui_error_message_prefix": "Mensagem de erro:",
   "com_ui_error_save_admin_settings": "Houve um erro ao salvar suas configurações de admin.",
+  "com_ui_error_try_following_prefix": "Por favor, tente um dos seguintes",
+  "com_ui_error_unexpected": "Ops! Algo inesperado aconteceu",
   "com_ui_error_updating_preferences": "Erro ao atualizar preferências",
+  "com_ui_everyone_permission_level": "Nível de permissão de todos",
   "com_ui_examples": "Exemplos",
+  "com_ui_expand": "Expandir",
   "com_ui_expand_chat": "Expandir Chat",
+  "com_ui_expand_thoughts": "Expandir pensamentos",
   "com_ui_export_convo_modal": "Exportar Modal de Conversação",
+  "com_ui_failed": "Falhou",
   "com_ui_feedback_more": "Mais...",
   "com_ui_feedback_more_information": "Fornecer feedback adicional",
   "com_ui_feedback_negative": "Precisa de melhorias",
   "com_ui_feedback_placeholder": "Por favor, forneça qualquer feedback adicional aqui",
   "com_ui_feedback_positive": "Amei isso",
   "com_ui_feedback_tag_accurate_reliable": "Preciso e confiável",
+  "com_ui_feedback_tag_attention_to_detail": "Atenção aos detalhes",
+  "com_ui_feedback_tag_bad_style": "Estilo ou tom ruim",
+  "com_ui_feedback_tag_clear_well_written": "Claro e bem escrito",
   "com_ui_feedback_tag_creative_solution": "Solução Criativa",
+  "com_ui_feedback_tag_inaccurate": "Resposta imprecisa ou incorreta",
+  "com_ui_feedback_tag_missing_image": "Esperava uma imagem",
   "com_ui_feedback_tag_not_helpful": "Faltou informação útil",
+  "com_ui_feedback_tag_not_matched": "Não correspondeu à minha solicitação",
+  "com_ui_feedback_tag_other": "Outro problema",
   "com_ui_feedback_tag_unjustified_refusal": "Recusado com razão",
+  "com_ui_field_max_length": "{{field}} deve ter menos que {{length}} caracteres",
   "com_ui_field_required": "Este campo é obrigatório",
+  "com_ui_file": "Arquivo",
+  "com_ui_file_input_avatar_label": "Entrada de arquivo para avatar",
   "com_ui_file_size": "Tamanho do Arquivo",
+  "com_ui_file_token_limit": "Limite de token de arquivo",
+  "com_ui_file_token_limit_desc": "Defina o limite máximo de tokens para processamento de arquivos para controlar custos e uso de recursos",
   "com_ui_files": "Arquivos",
+  "com_ui_filter_mcp_servers": "Filtrar servidores MCP por nome",
   "com_ui_filter_prompts": "Filtrar prompts",
   "com_ui_filter_prompts_name": "Filtrar prompts por nome",
+  "com_ui_final_touch": "Toque final",
   "com_ui_finance": "Financiar",
   "com_ui_fork": "Bifurcar",
   "com_ui_fork_all_target": "Incluir todos para/de aqui",
@@ -730,15 +1015,20 @@
   "com_ui_fork_change_default": "Opção de bifurcação padrão",
   "com_ui_fork_default": "Usar opção de bifurcação padrão",
   "com_ui_fork_error": "Houve um erro ao bifurcar a conversa",
+  "com_ui_fork_error_rate_limit": "Muitas solicitações de fork. Por favor, tente novamente mais tarde",
   "com_ui_fork_from_message": "Selecione uma opção de bifurcação",
   "com_ui_fork_info_1": "Use esta configuração para bifurcar mensagens com o comportamento desejado.",
   "com_ui_fork_info_2": "\"Bifurcação\" refere-se à criação de uma nova conversa que começa/termina a partir de mensagens específicas na conversa atual, criando uma cópia de acordo com as opções selecionadas.",
   "com_ui_fork_info_3": "A \"mensagem alvo\" refere-se à mensagem da qual este popup foi aberto, ou, se você marcar \"{{0}}\", a última mensagem na conversa.",
   "com_ui_fork_info_branches": "Esta opção bifurca as mensagens visíveis, junto com ramificações relacionadas; em outras palavras, o caminho direto para a mensagem alvo, incluindo ramificações ao longo do caminho.",
+  "com_ui_fork_info_button_label": "Ver informações sobre bifurcação de conversas",
   "com_ui_fork_info_remember": "Marque isto para lembrar as opções que você seleciona para uso futuro, tornando mais rápido bifurcar conversas conforme preferido.",
   "com_ui_fork_info_start": "Se marcado, a bifurcação começará desta mensagem até a última mensagem na conversa, de acordo com o comportamento selecionado acima.",
   "com_ui_fork_info_target": "Esta opção bifurca todas as mensagens até a mensagem alvo, incluindo seus vizinhos; em outras palavras, todos os ramos de mensagens, estejam ou não visíveis ou ao longo do mesmo caminho, estão incluídos.",
   "com_ui_fork_info_visible": "Esta opção bifurca apenas as mensagens visíveis; em outras palavras, o caminho direto para a mensagem alvo, sem quaisquer ramificações.",
+  "com_ui_fork_more_details_about": "Ver informações e detalhes adicionais sobre a opção de fork \"{{0}}\"",
+  "com_ui_fork_more_info_options": "Veja a explicação detalhada de todas as opções de fork e seus comportamentos",
+  "com_ui_fork_open_menu": "Abrir menu de fork",
   "com_ui_fork_processing": "Bifurcando conversa...",
   "com_ui_fork_remember": "Lembrar",
   "com_ui_fork_remember_checked": "Sua seleção será lembrada após o uso. Altere isso a qualquer momento nas configurações.",
@@ -748,16 +1038,23 @@
   "com_ui_fork_visible": "Apenas mensagens visíveis",
   "com_ui_generate_qrcode": "Gerar QR Code",
   "com_ui_generating": "Gerando...",
+  "com_ui_generating_image": "Gerando imagem...",
   "com_ui_generation_settings": "Configurações de Geração",
+  "com_ui_getting_started": "Primeiros passos",
   "com_ui_go_back": "Volte",
   "com_ui_go_to_conversation": "Ir para a conversa",
   "com_ui_good_afternoon": "Boa tarde",
   "com_ui_good_evening": "Boa noite",
   "com_ui_good_morning": "Bom dia",
+  "com_ui_group": "Grupo",
+  "com_ui_handoff_instructions": "Instruções de transferência",
   "com_ui_happy_birthday": "É meu 1º aniversário!",
+  "com_ui_header_format": "Formato de cabeçalho",
+  "com_ui_hide": "Ocultar",
+  "com_ui_hide_code": "Ocultar código",
   "com_ui_hide_image_details": "Esconder Detalhes de Imagem",
-  "com_ui_hide_password": "Esconder senha",
   "com_ui_hide_qr": "Ocultar QR Code",
+  "com_ui_high": "Alto",
   "com_ui_host": "Host",
   "com_ui_icon": "Ícone",
   "com_ui_idea": "Ideias",
@@ -765,158 +1062,435 @@
   "com_ui_image_details": "Detalhes da Imagem",
   "com_ui_image_edited": "Imagem editada",
   "com_ui_image_gen": "Geração de Imagem",
+  "com_ui_image_gen_failed": "Falha na geração da imagem",
   "com_ui_import": "Importar",
   "com_ui_import_conversation_error": "Houve um erro ao importar suas conversas",
   "com_ui_import_conversation_file_type_error": "Tipo de importação não suportado",
   "com_ui_import_conversation_info": "Importar conversas de um arquivo JSON",
   "com_ui_import_conversation_success": "Conversas importadas com sucesso",
+  "com_ui_import_conversation_upload_error": "Erro ao carregar o arquivo. Por favor, tente novamente.",
+  "com_ui_importing": "Importando",
   "com_ui_include_shadcnui": "Incluir instruções de componentes shadcn/ui",
+  "com_ui_initializing": "Inicializando...",
   "com_ui_input": "Entrada",
   "com_ui_instructions": "Instruções",
   "com_ui_key": "Chave",
+  "com_ui_key_required": "A chave de API é obrigatória",
+  "com_ui_labels": "Rótulos",
+  "com_ui_late_night": "Boa madrugada",
+  "com_ui_latest": "mais recente",
   "com_ui_latest_footer": "Toda IA para Todos.",
   "com_ui_latest_version": "Ultima versão",
+  "com_ui_leave_blank_to_keep": "Deixe em branco para manter o existente",
+  "com_ui_light_theme_enabled": "Tema claro ativado",
+  "com_ui_link_copied": "Link copiado",
+  "com_ui_link_refreshed": "Link atualizado",
+  "com_ui_live": "ao vivo",
   "com_ui_loading": "Carregando",
   "com_ui_locked": "Bloqueado",
   "com_ui_logo": "{{0}} Logo",
+  "com_ui_low": "Baixo",
+  "com_ui_make_production": "Tornar produção",
   "com_ui_manage": "Gerenciar",
+  "com_ui_marketplace": "Marketplace",
+  "com_ui_marketplace_allow_use": "Permitir uso do Marketplace",
+  "com_ui_max": "Máx.",
+  "com_ui_max_favorites_reached": "Máximo de itens fixados atingido ({{0}}). Desafixe um item para adicionar mais.",
+  "com_ui_max_file_size": "PNG, JPG ou JPEG (máx. {{0}})",
   "com_ui_max_tags": "O número máximo permitido é {{0}}, usando os valores mais recentes.",
   "com_ui_mcp_authenticated_success": "Servidor MCP '{{0}}' autenticado com sucesso",
+  "com_ui_mcp_click_to_defer": "Clique para adiar - a ferramenta poderá ser descoberta por meio de pesquisa, mas não será carregada até que seja necessária",
+  "com_ui_mcp_click_to_programmatic": "Habilitar chamada programática – a ferramenta só pode ser invocada por meio de execução de código",
+  "com_ui_mcp_configure_server": "Configurar {{0}}",
+  "com_ui_mcp_configure_server_description": "Configurar variáveis personalizadas para {{0}}",
+  "com_ui_mcp_defer": "Adiar",
+  "com_ui_mcp_defer_all": "Adiar todas as ferramentas",
+  "com_ui_mcp_defer_loading": "Adiar carregamento",
+  "com_ui_mcp_dialog_title": "Configurar variáveis para {{serverName}}. Status do servidor: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "O domínio do servidor MCP não está na lista de domínios permitidos. Entre em contato com seu administrador.",
   "com_ui_mcp_enter_var": "Insira um valor para {{0}}",
+  "com_ui_mcp_init_failed": "Falha ao inicializar o servidor MCP",
   "com_ui_mcp_initialize": "Inicializar",
   "com_ui_mcp_initialized_success": "Servidor MCP '{{0}}' inicializou com sucesso",
+  "com_ui_mcp_invalid_url": "Insira um URL válido",
+  "com_ui_mcp_no_description": "Nenhuma descrição disponível",
+  "com_ui_mcp_oauth_cancelled": "Login OAuth cancelado para {{0}}",
+  "com_ui_mcp_oauth_timeout": "O login do OAuth expirou para {{0}}",
+  "com_ui_mcp_programmatic": "Programático",
+  "com_ui_mcp_programmatic_all": "Marcar tudo como programático",
+  "com_ui_mcp_server": "Servidor MCP",
+  "com_ui_mcp_server_connection_failed": "A tentativa de conexão com o servidor MCP fornecido falhou. Certifique-se de que a URL, o tipo de servidor e qualquer configuração de autenticação estejam corretos e tente novamente. Certifique-se também de que a URL esteja acessível.",
+  "com_ui_mcp_server_created": "Servidor MCP criado com sucesso",
+  "com_ui_mcp_server_delete_confirm": "Tem certeza de que deseja excluir este servidor MCP?",
+  "com_ui_mcp_server_deleted": "Servidor MCP excluído com sucesso",
+  "com_ui_mcp_server_role_editor": "Editor de servidor MCP",
+  "com_ui_mcp_server_role_editor_desc": "Pode visualizar, usar e editar servidores MCP",
+  "com_ui_mcp_server_role_owner": "Proprietário do servidor MCP",
+  "com_ui_mcp_server_role_owner_desc": "Controle total sobre servidores MCP",
+  "com_ui_mcp_server_role_viewer": "Visualizador do servidor MCP",
+  "com_ui_mcp_server_role_viewer_desc": "Pode visualizar e usar servidores MCP",
+  "com_ui_mcp_server_updated": "Servidor MCP atualizado com sucesso",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
   "com_ui_mcp_servers": "Servidores MCP",
+  "com_ui_mcp_servers_allow_create": "Permitir que os usuários criem servidores MCP",
+  "com_ui_mcp_servers_allow_share": "Permitir que os usuários compartilhem servidores MCP",
+  "com_ui_mcp_servers_allow_share_public": "Permitir que os usuários compartilhem servidores MCP publicamente",
+  "com_ui_mcp_servers_allow_use": "Permitir que os usuários usem servidores MCP",
+  "com_ui_mcp_title_invalid": "O título só pode conter letras, números e espaços",
+  "com_ui_mcp_tool_options": "Opções de ferramentas",
+  "com_ui_mcp_transport": "Transporte",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "HTTPS com streaming",
+  "com_ui_mcp_undefer": "Não adiar",
+  "com_ui_mcp_undefer_all": "Cancelar adiamento de todas as ferramentas",
+  "com_ui_mcp_unprogrammatic_all": "Desmarcar tudo como programático",
   "com_ui_mcp_update_var": "Atualizar {{0}}",
   "com_ui_mcp_url": "URL do Servidor MCP",
   "com_ui_medium": "Médio",
   "com_ui_memories": "Memórias",
   "com_ui_memories_allow_create": "Permitir criação de Memórias",
+  "com_ui_memories_allow_opt_out": "Permitir que os usuários desativem as Memórias",
+  "com_ui_memories_allow_read": "Permitir leitura de memórias",
   "com_ui_memories_allow_update": "Permite a atualização de Memórias",
   "com_ui_memories_allow_use": "Permite a utilização de Memórias",
   "com_ui_memories_filter": "Filtrar memórias...",
   "com_ui_memory": "Memória",
+  "com_ui_memory_already_exceeded": "Armazenamento de memória já cheio; excedido em {{tokens}} tokens. Exclua memórias existentes antes de adicionar novas.",
   "com_ui_memory_created": "Memória criada com sucesso",
   "com_ui_memory_deleted": "Memória removida",
   "com_ui_memory_deleted_items": "Memórias removidas",
+  "com_ui_memory_error": "Erro de memória",
+  "com_ui_memory_key_exists": "Já existe uma memória com esta chave. Por favor, use uma chave diferente.",
+  "com_ui_memory_key_hint": "Use apenas letras minúsculas e sublinhados",
+  "com_ui_memory_key_validation": "A chave de memória deve conter apenas letras minúsculas e sublinhados.",
   "com_ui_memory_storage_full": "Armazenamento de Memória Cheio",
   "com_ui_memory_updated": "Memória salva atualizada",
   "com_ui_memory_updated_items": "Memórias Atualizadas",
   "com_ui_memory_would_exceed": "Impossível salvar - excederia o limite por {{tokens} tokens. Remova memórias existentes para liberar espaço.",
   "com_ui_mention": "Mencione um endpoint, assistente ou predefinição para alternar rapidamente para ele",
+  "com_ui_mermaid": "Mermaid",
+  "com_ui_mermaid_failed": "Falha ao renderizar o diagrama:",
+  "com_ui_mermaid_source": "Código fonte:",
+  "com_ui_message_input": "Entrada de mensagem",
+  "com_ui_microphone_unavailable": "O microfone não está disponível",
   "com_ui_min_tags": "Não é possível remover mais valores, um mínimo de {{0}} é necessário.",
+  "com_ui_minimal": "Mínimo",
   "com_ui_misc": "Diversos",
   "com_ui_model": "Modelo",
   "com_ui_model_parameters": "Parâmetros do Modelo",
+  "com_ui_model_parameters_reset": "Os parâmetros do modelo foram redefinidos.",
+  "com_ui_model_selected": "{{0}} selecionado",
+  "com_ui_model_spec": "Especificações do modelo",
   "com_ui_more_info": "Mais informações",
   "com_ui_my_prompts": "Meus Prompts",
   "com_ui_name": "Nome",
+  "com_ui_name_sort": "Classificar por nome",
+  "com_ui_navigate_results": "Navegue pelos resultados",
   "com_ui_new": "Novo",
   "com_ui_new_chat": "Novo chat",
+  "com_ui_new_conversation_title": "Novo título da conversa",
   "com_ui_next": "Próximo",
+  "com_ui_next_result": "Próximo resultado",
   "com_ui_no": "Não",
+  "com_ui_no_auth": "Nenhum (detecção automática)",
   "com_ui_no_bookmarks": "Parece que você ainda não tem favoritos. Clique em um chat e adicione um novo",
+  "com_ui_no_bookmarks_match": "Nenhum favorito corresponde à sua pesquisa",
+  "com_ui_no_bookmarks_title": "Ainda não há favoritos",
+  "com_ui_no_categories": "Nenhuma categoria disponível",
   "com_ui_no_category": "Sem categoria",
+  "com_ui_no_changes": "Nenhuma alteração foi feita",
+  "com_ui_no_individual_access": "Nenhum usuário ou grupo individual tem acesso a este agente",
+  "com_ui_no_labels": "Sem rótulos",
+  "com_ui_no_mcp_servers": "Ainda não há servidores MCP",
+  "com_ui_no_mcp_servers_match": "Nenhum servidor MCP corresponde ao seu filtro",
+  "com_ui_no_memories": "Sem memórias. Crie-as manualmente ou peça à IA para lembrar de algo",
+  "com_ui_no_memories_match": "Nenhuma memória corresponde à sua pesquisa",
+  "com_ui_no_memories_title": "Ainda não há memórias",
+  "com_ui_no_prompts_title": "Ainda não há prompts",
+  "com_ui_no_read_access": "Você não tem permissão para ver memórias",
+  "com_ui_no_results_found": "Nenhum resultado encontrado",
   "com_ui_no_terms_content": "Nenhum conteúdo de termos e condições para exibir",
   "com_ui_none": "Nenhum",
   "com_ui_not_used": "Não usado",
   "com_ui_nothing_found": "Nada encontrado",
   "com_ui_oauth": "OAuth",
+  "com_ui_oauth_connected_to": "Conectado a",
+  "com_ui_oauth_error_callback_failed": "Falha no retorno de chamada de autenticação. Por favor, tente novamente.",
+  "com_ui_oauth_error_generic": "Falha na autenticação. Por favor, tente novamente.",
+  "com_ui_oauth_error_invalid_state": "Parâmetro de estado inválido. Por favor, tente novamente.",
+  "com_ui_oauth_error_missing_code": "O código de autorização está faltando. Por favor, tente novamente.",
+  "com_ui_oauth_error_missing_state": "O parâmetro de estado está ausente. Por favor, tente novamente.",
+  "com_ui_oauth_error_title": "Falha na autenticação",
+  "com_ui_oauth_success_description": "Sua autenticação foi bem-sucedida. Esta janela será fechada em",
+  "com_ui_oauth_success_title": "Autenticação bem-sucedida",
   "com_ui_of": "de",
   "com_ui_off": "Desligado",
+  "com_ui_offline": "Off-line",
+  "com_ui_omitted": "Omitido",
   "com_ui_on": "Ligado",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (abre em uma nova guia)",
+  "com_ui_open_source_chat_new_tab": "Abrir chat de origem em nova guia",
+  "com_ui_open_source_chat_new_tab_title": "Abrir chat de origem em nova guia - {{title}}",
+  "com_ui_open_var": "Abrir {{0}}",
   "com_ui_openai": "OpenAI",
+  "com_ui_optional": "(opcional)",
+  "com_ui_options": "opções",
+  "com_ui_output": "Saída",
   "com_ui_page": "Página",
+  "com_ui_pagination": "Paginação",
+  "com_ui_parameters": "Parâmetros",
+  "com_ui_people": "pessoas",
+  "com_ui_people_picker": "Seletor de pessoas",
+  "com_ui_people_picker_allow_view_groups": "Permitir visualização de grupos",
+  "com_ui_people_picker_allow_view_roles": "Permitir visualização de funções",
+  "com_ui_people_picker_allow_view_users": "Permitir visualização de usuários",
+  "com_ui_permissions_failed_load": "Falha ao carregar permissões. Por favor, tente novamente.",
+  "com_ui_permissions_failed_update": "Falha ao atualizar as permissões. Por favor, tente novamente.",
+  "com_ui_permissions_updated_success": "Permissões atualizadas com sucesso",
+  "com_ui_pin": "Fixar",
+  "com_ui_preferences_updated": "Preferências atualizadas com sucesso",
   "com_ui_prev": "Anterior",
+  "com_ui_prev_result": "Resultado anterior",
   "com_ui_preview": "Pré-visualizar",
+  "com_ui_preview_unavailable": "A visualização não está disponível para este tipo de arquivo",
   "com_ui_privacy_policy": "Política de Privacidade",
   "com_ui_privacy_policy_url": "URL da Política de Privacidade",
+  "com_ui_production": "Produção",
   "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Seletor de categoria do prompt",
+  "com_ui_prompt_delete_confirm": "Tem certeza de que deseja excluir o prompt '{{0}}'?",
+  "com_ui_prompt_delete_error": "Ocorreu um erro ao excluir o prompt",
+  "com_ui_prompt_deleted_group": "Grupo de prompts \"{{0}}\" excluído",
+  "com_ui_prompt_details": "Detalhes do prompt {{name}}",
+  "com_ui_prompt_group_button": "Prompt {{name}}, categoria {{category}}",
+  "com_ui_prompt_group_button_no_category": "Prompt {{name}}",
+  "com_ui_prompt_groups": "Lista de grupos de prompts",
+  "com_ui_prompt_input": "Entrada de prompt",
+  "com_ui_prompt_input_field": "Campo de entrada de texto de prompt",
   "com_ui_prompt_name": "Nome do Prompt",
   "com_ui_prompt_name_required": "Nome do Prompt é obrigatório",
   "com_ui_prompt_preview_not_shared": "O autor não permitiu colaboração para este prompt.",
   "com_ui_prompt_text": "Texto",
   "com_ui_prompt_text_required": "Texto é obrigatório",
   "com_ui_prompt_update_error": "Houve um erro ao atualizar o prompt",
+  "com_ui_prompt_variables_list": "Lista de variáveis de prompt",
   "com_ui_prompts": "Prompts",
   "com_ui_prompts_allow_create": "Permitir criação de Prompts",
+  "com_ui_prompts_allow_share": "Permitir compartilhamento de prompts",
+  "com_ui_prompts_allow_share_public": "Permitir o compartilhamento de prompts publicamente",
   "com_ui_prompts_allow_use": "Permitir uso de Prompts",
   "com_ui_provider": "Provedor",
+  "com_ui_quality": "Qualidade",
   "com_ui_read_aloud": "Ler em voz alta",
+  "com_ui_redirect_uri": "URI de redirecionamento",
+  "com_ui_redirect_uri_instructions": "Copie este URI de redirecionamento e configure-o nas configurações do seu provedor OAuth.",
+  "com_ui_redirecting_to_provider": "Redirecionando para {{0}}, aguarde...",
+  "com_ui_reference_saved_memories": "Referência de memórias salvas",
+  "com_ui_reference_saved_memories_description": "Permita que o assistente faça referência e use suas memórias salvas ao responder",
+  "com_ui_refresh": "Atualizar",
   "com_ui_refresh_link": "Atualizar link",
+  "com_ui_refresh_page": "Atualizar página",
   "com_ui_regenerate": "Regenerar",
   "com_ui_regenerate_backup": "Regerar código de backup",
   "com_ui_regenerating": "Regerando...",
   "com_ui_region": "Região",
+  "com_ui_reinitialize": "Reinicializar",
+  "com_ui_relevance": "Relevância",
+  "com_ui_remote_access": "Acesso remoto",
+  "com_ui_remote_agent_role_editor": "Editor",
+  "com_ui_remote_agent_role_editor_desc": "Pode visualizar e modificar o agente via API",
+  "com_ui_remote_agent_role_owner": "Proprietário da API",
+  "com_ui_remote_agent_role_owner_desc": "Acesso total à API e permissão para conceder acesso remoto a outras pessoas",
+  "com_ui_remote_agent_role_viewer": "Visualizador da API",
+  "com_ui_remote_agent_role_viewer_desc": "Pode consultar o agente via API",
+  "com_ui_remote_agents": "Agentes Remotos (API)",
+  "com_ui_remote_agents_allow_create": "Permitir que os usuários criem agentes via API",
+  "com_ui_remote_agents_allow_share": "Permitir que usuários concedam acesso à API dos agentes a outras pessoas",
+  "com_ui_remote_agents_allow_share_public": "Permitir que usuários concedam acesso à API dos agentes a todos os usuários",
+  "com_ui_remote_agents_allow_use": "Permitir que os usuários criem chaves de API e consultem agentes remotamente",
+  "com_ui_remove_agent_from_chain": "Remover {{0}} da cadeia",
+  "com_ui_remove_user": "Remover {{0}}",
   "com_ui_rename": "Renomear",
+  "com_ui_rename_conversation": "Renomear conversa",
+  "com_ui_rename_failed": "Falha ao renomear a conversa",
   "com_ui_requires_auth": "Requer autenticação",
+  "com_ui_reset": "Redefinir",
+  "com_ui_reset_adjustments": "Redefinir ajustes",
   "com_ui_reset_var": "Redefinir {{0}}",
+  "com_ui_reset_zoom": "Redefinir zoom",
+  "com_ui_resource": "recurso",
+  "com_ui_response": "Resposta",
   "com_ui_result": "Resultado",
+  "com_ui_result_found": "Resultado {{count}} encontrado",
+  "com_ui_results_found": "Resultados {{count}} encontrados",
+  "com_ui_retrieved_files": "Arquivos pesquisados",
+  "com_ui_retry": "Tentar novamente",
   "com_ui_revoke": "Revogar",
   "com_ui_revoke_info": "Revogar todas as credenciais fornecidas pelo usuário",
   "com_ui_revoke_key_confirm": "Tem certeza de que deseja revogar esta chave?",
   "com_ui_revoke_key_endpoint": "Revogar chave para {{0}}",
+  "com_ui_revoke_key_error": "Falha ao revogar a chave de API. Por favor, tente novamente.",
+  "com_ui_revoke_key_success": "Chave de API revogada com sucesso",
   "com_ui_revoke_keys": "Revogar chaves",
   "com_ui_revoke_keys_confirm": "Tem certeza de que deseja revogar todas as chaves?",
+  "com_ui_role": "Papel",
+  "com_ui_role_editor": "Editor",
+  "com_ui_role_editor_desc": "Pode visualizar e modificar o agente",
+  "com_ui_role_manager": "Gerente",
+  "com_ui_role_manager_desc": "Pode visualizar, modificar e excluir o agente",
+  "com_ui_role_owner": "Proprietário",
+  "com_ui_role_owner_desc": "Tem controle total sobre o agente, incluindo compartilhamento",
   "com_ui_role_select": "Papel",
+  "com_ui_role_viewer": "Visualizador",
+  "com_ui_role_viewer_desc": "Pode visualizar e usar o agente, mas não pode modificá-lo",
   "com_ui_roleplay": "RPG",
+  "com_ui_rotate": "Girar",
+  "com_ui_rotate_90": "Girar 90 graus",
   "com_ui_run_code": "Executar código",
   "com_ui_run_code_error": "Ocorreu um erro ao executar o código",
+  "com_ui_running": "Em execução...",
   "com_ui_save": "Salvar",
+  "com_ui_save_badge_changes": "Salvar alterações dos emblemas?",
+  "com_ui_save_changes": "Salvar alterações",
+  "com_ui_save_key_error": "Falha ao salvar a chave de API. Por favor, tente novamente.",
+  "com_ui_save_key_success": "Chave de API salva com sucesso",
   "com_ui_save_submit": "Salvar & Enviar",
   "com_ui_saved": "Salvo!",
+  "com_ui_saving": "Salvando...",
   "com_ui_schema": "Esquema",
   "com_ui_scope": "Escopo",
   "com_ui_search": "Pesquisar",
+  "com_ui_search_above_to_add": "Pesquise acima para adicionar usuários ou grupos",
+  "com_ui_search_above_to_add_all": "Pesquise acima para adicionar usuários, grupos ou funções",
+  "com_ui_search_above_to_add_people": "Pesquise acima para adicionar pessoas",
+  "com_ui_search_agent_category": "Pesquisar categorias...",
+  "com_ui_search_default_placeholder": "Pesquise por nome ou email (mín. 2 caracteres)",
+  "com_ui_search_people_placeholder": "Pesquise pessoas ou grupos por nome ou email",
+  "com_ui_search_result_count": "Resultado {{count}} encontrado",
+  "com_ui_search_results_count": "Resultados {{count}} encontrados",
+  "com_ui_searching_files": "Pesquisando seus arquivos",
+  "com_ui_seconds": "segundos",
   "com_ui_secret_key": "Chave secreta",
   "com_ui_select": "Selecionar",
+  "com_ui_select_agent": "Selecione Agente",
+  "com_ui_select_all": "Selecionar tudo",
   "com_ui_select_file": "Selecionar um arquivo",
   "com_ui_select_model": "Selecionar um modelo",
+  "com_ui_select_options": "Selecione opções...",
+  "com_ui_select_or_create_prompt": "Selecione ou crie um prompt",
   "com_ui_select_provider": "Selecionar um provedor",
   "com_ui_select_provider_first": "Selecione um provedor primeiro",
   "com_ui_select_region": "Selecione uma região",
+  "com_ui_select_row": "Selecione a linha",
   "com_ui_select_search_model": "Pesquisar modelo por nome",
   "com_ui_select_search_provider": "Pesquisar provedor por nome",
   "com_ui_select_search_region": "Pesquisar região por nome",
+  "com_ui_set": "Definir",
   "com_ui_share": "Compartilhar",
   "com_ui_share_create_message": "Seu nome e quaisquer mensagens que você adicionar após o compartilhamento permanecerão privadas.",
   "com_ui_share_delete_error": "Houve um erro ao excluir o link compartilhado",
   "com_ui_share_error": "Houve um erro ao compartilhar o link do chat",
+  "com_ui_share_everyone": "Compartilhar com todos",
+  "com_ui_share_everyone_description_var": "Este {{resource}} estará disponível para todos. Certifique-se de que o {{resource}} realmente deve ser compartilhado com todos. Tenha cuidado com seus dados.",
   "com_ui_share_link_to_chat": "Compartilhar link para o chat",
+  "com_ui_share_qr_code_description": "Código QR para compartilhar o link desta conversa",
   "com_ui_share_update_message": "Seu nome, instruções personalizadas e quaisquer mensagens que você adicionar após o compartilhamento permanecerão privadas.",
   "com_ui_share_var": "Compartilhar {{0}}",
   "com_ui_shared_link_delete_success": "Link compartilhado excluído com sucesso",
   "com_ui_shared_link_not_found": "Link compartilhado não encontrado",
   "com_ui_shared_prompts": "Prompts Compartilhados",
   "com_ui_shop": "Shopping",
+  "com_ui_show": "Mostrar",
   "com_ui_show_all": "Mostrar Todos",
+  "com_ui_show_code": "Mostrar código",
+  "com_ui_show_image_details": "Mostrar detalhes da imagem",
+  "com_ui_show_less": "Mostrar menos",
+  "com_ui_show_more": "Mostrar mais",
   "com_ui_show_qr": "Mostrar QR Code",
   "com_ui_sign_in_to_domain": "Entre em {{0}}",
-  "com_ui_simple": "Simples",
   "com_ui_size": "Tamanho",
+  "com_ui_size_sort": "Classificar por tamanho",
+  "com_ui_special": "especial",
+  "com_ui_special_var_current_date": "Data Atual",
+  "com_ui_special_var_current_datetime": "Data e hora atuais",
+  "com_ui_special_var_current_user": "Usuário atual",
+  "com_ui_special_var_desc_current_date": "Data de hoje e dia da semana",
+  "com_ui_special_var_desc_current_datetime": "Data e hora local no seu fuso horário",
+  "com_ui_special_var_desc_current_user": "Nome de exibição da sua conta",
+  "com_ui_special_var_desc_iso_datetime": "Data e hora UTC no formato ISO 8601",
+  "com_ui_special_var_iso_datetime": "Data e hora UTC ISO",
+  "com_ui_special_variable_added": "Variável especial {{0}} adicionada.",
   "com_ui_special_variables": "Variáveis especiais:",
+  "com_ui_speech_not_supported": "Seu navegador não suporta reconhecimento de fala",
+  "com_ui_speech_not_supported_use_external": "Seu navegador não suporta reconhecimento de fala. Tente mudar para STT externo em Configurações > Fala.",
   "com_ui_speech_while_submitting": "Não é possível enviar a fala enquanto uma resposta está sendo gerada",
+  "com_ui_sr_global_prompt": "Grupo de prompt global",
+  "com_ui_stack_trace": "Rastreamento de pilha",
+  "com_ui_status_prefix": "Status:",
   "com_ui_stop": "Parar",
   "com_ui_storage": "Armazenamento",
+  "com_ui_storage_filter_sort": "Filtrar e classificar por armazenamento",
   "com_ui_submit": "Enviar",
+  "com_ui_summarized": "Resumido",
+  "com_ui_summarizing": "Resumindo...",
+  "com_ui_support_contact": "Contato de suporte",
+  "com_ui_support_contact_email": "Email",
+  "com_ui_support_contact_email_invalid": "Por favor insira um endereço de email válido",
+  "com_ui_support_contact_email_placeholder": "suporte@exemplo.com",
+  "com_ui_support_contact_name": "Nome",
+  "com_ui_support_contact_name_min_length": "O nome deve ter pelo menos {{minLength}} caracteres",
+  "com_ui_support_contact_name_placeholder": "Nome do contato de suporte",
   "com_ui_teach_or_explain": "Aprendizado",
+  "com_ui_temporary": "Chat temporário",
   "com_ui_terms_and_conditions": "Termos e Condições",
   "com_ui_terms_of_service": "Termos de Serviço",
+  "com_ui_text_variables": "Variáveis de texto",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensamentos",
+  "com_ui_toggle_theme": "Alternar tema",
+  "com_ui_token": "token",
   "com_ui_token_exchange_method": "Método de troca de tokens",
   "com_ui_token_url": "URL do token",
+  "com_ui_tokens": "tokens",
+  "com_ui_tool_collection_prefix": "Uma coleção de ferramentas de",
+  "com_ui_tool_failed": "falhou",
+  "com_ui_tool_list_collapse": "Recolher lista de ferramentas de {{serverName}}",
+  "com_ui_tool_list_expand": "Expandir lista de ferramentas de {{serverName}}",
+  "com_ui_tool_name_code": "Código",
+  "com_ui_tool_name_code_analysis": "Análise de código",
+  "com_ui_tool_name_file_search": "Pesquisa de arquivos",
+  "com_ui_tool_name_image_edit": "Edição de imagem",
+  "com_ui_tool_name_image_gen": "Geração de imagem",
+  "com_ui_tool_name_web_search": "Pesquisa na Web",
   "com_ui_tools": "Ferramentas",
+  "com_ui_tools_and_actions": "Ferramentas e ações",
+  "com_ui_transferred_to": "Transferido para",
   "com_ui_travel": "Viagem",
+  "com_ui_trust_app": "Eu confio neste aplicativo",
+  "com_ui_try_adjusting_search": "Tente ajustar seus termos de pesquisa",
+  "com_ui_ui_resource_error": "Erro de recurso de UI ({{0}})",
+  "com_ui_ui_resource_not_found": "Recurso de UI não encontrado (índice: {{0}})",
   "com_ui_unarchive": "Desarquivar",
+  "com_ui_unarchive_conversation": "Desarquivar conversa",
   "com_ui_unarchive_error": "Falha ao desarquivar conversa",
+  "com_ui_unavailable": "Indisponível",
   "com_ui_unknown": "Desconhecido",
+  "com_ui_unpin": "Desafixar",
+  "com_ui_unset": "Não definido",
+  "com_ui_untitled": "Sem título",
   "com_ui_update": "Atualizar",
+  "com_ui_update_mcp_server": "Atualizar servidor MCP",
+  "com_ui_updating": "Atualizando...",
   "com_ui_upload": "Carregar",
+  "com_ui_upload_agent_avatar": "Avatar do agente atualizado com sucesso",
+  "com_ui_upload_agent_avatar_label": "Carregar imagem de avatar do agente",
+  "com_ui_upload_avatar_label": "Carregar imagem de avatar",
   "com_ui_upload_delay": "O upload de \"{{0}}\" está demorando mais do que o esperado. Por favor, aguarde enquanto o arquivo termina de ser indexado para recuperação.",
   "com_ui_upload_error": "Houve um erro ao carregar seu arquivo",
   "com_ui_upload_file_context": "Contexto de upload de arquivo",
   "com_ui_upload_file_search": "Upload para pesquisa de arquivos",
   "com_ui_upload_files": "Carregar arquivos",
+  "com_ui_upload_icon": "Carregar imagem do ícone",
   "com_ui_upload_image": "Carregar uma imagem",
   "com_ui_upload_image_input": "Upload de imagem",
   "com_ui_upload_invalid": "Arquivo inválido para upload. Deve ser uma imagem não excedendo o limite",
@@ -925,18 +1499,30 @@
   "com_ui_upload_provider": "Anexar Arquivos",
   "com_ui_upload_success": "Arquivo carregado com sucesso",
   "com_ui_upload_type": "Selecione o tipo de upload",
+  "com_ui_usage": "Uso",
   "com_ui_use_2fa_code": "Use o código 2FA em vez disso",
   "com_ui_use_backup_code": "Use o código de backup",
+  "com_ui_use_memory": "Usar memória",
   "com_ui_use_micrphone": "Usar microfone",
+  "com_ui_use_prompt": "Usar prompt",
   "com_ui_used": "Usado",
+  "com_ui_used_n_tools": "{{0}} ferramentas usadas",
+  "com_ui_user": "Usuário",
+  "com_ui_user_group_permissions": "Permissões de usuário e grupo",
+  "com_ui_user_provides_key": "Cada usuário fornece sua própria chave",
+  "com_ui_value": "Valor",
+  "com_ui_variable_with_options": "Variável {{name}} com {{count}} opções",
   "com_ui_variables": "Variáveis",
   "com_ui_verify": "Verificar",
   "com_ui_version_var": "Versão {{0}}",
   "com_ui_versions": "Versões",
+  "com_ui_via_server": "em {{0}}",
+  "com_ui_view_memory": "Ver memória",
   "com_ui_web_search": "Busca na web",
   "com_ui_web_search_cohere_key": "Insira a chave de API Cohere",
   "com_ui_web_search_firecrawl_url": "URL da API Firecrawl (opcional)",
   "com_ui_web_search_jina_key": "Insira a chave de API Jina",
+  "com_ui_web_search_jina_url": "URL da API Jina (opcional)",
   "com_ui_web_search_processing": "Resultados de processamento",
   "com_ui_web_search_provider": "Provedor de Buscas",
   "com_ui_web_search_provider_searxng": "SearXNG",
@@ -948,16 +1534,28 @@
   "com_ui_web_search_reranker_cohere_key": "Obtenha sua chave de API Cohere",
   "com_ui_web_search_reranker_jina": "Jina AI",
   "com_ui_web_search_reranker_jina_key": "Obtenha sua chave de API Jina",
+  "com_ui_web_search_reranker_jina_url_help": "Saiba mais sobre a API Jina Rerank",
   "com_ui_web_search_scraper": "Scraper",
   "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
   "com_ui_web_search_scraper_firecrawl_key": "Obtenha sua chave de API Firecrawl",
+  "com_ui_web_search_scraper_serper": "API Serper Scrape",
+  "com_ui_web_search_scraper_serper_key": "Obtenha sua chave de API Serper",
   "com_ui_web_search_searxng_api_key": "Insira sua Chave de API SearXNG (opcional)",
+  "com_ui_web_search_searxng_instance_url": "URL da instância SearXNG",
+  "com_ui_web_search_source": "{{count}} fonte",
+  "com_ui_web_search_sources": "{{count}} fontes",
+  "com_ui_web_searched": "Pesquisa na web concluída",
   "com_ui_web_searching": "Procurando na web",
   "com_ui_web_searching_again": "Procurando na web novamente",
   "com_ui_weekend_morning": "Boa semana",
   "com_ui_write": "Escrevendo",
   "com_ui_x_selected": "{{0}} selecionado",
+  "com_ui_xhigh": "Muito alto",
   "com_ui_yes": "Sim",
+  "com_ui_your_api_key": "Sua chave de API",
   "com_ui_zoom": "Zoom",
+  "com_ui_zoom_in": "Ampliar",
+  "com_ui_zoom_level": "Nível de zoom",
+  "com_ui_zoom_out": "Diminuir zoom",
   "com_user_message": "Você"
 }
diff --git a/client/src/locales/pt-PT/translation.json b/client/src/locales/pt-PT/translation.json
index 7d136f187ea..480e2bc6784 100644
--- a/client/src/locales/pt-PT/translation.json
+++ b/client/src/locales/pt-PT/translation.json
@@ -398,15 +398,12 @@
   "com_nav_browser": "Navegador",
   "com_nav_center_chat_input": "Centrar a conversa no ecrã de boas vindas",
   "com_nav_change_picture": "Mudar foto",
-  "com_nav_chat_commands": "Comandos de conversa",
-  "com_nav_chat_commands_info": "Estes comandos são ativados ao escrever caracteres específicos no início da sua mensagem. Cada comando corre segundo o seu prefixo. Poderá desligar os mesmos se usa esses caracteres no início das suas mensagens com alguma frequência.",
   "com_nav_chat_direction": "Direção do chat",
   "com_nav_clear_all_chats": "Limpar todos os chats",
   "com_nav_clear_cache_confirm_message": "Tem a certeza que pretende apagar a cache?",
   "com_nav_clear_conversation": "Limpar conversas",
   "com_nav_clear_conversation_confirm_message": "Tem certeza de que deseja limpar todas as conversas? Isso é irreversível.",
   "com_nav_close_sidebar": "Fechar barra lateral",
-  "com_nav_commands": "Comandos",
   "com_nav_confirm_clear": "Confirmar Limpeza",
   "com_nav_conversation_mode": "Modo de Conversa",
   "com_nav_convo_menu_options": "Opções do Menu de Conversa",
@@ -514,12 +511,9 @@
   "com_nav_search_placeholder": "Buscar mensagens",
   "com_nav_send_message": "Enviar mensagem",
   "com_nav_setting_account": "Conta",
-  "com_nav_setting_balance": "Saldo",
   "com_nav_setting_chat": "Chat",
-  "com_nav_setting_data": "Controles de dados",
   "com_nav_setting_general": "Geral",
   "com_nav_setting_mcp": "Configurações MCP",
-  "com_nav_setting_personalization": "Personalização",
   "com_nav_setting_speech": "Fala",
   "com_nav_settings": "Configurações",
   "com_nav_shared_links": "Links compartilhados",
@@ -882,7 +876,6 @@
   "com_ui_group": "Grupo",
   "com_ui_happy_birthday": "É meu 1º aniversário!",
   "com_ui_hide_image_details": "Ocultar Detalhes da Imagem",
-  "com_ui_hide_password": "Ocultar palavra-passe",
   "com_ui_hide_qr": "Esconder QR Code",
   "com_ui_high": "Alto",
   "com_ui_host": "Host",
@@ -965,7 +958,6 @@
   "com_ui_no_changes": "Não foram feitas alterações",
   "com_ui_no_data": "algo precisa estar aqui. estava vazio",
   "com_ui_no_individual_access": "Nenhum utilizador individual ou grupo tem acesso a este agente",
-  "com_ui_no_personalization_available": "Não existem opções de personalização disponíveis atualmente",
   "com_ui_no_read_access": "Não tem permissão para ver memórias",
   "com_ui_no_results_found": "Nenhum resultado encontrado",
   "com_ui_no_terms_content": "Nenhum conteúdo de termos e condições para exibir",
@@ -1099,10 +1091,8 @@
   "com_ui_shop": "Compras",
   "com_ui_show_all": "Mostrar Todos",
   "com_ui_show_image_details": "Mostrar Detalhes da Imagem",
-  "com_ui_show_password": "Mostrar palavra-passe",
   "com_ui_show_qr": "Mostrar QR Code",
   "com_ui_sign_in_to_domain": "Autenticar em {{0}}",
-  "com_ui_simple": "Simples",
   "com_ui_size": "Tamanho",
   "com_ui_special_var_current_date": "Data Atual",
   "com_ui_special_var_current_datetime": "Data e Hora Atual",
diff --git a/client/src/locales/ru/translation.json b/client/src/locales/ru/translation.json
index 95e0577eb3d..2435cee429c 100644
--- a/client/src/locales/ru/translation.json
+++ b/client/src/locales/ru/translation.json
@@ -416,15 +416,12 @@
   "com_nav_browser": "Браузер",
   "com_nav_center_chat_input": "Центрировать поле ввода чата на экране приветствия",
   "com_nav_change_picture": "Изменить изображение",
-  "com_nav_chat_commands": "Команды чата",
-  "com_nav_chat_commands_info": "Эти команды активируются при вводе определенных символов в начале вашего сообщения. Каждая команда запускается своим префиксом. Вы можете отключить их, если часто используете эти символы для начала сообщений.",
   "com_nav_chat_direction": "Направление чата",
   "com_nav_clear_all_chats": "Удалить все чаты",
   "com_nav_clear_cache_confirm_message": "Вы уверены, что хотите очистить кэш?",
   "com_nav_clear_conversation": "Удалить чаты",
   "com_nav_clear_conversation_confirm_message": "Вы уверены, что хотите удалить все чаты? Это действие нельзя отменить.",
   "com_nav_close_sidebar": "Закрыть боковую панель",
-  "com_nav_commands": "Команды",
   "com_nav_confirm_clear": "Подтвердить удаление",
   "com_nav_control_panel": "Контрольная панель",
   "com_nav_conversation_mode": "Режим диалога",
@@ -543,13 +540,10 @@
   "com_nav_search_placeholder": "Поиск сообщений",
   "com_nav_send_message": "Отправить сообщение",
   "com_nav_setting_account": "Аккаунт",
-  "com_nav_setting_balance": "Баланс",
   "com_nav_setting_chat": "Чат",
-  "com_nav_setting_data": "Управление данными",
   "com_nav_setting_delay": "Задержка (сек.)",
   "com_nav_setting_general": "Общие",
   "com_nav_setting_mcp": "Настройки MCP",
-  "com_nav_setting_personalization": "Персонализация",
   "com_nav_setting_speech": "Голос",
   "com_nav_settings": "Настройки",
   "com_nav_shared_links": "Связываемые ссылки",
@@ -960,7 +954,6 @@
   "com_ui_header_format": "Формат заголовка",
   "com_ui_hide_code": "Спрятать код",
   "com_ui_hide_image_details": "Скрыть детали изображения",
-  "com_ui_hide_password": "Скрыть пароль",
   "com_ui_hide_qr": "Скрыть QR код",
   "com_ui_high": "Высокое",
   "com_ui_host": "Хост",
@@ -1056,7 +1049,6 @@
   "com_ui_no_data": "здесь должно быть что-то. было пусто",
   "com_ui_no_individual_access": "Ни один отдельный пользователь или группа не имеют доступа к этому агенту.",
   "com_ui_no_memories": "Нет воспоминаний. Создайте их вручную или попросите ИИ что-нибудь запомнить.",
-  "com_ui_no_personalization_available": "В настоящее время нет доступных опций персонализации.",
   "com_ui_no_read_access": "У вас нет разрешения на просмотр воспоминаний",
   "com_ui_no_results_found": "Результаты не найдены",
   "com_ui_no_terms_content": "Нет содержания условий использования для отображения",
@@ -1158,7 +1150,7 @@
   "com_ui_save": "Сохранить",
   "com_ui_save_badge_changes": "Сохранить изменения значков?",
   "com_ui_save_changes": "Сохранить изменения",
-  "com_ui_save_key_error": "Ошибк",
+  "com_ui_save_key_error": "Не удалось сохранить API-ключ. Повторите попытку.",
   "com_ui_save_key_success": "API-ключ сохранен успешно",
   "com_ui_save_submit": "Сохранить и отправить",
   "com_ui_saved": "Сохранено!",
@@ -1175,7 +1167,7 @@
   "com_ui_seconds": "секунды",
   "com_ui_secret_key": "Секретный ключ",
   "com_ui_select": "Выбрать",
-  "com_ui_select_agent": "Выб",
+  "com_ui_select_agent": "Выберите агента",
   "com_ui_select_all": "Выбрать все",
   "com_ui_select_file": "Выберите файл",
   "com_ui_select_model": "Выберите модель",
@@ -1205,10 +1197,8 @@
   "com_ui_show_all": "Показать все",
   "com_ui_show_code": "Показать код",
   "com_ui_show_image_details": "Показать детали изображения",
-  "com_ui_show_password": "Показать пароль",
   "com_ui_show_qr": "Показать QR код",
   "com_ui_sign_in_to_domain": "Вход в {{0}}",
-  "com_ui_simple": "Простой",
   "com_ui_size": "Размер",
   "com_ui_size_sort": "Отсортировать по размеру",
   "com_ui_special_var_current_date": "Текущая дата",
diff --git a/client/src/locales/sv/translation.json b/client/src/locales/sv/translation.json
index 88b5cc038e8..4619f725130 100644
--- a/client/src/locales/sv/translation.json
+++ b/client/src/locales/sv/translation.json
@@ -309,13 +309,11 @@
   "com_nav_browser": "Webbläsare",
   "com_nav_center_chat_input": "Centrera chattfältet på hemsidan",
   "com_nav_change_picture": "Ändra bild",
-  "com_nav_chat_commands": "Chattkommandon",
   "com_nav_chat_direction": "Chattriktning",
   "com_nav_clear_all_chats": "Rensa alla chattar",
   "com_nav_clear_conversation": "Rensa konversationer",
   "com_nav_clear_conversation_confirm_message": "Är du säker på att du vill rensa alla konversationer? Detta går inte att ångra.",
   "com_nav_close_sidebar": "Stäng sidofält",
-  "com_nav_commands": "Kommandon",
   "com_nav_confirm_clear": "Bekräfta rensning",
   "com_nav_conversation_mode": "Konversationsläge",
   "com_nav_convo_menu_options": "Konversationsmenyalternativ",
@@ -371,7 +369,6 @@
   "com_nav_send_message": "Skicka meddelande",
   "com_nav_setting_account": "Konto",
   "com_nav_setting_chat": "Chatt",
-  "com_nav_setting_data": "Datakontroller",
   "com_nav_setting_general": "Allmänt",
   "com_nav_settings": "Inställningar",
   "com_nav_shared_links": "Delade länkar",
@@ -472,7 +469,6 @@
   "com_ui_new_conversation_title": "Ny konversationstitel",
   "com_ui_next": "Nästa",
   "com_ui_no_bookmarks": "det verkar som om du inte har några bokmärken ännu. Klicka på en chatt och lägg till en ny",
-  "com_ui_no_personalization_available": "Inga personaliseringsalternativ är för närvarande tillgängliga",
   "com_ui_no_read_access": "Du har inte behörighet att visa minnen",
   "com_ui_no_terms_content": "Ingen innehåll för villkor för användning att visa",
   "com_ui_none": "Ingen",
diff --git a/client/src/locales/th/translation.json b/client/src/locales/th/translation.json
index 26d7bffe44b..249aa193d60 100644
--- a/client/src/locales/th/translation.json
+++ b/client/src/locales/th/translation.json
@@ -290,15 +290,12 @@
   "com_nav_balance": "ยอดคงเหลือ",
   "com_nav_browser": "เบราว์เซอร์",
   "com_nav_change_picture": "เปลี่ยนรูปภาพ",
-  "com_nav_chat_commands": "คำสั่งแชท",
-  "com_nav_chat_commands_info": "คำสั่งเหล่านี้ถูกเปิดใช้งานโดยการพิมพ์อักขระเฉพาะที่จุดเริ่มต้นของข้อความของคุณ แต่ละคำสั่งจะถูกเรียกใช้โดยคำนำหน้าที่กำหนดไว้ คุณสามารถปิดการใช้งานได้หากคุณมักใช้อักขระเหล่านี้เพื่อเริ่มต้นข้อความ",
   "com_nav_chat_direction": "ทิศทางการแชท",
   "com_nav_clear_all_chats": "ล้างการแชททั้งหมด",
   "com_nav_clear_cache_confirm_message": "คุณแน่ใจหรือว่าต้องการล้างแคช?",
   "com_nav_clear_conversation": "ล้างการสนทนา",
   "com_nav_clear_conversation_confirm_message": "คุณแน่ใจหรือว่าต้องการล้างการสนทนาทั้งหมด? การดำเนินการนี้ไม่สามารถย้อนกลับได้",
   "com_nav_close_sidebar": "ปิดแถบด้านข้าง",
-  "com_nav_commands": "คำสั่ง",
   "com_nav_confirm_clear": "ยืนยันการล้าง",
   "com_nav_conversation_mode": "โหมดการสนทนา",
   "com_nav_convo_menu_options": "ตัวเลือกเมนูการสนทนา",
@@ -387,7 +384,6 @@
   "com_nav_send_message": "ส่งข้อความ",
   "com_nav_setting_account": "บัญชี",
   "com_nav_setting_chat": "แชท",
-  "com_nav_setting_data": "การควบคุมข้อมูล",
   "com_nav_setting_general": "ทั่วไป",
   "com_nav_setting_speech": "คำพูด",
   "com_nav_settings": "ตั้งค่า",
@@ -762,10 +758,8 @@
   "com_ui_shop": "ช็อปปิ้ง",
   "com_ui_show_all": "แสดงทั้งหมด",
   "com_ui_show_image_details": "แสดงรายละเอียดรูปภาพ",
-  "com_ui_show_password": "แสดงรหัสผ่าน",
   "com_ui_show_qr": "แสดง QR Code",
   "com_ui_sign_in_to_domain": "เข้าสู่ระบบไปยัง {{0}}",
-  "com_ui_simple": "เรียบง่าย",
   "com_ui_size": "ขนาด",
   "com_ui_special_var_current_date": "วันที่ปัจจุบัน",
   "com_ui_special_var_current_datetime": "วันที่และเวลาปัจจุบัน",
diff --git a/client/src/locales/tr/translation.json b/client/src/locales/tr/translation.json
index 89e33586127..35310e4d290 100644
--- a/client/src/locales/tr/translation.json
+++ b/client/src/locales/tr/translation.json
@@ -3,25 +3,110 @@
   "chat_direction_right_to_left": "Sağdan Sola",
   "com_a11y_ai_composing": "Yapay zeka hala yanıt oluşturuyor.",
   "com_a11y_end": "Yapay zeka yanıtını tamamladı.",
+  "com_a11y_selected": "seçildi",
   "com_a11y_start": "Yapay zeka yanıtlamaya başladı.",
+  "com_a11y_summarize_completed": "Bağlam özetlendi.",
+  "com_a11y_summarize_failed": "Özetleme başarısız oldu, mevcut bağlamla devam ediliyor.",
+  "com_a11y_summarize_started": "Bağlam özetleniyor.",
+  "com_agents_agent_card_label": "{{name}} ajanı. {{description}}",
+  "com_agents_all": "Tüm Ajanlar",
   "com_agents_all_category": "Hepsi",
+  "com_agents_all_description": "Tüm kategorilerdeki paylaşılan ajanlara göz atın",
+  "com_agents_avatar_upload_error": "Ajan avatarı yüklenemedi",
+  "com_agents_category_aftersales": "Satış Sonrası",
+  "com_agents_category_aftersales_description": "Satış sonrası destek, bakım ve müşteri hizmetlerinde uzmanlaşmış ajanlar",
+  "com_agents_category_empty": "{{category}} kategorisinde ajan bulunamadı",
+  "com_agents_category_finance": "Finans",
+  "com_agents_category_finance_description": "Finansal analiz, bütçeleme ve muhasebede uzmanlaşmış ajanlar",
+  "com_agents_category_general": "Genel",
+  "com_agents_category_general_description": "Yaygın görevler ve sorgular için genel amaçlı ajanlar",
+  "com_agents_category_hr": "İnsan Kaynakları",
+  "com_agents_category_hr_description": "İK süreçleri, politikaları ve çalışan desteğinde uzmanlaşmış ajanlar",
+  "com_agents_category_it": "BT",
+  "com_agents_category_it_description": "BT desteği, teknik sorun giderme ve sistem yönetimi ajanları",
+  "com_agents_category_rd": "Araştırma ve Geliştirme",
+  "com_agents_category_rd_description": "Ar-Ge süreçleri, inovasyon ve teknik araştırmalara odaklanan ajanlar",
+  "com_agents_category_sales": "Satış",
+  "com_agents_category_sales_description": "Satış süreçleri ve müşteri ilişkilerine odaklanan ajanlar",
+  "com_agents_category_tab_label": "{{category}} kategorisi, {{position}} / {{total}}",
+  "com_agents_category_tabs_label": "Ajan Kategorileri",
+  "com_agents_chat_with": "{{name}} ile sohbet et",
+  "com_agents_clear_search": "Aramayı temizle",
+  "com_agents_contact": "İletişim",
+  "com_agents_copy_link": "Bağlantıyı Kopyala",
   "com_agents_create_error": "Ajanınız oluşturulurken bir hata oluştu.",
+  "com_agents_created_by": "tarafından",
+  "com_agents_description_card": "Açıklama: {{description}}",
   "com_agents_description_placeholder": "İsteğe bağlı: Ajanınızı burada tanımlayın",
+  "com_agents_empty_state_heading": "Ajan bulunamadı",
   "com_agents_enable_file_search": "Dosya Aramayı Etkinleştir",
+  "com_agents_error_bad_request_message": "İstek işlenemedi.",
+  "com_agents_error_bad_request_suggestion": "Lütfen girdinizi kontrol edip tekrar deneyin.",
+  "com_agents_error_category_title": "Kategori Hatası",
+  "com_agents_error_generic": "İçerik yüklenirken bir sorunla karşılaştık.",
+  "com_agents_error_invalid_request": "Geçersiz İstek",
+  "com_agents_error_loading": "Ajanlar yüklenirken hata oluştu",
+  "com_agents_error_network_message": "Sunucuya bağlanılamıyor.",
+  "com_agents_error_network_suggestion": "İnternet bağlantınızı kontrol edip tekrar deneyin.",
+  "com_agents_error_network_title": "Bağlantı Sorunu",
+  "com_agents_error_not_found_message": "İstenilen içerik bulunamadı.",
+  "com_agents_error_not_found_suggestion": "Diğer seçeneklere göz atmayı deneyin veya pazaryerine geri dönün.",
+  "com_agents_error_not_found_title": "Bulunamadı",
+  "com_agents_error_retry": "Tekrar Dene",
+  "com_agents_error_search_title": "Arama Hatası",
+  "com_agents_error_searching": "Ajanları ararken hata oluştu",
+  "com_agents_error_server_message": "Sunucu geçici olarak kullanılamıyor.",
+  "com_agents_error_server_suggestion": "Lütfen birkaç dakika sonra tekrar deneyin.",
+  "com_agents_error_server_title": "Sunucu Hatası",
+  "com_agents_error_suggestion_generic": "Lütfen sayfayı yenilemeyi veya daha sonra tekrar denemeyi unutmayın.",
+  "com_agents_error_timeout_message": "İsteğin tamamlanması çok uzun sürdü.",
+  "com_agents_error_timeout_suggestion": "Lütfen internet bağlantınızı kontrol edip tekrar deneyin.",
+  "com_agents_error_timeout_title": "Bağlantı Zaman Aşımı",
+  "com_agents_error_title": "Bir şeyler ters gitti",
+  "com_agents_file_context_description": "\"Bağlam\" olarak yüklenen dosyalar, Ajanın talimatlarını desteklemek üzere metin olarak ayrıştırılır. OCR mevcutsa veya yüklenen dosya türü için yapılandırılmışsa, metni çıkarmak için kullanılır. Bir dosyanın tam metin içeriğine ihtiyaç duyduğunuz belgeler, metin içeren resimler veya PDF'ler için idealdir.",
+  "com_agents_file_context_disabled": "Dosya Bağlamı için dosya yüklemeden önce ajan oluşturulmalıdır.",
+  "com_agents_file_context_label": "Dosya Bağlamı",
   "com_agents_file_search_disabled": "Dosya Arama için dosya yüklemeden önce ajan oluşturulmalıdır.",
   "com_agents_file_search_info": "Etkinleştirildiğinde, ajan aşağıda listelenen dosya adlarından haberdar olacak ve bu dosyalardan ilgili içeriği alabilecektir.",
+  "com_agents_grid_announcement": "{{category}} kategorisinde {{count}} ajan gösteriliyor",
   "com_agents_instructions_placeholder": "Ajanın kullandığı sistem talimatları",
+  "com_agents_link_copied": "Bağlantı kopyalandı",
+  "com_agents_link_copy_failed": "Bağlantı kopyalanamadı",
+  "com_agents_load_more_label": "{{category}} kategorisinden daha fazla ajan yükle",
+  "com_agents_loading": "Yükleniyor...",
+  "com_agents_marketplace": "Ajan Pazaryeri",
+  "com_agents_marketplace_subtitle": "İş akışlarınızı ve üretkenliğinizi artırmak için güçlü yapay zeka ajanlarını keşfedin ve kullanın",
+  "com_agents_mcp_description_placeholder": "Birkaç kelimeyle ne yaptığını açıklayın",
+  "com_agents_mcp_icon_size": "Minimum boyut 128 x 128 piksel",
+  "com_agents_mcp_name_placeholder": "Özel Araç",
+  "com_agents_mcp_trust_subtext": "Özel bağlayıcılar LibreChat tarafından doğrulanmamıştır",
+  "com_agents_missing_name": "Lütfen bir ajan oluşturmadan önce bir ad girin.",
   "com_agents_missing_provider_model": "Lütfen bir ajan oluşturmadan önce bir sağlayıcı ve model seçin.",
   "com_agents_name_placeholder": "İsteğe bağlı: Ajanın adı",
   "com_agents_no_access": "Bu ajanı düzenleme erişiminiz yok.",
+  "com_agents_no_agent_id_error": "Ajan kimliği bulunamadı. Lütfen önce ajanın oluşturulduğundan emin olun.",
+  "com_agents_no_more_results": "Sonuçların sonuna ulaştınız",
   "com_agents_not_available": "Ajan Mevcut Değil",
+  "com_agents_recommended": "Önerilen ajanlarımız",
+  "com_agents_results_for": "'{{query}}' için sonuçlar",
+  "com_agents_search_aria": "Ajanları ara",
+  "com_agents_search_empty_heading": "Arama sonucu yok",
+  "com_agents_search_info": "Etkinleştirildiğinde, ajanınızın güncel bilgi için web'de arama yapmasına olanak tanır. Geçerli bir API anahtarı gerektirir.",
+  "com_agents_search_instructions": "Ajanları ada veya açıklamaya göre aramak için yazın",
   "com_agents_search_name": "Ajanları ada göre ara",
+  "com_agents_search_no_results": "\"{{query}}\" için ajan bulunamadı",
+  "com_agents_search_placeholder": "Ajanları ara...",
+  "com_agents_see_more": "Daha fazla gör",
+  "com_agents_start_chat": "Sohbeti Başlat",
+  "com_agents_top_picks": "En İyiler",
   "com_agents_update_error": "Ajanınız güncellenirken bir hata oluştu.",
   "com_assistants_actions": "Eylemler",
   "com_assistants_actions_disabled": "Eylem eklemeden önce bir asistan oluşturmanız gerekiyor.",
   "com_assistants_actions_info": "Asistanın API'leri kullanarak bilgi getirmesine veya eylem gerçekleştirmesine izin ver",
   "com_assistants_add_actions": "Eylem Ekle",
+  "com_assistants_add_mcp_server_tools": "MCP Sunucu Araçlarını Ekle",
   "com_assistants_add_tools": "Araçları Ekle",
+  "com_assistants_allow_sites_you_trust": "Yalnızca güvendiğiniz sitelere izin verin.",
   "com_assistants_append_date": "Şu anki tarih ve saati ekleyin",
   "com_assistants_append_date_tooltip": "Etkinleştirildiğinde, şu anki müşteri tarihi ve saati, Asistanın sistem talimatlarına eklenir.",
   "com_assistants_available_actions": "Mevcut Eylemler",
@@ -51,11 +136,13 @@
   "com_assistants_non_retrieval_model": "Dosya arama bu modelde etkin değil. Lütfen başka bir model seçin.",
   "com_assistants_retrieval": "Geri Getirme",
   "com_assistants_running_action": "Eylem çalışıyor",
+  "com_assistants_running_var": "{{0}} çalışıyor",
   "com_assistants_search_name": "Asistan adında ara",
   "com_assistants_update_actions_error": "Eylem oluşturma veya güncelleme sırasında bir hata oluştu.",
   "com_assistants_update_actions_success": "Eylem başarıyla oluşturuldu veya güncellendi",
   "com_assistants_update_error": "Asistanınızı güncelleme sırasında bir hata oluştu.",
   "com_assistants_update_success": "Başarıyla güncellendi",
+  "com_assistants_update_success_name": "{{name}} başarıyla güncellendi",
   "com_auth_already_have_account": "Zaten bir hesabınız var mı?",
   "com_auth_apple_login": "Apple ile Giriş Yap",
   "com_auth_back_to_login": "Girişe geri dön",
@@ -80,28 +167,30 @@
   "com_auth_email_verification_redirecting": "{{0}} saniye içinde yönlendiriliyor...",
   "com_auth_email_verification_resend_prompt": "E-postayı almadınız mı?",
   "com_auth_email_verification_success": "E-posta başarıyla doğrulandı",
+  "com_auth_email_verifying_ellipsis": "Doğrulanıyor...",
   "com_auth_error_create": "Hesabınızı kaydetmeye çalışırken bir hata oluştu. Lütfen tekrar deneyin.",
   "com_auth_error_invalid_reset_token": "Bu şifre sıfırlama jetonu artık geçerli değil.",
   "com_auth_error_login": "Sağlanan bilgilerle giriş yapılamıyor. Lütfen kimlik bilgilerinizi kontrol edin ve tekrar deneyin.",
   "com_auth_error_login_ban": "Hesabınız hizmetimize yönelik ihlaller nedeniyle geçici olarak yasaklanmıştır.",
   "com_auth_error_login_rl": "Kısa sürede çok fazla giriş denemesi yapıldı. Lütfen daha sonra tekrar deneyin.",
   "com_auth_error_login_server": "Dahili sunucu hatası oluştu. Lütfen birkaç dakika bekleyin ve tekrar deneyin.",
-  "com_auth_error_login_unverified": "Hesabınız doğrulanmamış. Lütfen doğrulama bağlantısı için e-postanızı kontrol edin.",
+  "com_auth_error_login_unverified": "Hesabınız doğrulanmamış. Lütfen doğrulama yapmak için e-posta kutunuzu kontrol edin.",
+  "com_auth_error_oauth_failed": "Kimlik doğrulama başarısız oldu. Lütfen giriş yönteminizi kontrol edin ve tekrar deneyin.",
   "com_auth_facebook_login": "Facebook ile devam et",
-  "com_auth_full_name": "Tam adı",
+  "com_auth_full_name": "Tam isim",
   "com_auth_github_login": "Github ile devam et",
   "com_auth_google_login": "Google ile devam et",
   "com_auth_here": "BURAYA",
   "com_auth_login": "Giriş yap",
   "com_auth_login_with_new_password": "Şimdi yeni şifreniz ile giriş yapabilirsiniz.",
   "com_auth_name_max_length": "Ad en fazla 80 karakter olmalıdır",
-  "com_auth_name_min_length": "Ad en az 3 karakter olmalıdır",
-  "com_auth_name_required": "Ad gereklidir",
+  "com_auth_name_min_length": "Adınız en az 3 karakterden oluşmalıdır",
+  "com_auth_name_required": "Adınızı girmeniz gereklidir",
   "com_auth_no_account": "Hesabınız yok mu?",
   "com_auth_password": "Şifre",
   "com_auth_password_confirm": "Şifreyi onayla",
   "com_auth_password_forgot": "Şifremi unuttum?",
-  "com_auth_password_max_length": "Şifre en fazla 128 karakter olmalıdır",
+  "com_auth_password_max_length": "Şifre 128 karakterden az olmalıdır",
   "com_auth_password_min_length": "Şifre en az 8 karakter olmalıdır",
   "com_auth_password_not_match": "Şifreler uyuşmuyor",
   "com_auth_password_required": "Şifre gereklidir",
@@ -111,29 +200,40 @@
   "com_auth_reset_password_if_email_exists": "Bu e-postaya sahip bir hesap varsa, e-posta ile şifre sıfırlama talimatları gönderilmiştir. Lütfen spam klasörünüzü kontrol edin.",
   "com_auth_reset_password_link_sent": "E-posta gönderildi",
   "com_auth_reset_password_success": "Şifre başarıyla sıfırlandı",
+  "com_auth_saml_login": "SAML ile devam et",
   "com_auth_sign_in": "Giriş yap",
   "com_auth_sign_up": "Kaydol",
-  "com_auth_submit_registration": "Kayıt formunu gönder",
+  "com_auth_submit_registration": "Kaydı tamamla",
   "com_auth_to_reset_your_password": "şifrenizi sıfırlamak için.",
   "com_auth_to_try_again": "yeniden denemek için.",
+  "com_auth_two_factor": "Tercih ettiğiniz tek kullanımlık şifre uygulamasından bir kod kontrol edin",
   "com_auth_username": "Kullanıcı adı (isteğe bağlı)",
-  "com_auth_username_max_length": "Kullanıcı adı en fazla 20 karakter olmalıdır",
+  "com_auth_username_max_length": "Kullanıcı adı 20 karakterden az olmalıdır",
   "com_auth_username_min_length": "Kullanıcı adı en az 2 karakter olmalıdır",
+  "com_auth_verify_your_identity": "Kimliğinizi Doğrulayın",
   "com_auth_welcome_back": "Tekrar hoş geldiniz",
+  "com_citation_more_details": "{{label}} hakkında daha fazla ayrıntı",
+  "com_citation_source": "Kaynak",
   "com_click_to_download": "(indirmek için tıklayın)",
   "com_download_expired": "(indirme süresi doldu)",
   "com_endpoint": "Uç Nokta",
   "com_endpoint_agent": "Ajan",
   "com_endpoint_agent_placeholder": "Lütfen bir Ajan seçin",
   "com_endpoint_ai": "Yapay Zeka",
-  "com_endpoint_anthropic_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin.",
+  "com_endpoint_anthropic_effort": "Claude'un uyguladığı hesaplama çabasını kontrol eder. Düşük çaba token tasarrufu sağlar ve gecikmeyi azaltır; daha yüksek çaba daha kapsamlı yanıtlar üretir. 'Max' en derin mantık yürütmeyi etkinleştirir (Sadece Opus 4.6).",
+  "com_endpoint_anthropic_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin. Not: modeller bu maksimuma ulaşmadan durabilir.",
   "com_endpoint_anthropic_prompt_cache": "İstem önbelleğe alma, API çağrıları arasında büyük bağlam veya talimatların yeniden kullanılmasına izin vererek maliyetleri ve gecikmeyi azaltır",
   "com_endpoint_anthropic_temp": "0 ile 1 arasında değişir. Analitik / çoktan seçmeli sorular için 0'a yakın, yaratıcı ve üretken görevler için 1'e yakın bir sıcaklık kullanın. Bu parametre ile Olasılık Kütüphanesini değiştirmeyi öneririz (ikisini birden değiştirmemek).",
+  "com_endpoint_anthropic_thinking": "Desteklenen Claude modelleri için iç akıl yürütmeyi etkinleştirir. Daha yeni modeller için (Opus 4.6+), Effort parametresi tarafından kontrol edilen adaptif düşünmeyi kullanır. Eski modeller için, \"Thinking Budget\" ayarlanmış ve \"Max Output Tokens\"dan daha düşük olmalıdır.",
+  "com_endpoint_anthropic_thinking_budget": "Claude'un iç akıl yürütme süreci için kullanmasına izin verilen maksimum token sayısını belirler. Daha büyük bütçeler, karmaşık problemler için daha kapsamlı analizi etkinleştirerek yanıt kalitesini artırabilir, ancak Claude ayrılan tüm bütçeyi kullanmayabilir, özellikle 32K üzeri aralıklarda. Bu ayar \"Max Output Tokens\"dan daha düşük olmalıdır.",
+  "com_endpoint_anthropic_thinking_display_desc": "Claude'un düşünce dönütünü kontrol eder. Özetlenmiş düşüncelerin 'Oto' ",
   "com_endpoint_anthropic_topk": "Top-k, modelin çıktı için token seçimini nasıl yaptığını değiştirir. 1 olan bir top-k, modelin kelime haznesindeki en olası tokenin seçildiği (açgözlü kod çözme olarak da adlandırılır) anlamına gelirken, 3 olan bir top-k, bir sonraki tokenin en olası üç token arasından (sıcaklık kullanılarak) seçileceği anlamına gelir.",
   "com_endpoint_anthropic_topp": "Modelin çıktı için token seçim şeklini değiştirir. Tokenlar, en olasılıktan (bkz. topK parametresi) en az olasıya kadar seçilir ve olasılıkları toplamı, top-p değerine eşit olana kadar devam eder.",
+  "com_endpoint_anthropic_use_web_search": "Anthropic'in yerleşik arama yeteneklerini kullanarak web arama işlevini etkinleştirin. Bu, modelin güncel bilgiler için web'de arama yapmasına ve daha doğru, güncel yanıtlar sağlamasına olanak tanır.",
   "com_endpoint_assistant": "Asistan",
   "com_endpoint_assistant_model": "Asistan Modeli",
   "com_endpoint_assistant_placeholder": "Lütfen sağ tarafta bir Asistan seçin",
+  "com_endpoint_bedrock_reasoning_effort": "Desteklenen Bedrock modelleri için akıl yürütme seviyesini kontrol eder (ör. Kimi K2.5, GLM). Daha yüksek seviyeler, artan gecikme ve token pahasına daha kapsamlı mantık yürütme üretir.",
   "com_endpoint_config_click_here": "Buraya Tıklayın",
   "com_endpoint_config_google_api_info": "Gemini için Yapay Zeka Dil API Anahtarınızı almak için,",
   "com_endpoint_config_google_api_key": "Google API Anahtarı",
@@ -154,7 +254,7 @@
   "com_endpoint_config_key_name": "Anahtar",
   "com_endpoint_config_key_never_expires": "Anahtarınız asla sona ermeyecek",
   "com_endpoint_config_placeholder": "Sohbet etmek için Anahtarınızı Başlık menüsünde ayarlayın.",
-  "com_endpoint_config_value": "Değer girin",
+  "com_endpoint_config_value": "için değer girin",
   "com_endpoint_context": "Bağlam",
   "com_endpoint_context_info": "Bağlam için kullanılabilecek maksimum token sayısı. Bu, her istek için kaç token gönderileceğini kontrol etmek içindir. Belirtilmezse, bilinen modellerin bağlam boyutuna göre sistem varsayılanları kullanılacaktır. Daha yüksek değerler belirlemek hatalara ve/veya daha yüksek token maliyetine neden olabilir.",
   "com_endpoint_context_tokens": "Maksimum Bağlam Tokenleri",
@@ -162,15 +262,22 @@
   "com_endpoint_default": "varsayılan",
   "com_endpoint_default_blank": "varsayılan: boş",
   "com_endpoint_default_with_num": "varsayılan: {{0}}",
+  "com_endpoint_disable_streaming": "Akış yanıtlarını devre dışı bırakın ve tüm yanıtı tek seferde alın. Akış için organizasyon doğrulaması gerektiren o3 gibi modeller için faydalıdır",
+  "com_endpoint_disable_streaming_label": "Akışı Devre Dışı Bırak",
+  "com_endpoint_effort": "Çaba",
   "com_endpoint_examples": "Hazır Ayarlar",
   "com_endpoint_export": "Dışa Aktar",
   "com_endpoint_export_share": "Dışa Aktar / Paylaş",
   "com_endpoint_frequency_penalty": "Sıklık Cezası",
   "com_endpoint_google_custom_name_placeholder": "Google için özel bir ad ayarlayın",
-  "com_endpoint_google_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin.",
+  "com_endpoint_google_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin. Not: modeller bu maksimuma ulaşmadan durabilir.",
   "com_endpoint_google_temp": "Yüksek değerler = daha rastgele, düşük değerler = daha odaklı ve belirleyici. Bu parametre ile Olasılık Kütüphanesini değiştirmeyi öneririz (ikisini birden değiştirmemek).",
+  "com_endpoint_google_thinking": "Akıl yürütmeyi etkinleştirir veya devre dışı bırakır. Gemini 2.5 ve 3 serisi tarafından desteklenir. Not: Gemini 3 Pro düşünmeyi tamamen devre dışı bırakamaz.",
+  "com_endpoint_google_thinking_budget": "Modelin kullandığı düşünme tokenlerinin sayısını yönlendirir. Gerçek miktar isteme bağlı olarak bu değeri aşabilir veya altında kalabilir.\n\nBu ayar yalnızca Gemini 2.5 ve daha eski modeller için geçerlidir. Gemini 3 ve sonrası için bunun yerine Düşünme Seviyesi ayarını kullanın.\n\nGemini 2.5 Pro 128-32.768 tokeni destekler. Gemini 2.5 Flash 0-24.576 tokeni destekler. Gemini 2.5 Flash Lite 512-24.576 tokeni destekler.\n\nModelin ne zaman ve ne kadar düşüneceğine otomatik karar vermesi için boş bırakın veya \"-1\" olarak ayarlayın. Varsayılan olarak Gemini 2.5 Flash Lite düşünmez.",
+  "com_endpoint_google_thinking_level": "Gemini 3 ve sonraki modeller için akıl yürütme derinliğini kontrol eder. Gemini 2.5 ve daha eski modeller üzerinde etkisi yoktur — onlar için Düşünme Bütçesini kullanın.\n\nModel varsayılanını kullanmak için Otomatikte bırakın.",
   "com_endpoint_google_topk": "Top-k, modelin çıktı için token seçimini nasıl yaptığını değiştirir. 1 olan bir top-k, modelin kelime haznesindeki en olası tokenin seçildiği (açgözlü kod çözme olarak da adlandırılır) anlamına gelirken, 3 olan bir top-k, bir sonraki tokenin en olası üç token arasından (sıcaklık kullanılarak) seçileceği anlamına gelir.",
   "com_endpoint_google_topp": "Olasılık Kütüphanesi, modelin çıktı için token seçme şeklini değiştirir. Tokenler, en olasılıktan (bkz. topK parametresi) en az olasıya kadar seçilir ve olasılıkları toplamı, top-p değerine eşit olana kadar devam eder.",
+  "com_endpoint_google_use_search_grounding": "Gerçek zamanlı web arama sonuçlarıyla yanıtları geliştirmek için Google'ın arama temellendirme (grounding) özelliğini kullanın. Bu, modellerin güncel bilgilere erişmesini ve daha doğru, güncel yanıtlar sağlamasını sağlar.",
   "com_endpoint_instructions_assistants": "Talimatları Geçersiz Kıl",
   "com_endpoint_instructions_assistants_placeholder": "Asistanın talimatlarını geçersiz kılar. Bu, davranışı tek tek çalışma bazında değiştirmek için yararlıdır.",
   "com_endpoint_max_output_tokens": "Maksimum Çıktı Tokenleri",
@@ -186,23 +293,29 @@
   "com_endpoint_openai_max_tokens": "İsteğe bağlı `max_tokens` alanı, sohbet tamamlamalarında üretilebilecek maksimum token sayısını temsil eder. Giriş tokenlarının ve üretilen tokenların toplam uzunluğu, modellerin bağlam uzunluğu ile sınırlıdır. Bu sayının maksimum bağlam tokenlarını aşması durumunda hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_pres": " -2.0 ile 2.0 arasında bir değer. Pozitif değerler, metinde daha önceki varlıklarına dayalı olarak yeni tokenları cezalandırır, bu da modelin yeni konular hakkında konuşma olasılığını artırır.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Sistem Mesajına dahil edilecek özel talimatlar ayarlayın. Varsayılan: yok",
-  "com_endpoint_openai_reasoning_effort": "Sadece o1 modelleri: akıl yürütme modelleri için akıl yürütme çabasını kısıtlar. Akıl yürütme çabasını azaltmak, daha hızlı yanıtlara ve yanıtta akıl yürütmeye daha az token kullanılmasına neden olabilir.",
+  "com_endpoint_openai_reasoning_effort": "Sadece akıl yürütme modelleri: akıl yürütme çabasını kısıtlar. Akıl yürütme çabasını azaltmak, daha hızlı yanıtlara ve yanıtta akıl yürütmeye daha az token kullanılmasına neden olabilir. 'Minimal' kodlama ve talimat takibi için özellikle uygun olan en hızlı ilk token süresi için çok az akıl yürütme tokeni üretir.",
+  "com_endpoint_openai_reasoning_summary": "Sadece Yanıtlar API'si: Model tarafından gerçekleştirilen akıl yürütmenin bir özeti. Bu, modelin akıl yürütme sürecini hata ayıklamak ve anlamak için yararlı olabilir. none, auto, concise veya detailed olarak ayarlayın.",
   "com_endpoint_openai_resend": "Daha önce eklenmiş tüm görüntüleri yeniden gönderin. Not: Bu, token maliyetinizi önemli ölçüde artırabilir ve birden çok görüntü eklenmişse hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_resend_files": "Daha önce eklenmiş tüm dosyaları yeniden gönderin. Not: Bu, token maliyetinizi artıracaktır ve birden çok eklenmiş dosya ile hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_stop": "API'nin ek tokenlar üretmeyi durduracağı en fazla 4 sıra.",
   "com_endpoint_openai_temp": "Yüksek değerler = daha rastgele, düşük değerler = daha odaklı ve belirleyici. Bu parametre ile Olasılık Kütüphanesi (top-p) değiştirmeyi öneririz (ikisini birden değiştirmemek).",
   "com_endpoint_openai_topp": "Sıcaklıkla örneklemenin bir alternatifi olan, çekirdek örnekleme olarak adlandırılır, model top_p olasılık kütlesine sahip tokenların sonuçlarını dikkate alır. Yani 0.1, sadece top 10% olasılık kütlesine sahip tokenların dikkate alındığı anlamına gelir. Sıcaklık (temperature) ile değil bu parametre ile değiştirmenizi öneririz.",
+  "com_endpoint_openai_use_responses_api": "OpenAI'dan genişletilmiş özellikleri içeren Sohbet Tamamlamaları yerine Yanıtlar API'sini kullanın. o1-pro, o3-pro için ve akıl yürütme özetlerini etkinleştirmek için gereklidir.",
+  "com_endpoint_openai_use_web_search": "OpenAI'nin yerleşik arama yeteneklerini kullanarak web arama işlevini etkinleştirin. Bu, modelin güncel bilgiler için web'de arama yapmasına ve daha doğru, güncel yanıtlar sağlamasına olanak tanır.",
+  "com_endpoint_openai_verbosity": "Modelin yanıtının ayrıntı düzeyini kısıtlar. Daha düşük değerler daha kısa yanıtlara yol açarken, daha yüksek değerler daha ayrıntılı yanıtlarla sonuçlanır. Şu anda desteklenen değerler low (düşük), medium (orta) ve high (yüksek) düzeydedir.",
   "com_endpoint_output": "Çıktı",
   "com_endpoint_plug_image_detail": "Görüntü Detayı",
   "com_endpoint_plug_resend_files": "Dosyaları Yeniden Gönderin",
   "com_endpoint_presence_penalty": "Varlık Cezası",
   "com_endpoint_preset": "hazır ayar",
+  "com_endpoint_preset_custom_name_placeholder": "buraya bir şey girmeliydiniz. boş bırakıldı",
   "com_endpoint_preset_default": "şu anda varsayılan hazır ayar.",
   "com_endpoint_preset_default_item": "Varsayılan:",
   "com_endpoint_preset_default_none": "Aktif varsayılan hazır ayar yok.",
   "com_endpoint_preset_default_removed": "Artık varsayılan hazır ayar değil.",
   "com_endpoint_preset_delete_confirm": "Bu hazır ayarı silmek istediğinizden emin misiniz?",
   "com_endpoint_preset_delete_error": "Hazır ayarınızı silerken bir hata oluştu. Lütfen tekrar deneyin.",
+  "com_endpoint_preset_delete_success": "Hazır ayar başarıyla silindi",
   "com_endpoint_preset_import": "Hazır Ayar İthal Edildi!",
   "com_endpoint_preset_import_error": "Hazır ayarınızı karşıya yüklerken bir hata oluştu. Lütfen tekrar deneyin.",
   "com_endpoint_preset_name": "Hazır Ayar Adı",
@@ -218,67 +331,129 @@
   "com_endpoint_prompt_prefix_assistants_placeholder": "Asistanın ana talimatlarının üzerine ek talimatlar veya bağlam ekleyin. Boşsa yok sayılır.",
   "com_endpoint_prompt_prefix_placeholder": "Özel talimatlar veya bağlam ayarlayın. Boşsa yok sayılır.",
   "com_endpoint_reasoning_effort": "Akıl Yürütme Çabası",
+  "com_endpoint_reasoning_summary": "Akıl Yürütme Özeti",
   "com_endpoint_save_as_preset": "Hazır Olarak Kaydet",
   "com_endpoint_search": "Uç noktayı ada göre ara",
-  "com_endpoint_set_custom_name": "Özelleştirmenizi adlandırın, böylece bu ayarlanabilir",
+  "com_endpoint_search_endpoint_models": "{{0}} modelleri aranıyor...",
+  "com_endpoint_search_models": "Modeller aranıyor...",
+  "com_endpoint_search_var": "{{0}} aranıyor...",
+  "com_endpoint_set_custom_name": "Bu ayarı bulabilmeniz için özel bir ad ayarlayın",
   "com_endpoint_stop": "Durdurma Sıraları",
   "com_endpoint_stop_placeholder": "Değerleri ayırmak için `Enter` tuşuna basın",
   "com_endpoint_temperature": "Sıcaklık",
+  "com_endpoint_thinking": "Düşünme",
+  "com_endpoint_thinking_budget": "Düşünme Bütçesi",
+  "com_endpoint_thinking_level": "Düşünme Seviyesi",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Etkin Asistanı Kullan",
+  "com_endpoint_use_responses_api": "Yanıtlar API'sini Kullan",
+  "com_endpoint_use_search_grounding": "Google Arama ile Temellendirme (Grounding)",
+  "com_endpoint_verbosity": "Ayrıntı Düzeyi",
+  "com_error_endpoint_models_not_loaded": "{{0}} için modeller yüklenemedi. Lütfen sayfayı yenileyin ve tekrar deneyin.",
   "com_error_expired_user_key": "Belirtilen {{0}} anahtarı {{1}} tarihinde süresi dolmuş. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
   "com_error_files_dupe": "Yinelenen dosya tespit edildi.",
   "com_error_files_empty": "Boş dosyalara izin verilmez.",
   "com_error_files_process": "Dosya işlenirken bir hata oluştu.",
   "com_error_files_upload": "Dosya yüklenirken bir hata oluştu.",
   "com_error_files_upload_canceled": "Dosya yükleme isteği iptal edildi. Not: dosya yüklemesi hala işleniyor olabilir ve manuel olarak silinmesi gerekecektir.",
+  "com_error_files_upload_too_large": "Dosya çok büyük. Lütfen {{0}} MB'tan daha küçük bir dosya yükleyin",
   "com_error_files_validation": "Dosya doğrulanırken bir hata oluştu.",
-  "com_error_input_length": "Son mesajın token sayısı çok uzun, token limitini aşıyor ({{0}}). Lütfen mesajınızı kısaltın, konuşma parametrelerinden maksimum bağlam boyutunu ayarlayın veya devam etmek için konuşmayı çatallayın.",
-  "com_error_invalid_user_key": "Sağlanan anahtar geçersiz. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_google_tool_conflict": "Yerleşik Google araçlarının kullanımı harici araçlarla desteklenmez. Lütfen yerleşik araçları veya harici araçları devre dışı bırakın.",
+  "com_error_heic_conversion": "HEIC resmini JPEG'e dönüştürme başarısız oldu. Lütfen resmi manuel olarak dönüştürmeyi veya farklı bir format kullanmayı deneyin.",
+  "com_error_illegal_model_request": "\"{{0}}\" modeli {{1}} için mevcut değil. Lütfen farklı bir model seçin.",
+  "com_error_input_length": "Son mesajın token sayısı çok uzun, token limitini aşıyor veya token limiti parametreleriniz yanlış yapılandırılmış ve bağlam penceresini olumsuz etkiliyor. Daha fazla bilgi: {{0}}. Lütfen mesajınızı kısaltın, konuşma parametelerinden maksimum bağlam boyutunu ayarlayın veya devam etmek için konuşmayı çatallayın.",
+  "com_error_invalid_agent_provider": "\"{{0}}\" sağlayıcısı Ajanlarla kullanılamaz. Lütfen ajanınızın ayarlarına gidin ve şu anda mevcut olan bir sağlayıcı seçin.",
+  "com_error_invalid_base_url": "Sağladığınız temel URL kısıtlanmış bir adresi hedefliyor. Lütfen geçerli bir harici URL kullanın ve tekrar deneyin.",
+  "com_error_invalid_user_key": "Sağlanan anahtar geçersiz. Lütfen geçerli bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_missing_model": "{{0}} için model seçilmedi. Lütfen bir model seçin ve tekrar deneyin.",
+  "com_error_models_not_loaded": "Modeller yapılandırması yüklenemedi. Lütfen sayfayı yenileyin ve tekrar deneyin.",
   "com_error_moderation": "Gönderdiğiniz içerik, topluluk kurallarımıza uymadığı için moderasyon sistemimiz tarafından işaretlenmiş görünüyor. Bu belirli konu ile devam edemiyoruz. Başka sorularınız veya incelemek istediğiniz başka konular varsa, mesajınızı düzenleyin veya yeni bir konuşma başlatın.",
   "com_error_no_base_url": "Temel URL bulunamadı. Lütfen bir tane sağlayın ve tekrar deneyin.",
   "com_error_no_user_key": "Anahtar bulunamadı. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_refusal": "Yanıt güvenlik filtreleri tarafından reddedildi. Mesajınızı yeniden yazın ve tekrar deneyin. Claude Sonnet 4.5 veya Opus 4.1 kullanırken bunu sık sık yaşıyorsanız, farklı kullanım kısıtlamalarına sahip olan Sonnet 4'ü deneyebilirsiniz.",
+  "com_error_stream_expired": "Yanıt akışı sona erdi veya zaten tamamlandı. Lütfen tekrar deneyin.",
+  "com_file_pages": "Sayfalar: {{pages}}",
+  "com_file_source": "Dosya",
+  "com_file_unknown": "Bilinmeyen Dosya",
+  "com_files_download_failed": "{{0}} dosya başarısız oldu",
+  "com_files_download_percent_complete": "%{{0}} tamamlandı",
+  "com_files_download_progress": "{{1}} dosyadan {{0}} tanesi",
+  "com_files_downloading": "Dosyalar İndiriliyor",
   "com_files_filter": "Dosyaları filtrele...",
+  "com_files_filter_by": "Dosyaları şuna göre filtrele...",
   "com_files_no_results": "Sonuç bulunamadı.",
-  "com_files_number_selected": "{{0}} dosya/dosyadan {{1}} seçildi",
+  "com_files_number_selected": "{{1}} dosya/öğeden {{0}} seçildi",
+  "com_files_preparing_download": "İndirme hazırlanıyor...",
+  "com_files_result_found": "{{count}} sonuç bulundu",
+  "com_files_results_found": "{{count}} sonuç bulundu",
+  "com_files_sharepoint_picker_title": "Dosyaları Seç",
+  "com_files_table": "Dosyalar Tablosu",
+  "com_files_upload_local_machine": "Yerel Bilgisayardan",
+  "com_files_upload_sharepoint": "SharePoint'ten",
   "com_generated_files": "Oluşturulan dosyalar:",
   "com_hide_examples": "Örnekleri Gizle",
+  "com_info_heic_converting": "HEIC resmi JPEG'e dönüştürülüyor...",
+  "com_nav_2fa": "İki Faktörlü Kimlik Doğrulama (2FA)",
   "com_nav_account_settings": "Hesap Ayarları",
-  "com_nav_always_make_prod": "Her zaman yeni sürümleri üretime al",
-  "com_nav_archive_created_at": "Oluşturulma Tarihi",
+  "com_nav_always_make_prod": "Her zaman yeni istem sürümlerini üretime al",
+  "com_nav_archive_created_at": "Arşivlenme Tarihi",
   "com_nav_archive_name": "Ad",
   "com_nav_archived_chats": "Arşivlenmiş sohbetler",
   "com_nav_at_command": "@-Komutu",
   "com_nav_at_command_description": "Uç noktaları, modelleri, ön ayarları vb. değiştirmek için \"@\" komutunu aç/kapat",
   "com_nav_audio_play_error": "Ses oynatma hatası: {{0}}",
   "com_nav_audio_process_error": "Ses işleme hatası: {{0}}",
+  "com_nav_auto_expand_tools": "Araç detaylarını otomatik genişlet",
   "com_nav_auto_scroll": "Sohbet açıldığında otomatik olarak son mesaja kaydır",
-  "com_nav_auto_send_prompts": "İstemleri Otomatik Gönder",
-  "com_nav_auto_send_text": "Metni otomatik gönder (3 sn sonra)",
+  "com_nav_auto_send_prompts": "Seçildiğinde istemleri gönder",
+  "com_nav_auto_send_prompts_desc": "Seçildiğinde istemi otomatik olarak sohbete gönder",
+  "com_nav_auto_send_text": "Metni otomatik gönder",
   "com_nav_auto_transcribe_audio": "Sesi otomatik olarak yazıya dök",
-  "com_nav_automatic_playback": "Son Mesajı Otomatik Çal (yalnızca dış)",
-  "com_nav_balance": "Denge",
+  "com_nav_automatic_playback": "Son Mesajı Otomatik Çal",
+  "com_nav_balance": "Bakiye",
+  "com_nav_balance_auto_refill_disabled": "Otomatik Dolum devre dışı.",
+  "com_nav_balance_auto_refill_error": "Otomatik dolum ayarları yüklenirken hata oluştu.",
+  "com_nav_balance_auto_refill_settings": "Otomatik Dolum Ayarları",
+  "com_nav_balance_day": "gün",
+  "com_nav_balance_days": "gün",
+  "com_nav_balance_every": "Her",
+  "com_nav_balance_hour": "saat",
+  "com_nav_balance_hours": "saat",
+  "com_nav_balance_interval": "Aralık:",
+  "com_nav_balance_last_refill": "Son Dolum:",
+  "com_nav_balance_minute": "dakika",
+  "com_nav_balance_minutes": "dakika",
+  "com_nav_balance_month": "ay",
+  "com_nav_balance_months": "ay",
+  "com_nav_balance_next_refill": "Sonraki Dolum:",
+  "com_nav_balance_next_refill_info": "Sonraki dolum otomatik olarak ancak şu iki şart da sağlandığında gerçekleşecektir: Son dolumdan bu yana belirlenen süre aralığı geçmiş olacak ve bir istem göndermek bakiyenizin sıfırın altına düşmesine neden olacak.",
+  "com_nav_balance_refill_amount": "Dolum Miktarı:",
+  "com_nav_balance_second": "saniye",
+  "com_nav_balance_seconds": "saniye",
+  "com_nav_balance_week": "hafta",
+  "com_nav_balance_weeks": "hafta",
   "com_nav_browser": "Tarayıcı",
+  "com_nav_center_chat_input": "Karşılama Ekranında Sohbet Girdisini Ortala",
   "com_nav_change_picture": "Resmi değiştir",
-  "com_nav_chat_commands": "Sohbet Komutları",
-  "com_nav_chat_commands_info": "Bu komutlar, mesajınızın başına belirli karakterler yazarak etkinleştirilir. Her komut, belirlenen öneki ile tetiklenir. Bu karakterleri sıklıkla mesaj başlatmak için kullanıyorsanız bunları devre dışı bırakabilirsiniz.",
   "com_nav_chat_direction": "Sohbet yönü",
+  "com_nav_chat_direction_selected": "Sohbet yönü: {{direction}}",
   "com_nav_clear_all_chats": "Tüm sohbetleri temizle",
   "com_nav_clear_cache_confirm_message": "Önbelleği temizlemek istediğinizden emin misiniz?",
   "com_nav_clear_conversation": "Sohbetleri temizle",
   "com_nav_clear_conversation_confirm_message": "Tüm konuşmaları temizlemek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
   "com_nav_close_sidebar": "Yan paneli kapat",
-  "com_nav_commands": "Komutlar",
   "com_nav_confirm_clear": "Temizlemeyi Onayla",
+  "com_nav_control_panel": "Kontrol Paneli",
   "com_nav_conversation_mode": "Konuşma Modu",
   "com_nav_convo_menu_options": "Konuşma Menü Seçenekleri",
   "com_nav_db_sensitivity": "Desibel hassasiyeti",
+  "com_nav_default_temporary_chat": "Varsayılan Olarak Geçici Sohbet",
   "com_nav_delete_account": "Hesabı sil",
   "com_nav_delete_account_button": "Hesabımı kalıcı olarak sil",
   "com_nav_delete_account_confirm": "Hesabı silmek istediğinizden emin misiniz?",
   "com_nav_delete_account_email_placeholder": "Lütfen hesap e-postanızı girin",
-  "com_nav_delete_cache_storage": "Önbellek depolamayı sil",
+  "com_nav_delete_cache_storage": "TTS önbellek depolamasını sil",
   "com_nav_delete_data_info": "Tüm verileriniz silinecektir.",
   "com_nav_delete_warning": "UYARI: Bu işlem hesabınızı kalıcı olarak silecektir.",
   "com_nav_enable_cache_tts": "TTS önbelleğini etkinleştir",
@@ -291,58 +466,94 @@
   "com_nav_export_filename": "Dosya adı",
   "com_nav_export_filename_placeholder": "Dosya adını belirle",
   "com_nav_export_include_endpoint_options": "Uç nokta seçeneklerini dahil et",
-  "com_nav_export_recursive": "Yinelenen",
-  "com_nav_export_recursive_or_sequential": "Yinelenen mi, ardışık mı?",
+  "com_nav_export_recursive": "Özyinelemeli (Recursive)",
+  "com_nav_export_recursive_or_sequential": "Özyinelemeli mi yoksa sıralı mı?",
   "com_nav_export_type": "Tür",
   "com_nav_external": "Harici",
-  "com_nav_font_size": "Yazı Boyutu",
+  "com_nav_font_size": "Mesaj Yazı Boyutu",
   "com_nav_font_size_base": "Orta",
   "com_nav_font_size_lg": "Büyük",
   "com_nav_font_size_sm": "Küçük",
   "com_nav_font_size_xl": "Çok Büyük",
   "com_nav_font_size_xs": "Çok Küçük",
-  "com_nav_help_faq": "Yardım & SS",
+  "com_nav_help_faq": "Yardım & SSS",
+  "com_nav_info_balance": "Bakiye, kullanmanız için ne kadar token krediniz kaldığını gösterir. Token kredileri parasal değere çevrilir (ör. 1000 kredi = $0.001 USD)",
   "com_nav_info_code_artifacts": "Sohbet yanında deneysel kod yapıtlarının görüntülenmesini etkinleştirir",
+  "com_nav_info_code_artifacts_agent": "Bu ajan için kod yapıtlarının kullanımını etkinleştirir. \"Özel İstem Modu\" etkinleştirilmediği sürece, yapıtlara özel ek talimatlar varsayılan olarak eklenir.",
   "com_nav_info_custom_prompt_mode": "Etkinleştirildiğinde, varsayılan yapıtlar sistem istemi dahil edilmeyecektir. Bu modda tüm yapıt oluşturma talimatları manuel olarak sağlanmalıdır.",
+  "com_nav_info_default_temporary_chat": "Etkinleştirildiğinde, yeni sohbetler varsayılan olarak geçici sohbet modu aktifken başlayacaktır. Geçici sohbetler geçmişinize kaydedilmez.",
   "com_nav_info_enter_to_send": "Etkinleştirildiğinde, `ENTER` tuşuna basmak mesajınızı gönderecektir. Devre dışı bırakıldığında, Enter tuşuna basmak yeni bir satır ekleyecek ve mesajınızı göndermek için `CTRL + ENTER` / `⌘ + ENTER` tuşlarına basmanız gerekecektir.",
   "com_nav_info_fork_change_default": "`Sadece görünür mesajlar` yalnızca seçili mesaja giden doğrudan yolu içerir. `İlgili dalları dahil et` yol boyunca dalları ekler. `Buradan/buraya tümünü dahil et` tüm bağlantılı mesajları ve dalları içerir.",
-  "com_nav_info_fork_split_target_setting": "Etkinleştirildiğinde, çatallama, seçilen davranışa göre hedef mesajdan konuşmadaki en son mesaja kadar başlayacaktır.",
+  "com_nav_info_fork_split_target_setting": "Etkinleştirildiğinde, çatallama seçilen davranışa göre hedef mesajdan konuşmadaki en son mesaja kadar başlayacaktır.",
   "com_nav_info_include_shadcnui": "Etkinleştirildiğinde, shadcn/ui bileşenlerini kullanma talimatları dahil edilecektir. shadcn/ui, Radix UI ve Tailwind CSS kullanılarak oluşturulmuş yeniden kullanılabilir bileşenler koleksiyonudur. Not: bunlar uzun talimatlardır, yalnızca LLM'ye doğru içe aktarmaları ve bileşenleri bildirmek sizin için önemliyse etkinleştirmelisiniz. Bu bileşenler hakkında daha fazla bilgi için: https://ui.shadcn.com/",
   "com_nav_info_latex_parsing": "Etkinleştirildiğinde, mesajlardaki LaTeX kodu matematiksel denklemler olarak işlenecektir. LaTeX işlemeye ihtiyacınız yoksa performansı artırmak için bunu devre dışı bırakabilirsiniz.",
+  "com_nav_info_save_badges_state": "Etkinleştirildiğinde, sohbet rozetlerinin durumu kaydedilir. Bu, yeni bir sohbet başlattığınızda rozetlerin bir önceki sohbetle aynı durumda kalacağı anlamına gelir. Bu seçeneği devre dışı bırakırsanız, yeni bir sohbet oluşturduğunuzda rozetler varsayılan hallerine sıfırlanır.",
   "com_nav_info_save_draft": "Etkinleştirildiğinde, sohbet formuna girdiğiniz metin ve ekler otomatik olarak yerel olarak taslak olarak kaydedilecektir. Bu taslaklar, sayfayı yeniden yüklediğinizde veya farklı bir konuşmaya geçtiğinizde bile mevcut olacaktır. Taslaklar cihazınızda yerel olarak depolanır ve mesaj gönderildikten sonra silinir.",
   "com_nav_info_show_thinking": "Etkinleştirildiğinde, sohbet düşünme açılır menülerini varsayılan olarak açık gösterecek, yapay zekanın akıl yürütmesini gerçek zamanlı olarak görmenize olanak tanıyacaktır. Devre dışı bırakıldığında, daha temiz ve düzenli bir arayüz için düşünme açılır menüleri varsayılan olarak kapalı kalacaktır",
   "com_nav_info_user_name_display": "Etkinleştirildiğinde, gönderenin kullanıcı adı gönderdiğiniz her mesajın üzerinde gösterilecektir. Devre dışı bırakıldığında, mesajlarınızın üzerinde sadece \"Siz\" göreceksiniz.",
+  "com_nav_keep_screen_awake": "Yanıt oluşturulurken ekranı uyanık tut",
   "com_nav_lang_arabic": "العربية",
-  "com_nav_lang_auto": "Auto detect",
+  "com_nav_lang_armenian": "Հայերեն",
+  "com_nav_lang_auto": "Otomatik Algıla",
+  "com_nav_lang_bosnian": "Босански",
   "com_nav_lang_brazilian_portuguese": "Português Brasileiro",
+  "com_nav_lang_catalan": "Català",
   "com_nav_lang_chinese": "中文",
+  "com_nav_lang_czech": "Čeština",
+  "com_nav_lang_danish": "Dansk",
   "com_nav_lang_dutch": "Nederlands",
   "com_nav_lang_english": "English",
   "com_nav_lang_estonian": "Eesti keel",
   "com_nav_lang_finnish": "Suomi",
-  "com_nav_lang_french": "Français ",
+  "com_nav_lang_french": "Français",
   "com_nav_lang_georgian": "ქართული",
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
+  "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
+  "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
+  "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
+  "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
+  "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
   "com_nav_lang_thai": "ไทย",
+  "com_nav_lang_tibetan": "བོད་སྐད་",
   "com_nav_lang_traditional_chinese": "繁體中文",
   "com_nav_lang_turkish": "Türkçe",
+  "com_nav_lang_ukrainian": "Українська",
+  "com_nav_lang_uyghur": "Uyƣur tili",
   "com_nav_lang_vietnamese": "Tiếng Việt",
   "com_nav_language": "Dil",
   "com_nav_latex_parsing": "Mesajlarda LaTeX işleme (performansı etkileyebilir)",
   "com_nav_log_out": "Çıkış yap",
   "com_nav_long_audio_warning": "Daha uzun metinlerin işlenmesi daha uzun sürecektir.",
   "com_nav_maximize_chat_space": "Sohbet alanını maksimize et",
-  "com_nav_modular_chat": "Konuşmalar arasında uç noktaları değiştir",
+  "com_nav_mcp_access_revoked": "MCP sunucusu erişimi başarıyla iptal edildi.",
+  "com_nav_mcp_configure_server": "{{0}} Yapılandır",
+  "com_nav_mcp_connect": "Bağlan",
+  "com_nav_mcp_connect_server": "{{0}} Bağlan",
+  "com_nav_mcp_reconnect": "Yeniden Bağlan",
+  "com_nav_mcp_status_connected": "Bağlı",
+  "com_nav_mcp_status_connecting": "{{0}} - Bağlanıyor",
+  "com_nav_mcp_status_disconnected": "Bağlantı Kesildi",
+  "com_nav_mcp_status_error": "Hata",
+  "com_nav_mcp_status_initializing": "Başlatılıyor",
+  "com_nav_mcp_status_needs_auth": "Kimlik Doğrulaması Gerekiyor",
+  "com_nav_mcp_status_unknown": "Bilinmiyor",
+  "com_nav_mcp_vars_update_error": "MCP özel kullanıcı değişkenleri güncellenirken hata oluştu",
+  "com_nav_mcp_vars_updated": "MCP özel kullanıcı değişkenleri başarıyla güncellendi.",
+  "com_nav_modular_chat": "Konuşmalar arasında uç noktaları değiştirmeyi etkinleştir",
   "com_nav_my_files": "Dosyalarım",
   "com_nav_not_supported": "Desteklenmiyor",
   "com_nav_open_sidebar": "Yan paneli aç",
@@ -351,14 +562,16 @@
   "com_nav_plus_command": "+-Komutu",
   "com_nav_plus_command_description": "Çoklu yanıt ayarı eklemek için \"+\" komutunu aç/kapat",
   "com_nav_profile_picture": "Profil Resmi",
+  "com_nav_save_badges_state": "Rozet durumunu kaydet",
   "com_nav_save_drafts": "Taslakları yerel olarak kaydet",
   "com_nav_scroll_button": "Sona kaydır düğmesi",
   "com_nav_search_placeholder": "Mesajları ara",
-  "com_nav_send_message": "Mesajı gönder",
+  "com_nav_send_message": "Mesaj gönder",
   "com_nav_setting_account": "Hesap",
   "com_nav_setting_chat": "Sohbet",
-  "com_nav_setting_data": "Veri kontrolleri",
+  "com_nav_setting_delay": "Gecikme (sn)",
   "com_nav_setting_general": "Genel",
+  "com_nav_setting_mcp": "MCP Ayarları",
   "com_nav_setting_speech": "Konuşma",
   "com_nav_settings": "Ayarlar",
   "com_nav_shared_links": "Paylaşılan bağlantılar",
@@ -375,6 +588,7 @@
   "com_nav_tool_dialog": "Asistan Araçları",
   "com_nav_tool_dialog_agents": "Ajan Araçları",
   "com_nav_tool_dialog_description": "Araç seçimlerinin kalıcı olması için asistan kaydedilmelidir.",
+  "com_nav_tool_dialog_mcp_server_tools": "MCP Sunucu Araçları",
   "com_nav_tool_remove": "Kaldır",
   "com_nav_tool_search": "Araçları Ara",
   "com_nav_user": "KULLANICI",
@@ -383,54 +597,181 @@
   "com_nav_voice_select": "Ses Seçimi",
   "com_show_examples": "Örnekleri Göster",
   "com_sidepanel_agent_builder": "Ajan Oluşturucu",
-  "com_sidepanel_assistant_builder": "Asistan Yapıcı",
+  "com_sidepanel_assistant_builder": "Asistan Oluşturucu",
   "com_sidepanel_attach_files": "Dosyaları Ekle",
   "com_sidepanel_conversation_tags": "Yer İmleri",
   "com_sidepanel_hide_panel": "Paneli Gizle",
   "com_sidepanel_manage_files": "Dosyaları Yönet",
   "com_sidepanel_parameters": "Parametreler",
+  "com_sources_agent_file": "Kaynak Belge",
+  "com_sources_agent_files": "Ajan Dosyaları",
+  "com_sources_download_aria_label": "İndir: {{filename}}{{status}}",
+  "com_sources_download_failed": "İndirme başarısız oldu",
+  "com_sources_download_local_unavailable": "İndirilemiyor: Dosya kaydedilmedi",
+  "com_sources_downloading_status": " (indiriliyor...)",
+  "com_sources_error_fallback": "Kaynaklar yüklenemedi",
+  "com_sources_image_alt": "Arama sonucu resmi",
+  "com_sources_more_files": "+{{count}} dosya",
+  "com_sources_more_sources": "+{{count}} kaynak",
+  "com_sources_pages": "Sayfalar",
+  "com_sources_region_label": "Arama sonuçları ve kaynaklar",
+  "com_sources_reload_page": "Sayfayı yeniden yükle",
+  "com_sources_tab_all": "Tümü",
+  "com_sources_tab_files": "Dosyalar",
+  "com_sources_tab_images": "Resimler",
+  "com_sources_tab_news": "Haberler",
+  "com_sources_title": "Kaynaklar",
+  "com_ui_2fa_account_security": "İki faktörlü kimlik doğrulama, hesabınıza ekstra bir güvenlik katmanı ekler",
+  "com_ui_2fa_disable": "2FA'yı Devre Dışı Bırak",
+  "com_ui_2fa_disable_error": "İki faktörlü kimlik doğrulamayı devre dışı bırakırken bir hata oluştu",
+  "com_ui_2fa_disabled": "2FA devre dışı bırakıldı",
+  "com_ui_2fa_enable": "2FA'yı Etkinleştir",
+  "com_ui_2fa_enabled": "2FA etkinleştirildi",
+  "com_ui_2fa_generate_error": "İki faktörlü kimlik doğrulama ayarları oluşturulurken bir hata oluştu",
+  "com_ui_2fa_invalid": "Geçersiz iki faktörlü kimlik doğrulama kodu",
+  "com_ui_2fa_setup": "2FA Kurulumu",
+  "com_ui_2fa_verification_required": "Devam etmek için 2FA kodunuzu girin",
+  "com_ui_2fa_verified": "İki Faktörlü Kimlik Doğrulama başarıyla doğrulandı",
   "com_ui_accept": "Kabul ediyorum",
+  "com_ui_action_button": "Eylem Düğmesi",
+  "com_ui_active": "Aktif",
   "com_ui_add": "Ekle",
-  "com_ui_add_model_preset": "Ek bir yanıt için bir model veya ön ayar ekleyin",
+  "com_ui_add_first_bookmark": "Bir tane eklemek için bir sohbete tıklayın",
+  "com_ui_add_first_mcp_server": "Başlamak için ilk MCP sunucunuzu oluşturun",
+  "com_ui_add_first_prompt": "Başlamak için ilk isteminizi oluşturun",
+  "com_ui_add_labels": "Etiket Ekle",
+  "com_ui_add_mcp": "MCP Ekle",
+  "com_ui_add_mcp_server": "MCP Sunucusu Ekle",
+  "com_ui_add_model_preset": "Ek bir yanıt için bir model veya hazır ayar ekleyin",
   "com_ui_add_multi_conversation": "Çoklu konuşma ekle",
+  "com_ui_add_special_variables": "Özel Değişkenler Ekle",
+  "com_ui_add_web_search_api_keys": "Web Arama API Anahtarlarını Ekle",
+  "com_ui_adding_details": "Detaylar ekleniyor",
+  "com_ui_additional_details": "Ek Detaylar",
   "com_ui_admin": "Yönetici",
   "com_ui_admin_access_warning": "Bu özelliğe Yönetici erişimini devre dışı bırakmak, yenileme gerektiren beklenmedik kullanıcı arayüzü sorunlarına neden olabilir. Kaydedilirse, geri almanın tek yolu tüm rolleri etkileyen librechat.yaml yapılandırmasındaki arayüz ayarı aracılığıyladır.",
   "com_ui_admin_settings": "Yönetici Ayarları",
+  "com_ui_admin_settings_section": "Yönetici Ayarları - {{section}}",
   "com_ui_advanced": "Gelişmiş",
+  "com_ui_advanced_settings": "Gelişmiş Ayarlar",
   "com_ui_agent": "Ajan",
+  "com_ui_agent_api_keys": "Ajan API Anahtarları",
+  "com_ui_agent_category_aftersales": "Satış Sonrası",
+  "com_ui_agent_category_finance": "Finans",
+  "com_ui_agent_category_general": "Genel",
+  "com_ui_agent_category_hr": "İK",
+  "com_ui_agent_category_it": "BT",
+  "com_ui_agent_category_rd": "Ar-Ge",
+  "com_ui_agent_category_sales": "Satış",
+  "com_ui_agent_category_selector_aria": "Ajan kategori seçici",
+  "com_ui_agent_chain": "Ajan Zinciri (Ajan Karışımı)",
+  "com_ui_agent_chain_info": "Ajanlardan oluşan diziler oluşturmanıza olanak tanır. Her ajan zincirdeki önceki ajanların çıktılarına erişebilir. Ajanların yardımcı bilgi olarak önceki çıktıları kullandığı \"Mixture-of-Agents\" (Ajan Karışımı) mimarisine dayanmaktadır.",
+  "com_ui_agent_chain_max": "Maksimum ajan sınırına ulaştınız: {{0}}.",
   "com_ui_agent_delete_error": "Ajan silinirken bir hata oluştu",
   "com_ui_agent_deleted": "Ajan başarıyla silindi",
   "com_ui_agent_duplicate_error": "Ajan çoğaltılırken bir hata oluştu",
   "com_ui_agent_duplicated": "Ajan başarıyla çoğaltıldı",
+  "com_ui_agent_handoff_add": "Devretme ajanı ekle",
+  "com_ui_agent_handoff_description": "Devretme açıklaması",
+  "com_ui_agent_handoff_description_placeholder": "örn., İstatistiksel analiz için veri analistine aktar",
+  "com_ui_agent_handoff_info": "Spesifik uzmanlık gerektiğinde bu ajanın konuşmaları devredebileceği ajanları yapılandırın.",
+  "com_ui_agent_handoff_info_2": "Her bir devir işlemi, uzman ajanlara bağlam ile birlikte sorunsuz yönlendirme sağlayan bir transfer aracı oluşturur.",
+  "com_ui_agent_handoff_max": "Maksimum {{0}} devretme ajanı sınırına ulaşıldı.",
+  "com_ui_agent_handoff_prompt": "İletilen içerik (Passthrough)",
+  "com_ui_agent_handoff_prompt_key": "İçerik parametre adı (varsayılan: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Geçirilecek içeriği etiketle (varsayılan: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Bu ajana devralan ajana hangi içeriği oluşturup ileteceğini söyleyin. Bu özelliği etkinleştirmek için buraya bir şey eklemelisiniz.",
+  "com_ui_agent_handoffs": "Ajan Devretmeleri",
+  "com_ui_agent_name_is_required": "Ajan adı gereklidir",
+  "com_ui_agent_recursion_limit": "Maksimum Ajan Adımı",
+  "com_ui_agent_recursion_limit_info": "Ajanın nihai bir yanıt vermeden önce bir çalıştırmada atabileceği adım sayısını sınırlar. Varsayılan değer 25 adımdır. Bir adım, AI API isteği veya araç kullanım turudur. Örneğin, temel bir araç etkileşimi 3 adım sürer: başlangıç isteği, araç kullanımı ve takip isteği.",
+  "com_ui_agent_url_copied": "Ajan URL'si panoya kopyalandı",
+  "com_ui_agent_var": "{{0}} ajanı",
+  "com_ui_agent_version": "Sürüm",
+  "com_ui_agent_version_active": "Aktif Sürüm",
+  "com_ui_agent_version_empty": "Kullanılabilir sürüm yok",
+  "com_ui_agent_version_error": "Sürümler alınırken hata oluştu",
+  "com_ui_agent_version_history": "Sürüm Geçmişi",
+  "com_ui_agent_version_no_agent": "Ajan seçilmedi. Sürüm geçmişini görmek için lütfen bir ajan seçin.",
+  "com_ui_agent_version_no_date": "Tarih mevcut değil",
+  "com_ui_agent_version_restore": "Geri Yükle",
+  "com_ui_agent_version_restore_confirm": "Bu sürümü geri yüklemek istediğinizden emin misiniz?",
+  "com_ui_agent_version_restore_error": "Sürüm geri yüklenemedi",
+  "com_ui_agent_version_restore_success": "Sürüm başarıyla geri yüklendi",
+  "com_ui_agent_version_title": "Sürüm {{versionNumber}}",
+  "com_ui_agent_version_unknown_date": "Bilinmeyen tarih",
   "com_ui_agents": "Ajanlar",
   "com_ui_agents_allow_create": "Ajan oluşturmaya izin ver",
+  "com_ui_agents_allow_share": "Ajan paylaşımına izin ver",
+  "com_ui_agents_allow_share_public": "Ajanları herkese açık paylaşmaya izin ver",
   "com_ui_agents_allow_use": "Ajan kullanımına izin ver",
   "com_ui_all": "hepsi",
   "com_ui_all_proper": "Tümü",
+  "com_ui_analyzing": "Analiz ediliyor",
+  "com_ui_analyzing_finished": "Analiz tamamlandı",
+  "com_ui_api_key": "API Anahtarı",
+  "com_ui_api_key_create_error": "API anahtarı oluşturulamadı",
+  "com_ui_api_key_created": "API anahtarı başarıyla oluşturuldu",
+  "com_ui_api_key_delete_error": "API anahtarı silinemedi",
+  "com_ui_api_key_deleted": "API anahtarı başarıyla silindi",
+  "com_ui_api_key_name": "Anahtar Adı",
+  "com_ui_api_key_name_placeholder": "Benim API Anahtarım",
+  "com_ui_api_key_name_required": "API anahtarı adı gereklidir",
+  "com_ui_api_key_warning": "API anahtarınızı şimdi kopyaladığınızdan emin olun. Bir daha göremeyeceksiniz!",
+  "com_ui_api_keys_load_error": "API anahtarları yüklenemedi",
   "com_ui_archive": "Arşivle",
-  "com_ui_archive_error": "Konuşmayı arşivleyemedi",
+  "com_ui_archive_delete_error": "Arşivlenmiş konuşma silinemedi",
+  "com_ui_archive_error": "Konuşma arşivlenemedi",
   "com_ui_artifact_click": "Açmak için tıklayın",
   "com_ui_artifacts": "Yapıtlar",
+  "com_ui_artifacts_options": "Yapıt Seçenekleri",
   "com_ui_artifacts_toggle": "Yapıtlar Arayüzünü Aç/Kapat",
+  "com_ui_artifacts_toggle_agent": "Yapıtları Etkinleştir",
   "com_ui_ascending": "Artan",
   "com_ui_assistant": "Asistan",
   "com_ui_assistant_delete_error": "Asistan silme sırasında bir hata oluştu",
   "com_ui_assistant_deleted": "Asistan başarıyla silindi",
   "com_ui_assistants": "Asistanlar",
-  "com_ui_assistants_output": "Asistan Çıkışı",
+  "com_ui_assistants_output": "Asistan Çıktıları",
+  "com_ui_at_least_one_owner_required": "En az bir sahip (owner) gereklidir",
   "com_ui_attach_error": "Dosya eklenemiyor. Bir konuşma oluşturun veya seçin ya da sayfayı yenilemeyi deneyin.",
+  "com_ui_attach_error_disabled": "Bu uç nokta için dosya yüklemeleri devre dışı",
+  "com_ui_attach_error_limit": "Dosya sınırına ulaşıldı:",
   "com_ui_attach_error_openai": "Asistan dosyalarını diğer uç noktalara ekleyemezsiniz",
   "com_ui_attach_error_size": "Uç nokta için dosya boyutu sınırı aşıldı:",
+  "com_ui_attach_error_total_size": "Uç nokta için toplam dosya boyutu sınırı aşıldı:",
   "com_ui_attach_error_type": "Uç nokta için desteklenmeyen dosya türü:",
+  "com_ui_attach_remove": "Dosyayı kaldır",
   "com_ui_attach_warn_endpoint": "Asistan olmayan dosyalar uyumlu bir araç olmadan göz ardı edilebilir",
   "com_ui_attachment": "Ek",
+  "com_ui_auth_type": "Kimlik Doğrulama Türü",
+  "com_ui_auth_url": "Yetkilendirme URL'si",
+  "com_ui_authenticate": "Kimlik Doğrula",
   "com_ui_authentication": "Kimlik Doğrulama",
+  "com_ui_authentication_type": "Kimlik Doğrulama Türü",
+  "com_ui_auto": "Otomatik",
+  "com_ui_available_options": "Mevcut seçenekler",
   "com_ui_avatar": "Avatar",
+  "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
+  "com_ui_back": "Geri",
+  "com_ui_back_to_builder": "Oluşturucuya geri dön",
   "com_ui_back_to_prompts": "İstemlere Dön",
+  "com_ui_backup_code_number": "Kod #{{number}}",
+  "com_ui_backup_codes": "Yedek Kodlar",
+  "com_ui_backup_codes_regenerate_error": "Yedek kodlar yeniden oluşturulurken bir hata oluştu",
+  "com_ui_backup_codes_regenerated": "Yedek kodlar başarıyla yeniden oluşturuldu",
+  "com_ui_backup_codes_security_info": "Güvenlik nedenleriyle yedek kodlar oluşturulduğunda yalnızca bir kez görüntülenir. Lütfen bunları güvenli bir yere kaydedin.",
+  "com_ui_backup_codes_status": "Yedek Kod Durumu",
+  "com_ui_basic": "Temel",
+  "com_ui_basic_auth_header": "Temel yetkilendirme başlığı (Basic Auth)",
+  "com_ui_bearer": "Bearer",
+  "com_ui_beta": "Beta",
   "com_ui_bookmark_delete_confirm": "Bu yer imini silmek istediğinizden emin misiniz?",
   "com_ui_bookmarks": "Yer İmleri",
   "com_ui_bookmarks_add": "Yer İmi Ekle",
   "com_ui_bookmarks_add_to_conversation": "Mevcut sohbete ekle",
+  "com_ui_bookmarks_count_selected": "Yer İmleri, {{count}} seçildi",
   "com_ui_bookmarks_create_error": "Yer imi oluşturulurken bir hata oluştu",
   "com_ui_bookmarks_create_exists": "Bu yer imi zaten mevcut",
   "com_ui_bookmarks_create_success": "Yer imi başarıyla oluşturuldu",
@@ -441,36 +782,97 @@
   "com_ui_bookmarks_edit": "Yer İmini Düzenle",
   "com_ui_bookmarks_filter": "Yer imlerini filtrele...",
   "com_ui_bookmarks_new": "Yeni Yer İmi",
+  "com_ui_bookmarks_tag_exists": "Bu başlığa sahip bir yer imi zaten mevcut",
   "com_ui_bookmarks_title": "Başlık",
   "com_ui_bookmarks_update_error": "Yer imi güncellenirken bir hata oluştu",
   "com_ui_bookmarks_update_success": "Yer imi başarıyla güncellendi",
+  "com_ui_branch_created": "Dal başarıyla oluşturuldu",
+  "com_ui_branch_error": "Dal oluşturulamadı",
+  "com_ui_branch_message": "Bu yanıttan dal oluştur",
+  "com_ui_by_author": "{{0}} tarafından",
+  "com_ui_callback_url": "Geri Dönüş (Callback) URL'si",
   "com_ui_cancel": "İptal",
+  "com_ui_cancelled": "İptal edildi",
+  "com_ui_category": "Kategori",
+  "com_ui_change_version": "Sürümü Değiştir",
   "com_ui_chat": "Sohbet",
   "com_ui_chat_history": "Sohbet Geçmişi",
+  "com_ui_chats": "Sohbetler",
+  "com_ui_check_internet": "İnternet bağlantınızı kontrol edin",
   "com_ui_clear": "Temizle",
   "com_ui_clear_all": "Tümünü temizle",
+  "com_ui_clear_browser_cache": "Tarayıcı önbelleğinizi temizleyin",
+  "com_ui_clear_presets": "Hazır Ayarları Temizle",
+  "com_ui_clear_search": "Aramayı temizle",
+  "com_ui_click_to_close": "Kapatmak için tıklayın",
+  "com_ui_click_to_edit": "Düzenlemek için tıklayın",
+  "com_ui_click_to_view_var": "{{0}} görüntülemek için tıklayın",
+  "com_ui_client_id": "İstemci Kimliği (Client ID)",
+  "com_ui_client_secret": "İstemci Sırrı (Client Secret)",
   "com_ui_close": "Kapat",
   "com_ui_close_menu": "Menüyü Kapat",
+  "com_ui_close_settings": "Ayarları Kapat",
+  "com_ui_close_var": "{{0}} Kapat",
+  "com_ui_close_window": "Pencereyi Kapat",
   "com_ui_code": "Kod",
+  "com_ui_collapse": "Daralt",
   "com_ui_collapse_chat": "Sohbeti Daralt",
-  "com_ui_command_placeholder": "İsteğe bağlı: İstem için bir komut girin veya ad kullanılacak",
-  "com_ui_command_usage_placeholder": "Bir İstemi komut veya ada göre seçin",
+  "com_ui_collapse_summary": "Özeti Daralt",
+  "com_ui_collapse_thoughts": "Düşünceleri Daralt",
+  "com_ui_command_placeholder": "İsteğe bağlı: İstem için bir komut girin veya adı kullanılacaktır",
+  "com_ui_command_usage_placeholder": "Komut veya isimle bir İstem seçin",
+  "com_ui_complete": "Tamamlandı!",
+  "com_ui_complete_setup": "Kurulumu Tamamla",
+  "com_ui_concise": "Kısa ve Öz",
+  "com_ui_configure": "Yapılandır",
+  "com_ui_configure_mcp_variables_for": "{{0}} İçin Değişkenleri Yapılandır",
+  "com_ui_confirm": "Onayla",
   "com_ui_confirm_action": "Eylemi Onayla",
   "com_ui_confirm_admin_use_change": "Bu ayarı değiştirmek, siz dahil yöneticilerin erişimini engelleyecektir. Devam etmek istediğinizden emin misiniz?",
   "com_ui_confirm_change": "Değişikliği Onayla",
+  "com_ui_connecting": "Bağlanıyor",
+  "com_ui_contact_admin_if_issue_persists": "Sorun devam ederse Yönetici ile iletişime geçin",
   "com_ui_context": "Bağlam",
+  "com_ui_context_filter_sort": "Bağlama Göre Filtrele ve Sırala",
   "com_ui_continue": "Devam et",
-  "com_ui_convo_delete_success": "Konuşma başarıyla silindi.",
+  "com_ui_continue_oauth": "OAuth ile Devam Et",
+  "com_ui_control_bar": "Kontrol çubuğu",
+  "com_ui_conversation": "konuşma",
+  "com_ui_conversation_label": "{{title}} konuşması",
+  "com_ui_conversation_not_found": "Konuşma bulunamadı",
+  "com_ui_conversation_summarized": "Konuşma özetlendi",
+  "com_ui_conversations": "konuşmalar",
+  "com_ui_convo_archived": "Konuşma arşivlendi",
+  "com_ui_convo_delete_error": "Konuşma silinemedi",
+  "com_ui_convo_delete_success": "Konuşma başarıyla silindi",
   "com_ui_copied": "Kopyalandı!",
   "com_ui_copied_to_clipboard": "Panoya kopyalandı",
+  "com_ui_copy": "Kopyala",
   "com_ui_copy_code": "Kodu kopyala",
+  "com_ui_copy_failed": "Panoya kopyalama başarısız oldu",
   "com_ui_copy_link": "Bağlantıyı kopyala",
+  "com_ui_copy_stack_trace": "Yığın izlemeyi (stack trace) kopyala",
+  "com_ui_copy_summary": "Özeti panoya kopyala",
+  "com_ui_copy_thoughts_to_clipboard": "Düşünceleri panoya kopyala",
   "com_ui_copy_to_clipboard": "Panoya kopyala",
+  "com_ui_copy_url_to_clipboard": "URL'yi panoya kopyala",
   "com_ui_create": "Oluştur",
+  "com_ui_create_api_key": "API Anahtarı Oluştur",
+  "com_ui_create_assistant": "Asistan Oluştur",
   "com_ui_create_link": "Bağlantı oluştur",
+  "com_ui_create_mcp_server": "MCP sunucusu oluştur",
+  "com_ui_create_new_agent": "Yeni Ajan Oluştur",
   "com_ui_create_prompt": "İstem Oluştur",
-  "com_ui_currently_production": "Şu anda üretimde",
+  "com_ui_create_prompt_page": "Yeni İstem Yapılandırma Sayfası",
+  "com_ui_created": "Oluşturuldu",
+  "com_ui_creating": "Oluşturuluyor...",
+  "com_ui_creating_image": "Resim oluşturuluyor. Biraz sürebilir",
+  "com_ui_current": "Geçerli",
+  "com_ui_currently_production": "Şu anda üretimde (production)",
+  "com_ui_custom": "Özel",
+  "com_ui_custom_header_name": "Özel Başlık (Header) Adı",
   "com_ui_custom_prompt_mode": "Özel İstem Modu",
+  "com_ui_dark_theme_enabled": "Karanlık tema etkin",
   "com_ui_date": "Tarih",
   "com_ui_date_april": "Nisan",
   "com_ui_date_august": "Ağustos",
@@ -486,195 +888,636 @@
   "com_ui_date_previous_30_days": "Önceki 30 gün",
   "com_ui_date_previous_7_days": "Önceki 7 gün",
   "com_ui_date_september": "Eylül",
+  "com_ui_date_sort": "Tarihe Göre Sırala",
   "com_ui_date_today": "Bugün",
   "com_ui_date_yesterday": "Dün",
   "com_ui_decline": "Kabul etmiyorum",
+  "com_ui_default_post_request": "Varsayılan (POST isteği)",
   "com_ui_delete": "Sil",
   "com_ui_delete_action": "Eylemi Sil",
   "com_ui_delete_action_confirm": "Bu eylemi silmek istediğinizden emin misiniz?",
+  "com_ui_delete_agent": "Ajanı Sil",
   "com_ui_delete_agent_confirm": "Bu ajanı silmek istediğinizden emin misiniz?",
+  "com_ui_delete_assistant": "Asistanı Sil",
   "com_ui_delete_assistant_confirm": "Bu Asistanı gerçekten silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
-  "com_ui_delete_confirm": "Bu silinecek",
-  "com_ui_delete_confirm_prompt_version_var": "Bu, \"{{0}}\" için seçilen sürümü silecektir. Başka sürüm yoksa, istem silinecektir.",
-  "com_ui_delete_conversation": "Sohbeti sil?",
+  "com_ui_delete_confirm": "Bu işlem şunu silecek:",
+  "com_ui_delete_confirm_prompt_version_var": "Bu, \"{{0}}\" için seçilen sürümü silecektir. Başka sürüm yoksa istem tamamen silinir.",
+  "com_ui_delete_confirm_strong": "Bu <strong>{{title}}</strong> öğesini silecek",
+  "com_ui_delete_conversation": "Sohbet silinsin mi?",
+  "com_ui_delete_conversation_tooltip": "Konuşmayı sil",
+  "com_ui_delete_mcp_server": "MCP Sunucusu Silinsin mi?",
+  "com_ui_delete_mcp_server_name": "{{0}} MCP sunucusunu sil",
+  "com_ui_delete_not_allowed": "Silme işlemine izin verilmiyor",
+  "com_ui_delete_preset": "Hazır Ayar Silinsin mi?",
   "com_ui_delete_prompt": "İstem Silinsin mi?",
   "com_ui_delete_shared_link": "Paylaşılan bağlantı silinsin mi?",
+  "com_ui_delete_shared_link_heading": "Paylaşılan Bağlantıyı Sil",
+  "com_ui_delete_success": "Başarıyla silindi",
   "com_ui_delete_tool": "Aracı Sil",
   "com_ui_delete_tool_confirm": "Bu aracı silmek istediğinizden emin misiniz?",
+  "com_ui_delete_tool_save_reminder": "Araç kaldırıldı. Değişiklikleri uygulamak için ajanı kaydedin.",
+  "com_ui_deleted": "Silindi",
+  "com_ui_deleting": "Siliniyor...",
+  "com_ui_deleting_file": "Dosya siliniyor...",
+  "com_ui_deploy": "Dağıt (Deploy)",
   "com_ui_descending": "Azalan",
   "com_ui_description": "Açıklama",
   "com_ui_description_placeholder": "İsteğe bağlı: İstem için görüntülenecek bir açıklama girin",
+  "com_ui_deselect_all": "Tüm Seçimleri Kaldır",
+  "com_ui_detailed": "Detaylı",
+  "com_ui_details": "Detaylar",
+  "com_ui_disabling": "Devre dışı bırakılıyor...",
+  "com_ui_done": "Bitti",
   "com_ui_download": "İndir",
   "com_ui_download_artifact": "Yapıtı İndir",
+  "com_ui_download_backup": "Yedek Kodları İndir",
+  "com_ui_download_backup_tooltip": "Devam etmeden önce yedek kodlarınızı indirin. Kimlik doğrulayıcı cihazınızı kaybederseniz erişimi yeniden sağlamak için bunlara ihtiyacınız olacak.",
   "com_ui_download_error": "Dosya indirme hatası. Dosya silinmiş olabilir.",
-  "com_ui_drag_drop": "Sürükle ve bırak",
+  "com_ui_download_error_logs": "Hata günlüklerini indir",
+  "com_ui_drag_drop": "Konuşmaya eklemek için herhangi bir dosyayı buraya sürükleyip bırakın",
   "com_ui_dropdown_variables": "Açılır menü değişkenleri:",
   "com_ui_duplicate": "Çoğalt",
+  "com_ui_duplicate_agent": "Ajanı Çoğalt",
   "com_ui_duplication_error": "Konuşma çoğaltılırken bir hata oluştu",
   "com_ui_duplication_processing": "Konuşma çoğaltılıyor...",
   "com_ui_duplication_success": "Konuşma başarıyla çoğaltıldı",
   "com_ui_edit": "Düzenle",
+  "com_ui_edit_editing_image": "Resim düzenleniyor",
+  "com_ui_edit_mcp_server": "MCP Sunucusunu Düzenle",
+  "com_ui_edit_mcp_server_dialog_description": "Benzersiz Sunucu Tanımlayıcısı: {{serverName}}",
+  "com_ui_edit_preset_title": "Hazır Ayarı Düzenle - {{title}}",
+  "com_ui_edit_prompt_page": "İstem Düzenleme Sayfası",
+  "com_ui_editable_message": "Düzenlenebilir Mesaj",
+  "com_ui_editor_instructions": "Resmi yeniden konumlandırmak için sürükleyin • Boyutu ayarlamak için yakınlaştırma kaydırıcısını veya düğmelerini kullanın",
+  "com_ui_empty_category": "-",
   "com_ui_endpoint": "Uç Nokta",
   "com_ui_endpoint_menu": "LLM Uç Nokta Menüsü",
   "com_ui_enter": "Gir",
   "com_ui_enter_api_key": "API Anahtarı Girin",
+  "com_ui_enter_description": "Açıklama girin (isteğe bağlı)",
+  "com_ui_enter_key": "Anahtar girin",
+  "com_ui_enter_name": "Ad girin",
   "com_ui_enter_openapi_schema": "OpenAPI şemanızı buraya girin",
+  "com_ui_enter_value": "Değer girin",
   "com_ui_error": "Hata",
-  "com_ui_error_connection": "Sunucuya bağlanırken hata oluştu, sayfayı yenilemeyi deneyin.",
+  "com_ui_error_connection": "Sunucuya bağlanılırken hata oluştu, sayfayı yenilemeyi deneyin.",
+  "com_ui_error_message_prefix": "Hata Mesajı:",
   "com_ui_error_save_admin_settings": "Yönetici ayarlarınız kaydedilirken bir hata oluştu.",
+  "com_ui_error_try_following_prefix": "Lütfen şunlardan birini deneyin",
+  "com_ui_error_unexpected": "Oops! Beklenmeyen Bir Şey Oldu",
+  "com_ui_error_updating_preferences": "Tercihler güncellenirken hata oluştu",
+  "com_ui_everyone_permission_level": "Herkesin izin seviyesi",
   "com_ui_examples": "Örnekler",
+  "com_ui_expand": "Genişlet",
+  "com_ui_expand_chat": "Sohbeti Genişlet",
+  "com_ui_expand_thoughts": "Düşünceleri Genişlet",
   "com_ui_export_convo_modal": "Konuşma Dışa Aktarma Modalı",
+  "com_ui_failed": "Başarısız",
+  "com_ui_feedback_more": "Daha fazla...",
+  "com_ui_feedback_more_information": "Ek geri bildirim sağlayın",
+  "com_ui_feedback_negative": "Geliştirilmesi gerekiyor",
+  "com_ui_feedback_placeholder": "Lütfen buraya ek geri bildirim sağlayın",
+  "com_ui_feedback_positive": "Bunu sevdim",
+  "com_ui_feedback_tag_accurate_reliable": "Doğru ve Güvenilir",
+  "com_ui_feedback_tag_attention_to_detail": "Detaylara Dikkat Edilmiş",
+  "com_ui_feedback_tag_bad_style": "Kötü stil veya ton",
+  "com_ui_feedback_tag_clear_well_written": "Açık ve İyi Yazılmış",
+  "com_ui_feedback_tag_creative_solution": "Yaratıcı Çözüm",
+  "com_ui_feedback_tag_inaccurate": "Hatalı veya yanlış cevap",
+  "com_ui_feedback_tag_missing_image": "Bir resim bekleniyordu",
+  "com_ui_feedback_tag_not_helpful": "Faydalı bilgi eksikti",
+  "com_ui_feedback_tag_not_matched": "İsteğimle eşleşmedi",
+  "com_ui_feedback_tag_other": "Diğer sorun",
+  "com_ui_feedback_tag_unjustified_refusal": "Sebepsiz yere reddedildi",
+  "com_ui_field_max_length": "{{field}} {{length}} karakterden az olmalıdır",
   "com_ui_field_required": "Bu alan gereklidir",
+  "com_ui_file": "Dosya",
+  "com_ui_file_input_avatar_label": "Avatar için dosya girişi",
+  "com_ui_file_size": "Dosya Boyutu",
+  "com_ui_file_token_limit": "Dosya Token Sınırı",
+  "com_ui_file_token_limit_desc": "Maliyetleri ve kaynak kullanımını kontrol etmek için dosya işleme için maksimum token sınırını ayarlayın",
+  "com_ui_files": "Dosyalar",
+  "com_ui_filter_mcp_servers": "MCP sunucularını ada göre filtrele",
   "com_ui_filter_prompts": "İstemleri Filtrele",
   "com_ui_filter_prompts_name": "İstemleri ada göre filtrele",
-  "com_ui_fork": "Çatallaş",
-  "com_ui_fork_all_target": "Buradan tüm dahil et",
+  "com_ui_final_touch": "Son dokunuş",
+  "com_ui_finance": "Finans",
+  "com_ui_fork": "Çatalla (Fork)",
+  "com_ui_fork_all_target": "Buradan/buraya tümünü dahil et",
   "com_ui_fork_branches": "İlgili dalları dahil et",
   "com_ui_fork_change_default": "Varsayılan çatallama seçeneği",
   "com_ui_fork_default": "Varsayılan çatallama seçeneğini kullan",
   "com_ui_fork_error": "Konuşma çatallanmasında bir hata oluştu",
+  "com_ui_fork_error_rate_limit": "Çok fazla çatallama isteği. Lütfen daha sonra tekrar deneyin",
   "com_ui_fork_from_message": "Bir çatallama seçeneği seç",
   "com_ui_fork_info_1": "Mesajların istenilen davranışla çatallanması için bu ayarı kullanın.",
-  "com_ui_fork_info_2": "\"Çatallaşma\", mevcut konuşmadaki belirli mesajlardan veya mesajlardan başlayan/sonlanan yeni bir konuşma oluşturmayı ifade eder, seçilen seçeneklere göre bir kopya oluşturur.",
-  "com_ui_fork_info_3": "\"Hedef mesaj\" bu açılır pencerenin açıldığı mesajı veya \"{{0}}\" işaretlenirse, konuşmadaki son mesajı ifade eder.",
+  "com_ui_fork_info_2": "\"Çatallaşma\", mevcut konuşmadaki belirli mesajlardan başlayan/sonlanan yeni bir konuşma oluşturmayı ifade eder ve seçilen seçeneklere göre bir kopya oluşturur.",
+  "com_ui_fork_info_3": "\"Hedef mesaj\", bu açılır pencerenin açıldığı mesajı veya \"{{0}}\" işaretlenirse, konuşmadaki son mesajı ifade eder.",
   "com_ui_fork_info_branches": "Bu seçenek, görünen mesajları ilgili dallarla birlikte çatallandırır; diğer bir deyişle, hedef mesaja giden doğrudan yolu ve yol üzerindeki dalları içerir.",
-  "com_ui_fork_info_remember": "Çatallama işlemlerinde hızlıca tercih ettiğiniz seçenekleri hatırlayın, böylece gelecekte çatallama işlemlerini daha hızlı yapabilirsiniz.",
-  "com_ui_fork_info_start": "İşaretlenirse, yukarıda seçilen davranışa göre bu mesajdan konuşmadaki son mesaja kadar çatallandırılacaktır.",
+  "com_ui_fork_info_button_label": "Konuşmaları çatallama hakkında bilgi görüntüle",
+  "com_ui_fork_info_remember": "Gelecekteki kullanımlarda tercih ettiğiniz seçenekleri hatırlamak için bunu işaretleyin, böylece çatallama işlemleri daha hızlı yapılabilir.",
+  "com_ui_fork_info_start": "İşaretlenirse, yukarıda seçilen davranışa göre çatallama işlemi bu mesajdan başlayıp konuşmadaki en son mesaja kadar sürecektir.",
   "com_ui_fork_info_target": "Bu seçenek, hedef mesaja kadar olan tüm mesajları ve komşularını çatallandırır; diğer bir deyişle, tüm mesaj dalları, görünür olup olmadıklarına veya aynı yoldan olup olmadıklarına bakılmaksızın dahildir.",
-  "com_ui_fork_info_visible": "Bu seçenek sadece görünen mesajları çatallandırır; diğer bir deyişle, hedef mesaja giden doğrudan yolu, herhangi bir dal olmadan.",
+  "com_ui_fork_info_visible": "Bu seçenek sadece görünen mesajları çatallandırır; diğer bir deyişle, herhangi bir dal olmadan hedef mesaja giden doğrudan yolu alır.",
+  "com_ui_fork_more_details_about": "\"{{0}}\" çatallama seçeneği hakkında daha fazla bilgi ve ayrıntı görüntüle",
+  "com_ui_fork_more_info_options": "Tüm çatallama seçeneklerinin ve davranışlarının detaylı açıklamasını görüntüle",
+  "com_ui_fork_open_menu": "Çatallama Menüsünü Aç",
   "com_ui_fork_processing": "Konuşma çatallanıyor...",
   "com_ui_fork_remember": "Hatırla",
   "com_ui_fork_remember_checked": "Seçiminiz kullanımdan sonra hatırlanacaktır. Ayarlardan herhangi bir zamanda bunu değiştirebilirsiniz.",
   "com_ui_fork_split_target": "Çatallamaya burada başla",
   "com_ui_fork_split_target_setting": "Varsayılan olarak hedef mesajdan çatallamaya başla",
-  "com_ui_fork_success": "Başarıyla çatallanmış konuşma",
-  "com_ui_fork_visible": "Sadece görünen mesajlar",
+  "com_ui_fork_success": "Konuşma başarıyla çatallandı",
+  "com_ui_fork_visible": "Sadece görünür mesajlar",
+  "com_ui_generate_qrcode": "QR Kodu Oluştur",
+  "com_ui_generating": "Oluşturuluyor...",
+  "com_ui_generating_image": "Resim oluşturuluyor...",
+  "com_ui_generation_settings": "Oluşturma Ayarları",
+  "com_ui_getting_started": "Başlarken",
   "com_ui_go_back": "Geri git",
-  "com_ui_go_to_conversation": "Konuşmaya Git",
+  "com_ui_go_to_conversation": "Konuşmaya git",
+  "com_ui_good_afternoon": "Tünaydın",
+  "com_ui_good_evening": "İyi akşamlar",
+  "com_ui_good_morning": "Günaydın",
+  "com_ui_group": "Grup",
+  "com_ui_handoff_instructions": "Devretme talimatları",
   "com_ui_happy_birthday": "1. doğum günüm kutlu olsun!",
+  "com_ui_header_format": "Başlık (Header) Formatı",
+  "com_ui_hide": "Gizle",
+  "com_ui_hide_code": "Kodu Gizle",
+  "com_ui_hide_image_details": "Resim Detaylarını Gizle",
   "com_ui_hide_qr": "QR Kodunu Gizle",
-  "com_ui_host": "Host",
-  "com_ui_image_gen": "Görüntü Oluştur",
+  "com_ui_high": "Yüksek",
+  "com_ui_host": "Host (Sunucu)",
+  "com_ui_icon": "Simge",
+  "com_ui_idea": "Fikirler",
+  "com_ui_image_created": "Resim oluşturuldu",
+  "com_ui_image_details": "Resim Detayları",
+  "com_ui_image_edited": "Resim düzenlendi",
+  "com_ui_image_gen": "Resim Oluşturma",
+  "com_ui_image_gen_failed": "Resim oluşturma başarısız oldu",
+  "com_ui_import": "İçe Aktar",
   "com_ui_import_conversation_error": "Konuşmalarınızı içe aktarma sırasında bir hata oluştu",
   "com_ui_import_conversation_file_type_error": "Desteklenmeyen içe aktarma türü",
   "com_ui_import_conversation_info": "JSON dosyasından konuşmaları içe aktar",
   "com_ui_import_conversation_success": "Konuşmalar başarıyla içe aktarıldı",
+  "com_ui_import_conversation_upload_error": "Dosya yüklenirken hata oluştu. Lütfen tekrar deneyin.",
+  "com_ui_importing": "İçe Aktarılıyor",
   "com_ui_include_shadcnui": "shadcn/ui bileşen talimatlarını dahil et",
+  "com_ui_initializing": "Başlatılıyor...",
   "com_ui_input": "Girdi",
   "com_ui_instructions": "Talimatlar",
+  "com_ui_key": "Anahtar",
+  "com_ui_key_required": "API anahtarı gereklidir",
+  "com_ui_labels": "Etiketler",
+  "com_ui_late_night": "İyi geceler",
+  "com_ui_latest": "en son",
   "com_ui_latest_footer": "Herkes için Her Yapay Zeka.",
   "com_ui_latest_version": "En son sürüm",
+  "com_ui_leave_blank_to_keep": "Mevcut olanı korumak için boş bırakın",
+  "com_ui_light_theme_enabled": "Aydınlık tema etkin",
+  "com_ui_link_copied": "Bağlantı kopyalandı",
+  "com_ui_link_refreshed": "Bağlantı yenilendi",
+  "com_ui_live": "canlı",
+  "com_ui_loading": "Yükleniyor...",
   "com_ui_locked": "Kilitli",
   "com_ui_logo": "{{0}} Logosu",
+  "com_ui_low": "Düşük",
+  "com_ui_make_production": "Üretim (Production) Yap",
   "com_ui_manage": "Yönet",
+  "com_ui_marketplace": "Pazaryeri",
+  "com_ui_marketplace_allow_use": "Pazaryeri kullanımına izin ver",
+  "com_ui_max": "Maksimum",
+  "com_ui_max_favorites_reached": "Maksimum sabitlenmiş öğe sınırına ulaşıldı ({{0}}). Daha fazla eklemek için bir öğenin sabitlemesini kaldırın.",
+  "com_ui_max_file_size": "PNG, JPG veya JPEG (maks {{0}})",
   "com_ui_max_tags": "İzin verilen maksimum sayı {{0}}, en son değerler kullanılıyor.",
+  "com_ui_mcp_authenticated_success": "'{{0}}' MCP sunucusu başarıyla doğrulandı",
+  "com_ui_mcp_click_to_defer": "Ertelemek için tıklayın - araç arama yoluyla bulunabilir ancak gerekene kadar yüklenmez",
+  "com_ui_mcp_click_to_programmatic": "Programatik çağırmayı etkinleştir - araç yalnızca kod yürütme yoluyla çağrılabilir",
+  "com_ui_mcp_configure_server": "{{0}} Yapılandır",
+  "com_ui_mcp_configure_server_description": "{{0}} için özel değişkenleri yapılandır",
+  "com_ui_mcp_defer": "Ertele",
+  "com_ui_mcp_defer_all": "Tüm araçları ertele",
+  "com_ui_mcp_defer_loading": "Yüklemeyi ertele",
+  "com_ui_mcp_dialog_title": "{{serverName}} için Değişkenleri Yapılandır. Sunucu Durumu: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "MCP sunucusu alan adı (domain) izin verilenler listesinde değil. Lütfen yöneticinizle iletişime geçin.",
+  "com_ui_mcp_enter_var": "{{0}} için değer girin",
+  "com_ui_mcp_init_failed": "MCP sunucusu başlatılamadı",
+  "com_ui_mcp_initialize": "Başlat",
+  "com_ui_mcp_initialized_success": "'{{0}}' MCP sunucusu başarıyla başlatıldı",
+  "com_ui_mcp_invalid_url": "Lütfen geçerli bir URL girin",
+  "com_ui_mcp_no_description": "Açıklama mevcut değil",
+  "com_ui_mcp_oauth_cancelled": "{{0}} için OAuth girişi iptal edildi",
+  "com_ui_mcp_oauth_timeout": "{{0}} için OAuth girişi zaman aşımına uğradı",
+  "com_ui_mcp_programmatic": "Programatik",
+  "com_ui_mcp_programmatic_all": "Tümünü programatik olarak işaretle",
+  "com_ui_mcp_server": "MCP Sunucusu",
+  "com_ui_mcp_server_connection_failed": "Sağlanan MCP sunucusuna bağlantı denemesi başarısız oldu. Lütfen URL'nin, sunucu türünün ve herhangi bir kimlik doğrulama yapılandırmasının doğru olduğundan emin olup tekrar deneyin. Ayrıca URL'ye ulaşılabildiğinden emin olun.",
+  "com_ui_mcp_server_created": "MCP sunucusu başarıyla oluşturuldu",
+  "com_ui_mcp_server_delete_confirm": "Bu MCP sunucusunu silmek istediğinizden emin misiniz?",
+  "com_ui_mcp_server_deleted": "MCP sunucusu başarıyla silindi",
+  "com_ui_mcp_server_role_editor": "MCP Sunucusu Düzenleyici",
+  "com_ui_mcp_server_role_editor_desc": "MCP sunucularını görüntüleyebilir, kullanabilir ve düzenleyebilir",
+  "com_ui_mcp_server_role_owner": "MCP Sunucusu Sahibi",
+  "com_ui_mcp_server_role_owner_desc": "MCP sunucuları üzerinde tam kontrol",
+  "com_ui_mcp_server_role_viewer": "MCP Sunucusu İzleyici",
+  "com_ui_mcp_server_role_viewer_desc": "MCP sunucularını görüntüleyebilir ve kullanabilir",
+  "com_ui_mcp_server_updated": "MCP sunucusu başarıyla güncellendi",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
+  "com_ui_mcp_servers": "MCP Sunucuları",
+  "com_ui_mcp_servers_allow_create": "Kullanıcıların MCP sunucuları oluşturmasına izin ver",
+  "com_ui_mcp_servers_allow_share": "Kullanıcıların MCP sunucularını paylaşmasına izin ver",
+  "com_ui_mcp_servers_allow_share_public": "Kullanıcıların MCP sunucularını herkese açık paylaşmasına izin ver",
+  "com_ui_mcp_servers_allow_use": "Kullanıcıların MCP sunucularını kullanmasına izin ver",
+  "com_ui_mcp_title_invalid": "Başlık yalnızca harf, rakam ve boşluk içerebilir",
+  "com_ui_mcp_tool_options": "Araç Seçenekleri",
+  "com_ui_mcp_transport": "Taşıma (Transport)",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "Streamable HTTPS",
+  "com_ui_mcp_undefer": "Ertelemeyi Geri Al",
+  "com_ui_mcp_undefer_all": "Tüm araçların ertelenmesini geri al",
+  "com_ui_mcp_unprogrammatic_all": "Tümünün programatik işaretini kaldır",
+  "com_ui_mcp_update_var": "{{0}} Güncelle",
+  "com_ui_mcp_url": "MCP Sunucu URL'si",
+  "com_ui_medium": "Orta",
+  "com_ui_memory_key_hint": "Yalnızca küçük harfler ve alt çizgi kullanın",
   "com_ui_mention": "Bir uç nokta, asistan veya hazır ayar anın, hızlıca ona geçmek için",
+  "com_ui_mermaid": "mermaid",
+  "com_ui_mermaid_failed": "Diyagram çizilemedi:",
+  "com_ui_mermaid_source": "Kaynak kod:",
+  "com_ui_message_input": "Mesaj girdisi",
+  "com_ui_microphone_unavailable": "Mikrofon kullanılamıyor",
   "com_ui_min_tags": "Daha fazla değer kaldırılamaz, en az {{0}} gereklidir.",
+  "com_ui_minimal": "Minimal",
+  "com_ui_misc": "Çeşitli (Misc.)",
   "com_ui_model": "Model",
   "com_ui_model_parameters": "Model Parametreleri",
+  "com_ui_model_parameters_reset": "Model Parametreleri sıfırlandı.",
+  "com_ui_model_selected": "{{0}} seçildi",
   "com_ui_more_info": "Daha fazla bilgi",
   "com_ui_my_prompts": "İstemlerim",
   "com_ui_name": "Ad",
+  "com_ui_name_sort": "Ada Göre Sırala",
+  "com_ui_navigate_results": "Sonuçlarda gezin",
+  "com_ui_new": "Yeni",
   "com_ui_new_chat": "Yeni sohbet",
+  "com_ui_new_conversation_title": "Yeni Konuşma Başlığı",
   "com_ui_next": "Sonraki",
+  "com_ui_next_result": "Sonraki sonuç",
   "com_ui_no": "Hayır",
+  "com_ui_no_auth": "Yok (Otomatik algıla)",
   "com_ui_no_bookmarks": "henüz yer iminiz yok gibi görünüyor. Bir sohbete tıklayın ve yeni bir tane ekleyin",
+  "com_ui_no_bookmarks_match": "Aramanızla eşleşen yer imi yok",
+  "com_ui_no_bookmarks_title": "Henüz yer imi yok",
+  "com_ui_no_categories": "Mevcut kategori yok",
   "com_ui_no_category": "Kategori yok",
+  "com_ui_no_changes": "Herhangi bir değişiklik yapılmadı",
+  "com_ui_no_individual_access": "Bu ajana erişimi olan hiçbir bireysel kullanıcı veya grup yok",
+  "com_ui_no_labels": "Etiket Yok",
+  "com_ui_no_mcp_servers": "Henüz MCP sunucusu yok",
+  "com_ui_no_mcp_servers_match": "Filtrenizle eşleşen MCP sunucusu yok",
+  "com_ui_no_prompts_title": "Henüz istem yok",
+  "com_ui_no_results_found": "Sonuç bulunamadı",
   "com_ui_no_terms_content": "Şartlar ve koşullar için içerik bulunmuyor",
+  "com_ui_none": "Hiçbiri",
+  "com_ui_not_used": "Kullanılmadı",
   "com_ui_nothing_found": "Hiçbir şey bulunamadı",
-  "com_ui_of": "-den",
+  "com_ui_oauth": "OAuth",
+  "com_ui_oauth_connected_to": "Şuraya bağlı:",
+  "com_ui_oauth_error_callback_failed": "Kimlik doğrulama geri dönüşü (callback) başarısız oldu. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_generic": "Kimlik doğrulama başarısız oldu. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_invalid_state": "Geçersiz durum (state) parametresi. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_missing_code": "Yetkilendirme kodu (authorization code) eksik. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_missing_state": "Durum (state) parametresi eksik. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_title": "Kimlik Doğrulama Başarısız",
+  "com_ui_oauth_success_description": "Kimlik doğrulamanız başarılı oldu. Bu pencere kapanacaktır:",
+  "com_ui_oauth_success_title": "Kimlik Doğrulama Başarılı",
+  "com_ui_of": " / ",
   "com_ui_off": "Kapalı",
+  "com_ui_offline": "Çevrimdışı",
   "com_ui_on": "Açık",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (yeni sekmede açılır)",
+  "com_ui_open_source_chat_new_tab": "Kaynak Sohbeti Yeni Sekmede Aç",
+  "com_ui_open_source_chat_new_tab_title": "Kaynak Sohbeti Yeni Sekmede Aç - {{title}}",
+  "com_ui_open_var": "{{0}} Aç",
+  "com_ui_openai": "OpenAI",
+  "com_ui_optional": "(isteğe bağlı)",
+  "com_ui_options": "seçenekler",
+  "com_ui_output": "Çıktı",
   "com_ui_page": "Sayfa",
+  "com_ui_pagination": "Sayfalandırma",
+  "com_ui_parameters": "Parametreler",
+  "com_ui_people": "kişiler",
+  "com_ui_people_picker": "Kişi Seçici",
+  "com_ui_people_picker_allow_view_groups": "Grupları görüntülemeye izin ver",
+  "com_ui_people_picker_allow_view_roles": "Rolleri görüntülemeye izin ver",
+  "com_ui_people_picker_allow_view_users": "Kullanıcıları görüntülemeye izin ver",
+  "com_ui_permissions_failed_load": "İzinler yüklenemedi. Lütfen tekrar deneyin.",
+  "com_ui_permissions_failed_update": "İzinler güncellenemedi. Lütfen tekrar deneyin.",
+  "com_ui_permissions_updated_success": "İzinler başarıyla güncellendi",
+  "com_ui_pin": "Sabitle",
+  "com_ui_preferences_updated": "Tercihler başarıyla güncellendi",
   "com_ui_prev": "Önceki",
+  "com_ui_prev_result": "Önceki sonuç",
   "com_ui_preview": "Önizleme",
+  "com_ui_preview_unavailable": "Bu dosya türü için önizleme kullanılamıyor",
   "com_ui_privacy_policy": "Gizlilik Politikası",
   "com_ui_privacy_policy_url": "Gizlilik Politikası URL'si",
+  "com_ui_production": "Üretim (Production)",
   "com_ui_prompt": "İstem",
+  "com_ui_prompt_category_selector_aria": "İstem kategori seçici",
+  "com_ui_prompt_delete_confirm": "'{{0}}' istemini silmek istediğinizden emin misiniz?",
+  "com_ui_prompt_deleted_group": "\"{{0}}\" istem grubu silindi",
+  "com_ui_prompt_details": "{{name}} istemi detayları",
+  "com_ui_prompt_group_button": "{{name}} istemi, {{category}} kategorisi",
+  "com_ui_prompt_group_button_no_category": "{{name}} istemi",
+  "com_ui_prompt_groups": "İstem Grupları Listesi",
+  "com_ui_prompt_input": "İstem girdisi",
+  "com_ui_prompt_input_field": "İstem metin giriş alanı",
   "com_ui_prompt_name": "İstem Adı",
-  "com_ui_prompt_name_required": "İstem Adı gerekli",
+  "com_ui_prompt_name_required": "İstem Adı gereklidir",
   "com_ui_prompt_preview_not_shared": "Yazar bu istem için işbirliğine izin vermemiş.",
   "com_ui_prompt_text": "Metin",
-  "com_ui_prompt_text_required": "Metin gerekli",
+  "com_ui_prompt_text_required": "Metin gereklidir",
   "com_ui_prompt_update_error": "İstem güncellenirken bir hata oluştu",
+  "com_ui_prompt_variables_list": "İstem değişkenleri listesi",
   "com_ui_prompts": "İstemler",
   "com_ui_prompts_allow_create": "İstem oluşturmaya izin ver",
+  "com_ui_prompts_allow_share": "İstem paylaşımına izin ver",
+  "com_ui_prompts_allow_share_public": "İstemleri herkese açık paylaşmaya izin ver",
   "com_ui_prompts_allow_use": "İstem kullanımına izin ver",
   "com_ui_provider": "Sağlayıcı",
+  "com_ui_quality": "Kalite",
   "com_ui_read_aloud": "Sesli oku",
+  "com_ui_redirect_uri": "Yönlendirme (Redirect) URI'si",
+  "com_ui_redirect_uri_instructions": "Bu yönlendirme URI'sini kopyalayın ve OAuth sağlayıcı ayarlarınızda yapılandırın.",
+  "com_ui_redirecting_to_provider": "{{0}}'a yönlendiriliyor, lütfen bekleyin...",
+  "com_ui_refresh": "Yenile",
   "com_ui_refresh_link": "Bağlantıyı yenile",
+  "com_ui_refresh_page": "Sayfayı yenile",
   "com_ui_regenerate": "Yeniden Oluştur",
+  "com_ui_regenerate_backup": "Yedek Kodları Yeniden Oluştur",
+  "com_ui_regenerating": "Yeniden Oluşturuluyor...",
   "com_ui_region": "Bölge",
+  "com_ui_reinitialize": "Yeniden Başlat",
+  "com_ui_relevance": "İlgi",
+  "com_ui_remote_access": "Uzaktan Erişim",
+  "com_ui_remote_agent_role_editor": "Düzenleyici",
+  "com_ui_remote_agent_role_editor_desc": "Ajanı API üzerinden görüntüleyebilir ve değiştirebilir",
+  "com_ui_remote_agent_role_owner": "API Sahibi",
+  "com_ui_remote_agent_role_owner_desc": "Tam API erişimi ve başkalarına uzaktan erişim verebilir",
+  "com_ui_remote_agent_role_viewer": "API İzleyici",
+  "com_ui_remote_agent_role_viewer_desc": "Ajanı API üzerinden sorgulayabilir",
+  "com_ui_remote_agents": "Uzaktan Ajanlar (API)",
+  "com_ui_remote_agents_allow_create": "Kullanıcıların API üzerinden ajan oluşturmasına izin ver",
+  "com_ui_remote_agents_allow_share": "Kullanıcıların ajanlara API erişimi vermesine izin ver",
+  "com_ui_remote_agents_allow_share_public": "Kullanıcıların tüm kullanıcılara ajanlar için API erişimi vermesine izin ver",
+  "com_ui_remote_agents_allow_use": "Kullanıcıların API anahtarları oluşturmasına ve ajanları uzaktan sorgulamasına izin ver",
+  "com_ui_remove_agent_from_chain": "{{0}} ajanını zincirden çıkar",
+  "com_ui_remove_user": "{{0}} kaldır",
   "com_ui_rename": "Yeniden adlandır",
-  "com_ui_reset_var": "{{0}} sıfırla",
+  "com_ui_rename_conversation": "Konuşmayı Yeniden Adlandır",
+  "com_ui_rename_failed": "Konuşma yeniden adlandırılamadı",
+  "com_ui_requires_auth": "Kimlik Doğrulaması Gerektirir",
+  "com_ui_reset": "Sıfırla",
+  "com_ui_reset_adjustments": "Ayarlamaları sıfırla",
+  "com_ui_reset_var": "{{0}} Sıfırla",
+  "com_ui_reset_zoom": "Yakınlaştırmayı Sıfırla",
+  "com_ui_resource": "kaynak",
+  "com_ui_response": "Yanıt",
   "com_ui_result": "Sonuç",
-  "com_ui_revoke": "Geri Al",
+  "com_ui_result_found": "{{count}} sonuç bulundu",
+  "com_ui_results_found": "{{count}} sonuç bulundu",
+  "com_ui_retrieved_files": "Dosyalarınızda arandı",
+  "com_ui_retry": "Tekrar dene",
+  "com_ui_revoke": "İptal Et / Geri Al",
   "com_ui_revoke_info": "Kullanıcı tarafından sağlanan tüm kimlik bilgilerini geri al",
   "com_ui_revoke_key_confirm": "Bu anahtarı iptal etmek istediğinizden emin misiniz?",
   "com_ui_revoke_key_endpoint": "{{0}} için Anahtarı İptal Et",
+  "com_ui_revoke_key_error": "API anahtarı iptal edilemedi. Lütfen tekrar deneyin.",
+  "com_ui_revoke_key_success": "API anahtarı başarıyla iptal edildi",
   "com_ui_revoke_keys": "Anahtarları İptal Et",
   "com_ui_revoke_keys_confirm": "Tüm anahtarları iptal etmek istediğinizden emin misiniz?",
+  "com_ui_role": "Rol",
+  "com_ui_role_editor": "Düzenleyici",
+  "com_ui_role_editor_desc": "Ajanı görüntüleyebilir ve değiştirebilir",
+  "com_ui_role_manager": "Yönetici",
+  "com_ui_role_manager_desc": "Ajanı görüntüleyebilir, değiştirebilir ve silebilir",
+  "com_ui_role_owner": "Sahip",
+  "com_ui_role_owner_desc": "Ajanı paylaşmak da dahil olmak üzere üzerinde tam kontrole sahiptir",
   "com_ui_role_select": "Rol",
+  "com_ui_role_viewer": "İzleyici",
+  "com_ui_role_viewer_desc": "Ajanı görüntüleyebilir ve kullanabilir ancak değiştiremez",
+  "com_ui_roleplay": "Rol Yapma (Roleplay)",
+  "com_ui_rotate": "Döndür",
+  "com_ui_rotate_90": "90 derece döndür",
   "com_ui_run_code": "Kodu Çalıştır",
   "com_ui_run_code_error": "Kod çalıştırılırken bir hata oluştu",
+  "com_ui_running": "Çalışıyor...",
   "com_ui_save": "Kaydet",
+  "com_ui_save_badge_changes": "Rozet değişiklikleri kaydedilsin mi?",
+  "com_ui_save_changes": "Değişiklikleri Kaydet",
+  "com_ui_save_key_error": "API anahtarı kaydedilemedi. Lütfen tekrar deneyin.",
+  "com_ui_save_key_success": "API anahtarı başarıyla kaydedildi",
   "com_ui_save_submit": "Kaydet ve Gönder",
   "com_ui_saved": "Kaydedildi!",
+  "com_ui_saving": "Kaydediliyor...",
   "com_ui_schema": "Şema",
+  "com_ui_scope": "Kapsam (Scope)",
   "com_ui_search": "Ara",
+  "com_ui_search_above_to_add": "Kullanıcı veya grup eklemek için yukarıda arayın",
+  "com_ui_search_above_to_add_all": "Kullanıcı, grup veya rol eklemek için yukarıda arayın",
+  "com_ui_search_above_to_add_people": "Kişi eklemek için yukarıda arayın",
+  "com_ui_search_agent_category": "Kategorilerde ara...",
+  "com_ui_search_default_placeholder": "Ada veya e-postaya göre ara (min 2 karakter)",
+  "com_ui_search_people_placeholder": "Kişileri veya grupları ada veya e-postaya göre arayın",
+  "com_ui_search_result_count": "{{count}} sonuç bulundu",
+  "com_ui_search_results_count": "{{count}} sonuç bulundu",
+  "com_ui_searching_files": "Dosyalarınız aranıyor",
+  "com_ui_seconds": "saniye",
+  "com_ui_secret_key": "Gizli Anahtar (Secret Key)",
   "com_ui_select": "Seç",
+  "com_ui_select_agent": "Ajan Seç",
+  "com_ui_select_all": "Tümünü Seç",
   "com_ui_select_file": "Bir dosya seç",
   "com_ui_select_model": "Bir model seçin",
+  "com_ui_select_options": "Seçenekleri belirleyin...",
+  "com_ui_select_or_create_prompt": "Bir İstem Seçin veya Oluşturun",
   "com_ui_select_provider": "Bir sağlayıcı seç",
   "com_ui_select_provider_first": "Önce bir sağlayıcı seçin",
   "com_ui_select_region": "Bir bölge seç",
+  "com_ui_select_row": "Satırı seç",
   "com_ui_select_search_model": "Adına göre model ara",
   "com_ui_select_search_provider": "Sağlayıcıyı ada göre ara",
   "com_ui_select_search_region": "Bölgeyi ada göre ara",
+  "com_ui_set": "Ayarla",
   "com_ui_share": "Paylaş",
   "com_ui_share_create_message": "Adınız ve paylaşım sonrasında eklediğiniz mesajlar gizli kalır.",
   "com_ui_share_delete_error": "Paylaşılan bağlantı silinirken bir hata oluştu",
   "com_ui_share_error": "Sohbet bağlantısını paylaşırken bir hata oluştu",
+  "com_ui_share_everyone": "Herkesle paylaş",
+  "com_ui_share_everyone_description_var": "Bu {{resource}} herkese açık olacaktır. Lütfen bu {{resource}} kaynağının gerçekten herkesle paylaşılması gerektiğinden emin olun. Verilerinize dikkat edin.",
   "com_ui_share_link_to_chat": "Sohbete bağlantı paylaş",
+  "com_ui_share_qr_code_description": "Bu konuşma bağlantısını paylaşmak için QR kodu",
   "com_ui_share_update_message": "Adınız, özel talimatlarınız ve paylaşım sonrasında eklediğiniz mesajlar gizli kalır.",
   "com_ui_share_var": "{{0}} paylaş",
   "com_ui_shared_link_delete_success": "Paylaşılan bağlantı başarıyla silindi",
   "com_ui_shared_link_not_found": "Paylaşılan bağlantı bulunamadı",
   "com_ui_shared_prompts": "Paylaşılan İstemler",
+  "com_ui_shop": "Alışveriş",
+  "com_ui_show": "Göster",
   "com_ui_show_all": "Tümünü Göster",
+  "com_ui_show_code": "Kodu Göster",
+  "com_ui_show_image_details": "Resim Detaylarını Göster",
+  "com_ui_show_less": "Daha az göster",
+  "com_ui_show_more": "Daha fazla göster",
   "com_ui_show_qr": "QR Kodunu Göster",
-  "com_ui_simple": "Basit",
+  "com_ui_sign_in_to_domain": "{{0}} alan adına giriş yap",
   "com_ui_size": "Boyut",
-  "com_ui_special_variables": "Özel değişkenler:",
+  "com_ui_size_sort": "Boyuta Göre Sırala",
+  "com_ui_special": "özel",
+  "com_ui_special_var_current_date": "Geçerli Tarih",
+  "com_ui_special_var_current_datetime": "Geçerli Tarih ve Saat",
+  "com_ui_special_var_current_user": "Mevcut Kullanıcı",
+  "com_ui_special_var_desc_current_date": "Bugünün tarihi ve haftanın günü",
+  "com_ui_special_var_desc_current_datetime": "Saat diliminizdeki yerel tarih ve saat",
+  "com_ui_special_var_desc_current_user": "Hesap görünen adınız",
+  "com_ui_special_var_desc_iso_datetime": "ISO 8601 formatında UTC tarih ve saat",
+  "com_ui_special_var_iso_datetime": "UTC ISO Tarih/Saat",
+  "com_ui_special_variable_added": "{{0}} özel değişkeni eklendi.",
+  "com_ui_special_variables": "Özel değişkenler",
+  "com_ui_speech_not_supported": "Tarayıcınız konuşma tanımayı desteklemiyor",
+  "com_ui_speech_not_supported_use_external": "Tarayıcınız konuşma tanımayı desteklemiyor. Ayarlar > Konuşma bölümünden Harici STT'ye geçmeyi deneyin.",
   "com_ui_speech_while_submitting": "Bir yanıt oluşturulurken konuşma gönderilemez",
+  "com_ui_sr_global_prompt": "Genel istem grubu",
+  "com_ui_stack_trace": "Yığın İzleme (Stack Trace)",
+  "com_ui_status_prefix": "Durum:",
   "com_ui_stop": "Durdur",
   "com_ui_storage": "Depolama",
+  "com_ui_storage_filter_sort": "Depolamaya Göre Filtrele ve Sırala",
   "com_ui_submit": "Gönder",
-  "com_ui_terms_and_conditions": "Şartlar ve koşullar",
+  "com_ui_summarizing": "Özetleniyor...",
+  "com_ui_support_contact": "Destek İletişim",
+  "com_ui_support_contact_email": "E-posta",
+  "com_ui_support_contact_email_invalid": "Lütfen geçerli bir e-posta adresi girin",
+  "com_ui_support_contact_email_placeholder": "destek@ornek.com",
+  "com_ui_support_contact_name": "Ad",
+  "com_ui_support_contact_name_min_length": "Ad en az {{minLength}} karakter olmalıdır",
+  "com_ui_support_contact_name_placeholder": "Destek iletişim adı",
+  "com_ui_teach_or_explain": "Öğrenme",
+  "com_ui_temporary": "Geçici Sohbet",
+  "com_ui_terms_and_conditions": "Şartlar ve Koşullar",
   "com_ui_terms_of_service": "Hizmet Şartları",
+  "com_ui_text_variables": "Metin değişkenleri",
   "com_ui_thinking": "Düşünüyor...",
   "com_ui_thoughts": "Düşünceler",
+  "com_ui_toggle_theme": "Temayı Değiştir",
+  "com_ui_token": "token",
+  "com_ui_token_exchange_method": "Token Değişim Yöntemi",
+  "com_ui_token_url": "Token URL'si",
+  "com_ui_tokens": "tokenler",
+  "com_ui_tool_collection_prefix": "Şuradan araç koleksiyonu:",
+  "com_ui_tool_failed": "başarısız oldu",
+  "com_ui_tool_list_collapse": "{{serverName}} araç listesini daralt",
+  "com_ui_tool_list_expand": "{{serverName}} araç listesini genişlet",
+  "com_ui_tool_name_code": "Kod",
+  "com_ui_tool_name_code_analysis": "Kod Analizi",
+  "com_ui_tool_name_file_search": "Dosya Arama",
+  "com_ui_tool_name_image_edit": "Resim Düzenleme",
+  "com_ui_tool_name_image_gen": "Resim Oluşturma",
+  "com_ui_tool_name_web_search": "Web Arama",
   "com_ui_tools": "Araçlar",
+  "com_ui_tools_and_actions": "Araçlar ve Eylemler",
+  "com_ui_transferred_to": "Şuraya aktarıldı:",
+  "com_ui_travel": "Seyahat",
+  "com_ui_trust_app": "Bu uygulamaya güveniyorum",
+  "com_ui_try_adjusting_search": "Arama terimlerinizi ayarlamayı deneyin",
+  "com_ui_ui_resource_error": "Arayüz Kaynak Hatası ({{0}})",
+  "com_ui_ui_resource_not_found": "Arayüz Kaynağı bulunamadı (indeks: {{0}})",
   "com_ui_unarchive": "Arşivden çıkar",
+  "com_ui_unarchive_conversation": "Konuşmayı arşivden çıkar",
   "com_ui_unarchive_error": "Konuşmayı arşivden çıkarma başarısız oldu",
+  "com_ui_unavailable": "Kullanılamıyor",
   "com_ui_unknown": "Bilinmeyen",
+  "com_ui_unpin": "Sabitlemeyi Kaldır",
+  "com_ui_unset": "Kaldır/Temizle",
+  "com_ui_untitled": "İsimsiz",
   "com_ui_update": "Güncelle",
+  "com_ui_update_mcp_server": "MCP sunucusunu güncelle",
+  "com_ui_updating": "Güncelleniyor...",
   "com_ui_upload": "Yükle",
+  "com_ui_upload_agent_avatar": "Ajan avatarı başarıyla güncellendi",
+  "com_ui_upload_agent_avatar_label": "Ajan avatar resmi yükle",
+  "com_ui_upload_avatar_label": "Avatar resmi yükle",
   "com_ui_upload_delay": "\"{{0}}\" yüklenmesi beklenenden daha uzun sürüyor. Lütfen dosyanın alma işlemini tamamlamasını bekleyin.",
   "com_ui_upload_error": "Dosyanızı yüklerken bir hata oluştu",
+  "com_ui_upload_file_context": "Dosya Bağlamı Yükle",
   "com_ui_upload_file_search": "Dosya Arama için Yükle",
   "com_ui_upload_files": "Dosyaları yükle",
+  "com_ui_upload_icon": "Simge resmi yükle",
   "com_ui_upload_image": "Bir resim yükle",
   "com_ui_upload_image_input": "Resim Yükle",
-  "com_ui_upload_invalid": "Geçersiz dosya yükleme. 2 MB'ı geçmeyen bir resim olması gerekir",
+  "com_ui_upload_invalid": "Geçersiz dosya yükleme. Sınırı aşmayan bir resim olmalıdır.",
   "com_ui_upload_invalid_var": "Yükleme için geçersiz dosya. {{0}} MB'ı aşmayan bir resim olmalı",
+  "com_ui_upload_ocr_text": "Metin olarak Yükle",
+  "com_ui_upload_provider": "Sağlayıcıya Yükle",
   "com_ui_upload_success": "Dosya başarıyla yüklendi",
   "com_ui_upload_type": "Yükleme Türünü Seç",
+  "com_ui_usage": "Kullanım",
+  "com_ui_use_2fa_code": "Bunun Yerine 2FA Kodu Kullan",
+  "com_ui_use_backup_code": "Bunun Yerine Yedek Kod Kullan",
   "com_ui_use_micrphone": "Mikrofon kullan",
+  "com_ui_use_prompt": "İstem Kullan",
+  "com_ui_used": "Kullanıldı",
+  "com_ui_used_n_tools": "{{0}} araç kullanıldı",
+  "com_ui_user": "Kullanıcı",
+  "com_ui_user_group_permissions": "Kullanıcı ve Grup İzinleri",
+  "com_ui_user_provides_key": "Her kullanıcı kendi anahtarını sağlar",
+  "com_ui_value": "Değer",
+  "com_ui_variable_with_options": "{{count}} seçenekli {{name}} değişkeni",
   "com_ui_variables": "Değişkenler",
+  "com_ui_verify": "Doğrula",
   "com_ui_version_var": "Sürüm {{0}}",
   "com_ui_versions": "Sürümler",
+  "com_ui_via_server": "{{0}} içinde",
+  "com_ui_web_search": "Web Arama",
+  "com_ui_web_search_cohere_key": "Cohere API Anahtarını Girin",
+  "com_ui_web_search_firecrawl_url": "Firecrawl API URL'si (isteğe bağlı)",
+  "com_ui_web_search_jina_key": "Jina API Anahtarını Girin",
+  "com_ui_web_search_jina_url": "Jina API URL'si (isteğe bağlı)",
+  "com_ui_web_search_processing": "Sonuçlar işleniyor",
+  "com_ui_web_search_provider": "Arama Sağlayıcısı",
+  "com_ui_web_search_provider_searxng": "SearXNG",
+  "com_ui_web_search_provider_serper": "Serper API",
+  "com_ui_web_search_provider_serper_key": "Serper API anahtarınızı alın",
+  "com_ui_web_search_reading": "Sonuçlar okunuyor",
+  "com_ui_web_search_reranker": "Yeniden Sıralayıcı (Reranker)",
+  "com_ui_web_search_reranker_cohere": "Cohere",
+  "com_ui_web_search_reranker_cohere_key": "Cohere API anahtarınızı alın",
+  "com_ui_web_search_reranker_jina": "Jina AI",
+  "com_ui_web_search_reranker_jina_key": "Jina API anahtarınızı alın",
+  "com_ui_web_search_reranker_jina_url_help": "Jina Rerank API hakkında bilgi edinin",
+  "com_ui_web_search_scraper": "Kazıyıcı (Scraper)",
+  "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
+  "com_ui_web_search_scraper_firecrawl_key": "Firecrawl API anahtarınızı alın",
+  "com_ui_web_search_scraper_serper": "Serper Scrape API",
+  "com_ui_web_search_scraper_serper_key": "Serper API anahtarınızı alın",
+  "com_ui_web_search_searxng_api_key": "SearXNG API Anahtarını Girin (isteğe bağlı)",
+  "com_ui_web_search_searxng_instance_url": "SearXNG Sunucu (Instance) URL'si",
+  "com_ui_web_search_source": "{{count}} kaynak",
+  "com_ui_web_search_sources": "{{count}} kaynak",
+  "com_ui_web_searched": "Web'de arandı",
+  "com_ui_web_searching": "Web'de aranıyor",
+  "com_ui_web_searching_again": "Web'de tekrar aranıyor",
+  "com_ui_weekend_morning": "İyi hafta sonları",
+  "com_ui_write": "Yazma",
+  "com_ui_x_selected": "{{0}} seçildi",
+  "com_ui_xhigh": "Ekstra Yüksek",
   "com_ui_yes": "Evet",
+  "com_ui_your_api_key": "API Anahtarınız",
   "com_ui_zoom": "Yakınlaştır",
-  "com_user_message": "Sen"
+  "com_ui_zoom_in": "Yakınlaş",
+  "com_ui_zoom_level": "Yakınlaştırma seviyesi",
+  "com_ui_zoom_out": "Uzaklaş",
+  "com_user_message": "Siz"
 }
diff --git a/client/src/locales/uk/translation.json b/client/src/locales/uk/translation.json
index 9092543b122..8c60e4702c8 100644
--- a/client/src/locales/uk/translation.json
+++ b/client/src/locales/uk/translation.json
@@ -410,15 +410,12 @@
   "com_nav_browser": "Браузер",
   "com_nav_center_chat_input": "Центрувати поле введення чату на екрані привітання",
   "com_nav_change_picture": "Змінити зображення",
-  "com_nav_chat_commands": "Команди чату",
-  "com_nav_chat_commands_info": "Ці команди активуються при введенні певних символів на початку вашого повідомлення. Кожна команда запускається своїм префіксом. Ви можете вимкнути їх, якщо часто використовуєте ці символи для початку повідомлень.",
   "com_nav_chat_direction": "Напрямок чату",
   "com_nav_clear_all_chats": "Видалити всі чати",
   "com_nav_clear_cache_confirm_message": "Ви впевнені, що хочете очистити кеш?\n\nЦе призведе до виходу з системи, видалення локальних даних та оновлення сторінки.",
   "com_nav_clear_conversation": "Видалити чати",
   "com_nav_clear_conversation_confirm_message": "Ви впевнені, що хочете видалити всі чати? Цю дію не можна скасувати.",
   "com_nav_close_sidebar": "Закрити бічну панель",
-  "com_nav_commands": "Команди",
   "com_nav_confirm_clear": "Підтвердити видалення",
   "com_nav_conversation_mode": "Режим діалогу",
   "com_nav_convo_menu_options": "Параметри діалогу",
@@ -526,12 +523,9 @@
   "com_nav_search_placeholder": "Пошук повідомлень",
   "com_nav_send_message": "Надіслати повідомлення",
   "com_nav_setting_account": "Обліковий запис",
-  "com_nav_setting_balance": "Баланс",
   "com_nav_setting_chat": "Чат",
-  "com_nav_setting_data": "Керування даними",
   "com_nav_setting_general": "Загальні",
   "com_nav_setting_mcp": "Налаштування MCP",
-  "com_nav_setting_personalization": "Персоналізація",
   "com_nav_setting_speech": "Голос",
   "com_nav_settings": "Налаштування",
   "com_nav_shared_links": "Пов'язані посилання",
@@ -890,7 +884,6 @@
   "com_ui_group": "Група",
   "com_ui_happy_birthday": "Це мій перший день народження!",
   "com_ui_hide_image_details": "Приховати деталі зображення",
-  "com_ui_hide_password": "Приховати пароль",
   "com_ui_hide_qr": "Приховати QR-код",
   "com_ui_high": "Високий",
   "com_ui_host": "Хост",
@@ -972,7 +965,6 @@
   "com_ui_no_category": "Без категорії",
   "com_ui_no_changes": "Зміни не були внесені",
   "com_ui_no_individual_access": "Жоден користувач або група не має доступу до цього агента",
-  "com_ui_no_personalization_available": "Наразі немає доступних опцій персоналізації",
   "com_ui_no_read_access": "У вас немає дозволу на перегляд спогадів",
   "com_ui_no_results_found": "Нічого не знайдено",
   "com_ui_no_terms_content": "Немає змісту умов використання для відображення",
@@ -1106,10 +1098,8 @@
   "com_ui_shop": "Купити",
   "com_ui_show_all": "Показати все",
   "com_ui_show_image_details": "Показати деталі зображення",
-  "com_ui_show_password": "Показати пароль",
   "com_ui_show_qr": "Показати QR-код",
   "com_ui_sign_in_to_domain": "Увійти до {{0}}",
-  "com_ui_simple": "Простий",
   "com_ui_size": "Розмір",
   "com_ui_special_var_current_date": "Поточна дата",
   "com_ui_special_var_current_datetime": "Поточні дата та час",
diff --git a/client/src/locales/vi/translation.json b/client/src/locales/vi/translation.json
index 749f33e28fc..466291cf541 100644
--- a/client/src/locales/vi/translation.json
+++ b/client/src/locales/vi/translation.json
@@ -189,13 +189,11 @@
   "com_nav_browser": "Trình duyệt",
   "com_nav_center_chat_input": "Trung tâm trò chuyện đầu vào tại Màn hình Chào mừng",
   "com_nav_change_picture": "Thay đổi hình ảnh",
-  "com_nav_chat_commands_info": "Các lệnh này được kích hoạt bằng cách nhập các ký tự cụ thể vào đầu tin nhắn của bạn. Mỗi lệnh được kích hoạt bằng tiền tố được chỉ định của nó. Bạn có thể tắt chúng nếu bạn thường xuyên sử dụng các ký tự này để bắt đầu tin nhắn.",
   "com_nav_chat_direction": "Hướng trò chuyện",
   "com_nav_clear_all_chats": "Xóa tất cả cuộc trò chuyện",
   "com_nav_clear_conversation": "Xóa cuộc trò chuyện",
   "com_nav_clear_conversation_confirm_message": "Bạn có chắc chắn muốn xóa tất cả cuộc trò chuyện? Hành động này không thể hoàn tác.",
   "com_nav_close_sidebar": "Đóng thanh bên",
-  "com_nav_commands": "Lệnh",
   "com_nav_confirm_clear": "Xác nhận xóa",
   "com_nav_conversation_mode": "Chế độ hội thoại",
   "com_nav_convo_menu_options": "Tùy chọn Menu hội thoại",
@@ -257,7 +255,6 @@
   "com_nav_search_placeholder": "Tìm kiếm tin nhắn",
   "com_nav_send_message": "Gửi tin nhắn",
   "com_nav_setting_chat": "Trò chuyện",
-  "com_nav_setting_data": "Kiểm soát dữ liệu",
   "com_nav_setting_general": "Chung",
   "com_nav_settings": "Cài đặt",
   "com_nav_shared_links": "Liên kết được chia sẻ",
@@ -390,7 +387,6 @@
   "com_ui_show_all": "Hiển thị tất cả",
   "com_ui_show_image_details": "Hiển thị chi tiết hình ảnh",
   "com_ui_show_qr": "Hiển thị mã QR",
-  "com_ui_simple": "Đơn giản",
   "com_ui_submit": "Gửi",
   "com_ui_terms_and_conditions": "Điều khoản và điều kiện",
   "com_ui_unarchive": "Bỏ lưu trữ",
diff --git a/client/src/locales/zh-Hans/translation.json b/client/src/locales/zh-Hans/translation.json
index 2d235687fb8..3efb27a28ab 100644
--- a/client/src/locales/zh-Hans/translation.json
+++ b/client/src/locales/zh-Hans/translation.json
@@ -7,6 +7,7 @@
   "com_a11y_selected": "已选中",
   "com_a11y_start": "AI 已开始回复。",
   "com_a11y_summarize_completed": "上下文已总结。",
+  "com_a11y_summarize_failed": "摘要生成失败，将继续使用现有上下文。",
   "com_a11y_summarize_started": "正在总结上下文。",
   "com_agents_agent_card_label": "智能体 {{name}}：{{description}}",
   "com_agents_all": "全部智能体",
@@ -34,7 +35,7 @@
   "com_agents_clear_search": "清除搜索",
   "com_agents_contact": "联系",
   "com_agents_copy_link": "复制链接",
-  "com_agents_create_error": "更新智能体时出现错误。",
+  "com_agents_create_error": "创建智能体时出现错误。",
   "com_agents_created_by": "来自",
   "com_agents_description_card": "描述：{{description}}",
   "com_agents_description_placeholder": "可选：在此描述您的智能体",
@@ -89,6 +90,8 @@
   "com_agents_not_available": "智能体不可用",
   "com_agents_recommended": "我们推荐的智能体",
   "com_agents_results_for": "'{{query}}' 的结果",
+  "com_agents_run_code_files": "以下文件仅供代码环境使用：",
+  "com_agents_run_code_info": "启用后，允许您的智能体安全地运行生成的代码，包括文件处理。",
   "com_agents_search_aria": "搜索智能体",
   "com_agents_search_empty_heading": "无搜索结果",
   "com_agents_search_info": "启用后，允许您的智能体搜索网络以获取最新信息。需要有效的 API 密钥。",
@@ -142,7 +145,7 @@
   "com_assistants_update_actions_success": "已成功创建或更新操作",
   "com_assistants_update_error": "更新助手时出现错误。",
   "com_assistants_update_success": "更新成功",
-  "com_assistants_update_success_name": "成功上传{{name}}",
+  "com_assistants_update_success_name": "成功更新{{name}}",
   "com_auth_already_have_account": "已有账户？",
   "com_auth_apple_login": "使用 Apple 账户登录",
   "com_auth_back_to_login": "返回登录",
@@ -225,12 +228,19 @@
   "com_endpoint_anthropic_temp": "值介于 0 到 1 之间。对于分析性/选择性任务，值应更接近 0；对于创造性和生成性任务，值应更接近 1。我们建议更改该参数或 Top P，但不要同时更改这两个参数。",
   "com_endpoint_anthropic_thinking": "为支持的 Claude 模型启用内部推理。对于较新的模型（Opus 4.6 及以上版本），使用由“思考程度 (Effort)”参数控制的自适应思考。对于旧版模型，则需要设置“思考预算 (Thinking Budget)”，且该数值必须低于“最大输出 Token 数 (Max Output Tokens)”",
   "com_endpoint_anthropic_thinking_budget": "决定 Claude 内部推理过程允许使用的最大词元数。尽管 Claude 可能不会使用分配的全部预算，尤其是在超过 32K 的范围内，但较大的预算可以对复杂问题进行更深入的分析，从而提高响应质量。此设置必须小于 \"最大输出词元数\"。",
+  "com_endpoint_anthropic_thinking_display": "思维可见性",
+  "com_endpoint_anthropic_thinking_display_desc": "控制是否返回 Claude 的推理过程。'Auto'（自动）模式下，对于默认隐藏推理过程的模型（如 Opus 4.7 及更高版本），将启用并返回摘要化的思考过程；'Summarized'（摘要）模式始终显示推理过程；'Omitted'（省略）模式始终隐藏推理过程，以实现略微更低的延迟。",
   "com_endpoint_anthropic_topk": "top-k 会改变模型选择输出词元的方式。top-k 为 1 意味着所选词是模型词汇中概率最大的（也称为贪心解码），而 top-k 为 3 意味着下一个词是从 3 个概率最大的词中选出的（使用随机性）。",
   "com_endpoint_anthropic_topp": "top-p（核采样）会改变模型选择输出词元的方式。从概率最大的 K（参见 topK 参数）向最小的 K 选择，直到它们的概率之和等于 top-p 值。",
   "com_endpoint_anthropic_use_web_search": "使用 Anthropic 内置的搜索能力启用网络搜索功能。这使得模型能够搜索网络上的最新信息，提供更准确、更及时的响应。",
   "com_endpoint_assistant": "助手",
   "com_endpoint_assistant_model": "助手模型",
   "com_endpoint_assistant_placeholder": "请从右侧面板中选择助手",
+  "com_endpoint_bedrock_reasoning_effort": "控制受支持的 Bedrock 模型（例如 Kimi K2.5、GLM）的推理级别。较高的级别能够生成更为详尽的推理结果，但代价是会增加延迟和 词元（Token） 消耗。",
+  "com_endpoint_config_bedrock_access_key_id": "AWS 访问密钥 ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API 密钥",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS 秘密访问密钥",
+  "com_endpoint_config_bedrock_session_token": "AWS 会话令牌",
   "com_endpoint_config_click_here": "点击此处",
   "com_endpoint_config_google_api_info": "获取您的生成式语言 API 密钥（Gemini），",
   "com_endpoint_config_google_api_key": "Google API Key",
@@ -251,6 +261,7 @@
   "com_endpoint_config_key_name": "密钥",
   "com_endpoint_config_key_never_expires": "您的密钥将永远有效",
   "com_endpoint_config_placeholder": "在顶部菜单设置 API 密钥。",
+  "com_endpoint_config_required_fields": "以下字段为必填项：",
   "com_endpoint_config_value": "输入值：",
   "com_endpoint_context": "上下文",
   "com_endpoint_context_info": "可用于上下文的最大词元数。用于控制每个请求发送的词元数量。如果未指定，将根据已知模型的上下文大小使用系统默认值。设置较高的值可能会导致错误和/或更高的词元成本。",
@@ -261,6 +272,7 @@
   "com_endpoint_default_with_num": "默认值：{{0}}",
   "com_endpoint_disable_streaming": "禁用流式响应并一次性接收完整的响应。对于像 o3 这样需要进行组织验证才能进行流式响应的模型非常有用。",
   "com_endpoint_disable_streaming_label": "禁用流式响应",
+  "com_endpoint_effort": "投入",
   "com_endpoint_examples": " 预设",
   "com_endpoint_export": "导出",
   "com_endpoint_export_share": "导出/共享",
@@ -270,6 +282,7 @@
   "com_endpoint_google_temp": "值越高表示输出越随机，值越低表示输出越确定。建议不要同时改变此值和 Top-p。",
   "com_endpoint_google_thinking": "启用或禁用推理。此设置仅支持 Gemini 2.5及3系列。注意：Gemini 3 Pro不能完全禁用推理。",
   "com_endpoint_google_thinking_budget": "用于引导模型使用的思考 Token 数量。实际消耗量可能会根据提示词（Prompt）的不同而高于或低于此设定值。\n\n此设置仅适用于 Gemini 2.5 及更早版本的模型。对于 Gemini 3 及更高版本，请改用“思考级别 (Thinking Level)”设置。\n\nGemini 2.5 Pro 支持 128 - 32,768 个 Token；Gemini 2.5 Flash 支持 0 - 24,576 个 Token；Gemini 2.5 Flash Lite 支持 512 - 24,576 个 Token。\n\n留空或设置为“-1”可让模型自动决定何时思考以及思考多少。默认情况下，Gemini 2.5 Flash Lite 不启用思考功能。",
+  "com_endpoint_google_thinking_level": "控制谷歌Gemini 3 及后续模型的推理深度。对谷歌Gemini 2.5 及更早期的模型无效——对于谷歌这些更早期模型，请使用 Thinking Budget。\n\n保持设置为“自动”（Auto）以使用模型的默认设置。",
   "com_endpoint_google_topk": "top-k 会改变模型选择输出词元的方式。top-k 为 1 意味着所选词是模型词汇中概率最大的（也称为贪心解码），而 top-k 为 3 意味着下一个词是从 3 个概率最大的词中选出的（使用随机性）。",
   "com_endpoint_google_topp": "top-p（核采样）会改变模型选择输出词的方式。从概率最大的 K（参见 topK 参数）向最小的 K 选择，直到它们的概率之和等于 top-p 值。",
   "com_endpoint_google_use_search_grounding": "使用 Google 的基础搜索特性，通过实时网络搜索结果优化响应。这使得模型能够访问当前信息，提供更准确、更及时的答案。",
@@ -310,6 +323,7 @@
   "com_endpoint_preset_default_removed": "不再是默认预设。",
   "com_endpoint_preset_delete_confirm": "您确定要删除此预设吗？",
   "com_endpoint_preset_delete_error": "删除预设时发生错误，请重试。",
+  "com_endpoint_preset_delete_success": "预设删除成功",
   "com_endpoint_preset_import": "成功导入预设！",
   "com_endpoint_preset_import_error": "导入预设时发生错误，请重试。",
   "com_endpoint_preset_name": "预设名",
@@ -358,15 +372,18 @@
   "com_error_illegal_model_request": "模型 “{{0}}” 不可用于 {{1}}，请选择其他模型。",
   "com_error_input_length": "最新消息的令牌数过长，超出了令牌限制，或者您的令牌限制参数配置错误，对上下文窗口产生不利影响。更多信息：{{0}}。请缩短您的消息、调整对话参数中的最大上下文大小，或分叉对话以继续。",
   "com_error_invalid_agent_provider": "提供商 ”{{0}}“ 不适用于智能体。请转到智能体设置并选择当前可用的提供商。",
+  "com_error_invalid_base_url": "您提供的基准网址 URL 指向的是一个受限地址。请使用有效的外部 URL 并重试。",
   "com_error_invalid_user_key": "提供的密钥无效，请提供有效的密钥后重试。",
   "com_error_missing_model": "未选择 {{0}} 模型，请选择一个模型并重试。",
   "com_error_models_not_loaded": "无法加载模型配置，请刷新页面并重试。",
   "com_error_moderation": "很抱歉，您提交的内容被我们的审核系统标记为不符合社区指引。我们无法就此特定主题继续交流。如果您有任何其他问题或想探讨的话题，请编辑您的消息或开启新的对话。",
   "com_error_no_base_url": "未找到基础 URL，请提供一个后重试。",
   "com_error_no_user_key": "未找到密钥，请提供密钥后重试。",
+  "com_error_refusal": "响应被安全过滤器拒绝。请重写您的消息并重试。如果您在使用 Claude Sonnet 4.5 或 Opus 4.1 时频繁遇到此问题，可以尝试使用 Sonnet 4，该版本的限制规则有所不同。",
+  "com_error_stream_expired": "响应流已过期或已完成。请重试。",
   "com_file_pages": "页面：{{pages}}",
   "com_file_source": "文件",
-  "com_file_unknown": "位置文件",
+  "com_file_unknown": "未知文件",
   "com_files_download_failed": "{{0}} 个文件失败",
   "com_files_download_percent_complete": "已完成 {{0}}%",
   "com_files_download_progress": "第 {{0}} 个文件，共 {{1}} 个",
@@ -376,16 +393,26 @@
   "com_files_no_results": "无结果。",
   "com_files_number_selected": "已选择 {{0}} 个文件（共 {{1}} 个文件）",
   "com_files_preparing_download": "准备下载...",
+  "com_files_result_found": "找到 {{count}} 个结果",
   "com_files_results_found": "找到{{count}}个结果",
   "com_files_sharepoint_picker_title": "选择文件",
-  "com_files_table": "这里需要放点东西，当前是空的",
+  "com_files_table": "文件表",
   "com_files_upload_local_machine": "来自本地计算机",
   "com_files_upload_sharepoint": "来自 SharePoint",
   "com_generated_files": "生成的文件",
   "com_hide_examples": "隐藏示例",
   "com_info_heic_converting": "正在将 HEIC 图片转换为 JPEG ...",
   "com_nav_2fa": "双重身份验证（2FA）",
+  "com_nav_about_branch": "分支",
+  "com_nav_about_build_date": "已构建",
+  "com_nav_about_commit": "提交",
+  "com_nav_about_diagnostics_copied": "已复制到剪贴板",
+  "com_nav_about_diagnostics_copy": "复制诊断信息",
+  "com_nav_about_diagnostics_description": "在提交支持问题时，请复制此代码块，以便维护人员准确识别您当前运行的具体构建版本。",
+  "com_nav_about_version": "版本",
   "com_nav_account_settings": "账户设置",
+  "com_nav_advanced_prompts": "高级提示词编辑器",
+  "com_nav_advanced_prompts_desc": "启用提示词版本控制与生产控制",
   "com_nav_always_make_prod": "始终使用新版本",
   "com_nav_archive_created_at": "归档时间",
   "com_nav_archive_name": "名称",
@@ -394,8 +421,10 @@
   "com_nav_at_command_description": "切换至命令 “@” 以更改端点、模型、预设等",
   "com_nav_audio_play_error": "播放音频时发生错误：{{0}}",
   "com_nav_audio_process_error": "处理音频时发生错误：{{0}}",
+  "com_nav_auto_expand_tools": "自动展开工具详情",
   "com_nav_auto_scroll": "打开对话时自动滚动到最新消息",
-  "com_nav_auto_send_prompts": "自动发送提示词",
+  "com_nav_auto_send_prompts": "在选中时发送提示词",
+  "com_nav_auto_send_prompts_desc": "选择后自动将提示词提交到聊天",
   "com_nav_auto_send_text": "自动发送文本",
   "com_nav_auto_transcribe_audio": "自动转录音频",
   "com_nav_automatic_playback": "自动播放最新消息",
@@ -424,19 +453,19 @@
   "com_nav_browser": "浏览器",
   "com_nav_center_chat_input": "在欢迎屏幕上居中对话输入",
   "com_nav_change_picture": "修改头像",
-  "com_nav_chat_commands": "对话命令",
-  "com_nav_chat_commands_info": "这些命令通过在您的消息开头输入特定字符来激活。每个命令都由其指定的前缀触发。如果您经常在消息开头使用这些字符，可以选择禁用这些命令。",
   "com_nav_chat_direction": "对话方向",
+  "com_nav_chat_direction_selected": "聊天方向： {{direction}}",
   "com_nav_clear_all_chats": "清除所有对话",
   "com_nav_clear_cache_confirm_message": "您确定要清除缓存吗？",
   "com_nav_clear_conversation": "清除对话",
   "com_nav_clear_conversation_confirm_message": "您确定要删除所有对话吗？该操作无法撤销。",
   "com_nav_close_sidebar": "关闭侧边栏",
-  "com_nav_commands": "命令",
   "com_nav_confirm_clear": "确认清除",
+  "com_nav_control_panel": "控制面板",
   "com_nav_conversation_mode": "对话模式",
   "com_nav_convo_menu_options": "对话菜单选项",
   "com_nav_db_sensitivity": "分贝灵敏度",
+  "com_nav_default_temporary_chat": "默认临时聊天",
   "com_nav_delete_account": "删除账户",
   "com_nav_delete_account_button": "永久删除我的账户",
   "com_nav_delete_account_confirm": "删除账户 - 您确定吗？",
@@ -469,6 +498,7 @@
   "com_nav_info_code_artifacts": "启用在对话旁显示实验性代码工件",
   "com_nav_info_code_artifacts_agent": "使该智能体能够使用代码工件。默认情况下，除非启用“自定义提示词模式”，否则会添加与 Artifacts 使用相关的额外说明。",
   "com_nav_info_custom_prompt_mode": "启用后，默认的 Artifacts 系统提示词将不会包含在内。在此模式下，必须手动提供所有生成工件的指令。",
+  "com_nav_info_default_temporary_chat": "启用后，新聊天将默认以激活的临时聊天模式开始。临时对话不会保存到您的历史记录中。",
   "com_nav_info_enter_to_send": "启用后，按下 `ENTER` 将发送您的消息。禁用后，按下 `ENTER` 将添加新行，您需要按下 `CTRL + ENTER` / `⌘ + ENTER` 来发送消息。",
   "com_nav_info_fork_change_default": "`仅可见消息` 仅包含到所选消息的直接路径，`包含相关分支` 添加路径上的分支，`包含所有目标` 包括所有连接的消息和分支。",
   "com_nav_info_fork_split_target_setting": "启用后，将根据选择的行为，从目标消息开始到对话中的最新消息进行分叉。",
@@ -497,16 +527,19 @@
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "冰岛语",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
   "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "立陶宛语",
   "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
   "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "斯洛伐克语",
   "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
@@ -522,17 +555,22 @@
   "com_nav_log_out": "注销",
   "com_nav_long_audio_warning": "较长的文本将需要更长时间来处理。",
   "com_nav_maximize_chat_space": "最大化对话窗口",
+  "com_nav_mcp_access_revoked": "MCP 服务器访问权限已成功撤销。",
   "com_nav_mcp_configure_server": "配置 {{0}}",
   "com_nav_mcp_connect": "连接",
+  "com_nav_mcp_connect_server": "连接 {{0}}",
   "com_nav_mcp_reconnect": "重新连接",
   "com_nav_mcp_status_connected": "yi'lian'jie",
   "com_nav_mcp_status_connecting": "{{0}} - 连接中",
   "com_nav_mcp_status_error": "错误",
+  "com_nav_mcp_status_initializing": "MCP正在初始化",
+  "com_nav_mcp_status_needs_auth": "需授权",
   "com_nav_mcp_status_unknown": "未知",
   "com_nav_mcp_vars_update_error": "更新 MCP 自定义用户变量时发生错误",
   "com_nav_mcp_vars_updated": "MCP 自定义用户变量更新成功。",
   "com_nav_modular_chat": "启用在对话中切换端点",
   "com_nav_my_files": "我的文件",
+  "com_nav_new_chat_switch_to_history": "在新聊天中切换至聊天记录",
   "com_nav_not_supported": "未支持",
   "com_nav_open_sidebar": "打开侧边栏",
   "com_nav_playback_rate": "音频播放速度",
@@ -545,14 +583,12 @@
   "com_nav_scroll_button": "滚动到末尾按钮",
   "com_nav_search_placeholder": "搜索消息",
   "com_nav_send_message": "发送消息",
+  "com_nav_setting_about": "关于",
   "com_nav_setting_account": "账户",
-  "com_nav_setting_balance": "余额",
   "com_nav_setting_chat": "对话",
-  "com_nav_setting_data": "数据管理",
   "com_nav_setting_delay": "延迟（秒）",
   "com_nav_setting_general": "通用",
   "com_nav_setting_mcp": "MCP 设置",
-  "com_nav_setting_personalization": "个性化",
   "com_nav_setting_speech": "语音",
   "com_nav_settings": "设置",
   "com_nav_shared_links": "共享链接",
@@ -611,25 +647,32 @@
   "com_ui_2fa_generate_error": "生成双重身份验证设置时发生错误。",
   "com_ui_2fa_invalid": "无效的双重身份验证代码",
   "com_ui_2fa_setup": "设置双重身份验证",
+  "com_ui_2fa_verification_required": "请输入您的双重验证码以继续",
   "com_ui_2fa_verified": "成功验证双重身份验证",
   "com_ui_accept": "我接受",
   "com_ui_action_button": "操作按钮",
   "com_ui_active": "活动",
   "com_ui_add": "添加",
+  "com_ui_add_first_bookmark": "点击聊天以添加",
+  "com_ui_add_first_mcp_server": "创建您的首个 MCP 服务器以开始使用",
+  "com_ui_add_first_prompt": "创建您的第一个提示词以开始使用",
+  "com_ui_add_labels": "添加标签",
   "com_ui_add_mcp": "添加 MCP",
   "com_ui_add_mcp_server": "添加 MCP 服务器",
   "com_ui_add_model_preset": "添加一个模型或预设以获得额外的响应",
   "com_ui_add_multi_conversation": "添加多个对话",
+  "com_ui_add_skills": "添加技能",
   "com_ui_add_special_variables": "添加特殊变量",
   "com_ui_adding_details": "添加细节",
+  "com_ui_additional_details": "更多详情",
   "com_ui_admin": "管理",
   "com_ui_admin_access_warning": "禁用管理员对此特性的访问可能会导致界面出现异常，需要刷新页面。如果保存此设置，唯一的恢复方式是通过 librechat.yaml 配置文件中的界面设置进行修改，这将影响所有角色。",
   "com_ui_admin_settings": "管理员设置",
+  "com_ui_admin_settings_section": "管理员设置 - {{section}}",
   "com_ui_advanced": "进阶",
   "com_ui_advanced_settings": "进阶设置",
   "com_ui_agent": "智能体",
   "com_ui_agent_api_keys": "智能体API密钥",
-  "com_ui_agent_api_keys_description": "创建API密钥来通过API远程访问智能体",
   "com_ui_agent_category_aftersales": "售后",
   "com_ui_agent_category_finance": "财务",
   "com_ui_agent_category_general": "通用",
@@ -659,6 +702,12 @@
   "com_ui_agent_name_is_required": "智能体名称为必填项",
   "com_ui_agent_recursion_limit": "最大智能体步骤数",
   "com_ui_agent_recursion_limit_info": "限制智能体在给出最终响应之前可执行的步骤数。默认为 25 个步骤。步骤可以是一次 AI API 请求或一次工具使用。例如，一个基本的工具交互需要 3 个步骤：初始请求、工具使用和后续请求。",
+  "com_ui_agent_subagents": "子智能体",
+  "com_ui_agent_subagents_add": "添加子智能体",
+  "com_ui_agent_subagents_agents": "其他子智能体",
+  "com_ui_agent_subagents_allow_self": "允许自我生成",
+  "com_ui_agent_subagents_empty": "无子智能体可用：启用自我生成或添加至少一个智能体。",
+  "com_ui_agent_subagents_enable": "启用子智能体",
   "com_ui_agent_url_copied": "智能体 URL 已复制到剪贴板",
   "com_ui_agent_var": "{{0}} 智能体",
   "com_ui_agent_version": "版本",
@@ -684,7 +733,6 @@
   "com_ui_analyzing": "正在分析",
   "com_ui_analyzing_finished": "完成分析",
   "com_ui_api_key": "API 密钥",
-  "com_ui_api_key_copied": "API密钥已复制到粘贴板",
   "com_ui_api_key_create_error": "API密钥创建失败",
   "com_ui_api_key_created": "API密钥创建成功",
   "com_ui_api_key_delete_error": "删除API密钥",
@@ -988,7 +1036,6 @@
   "com_ui_hide": "隐藏",
   "com_ui_hide_code": "隐藏代码",
   "com_ui_hide_image_details": "隐藏图片详情",
-  "com_ui_hide_password": "隐藏密码",
   "com_ui_hide_qr": "隐藏二维码",
   "com_ui_high": "高",
   "com_ui_host": "主机",
@@ -1011,7 +1058,6 @@
   "com_ui_instructions": "指令",
   "com_ui_key": "键",
   "com_ui_key_required": "API Key 为必填项",
-  "com_ui_last_used": "最后使用",
   "com_ui_late_night": "夜深了",
   "com_ui_latest_footer": "Every AI for Everyone.",
   "com_ui_latest_version": "最新版本",
@@ -1084,7 +1130,6 @@
   "com_ui_no_memories": "暂无记忆，请手动创建或提示 AI 记住一些内容",
   "com_ui_no_memories_match": "没有与您的搜索匹配的记忆",
   "com_ui_no_memories_title": "还没有记忆",
-  "com_ui_no_personalization_available": "当前没有可用的个性化选项",
   "com_ui_no_prompts_title": "还没有提示词",
   "com_ui_no_read_access": "您没有权限查看记忆",
   "com_ui_no_results_found": "未找到结果",
@@ -1244,17 +1289,15 @@
   "com_ui_show_all": "展开全部",
   "com_ui_show_code": "显示代码",
   "com_ui_show_image_details": "显示图片详情",
-  "com_ui_show_password": "显示密码",
   "com_ui_show_qr": "显示二维码",
   "com_ui_sign_in_to_domain": "登录到 {{0}}",
-  "com_ui_simple": "基本",
   "com_ui_size": "大小",
   "com_ui_size_sort": "按大小排序",
   "com_ui_special_var_current_date": "当前日期",
   "com_ui_special_var_current_datetime": "当前日期时间",
   "com_ui_special_var_current_user": "当前用户",
   "com_ui_special_var_iso_datetime": "UTC ISO 日期时间",
-  "com_ui_special_variables": "特殊变量：",
+  "com_ui_special_variables": "特殊变量",
   "com_ui_speech_while_submitting": "正在生成响应时无法提交语音",
   "com_ui_stop": "停止",
   "com_ui_storage": "存储",
diff --git a/client/src/locales/zh-Hant/translation.json b/client/src/locales/zh-Hant/translation.json
index 6277e6f6719..9b87bc65240 100644
--- a/client/src/locales/zh-Hant/translation.json
+++ b/client/src/locales/zh-Hant/translation.json
@@ -2,12 +2,15 @@
   "chat_direction_left_to_right": "由左至右",
   "chat_direction_right_to_left": "由右至左",
   "com_a11y_ai_composing": "AI 仍在撰寫中",
+  "com_a11y_chats_date_section": "從 {{date}} 開始的對話",
   "com_a11y_end": "AI 已完成回覆",
+  "com_a11y_selected": "已選擇",
   "com_a11y_start": "AI 已開始回覆。",
   "com_agents_agent_card_label": "{{name}} agent。{{description}}",
   "com_agents_all": "全部 Agent",
   "com_agents_all_category": "全部",
   "com_agents_all_description": "瀏覽所有類別中的共用 agent",
+  "com_agents_avatar_upload_error": "上傳 agent 圖片失敗",
   "com_agents_category_aftersales": "售後",
   "com_agents_category_aftersales_description": "售後支援、維護與客戶服務 agent",
   "com_agents_category_empty": "在 {{category}} 類別中找不到 agent",
@@ -61,6 +64,7 @@
   "com_agents_file_search_disabled": "必須先建立代理才能上傳檔案進行檔案搜尋。",
   "com_agents_file_search_info": "啟用後，代理將會被告知以下列出的確切檔案名稱，使其能夠從這些檔案中擷取相關內容。",
   "com_agents_instructions_placeholder": "代理程式使用的系統指令",
+  "com_agents_link_copied": "已複製連結",
   "com_agents_loading": "載入中...",
   "com_agents_marketplace": "Agents市場",
   "com_agents_mcp_description_placeholder": "簡要解釋它的作用",
@@ -74,6 +78,7 @@
   "com_agents_no_agent_id_error": "找不到 Agent ID。請先建立 Agent。",
   "com_agents_not_available": "代理不可用",
   "com_agents_recommended": "我們推薦的agents",
+  "com_agents_search_empty_heading": "沒有搜尋結果",
   "com_agents_search_info": "啟用後，允許您的 Agent 搜尋網路以取得最新資訊。需要有效的 API 金鑰。",
   "com_agents_search_instructions": "輸入名稱或描述來搜尋agents",
   "com_agents_search_name": "依名稱搜尋代理",
@@ -369,15 +374,12 @@
   "com_nav_browser": "瀏覽器",
   "com_nav_center_chat_input": "在歡迎畫面置中顯示聊天輸入框",
   "com_nav_change_picture": "更換圖片",
-  "com_nav_chat_commands": "對話指令",
-  "com_nav_chat_commands_info": "這些指令是透過在訊息開頭輸入特定字元來啟動的。每個指令都由其專屬的前綴觸發。如果您經常在訊息開頭使用這些字元，可以選擇停用這些指令。",
   "com_nav_chat_direction": "對話方向",
   "com_nav_clear_all_chats": "清除所有對話",
   "com_nav_clear_cache_confirm_message": "您確定要清除快取嗎？",
   "com_nav_clear_conversation": "清除對話",
   "com_nav_clear_conversation_confirm_message": "您確定要清除所有對話嗎？此操作無法復原。",
   "com_nav_close_sidebar": "關閉側邊選單",
-  "com_nav_commands": "指令",
   "com_nav_confirm_clear": "確認清除",
   "com_nav_conversation_mode": "對話模式",
   "com_nav_convo_menu_options": "對話選單選項",
@@ -420,6 +422,7 @@
   "com_nav_info_save_badges_state": "啟用此功能後，聊天徽章的狀態將會被儲存。這表示當您建立新的對話時，徽章會維持和上一個對話相同的狀態。如果停用此選項，每次建立新的對話時，徽章都會重設為預設狀態。",
   "com_nav_info_save_draft": "啟用後，您在聊天表單中輸入的文字和附件將自動儲存為本地草稿。即使重新載入頁面或切換至其他對話，這些草稿仍會保留。草稿僅儲存在您的裝置上，並會在訊息送出後自動刪除。",
   "com_nav_info_user_name_display": "啟用時，每則您發送的訊息上方都會顯示您的使用者名稱。停用時，您的訊息上方只會顯示「您」。",
+  "com_nav_keep_screen_awake": "當產生回應時保持螢幕清醒",
   "com_nav_lang_arabic": "العربية",
   "com_nav_lang_armenian": "Հայերեն",
   "com_nav_lang_auto": "自動偵測",
@@ -462,6 +465,15 @@
   "com_nav_log_out": "登出",
   "com_nav_long_audio_warning": "較長的文字需要較多處理時間",
   "com_nav_maximize_chat_space": "最大化聊天視窗",
+  "com_nav_mcp_connect": "連線",
+  "com_nav_mcp_reconnect": "重新連線",
+  "com_nav_mcp_status_connected": "已連線",
+  "com_nav_mcp_status_connecting": "{{0}} - 連線中",
+  "com_nav_mcp_status_disconnected": "已斷線",
+  "com_nav_mcp_status_error": "錯誤",
+  "com_nav_mcp_status_initializing": "正在初始化",
+  "com_nav_mcp_status_needs_auth": "需要授權",
+  "com_nav_mcp_status_unknown": "未知",
   "com_nav_modular_chat": "允許在對話中途切換端點",
   "com_nav_my_files": "我的檔案",
   "com_nav_not_supported": "不支援",
@@ -478,10 +490,8 @@
   "com_nav_send_message": "傳送訊息",
   "com_nav_setting_account": "帳號",
   "com_nav_setting_chat": "對話",
-  "com_nav_setting_data": "資料控制",
   "com_nav_setting_general": "通用",
   "com_nav_setting_mcp": "MCP 設定",
-  "com_nav_setting_personalization": "個性化",
   "com_nav_setting_speech": "語音",
   "com_nav_settings": "設定",
   "com_nav_shared_links": "共享連結",
@@ -498,6 +508,7 @@
   "com_nav_tool_dialog": "AI 工具",
   "com_nav_tool_dialog_agents": "AI 代理工具",
   "com_nav_tool_dialog_description": "必須儲存 Assistant 才能保留工具選擇。",
+  "com_nav_tool_dialog_mcp_server_tools": "MCP Server 工具組",
   "com_nav_tool_remove": "移除",
   "com_nav_tool_search": "搜尋工具",
   "com_nav_user": "使用者",
@@ -573,6 +584,8 @@
   "com_ui_authentication": "驗證",
   "com_ui_auto": "自動",
   "com_ui_avatar": "大頭照",
+  "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
   "com_ui_back_to_prompts": "返回提示",
   "com_ui_bookmark_delete_confirm": "你確定要刪除這個書籤嗎？",
   "com_ui_bookmarks": "書籤",
@@ -603,6 +616,7 @@
   "com_ui_command_usage_placeholder": "透過指令或名稱選擇提示",
   "com_ui_concise": "簡潔",
   "com_ui_confirm_action": "確認操作",
+  "com_ui_connecting": "連線中",
   "com_ui_context": "前後文",
   "com_ui_continue": "繼續",
   "com_ui_copied": "已複製！",
@@ -718,6 +732,7 @@
   "com_ui_manage": "管理",
   "com_ui_max_tags": "允許的最大數量為 {{0}}，已使用最新值。",
   "com_ui_mcp_enter_var": "請輸入 {{0}} 的值",
+  "com_ui_mcp_type_sse": "SSE",
   "com_ui_mcp_url": "MCP 伺服器",
   "com_ui_medium": "中",
   "com_ui_memories": "記憶",
@@ -740,6 +755,7 @@
   "com_ui_memory_updated_items": "已更新的記憶",
   "com_ui_memory_would_exceed": "無法儲存——會超出限制 {{tokens}} 個 token。請刪除現有記憶以釋放空間。",
   "com_ui_mention": "提及端點、助理或預設設定以快速切換",
+  "com_ui_mermaid": "mermaid",
   "com_ui_min_tags": "無法再移除更多值，至少需要 {{0}} 個。",
   "com_ui_minimal": "最小值",
   "com_ui_model": "模型",
@@ -756,8 +772,10 @@
   "com_ui_no_terms_content": "沒有條款和條件內容顯示",
   "com_ui_none": "無",
   "com_ui_nothing_found": "找不到任何內容",
+  "com_ui_oauth": "OAuth",
   "com_ui_of": "的",
   "com_ui_off": "關閉",
+  "com_ui_offline": "離線",
   "com_ui_on": "開啟",
   "com_ui_openai": "OpenAI",
   "com_ui_page": "頁面",
@@ -818,9 +836,8 @@
   "com_ui_shared_link_not_found": "未找到共享連結",
   "com_ui_shared_prompts": "共享提示",
   "com_ui_show_all": "顯示全部",
-  "com_ui_simple": "簡單",
   "com_ui_size": "大小",
-  "com_ui_special_variables": "特殊變數：",
+  "com_ui_special_variables": "特殊變數",
   "com_ui_speech_while_submitting": "正在產生回應時無法送出語音",
   "com_ui_stop": "停止",
   "com_ui_storage": "儲存空間",
diff --git a/client/src/main.jsx b/client/src/main.jsx
index 53b483f8d20..f0f196e720a 100644
--- a/client/src/main.jsx
+++ b/client/src/main.jsx
@@ -1,18 +1,38 @@
-import 'regenerator-runtime/runtime';
+import './polyfills/regeneratorRuntime';
 import { createRoot } from 'react-dom/client';
-import './locales/i18n';
+import { initializeI18n } from './locales/i18n';
 import App from './App';
+import '@librechat/client/style.css';
 import './style.css';
 import './mobile.css';
 import { ApiErrorBoundaryProvider } from './hooks/ApiErrorBoundaryContext';
 import 'katex/dist/katex.min.css';
 import 'katex/dist/contrib/copy-tex.js';
 
+window.addEventListener('vite:preloadError', (event) => {
+  if (window.__lcRecoverStaleAssets?.()) {
+    event.preventDefault();
+  }
+});
+
 const container = document.getElementById('root');
 const root = createRoot(container);
 
-root.render(
-  <ApiErrorBoundaryProvider>
-    <App />
-  </ApiErrorBoundaryProvider>,
-);
+async function bootstrap() {
+  await initializeI18n();
+
+  root.render(
+    <ApiErrorBoundaryProvider>
+      <App />
+    </ApiErrorBoundaryProvider>,
+  );
+}
+
+bootstrap().catch((error) => {
+  console.error('[i18n] Failed to initialize before render', error);
+  root.render(
+    <ApiErrorBoundaryProvider>
+      <App />
+    </ApiErrorBoundaryProvider>,
+  );
+});
diff --git a/client/src/polyfills/regeneratorRuntime.js b/client/src/polyfills/regeneratorRuntime.js
new file mode 100644
index 00000000000..28c5a8d86c3
--- /dev/null
+++ b/client/src/polyfills/regeneratorRuntime.js
@@ -0,0 +1,3 @@
+import regeneratorRuntime from 'regenerator-runtime/runtime';
+
+globalThis.regeneratorRuntime ??= regeneratorRuntime;
diff --git a/client/src/routes/ChatRoute.tsx b/client/src/routes/ChatRoute.tsx
index a17d349037d..5f55df51dd2 100644
--- a/client/src/routes/ChatRoute.tsx
+++ b/client/src/routes/ChatRoute.tsx
@@ -1,4 +1,5 @@
-import { useEffect } from 'react';
+import { useEffect, useMemo } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
 import { useRecoilCallback, useRecoilValue } from 'recoil';
 import { Spinner, useToastContext } from '@librechat/client';
 import { useParams, useSearchParams } from 'react-router-dom';
@@ -11,8 +12,16 @@ import {
   getDefaultModelSpec,
   getModelSpecPreset,
   isNotFoundError,
+  isTemporaryConversation,
   logger,
+  clearMessagesCache,
 } from '~/utils';
+import {
+  useGetConvoIdQuery,
+  useGetStartupConfig,
+  useGetEndpointsQuery,
+  useProjectQuery,
+} from '~/data-provider';
 import {
   useAssistantListMap,
   useIdChangeEffect,
@@ -20,7 +29,6 @@ import {
   useNewConvo,
   useLocalize,
 } from '~/hooks';
-import { useGetConvoIdQuery, useGetStartupConfig, useGetEndpointsQuery } from '~/data-provider';
 import { ToolCallsMapProvider } from '~/Providers';
 import ChatView from '~/components/Chat/ChatView';
 import { NotificationSeverity } from '~/common';
@@ -28,9 +36,13 @@ import useAuthRedirect from './useAuthRedirect';
 import temporaryStore from '~/store/temporary';
 import store from '~/store';
 
+const isValidChatProjectId = (projectId: string | null): projectId is string =>
+  projectId != null && /^[a-f\d]{24}$/i.test(projectId);
+
 export default function ChatRoute() {
   const { data: startupConfig } = useGetStartupConfig();
   const { isAuthenticated, user, roles } = useAuthRedirect();
+  const queryClient = useQueryClient();
 
   const defaultTemporaryChat = useRecoilValue(temporaryStore.defaultTemporaryChat);
   const setIsTemporary = useRecoilCallback(
@@ -43,13 +55,64 @@ export default function ChatRoute() {
   useAppStartup({ startupConfig, user });
 
   const index = 0;
-  const [searchParams] = useSearchParams();
+  const [searchParams, setSearchParams] = useSearchParams();
   const { conversationId = '' } = useParams();
+  const projectIdParam = searchParams.get('projectId');
+  const chatProjectId = isValidChatProjectId(projectIdParam) ? projectIdParam : null;
   useIdChangeEffect(conversationId);
   const { hasSetConversation, conversation } = store.useCreateConversationAtom(index);
   const { newConversation } = useNewConvo();
   const { showToast } = useToastContext();
   const localize = useLocalize();
+  const projectQuery = useProjectQuery(chatProjectId, {
+    enabled: isAuthenticated && Boolean(chatProjectId),
+    retry: false,
+    staleTime: 30000,
+    cacheTime: 300000,
+  });
+  /**
+   * The scoped project is *confirmed gone* — a not-found/not-owned (404) response,
+   * or a success that resolved to a different/empty project. Transient failures
+   * (500, network, auth refresh race) are deliberately excluded: this query runs with
+   * `retry: false`, so treating any error as "gone" would unscope a valid project on
+   * a single blip.
+   */
+  const projectNotFound = projectQuery.isError && isNotFoundError(projectQuery.error);
+  /**
+   * Trust the scope when the project resolves to itself, and keep showing it through
+   * transient errors via React Query's retained data — but never for a project that
+   * is confirmed gone (otherwise the deleted project's chip lingers).
+   */
+  const verifiedChatProjectId =
+    !projectNotFound && projectQuery.data?._id === chatProjectId ? chatProjectId : null;
+  const projectTemplate = useMemo(
+    () => (verifiedChatProjectId ? { chatProjectId: verifiedChatProjectId } : {}),
+    [verifiedChatProjectId],
+  );
+
+  /**
+   * The scoped project is gone even though the URL still carries `?projectId`. Drop
+   * the param so the new-chat landing reverts to an unscoped chat — otherwise the
+   * stale chip lingers and sends target a dead project.
+   */
+  const projectScopeMissing =
+    Boolean(chatProjectId) &&
+    conversationId === Constants.NEW_CONVO &&
+    (projectNotFound || (projectQuery.isSuccess && projectQuery.data?._id !== chatProjectId));
+
+  useEffect(() => {
+    if (!projectScopeMissing) {
+      return;
+    }
+    setSearchParams(
+      (params) => {
+        const next = new URLSearchParams(params);
+        next.delete('projectId');
+        return next;
+      },
+      { replace: true },
+    );
+  }, [projectScopeMissing, setSearchParams]);
 
   const modelsQuery = useGetModelsQuery({
     enabled: isAuthenticated,
@@ -62,7 +125,7 @@ export default function ChatRoute() {
   const endpointsQuery = useGetEndpointsQuery({ enabled: isAuthenticated });
   const assistantListMap = useAssistantListMap();
 
-  const isTemporaryChat = conversation && conversation.expiredAt ? true : false;
+  const isTemporaryChat = isTemporaryConversation(conversation);
 
   useEffect(() => {
     if (conversationId === Constants.NEW_CONVO) {
@@ -80,24 +143,36 @@ export default function ChatRoute() {
   useEffect(() => {
     // Wait for roles to load so hasAgentAccess has a definitive value in useNewConvo
     const rolesLoaded = roles?.USER != null;
+    const isNewConvo = conversationId === Constants.NEW_CONVO;
+    const isDraftNewConvo = conversation?.conversationId === Constants.NEW_CONVO;
+    const draftProjectMismatch = verifiedChatProjectId
+      ? conversation?.chatProjectId !== verifiedChatProjectId
+      : conversation?.chatProjectId != null;
+    const newConvoNeedsInit =
+      isNewConvo && (!conversation || (isDraftNewConvo && draftProjectMismatch));
     const shouldSetConvo =
-      (startupConfig && rolesLoaded && !hasSetConversation.current && !modelsQuery.data?.initial) ??
+      (startupConfig &&
+        rolesLoaded &&
+        (!hasSetConversation.current || newConvoNeedsInit) &&
+        !modelsQuery.data?.initial) ??
       false;
     /* Early exit if startupConfig is not loaded and conversation is already set and only initial models have loaded */
     if (!shouldSetConvo) {
       return;
     }
 
-    const isNewConvo = conversationId === Constants.NEW_CONVO;
+    if (isNewConvo && chatProjectId && projectQuery.isLoading) {
+      return;
+    }
 
     const getNewConvoPreset = () => {
-      const result = getDefaultModelSpec(startupConfig);
-      const spec = result?.default ?? result?.last;
+      const result = getDefaultModelSpec(startupConfig, endpointsQuery.data);
+      const spec = result?.default ?? result?.last ?? result?.softDefault;
       const specPreset = spec ? getModelSpecPreset(spec) : undefined;
 
       const queryParams: Record<string, string> = {};
       searchParams.forEach((value, key) => {
-        if (key !== 'prompt' && key !== 'q' && key !== 'submit') {
+        if (key !== 'prompt' && key !== 'q' && key !== 'submit' && key !== 'projectId') {
           queryParams[key] = value;
         }
       });
@@ -113,9 +188,10 @@ export default function ChatRoute() {
       const preset = getNewConvoPreset();
 
       logger.log('conversation', 'ChatRoute, new convo effect', conversation);
+      clearMessagesCache(queryClient, conversation?.conversationId);
       newConversation({
         modelsData: modelsQuery.data,
-        template: conversation ? conversation : undefined,
+        template: projectTemplate,
         ...(preset ? { preset } : {}),
       });
 
@@ -127,7 +203,6 @@ export default function ChatRoute() {
         /* this is necessary to load all existing settings */
         preset: initialConvoQuery.data as TPreset,
         modelsData: modelsQuery.data,
-        keepLatestMessage: true,
       });
       hasSetConversation.current = true;
     } else if (
@@ -137,8 +212,8 @@ export default function ChatRoute() {
       initialConvoQuery.isError &&
       isNotFoundError(initialConvoQuery.error)
     ) {
-      const result = getDefaultModelSpec(startupConfig);
-      const spec = result?.default ?? result?.last;
+      const result = getDefaultModelSpec(startupConfig, endpointsQuery.data);
+      const spec = result?.default ?? result?.last ?? result?.softDefault;
       showToast({
         message: localize('com_ui_conversation_not_found'),
         severity: NotificationSeverity.WARNING,
@@ -161,9 +236,10 @@ export default function ChatRoute() {
       const preset = getNewConvoPreset();
 
       logger.log('conversation', 'ChatRoute new convo, assistants effect', conversation);
+      clearMessagesCache(queryClient, conversation?.conversationId);
       newConversation({
         modelsData: modelsQuery.data,
-        template: conversation ? conversation : undefined,
+        template: projectTemplate,
         ...(preset ? { preset } : {}),
       });
       hasSetConversation.current = true;
@@ -176,7 +252,6 @@ export default function ChatRoute() {
         template: initialConvoQuery.data,
         preset: initialConvoQuery.data as TPreset,
         modelsData: modelsQuery.data,
-        keepLatestMessage: true,
       });
       hasSetConversation.current = true;
     }
@@ -190,6 +265,13 @@ export default function ChatRoute() {
     endpointsQuery.data,
     modelsQuery.data,
     assistantListMap,
+    chatProjectId,
+    projectQuery.data?._id,
+    projectQuery.isLoading,
+    projectTemplate,
+    queryClient,
+    conversation?.chatProjectId,
+    conversation?.conversationId,
   ]);
 
   if (endpointsQuery.isLoading || modelsQuery.isLoading) {
@@ -219,7 +301,7 @@ export default function ChatRoute() {
 
   return (
     <ToolCallsMapProvider conversationId={conversation.conversationId ?? ''}>
-      <ChatView index={index} />
+      <ChatView index={index} project={verifiedChatProjectId ? projectQuery.data : undefined} />
     </ToolCallsMapProvider>
   );
 }
diff --git a/client/src/routes/Root.tsx b/client/src/routes/Root.tsx
index 21a2cdf047b..d792cae0bdc 100644
--- a/client/src/routes/Root.tsx
+++ b/client/src/routes/Root.tsx
@@ -2,14 +2,6 @@ import { useState, useEffect } from 'react';
 import { useRecoilValue } from 'recoil';
 import { Outlet } from 'react-router-dom';
 import { useMediaQuery } from '@librechat/client';
-import {
-  useSearchEnabled,
-  useAssistantsMap,
-  useAuthContext,
-  useAgentsMap,
-  useFileMap,
-} from '~/hooks';
-import store from '~/store';
 import {
   PromptGroupsProvider,
   AssistantsMapContext,
@@ -17,11 +9,33 @@ import {
   SetConvoProvider,
   FileMapContext,
 } from '~/Providers';
+import {
+  useSearchEnabled,
+  useAssistantsMap,
+  useAuthContext,
+  useAgentsMap,
+  useFileMap,
+} from '~/hooks';
+import KeyboardShortcutsDialog from '~/components/Nav/KeyboardShortcutsDialog';
+import KeyboardDeleteDialog from '~/components/Nav/KeyboardDeleteDialog';
 import { useUserTermsQuery, useGetStartupConfig } from '~/data-provider';
+import useKeyboardShortcuts from '~/hooks/useKeyboardShortcuts';
 import { UnifiedSidebar } from '~/components/UnifiedSidebar';
 import { TermsAndConditionsModal } from '~/components/ui';
 import { useHealthCheck } from '~/data-provider';
 import { Banner } from '~/components/Banners';
+import store from '~/store';
+
+/** Isolates keyboard shortcut listeners so they only mount after auth. */
+function KeyboardShortcutsProvider() {
+  useKeyboardShortcuts();
+  return (
+    <>
+      <KeyboardShortcutsDialog />
+      <KeyboardDeleteDialog />
+    </>
+  );
+}
 
 export default function Root() {
   const [showTerms, setShowTerms] = useState(false);
@@ -98,6 +112,7 @@ export default function Root() {
               modalContent={config.interface.termsOfService.modalContent}
             />
           )}
+          <KeyboardShortcutsProvider />
         </AssistantsMapContext.Provider>
       </FileMapContext.Provider>
     </SetConvoProvider>
diff --git a/client/src/routes/__tests__/skillsRoutes.spec.tsx b/client/src/routes/__tests__/skillsRoutes.spec.tsx
new file mode 100644
index 00000000000..7263a5ceb3e
--- /dev/null
+++ b/client/src/routes/__tests__/skillsRoutes.spec.tsx
@@ -0,0 +1,70 @@
+import React from 'react';
+
+jest.mock('~/components/Auth', () => ({
+  Login: () => null,
+  VerifyEmail: () => null,
+  Registration: () => null,
+  ResetPassword: () => null,
+  ApiErrorWatcher: () => null,
+  TwoFactorScreen: () => null,
+  RequestPasswordReset: () => null,
+}));
+
+jest.mock('~/components/Agents/MarketplaceContext', () => ({
+  MarketplaceProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+jest.mock('~/components/Agents/Marketplace', () => () => null);
+jest.mock('~/components/OAuth', () => ({
+  OAuthSuccess: () => null,
+  OAuthError: () => null,
+}));
+jest.mock('~/hooks/AuthContext', () => ({
+  AuthContextProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+jest.mock('../RouteErrorBoundary', () => () => null);
+jest.mock('../Layouts/Startup', () => () => null);
+jest.mock('../Layouts/Login', () => () => null);
+jest.mock('../Dashboard', () => ({
+  __esModule: true,
+  default: { path: 'dashboard', element: null },
+}));
+jest.mock('../ShareRoute', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+jest.mock('../ChatRoute', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+jest.mock('../Search', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+jest.mock('../Root', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+
+import { router } from '../index';
+
+type RouteNode = {
+  path?: string;
+  children?: RouteNode[];
+};
+
+function flattenPaths(routes: RouteNode[]): string[] {
+  return routes.flatMap((route) => [
+    ...(route.path ? [route.path] : []),
+    ...(route.children ? flattenPaths(route.children) : []),
+  ]);
+}
+
+describe('skills routes', () => {
+  it('registers the explicit /skills/new route', () => {
+    const paths = flattenPaths((router as unknown as { routes: RouteNode[] }).routes);
+
+    expect(paths).toContain('skills/new');
+  });
+});
diff --git a/client/src/routes/index.tsx b/client/src/routes/index.tsx
index b73aa47b1f1..ebcab40c147 100644
--- a/client/src/routes/index.tsx
+++ b/client/src/routes/index.tsx
@@ -12,6 +12,7 @@ import { MarketplaceProvider } from '~/components/Agents/MarketplaceContext';
 import AgentMarketplace from '~/components/Agents/Marketplace';
 import { OAuthSuccess, OAuthError } from '~/components/OAuth';
 import { AuthContextProvider } from '~/hooks/AuthContext';
+import WithRum from '~/lib/rum/WithRum';
 import RouteErrorBoundary from './RouteErrorBoundary';
 import StartupLayout from './Layouts/Startup';
 import LoginLayout from './Layouts/Login';
@@ -23,7 +24,9 @@ import Root from './Root';
 
 const AuthLayout = () => (
   <AuthContextProvider>
-    <Outlet />
+    <WithRum>
+      <Outlet />
+    </WithRum>
     <ApiErrorWatcher />
   </AuthContextProvider>
 );
@@ -38,6 +41,16 @@ const loadSkillsView = () =>
     Component: m.default,
   }));
 
+const loadProjectsView = () =>
+  import('~/components/Projects').then((m) => ({
+    Component: m.ProjectsView,
+  }));
+
+const loadProjectWorkspace = () =>
+  import('~/components/Projects').then((m) => ({
+    Component: m.ProjectWorkspace,
+  }));
+
 const baseEl = document.querySelector('base');
 const baseHref = baseEl?.getAttribute('href') || '/';
 
@@ -137,6 +150,10 @@ export const router = createBrowserRouter(
               path: 'skills',
               lazy: loadSkillsView,
             },
+            {
+              path: 'skills/new',
+              lazy: loadSkillsView,
+            },
             {
               path: 'skills/:skillId',
               lazy: loadSkillsView,
@@ -145,6 +162,14 @@ export const router = createBrowserRouter(
               path: 'skills/:skillId/edit',
               lazy: loadSkillsView,
             },
+            {
+              path: 'projects',
+              lazy: loadProjectsView,
+            },
+            {
+              path: 'projects/:projectId',
+              lazy: loadProjectWorkspace,
+            },
             {
               path: 'agents',
               element: (
diff --git a/client/src/store/__tests__/agents.spec.tsx b/client/src/store/__tests__/agents.spec.tsx
new file mode 100644
index 00000000000..0d28ccca756
--- /dev/null
+++ b/client/src/store/__tests__/agents.spec.tsx
@@ -0,0 +1,48 @@
+import React from 'react';
+import { RecoilRoot, useRecoilValue } from 'recoil';
+import { renderHook, act, waitFor } from '@testing-library/react';
+
+import { ephemeralAgentByConvoId, useApplyNewAgentTemplate } from '../agents';
+
+jest.mock('~/utils', () => ({
+  logger: {
+    log: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const Wrapper = ({ children }: { children: React.ReactNode }) => (
+  <RecoilRoot>{children}</RecoilRoot>
+);
+
+const useAgentTemplateHarness = (conversationId: string) => {
+  const applyTemplate = useApplyNewAgentTemplate();
+  const ephemeralAgent = useRecoilValue(ephemeralAgentByConvoId(conversationId));
+  return { applyTemplate, ephemeralAgent };
+};
+
+describe('useApplyNewAgentTemplate', () => {
+  it('applies an explicit ephemeral agent when optimistic hydration makes source and target match', async () => {
+    const conversationId = 'convo-123';
+    const agent = {
+      mcp: ['chrome-devtools'],
+      skills: true,
+      artifacts: 'default',
+      web_search: true,
+      file_search: true,
+      execute_code: true,
+    };
+    const { result } = renderHook(() => useAgentTemplateHarness(conversationId), {
+      wrapper: Wrapper,
+    });
+
+    await act(async () => {
+      await result.current.applyTemplate(conversationId, conversationId, agent);
+    });
+
+    await waitFor(() => {
+      expect(result.current.ephemeralAgent).toEqual(agent);
+    });
+  });
+});
diff --git a/client/src/store/agents.ts b/client/src/store/agents.ts
index 13136ef34ea..139a76f07dd 100644
--- a/client/src/store/agents.ts
+++ b/client/src/store/agents.ts
@@ -43,7 +43,7 @@ export function useApplyNewAgentTemplate() {
         const sourceId = _sourceId || Constants.NEW_CONVO;
         logger.log('agents', `Attempting to apply template from "${sourceId}" to "${targetId}"`);
 
-        if (targetId === sourceId) {
+        if (targetId === sourceId && ephemeralAgentState == null) {
           logger.warn('agents', `Attempted to apply template to itself ("${sourceId}"). Skipping.`);
           return;
         }
diff --git a/client/src/store/families.ts b/client/src/store/families.ts
index 7e754e05ce4..c4ad8221f59 100644
--- a/client/src/store/families.ts
+++ b/client/src/store/families.ts
@@ -1,5 +1,6 @@
 import { useEffect } from 'react';
 import { createSearchParams } from 'react-router-dom';
+import { LocalStorageKeys, isEphemeralAgentId, Constants } from 'librechat-data-provider';
 import {
   atom,
   selector,
@@ -10,14 +11,7 @@ import {
   useSetRecoilState,
   useRecoilCallback,
 } from 'recoil';
-import { LocalStorageKeys, isEphemeralAgentId, Constants } from 'librechat-data-provider';
-import type {
-  EModelEndpoint,
-  TConversation,
-  TSubmission,
-  TMessage,
-  TPreset,
-} from 'librechat-data-provider';
+import type { EModelEndpoint, TConversation, TSubmission, TPreset } from 'librechat-data-provider';
 import type { TOptionSettings, ExtendedFile } from '~/common';
 import {
   clearModelForNonEphemeralAgent,
@@ -27,46 +21,16 @@ import {
 } from '~/utils';
 import { useSetConvoContext } from '~/Providers/SetConvoContext';
 
-const latestMessageKeysAtom = atom<(string | number)[]>({
-  key: 'latestMessageKeys',
-  default: [],
-});
-
 const submissionKeysAtom = atom<(string | number)[]>({
   key: 'submissionKeys',
   default: [],
 });
 
-const latestMessageFamily = atomFamily<TMessage | null, string | number | null>({
-  key: 'latestMessageByIndex',
-  default: null,
-  effects: [
-    ({ onSet, node }) => {
-      onSet(async (newValue) => {
-        const key = Number(node.key.split(Constants.COMMON_DIVIDER)[1]);
-        logger.log('Recoil Effect: Setting latestMessage', { key, newValue });
-      });
-    },
-  ] as const,
-});
-
 const submissionByIndex = atomFamily<TSubmission | null, string | number>({
   key: 'submissionByIndex',
   default: null,
 });
 
-const latestMessageKeysSelector = selector<(string | number)[]>({
-  key: 'latestMessageKeysSelector',
-  get: ({ get }) => {
-    const keys = get(conversationKeysAtom);
-    return keys.filter((key) => get(latestMessageFamily(key)) !== null);
-  },
-  set: ({ set }, newKeys) => {
-    logger.log('setting latestMessageKeys', { newKeys });
-    set(latestMessageKeysAtom, newKeys);
-  },
-});
-
 const submissionKeysSelector = selector<(string | number)[]>({
   key: 'submissionKeysSelector',
   get: ({ get }) => {
@@ -129,6 +93,9 @@ const conversationByIndex = atomFamily<TConversation | null, string | number>({
 
         if (shouldUpdateParams) {
           const newParams = createChatSearchParams(newValue);
+          if (newValue.chatProjectId) {
+            newParams.set('projectId', newValue.chatProjectId);
+          }
           const searchParams = createSearchParams(newParams);
           const url = `${window.location.pathname}?${searchParams.toString()}`;
           window.history.pushState({}, '', url);
@@ -319,6 +286,20 @@ const pendingManualSkillsByConvoId = atomFamily<string[], string>({
   default: [],
 });
 
+/**
+ * Per-conversation queue of verbatim excerpts the user quoted via the
+ * "Add to chat" selection popup for the next submission. The submit pipeline
+ * (`useChatFunctions.ask`) drains this onto the user message's `quotes` field
+ * (which the backend merges into the model-facing text and persists for the
+ * `MessageQuotes` UI), then resets to `[]`. Compose-time chips above the
+ * textarea read this atom directly so users can see and dismiss each quote
+ * before sending.
+ */
+const pendingQuotesByConvoId = atomFamily<string[], string>({
+  key: 'pendingQuotesByConvoId',
+  default: [],
+});
+
 const globalAudioURLFamily = atomFamily<string | null, string | number | null>({
   key: 'globalAudioURLByIndex',
   default: null,
@@ -385,11 +366,6 @@ function useClearConvoState() {
           }
 
           reset(conversationByIndex(conversationKey));
-
-          const conversation = await snapshot.getPromise(conversationByIndex(conversationKey));
-          if (conversation) {
-            reset(latestMessageFamily(conversationKey));
-          }
         }
 
         reset(conversationKeysAtom);
@@ -426,33 +402,6 @@ function useClearSubmissionState() {
   return clearAllSubmissions;
 }
 
-function useClearLatestMessages(context?: string) {
-  const clearAllLatestMessages = useRecoilCallback(
-    ({ reset, set, snapshot }) =>
-      async (skipFirst?: boolean) => {
-        const latestMessageKeys = await snapshot.getPromise(latestMessageKeysSelector);
-        logger.log('[clearAllLatestMessages] latestMessageKeys', latestMessageKeys);
-        if (context != null && context) {
-          logger.log(`[clearAllLatestMessages] context: ${context}`);
-        }
-
-        for (const key of latestMessageKeys) {
-          if (skipFirst === true && key == 0) {
-            continue;
-          }
-
-          logger.log(`[clearAllLatestMessages] resetting latest message; key: ${key}`);
-          reset(latestMessageFamily(key));
-        }
-
-        set(latestMessageKeysSelector, []);
-      },
-    [],
-  );
-
-  return clearAllLatestMessages;
-}
-
 const updateConversationSelector = selectorFamily({
   key: 'updateConversationSelector',
   get: () => () => null as Partial<TConversation> | null,
@@ -490,7 +439,6 @@ export default {
   isSubmittingFamily,
   optionSettingsFamily,
   showPopoverFamily,
-  latestMessageFamily,
   messagesSiblingIdxFamily,
   anySubmittingSelector,
   allConversationsSelector,
@@ -514,9 +462,9 @@ export default {
   showPlusPopoverFamily,
   activePromptByIndex,
   useClearSubmissionState,
-  useClearLatestMessages,
   showPromptsPopoverFamily,
   showSkillsPopoverFamily,
   pendingManualSkillsByConvoId,
+  pendingQuotesByConvoId,
   updateConversationSelector,
 };
diff --git a/client/src/store/index.ts b/client/src/store/index.ts
index 0584e9d8054..7d7d9cfe614 100644
--- a/client/src/store/index.ts
+++ b/client/src/store/index.ts
@@ -1,21 +1,22 @@
 import * as artifacts from './artifacts';
-import families from './families';
-import endpoints from './endpoints';
-import user from './user';
-import text from './text';
-import toast from './toast';
 import submission from './submission';
+import isTemporary from './temporary';
+import endpoints from './endpoints';
+import families from './families';
+import settings from './settings';
+import prompts from './prompts';
 import search from './search';
 import preset from './preset';
-import prompts from './prompts';
 import lang from './language';
-import settings from './settings';
+import toast from './toast';
+import user from './user';
+import text from './text';
 import misc from './misc';
-import isTemporary from './temporary';
 export * from './agents';
 export * from './mcp';
 export * from './favorites';
 export * from './subagents';
+export * from './usage';
 
 export default {
   ...artifacts,
diff --git a/client/src/store/language.ts b/client/src/store/language.ts
index 50e98fb127b..f49ee997642 100644
--- a/client/src/store/language.ts
+++ b/client/src/store/language.ts
@@ -1,11 +1,36 @@
+import { atom } from 'recoil';
 import Cookies from 'js-cookie';
 import { atomWithLocalStorage } from './utils';
 
+const readStoredLang = () => {
+  if (typeof localStorage === 'undefined') {
+    return undefined;
+  }
+
+  const storedLang = localStorage.getItem('lang');
+  if (!storedLang) {
+    return undefined;
+  }
+
+  try {
+    const parsedLang = JSON.parse(storedLang);
+    return typeof parsedLang === 'string' ? parsedLang : storedLang;
+  } catch {
+    return storedLang;
+  }
+};
+
 const defaultLang = () => {
-  const userLang = navigator.language || navigator.languages[0];
-  return Cookies.get('lang') || localStorage.getItem('lang') || userLang;
+  const userLang =
+    (typeof navigator !== 'undefined' ? navigator.language || navigator.languages?.[0] : null) ??
+    'en';
+  return Cookies.get('lang') || readStoredLang() || userLang;
 };
 
 const lang = atomWithLocalStorage('lang', defaultLang());
+const languageLoading = atom<boolean>({
+  key: 'languageLoading',
+  default: false,
+});
 
-export default { lang };
+export default { lang, languageLoading };
diff --git a/client/src/store/misc.ts b/client/src/store/misc.ts
index 7bd571eaca0..0fa2b32900a 100644
--- a/client/src/store/misc.ts
+++ b/client/src/store/misc.ts
@@ -57,6 +57,31 @@ const isEditingBadges = atom<boolean>({
   default: false,
 });
 
+const showShortcutsDialog = atom<boolean>({
+  key: 'showShortcutsDialog',
+  default: false,
+});
+
+export type KeyboardDeleteTarget = {
+  conversationId: string;
+  title: string;
+};
+
+const keyboardDeleteTarget = atom<KeyboardDeleteTarget | null>({
+  key: 'keyboardDeleteTarget',
+  default: null,
+});
+
+export type ShortcutOverride = {
+  mac: string | null;
+  other: string | null;
+};
+
+const customShortcuts = atomWithLocalStorage<Record<string, ShortcutOverride>>(
+  'customKeyboardShortcuts',
+  {},
+);
+
 const chatBadges = atomWithLocalStorage<Pick<BadgeItem, 'id'>[]>('chatBadges', [
   // When adding new badges, make sure to add them to useChatBadges.ts as well and add them as last item
   // DO NOT CHANGE THE ORDER OF THE BADGES ALREADY IN THE ARRAY
@@ -70,5 +95,8 @@ export default {
   conversationAttachmentsSelector,
   queriesEnabled,
   isEditingBadges,
+  showShortcutsDialog,
+  keyboardDeleteTarget,
+  customShortcuts,
   chatBadges,
 };
diff --git a/client/src/store/usage.ts b/client/src/store/usage.ts
new file mode 100644
index 00000000000..a4bd064a587
--- /dev/null
+++ b/client/src/store/usage.ts
@@ -0,0 +1,183 @@
+import { atomFamily } from 'jotai/utils';
+import { atom, getDefaultStore } from 'jotai';
+import type { TMessage, TContextUsageEvent } from 'librechat-data-provider';
+import type { BranchTotals, BranchUsage } from '~/utils/tokens';
+import { EMPTY_BRANCH, EMPTY_USAGE } from '~/utils/tokens';
+
+/** Latest backend context snapshot, anchored to the run's user message for staleness checks */
+export interface ContextSnapshot extends TContextUsageEvent {
+  anchorMessageId: string | null;
+  /** Output tokens finalized after this pre-call snapshot (the last call's response) */
+  completedOutputTokens?: number;
+}
+
+/**
+ * In-flight usage for the streaming response only — a single-response pending
+ * holder. `foldUsage` accumulates the current response's `on_token_usage`
+ * events here; `finalizeUsage` flushes it into the per-message index and resets
+ * it. Branch/total figures are otherwise derived by summing the index, so this
+ * is the only live add (counted exactly once at finalize).
+ */
+export interface UsageTotals {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  eventCount: number;
+  /** Summed authoritative per-event cost from the backend (premium tiers,
+   *  cache rates). Populated only when `interface.contextCost` is enabled. */
+  costUSD: number;
+  /** Whether cost coverage is complete — every folded event carried a cost
+   *  (ANDed, vacuously true when empty); gates the cost row. */
+  costKnown: boolean;
+}
+
+export const EMPTY_USAGE_TOTALS: UsageTotals = {
+  input: 0,
+  output: 0,
+  cacheWrite: 0,
+  cacheRead: 0,
+  eventCount: 0,
+  costUSD: 0,
+  costKnown: true,
+};
+
+/**
+ * Split into small per-conversation atoms so high-frequency writes (live
+ * stream estimates) re-render only the subscribers that draw them.
+ */
+export const branchTotalsFamily = atomFamily((_conversationId: string) =>
+  atom<BranchTotals>(EMPTY_BRANCH),
+);
+
+export const contextSnapshotFamily = atomFamily((_conversationId: string) =>
+  atom<ContextSnapshot | null>(null),
+);
+
+/**
+ * Finalized snapshots keyed by their (branch-unique) response message id.
+ * `contextSnapshotFamily` only holds the latest run; this retains each
+ * generation's breakdown so switching to a branch generated earlier this
+ * session keeps its granular rows instead of dropping to coarse totals.
+ * Bounded by the conversation's generation count; cleared on convo switch.
+ */
+export const snapshotsByAnchorFamily = atomFamily((_conversationId: string) =>
+  atom<Map<string, ContextSnapshot>>(new Map()),
+);
+
+/** In-flight usage of the streaming response; flushed into the index at finalize. */
+export const pendingUsageFamily = atomFamily((_conversationId: string) =>
+  atom<UsageTotals>(EMPTY_USAGE_TOTALS),
+);
+
+/** Provider usage/cost summed across all branches of the conversation. */
+export const totalUsageFamily = atomFamily((_conversationId: string) =>
+  atom<BranchUsage>(EMPTY_USAGE),
+);
+
+/** Throttled in-flight output token estimate for the current model call */
+export const liveTokensFamily = atomFamily((_conversationId: string) => atom<number>(0));
+
+/** Last known provider-vs-estimate calibration ratio for the conversation */
+export const calibrationFamily = atomFamily((_conversationId: string) => atom<number>(1));
+
+/**
+ * Per-conversation set of usage-event identities already folded into the
+ * totals. Lets the live path and resume backfill fold each model call exactly
+ * once, so reconnect mid-stream preserves earlier prompts' usage instead of
+ * resetting the session totals.
+ */
+const foldedUsageKeys = new Map<string, Set<string>>();
+
+/** Records an event identity; returns false if it was already folded. */
+export function markUsageFolded(conversationId: string, key: string): boolean {
+  let seen = foldedUsageKeys.get(conversationId);
+  if (seen == null) {
+    seen = new Set<string>();
+    foldedUsageKeys.set(conversationId, seen);
+  }
+  if (seen.has(key)) {
+    return false;
+  }
+  seen.add(key);
+  return true;
+}
+
+/** Moves folded-key tracking from a temporary convo id to the persisted one. */
+export function migrateUsageFolded(fromId: string, toId: string): void {
+  const seen = foldedUsageKeys.get(fromId);
+  if (seen == null) {
+    return;
+  }
+  const target = foldedUsageKeys.get(toId) ?? new Set<string>();
+  for (const key of seen) {
+    target.add(key);
+  }
+  foldedUsageKeys.set(toId, target);
+  foldedUsageKeys.delete(fromId);
+}
+
+/**
+ * Forgets a conversation's folded usage-event identities so a subsequent resume
+ * can re-fold them. Used when a terminal close discards the in-flight pending
+ * usage: `backfillUsage` would otherwise treat the persisted events as already
+ * folded and never rebuild pending after a navigate-away-then-resume.
+ */
+export function clearUsageFolded(conversationId: string): void {
+  foldedUsageKeys.delete(conversationId);
+}
+
+/** Jotai atomFamily entries are never GC'd — call on conversation switch/cleanup */
+export function removeUsageAtoms(conversationId: string): void {
+  branchTotalsFamily.remove(conversationId);
+  contextSnapshotFamily.remove(conversationId);
+  snapshotsByAnchorFamily.remove(conversationId);
+  pendingUsageFamily.remove(conversationId);
+  totalUsageFamily.remove(conversationId);
+  liveTokensFamily.remove(conversationId);
+  calibrationFamily.remove(conversationId);
+  foldedUsageKeys.delete(conversationId);
+}
+
+/**
+ * Rehydrates per-branch context breakdowns from persisted `metadata.contextUsage`
+ * into the snapshot-history map so the granular gauge survives a reload / opening
+ * an existing conversation. Merges, never clobbers — a live finalized snapshot
+ * for the same response id wins. Re-anchors each blob to its (branch-unique)
+ * response message id and reads the response's `tokenCount` as completed output.
+ */
+export function hydrateSnapshots(conversationId: string, messages?: TMessage[] | null): void {
+  if (messages == null || messages.length === 0) {
+    return;
+  }
+  const store = getDefaultStore();
+  const historyAtom = snapshotsByAnchorFamily(conversationId);
+  const current = store.get(historyAtom);
+  let next: Map<string, ContextSnapshot> | null = null;
+  for (const message of messages) {
+    const id = message?.messageId;
+    if (!id || current.has(id)) {
+      continue;
+    }
+    const blob = message.metadata?.contextUsage;
+    if (blob == null || typeof blob !== 'object') {
+      continue;
+    }
+    const event = blob as TContextUsageEvent;
+    /** Use ONLY the persisted post-snapshot delta (the final call's output). Do
+     *  NOT fall back to the full response `tokenCount`: the snapshot already
+     *  counts earlier steps' output for multi-call turns, so adding the whole
+     *  tokenCount would double-count after reload. Absent (rare: no usage event)
+     *  contributes 0, matching the snapshot's pre-final-call base. */
+    const snapshot: ContextSnapshot = {
+      ...event,
+      anchorMessageId: id,
+      completedOutputTokens: event.completedOutputTokens,
+    };
+    next ??= new Map(current);
+    next.set(id, snapshot);
+  }
+  if (next != null) {
+    store.set(historyAtom, next);
+  }
+}
diff --git a/client/src/style.css b/client/src/style.css
index 902860ef525..17fa19f7c6d 100644
--- a/client/src/style.css
+++ b/client/src/style.css
@@ -1496,6 +1496,27 @@ button {
   background-color: transparent;
 }
 
+.markdown-table-wrapper {
+  -webkit-overflow-scrolling: touch;
+  overflow-x: auto;
+  overscroll-behavior-x: contain;
+  padding-bottom: 0.25rem;
+  scrollbar-color: var(--border-medium) transparent;
+  scrollbar-width: thin;
+}
+
+.markdown-table-wrapper::-webkit-scrollbar {
+  height: 0.5rem;
+}
+
+.markdown-table-wrapper::-webkit-scrollbar-thumb {
+  background-color: var(--border-medium);
+}
+
+.markdown-table-wrapper::-webkit-scrollbar-thumb:hover {
+  background-color: var(--border-heavy);
+}
+
 /* Show scrollbar only on hover */
 .scrollbar-hover {
   scrollbar-width: thin;
@@ -2682,16 +2703,21 @@ html {
   color: var(--text-primary);
 }
 
-.account-settings-popover .select-item[data-active-item] {
-  box-shadow: 0 0 0 2px hsl(var(--ring));
-}
-
 .popover-ui[data-enter] {
   opacity: 1;
   scale: 1;
   translate: 0;
 }
 
+.popover-ui.popover-from-left {
+  transform-origin: left;
+  translate: -0.5rem 0;
+  margin-top: 0;
+}
+.popover-ui.popover-from-left[data-enter] {
+  translate: 0 0;
+}
+
 .animate-popover-top,
 .animate-popover {
   transform-origin: top;
diff --git a/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts b/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
index 44bfbb82f7a..f6e9411270a 100644
--- a/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
+++ b/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
@@ -118,6 +118,16 @@ describe('applyModelSpecEphemeralAgent', () => {
       const agent = updateEphemeralAgent.mock.calls[0][1] as TEphemeralAgent;
       expect(agent.artifacts).toBe('custom-renderer');
     });
+
+    it('should not copy model spec subagents into client ephemeral agent state', () => {
+      const subagents = { enabled: true, allowSelf: true, agent_ids: ['agent_private'] };
+      const modelSpec = createModelSpec({ subagents });
+
+      applyModelSpecEphemeralAgent({ convoId: null, modelSpec, updateEphemeralAgent });
+
+      const agent = updateEphemeralAgent.mock.calls[0][1] as TEphemeralAgent;
+      expect('subagents' in agent).toBe(false);
+    });
   });
 
   // ─── Existing Conversations: Per-Conversation Persistence ──────────
diff --git a/client/src/utils/__tests__/collection.test.ts b/client/src/utils/__tests__/collection.test.ts
index 04da2e22bcf..53bace714b2 100644
--- a/client/src/utils/__tests__/collection.test.ts
+++ b/client/src/utils/__tests__/collection.test.ts
@@ -323,7 +323,7 @@ describe('deleteData', () => {
   it('removes the matching item from its page', () => {
     const data = makeInfiniteData([{ items: [makeItem('a', 'Alpha'), makeItem('b', 'Beta')] }]);
 
-    const result = deleteData<Page, Item>(data, 'items', (page) =>
+    const result = deleteData<Page, InfiniteData<Page>>(data, 'items', (page) =>
       page.items.findIndex((i) => i.id === 'a'),
     );
 
@@ -334,7 +334,7 @@ describe('deleteData', () => {
   it('leaves data unchanged when item is not found', () => {
     const data = makeInfiniteData([{ items: [makeItem('a', 'Alpha')] }]);
 
-    const result = deleteData<Page, Item>(data, 'items', (page) =>
+    const result = deleteData<Page, InfiniteData<Page>>(data, 'items', (page) =>
       page.items.findIndex((i) => i.id === 'z'),
     );
 
diff --git a/client/src/utils/__tests__/configHtml.test.ts b/client/src/utils/__tests__/configHtml.test.ts
new file mode 100644
index 00000000000..70dd2427854
--- /dev/null
+++ b/client/src/utils/__tests__/configHtml.test.ts
@@ -0,0 +1,62 @@
+import {
+  CONFIG_HTML_BLOCK_TAGS,
+  CONFIG_HTML_CLASS_ATTR,
+  CONFIG_HTML_INLINE_TAGS,
+  CONFIG_HTML_MEDIA_ATTR,
+  CONFIG_HTML_MEDIA_TAGS,
+  createConfigHtmlSanitizer,
+  sanitizeConfigHtml,
+} from '../configHtml';
+
+describe('configHtml', () => {
+  it('removes active attributes and unsupported elements', () => {
+    const sanitized = sanitizeConfigHtml(
+      '<img src=x onerror="alert(1)"><a href="javascript:alert(1)" onclick="alert(1)"><strong>Learn</strong></a><script>alert(1)</script><svg onload="alert(1)"></svg>',
+    );
+
+    expect(sanitized).toBe(
+      '<a target="_blank" rel="noopener noreferrer"><strong>Learn</strong></a>',
+    );
+  });
+
+  it('keeps configured rich text tags and normalizes links', () => {
+    const sanitize = createConfigHtmlSanitizer({
+      allowedTags: CONFIG_HTML_BLOCK_TAGS,
+      allowedAttr: CONFIG_HTML_CLASS_ATTR,
+    });
+    const sanitized = sanitize(
+      '<p class="notice">Read <a href="https://example.com" target="_self"><strong>more</strong></a><br><code>safe</code></p>',
+    );
+
+    expect(sanitized).toBe(
+      '<p class="notice">Read <a href="https://example.com" target="_blank" rel="noopener noreferrer"><strong>more</strong></a><br><code>safe</code></p>',
+    );
+  });
+
+  it('keeps relative links but removes protocol-relative links', () => {
+    const sanitize = createConfigHtmlSanitizer({
+      allowedTags: CONFIG_HTML_INLINE_TAGS,
+    });
+    const sanitized = sanitize(
+      '<a href="/docs">Docs</a> <a href="//example.com/remote">Remote</a>',
+    );
+
+    expect(sanitized).toBe(
+      '<a href="/docs" target="_blank" rel="noopener noreferrer">Docs</a> <a target="_blank" rel="noopener noreferrer">Remote</a>',
+    );
+  });
+
+  it('keeps inline images with safe sources under media tags', () => {
+    const sanitize = createConfigHtmlSanitizer({
+      allowedTags: CONFIG_HTML_MEDIA_TAGS,
+      allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+    });
+    const sanitized = sanitize(
+      '<span>Powered by <img src="/assets/brand.svg" alt="Brand" onerror="alert(1)"> AI</span><img src="javascript:alert(1)">',
+    );
+
+    expect(sanitized).toBe(
+      '<span>Powered by <img src="/assets/brand.svg" alt="Brand"> AI</span><img>',
+    );
+  });
+});
diff --git a/client/src/utils/__tests__/getDefaultModelSpec.test.ts b/client/src/utils/__tests__/getDefaultModelSpec.test.ts
new file mode 100644
index 00000000000..7a8fe01818d
--- /dev/null
+++ b/client/src/utils/__tests__/getDefaultModelSpec.test.ts
@@ -0,0 +1,464 @@
+import { Constants, EModelEndpoint, LocalStorageKeys } from 'librechat-data-provider';
+import type { TModelSpec, TStartupConfig, TEndpointsConfig } from 'librechat-data-provider';
+import { getDefaultModelSpec } from '../endpoints';
+
+const createModelSpec = (name: string, overrides: Partial<TModelSpec> = {}): TModelSpec =>
+  ({
+    name,
+    label: name,
+    preset: {
+      endpoint: EModelEndpoint.openAI,
+      model: name,
+    },
+    ...overrides,
+  }) as TModelSpec;
+
+const createStartupConfig = (
+  list: TModelSpec[],
+  {
+    prioritize = true,
+    modelSelect = true,
+    addedEndpoints,
+  }: { prioritize?: boolean; modelSelect?: boolean; addedEndpoints?: string[] } = {},
+): TStartupConfig =>
+  ({
+    interface: {
+      modelSelect,
+    },
+    modelSpecs: {
+      prioritize,
+      list,
+      ...(addedEndpoints ? { addedEndpoints } : {}),
+    },
+  }) as TStartupConfig;
+
+const fullEndpointsConfig: TEndpointsConfig = {
+  [EModelEndpoint.openAI]: { order: 0 },
+  [EModelEndpoint.agents]: { order: 1 },
+};
+
+const agentsOnlyEndpointsConfig: TEndpointsConfig = {
+  [EModelEndpoint.agents]: { order: 0 },
+};
+
+const writeLastModel = (endpoint: string, model: string) => {
+  const stored = JSON.parse(localStorage.getItem(LocalStorageKeys.LAST_MODEL) ?? '{}') as Record<
+    string,
+    string
+  >;
+  stored[endpoint] = model;
+  localStorage.setItem(LocalStorageKeys.LAST_MODEL, JSON.stringify(stored));
+};
+
+/** Mirrors what the conversation effect persists after a spec preset is applied */
+const persistAppliedSpec = (spec: TModelSpec, conversationId: string = Constants.NEW_CONVO) => {
+  localStorage.setItem(LocalStorageKeys.LAST_SPEC, spec.name);
+  writeLastModel(spec.preset.endpoint as string, spec.preset.model as string);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({
+      conversationId,
+      endpoint: spec.preset.endpoint,
+      model: spec.preset.model,
+      spec: spec.name,
+    }),
+  );
+};
+
+/** Mirrors what the conversation effect persists after the user selects an agent */
+const persistAgentSelection = (agentId: string) => {
+  localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, agentId);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({
+      endpoint: EModelEndpoint.agents,
+      agent_id: agentId,
+      model: null,
+      spec: null,
+    }),
+  );
+};
+
+/** Mirrors what the conversation effect persists after an ephemeral endpoint → model pick */
+const persistEphemeralSelection = (endpoint: string, model: string) => {
+  writeLastModel(endpoint, model);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({ endpoint, model, spec: null }),
+  );
+};
+
+describe('getDefaultModelSpec', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('uses the soft default for a fresh user with no prior selection', () => {
+    const regularSpec = createModelSpec('regular-spec');
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+
+    const result = getDefaultModelSpec(createStartupConfig([regularSpec, softSpec]));
+
+    expect(result).toEqual({ softDefault: softSpec });
+  });
+
+  it('keeps the last selected spec before applying the soft default', () => {
+    const lastSpec = createModelSpec('last-spec');
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    persistAppliedSpec(lastSpec);
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec, lastSpec]));
+
+    expect(result).toEqual({ last: lastSpec });
+  });
+
+  it('does not apply the soft default when a prior model selection exists', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec]), fullEndpointsConfig);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('does not apply the soft default when a prior agent selection exists', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    persistAgentSelection('agent_123');
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec]), fullEndpointsConfig);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('keeps hard admin defaults ahead of user history and soft defaults', () => {
+    const hardSpec = createModelSpec('hard-spec', { default: true });
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    persistAppliedSpec(softSpec);
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec, hardSpec]));
+
+    expect(result).toEqual({ default: hardSpec });
+  });
+
+  it('preserves the legacy first-spec fallback when no soft default is configured', () => {
+    const firstSpec = createModelSpec('first-spec');
+    const secondSpec = createModelSpec('second-spec');
+
+    const result = getDefaultModelSpec(createStartupConfig([firstSpec, secondSpec]));
+
+    expect(result).toEqual({ default: firstSpec });
+  });
+
+  describe('soft default auto-application residue', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('stays soft after its own application is persisted (prioritized config)', () => {
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('stays soft after its own application is persisted (modelSelect config)', () => {
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('yields to an agent selected after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to an agent selection even with the prioritized config', () => {
+      persistAppliedSpec(softSpec);
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to an ephemeral endpoint → model pick after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to a different spec selected after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistAppliedSpec(otherSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ last: otherSpec });
+    });
+
+    it('treats a matching stored agent as residue when the soft default points to an agent', () => {
+      const softAgentSpec = createModelSpec('soft-agent-spec', {
+        softDefault: true,
+        preset: { endpoint: EModelEndpoint.agents, agent_id: 'agent_soft' },
+      } as Partial<TModelSpec>);
+      persistAppliedSpec(softAgentSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([softAgentSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softAgentSpec });
+    });
+
+    it('treats a stored model matching the soft default preset as residue', () => {
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('stays soft after the first conversation is sent', () => {
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('re-arms after viewing the soft conversation, even when an ephemeral pick lingers', () => {
+      persistEphemeralSelection(EModelEndpoint.anthropic, 'claude-sonnet-4-6');
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('re-arms after viewing the soft conversation, even when an agent pick lingers', () => {
+      localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_abc');
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('yields when a different agent is stored than the soft default agent spec', () => {
+      const softAgentSpec = createModelSpec('soft-agent-spec', {
+        softDefault: true,
+        preset: { endpoint: EModelEndpoint.agents, agent_id: 'agent_soft' },
+      } as Partial<TModelSpec>);
+      persistAgentSelection('agent_other');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([softAgentSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('soft default endpoint outside an added-endpoints allow-list', () => {
+    // Mirrors a softDefault spec on `bedrock` with `addedEndpoints: [agents, <custom>]`.
+    // The custom endpoint turns on the ephemeral-options gate, and a model used on
+    // that endpoint lingers under a different key than the spec preset — which used
+    // to suppress the soft default and strand New Chat on the unselectable bedrock.
+    const softSpec = createModelSpec('clickhouse-agent', {
+      softDefault: true,
+      preset: { endpoint: 'bedrock', model: 'claude-sonnet-4-6' },
+    } as Partial<TModelSpec>);
+    const otherSpec = createModelSpec('other-spec');
+    const allowListConfig = { addedEndpoints: ['agents', 'ClickHouse'] };
+    const allowListEndpoints = {
+      bedrock: { order: 0 },
+      ClickHouse: { order: 1 },
+      [EModelEndpoint.agents]: { order: 2 },
+    } as TEndpointsConfig;
+
+    it('re-arms on New Chat after viewing the soft conversation last', () => {
+      writeLastModel('ClickHouse', 'kimi-k2p7-code');
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], allowListConfig),
+        allowListEndpoints,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('still yields when a selectable endpoint was the last conversation', () => {
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+      persistEphemeralSelection('ClickHouse', 'kimi-k2p7-code');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], allowListConfig),
+        allowListEndpoints,
+      );
+
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('explicit soft default selection', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('keeps the soft default selected over older model history (prioritized config)', () => {
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('keeps the soft default selected over older model history (modelSelect config)', () => {
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+  });
+
+  describe('no ephemeral endpoint → model options (edge case)', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('applies the soft default despite a stored agent when modelSelect is disabled', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { modelSelect: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('applies the soft default despite a stored agent when addedEndpoints only includes agents', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents],
+        }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('applies the soft default despite a stored agent when agents is the only endpoint', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        agentsOnlyEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('still defers to the last selected spec', () => {
+      persistAppliedSpec(otherSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        agentsOnlyEndpointsConfig,
+      );
+
+      expect(result).toEqual({ last: otherSpec });
+    });
+
+    it('keeps the selection gate when addedEndpoints includes ephemeral endpoints', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents, EModelEndpoint.openAI],
+        }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('keeps the selection gate while the endpoints config has not loaded', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        undefined,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('detects an agents-only allow-list before the endpoints config loads', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents],
+        }),
+        undefined,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+  });
+});
diff --git a/client/src/utils/__tests__/getModelSpecIconURL.test.ts b/client/src/utils/__tests__/getModelSpecIconURL.test.ts
new file mode 100644
index 00000000000..fdab800e924
--- /dev/null
+++ b/client/src/utils/__tests__/getModelSpecIconURL.test.ts
@@ -0,0 +1,53 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TModelSpec } from 'librechat-data-provider';
+import { getModelSpecIconURL } from '../endpoints';
+
+describe('getModelSpecIconURL', () => {
+  it('returns the explicit model spec icon before preset values', () => {
+    const modelSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+      iconURL: EModelEndpoint.google,
+      preset: {
+        endpoint: EModelEndpoint.openAI,
+        iconURL: EModelEndpoint.anthropic,
+      },
+    } as TModelSpec;
+
+    expect(getModelSpecIconURL(modelSpec)).toBe(EModelEndpoint.google);
+  });
+
+  it('falls back to the preset icon URL when no spec icon is defined', () => {
+    const modelSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+      preset: {
+        endpoint: EModelEndpoint.google,
+        iconURL: EModelEndpoint.openAI,
+      },
+    } as TModelSpec;
+
+    expect(getModelSpecIconURL(modelSpec)).toBe(EModelEndpoint.openAI);
+  });
+
+  it('falls back to the preset endpoint when no icon URL is defined', () => {
+    const modelSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+      preset: {
+        endpoint: EModelEndpoint.google,
+      },
+    } as TModelSpec;
+
+    expect(getModelSpecIconURL(modelSpec)).toBe(EModelEndpoint.google);
+  });
+
+  it('returns an empty icon when a runtime model spec is missing preset data', () => {
+    const modelSpec = {
+      name: 'gemini-test',
+      label: 'Gemini Test',
+    } as TModelSpec;
+
+    expect(getModelSpecIconURL(modelSpec)).toBe('');
+  });
+});
diff --git a/client/src/utils/__tests__/icons.test.ts b/client/src/utils/__tests__/icons.test.ts
new file mode 100644
index 00000000000..490b968f689
--- /dev/null
+++ b/client/src/utils/__tests__/icons.test.ts
@@ -0,0 +1,17 @@
+import { isImageURL } from '../icons';
+
+describe('isImageURL', () => {
+  it.each(['https://example.com/icon.png', 'http://example.com/icon.png', '/assets/icon.svg'])(
+    'accepts image URL %s',
+    (iconURL) => {
+      expect(isImageURL(iconURL)).toBe(true);
+    },
+  );
+
+  it.each(['openAI', 'anthropic', 'assets/icon.svg', '//example.com/icon.png', '', null])(
+    'rejects non-image URL %s',
+    (iconURL) => {
+      expect(isImageURL(iconURL)).toBe(false);
+    },
+  );
+});
diff --git a/client/src/utils/__tests__/localStorage.test.ts b/client/src/utils/__tests__/localStorage.test.ts
new file mode 100644
index 00000000000..18918ce1877
--- /dev/null
+++ b/client/src/utils/__tests__/localStorage.test.ts
@@ -0,0 +1,29 @@
+import { LocalStorageKeys } from 'librechat-data-provider';
+import { clearAllConversationStorage } from '../localStorage';
+
+describe('clearAllConversationStorage', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('wipes the selection and conversation state but keeps unrelated keys', () => {
+    localStorage.setItem(LocalStorageKeys.LAST_SPEC, 'some-spec');
+    localStorage.setItem(LocalStorageKeys.LAST_MODEL, JSON.stringify({ openAI: 'gpt-4o' }));
+    localStorage.setItem(LocalStorageKeys.LAST_TOOLS, JSON.stringify(['web_search']));
+    localStorage.setItem(
+      `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+      JSON.stringify({ spec: 'some-spec' }),
+    );
+    localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_1');
+    localStorage.setItem('unrelated-key', 'keep-me');
+
+    clearAllConversationStorage();
+
+    expect(localStorage.getItem(LocalStorageKeys.LAST_SPEC)).toBeNull();
+    expect(localStorage.getItem(LocalStorageKeys.LAST_MODEL)).toBeNull();
+    expect(localStorage.getItem(LocalStorageKeys.LAST_TOOLS)).toBeNull();
+    expect(localStorage.getItem(`${LocalStorageKeys.LAST_CONVO_SETUP}_0`)).toBeNull();
+    expect(localStorage.getItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`)).toBeNull();
+    expect(localStorage.getItem('unrelated-key')).toBe('keep-me');
+  });
+});
diff --git a/client/src/utils/__tests__/messages.test.ts b/client/src/utils/__tests__/messages.test.ts
index 4af9f694395..b919441348a 100644
--- a/client/src/utils/__tests__/messages.test.ts
+++ b/client/src/utils/__tests__/messages.test.ts
@@ -1,6 +1,11 @@
 import type { TMessage } from 'librechat-data-provider';
 import type { LocalizeFunction } from '~/common';
-import { getMessageAriaLabel, getHeaderPrefixForScreenReader } from '../messages';
+import {
+  isValidTimestamp,
+  getMessageAriaLabel,
+  getMessageTimestamp,
+  getHeaderPrefixForScreenReader,
+} from '../messages';
 
 const translations: Record<string, string> = {
   com_endpoint_message: 'Message',
@@ -80,3 +85,70 @@ describe('getHeaderPrefixForScreenReader', () => {
     expect(getHeaderPrefixForScreenReader(msg, localize)).toBe('Response: ');
   });
 });
+
+describe('isValidTimestamp', () => {
+  it('returns false for missing values', () => {
+    expect(isValidTimestamp(undefined)).toBe(false);
+    expect(isValidTimestamp(null)).toBe(false);
+    expect(isValidTimestamp('')).toBe(false);
+  });
+
+  it('returns false for unparseable strings', () => {
+    expect(isValidTimestamp('not-a-date')).toBe(false);
+  });
+
+  it('returns true for ISO date strings', () => {
+    expect(isValidTimestamp('2026-06-12T15:42:00.000Z')).toBe(true);
+  });
+});
+
+describe('getMessageTimestamp', () => {
+  const NOW = new Date('2026-06-12T15:42:00.000Z').getTime();
+
+  beforeEach(() => {
+    jest.useFakeTimers().setSystemTime(NOW);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('returns null for missing or invalid values', () => {
+    expect(getMessageTimestamp(undefined, 'en-US')).toBeNull();
+    expect(getMessageTimestamp(null, 'en-US')).toBeNull();
+    expect(getMessageTimestamp('not-a-date', 'en-US')).toBeNull();
+  });
+
+  it('formats relative and absolute time for a recent message', () => {
+    const twoHoursAgo = new Date(NOW - 2 * 60 * 60 * 1000).toISOString();
+    const result = getMessageTimestamp(twoHoursAgo, 'en-US');
+    expect(result).not.toBeNull();
+    expect(result?.relative).toBe('2 hours ago');
+    expect(result?.iso).toBe(twoHoursAgo);
+    expect(result?.absolute).toContain('2026');
+  });
+
+  it('flags messages under 24h as recent (prefer relative)', () => {
+    const justUnderADay = new Date(NOW - 23 * 60 * 60 * 1000).toISOString();
+    expect(getMessageTimestamp(justUnderADay, 'en-US')?.isRecent).toBe(true);
+  });
+
+  it('flags older messages as not recent (prefer absolute date)', () => {
+    const overADay = new Date(NOW - 25 * 60 * 60 * 1000).toISOString();
+    const monthAgo = new Date(NOW - 38 * 24 * 60 * 60 * 1000).toISOString();
+    expect(getMessageTimestamp(overADay, 'en-US')?.isRecent).toBe(false);
+    expect(getMessageTimestamp(monthAgo, 'en-US')?.isRecent).toBe(false);
+  });
+
+  it('uses "now" for the current instant', () => {
+    const result = getMessageTimestamp(new Date(NOW).toISOString(), 'en-US');
+    expect(result?.relative).toBe('now');
+    expect(result?.isRecent).toBe(true);
+  });
+
+  it('falls back to the default locale for a malformed locale tag', () => {
+    const iso = new Date(NOW - 60 * 1000).toISOString();
+    expect(() => getMessageTimestamp(iso, 'not a locale!!')).not.toThrow();
+    expect(getMessageTimestamp(iso, 'not a locale!!')).not.toBeNull();
+  });
+});
diff --git a/client/src/utils/__tests__/validateFiles.spec.ts b/client/src/utils/__tests__/validateFiles.spec.ts
index 6d690bf62a9..b7f13d64741 100644
--- a/client/src/utils/__tests__/validateFiles.spec.ts
+++ b/client/src/utils/__tests__/validateFiles.spec.ts
@@ -98,6 +98,22 @@ describe('validateFiles', () => {
     expect(setError).toHaveBeenCalledWith('Unsupported file type: application/x-unknown');
   });
 
+  it('normalizes Windows ZIP MIME type before validation', () => {
+    const fileList = [makeFile('archive.zip', 'application/x-zip-compressed', 1024)];
+    const result = validateFiles({ files, fileList, setError, endpointFileConfig, fileConfig });
+    expect(result).toBe(true);
+    expect(fileList[0].type).toBe('application/zip');
+    expect(setError).not.toHaveBeenCalled();
+  });
+
+  it('infers ZIP MIME type when the browser does not provide one', () => {
+    const fileList = [makeFile('archive.zip', '', 1024)];
+    const result = validateFiles({ files, fileList, setError, endpointFileConfig, fileConfig });
+    expect(result).toBe(true);
+    expect(fileList[0].type).toBe('application/zip');
+    expect(setError).not.toHaveBeenCalled();
+  });
+
   it('rejects when file size equals fileSizeLimit (>= comparison)', () => {
     const limit = 5 * megabyte;
     endpointFileConfig = makeEndpointConfig({ fileSizeLimit: limit });
diff --git a/client/src/utils/artifacts.ts b/client/src/utils/artifacts.ts
index 264c8f9e300..b5ff9552e71 100644
--- a/client/src/utils/artifacts.ts
+++ b/client/src/utils/artifacts.ts
@@ -178,9 +178,14 @@ export const sharedOptions: SandpackProviderProps['options'] = {
   externalResources: [TAILWIND_CDN],
 };
 
+export type SandpackStartupConfig = Pick<
+  Partial<TStartupConfig>,
+  'bundlerURL' | 'staticBundlerURL'
+>;
+
 export function buildSandpackOptions(
   template: SandpackProviderProps['template'],
-  startupConfig?: TStartupConfig,
+  startupConfig?: SandpackStartupConfig,
 ): SandpackProviderProps['options'] {
   if (!startupConfig) {
     return sharedOptions;
diff --git a/client/src/utils/configHtml.ts b/client/src/utils/configHtml.ts
new file mode 100644
index 00000000000..8c0cbddcd7d
--- /dev/null
+++ b/client/src/utils/configHtml.ts
@@ -0,0 +1,47 @@
+import DOMPurify from 'dompurify';
+
+export const CONFIG_HTML_INLINE_TAGS = ['a', 'strong', 'b', 'em', 'i', 'br', 'code'] as const;
+export const CONFIG_HTML_TEXT_TAGS = [...CONFIG_HTML_INLINE_TAGS, 'span'] as const;
+export const CONFIG_HTML_BLOCK_TAGS = [...CONFIG_HTML_TEXT_TAGS, 'p'] as const;
+export const CONFIG_HTML_MEDIA_TAGS = [...CONFIG_HTML_TEXT_TAGS, 'img'] as const;
+export const CONFIG_HTML_LINK_ATTR = ['href', 'target', 'rel'] as const;
+export const CONFIG_HTML_CLASS_ATTR = [...CONFIG_HTML_LINK_ATTR, 'class'] as const;
+export const CONFIG_HTML_MEDIA_ATTR = [...CONFIG_HTML_CLASS_ATTR, 'src', 'alt'] as const;
+
+const CONFIG_HTML_SAFE_URI =
+  /^(?:(?:https?|mailto|tel):|(?!(?:\s*[a-z][a-z0-9+.-]*:|\s*\/\/))[\s\S])/i;
+
+type ConfigHtmlSanitizerOptions = {
+  allowedTags?: readonly string[];
+  allowedAttr?: readonly string[];
+};
+
+export function createConfigHtmlSanitizer({
+  allowedTags = CONFIG_HTML_INLINE_TAGS,
+  allowedAttr = CONFIG_HTML_LINK_ATTR,
+}: ConfigHtmlSanitizerOptions = {}) {
+  const sanitizer = DOMPurify();
+  sanitizer.addHook('afterSanitizeAttributes', (node) => {
+    if (node.tagName === 'A') {
+      node.setAttribute('target', '_blank');
+      node.setAttribute('rel', 'noopener noreferrer');
+    }
+  });
+
+  return (html?: string | null): string => {
+    if (!html) {
+      return '';
+    }
+    return sanitizer.sanitize(html, {
+      ALLOWED_TAGS: [...allowedTags],
+      ALLOWED_ATTR: [...allowedAttr],
+      ALLOWED_URI_REGEXP: CONFIG_HTML_SAFE_URI,
+      ALLOW_DATA_ATTR: false,
+      ALLOW_ARIA_ATTR: false,
+    });
+  };
+}
+
+export function sanitizeConfigHtml(html?: string | null, options?: ConfigHtmlSanitizerOptions) {
+  return createConfigHtmlSanitizer(options)(html);
+}
diff --git a/client/src/utils/conversation.ts b/client/src/utils/conversation.ts
new file mode 100644
index 00000000000..31cdc39ebe1
--- /dev/null
+++ b/client/src/utils/conversation.ts
@@ -0,0 +1,5 @@
+import type { TConversation } from 'librechat-data-provider';
+
+export const isTemporaryConversation = (conversation?: Partial<TConversation> | null): boolean =>
+  conversation?.isTemporary === true ||
+  (conversation?.isTemporary === undefined && conversation?.expiredAt != null);
diff --git a/client/src/utils/conversationTags.spec.ts b/client/src/utils/conversationTags.spec.ts
index 10eb336682f..9bacd504b53 100644
--- a/client/src/utils/conversationTags.spec.ts
+++ b/client/src/utils/conversationTags.spec.ts
@@ -7,6 +7,7 @@ describe('ConversationTag Utilities', () => {
   beforeEach(() => {
     conversations = [
       {
+        _id: 'tag-id-saved',
         tag: 'saved',
         count: 1,
         position: 0,
@@ -16,6 +17,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-1',
         tag: 'tag1',
         count: 1,
         position: 1,
@@ -25,6 +27,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-2',
         tag: 'tag2',
         count: 20,
         position: 2,
@@ -34,6 +37,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-3',
         tag: 'tag3',
         count: 30,
         position: 3,
@@ -43,6 +47,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-4',
         tag: 'tag4',
         count: 40,
         position: 4,
@@ -52,6 +57,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-5',
         tag: 'tag5',
         count: 50,
         position: 5,
@@ -175,6 +181,7 @@ describe('ConversationTag Utilities', () => {
       conversations,
       { tag: 'newtag', description: 'newDescription' },
       {
+        _id: 'tag-id-newtag',
         tag: 'newtag',
         description: 'newDescription',
         position: 1,
@@ -208,6 +215,7 @@ describe('ConversationTag Utilities', () => {
       [],
       { tag: 'newtag', description: 'newDescription' },
       {
+        _id: 'tag-id-saved',
         tag: 'saved',
         description: 'newDescription',
         position: 0,
diff --git a/client/src/utils/convos.spec.ts b/client/src/utils/convos.spec.ts
index c00cb200856..6159aa2e126 100644
--- a/client/src/utils/convos.spec.ts
+++ b/client/src/utils/convos.spec.ts
@@ -10,6 +10,7 @@ import {
   groupConversationsByDate,
   updateConvoFieldsInfinite,
   addConvoToAllQueries,
+  upsertConvoInAllQueries,
   updateConvoInAllQueries,
   removeConvoFromAllQueries,
   addConversationToAllConversationsQueries,
@@ -144,6 +145,23 @@ describe('Conversation Utilities', () => {
       expect(grouped[1][1].length).toBe(1);
     });
 
+    it('excludes pinned conversations from date groups', () => {
+      const conversations = [
+        { conversationId: '1', updatedAt: new Date().toISOString(), pinned: true },
+        { conversationId: '2', updatedAt: new Date().toISOString() },
+        { conversationId: '3', updatedAt: '2023-06-01T12:00:00Z', pinned: true },
+        { conversationId: '4', updatedAt: '2023-06-01T12:00:00Z' },
+      ];
+
+      const grouped = groupConversationsByDate(conversations as TConversation[]);
+
+      const allGroupedIds = grouped.flatMap(([, convs]) => convs.map((c) => c.conversationId));
+      expect(allGroupedIds).not.toContain('1');
+      expect(allGroupedIds).not.toContain('3');
+      expect(allGroupedIds).toContain('2');
+      expect(allGroupedIds).toContain('4');
+    });
+
     it('correctly groups and sorts conversations for every month of the year', () => {
       const months = [
         'january',
@@ -590,6 +608,47 @@ describe('Conversation Utilities', () => {
         expect(data!.pages[0].conversations.filter((c) => c.conversationId === 'a').length).toBe(1);
       });
 
+      it('upsertConvoInAllQueries adds missing conversations to the top', () => {
+        upsertConvoInAllQueries(queryClient, convoB);
+        const data = queryClient.getQueryData<InfiniteData<{ conversations: TConversation[] }>>([
+          'allConversations',
+        ]);
+
+        expect(data!.pages[0].conversations[0].conversationId).toBe('b');
+        expect(data!.pages[0].conversations[1].conversationId).toBe('a');
+      });
+
+      it('upsertConvoInAllQueries updates existing conversations without duplicating them', () => {
+        upsertConvoInAllQueries(queryClient, {
+          ...convoA,
+          title: 'Updated Conversation A',
+        });
+        const data = queryClient.getQueryData<InfiniteData<{ conversations: TConversation[] }>>([
+          'allConversations',
+        ]);
+
+        expect(data!.pages[0].conversations).toHaveLength(1);
+        expect(data!.pages[0].conversations[0].title).toBe('Updated Conversation A');
+      });
+
+      it('upsertConvoInAllQueries moves an existing conversation to the top once', () => {
+        const convoC = { conversationId: 'c', updatedAt: '2024-01-03T12:00:00Z' } as TConversation;
+        queryClient.setQueryData(['allConversations'], {
+          pages: [{ conversations: [convoC, convoA], nextCursor: null }],
+          pageParams: [],
+        });
+
+        upsertConvoInAllQueries(queryClient, {
+          ...convoA,
+          title: 'Updated Conversation A',
+        });
+        const data = queryClient.getQueryData<InfiniteData<{ conversations: TConversation[] }>>([
+          'allConversations',
+        ]);
+
+        expect(data!.pages[0].conversations.map((c) => c.conversationId)).toEqual(['a', 'c']);
+      });
+
       it('updateConvoInAllQueries updates correct convo', () => {
         updateConvoInAllQueries(queryClient, 'a', (c) => ({ ...c, model: 'gpt-4' }));
         const data = queryClient.getQueryData<InfiniteData<any>>(['allConversations']);
diff --git a/client/src/utils/convos.ts b/client/src/utils/convos.ts
index e92d75d2daa..c22853b2df3 100644
--- a/client/src/utils/convos.ts
+++ b/client/src/utils/convos.ts
@@ -78,6 +78,7 @@ const dateGroupsSet = new Set([
 
 export const groupConversationsByDate = (
   conversations: Array<TConversation | null>,
+  dateField: 'updatedAt' | 'createdAt' = 'updatedAt',
 ): GroupedConversations => {
   if (!Array.isArray(conversations)) {
     return [];
@@ -87,14 +88,19 @@ export const groupConversationsByDate = (
   const now = new Date(Date.now());
 
   conversations.forEach((conversation) => {
-    if (!conversation || seenConversationIds.has(conversation.conversationId)) {
+    if (
+      !conversation ||
+      seenConversationIds.has(conversation.conversationId) ||
+      conversation.pinned
+    ) {
       return;
     }
     seenConversationIds.add(conversation.conversationId);
 
     let date: Date;
-    if (conversation.updatedAt) {
-      date = parseISO(conversation.updatedAt);
+    const dateValue = conversation[dateField] ?? conversation.updatedAt ?? conversation.createdAt;
+    if (dateValue) {
+      date = parseISO(dateValue);
     } else {
       date = now;
     }
@@ -131,7 +137,8 @@ export const groupConversationsByDate = (
   sortedGroups.forEach((conversations) => {
     conversations.sort(
       (a: TConversation, b: TConversation) =>
-        new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime(),
+        new Date(b[dateField] ?? b.updatedAt ?? 0).getTime() -
+        new Date(a[dateField] ?? a.updatedAt ?? 0).getTime(),
     );
   });
   return Array.from(sortedGroups, ([key, value]) => [key, value]);
@@ -142,6 +149,40 @@ export type ConversationCursorData = {
   nextCursor?: string | null;
 };
 
+function getConversationQueryProjectId(queryKey: readonly unknown[]): string | undefined {
+  const params = queryKey[1];
+  if (!params || typeof params !== 'object') {
+    return undefined;
+  }
+  return (params as { projectId?: string }).projectId;
+}
+
+function conversationMatchesProjectQuery(
+  queryKey: readonly unknown[],
+  conversation: Pick<TConversation, 'chatProjectId'>,
+): boolean {
+  const projectId = getConversationQueryProjectId(queryKey);
+  if (!projectId) {
+    return true;
+  }
+  if (projectId === 'unassigned') {
+    return !conversation.chatProjectId;
+  }
+  return conversation.chatProjectId === projectId;
+}
+
+/**
+ * Reads the project id from the current URL's `?projectId` param — the source of
+ * truth for a new chat's project scope (the conversation atom can lag behind it).
+ */
+export function getRouteChatProjectId(): string | null {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  const projectId = new URLSearchParams(window.location.search).get('projectId');
+  return projectId != null && /^[a-f\d]{24}$/i.test(projectId) ? projectId : null;
+}
+
 // === InfiniteData helpers for cursor-based convo queries ===
 
 export function findConversationInInfinite(
@@ -208,6 +249,9 @@ export function addConversationToAllConversationsQueries(
     .findAll([QueryKeys.allConversations], { exact: false });
 
   for (const query of queries) {
+    if (!conversationMatchesProjectQuery(query.queryKey, newConversation)) {
+      continue;
+    }
     queryClient.setQueryData<InfiniteData<ConversationCursorData>>(query.queryKey, (old) => {
       if (
         !old ||
@@ -322,6 +366,9 @@ export function addConvoToAllQueries(queryClient: QueryClient, newConvo: TConver
     .findAll([QueryKeys.allConversations], { exact: false });
 
   for (const query of queries) {
+    if (!conversationMatchesProjectQuery(query.queryKey, newConvo)) {
+      continue;
+    }
     queryClient.setQueryData<InfiniteData<ConversationCursorData>>(query.queryKey, (oldData) => {
       if (!oldData) {
         return oldData;
@@ -347,6 +394,106 @@ export function addConvoToAllQueries(queryClient: QueryClient, newConvo: TConver
   }
 }
 
+export function upsertConvoInAllQueries(
+  queryClient: QueryClient,
+  nextConvo: TConversation,
+  moveToTop = true,
+) {
+  if (!nextConvo.conversationId) {
+    return;
+  }
+
+  const queries = queryClient
+    .getQueryCache()
+    .findAll([QueryKeys.allConversations], { exact: false });
+
+  for (const query of queries) {
+    queryClient.setQueryData<InfiniteData<ConversationCursorData>>(query.queryKey, (oldData) => {
+      if (!oldData) {
+        return oldData;
+      }
+
+      let pageIdx = -1;
+      let convoIdx = -1;
+      for (let pi = 0; pi < oldData.pages.length; pi++) {
+        const ci = oldData.pages[pi].conversations.findIndex(
+          (c) => c.conversationId === nextConvo.conversationId,
+        );
+        if (ci !== -1) {
+          pageIdx = pi;
+          convoIdx = ci;
+          break;
+        }
+      }
+
+      const now = new Date().toISOString();
+      if (pageIdx === -1) {
+        if (!conversationMatchesProjectQuery(query.queryKey, nextConvo)) {
+          return oldData;
+        }
+        const firstPage = oldData.pages[0] ?? { conversations: [], nextCursor: null };
+        return {
+          ...oldData,
+          pages: [
+            {
+              ...firstPage,
+              conversations: [
+                { ...nextConvo, updatedAt: nextConvo.updatedAt ?? now },
+                ...firstPage.conversations,
+              ],
+            },
+            ...oldData.pages.slice(1),
+          ],
+        };
+      }
+
+      const found = oldData.pages[pageIdx].conversations[convoIdx];
+      const updated = {
+        ...found,
+        ...nextConvo,
+        updatedAt: nextConvo.updatedAt ?? (moveToTop ? now : found.updatedAt),
+      };
+
+      if (!conversationMatchesProjectQuery(query.queryKey, updated)) {
+        return removeConvoFromInfinitePages(oldData, updated.conversationId ?? '');
+      }
+
+      if (!moveToTop || (pageIdx === 0 && convoIdx === 0)) {
+        return {
+          ...oldData,
+          pages: oldData.pages.map((page, pi) =>
+            pi === pageIdx
+              ? {
+                  ...page,
+                  conversations: page.conversations.map((c, ci) => (ci === convoIdx ? updated : c)),
+                }
+              : page,
+          ),
+        };
+      }
+
+      const pages = oldData.pages.map((page, pi) => {
+        if (pi === 0 && pageIdx === 0) {
+          const conversations = page.conversations.filter((_, ci) => ci !== convoIdx);
+          return { ...page, conversations: [updated, ...conversations] };
+        }
+        if (pi === 0) {
+          return { ...page, conversations: [updated, ...page.conversations] };
+        }
+        if (pi === pageIdx) {
+          return {
+            ...page,
+            conversations: page.conversations.filter((_, ci) => ci !== convoIdx),
+          };
+        }
+        return page;
+      });
+
+      return { ...oldData, pages };
+    });
+  }
+}
+
 // Update
 export function updateConvoInAllQueries(
   queryClient: QueryClient,
@@ -387,6 +534,10 @@ export function updateConvoInAllQueries(
         ? { ...updater(found), updatedAt: new Date().toISOString() }
         : updater(found);
 
+      if (!conversationMatchesProjectQuery(query.queryKey, updated)) {
+        return removeConvoFromInfinitePages(oldData, conversationId);
+      }
+
       // If not moving to top, or already at top of page 0, update in place
       if (!moveToTop || (pageIdx === 0 && convoIdx === 0)) {
         return {
diff --git a/client/src/utils/endpoints.ts b/client/src/utils/endpoints.ts
index a27f71b8e9b..3143bb11151 100644
--- a/client/src/utils/endpoints.ts
+++ b/client/src/utils/endpoints.ts
@@ -137,6 +137,81 @@ interface InitiatedTemplateResult {
   newEndpointType: EModelEndpoint | undefined;
 }
 
+type StoredModelSelection = Pick<
+  t.TConversation,
+  'endpoint' | 'model' | 'spec' | 'agent_id' | 'assistant_id'
+>;
+
+function hasSelectionValue(value?: string | null): boolean {
+  return typeof value === 'string' && value.trim() !== '';
+}
+
+function parseStoredModelSelection(
+  value: string | null,
+): Partial<StoredModelSelection> | undefined {
+  if (!value) {
+    return;
+  }
+
+  try {
+    return JSON.parse(value) as Partial<StoredModelSelection>;
+  } catch {
+    return;
+  }
+}
+
+export function hasModelSelection(selection?: Partial<StoredModelSelection> | null): boolean {
+  if (!selection) {
+    return false;
+  }
+
+  return (
+    hasSelectionValue(selection.spec) ||
+    hasSelectionValue(selection.agent_id) ||
+    hasSelectionValue(selection.assistant_id) ||
+    hasSelectionValue(selection.model) ||
+    hasSelectionValue(selection.endpoint)
+  );
+}
+
+/**
+ * Whether the selector offers any ephemeral endpoint → model options.
+ * False when the endpoints menu is hidden (`modelSelect` disabled) or only
+ * agents/assistants picks remain; an empty endpoints config means not loaded.
+ */
+function hasEphemeralModelOptions({
+  endpointsConfig,
+  addedEndpoints,
+  modelSelect,
+}: {
+  endpointsConfig?: t.TEndpointsConfig;
+  addedEndpoints?: Array<EModelEndpoint | string>;
+  modelSelect?: boolean;
+}): boolean {
+  if (!modelSelect) {
+    return false;
+  }
+  const included = new Set(addedEndpoints ?? []);
+  const includesEphemeral =
+    included.size === 0 ||
+    [...included].some(
+      (endpoint) => !isAgentsEndpoint(endpoint) && !isAssistantsEndpoint(endpoint),
+    );
+  if (!includesEphemeral) {
+    return false;
+  }
+  if (endpointsConfig == null || Object.keys(endpointsConfig).length === 0) {
+    return true;
+  }
+  return Object.entries(endpointsConfig).some(
+    ([endpoint, config]) =>
+      config != null &&
+      !isAgentsEndpoint(endpoint) &&
+      !isAssistantsEndpoint(endpoint) &&
+      (included.size === 0 || included.has(endpoint)),
+  );
+}
+
 /** Get the conditional logic for switching conversations */
 export function getConvoSwitchLogic(params: ConversationInitParams): InitiatedTemplateResult {
   const { conversation, newEndpoint, endpointsConfig, modularChat = false } = params;
@@ -268,36 +343,68 @@ export function applyModelSpecEphemeralAgent({
 }
 
 /**
- * Gets default model spec from config and user preferences.
- * Priority: admin default → last selected → first spec (when prioritize=true or modelSelect disabled).
- * Otherwise: admin default or last conversation spec.
+ * Resolves the default model spec for a new chat. Priority: hard admin default →
+ * the most recent conversation's own selection → soft default → legacy first spec.
+ *
+ * `LAST_CONVO_SETUP_0` is the single source of truth for prior intent: a setup naming
+ * the soft spec is the soft default re-arming, any other spec/agent/endpoint is a
+ * selection to carry forward, and an empty setup is a fresh start (clearing chats
+ * wipes the selection, so a new chat then falls to the soft default). The soft default
+ * also wins whenever the selector offers no ephemeral endpoint → model options, so a
+ * stale agent never strands it. The legacy first-spec fallback applies only when specs
+ * are prioritized (or the model menu is hidden) and no soft default is configured.
  */
-export function getDefaultModelSpec(startupConfig?: t.TStartupConfig):
+export function getDefaultModelSpec(
+  startupConfig?: t.TStartupConfig,
+  endpointsConfig?: t.TEndpointsConfig,
+):
   | {
       default?: t.TModelSpec;
       last?: t.TModelSpec;
+      softDefault?: t.TModelSpec;
     }
   | undefined {
   const { modelSpecs, interface: interfaceConfig } = startupConfig ?? {};
-  const { list, prioritize } = modelSpecs ?? {};
+  const { list, prioritize, addedEndpoints } = modelSpecs ?? {};
   if (!list) {
     return;
   }
-  const defaultSpec = list?.find((spec) => spec.default);
-  if (prioritize === true || !interfaceConfig?.modelSelect) {
-    const lastSelectedSpecName = localStorage.getItem(LocalStorageKeys.LAST_SPEC);
-    const lastSelectedSpec = list?.find((spec) => spec.name === lastSelectedSpecName);
-    return { default: defaultSpec || lastSelectedSpec || list?.[0] };
-  } else if (defaultSpec) {
+
+  const defaultSpec = list.find((spec) => spec.default);
+  if (defaultSpec) {
     return { default: defaultSpec };
   }
-  const lastConversationSetup = JSON.parse(
-    localStorage.getItem(LocalStorageKeys.LAST_CONVO_SETUP + '_0') ?? '{}',
+
+  const softDefaultSpec = list.find((spec) => spec.softDefault);
+  const lastSetup = parseStoredModelSelection(
+    localStorage.getItem(LocalStorageKeys.LAST_CONVO_SETUP + '_0'),
   );
-  if (!lastConversationSetup.spec) {
-    return;
+  const lastSpec = hasSelectionValue(lastSetup?.spec)
+    ? list.find((spec) => spec.name === lastSetup?.spec)
+    : undefined;
+
+  if (lastSpec && lastSpec.name !== softDefaultSpec?.name) {
+    return { last: lastSpec };
+  }
+
+  if (softDefaultSpec) {
+    if (lastSpec?.name === softDefaultSpec.name) {
+      return { softDefault: softDefaultSpec };
+    }
+    const yieldsToSelection =
+      hasModelSelection(lastSetup) &&
+      hasEphemeralModelOptions({
+        endpointsConfig,
+        addedEndpoints,
+        modelSelect: interfaceConfig?.modelSelect,
+      });
+    return yieldsToSelection ? undefined : { softDefault: softDefaultSpec };
   }
-  return { last: list?.find((spec) => spec.name === lastConversationSetup.spec) };
+
+  if (prioritize === true || interfaceConfig?.modelSelect !== true) {
+    return { default: list[0] };
+  }
+  return;
 }
 
 export function getModelSpecPreset(modelSpec?: t.TModelSpec) {
@@ -335,12 +442,9 @@ export function mergeQuerySettingsWithSpec(
   };
 }
 
-/** Gets the default spec iconURL by order or definition.
- *
- * First, the admin defined default, then last selected spec, followed by first spec
- */
+/** Gets the model spec iconURL by explicit icon, preset icon, then preset endpoint. */
 export function getModelSpecIconURL(modelSpec: t.TModelSpec) {
-  return modelSpec.iconURL ?? modelSpec.preset.iconURL ?? modelSpec.preset.endpoint ?? '';
+  return modelSpec.iconURL ?? modelSpec.preset?.iconURL ?? modelSpec.preset?.endpoint ?? '';
 }
 
 /** Gets the default frontend-facing endpoint, dependent on iconURL definition.
diff --git a/client/src/utils/heicConverter.spec.ts b/client/src/utils/heicConverter.spec.ts
new file mode 100644
index 00000000000..59b30b2306c
--- /dev/null
+++ b/client/src/utils/heicConverter.spec.ts
@@ -0,0 +1,47 @@
+describe('heicConverter', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('does not load heic-to for non-HEIC files', async () => {
+    jest.doMock(
+      'heic-to',
+      () => {
+        throw new Error('heic-to should not be loaded');
+      },
+      { virtual: true },
+    );
+
+    const { processFileForUpload } = await import('./heicConverter');
+    const file = new File(['plain text'], 'notes.txt', { type: 'text/plain' });
+
+    await expect(processFileForUpload(file)).resolves.toBe(file);
+  });
+
+  it('detects and converts HEIC files after lazily loading heic-to', async () => {
+    const isHeic = jest.fn(async () => true);
+    const heicTo = jest.fn(async () => new Blob(['jpeg'], { type: 'image/jpeg' }));
+    jest.doMock('heic-to', () => ({ heicTo, isHeic }), { virtual: true });
+
+    const { processFileForUpload } = await import('./heicConverter');
+    const file = new File(['heic data'], 'photo.heic', {
+      type: 'image/heic',
+      lastModified: 123,
+    });
+    const onProgress = jest.fn();
+
+    const converted = await processFileForUpload(file, 0.85, onProgress);
+
+    expect(isHeic).toHaveBeenCalledWith(file);
+    expect(heicTo).toHaveBeenCalledWith({
+      blob: file,
+      type: 'image/jpeg',
+      quality: 0.85,
+    });
+    expect(converted).not.toBe(file);
+    expect(converted.name).toBe('photo.jpg');
+    expect(converted.type).toBe('image/jpeg');
+    expect(converted.lastModified).toBe(123);
+    expect(onProgress.mock.calls.map(([progress]) => progress)).toEqual([0.3, 0.8, 1]);
+  });
+});
diff --git a/client/src/utils/heicConverter.ts b/client/src/utils/heicConverter.ts
index a14e09a0508..46dc7d929a1 100644
--- a/client/src/utils/heicConverter.ts
+++ b/client/src/utils/heicConverter.ts
@@ -1,4 +1,19 @@
-import { heicTo, isHeic } from 'heic-to';
+const HEIC_MIME_TYPES = new Set(['image/heic', 'image/heif']);
+const HEIC_EXTENSION_REGEX = /\.(heic|heif)$/i;
+type HeicToModule = typeof import('heic-to');
+
+let heicConverterPromise: Promise<HeicToModule> | null = null;
+
+const loadHeicConverter = async (): Promise<HeicToModule> => {
+  heicConverterPromise ??= import('heic-to').catch((error) => {
+    heicConverterPromise = null;
+    throw error;
+  });
+  return heicConverterPromise;
+};
+
+const hasHEICMetadata = (file: File): boolean =>
+  HEIC_MIME_TYPES.has(file.type.toLowerCase()) || HEIC_EXTENSION_REGEX.test(file.name);
 
 /**
  * Check if a file is in HEIC format
@@ -6,7 +21,12 @@ import { heicTo, isHeic } from 'heic-to';
  * @returns Promise<boolean> - True if the file is HEIC
  */
 export const isHEICFile = async (file: File): Promise<boolean> => {
+  if (!hasHEICMetadata(file)) {
+    return false;
+  }
+
   try {
+    const { isHeic } = await loadHeicConverter();
     return await isHeic(file);
   } catch (error) {
     console.warn('Error checking if file is HEIC:', error);
@@ -31,6 +51,7 @@ export const convertHEICToJPEG = async (
     // Report conversion start
     onProgress?.(0.3);
 
+    const { heicTo } = await loadHeicConverter();
     const convertedBlob = await heicTo({
       blob: file,
       type: 'image/jpeg',
diff --git a/client/src/utils/icons.ts b/client/src/utils/icons.ts
new file mode 100644
index 00000000000..a518ba52f32
--- /dev/null
+++ b/client/src/utils/icons.ts
@@ -0,0 +1,7 @@
+export function isImageURL(iconURL?: string | null): iconURL is string {
+  if (!iconURL) {
+    return false;
+  }
+
+  return /^https?:\/\//i.test(iconURL) || (iconURL.startsWith('/') && !iconURL.startsWith('//'));
+}
diff --git a/client/src/utils/imageResize.ts b/client/src/utils/imageResize.ts
index 3be6e8d8c07..af13d97ff4d 100644
--- a/client/src/utils/imageResize.ts
+++ b/client/src/utils/imageResize.ts
@@ -45,7 +45,9 @@ export function supportsClientResize(): boolean {
     const canvas = document.createElement('canvas');
     const ctx = canvas.getContext('2d');
 
-    return !!(ctx && ctx.drawImage && canvas.toBlob);
+    return (
+      ctx != null && typeof ctx.drawImage === 'function' && typeof canvas.toBlob === 'function'
+    );
   } catch {
     return false;
   }
diff --git a/client/src/utils/index.ts b/client/src/utils/index.ts
index 643cb76183e..ea322b047fb 100644
--- a/client/src/utils/index.ts
+++ b/client/src/utils/index.ts
@@ -5,10 +5,12 @@ import logger from './logger';
 
 export * from './map';
 export * from './json';
+export * from './icons';
 export * from './email';
 export * from './share';
 export * from './files';
 export * from './latex';
+export * from './tilde';
 export * from './forms';
 export * from './roles';
 export * from './errors';
@@ -20,10 +22,13 @@ export * from './presets';
 export * from './prompts';
 export * from './textarea';
 export * from './messages';
+export * from './tokens';
 export * from './redirect';
 export * from './languages';
+export * from './conversation';
 export * from './endpoints';
 export * from './resources';
+export * from './configHtml';
 export * from './downloadFile';
 export * from './scaleImage';
 export * from './timestamps';
diff --git a/client/src/utils/localStorage.ts b/client/src/utils/localStorage.ts
index d1c9d1acf19..21fe7cb1aa1 100644
--- a/client/src/utils/localStorage.ts
+++ b/client/src/utils/localStorage.ts
@@ -72,7 +72,10 @@ export function clearAllConversationStorage() {
       key.startsWith(LocalStorageKeys.TEXT_DRAFT) ||
       key.startsWith(LocalStorageKeys.ASST_ID_PREFIX) ||
       key.startsWith(LocalStorageKeys.AGENT_ID_PREFIX) ||
-      key.startsWith(LocalStorageKeys.LAST_CONVO_SETUP)
+      key.startsWith(LocalStorageKeys.LAST_CONVO_SETUP) ||
+      key === LocalStorageKeys.LAST_SPEC ||
+      key === LocalStorageKeys.LAST_MODEL ||
+      key === LocalStorageKeys.LAST_TOOLS
     ) {
       localStorage.removeItem(key);
     }
diff --git a/client/src/utils/messages.ts b/client/src/utils/messages.ts
index 27dc0634811..0c756e7c375 100644
--- a/client/src/utils/messages.ts
+++ b/client/src/utils/messages.ts
@@ -1,6 +1,7 @@
 import {
   QueryKeys,
   Constants,
+  buildTree,
   ContentTypes,
   isEphemeralAgentId,
   appendAgentIdSuffix,
@@ -16,6 +17,125 @@ import type { QueryClient } from '@tanstack/react-query';
 import type { LocalizeFunction } from '~/common';
 
 export const TEXT_KEY_DIVIDER = '|||';
+export const STREAM_START_FAILED_METADATA_KEY = 'streamStartFailed';
+
+type SiblingIndexLookup = (parentMessageId: string | null | undefined) => number;
+
+export type BranchSiblingIndex = {
+  parentMessageId: string | null | undefined;
+  siblingIdx: number;
+};
+
+export const selectActiveBranchTail = (
+  messages: TMessage[] | null | undefined,
+  rootSiblingKey: string | null | undefined,
+  getSiblingIndex: SiblingIndexLookup = () => 0,
+): TMessage | null => {
+  const messagesTree = buildTree({ messages: messages ?? null });
+  if (!messagesTree?.length) {
+    return null;
+  }
+
+  let siblings = messagesTree;
+  let parentMessageId = rootSiblingKey;
+  let tail: TMessage | null = null;
+
+  while (siblings.length > 0) {
+    const siblingIdx = getSiblingIndex(parentMessageId);
+    const normalizedSiblingIdx = siblingIdx >= 0 && siblingIdx < siblings.length ? siblingIdx : 0;
+    const activeSiblingIndex = siblings.length - normalizedSiblingIdx - 1;
+    const message = siblings[activeSiblingIndex] ?? siblings[siblings.length - 1];
+    if (!message) {
+      return tail;
+    }
+
+    tail = message;
+    parentMessageId = message.messageId;
+    siblings = message.children ?? [];
+  }
+
+  return tail;
+};
+
+export const getMessageBranchSiblingParentIds = (
+  messages: TMessage[] | null | undefined,
+  rootSiblingKey: string | null | undefined,
+): (string | null)[] => {
+  const messagesTree = buildTree({ messages: messages ?? null });
+  if (!messagesTree?.length) {
+    return [];
+  }
+
+  const parentIds = new Set<string | null>();
+  const collectBranchParents = (
+    siblings: TMessage[] | undefined,
+    parentMessageId: string | null | undefined,
+  ) => {
+    if (!siblings?.length) {
+      return;
+    }
+
+    if (siblings.length > 1) {
+      parentIds.add(parentMessageId ?? null);
+    }
+
+    for (const message of siblings) {
+      collectBranchParents(message.children, message.messageId);
+    }
+  };
+
+  collectBranchParents(messagesTree, rootSiblingKey);
+  return Array.from(parentIds);
+};
+
+export const getBranchSiblingIndexesForTarget = (
+  messages: TMessage[] | null | undefined,
+  targetMessageId: string | null | undefined,
+  rootSiblingKey: string | null | undefined,
+): BranchSiblingIndex[] => {
+  if (!targetMessageId) {
+    return [];
+  }
+
+  const messagesTree = buildTree({ messages: messages ?? null });
+  if (!messagesTree?.length) {
+    return [];
+  }
+
+  const branchIndexes: BranchSiblingIndex[] = [];
+  const findTargetPath = (
+    siblings: TMessage[] | undefined,
+    parentMessageId: string | null | undefined,
+  ): boolean => {
+    if (!siblings?.length) {
+      return false;
+    }
+
+    for (let index = 0; index < siblings.length; index++) {
+      const message = siblings[index];
+      if (!message) {
+        continue;
+      }
+
+      const isTarget = message.messageId === targetMessageId;
+      const childHasTarget = findTargetPath(message.children, message.messageId);
+      if (isTarget || childHasTarget) {
+        if (siblings.length > 1) {
+          branchIndexes.unshift({
+            parentMessageId,
+            siblingIdx: siblings.length - index - 1,
+          });
+        }
+        return true;
+      }
+    }
+
+    return false;
+  };
+
+  findTargetPath(messagesTree, rootSiblingKey);
+  return branchIndexes;
+};
 
 export const getLatestText = (message?: TMessage | null, includeIndex?: boolean): string => {
   if (!message) {
@@ -71,6 +191,16 @@ export const getAllContentText = (message?: TMessage | null): string => {
   return '';
 };
 
+export const hasStreamStartFailed = (message?: Pick<TMessage, 'metadata'> | null): boolean =>
+  message?.metadata?.[STREAM_START_FAILED_METADATA_KEY] === true;
+
+export const markStreamStartFailedMetadata = (
+  metadata?: TMessage['metadata'],
+): TMessage['metadata'] => ({
+  ...(metadata ?? {}),
+  [STREAM_START_FAILED_METADATA_KEY]: true,
+});
+
 const getLatestContentForKey = (message: TMessage): string => {
   const formatText = (str: string, index: number): string => {
     if (str.length === 0) {
@@ -214,6 +344,94 @@ export const getHeaderPrefixForScreenReader = (
     : `${localize('com_ui_response')}${suffix}: `;
 };
 
+export type MessageTimestamp = {
+  /** Localized relative time, e.g. "2 hours ago". */
+  relative: string;
+  /** Localized absolute date and time, e.g. "Jun 12, 2026, 3:42 PM". */
+  absolute: string;
+  /** ISO 8601 string for the `<time>` element's `dateTime` attribute. */
+  iso: string;
+  /**
+   * True when the message is recent enough that the relative form ("10 minutes ago")
+   * reads better than the absolute date. Past this window the absolute date is clearer.
+   */
+  isRecent: boolean;
+};
+
+/** Below this age the relative form is preferred over the absolute date. */
+const RECENT_THRESHOLD_MS = 24 * 60 * 60 * 1000;
+
+/** Returns true when `value` parses to a valid date. */
+export const isValidTimestamp = (value?: string | null): value is string => {
+  if (!value) {
+    return false;
+  }
+  return !Number.isNaN(new Date(value).getTime());
+};
+
+const RELATIVE_TIME_DIVISIONS: { amount: number; unit: Intl.RelativeTimeFormatUnit }[] = [
+  { amount: 60, unit: 'second' },
+  { amount: 60, unit: 'minute' },
+  { amount: 24, unit: 'hour' },
+  { amount: 7, unit: 'day' },
+  { amount: 4.34524, unit: 'week' },
+  { amount: 12, unit: 'month' },
+  { amount: Number.POSITIVE_INFINITY, unit: 'year' },
+];
+
+/** Returns the locale only when it is a syntactically valid BCP-47 tag, else undefined. */
+const resolveLocale = (locale?: string): string | undefined => {
+  if (!locale) {
+    return undefined;
+  }
+  try {
+    Intl.DateTimeFormat.supportedLocalesOf(locale);
+    return locale;
+  } catch {
+    return undefined;
+  }
+};
+
+const formatRelativeTime = (from: Date, to: Date, locale?: string): string => {
+  const formatter = new Intl.RelativeTimeFormat(locale, { numeric: 'auto' });
+  let duration = (from.getTime() - to.getTime()) / 1000;
+  for (const division of RELATIVE_TIME_DIVISIONS) {
+    if (Math.abs(duration) < division.amount) {
+      return formatter.format(Math.round(duration), division.unit);
+    }
+    duration /= division.amount;
+  }
+  return formatter.format(Math.round(duration), 'year');
+};
+
+/**
+ * Formats a message timestamp into locale-aware relative and absolute strings.
+ * Returns null when the value is missing or unparseable, so callers can skip
+ * rendering the timestamp entirely.
+ */
+export const getMessageTimestamp = (
+  value?: string | null,
+  locale?: string,
+): MessageTimestamp | null => {
+  if (!isValidTimestamp(value)) {
+    return null;
+  }
+
+  const date = new Date(value);
+  const now = new Date(Date.now());
+  const safeLocale = resolveLocale(locale);
+
+  return {
+    iso: date.toISOString(),
+    relative: formatRelativeTime(date, now, safeLocale),
+    absolute: new Intl.DateTimeFormat(safeLocale, {
+      dateStyle: 'medium',
+      timeStyle: 'short',
+    }).format(date),
+    isRecent: Math.abs(now.getTime() - date.getTime()) < RECENT_THRESHOLD_MS,
+  };
+};
+
 /**
  * Creates initial content parts for dual message display with agent-based grouping.
  * Sets up primary and added agent content parts with agentId for column rendering.
diff --git a/client/src/utils/resources.ts b/client/src/utils/resources.ts
index a8bdfcb3414..09623247a29 100644
--- a/client/src/utils/resources.ts
+++ b/client/src/utils/resources.ts
@@ -71,6 +71,16 @@ export const RESOURCE_CONFIGS: Record<ResourceType, ResourceConfig> = {
       `Manage permissions for ${name && name !== '' ? name : 'skill'}`,
     getCopyUrlMessage: () => 'Skill URL copied',
   },
+  [ResourceType.SHARED_LINK]: {
+    resourceType: ResourceType.SHARED_LINK,
+    defaultViewerRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    defaultEditorRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    defaultOwnerRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+    getResourceName: (name?: string) => name || 'shared link',
+    getShareMessage: (name?: string) => name || 'shared link',
+    getManageMessage: (name?: string) => `Manage access for ${name || 'shared link'}`,
+    getCopyUrlMessage: () => 'Share link copied',
+  },
 };
 
 export const getResourceConfig = (resourceType: ResourceType): ResourceConfig | undefined => {
diff --git a/client/src/utils/roles.ts b/client/src/utils/roles.ts
index 3720e91939e..3dba1fe5ff6 100644
--- a/client/src/utils/roles.ts
+++ b/client/src/utils/roles.ts
@@ -73,6 +73,15 @@ export const ROLE_LOCALIZATIONS = {
     name: 'com_ui_role_owner' as const,
     description: 'com_ui_skill_role_owner_desc' as const,
   } as const,
+  // Shared link roles
+  sharedLink_viewer: {
+    name: 'com_ui_role_viewer' as const,
+    description: 'com_ui_role_viewer_desc' as const,
+  } as const,
+  sharedLink_owner: {
+    name: 'com_ui_role_owner' as const,
+    description: 'com_ui_role_owner_desc' as const,
+  } as const,
 };
 
 /**
diff --git a/client/src/utils/shortcuts.spec.ts b/client/src/utils/shortcuts.spec.ts
new file mode 100644
index 00000000000..d1bfe8a1395
--- /dev/null
+++ b/client/src/utils/shortcuts.spec.ts
@@ -0,0 +1,248 @@
+import type { ShortcutBinding } from './shortcuts';
+import {
+  hasModifier,
+  isCancelKey,
+  bindingHash,
+  normalizeKey,
+  parseBinding,
+  isModifierKey,
+  isValidBinding,
+  bindingTokens,
+  bindingToString,
+  resolveSubmitOverrideAction,
+  bindingFromEvent,
+  bindingDisplayKeys,
+  bindingDisplayString,
+} from './shortcuts';
+
+function makeBinding(overrides: Partial<ShortcutBinding> = {}): ShortcutBinding {
+  return { meta: false, ctrl: false, alt: false, shift: false, key: '', ...overrides };
+}
+
+describe('normalizeKey', () => {
+  it('maps special keys to their canonical token', () => {
+    expect(normalizeKey('Backspace')).toBe('Backspace');
+    expect(normalizeKey(' ')).toBe('Space');
+    expect(normalizeKey('ArrowUp')).toBe('ArrowUp');
+  });
+
+  it('uppercases single character keys', () => {
+    expect(normalizeKey('k')).toBe('K');
+    expect(normalizeKey('a')).toBe('A');
+  });
+
+  it('resolves shifted punctuation back to the base key when shift is held', () => {
+    expect(normalizeKey('?', true)).toBe('/');
+    expect(normalizeKey(':', true)).toBe(';');
+    expect(normalizeKey('?', false)).toBe('?');
+  });
+
+  it('passes through multi-character non-special keys unchanged', () => {
+    expect(normalizeKey('F5')).toBe('F5');
+  });
+});
+
+describe('isModifierKey', () => {
+  it('recognizes modifier keys', () => {
+    expect(isModifierKey('Meta')).toBe(true);
+    expect(isModifierKey('Control')).toBe(true);
+    expect(isModifierKey('Shift')).toBe(true);
+    expect(isModifierKey('Alt')).toBe(true);
+    expect(isModifierKey('k')).toBe(false);
+  });
+});
+
+describe('bindingFromEvent', () => {
+  it('returns null when the pressed key is itself a modifier', () => {
+    const event = new KeyboardEvent('keydown', { key: 'Shift', shiftKey: true });
+    expect(bindingFromEvent(event)).toBeNull();
+  });
+
+  it('captures active modifiers and the normalized key', () => {
+    const event = new KeyboardEvent('keydown', {
+      key: 'k',
+      ctrlKey: true,
+      shiftKey: true,
+    });
+    expect(bindingFromEvent(event)).toEqual(makeBinding({ ctrl: true, shift: true, key: 'K' }));
+  });
+
+  it('normalizes special keys from the event', () => {
+    const event = new KeyboardEvent('keydown', { key: 'Backspace', metaKey: true, shiftKey: true });
+    expect(bindingFromEvent(event)).toEqual(
+      makeBinding({ meta: true, shift: true, key: 'Backspace' }),
+    );
+  });
+});
+
+describe('parseBinding', () => {
+  it('returns null for empty input', () => {
+    expect(parseBinding('')).toBeNull();
+    expect(parseBinding(null)).toBeNull();
+    expect(parseBinding(undefined)).toBeNull();
+  });
+
+  it('parses modifier tokens and the trailing key', () => {
+    expect(parseBinding('Meta+Shift+T')).toEqual(
+      makeBinding({ meta: true, shift: true, key: 'T' }),
+    );
+    expect(parseBinding('Control+Shift+Backspace')).toEqual(
+      makeBinding({ ctrl: true, shift: true, key: 'Backspace' }),
+    );
+  });
+
+  it('accepts aliased modifier tokens', () => {
+    expect(parseBinding('Cmd+Option+/')).toEqual(makeBinding({ meta: true, alt: true, key: '/' }));
+  });
+
+  it('returns null when the binding has no concrete key', () => {
+    expect(parseBinding('Meta+Shift')).toBeNull();
+  });
+
+  it('round-trips with bindingToString', () => {
+    const binding = makeBinding({ ctrl: true, shift: true, key: 'K' });
+    expect(parseBinding(bindingToString(binding))).toEqual(binding);
+  });
+});
+
+describe('bindingToString', () => {
+  it('returns null for a null binding', () => {
+    expect(bindingToString(null)).toBeNull();
+  });
+
+  it('serializes modifiers in a stable order', () => {
+    expect(bindingToString(makeBinding({ meta: true, ctrl: true, shift: true, key: 'A' }))).toBe(
+      'Meta+Control+Shift+A',
+    );
+  });
+});
+
+describe('bindingHash', () => {
+  it('produces identical hashes for equivalent bindings', () => {
+    const a = makeBinding({ meta: true, shift: true, key: 'T' });
+    const b = makeBinding({ meta: true, shift: true, key: 'T' });
+    expect(bindingHash(a)).toBe(bindingHash(b));
+  });
+
+  it('differs when modifiers or keys differ', () => {
+    expect(bindingHash(makeBinding({ meta: true, key: 'T' }))).not.toBe(
+      bindingHash(makeBinding({ ctrl: true, key: 'T' })),
+    );
+    expect(bindingHash(makeBinding({ meta: true, key: 'T' }))).not.toBe(
+      bindingHash(makeBinding({ meta: true, key: 'Y' })),
+    );
+  });
+});
+
+describe('hasModifier', () => {
+  it('is true when any non-shift modifier is present', () => {
+    expect(hasModifier(makeBinding({ meta: true, key: 'T' }))).toBe(true);
+    expect(hasModifier(makeBinding({ ctrl: true, key: 'T' }))).toBe(true);
+    expect(hasModifier(makeBinding({ alt: true, key: 'T' }))).toBe(true);
+  });
+
+  it('is false for shift-only or unmodified bindings', () => {
+    expect(hasModifier(makeBinding({ shift: true, key: 'T' }))).toBe(false);
+    expect(hasModifier(makeBinding({ key: 'T' }))).toBe(false);
+  });
+});
+
+describe('isValidBinding', () => {
+  it('accepts any key combined with a non-shift modifier', () => {
+    expect(isValidBinding(makeBinding({ meta: true, key: 'T' })).valid).toBe(true);
+    expect(isValidBinding(makeBinding({ ctrl: true, key: 'Tab' })).valid).toBe(true);
+    expect(isValidBinding(makeBinding({ alt: true, shift: true, key: 'Enter' })).valid).toBe(true);
+  });
+
+  it('accepts shift with a known-safe key', () => {
+    expect(isValidBinding(makeBinding({ shift: true, key: 'Escape' })).valid).toBe(true);
+  });
+
+  it('rejects shift-only chords on focus/navigation keys', () => {
+    for (const key of ['Tab', 'ArrowUp', 'ArrowDown', 'Backspace', 'Enter', 'Space']) {
+      const result = isValidBinding(makeBinding({ shift: true, key }));
+      expect(result.valid).toBe(false);
+      expect(result.reason).toBe('noModifier');
+    }
+  });
+
+  it('rejects unmodified and shift-only printable keys', () => {
+    expect(isValidBinding(makeBinding({ key: 'A' })).valid).toBe(false);
+    expect(isValidBinding(makeBinding({ shift: true, key: 'A' })).valid).toBe(false);
+  });
+});
+
+describe('resolveSubmitOverrideAction', () => {
+  const altEnter = makeBinding({ alt: true, key: 'Enter' });
+
+  it('submits when the event matches the configured chord', () => {
+    expect(resolveSubmitOverrideAction(altEnter, altEnter, false)).toBe('submit');
+  });
+
+  it('newlines on the default Ctrl+Enter once the chord has been rebound', () => {
+    const ctrlEnter = makeBinding({ ctrl: true, key: 'Enter' });
+    expect(resolveSubmitOverrideAction(ctrlEnter, altEnter, false)).toBe('newline');
+    expect(resolveSubmitOverrideAction(ctrlEnter, altEnter, true)).toBe('newline');
+  });
+
+  it('still submits a bare Enter when Enter-to-send is on', () => {
+    const plainEnter = makeBinding({ key: 'Enter' });
+    expect(resolveSubmitOverrideAction(plainEnter, altEnter, true)).toBe('submit');
+    expect(resolveSubmitOverrideAction(plainEnter, altEnter, false)).toBe('newline');
+  });
+
+  it('treats an unbound submit shortcut as disabled while keeping Enter-to-send', () => {
+    const ctrlEnter = makeBinding({ ctrl: true, key: 'Enter' });
+    const plainEnter = makeBinding({ key: 'Enter' });
+    expect(resolveSubmitOverrideAction(ctrlEnter, null, false)).toBe('newline');
+    expect(resolveSubmitOverrideAction(plainEnter, null, true)).toBe('submit');
+    expect(resolveSubmitOverrideAction(plainEnter, null, false)).toBe('newline');
+  });
+
+  it('leaves Shift+Enter and non-Enter keys to the default behavior', () => {
+    expect(
+      resolveSubmitOverrideAction(makeBinding({ shift: true, key: 'Enter' }), altEnter, true),
+    ).toBe('none');
+    expect(resolveSubmitOverrideAction(makeBinding({ ctrl: true, key: 'J' }), altEnter, true)).toBe(
+      'none',
+    );
+    expect(resolveSubmitOverrideAction(null, altEnter, true)).toBe('none');
+  });
+});
+
+describe('isCancelKey', () => {
+  it('is true for a bare Escape press', () => {
+    expect(isCancelKey(new KeyboardEvent('keydown', { key: 'Escape' }))).toBe(true);
+  });
+
+  it('is false when Escape is combined with a modifier', () => {
+    expect(isCancelKey(new KeyboardEvent('keydown', { key: 'Escape', shiftKey: true }))).toBe(
+      false,
+    );
+  });
+});
+
+describe('display helpers', () => {
+  const binding = makeBinding({ meta: true, shift: true, key: 'T' });
+
+  it('returns an empty token list for a null binding', () => {
+    expect(bindingDisplayKeys(null, true)).toEqual([]);
+  });
+
+  it('lists tokens in modifier order', () => {
+    expect(bindingTokens(binding)).toEqual(['Meta', 'Shift', 'T']);
+  });
+
+  it('renders mac symbols joined by spaces', () => {
+    expect(bindingDisplayString(binding, true)).toBe('⌘ ⇧ T');
+  });
+
+  it('renders non-mac labels joined by plus signs', () => {
+    const ctrlBinding = makeBinding({ ctrl: true, shift: true, key: 'T' });
+    expect(bindingDisplayString(ctrlBinding, false)).toBe('Ctrl+Shift+T');
+  });
+
+  it('labels the Meta modifier as Win on non-mac platforms', () => {
+    expect(bindingDisplayString(binding, false)).toBe('Win+Shift+T');
+  });
+});
diff --git a/client/src/utils/shortcuts.ts b/client/src/utils/shortcuts.ts
new file mode 100644
index 00000000000..0051a217186
--- /dev/null
+++ b/client/src/utils/shortcuts.ts
@@ -0,0 +1,266 @@
+export type ShortcutBinding = {
+  meta: boolean;
+  ctrl: boolean;
+  alt: boolean;
+  shift: boolean;
+  key: string;
+};
+
+export const isMacPlatform =
+  typeof navigator !== 'undefined' && /Mac|iPhone|iPad|iPod/.test(navigator.userAgent);
+
+const MODIFIER_KEYS = new Set(['Meta', 'Control', 'Alt', 'Shift']);
+
+const SPECIAL_KEY_MAP: Record<string, string> = {
+  ArrowUp: 'ArrowUp',
+  ArrowDown: 'ArrowDown',
+  ArrowLeft: 'ArrowLeft',
+  ArrowRight: 'ArrowRight',
+  Backspace: 'Backspace',
+  Delete: 'Delete',
+  Enter: 'Enter',
+  Escape: 'Escape',
+  Tab: 'Tab',
+  Space: 'Space',
+  ' ': 'Space',
+};
+
+const SHIFT_TO_UNSHIFT: Record<string, string> = {
+  '?': '/',
+  ':': ';',
+  '<': ',',
+  '>': '.',
+  '"': "'",
+  '{': '[',
+  '}': ']',
+  '|': '\\',
+  _: '-',
+  '+': '=',
+  '~': '`',
+  '!': '1',
+  '@': '2',
+  '#': '3',
+  $: '4',
+  '%': '5',
+  '^': '6',
+  '&': '7',
+  '*': '8',
+  '(': '9',
+  ')': '0',
+};
+
+export function normalizeKey(key: string, shiftHeld?: boolean): string {
+  if (SPECIAL_KEY_MAP[key]) {
+    return SPECIAL_KEY_MAP[key];
+  }
+  if (key.length === 1) {
+    if (shiftHeld && SHIFT_TO_UNSHIFT[key]) {
+      return SHIFT_TO_UNSHIFT[key];
+    }
+    return key.toUpperCase();
+  }
+  return key;
+}
+
+export function isModifierKey(key: string): boolean {
+  return MODIFIER_KEYS.has(key);
+}
+
+export function bindingFromEvent(e: KeyboardEvent): ShortcutBinding | null {
+  if (isModifierKey(e.key)) {
+    return null;
+  }
+  return {
+    meta: e.metaKey,
+    ctrl: e.ctrlKey,
+    alt: e.altKey,
+    shift: e.shiftKey,
+    key: normalizeKey(e.key, e.shiftKey),
+  };
+}
+
+const MODIFIER_TOKENS: Record<string, 'meta' | 'ctrl' | 'alt' | 'shift'> = {
+  Meta: 'meta',
+  Cmd: 'meta',
+  Command: 'meta',
+  Control: 'ctrl',
+  Ctrl: 'ctrl',
+  Alt: 'alt',
+  Option: 'alt',
+  Shift: 'shift',
+};
+
+export function parseBinding(value: string | null | undefined): ShortcutBinding | null {
+  if (!value) {
+    return null;
+  }
+  const binding: ShortcutBinding = {
+    meta: false,
+    ctrl: false,
+    alt: false,
+    shift: false,
+    key: '',
+  };
+  let remaining = value;
+  let separatorIndex = remaining.indexOf('+');
+  while (separatorIndex > 0) {
+    const flag = MODIFIER_TOKENS[remaining.slice(0, separatorIndex)];
+    if (!flag) {
+      break;
+    }
+    binding[flag] = true;
+    remaining = remaining.slice(separatorIndex + 1);
+    separatorIndex = remaining.indexOf('+');
+  }
+  if (MODIFIER_TOKENS[remaining]) {
+    return null;
+  }
+  binding.key = normalizeKey(remaining);
+  if (!binding.key) {
+    return null;
+  }
+  return binding;
+}
+
+export function bindingToString(binding: ShortcutBinding | null): string | null {
+  if (!binding) {
+    return null;
+  }
+  const parts: string[] = [];
+  if (binding.meta) parts.push('Meta');
+  if (binding.ctrl) parts.push('Control');
+  if (binding.alt) parts.push('Alt');
+  if (binding.shift) parts.push('Shift');
+  parts.push(binding.key);
+  return parts.join('+');
+}
+
+export function bindingHash(binding: ShortcutBinding): string {
+  const flags = [
+    binding.meta ? 'M' : '',
+    binding.ctrl ? 'C' : '',
+    binding.alt ? 'A' : '',
+    binding.shift ? 'S' : '',
+  ].join('');
+  return `${flags}|${binding.key}`;
+}
+
+export function hasModifier(binding: ShortcutBinding): boolean {
+  return binding.meta || binding.ctrl || binding.alt;
+}
+
+/**
+ * Keys allowed as a shift-only chord. Limited to keys whose native behavior is safe to
+ * override; combos like Shift+Tab, Shift+Arrow, or Shift+Backspace would otherwise hijack
+ * browser focus/navigation on non-text controls.
+ */
+const SHIFT_SAFE_KEYS = new Set(['Escape']);
+
+export function isValidBinding(binding: ShortcutBinding): {
+  valid: boolean;
+  reason?: 'noModifier';
+} {
+  if (hasModifier(binding)) {
+    return { valid: true };
+  }
+  if (binding.shift && SHIFT_SAFE_KEYS.has(binding.key)) {
+    return { valid: true };
+  }
+  return { valid: false, reason: 'noModifier' };
+}
+
+export type ComposerEnterAction = 'submit' | 'newline' | 'none';
+
+/**
+ * Resolves what an Enter press should do in the composer when `submitMessage` has been rebound.
+ * The configured chord submits; a bare Enter still submits when "Enter to send" is on; any other
+ * non-shift Enter inserts a newline. Returns `none` for Shift+Enter and non-Enter keys so the
+ * caller leaves the browser's default behavior untouched.
+ */
+export function resolveSubmitOverrideAction(
+  eventBinding: ShortcutBinding | null,
+  submitOverride: ShortcutBinding | null,
+  enterToSend: boolean,
+): ComposerEnterAction {
+  if (!eventBinding || eventBinding.key !== 'Enter') {
+    return 'none';
+  }
+  const matchesChord =
+    submitOverride != null &&
+    submitOverride.key === 'Enter' &&
+    bindingHash(eventBinding) === bindingHash(submitOverride);
+  const isPlainEnter =
+    !eventBinding.meta && !eventBinding.ctrl && !eventBinding.alt && !eventBinding.shift;
+  if (matchesChord || (isPlainEnter && enterToSend)) {
+    return 'submit';
+  }
+  if (!eventBinding.shift) {
+    return 'newline';
+  }
+  return 'none';
+}
+
+export function isCancelKey(e: KeyboardEvent): boolean {
+  return e.key === 'Escape' && !e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey;
+}
+
+const MAC_SYMBOLS: Record<string, string> = {
+  Meta: '⌘',
+  Control: '⌃',
+  Alt: '⌥',
+  Shift: '⇧',
+  Backspace: '⌫',
+  Delete: '⌦',
+  Enter: '↵',
+  Escape: 'Esc',
+  Tab: '⇥',
+  Space: 'Space',
+  ArrowUp: '↑',
+  ArrowDown: '↓',
+  ArrowLeft: '←',
+  ArrowRight: '→',
+};
+
+const OTHER_LABELS: Record<string, string> = {
+  Meta: 'Win',
+  Control: 'Ctrl',
+  Alt: 'Alt',
+  Shift: 'Shift',
+  Backspace: 'Backspace',
+  Delete: 'Delete',
+  Enter: 'Enter',
+  Escape: 'Esc',
+  Tab: 'Tab',
+  Space: 'Space',
+  ArrowUp: '↑',
+  ArrowDown: '↓',
+  ArrowLeft: '←',
+  ArrowRight: '→',
+};
+
+function labelForToken(token: string, mac: boolean): string {
+  const map = mac ? MAC_SYMBOLS : OTHER_LABELS;
+  return map[token] ?? token;
+}
+
+export function bindingTokens(binding: ShortcutBinding): string[] {
+  const tokens: string[] = [];
+  if (binding.meta) tokens.push('Meta');
+  if (binding.ctrl) tokens.push('Control');
+  if (binding.alt) tokens.push('Alt');
+  if (binding.shift) tokens.push('Shift');
+  tokens.push(binding.key);
+  return tokens;
+}
+
+export function bindingDisplayKeys(binding: ShortcutBinding | null, mac: boolean): string[] {
+  if (!binding) {
+    return [];
+  }
+  return bindingTokens(binding).map((token) => labelForToken(token, mac));
+}
+
+export function bindingDisplayString(binding: ShortcutBinding | null, mac: boolean): string {
+  const keys = bindingDisplayKeys(binding, mac);
+  return mac ? keys.join(' ') : keys.join('+');
+}
diff --git a/client/src/utils/tilde.spec.ts b/client/src/utils/tilde.spec.ts
new file mode 100644
index 00000000000..fbda8d82581
--- /dev/null
+++ b/client/src/utils/tilde.spec.ts
@@ -0,0 +1,143 @@
+import type { Node } from 'unist';
+import { normalizeApproxTildes, remarkApproxTilde } from './tilde';
+
+const T = '∼'; // U+223C TILDE OPERATOR
+
+describe('normalizeApproxTildes', () => {
+  test('returns the same string when no tilde is present', () => {
+    const content = 'a plain string without any tilde';
+    expect(normalizeApproxTildes(content)).toBe(content);
+  });
+
+  test('neutralizes a paired approximation that would become subscript', () => {
+    expect(normalizeApproxTildes('down. ~50% of IPOs ... to ~10%).')).toBe(
+      `down. ${T}50% of IPOs ... to ${T}10%).`,
+    );
+  });
+
+  test('neutralizes a single approximation tilde', () => {
+    expect(normalizeApproxTildes('about ~50 people')).toBe(`about ${T}50 people`);
+  });
+
+  test('neutralizes approximation before currency and after an open bracket', () => {
+    expect(normalizeApproxTildes('range (~$5 to ~10%)')).toBe(`range (${T}$5 to ${T}10%)`);
+  });
+
+  test('neutralizes a spaced negative approximation', () => {
+    expect(normalizeApproxTildes('is ~ -3% from')).toBe(`is ${T} -3% from`);
+  });
+
+  test('neutralizes quoted approximations', () => {
+    expect(normalizeApproxTildes('about "~50%" and "~10%"')).toBe(`about "${T}50%" and "${T}10%"`);
+  });
+
+  test('preserves word-attached subscripts', () => {
+    expect(normalizeApproxTildes('H~2~O and x~1~')).toBe('H~2~O and x~1~');
+  });
+
+  test('preserves a space-delimited closed-number subscript', () => {
+    expect(normalizeApproxTildes('the term a ~2~ here')).toBe('the term a ~2~ here');
+  });
+
+  test('does not match a tilde attached to a preceding number', () => {
+    expect(normalizeApproxTildes('range 5~10 items')).toBe('range 5~10 items');
+  });
+});
+
+interface TextNode extends Node {
+  type: 'text';
+  value: string;
+}
+interface CodeNode extends Node {
+  type: 'inlineCode' | 'code';
+  value: string;
+}
+interface MathNode extends Node {
+  type: 'inlineMath' | 'math';
+  value: string;
+}
+interface LinkNode extends Node {
+  type: 'link';
+  url: string;
+  children: Node[];
+}
+
+describe('remarkApproxTilde', () => {
+  /**
+   * supersub only splits `text` nodes, so the plugin's contract is to rewrite
+   * approximation tildes in text nodes while leaving every other node type — code,
+   * math, and link destinations — byte-for-byte untouched. A hand-built tree proves
+   * that contract without depending on the parser.
+   */
+  test('rewrites text nodes but leaves code, math, and link URLs untouched', () => {
+    const text: TextNode = { type: 'text', value: 'about ~50% and ~10% here' };
+    const inlineCode: CodeNode = { type: 'inlineCode', value: '~50%' };
+    const fenced: CodeNode = { type: 'code', value: '~50% in code\n~/path' };
+    const inlineMath: MathNode = { type: 'inlineMath', value: 'x ~ 10' };
+    const displayMath: MathNode = { type: 'math', value: '~10' };
+    const linkText: TextNode = { type: 'text', value: '~50% off' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'https://example.com/~50/file',
+      children: [linkText],
+    };
+    const tree: Node = {
+      type: 'root',
+      children: [text, inlineCode, fenced, inlineMath, displayMath, link],
+    } as Node;
+
+    remarkApproxTilde()(tree);
+
+    expect(text.value).toBe(`about ${T}50% and ${T}10% here`);
+    expect(inlineCode.value).toBe('~50%');
+    expect(fenced.value).toBe('~50% in code\n~/path');
+    expect(inlineMath.value).toBe('x ~ 10');
+    expect(displayMath.value).toBe('~10');
+    expect(link.url).toBe('https://example.com/~50/file');
+    expect(linkText.value).toBe(`${T}50% off`);
+  });
+
+  test('preserves an autolink label that displays the URL', () => {
+    const label: TextNode = { type: 'text', value: 'https://example.com/~50/file' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'https://example.com/~50/file',
+      children: [label],
+    };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe('https://example.com/~50/file');
+  });
+
+  test('preserves a www autolink label whose href has an implied scheme', () => {
+    const label: TextNode = { type: 'text', value: 'www.example.com/~50/x' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'http://www.example.com/~50/x',
+      children: [label],
+    };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe('www.example.com/~50/x');
+  });
+
+  test('still converts a regular link label that is prose', () => {
+    const label: TextNode = { type: 'text', value: '~50% to ~10% off' };
+    const link: LinkNode = { type: 'link', url: 'https://example.com', children: [label] };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe(`${T}50% to ${T}10% off`);
+  });
+
+  test('removes both tildes of an approximation pair so no `~` remains to subscript', () => {
+    const node: TextNode = { type: 'text', value: 'first ~50% then ~10% drop' };
+    const tree: Node = { type: 'root', children: [node] } as Node;
+    remarkApproxTilde()(tree);
+    expect(node.value).not.toContain('~');
+    expect(node.value).toBe(`first ${T}50% then ${T}10% drop`);
+  });
+
+  test('leaves a genuine subscript text node intact for supersub to handle', () => {
+    const node: TextNode = { type: 'text', value: 'water H~2~O molecule' };
+    const tree: Node = { type: 'root', children: [node] } as Node;
+    remarkApproxTilde()(tree);
+    expect(node.value).toBe('water H~2~O molecule');
+  });
+});
diff --git a/client/src/utils/tilde.ts b/client/src/utils/tilde.ts
new file mode 100644
index 00000000000..e2b4384ae50
--- /dev/null
+++ b/client/src/utils/tilde.ts
@@ -0,0 +1,77 @@
+import type { Node } from 'unist';
+
+interface TextNode extends Node {
+  type: 'text';
+  value: string;
+}
+interface LinkNode extends Node {
+  type: 'link';
+  url: string;
+}
+interface ParentNode extends Node {
+  children?: Node[];
+}
+
+/**
+ * A GFM autolink renders the URL itself as its label, so the label text node equals the
+ * destination (with an implied scheme for `www.`/email links). Rewriting it would change the
+ * URL the user sees while leaving the href intact, so these are left untouched.
+ */
+function isAutolinkLabel(value: string, parent?: Node): boolean {
+  if (!parent || parent.type !== 'link') {
+    return false;
+  }
+  const url = (parent as LinkNode).url;
+  return (
+    url === value ||
+    url === `http://${value}` ||
+    url === `https://${value}` ||
+    url === `mailto:${value}`
+  );
+}
+
+// "Approximately" tilde: a `~` prefixing a number that is not attached to a preceding word —
+// e.g. `~50%`, `~ -3%`, `~$5`, `"~50%"`, `(~10%)`. Running on parsed text nodes (never code,
+// links, math, or URL destinations) means only real prose is touched, so the boundary can be
+// permissive: anything except a word character or another tilde. Word-attached and
+// closed-number subscripts (`H~2~O`, `a ~2~ b`) are excluded so genuine subscripts survive.
+// Markdown decodes `\~` to `~` before this runs, so escaped tildes are covered too.
+const APPROX_TILDE_REGEX = /(?<![\w~])~(?=[ \t]?[-−+]?\$?\d)(?![ \t]?[-−+]?\$?[\d.,]*~)/g;
+// U+223C TILDE OPERATOR — renders as a tilde but is not split by remark-supersub.
+const TILDE_OPERATOR = '∼';
+
+/**
+ * Replaces "approximately" tildes (e.g. `~50%`) in a single text value with the Unicode
+ * tilde operator so `remark-supersub` does not pair them into spurious `<sub>` ranges.
+ * A backslash escape cannot help — markdown decodes `\~` back to `~` before supersub runs —
+ * so the glyph itself must change.
+ */
+export function normalizeApproxTildes(value: string): string {
+  if (value.indexOf('~') === -1) return value;
+  return value.replace(APPROX_TILDE_REGEX, TILDE_OPERATOR);
+}
+
+function normalizeTextNodes(node: Node, parent?: Node): void {
+  if (node.type === 'text') {
+    const textNode = node as TextNode;
+    if (typeof textNode.value === 'string' && !isAutolinkLabel(textNode.value, parent)) {
+      textNode.value = normalizeApproxTildes(textNode.value);
+    }
+    return;
+  }
+  const children = (node as ParentNode).children;
+  if (!children) return;
+  for (const child of children) {
+    normalizeTextNodes(child, node);
+  }
+}
+
+/**
+ * remark plugin that neutralizes "approximately" tildes in text nodes before
+ * `remark-supersub` runs. Walking the parsed tree means code, links, math, and URL
+ * destinations are structurally excluded — none of them are `text` nodes. Autolink labels
+ * (which display the URL itself) are skipped so the visible URL is preserved verbatim.
+ */
+export function remarkApproxTilde() {
+  return (tree: Node) => normalizeTextNodes(tree);
+}
diff --git a/client/src/utils/tokens.spec.ts b/client/src/utils/tokens.spec.ts
new file mode 100644
index 00000000000..725fdab224d
--- /dev/null
+++ b/client/src/utils/tokens.spec.ts
@@ -0,0 +1,679 @@
+import { Constants, Providers } from 'librechat-data-provider';
+import type { TMessage, TResponseUsage } from 'librechat-data-provider';
+import {
+  buildIndex,
+  upsertEntries,
+  migrateIndex,
+  clearIndex,
+  hasIndex,
+  sumBranch,
+  mergeUsage,
+  setEntryUsage,
+  sumTotalUsage,
+  findBranchSnapshotAnchor,
+  estimateTokens,
+  normalizeUsageUnits,
+  formatCost,
+  groupToolTokens,
+  countTrailingOutputChars,
+  EMPTY_BRANCH,
+  EMPTY_USAGE,
+  EMPTY_TOOL_GROUPS,
+} from './tokens';
+
+const CONVO = 'convo-1';
+
+function msg(
+  messageId: string,
+  parentMessageId: string | null,
+  isCreatedByUser: boolean,
+  tokenCount?: number,
+): TMessage {
+  return {
+    messageId,
+    parentMessageId,
+    isCreatedByUser,
+    tokenCount,
+    conversationId: CONVO,
+    text: '',
+  } as TMessage;
+}
+
+/** Response message carrying a persisted `metadata.usage` rollup (the backend
+ *  persists already-normalized display units). */
+function responseMsg(
+  messageId: string,
+  parentMessageId: string | null,
+  tokenCount: number,
+  usage: TResponseUsage,
+): TMessage {
+  return {
+    messageId,
+    parentMessageId,
+    isCreatedByUser: false,
+    tokenCount,
+    conversationId: CONVO,
+    text: '',
+    metadata: { usage },
+  } as TMessage;
+}
+
+const USAGE_A: TResponseUsage = { input: 100, output: 50, cacheWrite: 0, cacheRead: 0, cost: 0.01 };
+const USAGE_B: TResponseUsage = { input: 200, output: 80, cacheWrite: 0, cacheRead: 0, cost: 0.02 };
+
+describe('token index', () => {
+  afterEach(() => {
+    clearIndex(CONVO);
+    clearIndex('convo-2');
+    clearIndex(Constants.NEW_CONVO);
+  });
+
+  it('sums only the active branch via the parent chain', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 30),
+      msg('a2', 'u2', false, 40),
+      /** Sibling branch that must not be counted */
+      msg('a2-alt', 'u2', false, 999),
+    ]);
+
+    const totals = sumBranch(CONVO, 'a2');
+    expect(totals.input).toBe(40);
+    expect(totals.output).toBe(60);
+    expect(totals.total).toBe(4);
+    expect(totals.counted).toBe(4);
+
+    const altTotals = sumBranch(CONVO, 'a2-alt');
+    expect(altTotals.output).toBe(1019);
+  });
+
+  it('caps the branch at a summary marker instead of re-summing compacted history', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      /** a2's turn compacted the history; pre-invoke context was 500 tokens. */
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 100),
+      msg('a1', 'u1', false, 9000) /** huge pre-summary history, now discarded */,
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+
+    const totals = sumBranch(CONVO, 'a3');
+    /** Walk stops at a2: only its output + the post-summary turn are summed. */
+    expect(totals.summaryBaseline).toBe(500);
+    expect(totals.input).toBe(15);
+    expect(totals.output).toBe(65); // a3 (25) + a2 (40)
+    /** Estimate used = post-summary + compacted baseline = 580, not the 9380
+     *  raw history sum that pinned the gauge at 100%. */
+    expect(totals.input + totals.output + totals.summaryBaseline).toBe(580);
+  });
+
+  it('keeps provider usage/cost across the full branch even past a summary marker', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { usage: USAGE_B, summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 9000, USAGE_A) /** pre-summary spend */,
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      responseMsg('a3', 'u3', 25, USAGE_A) /** post-summary spend */,
+    ]);
+
+    const totals = sumBranch(CONVO, 'a3');
+    /** Context is capped at the marker... */
+    expect(totals.summaryBaseline).toBe(500);
+    /** ...but cost/usage is cumulative spend and spans the WHOLE branch
+     *  (a1 + a2 + a3 = 0.01 + 0.02 + 0.01), not truncated at the summary boundary. */
+    expect(totals.usage.cost).toBeCloseTo(0.04);
+    expect(totals.usage.input).toBe(400); // 100 + 200 + 100
+  });
+
+  it('flags whether the anchor message is on the branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('a1-alt', 'u1', false, 25),
+    ]);
+
+    expect(sumBranch(CONVO, 'a1', 'a1').containsAnchor).toBe(true);
+    expect(sumBranch(CONVO, 'a1-alt', 'a1').containsAnchor).toBe(false);
+  });
+
+  it('stops matching the anchor once the context is capped at a summary marker', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 100),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+    /** a1 is older than the summary marker (a2): a snapshot anchored there is
+     *  pre-summary, so it must NOT count as on-branch — else useTokenUsage revives
+     *  that stale breakdown over the summary-baseline estimate. */
+    expect(sumBranch(CONVO, 'a3', 'a1').containsAnchor).toBe(false);
+    /** The summarized response's own (post-summary) snapshot still matches... */
+    expect(sumBranch(CONVO, 'a3', 'a2').containsAnchor).toBe(true);
+    /** ...as does a snapshot from a newer turn. */
+    expect(sumBranch(CONVO, 'a3', 'a3').containsAnchor).toBe(true);
+  });
+
+  it('tracks uncounted messages and tolerates missing parents', () => {
+    buildIndex(CONVO, [msg('u2', 'missing-parent', true, undefined), msg('a2', 'u2', false, 15)]);
+
+    const totals = sumBranch(CONVO, 'a2');
+    expect(totals.total).toBe(2);
+    expect(totals.counted).toBe(1);
+    expect(totals.output).toBe(15);
+  });
+
+  it('returns EMPTY_BRANCH without an index or tail', () => {
+    expect(sumBranch('unknown', 'x')).toBe(EMPTY_BRANCH);
+    buildIndex(CONVO, []);
+    expect(sumBranch(CONVO, null)).toBe(EMPTY_BRANCH);
+  });
+
+  it('upserts incrementally and overwrites by messageId', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10)]);
+    upsertEntries(CONVO, [msg('a1', 'u1', false, 20), null, undefined]);
+    expect(sumBranch(CONVO, 'a1').output).toBe(20);
+
+    upsertEntries(CONVO, [msg('a1', 'u1', false, 35)]);
+    expect(sumBranch(CONVO, 'a1').output).toBe(35);
+  });
+
+  it('migrates the index to a new conversation id', () => {
+    buildIndex(Constants.NEW_CONVO, [msg('u1', Constants.NO_PARENT, true, 10)]);
+    migrateIndex(Constants.NEW_CONVO, 'convo-2');
+
+    expect(hasIndex(Constants.NEW_CONVO)).toBe(false);
+    expect(sumBranch('convo-2', 'u1').input).toBe(10);
+  });
+});
+
+describe('findBranchSnapshotAnchor', () => {
+  afterEach(() => clearIndex(CONVO));
+
+  it('returns the deepest stored anchor on the viewed branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 30),
+      msg('a2', 'u2', false, 40),
+      msg('a2-alt', 'u2', false, 50),
+    ]);
+    /** Both a1 and a2 stored; walking from a2 must return the nearer one (a2). */
+    const anchors = new Map([
+      ['a1', 1],
+      ['a2', 1],
+    ]);
+    expect(findBranchSnapshotAnchor(CONVO, 'a2', anchors)).toBe('a2');
+    /** From the sibling branch tail, the only on-branch anchor is a1. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a2-alt', anchors)).toBe('a1');
+  });
+
+  it('returns null when no stored anchor sits on the branch', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 20)]);
+    expect(findBranchSnapshotAnchor(CONVO, 'a1', new Map([['other', 1]]))).toBeNull();
+    expect(findBranchSnapshotAnchor(CONVO, 'a1', new Map())).toBeNull();
+    expect(findBranchSnapshotAnchor('unknown', 'a1', new Map([['a1', 1]]))).toBeNull();
+  });
+
+  it('does not cross a summary marker to recover a stale pre-summary snapshot', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20) /** has a snapshot, but pre-summary */,
+      msg('u2', 'a1', true, 30),
+      summarized /** compacted here, no snapshot of its own */,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+    /** a1 is the only stored anchor, but it sits before the summary — the walk
+     *  must stop at a2 and return null so the summary-baseline estimate is used. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a3', new Map([['a1', 1]]))).toBeNull();
+    /** When the summarized response itself has a snapshot, return it. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a3', new Map([['a2', 1]]))).toBe('a2');
+  });
+});
+
+describe('estimateTokens', () => {
+  it('estimates chars/4 scaled by calibration ratio', () => {
+    expect(estimateTokens(400)).toBe(100);
+    expect(estimateTokens(400, 1.1)).toBe(110);
+    expect(estimateTokens(0)).toBe(0);
+    expect(estimateTokens(100, 0)).toBe(25);
+  });
+});
+
+describe('normalizeUsageUnits', () => {
+  it('subtracts cache from input for Anthropic (input_tokens is cache-inclusive)', () => {
+    /** The agents SDK folds cache into Anthropic input_tokens, so cache is a
+     *  subset of input and must be subtracted: 900 − 100 read = 800. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.ANTHROPIC,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 800, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('keeps cache additive for Bedrock (Converse input_tokens excludes cache)', () => {
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.BEDROCK,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 900, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('keeps subset semantics for OpenAI regardless of magnitude', () => {
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.OPENAI,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 800, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('falls back to a magnitude heuristic when provider is unknown', () => {
+    /** cacheSum (12000) > input (1000) ⇒ additive */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 500,
+        input_token_details: { cache_creation: 2000, cache_read: 10000 },
+      }),
+    ).toEqual({ input: 1000, output: 500, cacheWrite: 2000, cacheRead: 10000 });
+  });
+
+  it('repairs under-reported completion tokens (Vertex thinking)', () => {
+    /** total - input = 500 recovers the dropped thinking tokens */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1500,
+        provider: Providers.VERTEXAI,
+      }).output,
+    ).toBe(500);
+  });
+
+  it('does not mistake additive cache for missing completion tokens (Bedrock)', () => {
+    /** Bedrock keeps cache separate, so total = input + output + cache (1700).
+     *  Without the cache adjustment the repair would falsely inflate completion. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1700,
+        provider: Providers.BEDROCK,
+        input_token_details: { cache_creation: 300, cache_read: 200 },
+      }).output,
+    ).toBe(200);
+  });
+
+  it('does not inflate completion for cache-inclusive Anthropic totals', () => {
+    /** Anthropic total already includes cache (input 1000 covers the 500 cache),
+     *  so total 1200 leaves output at 200 — no false repair. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1200,
+        provider: Providers.ANTHROPIC,
+        input_token_details: { cache_creation: 300, cache_read: 200 },
+      }).output,
+    ).toBe(200);
+  });
+});
+
+describe('formatCost', () => {
+  it('formats across magnitude bands (USD default, unchanged)', () => {
+    expect(formatCost(0)).toBe('$0.00');
+    expect(formatCost(0.004)).toBe('<$0.01');
+    expect(formatCost(0.0523)).toBe('$0.0523');
+    expect(formatCost(1.234)).toBe('$1.23');
+  });
+
+  it('applies the static USD→local rate', () => {
+    expect(formatCost(2, { code: 'USD', rate: 0.5 })).toBe('$1.00');
+    expect(formatCost(10, { code: 'USD', rate: 0.1 })).toBe('$1.00');
+  });
+
+  it('formats in the configured currency', () => {
+    const eur = formatCost(5, { code: 'EUR', rate: 1 });
+    expect(eur).toContain('€');
+    expect(eur).toContain('5');
+  });
+
+  it('respects zero-decimal currencies', () => {
+    const jpy = formatCost(5, { code: 'JPY', rate: 1 });
+    expect(jpy).toContain('¥');
+    expect(jpy).not.toContain('.');
+  });
+
+  it('falls back to USD on a malformed currency code', () => {
+    expect(formatCost(5, { code: 'invalid', rate: 1 })).toBe('$5.00');
+  });
+
+  it('drops the rate too when the currency code is unsupported', () => {
+    /** A typo in `code` must not leave a converted amount under the $ symbol. */
+    expect(formatCost(10, { code: 'EURO', rate: 0.92 })).toBe('$10.00');
+  });
+
+  it('rejects well-formed but non-ISO codes that Intl would accept', () => {
+    /** `EUU`/`RMB` are 3 letters so Intl does not throw; the ISO-4217 set must
+     *  still reject them and fall back to USD (no converted amount, no rate). */
+    expect(formatCost(10, { code: 'EUU', rate: 0.92 })).toBe('$10.00');
+    expect(formatCost(10, { code: 'RMB', rate: 0.5 })).toBe('$10.00');
+  });
+
+  it('uses the currency minor unit for three-decimal currencies', () => {
+    /** KWD has 3 fractional digits, so the tiny threshold is 0.001, not 0.01. */
+    const small = formatCost(0.005, { code: 'KWD', rate: 1 });
+    expect(small).toContain('0.005');
+    expect(small).not.toContain('<');
+    expect(formatCost(0.0005, { code: 'KWD', rate: 1 })).toContain('0.001');
+  });
+
+  it('falls back to rate 1 when rate is not a finite positive number', () => {
+    /** Partial admin override (code set before rate) must never render NaN. */
+    const eur = formatCost(10, { code: 'EUR', rate: undefined as unknown as number });
+    expect(eur).toContain('€');
+    expect(eur).toContain('10');
+    expect(eur).not.toContain('NaN');
+    expect(formatCost(10, { code: 'USD', rate: Number.NaN })).toBe('$10.00');
+  });
+});
+
+describe('groupToolTokens', () => {
+  it('classifies tools into system, mcp, skills, and subagent groups', () => {
+    const groups = groupToolTokens(
+      {
+        execute_code: 500,
+        web_search: 300,
+        skill: 200,
+        subagent: 150,
+        'search_mcp_Google-Workspace': 400,
+        fetch_mcp_Github: 250,
+      },
+      ['fetch_mcp_Github', 'web_search'],
+    );
+
+    expect(groups).toEqual({
+      system: 500,
+      mcp: 400,
+      skills: 200,
+      subagents: 150,
+      systemDeferred: 300,
+      mcpDeferred: 250,
+    });
+  });
+
+  it('returns empty groups without counts and skips zero entries', () => {
+    expect(groupToolTokens(undefined)).toBe(EMPTY_TOOL_GROUPS);
+    expect(groupToolTokens({ execute_code: 0 })).toEqual(EMPTY_TOOL_GROUPS);
+  });
+});
+
+describe('countTrailingOutputChars', () => {
+  const text = (value: string) => ({ type: 'text', text: value });
+  const think = (value: string) => ({ type: 'think', think: value });
+  const tool = () => ({ type: 'tool_call', tool_call: { id: 'tc' } });
+
+  it('counts the trailing run of text and think parts', () => {
+    expect(countTrailingOutputChars([text('aaaa'), tool(), think('bb'), text('ccc')])).toBe(5);
+  });
+
+  it('returns 0 when the latest part is a tool call (no in-flight output)', () => {
+    /** Once a tool call is emitted, its preceding text is folded into the next
+     *  snapshot's messageTokens — counting it here would double-count. */
+    expect(countTrailingOutputChars([text('aaaa'), tool(), text('ccc'), tool()])).toBe(0);
+  });
+
+  it('stops at the previous tool boundary', () => {
+    expect(countTrailingOutputChars([text('aaaa'), tool(), text('ccc')])).toBe(3);
+  });
+
+  it('handles empty and non-output content', () => {
+    expect(countTrailingOutputChars(undefined)).toBe(0);
+    expect(countTrailingOutputChars([])).toBe(0);
+    expect(countTrailingOutputChars([tool()])).toBe(0);
+  });
+});
+
+describe('per-message usage index (branch + total)', () => {
+  afterEach(() => {
+    clearIndex(CONVO);
+  });
+
+  it('reads metadata.usage onto entries and sums it along the branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      msg('u2', 'a1', true, 30),
+      responseMsg('a2', 'u2', 80, USAGE_B),
+    ]);
+
+    const { usage } = sumBranch(CONVO, 'a2');
+    expect(usage).toEqual({
+      input: 300,
+      output: 130,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.03,
+      costKnown: true,
+    });
+  });
+
+  it('reads persisted display units (incl. cache) directly', () => {
+    /** The backend already normalized per-event; the client reads as-is */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 100, {
+        input: 600,
+        output: 100,
+        cacheWrite: 0,
+        cacheRead: 400,
+        cost: 0.03,
+      }),
+    ]);
+
+    const { usage } = sumBranch(CONVO, 'a1');
+    expect(usage).toEqual({
+      input: 600,
+      output: 100,
+      cacheWrite: 0,
+      cacheRead: 400,
+      cost: 0.03,
+      costKnown: true,
+    });
+  });
+
+  it('marks cost unknown when persisted usage omits cost (contextCost off)', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, { input: 100, output: 50, cacheWrite: 0, cacheRead: 0 }),
+    ]);
+    const { usage } = sumBranch(CONVO, 'a1');
+    expect(usage.costKnown).toBe(false);
+    expect(usage.cost).toBe(0);
+    expect(usage.input).toBe(100);
+  });
+
+  it('messages without metadata.usage contribute zero (backward compat)', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+    expect(sumTotalUsage(CONVO)).toEqual(EMPTY_USAGE);
+  });
+
+  it('preserves a prior entry usage when a rebuilt message lacks metadata.usage', () => {
+    /** Live finalize flushes usage into the index before persisted metadata
+     *  reaches the cache; a mid-session rebuild from a cache message without
+     *  metadata.usage must not wipe it (regenerate keeps the sibling's cost). */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+    /** Rebuild from the same cache (still no metadata.usage on a1) */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('restores branch cost from sticky history after regenerate drops then re-adds a sibling', () => {
+    /** a1 generated live; its cache message never carries metadata.usage */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+
+    /** Regenerate streaming shows only the active branch — a1 is dropped */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1-alt', 'u1', false, 60)]);
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+
+    /** Post-regenerate full rebuild re-adds a1 (still no metadata.usage) */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 50),
+      msg('a1-alt', 'u1', false, 60),
+    ]);
+
+    /** Switching back to branch A must still show its cost (the reported bug) */
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('scopes branch usage to the active thread while total spans all branches', () => {
+    /** Regenerate: a1 and a1-alt are sibling responses under the same user msg */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      responseMsg('a1-alt', 'u1', 80, USAGE_B),
+    ]);
+
+    /** Viewing branch B (the regenerated response) */
+    expect(sumBranch(CONVO, 'a1-alt').usage.cost).toBeCloseTo(0.02);
+    /** Viewing branch A (the original) */
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    /** Total spans both abandoned + active branches */
+    const total = sumTotalUsage(CONVO);
+    expect(total.cost).toBeCloseTo(0.03);
+    expect(total.input).toBe(300);
+    expect(total.output).toBe(130);
+  });
+
+  it('is idempotent across rebuilds', () => {
+    const messages = [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      responseMsg('a1-alt', 'u1', 80, USAGE_B),
+    ];
+    buildIndex(CONVO, messages);
+    const first = sumTotalUsage(CONVO);
+    buildIndex(CONVO, messages);
+    const second = sumTotalUsage(CONVO);
+    expect(second).toEqual(first);
+  });
+
+  it('flushes a live response usage via setEntryUsage (no metadata yet)', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    /** Live response entry has no metadata.usage until persisted; finalize flushes it */
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('mergeUsage sums records and ANDs costKnown (incomplete coverage wins)', () => {
+    const a = { input: 1, output: 2, cacheWrite: 3, cacheRead: 4, cost: 0.5, costKnown: false };
+    const b = { input: 10, output: 20, cacheWrite: 30, cacheRead: 40, cost: 1.5, costKnown: true };
+    expect(mergeUsage(a, b)).toEqual({
+      input: 11,
+      output: 22,
+      cacheWrite: 33,
+      cacheRead: 44,
+      cost: 2,
+      costKnown: false,
+    });
+  });
+
+  it('marks branch cost incomplete when any usage-bearing entry lacks cost', () => {
+    /** A turn saved before cost display was on (no cost) alongside one with cost
+     *  → the summed cost under-reports, so coverage is incomplete. */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, { input: 100, output: 50, cacheWrite: 0, cacheRead: 0 }),
+      responseMsg('a2', 'a1', 60, USAGE_B),
+    ]);
+    const { usage } = sumBranch(CONVO, 'a2');
+    expect(usage.costKnown).toBe(false);
+    /** Cost still sums what it can, but coverage is flagged incomplete */
+    expect(usage.cost).toBeCloseTo(0.02);
+    expect(sumTotalUsage(CONVO).costKnown).toBe(false);
+  });
+
+  it('EMPTY_BRANCH carries an empty usage record', () => {
+    expect(sumBranch('missing-convo', 'x')).toBe(EMPTY_BRANCH);
+    expect(EMPTY_BRANCH.usage).toEqual(EMPTY_USAGE);
+  });
+});
diff --git a/client/src/utils/tokens.ts b/client/src/utils/tokens.ts
new file mode 100644
index 00000000000..adbf65a0971
--- /dev/null
+++ b/client/src/utils/tokens.ts
@@ -0,0 +1,610 @@
+import { Tools, Constants, inputTokensIncludesCache } from 'librechat-data-provider';
+import type { TMessage, TResponseUsage, TTokenUsageEvent } from 'librechat-data-provider';
+
+/** Provider-reported usage of one response, in display units (post-normalize). */
+export interface BranchUsage {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  /** Authoritative USD cost; 0 when `interface.contextCost` was off at save */
+  cost: number;
+  /** Whether cost coverage is COMPLETE — every usage-bearing response summed
+   *  here carried a cost. Gates the cost row so a partial sum (some turns saved
+   *  before cost display was on) never renders an under-reported total. Starts
+   *  true (vacuous) and is ANDed; pair with `hasUsage` to require ≥1 entry. */
+  costKnown: boolean;
+}
+
+export const EMPTY_USAGE: BranchUsage = {
+  input: 0,
+  output: 0,
+  cacheWrite: 0,
+  cacheRead: 0,
+  cost: 0,
+  costKnown: true,
+};
+
+export interface TokenEntry {
+  tokenCount: number;
+  isCreatedByUser: boolean;
+  parentMessageId: string | null;
+  /** Per-response provider usage from `metadata.usage` (response messages only) */
+  usage?: BranchUsage;
+  /** Pre-invoke compacted context size (`metadata.summaryUsedTokens`) for a
+   *  response whose turn summarized. Caps the estimate so it stops re-summing
+   *  the now-discarded pre-summary history. */
+  summaryUsedTokens?: number;
+}
+
+export interface BranchTotals {
+  /** Sum of user-message token counts on the active branch */
+  input: number;
+  /** Sum of assistant-message token counts on the active branch */
+  output: number;
+  /** Messages on the branch with a known tokenCount */
+  counted: number;
+  /** Total messages on the branch */
+  total: number;
+  tailId: string | null;
+  /** Whether the latest run's anchor message is on this branch */
+  containsAnchor: boolean;
+  /** Provider usage/cost summed along the active branch */
+  usage: BranchUsage;
+  /** Compacted-context baseline from the deepest summarized response on the
+   *  branch (0 if none). The branch walk stops there, so `input`/`output` cover
+   *  only the post-summary messages; the estimate adds this to avoid counting
+   *  the discarded pre-summary history. */
+  summaryBaseline: number;
+}
+
+export const EMPTY_BRANCH: BranchTotals = {
+  input: 0,
+  output: 0,
+  counted: 0,
+  total: 0,
+  tailId: null,
+  containsAnchor: false,
+  usage: EMPTY_USAGE,
+  summaryBaseline: 0,
+};
+
+/** Module-level token index: conversationId → messageId → entry. Not render state. */
+const registry = new Map<string, Map<string, TokenEntry>>();
+
+/**
+ * Sticky per-response usage: conversationId → messageId → usage. Written only by
+ * the live finalize/stop flush (`setEntryUsage`) and never rebuilt from the
+ * messages cache, so a response's usage survives mid-session index rebuilds even
+ * when its cache message lacks `metadata.usage` AND it was transiently dropped
+ * from the cache (e.g. a sibling branch during a regenerate). `buildIndex`
+ * restores from here so branch cost persists across branch switches — the cost
+ * analog of `snapshotsByAnchorFamily` for the breakdown. Cleared on convo switch.
+ */
+const usageHistory = new Map<string, Map<string, BranchUsage>>();
+
+function stickyUsage(conversationId: string, messageId: string): BranchUsage | undefined {
+  return usageHistory.get(conversationId)?.get(messageId);
+}
+
+/** Reads the persisted per-response usage rollup off a message's metadata.
+ *  The backend already normalized per-event into display units, so this reads
+ *  them directly. Absent for user messages and pre-feature responses (they
+ *  contribute 0 to branch/total). */
+function readPersistedUsage(message: Partial<TMessage>): BranchUsage | undefined {
+  const usage = message.metadata?.usage;
+  if (usage == null || typeof usage !== 'object') {
+    return undefined;
+  }
+  const persisted = usage as TResponseUsage;
+  return {
+    input: persisted.input ?? 0,
+    output: persisted.output ?? 0,
+    cacheWrite: persisted.cacheWrite ?? 0,
+    cacheRead: persisted.cacheRead ?? 0,
+    cost: persisted.cost ?? 0,
+    /** Cost is omitted when saved with `contextCost` off — don't render $0.00 */
+    costKnown: typeof persisted.cost === 'number',
+  };
+}
+
+/** Pure sum of two usage records — for combining branch/total with pending. */
+export function mergeUsage(a: BranchUsage, b: BranchUsage): BranchUsage {
+  return {
+    input: a.input + b.input,
+    output: a.output + b.output,
+    cacheWrite: a.cacheWrite + b.cacheWrite,
+    cacheRead: a.cacheRead + b.cacheRead,
+    cost: a.cost + b.cost,
+    /** Coverage stays complete only if BOTH sides are complete */
+    costKnown: a.costKnown && b.costKnown,
+  };
+}
+
+/** Accumulates one entry's usage into a running total (in place). */
+function addUsage(target: BranchUsage, usage?: BranchUsage): void {
+  if (usage == null) {
+    return;
+  }
+  target.input += usage.input;
+  target.output += usage.output;
+  target.cacheWrite += usage.cacheWrite;
+  target.cacheRead += usage.cacheRead;
+  target.cost += usage.cost;
+  /** A usage-bearing entry without a cost breaks complete coverage */
+  if (!usage.costKnown) {
+    target.costKnown = false;
+  }
+}
+
+function toEntry(message: Partial<TMessage>): TokenEntry {
+  const summaryUsedTokens = message.metadata?.summaryUsedTokens;
+  return {
+    tokenCount: typeof message.tokenCount === 'number' ? message.tokenCount : 0,
+    isCreatedByUser: message.isCreatedByUser === true,
+    parentMessageId: message.parentMessageId ?? null,
+    usage: readPersistedUsage(message),
+    summaryUsedTokens:
+      typeof summaryUsedTokens === 'number' && summaryUsedTokens > 0
+        ? summaryUsedTokens
+        : undefined,
+  };
+}
+
+/** Full O(n) rebuild — only on discrete cache replacements (load, refetch, edits).
+ *  Restores a response's `usage` from the sticky history when the rebuilt message
+ *  carries none: per-message usage is immutable and the live finalize flushes it
+ *  into the index (`setEntryUsage`) before the persisted `metadata.usage` reaches
+ *  the cache, so a mid-session rebuild (e.g. during regenerate) must not wipe an
+ *  earlier branch's flushed usage — which would drop its branch cost on switch. */
+export function buildIndex(conversationId: string, messages?: TMessage[] | null): void {
+  const index = new Map<string, TokenEntry>();
+  if (messages != null) {
+    for (const message of messages) {
+      if (message?.messageId) {
+        const entry = toEntry(message);
+        if (entry.usage == null) {
+          entry.usage = stickyUsage(conversationId, message.messageId);
+        }
+        index.set(message.messageId, entry);
+      }
+    }
+  }
+  registry.set(conversationId, index);
+}
+
+/** Incremental upsert — final SSE events touch at most two entries */
+export function upsertEntries(
+  conversationId: string,
+  messages: (Partial<TMessage> | null | undefined)[],
+): void {
+  let index = registry.get(conversationId);
+  if (!index) {
+    index = new Map<string, TokenEntry>();
+    registry.set(conversationId, index);
+  }
+  for (const message of messages) {
+    if (message?.messageId) {
+      const entry = toEntry(message);
+      if (entry.usage == null) {
+        entry.usage = stickyUsage(conversationId, message.messageId);
+      }
+      index.set(message.messageId, entry);
+    }
+  }
+}
+
+/** Re-keys the index when `new` resolves to a real conversation id */
+export function migrateIndex(fromId: string, toId: string): void {
+  if (fromId === toId) {
+    return;
+  }
+  const index = registry.get(fromId);
+  if (index) {
+    registry.delete(fromId);
+    registry.set(toId, index);
+  }
+  const usage = usageHistory.get(fromId);
+  if (usage) {
+    usageHistory.delete(fromId);
+    usageHistory.set(toId, usage);
+  }
+}
+
+export function clearIndex(conversationId: string): void {
+  registry.delete(conversationId);
+  usageHistory.delete(conversationId);
+}
+
+export function hasIndex(conversationId: string): boolean {
+  return registry.has(conversationId);
+}
+
+/** O(depth) walk from the branch tail up the parent chain */
+export function sumBranch(
+  conversationId: string,
+  tailId: string | null | undefined,
+  anchorId?: string | null,
+): BranchTotals {
+  const index = registry.get(conversationId);
+  if (!index || !tailId) {
+    return EMPTY_BRANCH;
+  }
+
+  const totals = { input: 0, output: 0, counted: 0, total: 0, containsAnchor: false };
+  const usage: BranchUsage = { ...EMPTY_USAGE };
+  let summaryBaseline = 0;
+  /** Once a summary marker is crossed, older turns are out of the CONTEXT WINDOW
+   *  (subsumed by the baseline) — but their provider spend still happened, so the
+   *  usage/cost walk continues to the root while context counting stops. */
+  let contextCapped = false;
+  let currentId: string | null = tailId;
+  let guard = index.size;
+
+  while (currentId && currentId !== Constants.NO_PARENT && guard-- > 0) {
+    const entry: TokenEntry | undefined = index.get(currentId);
+    if (!entry) {
+      break;
+    }
+    totals.total += 1;
+    /** Only match the anchor while still inside the active context window. An
+     *  anchor OLDER than the deepest summary marker belongs to a pre-summary
+     *  snapshot; treating it as on-branch would let `useTokenUsage` revive that
+     *  stale breakdown (discarded history) over the summary-baseline estimate
+     *  that `findBranchSnapshotAnchor` correctly refuses to recover. */
+    if (!contextCapped && anchorId != null && currentId === anchorId) {
+      totals.containsAnchor = true;
+    }
+    if (!contextCapped && entry.tokenCount > 0) {
+      totals.counted += 1;
+      if (entry.isCreatedByUser) {
+        totals.input += entry.tokenCount;
+      } else {
+        totals.output += entry.tokenCount;
+      }
+    }
+    /** Cost/usage is cumulative spend — never truncated at the summary boundary. */
+    addUsage(usage, entry.usage);
+    /** This response's turn compacted the history: its own output is counted
+     *  above; record the pre-invoke compacted baseline and stop counting context
+     *  tokens for older (summarized-away) turns, but keep walking for cost. */
+    if (!contextCapped && entry.summaryUsedTokens != null) {
+      summaryBaseline = entry.summaryUsedTokens;
+      contextCapped = true;
+    }
+    currentId = entry.parentMessageId;
+  }
+
+  return { ...totals, tailId, usage, summaryBaseline };
+}
+
+/**
+ * Sums provider usage/cost across EVERY message in the conversation (all
+ * branches, including regenerated/abandoned responses) — the conversation
+ * total, shown alongside the branch figure when they differ.
+ */
+export function sumTotalUsage(conversationId: string): BranchUsage {
+  const usage: BranchUsage = { ...EMPTY_USAGE };
+  const index = registry.get(conversationId);
+  if (!index) {
+    return usage;
+  }
+  for (const entry of index.values()) {
+    addUsage(usage, entry.usage);
+  }
+  return usage;
+}
+
+/**
+ * Attaches a response's usage to its index entry AND the sticky usage history.
+ * Used by the live finalize/stop flush. The history copy lets `buildIndex`
+ * restore the usage after a rebuild (the persisted `metadata.usage` reaches
+ * `buildIndex` on reload; the sticky copy covers the in-session window before
+ * that, including a sibling transiently dropped from the cache on regenerate).
+ */
+export function setEntryUsage(conversationId: string, messageId: string, usage: BranchUsage): void {
+  /** Remember it durably first so a later rebuild — or a transient cache drop
+   *  during regenerate — can restore it even when the entry isn't present yet. */
+  let history = usageHistory.get(conversationId);
+  if (!history) {
+    history = new Map<string, BranchUsage>();
+    usageHistory.set(conversationId, history);
+  }
+  history.set(messageId, usage);
+  const entry = registry.get(conversationId)?.get(messageId);
+  if (entry) {
+    entry.usage = usage;
+  }
+}
+
+/**
+ * Walks the branch tail up the parent chain and returns the first message id
+ * present in `anchors` — i.e. the deepest (most recent) stored snapshot anchor
+ * on the viewed branch. Used to recover a branch's granular breakdown after a
+ * later generation on a sibling branch overwrote the live snapshot.
+ */
+export function findBranchSnapshotAnchor(
+  conversationId: string,
+  tailId: string | null | undefined,
+  anchors: ReadonlyMap<string, unknown>,
+): string | null {
+  const index = registry.get(conversationId);
+  if (!index || !tailId || anchors.size === 0) {
+    return null;
+  }
+
+  let currentId: string | null = tailId;
+  let guard = index.size;
+
+  while (currentId && currentId !== Constants.NO_PARENT && guard-- > 0) {
+    if (anchors.has(currentId)) {
+      return currentId;
+    }
+    const entry: TokenEntry | undefined = index.get(currentId);
+    if (!entry) {
+      break;
+    }
+    /** Stop at a summarized response that has no snapshot of its own: crossing it
+     *  would recover an older PRE-summary snapshot (discarded history), which the
+     *  summary-baseline estimate is meant to replace. */
+    if (entry.summaryUsedTokens != null) {
+      return null;
+    }
+    currentId = entry.parentMessageId;
+  }
+
+  return null;
+}
+
+export interface ToolTokenGroups {
+  system: number;
+  mcp: number;
+  skills: number;
+  subagents: number;
+  systemDeferred: number;
+  mcpDeferred: number;
+}
+
+export const EMPTY_TOOL_GROUPS: ToolTokenGroups = {
+  system: 0,
+  mcp: 0,
+  skills: 0,
+  subagents: 0,
+  systemDeferred: 0,
+  mcpDeferred: 0,
+};
+
+/**
+ * Classifies per-tool schema tokens into display groups: built-in system
+ * tools, MCP tools, skills, and subagents — with deferred (on-demand) tools
+ * split out for the system/MCP groups.
+ */
+export function groupToolTokens(
+  toolTokenCounts?: Record<string, number>,
+  deferredToolNames?: string[],
+): ToolTokenGroups {
+  if (toolTokenCounts == null) {
+    return EMPTY_TOOL_GROUPS;
+  }
+  const deferred = new Set(deferredToolNames ?? []);
+  const groups = { ...EMPTY_TOOL_GROUPS };
+  for (const [name, tokens] of Object.entries(toolTokenCounts)) {
+    if (tokens <= 0) {
+      continue;
+    }
+    if (name === Tools.skill) {
+      groups.skills += tokens;
+    } else if (name === Constants.SUBAGENT) {
+      groups.subagents += tokens;
+    } else if (name.includes(Constants.mcp_delimiter)) {
+      if (deferred.has(name)) {
+        groups.mcpDeferred += tokens;
+      } else {
+        groups.mcp += tokens;
+      }
+    } else if (deferred.has(name)) {
+      groups.systemDeferred += tokens;
+    } else {
+      groups.system += tokens;
+    }
+  }
+  return groups;
+}
+
+function getOutputChars(part: unknown): number | null {
+  if (part == null || typeof part !== 'object') {
+    return null;
+  }
+  const { text, think } = part as { text?: unknown; think?: unknown };
+  if (typeof text === 'string') {
+    return text.length;
+  }
+  if (typeof think === 'string') {
+    return think.length;
+  }
+  return null;
+}
+
+/**
+ * Chars of the contiguous text/think parts at the very END of aggregated
+ * content — the output the model is actively producing on the current call,
+ * which the latest pre-invoke context snapshot does not yet account for.
+ *
+ * Crucially this does NOT skip a trailing tool-call part: once the model has
+ * emitted a tool call, that call's text is already folded into the next
+ * snapshot's `messageTokens`, so counting it would double-count against the
+ * snapshot. A tool call at the end therefore yields 0 (nothing new in flight).
+ */
+export function countTrailingOutputChars(content?: unknown[] | null): number {
+  if (!Array.isArray(content) || content.length === 0) {
+    return 0;
+  }
+  let chars = 0;
+  for (let i = content.length - 1; i >= 0; i--) {
+    const partChars = getOutputChars(content[i]);
+    if (partChars == null) {
+      break;
+    }
+    chars += partChars;
+  }
+  return chars;
+}
+
+/** Rough live estimate for streaming text, calibrated by the last known provider ratio */
+export function estimateTokens(charCount: number, calibrationRatio = 1): number {
+  if (charCount <= 0) {
+    return 0;
+  }
+  const ratio = calibrationRatio > 0 ? calibrationRatio : 1;
+  return Math.round((charCount / 4) * ratio);
+}
+
+/** Billable token quantities of one or more model calls, normalized for pricing */
+export interface CostUnits {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+}
+
+/**
+ * Normalizes one call's usage into billable units, mirroring the backend's
+ * authoritative `splitUsage`/`resolveCompletionTokens`
+ * (packages/api/src/agents/usage.ts):
+ *   - cache classification is by provider, not magnitude — Anthropic/Bedrock
+ *     keep cache additive (input is uncached-only); subset providers fold
+ *     cache into `input_tokens`. Falls back to a magnitude heuristic only when
+ *     the provider is unknown.
+ *   - completion is repaired for providers (e.g. Vertex) that under-report
+ *     `output_tokens` but carry the gap in `total_tokens`.
+ * Applied per event so units stay correct when summed across calls.
+ */
+export function normalizeUsageUnits(usage: TTokenUsageEvent): CostUnits {
+  const rawInput = usage.input_tokens ?? 0;
+  const rawOutput = usage.output_tokens ?? 0;
+  const total = usage.total_tokens ?? 0;
+  const cacheWrite = usage.input_token_details?.cache_creation ?? 0;
+  const cacheRead = usage.input_token_details?.cache_read ?? 0;
+
+  const includesCache =
+    usage.provider != null
+      ? inputTokensIncludesCache(usage.provider)
+      : cacheWrite + cacheRead <= rawInput;
+
+  const cacheAdjustment = includesCache ? 0 : cacheRead + cacheWrite;
+  const output =
+    total > rawInput + rawOutput + cacheAdjustment ? total - rawInput - cacheAdjustment : rawOutput;
+
+  return {
+    input: includesCache ? Math.max(0, rawInput - cacheRead - cacheWrite) : rawInput,
+    output,
+    cacheWrite,
+    cacheRead,
+  };
+}
+
+export function formatTokens(count: number): string {
+  const formatted = new Intl.NumberFormat(undefined, {
+    notation: 'compact',
+    maximumFractionDigits: 1,
+  }).format(count);
+  return formatted.replace(/\.0(?=[A-Za-z]|$)/, '');
+}
+
+/** Display currency for the context cost. `rate` is a static USD→local
+ *  multiplier (no live FX); `code` is an ISO-4217 currency for Intl formatting. */
+export interface CurrencyConfig {
+  code: string;
+  rate: number;
+}
+
+const DEFAULT_CURRENCY: CurrencyConfig = { code: 'USD', rate: 1 };
+const currencyFormatters = new Map<string, Intl.NumberFormat>();
+const currencyDigits = new Map<string, number>();
+let supportedCurrencies: Set<string> | null | undefined;
+
+/** True only for codes recognized as ISO-4217. `Intl.NumberFormat` accepts any
+ *  well-formed three-letter code (e.g. `EUU`, `RMB`) without throwing, so the
+ *  ISO-4217 set is the real guard against typo'd / non-ISO codes. */
+function isSupportedCurrency(code: unknown): code is string {
+  if (typeof code !== 'string' || code.length === 0) {
+    return false;
+  }
+  const upper = code.toUpperCase();
+  if (supportedCurrencies === undefined) {
+    const supportedValuesOf = (
+      Intl as typeof Intl & { supportedValuesOf?: (key: string) => string[] }
+    ).supportedValuesOf;
+    supportedCurrencies =
+      typeof supportedValuesOf === 'function' ? new Set(supportedValuesOf('currency')) : null;
+  }
+  if (supportedCurrencies != null) {
+    return supportedCurrencies.has(upper);
+  }
+  /** Older runtime without `supportedValuesOf`: accept any code Intl can build. */
+  try {
+    new Intl.NumberFormat(undefined, { style: 'currency', currency: upper });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Default fraction digits for a validated currency: USD→2, JPY→0, KWD→3. */
+function maxFractionDigits(code: string): number {
+  const cached = currencyDigits.get(code);
+  if (cached !== undefined) {
+    return cached;
+  }
+  const digits =
+    new Intl.NumberFormat(undefined, { style: 'currency', currency: code }).resolvedOptions()
+      .maximumFractionDigits ?? 2;
+  currencyDigits.set(code, digits);
+  return digits;
+}
+
+function currencyFormatter(code: string, minDigits: number, maxDigits: number): Intl.NumberFormat {
+  const key = `${code}:${minDigits}:${maxDigits}`;
+  let formatter = currencyFormatters.get(key);
+  if (formatter == null) {
+    formatter = new Intl.NumberFormat(undefined, {
+      style: 'currency',
+      currency: code,
+      minimumFractionDigits: minDigits,
+      maximumFractionDigits: maxDigits,
+    });
+    currencyFormatters.set(key, formatter);
+  }
+  return formatter;
+}
+
+export function formatCost(usd: number, currency: CurrencyConfig = DEFAULT_CURRENCY): string {
+  /** Resolve to a safe (code, rate): an unsupported code falls back to USD AND
+   *  rate 1 — never present a converted amount under the wrong symbol. A
+   *  non-finite/negative rate (e.g. a partial admin override that set `code`
+   *  before `rate`) falls back to 1 so a cost never renders as `NaN`. */
+  let code = DEFAULT_CURRENCY.code;
+  let rate = 1;
+  if (isSupportedCurrency(currency?.code)) {
+    code = currency.code.toUpperCase();
+    rate = Number.isFinite(currency?.rate) && (currency.rate as number) > 0 ? currency.rate : 1;
+  }
+  const base = maxFractionDigits(code);
+
+  const amount = usd * rate;
+  /** The currency's own minor unit — USD/EUR→0.01, JPY→1, KWD→0.001. */
+  const smallest = Math.pow(10, -base);
+
+  if (amount <= 0) {
+    return currencyFormatter(code, base, base).format(0);
+  }
+  if (amount < smallest) {
+    return `<${currencyFormatter(code, base, base).format(smallest)}`;
+  }
+  if (amount < 1 && base > 0) {
+    /** Extra precision for sub-unit costs; trailing zeros trim to the currency's
+     *  own scale (min = base). */
+    return currencyFormatter(code, base, base + 2).format(amount);
+  }
+  return currencyFormatter(code, base, base).format(amount);
+}
diff --git a/client/sw/heal.js b/client/sw/heal.js
new file mode 100644
index 00000000000..40c79368a39
--- /dev/null
+++ b/client/sw/heal.js
@@ -0,0 +1,60 @@
+/* Runs inside the generated service worker via workbox `importScripts`.
+ * When a new build's worker activates, pages served from a previous build
+ * can no longer load their hashed chunks (the old precache is purged) and
+ * carry no recovery code of their own — the worker is the only code path
+ * stale clients fetch fresh. Ping every window client; reload the ones
+ * that cannot answer. */
+const PING_TYPE = 'LC_SW_PING';
+const PONG_TYPE = 'LC_SW_PONG';
+const PONG_TIMEOUT_MS = 1500;
+
+const pendingPongs = new Map();
+
+self.addEventListener('message', (event) => {
+  if (!event.data || event.data.type !== PONG_TYPE || !event.source) {
+    return;
+  }
+  const resolvePong = pendingPongs.get(event.source.id);
+  if (resolvePong) {
+    pendingPongs.delete(event.source.id);
+    resolvePong(true);
+  }
+});
+
+function pingClient(client) {
+  return new Promise((resolve) => {
+    pendingPongs.set(client.id, resolve);
+    setTimeout(() => {
+      if (pendingPongs.delete(client.id)) {
+        resolve(false);
+      }
+    }, PONG_TIMEOUT_MS);
+    client.postMessage({ type: PING_TYPE });
+  });
+}
+
+async function reloadUnresponsiveClients() {
+  await self.clients.claim();
+  const windowClients = await self.clients.matchAll({
+    type: 'window',
+    includeUncontrolled: true,
+  });
+  const topLevelClients = windowClients.filter((client) => client.frameType !== 'nested');
+  await Promise.all(
+    topLevelClients.map(async (client) => {
+      const responsive = await pingClient(client);
+      if (responsive) {
+        return;
+      }
+      try {
+        await client.navigate(client.url);
+      } catch {
+        /* client closed or no longer controllable */
+      }
+    }),
+  );
+}
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(reloadUnresponsiveClients());
+});
diff --git a/client/tailwind.config.cjs b/client/tailwind.config.cjs
index 624998e9d80..4cdace6d3df 100644
--- a/client/tailwind.config.cjs
+++ b/client/tailwind.config.cjs
@@ -47,6 +47,11 @@ module.exports = {
           '0%': { transform: 'translateX(0)' },
           '100%': { transform: 'translateX(100%)' },
         },
+        'shortcut-shake': {
+          '0%, 100%': { transform: 'translateX(0)' },
+          '25%': { transform: 'translateX(-3px)' },
+          '75%': { transform: 'translateX(3px)' },
+        },
       },
       animation: {
         'fade-in': 'fadeIn 0.5s ease-out forwards',
@@ -56,6 +61,7 @@ module.exports = {
         'slide-in-left': 'slide-in-left 300ms cubic-bezier(0.25, 0.1, 0.25, 1)',
         'slide-out-left': 'slide-out-left 300ms cubic-bezier(0.25, 0.1, 0.25, 1)',
         'slide-out-right': 'slide-out-right 300ms cubic-bezier(0.25, 0.1, 0.25, 1)',
+        'shortcut-shake': 'shortcut-shake 0.25s ease-in-out',
       },
       colors: {
         gray: {
diff --git a/client/tsconfig.json b/client/tsconfig.json
index fcf799dd1d5..582ce560c18 100644
--- a/client/tsconfig.json
+++ b/client/tsconfig.json
@@ -28,10 +28,8 @@
   "include": [
     "src/**/*",
     "test/**/*",
-    "../e2e/**/*",
     "test/setupTests.js",
     "env.d.ts",
-    "../config/translations/**/*.ts",
     "../packages/client/src/hooks/useDelayedRender.tsx",
     "../packages/client/src/components/InfoHoverCard.tsx"
   ]
diff --git a/client/vite.config.ts b/client/vite.config.ts
index 3c0886ec180..bf6fb53ff3e 100644
--- a/client/vite.config.ts
+++ b/client/vite.config.ts
@@ -1,4 +1,5 @@
 import react from '@vitejs/plugin-react';
+import fs from 'fs';
 import path from 'path';
 import { defineConfig } from 'vite';
 import { createRequire } from 'module';
@@ -12,7 +13,7 @@ const require = createRequire(import.meta.url);
 /**
  * vite-plugin-node-polyfills uses @rollup/plugin-inject to replace bare globals (e.g. `process`)
  * with imports like `import process from 'vite-plugin-node-polyfills/shims/process'`. When the
- * consuming module (e.g. recoil) is hoisted to the monorepo root, Vite 7's ESM resolver walks up
+ * consuming module (e.g. recoil) is hoisted to the monorepo root, Vite's ESM resolver walks up
  * from there and never finds the shims (installed only in client/node_modules). This map resolves
  * the shim specifiers to absolute paths via CJS require.resolve anchored to the client directory.
  */
@@ -33,6 +34,14 @@ const backendPort = (process.env.BACKEND_PORT && Number(process.env.BACKEND_PORT
 const backendURL = process.env.HOST
   ? `http://${process.env.HOST}:${backendPort}`
   : `http://localhost:${backendPort}`;
+const buildSourceMap = process.env.NODE_ENV === 'development';
+const QUERY_DEVTOOLS_CHUNK_MODULES = [
+  '@tanstack/react-query-devtools',
+  '@tanstack/match-sorter-utils',
+  'node_modules/superjson',
+  'node_modules/copy-anything',
+  'node_modules/is-what',
+];
 
 export default defineConfig(({ command }) => ({
   base: '',
@@ -65,6 +74,17 @@ export default defineConfig(({ command }) => ({
       },
     },
     nodePolyfills(),
+    {
+      name: 'emit-sw-heal',
+      apply: 'build',
+      generateBundle() {
+        this.emitFile({
+          type: 'asset',
+          fileName: 'sw-heal.js',
+          source: fs.readFileSync(path.resolve(__dirname, 'sw/heal.js'), 'utf8'),
+        });
+      },
+    },
     VitePWA({
       injectRegister: 'auto', // 'auto' | 'manual' | 'disabled'
       registerType: 'autoUpdate', // 'prompt' | 'autoUpdate'
@@ -82,9 +102,38 @@ export default defineConfig(({ command }) => ({
           'assets/maskable-icon.png',
           'manifest.webmanifest',
         ],
-        globIgnores: ['images/**/*', '**/*.map', 'index.html'],
+        globIgnores: [
+          'images/**/*',
+          '**/*.map',
+          'index.html',
+          'sw-heal.js',
+          'assets/rum.*.js',
+          'assets/locale-*.js',
+          'assets/query-devtools*.js',
+        ],
         maximumFileSizeToCacheInBytes: 4 * 1024 * 1024,
-        navigateFallbackDenylist: [/^\/oauth/, /^\/api/],
+        /** LibreChat mutates index.html per request for subpath and language support. */
+        navigateFallback: null,
+        /** Reloads window clients that cannot answer a ping after activation —
+         * pages stuck on a previous build's purged precache (stale index.html)
+         * have no working code of their own to recover with. */
+        importScripts: ['sw-heal.js'],
+        runtimeCaching: [
+          {
+            urlPattern: ({ url }) => /\/assets\/locale-[^/]+\.js$/.test(url.pathname),
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'locale-chunks',
+              cacheableResponse: {
+                statuses: [0, 200],
+              },
+              expiration: {
+                maxEntries: 80,
+                maxAgeSeconds: 30 * 24 * 60 * 60,
+              },
+            },
+          },
+        ],
       },
       includeAssets: [],
       manifest: {
@@ -123,172 +172,206 @@ export default defineConfig(({ command }) => ({
         ],
       },
     }),
-    sourcemapExclude({ excludeNodeModules: true }),
+    ...(buildSourceMap ? [sourcemapExclude({ excludeNodeModules: true })] : []),
     compression({
       threshold: 10240,
     }),
   ],
   publicDir: command === 'serve' ? './public' : false,
   build: {
-    sourcemap: process.env.NODE_ENV === 'development',
+    sourcemap: buildSourceMap,
     outDir: './dist',
-    minify: 'terser',
-    rollupOptions: {
+    minify: 'oxc',
+    rolldownOptions: {
       preserveEntrySignatures: 'strict',
       output: {
-        manualChunks(id: string) {
-          const normalizedId = id.replace(/\\/g, '/');
-          if (normalizedId.includes('node_modules')) {
-            // High-impact chunking for large libraries
+        codeSplitting: {
+          groups: [
+            {
+              name(id: string) {
+                const normalizedId = id.replace(/\\/g, '/');
+                if (normalizedId.includes('node_modules')) {
+                  if (normalizedId.includes('/node_modules/regenerator-runtime/')) {
+                    return 'polyfills';
+                  }
 
-            // IMPORTANT: mermaid and ALL its dependencies must be in the same chunk
-            // to avoid initialization order issues. This includes chevrotain, langium,
-            // dagre-d3-es, and their nested lodash-es dependencies.
-            if (
-              normalizedId.includes('mermaid') ||
-              normalizedId.includes('dagre-d3-es') ||
-              normalizedId.includes('chevrotain') ||
-              normalizedId.includes('langium') ||
-              normalizedId.includes('lodash-es')
-            ) {
-              return 'mermaid';
-            }
+                  if (normalizedId.includes('@hyperdx/')) {
+                    return 'rum';
+                  }
 
-            if (normalizedId.includes('@codesandbox/sandpack')) {
-              return 'sandpack';
-            }
-            if (normalizedId.includes('react-vtree')) {
-              return 'react-vtree';
-            }
-            if (normalizedId.includes('react-virtualized')) {
-              return 'virtualization';
-            }
-            if (normalizedId.includes('i18next') || normalizedId.includes('react-i18next')) {
-              return 'i18n';
-            }
-            // Only regular lodash (not lodash-es which goes to mermaid chunk)
-            if (normalizedId.includes('/lodash/')) {
-              return 'utilities';
-            }
-            if (normalizedId.includes('date-fns')) {
-              return 'date-utils';
-            }
-            if (normalizedId.includes('@dicebear')) {
-              return 'avatars';
-            }
-            if (
-              normalizedId.includes('react-dnd') ||
-              normalizedId.includes('dnd-core') ||
-              normalizedId.includes('react-flip-toolkit') ||
-              normalizedId.includes('flip-toolkit')
-            ) {
-              return 'react-interactions';
-            }
-            if (normalizedId.includes('react-hook-form')) {
-              return 'forms';
-            }
-            if (normalizedId.includes('react-router-dom')) {
-              return 'routing';
-            }
-            if (
-              normalizedId.includes('qrcode.react') ||
-              normalizedId.includes('@marsidev/react-turnstile')
-            ) {
-              return 'security-ui';
-            }
+                  // IMPORTANT: mermaid and ALL its dependencies must be in the same chunk
+                  // to avoid initialization order issues. This includes chevrotain, langium,
+                  // dagre-d3-es, and their nested lodash-es dependencies.
+                  if (
+                    normalizedId.includes('mermaid') ||
+                    normalizedId.includes('dagre-d3-es') ||
+                    normalizedId.includes('chevrotain') ||
+                    normalizedId.includes('langium') ||
+                    normalizedId.includes('lodash-es')
+                  ) {
+                    return 'mermaid';
+                  }
 
-            if (normalizedId.includes('@codemirror/view')) {
-              return 'codemirror-view';
-            }
-            if (normalizedId.includes('@codemirror/state')) {
-              return 'codemirror-state';
-            }
-            if (normalizedId.includes('@codemirror/language')) {
-              return 'codemirror-language';
-            }
-            if (normalizedId.includes('@codemirror')) {
-              return 'codemirror-core';
-            }
+                  if (normalizedId.includes('@codesandbox/sandpack')) {
+                    return 'sandpack';
+                  }
+                  if (normalizedId.includes('react-vtree')) {
+                    return 'react-vtree';
+                  }
+                  if (normalizedId.includes('react-virtualized')) {
+                    return 'virtualization';
+                  }
+                  if (normalizedId.includes('i18next') || normalizedId.includes('react-i18next')) {
+                    return 'i18n';
+                  }
+                  // Only regular lodash (not lodash-es which goes to mermaid chunk)
+                  if (normalizedId.includes('/lodash/')) {
+                    return 'utilities';
+                  }
+                  if (normalizedId.includes('date-fns')) {
+                    return 'date-utils';
+                  }
+                  if (normalizedId.includes('@dicebear')) {
+                    return 'avatars';
+                  }
+                  if (
+                    normalizedId.includes('react-dnd') ||
+                    normalizedId.includes('dnd-core') ||
+                    normalizedId.includes('react-flip-toolkit') ||
+                    normalizedId.includes('flip-toolkit')
+                  ) {
+                    return 'react-interactions';
+                  }
+                  if (normalizedId.includes('react-hook-form')) {
+                    return 'forms';
+                  }
+                  if (normalizedId.includes('react-router-dom')) {
+                    return 'routing';
+                  }
+                  if (
+                    normalizedId.includes('qrcode.react') ||
+                    normalizedId.includes('@marsidev/react-turnstile')
+                  ) {
+                    return 'security-ui';
+                  }
 
-            if (
-              normalizedId.includes('react-markdown') ||
-              normalizedId.includes('remark-') ||
-              normalizedId.includes('rehype-')
-            ) {
-              return 'markdown-processing';
-            }
-            if (normalizedId.includes('monaco-editor') || normalizedId.includes('@monaco-editor')) {
-              return 'code-editor';
-            }
-            if (normalizedId.includes('react-window') || normalizedId.includes('react-virtual')) {
-              return 'virtualization';
-            }
-            if (
-              normalizedId.includes('zod') ||
-              normalizedId.includes('yup') ||
-              normalizedId.includes('joi')
-            ) {
-              return 'validation';
-            }
-            if (
-              normalizedId.includes('axios') ||
-              normalizedId.includes('ky') ||
-              normalizedId.includes('fetch')
-            ) {
-              return 'http-client';
-            }
-            if (
-              normalizedId.includes('react-spring') ||
-              normalizedId.includes('react-transition-group')
-            ) {
-              return 'animations';
-            }
-            if (normalizedId.includes('react-select') || normalizedId.includes('downshift')) {
-              return 'advanced-inputs';
-            }
-            if (normalizedId.includes('heic-to')) {
-              return 'heic-converter';
-            }
+                  if (normalizedId.includes('@codemirror/view')) {
+                    return 'codemirror-view';
+                  }
+                  if (normalizedId.includes('@codemirror/state')) {
+                    return 'codemirror-state';
+                  }
+                  if (normalizedId.includes('@codemirror/language')) {
+                    return 'codemirror-language';
+                  }
+                  if (normalizedId.includes('@codemirror')) {
+                    return 'codemirror-core';
+                  }
 
-            // Existing chunks
-            if (normalizedId.includes('@radix-ui')) {
-              return 'radix-ui';
-            }
-            if (normalizedId.includes('framer-motion')) {
-              return 'framer-motion';
-            }
-            if (
-              normalizedId.includes('node_modules/highlight.js') ||
-              normalizedId.includes('node_modules/lowlight')
-            ) {
-              return 'markdown_highlight';
-            }
-            if (normalizedId.includes('katex') || normalizedId.includes('node_modules/katex')) {
-              return 'math-katex';
-            }
-            if (normalizedId.includes('node_modules/hast-util-raw')) {
-              return 'markdown_large';
-            }
-            if (normalizedId.includes('@tanstack')) {
-              return 'tanstack-vendor';
-            }
-            if (normalizedId.includes('@headlessui')) {
-              return 'headlessui';
-            }
+                  if (
+                    normalizedId.includes('react-markdown') ||
+                    normalizedId.includes('remark-') ||
+                    normalizedId.includes('rehype-')
+                  ) {
+                    return 'markdown-processing';
+                  }
+                  if (
+                    normalizedId.includes('monaco-editor') ||
+                    normalizedId.includes('@monaco-editor')
+                  ) {
+                    return 'code-editor';
+                  }
+                  if (
+                    normalizedId.includes('react-window') ||
+                    normalizedId.includes('react-virtual')
+                  ) {
+                    return 'virtualization';
+                  }
+                  if (
+                    normalizedId.includes('zod') ||
+                    normalizedId.includes('yup') ||
+                    normalizedId.includes('joi')
+                  ) {
+                    return 'validation';
+                  }
+                  if (
+                    normalizedId.includes('axios') ||
+                    normalizedId.includes('ky') ||
+                    normalizedId.includes('fetch')
+                  ) {
+                    return 'http-client';
+                  }
+                  if (
+                    normalizedId.includes('react-spring') ||
+                    normalizedId.includes('react-transition-group')
+                  ) {
+                    return 'animations';
+                  }
+                  if (normalizedId.includes('react-select') || normalizedId.includes('downshift')) {
+                    return 'advanced-inputs';
+                  }
+                  if (normalizedId.includes('heic-to')) {
+                    return 'heic-converter';
+                  }
 
-            if (normalizedId.includes('@icons-pack/react-simple-icons/icons/')) {
-              return;
-            }
+                  // Existing chunks
+                  if (normalizedId.includes('@radix-ui')) {
+                    return 'radix-ui';
+                  }
+                  if (normalizedId.includes('framer-motion')) {
+                    return 'framer-motion';
+                  }
+                  if (
+                    normalizedId.includes('node_modules/highlight.js') ||
+                    normalizedId.includes('node_modules/lowlight')
+                  ) {
+                    return 'markdown_highlight';
+                  }
+                  if (
+                    normalizedId.includes('katex') ||
+                    normalizedId.includes('node_modules/katex')
+                  ) {
+                    return 'math-katex';
+                  }
+                  if (normalizedId.includes('node_modules/hast-util-raw')) {
+                    return 'markdown_large';
+                  }
+                  if (
+                    QUERY_DEVTOOLS_CHUNK_MODULES.some((moduleName) =>
+                      normalizedId.includes(moduleName),
+                    )
+                  ) {
+                    return 'query-devtools';
+                  }
+                  if (normalizedId.includes('@tanstack')) {
+                    return 'tanstack-vendor';
+                  }
+                  if (normalizedId.includes('@headlessui')) {
+                    return 'headlessui';
+                  }
 
-            // Everything else falls into a generic vendor chunk.
-            return 'vendor';
-          }
-          // Create a separate chunk for all locale files under src/locales.
-          if (normalizedId.includes('/src/locales/')) {
-            return 'locales';
-          }
-          // Let Rollup decide automatically for any other files.
-          return null;
+                  if (normalizedId.includes('@icons-pack/react-simple-icons/icons/')) {
+                    return null;
+                  }
+
+                  // Everything else falls into a generic vendor chunk.
+                  return 'vendor';
+                }
+                if (normalizedId.includes('/src/polyfills/')) {
+                  return 'polyfills';
+                }
+                // Keep lazy-loaded locale files in one chunk per locale.
+                const localeMatch = normalizedId.match(
+                  /\/src\/locales\/([^/]+)\/translation\.json$/,
+                );
+                if (localeMatch) {
+                  return localeMatch[1] === 'en' ? null : `locale-${localeMatch[1]}`;
+                }
+                // Let Rolldown decide automatically for any other files.
+                return null;
+              },
+            },
+          ],
         },
         entryFileNames: 'assets/[name].[hash].js',
         chunkFileNames: 'assets/[name].[hash].js',
diff --git a/config/__tests__/migrate-shared-link-permissions.spec.js b/config/__tests__/migrate-shared-link-permissions.spec.js
new file mode 100644
index 00000000000..246d5e7e975
--- /dev/null
+++ b/config/__tests__/migrate-shared-link-permissions.spec.js
@@ -0,0 +1,218 @@
+jest.mock('../connect', () => jest.fn().mockResolvedValue(true));
+jest.mock('@librechat/api', () => ({
+  ensureRequiredCollectionsExist: jest.fn().mockResolvedValue(undefined),
+  matchModelName: jest.fn(),
+  findMatchingPattern: jest.fn(),
+}));
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+jest.mock('~/cache/getLogStores', () => jest.fn());
+
+const mongoose = require('mongoose');
+const { MongoMemoryServer } = require('mongodb-memory-server');
+const { createMethods, SYSTEM_TENANT_ID, tenantStorage } = require('@librechat/data-schemas');
+
+describe('migrate-shared-link-permissions', () => {
+  let mongoServer;
+  let SharedLink, AclEntry;
+  let migrateSharedLinkPermissions;
+  const testUserId = new mongoose.Types.ObjectId();
+
+  beforeAll(async () => {
+    mongoServer = await MongoMemoryServer.create();
+    await mongoose.connect(mongoServer.getUri());
+
+    const migration = require('../migrate-shared-link-permissions');
+    migrateSharedLinkPermissions = migration.migrateSharedLinkPermissions;
+
+    SharedLink = mongoose.models.SharedLink;
+    AclEntry = mongoose.models.AclEntry;
+
+    await createMethods(mongoose).seedDefaultRoles();
+  });
+
+  afterAll(async () => {
+    await mongoose.disconnect();
+    await mongoServer.stop();
+  });
+
+  beforeEach(async () => {
+    await AclEntry.deleteMany({});
+    await SharedLink.deleteMany({});
+    jest.restoreAllMocks();
+  });
+
+  async function createLegacyLink(isPublic = true, user = testUserId, overrides = {}) {
+    const link = await SharedLink.create({
+      shareId: `share-${Date.now()}-${Math.random()}`,
+      conversationId: 'convo1',
+      messages: [],
+      ...(user != null ? { user } : {}),
+      ...overrides,
+    });
+    await mongoose.connection.db
+      .collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  test('removes isPublic from all links on success', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.errors).toBe(0);
+    expect(result.failedLinkCount).toBe(0);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+    expect(raw1).not.toHaveProperty('isPublic');
+    expect(raw2).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic on links with partial write errors', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+    const link3 = await createLegacyLink(true);
+
+    const originalBulkWrite = AclEntry.bulkWrite.bind(AclEntry);
+    jest.spyOn(AclEntry, 'bulkWrite').mockImplementationOnce(async (ops, options) => {
+      const failedIndices = [];
+      const successOps = [];
+
+      for (let i = 0; i < ops.length; i++) {
+        if (ops[i].updateOne.filter.resourceId.equals(link2._id)) {
+          failedIndices.push(i);
+        } else {
+          successOps.push(ops[i]);
+        }
+      }
+
+      if (successOps.length > 0) {
+        await originalBulkWrite(successOps, options);
+      }
+
+      const error = new Error('Partial bulk write failure');
+      error.writeErrors = failedIndices.map((idx) => ({
+        index: idx,
+        errmsg: 'Simulated write error',
+      }));
+      throw error;
+    });
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.failedLinkCount).toBe(1);
+    expect(result.errors).toBeGreaterThan(0);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+    const raw3 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link3._id });
+
+    expect(raw2).toHaveProperty('isPublic', true);
+    expect(raw1).not.toHaveProperty('isPublic');
+    expect(raw3).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic on all batch links when bulk write fails entirely', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+
+    jest.spyOn(AclEntry, 'bulkWrite').mockRejectedValueOnce(new Error('Connection lost'));
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.failedLinkCount).toBe(2);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+
+    expect(raw1).toHaveProperty('isPublic', true);
+    expect(raw2).toHaveProperty('isPublic', true);
+  });
+
+  test('does not grant PUBLIC VIEWER to isPublic false links when forced', async () => {
+    const link = await createLegacyLink(false);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, force: true });
+
+    expect(result.aborted).toBeUndefined();
+    expect(result.publicViewerSkipped).toBe(1);
+
+    const publicEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'public',
+    }).lean();
+    expect(publicEntry).toBeNull();
+
+    const ownerEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'user',
+    }).lean();
+    expect(ownerEntry).toBeDefined();
+  });
+
+  test('reports private legacy links during dry run without aborting', async () => {
+    await createLegacyLink(false);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: true });
+
+    expect(result.aborted).toBeUndefined();
+    expect(result.dryRun).toBe(true);
+    expect(result.summary.withIsPublicFalse).toBe(1);
+  });
+
+  test('grants PUBLIC VIEWER to ownerless public legacy links', async () => {
+    const link = await createLegacyLink(true, null);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false });
+
+    expect(result.missingUserWarnings).toBe(1);
+
+    const publicEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'public',
+    }).lean();
+    expect(publicEntry).toBeDefined();
+    expect(publicEntry).not.toHaveProperty('grantedBy');
+
+    const ownerEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'user',
+    }).lean();
+    expect(ownerEntry).toBeNull();
+  });
+
+  test('copies shared link expiration to migrated ACL entries', async () => {
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    const link = await createLegacyLink(true, testUserId, { expiredAt });
+
+    await migrateSharedLinkPermissions({ dryRun: false });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+    for (const entry of entries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+  });
+
+  test('runs the migration body inside a system tenant context', async () => {
+    await createLegacyLink(true);
+    const contextsObserved = [];
+    const originalCountDocuments = SharedLink.countDocuments.bind(SharedLink);
+    SharedLink.countDocuments = jest.fn((...args) => {
+      contextsObserved.push(tenantStorage.getStore()?.tenantId);
+      return originalCountDocuments(...args);
+    });
+
+    try {
+      await migrateSharedLinkPermissions({ dryRun: true });
+      expect(contextsObserved).toContain(SYSTEM_TENANT_ID);
+    } finally {
+      SharedLink.countDocuments = originalCountDocuments;
+    }
+  });
+});
diff --git a/config/create-user.js b/config/create-user.js
index 3688d736e24..4d05211acc5 100644
--- a/config/create-user.js
+++ b/config/create-user.js
@@ -103,10 +103,11 @@ or the user will need to attempt logging in to have a verification link sent to
     silentExit(1);
   }
 
-  const user = { email, password, name, username, confirm_password: password, provider };
+  const user = { email, password, name, username, confirm_password: password };
+  const additionalData = { emailVerified, ...(provider !== undefined ? { provider } : {}) };
   let result;
   try {
-    result = await registerUser(user, { emailVerified });
+    result = await registerUser(user, additionalData);
   } catch (error) {
     console.red('Error: ' + error.message);
     silentExit(1);
diff --git a/config/jest.config.js b/config/jest.config.js
new file mode 100644
index 00000000000..f3bccbb890f
--- /dev/null
+++ b/config/jest.config.js
@@ -0,0 +1,18 @@
+const path = require('path');
+const apiConfig = require('../api/jest.config');
+
+const apiDir = path.resolve(__dirname, '..', 'api');
+
+const resolvedMapper = Object.fromEntries(
+  Object.entries(apiConfig.moduleNameMapper).map(([key, value]) => [
+    key,
+    value.replace('<rootDir>', apiDir),
+  ]),
+);
+
+module.exports = {
+  ...apiConfig,
+  roots: ['<rootDir>'],
+  setupFiles: apiConfig.setupFiles.map((f) => path.resolve(apiDir, f)),
+  moduleNameMapper: resolvedMapper,
+};
diff --git a/config/migrate-shared-link-permissions.js b/config/migrate-shared-link-permissions.js
new file mode 100644
index 00000000000..f106cd46046
--- /dev/null
+++ b/config/migrate-shared-link-permissions.js
@@ -0,0 +1,357 @@
+const path = require('path');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
+const { ensureRequiredCollectionsExist } = require('@librechat/api');
+
+require('module-alias')({ base: path.resolve(__dirname, '..', 'api') });
+const connect = require('./connect');
+
+const { findRoleByIdentifier } = require('~/models');
+const { SharedLink, AclEntry } = require('~/db/models');
+
+/**
+ * String literals matching `librechat-data-provider` enums so this script
+ * runs standalone without requiring a built data-provider package.
+ */
+const RESOURCE_TYPE_SHARED_LINK = 'sharedLink';
+const ROLE_ID_OWNER = 'sharedLink_owner';
+const ROLE_ID_VIEWER = 'sharedLink_viewer';
+const PRINCIPAL_USER = 'user';
+const PRINCIPAL_PUBLIC = 'public';
+
+async function migrateSharedLinkPermissions({
+  dryRun = true,
+  batchSize = 100,
+  force = false,
+} = {}) {
+  await connect();
+
+  return runAsSystem(async () => {
+    logger.info('Starting SharedLink Permissions Migration', { dryRun, batchSize, force });
+
+    const mongoose = require('mongoose');
+    /** @type {import('mongoose').mongo.Db | undefined} */
+    const db = mongoose.connection.db;
+    if (db) {
+      await ensureRequiredCollectionsExist(db);
+    }
+
+    const ownerRole = await findRoleByIdentifier(ROLE_ID_OWNER);
+    const viewerRole = await findRoleByIdentifier(ROLE_ID_VIEWER);
+
+    if (!ownerRole || !viewerRole) {
+      throw new Error(
+        'Required sharedLink roles not found (sharedLink_owner, sharedLink_viewer). Run role seeding first.',
+      );
+    }
+
+    logger.info('Roles resolved', {
+      owner: { id: ownerRole._id, permBits: ownerRole.permBits },
+      viewer: { id: viewerRole._id, permBits: viewerRole.permBits },
+    });
+
+    // --- Safety check: abort if isPublic: false documents exist (unless --force) ---
+    // Raw driver bypasses mongoose strictQuery: true, which silently strips query
+    // keys absent from the schema. isPublic was removed from the schema by this
+    // migration, so Mongoose queries like { isPublic: false } become {} (match all).
+    const rawCollection = mongoose.connection.db.collection('sharedlinks');
+    const isPublicFalseCount = await rawCollection.countDocuments({ isPublic: false });
+    if (!dryRun && isPublicFalseCount > 0 && !force) {
+      const sample = await rawCollection
+        .find({ isPublic: false })
+        .project({ _id: 1, shareId: 1, user: 1 })
+        .limit(20)
+        .toArray();
+
+      const sampleIds = sample.map((doc) => doc._id.toString());
+      logger.error(
+        `Found ${isPublicFalseCount} SharedLink documents with isPublic: false. ` +
+          'These may have been intentionally marked non-public. ' +
+          'Use --force to proceed anyway (they will NOT receive a PUBLIC VIEWER grant).',
+        { sampleIds },
+      );
+      return {
+        aborted: true,
+        reason: 'isPublic: false documents found',
+        isPublicFalseCount,
+        sampleIds,
+      };
+    }
+
+    // --- Count totals for progress reporting ---
+    const totalLinks = await SharedLink.countDocuments({});
+    logger.info(`Found ${totalLinks} SharedLink documents total`);
+
+    if (totalLinks === 0) {
+      logger.info('No SharedLink documents to migrate');
+      return { migrated: 0, errors: 0, skipped: 0, dryRun };
+    }
+
+    // --- Dry run: scan and categorize ---
+    if (dryRun) {
+      const withUser = await SharedLink.countDocuments({ user: { $exists: true, $ne: null } });
+      const withoutUser = await SharedLink.countDocuments({
+        $or: [{ user: { $exists: false } }, { user: null }],
+      });
+      const withIsPublicTrue = await rawCollection.countDocuments({ isPublic: true });
+      const withIsPublicFalse = isPublicFalseCount;
+      const withIsPublicField = await rawCollection.countDocuments({ isPublic: { $exists: true } });
+
+      const alreadyMigratedOwner = await AclEntry.countDocuments({
+        resourceType: RESOURCE_TYPE_SHARED_LINK,
+        principalType: PRINCIPAL_USER,
+      });
+      const alreadyMigratedPublic = await AclEntry.countDocuments({
+        resourceType: RESOURCE_TYPE_SHARED_LINK,
+        principalType: PRINCIPAL_PUBLIC,
+      });
+
+      return {
+        migrated: 0,
+        errors: 0,
+        dryRun: true,
+        summary: {
+          totalLinks,
+          withUser,
+          withoutUser,
+          withIsPublicTrue,
+          withIsPublicFalse,
+          withIsPublicField,
+          alreadyMigratedOwner,
+          alreadyMigratedPublic,
+        },
+      };
+    }
+
+    // --- Live migration: cursor-based batch processing ---
+    const failedLinkIds = new Set();
+
+    const results = {
+      migrated: 0,
+      errors: 0,
+      skipped: 0,
+      ownerGrants: 0,
+      ownerSkipped: 0,
+      publicViewerGrants: 0,
+      publicViewerSkipped: 0,
+      missingUserWarnings: 0,
+    };
+
+    const cursor = SharedLink.find({})
+      .select('_id user isPublic tenantId expiredAt')
+      .lean()
+      .cursor();
+
+    let batch = [];
+    let batchIndex = 0;
+
+    /**
+     * Process a single batch of SharedLink documents.
+     * Collects upsert operations into a single bulkWrite for efficiency.
+     * Tracks which op indices map to which link IDs so write failures
+     * can be attributed to specific links.
+     */
+    async function processBatch(links) {
+      const bulkOps = [];
+      const opIndexToLinkId = [];
+
+      for (const link of links) {
+        const linkId = link._id;
+        const userId = link.user;
+        const tenantId = link.tenantId;
+        const expiredAt = link.expiredAt;
+        const now = new Date();
+
+        if (userId) {
+          opIndexToLinkId.push(linkId);
+          bulkOps.push({
+            updateOne: {
+              filter: {
+                resourceType: RESOURCE_TYPE_SHARED_LINK,
+                resourceId: linkId,
+                principalType: PRINCIPAL_USER,
+                principalId: new mongoose.Types.ObjectId(userId),
+              },
+              update: {
+                $set: {
+                  permBits: ownerRole.permBits,
+                  roleId: ownerRole._id,
+                  grantedBy: new mongoose.Types.ObjectId(userId),
+                  grantedAt: now,
+                  ...(expiredAt && { expiredAt }),
+                },
+                $setOnInsert: {
+                  principalModel: 'User',
+                  ...(tenantId && { tenantId }),
+                },
+              },
+              upsert: true,
+            },
+          });
+        } else {
+          results.missingUserWarnings++;
+          logger.warn('SharedLink has no user field, skipping OWNER grant', {
+            linkId: linkId.toString(),
+          });
+        }
+
+        const hasIsPublic = link.isPublic !== undefined;
+        if (hasIsPublic && link.isPublic === false) {
+          results.publicViewerSkipped++;
+        } else if (hasIsPublic) {
+          const publicUpdateSet = {
+            permBits: viewerRole.permBits,
+            roleId: viewerRole._id,
+            grantedAt: now,
+            ...(expiredAt && { expiredAt }),
+          };
+          if (userId) {
+            publicUpdateSet.grantedBy = new mongoose.Types.ObjectId(userId);
+          }
+
+          opIndexToLinkId.push(linkId);
+          bulkOps.push({
+            updateOne: {
+              filter: {
+                resourceType: RESOURCE_TYPE_SHARED_LINK,
+                resourceId: linkId,
+                principalType: PRINCIPAL_PUBLIC,
+              },
+              update: {
+                $set: publicUpdateSet,
+                $setOnInsert: {
+                  ...(tenantId && { tenantId }),
+                },
+              },
+              upsert: true,
+            },
+          });
+        }
+
+        results.migrated++;
+      }
+
+      if (bulkOps.length > 0) {
+        try {
+          const bulkResult = await AclEntry.bulkWrite(bulkOps, { ordered: false });
+          results.ownerGrants += bulkResult.upsertedCount;
+        } catch (error) {
+          if (error.writeErrors) {
+            results.errors += error.writeErrors.length;
+            for (const writeError of error.writeErrors) {
+              const failedId = opIndexToLinkId[writeError.index];
+              if (failedId) {
+                failedLinkIds.add(failedId);
+              }
+              logger.error('Failed to migrate SharedLink in bulk', {
+                error: writeError.errmsg,
+                linkId: failedId?.toString(),
+              });
+            }
+          } else {
+            results.errors += links.length;
+            for (const link of links) {
+              failedLinkIds.add(link._id);
+            }
+            logger.error('Bulk write failed entirely', { error: error.message });
+          }
+        }
+      }
+    }
+
+    for await (const doc of cursor) {
+      batch.push(doc);
+
+      if (batch.length >= batchSize) {
+        batchIndex++;
+        const totalBatches = Math.ceil(totalLinks / batchSize);
+
+        if (batchIndex % 5 === 0 || batchIndex === 1) {
+          logger.info(`Processing batch ${batchIndex}/${totalBatches}`, {
+            migrated: results.migrated,
+            errors: results.errors,
+          });
+        }
+
+        await processBatch(batch);
+        batch = [];
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    }
+
+    // Process remaining documents
+    if (batch.length > 0) {
+      batchIndex++;
+      const totalBatches = Math.ceil(totalLinks / batchSize);
+      logger.info(`Processing final batch ${batchIndex}/${totalBatches}`, {
+        remaining: batch.length,
+      });
+      await processBatch(batch);
+    }
+
+    // --- $unset isPublic only from successfully migrated documents ---
+    const unsetFilter = { isPublic: { $exists: true } };
+    if (failedLinkIds.size > 0) {
+      unsetFilter._id = { $nin: [...failedLinkIds] };
+      logger.warn(
+        `Skipping isPublic removal for ${failedLinkIds.size} links with failed ACL grants`,
+        { failedLinkIds: [...failedLinkIds].map((id) => id.toString()) },
+      );
+    }
+
+    logger.info('Removing isPublic field from successfully migrated SharedLink documents...');
+    const unsetResult = await rawCollection.updateMany(unsetFilter, { $unset: { isPublic: 1 } });
+    logger.info(`Removed isPublic field from ${unsetResult.modifiedCount} documents`);
+
+    results.isPublicFieldsRemoved = unsetResult.modifiedCount;
+    results.failedLinkCount = failedLinkIds.size;
+
+    logger.info('SharedLink migration completed', results);
+    return results;
+  });
+}
+
+if (require.main === module) {
+  const dryRun = process.argv.includes('--dry-run');
+  const force = process.argv.includes('--force');
+  const batchSize =
+    parseInt(process.argv.find((arg) => arg.startsWith('--batch-size='))?.split('=')[1]) || 100;
+
+  migrateSharedLinkPermissions({ dryRun, batchSize, force })
+    .then((result) => {
+      if (result.aborted) {
+        console.log('\n=== MIGRATION ABORTED ===');
+        console.log(`Reason: ${result.reason}`);
+        console.log(`Documents with isPublic: false: ${result.isPublicFalseCount}`);
+        console.log(`Sample IDs: ${result.sampleIds.join(', ')}`);
+        console.log('\nUse --force to proceed anyway');
+        process.exit(1);
+      }
+
+      if (dryRun) {
+        console.log('\n=== DRY RUN RESULTS ===');
+        console.log(`Total SharedLink documents: ${result.summary.totalLinks}`);
+        console.log(`- With user field: ${result.summary.withUser}`);
+        console.log(`- Without user field: ${result.summary.withoutUser}`);
+        console.log(`- With isPublic: true: ${result.summary.withIsPublicTrue}`);
+        console.log(`- With isPublic: false: ${result.summary.withIsPublicFalse}`);
+        console.log(`- With isPublic field present: ${result.summary.withIsPublicField}`);
+        console.log(
+          `\nAlready migrated (OWNER AclEntries): ${result.summary.alreadyMigratedOwner}`,
+        );
+        console.log(
+          `Already migrated (PUBLIC AclEntries): ${result.summary.alreadyMigratedPublic}`,
+        );
+        console.log('\nTo run the actual migration, remove the --dry-run flag');
+      } else {
+        console.log('\n=== MIGRATION RESULTS ===');
+        console.log(JSON.stringify(result, null, 2));
+      }
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('SharedLink migration failed:', error);
+      process.exit(1);
+    });
+}
+
+module.exports = { migrateSharedLinkPermissions };
diff --git a/config/set-balance.js b/config/set-balance.js
index e2dc73139bd..7e5a2ee3e02 100644
--- a/config/set-balance.js
+++ b/config/set-balance.js
@@ -3,9 +3,9 @@ const mongoose = require('mongoose');
 const { getBalanceConfig } = require('@librechat/api');
 const { User, Balance } = require('@librechat/data-schemas').createModels(mongoose);
 require('module-alias')({ base: path.resolve(__dirname, '..', 'api') });
+const { getAppConfig } = require('~/server/services/Config');
 const { askQuestion, silentExit } = require('./helpers');
 const connect = require('./connect');
-const { getAppConfig } = require('~/server/services/Config');
 
 (async () => {
   await connect();
diff --git a/deploy-compose.yml b/deploy-compose.yml
index 5d7bcebcd0d..a024d972590 100644
--- a/deploy-compose.yml
+++ b/deploy-compose.yml
@@ -23,6 +23,14 @@ services:
       - MEILI_HOST=http://meilisearch:7700
       - RAG_PORT=${RAG_PORT:-8000}
       - RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
+      - PROXY=${PROXY:-}
+      - HTTP_PROXY=${HTTP_PROXY:-}
+      - HTTPS_PROXY=${HTTPS_PROXY:-}
+      - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1,::1},${no_proxy:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
+      - http_proxy=${http_proxy:-}
+      - https_proxy=${https_proxy:-}
+      - no_proxy=${no_proxy:-localhost,127.0.0.1,::1},${NO_PROXY:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
+      - ADMIN_PANEL_URL=${ADMIN_PANEL_URL:-http://admin.localhost}
     volumes:
       - type: bind
         source: ./librechat.yaml
@@ -30,6 +38,22 @@ services:
       - ./images:/app/client/public/images
       - ./uploads:/app/uploads
       - ./logs:/app/api/logs
+      - ./skill:/app/skill
+
+  admin-panel:
+    image: registry.librechat.ai/clickhouse/librechat-admin-panel:latest
+    container_name: admin-panel
+    depends_on:
+      - api
+    restart: always
+    environment:
+      - PORT=3000
+      # Plain expansion (not :?) so `docker compose down`/`pull` still run when this is unset.
+      # The panel itself refuses to start without it; set ADMIN_PANEL_SESSION_SECRET in .env.
+      - SESSION_SECRET=${ADMIN_PANEL_SESSION_SECRET}
+      - API_SERVER_URL=http://api:3080
+      - VITE_API_BASE_URL=${DOMAIN_CLIENT:-http://localhost}
+      - SESSION_COOKIE_SECURE=${ADMIN_PANEL_SESSION_COOKIE_SECURE:-false}
 
   client:
     image: nginx:1.27.0-alpine
@@ -39,6 +63,7 @@ services:
       - 443:443
     depends_on:
       - api
+      - admin-panel
     restart: always
     volumes:
       - ./client/nginx.conf:/etc/nginx/conf.d/default.conf
diff --git a/docker-compose.yml b/docker-compose.yml
index 6c95c309b46..0fada4bb69c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,6 +20,13 @@ services:
       - MEILI_HOST=http://meilisearch:7700
       - RAG_PORT=${RAG_PORT:-8000}
       - RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
+      - PROXY=${PROXY:-}
+      - HTTP_PROXY=${HTTP_PROXY:-}
+      - HTTPS_PROXY=${HTTPS_PROXY:-}
+      - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1,::1},${no_proxy:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
+      - http_proxy=${http_proxy:-}
+      - https_proxy=${https_proxy:-}
+      - no_proxy=${no_proxy:-localhost,127.0.0.1,::1},${NO_PROXY:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
     volumes:
       - type: bind
         source: ./.env
@@ -27,6 +34,23 @@ services:
       - ./images:/app/client/public/images
       - ./uploads:/app/uploads
       - ./logs:/app/logs
+      - ./skill:/app/skill
+  admin-panel:
+    container_name: admin-panel
+    image: registry.librechat.ai/clickhouse/librechat-admin-panel:latest
+    ports:
+      - "${ADMIN_PANEL_PORT:-3000}:3000"
+    depends_on:
+      - api
+    restart: always
+    environment:
+      - PORT=3000
+      # Plain expansion (not :?) so `docker compose down`/`pull` still run when this is unset.
+      # The panel itself refuses to start without it; set ADMIN_PANEL_SESSION_SECRET in .env.
+      - SESSION_SECRET=${ADMIN_PANEL_SESSION_SECRET}
+      - API_SERVER_URL=http://api:${PORT:-3080}
+      - VITE_API_BASE_URL=${DOMAIN_CLIENT:-http://localhost:3080}
+      - SESSION_COOKIE_SECURE=${ADMIN_PANEL_SESSION_COOKIE_SECURE:-false}
   mongodb:
     container_name: chat-mongodb
     image: mongo:8.0.20
diff --git a/e2e/README.md b/e2e/README.md
new file mode 100644
index 00000000000..86ec9124475
--- /dev/null
+++ b/e2e/README.md
@@ -0,0 +1,40 @@
+# LibreChat e2e
+
+The mock e2e profile is the safest default for generated tests. It starts LibreChat with `e2e/config/librechat.e2e.yaml`, injects an in-process fake LLM (via `LIBRECHAT_TEST_RUN_HOOK`), creates an authenticated e2e user, and avoids real provider credentials.
+
+## Recording Tests
+
+Use Playwright codegen when you want to turn an exploratory browser session into a draft test:
+
+```sh
+npm run e2e:record
+```
+
+That command builds the app, starts the LibreChat test server (with an in-process fake LLM) when needed, writes `e2e/storageState.json`, and opens Playwright codegen at `/c/new`. The npm script uses `http://localhost:3333` so it does not collide with a normal dev server on `3080`. Raw recordings are written to `e2e/recordings/` and ignored by git.
+
+For a real local LibreChat config instead of the mock profile:
+
+```sh
+npm run e2e:record:local
+```
+
+Useful direct options:
+
+```sh
+node e2e/setup/record.js --url=http://localhost:3080/c/new
+node e2e/setup/record.js --profile=local --no-output
+node e2e/setup/record.js --auth-only
+node e2e/setup/record.js --output=e2e/recordings/settings-draft.spec.ts
+```
+
+## LLM-Assisted Loop
+
+1. Start `npm run e2e:record`.
+2. Let the LLM use Computer Use to operate the headed Playwright browser.
+3. Stop codegen after the workflow is captured.
+4. Move the useful parts from `e2e/recordings/` into a committed spec under `e2e/specs/mock/`.
+5. Replace brittle generated selectors with role, label, text, or `data-testid` locators.
+6. Add assertions that prove the behavior, not just the clicked path.
+7. Run the finished spec with `npm run e2e:mock -- <spec name>`.
+
+Generated recordings are a draft, not the final test. The committed version should use the shared helpers in `e2e/specs/mock/helpers.ts` where possible, wait on network or visible UI state instead of fixed sleeps, and keep test data deterministic.
diff --git a/e2e/config/librechat.e2e.yaml b/e2e/config/librechat.e2e.yaml
new file mode 100644
index 00000000000..daa5154bb4e
--- /dev/null
+++ b/e2e/config/librechat.e2e.yaml
@@ -0,0 +1,150 @@
+# Credential-free e2e config template. e2e/playwright.config.mock.ts copies this
+# to an ignored runtime path; the in-process fake model (e2e/setup/fake-model.js)
+# overrides each run, so the placeholder baseURL below is never contacted.
+version: 1.3.11
+cache: true
+
+interface:
+  # Exercises the cost row in the context usage gauge (off by default).
+  # Mock models price at the default rate, so synthetic usage yields a value.
+  contextCost: true
+
+mcpSettings:
+  # Deliberately excludes 127.0.0.1, so the URL-based `e2e-http` server below is blocked
+  # at boot (stored as inspectionFailed). mcp-allowlist-override.spec.ts adds that origin
+  # via an admin-panel config override and asserts the server reinitializes — proving the
+  # admin override is honored by inspection/connection. stdio servers skip this check.
+  allowedDomains:
+    - https://allowed.example.com
+
+mcpServers:
+  e2e-memory:
+    type: stdio
+    command: node
+    args:
+      - e2e/setup/fake-mcp-server.js
+    title: E2E Memory
+    description: Local MCP fixture used by mock end-to-end tests.
+    timeout: 30000
+  e2e-http:
+    type: streamable-http
+    url: http://127.0.0.1:8765/mcp
+    title: E2E HTTP
+    description: Local HTTP MCP fixture for allowlist-override e2e tests.
+    timeout: 30000
+
+endpoints:
+  custom:
+    - name: 'Mock Provider A'
+      apiKey: 'e2e-mock-key-a'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-a'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider A'
+      customParams:
+        defaultParamsEndpoint: anthropic
+
+    - name: 'Mock Provider B'
+      apiKey: 'e2e-mock-key-b'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-b'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider B'
+
+    # No model spec mirrors this endpoint's label, so it stays unambiguous in the
+    # selector and gives e2e tests a real ephemeral endpoint → model option.
+    - name: 'Mock Provider C'
+      apiKey: 'e2e-mock-key-c'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-c'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider C'
+
+    # Second non-spec endpoint so e2e tests can switch between two real
+    # ephemeral endpoints (e.g. MCP selection persistence across switches).
+    - name: 'Mock Provider D'
+      apiKey: 'e2e-mock-key-d'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-d'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider D'
+
+modelSpecs:
+  prioritize: true
+  # Enforcement would reject sends from the non-spec paths addedEndpoints
+  # exposes below (buildEndpointOption requires a spec when enforce is true).
+  enforce: false
+  # Surfaces the endpoints menu (modelSelect defaults on when addedEndpoints is
+  # set) limited to entries that don't collide with the spec labels above.
+  addedEndpoints:
+    - 'Mock Provider C'
+    - 'Mock Provider D'
+    - 'agents'
+  list:
+    - name: 'e2e-mock-provider-a'
+      label: 'Mock Provider A'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-mock-provider-b'
+      label: 'Mock Provider B'
+      preset:
+        endpoint: 'Mock Provider B'
+        model: 'mock-model-b'
+
+    - name: 'e2e-icon-spec'
+      label: 'E2E Icon Spec'
+      iconURL: '/assets/openai.svg'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-skill-scope'
+      label: 'E2E Skill Scope'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+      skills:
+        - 'e2e-model-spec-allowed'
+        - 'e2e-model-spec-missing'
+        - 'e2e-model-spec-inaccessible'
+
+    - name: 'e2e-soft-default'
+      label: 'E2E Soft Default'
+      softDefault: true
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-branded'
+      label: 'E2E Branded'
+      description: '<strong>Branded</strong> answers <img src="/assets/openai.svg" alt="brand icon">'
+      showOnLanding: true
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-starters'
+      label: 'E2E Starters'
+      conversation_starters:
+        - 'E2E_REPLY:starter'
+        - 'Plan my week'
+        - 'Third starter prompt'
+        - 'Fourth starter prompt'
+        - 'Fifth starter beyond the cap'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
diff --git a/e2e/config/librechat.real.yaml b/e2e/config/librechat.real.yaml
new file mode 100644
index 00000000000..7c8c3b4bd52
--- /dev/null
+++ b/e2e/config/librechat.real.yaml
@@ -0,0 +1,10 @@
+# Real-provider local e2e template. Used only by e2e/playwright.config.real.ts,
+# which requires ANTHROPIC_API_KEY in the invoking environment — the key is
+# passed through process env at runtime and never written to disk. Not wired
+# into CI; the mock workflow only runs playwright.config.mock.ts.
+version: 1.3.11
+cache: true
+
+interface:
+  # Exercise the cost row against real provider usage.
+  contextCost: true
diff --git a/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md b/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md
new file mode 100644
index 00000000000..a0d1d260ece
--- /dev/null
+++ b/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md
@@ -0,0 +1,10 @@
+---
+name: e2e-deployment-skill
+description: Use this deployment skill to verify shared skills load during Playwright startup.
+always-apply: true
+user-invocable: true
+---
+
+# E2E Deployment Skill
+
+E2E deployment skill loaded through Playwright from the configured deployment skills directory.
diff --git a/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt b/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt
new file mode 100644
index 00000000000..17ca54fd454
--- /dev/null
+++ b/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt
@@ -0,0 +1 @@
+deployment skill file fixture
diff --git a/e2e/jestSetup.js b/e2e/jestSetup.js
index e9acb4a9314..49d92eb8c86 100644
--- a/e2e/jestSetup.js
+++ b/e2e/jestSetup.js
@@ -1,3 +1,3 @@
-// v0.8.6-rc1
+// v0.8.7
 // See .env.test.example for an example of the '.env.test' file.
 require('dotenv').config({ path: './e2e/.env.test' });
diff --git a/e2e/playwright.config.local.ts b/e2e/playwright.config.local.ts
index 5281836ac25..bd7d674e7d1 100644
--- a/e2e/playwright.config.local.ts
+++ b/e2e/playwright.config.local.ts
@@ -1,10 +1,15 @@
 import { PlaywrightTestConfig } from '@playwright/test';
 import mainConfig from './playwright.config';
+import { getLocalE2EEnv } from './setup/env';
 import path from 'path';
-const absolutePath = path.resolve(process.cwd(), 'api/server/index.js');
+const rootPath = path.resolve(__dirname, '..');
+const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
 import dotenv from 'dotenv';
 dotenv.config();
 
+const e2eEnv = getLocalE2EEnv();
+Object.assign(process.env, e2eEnv);
+
 const config: PlaywrightTestConfig = {
   ...mainConfig,
   retries: 0,
@@ -12,43 +17,8 @@ const config: PlaywrightTestConfig = {
   globalTeardown: require.resolve('./setup/global-teardown.local'),
   webServer: {
     ...mainConfig.webServer,
-    command: `node ${absolutePath}`,
-    env: {
-      ...process.env,
-      SEARCH: 'false',
-      NODE_ENV: 'CI',
-      EMAIL_HOST: '',
-      TITLE_CONVO: 'false',
-      SESSION_EXPIRY: '60000',
-      REFRESH_TOKEN_EXPIRY: '300000',
-      LOGIN_VIOLATION_SCORE: '0',
-      REGISTRATION_VIOLATION_SCORE: '0',
-      CONCURRENT_VIOLATION_SCORE: '0',
-      MESSAGE_VIOLATION_SCORE: '0',
-      NON_BROWSER_VIOLATION_SCORE: '0',
-      FORK_VIOLATION_SCORE: '0',
-      IMPORT_VIOLATION_SCORE: '0',
-      TTS_VIOLATION_SCORE: '0',
-      STT_VIOLATION_SCORE: '0',
-      FILE_UPLOAD_VIOLATION_SCORE: '0',
-      RESET_PASSWORD_VIOLATION_SCORE: '0',
-      VERIFY_EMAIL_VIOLATION_SCORE: '0',
-      TOOL_CALL_VIOLATION_SCORE: '0',
-      CONVO_ACCESS_VIOLATION_SCORE: '0',
-      ILLEGAL_MODEL_REQ_SCORE: '0',
-      LOGIN_MAX: '20',
-      LOGIN_WINDOW: '1',
-      REGISTER_MAX: '20',
-      REGISTER_WINDOW: '1',
-      LIMIT_CONCURRENT_MESSAGES: 'false',
-      CONCURRENT_MESSAGE_MAX: '20',
-      LIMIT_MESSAGE_IP: 'false',
-      MESSAGE_IP_MAX: '100',
-      MESSAGE_IP_WINDOW: '1',
-      LIMIT_MESSAGE_USER: 'false',
-      MESSAGE_USER_MAX: '100',
-      MESSAGE_USER_WINDOW: '1',
-    },
+    command: `node ${serverPath}`,
+    cwd: rootPath,
   },
   fullyParallel: false, // if you are on Windows, keep this as `false`. On a Mac, `true` could make tests faster (maybe on some Windows too, just try)
   // workers: 1,
diff --git a/e2e/playwright.config.mock.ts b/e2e/playwright.config.mock.ts
new file mode 100644
index 00000000000..74aac8dbd03
--- /dev/null
+++ b/e2e/playwright.config.mock.ts
@@ -0,0 +1,150 @@
+import { defineConfig, devices } from '@playwright/test';
+import fs from 'fs';
+import path from 'path';
+import { getLocalE2EEnv, getE2EBaseURL } from './setup/env';
+
+const rootPath = path.resolve(__dirname, '..');
+const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
+const mcpHttpServerPath = path.resolve(rootPath, 'e2e/setup/fake-mcp-http-server.js');
+/** Must match the `e2e-http` server URL in e2e/config/librechat.e2e.yaml. */
+const MCP_HTTP_PORT = process.env.E2E_MCP_HTTP_PORT || '8765';
+const fakeModelHookPath = path.resolve(rootPath, 'e2e/setup/fake-model.js');
+const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.e2e.yaml');
+const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.e2e.yaml');
+const reportPath = path.resolve(rootPath, 'e2e/playwright-report');
+const deploymentSkillsPath = path.resolve(rootPath, 'e2e/fixtures/deployment-skills');
+
+const baseURL = getE2EBaseURL();
+const chromiumChannel = process.env.E2E_CHROMIUM_CHANNEL || undefined;
+
+const vanillaOverrides = {
+  TENANT_ISOLATION_STRICT: 'false',
+  OPENAI_API_KEY: 'user_provided',
+  OPENID_CLIENT_ID: '',
+  OPENID_ISSUER: '',
+  OPENID_AUTO_REDIRECT: 'false',
+  ALLOW_SOCIAL_LOGIN: 'false',
+  ALLOW_SOCIAL_REGISTRATION: 'false',
+  STREAM_KEEP_COMPLETED_JOBS: 'true',
+};
+
+const baseEnv = {
+  ...getLocalE2EEnv(),
+  CONFIG_PATH: configPath,
+  DEPLOYMENT_SKILLS_DIR: deploymentSkillsPath,
+  /** Loaded in-process by `@librechat/api`'s `createRun` to swap in a fake model. */
+  LIBRECHAT_TEST_RUN_HOOK: fakeModelHookPath,
+  ...vanillaOverrides,
+};
+
+const SECRET_KEY_PATTERN = /(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIALS|CLIENT_ID|_KEY)$/i;
+const preservedCredentialEnvKeys = new Set([
+  ...Object.keys(baseEnv),
+  'E2E_USER_PASSWORD',
+  'E2E_USER_B_PASSWORD',
+]);
+
+/**
+ * The custom endpoints in the template point at an unreachable baseURL; the fake
+ * model injected via `LIBRECHAT_TEST_RUN_HOOK` overrides the run before any
+ * request is made, so no real (or mock HTTP) provider is contacted.
+ */
+function writeRuntimeMockConfig() {
+  const template = fs.readFileSync(configTemplatePath, 'utf8');
+  const config =
+    process.env.E2E_MODEL_SPECS_ENFORCE === 'true'
+      ? template.replace('\n  enforce: false\n', '\n  enforce: true\n')
+      : template;
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, config);
+}
+
+function neutralizeCredentialEnv(env: NodeJS.ProcessEnv, keep: Set<string>) {
+  for (const key of Object.keys(env)) {
+    if (!keep.has(key) && SECRET_KEY_PATTERN.test(key)) {
+      env[key] = '';
+    }
+  }
+}
+
+/** Blank any credential-like vars from a local `.env` so they never reach the test server. */
+function neutralizeDotenvSecrets(envFile: string, keep: Set<string>) {
+  if (!fs.existsSync(envFile)) {
+    return;
+  }
+  const lines = fs.readFileSync(envFile, 'utf8').split('\n');
+  for (const line of lines) {
+    const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+    if (!match) {
+      continue;
+    }
+    const key = match[1];
+    if (keep.has(key)) {
+      continue;
+    }
+    if (SECRET_KEY_PATTERN.test(key)) {
+      process.env[key] = '';
+    }
+  }
+}
+
+writeRuntimeMockConfig();
+neutralizeCredentialEnv(process.env, preservedCredentialEnvKeys);
+Object.assign(process.env, baseEnv);
+neutralizeDotenvSecrets(path.resolve(rootPath, '.env'), preservedCredentialEnvKeys);
+
+export default defineConfig({
+  globalSetup: require.resolve('./setup/global-setup'),
+  globalTeardown: require.resolve('./setup/global-teardown.mock'),
+  testDir: 'specs/mock/',
+  outputDir: 'specs/.test-results',
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: 1,
+  reporter: process.env.CI
+    ? [['html', { outputFolder: reportPath, open: 'never' }], ['line']]
+    : [['html', { outputFolder: reportPath }], ['list']],
+  use: {
+    baseURL,
+    video: 'on-first-retry',
+    trace: 'retain-on-failure',
+    ignoreHTTPSErrors: true,
+    headless: true,
+    storageState: path.resolve(process.cwd(), 'e2e/storageState.json'),
+    screenshot: 'only-on-failure',
+  },
+  expect: {
+    timeout: 10000,
+  },
+  projects: [
+    {
+      name: chromiumChannel ?? 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+        ...(chromiumChannel ? { channel: chromiumChannel } : {}),
+      },
+    },
+  ],
+  webServer: [
+    {
+      command: `node ${serverPath}`,
+      cwd: rootPath,
+      url: baseURL,
+      stdout: 'pipe',
+      ignoreHTTPSErrors: true,
+      timeout: 120_000,
+      reuseExistingServer: false,
+    },
+    {
+      // URL-based MCP fixture for the allowlist-override spec (its health route is GET /).
+      command: `node ${mcpHttpServerPath}`,
+      cwd: rootPath,
+      env: { ...process.env, E2E_MCP_HTTP_PORT: MCP_HTTP_PORT },
+      url: `http://127.0.0.1:${MCP_HTTP_PORT}/`,
+      stdout: 'pipe',
+      timeout: 60_000,
+      reuseExistingServer: false,
+    },
+  ],
+});
diff --git a/e2e/playwright.config.real.ts b/e2e/playwright.config.real.ts
new file mode 100644
index 00000000000..d854155a04b
--- /dev/null
+++ b/e2e/playwright.config.real.ts
@@ -0,0 +1,139 @@
+import { defineConfig, devices } from '@playwright/test';
+import fs from 'fs';
+import path from 'path';
+import { getLocalE2EEnv, getE2EBaseURL } from './setup/env';
+
+/**
+ * LOCAL-ONLY real-provider config: boots the same self-contained harness as
+ * the mock config (in-memory Mongo, seeded user, generated secrets) but runs
+ * real Anthropic calls — no fake-model hook. The API key is consumed from the
+ * invoking environment only; every other credential-like variable is blanked
+ * before the server boots, and nothing secret is written to disk.
+ *
+ * Run with:
+ * ANTHROPIC_API_KEY=... E2E_BASE_URL=http://localhost:3334 \
+ *   npm run e2e:prepare && npx playwright test --config=e2e/playwright.config.real.ts
+ */
+if (!process.env.ANTHROPIC_API_KEY) {
+  throw new Error(
+    '[e2e:real] ANTHROPIC_API_KEY is required in the environment for the real-provider config.',
+  );
+}
+
+const rootPath = path.resolve(__dirname, '..');
+const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
+const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.real.yaml');
+const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.real.yaml');
+const reportPath = path.resolve(rootPath, 'e2e/playwright-report');
+
+const baseURL = getE2EBaseURL();
+const chromiumChannel = process.env.E2E_CHROMIUM_CHANNEL || undefined;
+
+const realModel = process.env.E2E_REAL_ANTHROPIC_MODEL ?? 'claude-haiku-4-5';
+
+const baseEnv = {
+  ...getLocalE2EEnv(),
+  CONFIG_PATH: configPath,
+  TENANT_ISOLATION_STRICT: 'false',
+  OPENAI_API_KEY: 'user_provided',
+  ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
+  /** Single deterministic model so the selector flow never drifts */
+  ANTHROPIC_MODELS: realModel,
+  OPENID_CLIENT_ID: '',
+  OPENID_ISSUER: '',
+  OPENID_AUTO_REDIRECT: 'false',
+  ALLOW_SOCIAL_LOGIN: 'false',
+  ALLOW_SOCIAL_REGISTRATION: 'false',
+  STREAM_KEEP_COMPLETED_JOBS: 'true',
+};
+
+const SECRET_KEY_PATTERN = /(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIALS|CLIENT_ID|_KEY)$/i;
+const preservedCredentialEnvKeys = new Set([
+  ...Object.keys(baseEnv),
+  'E2E_USER_PASSWORD',
+  'E2E_USER_B_PASSWORD',
+]);
+
+function writeRuntimeRealConfig() {
+  const template = fs.readFileSync(configTemplatePath, 'utf8');
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, template);
+}
+
+function neutralizeCredentialEnv(env: NodeJS.ProcessEnv, keep: Set<string>) {
+  for (const key of Object.keys(env)) {
+    if (!keep.has(key) && SECRET_KEY_PATTERN.test(key)) {
+      env[key] = '';
+    }
+  }
+}
+
+/** Blank any credential-like vars from a local `.env` so they never reach the test server. */
+function neutralizeDotenvSecrets(envFile: string, keep: Set<string>) {
+  if (!fs.existsSync(envFile)) {
+    return;
+  }
+  const lines = fs.readFileSync(envFile, 'utf8').split('\n');
+  for (const line of lines) {
+    const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+    if (!match) {
+      continue;
+    }
+    const key = match[1];
+    if (keep.has(key)) {
+      continue;
+    }
+    if (SECRET_KEY_PATTERN.test(key)) {
+      process.env[key] = '';
+    }
+  }
+}
+
+writeRuntimeRealConfig();
+neutralizeCredentialEnv(process.env, preservedCredentialEnvKeys);
+Object.assign(process.env, baseEnv);
+neutralizeDotenvSecrets(path.resolve(rootPath, '.env'), preservedCredentialEnvKeys);
+
+export default defineConfig({
+  globalSetup: require.resolve('./setup/global-setup'),
+  globalTeardown: require.resolve('./setup/global-teardown.mock'),
+  testDir: 'specs/real/',
+  outputDir: 'specs/.test-results',
+  fullyParallel: false,
+  forbidOnly: true,
+  retries: 0,
+  workers: 1,
+  reporter: [['html', { outputFolder: reportPath, open: 'never' }], ['list']],
+  use: {
+    baseURL,
+    video: 'off',
+    trace: 'off',
+    ignoreHTTPSErrors: true,
+    headless: true,
+    storageState: path.resolve(process.cwd(), 'e2e/storageState.json'),
+    screenshot: 'only-on-failure',
+  },
+  expect: {
+    timeout: 15000,
+  },
+  projects: [
+    {
+      name: chromiumChannel ?? 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+        ...(chromiumChannel ? { channel: chromiumChannel } : {}),
+      },
+    },
+  ],
+  webServer: [
+    {
+      command: `node ${serverPath}`,
+      cwd: rootPath,
+      url: baseURL,
+      stdout: 'pipe',
+      ignoreHTTPSErrors: true,
+      timeout: 120_000,
+      reuseExistingServer: false,
+    },
+  ],
+});
diff --git a/e2e/playwright.config.ts b/e2e/playwright.config.ts
index 48b4d71101b..e62856c2d30 100644
--- a/e2e/playwright.config.ts
+++ b/e2e/playwright.config.ts
@@ -1,9 +1,15 @@
 import { defineConfig, devices } from '@playwright/test';
 import path from 'path';
-const absolutePath = path.resolve(process.cwd(), 'api/server/index.js');
+import { getBaseE2EEnv, getE2EBaseURL } from './setup/env';
+const rootPath = path.resolve(__dirname, '..');
+const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
 import dotenv from 'dotenv';
 dotenv.config();
 
+const baseURL = getE2EBaseURL();
+const e2eEnv = getBaseE2EEnv();
+Object.assign(process.env, e2eEnv);
+
 export default defineConfig({
   globalSetup: require.resolve('./setup/global-setup'),
   globalTeardown: require.resolve('./setup/global-teardown'),
@@ -21,9 +27,10 @@ export default defineConfig({
   workers: process.env.CI ? 1 : undefined,
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: [['html', { outputFolder: 'playwright-report' }]],
+  testIgnore: ['**/mock/**'],
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    baseURL: 'http://localhost:3080',
+    baseURL,
     video: 'on-first-retry',
     trace: 'retain-on-failure',
     ignoreHTTPSErrors: true,
@@ -53,21 +60,12 @@ export default defineConfig({
 
   /* Run your local dev server before starting the tests */
   webServer: {
-    command: `node ${absolutePath}`,
-    port: 3080,
+    command: `node ${serverPath}`,
+    cwd: rootPath,
+    url: baseURL,
     stdout: 'pipe',
     ignoreHTTPSErrors: true,
-    // url: 'http://localhost:3080',
-    timeout: 30_000,
+    timeout: 120_000,
     reuseExistingServer: true,
-    env: {
-      ...process.env,
-      NODE_ENV: 'CI',
-      EMAIL_HOST: '',
-      SEARCH: 'false',
-      SESSION_EXPIRY: '60000',
-      ALLOW_REGISTRATION: 'true',
-      REFRESH_TOKEN_EXPIRY: '300000',
-    },
   },
 });
diff --git a/e2e/recordings/.gitignore b/e2e/recordings/.gitignore
new file mode 100644
index 00000000000..d6b7ef32c84
--- /dev/null
+++ b/e2e/recordings/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitignore
diff --git a/e2e/setup/authenticate.ts b/e2e/setup/authenticate.ts
index 3d5b802c42f..0d637c400ca 100644
--- a/e2e/setup/authenticate.ts
+++ b/e2e/setup/authenticate.ts
@@ -1,17 +1,17 @@
-import { Page, FullConfig, chromium } from '@playwright/test';
+import { chromium } from '@playwright/test';
+import type { FullConfig, Page } from '@playwright/test';
 import type { User } from '../types';
 import cleanupUser from './cleanupUser';
 import dotenv from 'dotenv';
 dotenv.config();
 
-const timeout = 6000;
+const timeout = Number(process.env.E2E_AUTH_TIMEOUT ?? 15000);
+const chromiumChannel = process.env.E2E_CHROMIUM_CHANNEL || undefined;
 
 async function register(page: Page, user: User) {
   await page.getByRole('link', { name: 'Sign up' }).click();
   await page.getByLabel('Full name').click();
-  await page.getByLabel('Full name').fill('test');
-  await page.getByText('Username (optional)').click();
-  await page.getByLabel('Username (optional)').fill('test');
+  await page.getByLabel('Full name').fill(user.name);
   await page.getByLabel('Email').click();
   await page.getByLabel('Email').fill(user.email);
   await page.getByLabel('Email').press('Tab');
@@ -22,32 +22,46 @@ async function register(page: Page, user: User) {
   await page.getByLabel('Submit registration').click();
 }
 
-async function logout(page: Page) {
-  await page.getByTestId('nav-user').click();
-  await page.getByRole('button', { name: 'Log out' }).click();
+async function registrationErrorIsVisible(page: Page) {
+  return page
+    .getByTestId('registration-error')
+    .isVisible({ timeout: 500 })
+    .catch(() => false);
 }
 
 async function login(page: Page, user: User) {
-  await page.locator('input[name="email"]').fill(user.email);
-  await page.locator('input[name="password"]').fill(user.password);
-  await page.locator('input[name="password"]').press('Enter');
+  await page.getByLabel('Email').fill(user.email);
+  await page.getByLabel('Password').fill(user.password);
+  await page.getByTestId('login-button').click();
+}
+
+function appURL(baseURL: string, pathname = '') {
+  const normalizedBaseURL = baseURL.endsWith('/') ? baseURL : `${baseURL}/`;
+  return new URL(pathname.replace(/^\/+/, ''), normalizedBaseURL).toString();
 }
 
 async function authenticate(config: FullConfig, user: User) {
   console.log('🤖: global setup has been started');
   const { baseURL, storageState } = config.projects[0].use;
   console.log('🤖: using baseURL', baseURL);
-  console.dir(user, { depth: null });
+  console.log('🤖: using E2E user:', user.email);
+  if (typeof storageState !== 'string') {
+    throw new Error('🤖: storageState must be a file path');
+  }
+
   const browser = await chromium.launch({
-    headless: false,
+    headless: config.projects[0].use.headless ?? true,
+    ...(chromiumChannel ? { channel: chromiumChannel } : {}),
   });
   try {
     const page = await browser.newPage();
     console.log('🤖: 🗝  authenticating user:', user.email);
 
-    if (!baseURL) {
+    if (typeof baseURL !== 'string') {
       throw new Error('🤖: baseURL is not defined');
     }
+    const conversationURL = appURL(baseURL, 'c/new');
+    const loginURL = appURL(baseURL, 'login');
 
     // Set localStorage before navigating to the page
     await page.context().addInitScript(() => {
@@ -58,31 +72,27 @@ async function authenticate(config: FullConfig, user: User) {
     await page.goto(baseURL, { timeout });
     await register(page, user);
     try {
-      await page.waitForURL(`${baseURL}/c/new`, { timeout });
+      await page.waitForURL(conversationURL, { timeout });
     } catch (error) {
       console.error('Error:', error);
-      const userExists = page.getByTestId('registration-error');
-      if (userExists) {
+      if (await registrationErrorIsVisible(page)) {
         console.log('🤖: 🚨  user already exists');
         await cleanupUser(user);
         await page.goto(baseURL, { timeout });
         await register(page, user);
+        await page.waitForURL(conversationURL, { timeout });
       } else {
         throw new Error('🤖: 🚨  user failed to register');
       }
     }
     console.log('🤖: ✔️  user successfully registered');
 
-    // Logout
-    // await logout(page);
-    // await page.waitForURL(`${baseURL}/login`, { timeout });
-    // console.log('🤖: ✔️  user successfully logged out');
-
+    await page.goto(loginURL, { timeout });
     await login(page, user);
-    await page.waitForURL(`${baseURL}/c/new`, { timeout });
+    await page.waitForURL(conversationURL, { timeout });
     console.log('🤖: ✔️  user successfully authenticated');
 
-    await page.context().storageState({ path: storageState as string });
+    await page.context().storageState({ path: storageState });
     console.log('🤖: ✔️  authentication state successfully saved in', storageState);
     // await browser.close();
     // console.log('🤖: global setup has been finished');
diff --git a/e2e/setup/cleanupUser.ts b/e2e/setup/cleanupUser.ts
index 2e3de7d7356..aea43cc9aba 100644
--- a/e2e/setup/cleanupUser.ts
+++ b/e2e/setup/cleanupUser.ts
@@ -1,15 +1,27 @@
-import { connectDb } from '@librechat/backend/db/connect';
-import {
-  findUser,
-  deleteConvos,
-  deleteMessages,
-  deleteAllUserSessions,
-} from '@librechat/backend/models';
-import { User, Balance, Transaction, AclEntry, Token, Group } from '@librechat/backend/db/models';
+import { applyRuntimeEnv } from './runtimeEnv';
 
 type TUser = { email: string; password: string };
 
 export default async function cleanupUser(user: TUser) {
+  applyRuntimeEnv();
+  /* eslint-disable @typescript-eslint/no-require-imports */
+  const { connectDb } = require('@librechat/backend/db/connect');
+  const {
+    findUser,
+    deleteConvos,
+    deleteMessages,
+    deleteAllUserSessions,
+  } = require('@librechat/backend/models');
+  const {
+    User,
+    Balance,
+    Transaction,
+    AclEntry,
+    Token,
+    Group,
+  } = require('@librechat/backend/db/models');
+  /* eslint-enable @typescript-eslint/no-require-imports */
+
   const { email } = user;
   try {
     console.log('🤖: global teardown has been started');
@@ -26,7 +38,14 @@ export default async function cleanupUser(user: TUser) {
     console.log('🤖:  ✅  Found user in Database');
 
     // Delete all conversations & associated messages
-    const { deletedCount, messages } = await deleteConvos(userId, {});
+    const { deletedCount, messages } = await deleteConvos(userId, {}).catch((error) => {
+      if (error instanceof Error && error.message.includes('Conversation not found')) {
+        console.log('🤖:  ⚠️  No conversations found for user');
+        return { deletedCount: 0, messages: { deletedCount: 0 } };
+      }
+
+      throw error;
+    });
 
     if (messages.deletedCount > 0 || deletedCount > 0) {
       console.log(`🤖:  ✅  Deleted ${deletedCount} convos & ${messages.deletedCount} messages`);
diff --git a/e2e/setup/env.ts b/e2e/setup/env.ts
new file mode 100644
index 00000000000..9a4b184a7ad
--- /dev/null
+++ b/e2e/setup/env.ts
@@ -0,0 +1,134 @@
+import crypto from 'crypto';
+import path from 'path';
+
+const DEFAULT_BASE_URL = 'http://localhost:3080';
+const DEFAULT_MONGO_URI = 'mongodb://127.0.0.1:27017/LibreChat-e2e';
+const DEFAULT_RUNTIME_ENV_PATH = path.resolve(__dirname, '../specs/.test-results/runtime-env.json');
+const GENERATED_CREDS_KEY = crypto.randomBytes(32).toString('hex');
+const GENERATED_CREDS_IV = crypto.randomBytes(16).toString('hex');
+const GENERATED_JWT_SECRET = crypto.randomBytes(32).toString('hex');
+const GENERATED_JWT_REFRESH_SECRET = crypto.randomBytes(32).toString('hex');
+const PASSTHROUGH_ENV_KEYS = [
+  'APPDATA',
+  'CI',
+  'FORCE_COLOR',
+  'HOME',
+  'LOCALAPPDATA',
+  'NO_COLOR',
+  'NO_PROXY',
+  'NODE_OPTIONS',
+  'PATH',
+  'PLAYWRIGHT_BROWSERS_PATH',
+  'SHELL',
+  'TEMP',
+  'TMP',
+  'TMPDIR',
+  'USER',
+  'USERNAME',
+  'http_proxy',
+  'https_proxy',
+  'no_proxy',
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+];
+
+export function getE2EBaseURL() {
+  return process.env.E2E_BASE_URL ?? DEFAULT_BASE_URL;
+}
+
+export function getE2EServerAddress(baseURL = getE2EBaseURL()) {
+  const url = new URL(baseURL);
+  const host = url.hostname.replace(/^\[(.*)\]$/, '$1');
+  const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+
+  return { host, port };
+}
+
+export function getRuntimeEnvPath() {
+  return process.env.E2E_RUNTIME_ENV_PATH ?? DEFAULT_RUNTIME_ENV_PATH;
+}
+
+function getPassthroughEnv(): Record<string, string> {
+  const env: Record<string, string> = {};
+  const passthroughKeys = [
+    ...PASSTHROUGH_ENV_KEYS,
+    ...(process.env.E2E_PASSTHROUGH_ENV?.split(',') ?? []),
+  ];
+
+  for (const key of passthroughKeys) {
+    const value = process.env[key.trim()];
+    if (value != null) {
+      env[key.trim()] = value;
+    }
+  }
+
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith('MONGOMS_') && value != null) {
+      env[key] = value;
+    }
+  }
+
+  return env;
+}
+
+export function getBaseE2EEnv(): Record<string, string> {
+  const baseURL = getE2EBaseURL();
+  const { host, port } = getE2EServerAddress(baseURL);
+
+  return {
+    ...getPassthroughEnv(),
+    NODE_ENV: 'CI',
+    HOST: process.env.E2E_HOST ?? host,
+    PORT: process.env.E2E_PORT ?? port,
+    MONGO_URI: process.env.MONGO_URI ?? DEFAULT_MONGO_URI,
+    DOMAIN_CLIENT: process.env.E2E_DOMAIN_CLIENT ?? baseURL,
+    DOMAIN_SERVER: process.env.E2E_DOMAIN_SERVER ?? baseURL,
+    E2E_RUNTIME_ENV_PATH: getRuntimeEnvPath(),
+    E2E_USE_MEMORY_MONGO: process.env.E2E_USE_MEMORY_MONGO ?? 'auto',
+    NO_INDEX: process.env.NO_INDEX ?? 'true',
+    OPENAI_API_KEY: process.env.OPENAI_API_KEY ?? 'user_provided',
+    CREDS_KEY: process.env.CREDS_KEY ?? GENERATED_CREDS_KEY,
+    CREDS_IV: process.env.CREDS_IV ?? GENERATED_CREDS_IV,
+    JWT_SECRET: process.env.JWT_SECRET ?? GENERATED_JWT_SECRET,
+    JWT_REFRESH_SECRET: process.env.JWT_REFRESH_SECRET ?? GENERATED_JWT_REFRESH_SECRET,
+    EMAIL_HOST: '',
+    SEARCH: 'false',
+    SESSION_EXPIRY: process.env.SESSION_EXPIRY ?? '3600000',
+    ALLOW_REGISTRATION: 'true',
+    REFRESH_TOKEN_EXPIRY: process.env.REFRESH_TOKEN_EXPIRY ?? '3600000',
+  };
+}
+
+export function getLocalE2EEnv(): Record<string, string> {
+  return {
+    ...getBaseE2EEnv(),
+    TITLE_CONVO: 'false',
+    LOGIN_VIOLATION_SCORE: '0',
+    REGISTRATION_VIOLATION_SCORE: '0',
+    CONCURRENT_VIOLATION_SCORE: '0',
+    MESSAGE_VIOLATION_SCORE: '0',
+    NON_BROWSER_VIOLATION_SCORE: '0',
+    FORK_VIOLATION_SCORE: '0',
+    IMPORT_VIOLATION_SCORE: '0',
+    TTS_VIOLATION_SCORE: '0',
+    STT_VIOLATION_SCORE: '0',
+    FILE_UPLOAD_VIOLATION_SCORE: '0',
+    RESET_PASSWORD_VIOLATION_SCORE: '0',
+    VERIFY_EMAIL_VIOLATION_SCORE: '0',
+    TOOL_CALL_VIOLATION_SCORE: '0',
+    CONVO_ACCESS_VIOLATION_SCORE: '0',
+    ILLEGAL_MODEL_REQ_SCORE: '0',
+    LOGIN_MAX: '20',
+    LOGIN_WINDOW: '1',
+    REGISTER_MAX: '20',
+    REGISTER_WINDOW: '1',
+    LIMIT_CONCURRENT_MESSAGES: 'false',
+    CONCURRENT_MESSAGE_MAX: '20',
+    LIMIT_MESSAGE_IP: 'false',
+    MESSAGE_IP_MAX: '100',
+    MESSAGE_IP_WINDOW: '1',
+    LIMIT_MESSAGE_USER: 'false',
+    MESSAGE_USER_MAX: '100',
+    MESSAGE_USER_WINDOW: '1',
+  };
+}
diff --git a/e2e/setup/fake-mcp-http-server.js b/e2e/setup/fake-mcp-http-server.js
new file mode 100644
index 00000000000..503e82d9e2e
--- /dev/null
+++ b/e2e/setup/fake-mcp-http-server.js
@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+/**
+ * Streamable-HTTP MCP fixture for the allowlist-override e2e spec.
+ *
+ * Unlike the stdio `fake-mcp-server.js`, this one is reachable over a URL so it
+ * exercises the `mcpSettings.allowedDomains` check (stdio transports skip it). The
+ * e2e config deliberately omits this server's origin from `allowedDomains`, so it
+ * boots as `inspectionFailed`; `mcp-allowlist-override.spec.ts` then adds the origin
+ * via an admin-panel config override and asserts the server reinitializes.
+ *
+ * Mirrors the stateful streamable-HTTP pattern in
+ * packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts (without OAuth).
+ */
+
+const http = require('http');
+const { randomUUID } = require('crypto');
+const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
+const {
+  StreamableHTTPServerTransport,
+} = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+
+const PORT = parseInt(process.env.E2E_MCP_HTTP_PORT || '8765', 10);
+const HOST = '127.0.0.1';
+
+function createMcpServer() {
+  const server = new McpServer({ name: 'e2e-http', version: '1.0.0' });
+  server.registerTool(
+    'http_ping',
+    {
+      description: 'Returns a deterministic value for LibreChat allowlist-override e2e tests.',
+      inputSchema: {},
+    },
+    async () => ({
+      content: [{ type: 'text', text: 'E2E HTTP MCP pong' }],
+    }),
+  );
+  return server;
+}
+
+/** @type {Map<string, InstanceType<typeof StreamableHTTPServerTransport>>} */
+const sessions = new Map();
+
+const httpServer = http.createServer(async (req, res) => {
+  const url = new URL(req.url, `http://${req.headers.host}`);
+
+  // Health endpoint so Playwright's `webServer` can detect readiness.
+  if (url.pathname === '/' && req.method === 'GET') {
+    res.writeHead(200, { 'Content-Type': 'text/plain' });
+    res.end('ok');
+    return;
+  }
+
+  if (url.pathname !== '/mcp') {
+    res.writeHead(404);
+    res.end();
+    return;
+  }
+
+  const sid = req.headers['mcp-session-id'];
+  let transport = typeof sid === 'string' ? sessions.get(sid) : undefined;
+  if (!transport) {
+    transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+    const mcp = createMcpServer();
+    await mcp.connect(transport);
+  }
+
+  await transport.handleRequest(req, res);
+
+  if (transport.sessionId && !sessions.has(transport.sessionId)) {
+    sessions.set(transport.sessionId, transport);
+    transport.onclose = () => sessions.delete(transport.sessionId);
+  }
+});
+
+httpServer.listen(PORT, HOST, () => {
+  console.log(`[e2e] fake HTTP MCP server listening on http://${HOST}:${PORT}/mcp`);
+});
diff --git a/e2e/setup/fake-mcp-server.js b/e2e/setup/fake-mcp-server.js
new file mode 100644
index 00000000000..87419df88a4
--- /dev/null
+++ b/e2e/setup/fake-mcp-server.js
@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+
+const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
+const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
+const z = require('zod/v4');
+
+const server = new McpServer({
+  name: 'e2e-memory',
+  version: '1.0.0',
+});
+
+server.registerTool(
+  'remember_fact',
+  {
+    description: 'Stores a deterministic fact for LibreChat mock end-to-end tests.',
+    inputSchema: {
+      fact: z.string().optional(),
+    },
+  },
+  async ({ fact = 'LibreChat MCP e2e fact' }) => ({
+    content: [
+      {
+        type: 'text',
+        text: `E2E MCP memory noted: ${fact}`,
+      },
+    ],
+  }),
+);
+
+server.registerTool(
+  'recall_fact',
+  {
+    description: 'Returns a deterministic fact for LibreChat mock end-to-end tests.',
+    inputSchema: {},
+  },
+  async () => ({
+    content: [
+      {
+        type: 'text',
+        text: 'E2E MCP memory recalled: LibreChat can persist MCP tools on agents.',
+      },
+    ],
+  }),
+);
+
+async function main() {
+  await server.connect(new StdioServerTransport());
+}
+
+main().catch((error) => {
+  console.error('[fake-mcp-server] failed to start', error);
+  process.exit(1);
+});
diff --git a/e2e/setup/fake-model.js b/e2e/setup/fake-model.js
new file mode 100644
index 00000000000..54b786f3e63
--- /dev/null
+++ b/e2e/setup/fake-model.js
@@ -0,0 +1,576 @@
+/**
+ * In-process fake LLM for credential-free e2e tests. Loaded by `@librechat/api`'s
+ * `createRun` via the `LIBRECHAT_TEST_RUN_HOOK` env var (set by the mock
+ * Playwright config and the `--profile=mock` recorder), it swaps the run's model
+ * for the agents package's own `FakeChatModel` through
+ * `run.Graph.overrideTestModel(...)`.
+ *
+ * This exercises the real `Run.create` -> graph -> tool-node pipeline end to end
+ * without a live provider or a standalone HTTP mock server: responses are decided
+ * from the conversation and the agents' advertised tools.
+ */
+const { FakeChatModel } = require('@librechat/agents');
+const { ChatGenerationChunk } = require('@langchain/core/outputs');
+const { AIMessageChunk } = require('@langchain/core/messages');
+
+const MOCK_REPLY = process.env.MOCK_LLM_REPLY || 'E2E mock reply: pong';
+const CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_CHUNK_DELAY_MS) || 10;
+
+const CREATE_SKILL_MARKER = 'E2E_CREATE_SKILL:';
+const EDIT_SKILL_MARKER = 'E2E_EDIT_SKILL:';
+const ASSERT_MODEL_SPEC_SKILLS_MARKER = 'E2E_ASSERT_MODEL_SPEC_SKILLS';
+const ASSERT_PROVIDER_FILE_MARKER = 'E2E_ASSERT_PROVIDER_FILE:';
+const ASSERT_QUOTE_MARKER = 'E2E_ASSERT_QUOTE:';
+const REPLY_MARKER = 'E2E_REPLY:';
+const COUNTED_REPLY_MARKER = 'E2E_COUNTED_REPLY:';
+const SLOW_REPLY_MARKER = 'E2E_SLOW_REPLY:';
+const SLOW_COUNTED_REPLY_MARKER = 'E2E_SLOW_COUNTED_REPLY:';
+const RESUME_ICON_REPLY_MARKER = 'E2E_RESUME_ICON_REPLY:';
+const FORCED_ERROR_MARKER = 'E2E_FORCED_ERROR:';
+const MARKDOWN_REPLY_MARKER = 'E2E_MARKDOWN_REPLY';
+const CREATE_FILE_AUTHORING_FINAL_TEXT = 'E2E file authoring complete';
+const EDIT_FILE_AUTHORING_FINAL_TEXT = 'E2E file edit complete';
+const MODEL_SPEC_SKILL_ASSERTION_FINAL_TEXT = 'E2E model spec skill assertion passed';
+const PROVIDER_FILE_ASSERTION_FINAL_TEXT = 'E2E provider file assertion passed';
+const QUOTE_ASSERTION_FINAL_TEXT = 'E2E quote assertion passed';
+const SLOW_CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_SLOW_CHUNK_DELAY_MS) || 35;
+const SLOW_REPLY_CHUNKS = 160;
+const RESUME_ICON_CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_RESUME_ICON_CHUNK_DELAY_MS) || 60;
+const RESUME_ICON_REPLY_CHUNKS = 240;
+const CREATE_FILE_TOOL_NAME = 'create_file';
+const EDIT_FILE_TOOL_NAME = 'edit_file';
+const BASH_TOOL_NAME = 'bash_tool';
+const SKILL_TOOL_NAME = 'skill';
+const CREATE_SKILL_TOOL_CALL_ID = 'call_e2e_create_skill';
+const EDIT_SKILL_TOOL_CALL_ID = 'call_e2e_edit_skill';
+const MODEL_SPEC_ACCESSIBLE_SKILL = 'e2e-model-spec-allowed';
+const MODEL_SPEC_MISSING_SKILL = 'e2e-model-spec-missing';
+const MODEL_SPEC_INACCESSIBLE_SKILL = 'e2e-model-spec-inaccessible';
+const ALWAYS_APPLY_BODY_MARKER = 'E2E_ALWAYS_APPLY_BODY_MARKER';
+const SKILL_DESCRIPTION =
+  'Use this skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const EDITED_SKILL_DESCRIPTION =
+  'Use this edited skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const countedReplies = new Map();
+const slowCountedReplies = new Map();
+
+function messageType(message) {
+  if (typeof message.getType === 'function') {
+    return message.getType();
+  }
+  if (typeof message._getType === 'function') {
+    return message._getType();
+  }
+  return message.role || message.type || '';
+}
+
+function getContentText(content) {
+  if (typeof content === 'string') {
+    return content;
+  }
+  if (!Array.isArray(content)) {
+    return '';
+  }
+  return content
+    .map((part) => {
+      if (typeof part === 'string') {
+        return part;
+      }
+      if (part && typeof part === 'object' && typeof part.text === 'string') {
+        return part.text;
+      }
+      return '';
+    })
+    .join('\n');
+}
+
+function getLatestUserText(messages) {
+  const message = getLatestUserMessage(messages);
+  return message ? getContentText(message.content) : '';
+}
+
+function getLatestUserMessage(messages) {
+  if (!Array.isArray(messages)) {
+    return null;
+  }
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index];
+    if (!message) {
+      continue;
+    }
+    const type = messageType(message);
+    if (type === 'human' || type === 'user') {
+      return message;
+    }
+  }
+  return null;
+}
+
+function getRequestedSkillName(text, marker) {
+  const markerIndex = text.indexOf(marker);
+  if (markerIndex === -1) {
+    return '';
+  }
+  const afterMarker = text.slice(markerIndex + marker.length);
+  return afterMarker.match(/[a-z0-9][a-z0-9-]*/)?.[0] ?? '';
+}
+
+function getMarkerValue(text, marker) {
+  const markerIndex = text.indexOf(marker);
+  if (markerIndex === -1) {
+    return '';
+  }
+  return (
+    text
+      .slice(markerIndex + marker.length)
+      .trim()
+      .split(/\s+/, 1)[0] ?? ''
+  );
+}
+
+function collectToolNames(agents) {
+  const names = new Set();
+  const add = (name) => {
+    if (typeof name === 'string' && name) {
+      names.add(name);
+    }
+  };
+  for (const agent of agents ?? []) {
+    if (!agent) {
+      continue;
+    }
+    for (const tool of agent.tools ?? []) {
+      add(tool?.name);
+    }
+    for (const def of agent.toolDefinitions ?? []) {
+      add(def?.name);
+    }
+    if (agent.toolRegistry && typeof agent.toolRegistry.keys === 'function') {
+      for (const name of agent.toolRegistry.keys()) {
+        add(name);
+      }
+    }
+  }
+  return names;
+}
+
+function collectAdditionalInstructions(agents) {
+  return (agents ?? [])
+    .map((agent) =>
+      typeof agent?.additional_instructions === 'string' ? agent.additional_instructions : '',
+    )
+    .filter(Boolean)
+    .join('\n');
+}
+
+function collectSkillPrimeMessages(messages) {
+  return (messages ?? [])
+    .filter((message) => message?.additional_kwargs?.source === 'skill')
+    .map((message) => ({
+      name: message.additional_kwargs.skillName,
+      trigger: message.additional_kwargs.trigger,
+      content: getContentText(message.content),
+    }));
+}
+
+function collectProviderFileNames(value, names = new Set()) {
+  if (value == null) {
+    return names;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectProviderFileNames(item, names);
+    }
+    return names;
+  }
+
+  if (typeof value !== 'object') {
+    return names;
+  }
+
+  if (value.type === 'input_file' && typeof value.filename === 'string') {
+    names.add(value.filename);
+  }
+
+  if (value.type === 'file' && typeof value.file?.filename === 'string') {
+    names.add(value.file.filename);
+  }
+
+  if (value.type === 'document' && typeof value.context === 'string') {
+    const match = value.context.match(/File:\s*"([^"]+)"/);
+    if (match?.[1]) {
+      names.add(match[1]);
+    }
+  }
+
+  for (const child of Object.values(value)) {
+    collectProviderFileNames(child, names);
+  }
+
+  return names;
+}
+
+function providerFileAssertionResponses({ messages, text }) {
+  const filename = getMarkerValue(text, ASSERT_PROVIDER_FILE_MARKER);
+  if (!filename) {
+    return null;
+  }
+
+  const latestUserMessage = getLatestUserMessage(messages);
+  const providerFileNames = collectProviderFileNames(latestUserMessage?.content);
+  if (providerFileNames.has(filename)) {
+    return {
+      responses: [`${PROVIDER_FILE_ASSERTION_FINAL_TEXT}: ${filename}`],
+    };
+  }
+
+  return {
+    responses: [
+      `E2E provider file assertion failed: expected ${filename}; saw ${
+        Array.from(providerFileNames).join(', ') || 'no provider files'
+      }`,
+    ],
+  };
+}
+
+/**
+ * Verifies the quote feature end to end: scans every user message in the prompt
+ * the model actually received for a Markdown blockquote line containing the
+ * expected token. Passing proves the excerpt was merged into the model-facing
+ * turn — covering both the current turn and durable re-merge of a prior quoted
+ * turn from history (the merge runs in `AgentClient.buildMessages`).
+ */
+function quoteAssertionResponses({ messages, text }) {
+  const expected = getMarkerValue(text, ASSERT_QUOTE_MARKER);
+  if (!expected) {
+    return null;
+  }
+
+  const found = (messages ?? []).some((message) => {
+    const type = messageType(message);
+    if (type !== 'human' && type !== 'user') {
+      return false;
+    }
+    return getContentText(message.content)
+      .split('\n')
+      .some((line) => line.startsWith('> ') && line.includes(expected));
+  });
+
+  if (found) {
+    return { responses: [`${QUOTE_ASSERTION_FINAL_TEXT}: ${expected}`] };
+  }
+  return {
+    responses: [`E2E quote assertion failed: no blockquote containing "${expected}" in the prompt`],
+  };
+}
+
+function replyResponses(text) {
+  if (text.includes(MARKDOWN_REPLY_MARKER)) {
+    return {
+      responses: [
+        [
+          '## E2E markdown heading',
+          '',
+          '**E2E bold text**',
+          '',
+          '- E2E list item',
+          '',
+          '```javascript',
+          'const e2eSyntaxHighlight = "ok";',
+          '```',
+        ].join('\n'),
+      ],
+    };
+  }
+
+  const errorName = getMarkerValue(text, FORCED_ERROR_MARKER);
+  if (errorName) {
+    return {
+      responses: [`E2E forced error prelude ${errorName}`],
+      thrownError: `E2E forced stream error ${errorName}`,
+    };
+  }
+
+  const replyName = getMarkerValue(text, REPLY_MARKER);
+  if (replyName) {
+    return {
+      responses: [`E2E reply ${replyName}`],
+    };
+  }
+
+  const countedName = getMarkerValue(text, COUNTED_REPLY_MARKER);
+  if (countedName) {
+    const count = (countedReplies.get(countedName) ?? 0) + 1;
+    countedReplies.set(countedName, count);
+    return {
+      responses: [`E2E counted reply ${countedName} #${count}`],
+    };
+  }
+
+  const slowName = getMarkerValue(text, SLOW_REPLY_MARKER);
+  if (slowName) {
+    const chunks = Array.from(
+      { length: SLOW_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E slow reply ${slowName} ${chunks}`],
+      sleep: SLOW_CHUNK_DELAY_MS,
+    };
+  }
+
+  const slowCountedName = getMarkerValue(text, SLOW_COUNTED_REPLY_MARKER);
+  if (slowCountedName) {
+    const count = (slowCountedReplies.get(slowCountedName) ?? 0) + 1;
+    slowCountedReplies.set(slowCountedName, count);
+    const chunks = Array.from(
+      { length: SLOW_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E slow counted reply ${slowCountedName} #${count} ${chunks}`],
+      sleep: SLOW_CHUNK_DELAY_MS,
+    };
+  }
+
+  const resumeIconName = getMarkerValue(text, RESUME_ICON_REPLY_MARKER);
+  if (resumeIconName) {
+    const chunks = Array.from(
+      { length: RESUME_ICON_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E resume icon reply ${resumeIconName} ${chunks}`],
+      sleep: RESUME_ICON_CHUNK_DELAY_MS,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Attaches synthetic usage_metadata on a final empty chunk (the OpenAI
+ * streaming pattern) so token-usage SSE events flow end to end in mock runs.
+ */
+class UsageEmittingFakeChatModel extends FakeChatModel {
+  async *_streamResponseChunks(messages, options, runManager) {
+    let outputChars = 0;
+    for await (const chunk of super._streamResponseChunks(messages, options, runManager)) {
+      outputChars += typeof chunk.text === 'string' ? chunk.text.length : 0;
+      yield chunk;
+    }
+    const inputChars = (messages ?? []).reduce(
+      (sum, message) => sum + getContentText(message?.content).length,
+      0,
+    );
+    const input_tokens = Math.max(1, Math.ceil(inputChars / 4));
+    const output_tokens = Math.max(1, Math.ceil(outputChars / 4));
+    yield new ChatGenerationChunk({
+      text: '',
+      message: new AIMessageChunk({
+        content: '',
+        usage_metadata: { input_tokens, output_tokens, total_tokens: input_tokens + output_tokens },
+      }),
+    });
+  }
+}
+
+function overrideModel({ graph, responses, sleep, toolCalls, thrownError }) {
+  if (!thrownError) {
+    graph.overrideModel = new UsageEmittingFakeChatModel({
+      responses,
+      sleep: sleep ?? CHUNK_DELAY_MS,
+      emitCustomEvent: true,
+      toolCalls,
+    });
+    return;
+  }
+
+  class ThrowingFakeChatModel extends FakeChatModel {
+    async *_streamResponseChunks(messages, options, runManager) {
+      yield* super._streamResponseChunks(
+        messages,
+        { ...options, thrownErrorString: thrownError },
+        runManager,
+      );
+    }
+  }
+
+  graph.overrideModel = new ThrowingFakeChatModel({
+    responses,
+    sleep: sleep ?? CHUNK_DELAY_MS,
+    emitCustomEvent: true,
+    toolCalls,
+  });
+}
+
+function modelSpecSkillAssertionResponses({ agents, messages, toolNames }) {
+  const failures = [];
+  const additionalInstructions = collectAdditionalInstructions(agents);
+  const skillPrimeMessages = collectSkillPrimeMessages(messages);
+  const alwaysApplyPrime = skillPrimeMessages.find(
+    (message) => message.name === MODEL_SPEC_ACCESSIBLE_SKILL && message.trigger === 'always-apply',
+  );
+
+  if (!toolNames.has(SKILL_TOOL_NAME)) {
+    failures.push(`${SKILL_TOOL_NAME} tool was not advertised`);
+  }
+  if (!additionalInstructions.includes(MODEL_SPEC_ACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} was not present in the model-visible catalog`);
+  }
+  if (additionalInstructions.includes(MODEL_SPEC_MISSING_SKILL)) {
+    failures.push(`${MODEL_SPEC_MISSING_SKILL} leaked into the model-visible catalog`);
+  }
+  if (additionalInstructions.includes(MODEL_SPEC_INACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_INACCESSIBLE_SKILL} leaked into the model-visible catalog`);
+  }
+  if (!alwaysApplyPrime) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} was not always-apply primed`);
+  } else if (!alwaysApplyPrime.content.includes(ALWAYS_APPLY_BODY_MARKER)) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} always-apply body was missing its marker`);
+  }
+  if (skillPrimeMessages.some((message) => message.name === MODEL_SPEC_MISSING_SKILL)) {
+    failures.push(`${MODEL_SPEC_MISSING_SKILL} was unexpectedly primed`);
+  }
+  if (skillPrimeMessages.some((message) => message.name === MODEL_SPEC_INACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_INACCESSIBLE_SKILL} was unexpectedly primed`);
+  }
+
+  if (failures.length > 0) {
+    return {
+      responses: [`E2E model spec skill assertion failed: ${failures.join('; ')}`],
+    };
+  }
+  return {
+    responses: [`${MODEL_SPEC_SKILL_ASSERTION_FINAL_TEXT}: ${MODEL_SPEC_ACCESSIBLE_SKILL}`],
+  };
+}
+
+function buildSkillBody(skillName) {
+  return `---
+name: ${skillName}
+description: ${SKILL_DESCRIPTION}
+---
+
+# ${skillName}
+
+Created by the Playwright mock e2e suite to verify host file authoring without code execution.`;
+}
+
+function buildCreateSkillArgs(skillName) {
+  return {
+    path: `skills/${skillName}/SKILL.md`,
+    content: buildSkillBody(skillName),
+    overwrite: false,
+  };
+}
+
+function buildEditSkillArgs(skillName) {
+  return {
+    path: `skills/${skillName}/SKILL.md`,
+    old_text: `description: ${SKILL_DESCRIPTION}`,
+    new_text: `description: ${EDITED_SKILL_DESCRIPTION}`,
+  };
+}
+
+/**
+ * Pick the fake-model script for a skill file-authoring turn. The graph runs two
+ * model turns: turn 1 streams the (empty) preamble and emits the tool call, the
+ * tool node writes the SKILL.md, then turn 2 streams the final text. The guards
+ * assert the feature advertised the host file-authoring tool and did NOT enable
+ * code execution.
+ */
+function fileAuthoringResponses(operation, toolNames) {
+  if (!toolNames.has(operation.toolName)) {
+    return {
+      responses: [`E2E file authoring unavailable: ${operation.toolName} was not advertised.`],
+    };
+  }
+  if (toolNames.has(BASH_TOOL_NAME)) {
+    return {
+      responses: [`E2E file authoring unavailable: ${BASH_TOOL_NAME} was unexpectedly advertised.`],
+    };
+  }
+  return {
+    responses: ['', `${operation.finalText}: ${operation.skillName}`],
+    toolCalls: [
+      {
+        id: operation.toolCallId,
+        name: operation.toolName,
+        args: operation.args,
+        type: 'tool_call',
+      },
+    ],
+  };
+}
+
+function resolveResponses({ agents, messages, text, toolNames }) {
+  const reply = replyResponses(text);
+  if (reply) {
+    return reply;
+  }
+
+  const providerFileAssertion = providerFileAssertionResponses({ messages, text });
+  if (providerFileAssertion) {
+    return providerFileAssertion;
+  }
+
+  const quoteAssertion = quoteAssertionResponses({ messages, text });
+  if (quoteAssertion) {
+    return quoteAssertion;
+  }
+
+  if (text.includes(ASSERT_MODEL_SPEC_SKILLS_MARKER)) {
+    return modelSpecSkillAssertionResponses({ agents, messages, toolNames });
+  }
+
+  const createSkillName = getRequestedSkillName(text, CREATE_SKILL_MARKER);
+  if (createSkillName) {
+    return fileAuthoringResponses(
+      {
+        skillName: createSkillName,
+        toolName: CREATE_FILE_TOOL_NAME,
+        toolCallId: CREATE_SKILL_TOOL_CALL_ID,
+        finalText: CREATE_FILE_AUTHORING_FINAL_TEXT,
+        args: buildCreateSkillArgs(createSkillName),
+      },
+      toolNames,
+    );
+  }
+
+  const editSkillName = getRequestedSkillName(text, EDIT_SKILL_MARKER);
+  if (editSkillName) {
+    return fileAuthoringResponses(
+      {
+        skillName: editSkillName,
+        toolName: EDIT_FILE_TOOL_NAME,
+        toolCallId: EDIT_SKILL_TOOL_CALL_ID,
+        finalText: EDIT_FILE_AUTHORING_FINAL_TEXT,
+        args: buildEditSkillArgs(editSkillName),
+      },
+      toolNames,
+    );
+  }
+
+  return { responses: [MOCK_REPLY] };
+}
+
+/** @type {import('@librechat/api').TestRunHook} */
+module.exports = function fakeModelHook(run, context) {
+  const graph = run?.Graph;
+  if (!graph || typeof graph.overrideTestModel !== 'function') {
+    console.warn('[e2e] fake-model hook: run.Graph.overrideTestModel unavailable');
+    return;
+  }
+
+  const text = getLatestUserText(context?.messages);
+  const toolNames = collectToolNames(context?.agents);
+  const { responses, sleep, toolCalls, thrownError } = resolveResponses({
+    agents: context?.agents,
+    messages: context?.messages,
+    text,
+    toolNames,
+  });
+  overrideModel({ graph, responses, sleep, toolCalls, thrownError });
+};
diff --git a/e2e/setup/global-setup.local.ts b/e2e/setup/global-setup.local.ts
index 2bbb1973899..c417ebc3409 100644
--- a/e2e/setup/global-setup.local.ts
+++ b/e2e/setup/global-setup.local.ts
@@ -1,9 +1,9 @@
 import { FullConfig } from '@playwright/test';
-import localUser from '../config.local';
 import authenticate from './authenticate';
+import { getE2EUser } from './user';
 
 async function globalSetup(config: FullConfig) {
-  await authenticate(config, localUser);
+  await authenticate(config, getE2EUser());
 }
 
 export default globalSetup;
diff --git a/e2e/setup/global-setup.ts b/e2e/setup/global-setup.ts
index 25c60e11af7..c417ebc3409 100644
--- a/e2e/setup/global-setup.ts
+++ b/e2e/setup/global-setup.ts
@@ -1,14 +1,9 @@
 import { FullConfig } from '@playwright/test';
 import authenticate from './authenticate';
+import { getE2EUser } from './user';
 
 async function globalSetup(config: FullConfig) {
-  const user = {
-    name: 'test',
-    email: String(process.env.E2E_USER_EMAIL),
-    password: String(process.env.E2E_USER_PASSWORD),
-  };
-
-  await authenticate(config, user);
+  await authenticate(config, getE2EUser());
 }
 
 export default globalSetup;
diff --git a/e2e/setup/global-teardown.local.ts b/e2e/setup/global-teardown.local.ts
index cef902cfc8a..c61c86c367a 100644
--- a/e2e/setup/global-teardown.local.ts
+++ b/e2e/setup/global-teardown.local.ts
@@ -1,9 +1,9 @@
-import localUser from '../config.local';
 import cleanupUser from './cleanupUser';
+import { getE2EUser } from './user';
 
 async function globalTeardown() {
   try {
-    await cleanupUser(localUser);
+    await cleanupUser(getE2EUser());
   } catch (error) {
     console.error('Error:', error);
   }
diff --git a/e2e/setup/global-teardown.mock.ts b/e2e/setup/global-teardown.mock.ts
new file mode 100644
index 00000000000..72dc93a2212
--- /dev/null
+++ b/e2e/setup/global-teardown.mock.ts
@@ -0,0 +1,14 @@
+import cleanupUser from './cleanupUser';
+import { getPrimaryE2EUser, getSecondaryE2EUser } from './users.mock';
+
+async function globalTeardown() {
+  for (const user of [getPrimaryE2EUser(), getSecondaryE2EUser()]) {
+    try {
+      await cleanupUser(user);
+    } catch (error) {
+      console.error('Error:', error);
+    }
+  }
+}
+
+export default globalTeardown;
diff --git a/e2e/setup/global-teardown.ts b/e2e/setup/global-teardown.ts
index c71e4d56a17..c61c86c367a 100644
--- a/e2e/setup/global-teardown.ts
+++ b/e2e/setup/global-teardown.ts
@@ -1,13 +1,9 @@
 import cleanupUser from './cleanupUser';
+import { getE2EUser } from './user';
 
 async function globalTeardown() {
-  const user = {
-    email: String(process.env.E2E_USER_EMAIL),
-    password: String(process.env.E2E_USER_PASSWORD),
-  };
-
   try {
-    await cleanupUser(user);
+    await cleanupUser(getE2EUser());
   } catch (error) {
     console.error('Error:', error);
   }
diff --git a/e2e/setup/record.js b/e2e/setup/record.js
new file mode 100644
index 00000000000..70052a2b788
--- /dev/null
+++ b/e2e/setup/record.js
@@ -0,0 +1,425 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { spawn } = require('child_process');
+
+const rootPath = path.resolve(__dirname, '../..');
+const baseURL = process.env.E2E_BASE_URL || 'http://localhost:3080';
+const storageStatePath = path.resolve(rootPath, 'e2e/storageState.json');
+const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.e2e.yaml');
+const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.e2e.yaml');
+const fakeModelHookPath = path.resolve(rootPath, 'e2e/setup/fake-model.js');
+const defaultUser = {
+  email: 'testuser@example.com',
+  name: 'Test User',
+  password: 'securepassword123',
+};
+
+const rateLimitOverrides = {
+  LOGIN_VIOLATION_SCORE: '0',
+  REGISTRATION_VIOLATION_SCORE: '0',
+  CONCURRENT_VIOLATION_SCORE: '0',
+  MESSAGE_VIOLATION_SCORE: '0',
+  NON_BROWSER_VIOLATION_SCORE: '0',
+  FORK_VIOLATION_SCORE: '0',
+  IMPORT_VIOLATION_SCORE: '0',
+  TTS_VIOLATION_SCORE: '0',
+  STT_VIOLATION_SCORE: '0',
+  FILE_UPLOAD_VIOLATION_SCORE: '0',
+  RESET_PASSWORD_VIOLATION_SCORE: '0',
+  VERIFY_EMAIL_VIOLATION_SCORE: '0',
+  TOOL_CALL_VIOLATION_SCORE: '0',
+  CONVO_ACCESS_VIOLATION_SCORE: '0',
+  ILLEGAL_MODEL_REQ_SCORE: '0',
+  LOGIN_MAX: '20',
+  LOGIN_WINDOW: '1',
+  REGISTER_MAX: '20',
+  REGISTER_WINDOW: '1',
+  LIMIT_CONCURRENT_MESSAGES: 'false',
+  CONCURRENT_MESSAGE_MAX: '20',
+  LIMIT_MESSAGE_IP: 'false',
+  MESSAGE_IP_MAX: '100',
+  MESSAGE_IP_WINDOW: '1',
+  LIMIT_MESSAGE_USER: 'false',
+  MESSAGE_USER_MAX: '100',
+  MESSAGE_USER_WINDOW: '1',
+};
+
+const mockOverrides = {
+  CONFIG_PATH: configPath,
+  /** Loaded in-process by `@librechat/api`'s `createRun` to swap in a fake model. */
+  LIBRECHAT_TEST_RUN_HOOK: fakeModelHookPath,
+  OPENAI_API_KEY: 'user_provided',
+  TENANT_ISOLATION_STRICT: 'false',
+  OPENID_CLIENT_ID: '',
+  OPENID_ISSUER: '',
+  OPENID_AUTO_REDIRECT: 'false',
+  ALLOW_SOCIAL_LOGIN: 'false',
+  ALLOW_SOCIAL_REGISTRATION: 'false',
+  STREAM_KEEP_COMPLETED_JOBS: 'true',
+};
+
+const secretKeyPattern = /(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIALS|CLIENT_ID|_KEY)$/i;
+const preservedCredentialEnvKeys = new Set([
+  ...Object.keys(rateLimitOverrides),
+  ...Object.keys(mockOverrides).filter((key) => key !== 'OPENAI_API_KEY'),
+  'CREDS_KEY',
+  'CREDS_IV',
+  'E2E_USER_PASSWORD',
+  'E2E_USER_B_PASSWORD',
+  'JWT_SECRET',
+  'JWT_REFRESH_SECRET',
+  'REFRESH_TOKEN_EXPIRY',
+  'SESSION_EXPIRY',
+]);
+const npxBin = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+
+function appURL(pathname = '') {
+  const normalizedBaseURL = baseURL.endsWith('/') ? baseURL : `${baseURL}/`;
+  return new URL(pathname.replace(/^\/+/, ''), normalizedBaseURL).toString();
+}
+
+function getServerAddress() {
+  const url = new URL(baseURL);
+  const host = url.hostname.replace(/^\[(.*)\]$/, '$1');
+  const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+  return { host, port };
+}
+
+function randomHex(bytes) {
+  return crypto.randomBytes(bytes).toString('hex');
+}
+
+function getUser(env) {
+  return {
+    email: env.E2E_USER_EMAIL || defaultUser.email,
+    name: env.E2E_USER_NAME || defaultUser.name,
+    password: env.E2E_USER_PASSWORD || defaultUser.password,
+  };
+}
+
+function getBaseEnv() {
+  const { host, port } = getServerAddress();
+  return {
+    ...process.env,
+    NODE_ENV: 'CI',
+    HOST: process.env.E2E_HOST || host,
+    PORT: process.env.E2E_PORT || port,
+    MONGO_URI: process.env.MONGO_URI || 'mongodb://127.0.0.1:27017/LibreChat-e2e',
+    DOMAIN_CLIENT: process.env.E2E_DOMAIN_CLIENT || baseURL,
+    DOMAIN_SERVER: process.env.E2E_DOMAIN_SERVER || baseURL,
+    E2E_RUNTIME_ENV_PATH:
+      process.env.E2E_RUNTIME_ENV_PATH ||
+      path.resolve(rootPath, 'e2e/specs/.test-results/runtime-env.json'),
+    E2E_USE_MEMORY_MONGO: process.env.E2E_USE_MEMORY_MONGO || 'auto',
+    NO_INDEX: process.env.NO_INDEX || 'true',
+    OPENAI_API_KEY: process.env.OPENAI_API_KEY || 'user_provided',
+    CREDS_KEY: process.env.CREDS_KEY || randomHex(32),
+    CREDS_IV: process.env.CREDS_IV || randomHex(16),
+    JWT_SECRET: process.env.JWT_SECRET || randomHex(32),
+    JWT_REFRESH_SECRET: process.env.JWT_REFRESH_SECRET || randomHex(32),
+    EMAIL_HOST: '',
+    SEARCH: 'false',
+    SESSION_EXPIRY: process.env.SESSION_EXPIRY || '3600000',
+    ALLOW_REGISTRATION: 'true',
+    REFRESH_TOKEN_EXPIRY: process.env.REFRESH_TOKEN_EXPIRY || '3600000',
+    TITLE_CONVO: 'false',
+    ...rateLimitOverrides,
+  };
+}
+
+function neutralizeCredentialEnv(env) {
+  for (const key of Object.keys(env)) {
+    if (!preservedCredentialEnvKeys.has(key) && secretKeyPattern.test(key)) {
+      env[key] = '';
+    }
+  }
+}
+
+function neutralizeDotenvSecrets(envFile, env) {
+  if (!fs.existsSync(envFile)) {
+    return;
+  }
+  const lines = fs.readFileSync(envFile, 'utf8').split('\n');
+  for (const line of lines) {
+    const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+    if (!match) {
+      continue;
+    }
+    const key = match[1];
+    if (!preservedCredentialEnvKeys.has(key) && secretKeyPattern.test(key)) {
+      env[key] = '';
+    }
+  }
+}
+
+function getEnv(profile) {
+  const env = getBaseEnv();
+  if (profile === 'mock') {
+    neutralizeCredentialEnv(env);
+    neutralizeDotenvSecrets(path.resolve(rootPath, '.env'), env);
+    Object.assign(env, mockOverrides);
+  }
+  return env;
+}
+
+function formatDate(date) {
+  return date
+    .toISOString()
+    .replace(/\.\d{3}Z$/, '')
+    .replace(/[:T]/g, '-');
+}
+
+function writeRuntimeMockConfig() {
+  const template = fs.readFileSync(configTemplatePath, 'utf8');
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, template);
+}
+
+function parseArgs(argv) {
+  const options = {
+    profile: 'mock',
+    output: path.resolve(rootPath, `e2e/recordings/recording-${formatDate(new Date())}.spec.ts`),
+    storage: storageStatePath,
+    url: appURL('c/new'),
+    authOnly: false,
+    saveOutput: true,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+    const readValue = () => {
+      if (arg.includes('=')) {
+        return arg.slice(arg.indexOf('=') + 1);
+      }
+      index += 1;
+      return next;
+    };
+
+    if (arg === '--help' || arg === '-h') {
+      options.help = true;
+    } else if (arg.startsWith('--profile')) {
+      options.profile = readValue();
+    } else if (arg.startsWith('--url')) {
+      const value = readValue();
+      options.url = /^https?:\/\//i.test(value) ? value : appURL(value);
+    } else if (arg.startsWith('--output')) {
+      options.output = path.resolve(rootPath, readValue());
+    } else if (arg.startsWith('--storage')) {
+      options.storage = path.resolve(rootPath, readValue());
+    } else if (arg === '--no-output') {
+      options.saveOutput = false;
+    } else if (arg === '--auth-only') {
+      options.authOnly = true;
+    }
+  }
+
+  return options;
+}
+
+function printHelp() {
+  console.log(`
+Usage: node e2e/setup/record.js [options]
+
+Options:
+  --profile mock|local     Server profile to record against. Defaults to mock.
+  --url <url>              URL opened by Playwright codegen. Defaults to /c/new.
+  --output <path>          Raw recording output path under the repo.
+  --storage <path>         Auth storage state path. Defaults to e2e/storageState.json.
+  --no-output              Let codegen show generated code without writing a file.
+  --auth-only              Start servers, write storage state, then exit.
+
+Examples:
+  node e2e/setup/record.js
+  node e2e/setup/record.js --profile=local --url=http://localhost:3080/c/new
+`);
+}
+
+async function waitForURL(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1000);
+    try {
+      const response = await fetch(url, { signal: controller.signal });
+      if (response.ok) {
+        return true;
+      }
+    } catch {
+      await new Promise((resolve) => setTimeout(resolve, 500));
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  return false;
+}
+
+function spawnProcess(name, command, args, env) {
+  const child = spawn(command, args, {
+    cwd: rootPath,
+    env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  child.stdout.on('data', (chunk) => process.stdout.write(`[${name}] ${chunk}`));
+  child.stderr.on('data', (chunk) => process.stderr.write(`[${name}] ${chunk}`));
+  child.on('exit', (code) => {
+    if (code && code !== 0) {
+      console.error(`[${name}] exited with code ${code}`);
+    }
+  });
+
+  return child;
+}
+
+async function stopProcess(child) {
+  if (!child || child.exitCode != null) {
+    return;
+  }
+
+  child.kill('SIGTERM');
+  await new Promise((resolve) => {
+    const timeout = setTimeout(() => {
+      child.kill('SIGKILL');
+      resolve();
+    }, 5000);
+    child.once('exit', () => {
+      clearTimeout(timeout);
+      resolve();
+    });
+  });
+}
+
+async function register(page, user, timeout) {
+  await page.getByRole('link', { name: 'Sign up' }).click({ timeout });
+  await page.getByLabel('Full name').fill(user.name);
+  await page.getByLabel('Email').fill(user.email);
+  await page.getByTestId('password').fill(user.password);
+  await page.getByTestId('confirm_password').fill(user.password);
+  await page.getByLabel('Submit registration').click();
+}
+
+async function login(page, user) {
+  await page.getByLabel('Email').fill(user.email);
+  await page.getByLabel('Password').fill(user.password);
+  await page.getByTestId('login-button').click();
+}
+
+async function writeStorageState(env, storagePath) {
+  const { chromium } = require('@playwright/test');
+  const user = getUser(env);
+  const timeout = Number(env.E2E_AUTH_TIMEOUT || 15000);
+  const conversationURL = appURL('c/new');
+  const loginURL = appURL('login');
+  const browser = await chromium.launch({ headless: true });
+
+  try {
+    const page = await browser.newPage();
+    await page.context().addInitScript(() => {
+      localStorage.setItem('navVisible', 'true');
+    });
+
+    await page.goto(baseURL, { timeout });
+    try {
+      await register(page, user, timeout);
+      await page.waitForURL(conversationURL, { timeout });
+    } catch {
+      await page.goto(loginURL, { timeout });
+      await login(page, user);
+      await page.waitForURL(conversationURL, { timeout });
+    }
+
+    fs.mkdirSync(path.dirname(storagePath), { recursive: true });
+    await page.context().storageState({ path: storagePath });
+    console.log(`[record] Saved authenticated storage state to ${storagePath}`);
+  } finally {
+    await browser.close();
+  }
+}
+
+function runCodegen(options, env) {
+  const args = [
+    'playwright',
+    'codegen',
+    '--target=playwright-test',
+    '--test-id-attribute=data-testid',
+    '--load-storage',
+    options.storage,
+  ];
+
+  if (options.saveOutput) {
+    fs.mkdirSync(path.dirname(options.output), { recursive: true });
+    args.push('--output', options.output);
+  }
+
+  args.push(options.url);
+  console.log(`[record] Opening Playwright codegen at ${options.url}`);
+  if (options.saveOutput) {
+    console.log(`[record] Raw recording will be written to ${options.output}`);
+  }
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(npxBin, args, {
+      cwd: rootPath,
+      env,
+      stdio: 'inherit',
+    });
+    child.on('exit', (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`Playwright codegen exited with code ${code}`));
+      }
+    });
+  });
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  if (options.help) {
+    printHelp();
+    return;
+  }
+
+  if (!['mock', 'local'].includes(options.profile)) {
+    throw new Error('--profile must be "mock" or "local"');
+  }
+
+  const env = getEnv(options.profile);
+  const children = [];
+
+  try {
+    if (options.profile === 'mock') {
+      writeRuntimeMockConfig();
+    }
+
+    if (await waitForURL(baseURL, 1000)) {
+      if (options.profile === 'mock') {
+        console.warn('[record] Reusing an existing app server; make sure it uses e2e mock config.');
+      }
+    } else {
+      children.push(
+        spawnProcess('app', 'node', [path.resolve(rootPath, 'e2e/setup/start-server.js')], env),
+      );
+      if (!(await waitForURL(baseURL, 120000))) {
+        throw new Error(`LibreChat server did not become ready at ${baseURL}`);
+      }
+    }
+
+    await writeStorageState(env, options.storage);
+    if (options.authOnly) {
+      return;
+    }
+    await runCodegen(options, env);
+  } finally {
+    for (const child of children.reverse()) {
+      await stopProcess(child);
+    }
+  }
+}
+
+main().catch((error) => {
+  console.error('[record] Failed:', error);
+  process.exit(1);
+});
diff --git a/e2e/setup/runtimeEnv.ts b/e2e/setup/runtimeEnv.ts
new file mode 100644
index 00000000000..889c299d878
--- /dev/null
+++ b/e2e/setup/runtimeEnv.ts
@@ -0,0 +1,21 @@
+import fs from 'fs';
+import { getRuntimeEnvPath } from './env';
+
+export function applyRuntimeEnv() {
+  const runtimeEnvPath = getRuntimeEnvPath();
+
+  if (!fs.existsSync(runtimeEnvPath)) {
+    return;
+  }
+
+  const runtimeEnv = JSON.parse(fs.readFileSync(runtimeEnvPath, 'utf8')) as Record<
+    string,
+    string | undefined
+  >;
+
+  for (const [key, value] of Object.entries(runtimeEnv)) {
+    if (value != null) {
+      process.env[key] = value;
+    }
+  }
+}
diff --git a/e2e/setup/start-server.js b/e2e/setup/start-server.js
new file mode 100644
index 00000000000..b81f01f35a1
--- /dev/null
+++ b/e2e/setup/start-server.js
@@ -0,0 +1,187 @@
+const fs = require('fs');
+const net = require('net');
+const path = require('path');
+require('dotenv').config();
+
+const DEFAULT_MONGO_URI = 'mongodb://127.0.0.1:27017/LibreChat-e2e';
+const DEFAULT_RUNTIME_ENV_PATH = path.resolve(__dirname, '../specs/.test-results/runtime-env.json');
+let mongoServer;
+
+function decodeMongoValue(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+function getMongoScheme(uri) {
+  const schemeEnd = uri.indexOf('://');
+  return schemeEnd === -1 ? '' : uri.slice(0, schemeEnd).toLowerCase();
+}
+
+function getMongoAuthority(uri) {
+  const schemeEnd = uri.indexOf('://');
+  if (schemeEnd === -1) {
+    return '';
+  }
+
+  const withoutScheme = uri.slice(schemeEnd + 3);
+  return withoutScheme.split(/[/?#]/, 1)[0];
+}
+
+function getMongoDbName(uri) {
+  const schemeEnd = uri.indexOf('://');
+  if (schemeEnd === -1) {
+    return 'LibreChat-e2e';
+  }
+
+  const withoutScheme = uri.slice(schemeEnd + 3);
+  const pathStart = withoutScheme.indexOf('/');
+  if (pathStart === -1) {
+    return 'LibreChat-e2e';
+  }
+
+  const pathname = withoutScheme.slice(pathStart + 1).split(/[?#]/, 1)[0];
+  const dbName = pathname.split('/', 1)[0];
+  return dbName ? decodeMongoValue(dbName) : 'LibreChat-e2e';
+}
+
+function normalizeMongoPort(port) {
+  const parsed = Number(port);
+  return Number.isInteger(parsed) && parsed > 0 && parsed <= 65535 ? parsed : 27017;
+}
+
+function parseMongoHost(hostEntry) {
+  if (!hostEntry) {
+    return null;
+  }
+
+  if (hostEntry.startsWith('[')) {
+    const hostEnd = hostEntry.indexOf(']');
+    if (hostEnd === -1) {
+      return null;
+    }
+
+    const host = hostEntry.slice(1, hostEnd);
+    const port = hostEntry[hostEnd + 1] === ':' ? hostEntry.slice(hostEnd + 2) : '';
+    return { host, port: normalizeMongoPort(port) };
+  }
+
+  const [host, port] = hostEntry.split(':');
+  return host ? { host, port: normalizeMongoPort(port) } : null;
+}
+
+function parseMongoUri(uri) {
+  const scheme = getMongoScheme(uri);
+  const authority = getMongoAuthority(uri);
+  const hosts = authority
+    .slice(authority.lastIndexOf('@') + 1)
+    .split(',')
+    .filter(Boolean);
+  const parsedHost =
+    scheme === 'mongodb+srv' || hosts.length !== 1 ? null : parseMongoHost(hosts[0]);
+
+  return {
+    dbName: getMongoDbName(uri),
+    host: parsedHost?.host ?? '',
+    port: parsedHost?.port ?? 27017,
+    canProbe: Boolean(parsedHost),
+  };
+}
+
+function isLocalHost(host) {
+  return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+}
+
+async function canConnect(host, port) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection({ host, port });
+    const done = (result) => {
+      socket.destroy();
+      resolve(result);
+    };
+
+    socket.setTimeout(500);
+    socket.once('connect', () => done(true));
+    socket.once('timeout', () => done(false));
+    socket.once('error', () => done(false));
+  });
+}
+
+function withDbName(uri, dbName) {
+  const parsed = new URL(uri);
+  parsed.pathname = `/${dbName}`;
+  return parsed.toString();
+}
+
+function writeRuntimeEnv() {
+  const runtimeEnvPath = process.env.E2E_RUNTIME_ENV_PATH || DEFAULT_RUNTIME_ENV_PATH;
+  fs.mkdirSync(path.dirname(runtimeEnvPath), { recursive: true });
+  fs.writeFileSync(runtimeEnvPath, JSON.stringify({ MONGO_URI: process.env.MONGO_URI }, null, 2));
+}
+
+async function maybeStartMemoryMongo() {
+  const mongoUri = process.env.MONGO_URI ?? DEFAULT_MONGO_URI;
+  const mode = process.env.E2E_USE_MEMORY_MONGO ?? 'auto';
+
+  if (mode === 'false') {
+    process.env.MONGO_URI = mongoUri;
+    writeRuntimeEnv();
+    return;
+  }
+
+  const { dbName, host, port, canProbe } = parseMongoUri(mongoUri);
+  if (mode === 'auto' && (!canProbe || !isLocalHost(host) || (await canConnect(host, port)))) {
+    process.env.MONGO_URI = mongoUri;
+    writeRuntimeEnv();
+    return;
+  }
+
+  const { MongoMemoryServer } = require('mongodb-memory-server');
+  mongoServer = await MongoMemoryServer.create({
+    instance: {
+      dbName,
+      ip: '127.0.0.1',
+    },
+  });
+  process.env.MONGO_URI = withDbName(mongoServer.getUri(), dbName);
+  writeRuntimeEnv();
+  console.log(`[e2e] Started memory MongoDB at ${process.env.MONGO_URI}`);
+}
+
+async function shutdown() {
+  if (mongoServer) {
+    await mongoServer.stop();
+  }
+}
+
+process.once('SIGINT', async () => {
+  await shutdown();
+  process.exit(130);
+});
+
+process.once('SIGTERM', async () => {
+  await shutdown();
+  process.exit(143);
+});
+
+function startServer() {
+  return maybeStartMemoryMongo()
+    .then(() => {
+      require(path.resolve(__dirname, '../../api/server/index.js'));
+    })
+    .catch((error) => {
+      console.error('[e2e] Failed to start test server:', error);
+      process.exit(1);
+    });
+}
+
+if (require.main === module) {
+  startServer();
+}
+
+module.exports = {
+  parseMongoUri,
+  startServer,
+};
diff --git a/e2e/setup/user.ts b/e2e/setup/user.ts
new file mode 100644
index 00000000000..53b0db609b3
--- /dev/null
+++ b/e2e/setup/user.ts
@@ -0,0 +1,15 @@
+import type { User } from '../types';
+
+const DEFAULT_USER: User = {
+  email: 'testuser@example.com',
+  name: 'Test User',
+  password: 'securepassword123',
+};
+
+export function getE2EUser(): User {
+  return {
+    email: process.env.E2E_USER_EMAIL ?? DEFAULT_USER.email,
+    name: process.env.E2E_USER_NAME ?? DEFAULT_USER.name,
+    password: process.env.E2E_USER_PASSWORD ?? DEFAULT_USER.password,
+  };
+}
diff --git a/e2e/setup/users.mock.ts b/e2e/setup/users.mock.ts
new file mode 100644
index 00000000000..8e0a4ec3d41
--- /dev/null
+++ b/e2e/setup/users.mock.ts
@@ -0,0 +1,20 @@
+import type { User } from '../types';
+import { getE2EUser } from './user';
+
+const DEFAULT_SECONDARY_USER: User = {
+  email: 'testuser-b@example.com',
+  name: 'Test User B',
+  password: 'securepassword456',
+};
+
+export function getPrimaryE2EUser(): User {
+  return getE2EUser();
+}
+
+export function getSecondaryE2EUser(): User {
+  return {
+    email: process.env.E2E_USER_B_EMAIL ?? DEFAULT_SECONDARY_USER.email,
+    name: process.env.E2E_USER_B_NAME ?? DEFAULT_SECONDARY_USER.name,
+    password: process.env.E2E_USER_B_PASSWORD ?? DEFAULT_SECONDARY_USER.password,
+  };
+}
diff --git a/e2e/specs/landing.spec.ts b/e2e/specs/landing.spec.ts
index 86421cb6f1d..8fa0140a8e2 100644
--- a/e2e/specs/landing.spec.ts
+++ b/e2e/specs/landing.spec.ts
@@ -2,41 +2,18 @@ import { expect, test } from '@playwright/test';
 
 test.describe('Landing suite', () => {
   test('Landing title', async ({ page }) => {
-    await page.goto('http://localhost:3080/', { timeout: 5000 });
-    const pageTitle = await page.textContent('#landing-title');
-    expect(pageTitle?.length).toBeGreaterThan(0);
+    await page.goto('/', { timeout: 5000 });
+
+    await expect(page.getByRole('main')).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Select a model' })).toBeVisible();
   });
 
   test('Create Conversation', async ({ page }) => {
-    await page.goto('http://localhost:3080/', { timeout: 5000 });
-
-    async function getItems() {
-      const navDiv = await page.waitForSelector('nav > div');
-      if (!navDiv) {
-        return [];
-      }
-
-      const items = await navDiv.$$('a.group');
-      return items || [];
-    }
-
-    // Wait for the page to load and the SVG loader to disappear
-    await page.waitForSelector('nav > div');
-    await page.waitForSelector('nav > div > div > svg', { state: 'detached' });
-
-    const beforeAdding = (await getItems()).length;
-
-    const input = await page.locator('form').getByRole('textbox');
-    await input.click();
-    await input.fill('Hi!');
-
-    // Send the message
-    await page.locator('form').getByRole('button').nth(1).click();
-
-    // Wait for the message to be sent
-    await page.waitForTimeout(3500);
-    const afterAdding = (await getItems()).length;
+    await page.goto('/c/new', { timeout: 5000 });
 
-    expect(afterAdding).toBeGreaterThanOrEqual(beforeAdding);
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(page.getByRole('link', { name: 'New chat' })).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
   });
 });
diff --git a/e2e/specs/mock/agents.helpers.ts b/e2e/specs/mock/agents.helpers.ts
new file mode 100644
index 00000000000..bf5566f6af8
--- /dev/null
+++ b/e2e/specs/mock/agents.helpers.ts
@@ -0,0 +1,130 @@
+import { expect } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { MOCK_ENDPOINTS, NEW_CHAT_PATH, fetchJson, getAccessToken, requestJson } from './helpers';
+
+export const AGENT_EDIT_PERMISSION = 2;
+
+export type AgentSummary = {
+  _id: string;
+  id: string;
+  name?: string;
+  description?: string;
+  provider: string;
+  model: string;
+  category?: string;
+};
+
+export type ModelParameters = {
+  maxContextTokens?: number;
+  maxOutputTokens?: number;
+  temperature?: number;
+  topP?: number;
+  topK?: number;
+  thinkingBudget?: number;
+  fileTokenLimit?: number;
+  resendFiles?: boolean;
+  promptCache?: boolean;
+  thinking?: boolean;
+  web_search?: boolean;
+};
+
+export type AgentDetail = AgentSummary & {
+  instructions?: string;
+  model_parameters?: ModelParameters;
+  tools?: string[];
+  mcpServerNames?: string[];
+};
+
+export const uniqueAgentName = (prefix: string) =>
+  `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+export async function findAgent(
+  page: Page,
+  agentName: string,
+  token: string,
+): Promise<AgentSummary | null> {
+  const body = await fetchJson<{ data?: AgentSummary[] }>(
+    page,
+    `/api/agents?search=${encodeURIComponent(agentName)}&limit=10&requiredPermission=${AGENT_EDIT_PERMISSION}`,
+    token,
+  );
+  return body.data?.find((agent) => agent.name === agentName) ?? null;
+}
+
+export async function waitForPersistedAgent(
+  page: Page,
+  agentName: string,
+  description: string,
+): Promise<AgentDetail> {
+  const token = await getAccessToken(page);
+  let latestAgent: AgentDetail | null = null;
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const agent = await findAgent(page, agentName, token);
+    if (agent) {
+      latestAgent = await fetchJson<AgentDetail>(
+        page,
+        `/api/agents/${encodeURIComponent(agent.id)}/expanded`,
+        token,
+      );
+      if (latestAgent.description === description) {
+        return latestAgent;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestAgent, `Expected agent "${agentName}" to be persisted`).not.toBeNull();
+  expect(latestAgent?.description).toBe(description);
+  return latestAgent!;
+}
+
+export async function openAgentBuilder(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+  const builderVisible = await form
+    .waitFor({ state: 'visible', timeout: 1000 })
+    .then(() => true)
+    .catch(() => false);
+  if (!builderVisible) {
+    const agentBuilderButton = page.getByRole('button', { name: 'Agent Builder' });
+    await expect(agentBuilderButton).toBeVisible();
+    if ((await agentBuilderButton.getAttribute('aria-pressed')) !== 'true') {
+      await agentBuilderButton.click();
+    }
+  }
+  await expect(form).toBeVisible();
+  return form;
+}
+
+export async function selectMockModel(page: Page, clickBackToBuilder = false) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await form.locator('label[for="provider"] + button').click();
+  await expect(form.getByText('Model Parameters', { exact: true })).toBeVisible();
+
+  await form.getByRole('combobox', { name: 'Provider' }).click();
+  await page.getByRole('option', { name: MOCK_ENDPOINTS[0].label }).click();
+
+  await form.getByRole('combobox', { name: 'Model' }).click();
+  await page.getByRole('option', { name: MOCK_ENDPOINTS[0].model, exact: true }).click();
+
+  if (clickBackToBuilder) {
+    await form.getByRole('button', { name: 'Back to builder' }).click();
+    await expect(page.getByRole('form', { name: 'Agent configuration form' })).toBeVisible();
+  }
+}
+
+export async function cleanupAgent(page: Page, agentId?: string) {
+  if (!agentId) {
+    return;
+  }
+
+  const token = await getAccessToken(page);
+  await requestJson<{ message?: string }>(page, {
+    path: `/api/agents/${encodeURIComponent(agentId)}`,
+    token,
+    method: 'DELETE',
+  });
+}
diff --git a/e2e/specs/mock/agents.spec.ts b/e2e/specs/mock/agents.spec.ts
new file mode 100644
index 00000000000..8130a2ed68b
--- /dev/null
+++ b/e2e/specs/mock/agents.spec.ts
@@ -0,0 +1,197 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import type { AgentDetail } from './agents.helpers';
+import {
+  cleanupAgent,
+  openAgentBuilder,
+  selectMockModel,
+  uniqueAgentName,
+  waitForPersistedAgent,
+} from './agents.helpers';
+import { MOCK_ENDPOINTS, mockReply, sendMessage } from './helpers';
+
+const DESCRIPTION = 'Use this agent to verify LibreChat agent creation in mock end-to-end tests.';
+const INSTRUCTIONS =
+  'Reply through the mock e2e model and keep this agent available for UI persistence checks.';
+const MODEL_PARAMETERS = {
+  maxContextTokens: 32000,
+  maxOutputTokens: 4096,
+  temperature: 0.25,
+  topP: 0.8,
+  topK: 12,
+  resendFiles: false,
+  promptCache: true,
+  thinking: true,
+  thinkingBudget: 2000,
+  web_search: true,
+  fileTokenLimit: 12000,
+};
+const PERSISTED_MODEL_PARAMETERS = {
+  maxContextTokens: MODEL_PARAMETERS.maxContextTokens,
+  maxOutputTokens: MODEL_PARAMETERS.maxOutputTokens,
+  temperature: MODEL_PARAMETERS.temperature,
+  topP: MODEL_PARAMETERS.topP,
+  topK: MODEL_PARAMETERS.topK,
+  resendFiles: MODEL_PARAMETERS.resendFiles,
+  web_search: MODEL_PARAMETERS.web_search,
+  fileTokenLimit: MODEL_PARAMETERS.fileTokenLimit,
+};
+
+async function setSwitch(form: Locator, name: string, checked: boolean) {
+  const control = form.getByRole('switch', { name, exact: true });
+  await expect(control).toBeVisible();
+  if ((await control.getAttribute('aria-checked')) !== String(checked)) {
+    await control.click();
+  }
+  await expect(control).toHaveAttribute('aria-checked', String(checked));
+}
+
+async function fillAnthropicStyleModelParameters(page: Page) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await expect(form.getByLabel('Max Context Tokens')).toBeVisible();
+  await expect(form.getByLabel('Max Output Tokens')).toBeVisible();
+  await expect(form.getByText('Temperature', { exact: true })).toBeVisible();
+  await expect(form.getByText('Top P', { exact: true })).toBeVisible();
+  await expect(form.getByText('Top K', { exact: true })).toBeVisible();
+  await expect(form.getByText('Effort', { exact: true })).toBeVisible();
+  await expect(form.getByText('Thought Visibility', { exact: true })).toBeVisible();
+
+  await form
+    .locator('#maxContextTokens-dynamic-input')
+    .fill(`${MODEL_PARAMETERS.maxContextTokens}`);
+  await form.locator('#maxOutputTokens-dynamic-input').fill(`${MODEL_PARAMETERS.maxOutputTokens}`);
+  await form
+    .locator('#temperature-dynamic-setting-input-number')
+    .fill(`${MODEL_PARAMETERS.temperature}`);
+  await form.locator('#topP-dynamic-setting-input-number').fill(`${MODEL_PARAMETERS.topP}`);
+  await form.locator('#topK-dynamic-setting-input-number').fill(`${MODEL_PARAMETERS.topK}`);
+  await form.locator('#thinkingBudget-dynamic-input').fill(`${MODEL_PARAMETERS.thinkingBudget}`);
+  await form.locator('#fileTokenLimit-dynamic-input').fill(`${MODEL_PARAMETERS.fileTokenLimit}`);
+
+  await setSwitch(form, 'Resend Files', MODEL_PARAMETERS.resendFiles);
+  await setSwitch(form, 'Use Prompt Caching', MODEL_PARAMETERS.promptCache);
+  await setSwitch(form, 'Thinking', MODEL_PARAMETERS.thinking);
+  await setSwitch(form, 'Web Search', MODEL_PARAMETERS.web_search);
+
+  // DynamicInput/DynamicSlider values use a 450ms debounced form update.
+  await page.waitForTimeout(600);
+}
+
+async function expectAnthropicStyleModelParameters(page: Page) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await expect(form.locator('#maxContextTokens-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.maxContextTokens}`,
+  );
+  await expect(form.locator('#maxOutputTokens-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.maxOutputTokens}`,
+  );
+  await expect(form.locator('#temperature-dynamic-setting-input-number')).toHaveValue(
+    `${MODEL_PARAMETERS.temperature}`,
+  );
+  await expect(form.locator('#topP-dynamic-setting-input-number')).toHaveValue(
+    MODEL_PARAMETERS.topP.toFixed(2),
+  );
+  await expect(form.locator('#topK-dynamic-setting-input-number')).toHaveValue(
+    `${MODEL_PARAMETERS.topK}`,
+  );
+  await expect(form.locator('#thinkingBudget-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.thinkingBudget}`,
+  );
+  await expect(form.locator('#fileTokenLimit-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.fileTokenLimit}`,
+  );
+
+  await expect(form.getByRole('switch', { name: 'Resend Files', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.resendFiles),
+  );
+  await expect(
+    form.getByRole('switch', { name: 'Use Prompt Caching', exact: true }),
+  ).toHaveAttribute('aria-checked', String(MODEL_PARAMETERS.promptCache));
+  await expect(form.getByRole('switch', { name: 'Thinking', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.thinking),
+  );
+  await expect(form.getByRole('switch', { name: 'Web Search', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.web_search),
+  );
+}
+
+test.describe('agent builder', () => {
+  test('creates an agent, persists its configuration, and can chat with it', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const agentName = uniqueAgentName('E2E Agent');
+    let createdAgentId: string | undefined;
+
+    try {
+      let form = await openAgentBuilder(page);
+
+      await form.getByLabel('Agent name').fill(agentName);
+      await form.getByLabel('Agent description').fill(DESCRIPTION);
+      await form.getByLabel('Agent instructions').fill(INSTRUCTIONS);
+
+      await selectMockModel(page);
+      await fillAnthropicStyleModelParameters(page);
+      await page
+        .getByRole('form', { name: 'Agent configuration form' })
+        .getByRole('button', {
+          name: 'Back to builder',
+        })
+        .click();
+      form = page.getByRole('form', { name: 'Agent configuration form' });
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/agents' &&
+            response.status() === 201,
+          { timeout: 30000 },
+        ),
+        form.getByRole('button', { name: 'Create' }).click(),
+      ]);
+      const createdAgent = (await createResponse.json()) as AgentDetail;
+      createdAgentId = createdAgent.id;
+
+      await expect(
+        page.getByText(`Successfully created ${agentName}`, { exact: true }),
+      ).toBeVisible();
+
+      const persistedAgent = await waitForPersistedAgent(page, agentName, DESCRIPTION);
+      expect(persistedAgent).toMatchObject({
+        id: createdAgentId,
+        name: agentName,
+        description: DESCRIPTION,
+        instructions: INSTRUCTIONS,
+        provider: MOCK_ENDPOINTS[0].label,
+        model: MOCK_ENDPOINTS[0].model,
+        category: 'general',
+      });
+      expect(persistedAgent.model_parameters).toMatchObject(PERSISTED_MODEL_PARAMETERS);
+
+      form = await openAgentBuilder(page);
+      await form.getByRole('combobox', { name: 'Agent', exact: true }).click();
+      await page.getByRole('option', { name: agentName }).click();
+
+      await expect(form.getByLabel('Agent name')).toHaveValue(agentName);
+      await expect(form.getByLabel('Agent description')).toHaveValue(DESCRIPTION);
+      await expect(form.getByLabel('Agent instructions')).toHaveValue(INSTRUCTIONS);
+
+      await form.locator('label[for="provider"] + button').click();
+      await expectAnthropicStyleModelParameters(page);
+      await form.getByRole('button', { name: 'Back to builder' }).click();
+
+      await form.getByRole('button', { name: 'Select Agent' }).click();
+
+      const response = await sendMessage(page, `hello from ${agentName}`);
+      expect(response.ok()).toBeTruthy();
+      await expect(mockReply(page)).toBeVisible({ timeout: 30000 });
+    } finally {
+      await cleanupAgent(page, createdAgentId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/app-load.spec.ts b/e2e/specs/mock/app-load.spec.ts
new file mode 100644
index 00000000000..9c5d6865013
--- /dev/null
+++ b/e2e/specs/mock/app-load.spec.ts
@@ -0,0 +1,25 @@
+import { expect, test } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
+import { NEW_CHAT_PATH } from './helpers';
+
+test.describe('app loads cleanly', () => {
+  test('authenticated user lands on a rendered chat view without runtime errors', async ({
+    page,
+  }) => {
+    const user = getPrimaryE2EUser();
+    const pageErrors: string[] = [];
+    page.on('pageerror', (error) => pageErrors.push(error.message));
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(page.getByRole('main')).toBeVisible();
+    await expect(page.getByRole('main')).toContainText(user.name);
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Select a model' }).first()).toBeVisible();
+    await expect(page.getByTestId('nav-user')).toBeVisible();
+
+    await expect(page.getByText(/something went wrong/i)).toHaveCount(0);
+    expect(pageErrors, `Unexpected runtime errors: ${pageErrors.join(', ')}`).toHaveLength(0);
+  });
+});
diff --git a/e2e/specs/mock/attachment-preview-loop.spec.ts b/e2e/specs/mock/attachment-preview-loop.spec.ts
new file mode 100644
index 00000000000..1daecca2d25
--- /dev/null
+++ b/e2e/specs/mock/attachment-preview-loop.spec.ts
@@ -0,0 +1,169 @@
+import { expect, test } from '@playwright/test';
+import type { Route } from '@playwright/test';
+
+/**
+ * Regression for issue #13916: hard-refreshing a conversation that
+ * contains a large (>1MB) code-execution office file crashed the whole
+ * app with React error #185 ("Maximum update depth exceeded").
+ *
+ * Root cause (client-only): on a loaded conversation the message's
+ * attachment is frozen at the immediate-persist snapshot
+ * `status: 'pending'`. `useAttachmentPreviewSync` polls the preview
+ * endpoint, and once it resolves it writes the record back into
+ * `messageAttachmentsMap`. `useAttachments` re-derives the attachment
+ * with a fresh identity on every such write, and that attachment is in
+ * the effect's dependency array — so the write-back ping-ponged forever.
+ *
+ * This spec reconstructs that exact load: it intercepts the
+ * conversation, messages, and preview endpoints to serve a code-exec
+ * tool call carrying a still-`pending` office attachment whose preview
+ * resolves to `ready`. With the bug present the page throws #185 and the
+ * route's error boundary replaces the chat; with the fix it settles and
+ * the conversation renders normally.
+ *
+ * It uses network interception (not the fake model) because the trigger
+ * is the persisted deferred-preview lifecycle, which the mock LLM does
+ * not produce.
+ */
+
+const NO_PARENT = '00000000-0000-0000-0000-000000000000';
+
+const unique = (p: string) => `${p}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+const escapeRe = (v: string) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+test.describe('issue #13916 — code-exec attachment preview', () => {
+  test('loading a conversation with a pending >1MB doc attachment does not crash (React #185)', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+
+    const conversationId = unique('e2e-13916');
+    const messageId = `${conversationId}-msg`;
+    const fileId = `${conversationId}-file`;
+    const filename = 'repro-13916-large.docx';
+    const now = new Date(0).toISOString();
+
+    /** DB-frozen, immediate-persist snapshot: pending, no resolved text. */
+    const attachment = {
+      file_id: fileId,
+      filename,
+      filepath: `/uploads/682f49b90f07376815c38ef2/${fileId}__${filename}`,
+      type: 'execute_code',
+      source: 'local',
+      bytes: 1256732,
+      messageId,
+      conversationId,
+      toolCallId: 'tc-13916',
+      status: 'pending',
+      metadata: {
+        codeEnvRef: { kind: 'user', id: '682f49b90f07376815c38ef2', storage_session_id: 'sess' },
+      },
+    };
+
+    const message = {
+      messageId,
+      conversationId,
+      parentMessageId: NO_PARENT,
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      endpoint: 'Mock Provider A',
+      model: 'mock-model-a',
+      text: '',
+      content: [
+        {
+          type: 'tool_call',
+          tool_call: {
+            id: 'tc-13916',
+            name: 'execute_code',
+            args: '{"lang":"py","code":"# edit the document"}',
+            output: 'edited 1 paragraph',
+            progress: 1,
+          },
+        },
+      ],
+      attachments: [attachment],
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    const conversation = {
+      conversationId,
+      title: 'File Editing Request',
+      endpoint: 'Mock Provider A',
+      endpointType: 'custom',
+      model: 'mock-model-a',
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    /* The preview poll resolves immediately to `ready`; this terminal
+     * response is the edge that kicks off the (formerly infinite) write-back. */
+    const previewReady = {
+      file_id: fileId,
+      status: 'ready',
+      text: '<p>edited paragraph added</p>',
+      textFormat: 'html',
+    };
+
+    const convoIdRe = escapeRe(conversationId);
+    await page.route(new RegExp(`/api/convos/${convoIdRe}(?:\\?.*)?$`), (route: Route) =>
+      route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify(conversation),
+      }),
+    );
+    await page.route(new RegExp(`/api/messages/${convoIdRe}(?:\\?.*)?$`), (route: Route) =>
+      route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify([message]),
+      }),
+    );
+    await page.route(/\/api\/files\/[^/]+\/preview(?:\?.*)?$/, (route: Route) =>
+      route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify(previewReady),
+      }),
+    );
+
+    /* The exact failure signature from the issue. Capture both the
+     * uncaught throw and the console error React logs alongside it. */
+    const maxDepth = /Maximum update depth exceeded/i;
+    const fatalErrors: string[] = [];
+    page.on('pageerror', (err) => {
+      if (maxDepth.test(err.message)) {
+        fatalErrors.push(err.message);
+      }
+    });
+    page.on('console', (msg) => {
+      if (msg.type() === 'error' && maxDepth.test(msg.text())) {
+        fatalErrors.push(msg.text());
+      }
+    });
+
+    await page.goto(`/c/${conversationId}`, { timeout: 30000 });
+
+    /* Anti-false-pass: the attachment path must actually execute, else
+     * the buggy build would never loop and this test would guard nothing.
+     * The filename renders only once the code-exec attachment mounts. */
+    await expect(page.getByText(new RegExp(escapeRe('repro-13916'))).first()).toBeVisible({
+      timeout: 30000,
+    });
+
+    /* Let the preview poll + any re-render storm play out. */
+    await page.waitForTimeout(3000);
+
+    expect(
+      fatalErrors,
+      `React #185 fired during conversation load:\n${fatalErrors.join('\n---\n')}`,
+    ).toHaveLength(0);
+
+    /* The route's error boundary replaces the composer on crash, so its
+     * presence is an independent "the app survived" signal. */
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible({
+      timeout: 10000,
+    });
+  });
+});
diff --git a/e2e/specs/mock/auth.spec.ts b/e2e/specs/mock/auth.spec.ts
new file mode 100644
index 00000000000..7443a64fe91
--- /dev/null
+++ b/e2e/specs/mock/auth.spec.ts
@@ -0,0 +1,181 @@
+import { expect, test } from '@playwright/test';
+import type { APIRequestContext } from '@playwright/test';
+import type { User } from '../../types';
+import { getSecondaryE2EUser } from '../../setup/users.mock';
+import cleanupUser from '../../setup/cleanupUser';
+import { NEW_CHAT_PATH } from './helpers';
+
+type AuthRecoveryTestEvent = {
+  type: string;
+  detail: unknown;
+};
+
+type AuthRecoveryTestWindow = Window & {
+  __authRecoveryTestEvents: AuthRecoveryTestEvent[];
+};
+
+type RefreshTokenBody = {
+  token?: string;
+};
+
+function createJwt(expiresAtMs: number) {
+  const payload = Buffer.from(JSON.stringify({ exp: Math.floor(expiresAtMs / 1000) })).toString(
+    'base64url',
+  );
+  return `header.${payload}.signature`;
+}
+
+async function getIsolatedStorageState(request: APIRequestContext, user: User) {
+  await cleanupUser(user);
+
+  const registerResponse = await request.post('/api/auth/register', {
+    data: {
+      email: user.email,
+      name: user.name,
+      password: user.password,
+      confirm_password: user.password,
+    },
+  });
+  expect(registerResponse.ok()).toBeTruthy();
+
+  const loginResponse = await request.post('/api/auth/login', {
+    data: {
+      email: user.email,
+      password: user.password,
+    },
+  });
+  expect(loginResponse.ok()).toBeTruthy();
+
+  return request.storageState();
+}
+
+test.describe('auth session', () => {
+  test('session persists across a full page reload', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await expect(page).not.toHaveURL(/\/login/);
+    await expect(page.getByTestId('nav-user')).toBeVisible();
+
+    await page.reload({ timeout: 10000 });
+
+    await expect(page).not.toHaveURL(/\/login/);
+    await expect(page.getByTestId('nav-user')).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+  });
+
+  test('logout ends the session and protects authenticated routes', async ({
+    request,
+    browser,
+    baseURL,
+  }) => {
+    test.setTimeout(90000);
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for mock auth tests');
+    }
+
+    const user = getSecondaryE2EUser();
+    const context = await browser.newContext({
+      storageState: await getIsolatedStorageState(request, user),
+      baseURL,
+    });
+    await context.addInitScript(() => {
+      localStorage.setItem('navVisible', 'true');
+    });
+    const page = await context.newPage();
+
+    try {
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await expect(page).not.toHaveURL(/\/login/);
+
+      await page.getByTestId('nav-user').click();
+      await page.getByRole('menuitem', { name: 'Log out' }).click();
+
+      await page.waitForURL(/\/login/, { timeout: 10000 });
+      await expect(page.getByLabel('Email')).toBeVisible();
+
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await expect(page).toHaveURL(/\/login/);
+    } finally {
+      await context.close().catch(() => undefined);
+      await cleanupUser(user);
+    }
+  });
+
+  test('recovers from an expired bearer during app bootstrap without redirect looping', async ({
+    page,
+  }) => {
+    test.setTimeout(30000);
+
+    const expiredToken = createJwt(Date.now() - 60_000);
+    const expiredBearerPaths: string[] = [];
+    let refreshCalls = 0;
+
+    await page.addInitScript(() => {
+      const testWindow = window as AuthRecoveryTestWindow;
+      testWindow.__authRecoveryTestEvents = [];
+      window.addEventListener('authRecovery', (event) => {
+        testWindow.__authRecoveryTestEvents.push({
+          type: 'authRecovery',
+          detail: (event as CustomEvent).detail,
+        });
+      });
+      window.addEventListener('authRedirectStarted', (event) => {
+        testWindow.__authRecoveryTestEvents.push({
+          type: 'authRedirectStarted',
+          detail: (event as CustomEvent).detail,
+        });
+      });
+    });
+
+    await page.route('**/api/**', async (route) => {
+      const request = route.request();
+      const pathname = new URL(request.url()).pathname;
+
+      if (pathname === '/api/auth/refresh') {
+        refreshCalls += 1;
+        const response = await route.fetch();
+        if (refreshCalls === 1) {
+          const body = (await response.json()) as RefreshTokenBody;
+          await route.fulfill({
+            response,
+            json: {
+              ...body,
+              token: expiredToken,
+            },
+          });
+          return;
+        }
+
+        await route.fulfill({ response });
+        return;
+      }
+
+      if (request.headers().authorization === `Bearer ${expiredToken}`) {
+        expiredBearerPaths.push(pathname);
+        await route.fulfill({
+          status: 401,
+          contentType: 'application/json',
+          json: { message: 'jwt expired' },
+        });
+        return;
+      }
+
+      await route.continue();
+    });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await expect(page).not.toHaveURL(/\/login/);
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect.poll(() => refreshCalls).toBe(2);
+    expect(expiredBearerPaths.length).toBeGreaterThan(0);
+
+    const events = await page.evaluate(
+      () => (window as AuthRecoveryTestWindow).__authRecoveryTestEvents,
+    );
+
+    expect(events.filter((event) => event.type === 'authRedirectStarted')).toHaveLength(0);
+    expect(
+      events.filter((event) => event.type === 'authRecovery').map((event) => event.detail),
+    ).toEqual([{ state: 'started' }, { state: 'finished' }]);
+  });
+});
diff --git a/e2e/specs/mock/bookmarks.spec.ts b/e2e/specs/mock/bookmarks.spec.ts
new file mode 100644
index 00000000000..6b05c61fc8f
--- /dev/null
+++ b/e2e/specs/mock/bookmarks.spec.ts
@@ -0,0 +1,145 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import {
+  selectMockEndpoint,
+  getAccessToken,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  sendMessage,
+  fetchJson,
+} from './helpers';
+
+type TagCount = { tag: string; count: number };
+
+const uniqueName = (prefix: string) =>
+  `${prefix}-${Date.now().toString(36)}-${Math.floor(Math.random() * 1e4)}`;
+
+const firstConversation = (page: Page) => page.getByTestId('convo-item').first();
+
+/** The header bookmark menu (the nav filter button shares the `bookmark-menu` testid). */
+const headerBookmarkButton = (page: Page) => page.locator('#bookmark-menu-button');
+
+/** Start a mock chat and send a message so the conversation persists at `/c/:id`. */
+async function startBookmarkableChat(page: Page): Promise<void> {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+  const response = await sendMessage(page, 'hello bookmarks');
+  expect(response.ok()).toBeTruthy();
+  await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+  await expect(headerBookmarkButton(page)).toBeVisible({ timeout: 15000 });
+}
+
+/** Create a brand-new bookmark and attach it to the active conversation (count -> 1). */
+async function createBookmarkForActiveChat(page: Page, tag: string): Promise<void> {
+  await headerBookmarkButton(page).click();
+  await page.getByRole('menuitem', { name: 'New Bookmark' }).click();
+
+  const dialog = page.getByRole('dialog');
+  await dialog.getByRole('textbox', { name: 'Title' }).fill(tag);
+  const [response] = await Promise.all([
+    page.waitForResponse(
+      (r) => r.request().method() === 'POST' && new URL(r.url()).pathname === '/api/tags',
+      { timeout: 15000 },
+    ),
+    dialog.getByRole('button', { name: 'Save' }).click(),
+  ]);
+  expect(response.ok()).toBeTruthy();
+  await expect(dialog).toBeHidden();
+  await page.keyboard.press('Escape');
+}
+
+/** Attach an already-existing bookmark to the active conversation (count += 1). */
+async function addExistingBookmarkToActiveChat(page: Page, tag: string): Promise<void> {
+  await headerBookmarkButton(page).click();
+  // Existing-tag rows render as `menuitemcheckbox` (they carry aria-checked).
+  const tagItem = page.getByRole('menuitemcheckbox', { name: tag, exact: true });
+  await expect(tagItem).toBeVisible({ timeout: 10000 });
+  const [response] = await Promise.all([
+    page.waitForResponse(
+      (r) =>
+        r.request().method() === 'PUT' && new URL(r.url()).pathname.startsWith('/api/tags/convo/'),
+      { timeout: 15000 },
+    ),
+    tagItem.click(),
+  ]);
+  expect(response.ok()).toBeTruthy();
+  await page.keyboard.press('Escape');
+}
+
+/** Read the persisted bookmark count from the server (0 when the tag is absent). */
+async function getTagCount(page: Page, tag: string): Promise<number> {
+  const token = await getAccessToken(page);
+  const tags = await fetchJson<TagCount[]>(page, '/api/tags', token);
+  return tags.find((t) => t.tag === tag)?.count ?? 0;
+}
+
+async function renameConversation(page: Page, conversation: Locator, title: string): Promise<void> {
+  await conversation.hover();
+  await conversation.getByRole('button', { name: 'Conversation Menu Options' }).click();
+  await page.getByRole('menuitem', { name: 'Rename' }).click();
+  const titleInput = conversation.getByRole('textbox', { name: 'New Conversation Title' });
+  await expect(titleInput).toBeVisible();
+  await titleInput.fill(title);
+  await conversation.getByRole('button', { name: 'Save' }).click();
+  await expect(conversation).toContainText(title);
+}
+
+async function deleteConversation(page: Page, conversation: Locator): Promise<void> {
+  await conversation.hover();
+  await conversation.getByRole('button', { name: 'Conversation Menu Options' }).click();
+  await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+  const dialog = page.getByRole('dialog', { name: 'Delete chat?' });
+  await expect(dialog).toBeVisible();
+  const [response] = await Promise.all([
+    page.waitForResponse(
+      (r) => r.request().method() === 'DELETE' && r.url().includes('/api/convos'),
+      { timeout: 30000 },
+    ),
+    dialog.getByRole('button', { name: 'Delete' }).click(),
+  ]);
+  expect(response.ok()).toBeTruthy();
+}
+
+test.describe('bookmark counts', () => {
+  test.describe.configure({ timeout: 120_000 });
+
+  test('drops a bookmark count to zero when its only conversation is deleted', async ({ page }) => {
+    const tag = uniqueName('E2E Bookmark');
+
+    await startBookmarkableChat(page);
+    await createBookmarkForActiveChat(page, tag);
+    expect(await getTagCount(page, tag)).toBe(1);
+
+    await deleteConversation(page, firstConversation(page));
+
+    await expect.poll(() => getTagCount(page, tag), { timeout: 15000 }).toBe(0);
+  });
+
+  test('keeps a shared bookmark at one when another conversation still uses it', async ({
+    page,
+  }) => {
+    const tag = uniqueName('E2E Shared');
+
+    // Conversation A: create the bookmark (count -> 1).
+    await startBookmarkableChat(page);
+    await createBookmarkForActiveChat(page, tag);
+    const titleA = uniqueName('Bookmark A');
+    await renameConversation(page, firstConversation(page), titleA);
+    expect(await getTagCount(page, tag)).toBe(1);
+
+    // Conversation B: attach the same bookmark (count -> 2).
+    await startBookmarkableChat(page);
+    await addExistingBookmarkToActiveChat(page, tag);
+    const titleB = uniqueName('Bookmark B');
+    await renameConversation(page, firstConversation(page), titleB);
+    expect(await getTagCount(page, tag)).toBe(2);
+
+    // Deleting A leaves the count at 1 because B still carries the bookmark.
+    const conversationA = page.getByTestId('convo-item').filter({ hasText: titleA });
+    await deleteConversation(page, conversationA);
+
+    await expect.poll(() => getTagCount(page, tag), { timeout: 15000 }).toBe(1);
+    await expect(page.getByTestId('convo-item').filter({ hasText: titleB })).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/chat.spec.ts b/e2e/specs/mock/chat.spec.ts
new file mode 100644
index 00000000000..da72bdf161b
--- /dev/null
+++ b/e2e/specs/mock/chat.spec.ts
@@ -0,0 +1,396 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  isAgentsStream,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  messagesView,
+  mockReply,
+  replyText,
+  replyPrompt,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+type UploadFixture = {
+  name: string;
+  mimeType: string;
+  buffer: Buffer;
+};
+
+const pdfFixture: UploadFixture = {
+  name: 'provider-context.pdf',
+  mimeType: 'application/pdf',
+  buffer: Buffer.from(
+    `%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Count 0 >>
+endobj
+trailer
+<< /Root 1 0 R >>
+%%EOF
+`,
+  ),
+};
+
+const textFixture: UploadFixture = {
+  name: 'provider-context.txt',
+  mimeType: 'text/plain',
+  buffer: Buffer.from('This text attachment should be available to the mock model.\n'),
+};
+
+const imageFixture: UploadFixture = {
+  name: 'provider-context.png',
+  mimeType: 'image/png',
+  buffer: Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=',
+    'base64',
+  ),
+};
+
+const composer = (page: Page) => page.locator('form');
+
+async function openProviderFileChooser(page: Page) {
+  await page.getByRole('button', { name: 'Attach File Options' }).click();
+  await expect(page.getByText('Upload to Provider')).toBeVisible();
+
+  const fileChooserPromise = page.waitForEvent('filechooser');
+  await page.getByText('Upload to Provider').click();
+  const fileChooser = await fileChooserPromise;
+  expect(await fileChooser.element().getAttribute('type')).toBe('file');
+  return fileChooser;
+}
+
+async function uploadProviderFile(page: Page, fixture: UploadFixture) {
+  const fileChooser = await openProviderFileChooser(page);
+  const uploadResponsePromise = page.waitForResponse(
+    (response) =>
+      response.url().includes('/api/files') &&
+      response.request().method() === 'POST' &&
+      response.status() === 200,
+    { timeout: 30000 },
+  );
+  await fileChooser.setFiles(fixture);
+  const uploadResponse = await uploadResponsePromise;
+  expect(uploadResponse.ok()).toBeTruthy();
+  await page.waitForTimeout(350);
+  return uploadResponse;
+}
+
+test.describe('core chat loop', () => {
+  test('streams a response, saves the conversation, and persists across reload', async ({
+    page,
+  }) => {
+    test.setTimeout(60000);
+    const userMessage = 'ping from e2e';
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, userMessage);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(page.getByText(userMessage)).toBeVisible();
+    const userMessageTurn = messagesView(page)
+      .locator('.message-render')
+      .filter({ hasText: userMessage });
+    await expect(userMessageTurn.locator('.user-turn')).toBeVisible();
+    await expect(userMessageTurn.locator('.agent-turn')).toHaveCount(0);
+    await expect(mockReply(page)).toBeVisible();
+
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    const conversationUrl = page.url();
+
+    await expect(page.getByTestId('convo-item').first()).toBeVisible();
+
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(page.getByText(userMessage)).toBeVisible();
+    await expect(mockReply(page)).toBeVisible();
+    await expect(page.getByTestId('convo-item').first()).toBeVisible();
+  });
+
+  test('keeps send disabled until the composer has message text', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    const sendButton = page.getByTestId('send-button');
+
+    await expect(sendButton).toBeDisabled();
+    await input.fill('ready to send');
+    await expect(sendButton).toBeEnabled();
+    await input.fill('   ');
+    await expect(sendButton).toBeDisabled();
+  });
+
+  test('renders assistant markdown and syntax-highlighted code blocks', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'E2E_MARKDOWN_REPLY');
+    expect(response.ok()).toBeTruthy();
+
+    const assistantMessage = messagesView(page)
+      .locator('.message-render')
+      .filter({ hasText: 'E2E markdown heading' })
+      .last();
+    await expect(assistantMessage.locator('.agent-turn')).toBeVisible();
+    await expect(
+      assistantMessage.getByRole('heading', { name: 'E2E markdown heading' }),
+    ).toBeVisible();
+    await expect(
+      assistantMessage.locator('strong').filter({ hasText: 'E2E bold text' }),
+    ).toBeVisible();
+    await expect(
+      assistantMessage.getByRole('listitem').filter({ hasText: 'E2E list item' }),
+    ).toBeVisible();
+
+    const codeBlock = assistantMessage.locator('code').filter({ hasText: 'e2eSyntaxHighlight' });
+    await expect(codeBlock).toBeVisible();
+    await expect(codeBlock).toHaveClass(/hljs/);
+    await expect(codeBlock).toHaveClass(/language-javascript/);
+  });
+
+  test('can switch back to the previous branch after regenerating an earlier response', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+    const firstMessage = 'branch root from e2e';
+    const followUpMessage = 'follow-up on original branch from e2e';
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    let response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible();
+
+    response = await sendMessage(page, followUpMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(followUpMessage)).toBeVisible();
+
+    const firstAssistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await firstAssistantMessage.hover();
+    const regenerateButton = firstAssistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+
+    const [regenerateResponse] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regenerateResponse.ok()).toBeTruthy();
+
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(page.getByText(followUpMessage)).toBeVisible();
+  });
+
+  test('keeps the viewed branch when regenerating its latest response with an earlier branch present', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const firstMessage = 'first turn from e2e';
+    const secondMessage = 'second turn from e2e';
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    let response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page).first()).toBeVisible();
+    response = await sendMessage(page, secondMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(secondMessage)).toBeVisible();
+
+    // Regenerate the INITIAL response → a second root-level branch the second
+    // turn does not belong to.
+    const firstAssistant = messagesView(page).locator('.message-render').nth(1);
+    await firstAssistant.hover();
+    const regenInitial = firstAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenInitial).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenInitial.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    await expect(page.getByText(secondMessage)).toHaveCount(0);
+
+    // Back to the ORIGINAL branch (both turns present).
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(page.getByText(secondMessage)).toBeVisible();
+
+    // Regenerate the LATEST response on the original branch. The bug snapped the
+    // root fork back to the newest (regenerated-initial) branch, dropping the
+    // original thread; the view must stay put.
+    const latestAssistant = messagesView(page).locator('.message-render').last();
+    await latestAssistant.hover();
+    const regenLatest = latestAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenLatest).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenLatest.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    // Still on the original branch: the second turn survives and the root fork
+    // still reads 1 / 2 (rather than snapping to the regenerated-initial branch).
+    await expect(page.getByText(secondMessage)).toBeVisible();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+  });
+
+  test('preserves a long original branch when regenerating early then later on it', async ({
+    page,
+  }) => {
+    test.setTimeout(150000);
+    // Labeled prompts give each turn a unique reply, so we can both settle on
+    // it (turn complete) and assert which branch is visible.
+    const turns = [
+      { prompt: replyPrompt('lb-one'), reply: replyText('lb-one') },
+      { prompt: replyPrompt('lb-two'), reply: replyText('lb-two') },
+      { prompt: replyPrompt('lb-three'), reply: replyText('lb-three') },
+    ];
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    // Build a three-turn thread (the "long running thread"), waiting for each
+    // turn's unique reply to render before sending the next.
+    for (const turn of turns) {
+      const response = await sendMessage(page, turn.prompt);
+      expect(response.ok()).toBeTruthy();
+      await expect(messagesView(page).getByText(turn.reply)).toBeVisible({ timeout: 30000 });
+    }
+
+    // Regenerate from an EARLIER part of the branch (the first response). This
+    // forks a fresh root branch that does not contain the later turns.
+    const earlyAssistant = messagesView(page).locator('.message-render').nth(1);
+    await earlyAssistant.hover();
+    const regenEarly = earlyAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenEarly).toBeVisible();
+    let [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenEarly.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    // The fresh branch does not contain the later turns' replies.
+    await expect(messagesView(page).getByText(turns[1].reply)).toHaveCount(0);
+    await expect(messagesView(page).getByText(turns[2].reply)).toHaveCount(0);
+
+    // Go back to the ORIGINAL branch — all three turns are present again.
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(messagesView(page).getByText(turns[1].reply)).toBeVisible();
+    await expect(messagesView(page).getByText(turns[2].reply)).toBeVisible();
+
+    // Regenerate from LATER in the original branch (its latest response). The
+    // bug snapped the early fork back to the regenerated branch, collapsing the
+    // long original thread; it must stay intact.
+    const lateAssistant = messagesView(page).locator('.message-render').last();
+    await lateAssistant.hover();
+    const regenLate = lateAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenLate).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenLate.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    // The whole original branch survives and its first fork still reads 1 / 2.
+    await expect(messagesView(page).getByText(turns[1].reply)).toBeVisible();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+  });
+
+  test('keeps upload-to-provider CSV attached to the sent message and model input', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+
+    const csvFixture: UploadFixture = {
+      name: 'provider-upload.csv',
+      mimeType: 'text/csv',
+      buffer: Buffer.from('name,value\nalpha,1\n'),
+    };
+    const filename = csvFixture.name;
+    const assertionText = `E2E_ASSERT_PROVIDER_FILE:${filename}`;
+    const fileChip = messagesView(page).getByRole('button', { name: filename });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await uploadProviderFile(page, csvFixture);
+
+    await expect(page.getByRole('button', { name: filename })).toBeVisible();
+
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await input.click();
+    await input.fill(assertionText);
+    await expect(page.getByTestId('send-button')).toBeEnabled();
+
+    const [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByTestId('send-button').click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      messagesView(page).getByText(`E2E provider file assertion passed: ${filename}`),
+    ).toBeVisible();
+    await expect(fileChip).toBeVisible();
+
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    const conversationUrl = page.url();
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(fileChip).toBeVisible();
+  });
+
+  test('supports attaching, removing, and sending provider files from the composer', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await uploadProviderFile(page, pdfFixture);
+    const pdfChip = composer(page).getByRole('button', { name: pdfFixture.name });
+    await expect(pdfChip).toBeVisible();
+
+    await composer(page).getByRole('button', { name: 'Remove file' }).click();
+    await expect(pdfChip).toHaveCount(0);
+
+    await uploadProviderFile(page, imageFixture);
+    await expect(
+      composer(page).getByRole('button', { name: 'View Preview image in full size' }),
+    ).toBeVisible();
+
+    await uploadProviderFile(page, textFixture);
+    const textChip = composer(page).getByRole('button', { name: textFixture.name });
+    await expect(textChip).toBeVisible();
+
+    const assertionText = `E2E_ASSERT_PROVIDER_FILE:${textFixture.name}`;
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await input.click();
+    await input.fill(assertionText);
+    await expect(page.getByTestId('send-button')).toBeEnabled();
+
+    const [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByTestId('send-button').click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      messagesView(page).getByText(`E2E provider file assertion passed: ${textFixture.name}`),
+    ).toBeVisible();
+    await expect(messagesView(page).getByRole('button', { name: textFixture.name })).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/conversation-management.spec.ts b/e2e/specs/mock/conversation-management.spec.ts
new file mode 100644
index 00000000000..c289aa16997
--- /dev/null
+++ b/e2e/specs/mock/conversation-management.spec.ts
@@ -0,0 +1,120 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  messagesView,
+  replyPrompt,
+  replyText,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const firstConversation = (page: Page) => page.getByTestId('convo-item').first();
+
+function uniqueLabel(prefix: string) {
+  return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+async function openMockChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+}
+
+async function sendAndExpectReply(page: Page, label: string) {
+  const prompt = replyPrompt(label);
+  const reply = replyText(label);
+  const response = await sendMessage(page, prompt);
+  expect(response.ok()).toBeTruthy();
+  await expect(messagesView(page).getByText(prompt)).toBeVisible();
+  await expect(messagesView(page).getByText(reply)).toBeVisible();
+  return { prompt, reply };
+}
+
+async function openConversationMenu(conversation: Locator) {
+  await conversation.hover();
+  await conversation.getByRole('button', { name: 'Conversation Menu Options' }).click();
+}
+
+async function renameConversation(page: Page, conversation: Locator, title: string) {
+  await openConversationMenu(conversation);
+  await page.getByRole('menuitem', { name: 'Rename' }).click();
+  const titleInput = conversation.getByRole('textbox', { name: 'New Conversation Title' });
+  await expect(titleInput).toBeVisible();
+  await titleInput.fill(title);
+  await conversation.getByRole('button', { name: 'Save' }).click();
+  await expect(conversation).toContainText(title);
+}
+
+test.describe('conversation management', () => {
+  test('loads a past sidebar conversation with its message history', async ({ page }) => {
+    const firstLabel = uniqueLabel('sidebar-history-first');
+    const secondLabel = uniqueLabel('sidebar-history-second');
+
+    await openMockChat(page);
+    const firstTurn = await sendAndExpectReply(page, firstLabel);
+    const secondTurn = await sendAndExpectReply(page, secondLabel);
+    const conversationUrl = page.url();
+
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    await expect(firstConversation(page)).toBeVisible();
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(messagesView(page).getByText(firstTurn.prompt)).toHaveCount(0);
+    await expect(messagesView(page).getByText(secondTurn.prompt)).toHaveCount(0);
+
+    await firstConversation(page).click();
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(messagesView(page).getByText(firstTurn.prompt)).toBeVisible();
+    await expect(messagesView(page).getByText(firstTurn.reply)).toBeVisible();
+    await expect(messagesView(page).getByText(secondTurn.prompt)).toBeVisible();
+    await expect(messagesView(page).getByText(secondTurn.reply)).toBeVisible();
+  });
+
+  test('renames a conversation from the sidebar', async ({ page }) => {
+    const label = uniqueLabel('sidebar-rename');
+    const renamedTitle = `Renamed ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, label);
+
+    await renameConversation(page, firstConversation(page), renamedTitle);
+    await page.reload({ timeout: 10000 });
+    await expect(page.getByTestId('convo-item').filter({ hasText: renamedTitle })).toBeVisible();
+  });
+
+  test('deletes a conversation from the sidebar and blocks direct URL access', async ({ page }) => {
+    const label = uniqueLabel('sidebar-delete');
+    const renamedTitle = `Delete ${label}`;
+
+    await openMockChat(page);
+    const turn = await sendAndExpectReply(page, label);
+    const conversationUrl = page.url();
+
+    const conversation = firstConversation(page);
+    await renameConversation(page, conversation, renamedTitle);
+    await openConversationMenu(conversation);
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+    const dialog = page.getByRole('dialog', { name: 'Delete chat?' });
+    await expect(dialog).toBeVisible();
+    const [deleteResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'DELETE' && response.url().includes('/api/convos'),
+        { timeout: 30000 },
+      ),
+      dialog.getByRole('button', { name: 'Delete' }).click(),
+    ]);
+    expect(deleteResponse.ok()).toBeTruthy();
+
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(page.getByTestId('convo-item').filter({ hasText: renamedTitle })).toHaveCount(0);
+
+    await page.goto(conversationUrl, { timeout: 10000 });
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect(messagesView(page).getByText(turn.prompt)).toHaveCount(0);
+    await expect(messagesView(page).getByText(turn.reply)).toHaveCount(0);
+  });
+});
diff --git a/e2e/specs/mock/deployment-skills.spec.ts b/e2e/specs/mock/deployment-skills.spec.ts
new file mode 100644
index 00000000000..c5c98e29268
--- /dev/null
+++ b/e2e/specs/mock/deployment-skills.spec.ts
@@ -0,0 +1,218 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { NEW_CHAT_PATH } from './helpers';
+
+const DEPLOYMENT_SKILL_NAME = 'e2e-deployment-skill';
+const DEPLOYMENT_SKILL_DESCRIPTION =
+  'Use this deployment skill to verify shared skills load during Playwright startup.';
+
+type RefreshTokenBody = {
+  token?: string;
+};
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+  source?: string;
+  sourceMetadata?: Record<string, unknown>;
+  fileCount?: number;
+  alwaysApply?: boolean;
+  isPublic?: boolean;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+  frontmatter?: Record<string, unknown>;
+};
+
+type SkillFile = {
+  _id: string;
+  skillId: string;
+  relativePath: string;
+  file_id: string;
+  filename: string;
+  filepath: string;
+  source: string;
+  mimeType: string;
+  bytes: number;
+  category: string;
+  isExecutable: boolean;
+  author: string;
+  createdAt: string;
+  updatedAt: string;
+  content?: string;
+};
+
+type SkillFileContent = Pick<
+  SkillFile,
+  'relativePath' | 'filename' | 'mimeType' | 'bytes' | 'content'
+> & {
+  isBinary?: boolean;
+};
+
+type ApiResult<T> = {
+  ok: boolean;
+  status: number;
+  text: string;
+  json: T | null;
+};
+
+async function getAccessToken(page: Page): Promise<string> {
+  const result = await page.evaluate(async () => {
+    const response = await fetch('/api/auth/refresh', {
+      method: 'POST',
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    const text = await response.text();
+    let json: unknown = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, text, json };
+  });
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected /api/auth/refresh to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+
+  const body = result.json as RefreshTokenBody | null;
+  if (!body?.token) {
+    throw new Error(`Expected /api/auth/refresh to return a token, got: ${result.text}`);
+  }
+
+  return body.token;
+}
+
+async function apiJson<T>(
+  page: Page,
+  path: string,
+  token: string,
+  init: { method?: string; body?: unknown } = {},
+): Promise<ApiResult<T>> {
+  return page.evaluate(
+    async ({ accessToken, body, method, urlPath }) => {
+      const headers: Record<string, string> = { Authorization: `Bearer ${accessToken}` };
+      if (body !== undefined) {
+        headers['Content-Type'] = 'application/json';
+      }
+      const response = await fetch(urlPath, {
+        method,
+        credentials: 'include',
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+      });
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    {
+      accessToken: token,
+      body: init.body,
+      method: init.method,
+      urlPath: path,
+    },
+  ) as Promise<ApiResult<T>>;
+}
+
+async function fetchJson<T>(page: Page, path: string, token: string): Promise<T> {
+  const result = await apiJson<T>(page, path, token);
+  if (!result.ok) {
+    throw new Error(`Expected ${path} to return 2xx, got ${result.status}: ${result.text}`);
+  }
+  return result.json as T;
+}
+
+test.describe('deployment skills', () => {
+  test('loads configured deployment skills for every authenticated user as read-only', async ({
+    page,
+  }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+
+    const list = await fetchJson<{ skills?: SkillSummary[] }>(
+      page,
+      `/api/skills?search=${encodeURIComponent(DEPLOYMENT_SKILL_NAME)}&limit=10`,
+      token,
+    );
+    const skill = list.skills?.find((item) => item.name === DEPLOYMENT_SKILL_NAME);
+    expect(skill).toMatchObject({
+      name: DEPLOYMENT_SKILL_NAME,
+      description: DEPLOYMENT_SKILL_DESCRIPTION,
+      source: 'deployment',
+      sourceMetadata: { deployment: true },
+      fileCount: 1,
+      alwaysApply: true,
+      isPublic: true,
+    });
+
+    const detail = await fetchJson<SkillDetail>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}`,
+      token,
+    );
+    expect(detail.body).toContain('E2E deployment skill loaded through Playwright');
+    expect(detail.frontmatter).toMatchObject({
+      name: DEPLOYMENT_SKILL_NAME,
+      description: DEPLOYMENT_SKILL_DESCRIPTION,
+      'always-apply': true,
+    });
+
+    const files = await fetchJson<{ files?: SkillFile[] }>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}/files`,
+      token,
+    );
+    expect(files.files).toHaveLength(1);
+    expect(files.files?.[0]).toMatchObject({
+      skillId: skill!._id,
+      relativePath: 'guide.txt',
+      filename: 'guide.txt',
+      source: 'deployment',
+      mimeType: 'text/plain',
+      bytes: 'deployment skill file fixture\n'.length,
+      category: 'other',
+      isExecutable: false,
+    });
+    expect(files.files?.[0]).not.toHaveProperty('content');
+
+    const downloaded = await fetchJson<SkillFileContent>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}/files/guide.txt`,
+      token,
+    );
+    expect(downloaded).toMatchObject({
+      relativePath: 'guide.txt',
+      filename: 'guide.txt',
+      mimeType: 'text/plain',
+      bytes: 'deployment skill file fixture\n'.length,
+      isBinary: false,
+      content: 'deployment skill file fixture\n',
+    });
+
+    const patch = await apiJson<{ message?: string }>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}`,
+      token,
+      {
+        method: 'PATCH',
+        body: {
+          description: 'Deployment skills should stay read-only.',
+        },
+      },
+    );
+    expect(patch.status).toBe(403);
+    expect(patch.json).toMatchObject({ message: 'Deployment skills are read-only' });
+  });
+});
diff --git a/e2e/specs/mock/enforced-model-specs.spec.ts b/e2e/specs/mock/enforced-model-specs.spec.ts
new file mode 100644
index 00000000000..d8f9ad1abbe
--- /dev/null
+++ b/e2e/specs/mock/enforced-model-specs.spec.ts
@@ -0,0 +1,170 @@
+import { randomUUID } from 'crypto';
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  getAccessToken,
+  messagesView,
+  replyPrompt,
+  replyText,
+  requestJson,
+  selectModelSpec,
+  sendMessage,
+} from './helpers';
+
+const NO_PARENT = '00000000-0000-0000-0000-000000000000';
+const ENFORCED_SPEC_NAME = 'e2e-mock-provider-a';
+const ENFORCED_SPEC_LABEL = 'Mock Provider A';
+
+type AgentStartResponse = {
+  conversationId: string;
+  streamId: string;
+  status: string;
+};
+
+async function createProject(page: Page, name: string): Promise<string> {
+  await page.goto('/projects', { timeout: 10000 });
+  await page.getByRole('button', { name: 'New project' }).first().click();
+
+  const dialog = page.getByRole('dialog');
+  await dialog.getByRole('textbox', { name: 'Project name' }).fill(name);
+  await dialog.getByRole('button', { name: 'Create project' }).click();
+
+  await expect(page.getByRole('heading', { name })).toBeVisible();
+  const projectId = new URL(page.url()).pathname.split('/projects/')[1];
+  expect(projectId).toBeTruthy();
+  return projectId;
+}
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function waitForStreamReply(page: Page, token: string, streamId: string, expected: string) {
+  await page.evaluate(
+    async ({ accessToken, expectedText, currentStreamId }) => {
+      const controller = new AbortController();
+      const timeout = window.setTimeout(() => controller.abort(), 60000);
+      let buffered = '';
+
+      try {
+        const response = await fetch(
+          `/api/agents/chat/stream/${encodeURIComponent(currentStreamId)}?resume=true`,
+          {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Authorization: `Bearer ${accessToken}` },
+            signal: controller.signal,
+          },
+        );
+
+        if (!response.ok || !response.body) {
+          throw new Error(`Expected stream to return 2xx, got ${response.status}`);
+        }
+
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+
+          buffered += decoder.decode(value, { stream: true });
+          if (buffered.includes(expectedText)) {
+            await reader.cancel();
+            return;
+          }
+
+          if (buffered.includes('event: error')) {
+            await reader.cancel();
+            throw new Error(`Stream emitted an error before ${expectedText}:\n${buffered}`);
+          }
+        }
+      } finally {
+        window.clearTimeout(timeout);
+      }
+
+      throw new Error(`Timed out waiting for ${expectedText}. Latest stream:\n${buffered}`);
+    },
+    { accessToken: token, currentStreamId: streamId, expectedText: expected },
+  );
+}
+
+test.describe('enforced model specs', () => {
+  test.skip(
+    process.env.E2E_MODEL_SPECS_ENFORCE !== 'true',
+    'requires E2E_MODEL_SPECS_ENFORCE=true',
+  );
+
+  test('rebuilds a valid enforced spec from the backend preset when the request is stale', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const label = uniqueName('reported-spec').replace(/\s+/g, '-');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+    const userMessageId = randomUUID();
+    const start = await requestJson<AgentStartResponse>(page, {
+      path: `/api/agents/chat/${encodeURIComponent(MOCK_ENDPOINTS[0].label)}`,
+      token,
+      method: 'POST',
+      body: {
+        text: replyPrompt(label),
+        sender: 'User',
+        clientTimestamp: new Date().toLocaleString('sv').replace(' ', 'T'),
+        isCreatedByUser: true,
+        parentMessageId: NO_PARENT,
+        conversationId: 'new',
+        messageId: userMessageId,
+        responseMessageId: `${userMessageId}_`,
+        endpoint: MOCK_ENDPOINTS[0].label,
+        endpointType: 'custom',
+        model: { stale: 'cached-client-value' },
+        agent_id: 'agent_from_cached_client_state',
+        spec: ENFORCED_SPEC_NAME,
+        isTemporary: false,
+        isRegenerate: false,
+        error: false,
+      },
+    });
+
+    expect(start.status).toBe('started');
+    expect(start.conversationId).toBeTruthy();
+
+    await waitForStreamReply(page, token, start.streamId, replyText(label));
+  });
+
+  test('keeps a project-scoped chat attached when sending with an enforced spec', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const name = uniqueName('E2E Enforced Project');
+    const projectId = await createProject(page, name);
+    const label = uniqueName('project-spec').replace(/\s+/g, '-');
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toHaveAttribute(
+      'placeholder',
+      new RegExp(name),
+    );
+
+    await selectModelSpec(page, ENFORCED_SPEC_LABEL);
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    const response = await sendMessage(page, replyPrompt(label));
+    expect(response.ok()).toBeTruthy();
+    await expect(messagesView(page).getByText(replyText(label))).toBeVisible({ timeout: 30000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    const projectRow = page.getByRole('button', { name }).first();
+    if ((await projectRow.getAttribute('aria-expanded')) !== 'true') {
+      await projectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/helpers.ts b/e2e/specs/mock/helpers.ts
new file mode 100644
index 00000000000..d24a021c0ac
--- /dev/null
+++ b/e2e/specs/mock/helpers.ts
@@ -0,0 +1,180 @@
+import { expect } from '@playwright/test';
+import type { Page, Response } from '@playwright/test';
+
+/** Substring of the reply emitted by the mock LLM server. */
+export const MOCK_REPLY_TEXT = 'E2E mock reply';
+
+/** Custom endpoints defined in e2e/config/librechat.e2e.yaml. */
+export const MOCK_ENDPOINTS = [
+  { label: 'Mock Provider A', model: 'mock-model-a' },
+  { label: 'Mock Provider B', model: 'mock-model-b' },
+] as const;
+
+export type MockEndpoint = { label: string; model: string };
+
+export const NEW_CHAT_PATH = '/c/new';
+
+type RefreshTokenBody = {
+  token?: string;
+};
+
+export function isAgentsStream(response: Response) {
+  return isAgentGenerationStart(response);
+}
+
+export function isAgentGenerationStart(response: Response) {
+  const { pathname } = new URL(response.url());
+  const isAgentsChat = pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+  return (
+    response.request().method() === 'POST' &&
+    isAgentsChat &&
+    !pathname.endsWith('/abort') &&
+    response.status() === 200
+  );
+}
+
+const modelSelectorTrigger = (page: Page) =>
+  page.getByRole('button', { name: 'Select a model' }).first();
+
+export const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/** Open the model selector, choose an endpoint, then its model (committed on the model click). */
+export async function selectMockEndpoint(page: Page, endpoint: MockEndpoint) {
+  const trigger = modelSelectorTrigger(page);
+  await trigger.click();
+  await page.getByRole('option', { name: endpoint.label }).click();
+  const modelOption = page.getByRole('option', { name: endpoint.model, exact: true });
+  if (await modelOption.isVisible({ timeout: 1000 }).catch(() => false)) {
+    await modelOption.click();
+  }
+  await expect(trigger).not.toHaveText('Select a model');
+}
+
+/** Open the model selector and choose a configured model spec by label. */
+export async function selectModelSpec(page: Page, label: string) {
+  const trigger = modelSelectorTrigger(page);
+  await expect(trigger).toBeVisible();
+  if ((await trigger.textContent())?.includes(label)) {
+    return;
+  }
+  await trigger.click();
+  await page.getByRole('option', { name: new RegExp(`(^|\\s)${escapeRegExp(label)}\\b`) }).click();
+  await expect(trigger).toContainText(label);
+}
+
+/** Enable the ephemeral Skills capability from the composer tool menu. */
+export async function enableSkills(page: Page) {
+  await page.getByRole('button', { name: 'Tools Options' }).click();
+  await page.getByTestId('tools-menu-skills').click();
+  await page.keyboard.press('Escape');
+  await expect(page.getByRole('button', { name: 'Skills' })).toBeVisible();
+}
+
+/** The conversation messages container. */
+export const messagesView = (page: Page) => page.getByTestId('messages-view');
+
+/** Build the mock-model reply trigger and its expected rendered text for a label. */
+export const replyPrompt = (label: string) => `E2E_REPLY:${label}`;
+export const replyText = (label: string) => `E2E reply ${label}`;
+
+/** The mock reply as rendered in the conversation, scoped to the messages view. */
+export function mockReply(page: Page) {
+  return messagesView(page).getByText(new RegExp(MOCK_REPLY_TEXT, 'i'));
+}
+
+/** Type a message, send it, and wait for the streamed `/api/agents` response. */
+export async function sendMessage(page: Page, text: string): Promise<Response> {
+  const input = page.getByRole('textbox', { name: 'Message input' });
+  await input.click();
+  await input.fill(text);
+  const [response] = await Promise.all([
+    page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+    input.press('Enter'),
+  ]);
+  return response;
+}
+
+export async function getAccessToken(page: Page): Promise<string> {
+  const result = await page.evaluate(async () => {
+    const response = await fetch('/api/auth/refresh', {
+      method: 'POST',
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    const text = await response.text();
+    let json: unknown = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, text, json };
+  });
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected /api/auth/refresh to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+
+  const body = result.json as RefreshTokenBody | null;
+  if (!body?.token) {
+    throw new Error(`Expected /api/auth/refresh to return a token, got: ${result.text}`);
+  }
+
+  return body.token;
+}
+
+export async function requestJson<T>(
+  page: Page,
+  params: {
+    path: string;
+    token: string;
+    method?: string;
+    body?: unknown;
+  },
+): Promise<T> {
+  const result = await page.evaluate(
+    async ({ accessToken, body, method, urlPath }) => {
+      const headers: Record<string, string> = {
+        Authorization: `Bearer ${accessToken}`,
+      };
+      const init: RequestInit = {
+        method,
+        credentials: 'include',
+        headers,
+      };
+      if (body !== undefined) {
+        headers['Content-Type'] = 'application/json';
+        init.body = JSON.stringify(body);
+      }
+      const response = await fetch(urlPath, init);
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    {
+      accessToken: params.token,
+      body: params.body,
+      method: params.method ?? 'GET',
+      urlPath: params.path,
+    },
+  );
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected ${params.method ?? 'GET'} ${params.path} to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+  return result.json as T;
+}
+
+export async function fetchJson<T>(page: Page, path: string, token: string): Promise<T> {
+  return requestJson<T>(page, { path, token });
+}
diff --git a/e2e/specs/mock/isolation.spec.ts b/e2e/specs/mock/isolation.spec.ts
new file mode 100644
index 00000000000..a9805813b41
--- /dev/null
+++ b/e2e/specs/mock/isolation.spec.ts
@@ -0,0 +1,97 @@
+import { expect, test } from '@playwright/test';
+import type { Browser, Page } from '@playwright/test';
+import type { User } from '../../types';
+import { MOCK_ENDPOINTS, NEW_CHAT_PATH, selectMockEndpoint, sendMessage } from './helpers';
+import { getSecondaryE2EUser } from '../../setup/users.mock';
+import cleanupUser from '../../setup/cleanupUser';
+
+const A_PRIVATE_MARKER = 'A-private-conversation-marker';
+
+async function register(page: Page, user: User) {
+  await page.getByRole('link', { name: 'Sign up' }).click();
+  await page.getByLabel('Full name').fill(user.name);
+  await page.getByLabel('Email').fill(user.email);
+  await page.getByTestId('password').fill(user.password);
+  await page.getByTestId('confirm_password').fill(user.password);
+  await page.getByLabel('Submit registration').click();
+}
+
+async function registrationErrorIsVisible(page: Page) {
+  return page
+    .getByTestId('registration-error')
+    .isVisible({ timeout: 500 })
+    .catch(() => false);
+}
+
+async function registerSecondaryUser(page: Page, user: User) {
+  await page.goto('/', { timeout: 10000 });
+  await page.waitForURL(/\/login/, { timeout: 10000 });
+  await register(page, user);
+
+  try {
+    await page.waitForURL(/\/c\/new/, { timeout: 10000 });
+  } catch (error) {
+    if (!(await registrationErrorIsVisible(page))) {
+      throw error;
+    }
+
+    await cleanupUser(user);
+    await page.goto('/', { timeout: 10000 });
+    await page.waitForURL(/\/login/, { timeout: 10000 });
+    await register(page, user);
+    await page.waitForURL(/\/c\/new/, { timeout: 10000 });
+  }
+}
+
+/** Register the secondary user in a throwaway context, then log in within `page`. */
+async function ensureSecondaryUser(browser: Browser, page: Page, user: User, baseURL: string) {
+  const setupContext = await browser.newContext({ storageState: undefined, baseURL });
+  const setupPage = await setupContext.newPage();
+  try {
+    await registerSecondaryUser(setupPage, user);
+  } finally {
+    await setupContext.close();
+  }
+
+  await page.goto('/login', { timeout: 10000 });
+  await page.getByLabel('Email').fill(user.email);
+  await page.getByLabel('Password').fill(user.password);
+  await page.getByTestId('login-button').click();
+  await page.waitForURL(/\/c\/new/, { timeout: 10000 });
+}
+
+test.describe('user isolation', () => {
+  test('user B cannot see user A conversations', async ({ page, browser, baseURL }) => {
+    test.setTimeout(90000);
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for mock isolation tests');
+    }
+
+    // User A (authenticated via storageState) creates a private conversation.
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+    await sendMessage(page, A_PRIVATE_MARKER);
+    await expect(page.getByText(A_PRIVATE_MARKER)).toBeVisible();
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    const conversationAUrl = page.url();
+
+    // User B in a fresh, unauthenticated context.
+    const contextB = await browser.newContext({ storageState: undefined, baseURL });
+    const pageB = await contextB.newPage();
+    try {
+      await ensureSecondaryUser(browser, pageB, getSecondaryE2EUser(), baseURL);
+
+      // (a) Sidebar list does not expose A's conversation.
+      await pageB.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await expect(pageB.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+      await expect(pageB.getByText(A_PRIVATE_MARKER)).toHaveCount(0);
+
+      // (b) Direct navigation to A's conversation does not reveal its content.
+      await pageB.goto(conversationAUrl, { timeout: 10000 });
+      await expect(pageB.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+      await expect(pageB.getByText(A_PRIVATE_MARKER)).toHaveCount(0);
+    } finally {
+      await contextB.close();
+    }
+  });
+});
diff --git a/e2e/specs/mock/mcp-allowlist-override.spec.ts b/e2e/specs/mock/mcp-allowlist-override.spec.ts
new file mode 100644
index 00000000000..281c1aebd0c
--- /dev/null
+++ b/e2e/specs/mock/mcp-allowlist-override.spec.ts
@@ -0,0 +1,77 @@
+import { expect, test } from '@playwright/test';
+import type { APIRequestContext } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
+
+/**
+ * Proves the #13809 fix end to end: an admin-panel `mcpSettings.allowedDomains`
+ * override is honored by MCP inspection/connection without a restart.
+ *
+ * `e2e-http` (a URL-based MCP fixture) boots `inspectionFailed` because its origin
+ * is absent from the YAML allowlist. Adding that origin via an admin config override
+ * must let the server reinitialize. Before the fix, reinspection used the frozen
+ * YAML allowlist and the server stayed unreachable.
+ *
+ * Pure-API e2e against the real backend + DB: the JWT comes from the Authorization
+ * header (`ExtractJwt.fromAuthHeaderAsBearerToken`), so we log in for a token rather
+ * than relying on the browser storage state.
+ */
+
+const SERVER_NAME = 'e2e-http';
+/** Must match the `e2e-http` URL origin in e2e/config/librechat.e2e.yaml. */
+const FIXTURE_ORIGIN = `http://127.0.0.1:${process.env.E2E_MCP_HTTP_PORT || '8765'}`;
+
+async function reinitialize(
+  request: APIRequestContext,
+  headers: Record<string, string>,
+): Promise<{ status: number; success: boolean }> {
+  const res = await request.post(`/api/mcp/${SERVER_NAME}/reinitialize`, { headers });
+  if (!res.ok()) {
+    return { status: res.status(), success: false };
+  }
+  const body = (await res.json()) as { success?: boolean };
+  return { status: res.status(), success: body.success === true };
+}
+
+test.describe('MCP admin-panel allowlist override', () => {
+  test('honors an admin mcpSettings.allowedDomains override so a blocked server reinitializes', async ({
+    request,
+  }) => {
+    test.setTimeout(120000);
+
+    // The seeded primary user is the first-registered user → ADMIN, so it can write
+    // config overrides. Log in for a Bearer token + the user id.
+    const { email, password } = getPrimaryE2EUser();
+    const loginRes = await request.post('/api/auth/login', { data: { email, password } });
+    expect(loginRes.ok()).toBeTruthy();
+    const { token, user } = (await loginRes.json()) as {
+      token: string;
+      user: { id?: string; _id?: string };
+    };
+    const userId = user.id ?? user._id;
+    expect(token).toBeTruthy();
+    expect(userId).toBeTruthy();
+
+    const headers = { Authorization: `Bearer ${token}` };
+
+    // Baseline: the fixture's origin is not in the YAML allowlist, so reinit fails.
+    const before = await reinitialize(request, headers);
+    expect(before.status).toBe(200);
+    expect(before.success).toBe(false);
+
+    // Admin-panel override: allow the fixture's origin for this user.
+    const put = await request.put(`/api/admin/config/user/${userId}`, {
+      headers,
+      data: { overrides: { mcpSettings: { allowedDomains: [FIXTURE_ORIGIN] } } },
+    });
+    expect(put.ok()).toBeTruthy();
+
+    // The override is honored on reinit: the server now connects. invalidateConfigCaches
+    // runs asynchronously after the PUT, so poll until the merged allowlist lands.
+    await expect
+      .poll(async () => (await reinitialize(request, headers)).success, {
+        timeout: 30000,
+        intervals: [1000, 2000, 3000],
+      })
+      .toBe(true);
+  });
+});
diff --git a/e2e/specs/mock/mcp-ephemeral.spec.ts b/e2e/specs/mock/mcp-ephemeral.spec.ts
new file mode 100644
index 00000000000..93104f4a43e
--- /dev/null
+++ b/e2e/specs/mock/mcp-ephemeral.spec.ts
@@ -0,0 +1,84 @@
+import { expect, test } from '@playwright/test';
+import type { Page, Response } from '@playwright/test';
+import {
+  NEW_CHAT_PATH,
+  isAgentsStream,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+/** Non-spec endpoints from e2e/config/librechat.e2e.yaml — switching between
+ *  them exercises the no-spec `applyModelSpecEffects` path that previously
+ *  wiped the ephemeral agent (MCP selection) for the active conversation. */
+const PROVIDER_C = { label: 'Mock Provider C', model: 'mock-model-c' };
+const PROVIDER_D = { label: 'Mock Provider D', model: 'mock-model-d' };
+
+const MCP_SERVER_NAME = 'e2e-memory';
+const MCP_SERVER_TITLE = 'E2E Memory';
+
+const uniqueText = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+const mcpBadge = (page: Page) => page.getByRole('button', { name: new RegExp(MCP_SERVER_TITLE) });
+
+/** Select the MCP server from the composer's ephemeral MCP dropdown. */
+async function selectEphemeralMCP(page: Page) {
+  await page.getByRole('button', { name: 'MCP Servers', exact: true }).click();
+  const serverItem = page.getByRole('menuitemcheckbox', { name: new RegExp(MCP_SERVER_TITLE) });
+  await expect(serverItem).toBeVisible();
+  await serverItem.click();
+  await expect(serverItem).toHaveAttribute('aria-checked', 'true');
+  await page.keyboard.press('Escape');
+  await expect(mcpBadge(page)).toBeVisible();
+}
+
+/** The `ephemeralAgent.mcp` array sent with a chat request. */
+function requestMCP(response: Response): string[] | undefined {
+  const body = response.request().postDataJSON() as { ephemeralAgent?: { mcp?: string[] } };
+  return body.ephemeralAgent?.mcp;
+}
+
+test.describe('ephemeral MCP selection persistence', () => {
+  test('keeps the MCP selection when switching models on a new chat', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectMockEndpoint(page, PROVIDER_C);
+    await selectEphemeralMCP(page);
+
+    await selectMockEndpoint(page, PROVIDER_D);
+    await expect(mcpBadge(page)).toBeVisible();
+
+    const response = await sendMessage(page, uniqueText('mcp new chat switch'));
+    expect(response.ok()).toBeTruthy();
+    expect(requestMCP(response)).toContain(MCP_SERVER_NAME);
+
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  });
+
+  test('keeps the MCP selection when regenerating after a model switch', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectMockEndpoint(page, PROVIDER_C);
+    await selectEphemeralMCP(page);
+
+    const first = await sendMessage(page, uniqueText('mcp regenerate switch'));
+    expect(first.ok()).toBeTruthy();
+    expect(requestMCP(first)).toContain(MCP_SERVER_NAME);
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    await selectMockEndpoint(page, PROVIDER_D);
+    await expect(mcpBadge(page)).toBeVisible();
+
+    const [regenerated] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByRole('button', { name: 'Regenerate', exact: true }).click(),
+    ]);
+    expect(regenerated.ok()).toBeTruthy();
+    expect(requestMCP(regenerated)).toContain(MCP_SERVER_NAME);
+
+    await expect(mockReply(page).first()).toBeVisible({ timeout: 20000 });
+  });
+});
diff --git a/e2e/specs/mock/mcp.spec.ts b/e2e/specs/mock/mcp.spec.ts
new file mode 100644
index 00000000000..0a2b4fd466f
--- /dev/null
+++ b/e2e/specs/mock/mcp.spec.ts
@@ -0,0 +1,150 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import type { AgentDetail } from './agents.helpers';
+import {
+  cleanupAgent,
+  openAgentBuilder,
+  selectMockModel,
+  uniqueAgentName,
+  waitForPersistedAgent,
+} from './agents.helpers';
+import { MOCK_ENDPOINTS, fetchJson, getAccessToken, mockReply, sendMessage } from './helpers';
+
+const MCP_SERVER_NAME = 'e2e-memory';
+const MCP_SERVER_TITLE = 'E2E Memory';
+const MCP_TOOL_NAME = 'remember_fact';
+const MCP_SERVER_TOOL_ID = `sys__server__sys_mcp_${MCP_SERVER_NAME}`;
+const MCP_TOOL_ID = `${MCP_TOOL_NAME}_mcp_${MCP_SERVER_NAME}`;
+const DESCRIPTION = 'Use this agent to verify LibreChat MCP tool selection in mock e2e tests.';
+const INSTRUCTIONS =
+  'Keep the selected MCP server tools available while replying through the mock e2e model.';
+
+type MCPToolsResponse = {
+  servers?: Record<
+    string,
+    {
+      tools?: Array<{
+        name: string;
+        pluginKey: string;
+        description?: string;
+      }>;
+    }
+  >;
+};
+
+async function waitForMCPTools(page: Page) {
+  const token = await getAccessToken(page);
+  let latestTools: MCPToolsResponse | null = null;
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    latestTools = await fetchJson<MCPToolsResponse>(page, '/api/mcp/tools', token);
+    const serverTools = latestTools.servers?.[MCP_SERVER_NAME]?.tools ?? [];
+    if (serverTools.some((tool) => tool.pluginKey === MCP_TOOL_ID)) {
+      return serverTools;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(
+    latestTools?.servers?.[MCP_SERVER_NAME]?.tools,
+    `Expected ${MCP_SERVER_NAME} to expose ${MCP_TOOL_ID}`,
+  ).toEqual(expect.arrayContaining([expect.objectContaining({ pluginKey: MCP_TOOL_ID })]));
+  return latestTools!.servers![MCP_SERVER_NAME].tools!;
+}
+
+async function addMCPServerTools(page: Page, form: Locator) {
+  await expect(form.getByText('MCP Servers', { exact: true })).toBeVisible();
+  await form.getByRole('button', { name: 'Add MCP Server Tools' }).click();
+
+  const dialogTitle = page.getByText('MCP Server Tools', { exact: true });
+  await expect(dialogTitle).toBeVisible();
+  await expect(page.getByText(MCP_SERVER_TITLE, { exact: true })).toBeVisible();
+
+  await page.getByRole('button', { name: `Add ${MCP_SERVER_TITLE}` }).click();
+  await expect(page.getByRole('button', { name: `Remove ${MCP_SERVER_TITLE}` })).toBeVisible({
+    timeout: 30000,
+  });
+
+  await page.getByRole('button', { name: 'Close dialog' }).click();
+  await expect(dialogTitle).toBeHidden();
+
+  await expect(form.getByText(MCP_SERVER_NAME, { exact: true })).toBeVisible();
+  await form.getByText(MCP_SERVER_NAME, { exact: true }).click();
+  await expect(form.getByLabel(MCP_TOOL_NAME)).toBeVisible();
+}
+
+async function expectSelectedMCPServerTools(form: Locator) {
+  await expect(form.getByText(MCP_SERVER_NAME, { exact: true })).toBeVisible();
+  await form.getByText(MCP_SERVER_NAME, { exact: true }).click();
+  await expect(form.getByLabel(MCP_TOOL_NAME)).toBeVisible();
+}
+
+test.describe('agent builder MCP tools', () => {
+  test('creates an agent with MCP server tools and persists the selection', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const agentName = uniqueAgentName('E2E MCP Agent');
+    let createdAgentId: string | undefined;
+
+    try {
+      const form = await openAgentBuilder(page);
+      await waitForMCPTools(page);
+
+      await form.getByLabel('Agent name').fill(agentName);
+      await form.getByLabel('Agent description').fill(DESCRIPTION);
+      await form.getByLabel('Agent instructions').fill(INSTRUCTIONS);
+      await selectMockModel(page, true);
+
+      await addMCPServerTools(page, form);
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/agents' &&
+            response.status() === 201,
+          { timeout: 30000 },
+        ),
+        form.getByRole('button', { name: 'Create' }).click(),
+      ]);
+      const createdAgent = (await createResponse.json()) as AgentDetail;
+      createdAgentId = createdAgent.id;
+
+      await expect(
+        page.getByText(`Successfully created ${agentName}`, { exact: true }),
+      ).toBeVisible();
+
+      const persistedAgent = await waitForPersistedAgent(page, agentName, DESCRIPTION);
+      expect(persistedAgent).toMatchObject({
+        id: createdAgentId,
+        name: agentName,
+        description: DESCRIPTION,
+        instructions: INSTRUCTIONS,
+        provider: MOCK_ENDPOINTS[0].label,
+        model: MOCK_ENDPOINTS[0].model,
+        category: 'general',
+      });
+      expect(persistedAgent.tools).toEqual(
+        expect.arrayContaining([MCP_SERVER_TOOL_ID, MCP_TOOL_ID]),
+      );
+      expect(persistedAgent.mcpServerNames).toEqual(expect.arrayContaining([MCP_SERVER_NAME]));
+
+      const reopenedForm = await openAgentBuilder(page);
+      await reopenedForm.getByRole('combobox', { name: 'Agent', exact: true }).click();
+      await page.getByRole('option', { name: agentName }).click();
+
+      await expect(reopenedForm.getByLabel('Agent name')).toHaveValue(agentName);
+      await expect(reopenedForm.getByLabel('Agent description')).toHaveValue(DESCRIPTION);
+      await expect(reopenedForm.getByLabel('Agent instructions')).toHaveValue(INSTRUCTIONS);
+      await expectSelectedMCPServerTools(reopenedForm);
+
+      await reopenedForm.getByRole('button', { name: 'Select Agent' }).click();
+
+      const response = await sendMessage(page, `hello from ${agentName}`);
+      expect(response.ok()).toBeTruthy();
+      await expect(mockReply(page)).toBeVisible({ timeout: 30000 });
+    } finally {
+      await cleanupAgent(page, createdAgentId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/message-tree.spec.ts b/e2e/specs/mock/message-tree.spec.ts
new file mode 100644
index 00000000000..f66c41dafae
--- /dev/null
+++ b/e2e/specs/mock/message-tree.spec.ts
@@ -0,0 +1,1248 @@
+import { expect, test } from '@playwright/test';
+import type { Page, Response, Route } from '@playwright/test';
+import {
+  isAgentGenerationStart,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  fetchJson,
+  getAccessToken,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const NO_PARENT = '00000000-0000-0000-0000-000000000000';
+
+type TextContentPart = {
+  type?: string;
+  text?: string | { value?: string };
+  error?: string;
+};
+
+type E2EMessage = {
+  messageId: string;
+  parentMessageId?: string | null;
+  conversationId?: string | null;
+  text?: string;
+  content?: TextContentPart[];
+  isCreatedByUser?: boolean;
+  error?: boolean;
+  unfinished?: boolean;
+};
+
+type ForkResponse = {
+  conversation: {
+    conversationId?: string;
+  };
+  messages: E2EMessage[];
+};
+
+type JsonResponse = {
+  ok: boolean;
+  status: number;
+  text: string;
+  json: unknown;
+};
+
+const uniqueLabel = (name: string) => `${name}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+
+const replyPrompt = (label: string) => `E2E_REPLY:${label}`;
+const replyText = (label: string) => `E2E reply ${label}`;
+const countedPrompt = (label: string) => `E2E_COUNTED_REPLY:${label}`;
+const countedReplyText = (label: string, count: number) => `E2E counted reply ${label} #${count}`;
+const slowPrompt = (label: string) => `E2E_SLOW_REPLY:${label}`;
+const slowReplyPrefix = (label: string) => `E2E slow reply ${label}`;
+const slowCountedPrompt = (label: string) => `E2E_SLOW_COUNTED_REPLY:${label}`;
+const slowCountedReplyText = (label: string, count: number) =>
+  `E2E slow counted reply ${label} #${count}`;
+
+const messagesView = (page: Page) => page.getByTestId('messages-view');
+const messageRender = (page: Page, text: string) =>
+  page.locator('.message-render').filter({ hasText: text }).last();
+const conversationPath = (conversationId: string) => `/c/${encodeURIComponent(conversationId)}`;
+
+function contentText(part: TextContentPart): string {
+  if (typeof part.text === 'string') {
+    return part.text;
+  }
+  if (part.text?.value) {
+    return part.text.value;
+  }
+  return part.error ?? '';
+}
+
+function messageText(message: E2EMessage): string {
+  if (message.text) {
+    return message.text;
+  }
+  return message.content?.map(contentText).filter(Boolean).join('\n') ?? '';
+}
+
+function sseMessage(payload: unknown): string {
+  return `event: message\ndata: ${JSON.stringify(payload)}\n\n`;
+}
+
+function findMessage(messages: E2EMessage[], text: string, isCreatedByUser?: boolean): E2EMessage {
+  const message = messages.find((candidate) => {
+    const roleMatches =
+      isCreatedByUser === undefined || candidate.isCreatedByUser === isCreatedByUser;
+    return roleMatches && messageText(candidate).includes(text);
+  });
+  if (!message) {
+    throw new Error(
+      `Expected message containing "${text}". Saw:\n${messages.map(messageText).join('\n---\n')}`,
+    );
+  }
+  return message;
+}
+
+function expectParent(
+  messages: E2EMessage[],
+  childText: string,
+  parentText: string,
+  childIsUser?: boolean,
+) {
+  const child = findMessage(messages, childText, childIsUser);
+  const parent = findMessage(messages, parentText);
+  expect(child.parentMessageId, `${childText} should be a child of ${parentText}`).toBe(
+    parent.messageId,
+  );
+}
+
+function expectNoFoldedMessages(messages: E2EMessage[]) {
+  const ids = new Set(messages.map((message) => message.messageId));
+  const folded = messages.filter((message) => {
+    const parentId = message.parentMessageId;
+    return parentId != null && parentId !== '' && parentId !== NO_PARENT && !ids.has(parentId);
+  });
+  expect(
+    folded.map((message) => ({
+      text: messageText(message),
+      messageId: message.messageId,
+      parentMessageId: message.parentMessageId,
+    })),
+    'messages must not render as parent-less folded children',
+  ).toEqual([]);
+
+  const roots = messages.filter((message) => {
+    const parentId = message.parentMessageId;
+    return parentId == null || parentId === '' || parentId === NO_PARENT;
+  });
+  expect(
+    roots.map((message) => ({
+      text: messageText(message),
+      isCreatedByUser: message.isCreatedByUser,
+    })),
+    'only user messages should be roots',
+  ).toEqual(roots.map(() => expect.objectContaining({ isCreatedByUser: true })));
+}
+
+async function expectVisibleMessages(page: Page, texts: string[]) {
+  for (const text of texts) {
+    await expect(messagesView(page).getByText(text)).toBeVisible({ timeout: 30000 });
+  }
+}
+
+async function reloadAndExpectMessages(page: Page, texts: string[]) {
+  await page.reload({ timeout: 10000 });
+  await expectVisibleMessages(page, texts);
+}
+
+async function revisitConversationAndExpectMessages(
+  page: Page,
+  conversationId: string,
+  texts: string[],
+) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await page.goto(conversationPath(conversationId), { timeout: 10000 });
+  await expectVisibleMessages(page, texts);
+}
+
+async function mockActiveOAuthResumeStream({
+  page,
+  authUrl,
+  conversationId,
+  parentMessageId,
+  pendingPrompt,
+  pendingUserMessageId,
+  postAuthRunId,
+  postAuthText,
+}: {
+  page: Page;
+  authUrl: string;
+  conversationId: string;
+  parentMessageId: string;
+  pendingPrompt: string;
+  pendingUserMessageId: string;
+  postAuthRunId?: string;
+  postAuthText?: string;
+}) {
+  const pendingResponseMessageId = `${pendingUserMessageId}_`;
+  const toolCallId = `${pendingUserMessageId}:Google-Workspace`;
+  const stepId = 'step_oauth_login_Google-Workspace';
+  const messageStepId = 'step_post_auth_message';
+  const resumeState = {
+    runSteps: [],
+    aggregatedContent: [],
+    responseMessageId: pendingResponseMessageId,
+    conversationId,
+    userMessage: {
+      messageId: pendingUserMessageId,
+      parentMessageId,
+      conversationId,
+      text: pendingPrompt,
+    },
+    replayEvents: [
+      {
+        event: 'on_run_step',
+        data: {
+          runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          id: stepId,
+          type: 'tool_calls',
+          index: 0,
+          stepDetails: {
+            type: 'tool_calls',
+            tool_calls: [
+              {
+                id: toolCallId,
+                name: 'oauth_mcp_Google-Workspace',
+                type: 'tool_call_chunk',
+              },
+            ],
+          },
+        },
+      },
+      {
+        event: 'on_run_step_delta',
+        data: {
+          id: stepId,
+          delta: {
+            type: 'tool_calls',
+            tool_calls: [
+              {
+                id: toolCallId,
+                name: 'oauth_mcp_Google-Workspace',
+                type: 'tool_call_chunk',
+                args: '',
+              },
+            ],
+            auth: authUrl,
+            expires_at: Date.now() + 120000,
+          },
+        },
+      },
+    ],
+  };
+  const streamPayloads: unknown[] = [
+    {
+      sync: true,
+      resumeState,
+      pendingEvents: [],
+    },
+  ];
+
+  if (postAuthText) {
+    streamPayloads.push(
+      {
+        event: 'on_run_step',
+        data: {
+          runId: postAuthRunId ?? 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          id: messageStepId,
+          type: 'message_creation',
+          index: 0,
+          stepDetails: {
+            type: 'message_creation',
+            message_creation: {
+              message_id: `${pendingResponseMessageId}-post-auth`,
+            },
+          },
+          usage: null,
+        },
+      },
+      {
+        event: 'on_message_delta',
+        data: {
+          id: messageStepId,
+          delta: {
+            content: [
+              {
+                type: 'text',
+                text: postAuthText,
+              },
+            ],
+          },
+        },
+      },
+    );
+  }
+
+  await page.route(`**/api/agents/chat/status/${conversationId}`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        active: true,
+        streamId: conversationId,
+        status: 'running',
+        aggregatedContent: [],
+        createdAt: Date.now(),
+        resumeState,
+      }),
+    }),
+  );
+
+  await page.route(`**/api/agents/chat/stream/${conversationId}**`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'text/event-stream',
+      body: streamPayloads.map(sseMessage).join(''),
+    }),
+  );
+}
+
+async function mockPreCreatedOAuthStream({
+  page,
+  authUrl,
+  conversationId,
+  parentMessageId,
+  prompt,
+  serverUserMessageId,
+  responseMessageId,
+  postAuthText,
+}: {
+  page: Page;
+  authUrl: string;
+  conversationId: string;
+  parentMessageId: string;
+  prompt: string;
+  serverUserMessageId: string;
+  responseMessageId: string;
+  postAuthText: string;
+}) {
+  const toolCallId = `${serverUserMessageId}:Google-Workspace`;
+  const oauthStepId = 'step_oauth_login_Google-Workspace';
+  const reasoningStepId = 'step_post_auth_reasoning';
+  const messageStepId = 'step_post_auth_message';
+  const payloads = [
+    {
+      event: 'on_run_step',
+      data: {
+        runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+        id: oauthStepId,
+        type: 'tool_calls',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [
+            {
+              id: toolCallId,
+              name: 'oauth_mcp_Google-Workspace',
+              type: 'tool_call_chunk',
+            },
+          ],
+        },
+      },
+    },
+    {
+      event: 'on_run_step_delta',
+      data: {
+        id: oauthStepId,
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [
+            {
+              id: toolCallId,
+              name: 'oauth_mcp_Google-Workspace',
+              type: 'tool_call_chunk',
+              args: '',
+            },
+          ],
+          auth: authUrl,
+          expires_at: Date.now() + 120000,
+        },
+      },
+    },
+    {
+      event: 'on_run_step_completed',
+      data: {
+        result: {
+          id: oauthStepId,
+          index: 0,
+          tool_call: {
+            id: toolCallId,
+            name: 'oauth_mcp_Google-Workspace',
+            args: '',
+            output: 'OAuth authentication completed',
+            type: 'tool_call',
+          },
+        },
+      },
+    },
+    {
+      created: true,
+      message: {
+        messageId: serverUserMessageId,
+        parentMessageId,
+        conversationId,
+        sender: 'User',
+        text: prompt,
+        isCreatedByUser: true,
+      },
+      streamId: conversationId,
+    },
+    {
+      event: 'on_run_step',
+      data: {
+        runId: responseMessageId,
+        id: reasoningStepId,
+        type: 'message_creation',
+        index: 0,
+        stepDetails: {
+          type: 'message_creation',
+          message_creation: {
+            message_id: `${responseMessageId}-reasoning`,
+          },
+        },
+        usage: null,
+      },
+    },
+    {
+      event: 'on_reasoning_delta',
+      data: {
+        id: reasoningStepId,
+        delta: {
+          content: [
+            {
+              type: 'think',
+              think: 'The user completed OAuth.',
+            },
+          ],
+        },
+      },
+    },
+    {
+      event: 'on_run_step',
+      data: {
+        runId: responseMessageId,
+        id: messageStepId,
+        type: 'message_creation',
+        index: 1,
+        stepDetails: {
+          type: 'message_creation',
+          message_creation: {
+            message_id: `${responseMessageId}-message`,
+          },
+        },
+        usage: null,
+      },
+    },
+    {
+      event: 'on_message_delta',
+      data: {
+        id: messageStepId,
+        delta: {
+          content: [
+            {
+              type: 'text',
+              text: postAuthText,
+              index: 1,
+            },
+          ],
+        },
+      },
+    },
+  ];
+
+  await page.route(`**/api/agents/chat/stream/${conversationId}**`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'text/event-stream',
+      body: payloads.map(sseMessage).join(''),
+    }),
+  );
+}
+
+async function openMockChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+}
+
+function isAgentGenerationResponse(response: Response, expectedStatus: number) {
+  const { pathname } = new URL(response.url());
+  const isAgentsChat = pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+  return (
+    response.request().method() === 'POST' &&
+    isAgentsChat &&
+    !pathname.endsWith('/abort') &&
+    response.status() === expectedStatus
+  );
+}
+
+async function waitForGenerationStart(page: Page, action: () => Promise<void>): Promise<Response> {
+  const [response] = await Promise.all([
+    page.waitForResponse(isAgentGenerationStart, { timeout: 30000 }),
+    action(),
+  ]);
+  expect(response.ok()).toBeTruthy();
+  return response;
+}
+
+async function sendAndExpectReply(page: Page, prompt: string, expectedReply: string) {
+  const response = await sendMessage(page, prompt);
+  expect(response.ok()).toBeTruthy();
+  await expect(messagesView(page).getByText(expectedReply)).toBeVisible({ timeout: 30000 });
+}
+
+async function submitMessageExpectingGenerationFailure(
+  page: Page,
+  prompt: string,
+  expectedStatus: number,
+) {
+  const input = page.getByRole('textbox', { name: 'Message input' });
+  await expect(input).toBeEnabled({ timeout: 30000 });
+  await input.click();
+  await input.fill(prompt);
+  const [response] = await Promise.all([
+    page.waitForResponse((res) => isAgentGenerationResponse(res, expectedStatus), {
+      timeout: 30000,
+    }),
+    input.press('Enter'),
+  ]);
+  return response;
+}
+
+async function conversationIdFromPage(page: Page): Promise<string> {
+  await expect(page).toHaveURL(/\/c\/(?!new)[0-9a-fA-F-]{36}$/);
+  const id = new URL(page.url()).pathname.split('/').pop();
+  if (!id) {
+    throw new Error(`Could not parse conversation id from ${page.url()}`);
+  }
+  return id;
+}
+
+async function fetchMessages(
+  page: Page,
+  conversationId: string,
+  accessToken?: string,
+): Promise<E2EMessage[]> {
+  const token = accessToken ?? (await getAccessToken(page));
+  return fetchJson<E2EMessage[]>(
+    page,
+    `/api/messages/${encodeURIComponent(conversationId)}`,
+    token,
+  );
+}
+
+async function postJsonWithStatus(page: Page, path: string, token: string, body: unknown) {
+  return page.evaluate(
+    async ({ accessToken, requestBody, urlPath }): Promise<JsonResponse> => {
+      const response = await fetch(urlPath, {
+        method: 'POST',
+        credentials: 'include',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(requestBody),
+      });
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    { accessToken: token, requestBody: body, urlPath: path },
+  );
+}
+
+async function waitForMessages(
+  page: Page,
+  conversationId: string,
+  predicate: (messages: E2EMessage[]) => boolean,
+  description: string,
+): Promise<E2EMessage[]> {
+  let latest: E2EMessage[] = [];
+  const token = await getAccessToken(page);
+  for (let attempt = 0; attempt < 80; attempt++) {
+    latest = await fetchMessages(page, conversationId, token);
+    if (predicate(latest)) {
+      return latest;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+
+  throw new Error(
+    `Timed out waiting for ${description}. Latest messages:\n${latest
+      .map(
+        (message) => `${message.messageId} <- ${message.parentMessageId}: ${messageText(message)}`,
+      )
+      .join('\n')}`,
+  );
+}
+
+async function clickMessageTitleButton(page: Page, messageTextValue: string, title: string) {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.locator(`button[title="${title}"]`).last().click();
+}
+
+async function clickSibling(page: Page, messageTextValue: string, direction: 'Previous' | 'Next') {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.getByRole('button', { name: `${direction} sibling message` }).click();
+}
+
+async function expectCanCycleSiblingTexts(page: Page, previousText: string, nextText: string) {
+  const previous = messagesView(page).getByText(previousText);
+  const next = messagesView(page).getByText(nextText);
+  if (await previous.isVisible()) {
+    await clickSibling(page, previousText, 'Next');
+    await expect(next).toBeVisible();
+    await clickSibling(page, nextText, 'Previous');
+    await expect(previous).toBeVisible();
+    return;
+  }
+
+  if (await next.isVisible()) {
+    await clickSibling(page, nextText, 'Previous');
+    await expect(previous).toBeVisible();
+    await clickSibling(page, previousText, 'Next');
+    await expect(next).toBeVisible();
+    return;
+  }
+
+  throw new Error(`Expected either sibling "${previousText}" or "${nextText}" to be visible`);
+}
+
+async function clickForkVisibleMessages(
+  page: Page,
+  messageTextValue: string,
+): Promise<ForkResponse> {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.getByRole('button', { name: 'Open Fork Menu' }).click();
+
+  const [response] = await Promise.all([
+    page.waitForResponse(
+      (res) =>
+        res.request().method() === 'POST' &&
+        res.url().includes('/api/convos/fork') &&
+        res.status() === 200,
+      { timeout: 30000 },
+    ),
+    page.getByRole('button', { name: 'Visible messages only', exact: true }).click(),
+  ]);
+
+  return (await response.json()) as ForkResponse;
+}
+
+test.describe('message tree stream operations', () => {
+  test.setTimeout(180000);
+
+  test('streams follow-ups and keeps an aborted response as the next parent', async ({ page }) => {
+    const label = uniqueLabel('abort');
+    const firstPrompt = replyPrompt(`${label}-first`);
+    const firstReply = replyText(`${label}-first`);
+    const secondPrompt = replyPrompt(`${label}-second`);
+    const secondReply = replyText(`${label}-second`);
+    const abortPrompt = slowPrompt(`${label}-stop`);
+    const abortReply = slowReplyPrefix(`${label}-stop`);
+    const afterAbortPrompt = replyPrompt(`${label}-after-stop`);
+    const afterAbortReply = replyText(`${label}-after-stop`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, firstPrompt, firstReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, secondPrompt, secondReply);
+
+    const slowStart = await sendMessage(page, abortPrompt);
+    expect(slowStart.ok()).toBeTruthy();
+    await expect(messagesView(page).getByText(abortReply)).toBeVisible({ timeout: 30000 });
+
+    const [abortResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'POST' &&
+          response.url().includes('/api/agents/chat/abort'),
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Stop generating' }).click(),
+    ]);
+    expect(abortResponse.ok()).toBeTruthy();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+      timeout: 30000,
+    });
+
+    let messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(abortReply)),
+      'aborted response to persist',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, secondPrompt, firstReply, true);
+    expectParent(messages, abortReply, abortPrompt, false);
+
+    await sendAndExpectReply(page, afterAbortPrompt, afterAbortReply);
+    messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterAbortReply)),
+      'follow-up after abort',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterAbortPrompt, abortReply, true);
+    expectParent(messages, afterAbortReply, afterAbortPrompt, false);
+
+    await reloadAndExpectMessages(page, [firstReply, secondReply, abortReply, afterAbortReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      firstReply,
+      secondReply,
+      abortReply,
+      afterAbortReply,
+    ]);
+  });
+
+  test('regenerates assistant siblings, cycles branches, follows up, and forks the visible branch', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('regen');
+    const prompt = countedPrompt(label);
+    const firstReply = countedReplyText(label, 1);
+    const regeneratedReply = countedReplyText(label, 2);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const followReply = replyText(`${label}-follow`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, prompt, firstReply);
+    const originalConversationId = await conversationIdFromPage(page);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, firstReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expect(messagesView(page).getByText(firstReply)).toBeVisible();
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+    await clickSibling(page, firstReply, 'Next');
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible();
+
+    await sendAndExpectReply(page, followPrompt, followReply);
+    let messages = await waitForMessages(
+      page,
+      originalConversationId,
+      (items) => items.some((message) => messageText(message).includes(followReply)),
+      'follow-up after regenerate',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, firstReply, prompt, false);
+    expectParent(messages, regeneratedReply, prompt, false);
+    expectParent(messages, followPrompt, regeneratedReply, true);
+    expectParent(messages, followReply, followPrompt, false);
+
+    const userMessage = findMessage(messages, prompt, true);
+    const assistantSiblings = messages.filter(
+      (message) => message.parentMessageId === userMessage.messageId && !message.isCreatedByUser,
+    );
+    expect(assistantSiblings.map(messageText).sort()).toEqual(
+      [firstReply, regeneratedReply].sort(),
+    );
+
+    await reloadAndExpectMessages(page, [regeneratedReply, followReply]);
+    await revisitConversationAndExpectMessages(page, originalConversationId, [
+      regeneratedReply,
+      followReply,
+    ]);
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expect(messagesView(page).getByText(firstReply)).toBeVisible();
+    const fork = await clickForkVisibleMessages(page, firstReply);
+    const forkedConversationId = fork.conversation.conversationId;
+    if (!forkedConversationId) {
+      throw new Error('Expected fork response to include a conversation id');
+    }
+    await expect(page).toHaveURL(new RegExp(`/c/${forkedConversationId}$`));
+
+    messages = fork.messages;
+    expectNoFoldedMessages(messages);
+    expect(messages.some((message) => messageText(message).includes(firstReply))).toBe(true);
+    expect(messages.some((message) => messageText(message).includes(regeneratedReply))).toBe(false);
+    expect(messages.some((message) => messageText(message).includes(followReply))).toBe(false);
+  });
+
+  test('shows the regenerating response immediately when regenerating a non-latest sibling', async ({
+    page,
+  }) => {
+    // A parent with multiple siblings, switched to an older one, then
+    // regenerated: the optimistic slice drops the target but keeps the other
+    // siblings, so the child count is unchanged and MultiMessage's
+    // length-change reset never fires. Without an explicit focus the view stays
+    // on the kept (newer) sibling and the streaming response is hidden until the
+    // server restores the dropped sibling at finalize. A slow reply keeps the
+    // stream open long enough to assert the during-stream state.
+    const label = uniqueLabel('regen-nonlatest');
+    const prompt = slowCountedPrompt(label);
+    const reply1 = slowCountedReplyText(label, 1);
+    const reply2 = slowCountedReplyText(label, 2);
+    const reply3 = slowCountedReplyText(label, 3);
+    const stopButton = page.getByRole('button', { name: 'Stop generating' });
+
+    await openMockChat(page);
+    await sendMessage(page, prompt);
+    await expect(messagesView(page).getByText(reply1)).toBeVisible({ timeout: 30000 });
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+
+    // First regenerate adds a sibling; the parent now has two responses.
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    await expect(messagesView(page).getByText(reply2)).toBeVisible({ timeout: 30000 });
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+
+    // View the older sibling, then regenerate it (the non-latest one).
+    await clickSibling(page, reply2, 'Previous');
+    await expect(messagesView(page).getByText(reply1)).toBeVisible();
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    // Still streaming (slow reply): the regenerating response must be visible
+    // now — not the kept sibling — and well before finalize.
+    await expect(stopButton).toBeVisible({ timeout: 30000 });
+    await expect(messagesView(page).getByText(reply3)).toBeVisible({ timeout: 4000 });
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    // It stays put after finalize too.
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+    await expect(messagesView(page).getByText(reply3)).toBeVisible();
+  });
+
+  test('does not flash the kept sibling before the created event when regenerating a non-latest sibling', async ({
+    page,
+  }) => {
+    // Same hazard at the optimistic (pre-`created`) render: useChatFunctions
+    // appends the placeholder and renders it before the request resolves. Gate
+    // the regenerate request so only that optimistic frame is on screen — with
+    // no `created` event to fall back on — and assert the kept sibling is
+    // already gone (the regenerating placeholder took its place). This isolates
+    // the optimistic focus; the createdHandler focus cannot mask a regression
+    // because `created` never arrives during the assertion.
+    const label = uniqueLabel('regen-precreated');
+    const prompt = countedPrompt(label);
+    const reply1 = countedReplyText(label, 1);
+    const reply2 = countedReplyText(label, 2);
+    const reply3 = countedReplyText(label, 3);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, prompt, reply1);
+
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    await expect(messagesView(page).getByText(reply2)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, reply2, 'Previous');
+    await expect(messagesView(page).getByText(reply1)).toBeVisible();
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    // Hold the SSE stream so the `created` event cannot arrive: the optimistic
+    // render is all there is. The chat POST returns a stream id; the stream
+    // itself is a separate GET (/api/agents/chat/stream/<id>) — gate that one,
+    // not the POST, which must complete to hand back the id.
+    let release = () => {};
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await page.route(/\/api\/agents\/chat\/stream\//, async (route: Route) => {
+      await gate;
+      return route.continue();
+    });
+
+    try {
+      await clickMessageTitleButton(page, reply1, 'Regenerate');
+      // The stream is gated, so the regenerating response has no text yet.
+      await expect(messagesView(page).getByText(reply3)).toBeHidden();
+      // Pre-`created` window: the kept sibling must not be the one on screen —
+      // the regenerating placeholder has already taken its place.
+      await expect(messagesView(page).getByText(reply2)).toBeHidden({ timeout: 5000 });
+      await expect(messagesView(page).getByText(reply1)).toBeHidden();
+    } finally {
+      release();
+    }
+
+    await expect(messagesView(page).getByText(reply3)).toBeVisible({ timeout: 30000 });
+  });
+
+  test('resumes pending OAuth on the selected older branch after reload', async ({ page }) => {
+    const label = uniqueLabel('oauth-branch');
+    const rootPrompt = countedPrompt(`${label}-root`);
+    const firstReply = countedReplyText(`${label}-root`, 1);
+    const regeneratedReply = countedReplyText(`${label}-root`, 2);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const followReply = replyText(`${label}-follow`);
+    const pendingPrompt = replyPrompt(`${label}-oauth`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, firstReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, followPrompt, followReply);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, firstReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expectVisibleMessages(page, [firstReply, followPrompt, followReply]);
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) =>
+        items.some((message) => messageText(message).includes(followReply)) &&
+        items.some((message) => messageText(message).includes(regeneratedReply)),
+      'two-branch conversation',
+    );
+    const branchOneTail = findMessage(messages, followReply, false);
+
+    await mockActiveOAuthResumeStream({
+      page,
+      conversationId,
+      parentMessageId: branchOneTail.messageId,
+      pendingPrompt,
+      pendingUserMessageId: `${label}-pending-user`,
+      authUrl: `https://auth.example.test/${label}`,
+    });
+
+    await page.reload({ timeout: 10000 });
+    await expectVisibleMessages(page, [firstReply, followPrompt, followReply, pendingPrompt]);
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+  });
+
+  test('keeps existing messages visible when resumed OAuth streams post-auth content', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('oauth-post-auth');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const pendingPrompt = replyPrompt(`${label}-pending`);
+    const postAuthText = `E2E post-auth OAuth reply ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(rootReply)),
+      'root reply before OAuth resume',
+    );
+    const branchTail = findMessage(messages, rootReply, false);
+
+    await mockActiveOAuthResumeStream({
+      page,
+      conversationId,
+      parentMessageId: branchTail.messageId,
+      pendingPrompt,
+      pendingUserMessageId: `${label}-pending-user`,
+      authUrl: `https://auth.example.test/${label}`,
+      postAuthRunId: `${label}-stable-response`,
+      postAuthText,
+    });
+
+    await page.reload({ timeout: 10000 });
+    await expectVisibleMessages(page, [rootPrompt, rootReply, pendingPrompt, postAuthText]);
+  });
+
+  test('keeps existing messages visible when OAuth completes before created', async ({ page }) => {
+    const label = uniqueLabel('oauth-pre-created');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const postAuthText = `E2E pre-created OAuth reply ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(rootReply)),
+      'root reply before pre-created OAuth stream',
+    );
+    const branchTail = findMessage(messages, rootReply, false);
+
+    await mockPreCreatedOAuthStream({
+      page,
+      conversationId,
+      parentMessageId: branchTail.messageId,
+      prompt: followPrompt,
+      serverUserMessageId: `${label}-server-user`,
+      responseMessageId: `${label}-response`,
+      authUrl: `https://auth.example.test/${label}`,
+      postAuthText,
+    });
+
+    const response = await sendMessage(page, followPrompt);
+    expect(response.ok()).toBeTruthy();
+    await expectVisibleMessages(page, [rootPrompt, rootReply, followPrompt, postAuthText]);
+  });
+
+  test('long threads retain regenerated and save-and-submit branches after revisit', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('save-submit');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const firstPrompt = replyPrompt(`${label}-first`);
+    const firstReply = replyText(`${label}-first`);
+    const middlePrompt = replyPrompt(`${label}-middle`);
+    const middleReply = replyText(`${label}-middle`);
+    const fourthPrompt = replyPrompt(`${label}-fourth`);
+    const fourthReply = replyText(`${label}-fourth`);
+    const tailPrompt = countedPrompt(`${label}-tail`);
+    const tailReply = countedReplyText(`${label}-tail`, 1);
+    const regeneratedTailReply = countedReplyText(`${label}-tail`, 2);
+    const editedMiddlePrompt = replyPrompt(`${label}-middle-edited`);
+    const editedMiddleReply = replyText(`${label}-middle-edited`);
+    const afterEditPrompt = replyPrompt(`${label}-after-edit`);
+    const afterEditReply = replyText(`${label}-after-edit`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, firstPrompt, firstReply);
+    await sendAndExpectReply(page, middlePrompt, middleReply);
+    await sendAndExpectReply(page, fourthPrompt, fourthReply);
+    await sendAndExpectReply(page, tailPrompt, tailReply);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, tailReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedTailReply)).toBeVisible({
+      timeout: 30000,
+    });
+
+    await clickMessageTitleButton(page, middlePrompt, 'Edit');
+    const editor = page.getByTestId('message-text-editor');
+    await expect(editor).toBeVisible();
+    await editor.fill(editedMiddlePrompt);
+    await waitForGenerationStart(page, () =>
+      page.getByRole('button', { name: 'Save & Submit' }).click(),
+    );
+    await expect(messagesView(page).getByText(editedMiddleReply)).toBeVisible({ timeout: 30000 });
+
+    let messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(editedMiddleReply)),
+      'save-and-submit edited branch',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, firstPrompt, rootReply, true);
+    expectParent(messages, firstReply, firstPrompt, false);
+    expectParent(messages, middlePrompt, firstReply, true);
+    expectParent(messages, middleReply, middlePrompt, false);
+    expectParent(messages, fourthPrompt, middleReply, true);
+    expectParent(messages, fourthReply, fourthPrompt, false);
+    expectParent(messages, tailPrompt, fourthReply, true);
+    expectParent(messages, tailReply, tailPrompt, false);
+    expectParent(messages, regeneratedTailReply, tailPrompt, false);
+    expectParent(messages, editedMiddlePrompt, firstReply, true);
+    expectParent(messages, editedMiddleReply, editedMiddlePrompt, false);
+
+    await clickSibling(page, editedMiddlePrompt, 'Previous');
+    await expectVisibleMessages(page, [middlePrompt, fourthReply]);
+    await expectCanCycleSiblingTexts(page, tailReply, regeneratedTailReply);
+    await clickSibling(page, middlePrompt, 'Next');
+    await expectVisibleMessages(page, [editedMiddlePrompt, editedMiddleReply]);
+
+    await sendAndExpectReply(page, afterEditPrompt, afterEditReply);
+    messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterEditReply)),
+      'follow-up after save-and-submit branch',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterEditPrompt, editedMiddleReply, true);
+    expectParent(messages, afterEditReply, afterEditPrompt, false);
+    expect(messages.some((message) => messageText(message).includes(tailReply))).toBe(true);
+    expect(messages.some((message) => messageText(message).includes(regeneratedTailReply))).toBe(
+      true,
+    );
+
+    await reloadAndExpectMessages(page, [rootReply, firstReply, editedMiddleReply, afterEditReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      rootReply,
+      firstReply,
+      editedMiddleReply,
+      afterEditReply,
+    ]);
+    await clickSibling(page, editedMiddlePrompt, 'Previous');
+    await expectVisibleMessages(page, [middlePrompt, fourthReply]);
+    await expectCanCycleSiblingTexts(page, tailReply, regeneratedTailReply);
+    await clickSibling(page, middlePrompt, 'Next');
+    await expectVisibleMessages(page, [editedMiddlePrompt, editedMiddleReply, afterEditReply]);
+  });
+
+  test('error responses remain valid parents for follow-ups', async ({ page }) => {
+    const label = uniqueLabel('error');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const errorPrompt = `E2E_FORCED_ERROR:${label}`;
+    const errorText = `E2E forced stream error ${label}`;
+    const afterErrorPrompt = replyPrompt(`${label}-after-error`);
+    const afterErrorReply = replyText(`${label}-after-error`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    await sendAndExpectReply(page, errorPrompt, errorText);
+    await expect(messagesView(page).getByText(errorText)).toBeVisible({ timeout: 30000 });
+
+    await sendAndExpectReply(page, afterErrorPrompt, afterErrorReply);
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterErrorReply)),
+      'follow-up after error',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, errorPrompt, baseReply, true);
+    expectParent(messages, errorText, errorPrompt, false);
+    expectParent(messages, afterErrorPrompt, errorText, true);
+    expectParent(messages, afterErrorReply, afterErrorPrompt, false);
+
+    await reloadAndExpectMessages(page, [baseReply, errorText, afterErrorReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      baseReply,
+      errorText,
+      afterErrorReply,
+    ]);
+  });
+
+  test('rejects normal follow-ups whose parent is a preliminary assistant placeholder', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('placeholder-parent');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const followPrompt = replyPrompt(`${label}-follow`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+    const token = await getAccessToken(page);
+
+    const beforeMessages = await fetchMessages(page, conversationId, token);
+    const stableParent = findMessage(beforeMessages, baseReply, false);
+    const response = await postJsonWithStatus(
+      page,
+      `/api/agents/chat/${encodeURIComponent(MOCK_ENDPOINTS[0].label)}`,
+      token,
+      {
+        text: followPrompt,
+        sender: 'User',
+        clientTimestamp: new Date().toLocaleString('sv').replace(' ', 'T'),
+        isCreatedByUser: true,
+        parentMessageId: `${stableParent.messageId}_`,
+        conversationId,
+        messageId: `${label}-user-message`,
+        endpoint: MOCK_ENDPOINTS[0].label,
+        endpointType: 'custom',
+        model: MOCK_ENDPOINTS[0].model,
+        spec: 'e2e-mock-provider-a',
+        isTemporary: false,
+        isRegenerate: false,
+        error: false,
+      },
+    );
+
+    expect(response.status).toBe(409);
+    expect(response.json).toEqual(
+      expect.objectContaining({
+        error: expect.stringContaining('selected parent response is still being saved'),
+      }),
+    );
+
+    const afterMessages = await fetchMessages(page, conversationId, token);
+    expect(afterMessages.map((message) => message.messageId).sort()).toEqual(
+      beforeMessages.map((message) => message.messageId).sort(),
+    );
+    expect(afterMessages.some((message) => messageText(message).includes(followPrompt))).toBe(
+      false,
+    );
+    expectNoFoldedMessages(afterMessages);
+  });
+
+  test('generation-start failures recover without folding the next follow-up', async ({ page }) => {
+    const label = uniqueLabel('start-error');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const failedPrompt = replyPrompt(`${label}-failed-start`);
+    const failedText = `E2E generation start failure ${label}`;
+    const afterFailurePrompt = replyPrompt(`${label}-after-start-failure`);
+    const afterFailureReply = replyText(`${label}-after-start-failure`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const failGenerationStart = async (route: Route) => {
+      const request = route.request();
+      const { pathname } = new URL(request.url());
+      const isAgentsChat =
+        pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+      if (
+        request.method() !== 'POST' ||
+        !isAgentsChat ||
+        pathname.endsWith('/abort') ||
+        !request.postData()?.includes(failedPrompt)
+      ) {
+        await route.continue();
+        return;
+      }
+
+      await route.fulfill({
+        status: 500,
+        contentType: 'application/json',
+        body: JSON.stringify({ message: failedText }),
+      });
+    };
+    await page.route('**/api/agents/chat**', failGenerationStart);
+
+    const failure = await submitMessageExpectingGenerationFailure(page, failedPrompt, 500);
+    expect(failure.ok()).toBe(false);
+    await expect(messagesView(page).getByText(failedText)).toBeVisible({ timeout: 30000 });
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeEnabled({
+      timeout: 30000,
+    });
+    await page.unroute('**/api/agents/chat**', failGenerationStart);
+
+    await sendAndExpectReply(page, afterFailurePrompt, afterFailureReply);
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterFailureReply)),
+      'follow-up after generation-start failure',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterFailurePrompt, baseReply, true);
+    expectParent(messages, afterFailureReply, afterFailurePrompt, false);
+    expect(messages.some((message) => messageText(message).includes(failedPrompt))).toBe(false);
+    expect(messages.some((message) => messageText(message).includes(failedText))).toBe(false);
+
+    await reloadAndExpectMessages(page, [baseReply, afterFailureReply]);
+    await expect(messagesView(page).getByText(failedText)).toBeHidden();
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      baseReply,
+      afterFailureReply,
+    ]);
+    await expect(messagesView(page).getByText(failedText)).toBeHidden();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-branding.spec.ts b/e2e/specs/mock/model-spec-branding.spec.ts
new file mode 100644
index 00000000000..493572cfd5e
--- /dev/null
+++ b/e2e/specs/mock/model-spec-branding.spec.ts
@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
+import { NEW_CHAT_PATH, selectModelSpec } from './helpers';
+
+/** Spec with `showOnLanding: true` and an HTML `description` in e2e/config/librechat.e2e.yaml. */
+const BRANDED_SPEC = {
+  label: 'E2E Branded',
+  descriptionText: 'Branded answers',
+  descriptionIcon: '/assets/openai.svg',
+};
+
+/** The `softDefault: true` spec does not set `showOnLanding`, so it is unbranded. */
+const UNBRANDED_SPEC_LABEL = 'E2E Soft Default';
+
+test.describe('model spec branding on landing', () => {
+  test('branded spec replaces the greeting with its label and rendered description', async ({
+    page,
+  }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, BRANDED_SPEC.label);
+
+    const main = page.getByRole('main');
+    await expect(main).toContainText(BRANDED_SPEC.label);
+    await expect(main).toContainText(BRANDED_SPEC.descriptionText);
+    await expect(main.locator(`img[src$="${BRANDED_SPEC.descriptionIcon}"]`)).toBeVisible();
+
+    const user = getPrimaryE2EUser();
+    await expect(main).not.toContainText(user.name);
+  });
+
+  test('unbranded spec keeps the personalized greeting', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, UNBRANDED_SPEC_LABEL);
+
+    const user = getPrimaryE2EUser();
+    await expect(page.getByRole('main')).toContainText(user.name);
+  });
+
+  test('branded spec renders its description in the model selector', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await page.getByRole('button', { name: 'Select a model' }).first().click();
+    const option = page.getByRole('option', { name: new RegExp(BRANDED_SPEC.label) });
+    await expect(option).toContainText(BRANDED_SPEC.descriptionText);
+    await expect(option.locator(`img[src$="${BRANDED_SPEC.descriptionIcon}"]`)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-icons.spec.ts b/e2e/specs/mock/model-spec-icons.spec.ts
new file mode 100644
index 00000000000..64b861bbfd8
--- /dev/null
+++ b/e2e/specs/mock/model-spec-icons.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import { NEW_CHAT_PATH, selectModelSpec, sendMessage } from './helpers';
+
+const ICON_SPEC_LABEL = 'E2E Icon Spec';
+const ICON_SPEC_URL = '/assets/openai.svg';
+
+const uniqueLabel = (name: string) => `${name}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+const iconPrompt = (label: string) => `E2E_RESUME_ICON_REPLY:${label}`;
+const iconReplyPrefix = (label: string) => `E2E resume icon reply ${label}`;
+
+const assistantMessage = (page: Page, text: string) =>
+  page.locator('.message-render').filter({ hasText: text }).last();
+
+const modelSpecIcon = (message: Locator) => message.locator(`img[src$="${ICON_SPEC_URL}"]`);
+
+async function openIconSpecChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectModelSpec(page, ICON_SPEC_LABEL);
+}
+
+async function sendIconSpecStream(page: Page, label: string) {
+  const response = await sendMessage(page, iconPrompt(label));
+  expect(response.ok()).toBeTruthy();
+  await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}(?:\?.*)?$/);
+
+  const reply = iconReplyPrefix(label);
+  const message = assistantMessage(page, reply);
+  await expect(message.getByText(reply)).toBeVisible({ timeout: 30000 });
+  await expect(modelSpecIcon(message)).toBeVisible();
+
+  return { conversationUrl: page.url(), reply };
+}
+
+test.describe('model spec message icons', () => {
+  test('preserves iconURL when resuming an active stream after navigation', async ({ page }) => {
+    test.setTimeout(90000);
+    const label = uniqueLabel('resume-icon');
+
+    await openIconSpecChat(page);
+    const { conversationUrl, reply } = await sendIconSpecStream(page, label);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await page.goto(conversationUrl, { timeout: 10000 });
+
+    const resumedMessage = assistantMessage(page, reply);
+    await expect(resumedMessage.getByText(reply)).toBeVisible({ timeout: 30000 });
+    await expect(modelSpecIcon(resumedMessage)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeVisible();
+  });
+
+  test('preserves iconURL when aborting an active model spec stream', async ({ page }) => {
+    test.setTimeout(90000);
+    const label = uniqueLabel('abort-icon');
+
+    await openIconSpecChat(page);
+    const { reply } = await sendIconSpecStream(page, label);
+
+    const [abortResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'POST' &&
+          response.url().includes('/api/agents/chat/abort'),
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Stop generating' }).click(),
+    ]);
+    expect(abortResponse.ok()).toBeTruthy();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+      timeout: 30000,
+    });
+
+    const abortedMessage = assistantMessage(page, reply);
+    await expect(abortedMessage.getByText(reply)).toBeVisible();
+    await expect(modelSpecIcon(abortedMessage)).toBeVisible();
+
+    await page.reload({ timeout: 10000 });
+    const reloadedMessage = assistantMessage(page, reply);
+    await expect(reloadedMessage.getByText(reply)).toBeVisible({ timeout: 30000 });
+    await expect(modelSpecIcon(reloadedMessage)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-skills.spec.ts b/e2e/specs/mock/model-spec-skills.spec.ts
new file mode 100644
index 00000000000..b0c9394959a
--- /dev/null
+++ b/e2e/specs/mock/model-spec-skills.spec.ts
@@ -0,0 +1,175 @@
+import { expect, test } from '@playwright/test';
+import { MongoClient, ObjectId } from 'mongodb';
+import type { Page } from '@playwright/test';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+import {
+  NEW_CHAT_PATH,
+  fetchJson,
+  getAccessToken,
+  requestJson,
+  selectModelSpec,
+  sendMessage,
+} from './helpers';
+
+const MODEL_SPEC_LABEL = 'E2E Skill Scope';
+const ASSERTION_MARKER = 'E2E_ASSERT_MODEL_SPEC_SKILLS';
+const ASSERTION_FINAL_TEXT = 'E2E model spec skill assertion passed';
+const ACCESSIBLE_SKILL_NAME = 'e2e-model-spec-allowed';
+const INACCESSIBLE_SKILL_NAME = 'e2e-model-spec-inaccessible';
+const ALWAYS_APPLY_BODY_MARKER = 'E2E_ALWAYS_APPLY_BODY_MARKER';
+const INACCESSIBLE_AUTHOR_ID = new ObjectId('64f000000000000000000001');
+const SKILL_DESCRIPTION =
+  'Use this skill to verify model-spec skill scoping and always-apply priming in mock e2e tests.';
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+  version: number;
+  alwaysApply?: boolean;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+};
+
+function buildSkillBody(name: string) {
+  return `---
+name: ${name}
+description: ${SKILL_DESCRIPTION}
+alwaysApply: true
+---
+
+# ${name}
+
+${ALWAYS_APPLY_BODY_MARKER}
+
+This body should be injected as an always-apply skill prime.`;
+}
+
+async function findSkill(
+  page: Page,
+  skillName: string,
+  token: string,
+): Promise<SkillSummary | null> {
+  const body = await fetchJson<{ skills?: SkillSummary[] }>(
+    page,
+    `/api/skills?search=${encodeURIComponent(skillName)}&limit=10`,
+    token,
+  );
+  return body.skills?.find((skill) => skill.name === skillName) ?? null;
+}
+
+async function seedAccessibleSkill(page: Page, token: string): Promise<SkillDetail> {
+  const body = buildSkillBody(ACCESSIBLE_SKILL_NAME);
+  const payload = {
+    name: ACCESSIBLE_SKILL_NAME,
+    description: SKILL_DESCRIPTION,
+    body,
+  };
+  const existing = await findSkill(page, ACCESSIBLE_SKILL_NAME, token);
+  if (!existing) {
+    return requestJson<SkillDetail>(page, {
+      path: '/api/skills',
+      token,
+      method: 'POST',
+      body: payload,
+    });
+  }
+
+  const detail = await fetchJson<SkillDetail>(
+    page,
+    `/api/skills/${encodeURIComponent(existing._id)}`,
+    token,
+  );
+  return requestJson<SkillDetail>(page, {
+    path: `/api/skills/${encodeURIComponent(existing._id)}`,
+    token,
+    method: 'PATCH',
+    body: {
+      ...payload,
+      expectedVersion: detail.version,
+    },
+  });
+}
+
+async function seedInaccessibleSkill() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for model-spec skill mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  try {
+    const db = client.db();
+    const skills = db.collection('skills');
+    const aclEntries = db.collection('aclentries');
+    const now = new Date();
+    await skills.updateOne(
+      {
+        name: INACCESSIBLE_SKILL_NAME,
+        author: INACCESSIBLE_AUTHOR_ID,
+        tenantId: null,
+      },
+      {
+        $set: {
+          description: SKILL_DESCRIPTION,
+          body: buildSkillBody(INACCESSIBLE_SKILL_NAME),
+          authorName: 'Inaccessible E2E User',
+          updatedAt: now,
+        },
+        $setOnInsert: {
+          displayTitle: INACCESSIBLE_SKILL_NAME,
+          frontmatter: {},
+          disableModelInvocation: false,
+          userInvocable: true,
+          allowedTools: [],
+          alwaysApply: true,
+          source: 'inline',
+          fileCount: 0,
+          version: 1,
+          createdAt: now,
+        },
+      },
+      { upsert: true },
+    );
+    const skill = await skills.findOne({
+      name: INACCESSIBLE_SKILL_NAME,
+      author: INACCESSIBLE_AUTHOR_ID,
+      tenantId: null,
+    });
+    if (skill?._id) {
+      await aclEntries.deleteMany({ resourceType: 'skill', resourceId: skill._id });
+    }
+  } finally {
+    await client.close();
+  }
+}
+
+test.describe('model spec skills', () => {
+  test('loads accessible configured skills and skips missing or inaccessible names', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+    const skill = await seedAccessibleSkill(page, token);
+    expect(skill.alwaysApply).toBe(true);
+    await seedInaccessibleSkill();
+
+    await selectModelSpec(page, MODEL_SPEC_LABEL);
+    const response = await sendMessage(
+      page,
+      `${ASSERTION_MARKER}\nVerify model-spec skill scope and always-apply frontmatter.`,
+    );
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      page
+        .getByTestId('messages-view')
+        .getByText(`${ASSERTION_FINAL_TEXT}: ${ACCESSIBLE_SKILL_NAME}`),
+    ).toBeVisible({ timeout: 30000 });
+  });
+});
diff --git a/e2e/specs/mock/model-spec-starters.spec.ts b/e2e/specs/mock/model-spec-starters.spec.ts
new file mode 100644
index 00000000000..a723f965311
--- /dev/null
+++ b/e2e/specs/mock/model-spec-starters.spec.ts
@@ -0,0 +1,49 @@
+import { expect, test } from '@playwright/test';
+import { messagesView, NEW_CHAT_PATH, replyPrompt, replyText, selectModelSpec } from './helpers';
+
+/** Spec with five `conversation_starters` in e2e/config/librechat.e2e.yaml; only four may render. */
+const STARTER_SPEC_LABEL = 'E2E Starters';
+const STARTER_PROMPTS = [
+  replyPrompt('starter'),
+  'Plan my week',
+  'Third starter prompt',
+  'Fourth starter prompt',
+];
+const STARTER_BEYOND_CAP = 'Fifth starter beyond the cap';
+
+/** A spec without `conversation_starters`. */
+const PLAIN_SPEC_LABEL = 'E2E Soft Default';
+
+test.describe('model spec conversation starters', () => {
+  test('starter prompts render on the landing for a spec that defines them', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, STARTER_SPEC_LABEL);
+
+    for (const text of STARTER_PROMPTS) {
+      await expect(page.getByRole('button', { name: text })).toBeVisible();
+    }
+    await expect(page.getByRole('button', { name: STARTER_BEYOND_CAP })).toBeHidden();
+  });
+
+  test('a spec without starters shows none', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, PLAIN_SPEC_LABEL);
+
+    for (const text of STARTER_PROMPTS) {
+      await expect(page.getByRole('button', { name: text })).toBeHidden();
+    }
+  });
+
+  test('clicking a starter submits it as the first message', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, STARTER_SPEC_LABEL);
+
+    const prompt = replyPrompt('starter');
+    await page.getByRole('button', { name: prompt }).click();
+
+    await expect(messagesView(page).getByText(prompt)).toBeVisible({ timeout: 30000 });
+    await expect(messagesView(page).getByText(replyText('starter'))).toBeVisible({
+      timeout: 30000,
+    });
+  });
+});
diff --git a/e2e/specs/mock/model-switching.spec.ts b/e2e/specs/mock/model-switching.spec.ts
new file mode 100644
index 00000000000..7c9a62de903
--- /dev/null
+++ b/e2e/specs/mock/model-switching.spec.ts
@@ -0,0 +1,23 @@
+import { expect, test } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+test.describe('endpoint switching', () => {
+  for (const endpoint of MOCK_ENDPOINTS) {
+    test(`"${endpoint.label}" returns a streamed response`, async ({ page }) => {
+      test.setTimeout(60000);
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+      await selectMockEndpoint(page, endpoint);
+
+      const response = await sendMessage(page, `hello ${endpoint.model}`);
+      expect(response.ok()).toBeTruthy();
+      await expect(mockReply(page)).toBeVisible();
+    });
+  }
+});
diff --git a/e2e/specs/mock/permissions.spec.ts b/e2e/specs/mock/permissions.spec.ts
new file mode 100644
index 00000000000..ae02995c327
--- /dev/null
+++ b/e2e/specs/mock/permissions.spec.ts
@@ -0,0 +1,407 @@
+import { expect, request as playwrightRequest, test } from '@playwright/test';
+import { MongoClient, ObjectId } from 'mongodb';
+import type { APIRequestContext } from '@playwright/test';
+import type { Collection, Db } from 'mongodb';
+import cleanupUser from '../../setup/cleanupUser';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+
+type TestUser = {
+  email: string;
+  name: string;
+  password: string;
+};
+
+type UserDoc = {
+  _id: ObjectId;
+  email: string;
+  name: string;
+  tenantId?: string;
+};
+
+type GroupDoc = {
+  _id: ObjectId;
+  name: string;
+  email?: string;
+  tenantId?: string;
+};
+
+type AccessRoleDoc = {
+  _id: ObjectId;
+  accessRoleId: string;
+  resourceType: string;
+  permBits: number;
+  tenantId?: string;
+};
+
+type PrincipalResponse = {
+  type: string;
+  id: string;
+  email?: string;
+  name?: string;
+  accessRoleId: string;
+};
+
+type PermissionsResponse = {
+  principals: PrincipalResponse[];
+};
+
+type AuthenticatedRequest = {
+  api: APIRequestContext;
+  token: string;
+  role: string;
+};
+
+const CURRENT_TENANT_ID = 'e2e-acl-current';
+const OTHER_TENANT_ID = 'e2e-acl-other';
+const RESOURCE_TYPE_AGENT = 'agent';
+const PRINCIPAL_TYPE_USER = 'user';
+const PRINCIPAL_TYPE_GROUP = 'group';
+const PRINCIPAL_MODEL_USER = 'User';
+const PRINCIPAL_MODEL_GROUP = 'Group';
+const ACCESS_ROLE_AGENT_OWNER = 'agent_owner';
+const ACCESS_ROLE_AGENT_VIEWER = 'agent_viewer';
+const PERM_BITS_VIEWER = 1;
+const PERM_BITS_OWNER = 15;
+
+const randomSuffix = () => `${Date.now()}-${Math.floor(Math.random() * 10000)}`;
+
+async function connectToE2EDb() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for permissions mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  return { client, db: client.db() };
+}
+
+async function createAuthenticatedRequest(
+  baseURL: string,
+  user: TestUser,
+  tenantId: string,
+): Promise<AuthenticatedRequest> {
+  await cleanupUser(user);
+
+  const api = await playwrightRequest.newContext({
+    baseURL,
+    storageState: { cookies: [], origins: [] },
+    extraHTTPHeaders: {
+      'X-Tenant-Id': tenantId,
+    },
+  });
+
+  const registerResponse = await api.post('/api/auth/register', {
+    data: {
+      email: user.email,
+      name: user.name,
+      password: user.password,
+      confirm_password: user.password,
+    },
+  });
+  expect(registerResponse.ok()).toBeTruthy();
+
+  const loginResponse = await api.post('/api/auth/login', {
+    data: {
+      email: user.email,
+      password: user.password,
+    },
+  });
+  expect(loginResponse.ok()).toBeTruthy();
+  const loginPayload = (await loginResponse.json()) as { token?: string; user?: { role?: string } };
+  if (!loginPayload.token || !loginPayload.user?.role) {
+    throw new Error('Expected login response to include a bearer token and user role');
+  }
+
+  return {
+    api,
+    token: loginPayload.token,
+    role: loginPayload.user.role,
+  };
+}
+
+async function seedTenantRole(db: Db, tenantId: string, roleName: string) {
+  await db.collection('roles').updateOne(
+    { name: roleName, tenantId },
+    {
+      $set: {
+        name: roleName,
+        tenantId,
+        permissions: {
+          AGENTS: {
+            USE: true,
+            CREATE: true,
+            SHARE: true,
+            SHARE_PUBLIC: true,
+          },
+        },
+      },
+      $setOnInsert: {
+        createdAt: new Date(),
+      },
+      $currentDate: {
+        updatedAt: true,
+      },
+    },
+    { upsert: true },
+  );
+}
+
+async function seedAccessRole(
+  accessRoles: Collection<AccessRoleDoc>,
+  tenantId: string,
+  accessRoleId: string,
+  permBits: number,
+): Promise<AccessRoleDoc> {
+  await accessRoles.updateOne(
+    { accessRoleId, tenantId },
+    {
+      $set: {
+        accessRoleId,
+        tenantId,
+        resourceType: RESOURCE_TYPE_AGENT,
+        permBits,
+        name: accessRoleId,
+      },
+      $setOnInsert: {
+        createdAt: new Date(),
+      },
+      $currentDate: {
+        updatedAt: true,
+      },
+    },
+    { upsert: true },
+  );
+
+  const role = await accessRoles.findOne({ accessRoleId, tenantId });
+  if (!role) {
+    throw new Error(`Expected seeded access role ${accessRoleId}`);
+  }
+  return role;
+}
+
+test.describe('permission principal details', () => {
+  test.setTimeout(120000);
+
+  test('keeps permission details and local principal writes in the authenticated context', async ({
+    baseURL,
+  }) => {
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for permissions mock e2e tests');
+    }
+
+    const suffix = randomSuffix();
+    const ownerUser: TestUser = {
+      email: `acl-owner-${suffix}@example.com`,
+      name: `ACL Owner ${suffix}`,
+      password: 'securepassword123',
+    };
+
+    const { api, role, token } = await createAuthenticatedRequest(
+      baseURL,
+      ownerUser,
+      CURRENT_TENANT_ID,
+    );
+    const { client, db } = await connectToE2EDb();
+    const users = db.collection<UserDoc>('users');
+    const groups = db.collection<GroupDoc>('groups');
+    const aclEntries = db.collection('aclentries');
+    const accessRoles = db.collection<AccessRoleDoc>('accessroles');
+    const resourceId = new ObjectId();
+    const createdIds: ObjectId[] = [];
+
+    try {
+      await seedTenantRole(db, CURRENT_TENANT_ID, role);
+      const ownerRole = await seedAccessRole(
+        accessRoles,
+        CURRENT_TENANT_ID,
+        ACCESS_ROLE_AGENT_OWNER,
+        PERM_BITS_OWNER,
+      );
+      const viewerRole = await seedAccessRole(
+        accessRoles,
+        CURRENT_TENANT_ID,
+        ACCESS_ROLE_AGENT_VIEWER,
+        PERM_BITS_VIEWER,
+      );
+
+      const currentOwner = await users.findOne({
+        email: ownerUser.email,
+        tenantId: CURRENT_TENANT_ID,
+      });
+      if (!currentOwner) {
+        throw new Error('Expected authenticated e2e user to be stored with a tenant id');
+      }
+
+      const outsideUserId = new ObjectId();
+      const outsideGroupId = new ObjectId();
+      const outsideWriteUserId = new ObjectId();
+      const currentGroupId = new ObjectId();
+      createdIds.push(outsideUserId, outsideGroupId, outsideWriteUserId, currentGroupId);
+
+      await users.insertMany([
+        {
+          _id: outsideUserId,
+          email: `outside-read-${suffix}@example.com`,
+          name: `Outside Read User ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+        {
+          _id: outsideWriteUserId,
+          email: `outside-write-${suffix}@example.com`,
+          name: `Outside Write User ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+      ]);
+      await groups.insertMany([
+        {
+          _id: outsideGroupId,
+          email: `outside-group-${suffix}@example.com`,
+          name: `Outside Group ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+        {
+          _id: currentGroupId,
+          email: `current-group-${suffix}@example.com`,
+          name: `Current Group ${suffix}`,
+          tenantId: CURRENT_TENANT_ID,
+        },
+      ]);
+
+      await aclEntries.insertMany([
+        {
+          principalType: PRINCIPAL_TYPE_USER,
+          principalId: currentOwner._id,
+          principalModel: PRINCIPAL_MODEL_USER,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: ownerRole.permBits,
+          roleId: ownerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+        {
+          principalType: PRINCIPAL_TYPE_USER,
+          principalId: outsideUserId,
+          principalModel: PRINCIPAL_MODEL_USER,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: viewerRole.permBits,
+          roleId: viewerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+        {
+          principalType: PRINCIPAL_TYPE_GROUP,
+          principalId: outsideGroupId,
+          principalModel: PRINCIPAL_MODEL_GROUP,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: viewerRole.permBits,
+          roleId: viewerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ]);
+
+      const authHeaders = { Authorization: `Bearer ${token}` };
+
+      const getResponse = await api.get(`/api/permissions/${RESOURCE_TYPE_AGENT}/${resourceId}`, {
+        headers: authHeaders,
+      });
+      expect(getResponse.ok()).toBeTruthy();
+      const getPayload = (await getResponse.json()) as PermissionsResponse;
+      const serializedGetPayload = JSON.stringify(getPayload);
+
+      expect(getPayload.principals).toEqual([
+        expect.objectContaining({
+          type: PRINCIPAL_TYPE_USER,
+          id: currentOwner._id.toString(),
+          email: ownerUser.email,
+          accessRoleId: ACCESS_ROLE_AGENT_OWNER,
+        }),
+      ]);
+      expect(serializedGetPayload).not.toContain(`outside-read-${suffix}@example.com`);
+      expect(serializedGetPayload).not.toContain(`outside-group-${suffix}@example.com`);
+      expect(serializedGetPayload).not.toContain(outsideUserId.toString());
+      expect(serializedGetPayload).not.toContain(outsideGroupId.toString());
+
+      const putResponse = await api.put(`/api/permissions/${RESOURCE_TYPE_AGENT}/${resourceId}`, {
+        headers: authHeaders,
+        data: {
+          updated: [
+            {
+              type: PRINCIPAL_TYPE_GROUP,
+              id: currentGroupId.toString(),
+              name: `Current Group ${suffix}`,
+              source: 'local',
+              accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+            },
+            {
+              type: PRINCIPAL_TYPE_USER,
+              id: outsideWriteUserId.toString(),
+              name: `Outside Write User ${suffix}`,
+              email: `outside-write-${suffix}@example.com`,
+              source: 'local',
+              accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+            },
+          ],
+          removed: [],
+        },
+      });
+      expect(putResponse.ok()).toBeTruthy();
+      const putPayload = (await putResponse.json()) as { results: PermissionsResponse };
+      const serializedPutPayload = JSON.stringify(putPayload);
+
+      expect(putPayload.results.principals).toEqual([
+        expect.objectContaining({
+          type: PRINCIPAL_TYPE_GROUP,
+          id: currentGroupId.toString(),
+          accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+        }),
+      ]);
+      expect(serializedPutPayload).not.toContain(outsideWriteUserId.toString());
+      expect(serializedPutPayload).not.toContain(`outside-write-${suffix}@example.com`);
+      await expect
+        .poll(() =>
+          aclEntries.countDocuments({
+            resourceType: RESOURCE_TYPE_AGENT,
+            resourceId,
+            principalId: currentGroupId,
+            tenantId: CURRENT_TENANT_ID,
+          }),
+        )
+        .toBe(1);
+      await expect
+        .poll(() =>
+          aclEntries.countDocuments({
+            resourceType: RESOURCE_TYPE_AGENT,
+            resourceId,
+            principalId: outsideWriteUserId,
+            tenantId: CURRENT_TENANT_ID,
+          }),
+        )
+        .toBe(0);
+    } finally {
+      await Promise.all([
+        aclEntries.deleteMany({ resourceId }),
+        users.deleteMany({ _id: { $in: createdIds } }),
+        groups.deleteMany({ _id: { $in: createdIds } }),
+        db.collection('roles').deleteOne({ name: role, tenantId: CURRENT_TENANT_ID }),
+        accessRoles.deleteMany({
+          accessRoleId: { $in: [ACCESS_ROLE_AGENT_OWNER, ACCESS_ROLE_AGENT_VIEWER] },
+          tenantId: CURRENT_TENANT_ID,
+        }),
+      ]);
+      await client.close();
+      await api.dispose();
+      await cleanupUser(ownerUser);
+    }
+  });
+});
diff --git a/e2e/specs/mock/projects.spec.ts b/e2e/specs/mock/projects.spec.ts
new file mode 100644
index 00000000000..a336a94d3e3
--- /dev/null
+++ b/e2e/specs/mock/projects.spec.ts
@@ -0,0 +1,149 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { MOCK_ENDPOINTS, mockReply, selectMockEndpoint, sendMessage } from './helpers';
+
+/**
+ * Creates a project from the all-projects page and returns its id.
+ * Project creation navigates to the project workspace (`/projects/:id`).
+ */
+async function createProject(page: Page, name: string): Promise<string> {
+  await page.goto('/projects', { timeout: 10000 });
+  await page.getByRole('button', { name: 'New project' }).first().click();
+
+  const dialog = page.getByRole('dialog');
+  await dialog.getByRole('textbox', { name: 'Project name' }).fill(name);
+  await dialog.getByRole('button', { name: 'Create project' }).click();
+
+  await expect(page.getByRole('heading', { name })).toBeVisible();
+  const projectId = new URL(page.url()).pathname.split('/projects/')[1];
+  expect(projectId).toBeTruthy();
+  return projectId;
+}
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+test.describe('chat projects', () => {
+  test('creates a project and lists it on the all-projects page', async ({ page }) => {
+    test.setTimeout(60000);
+    const name = uniqueName('E2E Project');
+
+    await createProject(page, name);
+
+    await page.goto('/projects', { timeout: 10000 });
+    await expect(page.getByRole('button', { name }).first()).toBeVisible();
+  });
+
+  test('starts a project-scoped chat and persists it under the project', async ({ page }) => {
+    test.setTimeout(120000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    // The workspace exposes a composer entry to start a chat in the project.
+    await expect(page.getByRole('button', { name: `New chat in ${name}` }).first()).toBeVisible();
+
+    // Open the project-scoped new-chat landing directly.
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+
+    // The interactive project chip is present, and the composer is scoped.
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await expect(input).toHaveAttribute('placeholder', new RegExp(name));
+
+    // Switch to a mock endpoint so the message streams without a real API key;
+    // the project scope must be retained across the model switch.
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Send the message; it streams a reply and the new chat opens at /c/:id.
+    const response = await sendMessage(page, 'hello from a project');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    // Expand the project in the sidebar and confirm the chat is filed under it.
+    const projectRow = page.getByRole('button', { name }).first();
+    if ((await projectRow.getAttribute('aria-expanded')) !== 'true') {
+      await projectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+
+    const conversationUrl = page.url();
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+
+    const reloadedProjectRow = page.getByRole('button', { name }).first();
+    if ((await reloadedProjectRow.getAttribute('aria-expanded')) !== 'true') {
+      await reloadedProjectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+  });
+
+  test('removes the project scope via the chip ×', async ({ page }) => {
+    test.setTimeout(60000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    await page.getByRole('button', { name: 'Remove from project' }).click();
+
+    // Chip disappears and the URL drops the project scope.
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeHidden();
+    await expect(page).toHaveURL((url) => !url.searchParams.has('projectId'));
+  });
+
+  test('drops the project scope when the scoped project is deleted', async ({ page }) => {
+    test.setTimeout(90000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Delete the scoped project from the sidebar while it is selected on the landing.
+    const row = page.getByRole('button', { name, exact: true }).first();
+    await expect(row).toBeVisible();
+    const item = row.locator('..');
+    await item.hover();
+    await item.getByRole('button', { name: 'More options' }).click();
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+    await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click();
+
+    // The stale chip is gone, the URL drops the now-dead project scope, and the
+    // composer reverts to an unscoped chat (placeholder no longer names the project).
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeHidden();
+    await expect(page).toHaveURL((url) => !url.searchParams.has('projectId'));
+    await expect(page.getByRole('textbox', { name: 'Message input' })).not.toHaveAttribute(
+      'placeholder',
+      new RegExp(name),
+    );
+  });
+
+  test('switches the project via the chip combobox', async ({ page }) => {
+    test.setTimeout(90000);
+    const nameA = uniqueName('E2E Project A');
+    const nameB = uniqueName('E2E Project B');
+    await createProject(page, nameA);
+    const projectIdA = new URL(page.url()).pathname.split('/projects/')[1];
+    await createProject(page, nameB);
+    const projectIdB = new URL(page.url()).pathname.split('/projects/')[1];
+
+    await page.goto(`/c/new?projectId=${projectIdA}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Open the combobox and pick the other project.
+    await page.locator('#project-landing-select').click();
+    await page.getByRole('option', { name: nameB }).click();
+
+    await expect(page).toHaveURL(new RegExp(`projectId=${projectIdB}`));
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toHaveAttribute(
+      'placeholder',
+      new RegExp(nameB),
+    );
+  });
+});
diff --git a/e2e/specs/mock/prompts.spec.ts b/e2e/specs/mock/prompts.spec.ts
new file mode 100644
index 00000000000..b0e39604c28
--- /dev/null
+++ b/e2e/specs/mock/prompts.spec.ts
@@ -0,0 +1,203 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  isAgentsStream,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  escapeRegExp,
+  fetchJson,
+  getAccessToken,
+  replyPrompt,
+  replyText,
+  requestJson,
+  selectMockEndpoint,
+} from './helpers';
+
+const DESCRIPTION = 'Use this prompt to verify LibreChat prompt creation in mock e2e tests.';
+const COMMAND = 'e2e-prompt';
+
+type Prompt = {
+  _id?: string;
+  groupId: string;
+  prompt: string;
+  type: 'text' | 'chat';
+};
+
+type PromptGroup = {
+  _id?: string;
+  name: string;
+  oneliner?: string;
+  command?: string;
+  productionPrompt?: Pick<Prompt, 'prompt'> | null;
+};
+
+type PromptGroupListResponse = {
+  promptGroups?: PromptGroup[];
+};
+
+const uniquePromptName = () => `E2E Prompt ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function findPromptGroup(
+  page: Page,
+  promptName: string,
+  token: string,
+): Promise<PromptGroup | null> {
+  const body = await fetchJson<PromptGroupListResponse>(
+    page,
+    `/api/prompts/groups?name=${encodeURIComponent(promptName)}&limit=10`,
+    token,
+  );
+  return body.promptGroups?.find((group) => group.name === promptName) ?? null;
+}
+
+async function waitForPersistedPrompt(
+  page: Page,
+  promptName: string,
+  expectedPrompt: string,
+): Promise<{ group: PromptGroup; prompts: Prompt[] }> {
+  const token = await getAccessToken(page);
+  let latestGroup: PromptGroup | null = null;
+  let latestPrompts: Prompt[] = [];
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const group = await findPromptGroup(page, promptName, token);
+    if (group?._id) {
+      latestGroup = await fetchJson<PromptGroup>(
+        page,
+        `/api/prompts/groups/${encodeURIComponent(group._id)}`,
+        token,
+      );
+      latestPrompts = await fetchJson<Prompt[]>(
+        page,
+        `/api/prompts?groupId=${encodeURIComponent(group._id)}`,
+        token,
+      );
+
+      const hasExpectedPrompt = latestPrompts.some((prompt) => prompt.prompt === expectedPrompt);
+      if (
+        latestGroup.oneliner === DESCRIPTION &&
+        latestGroup.command === COMMAND &&
+        latestGroup.productionPrompt?.prompt === expectedPrompt &&
+        hasExpectedPrompt
+      ) {
+        return { group: latestGroup, prompts: latestPrompts };
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestGroup, `Expected prompt group "${promptName}" to be persisted`).not.toBeNull();
+  expect(latestGroup?.oneliner).toBe(DESCRIPTION);
+  expect(latestGroup?.command).toBe(COMMAND);
+  expect(latestGroup?.productionPrompt?.prompt).toBe(expectedPrompt);
+  expect(latestPrompts.some((prompt) => prompt.prompt === expectedPrompt)).toBe(true);
+  return { group: latestGroup!, prompts: latestPrompts };
+}
+
+async function cleanupPromptGroup(page: Page, groupId?: string) {
+  if (!groupId) {
+    return;
+  }
+
+  const token = await getAccessToken(page);
+  await requestJson<{ message?: string }>(page, {
+    path: `/api/prompts/groups/${encodeURIComponent(groupId)}`,
+    token,
+    method: 'DELETE',
+  });
+}
+
+async function openPromptsPanel(page: Page) {
+  const promptsButton = page.getByRole('button', { name: 'Prompts', exact: true });
+  await expect(promptsButton).toBeVisible();
+  if ((await promptsButton.getAttribute('aria-pressed')) !== 'true') {
+    await promptsButton.click();
+  }
+  await expect(page.getByRole('search')).toBeVisible();
+}
+
+async function ensureAutoSendPrompts(page: Page) {
+  const autoSend = page.getByRole('button', { name: 'Send prompts on select' });
+  await expect(autoSend).toBeVisible();
+  if ((await autoSend.getAttribute('aria-pressed')) !== 'true') {
+    await autoSend.click();
+  }
+  await expect(autoSend).toHaveAttribute('aria-pressed', 'true');
+}
+
+test.describe('prompt manager', () => {
+  test('creates a prompt and can send it from chat', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const promptName = uniquePromptName();
+    const label = promptName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
+    const promptText = replyPrompt(label);
+    let createdGroupId: string | undefined;
+
+    try {
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await openPromptsPanel(page);
+
+      await page.getByRole('link', { name: 'Create Prompt' }).click();
+      await expect(page).toHaveURL(/\/prompts\/new$/);
+
+      await page.getByRole('textbox', { name: 'Prompt Name' }).fill(promptName);
+      await page.getByRole('textbox', { name: 'Prompt text input field' }).fill(promptText);
+      await page
+        .getByRole('textbox', { name: 'Optional: Enter a description to display for the prompt' })
+        .fill(DESCRIPTION);
+      await page
+        .getByRole('textbox', {
+          name: 'Optional: Enter a command for the prompt or name will be used',
+        })
+        .fill(COMMAND);
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/prompts' &&
+            response.status() >= 200 &&
+            response.status() < 300,
+          { timeout: 30000 },
+        ),
+        page.getByRole('button', { name: 'Create Prompt' }).click(),
+      ]);
+      const createdPrompt = (await createResponse.json()) as {
+        group?: PromptGroup;
+        prompt?: Prompt;
+      };
+      createdGroupId = createdPrompt.group?._id ?? createdPrompt.prompt?.groupId;
+
+      const { group } = await waitForPersistedPrompt(page, promptName, promptText);
+      createdGroupId = group._id ?? createdGroupId;
+      expect(createdGroupId).toBeTruthy();
+      await expect(page).toHaveURL(new RegExp(`/prompts/${createdGroupId}$`));
+      await expect(page.getByRole('button', { name: `Edit: ${promptName}` })).toBeVisible();
+
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+      await openPromptsPanel(page);
+      await ensureAutoSendPrompts(page);
+
+      await page.getByLabel('Filter prompts by name').fill(promptName);
+      const promptCard = page.getByRole('button', {
+        name: new RegExp(`^${escapeRegExp(promptName)} prompt`),
+      });
+      await expect(promptCard).toBeVisible({ timeout: 10000 });
+
+      const [response] = await Promise.all([
+        page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+        promptCard.click(),
+      ]);
+      expect(response.ok()).toBeTruthy();
+
+      await expect(page.getByTestId('messages-view').getByText(promptText)).toBeVisible();
+      await expect(page.getByTestId('messages-view').getByText(replyText(label))).toBeVisible({
+        timeout: 30000,
+      });
+    } finally {
+      await cleanupPromptGroup(page, createdGroupId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/quotes.spec.ts b/e2e/specs/mock/quotes.spec.ts
new file mode 100644
index 00000000000..104965af7df
--- /dev/null
+++ b/e2e/specs/mock/quotes.spec.ts
@@ -0,0 +1,299 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  MOCK_REPLY_TEXT,
+  NEW_CHAT_PATH,
+  messagesView,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+/**
+ * Place a real DOM Selection over `needle` inside the most recent
+ * `.message-render` that contains it, then dispatch `mouseup` so the
+ * `QuoteButton` listener fires — the deterministic equivalent of a user
+ * drag-selecting that text to summon the "Add to chat" popup.
+ */
+async function selectMessageText(page: Page, needle: string) {
+  await page.evaluate((text) => {
+    const renders = Array.from(document.querySelectorAll('.message-render'));
+    const host = [...renders].reverse().find((el) => (el.textContent ?? '').includes(text));
+    if (!host) {
+      throw new Error(`No message contains: ${text}`);
+    }
+    const walker = document.createTreeWalker(host, NodeFilter.SHOW_TEXT);
+    let node = walker.nextNode();
+    while (node) {
+      const value = node.nodeValue ?? '';
+      const index = value.indexOf(text);
+      if (index !== -1) {
+        const range = document.createRange();
+        range.setStart(node, index);
+        range.setEnd(node, index + text.length);
+        const selection = window.getSelection();
+        if (!selection) {
+          throw new Error('Selection API unavailable');
+        }
+        selection.removeAllRanges();
+        selection.addRange(range);
+        document.dispatchEvent(new MouseEvent('mouseup', { bubbles: true }));
+        return;
+      }
+      node = walker.nextNode();
+    }
+    throw new Error(`No text node contains: ${text}`);
+  }, needle);
+}
+
+/**
+ * Double-click the first word of `needle` inside the most recent message
+ * containing it, using native mouse events at that word's measured coordinates.
+ * Unlike `selectMessageText` (a programmatic Range), this exercises the
+ * browser's own double-click word selection — the path the `dblclick` listener
+ * guards. Measuring the `needle` text node itself (not the first text node in
+ * `.message-render`, which may be a `select-none` screen-reader/model-label
+ * header) keeps the click on the actual reply word, not metadata or whitespace.
+ */
+async function doubleClickWord(page: Page, needle: string) {
+  const point = await page.evaluate((text) => {
+    const renders = Array.from(document.querySelectorAll('.message-render'));
+    const host = [...renders].reverse().find((el) => (el.textContent ?? '').includes(text));
+    if (!host) {
+      throw new Error(`No message contains: ${text}`);
+    }
+    const walker = document.createTreeWalker(host, NodeFilter.SHOW_TEXT);
+    let node = walker.nextNode();
+    while (node && !(node.nodeValue ?? '').includes(text)) {
+      node = walker.nextNode();
+    }
+    if (!node) {
+      throw new Error(`No text node contains: ${text}`);
+    }
+    const index = (node.nodeValue ?? '').indexOf(text);
+    const range = document.createRange();
+    range.setStart(node, index);
+    range.setEnd(node, index + 1);
+    const r = range.getBoundingClientRect();
+    return { x: r.x + r.width / 2, y: r.y + r.height / 2 };
+  }, needle);
+  await page.mouse.dblclick(point.x, point.y);
+}
+
+const addToChat = (page: Page) => page.getByTestId('add-to-chat-button');
+const pendingChips = (page: Page) => page.getByTestId('pending-quote-chips');
+const messageQuotes = (page: Page) => messagesView(page).getByTestId('message-quotes');
+
+/** The mock model echoes this when a blockquote containing the token reached the prompt. */
+const QUOTE_ASSERTION_PASSED = 'E2E quote assertion passed: reply';
+
+/**
+ * Select `needle` inside a message and add it as a quote, asserting the pending
+ * chip count reaches `expectedCount`. Retried as a unit: a pending selection is
+ * dismissed on any scroll/layout shift (e.g. auto-scroll after a new message),
+ * which is correct UX but races with a scripted select+click — `toPass` re-runs
+ * the select+click until the chip commits. Dedup keeps re-runs idempotent.
+ */
+async function addQuote(page: Page, needle: string, expectedCount: number) {
+  await expect(async () => {
+    await selectMessageText(page, needle);
+    const button = addToChat(page);
+    await expect(button).toBeVisible({ timeout: 3000 });
+    await button.click();
+    await expect(pendingChips(page)).toHaveAttribute('data-quote-count', String(expectedCount));
+  }).toPass({ timeout: 30000 });
+}
+
+test.describe('quote references', () => {
+  test('merges a quoted excerpt into the model turn, pins it to the message, and persists across reload', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    // Seed an assistant reply to quote.
+    let response = await sendMessage(page, 'seed for quote');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+
+    // Select the reply text -> popup -> chip above the composer.
+    await addQuote(page, MOCK_REPLY_TEXT, 1);
+    await expect(pendingChips(page)).toContainText(MOCK_REPLY_TEXT);
+
+    // Send a turn that asks the mock model to confirm the quote reached the prompt.
+    response = await sendMessage(page, 'E2E_ASSERT_QUOTE:reply');
+    expect(response.ok()).toBeTruthy();
+
+    // The model received the merged blockquote (verified server-side by the mock).
+    await expect(messagesView(page).getByText(QUOTE_ASSERTION_PASSED)).toBeVisible({
+      timeout: 20000,
+    });
+    // Pending chips drained; the reference is pinned to the sent user message.
+    await expect(pendingChips(page)).toHaveCount(0);
+    await expect(messageQuotes(page)).toContainText(MOCK_REPLY_TEXT);
+
+    // Round-trips through the DB: still pinned after reload.
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+    const conversationUrl = page.url();
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(messageQuotes(page)).toContainText(MOCK_REPLY_TEXT);
+  });
+
+  test('summons the popup from a native double-click word selection', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'seed for dblclick');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+
+    // A real double-click selects the word under the cursor. Chromium commits
+    // that selection on `dblclick`, AFTER `mouseup` fires, so only a `dblclick`
+    // listener catches it — a programmatic Range (the other tests) would bypass
+    // this path entirely. Retried as a unit: auto-scroll can clear a fresh
+    // selection, which races the scripted double-click.
+    await expect(async () => {
+      await doubleClickWord(page, MOCK_REPLY_TEXT);
+      const button = addToChat(page);
+      await expect(button).toBeVisible({ timeout: 3000 });
+      await button.click();
+      await expect(pendingChips(page)).toHaveAttribute('data-quote-count', '1');
+    }).toPass({ timeout: 30000 });
+
+    // The quoted excerpt is a word from the reply, not empty.
+    await expect(pendingChips(page)).toContainText(/E2E|mock|reply/i);
+  });
+
+  test('hides the popup when the selection collapses without a mouse event', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'seed for collapse');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+
+    await expect(async () => {
+      await doubleClickWord(page, MOCK_REPLY_TEXT);
+      await expect(addToChat(page)).toBeVisible({ timeout: 3000 });
+    }).toPass({ timeout: 30000 });
+
+    // Collapse the selection the way a streaming markdown re-render does —
+    // dropping the selected text node fires only `selectionchange`, not a
+    // mouse/key event. The popup must not linger over the now-empty caret.
+    await page.evaluate(() => window.getSelection()?.collapseToEnd());
+    await expect(addToChat(page)).toBeHidden({ timeout: 5000 });
+  });
+
+  test('collapses multiple selections into one chip with a hover popup, and removes one', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const firstMessage = 'quote target alpha';
+    const popup = page.getByTestId('quote-selections-popup');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+
+    // First the assistant reply, then the user's own message.
+    await addQuote(page, MOCK_REPLY_TEXT, 1);
+    await addQuote(page, firstMessage, 2);
+
+    // Composer shows a single collapsed "2 selections" chip, not a row of two.
+    await expect(pendingChips(page)).toContainText('2 selections');
+
+    // Hovering the collapsed chip reveals a popup listing every excerpt.
+    await pendingChips(page).getByRole('listitem').hover();
+    await expect(popup).toBeVisible({ timeout: 5000 });
+    await expect(popup).toContainText(MOCK_REPLY_TEXT);
+    await expect(popup).toContainText(firstMessage);
+
+    // Remove the reply from the popup; one selection remains and collapses back
+    // to its excerpt text.
+    await popup
+      .getByRole('listitem')
+      .filter({ hasText: MOCK_REPLY_TEXT })
+      .getByRole('button', { name: /remove quote/i })
+      .click();
+    await expect(pendingChips(page)).toHaveAttribute('data-quote-count', '1');
+    await expect(pendingChips(page)).toContainText(firstMessage);
+    await expect(pendingChips(page)).not.toContainText(MOCK_REPLY_TEXT);
+
+    // Send; only the remaining quote pins to the new user message.
+    const followUp = await sendMessage(page, 'expand on this');
+    expect(followUp.ok()).toBeTruthy();
+    await expect(messageQuotes(page)).toContainText(firstMessage);
+    await expect(messageQuotes(page)).not.toContainText(MOCK_REPLY_TEXT);
+  });
+
+  test('opens the selections popup via keyboard and closes on Escape', async ({ page }) => {
+    test.setTimeout(120000);
+    const firstMessage = 'quote target beta';
+    const popup = page.getByTestId('quote-selections-popup');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await addQuote(page, MOCK_REPLY_TEXT, 1);
+    await addQuote(page, firstMessage, 2);
+
+    // The collapsed pill is a focusable disclosure: focus + Enter opens it.
+    const trigger = pendingChips(page).getByRole('button', { name: '2 selections' });
+    await trigger.focus();
+    await expect(trigger).toBeFocused();
+    await page.keyboard.press('Enter');
+    await expect(popup).toBeVisible({ timeout: 5000 });
+    await expect(popup).toContainText(MOCK_REPLY_TEXT);
+    await expect(popup).toContainText(firstMessage);
+
+    // Opening via keyboard moves focus into the popup (first excerpt's remove ×).
+    await expect(popup.getByRole('button').first()).toBeFocused();
+
+    // Escape closes it and returns focus to the composer (NOT the page top, the
+    // bug this guards against). `document.activeElement` must be a real control.
+    await page.keyboard.press('Escape');
+    await expect(popup).toBeHidden();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeFocused();
+    const focusTag = await page.evaluate(() => document.activeElement?.tagName ?? 'NONE');
+    expect(focusTag).not.toBe('BODY');
+  });
+
+  test('re-merges a persisted quote into later-turn history (durable)', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    // Turn 1: quote the assistant reply and send a (labeled) message carrying it.
+    let response = await sendMessage(page, 'seed for durable');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await addQuote(page, MOCK_REPLY_TEXT, 1);
+    response = await sendMessage(page, 'E2E_REPLY:carryquote');
+    expect(response.ok()).toBeTruthy();
+    // Wait for turn 1's generation to fully finish before sending again — a new
+    // submit is blocked while the prior turn is still streaming.
+    await expect(messagesView(page).getByText('E2E reply carryquote')).toBeVisible({
+      timeout: 20000,
+    });
+    await expect(messageQuotes(page)).toContainText(MOCK_REPLY_TEXT);
+
+    // Turn 2: no new quote. The prior quoted turn must be re-merged into history,
+    // so the model still receives the blockquote on this later turn.
+    response = await sendMessage(page, 'E2E_ASSERT_QUOTE:reply');
+    expect(response.ok()).toBeTruthy();
+    await expect(messagesView(page).getByText(QUOTE_ASSERTION_PASSED)).toBeVisible({
+      timeout: 20000,
+    });
+  });
+});
diff --git a/e2e/specs/mock/shared-links.spec.ts b/e2e/specs/mock/shared-links.spec.ts
new file mode 100644
index 00000000000..145dc8377e9
--- /dev/null
+++ b/e2e/specs/mock/shared-links.spec.ts
@@ -0,0 +1,187 @@
+import { expect, test } from '@playwright/test';
+import { MongoClient } from 'mongodb';
+import type { Collection, ObjectId } from 'mongodb';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+import {
+  MOCK_ENDPOINTS,
+  MOCK_REPLY_TEXT,
+  NEW_CHAT_PATH,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+type SharedLinkDoc = {
+  _id?: ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  messages?: ObjectId[];
+  shareId: string;
+  isPublic?: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+type StoredSharedLinkDoc = SharedLinkDoc & {
+  _id: ObjectId;
+  messages: ObjectId[];
+};
+
+type AclEntryDoc = {
+  _id: ObjectId;
+  principalType: string;
+  resourceType: string;
+  resourceId: ObjectId;
+};
+
+const randomSuffix = () => `${Date.now()}-${Math.floor(Math.random() * 10000)}`;
+
+async function connectToE2EDb() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for shared-links mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  return { client, db: client.db() };
+}
+
+async function waitForSharedLink(
+  sharedLinks: Collection<SharedLinkDoc>,
+  shareId: string,
+): Promise<StoredSharedLinkDoc> {
+  const deadline = Date.now() + 15000;
+
+  while (Date.now() < deadline) {
+    const share = await sharedLinks.findOne({ shareId });
+    if (share?._id && Array.isArray(share.messages) && share.messages.length > 0) {
+      return share as StoredSharedLinkDoc;
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+
+  throw new Error(`Timed out waiting for persisted shared link ${shareId}`);
+}
+
+test.describe('shared links', () => {
+  test.setTimeout(120000);
+
+  test('creates a shared link and preserves legacy public links through runtime migration', async ({
+    page,
+    baseURL,
+  }) => {
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for shared-link mock e2e tests');
+    }
+
+    const suffix = randomSuffix();
+    const userMessage = `Shared link e2e ${suffix}`;
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, userMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(userMessage)).toBeVisible();
+    await expect(mockReply(page)).toBeVisible();
+
+    await expect(page).toHaveURL(/\/c\/(?!new)[0-9a-fA-F-]{36}$/);
+    const conversationUrl = new URL(page.url());
+    const conversationId = conversationUrl.pathname.split('/').pop();
+    if (!conversationId) {
+      throw new Error(`Could not parse conversation id from ${conversationUrl.href}`);
+    }
+
+    await page.getByRole('button', { name: 'Export options' }).click();
+    await page.getByTestId('share-conversation-menu-item').click();
+    await expect(page.getByRole('dialog', { name: 'Share link to chat' })).toBeVisible();
+
+    const [shareResponse] = await Promise.all([
+      page.waitForResponse(
+        (res) =>
+          res.request().method() === 'POST' &&
+          res.url().includes(`/api/share/${conversationId}`) &&
+          res.status() === 200,
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Create link' }).click(),
+    ]);
+    expect(shareResponse.ok()).toBeTruthy();
+    const sharePayload = (await shareResponse.json()) as { shareId?: string };
+    if (!sharePayload.shareId) {
+      throw new Error('Expected create-share response to include a shareId');
+    }
+
+    await expect(page.getByTestId('shared-link-url')).toContainText('/share/');
+    await expect(page.getByRole('button', { name: 'Manage Access' })).toBeVisible();
+    const sharedLinkUrl = (await page.getByTestId('shared-link-url').textContent())?.trim();
+    if (!sharedLinkUrl) {
+      throw new Error('Expected shared-link URL to be rendered after creating a link');
+    }
+
+    await page.goto(new URL(sharedLinkUrl, baseURL).pathname, { timeout: 10000 });
+    await expect(page).toHaveURL(/\/share\/.+/);
+    await expect(page.getByTestId('messages-view').getByText(userMessage)).toBeVisible();
+    await expect(mockReply(page)).toBeVisible();
+
+    const { client, db } = await connectToE2EDb();
+    const aclEntries = db.collection<AclEntryDoc>('aclentries');
+    const sharedLinks = db.collection<SharedLinkDoc>('sharedlinks');
+    const legacyShareId = `legacy-${suffix}`;
+    let legacyResourceId: ObjectId | undefined;
+
+    try {
+      const createdShare = await waitForSharedLink(sharedLinks, sharePayload.shareId);
+      const legacyShare = {
+        shareId: legacyShareId,
+        conversationId: createdShare.conversationId,
+        title: createdShare.title ?? `Legacy shared link ${suffix}`,
+        ...(createdShare.user ? { user: createdShare.user } : {}),
+        messages: createdShare.messages,
+        isPublic: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+      const insertResult = await sharedLinks.insertOne(legacyShare);
+      const resourceId = insertResult.insertedId;
+      legacyResourceId = resourceId;
+
+      await page.goto(`/share/${legacyShareId}`, { timeout: 10000 });
+      await expect(page.getByTestId('messages-view').getByText(userMessage)).toBeVisible();
+      await expect(mockReply(page)).toBeVisible();
+
+      await expect
+        .poll(
+          async () =>
+            aclEntries.countDocuments({
+              resourceType: 'sharedLink',
+              resourceId,
+              principalType: 'public',
+            }),
+          { timeout: 15000 },
+        )
+        .toBe(1);
+
+      await expect
+        .poll(
+          async () => {
+            const migrated = await sharedLinks.findOne({ _id: resourceId });
+            return migrated != null && !Object.prototype.hasOwnProperty.call(migrated, 'isPublic');
+          },
+          { timeout: 15000 },
+        )
+        .toBe(true);
+    } finally {
+      if (legacyResourceId) {
+        await Promise.all([
+          aclEntries.deleteMany({ resourceId: legacyResourceId }),
+          sharedLinks.deleteOne({ _id: legacyResourceId }),
+        ]);
+      }
+      await client.close();
+    }
+  });
+});
diff --git a/e2e/specs/mock/sidebar.spec.ts b/e2e/specs/mock/sidebar.spec.ts
new file mode 100644
index 00000000000..e622145d4b8
--- /dev/null
+++ b/e2e/specs/mock/sidebar.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+
+/** Size of the virtualized chat list grid vs. its measured container. */
+const sizes = (page: Page) =>
+  page.evaluate(() => {
+    const grid = document.querySelector<HTMLElement>('aside .ReactVirtualized__Grid');
+    const wrap = grid?.parentElement ?? null;
+    const gridRect = grid?.getBoundingClientRect();
+    const wrapRect = wrap?.getBoundingClientRect();
+    return {
+      grid: gridRect ? gridRect.width : -1,
+      wrap: wrapRect ? wrapRect.width : -1,
+      gridH: gridRect ? gridRect.height : -1,
+      wrapH: wrapRect ? wrapRect.height : -1,
+    };
+  });
+
+/**
+ * Polls until the grid matches its container AND the size has stopped changing
+ * between samples — the sidebar expand/collapse animation runs for 300ms, and a
+ * tracking-only check can match mid-animation on slow CI machines.
+ */
+const settledSizes = async (page: Page) => {
+  let prev = await sizes(page);
+  for (let attempt = 0; attempt < 40; attempt++) {
+    await page.waitForTimeout(350);
+    const next = await sizes(page);
+    const tracked =
+      next.wrap > 0 &&
+      next.wrapH > 0 &&
+      Math.abs(next.grid - next.wrap) <= 1 &&
+      Math.abs(next.gridH - next.wrapH) <= 1;
+    const stable = Math.abs(next.grid - prev.grid) <= 1 && Math.abs(next.gridH - prev.gridH) <= 1;
+    if (tracked && stable) {
+      return next;
+    }
+    prev = next;
+  }
+  throw new Error(`Sidebar chat list never settled: ${JSON.stringify(prev)}`);
+};
+
+test.describe('sidebar chat list', () => {
+  test('chat list width tracks the sidebar through resize and collapse cycles', async ({
+    page,
+  }) => {
+    test.setTimeout(60000);
+    await page.goto('/c/new', { timeout: 10000 });
+    await expect(page.locator('aside .ReactVirtualized__Grid').first()).toBeVisible({
+      timeout: 20000,
+    });
+
+    const initial = await settledSizes(page);
+
+    const separator = page.locator('[role="separator"][aria-label="Resize sidebar"]');
+    const sepBox = await separator.boundingBox();
+    expect(sepBox).not.toBeNull();
+    const startX = (sepBox?.x ?? 0) + (sepBox?.width ?? 0) / 2;
+    const y = (sepBox?.y ?? 0) + (sepBox?.height ?? 0) / 2;
+
+    await page.mouse.move(startX, y);
+    await page.mouse.down();
+    for (let i = 1; i <= 5; i++) {
+      await page.mouse.move(startX + i * 20, y);
+      await page.waitForTimeout(50);
+    }
+    await page.mouse.up();
+
+    const widened = await settledSizes(page);
+    expect(widened.grid).toBeGreaterThan(initial.grid);
+
+    await page.locator('aside').getByTestId('close-sidebar-button').click();
+    await page.locator('aside').getByTestId('open-sidebar-button').click();
+
+    const reopened = await settledSizes(page);
+    expect(reopened.grid).toBeGreaterThan(initial.grid);
+
+    await page.setViewportSize({ width: 1280, height: 540 });
+    const shrunken = await settledSizes(page);
+    expect(shrunken.gridH).toBeLessThan(reopened.gridH);
+  });
+});
diff --git a/e2e/specs/mock/skill-file-authoring.spec.ts b/e2e/specs/mock/skill-file-authoring.spec.ts
new file mode 100644
index 00000000000..529a2991bf2
--- /dev/null
+++ b/e2e/specs/mock/skill-file-authoring.spec.ts
@@ -0,0 +1,128 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  enableSkills,
+  fetchJson,
+  getAccessToken,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const FINAL_TEXT = 'E2E file authoring complete';
+const EDIT_FINAL_TEXT = 'E2E file edit complete';
+const DESCRIPTION =
+  'Use this skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const EDITED_DESCRIPTION =
+  'Use this edited skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+};
+
+const uniqueSkillName = () => `e2e-file-authoring-${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function findSkill(
+  page: Page,
+  skillName: string,
+  token: string,
+): Promise<SkillSummary | null> {
+  const body = await fetchJson<{ skills?: SkillSummary[] }>(
+    page,
+    `/api/skills?search=${encodeURIComponent(skillName)}&limit=10`,
+    token,
+  );
+  return body.skills?.find((skill) => skill.name === skillName) ?? null;
+}
+
+async function waitForPersistedSkill(
+  page: Page,
+  skillName: string,
+  expectedDescription = DESCRIPTION,
+): Promise<SkillDetail> {
+  const token = await getAccessToken(page);
+  let latestSkill: SkillDetail | null = null;
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const skill = await findSkill(page, skillName, token);
+    if (skill) {
+      latestSkill = await fetchJson<SkillDetail>(
+        page,
+        `/api/skills/${encodeURIComponent(skill._id)}`,
+        token,
+      );
+      if (latestSkill.description === expectedDescription) {
+        return latestSkill;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestSkill, `Expected skill "${skillName}" to be persisted`).not.toBeNull();
+  expect(latestSkill?.description).toBe(expectedDescription);
+  return latestSkill!;
+}
+
+test.describe('skill file authoring tools', () => {
+  test('creates and edits a skill without enabling code execution', async ({ page }) => {
+    test.setTimeout(120000);
+    const skillName = uniqueSkillName();
+    const prompt = [
+      `${FINAL_TEXT} request`,
+      `E2E_CREATE_SKILL:${skillName}`,
+      'Create the skill file using host file authoring only.',
+    ].join('\n');
+    const editPrompt = [
+      `${EDIT_FINAL_TEXT} request`,
+      `E2E_EDIT_SKILL:${skillName}`,
+      'Edit the skill file using host file authoring only.',
+    ].join('\n');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+    await enableSkills(page);
+
+    const response = await sendMessage(page, prompt);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+    const conversationPath = new URL(page.url()).pathname;
+    await expect(
+      page.getByTestId('messages-view').getByText(`${FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    const skill = await waitForPersistedSkill(page, skillName);
+    expect(skill.description).toBe(DESCRIPTION);
+    expect(skill.body).toContain(`name: ${skillName}`);
+    expect(skill.body).toContain(DESCRIPTION);
+
+    const editResponse = await sendMessage(page, editPrompt);
+    expect(editResponse.ok()).toBeTruthy();
+
+    await expect(
+      page.getByTestId('messages-view').getByText(`${EDIT_FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    const editedSkill = await waitForPersistedSkill(page, skillName, EDITED_DESCRIPTION);
+    expect(editedSkill.body).toContain(EDITED_DESCRIPTION);
+
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL((url) => url.pathname === conversationPath);
+    await expect(
+      page.getByTestId('messages-view').getByText(`${FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+    await expect(
+      page.getByTestId('messages-view').getByText(`${EDIT_FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    await page.goto(`/skills/${editedSkill._id}`, { timeout: 10000 });
+    await expect(page.getByRole('heading', { level: 1, name: skillName })).toBeVisible();
+    await expect(page.getByText(EDITED_DESCRIPTION)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/soft-default.spec.ts b/e2e/specs/mock/soft-default.spec.ts
new file mode 100644
index 00000000000..724cc7c40e4
--- /dev/null
+++ b/e2e/specs/mock/soft-default.spec.ts
@@ -0,0 +1,187 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  NEW_CHAT_PATH,
+  getAccessToken,
+  mockReply,
+  requestJson,
+  selectModelSpec,
+  sendMessage,
+} from './helpers';
+
+/** Label of the `softDefault: true` spec in e2e/config/librechat.e2e.yaml. */
+const SOFT_DEFAULT_LABEL = 'E2E Soft Default';
+
+/** Ephemeral endpoint from e2e/config/librechat.e2e.yaml with no mirroring spec. */
+const EPHEMERAL_ENDPOINT = { label: 'Mock Provider C', model: 'mock-model-c' };
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+const modelTrigger = (page: Page) => page.getByRole('button', { name: 'Select a model' }).first();
+
+/** Reset selection state so the test starts as a fresh instance (auth stays in cookies). */
+async function startFresh(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await page.evaluate(() => localStorage.clear());
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+}
+
+type AgentResponse = {
+  id: string;
+  name?: string | null;
+};
+
+async function createAgent(page: Page, name: string): Promise<AgentResponse> {
+  const token = await getAccessToken(page);
+  return requestJson<AgentResponse>(page, {
+    path: '/api/agents',
+    token,
+    method: 'POST',
+    body: {
+      name,
+      provider: 'Mock Provider A',
+      model: 'mock-model-a',
+      model_parameters: {},
+    },
+  });
+}
+
+async function selectAgent(page: Page, agentName: string) {
+  await modelTrigger(page).click();
+  await page.getByRole('option', { name: 'My Agents' }).click();
+  await page.getByRole('option', { name: agentName }).click();
+  await expect(modelTrigger(page)).toContainText(agentName);
+}
+
+async function selectEphemeralModel(page: Page) {
+  await modelTrigger(page).click();
+  await page.getByRole('option', { name: EPHEMERAL_ENDPOINT.label }).click();
+  await page.getByRole('option', { name: EPHEMERAL_ENDPOINT.model, exact: true }).click();
+  await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model);
+}
+
+async function sendAndAwaitReply(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+}
+
+async function newChat(page: Page) {
+  await page.getByTestId('new-chat-button').click();
+  await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+}
+
+test.describe('soft default model spec', () => {
+  test('applies the soft default on a fresh instance and stays applied across reloads', async ({
+    page,
+  }) => {
+    await startFresh(page);
+
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    // Its own auto-application must not convert it into a sticky "last" selection
+    // that would behave differently on the next load.
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+  });
+
+  test('a previously selected agent outranks the soft default', async ({ page }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    const agentName = uniqueName('E2E Soft Agent');
+    await createAgent(page, agentName);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectAgent(page, agentName);
+
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(agentName, { timeout: 15000 });
+
+    await page.getByTestId('new-chat-button').click();
+    await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+    await expect(modelTrigger(page)).toContainText(agentName, { timeout: 15000 });
+  });
+
+  test('a previous ephemeral endpoint and model selection outranks the soft default', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await selectEphemeralModel(page);
+
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model, { timeout: 15000 });
+    await expect(modelTrigger(page)).not.toContainText(SOFT_DEFAULT_LABEL);
+
+    await page.getByTestId('new-chat-button').click();
+    await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+    await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model, { timeout: 15000 });
+  });
+
+  test('stays soft on New Chat after the first conversation is sent', async ({ page }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await sendAndAwaitReply(page, 'first soft conversation');
+
+    await newChat(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+  });
+
+  test('viewing the soft conversation re-arms it on the next New Chat', async ({ page }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await sendAndAwaitReply(page, 'soft history conversation');
+    const softConvoUrl = page.url();
+
+    await newChat(page);
+    await selectEphemeralModel(page);
+
+    await page.goto(softConvoUrl, { timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    // Fresh load (not the in-memory SPA transition, which masks the regression): the
+    // cold ChatRoute path resolves the New Chat purely from getDefaultModelSpec.
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+    await expect(modelTrigger(page)).not.toHaveText('Select a model');
+  });
+
+  // Regression: softDefault spec on an endpoint kept out of `addedEndpoints` (e.g. a
+  // bedrock spec with `addedEndpoints: [agents, <custom>]`). Using the custom endpoint
+  // leaves a model in history under a key the spec preset never matches, which used to
+  // suppress the soft default and strand a freshly loaded New Chat on the unselectable
+  // endpoint ("Select a model"). The spec must re-arm when it was the conversation used
+  // last. A cold load is used because the SPA New Chat transition resolves non-
+  // deterministically and can mask the dropped spec.
+  test('re-arms on a fresh New Chat when the spec endpoint is outside the allow-list', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await selectEphemeralModel(page);
+    await sendAndAwaitReply(page, 'history on a different endpoint');
+
+    await newChat(page);
+    await selectModelSpec(page, SOFT_DEFAULT_LABEL);
+    await sendAndAwaitReply(page, 'soft spec used last');
+    const specConvoUrl = page.url();
+
+    await page.goto(specConvoUrl, { timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+    await expect(modelTrigger(page)).not.toHaveText('Select a model');
+  });
+});
diff --git a/e2e/specs/mock/two-factor.spec.ts b/e2e/specs/mock/two-factor.spec.ts
new file mode 100644
index 00000000000..d1f3245179d
--- /dev/null
+++ b/e2e/specs/mock/two-factor.spec.ts
@@ -0,0 +1,42 @@
+import { expect, test } from '@playwright/test';
+import { NEW_CHAT_PATH } from './helpers';
+
+/**
+ * Regression test for the framer-motion / Vite incompatibility that crashed the
+ * client with "e is not a function" when opening the Enable 2FA dialog
+ * (issue #13511). The dialog body is a framer-motion `<motion.div>`; on the
+ * broken build it throws while rendering, so the dialog never appears.
+ *
+ * This only reproduces in a production build (the mock harness builds the client
+ * via `e2e:prepare`), matching the original report.
+ */
+test.describe('account settings · two-factor dialog', () => {
+  test('opening the Enable 2FA dialog renders without a framer-motion crash', async ({ page }) => {
+    test.setTimeout(60000);
+
+    const framerErrors: string[] = [];
+    page.on('pageerror', (error) => {
+      if (/is not a function/i.test(error.message)) {
+        framerErrors.push(error.message);
+      }
+    });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await page.getByTestId('nav-user').click();
+    await page.getByRole('menuitem', { name: 'Settings' }).click();
+    await page.getByRole('tab', { name: 'Account' }).click();
+
+    // Opening the dialog mounts the framer-motion-animated body — the crash site.
+    await page.getByRole('button', { name: 'Enable 2FA' }).click();
+
+    // With the broken framer-motion build this content never renders.
+    await expect(page.locator('#two-factor-authentication-dialog')).toBeVisible({ timeout: 15000 });
+    await expect(page.getByRole('button', { name: 'Generate QR Code' })).toBeVisible();
+
+    expect(
+      framerErrors,
+      `framer-motion threw while rendering the 2FA dialog: ${framerErrors.join(' | ')}`,
+    ).toEqual([]);
+  });
+});
diff --git a/e2e/specs/mock/usage.spec.ts b/e2e/specs/mock/usage.spec.ts
new file mode 100644
index 00000000000..1d854870941
--- /dev/null
+++ b/e2e/specs/mock/usage.spec.ts
@@ -0,0 +1,230 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  mockReply,
+  sendMessage,
+  messagesView,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  isAgentsStream,
+  selectMockEndpoint,
+} from './helpers';
+
+const gauge = (page: Page) => page.getByTestId('token-usage');
+const gaugeMeter = (page: Page) => gauge(page).getByRole('meter');
+
+async function expectGaugeAboveZero(page: Page) {
+  await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+  await expect(gaugeMeter(page)).toHaveAttribute('aria-valuenow', /[1-9]/, { timeout: 20000 });
+}
+
+/** Opens the gauge breakdown popover (click, not hover) and returns its region. */
+async function openBreakdown(page: Page) {
+  await expectGaugeAboveZero(page);
+  await gauge(page).click();
+  const popover = page.getByRole('region', { name: 'Context usage' });
+  await expect(popover).toBeVisible({ timeout: 10000 });
+  return popover;
+}
+
+/** Granularity lives only in the live `on_context_usage` snapshot; its rows
+ *  render under the `context-breakdown` testid, the coarse message-history
+ *  fallback under `context-estimate`. They are mutually exclusive. */
+async function expectGranular(page: Page) {
+  const popover = await openBreakdown(page);
+  await expect(popover.getByTestId('context-breakdown')).toBeVisible({ timeout: 10000 });
+  await expect(popover.getByTestId('context-estimate')).toHaveCount(0);
+  await expect(popover.getByText('Messages', { exact: true })).toBeVisible();
+  await expect(popover.getByText('Free space', { exact: true })).toBeVisible();
+}
+
+async function sendAndAwaitReply(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+}
+
+test.describe('context usage gauge', () => {
+  test('tracks usage from live SSE events and survives reload', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    // REQUIRED so the message streams without a real key.
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'hello');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    /** Live path: the agents pipeline's context snapshot + usage events fill the gauge */
+    await expectGaugeAboveZero(page);
+
+    /** Breakdown popover: context section always; the usage section is
+     *  scoped by testid since the pre-snapshot fallback renders its own
+     *  Input/Output rows when the lib predates on_context_usage */
+    await gauge(page).click();
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await expect(popover.getByText('Context window')).toBeVisible();
+    const usageSection = popover.getByTestId('token-usage-totals');
+    await expect(usageSection).toBeVisible({ timeout: 10000 });
+    await expect(usageSection.getByText('Input', { exact: true })).toBeVisible();
+    await expect(usageSection.getByText('Output', { exact: true })).toBeVisible();
+
+    /** Cost row: interface.contextCost is enabled in the harness yaml, the
+     *  token-config endpoint prices mock models at the default rate, and the
+     *  fake model emits usage — so a $ value must render. A single (unbranched)
+     *  conversation shows only the branch cost, no all-branches total line. */
+    const costSection = popover.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    await expect(costSection.getByText(/\$\d|<\$0\.01/)).toBeVisible();
+    await expect(costSection.getByText('All branches')).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    /** Persistence (Parts A + B): after reload the breakdown rehydrates from
+     *  the response message's metadata.contextUsage + metadata.usage — the
+     *  granular rows AND the branch cost survive without generating a turn. */
+    await page.reload({ timeout: 15000 });
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expectGaugeAboveZero(page);
+    const reloaded = await openBreakdown(page);
+    await expect(reloaded.getByTestId('context-breakdown')).toBeVisible({ timeout: 10000 });
+    const reloadedCost = reloaded.getByTestId('token-usage-cost');
+    await expect(reloadedCost).toBeVisible();
+    await expect(reloadedCost.getByText(/\$\d|<\$0\.01/)).toBeVisible();
+  });
+
+  test('renders the granular breakdown from the live context snapshot', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** The agents pipeline emits on_context_usage on each model call, so the
+     *  breakdown — not the estimate fallback — drives the popover. */
+    await expectGranular(page);
+  });
+
+  test('shows branch cost with an all-branches total after regenerating', async ({ page }) => {
+    test.setTimeout(150000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** Single branch: branch cost == total, so no all-branches line renders. */
+    let popover = await openBreakdown(page);
+    await expect(popover.getByTestId('token-usage-cost')).toBeVisible();
+    await expect(popover.getByText('All branches')).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    /** Regenerate to create a sibling branch (B). */
+    const assistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await assistantMessage.hover();
+    const regenerateButton = assistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+    const [regen] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regen.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible({ timeout: 20000 });
+
+    /** Branch cost is shown live for the regenerated branch. */
+    popover = await openBreakdown(page);
+    await expect(popover.getByTestId('token-usage-cost')).toBeVisible();
+    await page.keyboard.press('Escape');
+
+    /** After reload both branches rehydrate from persisted metadata.usage, so
+     *  the cost is branch-scoped and a muted all-branches total appears (it
+     *  exceeds the single viewed branch). */
+    await page.reload({ timeout: 15000 });
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    const reloaded = await openBreakdown(page);
+    const costSection = reloaded.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    await expect(costSection.getByText('Cost (this branch)')).toBeVisible();
+    await expect(costSection.getByText('All branches')).toBeVisible();
+  });
+
+  test('preserves the granular breakdown after switching branches', async ({ page }) => {
+    test.setTimeout(150000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** Branch A: the just-generated branch shows its live snapshot. */
+    await expectGranular(page);
+    await page.keyboard.press('Escape');
+
+    /** Regenerate to create a sibling branch (B), which overwrites the single
+     *  live snapshot and anchors it to B's response (proven selectors mirror
+     *  chat.spec.ts's branch test). */
+    const assistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await assistantMessage.hover();
+    const regenerateButton = assistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+    const [regen] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regen.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible({ timeout: 20000 });
+
+    /** Switch back to branch A. Its live snapshot was overwritten by B, so the
+     *  rows can only survive via the per-anchor snapshot history map. */
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible({ timeout: 10000 });
+
+    await expectGranular(page);
+
+    /** Branch cost must also survive the switch (live, no reload): branch A's
+     *  flushed usage is restored from the sticky usage history even though its
+     *  cache message lacks metadata.usage and B's regenerate dropped it. */
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    const costSection = popover.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    /** Branch A also has siblings, so both a branch-cost row and an all-branches
+     *  total render — assert at least one cost value is present. */
+    await expect(costSection.getByText(/\$\d|<\$0\.01/).first()).toBeVisible();
+  });
+
+  test('hides on a new chat, then reveals snapshot on hover and breakdown on click', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    /** A fresh, message-less chat shows no gauge (it is not mounted). */
+    await expect(gauge(page)).toHaveCount(0);
+
+    await sendAndAwaitReply(page, 'hello');
+    await expectGaugeAboveZero(page);
+
+    /** Hover surfaces the compact snapshot tooltip — not the full breakdown. */
+    await gauge(page).hover();
+    const tooltip = page.getByRole('tooltip');
+    await expect(tooltip).toBeVisible({ timeout: 10000 });
+    await expect(tooltip).toContainText('Context');
+    await expect(page.getByRole('region', { name: 'Context usage' })).toHaveCount(0);
+
+    /** Click opens the breakdown popover; Escape (focus-away) closes it. */
+    await gauge(page).click();
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await expect(popover.getByText('Context window')).toBeVisible();
+    await page.keyboard.press('Escape');
+    await expect(popover).toBeHidden({ timeout: 10000 });
+
+    /** Reopen, then dismiss by clicking outside (blur). */
+    await gauge(page).click();
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await messagesView(page).click({ position: { x: 5, y: 5 } });
+    await expect(popover).toBeHidden({ timeout: 10000 });
+  });
+});
diff --git a/e2e/specs/nav.spec.ts b/e2e/specs/nav.spec.ts
index e902c461cd1..0b29fa0ca49 100644
--- a/e2e/specs/nav.spec.ts
+++ b/e2e/specs/nav.spec.ts
@@ -2,7 +2,7 @@ import { expect, test } from '@playwright/test';
 
 test.describe('Navigation suite', () => {
   test('Navigation bar', async ({ page }) => {
-    await page.goto('http://localhost:3080/', { timeout: 5000 });
+    await page.goto('/', { timeout: 5000 });
 
     await page.getByTestId('nav-user').click();
     const navSettings = await page.getByTestId('nav-user').isVisible();
@@ -10,49 +10,23 @@ test.describe('Navigation suite', () => {
   });
 
   test('Settings modal', async ({ page }) => {
-    await page.goto('http://localhost:3080/', { timeout: 5000 });
+    await page.goto('/', { timeout: 5000 });
     await page.getByTestId('nav-user').click();
-    await page.getByText('Settings').click();
+    await page.getByRole('menuitem', { name: 'Settings' }).click();
 
-    const modal = await page.getByRole('dialog', { name: 'Settings' }).isVisible();
-    expect(modal).toBeTruthy();
+    const modal = page.getByRole('dialog', { name: /Settings/ });
 
-    const modalTitle = await page.getByRole('heading', { name: 'Settings' }).textContent();
+    const modalHeading = modal.getByRole('heading', { name: 'Settings' });
+    await expect(modalHeading).toBeVisible();
+    const modalTitle = await modalHeading.textContent();
     expect(modalTitle?.length).toBeGreaterThan(0);
     expect(modalTitle).toEqual('Settings');
 
-    const modalTabList = await page.getByRole('tablist', { name: 'Settings' }).isVisible();
-    expect(modalTabList).toBeTruthy();
+    await expect(modal.getByRole('tablist', { name: 'Settings' })).toBeVisible();
+    await expect(modal.getByRole('tabpanel', { name: 'General' })).toBeVisible();
+    await expect(modal.getByRole('combobox', { name: 'Theme' })).toBeVisible();
 
-    const generalTabPanel = await page.getByRole('tabpanel', { name: 'General' }).isVisible();
-    expect(generalTabPanel).toBeTruthy();
-
-    const modalClearConvos = await page.getByRole('button', { name: 'Clear' }).isVisible();
-    expect(modalClearConvos).toBeTruthy();
-
-    const modalTheme = page.getByTestId('theme-selector');
-    expect(modalTheme).toBeTruthy();
-
-    async function changeMode(theme: string) {
-      // Ensure Element Visibility:
-      await page.waitForSelector('[data-testid="theme-selector"]');
-      await modalTheme.click();
-
-      await page.click(`[data-theme="${theme}"]`);
-
-      // Wait for the theme change
-      await page.waitForTimeout(1000);
-
-      // Check if the HTML element has the theme class
-      const html = await page.$eval(
-        'html',
-        (element, selectedTheme) => element.classList.contains(selectedTheme.toLowerCase()),
-        theme,
-      );
-      expect(html).toBeTruthy();
-    }
-
-    await changeMode('dark');
-    await changeMode('light');
+    await modal.getByRole('button', { name: 'Close Settings' }).click();
+    await expect(modalHeading).toBeHidden();
   });
 });
diff --git a/e2e/specs/real/usage.spec.ts b/e2e/specs/real/usage.spec.ts
new file mode 100644
index 00000000000..f7cedbe1aee
--- /dev/null
+++ b/e2e/specs/real/usage.spec.ts
@@ -0,0 +1,122 @@
+import { expect, test } from '@playwright/test';
+import type { Page, TestInfo } from '@playwright/test';
+import { sendMessage, selectMockEndpoint } from '../mock/helpers';
+
+/**
+ * LOCAL-ONLY real-provider verification: drives multiple turns against real
+ * Anthropic and asserts the context gauge tracks genuine provider usage.
+ * Runs only via e2e/playwright.config.real.ts (requires ANTHROPIC_API_KEY).
+ */
+
+const REAL_MODEL = process.env.E2E_REAL_ANTHROPIC_MODEL ?? 'claude-haiku-4-5';
+
+const gauge = (page: Page) => page.getByTestId('token-usage');
+const gaugeMeter = (page: Page) => gauge(page).getByRole('meter');
+const popover = (page: Page) => page.getByRole('region', { name: 'Context usage' });
+
+async function gaugeValue(page: Page): Promise<number> {
+  const raw = await gaugeMeter(page).getAttribute('aria-valuenow');
+  const value = Number(raw);
+  expect(Number.isFinite(value)).toBe(true);
+  return value;
+}
+
+/** Parses formatTokens output ("950", "1.2K", "2M") back to a number. */
+function parseTokens(text: string): number {
+  const match = text.trim().match(/^([\d.]+)([KM])?/i);
+  if (!match) {
+    return NaN;
+  }
+  const suffix = match[2]?.toUpperCase();
+  let scale = 1;
+  if (suffix === 'M') {
+    scale = 1e6;
+  } else if (suffix === 'K') {
+    scale = 1e3;
+  }
+  return parseFloat(match[1]) * scale;
+}
+
+async function readUsageTotals(page: Page): Promise<{ input: number; output: number }> {
+  await gauge(page).hover();
+  const section = popover(page).getByTestId('token-usage-totals');
+  await expect(section).toBeVisible({ timeout: 15000 });
+  const rows = section.locator('div');
+  const input = parseTokens(
+    (await rows.filter({ hasText: 'Input' }).first().locator('span').last().innerText()) ?? '',
+  );
+  const output = parseTokens(
+    (await rows.filter({ hasText: 'Output' }).first().locator('span').last().innerText()) ?? '',
+  );
+  await page.keyboard.press('Escape');
+  return { input, output };
+}
+
+async function sendTurn(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  /** Settle: streaming over once the stop button yields back to send */
+  await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+    timeout: 90000,
+  });
+  await expect(page.getByTestId('send-button')).toBeVisible({ timeout: 30000 });
+}
+
+test.describe('context usage gauge with a real provider', () => {
+  test('grows across turns and reflects real usage', async ({ page }, testInfo: TestInfo) => {
+    test.setTimeout(300000);
+    await page.goto('/c/new', { timeout: 15000 });
+
+    await selectMockEndpoint(page, { label: 'Anthropic', model: REAL_MODEL } as never);
+
+    /** Turn 1 */
+    await sendTurn(page, 'Reply with exactly one word: alpha');
+    await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+    const v1 = await gaugeValue(page);
+    expect(v1).toBeGreaterThan(0);
+    const totals1 = await readUsageTotals(page);
+    expect(totals1.input).toBeGreaterThan(0);
+    expect(totals1.output).toBeGreaterThan(0);
+    await gauge(page).hover();
+    await expect(popover(page).getByText('Messages')).toBeVisible();
+    await expect(popover(page).getByText('Free space')).toBeVisible();
+    await expect(popover(page).getByText('Session cost')).toBeVisible();
+    await expect(popover(page).getByText(/\$\d|<\$0\.01/)).toBeVisible();
+    await page.screenshot({ path: testInfo.outputPath('turn1-popover.png') });
+    await page.keyboard.press('Escape');
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    /** Turn 2: context must include turn 1 — gauge and totals grow */
+    await sendTurn(page, 'Reply with exactly one word: beta');
+    const v2 = await gaugeValue(page);
+    expect(v2).toBeGreaterThan(v1);
+    const totals2 = await readUsageTotals(page);
+    expect(totals2.input).toBeGreaterThan(totals1.input);
+    expect(totals2.output).toBeGreaterThan(totals1.output);
+
+    /** Turn 3 */
+    await sendTurn(page, 'Reply with exactly one word: gamma');
+    const v3 = await gaugeValue(page);
+    expect(v3).toBeGreaterThan(v2);
+    await gauge(page).hover();
+    await expect(popover(page)).toBeVisible({ timeout: 15000 });
+    await page.screenshot({ path: testInfo.outputPath('turn3-popover.png') });
+    await page.keyboard.press('Escape');
+
+    /** Reload: gauge rebuilds from persisted per-message token counts once
+     *  the messages query resolves — retry until the meter leaves zero */
+    await page.reload({ timeout: 20000 });
+    await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+    await expect(gaugeMeter(page)).toHaveAttribute('aria-valuenow', /[1-9]/, { timeout: 20000 });
+    const vReload = await gaugeValue(page);
+    expect(vReload).toBeGreaterThan(0);
+    await gauge(page).hover();
+    await expect(popover(page)).toBeVisible({ timeout: 15000 });
+    await page.screenshot({ path: testInfo.outputPath('reload-popover.png') });
+
+    testInfo.annotations.push({
+      type: 'observed',
+      description: `v1=${v1} v2=${v2} v3=${v3} reload=${vReload} input1=${totals1.input} input2=${totals2.input}`,
+    });
+  });
+});
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 59c348374d3..800e71f69db 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -25,7 +25,6 @@ const compat = new FlatCompat({
 export default [
   {
     ignores: [
-      'client/vite.config.ts',
       'client/dist/**/*',
       'client/public/**/*',
       'client/coverage/**/*',
@@ -121,7 +120,7 @@ export default [
       'jsx-a11y/img-redundant-alt': 'off',
       'jsx-a11y/no-noninteractive-tabindex': 'off',
       // common rules
-      'no-nested-ternary': 'warn',
+      'no-nested-ternary': 'error',
       'no-constant-binary-expression': 'warn',
       'no-unused-vars': [
         'warn',
@@ -170,12 +169,15 @@ export default [
     },
   },
   {
-    files: ['**/rollup.config.js', '**/.eslintrc.js', '**/jest.config.js'],
+    files: ['**/rollup.config.js', '**/.eslintrc.js', '**/jest.config.js', 'client/vite.config.ts'],
     languageOptions: {
       globals: {
         ...globals.node,
       },
     },
+    rules: {
+      'import/no-cycle': 'off',
+    },
   },
   {
     files: [
@@ -217,7 +219,10 @@ export default [
     })),
   {
     files: ['**/*.ts', '**/*.tsx'],
-    ignores: ['packages/**/*'],
+    // e2e specs are not part of `client/tsconfig.json`'s program, so typed
+    // linting them errors with "file not found in project"; they still get
+    // the non-type-checked recommended rules from the block above.
+    ignores: ['packages/**/*', 'client/vite.config.ts', 'e2e/**/*'],
     plugins: {
       '@typescript-eslint': typescriptEslintEslintPlugin,
       jest: fixupPluginRules(jest),
diff --git a/helm/librechat/Chart.yaml b/helm/librechat/Chart.yaml
index 92bee492524..e45c3d0372f 100755
--- a/helm/librechat/Chart.yaml
+++ b/helm/librechat/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.0.3
+version: 2.0.7
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -23,7 +23,7 @@ version: 2.0.3
 # It is recommended to use it with quotes.
 
 # renovate: image=registry.librechat.ai/danny-avila/librechat
-appVersion: "v0.8.6-rc1"
+appVersion: "v0.8.7"
 
 home: https://www.librechat.ai
 
diff --git a/helm/librechat/readme.md b/helm/librechat/readme.md
index b557825c3c5..685c41e1e76 100755
--- a/helm/librechat/readme.md
+++ b/helm/librechat/readme.md
@@ -34,4 +34,22 @@ kind: Secret
 
 3. Apply the Secret to the Cluster
 
-4. Fill out values.yaml and apply the Chart to the Cluster
\ No newline at end of file
+4. Fill out values.yaml and apply the Chart to the Cluster
+
+## Admin Panel SSO
+
+When deploying the admin panel at a separate URL, set `librechat.adminPanelUrl`
+to the external admin panel base URL. It may include a path, but it should not
+end with a trailing `/` because LibreChat appends `/auth/...` callback paths.
+
+```yaml
+librechat:
+  adminPanelUrl: https://admin.example.com/admin
+```
+
+This renders `ADMIN_PANEL_URL` for LibreChat's admin OAuth flow. For OpenID SSO,
+also register this LibreChat callback URL with your identity provider:
+
+```text
+https://<librechat-domain>/api/admin/oauth/openid/callback
+```
diff --git a/helm/librechat/templates/configmap-env.yaml b/helm/librechat/templates/configmap-env.yaml
index ed5ac822dac..5fd43940d20 100755
--- a/helm/librechat/templates/configmap-env.yaml
+++ b/helm/librechat/templates/configmap-env.yaml
@@ -3,6 +3,9 @@ apiVersion: v1
 metadata:
   name: {{ include "librechat.fullname" $ }}-configenv
 data:
+  {{- $configEnv := default dict .Values.librechat.configEnv }}
+  {{- $adminPanelUrl := .Values.librechat.adminPanelUrl }}
+  {{- $configAdminPanelUrl := dig "configEnv" "ADMIN_PANEL_URL" "" .Values.librechat }}
   {{- if (index .Values "librechat-rag-api" "enabled") }}
   RAG_API_URL: http://{{ include "rag.fullname" (index .Subcharts "librechat-rag-api") | lower }}.{{ .Release.Namespace | lower }}.svc.cluster.local:8000 
   {{- end }}
@@ -18,6 +21,15 @@ data:
   {{- if and (not (dig "configEnv" "REDIS_URI" "" .Values.librechat)) .Values.redis.enabled }}
   REDIS_URI: redis://{{ include "common.names.fullname" .Subcharts.redis }}-master.{{ .Release.Namespace | lower }}.svc.cluster.local:6379
   {{- end }}
-  {{- if .Values.librechat.configEnv }}
-  {{- toYaml .Values.librechat.configEnv | nindent 2 }}
-  {{- end }}
\ No newline at end of file
+  {{- if and $adminPanelUrl (not $configAdminPanelUrl) }}
+  ADMIN_PANEL_URL: {{ $adminPanelUrl | quote }}
+  {{- end }}
+  {{- if $configEnv }}
+  {{- $renderedConfigEnv := $configEnv }}
+  {{- if and $adminPanelUrl (hasKey $configEnv "ADMIN_PANEL_URL") (not $configAdminPanelUrl) }}
+  {{- $renderedConfigEnv = omit $configEnv "ADMIN_PANEL_URL" }}
+  {{- end }}
+  {{- if $renderedConfigEnv }}
+  {{- toYaml $renderedConfigEnv | nindent 2 }}
+  {{- end }}
+  {{- end }}
diff --git a/helm/librechat/templates/configmap.yaml b/helm/librechat/templates/configmap.yaml
index dd80ce1bbb1..fe8d5b86d77 100755
--- a/helm/librechat/templates/configmap.yaml
+++ b/helm/librechat/templates/configmap.yaml
@@ -5,6 +5,6 @@ metadata:
   name: {{ include "librechat.fullname" $ }}-config
 data:
   librechat.yaml: |
-{{ .Values.librechat.configYamlContent | toYaml | indent 4 }}
+{{ .Values.librechat.configYamlContent | indent 4 }}
 
 {{- end }}
\ No newline at end of file
diff --git a/helm/librechat/tests/configmap_render_test.sh b/helm/librechat/tests/configmap_render_test.sh
new file mode 100755
index 00000000000..d11175695e2
--- /dev/null
+++ b/helm/librechat/tests/configmap_render_test.sh
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Regression test for the librechat ConfigMap template.
+#
+# Background: at one point templates/configmap.yaml ran
+# `.Values.librechat.configYamlContent | toYaml | indent 4`. Because the
+# value is already a YAML literal string, toYaml re-wrapped it in another `|`
+# block scalar, producing a mounted /app/librechat.yaml whose first line was
+# a bare `|`. js-yaml "recovered" by returning the body as a string, so
+# LibreChat silently fell back to internal defaults for every config block
+# (endpoints, interface, modelSpecs, ...).
+#
+# This test renders the ConfigMap with a sample configYamlContent and asserts
+# that the rendered librechat.yaml is a proper YAML object preserving nested
+# keys.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHART_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="$(mktemp -t librechat-configmap-values.XXXXXX)"
+RENDERED_FILE="$(mktemp -t librechat-configmap-render.XXXXXX)"
+trap 'rm -f "${VALUES_FILE}" "${RENDERED_FILE}"' EXIT
+
+cat > "${VALUES_FILE}" <<'YAML'
+librechat:
+  configYamlContent: |
+    version: 1.3.11
+    endpoints:
+      agents:
+        disableBuilder: false
+YAML
+
+if ! command -v helm >/dev/null 2>&1; then
+  echo "FAIL: helm not on PATH" >&2
+  exit 1
+fi
+
+# Render only the chart's templates so dependent sub-charts don't need network access.
+helm template librechat "${CHART_DIR}" \
+  --show-only templates/configmap.yaml \
+  -f "${VALUES_FILE}" > "${RENDERED_FILE}"
+
+# Pull the block scalar body that lives under `librechat.yaml: |`.
+# awk: enter the block on the header line, then emit subsequent lines while
+# they are indented (the body) and stop at the next unindented line.
+BODY="$(awk '
+  /^  librechat\.yaml: \|/ { in_block = 1; next }
+  in_block {
+    if ($0 ~ /^    /) { sub(/^    /, ""); print; next }
+    if ($0 ~ /^$/)    { print; next }
+    exit
+  }
+' "${RENDERED_FILE}")"
+
+if [[ -z "${BODY}" ]]; then
+  echo "FAIL: could not extract librechat.yaml body from rendered ConfigMap" >&2
+  cat "${RENDERED_FILE}" >&2
+  exit 1
+fi
+
+FIRST_LINE="$(printf '%s\n' "${BODY}" | awk 'NF { print; exit }')"
+if [[ "${FIRST_LINE}" == "|" ]]; then
+  echo "FAIL: rendered librechat.yaml starts with a bare '|' — configYamlContent is double-wrapped" >&2
+  echo "----- rendered body -----" >&2
+  printf '%s\n' "${BODY}" >&2
+  exit 1
+fi
+
+if ! printf '%s\n' "${BODY}" | grep -qE '^version: 1\.3\.11$'; then
+  echo "FAIL: expected top-level 'version: 1.3.11' in rendered librechat.yaml" >&2
+  printf '%s\n' "${BODY}" >&2
+  exit 1
+fi
+
+if ! printf '%s\n' "${BODY}" | grep -qE '^endpoints:$'; then
+  echo "FAIL: expected top-level 'endpoints:' key in rendered librechat.yaml" >&2
+  printf '%s\n' "${BODY}" >&2
+  exit 1
+fi
+
+if ! printf '%s\n' "${BODY}" | grep -qE '^  agents:$'; then
+  echo "FAIL: expected nested 'endpoints.agents' key in rendered librechat.yaml" >&2
+  printf '%s\n' "${BODY}" >&2
+  exit 1
+fi
+
+# If a YAML parser is available, do a real parse to confirm the body loads as
+# an object (not a string) and that endpoints.agents survives the round trip.
+PARSER=""
+if command -v python3 >/dev/null 2>&1 && python3 -c 'import yaml' >/dev/null 2>&1; then
+  PARSER="python3"
+elif command -v node >/dev/null 2>&1 && node -e 'require("js-yaml")' >/dev/null 2>&1; then
+  PARSER="node"
+fi
+
+case "${PARSER}" in
+  python3)
+    BODY="${BODY}" python3 - <<'PY'
+import os, sys, yaml
+body = os.environ["BODY"]
+doc = yaml.safe_load(body)
+if not isinstance(doc, dict):
+    sys.stderr.write(f"FAIL: parsed librechat.yaml is {type(doc).__name__}, expected dict\n")
+    sys.exit(1)
+agents = (doc.get("endpoints") or {}).get("agents")
+if not isinstance(agents, dict) or "disableBuilder" not in agents:
+    sys.stderr.write(f"FAIL: endpoints.agents missing or malformed after parse: {agents!r}\n")
+    sys.exit(1)
+PY
+    ;;
+  node)
+    BODY="${BODY}" node -e '
+      const yaml = require("js-yaml");
+      const doc = yaml.load(process.env.BODY);
+      if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
+        console.error("FAIL: parsed librechat.yaml is " + typeof doc + ", expected object");
+        process.exit(1);
+      }
+      const agents = doc.endpoints && doc.endpoints.agents;
+      if (!agents || typeof agents.disableBuilder === "undefined") {
+        console.error("FAIL: endpoints.agents missing after parse: " + JSON.stringify(agents));
+        process.exit(1);
+      }
+    '
+    ;;
+  *)
+    echo "NOTE: skipping YAML-parser assertion (install python3+pyyaml or node+js-yaml to enable)"
+    ;;
+esac
+
+echo "PASS: rendered librechat.yaml is a proper YAML document with nested keys preserved"
diff --git a/helm/librechat/values.yaml b/helm/librechat/values.yaml
index 25b61e82d7f..e5321c2a933 100755
--- a/helm/librechat/values.yaml
+++ b/helm/librechat/values.yaml
@@ -33,6 +33,12 @@ global:
     #        key: client_id
 
 librechat:
+  # External admin panel base URL used for admin OAuth/SSO redirects.
+  # Required when deploying the admin panel on a separate URL.
+  # May include a path. Do not include a trailing slash.
+  # Example: https://admin.example.com/admin
+  adminPanelUrl: ""
+
   configEnv:
     # IMPORTANT -- GENERATE your own: openssl rand -hex 32 and openssl rand -hex 16 for CREDS_IV. Best Practise: Put into Secret. See global.librechat.existingSecretName
     CREDS_KEY: 9e95d9894da7e68dd69c0046caf5343c8b1e80c89609b5a1e40e6568b5b23ce6
diff --git a/librechat.example.yaml b/librechat.example.yaml
index b126f8217cf..bfdcc60148c 100644
--- a/librechat.example.yaml
+++ b/librechat.example.yaml
@@ -2,7 +2,7 @@
 # https://www.librechat.ai/docs/configuration/librechat_yaml
 
 # Configuration version (required)
-version: 1.3.11
+version: 1.3.13
 
 # Cache settings: Set to true to enable caching
 cache: true
@@ -61,6 +61,37 @@ cache: true
 #   # Recommended for download paths: attach a CloudFront response headers policy
 #   # with X-Content-Type-Options: nosniff and CSP default-src 'none'.
 
+# Skill sync configuration (optional)
+# GitHub tokens are referenced from environment variables. Put the token in
+# `.env`, then reference it here with `token: '${GITHUB_SKILLS_TOKEN}'`. Use a
+# GitHub fine-grained personal access token scoped to the selected repository
+# with read-only Contents and Metadata permissions.
+# skillSync:
+#   github:
+#     enabled: false
+#     intervalMinutes: 60
+#     runOnStartup: true
+#     sources:
+#       - id: librechat-skills
+#         owner: your-org
+#         repo: your-skills-repo
+#         ref: main
+#         paths:
+#           - skills
+#         # Number of directory levels below each configured path to scan for
+#         # `SKILL.md`. Use 2 for repos shaped like `skills/<category>/<skill>`.
+#         skillDiscoveryDepth: 2
+#         token: '${GITHUB_SKILLS_TOKEN}'
+#         # Optional. Owns the mirrored skills under the given tenant so they are
+#         # created and shared within that tenant. Required for visibility when
+#         # tenant isolation is enabled. Omit for single-tenant deployments.
+#         # Treat as immutable per source id: changing (or adding/removing) the
+#         # tenantId later leaves previously mirrored skills in the old tenant,
+#         # where this source's sync can no longer see or clean them up. To move a
+#         # source between tenants, delete its mirrored skills in the old tenant
+#         # first, or use a new source id for the new tenant.
+#         # tenantId: your-tenant-id
+
 # Custom interface configuration
 interface:
   customWelcome: 'Welcome to LibreChat! Enjoy your experience.'
@@ -138,6 +169,15 @@ interface:
   marketplace:
     use: false
   fileCitations: true
+  # Tools pinned to the prompt bar by default for all users.
+  # Only seeds the initial state — once a user pins/unpins a tool, their choice is kept.
+  # Valid tool keys: artifacts, execute_code, web_search, file_search, skills.
+  # Use 'mcp' (or a specific MCP server name) to pin the MCP servers dropdown.
+  # When omitted, tools start unpinned and the MCP dropdown keeps its default (pinned).
+  # defaultPinnedTools:
+  #   - 'artifacts'
+  #   - 'execute_code'
+  #   - 'mcp'
   # Remote Agents configuration
   # Controls user permissions for remote agents with external API support
   # remoteAgents:
@@ -146,27 +186,46 @@ interface:
   #   share: false
   #   public: false
   # MCP Servers configuration example
+  # Shared Links configuration
+  # Controls user permissions for shared links (e.g. sharing conversations via link)
+  # sharedLinks:
+  #   create: false
+  #   share: true
+  #   public: true # Allows users to toggle "share with everyone" for their links. Whether anonymous access is permitted is controlled by ALLOW_SHARED_LINKS_PUBLIC.
+  #   snapshotFiles: true # Snapshot files referenced by a shared chat so viewers can preview/download them via the link. Enabled by default; the SHARED_LINKS_SNAPSHOT_FILES env var overrides this.
   # mcpServers:
-    # Controls user permissions for MCP (Model Context Protocol) server management
-    # - use: Allow users to use configured MCP servers
-    # - create: Allow users to create and manage new MCP servers
-    # - share: Allow users to share MCP servers with other users
-    # - public: Allow users to share MCP servers publicly (with everyone)
-
-    # Creation / edit MCP server config Dialog config example
-    # trustCheckbox:
-    #   label:
-    #     en: 'I understand and I want to continue'
-    #     de: 'Ich verstehe und möchte fortfahren'
-    #     de-DE: 'Ich verstehe und möchte fortfahren' # You can narrow translation to regions like (de-DE or de-CH)
-    #   subLabel:
-    #     en: |
-    #       Librechat hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data. <a href="https://google.de" target="_blank"><strong>Learn more.</strong></a>
-    #     de: |
-    #       LibreChat hat diesen MCP-Server nicht überprüft. Angreifer könnten versuchen, Ihre Daten zu stehlen oder das Modell zu unbeabsichtigten Aktionen zu verleiten, einschließlich der Zerstörung von Daten. <a href="https://google.de" target="_blank"><strong>Mehr erfahren.</strong></a>
+  # Controls user permissions for MCP (Model Context Protocol) server management
+  # - use: Allow users to use configured MCP servers
+  # - create: Allow users to create and manage new MCP servers
+  # - share: Allow users to share MCP servers with other users
+  # - public: Allow users to share MCP servers publicly (with everyone)
+
+  # Creation / edit MCP server config Dialog config example
+  # trustCheckbox:
+  #   label:
+  #     en: 'I understand and I want to continue'
+  #     de: 'Ich verstehe und möchte fortfahren'
+  #     de-DE: 'Ich verstehe und möchte fortfahren' # You can narrow translation to regions like (de-DE or de-CH)
+  #   subLabel:
+  #     en: |
+  #       Librechat hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data. <a href="https://google.de" target="_blank"><strong>Learn more.</strong></a>
+  #     de: |
+  #       LibreChat hat diesen MCP-Server nicht überprüft. Angreifer könnten versuchen, Ihre Daten zu stehlen oder das Modell zu unbeabsichtigten Aktionen zu verleiten, einschließlich der Zerstörung von Daten. <a href="https://google.de" target="_blank"><strong>Mehr erfahren.</strong></a>
 
   # Temporary chat retention period in hours (default: 720, min: 1, max: 8760)
   # temporaryChatRetention: 1
+  # Retention mode: "all" applies expiry to all data types, "temporary" (default) only to temporary chats
+  # Before switching from "all" back to "temporary", remove retention deadlines from non-temporary data
+  # that should stop expiring:
+  # db.conversations.updateMany({ isTemporary: false, expiredAt: { $ne: null } }, { $unset: { expiredAt: 1 } })
+  # db.messages.updateMany({ isTemporary: false, expiredAt: { $ne: null } }, { $unset: { expiredAt: 1 } })
+  # MongoDB does not drop superseded indexes automatically. After upgrading, old Meili indexes
+  # such as "_meiliIndex_1_expiredAt_1" can be dropped from conversations/messages once the new
+  # "_meiliIndex_1_isTemporary_1_expiredAt_1" indexes exist.
+  # retentionMode: "temporary"
+  # Set retainAgentFiles to true to keep persistent agent resource files from expiring under
+  # retentionMode: "all"; non-agent files still expire.
+  # retainAgentFiles: false
 
 # Example Cloudflare turnstile (optional)
 #turnstile:
@@ -304,6 +363,7 @@ actions:
 #   everything:
 #     # type: sse # type can optionally be omitted
 #     url: http://localhost:3001/sse
+#     # proxy: "${MCP_PROXY_URL}"  # optional outbound proxy (http/https/socks/socks5)
 #     timeout: 60000  # 1 minute timeout for this server, this is the default timeout for MCP servers.
 #   puppeteer:
 #     type: stdio
@@ -349,6 +409,12 @@ endpoints:
   #   maxRecursionLimit: 100
   #   # (optional) Disable the builder interface for agents
   #   disableBuilder: false
+  #   # (optional) When conversation titles are generated:
+  #   #   immediate (default): generate as soon as the request is made, in parallel
+  #   #     with the response, from the user's first message (title appears within ~1-2s).
+  #   #   final: defer generation until the full response completes (legacy behavior).
+  #   # Set under `endpoints.all` instead to apply as the global default for all endpoints.
+  #   titleTiming: immediate
   #   # (optional) Maximum total citations to include in agent responses, defaults to 30
   #   maxCitations: 30
   #   # (optional) Maximum citations per file to include in agent responses, defaults to 7
@@ -356,9 +422,28 @@ endpoints:
   #   # (optional) Minimum relevance score for sources to be included in responses, defaults to 0.45 (45% relevance threshold)
   #   # Set to 0.0 to show all sources (no filtering), or higher like 0.7 for stricter filtering
   #   minRelevanceScore: 0.45
+  #   # (optional) Cap the number of active accessible skills shown in the model-visible catalog.
+  #   # Useful for large organizations where many department-specific skills may be available.
+  #   skills:
+  #     maxCatalogSkills: 20
   #   # (optional) Agent Capabilities available to all users. Omit the ones you wish to exclude. Defaults to list below.
   #   capabilities: ["deferred_tools", "execute_code", "file_search", "actions", "tools"]
 
+  # (optional) Custom request headers for the built-in OpenAI / Google endpoints.
+  # Forwarded on every request to the provider (or an AI gateway / reverse proxy
+  # in front of it) while keeping provider-native request shaping intact. Values
+  # support env vars (${VAR}), user fields ({{LIBRECHAT_USER_*}}), and request-body
+  # fields ({{LIBRECHAT_BODY_CONVERSATIONID}}). Set the same `headers:` block under
+  # `endpoints.all` to apply globally across endpoints (endpoint values win on key
+  # collisions). NOTE: send metadata headers like these only behind a gateway that
+  # consumes them — native provider APIs ignore unknown headers.
+  # openAI:
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+  # google:
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+
   # Anthropic endpoint configuration with Vertex AI support
   # Use this to run Anthropic Claude models through Google Cloud Vertex AI
   # anthropic:
@@ -366,6 +451,12 @@ endpoints:
   #   streamRate: 20
   #   # (optional) Title model for conversation titles
   #   titleModel: claude-3.5-haiku  # Use the visible model name (key from models config)
+  #   # (optional) Custom request headers, same placeholder resolution as above.
+  #   # Useful for correlating reverse-proxied requests by conversation, since an
+  #   # unknown header is simply ignored by the native Anthropic API.
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+  #     X-Conversation-Id: '{{LIBRECHAT_BODY_CONVERSATIONID}}'
   #
   #   # Vertex AI Configuration - enables running Claude models via Google Cloud
   #   # This is similar to Azure OpenAI but for Anthropic models on Google Cloud
@@ -391,6 +482,8 @@ endpoints:
   #     # Option 1: Simple array (legacy format - model name = deployment name)
   #     # Use this if you want the technical model IDs to show in the UI
   #     # models:
+  #     #   - "claude-fable-5"
+  #     #   - "claude-opus-4-8"
   #     #   - "claude-sonnet-4-6"
   #     #   - "claude-3-7-sonnet-20250219"
   #     #   - "claude-3-5-sonnet-v2@20241022"
@@ -401,6 +494,10 @@ endpoints:
   #     # The deploymentName is the actual Vertex AI model ID used for API calls
   #     # You can use friendly names (avoid spaces for cleaner YAML) or technical IDs as keys
   #     models:
+  #       claude-fable-5:
+  #         deploymentName: claude-fable-5
+  #       claude-opus-4.8:
+  #         deploymentName: claude-opus-4-8
   #       claude-opus-4.5:
   #         deploymentName: claude-opus-4-5@20251101
   #       claude-sonnet-4:
@@ -421,6 +518,29 @@ endpoints:
   #     #     deploymentName: claude-3-5-haiku@20241022  # Override for this model
 
   custom:
+    # Anthropic-compatible Example (native `/v1/messages` API)
+    # Set `provider: anthropic` to use the native Anthropic client instead of the
+    # default OpenAI-compatible one — for Anthropic itself or Anthropic-compatible
+    # gateways (e.g. AI gateways, OpenCode Zen). The `baseURL` must be the API root
+    # the Anthropic SDK appends `/v1/messages` to. List models explicitly: model
+    # auto-fetch uses the OpenAI `/models` convention and is not used for this provider.
+    - name: 'Claude-Compatible'
+      provider: 'anthropic'
+      apiKey: '${ANTHROPIC_API_KEY}'
+      baseURL: 'https://api.anthropic.com'
+      # (optional) headers forwarded on every request (e.g. for a reverse proxy);
+      # values support the same placeholders as built-in endpoints.
+      headers:
+        anthropic-version: '2023-06-01'
+      models:
+        default:
+          - 'claude-sonnet-4-5'
+          - 'claude-opus-4-5'
+        fetch: false
+      titleConvo: true
+      titleModel: 'claude-sonnet-4-5'
+      modelDisplayLabel: 'Claude (Compatible)'
+
     # Groq Example
     - name: 'groq'
       apiKey: '${GROQ_API_KEY}'
@@ -574,10 +694,22 @@ endpoints:
 #     - name: "gpt-4o"
 #       label: "GPT-4 Optimized"
 #       description: "Most capable GPT-4 model with multimodal support"
+#       # default: true      # Hard admin default; takes precedence over prior user choices
+#       # softDefault: true  # First-time default only; skipped after a user selects a model/spec/agent
 #       group: "openAI"  # String value matching the endpoint name
 #       preset:
 #         endpoint: "openAI"
 #         model: "gpt-4o"
+#       # Skills can be enabled per model spec. Use true for the user's active
+#       # accessible skill catalog, false to force skills off, or a name list as
+#       # a strict allowlist for catalog, manual, and always-apply resolution.
+#       # skills: ["brand-guidelines", "code-review"]
+#       # Subagents can be enabled per model spec. `allowSelf: true` lets the
+#       # ephemeral agent spawn a fresh isolated copy of itself for focused work.
+#       # subagents:
+#       #   enabled: true
+#       #   allowSelf: true
+#       #   agent_ids: []
 #
 #     # Example 2: Nested under a custom endpoint (grouped with groq endpoint)
 #     - name: "llama3-70b-8192"
@@ -624,6 +756,7 @@ endpoints:
 #       label: "General Assistant"
 #       description: "General purpose assistant"
 #       # No 'group' field - appears as standalone item at top level (not nested)
+#       # hideBadgeRow: true  # Optional: hides the tool badge row for this spec
 #       preset:
 #         endpoint: "openAI"
 #         model: "gpt-4o-mini"
@@ -713,8 +846,10 @@ endpoints:
 #   disabled: false
 #   # (optional) Restrict memory keys to specific values to limit memory storage and improve consistency
 #   validKeys: ["preferences", "work_info", "personal_info", "skills", "interests", "context"]
-#   # (optional) Maximum token limit for memory storage (not yet implemented for token counting)
+#   # (optional) Maximum token limit for stored memory values
 #   tokenLimit: 10000
+#   # (optional) Maximum tokens from recent chat sent to the memory agent before truncation
+#   maxInputTokens: 12000
 #   # (optional) Enable personalization features (defaults to true if memory is configured)
 #   # When false, users will not see the Personalization tab in settings
 #   personalize: true
@@ -731,3 +866,21 @@ endpoints:
 #     # instructions: "You are a memory management assistant. Store and manage user information accurately."
 #     # model_parameters:
 #     #   temperature: 0.1
+
+# Reject chat messages whose text matches credential-shaped patterns
+# before they reach moderation, the model, or persistence. Filter
+# types live under `messageFilter.<type>`; today only `pii` ships, but
+# the namespace is structured so future filter types can plug in.
+# Omit the whole section to disable.
+# messageFilter:
+#   pii:
+#     # (optional) Pick a subset of the starter catalog by id; omit to
+#     # enable all starters (sk_prefix, bearer_header, api_key_header).
+#     starterPatterns: [sk_prefix, bearer_header, api_key_header]
+#     # (optional) Operator-defined patterns. Each entry needs id,
+#     # label, and a JavaScript-flavor regex; the regex is validated
+#     # at config load time.
+#     customPatterns:
+#       - id: anthropic_api_key
+#         label: Anthropic API key
+#         regex: "sk-ant-[A-Za-z0-9_-]{20,}"
diff --git a/package-lock.json b/package-lock.json
index 51d6fa062a1..3be38866307 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "LibreChat",
-  "version": "v0.8.6-rc1",
+  "version": "v0.8.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "LibreChat",
-      "version": "v0.8.6-rc1",
+      "version": "v0.8.7",
       "license": "ISC",
       "workspaces": [
         "api",
@@ -40,13 +40,13 @@
         "lint-staged": "^15.4.3",
         "prettier": "^3.5.0",
         "prettier-plugin-tailwindcss": "^0.6.11",
-        "turbo": "^2.8.12",
-        "typescript-eslint": "^8.24.0"
+        "turbo": "^2.9.17",
+        "typescript-eslint": "^8.60.1"
       }
     },
     "api": {
       "name": "@librechat/backend",
-      "version": "v0.8.6-rc1",
+      "version": "v0.8.7",
       "license": "ISC",
       "dependencies": {
         "@anthropic-ai/vertex-sdk": "^0.16.0",
@@ -54,18 +54,29 @@
         "@aws-sdk/client-cloudfront": "^3.1042.0",
         "@aws-sdk/client-s3": "^3.980.0",
         "@aws-sdk/cloudfront-signer": "^3.1036.0",
+        "@aws-sdk/credential-providers": "^3.1045.0",
         "@aws-sdk/s3-request-presigner": "^3.758.0",
         "@azure/identity": "^4.13.1",
         "@azure/search-documents": "^12.0.0",
         "@azure/storage-blob": "^12.30.0",
-        "@google/genai": "^2.0.1",
+        "@google/genai": "^2.8.0",
         "@keyv/redis": "^4.3.3",
-        "@librechat/agents": "^3.1.86",
+        "@librechat/agents": "^3.2.46",
         "@librechat/api": "*",
         "@librechat/data-schemas": "*",
         "@microsoft/microsoft-graph-client": "^3.0.7",
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@node-saml/passport-saml": "^5.1.0",
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/instrumentation-express": "^0.56.0",
+        "@opentelemetry/instrumentation-http": "^0.207.0",
+        "@opentelemetry/instrumentation-ioredis": "^0.55.0",
+        "@opentelemetry/instrumentation-mongodb": "^0.60.0",
+        "@opentelemetry/instrumentation-mongoose": "^0.54.0",
+        "@opentelemetry/instrumentation-undici": "^0.18.0",
+        "@opentelemetry/resources": "^2.6.1",
+        "@opentelemetry/sdk-node": "^0.218.0",
+        "@opentelemetry/semantic-conventions": "^1.39.0",
         "@smithy/node-http-handler": "^4.4.5",
         "ai-tokenizer": "^1.0.6",
         "axios": "^1.16.0",
@@ -86,11 +97,13 @@
         "file-type": "^21.3.2",
         "firebase": "^11.0.2",
         "form-data": "^4.0.4",
+        "get-stream": "^6.0.1",
         "handlebars": "^4.7.9",
         "https-proxy-agent": "^7.0.6",
         "ioredis": "^5.3.2",
-        "js-yaml": "^4.1.1",
+        "js-yaml": "^4.2.0",
         "jsonwebtoken": "^9.0.0",
+        "jszip": "^3.10.1",
         "jwks-rsa": "^3.2.0",
         "keyv": "^5.3.2",
         "keyv-file": "^5.1.2",
@@ -103,11 +116,12 @@
         "memorystore": "^1.6.7",
         "mime": "^3.0.0",
         "module-alias": "^2.2.3",
+        "mongodb": "^6.14.2",
         "mongoose": "^8.23.1",
-        "multer": "^2.1.1",
+        "multer": "^2.2.0",
         "nanoid": "^3.3.7",
         "node-fetch": "^2.7.0",
-        "nodemailer": "^8.0.5",
+        "nodemailer": "^9.0.1",
         "ollama": "^0.5.0",
         "openai": "5.8.2",
         "openid-client": "^6.5.0",
@@ -121,10 +135,10 @@
         "passport-ldapauth": "^3.0.1",
         "passport-local": "^1.0.0",
         "pdfjs-dist": "^5.4.624",
+        "prom-client": "^15.1.3",
         "rate-limit-redis": "^4.2.0",
         "sanitize-html": "^2.13.0",
         "sharp": "^0.33.5",
-        "traverse": "^0.6.7",
         "ua-parser-js": "^1.0.36",
         "undici": "^7.24.1",
         "winston": "^3.11.0",
@@ -134,6 +148,7 @@
         "zod": "^3.22.4"
       },
       "devDependencies": {
+        "@babel/preset-env": "^7.29.5",
         "@types/sanitize-html": "^2.13.0",
         "jest": "^30.2.0",
         "mongodb-memory-server": "^11.0.1",
@@ -395,15 +410,16 @@
     },
     "client": {
       "name": "@librechat/frontend",
-      "version": "v0.8.6-rc1",
+      "version": "v0.8.7",
       "license": "ISC",
       "dependencies": {
-        "@ariakit/react": "^0.4.15",
-        "@ariakit/react-core": "^0.4.17",
+        "@ariakit/react": "^0.4.29",
+        "@ariakit/react-core": "^0.4.26",
         "@codesandbox/sandpack-react": "^2.19.10",
         "@dicebear/collection": "^9.4.1",
         "@dicebear/core": "^9.4.1",
         "@headlessui/react": "^2.1.2",
+        "@hyperdx/browser": "^0.24.0",
         "@librechat/client": "*",
         "@marsidev/react-turnstile": "^1.1.0",
         "@mcp-ui/client": "^5.7.0",
@@ -438,7 +454,7 @@
         "downloadjs": "^1.4.7",
         "export-from-json": "^1.7.2",
         "filenamify": "^6.0.0",
-        "framer-motion": "^11.5.4",
+        "framer-motion": "^12.40.0",
         "heic-to": "^1.1.14",
         "html-to-image": "^1.11.11",
         "i18next": "^24.2.2",
@@ -450,8 +466,15 @@
         "lodash": "^4.17.23",
         "lucide-react": "^0.394.0",
         "match-sorter": "^8.1.0",
+        "mdast-util-directive": "^3.0.0",
+        "mdast-util-from-markdown": "^2.0.1",
+        "mdast-util-gfm": "^3.0.0",
+        "mdast-util-math": "^3.0.0",
         "mermaid": "^11.15.0",
+        "micromark-extension-directive": "^3.0.1",
+        "micromark-extension-gfm": "^3.0.0",
         "micromark-extension-llm-math": "^3.1.0",
+        "micromark-extension-math": "^3.1.0",
         "qrcode.react": "^4.2.0",
         "rc-input-number": "^7.4.2",
         "react": "^18.2.0",
@@ -479,7 +502,7 @@
         "remark-gfm": "^4.0.0",
         "remark-math": "^6.0.0",
         "remark-supersub": "^1.0.0",
-        "sse.js": "^2.5.0",
+        "sse.js": "^2.8.0",
         "swr": "^2.3.8",
         "tailwind-merge": "^1.9.1",
         "tailwindcss-animate": "^1.0.5",
@@ -501,10 +524,10 @@
         "@types/jest": "^29.5.14",
         "@types/js-cookie": "^3.0.6",
         "@types/lodash": "^4.17.15",
-        "@types/node": "^20.19.35",
+        "@types/node": "^24.12.4",
         "@types/react": "^18.2.11",
         "@types/react-dom": "^18.2.4",
-        "@vitejs/plugin-react": "^5.1.4",
+        "@vitejs/plugin-react": "^6.0.2",
         "autoprefixer": "^10.4.20",
         "babel-plugin-replace-ts-export-assignment": "^0.0.2",
         "babel-plugin-root-import": "^6.6.0",
@@ -517,1316 +540,464 @@
         "jest-canvas-mock": "^2.5.2",
         "jest-environment-jsdom": "^30.2.0",
         "jest-file-loader": "^1.0.3",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "monaco-editor": "^0.55.1",
         "postcss": "^8.4.31",
         "postcss-preset-env": "^11.2.0",
         "tailwindcss": "^3.4.1",
-        "typescript": "^5.3.3",
-        "vite": "^7.3.1",
-        "vite-plugin-compression2": "^2.2.1",
-        "vite-plugin-node-polyfills": "^0.25.0",
-        "vite-plugin-pwa": "^1.2.0"
+        "typescript": "^5.9.3",
+        "vite": "^8.0.16",
+        "vite-plugin-compression2": "^2.5.3",
+        "vite-plugin-node-polyfills": "^0.28.0",
+        "vite-plugin-pwa": "^1.3.0"
       }
     },
-    "client/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
+    "client/node_modules/@codesandbox/sandpack-client": {
+      "version": "2.19.8",
+      "resolved": "https://registry.npmjs.org/@codesandbox/sandpack-client/-/sandpack-client-2.19.8.tgz",
+      "integrity": "sha512-CMV4nr1zgKzVpx4I3FYvGRM5YT0VaQhALMW9vy4wZRhEyWAtJITQIqZzrTGWqB1JvV7V72dVEUCUPLfYz5hgJQ==",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "@codesandbox/nodebox": "0.1.8",
+        "buffer": "^6.0.3",
+        "dequal": "^2.0.2",
+        "mime-db": "^1.52.0",
+        "outvariant": "1.4.0",
+        "static-browser-server": "1.0.3"
       }
     },
-    "client/node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
-      "dev": true,
-      "license": "MIT",
+    "client/node_modules/@codesandbox/sandpack-react": {
+      "version": "2.19.10",
+      "resolved": "https://registry.npmjs.org/@codesandbox/sandpack-react/-/sandpack-react-2.19.10.tgz",
+      "integrity": "sha512-X/7NzhR7R5pp5qYS+Gc31OzJvy+EzGz++H1YN9bJlDE+VzxTBsMN9dv3adzeo5wtxUhqexVOJS7mGr//e7KP2A==",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/remapping": "^2.3.5",
-        "convert-source-map": "^2.0.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.2",
-        "json5": "^2.2.3",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "@codemirror/autocomplete": "^6.4.0",
+        "@codemirror/commands": "^6.1.3",
+        "@codemirror/lang-css": "^6.0.1",
+        "@codemirror/lang-html": "^6.4.0",
+        "@codemirror/lang-javascript": "^6.1.2",
+        "@codemirror/language": "^6.3.2",
+        "@codemirror/state": "^6.2.0",
+        "@codemirror/view": "^6.7.1",
+        "@codesandbox/sandpack-client": "^2.19.8",
+        "@lezer/highlight": "^1.1.3",
+        "@react-hook/intersection-observer": "^3.1.1",
+        "@stitches/core": "^1.2.6",
+        "anser": "^2.1.1",
+        "clean-set": "^1.1.2",
+        "dequal": "^2.0.2",
+        "escape-carriage": "^1.3.1",
+        "lz-string": "^1.4.4",
+        "react-devtools-inline": "4.4.0",
+        "react-is": "^17.0.2"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/babel"
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17 || ^18",
+        "react-dom": "^16.8.0 || ^17 || ^18"
       }
     },
-    "client/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
+    "client/node_modules/@react-spring/web": {
+      "version": "9.7.5",
+      "resolved": "https://registry.npmjs.org/@react-spring/web/-/web-9.7.5.tgz",
+      "integrity": "sha512-lmvqGwpe+CSttsWNZVr+Dg62adtKhauGwLyGE/RRyZ8AAMLgb9x3NDMA5RMElXo+IMyTkPp7nxTB8ZQlmhb6JQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
+        "@react-spring/animated": "~9.7.5",
+        "@react-spring/core": "~9.7.5",
+        "@react-spring/shared": "~9.7.5",
+        "@react-spring/types": "~9.7.5"
       },
-      "engines": {
-        "node": ">=6.9.0"
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0"
       }
     },
-    "client/node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+    "client/node_modules/@types/jest": {
+      "version": "29.5.14",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
+      "integrity": "sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "expect": "^29.0.0",
+        "pretty-format": "^29.0.0"
       }
     },
-    "client/node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+    "client/node_modules/@vitejs/plugin-react": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.2.tgz",
+      "integrity": "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@rolldown/pluginutils": "^1.0.0"
       },
       "engines": {
-        "node": ">=6.9.0"
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
+        "babel-plugin-react-compiler": "^1.0.0",
+        "vite": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@rolldown/plugin-babel": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        }
       }
     },
-    "client/node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+    "client/node_modules/babel-plugin-transform-import-meta": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/babel-plugin-transform-import-meta/-/babel-plugin-transform-import-meta-2.3.2.tgz",
+      "integrity": "sha512-902o4GiQqI1GqAXfD5rEoz0PJamUfJ3VllpdWaNsFTwdaNjFSFHawvBO+cp5K2j+g2h3bZ4lnM1Xb6yFYGihtA==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "@babel/template": "^7.25.9",
+        "tslib": "^2.8.1"
       },
       "peerDependencies": {
-        "@babel/core": "^7.0.0"
+        "@babel/core": "^7.10.0"
       }
     },
-    "client/node_modules/@babel/helpers": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
-      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
+    "client/node_modules/lucide-react": {
+      "version": "0.394.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.394.0.tgz",
+      "integrity": "sha512-PzTbJ0bsyXRhH59k5qe7MpTd5MxlpYZUcM9kGSwvPGAfnn0J6FElDwu2EX6Vuh//F7y60rcVJiFQ7EK9DCMgfw==",
+      "license": "ISC",
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0"
+      }
+    },
+    "client/node_modules/react-is": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="
+    },
+    "node_modules/@aashutoshrathi/word-wrap": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz",
+      "integrity": "sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==",
       "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/@adobe/css-tools": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.3.tgz",
+      "integrity": "sha512-rE0Pygv0sEZ4vBWHlAgJLGDU7Pm8xoO6p3wsEceb7GYAjScrOHpEo8KK/eVkAcnSM+slAEtXjA2JpdjLp4fJQQ==",
+      "dev": true
+    },
+    "node_modules/@alloc/quick-lru": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
+      "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@antfu/install-pkg": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
+      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "package-manager-detector": "^1.3.0",
+        "tinyexec": "^1.0.1"
       },
-      "engines": {
-        "node": ">=6.9.0"
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
       }
     },
-    "client/node_modules/@babel/parser": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
-      "dev": true,
+    "node_modules/@anthropic-ai/sdk": {
+      "version": "0.92.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.92.0.tgz",
+      "integrity": "sha512-l653JFC83wCglH8H83t1xpgDurCyPyslYW1maPRdCsfuNuGbLvQjQ81sWd3Go3LWRm0jNspzAhuqAYV8r9joSw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "json-schema-to-ts": "^3.1.1"
       },
       "bin": {
-        "parser": "bin/babel-parser.js"
+        "anthropic-ai-sdk": "bin/cli"
       },
-      "engines": {
-        "node": ">=6.0.0"
+      "peerDependencies": {
+        "zod": "^3.25.0 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "client/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
+    "node_modules/@anthropic-ai/vertex-sdk": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/vertex-sdk/-/vertex-sdk-0.16.0.tgz",
+      "integrity": "sha512-ntxemtRkwPsjVzGQJsmBPRW38tfas6VuVlD1v6pHffDJKLPtCdaiN9KUQeraJ/F34tjxEWlsaCnl3t/orJm1Xw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "@anthropic-ai/sdk": ">=0.50.3 <1",
+        "google-auth-library": "^9.4.2"
       }
     },
-    "client/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+    "node_modules/@apideck/better-ajv-errors": {
+      "version": "0.3.7",
+      "resolved": "https://registry.npmjs.org/@apideck/better-ajv-errors/-/better-ajv-errors-0.3.7.tgz",
+      "integrity": "sha512-TajUJwGWbDwkCx/CZi7tRE8PVB7simCvKJfHUsSdvps+aTM/PDPP4gkLmKnc+x3CE//y9i/nj74GqdL/hwk7Iw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
+        "jsonpointer": "^5.0.1",
+        "leven": "^3.1.0"
       },
       "engines": {
-        "node": ">=6.9.0"
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "ajv": ">=8"
       }
     },
-    "client/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
+    "node_modules/@ariakit/components": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/components/-/components-0.1.2.tgz",
+      "integrity": "sha512-tvh2P0x1cJnoPXnmDEJwdRk3z7x6cTB8ArctcZdAUXlRg9tuwW/rJoBFJMzD5qMI9CDDlQ3Zctx58HvENw4BYw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
+        "@ariakit/store": "0.1.2",
+        "@ariakit/utils": "0.1.2"
       }
     },
-    "client/node_modules/@codesandbox/sandpack-client": {
-      "version": "2.19.8",
-      "resolved": "https://registry.npmjs.org/@codesandbox/sandpack-client/-/sandpack-client-2.19.8.tgz",
-      "integrity": "sha512-CMV4nr1zgKzVpx4I3FYvGRM5YT0VaQhALMW9vy4wZRhEyWAtJITQIqZzrTGWqB1JvV7V72dVEUCUPLfYz5hgJQ==",
-      "dependencies": {
-        "@codesandbox/nodebox": "0.1.8",
-        "buffer": "^6.0.3",
-        "dequal": "^2.0.2",
-        "mime-db": "^1.52.0",
-        "outvariant": "1.4.0",
-        "static-browser-server": "1.0.3"
-      }
+    "node_modules/@ariakit/core": {
+      "version": "0.4.20",
+      "resolved": "https://registry.npmjs.org/@ariakit/core/-/core-0.4.20.tgz",
+      "integrity": "sha512-DJbUnui0fM+2ZgiWLOMuFOmlWSJDNV3f6tqghIYRTWEm51TN/LoU6uM8og6/g7Nrwl4Uo5l8AoQT9Kkr/i/uRg==",
+      "deprecated": "This package has been split into smaller packages. Use @ariakit/components, @ariakit/store, or @ariakit/utils depending on the APIs you need.",
+      "license": "MIT"
     },
-    "client/node_modules/@codesandbox/sandpack-react": {
-      "version": "2.19.10",
-      "resolved": "https://registry.npmjs.org/@codesandbox/sandpack-react/-/sandpack-react-2.19.10.tgz",
-      "integrity": "sha512-X/7NzhR7R5pp5qYS+Gc31OzJvy+EzGz++H1YN9bJlDE+VzxTBsMN9dv3adzeo5wtxUhqexVOJS7mGr//e7KP2A==",
+    "node_modules/@ariakit/react": {
+      "version": "0.4.29",
+      "resolved": "https://registry.npmjs.org/@ariakit/react/-/react-0.4.29.tgz",
+      "integrity": "sha512-SLXlsddWHSwfUol4Yi0zULlalNWjzWjpS3zg7B7aaPd64saONQ5ktWf9KMxqBklcpjMLeF2dB9BAHAvpPVdCIQ==",
+      "license": "MIT",
       "dependencies": {
-        "@codemirror/autocomplete": "^6.4.0",
-        "@codemirror/commands": "^6.1.3",
-        "@codemirror/lang-css": "^6.0.1",
-        "@codemirror/lang-html": "^6.4.0",
-        "@codemirror/lang-javascript": "^6.1.2",
-        "@codemirror/language": "^6.3.2",
-        "@codemirror/state": "^6.2.0",
-        "@codemirror/view": "^6.7.1",
-        "@codesandbox/sandpack-client": "^2.19.8",
-        "@lezer/highlight": "^1.1.3",
-        "@react-hook/intersection-observer": "^3.1.1",
-        "@stitches/core": "^1.2.6",
-        "anser": "^2.1.1",
-        "clean-set": "^1.1.2",
-        "dequal": "^2.0.2",
-        "escape-carriage": "^1.3.1",
-        "lz-string": "^1.4.4",
-        "react-devtools-inline": "4.4.0",
-        "react-is": "^17.0.2"
+        "@ariakit/react-components": "0.1.2"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/ariakit"
       },
       "peerDependencies": {
-        "react": "^16.8.0 || ^17 || ^18",
-        "react-dom": "^16.8.0 || ^17 || ^18"
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "client/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
+    "node_modules/@ariakit/react-components": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/react-components/-/react-components-0.1.2.tgz",
+      "integrity": "sha512-SM+SPMAVlOZmGAfWNBza+0k9y4mkA5/dJhDoOyhE96cbNARy665uLdwowSJl1JGuFfcZzuzAwGon7f/rYeyfkQ==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@ariakit/components": "0.1.2",
+        "@ariakit/react-store": "0.1.2",
+        "@ariakit/react-utils": "0.1.2",
+        "@ariakit/store": "0.1.2",
+        "@ariakit/utils": "0.1.2",
+        "@floating-ui/dom": "^1.0.0"
+      },
+      "peerDependencies": {
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "client/node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
+    "node_modules/@ariakit/react-core": {
+      "version": "0.4.26",
+      "resolved": "https://registry.npmjs.org/@ariakit/react-core/-/react-core-0.4.26.tgz",
+      "integrity": "sha512-/Peh1KiVpjj79nCJIa6lEdzSTT9P9FZoy+CxByIFKL3YKdlXmDIIhS1E/tAqKbDq4ODVdynnqmrIDxE5wCoZYw==",
+      "deprecated": "This package has been split into smaller packages. Use @ariakit/react-components or @ariakit/react-utils depending on the APIs you need.",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@ariakit/core": "0.4.20",
+        "@floating-ui/dom": "^1.0.0",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "client/node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
+    "node_modules/@ariakit/react-store": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/react-store/-/react-store-0.1.2.tgz",
+      "integrity": "sha512-1r1Gn0tqhnOS0LFvHNGzn5/8C5aOANO5vb0Gxh94oR/be4zwCSE2zfQjOjRfpL+BBDhOcProME2+G6UslEJxbg==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@ariakit/react-utils": "0.1.2",
+        "@ariakit/store": "0.1.2",
+        "@ariakit/utils": "0.1.2",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "client/node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
+    "node_modules/@ariakit/react-utils": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/react-utils/-/react-utils-0.1.2.tgz",
+      "integrity": "sha512-Rnl6D1542Mqu80xK++oUv1JXS0PtNmKXd9nkdud5nyvySiBDTrmPqRW44/D+5GbuZrboreQuY3tPYwKL7a7onQ==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@ariakit/store": "0.1.2",
+        "@ariakit/utils": "0.1.2"
+      },
+      "peerDependencies": {
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "client/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
+    "node_modules/@ariakit/store": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/store/-/store-0.1.2.tgz",
+      "integrity": "sha512-SS7bV4+a+1q9M9i0WV6DD4P/ypRKlCvII8soo2UMe1yuaxZA/Fc0htHe+EZwjJ6TMLjHfHh2TDSnXyrjC7QImA==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@ariakit/utils": "0.1.2"
       }
     },
-    "client/node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
+    "node_modules/@ariakit/utils": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/@ariakit/utils/-/utils-0.1.2.tgz",
+      "integrity": "sha512-lBJhtBWpKjIck/9i7G8cahvaUgLsyGklI/Pjv+VtY9KTzyuzX5GpRbbLKMS/e1qLnFPS4C3CybYB70b1bVcAkw==",
+      "license": "MIT"
     },
-    "client/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
       }
     },
-    "client/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
       ],
+      "license": "MIT-0",
       "engines": {
         "node": ">=18"
       }
     },
-    "client/node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
-      "cpu": [
-        "arm"
-      ],
+    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
       ],
+      "license": "MIT",
       "engines": {
         "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
       }
     },
-    "client/node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
       ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
       "engines": {
         "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
       }
     },
-    "client/node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
-      "cpu": [
-        "ia32"
-      ],
+    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
       ],
+      "license": "MIT",
       "engines": {
         "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
       }
     },
-    "client/node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
-      "cpu": [
-        "loong64"
-      ],
+    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
       ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "client/node_modules/@react-spring/web": {
-      "version": "9.7.5",
-      "resolved": "https://registry.npmjs.org/@react-spring/web/-/web-9.7.5.tgz",
-      "integrity": "sha512-lmvqGwpe+CSttsWNZVr+Dg62adtKhauGwLyGE/RRyZ8AAMLgb9x3NDMA5RMElXo+IMyTkPp7nxTB8ZQlmhb6JQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@react-spring/animated": "~9.7.5",
-        "@react-spring/core": "~9.7.5",
-        "@react-spring/shared": "~9.7.5",
-        "@react-spring/types": "~9.7.5"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0"
-      }
-    },
-    "client/node_modules/@types/jest": {
-      "version": "29.5.14",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
-      "integrity": "sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "expect": "^29.0.0",
-        "pretty-format": "^29.0.0"
-      }
-    },
-    "client/node_modules/@types/node": {
-      "version": "20.19.35",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.35.tgz",
-      "integrity": "sha512-Uarfe6J91b9HAUXxjvSOdiO2UPOKLm07Q1oh0JHxoZ1y8HoqxDAu3gVrsrOHeiio0kSsoVBt4wFrKOm0dKxVPQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "client/node_modules/@vitejs/plugin-react": {
-      "version": "5.1.4",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-5.1.4.tgz",
-      "integrity": "sha512-VIcFLdRi/VYRU8OL/puL7QXMYafHmqOnwTZY50U1JPlCNj30PxCMx65c494b1K9be9hX83KVt0+gTEwTWLqToA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/core": "^7.29.0",
-        "@babel/plugin-transform-react-jsx-self": "^7.27.1",
-        "@babel/plugin-transform-react-jsx-source": "^7.27.1",
-        "@rolldown/pluginutils": "1.0.0-rc.3",
-        "@types/babel__core": "^7.20.5",
-        "react-refresh": "^0.18.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "peerDependencies": {
-        "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
-      }
-    },
-    "client/node_modules/babel-plugin-transform-import-meta": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/babel-plugin-transform-import-meta/-/babel-plugin-transform-import-meta-2.3.2.tgz",
-      "integrity": "sha512-902o4GiQqI1GqAXfD5rEoz0PJamUfJ3VllpdWaNsFTwdaNjFSFHawvBO+cp5K2j+g2h3bZ4lnM1Xb6yFYGihtA==",
-      "dev": true,
-      "license": "BSD",
-      "dependencies": {
-        "@babel/template": "^7.25.9",
-        "tslib": "^2.8.1"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.10.0"
-      }
-    },
-    "client/node_modules/browserslist": {
-      "version": "4.24.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.4.tgz",
-      "integrity": "sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "caniuse-lite": "^1.0.30001688",
-        "electron-to-chromium": "^1.5.73",
-        "node-releases": "^2.0.19",
-        "update-browserslist-db": "^1.1.1"
-      },
-      "bin": {
-        "browserslist": "cli.js"
-      },
-      "engines": {
-        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
-      }
-    },
-    "client/node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
-      }
-    },
-    "client/node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
-    "client/node_modules/framer-motion": {
-      "version": "11.18.2",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-11.18.2.tgz",
-      "integrity": "sha512-5F5Och7wrvtLVElIpclDT0CBzMVg3dL22B64aZwHtsIY8RB4mXICLrkajK4G9R+ieSAGcgrLeae2SeUTg2pr6w==",
-      "license": "MIT",
-      "dependencies": {
-        "motion-dom": "^11.18.1",
-        "motion-utils": "^11.18.1",
-        "tslib": "^2.4.0"
-      },
-      "peerDependencies": {
-        "@emotion/is-prop-valid": "*",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@emotion/is-prop-valid": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "client/node_modules/lucide-react": {
-      "version": "0.394.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.394.0.tgz",
-      "integrity": "sha512-PzTbJ0bsyXRhH59k5qe7MpTd5MxlpYZUcM9kGSwvPGAfnn0J6FElDwu2EX6Vuh//F7y60rcVJiFQ7EK9DCMgfw==",
-      "license": "ISC",
-      "peerDependencies": {
-        "react": "^16.5.1 || ^17.0.0 || ^18.0.0"
-      }
-    },
-    "client/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "client/node_modules/react-is": {
-      "version": "17.0.2",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
-      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="
-    },
-    "client/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "client/node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "client/node_modules/update-browserslist-db": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.2.tgz",
-      "integrity": "sha512-PPypAm5qvlD7XMZC3BujecnaOxwhrtoFR+Dqkk5Aa/6DssiH0ibKoketaj9w8LP7Bont1rYeoV5plxD7RTEPRg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/browserslist"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "escalade": "^3.2.0",
-        "picocolors": "^1.1.1"
-      },
-      "bin": {
-        "update-browserslist-db": "cli.js"
-      },
-      "peerDependencies": {
-        "browserslist": ">= 4.21.0"
-      }
-    },
-    "client/node_modules/vite": {
-      "version": "7.3.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
-      "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "esbuild": "^0.27.0",
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3",
-        "postcss": "^8.5.6",
-        "rollup": "^4.43.0",
-        "tinyglobby": "^0.2.15"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "funding": {
-        "url": "https://github.com/vitejs/vite?sponsor=1"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      },
-      "peerDependencies": {
-        "@types/node": "^20.19.0 || >=22.12.0",
-        "jiti": ">=1.21.0",
-        "less": "^4.0.0",
-        "lightningcss": "^1.21.0",
-        "sass": "^1.70.0",
-        "sass-embedded": "^1.70.0",
-        "stylus": ">=0.54.8",
-        "sugarss": "^5.0.0",
-        "terser": "^5.16.0",
-        "tsx": "^4.8.1",
-        "yaml": "^2.4.2"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        },
-        "jiti": {
-          "optional": true
-        },
-        "less": {
-          "optional": true
-        },
-        "lightningcss": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        },
-        "sass-embedded": {
-          "optional": true
-        },
-        "stylus": {
-          "optional": true
-        },
-        "sugarss": {
-          "optional": true
-        },
-        "terser": {
-          "optional": true
-        },
-        "tsx": {
-          "optional": true
-        },
-        "yaml": {
-          "optional": true
-        }
-      }
-    },
-    "client/node_modules/vite-plugin-node-polyfills": {
-      "version": "0.25.0",
-      "resolved": "https://registry.npmjs.org/vite-plugin-node-polyfills/-/vite-plugin-node-polyfills-0.25.0.tgz",
-      "integrity": "sha512-rHZ324W3LhfGPxWwQb2N048TThB6nVvnipsqBUJEzh3R9xeK9KI3si+GMQxCuAcpPJBVf0LpDtJ+beYzB3/chg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@rollup/plugin-inject": "^5.0.5",
-        "node-stdlib-browser": "^1.3.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/davidmyersdev"
-      },
-      "peerDependencies": {
-        "vite": "^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
-      }
-    },
-    "client/node_modules/vite-plugin-pwa": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/vite-plugin-pwa/-/vite-plugin-pwa-1.2.0.tgz",
-      "integrity": "sha512-a2xld+SJshT9Lgcv8Ji4+srFJL4k/1bVbd1x06JIkvecpQkwkvCncD1+gSzcdm3s+owWLpMJerG3aN5jupJEVw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.6",
-        "pretty-bytes": "^6.1.1",
-        "tinyglobby": "^0.2.10",
-        "workbox-build": "^7.4.0",
-        "workbox-window": "^7.4.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
-      },
-      "peerDependencies": {
-        "@vite-pwa/assets-generator": "^1.0.0",
-        "vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0",
-        "workbox-build": "^7.4.0",
-        "workbox-window": "^7.4.0"
-      },
-      "peerDependenciesMeta": {
-        "@vite-pwa/assets-generator": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@aashutoshrathi/word-wrap": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz",
-      "integrity": "sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/@adobe/css-tools": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.3.tgz",
-      "integrity": "sha512-rE0Pygv0sEZ4vBWHlAgJLGDU7Pm8xoO6p3wsEceb7GYAjScrOHpEo8KK/eVkAcnSM+slAEtXjA2JpdjLp4fJQQ==",
-      "dev": true
-    },
-    "node_modules/@alloc/quick-lru": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
-      "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@antfu/install-pkg": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
-      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
-      "license": "MIT",
-      "dependencies": {
-        "package-manager-detector": "^1.3.0",
-        "tinyexec": "^1.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
-      }
-    },
-    "node_modules/@anthropic-ai/sdk": {
-      "version": "0.92.0",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.92.0.tgz",
-      "integrity": "sha512-l653JFC83wCglH8H83t1xpgDurCyPyslYW1maPRdCsfuNuGbLvQjQ81sWd3Go3LWRm0jNspzAhuqAYV8r9joSw==",
-      "license": "MIT",
-      "dependencies": {
-        "json-schema-to-ts": "^3.1.1"
-      },
-      "bin": {
-        "anthropic-ai-sdk": "bin/cli"
-      },
-      "peerDependencies": {
-        "zod": "^3.25.0 || ^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "zod": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@anthropic-ai/vertex-sdk": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/vertex-sdk/-/vertex-sdk-0.16.0.tgz",
-      "integrity": "sha512-ntxemtRkwPsjVzGQJsmBPRW38tfas6VuVlD1v6pHffDJKLPtCdaiN9KUQeraJ/F34tjxEWlsaCnl3t/orJm1Xw==",
-      "license": "MIT",
-      "dependencies": {
-        "@anthropic-ai/sdk": ">=0.50.3 <1",
-        "google-auth-library": "^9.4.2"
-      }
-    },
-    "node_modules/@apideck/better-ajv-errors": {
-      "version": "0.3.6",
-      "resolved": "https://registry.npmjs.org/@apideck/better-ajv-errors/-/better-ajv-errors-0.3.6.tgz",
-      "integrity": "sha512-P+ZygBLZtkp0qqOAJJVX4oX/sFo5JR3eBWwwuqHHhK0GIgQOKWrAfiAaWX0aArHkRWHMuggFEgAZNxVPwPZYaA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "json-schema": "^0.4.0",
-        "jsonpointer": "^5.0.0",
-        "leven": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "ajv": ">=8"
-      }
-    },
-    "node_modules/@ariakit/core": {
-      "version": "0.4.15",
-      "resolved": "https://registry.npmjs.org/@ariakit/core/-/core-0.4.15.tgz",
-      "integrity": "sha512-vvxmZvkNhiisKM+Y1TbGMUfVVchV/sWu9F0xw0RYADXcimWPK31dd9JnIZs/OQ5pwAryAHmERHwuGQVESkSjwQ==",
-      "license": "MIT"
-    },
-    "node_modules/@ariakit/react": {
-      "version": "0.4.17",
-      "resolved": "https://registry.npmjs.org/@ariakit/react/-/react-0.4.17.tgz",
-      "integrity": "sha512-HQaIboE2axtlncJz1hRTaiQfJ1GGjhdtNcAnPwdjvl2RybfmlHowIB+HTVBp36LzroKPs/M4hPCxk7XTaqRZGg==",
-      "license": "MIT",
-      "dependencies": {
-        "@ariakit/react-core": "0.4.17"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/ariakit"
-      },
-      "peerDependencies": {
-        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
-    "node_modules/@ariakit/react-core": {
-      "version": "0.4.17",
-      "resolved": "https://registry.npmjs.org/@ariakit/react-core/-/react-core-0.4.17.tgz",
-      "integrity": "sha512-kFF6n+gC/5CRQIyaMTFoBPio2xUe0k9rZhMNdUobWRmc/twfeLVkODx+8UVYaNyKilTge8G0JFqwvFKku/jKEw==",
-      "license": "MIT",
-      "dependencies": {
-        "@ariakit/core": "0.4.15",
-        "@floating-ui/dom": "^1.0.0",
-        "use-sync-external-store": "^1.2.0"
-      },
-      "peerDependencies": {
-        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
-      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/css-calc": "^2.1.3",
-        "@csstools/css-color-parser": "^3.0.9",
-        "@csstools/css-parser-algorithms": "^3.0.4",
-        "@csstools/css-tokenizer": "^3.0.3",
-        "lru-cache": "^10.4.3"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/color-helpers": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
-      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-calc": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
-      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^3.0.5",
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-color-parser": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
-      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/color-helpers": "^5.1.0",
-        "@csstools/css-calc": "^2.1.4"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^3.0.5",
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-parser-algorithms": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
-      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@csstools/css-tokenizer": "^3.0.4"
-      }
-    },
-    "node_modules/@asamuzakjp/css-color/node_modules/@csstools/css-tokenizer": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
-      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
+      "license": "MIT",
       "engines": {
         "node": ">=18"
       }
@@ -1924,224 +1095,51 @@
       }
     },
     "node_modules/@aws-sdk/client-bedrock-agent-runtime": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-bedrock-agent-runtime/-/client-bedrock-agent-runtime-3.1041.0.tgz",
-      "integrity": "sha512-tQD9QZawn9HUVdSInfL2lxgA6f8QMftziqPa8qV2FyaZKUYaGZsG5wNDGBweVHkW+ZFaCBP+VtabRgg8v0S+UQ==",
+      "version": "3.1071.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-bedrock-agent-runtime/-/client-bedrock-agent-runtime-3.1071.0.tgz",
+      "integrity": "sha512-WKgN6xC2ymKQNXMnddtVTP8rfvuRtUiDERh/qpfqxIP2ewhbawqWxC+xCWYZer/TB+mb1lTnZ/cXQc97Be805g==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/credential-provider-node": "^3.972.39",
-        "@aws-sdk/middleware-host-header": "^3.972.10",
-        "@aws-sdk/middleware-logger": "^3.972.10",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/region-config-resolver": "^3.972.13",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@aws-sdk/util-user-agent-browser": "^3.972.10",
-        "@aws-sdk/util-user-agent-node": "^3.973.24",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/core": "^3.23.17",
-        "@smithy/eventstream-serde-browser": "^4.2.14",
-        "@smithy/eventstream-serde-config-resolver": "^4.3.14",
-        "@smithy/eventstream-serde-node": "^4.2.14",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/hash-node": "^4.2.14",
-        "@smithy/invalid-dependency": "^4.2.14",
-        "@smithy/middleware-content-length": "^4.2.14",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-retry": "^4.5.7",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.49",
-        "@smithy/util-defaults-mode-node": "^4.2.54",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-agent-runtime/node_modules/@aws-sdk/util-endpoints": {
-      "version": "3.996.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
-      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-endpoints": "^3.4.2",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/credential-provider-node": "^3.972.57",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-bedrock-agent-runtime/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-agent-runtime/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-agent-runtime/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/@aws-sdk/client-bedrock-runtime": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-bedrock-runtime/-/client-bedrock-runtime-3.1041.0.tgz",
-      "integrity": "sha512-1QehYO3jhdvNQ5mOKtwIiNV04y4aywaNZw9HzCp7SSYCX4yy+AGXc2hhYjCiMDUvQPIELuvbR8MXw81NGAj8ZQ==",
+      "version": "3.1071.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-bedrock-runtime/-/client-bedrock-runtime-3.1071.0.tgz",
+      "integrity": "sha512-1Sa7UTC98Wy+M+zYbbXEqhcL5WUE3VnAmO1Y2RikmYjWx/8nCHudjSj1bVovk6Obfrrsir9Q1AbrmKbgxwI90g==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/credential-provider-node": "^3.972.39",
-        "@aws-sdk/eventstream-handler-node": "^3.972.14",
-        "@aws-sdk/middleware-eventstream": "^3.972.10",
-        "@aws-sdk/middleware-host-header": "^3.972.10",
-        "@aws-sdk/middleware-logger": "^3.972.10",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/middleware-websocket": "^3.972.16",
-        "@aws-sdk/region-config-resolver": "^3.972.13",
-        "@aws-sdk/token-providers": "3.1041.0",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@aws-sdk/util-user-agent-browser": "^3.972.10",
-        "@aws-sdk/util-user-agent-node": "^3.973.24",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/core": "^3.23.17",
-        "@smithy/eventstream-serde-browser": "^4.2.14",
-        "@smithy/eventstream-serde-config-resolver": "^4.3.14",
-        "@smithy/eventstream-serde-node": "^4.2.14",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/hash-node": "^4.2.14",
-        "@smithy/invalid-dependency": "^4.2.14",
-        "@smithy/middleware-content-length": "^4.2.14",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-retry": "^4.5.7",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.49",
-        "@smithy/util-defaults-mode-node": "^4.2.54",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-runtime/node_modules/@aws-sdk/util-endpoints": {
-      "version": "3.996.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
-      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-endpoints": "^3.4.2",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/credential-provider-node": "^3.972.57",
+        "@aws-sdk/eventstream-handler-node": "^3.972.22",
+        "@aws-sdk/middleware-eventstream": "^3.972.18",
+        "@aws-sdk/middleware-websocket": "^3.972.30",
+        "@aws-sdk/token-providers": "3.1071.0",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-bedrock-runtime/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-runtime/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-bedrock-runtime/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/@aws-sdk/client-cloudfront": {
       "version": "3.1042.0",
       "resolved": "https://registry.npmjs.org/@aws-sdk/client-cloudfront/-/client-cloudfront-3.1042.0.tgz",
@@ -2248,10 +1246,10 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-kendra": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-kendra/-/client-kendra-3.1041.0.tgz",
-      "integrity": "sha512-GaqjopKBztgz2QSxDmY3sjS6g8PDTnai9AQPDPvPvqnEFEmK2EkzhHSNLVEAWNCPgdDVm3mpq/qkLwIK4AC7WQ==",
+    "node_modules/@aws-sdk/client-cognito-identity": {
+      "version": "3.1045.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.1045.0.tgz",
+      "integrity": "sha512-3OEn8zvtfJoN0jFfjVJ9jF2GVRDL3IjDfk6CAgVTAqjfCVjajiUD0iFAGQ4cOzdcv1LGsZ0b/snJDWalY3OePQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
@@ -2298,7 +1296,7 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-kendra/node_modules/@aws-sdk/util-endpoints": {
+    "node_modules/@aws-sdk/client-cognito-identity/node_modules/@aws-sdk/util-endpoints": {
       "version": "3.996.8",
       "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
       "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
@@ -2314,42 +1312,38 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-kendra/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/client-kendra/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
+    "node_modules/@aws-sdk/client-cognito-identity/node_modules/@smithy/util-utf8": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.3.1.tgz",
+      "integrity": "sha512-FtRrSnriXtOs4+J8/y9SbQ1xmN71hrOsN/YJr5PQQj5nR1l7YNkGS/TEk4gr0WN7gyrUqw8/RFaYVjI18732ZA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
+        "@smithy/core": "^3.24.1",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-kendra/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
+    "node_modules/@aws-sdk/client-kendra": {
+      "version": "3.1071.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-kendra/-/client-kendra-3.1071.0.tgz",
+      "integrity": "sha512-XKsCTt12sLnx1JtDpgvyaSXJVHE5P54xJcp+6Hste6rEuAqlnRFQnuT/GhxU4NeVy05Xe2gdBNPd1VmIzj/XNQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/credential-provider-node": "^3.972.57",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@aws-sdk/client-s3": {
@@ -2525,68 +1519,24 @@
       }
     },
     "node_modules/@aws-sdk/core": {
-      "version": "3.974.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.8.tgz",
-      "integrity": "sha512-njR2qoG6ZuB0kvAS2FyICsFZJ6gmCcf2X/7JcD14sUvGDm26wiZ5BrA6LOiUxKFEF+IVe7kdroxyE00YlkiYsw==",
+      "version": "3.974.22",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.22.tgz",
+      "integrity": "sha512-YofH63shc6YRdXjz80BJkpJW+Bkn0Cuu2dn4Rv7s9G2Idt58tgtzQEWxrR2xVljlVfIBeUjPuULnSVYLke3sUQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/xml-builder": "^3.972.22",
-        "@smithy/core": "^3.23.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-utf8": "^4.2.2",
+        "@aws-sdk/types": "^3.973.13",
+        "@aws-sdk/xml-builder": "^3.972.30",
+        "@aws/lambda-invoke-store": "^0.2.2",
+        "@smithy/core": "^3.24.6",
+        "@smithy/signature-v4": "^5.4.6",
+        "@smithy/types": "^4.14.3",
+        "bowser": "^2.11.0",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/core/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/core/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/core/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/@aws-sdk/crc64-nvme": {
       "version": "3.972.5",
       "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.5.tgz",
@@ -2600,13 +1550,13 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/credential-provider-env": {
-      "version": "3.972.34",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.34.tgz",
-      "integrity": "sha512-XT0jtf8Fw9JE6ppsQeoNnZRiG+jqRixMT1v1ZR17G60UvVdsQmTG8nbEyHuEPfMxDXEhfdARaM/XiEhca4lGHQ==",
+    "node_modules/@aws-sdk/credential-provider-cognito-identity": {
+      "version": "3.972.31",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.972.31.tgz",
+      "integrity": "sha512-W5JtzDp3ejzhOOknXlnt+vJsNN2GZdAcBK+hR7HQ1DCacXqS0UpmnIyihIU7CK0IB+XYWeBaN3bBv4pXavp7Vg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/nested-clients": "^3.997.6",
         "@aws-sdk/types": "^3.973.8",
         "@smithy/property-provider": "^4.2.14",
         "@smithy/types": "^4.14.1",
@@ -2616,46 +1566,58 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/credential-provider-http": {
-      "version": "3.972.36",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.36.tgz",
-      "integrity": "sha512-DPoGWfy7J7RKxvbf5kOKIGQkD2ek3dbKgzKIGrnLuvZBz5myU+Im/H6pmc14QcnFbqHMqxvtWSgRDSJW3qXLQg==",
+    "node_modules/@aws-sdk/credential-provider-env": {
+      "version": "3.972.48",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.48.tgz",
+      "integrity": "sha512-h6FEC95fbexUd6zxm4PdgS82bTcI2PRtUb2ZwMipb/Xr8bPwtf0G8rBo2jp7NA24Mbx2JA8/WingiYpA9RCCyw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-stream": "^4.5.25",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/credential-provider-ini": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.38.tgz",
-      "integrity": "sha512-oDzUBu2MGJFgoar05sPMCwSrhw44ASyccrHzj66vO69OZqi7I6hZZxXfuPLC8OCzW7C+sU+bI73XHij41yekgQ==",
+    "node_modules/@aws-sdk/credential-provider-http": {
+      "version": "3.972.50",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.50.tgz",
+      "integrity": "sha512-lJO3OLpjvz5m/RSBQmsG/CEUGsvCy5ruxKwPQaOCqxqCMuyYT2BZwQUTDZVVwqQ9LrZKuK24JSa6r31hL/tvkg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/credential-provider-env": "^3.972.34",
-        "@aws-sdk/credential-provider-http": "^3.972.36",
-        "@aws-sdk/credential-provider-login": "^3.972.38",
-        "@aws-sdk/credential-provider-process": "^3.972.34",
-        "@aws-sdk/credential-provider-sso": "^3.972.38",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/credential-provider-imds": "^4.2.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@aws-sdk/credential-provider-ini": {
+      "version": "3.972.55",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.55.tgz",
+      "integrity": "sha512-TBoF4buBGYhXjdZAryayY2TrkQj2B2KfE/msG4V53XCt+w0EhEwM2JRjx8p2grJ2C6gtH5++SAwEvGMRdi0yyw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/credential-provider-env": "^3.972.48",
+        "@aws-sdk/credential-provider-http": "^3.972.50",
+        "@aws-sdk/credential-provider-login": "^3.972.54",
+        "@aws-sdk/credential-provider-process": "^3.972.48",
+        "@aws-sdk/credential-provider-sso": "^3.972.54",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.54",
+        "@aws-sdk/nested-clients": "^3.997.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/credential-provider-imds": "^4.3.7",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2663,18 +1625,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-login": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.38.tgz",
-      "integrity": "sha512-g1NosS8qe4OF++G2UFCM5ovSkgipC7YYor5KCWatG0UoMSO5YFj9C8muePlyVmOBV/WTI16Jo3/s1NUo/o1Bww==",
+      "version": "3.972.54",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.54.tgz",
+      "integrity": "sha512-hBWI3wZTdTGiuMfmPts6AWbAjFfRniOQnqx68tc2cQvRKWawFbN9wkLOVPWM1FAOyowZU73mC6Fi+rHSHNyLFw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/nested-clients": "^3.997.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2682,22 +1642,21 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-node": {
-      "version": "3.972.39",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.39.tgz",
-      "integrity": "sha512-HEswDQyxUtadoZ/bJsPPENHg7R0Lzym5LuMksJeHvqhCOpP+rtkDLKI4/ZChH4w3cf5kG8n6bZuI8PzajoiqMg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/credential-provider-env": "^3.972.34",
-        "@aws-sdk/credential-provider-http": "^3.972.36",
-        "@aws-sdk/credential-provider-ini": "^3.972.38",
-        "@aws-sdk/credential-provider-process": "^3.972.34",
-        "@aws-sdk/credential-provider-sso": "^3.972.38",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/credential-provider-imds": "^4.2.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+      "version": "3.972.57",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.57.tgz",
+      "integrity": "sha512-u6dClpzNdWf1HGWz4wwhdXi1wiOofCLniM9S4BQQGlLAN9TW7VB+ld5V533GdKrYMaFeBGFqKnj0JCYvynLqwQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/credential-provider-env": "^3.972.48",
+        "@aws-sdk/credential-provider-http": "^3.972.50",
+        "@aws-sdk/credential-provider-ini": "^3.972.55",
+        "@aws-sdk/credential-provider-process": "^3.972.48",
+        "@aws-sdk/credential-provider-sso": "^3.972.54",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.54",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/credential-provider-imds": "^4.3.7",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2705,16 +1664,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-process": {
-      "version": "3.972.34",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.34.tgz",
-      "integrity": "sha512-T3IFs4EVmVi1dVN5RciFnklCANSzvrQd/VuHY9ThHSQmYkTogjcGkoJEr+oNUPQZnso52183088NqysMPji1/Q==",
+      "version": "3.972.48",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.48.tgz",
+      "integrity": "sha512-w6VZwojPt12WnEkAUy6Nu4K6sWCbBmR7QX390b0nE6vRvkXbrYr9Lq9VySGkfjiMjpUA87op+J4EgvRmtWIDoQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2722,18 +1680,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-sso": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.38.tgz",
-      "integrity": "sha512-5ZxG+t0+3Q3QPh8KEjX6syskhgNf7I0MN7oGioTf6Lm1NTjfP7sIcYGNsthXC2qR8vcD3edNZwCr2ovfSSWuRA==",
+      "version": "3.972.54",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.54.tgz",
+      "integrity": "sha512-23uZpIpF2SIFDCa1fcWa202tK4gGeyvX6GIIAjiB8WBsvsVRBMnJ/7dCxHzxf7eZT7GToJg837LDIBnZsl/VUg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/token-providers": "3.1041.0",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/nested-clients": "^3.997.22",
+        "@aws-sdk/token-providers": "3.1071.0",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2741,16 +1698,46 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-web-identity": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.38.tgz",
-      "integrity": "sha512-lYHFF30DGI20jZcYX8cm6Ns0V7f1dDN6g/MBDLTyD/5iw+bXs3yBr2iAiHDkx4RFU5JgsnZvCHYKiRVPRdmOgw==",
+      "version": "3.972.54",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.54.tgz",
+      "integrity": "sha512-0Iv5QttS6wcATlodYKgvQj6B9Db51rx7NU9fqu0PoLeS4BIgdYMc/QK4smwLwpm5RFrs02V/eLyEFp3FklvlNQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/nested-clients": "^3.997.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@aws-sdk/credential-providers": {
+      "version": "3.1045.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-providers/-/credential-providers-3.1045.0.tgz",
+      "integrity": "sha512-J+it58HUGyMIAquB6pWtvmO4m0E/gQ/Tz9Xcoogk3Rety13likU5U8HioeIgE+aN1DDOAB//MARoIdLZS1Mpfw==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@aws-sdk/client-cognito-identity": "3.1045.0",
         "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/credential-provider-cognito-identity": "^3.972.31",
+        "@aws-sdk/credential-provider-env": "^3.972.34",
+        "@aws-sdk/credential-provider-http": "^3.972.36",
+        "@aws-sdk/credential-provider-ini": "^3.972.38",
+        "@aws-sdk/credential-provider-login": "^3.972.38",
+        "@aws-sdk/credential-provider-node": "^3.972.39",
+        "@aws-sdk/credential-provider-process": "^3.972.34",
+        "@aws-sdk/credential-provider-sso": "^3.972.38",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
         "@aws-sdk/nested-clients": "^3.997.6",
         "@aws-sdk/types": "^3.973.8",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
         "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
         "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
@@ -2759,14 +1746,14 @@
       }
     },
     "node_modules/@aws-sdk/eventstream-handler-node": {
-      "version": "3.972.14",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/eventstream-handler-node/-/eventstream-handler-node-3.972.14.tgz",
-      "integrity": "sha512-m4X56gxG76/CKfxNVbOFuYwnAZcHgS6HOH8lgp15HoGHIAVTcZfZrXvcYzJFOMLEJgVn+JHBu6EiNV+xSNXXFg==",
+      "version": "3.972.22",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/eventstream-handler-node/-/eventstream-handler-node-3.972.22.tgz",
+      "integrity": "sha512-tqPJv0dz4+O0hWGm1a6YekcMZyPhDFs/zH73Von7icaVT5n0Jqvm86typ3jRrG+qoUdPhALOnboRLTmnWQTlYQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/eventstream-codec": "^4.2.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2804,14 +1791,14 @@
       }
     },
     "node_modules/@aws-sdk/middleware-eventstream": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-eventstream/-/middleware-eventstream-3.972.10.tgz",
-      "integrity": "sha512-QUqLs7Af1II9X4fCRAu+EGHG3KHyOp4RkuLhRKoA3NuFlh6TL8i+zXBl8w2LUxqm44B/Kom45hgSlwA1SpTsXQ==",
+      "version": "3.972.18",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-eventstream/-/middleware-eventstream-3.972.18.tgz",
+      "integrity": "sha512-OHpk8YoZi3yexPq8aFt1vN1IxA2zLKvsIR5GpWYylX/ve6kQmY7wxHNSFy/D3t2apMZ16rs76Co4dJWcDyIk3A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3103,150 +2090,38 @@
       }
     },
     "node_modules/@aws-sdk/middleware-websocket": {
-      "version": "3.972.16",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-websocket/-/middleware-websocket-3.972.16.tgz",
-      "integrity": "sha512-86+S9oCyRVGzoMRpQhxkArp7kD2K75GPmaNevd9B6EyNhWoNvnCZZ3WbgN4j7ZT+jvtvBCGZvI2XHsWZJ+BRIg==",
+      "version": "3.972.30",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-websocket/-/middleware-websocket-3.972.30.tgz",
+      "integrity": "sha512-kH6N4f/Fzi9r/dYap8EQ+Zk4NOz8pl4AtWKhzAoG2C1/4YkIHok9APp/e+75woreWQq264n+LkrJsJVZ0Q+M1Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-format-url": "^3.972.10",
-        "@smithy/eventstream-codec": "^4.2.14",
-        "@smithy/eventstream-serde-browser": "^4.2.14",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-hex-encoding": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/signature-v4": "^5.4.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">= 14.0.0"
       }
     },
-    "node_modules/@aws-sdk/middleware-websocket/node_modules/@aws-sdk/util-format-url": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-format-url/-/util-format-url-3.972.10.tgz",
-      "integrity": "sha512-DEKiHNJVtNxdyTeQspzY+15Po/kHm6sF0Cs4HV9Q2+lplB63+DrvdeiSoOSdWEWAoO2RcY1veoXVDz2tWxWCgQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/querystring-builder": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-websocket/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-websocket/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-websocket/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/@aws-sdk/nested-clients": {
-      "version": "3.997.6",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.6.tgz",
-      "integrity": "sha512-WBDnqatJl+kGObpfmfSxqnXeYTu3Me8wx8WCtvoxX3pfWrrTv8I4WTMSSs7PZqcRcVh8WeUKMgGFjMG+52SR1w==",
+      "version": "3.997.22",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.22.tgz",
+      "integrity": "sha512-4IwtcYSxEIVw5hcp8ogq0CMbFNZFw7jJUetpfFUhFFeqsa1K8j2Ihg2hnxLyOp3stMZnXda6VzOmPi1AFZQXcg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/middleware-host-header": "^3.972.10",
-        "@aws-sdk/middleware-logger": "^3.972.10",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/region-config-resolver": "^3.972.13",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.25",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@aws-sdk/util-user-agent-browser": "^3.972.10",
-        "@aws-sdk/util-user-agent-node": "^3.973.24",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/core": "^3.23.17",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/hash-node": "^4.2.14",
-        "@smithy/invalid-dependency": "^4.2.14",
-        "@smithy/middleware-content-length": "^4.2.14",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-retry": "^4.5.7",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.49",
-        "@smithy/util-defaults-mode-node": "^4.2.54",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@aws-sdk/middleware-sdk-s3": {
-      "version": "3.972.37",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.37.tgz",
-      "integrity": "sha512-Km7M+i8DrLArVzrid1gfxeGhYHBd3uxvE77g0s5a52zPSVosxzQBnJ0gwWb6NIp/DOk8gsBMhi7V+cpJG0ndTA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-arn-parser": "^3.972.3",
-        "@smithy/core": "^3.23.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-config-provider": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3254,88 +2129,20 @@
       }
     },
     "node_modules/@aws-sdk/nested-clients/node_modules/@aws-sdk/signature-v4-multi-region": {
-      "version": "3.996.25",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.25.tgz",
-      "integrity": "sha512-+CMIt3e1VzlklAECmG+DtP1sV8iKq25FuA0OKpnJ4KA0kxUtd7CgClY7/RU6VzJBQwbN4EJ9Ue6plvqx1qGadw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/middleware-sdk-s3": "^3.972.37",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@aws-sdk/util-arn-parser": {
-      "version": "3.972.3",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-arn-parser/-/util-arn-parser-3.972.3.tgz",
-      "integrity": "sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA==",
+      "version": "3.996.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.35.tgz",
+      "integrity": "sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/signature-v4": "^5.4.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@aws-sdk/util-endpoints": {
-      "version": "3.996.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
-      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-endpoints": "^3.4.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/nested-clients/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/@aws-sdk/region-config-resolver": {
       "version": "3.972.13",
       "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.13.tgz",
@@ -3415,17 +2222,16 @@
       }
     },
     "node_modules/@aws-sdk/token-providers": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1041.0.tgz",
-      "integrity": "sha512-Th7kPI6YPtvJUcdznooXJMy+9rQWjmEF81LxaJssngBzuysK4a/x+l8kjm1zb7nYsUPbndnBdUnwng/3PLvtGw==",
+      "version": "3.1071.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1071.0.tgz",
+      "integrity": "sha512-4LDW2Qob6LoLFuqYSYZq2AyTE9koSE9+i+n5UZcm10GpmQOK0zRD9L4uYlzItiTKksIWgC/qMFChAi3RvKYtMg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.22",
+        "@aws-sdk/nested-clients": "^3.997.22",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3433,12 +2239,12 @@
       }
     },
     "node_modules/@aws-sdk/types": {
-      "version": "3.973.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.8.tgz",
-      "integrity": "sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw==",
+      "version": "3.973.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.13.tgz",
+      "integrity": "sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.1",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3550,14 +2356,13 @@
       }
     },
     "node_modules/@aws-sdk/xml-builder": {
-      "version": "3.972.22",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.22.tgz",
-      "integrity": "sha512-PMYKKtJd70IsSG0yHrdAbxBr+ZWBKLvzFZfD3/urxgf6hXVMzuU5M+3MJ5G67RpOmLBu1fAUN65SbWuKUCOlAA==",
+      "version": "3.972.30",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.30.tgz",
+      "integrity": "sha512-StElZPEoBquWwNqw1AcfpzEyZqJvFxouG+mpDNYlcH6ZOrqd2CuIryv+8LV8gNHZUOyKyJF3Dq9vxaXEmDR9TQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@nodable/entities": "2.1.0",
-        "@smithy/types": "^4.14.1",
-        "fast-xml-parser": "5.7.2",
+        "@smithy/types": "^4.14.3",
+        "fast-xml-parser": "5.7.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3862,12 +2667,12 @@
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
-      "integrity": "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -3876,29 +2681,29 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.5.tgz",
-      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@babel/generator": "^7.28.5",
-        "@babel/helper-compilation-targets": "^7.27.2",
-        "@babel/helper-module-transforms": "^7.28.3",
-        "@babel/helpers": "^7.28.4",
-        "@babel/parser": "^7.28.5",
-        "@babel/template": "^7.27.2",
-        "@babel/traverse": "^7.28.5",
-        "@babel/types": "^7.28.5",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -3923,13 +2728,13 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.28.5.tgz",
-      "integrity": "sha512-3EwLFhZ38J4VyIP6WNtt2kUdW9dokXA9Cr4IVIFHuCpZ3H8/YFOl5JjZHisrn1fATPBmKKqXzDFvh9fUwHz6CQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.28.5",
-        "@babel/types": "^7.28.5",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -3952,13 +2757,13 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.27.2",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.27.2.tgz",
-      "integrity": "sha512-2+1thGUUWWjLTYTHZWK1n8Yga0ijBz1XAhUXcKy81rd5g6yh7hGqMp45v7cadSbEHc9G3OTv45SyneRN3ps4DQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.27.2",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -3997,102 +2802,6 @@
         "@babel/core": "^7.0.0"
       }
     },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/parser": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.2.tgz",
-      "integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
       "version": "6.3.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
@@ -4145,9 +2854,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -4168,27 +2877,27 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.27.1.tgz",
-      "integrity": "sha512-0gSFWUPNXNopqtIPQvlD5WgXYI5GY2kP2cCvoT8kczjbfcfuIljTbcWrulD1CIPIX2gt1wghbDy08yE1p+/r3w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.27.1",
-        "@babel/types": "^7.27.1"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.3.tgz",
-      "integrity": "sha512-gytXUbs8k2sXS9PnQptz5o0QnpLL51SwASIORY6XaBKF88nsOT0Zw9szLqlSGQDP/4TljBAD5y98p2U1fqkdsw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.27.1",
-        "@babel/traverse": "^7.28.3"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -4255,102 +2964,6 @@
         "@babel/core": "^7.0.0"
       }
     },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/parser": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.2.tgz",
-      "integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.27.1.tgz",
@@ -4366,27 +2979,27 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -4407,122 +3020,26 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-wrap-function/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/helpers": {
-      "version": "7.28.4",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.4.tgz",
-      "integrity": "sha512-HFN59MmQXGHVyYadKLVumYsA9dBFun/ldYxipEjzA4196jpLZd8UjEEBLkbEkvfYreDqJhZxYAWFPtrfhNpj4w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.27.2",
-        "@babel/types": "^7.28.4"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.5.tgz",
-      "integrity": "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.28.5"
+        "@babel/types": "^7.29.7"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -4554,178 +3071,82 @@
       "integrity": "sha512-qNeq3bCKnGgLkEXUuFry6dPlGfCdQNZbn7yUAPCInwAJHMU7THJfrBSozkcWq5sNM6RcF3S8XyQL2A52KNR9IA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.27.1.tgz",
-      "integrity": "sha512-g4L7OYun04N1WyqMNjldFwlfPCLVkgB54A/YCXICZYBsvJJE3kByKv9c9+R/nAfmIfjl2rKYLNyMHboYbZaWaA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array/-/plugin-bugfix-safari-rest-destructuring-rhs-array-7.29.3.tgz",
-      "integrity": "sha512-SRS46DFR4HqzUzCVgi90/xMoL+zeBDBvWdKYXSEzh79kXswNFEglUpMKxR04//dPqwYXWUBJ3mpUd933ru9Kmg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6",
-        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.27.1.tgz",
-      "integrity": "sha512-oO02gcONcD5O1iTLi/6frMJBIwWEHceWGSGqrpCmEL8nogiS6J9PBlE48CaK20/Jx1LuRml9aDftLgdjXT8+Cw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1",
-        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1",
-        "@babel/plugin-transform-optional-chaining": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.13.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.28.6.tgz",
-      "integrity": "sha512-a0aBScVTlNaiUe35UtfxAN7A/tehvvG4/ByO6+46VPKTRSlfnAFsgKy0FUh+qAkQrDTmhDkT+IBOKlOoMUxQ0g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6",
-        "@babel/traverse": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.27.1"
       },
       "engines": {
         "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
       }
     },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+    "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.27.1.tgz",
+      "integrity": "sha512-g4L7OYun04N1WyqMNjldFwlfPCLVkgB54A/YCXICZYBsvJJE3kByKv9c9+R/nAfmIfjl2rKYLNyMHboYbZaWaA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
+        "@babel/helper-plugin-utils": "^7.27.1"
       },
       "engines": {
-        "node": ">=6.0.0"
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
       }
     },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+    "node_modules/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array": {
+      "version": "7.29.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array/-/plugin-bugfix-safari-rest-destructuring-rhs-array-7.29.3.tgz",
+      "integrity": "sha512-SRS46DFR4HqzUzCVgi90/xMoL+zeBDBvWdKYXSEzh79kXswNFEglUpMKxR04//dPqwYXWUBJ3mpUd933ru9Kmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.28.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1"
       },
       "engines": {
         "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
       }
     },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+    "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.27.1.tgz",
+      "integrity": "sha512-oO02gcONcD5O1iTLi/6frMJBIwWEHceWGSGqrpCmEL8nogiS6J9PBlE48CaK20/Jx1LuRml9aDftLgdjXT8+Cw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
+        "@babel/helper-plugin-utils": "^7.27.1",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1",
+        "@babel/plugin-transform-optional-chaining": "^7.27.1"
       },
       "engines": {
         "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.13.0"
       }
     },
-    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+    "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.28.6.tgz",
+      "integrity": "sha512-a0aBScVTlNaiUe35UtfxAN7A/tehvvG4/ByO6+46VPKTRSlfnAFsgKy0FUh+qAkQrDTmhDkT+IBOKlOoMUxQ0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-plugin-utils": "^7.28.6",
+        "@babel/traverse": "^7.28.6"
       },
       "engines": {
         "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
       }
     },
     "node_modules/@babel/plugin-proposal-private-property-in-object": {
@@ -5031,102 +3452,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-generator-functions/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/plugin-transform-async-to-generator": {
       "version": "7.28.6",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.28.6.tgz",
@@ -5145,116 +3470,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-async-to-generator/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/plugin-transform-block-scoped-functions": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.27.1.tgz",
@@ -5342,129 +3557,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-classes/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/@babel/plugin-transform-computed-properties": {
       "version": "7.28.6",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.28.6.tgz",
@@ -5482,66 +3574,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-computed-properties/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-computed-properties/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-computed-properties/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-computed-properties/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/plugin-transform-destructuring": {
       "version": "7.28.5",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.28.5.tgz",
@@ -5807,134 +3839,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/parser": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.2.tgz",
-      "integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-commonjs/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/plugin-transform-modules-systemjs": {
       "version": "7.29.4",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.4.tgz",
@@ -5954,134 +3858,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-modules-systemjs/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/plugin-transform-modules-umd": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.27.1.tgz",
@@ -6184,129 +3960,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/types": "^7.29.0"
-      },
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
-        "debug": "^4.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-object-rest-spread/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/@babel/plugin-transform-object-super": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.27.1.tgz",
@@ -6473,38 +4126,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/plugin-transform-react-jsx-self": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.27.1.tgz",
-      "integrity": "sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-react-jsx-source": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.27.1.tgz",
-      "integrity": "sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
     "node_modules/@babel/plugin-transform-react-pure-annotations": {
       "version": "7.23.3",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.23.3.tgz",
@@ -6867,23 +4488,6 @@
         "@babel/core": "^7.0.0-0"
       }
     },
-    "node_modules/@babel/preset-env/node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/preset-env/node_modules/@babel/helper-define-polyfill-provider": {
       "version": "0.6.8",
       "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.8.tgz",
@@ -7041,31 +4645,31 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.27.2",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.27.2.tgz",
-      "integrity": "sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@babel/parser": "^7.27.2",
-        "@babel/types": "^7.27.1"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.28.5.tgz",
-      "integrity": "sha512-TCCj4t55U90khlYkVV/0TfkJkAkUg3jZFA3Neb7unZT8CPok7iiRfaX0F+WnqWqt7OxhOn0uBKXCw4lbL8W0aQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@babel/generator": "^7.28.5",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.28.5",
-        "@babel/template": "^7.27.2",
-        "@babel/types": "^7.28.5",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -7073,13 +4677,13 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.5.tgz",
-      "integrity": "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -9129,21 +6733,21 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.7.1.tgz",
-      "integrity": "sha512-o1uhUASyo921r2XtHYOHy7gdkGLge8ghBEQHMWmyJFoXlpU58kIrhhN3w26lpQb6dspetweapMn2CSNwQ8I4wg==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.1.0",
+        "@emnapi/wasi-threads": "1.2.1",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.7.1.tgz",
-      "integrity": "sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -9151,9 +6755,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
-      "integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9161,27 +6765,10 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.0",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.0.tgz",
-      "integrity": "sha512-ayVFHdtZ+hsq1t2Dy24wCmGXGe4q9Gu3smhLYALJrr473ZH27MsnSL+LKUlimp4BWJqMDMLmPpx/Q9R3OAlL4g==",
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9198,9 +6785,9 @@
       }
     },
     "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.1.tgz",
-      "integrity": "sha512-CCZCDJuduB9OUkFkY2IgppNZMi2lBQgD2qzwXkEia16cge2pijY/aXi96CJMquDMn3nJdlPV1A5KrJEXwfLNzQ==",
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9979,9 +7566,9 @@
       "license": "MIT"
     },
     "node_modules/@google/genai": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.0.1.tgz",
-      "integrity": "sha512-trxxbVePM9J8Cuni5x7+xvApoqb2y6Zk27/wugjT2cuwHOT78nFGdf/Ni29MkDxzWwrj90OQpno1Ana6dm3D2A==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.8.0.tgz",
+      "integrity": "sha512-pc2ayxqO5+O7AvnHBqpNHIk7PAZkHZgL31tbyx0gJZBSS9qPYiQoqwK7oYOw/ePmG6QY4EMSu+304vD5QlhXAw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -10018,13 +7605,13 @@
       }
     },
     "node_modules/@google/genai/node_modules/gcp-metadata": {
-      "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
-      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.3.tgz",
+      "integrity": "sha512-ziTrzUhhpL9Zk5k0HHzgP/KIpWDJT0VMBC/ynt/QIBvTW+UUcSivQRl6VlwTf/EilDxtSWklHoRsKy1c4k+59w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "gaxios": "^7.0.0",
-        "google-logging-utils": "^1.0.0",
+        "gaxios": "7.1.3",
+        "google-logging-utils": "1.1.3",
         "json-bigint": "^1.0.0"
       },
       "engines": {
@@ -10112,9 +7699,10 @@
       }
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.9.15",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.9.15.tgz",
-      "integrity": "sha512-nqE7Hc0AzI+euzUwDAy0aY5hCp10r734gMGRdU+qOPX0XSceI2ULrcXB5U2xSc5VkWwalCj4M7GzCAygZl2KoQ==",
+      "version": "1.9.16",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.9.16.tgz",
+      "integrity": "sha512-wE4Ut/olIzfKqp631XrG+wbF0v1vWFN4YL9FyXC2LJiG33DsV7PLzURjrCvY/6je2ntdRkeLpPDluzSRGaVltQ==",
+      "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.7.8",
         "@types/node": ">=12.12.47"
@@ -10213,48 +7801,254 @@
         "@humanwhocodes/retry": "^0.3.0"
       },
       "engines": {
-        "node": ">=18.18.0"
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node/node_modules/@humanwhocodes/retry": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.3.1.tgz",
+      "integrity": "sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@hyperdx/browser": {
+      "version": "0.24.0",
+      "resolved": "https://registry.npmjs.org/@hyperdx/browser/-/browser-0.24.0.tgz",
+      "integrity": "sha512-DTk6Er+RKMe1O9e1uE3ORYl/LLRPlBeVwdUvHOYtqCSJLGcoUbhxyiX6msiTFRbfYu+pohkapxpJ7khYxYYq9g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@hyperdx/otel-web": "0.18.0",
+        "@hyperdx/otel-web-session-recorder": "2.0.0"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-exception": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@hyperdx/instrumentation-exception/-/instrumentation-exception-0.3.0.tgz",
+      "integrity": "sha512-4u0Rp02xNfd8uVg2UYEuDOvEXuYzvgQAEUn2ZpZ/50wXWES4X7yE30fan4JcMB3CN8el0LkKb127dnSC62/qEg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@hyperdx/instrumentation-sentry-node": "^0.2.0",
+        "@opentelemetry/core": "^2.7.1",
+        "@opentelemetry/instrumentation": "^0.218.0",
+        "@opentelemetry/semantic-conventions": "^1.41.1",
+        "@sentry/core": "^8.7.0",
+        "@sentry/types": "^8.7.0",
+        "@sentry/utils": "^8.7.0",
+        "json-stringify-safe": "^5.0.1",
+        "shimmer": "^1.2.1",
+        "tslib": "^2.5.3"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.1"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-exception/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-exception/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-sentry-node": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@hyperdx/instrumentation-sentry-node/-/instrumentation-sentry-node-0.2.0.tgz",
+      "integrity": "sha512-6a7rbTk3A5ronTrQhrSDodf13Jr1gYNyeuiQ28T8uSIyp9i/FQNHWr5oDYnrV+B5KiaHso1yW5uiNMO7dZxRQw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "^2.7.1",
+        "@opentelemetry/instrumentation": "^0.218.0",
+        "@opentelemetry/semantic-conventions": "^1.41.1",
+        "json-stringify-safe": "^5.0.1",
+        "shimmer": "^1.2.1",
+        "tslib": "^2.5.3"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.1"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-sentry-node/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@hyperdx/instrumentation-sentry-node/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@humanfs/node/node_modules/@humanwhocodes/retry": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.3.1.tgz",
-      "integrity": "sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==",
-      "dev": true,
+    "node_modules/@hyperdx/otel-web": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/@hyperdx/otel-web/-/otel-web-0.18.0.tgz",
+      "integrity": "sha512-A14puQNI+ZPSAUXHCzCLSFMy52xM53Ze5KTzoNM1WHcDat0CQ3N8OoZBLSLdCknEng53JXMlH/BSW53sKclTeA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@hyperdx/instrumentation-exception": "^0.3.0",
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/core": "^2.7.1",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
+        "@opentelemetry/instrumentation": "^0.218.0",
+        "@opentelemetry/instrumentation-document-load": "^0.63.0",
+        "@opentelemetry/instrumentation-fetch": "^0.218.0",
+        "@opentelemetry/instrumentation-user-interaction": "^0.62.0",
+        "@opentelemetry/instrumentation-xml-http-request": "^0.218.0",
+        "@opentelemetry/resources": "^2.7.1",
+        "@opentelemetry/sdk-trace-base": "^2.7.1",
+        "@opentelemetry/sdk-trace-web": "^2.7.1",
+        "@opentelemetry/semantic-conventions": "^1.41.1",
+        "json-stringify-safe": "^5.0.1",
+        "lodash": "^4.18.1",
+        "shimmer": "^1.2.1",
+        "web-vitals": "^3.3.2"
+      }
+    },
+    "node_modules/@hyperdx/otel-web-session-recorder": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@hyperdx/otel-web-session-recorder/-/otel-web-session-recorder-2.0.0.tgz",
+      "integrity": "sha512-yKiVaI8mBOH3pW/DyMAodapWtKljcPLkXXH+cK9oaL9YeLoTkd9JlgCVEuQYqTVIwWmVXe97BWI8o+WMHmU89Q==",
       "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18.18"
+      "dependencies": {
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/core": "^2.7.1",
+        "@opentelemetry/resources": "^2.7.1",
+        "fflate": "0.7.4",
+        "long": "^5.2.3",
+        "protobufjs": "~7.5.8",
+        "rrweb": "1.1.3",
+        "type-fest": "4.20.1"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+      "peerDependencies": {
+        "@hyperdx/otel-web": "^0.18.0"
       }
     },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true,
+    "node_modules/@hyperdx/otel-web-session-recorder/node_modules/type-fest": {
+      "version": "4.20.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.20.1.tgz",
+      "integrity": "sha512-R6wDsVsoS9xYOpy8vgeBlqpdOyzJ12HNfQhC/aAKWM3YoCV9TtunJzh/QpkMgeDhkoynDcw5f1y+qF9yc/HHyg==",
+      "license": "(MIT OR CC0-1.0)",
       "engines": {
-        "node": ">=12.22"
+        "node": ">=16"
       },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@humanwhocodes/retry": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
-      "dev": true,
+    "node_modules/@hyperdx/otel-web/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
       "engines": {
-        "node": ">=18.18"
+        "node": "^18.19.0 || >=20.6.0"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@hyperdx/otel-web/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/@iconify/types": {
@@ -10679,16 +8473,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/camelcase": {
       "version": "5.3.1",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
@@ -10713,20 +8497,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
@@ -10825,452 +8595,24 @@
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
         "@types/jsdom": "^21.1.7",
-        "@types/node": "*",
-        "jest-mock": "30.2.0",
-        "jest-util": "30.2.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      },
-      "peerDependencies": {
-        "canvas": "^3.0.0",
-        "jsdom": "*"
-      },
-      "peerDependenciesMeta": {
-        "canvas": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@sinclair/typebox": "^0.34.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/@jest/types": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/pattern": "30.0.1",
-        "@jest/schemas": "30.0.5",
-        "@types/istanbul-lib-coverage": "^2.0.6",
-        "@types/istanbul-reports": "^3.0.4",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.33",
-        "chalk": "^4.1.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinclair/typebox": {
-      "version": "0.34.41",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
-      "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/ci-info": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
-      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/sibiraj-s"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/jest-util": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
-      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/types": "30.2.0",
-        "@types/node": "*",
-        "chalk": "^4.1.2",
-        "ci-info": "^4.2.0",
-        "graceful-fs": "^4.2.11",
-        "picomatch": "^4.0.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/environment-jsdom-abstract/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/@jest/environment/node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@sinclair/typebox": "^0.34.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/environment/node_modules/@jest/types": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/pattern": "30.0.1",
-        "@jest/schemas": "30.0.5",
-        "@types/istanbul-lib-coverage": "^2.0.6",
-        "@types/istanbul-reports": "^3.0.4",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.33",
-        "chalk": "^4.1.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/environment/node_modules/@sinclair/typebox": {
-      "version": "0.34.48",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
-      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@jest/expect-utils": {
-      "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-29.7.0.tgz",
-      "integrity": "sha512-GlsNBWiFQFCVi9QVSx7f5AgMeLxe9YCCs5PuP2O2LdjDAA8Jh9eX7lA1Jq/xdXw3Wb3hyvlFNfZIfcRetSzYcA==",
-      "dev": true,
-      "dependencies": {
-        "jest-get-type": "^29.6.3"
-      },
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.2.0.tgz",
-      "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/types": "30.2.0",
-        "@sinonjs/fake-timers": "^13.0.0",
-        "@types/node": "*",
-        "jest-message-util": "30.2.0",
-        "jest-mock": "30.2.0",
-        "jest-util": "30.2.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@sinclair/typebox": "^0.34.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/@jest/types": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/pattern": "30.0.1",
-        "@jest/schemas": "30.0.5",
-        "@types/istanbul-lib-coverage": "^2.0.6",
-        "@types/istanbul-reports": "^3.0.4",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.33",
-        "chalk": "^4.1.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/@sinclair/typebox": {
-      "version": "0.34.48",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
-      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@jest/fake-timers/node_modules/ansi-styles": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/ci-info": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
-      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/sibiraj-s"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/jest-message-util": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.2.0.tgz",
-      "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@jest/types": "30.2.0",
-        "@types/stack-utils": "^2.0.3",
-        "chalk": "^4.1.2",
-        "graceful-fs": "^4.2.11",
-        "micromatch": "^4.0.8",
-        "pretty-format": "30.2.0",
-        "slash": "^3.0.0",
-        "stack-utils": "^2.0.6"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/jest-util": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
-      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/types": "30.2.0",
-        "@types/node": "*",
-        "chalk": "^4.1.2",
-        "ci-info": "^4.2.0",
-        "graceful-fs": "^4.2.11",
-        "picomatch": "^4.0.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/pretty-format": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
-      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/schemas": "30.0.5",
-        "ansi-styles": "^5.2.0",
-        "react-is": "^18.3.1"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/fake-timers/node_modules/slash": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jest/get-type": {
-      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/pattern": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.0.1.tgz",
-      "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*",
-        "jest-regex-util": "30.0.1"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/pattern/node_modules/jest-regex-util": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
-      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/schemas": {
-      "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
-      "integrity": "sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==",
-      "dev": true,
-      "dependencies": {
-        "@sinclair/typebox": "^0.27.8"
-      },
-      "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/@jest/snapshot-utils": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.2.0.tgz",
-      "integrity": "sha512-0aVxM3RH6DaiLcjj/b0KrIBZhSX1373Xci4l3cW5xiUWPctZ59zQ7jj4rqcJQ/Z8JuN/4wX3FpJSa3RssVvCug==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/types": "30.2.0",
-        "chalk": "^4.1.2",
-        "graceful-fs": "^4.2.11",
-        "natural-compare": "^1.4.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/snapshot-utils/node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@sinclair/typebox": "^0.34.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/snapshot-utils/node_modules/@jest/types": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/pattern": "30.0.1",
-        "@jest/schemas": "30.0.5",
-        "@types/istanbul-lib-coverage": "^2.0.6",
-        "@types/istanbul-reports": "^3.0.4",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.33",
-        "chalk": "^4.1.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/snapshot-utils/node_modules/@sinclair/typebox": {
-      "version": "0.34.41",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
-      "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@jest/transform": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.2.0.tgz",
-      "integrity": "sha512-XsauDV82o5qXbhalKxD7p4TZYYdwcaEXC77PPD2HixEFF+6YGppjrAAQurTl2ECWcEomHBMMNS9AH3kcCFx8jA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/core": "^7.27.4",
-        "@jest/types": "30.2.0",
-        "@jridgewell/trace-mapping": "^0.3.25",
-        "babel-plugin-istanbul": "^7.0.1",
-        "chalk": "^4.1.2",
-        "convert-source-map": "^2.0.0",
-        "fast-json-stable-stringify": "^2.1.0",
-        "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.2.0",
-        "jest-regex-util": "30.0.1",
-        "jest-util": "30.2.0",
-        "micromatch": "^4.0.8",
-        "pirates": "^4.0.7",
-        "slash": "^3.0.0",
-        "write-file-atomic": "^5.0.1"
+        "@types/node": "*",
+        "jest-mock": "30.2.0",
+        "jest-util": "30.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@jest/transform/node_modules/@jest/schemas": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/@jest/schemas": {
       "version": "30.0.5",
       "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
@@ -11283,7 +8625,7 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@jest/transform/node_modules/@jest/types": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/@jest/types": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
@@ -11302,14 +8644,14 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@jest/transform/node_modules/@sinclair/typebox": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinclair/typebox": {
       "version": "0.34.41",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@jest/transform/node_modules/ci-info": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/ci-info": {
       "version": "4.3.1",
       "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
       "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
@@ -11325,42 +8667,7 @@
         "node": ">=8"
       }
     },
-    "node_modules/@jest/transform/node_modules/jest-haste-map": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.2.0.tgz",
-      "integrity": "sha512-sQA/jCb9kNt+neM0anSj6eZhLZUIhQgwDt7cPGjumgLM4rXsfb9kpnlacmvZz3Q5tb80nS+oG/if+NBKrHC+Xw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jest/types": "30.2.0",
-        "@types/node": "*",
-        "anymatch": "^3.1.3",
-        "fb-watchman": "^2.0.2",
-        "graceful-fs": "^4.2.11",
-        "jest-regex-util": "30.0.1",
-        "jest-util": "30.2.0",
-        "jest-worker": "30.2.0",
-        "micromatch": "^4.0.8",
-        "walker": "^1.0.8"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "^2.3.3"
-      }
-    },
-    "node_modules/@jest/transform/node_modules/jest-regex-util": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
-      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/transform/node_modules/jest-util": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/jest-util": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
@@ -11378,24 +8685,7 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@jest/transform/node_modules/jest-worker": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.2.0.tgz",
-      "integrity": "sha512-0Q4Uk8WF7BUwqXHuAjc23vmopWJw5WH7w2tqBoUOZpOjW/ZnR44GXXd1r82RvnmI2GZge3ivrYXk/BE2+VtW2g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*",
-        "@ungap/structured-clone": "^1.3.0",
-        "jest-util": "30.2.0",
-        "merge-stream": "^2.0.0",
-        "supports-color": "^8.1.1"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/transform/node_modules/picomatch": {
+    "node_modules/@jest/environment-jsdom-abstract/node_modules/picomatch": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
@@ -11408,192 +8698,120 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@jest/transform/node_modules/slash": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jest/transform/node_modules/supports-color": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+    "node_modules/@jest/environment/node_modules/@jest/schemas": {
+      "version": "30.0.5",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
+      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "has-flag": "^4.0.0"
+        "@sinclair/typebox": "^0.34.0"
       },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/supports-color?sponsor=1"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@jest/types": {
-      "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-29.6.3.tgz",
-      "integrity": "sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==",
+    "node_modules/@jest/environment/node_modules/@jest/types": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
+      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@jest/schemas": "^29.6.3",
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "@types/istanbul-reports": "^3.0.0",
+        "@jest/pattern": "30.0.1",
+        "@jest/schemas": "30.0.5",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
         "@types/node": "*",
-        "@types/yargs": "^17.0.8",
-        "chalk": "^4.0.0"
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
       },
       "engines": {
-        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz",
-      "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==",
-      "engines": {
-        "node": ">=6.0.0"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@jridgewell/source-map": {
-      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.5.tgz",
-      "integrity": "sha512-UTYAUj/wviwdsMfzoSJspJxbkH5o1snzwX0//0ENX1u/55kkZZkcTZP6u9bwKGkv+dkk9at4m1Cpt0uY80kcpQ==",
+    "node_modules/@jest/environment/node_modules/@sinclair/typebox": {
+      "version": "0.34.48",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
+      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
       "dev": true,
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.0",
-        "@jridgewell/trace-mapping": "^0.3.9"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz",
-      "integrity": "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ=="
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
+      "license": "MIT"
     },
-    "node_modules/@keyv/redis": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/@keyv/redis/-/redis-4.3.3.tgz",
-      "integrity": "sha512-J/uhvKu/Qfh11yMUs+9KdcGCLmWFd3vMxtDVQh2j9cOcnrpnM5jE1xU+K1/kI89czSVEdeMyqTC9gGNtwi3JEQ==",
-      "license": "MIT",
+    "node_modules/@jest/expect-utils": {
+      "version": "29.7.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-29.7.0.tgz",
+      "integrity": "sha512-GlsNBWiFQFCVi9QVSx7f5AgMeLxe9YCCs5PuP2O2LdjDAA8Jh9eX7lA1Jq/xdXw3Wb3hyvlFNfZIfcRetSzYcA==",
+      "dev": true,
       "dependencies": {
-        "cluster-key-slot": "^1.1.2",
-        "keyv": "^5.3.2",
-        "redis": "^4.7.0"
+        "jest-get-type": "^29.6.3"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@keyv/serialize": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.0.3.tgz",
-      "integrity": "sha512-qnEovoOp5Np2JDGonIDL6Ayihw0RhnRh6vxPuHo4RDn1UOzwEo4AeIfpL6UGIrsceWrCMiVPgwRjbHu4vYFc3g==",
-      "dependencies": {
-        "buffer": "^6.0.3"
+        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       }
     },
-    "node_modules/@langchain/anthropic": {
-      "version": "1.3.28",
-      "resolved": "https://registry.npmjs.org/@langchain/anthropic/-/anthropic-1.3.28.tgz",
-      "integrity": "sha512-gOF8oXJL8xDdYes2KXNI9vFm/9TldBBBHOjuCdt27kganVaQKzLvTw5kV6R4mjbnFagV5CWteNH7APLZYCpdwg==",
+    "node_modules/@jest/fake-timers": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.2.0.tgz",
+      "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@anthropic-ai/sdk": "^0.90.0",
-        "zod": "^3.25.76 || ^4"
+        "@jest/types": "30.2.0",
+        "@sinonjs/fake-timers": "^13.0.0",
+        "@types/node": "*",
+        "jest-message-util": "30.2.0",
+        "jest-mock": "30.2.0",
+        "jest-util": "30.2.0"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.42"
-      }
-    },
-    "node_modules/@langchain/anthropic/node_modules/zod": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.2.tgz",
-      "integrity": "sha512-IynmDyxsEsb9RKzO3J9+4SxXnl2FTFSzNBaKKaMV6tsSk0rw9gYw9gs+JFCq/qk2LCZ78KDwyj+Z289TijSkUw==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/aws": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@langchain/aws/-/aws-1.3.5.tgz",
-      "integrity": "sha512-sK+/k2gDSppiRlvjuMPKyTypxwY6/CYnhlHr74LPyp4XE3ctwBzFbPANmzEAwSRCRaqjIqE4zvnwqiiV2q2sEQ==",
+    "node_modules/@jest/fake-timers/node_modules/@jest/schemas": {
+      "version": "30.0.5",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
+      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@aws-sdk/client-bedrock-agent-runtime": "^3.1022.0",
-        "@aws-sdk/client-bedrock-runtime": "^3.1006.0",
-        "@aws-sdk/client-kendra": "^3.1006.0",
-        "@aws-sdk/credential-provider-node": "^3.972.29"
+        "@sinclair/typebox": "^0.34.0"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.0.0"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/core": {
-      "version": "1.1.44",
-      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.44.tgz",
-      "integrity": "sha512-RePW1IjGCHr9ua2vcby3aE8mOOz3EnwDZxMEGbNDT91kf14eqkJqxDXvaZFviGdcN9DTrxM5RPQNAHmwSm4tbg==",
+    "node_modules/@jest/fake-timers/node_modules/@jest/types": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
+      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@cfworker/json-schema": "^4.0.2",
-        "@standard-schema/spec": "^1.1.0",
-        "ansi-styles": "^5.0.0",
-        "camelcase": "6",
-        "decamelize": "1.2.0",
-        "js-tiktoken": "^1.0.12",
-        "langsmith": ">=0.5.0 <1.0.0",
-        "mustache": "^4.2.0",
-        "p-queue": "^6.6.2",
-        "zod": "^3.25.76 || ^4"
+        "@jest/pattern": "30.0.1",
+        "@jest/schemas": "30.0.5",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
       },
       "engines": {
-        "node": ">=20"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/core/node_modules/ansi-styles": {
+    "node_modules/@jest/fake-timers/node_modules/@sinclair/typebox": {
+      "version": "0.34.48",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
+      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jest/fake-timers/node_modules/ansi-styles": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=10"
       },
@@ -11601,2080 +8819,1749 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/@langchain/core/node_modules/zod": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.2.tgz",
-      "integrity": "sha512-IynmDyxsEsb9RKzO3J9+4SxXnl2FTFSzNBaKKaMV6tsSk0rw9gYw9gs+JFCq/qk2LCZ78KDwyj+Z289TijSkUw==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
-    "node_modules/@langchain/deepseek": {
-      "version": "1.0.25",
-      "resolved": "https://registry.npmjs.org/@langchain/deepseek/-/deepseek-1.0.25.tgz",
-      "integrity": "sha512-8IvUmS6oeSRt129Z6d7MUqBeQlVmOiP7EfLGWCTh8BMCg6IA0n8uAb7057ryOUgzuVF6GtAAJVKmFF0CnOSIJQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@langchain/openai": "1.4.5"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.0.0"
-      }
-    },
-    "node_modules/@langchain/google-common": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-common/-/google-common-2.1.28.tgz",
-      "integrity": "sha512-iSQ3IKYDWW56F0FMrk4ztm1vABox4S3EfY2ZFhEHRD/ckC3pvcAa6n5ZEH0cuMUY63OBKxPiLS0+lJG3TgLJ2A==",
-      "license": "MIT",
-      "dependencies": {
-        "uuid": "^10.0.0"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.41"
-      }
-    },
-    "node_modules/@langchain/google-common/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+    "node_modules/@jest/fake-timers/node_modules/ci-info": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
+      "dev": true,
       "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
       ],
       "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/@langchain/google-gauth": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-gauth/-/google-gauth-2.1.28.tgz",
-      "integrity": "sha512-aMxBwv0OrAa+oNQ/5kUuBo1MLXi6xtjOLtRN5XF6qpbCmqx21Z0PsMfZ4+dD0128H3O8jY8M4whgr3cdyhbVpQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@langchain/google-common": "2.1.28",
-        "google-auth-library": "^10.6.2"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@langchain/google-gauth/node_modules/gaxios": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.4.tgz",
-      "integrity": "sha512-bTIgTsM2bWn3XklZISBTQX7ZSddGW+IO3bMdGaemHZ3tbqExMENHLx6kKZ/KlejgrMtj8q7wBItt51yegqalrA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "extend": "^3.0.2",
-        "https-proxy-agent": "^7.0.1",
-        "node-fetch": "^3.3.2"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@langchain/google-gauth/node_modules/gcp-metadata": {
-      "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
-      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "gaxios": "^7.0.0",
-        "google-logging-utils": "^1.0.0",
-        "json-bigint": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@langchain/google-gauth/node_modules/google-auth-library": {
-      "version": "10.6.2",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.6.2.tgz",
-      "integrity": "sha512-e27Z6EThmVNNvtYASwQxose/G57rkRuaRbQyxM2bvYLLX/GqWZ5chWq2EBoUchJbCc57eC9ArzO5wMsEmWftCw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "base64-js": "^1.3.0",
-        "ecdsa-sig-formatter": "^1.0.11",
-        "gaxios": "^7.1.4",
-        "gcp-metadata": "8.1.2",
-        "google-logging-utils": "1.1.3",
-        "jws": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@langchain/google-gauth/node_modules/google-logging-utils": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-1.1.3.tgz",
-      "integrity": "sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@langchain/google-gauth/node_modules/node-fetch": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
-      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
-      "license": "MIT",
-      "dependencies": {
-        "data-uri-to-buffer": "^4.0.0",
-        "fetch-blob": "^3.1.4",
-        "formdata-polyfill": "^4.0.10"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/node-fetch"
-      }
-    },
-    "node_modules/@langchain/google-genai": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.28.tgz",
-      "integrity": "sha512-iTzNYWST8hTRqOXZdme18tq5GnCUwtrrJECE51ZCjg6Vg0mPsV44amdC+/bc+UK0+uphKWESGWs277aAyM2MlA==",
-      "license": "MIT",
-      "dependencies": {
-        "@google/generative-ai": "^0.24.0",
-        "uuid": "^11.1.0"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.41"
-      }
-    },
-    "node_modules/@langchain/google-vertexai": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-vertexai/-/google-vertexai-2.1.28.tgz",
-      "integrity": "sha512-NuZAvM3xlkQWZa2CCFhPAaeYwGI+raY+piwwF0f5sZTjWgYEwAQC2/GMoOK4/uaC23visNdhKGW2GeY31AQoNw==",
-      "license": "MIT",
-      "dependencies": {
-        "@langchain/google-gauth": "2.1.28"
-      },
       "engines": {
-        "node": ">=20"
+        "node": ">=8"
       }
     },
-    "node_modules/@langchain/langgraph-checkpoint": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-1.0.2.tgz",
-      "integrity": "sha512-F4E5Tr0nt8FGghgdscJtHw+ABzChOHeI80R7Y1pjIHdiJom6c2ieo76vL+FWiny80JmoGqhrVAEIWrw0cXKPxg==",
+    "node_modules/@jest/fake-timers/node_modules/jest-message-util": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.2.0.tgz",
+      "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "uuid": "^10.0.0"
+        "@babel/code-frame": "^7.27.1",
+        "@jest/types": "30.2.0",
+        "@types/stack-utils": "^2.0.3",
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "micromatch": "^4.0.8",
+        "pretty-format": "30.2.0",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.6"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.44"
-      }
-    },
-    "node_modules/@langchain/langgraph-checkpoint/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/@langchain/langgraph-sdk": {
-      "version": "1.8.10",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.8.10.tgz",
-      "integrity": "sha512-wrB3rkRw5KAmsqezwvKP3midT4qJrV6Hj9XJMYo+cbvXC4HYpSAmyY/VriSyeTFRbLG/OP/pY2Yz+9Z54nSaXQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15",
-        "p-queue": "^9.0.1",
-        "p-retry": "^7.1.1",
-        "uuid": "^13.0.0"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.16",
-        "react": "^18 || ^19",
-        "react-dom": "^18 || ^19",
-        "svelte": "^4.0.0 || ^5.0.0",
-        "vue": "^3.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@langchain/core": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        },
-        "svelte": {
-          "optional": true
-        },
-        "vue": {
-          "optional": true
-        }
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/langgraph-sdk/node_modules/p-queue": {
-      "version": "9.2.0",
-      "resolved": "https://registry.npmjs.org/p-queue/-/p-queue-9.2.0.tgz",
-      "integrity": "sha512-dWgLE8AH0HjQ9fe74pUkKkvzzYT18Inp4zra3lKHnnwqGvcfcUBrvF2EAVX+envufDNBOzpPq/IBUONDbI7+3g==",
+    "node_modules/@jest/fake-timers/node_modules/jest-util": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
+      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "eventemitter3": "^5.0.4",
-        "p-timeout": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=20"
+        "@jest/types": "30.2.0",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "ci-info": "^4.2.0",
+        "graceful-fs": "^4.2.11",
+        "picomatch": "^4.0.2"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@langchain/langgraph-sdk/node_modules/p-timeout": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-7.0.1.tgz",
-      "integrity": "sha512-AxTM2wDGORHGEkPCt8yqxOTMgpfbEHqF51f/5fJCmwFC3C/zNcGT63SymH2ttOAaiIws2zVg4+izQCjrakcwHg==",
-      "license": "MIT",
       "engines": {
-        "node": ">=20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@langchain/langgraph-sdk/node_modules/uuid": {
-      "version": "13.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.1.tgz",
-      "integrity": "sha512-9ezox2roIft6ExBVTVqibSd5dc5/47Sw/uY6b4SjQUT2TzQ0tltNquWA46y4xPQmdZYqvnio22SgWd41M86+jw==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/mistralai": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@langchain/mistralai/-/mistralai-1.0.8.tgz",
-      "integrity": "sha512-gvroJpw2bfPWk7Tkv/OmnVwj0lBpREOtTR53XT+qAgTP6kZz00vKI7IlzNCrL3TcZobUmIoujA7WnjX9ogNSIA==",
+    "node_modules/@jest/fake-timers/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@mistralai/mistralai": "^1.3.1"
-      },
       "engines": {
-        "node": ">=20"
+        "node": ">=12"
       },
-      "peerDependencies": {
-        "@langchain/core": "^1.0.0"
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@langchain/openai": {
-      "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.4.5.tgz",
-      "integrity": "sha512-bQ2WMIZfSh02trJLYSAtiIcD3j6EBCiAm9nw0dZWQsVaUxmWc3JJqs8uUte6AkMazmLHzcUIw+14UkXO5fRJvQ==",
+    "node_modules/@jest/fake-timers/node_modules/pretty-format": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
+      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "js-tiktoken": "^1.0.12",
-        "openai": "^6.34.0",
-        "zod": "^3.25.76 || ^4"
+        "@jest/schemas": "30.0.5",
+        "ansi-styles": "^5.2.0",
+        "react-is": "^18.3.1"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.42"
-      }
-    },
-    "node_modules/@langchain/openai/node_modules/openai": {
-      "version": "6.35.0",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-6.35.0.tgz",
-      "integrity": "sha512-L/skwIGnt5xQZHb0UfTu9uAUKbis3ehKypOuJKi20QvG7UStV6C8IC3myGYHcdiF4kms/bAvOJ9UqqNWqi8x/Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "openai": "bin/cli"
-      },
-      "peerDependencies": {
-        "ws": "^8.18.0",
-        "zod": "^3.25 || ^4.0"
-      },
-      "peerDependenciesMeta": {
-        "ws": {
-          "optional": true
-        },
-        "zod": {
-          "optional": true
-        }
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/openai/node_modules/zod": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.2.tgz",
-      "integrity": "sha512-IynmDyxsEsb9RKzO3J9+4SxXnl2FTFSzNBaKKaMV6tsSk0rw9gYw9gs+JFCq/qk2LCZ78KDwyj+Z289TijSkUw==",
+    "node_modules/@jest/fake-timers/node_modules/slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
+      "engines": {
+        "node": ">=8"
       }
     },
-    "node_modules/@langchain/textsplitters": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@langchain/textsplitters/-/textsplitters-1.0.1.tgz",
-      "integrity": "sha512-rheJlB01iVtrOUzttscutRgLybPH9qR79EyzBEbf1u97ljWyuxQfCwIWK+SjoQTM9O8M7GGLLRBSYE26Jmcoww==",
+    "node_modules/@jest/get-type": {
+      "version": "30.1.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
+      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "js-tiktoken": "^1.0.12"
-      },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.0.0"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langchain/xai": {
-      "version": "1.3.17",
-      "resolved": "https://registry.npmjs.org/@langchain/xai/-/xai-1.3.17.tgz",
-      "integrity": "sha512-15S5fSy3Yopa17qRynInFPHW7T3uA4yGU0QBq5D7SeXOEQBsepWsS8sQ/p1IsiCBwCQaCEp+NwEfRT5suGHpnA==",
+    "node_modules/@jest/pattern": {
+      "version": "30.0.1",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.0.1.tgz",
+      "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@langchain/openai": "1.4.5"
+        "@types/node": "*",
+        "jest-regex-util": "30.0.1"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.0.0"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langfuse/core": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@langfuse/core/-/core-4.5.1.tgz",
-      "integrity": "sha512-caJ2YWcaEU+kbzxFiyzRYaCmKxGzL9DSxbrCer8HbayYo2TaFaAu67Zeili8u8qG4q7TXga4aL2+rpU5ebWdRA==",
+    "node_modules/@jest/pattern/node_modules/jest-regex-util": {
+      "version": "30.0.1",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
+      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
+      "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.9.0"
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langfuse/langchain": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@langfuse/langchain/-/langchain-4.5.1.tgz",
-      "integrity": "sha512-+pzC/WVR9f8YS3vEi69GmTNzwqJ9z2VZN8tOGYO3zO15b306aMTvUm44/EYCanWiZjhwUNqEM25jEHB+/dCFYA==",
-      "license": "MIT",
+    "node_modules/@jest/schemas": {
+      "version": "29.6.3",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
+      "integrity": "sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==",
+      "dev": true,
       "dependencies": {
-        "@langfuse/core": "^4.5.1",
-        "@langfuse/tracing": "^4.5.1"
+        "@sinclair/typebox": "^0.27.8"
       },
-      "peerDependencies": {
-        "@langchain/core": ">=0.3.0",
-        "@opentelemetry/api": "^1.9.0"
+      "engines": {
+        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       }
     },
-    "node_modules/@langfuse/otel": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@langfuse/otel/-/otel-4.5.1.tgz",
-      "integrity": "sha512-cqykMEAYmGnd9RSZW2FPCNLda5jKZpCOnHTCu0pQD8EDgxCaHbnmD16k6WyjE/jywh991BcIFXzYub2fNbbSSQ==",
+    "node_modules/@jest/snapshot-utils": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.2.0.tgz",
+      "integrity": "sha512-0aVxM3RH6DaiLcjj/b0KrIBZhSX1373Xci4l3cW5xiUWPctZ59zQ7jj4rqcJQ/Z8JuN/4wX3FpJSa3RssVvCug==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@langfuse/core": "^4.5.1"
+        "@jest/types": "30.2.0",
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "natural-compare": "^1.4.0"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/core": "^2.0.1",
-        "@opentelemetry/exporter-trace-otlp-http": ">=0.202.0 <1.0.0",
-        "@opentelemetry/sdk-trace-base": "^2.0.1"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@langfuse/tracing": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@langfuse/tracing/-/tracing-4.5.1.tgz",
-      "integrity": "sha512-PvN8fJzEDG2IQMD7/iGhoeEzMM0fJ/ktZdy5gfMfj3/UUccigqV0flxpzvgRoAUss+0ZmqkIlJoaerHKOCMD+A==",
+    "node_modules/@jest/snapshot-utils/node_modules/@jest/schemas": {
+      "version": "30.0.5",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
+      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@langfuse/core": "^4.5.1"
+        "@sinclair/typebox": "^0.34.0"
       },
       "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.9.0"
-      }
-    },
-    "node_modules/@lezer/common": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.2.1.tgz",
-      "integrity": "sha512-yemX0ZD2xS/73llMZIK6KplkjIjf2EvAHcinDi/TfJ9hS25G0388+ClHt6/3but0oOxinTcQHJLDXh6w1crzFQ=="
-    },
-    "node_modules/@lezer/css": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/@lezer/css/-/css-1.1.8.tgz",
-      "integrity": "sha512-7JhxupKuMBaWQKjQoLtzhGj83DdnZY9MckEOG5+/iLKNK2ZJqKc6hf6uc0HjwCX7Qlok44jBNqZhHKDhEhZYLA==",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
-      }
-    },
-    "node_modules/@lezer/highlight": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.1.tgz",
-      "integrity": "sha512-Z5duk4RN/3zuVO7Jq0pGLJ3qynpxUVsh7IbUbGj88+uV2ApSAn6kWg2au3iJb+0Zi7kKtqffIESgNcRXWZWmSA==",
-      "dependencies": {
-        "@lezer/common": "^1.0.0"
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@lezer/html": {
-      "version": "1.3.10",
-      "resolved": "https://registry.npmjs.org/@lezer/html/-/html-1.3.10.tgz",
-      "integrity": "sha512-dqpT8nISx/p9Do3AchvYGV3qYc4/rKr3IBZxlHmpIKam56P47RSHkSF5f13Vu9hebS1jM0HmtJIwLbWz1VIY6w==",
+    "node_modules/@jest/snapshot-utils/node_modules/@jest/types": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
+      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.0.0",
-        "@lezer/lr": "^1.0.0"
+        "@jest/pattern": "30.0.1",
+        "@jest/schemas": "30.0.5",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@lezer/javascript": {
-      "version": "1.4.17",
-      "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.4.17.tgz",
-      "integrity": "sha512-bYW4ctpyGK+JMumDApeUzuIezX01H76R1foD6LcRX224FWfyYit/HYxiPGDjXXe/wQWASjCvVGoukTH68+0HIA==",
-      "dependencies": {
-        "@lezer/common": "^1.2.0",
-        "@lezer/highlight": "^1.1.3",
-        "@lezer/lr": "^1.3.0"
-      }
+    "node_modules/@jest/snapshot-utils/node_modules/@sinclair/typebox": {
+      "version": "0.34.41",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
+      "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/@lezer/lr": {
-      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.2.tgz",
-      "integrity": "sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==",
+    "node_modules/@jest/transform": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.2.0.tgz",
+      "integrity": "sha512-XsauDV82o5qXbhalKxD7p4TZYYdwcaEXC77PPD2HixEFF+6YGppjrAAQurTl2ECWcEomHBMMNS9AH3kcCFx8jA==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@lezer/common": "^1.0.0"
+        "@babel/core": "^7.27.4",
+        "@jest/types": "30.2.0",
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "babel-plugin-istanbul": "^7.0.1",
+        "chalk": "^4.1.2",
+        "convert-source-map": "^2.0.0",
+        "fast-json-stable-stringify": "^2.1.0",
+        "graceful-fs": "^4.2.11",
+        "jest-haste-map": "30.2.0",
+        "jest-regex-util": "30.0.1",
+        "jest-util": "30.2.0",
+        "micromatch": "^4.0.8",
+        "pirates": "^4.0.7",
+        "slash": "^3.0.0",
+        "write-file-atomic": "^5.0.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@librechat/agents": {
-      "version": "3.1.86",
-      "resolved": "https://registry.npmjs.org/@librechat/agents/-/agents-3.1.86.tgz",
-      "integrity": "sha512-cUr9AQxyWRr4NUh4p2Ynei/6SN96wdjwGp//XOf6I9TDNKhlavVdeKcOuTmLfs6Pzs7YDmbdYjYPY72SIiAiTw==",
+    "node_modules/@jest/transform/node_modules/@jest/schemas": {
+      "version": "30.0.5",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
+      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@anthropic-ai/sdk": "^0.92.0",
-        "@aws-sdk/client-bedrock-runtime": "^3.1013.0",
-        "@langchain/anthropic": "^1.3.28",
-        "@langchain/aws": "^1.3.5",
-        "@langchain/core": "1.1.44",
-        "@langchain/deepseek": "^1.0.25",
-        "@langchain/google-common": "2.1.28",
-        "@langchain/google-gauth": "2.1.28",
-        "@langchain/google-genai": "2.1.28",
-        "@langchain/google-vertexai": "2.1.28",
-        "@langchain/langgraph": "^1.2.9",
-        "@langchain/mistralai": "^1.0.8",
-        "@langchain/openai": "1.4.5",
-        "@langchain/textsplitters": "^1.0.1",
-        "@langchain/xai": "^1.3.17",
-        "@langfuse/langchain": "^4.3.0",
-        "@langfuse/otel": "^4.3.0",
-        "@langfuse/tracing": "^4.3.0",
-        "@opentelemetry/sdk-node": "^0.207.0",
-        "@scarf/scarf": "^1.4.0",
-        "@types/diff": "^7.0.2",
-        "ai-tokenizer": "^1.0.6",
-        "axios": "^1.16.0",
-        "cheerio": "^1.0.0",
-        "diff": "^9.0.0",
-        "dotenv": "^16.4.7",
-        "https-proxy-agent": "^7.0.6",
-        "mathjs": "^15.2.0",
-        "nanoid": "^3.3.7",
-        "okapibm25": "^1.4.1",
-        "openai": "^6.35.0",
-        "uuid": "^11.1.1"
+        "@sinclair/typebox": "^0.34.0"
       },
       "engines": {
-        "node": ">=20.0.0"
-      },
-      "peerDependencies": {
-        "@anthropic-ai/sandbox-runtime": "^0.0.49"
-      },
-      "peerDependenciesMeta": {
-        "@anthropic-ai/sandbox-runtime": {
-          "optional": true
-        }
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@librechat/agents/node_modules/@langchain/langgraph": {
-      "version": "1.2.9",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.2.9.tgz",
-      "integrity": "sha512-3c7BtGycHC2v9p6w/Hv8L7kEl1YnZYOQTDJtmAp3knk6JOedO7d2bYP3y0SRyhv5orUEGf/KGvx8ZsB/ideP7g==",
+    "node_modules/@jest/transform/node_modules/@jest/types": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
+      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@langchain/langgraph-checkpoint": "^1.0.1",
-        "@langchain/langgraph-sdk": "~1.8.9",
-        "@standard-schema/spec": "1.1.0",
-        "uuid": "^10.0.0"
+        "@jest/pattern": "30.0.1",
+        "@jest/schemas": "30.0.5",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@langchain/core": "^1.1.40",
-        "zod": "^3.25.32 || ^4.2.0",
-        "zod-to-json-schema": "^3.x"
-      },
-      "peerDependenciesMeta": {
-        "zod-to-json-schema": {
-          "optional": true
-        }
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@librechat/agents/node_modules/@langchain/langgraph/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+    "node_modules/@jest/transform/node_modules/@sinclair/typebox": {
+      "version": "0.34.41",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
+      "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jest/transform/node_modules/ci-info": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
+      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "dev": true,
       "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
       ],
       "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/@librechat/agents/node_modules/diff": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-9.0.0.tgz",
-      "integrity": "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==",
-      "license": "BSD-3-Clause",
       "engines": {
-        "node": ">=0.3.1"
+        "node": ">=8"
       }
     },
-    "node_modules/@librechat/agents/node_modules/openai": {
-      "version": "6.35.0",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-6.35.0.tgz",
-      "integrity": "sha512-L/skwIGnt5xQZHb0UfTu9uAUKbis3ehKypOuJKi20QvG7UStV6C8IC3myGYHcdiF4kms/bAvOJ9UqqNWqi8x/Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "openai": "bin/cli"
+    "node_modules/@jest/transform/node_modules/jest-haste-map": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.2.0.tgz",
+      "integrity": "sha512-sQA/jCb9kNt+neM0anSj6eZhLZUIhQgwDt7cPGjumgLM4rXsfb9kpnlacmvZz3Q5tb80nS+oG/if+NBKrHC+Xw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.2.0",
+        "@types/node": "*",
+        "anymatch": "^3.1.3",
+        "fb-watchman": "^2.0.2",
+        "graceful-fs": "^4.2.11",
+        "jest-regex-util": "30.0.1",
+        "jest-util": "30.2.0",
+        "jest-worker": "30.2.0",
+        "micromatch": "^4.0.8",
+        "walker": "^1.0.8"
       },
-      "peerDependencies": {
-        "ws": "^8.18.0",
-        "zod": "^3.25 || ^4.0"
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       },
-      "peerDependenciesMeta": {
-        "ws": {
-          "optional": true
-        },
-        "zod": {
-          "optional": true
-        }
+      "optionalDependencies": {
+        "fsevents": "^2.3.3"
       }
     },
-    "node_modules/@librechat/api": {
-      "resolved": "packages/api",
-      "link": true
-    },
-    "node_modules/@librechat/backend": {
-      "resolved": "api",
-      "link": true
-    },
-    "node_modules/@librechat/client": {
-      "resolved": "packages/client",
-      "link": true
-    },
-    "node_modules/@librechat/data-schemas": {
-      "resolved": "packages/data-schemas",
-      "link": true
-    },
-    "node_modules/@librechat/frontend": {
-      "resolved": "client",
-      "link": true
-    },
-    "node_modules/@marsidev/react-turnstile": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@marsidev/react-turnstile/-/react-turnstile-1.1.0.tgz",
-      "integrity": "sha512-X7bP9ZYutDd+E+klPYF+/BJHqEyyVkN4KKmZcNRr84zs3DcMoftlMAuoKqNSnqg0HE7NQ1844+TLFSJoztCdSA==",
+    "node_modules/@jest/transform/node_modules/jest-regex-util": {
+      "version": "30.0.1",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
+      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
+      "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "react": "^17.0.2 || ^18.0.0 || ^19.0",
-        "react-dom": "^17.0.2 || ^18.0.0 || ^19.0"
-      }
-    },
-    "node_modules/@mcp-ui/client": {
-      "version": "5.7.0",
-      "resolved": "https://registry.npmjs.org/@mcp-ui/client/-/client-5.7.0.tgz",
-      "integrity": "sha512-+HbPw3VS46WUSWmyJ34ZVnygb81QByA3luR6y0JDbyDZxjYtHw1FcIN7v9WbbE8PrfI0WcuWCSiNOO6sOGbwpQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@modelcontextprotocol/sdk": "*",
-        "@quilted/threads": "^3.1.3",
-        "@r2wc/react-to-web-component": "^2.0.4",
-        "@remote-dom/core": "^1.8.0",
-        "@remote-dom/react": "^1.2.2",
-        "react": "^18.3.1",
-        "react-dom": "^18.3.1"
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@mermaid-js/parser": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz",
-      "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+    "node_modules/@jest/transform/node_modules/jest-util": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
+      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@chevrotain/types": "~11.1.1"
+        "@jest/types": "30.2.0",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "ci-info": "^4.2.0",
+        "graceful-fs": "^4.2.11",
+        "picomatch": "^4.0.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@microsoft/microsoft-graph-client": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@microsoft/microsoft-graph-client/-/microsoft-graph-client-3.0.7.tgz",
-      "integrity": "sha512-/AazAV/F+HK4LIywF9C+NYHcJo038zEnWkteilcxC1FM/uK/4NVGDKGrxx7nNq1ybspAroRKT4I1FHfxQzxkUw==",
+    "node_modules/@jest/transform/node_modules/jest-worker": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.2.0.tgz",
+      "integrity": "sha512-0Q4Uk8WF7BUwqXHuAjc23vmopWJw5WH7w2tqBoUOZpOjW/ZnR44GXXd1r82RvnmI2GZge3ivrYXk/BE2+VtW2g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.12.5",
-        "tslib": "^2.2.0"
+        "@types/node": "*",
+        "@ungap/structured-clone": "^1.3.0",
+        "jest-util": "30.2.0",
+        "merge-stream": "^2.0.0",
+        "supports-color": "^8.1.1"
       },
       "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@azure/identity": {
-          "optional": true
-        },
-        "@azure/msal-browser": {
-          "optional": true
-        },
-        "buffer": {
-          "optional": true
-        },
-        "stream-browserify": {
-          "optional": true
-        }
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@mistralai/mistralai": {
-      "version": "1.15.1",
-      "resolved": "https://registry.npmjs.org/@mistralai/mistralai/-/mistralai-1.15.1.tgz",
-      "integrity": "sha512-fb995eiz3r0KsBGtRjFV+/iLbX+UpfalxpF+YitT3R6ukrPD4PN+FGwwmYcRFhNAzVzDUtTVxQYnjQWEnwV5nw==",
-      "dependencies": {
-        "ws": "^8.18.0",
-        "zod": "^3.25.0 || ^4.0.0",
-        "zod-to-json-schema": "^3.24.1"
+    "node_modules/@jest/transform/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.29.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
-      "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==",
+    "node_modules/@jest/transform/node_modules/slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@hono/node-server": "^1.19.9",
-        "ajv": "^8.17.1",
-        "ajv-formats": "^3.0.1",
-        "content-type": "^1.0.5",
-        "cors": "^2.8.5",
-        "cross-spawn": "^7.0.5",
-        "eventsource": "^3.0.2",
-        "eventsource-parser": "^3.0.0",
-        "express": "^5.2.1",
-        "express-rate-limit": "^8.2.1",
-        "hono": "^4.11.4",
-        "jose": "^6.1.3",
-        "json-schema-typed": "^8.0.2",
-        "pkce-challenge": "^5.0.0",
-        "raw-body": "^3.0.0",
-        "zod": "^3.25 || ^4.0",
-        "zod-to-json-schema": "^3.25.1"
-      },
       "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@cfworker/json-schema": "^4.1.1",
-        "zod": "^3.25 || ^4.0"
-      },
-      "peerDependenciesMeta": {
-        "@cfworker/json-schema": {
-          "optional": true
-        },
-        "zod": {
-          "optional": false
-        }
+        "node": ">=8"
       }
     },
-    "node_modules/@modelcontextprotocol/sdk/node_modules/jose": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
-      "integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
+    "node_modules/@jest/transform/node_modules/supports-color": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
       "funding": {
-        "url": "https://github.com/sponsors/panva"
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
       }
     },
-    "node_modules/@monaco-editor/loader": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/@monaco-editor/loader/-/loader-1.7.0.tgz",
-      "integrity": "sha512-gIwR1HrJrrx+vfyOhYmCZ0/JcWqG5kbfG7+d3f/C1LXk2EvzAbHSg3MQ5lO2sMlo9izoAZ04shohfKLVT6crVA==",
-      "license": "MIT",
+    "node_modules/@jest/types": {
+      "version": "29.6.3",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-29.6.3.tgz",
+      "integrity": "sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==",
+      "dev": true,
       "dependencies": {
-        "state-local": "^1.0.6"
+        "@jest/schemas": "^29.6.3",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.8",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^14.15.0 || ^16.10.0 || >=18.0.0"
       }
     },
-    "node_modules/@monaco-editor/react": {
-      "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/@monaco-editor/react/-/react-4.7.0.tgz",
-      "integrity": "sha512-cyzXQCtO47ydzxpQtCGSQGOC8Gk3ZUeBXFAxD+CWXYFo5OqZyZUonFl0DwUlTyAfRHntBfw2p3w4s9R6oe1eCA==",
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
       "license": "MIT",
       "dependencies": {
-        "@monaco-editor/loader": "^1.5.0"
-      },
-      "peerDependencies": {
-        "monaco-editor": ">= 0.25.0 < 1",
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
       }
     },
-    "node_modules/@mongodb-js/saslprep": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.3.1.tgz",
-      "integrity": "sha512-6nZrq5kfAz0POWyhljnbWQQJQ5uT8oE2ddX303q1uY0tWsivWKgBDXBBvuFPwOqRRalXJuVO9EjOdVtuhLX0zg==",
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
       "license": "MIT",
       "dependencies": {
-        "sparse-bitfield": "^3.0.3"
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
       }
     },
-    "node_modules/@napi-rs/canvas": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas/-/canvas-0.1.88.tgz",
-      "integrity": "sha512-/p08f93LEbsL5mDZFQ3DBxcPv/I4QG9EDYRRq1WNlCOXVfAHBTHMSVMwxlqG/AtnSfUr9+vgfN7MKiyDo0+Weg==",
-      "license": "MIT",
-      "optional": true,
-      "workspaces": [
-        "e2e/*"
-      ],
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz",
+      "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==",
       "engines": {
-        "node": ">= 10"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
-      },
-      "optionalDependencies": {
-        "@napi-rs/canvas-android-arm64": "0.1.88",
-        "@napi-rs/canvas-darwin-arm64": "0.1.88",
-        "@napi-rs/canvas-darwin-x64": "0.1.88",
-        "@napi-rs/canvas-linux-arm-gnueabihf": "0.1.88",
-        "@napi-rs/canvas-linux-arm64-gnu": "0.1.88",
-        "@napi-rs/canvas-linux-arm64-musl": "0.1.88",
-        "@napi-rs/canvas-linux-riscv64-gnu": "0.1.88",
-        "@napi-rs/canvas-linux-x64-gnu": "0.1.88",
-        "@napi-rs/canvas-linux-x64-musl": "0.1.88",
-        "@napi-rs/canvas-win32-arm64-msvc": "0.1.88",
-        "@napi-rs/canvas-win32-x64-msvc": "0.1.88"
+        "node": ">=6.0.0"
       }
     },
-    "node_modules/@napi-rs/canvas-android-arm64": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-android-arm64/-/canvas-android-arm64-0.1.88.tgz",
-      "integrity": "sha512-KEaClPnZuVxJ8smUWjV1wWFkByBO/D+vy4lN+Dm5DFH514oqwukxKGeck9xcKJhaWJGjfruGmYGiwRe//+/zQQ==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@jridgewell/source-map": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.5.tgz",
+      "integrity": "sha512-UTYAUj/wviwdsMfzoSJspJxbkH5o1snzwX0//0ENX1u/55kkZZkcTZP6u9bwKGkv+dkk9at4m1Cpt0uY80kcpQ==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@napi-rs/canvas-darwin-arm64": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-arm64/-/canvas-darwin-arm64-0.1.88.tgz",
-      "integrity": "sha512-Xgywz0dDxOKSgx3eZnK85WgGMmGrQEW7ZLA/E7raZdlEE+xXCozobgqz2ZvYigpB6DJFYkqnwHjqCOTSDGlFdg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@js-sdsl/ordered-map": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
+      "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+        "type": "opencollective",
+        "url": "https://opencollective.com/js-sdsl"
       }
     },
-    "node_modules/@napi-rs/canvas-darwin-x64": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-x64/-/canvas-darwin-x64-0.1.88.tgz",
-      "integrity": "sha512-Yz4wSCIQOUgNucgk+8NFtQxQxZV5NO8VKRl9ePKE6XoNyNVC8JDqtvhh3b3TPqKK8W5p2EQpAr1rjjm0mfBxdg==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@keyv/redis": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@keyv/redis/-/redis-4.3.3.tgz",
+      "integrity": "sha512-J/uhvKu/Qfh11yMUs+9KdcGCLmWFd3vMxtDVQh2j9cOcnrpnM5jE1xU+K1/kI89czSVEdeMyqTC9gGNtwi3JEQ==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
+      "dependencies": {
+        "cluster-key-slot": "^1.1.2",
+        "keyv": "^5.3.2",
+        "redis": "^4.7.0"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "engines": {
+        "node": ">= 18"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-arm-gnueabihf": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm-gnueabihf/-/canvas-linux-arm-gnueabihf-0.1.88.tgz",
-      "integrity": "sha512-9gQM2SlTo76hYhxHi2XxWTAqpTOb+JtxMPEIr+H5nAhHhyEtNmTSDRtz93SP7mGd2G3Ojf2oF5tP9OdgtgXyKg==",
-      "cpu": [
-        "arm"
-      ],
+    "node_modules/@keyv/serialize": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.0.3.tgz",
+      "integrity": "sha512-qnEovoOp5Np2JDGonIDL6Ayihw0RhnRh6vxPuHo4RDn1UOzwEo4AeIfpL6UGIrsceWrCMiVPgwRjbHu4vYFc3g==",
+      "dependencies": {
+        "buffer": "^6.0.3"
+      }
+    },
+    "node_modules/@langchain/anthropic": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@langchain/anthropic/-/anthropic-1.5.0.tgz",
+      "integrity": "sha512-IhWeK87QRAYyhlvSE0p+Zh4oylnZoa+16XP7XgvsPsLEbW4YMueVYl7aT4EsbsM37xbr3l/P7euIRdowc8WfOA==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+      "dependencies": {
+        "@anthropic-ai/sdk": "^0.103.0",
+        "zod": "^3.25.76 || ^4"
+      },
       "engines": {
-        "node": ">= 10"
+        "node": ">=20"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "peerDependencies": {
+        "@langchain/core": "^1.2.0"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-arm64-gnu": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-gnu/-/canvas-linux-arm64-gnu-0.1.88.tgz",
-      "integrity": "sha512-7qgaOBMXuVRk9Fzztzr3BchQKXDxGbY+nwsovD3I/Sx81e+sX0ReEDYHTItNb0Je4NHbAl7D0MKyd4SvUc04sg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@langchain/anthropic/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+        "url": "https://github.com/sponsors/colinhacks"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-arm64-musl": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-musl/-/canvas-linux-arm64-musl-0.1.88.tgz",
-      "integrity": "sha512-kYyNrUsHLkoGHBc77u4Unh067GrfiCUMbGHC2+OTxbeWfZkPt2o32UOQkhnSswKd9Fko/wSqqGkY956bIUzruA==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@langchain/aws": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@langchain/aws/-/aws-1.4.0.tgz",
+      "integrity": "sha512-i4xWnW4RNTNEk0L7jDKQpV8HdT1SMJ4tPl8R/42SWizEi/+kdapryPzsBBfaFVyIt909t1gE/ArN/83WAydwxw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+      "dependencies": {
+        "@aws-sdk/client-bedrock-agent-runtime": "^3.1059.0",
+        "@aws-sdk/client-bedrock-runtime": "^3.1059.0",
+        "@aws-sdk/client-kendra": "^3.1059.0",
+        "@aws-sdk/credential-provider-node": "^3.972.49"
+      },
       "engines": {
-        "node": ">= 10"
+        "node": ">=20"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "peerDependencies": {
+        "@langchain/core": "^1.0.0"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-riscv64-gnu": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-riscv64-gnu/-/canvas-linux-riscv64-gnu-0.1.88.tgz",
-      "integrity": "sha512-HVuH7QgzB0yavYdNZDRyAsn/ejoXB0hn8twwFnOqUbCCdkV+REna7RXjSR7+PdfW0qMQ2YYWsLvVBT5iL/mGpw==",
-      "cpu": [
-        "riscv64"
-      ],
+    "node_modules/@langchain/core": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.2.0.tgz",
+      "integrity": "sha512-nXmyH0FbcsASlRmC9sbqX0gjQdxgB9KcS13vkw9PMaH0zzylwZkGFU9sY0XCPa2/AokmaNTU9DOW3IUDfAtQow==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
+      "peer": true,
+      "dependencies": {
+        "@cfworker/json-schema": "^4.0.2",
+        "@standard-schema/spec": "^1.1.0",
+        "js-tiktoken": "^1.0.12",
+        "langsmith": ">=0.5.0 <1.0.0",
+        "mustache": "^4.2.0",
+        "p-queue": "^6.6.2",
+        "zod": "^3.25.76 || ^4"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "engines": {
+        "node": ">=20"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-x64-gnu": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-0.1.88.tgz",
-      "integrity": "sha512-hvcvKIcPEQrvvJtJnwD35B3qk6umFJ8dFIr8bSymfrSMem0EQsfn1ztys8ETIFndTwdNWJKWluvxztA41ivsEw==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@langchain/core/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      },
+      "peer": true,
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+        "url": "https://github.com/sponsors/colinhacks"
       }
     },
-    "node_modules/@napi-rs/canvas-linux-x64-musl": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-musl/-/canvas-linux-x64-musl-0.1.88.tgz",
-      "integrity": "sha512-eSMpGYY2xnZSQ6UxYJ6plDboxq4KeJ4zT5HaVkUnbObNN6DlbJe0Mclh3wifAmquXfrlgTZt6zhHsUgz++AK6g==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@langchain/deepseek": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@langchain/deepseek/-/deepseek-1.1.0.tgz",
+      "integrity": "sha512-H5Ed4pDTvECz3FBa2wNdKRebJ5QcvWbsgPN2TDMZD/XdLOnQ9t9PQUp8KI7PO7DrnrYwSrzRQg2VmQyzv6N/Ag==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+      "dependencies": {
+        "@langchain/openai": "1.5.0"
+      },
       "engines": {
-        "node": ">= 10"
+        "node": ">=20"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "peerDependencies": {
+        "@langchain/core": "^1.0.0"
       }
     },
-    "node_modules/@napi-rs/canvas-win32-arm64-msvc": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-arm64-msvc/-/canvas-win32-arm64-msvc-0.1.88.tgz",
-      "integrity": "sha512-qcIFfEgHrchyYqRrxsCeTQgpJZ/GqHiqPcU/Fvw/ARVlQeDX1VyFH+X+0gCR2tca6UJrq96vnW+5o7buCq+erA==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@langchain/deepseek/node_modules/@langchain/openai": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.5.0.tgz",
+      "integrity": "sha512-ooC02qF3wnQ5m0WyibVPO5vCkgyZwjWPgNrpGFSTv3ZLnKfW1yC4k2Fp4qOf6qoVmwTeYSW4C+wNiiZ3PXshMA==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+      "dependencies": {
+        "js-tiktoken": "^1.0.12",
+        "openai": "^6.41.0",
+        "zod": "^3.25.76 || ^4"
+      },
       "engines": {
-        "node": ">= 10"
+        "node": ">=20"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "peerDependencies": {
+        "@langchain/core": "^1.2.0"
       }
     },
-    "node_modules/@napi-rs/canvas-win32-x64-msvc": {
-      "version": "0.1.88",
-      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-x64-msvc/-/canvas-win32-x64-msvc-0.1.88.tgz",
-      "integrity": "sha512-ROVqbfS4QyZxYkqmaIBBpbz/BQvAR+05FXM5PAtTYVc0uyY8Y4BHJSMdGAaMf6TdIVRsQsiq+FG/dH9XhvWCFQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
+    "node_modules/@langchain/deepseek/node_modules/openai": {
+      "version": "6.44.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.44.0.tgz",
+      "integrity": "sha512-09/gH+8jH0RgUwsgWHAaxsKGRT5zVZ95IaJUnqAWj6XejIBmnFRwq2WUIF37VtDEsmGrtPmvCs5+yBSeZGWvkA==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "ws": "^8.18.0",
+        "zod": "^3.25 || ^4.0"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
-      "dev": true,
+    "node_modules/@langchain/deepseek/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
       }
     },
-    "node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
-      "dev": true,
+    "node_modules/@langchain/google-common": {
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-common/-/google-common-2.1.31.tgz",
+      "integrity": "sha512-UZylzgnG7pGq3KdLZy2UHIB5BO5ssQXL69OwQurvwJxsbZ1gg8eixB345o0fw9/AuJkOulgRMJWm8Lmr3vDI9w==",
       "license": "MIT",
       "engines": {
-        "node": "^14.21.3 || >=16"
+        "node": ">=20"
       },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+      "peerDependencies": {
+        "@langchain/core": "^1.1.47"
       }
     },
-    "node_modules/@nodable/entities": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
-      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodable"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/@nodelib/fs.scandir": {
-      "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+    "node_modules/@langchain/google-gauth": {
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-gauth/-/google-gauth-2.1.31.tgz",
+      "integrity": "sha512-k4il0hff88bQ4HiGCTiGraRGsNiKAOkb2neAea27U7m6Tmomn5Pn0WItCoyBmoEm6GoE/874pSNNk1Ze7qj07g==",
+      "license": "MIT",
       "dependencies": {
-        "@nodelib/fs.stat": "2.0.5",
-        "run-parallel": "^1.1.9"
+        "@langchain/google-common": "2.1.31",
+        "google-auth-library": "^10.6.2"
       },
       "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.stat": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
-      "engines": {
-        "node": ">= 8"
+        "node": ">=20"
       }
     },
-    "node_modules/@nodelib/fs.walk": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+    "node_modules/@langchain/google-gauth/node_modules/gaxios": {
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.5.tgz",
+      "integrity": "sha512-5FZy72Rh8LhtjmvDrKkI+lVhrsQrVKVsItxMoDm5mNQE+xR0WVIIs+jzPSJgBvKVsLi24fZhXJIsNI0bihDzFg==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@nodelib/fs.scandir": "2.1.5",
-        "fastq": "^1.6.0"
+        "extend": "^3.0.2",
+        "https-proxy-agent": "^7.0.1",
+        "node-fetch": "^3.3.2"
       },
       "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nolyfill/is-core-module": {
-      "version": "1.0.39",
-      "resolved": "https://registry.npmjs.org/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz",
-      "integrity": "sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.4.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@open-draft/deferred-promise": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@open-draft/deferred-promise/-/deferred-promise-2.2.0.tgz",
-      "integrity": "sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA=="
-    },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
-      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
+    "node_modules/@langchain/google-gauth/node_modules/gcp-metadata": {
+      "version": "8.1.2",
+      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
+      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "gaxios": "^7.0.0",
+        "google-logging-utils": "^1.0.0",
+        "json-bigint": "^1.0.0"
+      },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/api-logs": {
-      "version": "0.214.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.214.0.tgz",
-      "integrity": "sha512-40lSJeqYO8Uz2Yj7u94/SJWE/wONa7rmMKjI1ZcIjgf3MHNHv1OZUCrCETGuaRF62d5pQD1wKIW+L4lmSMTzZA==",
+    "node_modules/@langchain/google-gauth/node_modules/google-auth-library": {
+      "version": "10.7.0",
+      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.7.0.tgz",
+      "integrity": "sha512-QpTAbNJ36TliZLx3TTtahR8HG0hN9RllL1e3FymOvQSIKK8JmgV58H924ub2wa2DsS3ANjjP1Aw1N+Ramc8hqQ==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "base64-js": "^1.3.0",
+        "ecdsa-sig-formatter": "^1.0.11",
+        "gaxios": "^7.1.4",
+        "gcp-metadata": "8.1.2",
+        "google-logging-utils": "1.1.3",
+        "jws": "^4.0.0"
       },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/context-async-hooks": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/context-async-hooks/-/context-async-hooks-2.2.0.tgz",
-      "integrity": "sha512-qRkLWiUEZNAmYapZ7KGS5C4OmBLcP/H2foXeOEaowYCR0wi89fHejrfYfbuLVCMLp/dWZXKvQusdbUEZjERfwQ==",
+    "node_modules/@langchain/google-gauth/node_modules/google-logging-utils": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-1.1.3.tgz",
+      "integrity": "sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==",
       "license": "Apache-2.0",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "node": ">=14"
       }
     },
-    "node_modules/@opentelemetry/core": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.6.1.tgz",
-      "integrity": "sha512-8xHSGWpJP9wBxgBpnqGL0R3PbdWQndL1Qp50qrg71+B28zK5OQmUgcDKLJgzyAAV38t4tOyLMGDD60LneR5W8g==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/@langchain/google-gauth/node_modules/node-fetch": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
+      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "data-uri-to-buffer": "^4.0.0",
+        "fetch-blob": "^3.1.4",
+        "formdata-polyfill": "^4.0.10"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-grpc/-/exporter-logs-otlp-grpc-0.207.0.tgz",
-      "integrity": "sha512-K92RN+kQGTMzFDsCzsYNGqOsXRUnko/Ckk+t/yPJao72MewOLgBUTWVHhebgkNfRCYqDz1v3K0aPT9OJkemvgg==",
-      "license": "Apache-2.0",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
+      }
+    },
+    "node_modules/@langchain/google-genai": {
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.31.tgz",
+      "integrity": "sha512-lHIJGtZab0jqoufKRPXyHHg1nLXrE74LXd0ftgibWEACc1SpSLu6XwtA23+dX4l7Q/YeSgb9n40YJx5k00/fqw==",
+      "license": "MIT",
       "dependencies": {
-        "@grpc/grpc-js": "^1.7.1",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-grpc-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/sdk-logs": "0.207.0"
+        "@google/generative-ai": "^0.24.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/core": "^1.1.47"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/google-vertexai": {
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-vertexai/-/google-vertexai-2.1.31.tgz",
+      "integrity": "sha512-ZJwUumwyVyyU5z0PoaMm7nAeGTm9Rp3QcEfm5WVUJl2ag4bqiQhd33+7jzb8h0GkiqvK9INtpmfvtUh29rH3qg==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/google-gauth": "2.1.31"
       },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=20"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/langgraph": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.4.4.tgz",
+      "integrity": "sha512-20p+/xHRIUIEkk6dsoA576X7D5+FY+LkShsGjBpKrwATzQU0IJ2dfpBaP+4Z4wwpL9ArpDxjoRQR58kycdxU8A==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@langchain/langgraph-checkpoint": "^1.1.2",
+        "@langchain/langgraph-sdk": "~1.9.23",
+        "@langchain/protocol": "^0.0.16",
+        "@standard-schema/spec": "1.1.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=18"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@langchain/core": "^1.1.48",
+        "zod": "^3.25.32 || ^4.2.0",
+        "zod-to-json-schema": "^3.x"
+      },
+      "peerDependenciesMeta": {
+        "zod-to-json-schema": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
-      },
+    "node_modules/@langchain/langgraph-checkpoint": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-1.1.2.tgz",
+      "integrity": "sha512-m5Xd7W3G9JrlEhFZ5WAcqZPgE46R9gr1gFDFaVqEKeuwin3tgEp0jlPbru+iFXCug338DcQjFS/Kuuci21ydvw==",
+      "license": "MIT",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=18"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/core": "^1.1.48"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/langgraph-sdk": {
+      "version": "1.9.23",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.9.23.tgz",
+      "integrity": "sha512-JF5TWOrrKaMn9D7O0xT/9e9t3CpDRd8DUyKQdcbGswDsWdlI+04E9E1Lxv361tMu5pNYhval3iJPAwGxUuqi4w==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "@langchain/protocol": "^0.0.16",
+        "@types/json-schema": "^7.0.15",
+        "p-queue": "^9.0.1",
+        "p-retry": "^7.1.1"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/core": "^1.1.48",
+        "react": "^18 || ^19",
+        "react-dom": "^18 || ^19",
+        "svelte": "^4.0.0 || ^5.0.0",
+        "vue": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        },
+        "svelte": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/langgraph-sdk/node_modules/p-queue": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/p-queue/-/p-queue-9.3.0.tgz",
+      "integrity": "sha512-7NED7xhQ74Ngp4JP/2e0VZHp7vSWfJfqeiR92jPgxsz6m0Se4P03YoTKa9dDXyZ3r6P616gUXttrB6nnHYKang==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "eventemitter3": "^5.0.4",
+        "p-timeout": "^7.0.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
+    "node_modules/@langchain/langgraph-sdk/node_modules/p-timeout": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-7.0.1.tgz",
+      "integrity": "sha512-AxTM2wDGORHGEkPCt8yqxOTMgpfbEHqF51f/5fJCmwFC3C/zNcGT63SymH2ttOAaiIws2zVg4+izQCjrakcwHg==",
+      "license": "MIT",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/mistralai": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@langchain/mistralai/-/mistralai-1.2.0.tgz",
+      "integrity": "sha512-SRtCSDIBzcQc6ZK5qa1V2ZhqSdZomXOt4VzBWXkD//IYYhbMJHhbrlYuCIuHktwpF/1ME5a7Euyk+BujN9hkTA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@mistralai/mistralai": "2.2.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@langchain/core": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/openai": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.4.5.tgz",
+      "integrity": "sha512-bQ2WMIZfSh02trJLYSAtiIcD3j6EBCiAm9nw0dZWQsVaUxmWc3JJqs8uUte6AkMazmLHzcUIw+14UkXO5fRJvQ==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "js-tiktoken": "^1.0.12",
+        "openai": "^6.34.0",
+        "zod": "^3.25.76 || ^4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@langchain/core": "^1.1.42"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-http/-/exporter-logs-otlp-http-0.207.0.tgz",
-      "integrity": "sha512-JpOh7MguEUls8eRfkVVW3yRhClo5b9LqwWTOg8+i4gjr/+8eiCtquJnC7whvpTIGyff06cLZ2NsEj+CVP3Mjeg==",
+    "node_modules/@langchain/openai/node_modules/openai": {
+      "version": "6.44.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.44.0.tgz",
+      "integrity": "sha512-09/gH+8jH0RgUwsgWHAaxsKGRT5zVZ95IaJUnqAWj6XejIBmnFRwq2WUIF37VtDEsmGrtPmvCs5+yBSeZGWvkA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/sdk-logs": "0.207.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "ws": "^8.18.0",
+        "zod": "^3.25 || ^4.0"
+      },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
+    "node_modules/@langchain/openai/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/protocol": {
+      "version": "0.0.16",
+      "resolved": "https://registry.npmjs.org/@langchain/protocol/-/protocol-0.0.16.tgz",
+      "integrity": "sha512-ws+J7MaHyhO5dG7f0vdyHQiUn9hoCnki0f3crJPa4MCTGzcRC39jYSCghyrGtBPYQnZbUQiGyRVpW3z3M8IpJg==",
+      "license": "MIT"
+    },
+    "node_modules/@langchain/textsplitters": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@langchain/textsplitters/-/textsplitters-1.0.1.tgz",
+      "integrity": "sha512-rheJlB01iVtrOUzttscutRgLybPH9qR79EyzBEbf1u97ljWyuxQfCwIWK+SjoQTM9O8M7GGLLRBSYE26Jmcoww==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "js-tiktoken": "^1.0.12"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@langchain/core": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/xai": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@langchain/xai/-/xai-1.4.0.tgz",
+      "integrity": "sha512-usZbl0dS8DdLos8ZdhSQ3zd2YuNCi587fbAR6EUqR88BlLH9Lg+fsUNeR7bWsDSEyF92qyxb5l8png0ssX8QKA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@langchain/openai": "1.5.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/core": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
+    "node_modules/@langchain/xai/node_modules/@langchain/openai": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.5.0.tgz",
+      "integrity": "sha512-ooC02qF3wnQ5m0WyibVPO5vCkgyZwjWPgNrpGFSTv3ZLnKfW1yC4k2Fp4qOf6qoVmwTeYSW4C+wNiiZ3PXshMA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
+        "js-tiktoken": "^1.0.12",
+        "openai": "^6.41.0",
+        "zod": "^3.25.76 || ^4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@langchain/core": "^1.2.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@langchain/xai/node_modules/openai": {
+      "version": "6.44.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.44.0.tgz",
+      "integrity": "sha512-09/gH+8jH0RgUwsgWHAaxsKGRT5zVZ95IaJUnqAWj6XejIBmnFRwq2WUIF37VtDEsmGrtPmvCs5+yBSeZGWvkA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "ws": "^8.18.0",
+        "zod": "^3.25 || ^4.0"
+      },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
+    "node_modules/@langchain/xai/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/@langfuse/core": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/@langfuse/core/-/core-5.4.1.tgz",
+      "integrity": "sha512-TjaRTr9fGqaWuyYKFSezKxN4DWAaK/lq//hRMw8rQKFkZUs6vTgUODxqZTFTR6np5VnLVw+eZLlnHROPKbXqdg==",
+      "license": "MIT",
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "@opentelemetry/api": "^1.9.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
+    "node_modules/@langfuse/langchain": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/@langfuse/langchain/-/langchain-5.4.1.tgz",
+      "integrity": "sha512-cCGrOLAhxK5L45nYxr4qrO1bWGV11PkTweg03W+eBJoSKbpzjDSjVEZm5CG4dXRwJbj2CHQoVuyQ8F5u/XeBIg==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "@langfuse/core": "^5.4.1",
+        "@langfuse/tracing": "^5.4.1"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@langchain/core": ">=0.3.8",
+        "@opentelemetry/api": "^1.9.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
+    "node_modules/@langfuse/otel": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/@langfuse/otel/-/otel-5.4.1.tgz",
+      "integrity": "sha512-w69aVC2fTmd7hyCTaX8zhhivHlsGVgZ551XOf6yMSOi3k8tlDML4dinnjJUP/6qTvdH54NYcmAIp5KZRbkouxg==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@langfuse/core": "^5.4.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^2.0.1",
+        "@opentelemetry/exporter-trace-otlp-http": ">=0.202.0 <1.0.0",
+        "@opentelemetry/sdk-trace-base": "^2.0.1"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-proto/-/exporter-logs-otlp-proto-0.207.0.tgz",
-      "integrity": "sha512-RQJEV/K6KPbQrIUbsrRkEe0ufks1o5OGLHy6jbDD8tRjeCsbFHWfg99lYBRqBV33PYZJXsigqMaAbjWGTFYzLw==",
-      "license": "Apache-2.0",
+    "node_modules/@langfuse/tracing": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/@langfuse/tracing/-/tracing-5.4.1.tgz",
+      "integrity": "sha512-nPyoPXXNMaJgaUZgIE0haWI/hrT7l4r/irp0o/FGaBYR2V07EFNvSKFcqOsX1pQvVvB6HyfNlYQm7AoQJj+fqQ==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@langfuse/core": "^5.4.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=20"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@opentelemetry/api": "^1.9.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
+    "node_modules/@lezer/common": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.2.1.tgz",
+      "integrity": "sha512-yemX0ZD2xS/73llMZIK6KplkjIjf2EvAHcinDi/TfJ9hS25G0388+ClHt6/3but0oOxinTcQHJLDXh6w1crzFQ=="
+    },
+    "node_modules/@lezer/css": {
+      "version": "1.1.8",
+      "resolved": "https://registry.npmjs.org/@lezer/css/-/css-1.1.8.tgz",
+      "integrity": "sha512-7JhxupKuMBaWQKjQoLtzhGj83DdnZY9MckEOG5+/iLKNK2ZJqKc6hf6uc0HjwCX7Qlok44jBNqZhHKDhEhZYLA==",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
+        "@lezer/common": "^1.2.0",
+        "@lezer/highlight": "^1.0.0",
+        "@lezer/lr": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
+    "node_modules/@lezer/highlight": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.1.tgz",
+      "integrity": "sha512-Z5duk4RN/3zuVO7Jq0pGLJ3qynpxUVsh7IbUbGj88+uV2ApSAn6kWg2au3iJb+0Zi7kKtqffIESgNcRXWZWmSA==",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@lezer/common": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
-      "license": "Apache-2.0",
+    "node_modules/@lezer/html": {
+      "version": "1.3.10",
+      "resolved": "https://registry.npmjs.org/@lezer/html/-/html-1.3.10.tgz",
+      "integrity": "sha512-dqpT8nISx/p9Do3AchvYGV3qYc4/rKr3IBZxlHmpIKam56P47RSHkSF5f13Vu9hebS1jM0HmtJIwLbWz1VIY6w==",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@lezer/common": "^1.2.0",
+        "@lezer/highlight": "^1.0.0",
+        "@lezer/lr": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
+    "node_modules/@lezer/javascript": {
+      "version": "1.4.17",
+      "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.4.17.tgz",
+      "integrity": "sha512-bYW4ctpyGK+JMumDApeUzuIezX01H76R1foD6LcRX224FWfyYit/HYxiPGDjXXe/wQWASjCvVGoukTH68+0HIA==",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@lezer/common": "^1.2.0",
+        "@lezer/highlight": "^1.1.3",
+        "@lezer/lr": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
+    "node_modules/@lezer/lr": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.2.tgz",
+      "integrity": "sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@lezer/common": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
+    "node_modules/@librechat/agents": {
+      "version": "3.2.46",
+      "resolved": "https://registry.npmjs.org/@librechat/agents/-/agents-3.2.46.tgz",
+      "integrity": "sha512-ppylwuFF3BOlhrnzDdD6J7h9mkUgAi9aF7LBt5pPpk6/Hab/h5BecxA6a7PyRo5x4xNfgPvAlnTn6MSDeAqJBg==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@anthropic-ai/sdk": "^0.92.0",
+        "@aws-sdk/client-bedrock-runtime": "^3.1013.0",
+        "@langchain/anthropic": "^1.3.28",
+        "@langchain/aws": "^1.3.5",
+        "@langchain/core": "1.1.48",
+        "@langchain/deepseek": "^1.0.25",
+        "@langchain/google-common": "2.1.31",
+        "@langchain/google-gauth": "2.1.31",
+        "@langchain/google-genai": "2.1.31",
+        "@langchain/google-vertexai": "2.1.31",
+        "@langchain/langgraph": "^1.2.9",
+        "@langchain/mistralai": "^1.0.8",
+        "@langchain/openai": "1.4.5",
+        "@langchain/textsplitters": "^1.0.1",
+        "@langchain/xai": "^1.3.17",
+        "@langfuse/langchain": "^5.4.1",
+        "@langfuse/otel": "^5.4.1",
+        "@langfuse/tracing": "^5.4.1",
+        "@opentelemetry/context-async-hooks": "2.7.1",
+        "@opentelemetry/sdk-node": "^0.218.0",
+        "@scarf/scarf": "^1.4.0",
+        "@types/diff": "^7.0.2",
+        "ai-tokenizer": "^1.0.6",
+        "axios": "^1.16.0",
+        "cheerio": "^1.0.0",
+        "diff": "^9.0.0",
+        "dotenv": "^16.4.7",
+        "https-proxy-agent": "^7.0.6",
+        "mathjs": "^15.2.0",
+        "nanoid": "^3.3.7",
+        "okapibm25": "^1.4.1",
+        "openai": "^6.35.0",
+        "uuid": "^11.1.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=24.0.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "@anthropic-ai/sandbox-runtime": "^0.0.54"
+      },
+      "peerDependenciesMeta": {
+        "@anthropic-ai/sandbox-runtime": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
+    "node_modules/@librechat/agents/node_modules/@langchain/core": {
+      "version": "1.1.48",
+      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.48.tgz",
+      "integrity": "sha512-fQU6Guyb1pwc2fEplmA8FPbKfOMAofjnyJzExevro0FxEiuGHE18Ov/ZHmT9trWCDTZRI9eW1VIc6aChxV8pAQ==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@cfworker/json-schema": "^4.0.2",
+        "@standard-schema/spec": "^1.1.0",
+        "js-tiktoken": "^1.0.12",
+        "langsmith": ">=0.5.0 <1.0.0",
+        "mustache": "^4.2.0",
+        "p-queue": "^6.6.2",
+        "zod": "^3.25.76 || ^4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "node": ">=20"
       }
     },
-    "node_modules/@opentelemetry/exporter-logs-otlp-proto/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@librechat/agents/node_modules/diff": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-9.0.0.tgz",
+      "integrity": "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==",
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">=0.3.1"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-grpc/-/exporter-metrics-otlp-grpc-0.207.0.tgz",
-      "integrity": "sha512-6flX89W54gkwmqYShdcTBR1AEF5C1Ob0O8pDgmLPikTKyEv27lByr9yBmO5WrP0+5qJuNPHrLfgFQFYi6npDGA==",
+    "node_modules/@librechat/agents/node_modules/openai": {
+      "version": "6.44.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.44.0.tgz",
+      "integrity": "sha512-09/gH+8jH0RgUwsgWHAaxsKGRT5zVZ95IaJUnqAWj6XejIBmnFRwq2WUIF37VtDEsmGrtPmvCs5+yBSeZGWvkA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@grpc/grpc-js": "^1.7.1",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/exporter-metrics-otlp-http": "0.207.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-grpc-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-metrics": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+      "peerDependencies": {
+        "ws": "^8.18.0",
+        "zod": "^3.25 || ^4.0"
       },
+      "peerDependenciesMeta": {
+        "ws": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@librechat/agents/node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/@librechat/api": {
+      "resolved": "packages/api",
+      "link": true
+    },
+    "node_modules/@librechat/backend": {
+      "resolved": "api",
+      "link": true
+    },
+    "node_modules/@librechat/client": {
+      "resolved": "packages/client",
+      "link": true
+    },
+    "node_modules/@librechat/data-schemas": {
+      "resolved": "packages/data-schemas",
+      "link": true
+    },
+    "node_modules/@librechat/frontend": {
+      "resolved": "client",
+      "link": true
+    },
+    "node_modules/@marsidev/react-turnstile": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@marsidev/react-turnstile/-/react-turnstile-1.1.0.tgz",
+      "integrity": "sha512-X7bP9ZYutDd+E+klPYF+/BJHqEyyVkN4KKmZcNRr84zs3DcMoftlMAuoKqNSnqg0HE7NQ1844+TLFSJoztCdSA==",
+      "license": "MIT",
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "react": "^17.0.2 || ^18.0.0 || ^19.0",
+        "react-dom": "^17.0.2 || ^18.0.0 || ^19.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
+    "node_modules/@mcp-ui/client": {
+      "version": "5.7.0",
+      "resolved": "https://registry.npmjs.org/@mcp-ui/client/-/client-5.7.0.tgz",
+      "integrity": "sha512-+HbPw3VS46WUSWmyJ34ZVnygb81QByA3luR6y0JDbyDZxjYtHw1FcIN7v9WbbE8PrfI0WcuWCSiNOO6sOGbwpQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
+        "@modelcontextprotocol/sdk": "*",
+        "@quilted/threads": "^3.1.3",
+        "@r2wc/react-to-web-component": "^2.0.4",
+        "@remote-dom/core": "^1.8.0",
+        "@remote-dom/react": "^1.2.2",
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1"
+      }
+    },
+    "node_modules/@mermaid-js/parser": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz",
+      "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+      "license": "MIT",
+      "dependencies": {
+        "@chevrotain/types": "~11.1.1"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
+    "node_modules/@microsoft/microsoft-graph-client": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/@microsoft/microsoft-graph-client/-/microsoft-graph-client-3.0.7.tgz",
+      "integrity": "sha512-/AazAV/F+HK4LIywF9C+NYHcJo038zEnWkteilcxC1FM/uK/4NVGDKGrxx7nNq1ybspAroRKT4I1FHfxQzxkUw==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@babel/runtime": "^7.12.5",
+        "tslib": "^2.2.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=12.0.0"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      "peerDependenciesMeta": {
+        "@azure/identity": {
+          "optional": true
+        },
+        "@azure/msal-browser": {
+          "optional": true
+        },
+        "buffer": {
+          "optional": true
+        },
+        "stream-browserify": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
+    "node_modules/@mistralai/mistralai": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@mistralai/mistralai/-/mistralai-2.2.1.tgz",
+      "integrity": "sha512-uKU8CZmL2RzYKmplsU01hii4p3pe4HqJefpWNRWXm1Tcm0Sm4xXfwSLIy4k7ZCPlbETCGcp69E7hZs+WOJ5itQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "ws": "^8.18.0",
+        "zod": "^3.25.0 || ^4.0.0",
+        "zod-to-json-schema": "^3.25.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
+    "node_modules/@modelcontextprotocol/sdk": {
+      "version": "1.29.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
+      "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
+        "@hono/node-server": "^1.19.9",
+        "ajv": "^8.17.1",
+        "ajv-formats": "^3.0.1",
+        "content-type": "^1.0.5",
+        "cors": "^2.8.5",
+        "cross-spawn": "^7.0.5",
+        "eventsource": "^3.0.2",
+        "eventsource-parser": "^3.0.0",
+        "express": "^5.2.1",
+        "express-rate-limit": "^8.2.1",
+        "hono": "^4.11.4",
+        "jose": "^6.1.3",
+        "json-schema-typed": "^8.0.2",
+        "pkce-challenge": "^5.0.0",
+        "raw-body": "^3.0.0",
+        "zod": "^3.25 || ^4.0",
+        "zod-to-json-schema": "^3.25.1"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">=18"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@cfworker/json-schema": "^4.1.1",
+        "zod": "^3.25 || ^4.0"
+      },
+      "peerDependenciesMeta": {
+        "@cfworker/json-schema": {
+          "optional": true
+        },
+        "zod": {
+          "optional": false
+        }
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
+    "node_modules/@modelcontextprotocol/sdk/node_modules/jose": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
+      "integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/@monaco-editor/loader": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/@monaco-editor/loader/-/loader-1.7.0.tgz",
+      "integrity": "sha512-gIwR1HrJrrx+vfyOhYmCZ0/JcWqG5kbfG7+d3f/C1LXk2EvzAbHSg3MQ5lO2sMlo9izoAZ04shohfKLVT6crVA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "state-local": "^1.0.6"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
+    "node_modules/@monaco-editor/react": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/@monaco-editor/react/-/react-4.7.0.tgz",
+      "integrity": "sha512-cyzXQCtO47ydzxpQtCGSQGOC8Gk3ZUeBXFAxD+CWXYFo5OqZyZUonFl0DwUlTyAfRHntBfw2p3w4s9R6oe1eCA==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "@monaco-editor/loader": "^1.5.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "monaco-editor": ">= 0.25.0 < 1",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
+    "node_modules/@mongodb-js/saslprep": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.3.1.tgz",
+      "integrity": "sha512-6nZrq5kfAz0POWyhljnbWQQJQ5uT8oE2ddX303q1uY0tWsivWKgBDXBBvuFPwOqRRalXJuVO9EjOdVtuhLX0zg==",
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
+        "sparse-bitfield": "^3.0.3"
+      }
+    },
+    "node_modules/@napi-rs/canvas": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas/-/canvas-0.1.88.tgz",
+      "integrity": "sha512-/p08f93LEbsL5mDZFQ3DBxcPv/I4QG9EDYRRq1WNlCOXVfAHBTHMSVMwxlqG/AtnSfUr9+vgfN7MKiyDo0+Weg==",
+      "license": "MIT",
+      "optional": true,
+      "workspaces": [
+        "e2e/*"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/canvas-android-arm64": "0.1.88",
+        "@napi-rs/canvas-darwin-arm64": "0.1.88",
+        "@napi-rs/canvas-darwin-x64": "0.1.88",
+        "@napi-rs/canvas-linux-arm-gnueabihf": "0.1.88",
+        "@napi-rs/canvas-linux-arm64-gnu": "0.1.88",
+        "@napi-rs/canvas-linux-arm64-musl": "0.1.88",
+        "@napi-rs/canvas-linux-riscv64-gnu": "0.1.88",
+        "@napi-rs/canvas-linux-x64-gnu": "0.1.88",
+        "@napi-rs/canvas-linux-x64-musl": "0.1.88",
+        "@napi-rs/canvas-win32-arm64-msvc": "0.1.88",
+        "@napi-rs/canvas-win32-x64-msvc": "0.1.88"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@napi-rs/canvas-android-arm64": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-android-arm64/-/canvas-android-arm64-0.1.88.tgz",
+      "integrity": "sha512-KEaClPnZuVxJ8smUWjV1wWFkByBO/D+vy4lN+Dm5DFH514oqwukxKGeck9xcKJhaWJGjfruGmYGiwRe//+/zQQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-http/-/exporter-metrics-otlp-http-0.207.0.tgz",
-      "integrity": "sha512-fG8FAJmvXOrKXGIRN8+y41U41IfVXxPRVwyB05LoMqYSjugx/FSBkMZUZXUT/wclTdmBKtS5MKoi0bEKkmRhSw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-metrics": "2.2.0"
-      },
+    "node_modules/@napi-rs/canvas-darwin-arm64": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-arm64/-/canvas-darwin-arm64-0.1.88.tgz",
+      "integrity": "sha512-Xgywz0dDxOKSgx3eZnK85WgGMmGrQEW7ZLA/E7raZdlEE+xXCozobgqz2ZvYigpB6DJFYkqnwHjqCOTSDGlFdg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
+    "node_modules/@napi-rs/canvas-darwin-x64": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-x64/-/canvas-darwin-x64-0.1.88.tgz",
+      "integrity": "sha512-Yz4wSCIQOUgNucgk+8NFtQxQxZV5NO8VKRl9ePKE6XoNyNVC8JDqtvhh3b3TPqKK8W5p2EQpAr1rjjm0mfBxdg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-arm-gnueabihf": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm-gnueabihf/-/canvas-linux-arm-gnueabihf-0.1.88.tgz",
+      "integrity": "sha512-9gQM2SlTo76hYhxHi2XxWTAqpTOb+JtxMPEIr+H5nAhHhyEtNmTSDRtz93SP7mGd2G3Ojf2oF5tP9OdgtgXyKg==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-arm64-gnu": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-gnu/-/canvas-linux-arm64-gnu-0.1.88.tgz",
+      "integrity": "sha512-7qgaOBMXuVRk9Fzztzr3BchQKXDxGbY+nwsovD3I/Sx81e+sX0ReEDYHTItNb0Je4NHbAl7D0MKyd4SvUc04sg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-arm64-musl": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-musl/-/canvas-linux-arm64-musl-0.1.88.tgz",
+      "integrity": "sha512-kYyNrUsHLkoGHBc77u4Unh067GrfiCUMbGHC2+OTxbeWfZkPt2o32UOQkhnSswKd9Fko/wSqqGkY956bIUzruA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-riscv64-gnu": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-riscv64-gnu/-/canvas-linux-riscv64-gnu-0.1.88.tgz",
+      "integrity": "sha512-HVuH7QgzB0yavYdNZDRyAsn/ejoXB0hn8twwFnOqUbCCdkV+REna7RXjSR7+PdfW0qMQ2YYWsLvVBT5iL/mGpw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-x64-gnu": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-0.1.88.tgz",
+      "integrity": "sha512-hvcvKIcPEQrvvJtJnwD35B3qk6umFJ8dFIr8bSymfrSMem0EQsfn1ztys8ETIFndTwdNWJKWluvxztA41ivsEw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
+    "node_modules/@napi-rs/canvas-linux-x64-musl": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-musl/-/canvas-linux-x64-musl-0.1.88.tgz",
+      "integrity": "sha512-eSMpGYY2xnZSQ6UxYJ6plDboxq4KeJ4zT5HaVkUnbObNN6DlbJe0Mclh3wifAmquXfrlgTZt6zhHsUgz++AK6g==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@napi-rs/canvas-win32-arm64-msvc": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-arm64-msvc/-/canvas-win32-arm64-msvc-0.1.88.tgz",
+      "integrity": "sha512-qcIFfEgHrchyYqRrxsCeTQgpJZ/GqHiqPcU/Fvw/ARVlQeDX1VyFH+X+0gCR2tca6UJrq96vnW+5o7buCq+erA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-proto/-/exporter-metrics-otlp-proto-0.207.0.tgz",
-      "integrity": "sha512-kDBxiTeQjaRlUQzS1COT9ic+et174toZH6jxaVuVAvGqmxOkgjpLOjrI5ff8SMMQE69r03L3Ll3nPKekLopLwg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/exporter-metrics-otlp-http": "0.207.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-metrics": "2.2.0"
-      },
+    "node_modules/@napi-rs/canvas-win32-x64-msvc": {
+      "version": "0.1.88",
+      "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-x64-msvc/-/canvas-win32-x64-msvc-0.1.88.tgz",
+      "integrity": "sha512-ROVqbfS4QyZxYkqmaIBBpbz/BQvAR+05FXM5PAtTYVc0uyY8Y4BHJSMdGAaMf6TdIVRsQsiq+FG/dH9XhvWCFQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": ">= 10"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "0.2.12",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
+      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
+        "@emnapi/core": "^1.4.3",
+        "@emnapi/runtime": "^1.4.3",
+        "@tybys/wasm-util": "^0.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
+    "node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+        "node": "^14.21.3 || >=16"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
-      "license": "Apache-2.0",
+    "node_modules/@nodable/entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "node": ">= 8"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "node": ">= 8"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">= 8"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
+    "node_modules/@nolyfill/is-core-module": {
+      "version": "1.0.39",
+      "resolved": "https://registry.npmjs.org/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz",
+      "integrity": "sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "node": ">=12.4.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/sdk-metrics": {
+    "node_modules/@open-draft/deferred-promise": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
+      "resolved": "https://registry.npmjs.org/@open-draft/deferred-promise/-/deferred-promise-2.2.0.tgz",
+      "integrity": "sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA=="
+    },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
+      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-metrics-otlp-proto/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/api-logs": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.218.0.tgz",
+      "integrity": "sha512-fmEWp5kXlGEc3i/lR698Hz41DfGyN4Tbe4g7L1AxSc7fF8Xeh/FQ9Quqpa9dVA413Q1Ad43QOLzU4JoXgbFPWw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api": "^1.3.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-prometheus": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-prometheus/-/exporter-prometheus-0.207.0.tgz",
-      "integrity": "sha512-Y5p1s39FvIRmU+F1++j7ly8/KSqhMmn6cMfpQqiDCqDjdDHwUtSq0XI0WwL3HYGnZeaR/VV4BNmsYQJ7GAPrhw==",
+    "node_modules/@opentelemetry/configuration": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/configuration/-/configuration-0.218.0.tgz",
+      "integrity": "sha512-W8wIz7H2R1pufR5jfjb3gU2XkMpm2x/7b1RJcsuzvd70Il/rWWE+g5/Od7hQKrxRTSrTrOWlru101PWXz5I1EQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-metrics": "2.2.0"
+        "@opentelemetry/core": "2.7.1",
+        "yaml": "^2.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@opentelemetry/api": "^1.9.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-prometheus/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/context-async-hooks": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/context-async-hooks/-/context-async-hooks-2.7.1.tgz",
+      "integrity": "sha512-OPFBYuXEn1E4ja3Y6eeA7O+ZnLBNcXTV5Cgsn1VaqBZ6hC5FnpZPLBNme1LJY8ZtF4aOujPKFoeWN4ik487KuQ==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
@@ -13682,94 +10569,104 @@
         "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-prometheus/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/core": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.7.1.tgz",
+      "integrity": "sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-prometheus/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
+    "node_modules/@opentelemetry/exporter-logs-otlp-grpc": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-grpc/-/exporter-logs-otlp-grpc-0.218.0.tgz",
+      "integrity": "sha512-hoxrNH1l/Xy6F9WTJ5IK+6j1r9nQFlPOmrnTlhYHTySdunfXLmUCPv3bQtKYntxag9h3wLYBZQ2HI6FOx+BT2g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-grpc-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/sdk-logs": "0.218.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-grpc/-/exporter-trace-otlp-grpc-0.207.0.tgz",
-      "integrity": "sha512-7u2ZmcIx6D4KG/+5np4X2qA0o+O0K8cnUDhR4WI/vr5ZZ0la9J9RG+tkSjC7Yz+2XgL6760gSIM7/nyd3yaBLA==",
+    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@grpc/grpc-js": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@grpc/grpc-js": "^1.7.1",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-grpc-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "node": ">=12.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
+    "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
       },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=6"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/exporter-logs-otlp-http": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-http/-/exporter-logs-otlp-http-0.218.0.tgz",
+      "integrity": "sha512-Qx+4rpVHzgg89dawcWRHyt+XRXeLnhFz/qBtvggmjkcgPUdr+NAB0/u/eIPA8yAeJV0J80Vz43JZCh/XFvZFGw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/sdk-logs": "0.218.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
+    "node_modules/@opentelemetry/exporter-logs-otlp-proto": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-proto/-/exporter-logs-otlp-proto-0.218.0.tgz",
+      "integrity": "sha512-1/noQNsp9gXD75HPzgjBrcF1+XTtry7pFAUfxVEJgg7mPv2AawKQuYkhMmJ8qjxz4Ubc3Y8bwvfxevXsKTq4cg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-logs": "0.218.0",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13778,19 +10675,20 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
+    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-grpc/-/exporter-metrics-otlp-grpc-0.218.0.tgz",
+      "integrity": "sha512-YapQ9vNMX0NSZF6LK5pWAFfjpJleV2O9uYWfYGeb/5F1Kb9rPGK8tZDMJFa/sOksgdFuflDvYuA0B4qjDB4fjQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/exporter-metrics-otlp-http": "0.218.0",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-grpc-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-metrics": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13799,84 +10697,86 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@grpc/grpc-js": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">=12.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
+    "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
       },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+      "engines": {
+        "node": ">=6"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
+    "node_modules/@opentelemetry/exporter-metrics-otlp-http": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-http/-/exporter-metrics-otlp-http-0.218.0.tgz",
+      "integrity": "sha512-bV7d2OuMpZu2+gAaxUAhzfZ0h3WVZk8ETQUEE3DNSntbTaMpuITjtm8I0rNyHFdm7Ax57K6ty7SgFXlBmOLIvQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-metrics": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/exporter-metrics-otlp-proto": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-metrics-otlp-proto/-/exporter-metrics-otlp-proto-0.218.0.tgz",
+      "integrity": "sha512-ubLddKjWULhla9YZRCj/rTBeppjJYE4e9w0icx5mTu3eFhWjQzbV75NYjXuIlEG+NJsBl6d+sTFw5Qu+oej4oQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/exporter-metrics-otlp-http": "0.218.0",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-metrics": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-http": {
-      "version": "0.214.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-http/-/exporter-trace-otlp-http-0.214.0.tgz",
-      "integrity": "sha512-kIN8nTBMgV2hXzV/a20BCFilPZdAIMYYJGSgfMMRm/Xa+07y5hRDS2Vm12A/z8Cdu3Sq++ZvJfElokX2rkgGgw==",
+    "node_modules/@opentelemetry/exporter-prometheus": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-prometheus/-/exporter-prometheus-0.218.0.tgz",
+      "integrity": "sha512-RT5oEyu1kddZJ1vt7/BUo5wV+P7hpNAESsR3dUd3+8deHuX7gWNoCOZn+SfDT+hJHlIJ5h/AxiCLXIrutswDJg==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/otlp-exporter-base": "0.214.0",
-        "@opentelemetry/otlp-transformer": "0.214.0",
-        "@opentelemetry/resources": "2.6.1",
-        "@opentelemetry/sdk-trace-base": "2.6.1"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-metrics": "2.7.1",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13885,17 +10785,19 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-proto/-/exporter-trace-otlp-proto-0.207.0.tgz",
-      "integrity": "sha512-ruUQB4FkWtxHjNmSXjrhmJZFvyMm+tBzHyMm7YPQshApy4wvZUTcrpPyP/A/rCl/8M4BwoVIZdiwijMdbZaq4w==",
+    "node_modules/@opentelemetry/exporter-trace-otlp-grpc": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-grpc/-/exporter-trace-otlp-grpc-0.218.0.tgz",
+      "integrity": "sha512-3fXxVQEj9TNAFaCi79JeFKfeLd0sDtInaR3gaZDVlzNSPHtz8PZuCV34JKWjD4XXzT20IdMe8IpX6mRVNDA4Tw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-grpc-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13904,41 +10806,48 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
+    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@grpc/grpc-js": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
       },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=12.10.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
       },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
       },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      "engines": {
+        "node": ">=6"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
+    "node_modules/@opentelemetry/exporter-trace-otlp-http": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-http/-/exporter-trace-otlp-http-0.218.0.tgz",
+      "integrity": "sha512-8dqezsmPhtKitIK/eTipZhYl9EX2/gNQ5zUMhaz3uxEURwfkNf8IPvo6yNfrzbxdtpAOybS/+h7wmIWYqFSpiw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13947,19 +10856,17 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
+    "node_modules/@opentelemetry/exporter-trace-otlp-proto": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-proto/-/exporter-trace-otlp-proto-0.218.0.tgz",
+      "integrity": "sha512-r1Msf8SNLRmwh9J6XQ5uh82D7CdDWMNHnPB7LAVHjzut0TkSeKc5KcIvr4SvHvfk/xwN5gxC+VLKQ1k0o8PSPw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -13968,146 +10875,134 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/exporter-zipkin": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-zipkin/-/exporter-zipkin-2.7.1.tgz",
+      "integrity": "sha512-mfsD9bKAxcKrh5+y08TPodvClBO0CznBE3p79YAGnO81WI4LrdsGA65T53e4iTSbCalW4WaUpkbeJcbpyIUHfg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.0.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/sdk-logs": {
+    "node_modules/@opentelemetry/instrumentation": {
       "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.207.0.tgz",
+      "integrity": "sha512-y6eeli9+TLKnznrR8AZlQMSJT7wILpXH+6EYq5Vf/4Ao+huI7EedxQHwRgVUOMLFbe7VFDvHJrX9/f4lcwnJsA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "import-in-the-middle": "^2.0.0",
+        "require-in-the-middle": "^8.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-trace-otlp-proto/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/instrumentation-document-load": {
+      "version": "0.63.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-document-load/-/instrumentation-document-load-0.63.0.tgz",
+      "integrity": "sha512-eVQ2IcDeWFMLgnmeVGvgGSMIdomrEat56fDfA9jXYExgr/1xClO0MpHKDDfInGV2o6STtzarcrsBgwrnV8cm7w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "^2.0.0",
+        "@opentelemetry/instrumentation": "^0.218.0",
+        "@opentelemetry/sdk-trace-web": "^2.0.0",
+        "@opentelemetry/semantic-conventions": "^1.23.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-zipkin": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-zipkin/-/exporter-zipkin-2.2.0.tgz",
-      "integrity": "sha512-VV4QzhGCT7cWrGasBWxelBjqbNBbyHicWWS/66KoZoe9BzYwFB72SH2/kkc4uAviQlO8iwv2okIJy+/jqqEHTg==",
+    "node_modules/@opentelemetry/instrumentation-document-load/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.0.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-zipkin/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/instrumentation-document-load/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/exporter-zipkin/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/instrumentation-express": {
+      "version": "0.56.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-express/-/instrumentation-express-0.56.0.tgz",
+      "integrity": "sha512-rMV0WUTtAGEhHrHl3uDRIO97EkNUp4ewrW2iRVuP7kaV5qRT2b1pPV5PE75oR3GyLLSTooSAzGWl6CTm8eftKQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "^2.0.0",
+        "@opentelemetry/instrumentation": "^0.207.0",
+        "@opentelemetry/semantic-conventions": "^1.27.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/exporter-zipkin/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/instrumentation-fetch": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-fetch/-/instrumentation-fetch-0.218.0.tgz",
+      "integrity": "sha512-eP/Y5hDupb+6MwZSaMw4ZdsDz8YgfJbJ4Ta86BMVeOmI2EArwXcd0v1nfNIvUzXTPi7nakidwqeuUa3FwRwECg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/instrumentation": "0.218.0",
+        "@opentelemetry/sdk-trace-web": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/instrumentation": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.207.0.tgz",
-      "integrity": "sha512-y6eeli9+TLKnznrR8AZlQMSJT7wILpXH+6EYq5Vf/4Ao+huI7EedxQHwRgVUOMLFbe7VFDvHJrX9/f4lcwnJsA==",
+    "node_modules/@opentelemetry/instrumentation-fetch/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "import-in-the-middle": "^2.0.0",
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
         "require-in-the-middle": "^8.0.0"
       },
       "engines": {
@@ -14117,45 +11012,31 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/instrumentation/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.214.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.214.0.tgz",
-      "integrity": "sha512-u1Gdv0/E9wP+apqWf7Wv2npXmgJtxsW2XL0TEv9FZloTZRuMBKmu8cYVXwS4Hm3q/f/3FuCnPTgiwYvIqRSpRg==",
+    "node_modules/@opentelemetry/instrumentation-fetch/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/otlp-transformer": "0.214.0"
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base": {
+    "node_modules/@opentelemetry/instrumentation-http": {
       "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-grpc-exporter-base/-/otlp-grpc-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-eKFjKNdsPed4q9yYqeI5gBTLjXxDM/8jwhiC0icw3zKxHVGBySoDsed5J5q/PGY/3quzenTr3FiTxA3NiNT+nw==",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-http/-/instrumentation-http-0.207.0.tgz",
+      "integrity": "sha512-FC4i5hVixTzuhg4SV2ycTEAYx+0E2hm+GwbdoVPSA6kna0pPVI4etzaA9UkpJ9ussumQheFXP6rkGIaFJjMxsw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@grpc/grpc-js": "^1.7.1",
         "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@opentelemetry/instrumentation": "0.207.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0",
+        "forwarded-parse": "2.1.2"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14164,19 +11045,7 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/core": {
+    "node_modules/@opentelemetry/instrumentation-http/node_modules/@opentelemetry/core": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
       "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
@@ -14191,14 +11060,14 @@
         "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
+    "node_modules/@opentelemetry/instrumentation-ioredis": {
+      "version": "0.55.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-ioredis/-/instrumentation-ioredis-0.55.0.tgz",
+      "integrity": "sha512-ASuBMzh0ImmfOnWj9vCPtBMqSjr54/r/HluUIylwZB7xzTU6gL2SfybxySJMzEL9+386gJJVApwQktVznAtrWA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@opentelemetry/instrumentation": "^0.207.0",
+        "@opentelemetry/redis-common": "^0.38.2"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14207,19 +11076,13 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
+    "node_modules/@opentelemetry/instrumentation-mongodb": {
+      "version": "0.60.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-mongodb/-/instrumentation-mongodb-0.60.0.tgz",
+      "integrity": "sha512-8mKW2oyyWdYOKYpu70AGGAvLnExGlOoFT+Ylk9hJvWYHR5f6IrmVqwUMlzPM2WC4ihQ9crvqrtldMPmlVezTqg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
+        "@opentelemetry/instrumentation": "^0.207.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14228,86 +11091,66 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
+    "node_modules/@opentelemetry/instrumentation-mongoose": {
+      "version": "0.54.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-mongoose/-/instrumentation-mongoose-0.54.0.tgz",
+      "integrity": "sha512-R2JzMrxiz3R9m+cO6iVC85bma3E3vdBr06F+D4zGcEkJS9FaCRw6+Hdb+aQ1AaDRwEMTaw+F28+6VdMpniBOXQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@opentelemetry/core": "^2.0.0",
+        "@opentelemetry/instrumentation": "^0.207.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
+    "node_modules/@opentelemetry/instrumentation-undici": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-undici/-/instrumentation-undici-0.18.0.tgz",
+      "integrity": "sha512-NalxLuZV621Xq4IhQkC+OXoZjAT8Xf6vYRdTjHitOXMU+4l/peRY05V7wGr4d7huf+vjyQry0XKlyhsEr4ouNw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@opentelemetry/core": "^2.0.0",
+        "@opentelemetry/instrumentation": "^0.207.0",
+        "@opentelemetry/semantic-conventions": "^1.24.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@opentelemetry/api": "^1.7.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/instrumentation-user-interaction": {
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-user-interaction/-/instrumentation-user-interaction-0.62.0.tgz",
+      "integrity": "sha512-H5shIIfTh5H5E5aRbHm+Swvfoy70M6Kt/aj05F0o/FyPr4AP3x3qS8jl4YEvXJIAvSvJHNpBia0t8QjcVeNrPA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "^2.0.0",
+        "@opentelemetry/instrumentation": "^0.218.0",
+        "@opentelemetry/sdk-trace-web": "^2.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0",
+        "zone.js": "^0.11.4 || ^0.13.0 || ^0.14.0 || ^0.15.0 || ^0.16.0"
       }
     },
-    "node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.214.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.214.0.tgz",
-      "integrity": "sha512-DSaYcuBRh6uozfsWN3R8HsN0yDhCuWP7tOFdkUOVaWD1KVJg8m4qiLUsg/tNhTLS9HUYUcwNpwL2eroLtsZZ/w==",
+    "node_modules/@opentelemetry/instrumentation-user-interaction/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/api-logs": "0.214.0",
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/resources": "2.6.1",
-        "@opentelemetry/sdk-logs": "0.214.0",
-        "@opentelemetry/sdk-metrics": "2.6.1",
-        "@opentelemetry/sdk-trace-base": "2.6.1",
-        "protobufjs": "^7.0.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14316,245 +11159,214 @@
         "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/propagator-b3": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-b3/-/propagator-b3-2.2.0.tgz",
-      "integrity": "sha512-9CrbTLFi5Ee4uepxg2qlpQIozoJuoAZU5sKMx0Mn7Oh+p7UrgCiEV6C02FOxxdYVRRFQVCinYR8Kf6eMSQsIsw==",
+    "node_modules/@opentelemetry/instrumentation-user-interaction/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0"
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/propagator-b3/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/instrumentation-xml-http-request": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-xml-http-request/-/instrumentation-xml-http-request-0.218.0.tgz",
+      "integrity": "sha512-KzqSO62lTiqbT1ihKbbdJSt6A3TngIkacHJHi0SNUJmlpS0/Jg8Sn8kneKffQGjjpScODjZJ6LLs640zWlOGIg==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/instrumentation": "0.218.0",
+        "@opentelemetry/sdk-trace-web": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/propagator-jaeger": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-jaeger/-/propagator-jaeger-2.2.0.tgz",
-      "integrity": "sha512-FfeOHOrdhiNzecoB1jZKp2fybqmqMPJUXe2ZOydP7QzmTPYcfPeuaclTLYVhK3HyJf71kt8sTl92nV4YIaLaKA==",
+    "node_modules/@opentelemetry/instrumentation-xml-http-request/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/propagator-jaeger/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/instrumentation-xml-http-request/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/resources": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.6.1.tgz",
-      "integrity": "sha512-lID/vxSuKWXM55XhAKNoYXu9Cutoq5hFdkbTdI/zDKQktXzcWBVhNsOkiZFTMU9UtEWuGRNe0HUgmsFldIdxVA==",
+    "node_modules/@opentelemetry/instrumentation/node_modules/@opentelemetry/api-logs": {
+      "version": "0.207.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
+      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api": "^1.3.0"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.214.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.214.0.tgz",
-      "integrity": "sha512-zf6acnScjhsaBUU22zXZ/sLWim1dfhUAbGXdMmHmNG3LfBnQ3DKsOCITb2IZwoUsNNMTogqFKBnlIPPftUgGwA==",
+    "node_modules/@opentelemetry/otlp-exporter-base": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.218.0.tgz",
+      "integrity": "sha512-ZwqpkNL5W7RyGJPDZ9g06DvKp8KFTWPJPN12anpMQYSKpTSU0z3EIZuPq9vPGpS8siFyOqDYDAuCwlNO9FqgbA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/api-logs": "0.214.0",
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/resources": "2.6.1",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-transformer": "0.218.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.6.1.tgz",
-      "integrity": "sha512-9t9hJHX15meBy2NmTJxL+NJfXmnausR2xUDvE19XQce0Qi/GBtDGamU8nS1RMbdgDmhgpm3VaOu2+fiS/SfTpQ==",
+    "node_modules/@opentelemetry/otlp-grpc-exporter-base": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-grpc-exporter-base/-/otlp-grpc-exporter-base-0.218.0.tgz",
+      "integrity": "sha512-H/lCGJ536N98VpYJOaWTQOkv4Dx6TnmStK6Rqfu1W7KkFbPAx04hjdYEMZF/YbnHzPUSIK4kM6OE2GKGBTpV9A==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/resources": "2.6.1"
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/otlp-transformer": "0.218.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-node/-/sdk-node-0.207.0.tgz",
-      "integrity": "sha512-hnRsX/M8uj0WaXOBvFenQ8XsE8FLVh2uSnn1rkWu4mx+qu7EKGUZvZng6y/95cyzsqOfiaDDr08Ek4jppkIDNg==",
+    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@grpc/grpc-js": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/exporter-logs-otlp-grpc": "0.207.0",
-        "@opentelemetry/exporter-logs-otlp-http": "0.207.0",
-        "@opentelemetry/exporter-logs-otlp-proto": "0.207.0",
-        "@opentelemetry/exporter-metrics-otlp-grpc": "0.207.0",
-        "@opentelemetry/exporter-metrics-otlp-http": "0.207.0",
-        "@opentelemetry/exporter-metrics-otlp-proto": "0.207.0",
-        "@opentelemetry/exporter-prometheus": "0.207.0",
-        "@opentelemetry/exporter-trace-otlp-grpc": "0.207.0",
-        "@opentelemetry/exporter-trace-otlp-http": "0.207.0",
-        "@opentelemetry/exporter-trace-otlp-proto": "0.207.0",
-        "@opentelemetry/exporter-zipkin": "2.2.0",
-        "@opentelemetry/instrumentation": "0.207.0",
-        "@opentelemetry/propagator-b3": "2.2.0",
-        "@opentelemetry/propagator-jaeger": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "@opentelemetry/sdk-trace-node": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "node": ">=12.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/api-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.207.0.tgz",
-      "integrity": "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==",
+    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
       },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=6"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/otlp-transformer": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.218.0.tgz",
+      "integrity": "sha512-CFaKH87WAzjuJ4awowTTLzUvMfaRfiOFG5+qm5S5ncyalRtN4ecQ+YmuANJSCrVPuvZFEkUgKhBPBndxi3rHsQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-logs": "0.218.0",
+        "@opentelemetry/sdk-metrics": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/exporter-trace-otlp-http": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-http/-/exporter-trace-otlp-http-0.207.0.tgz",
-      "integrity": "sha512-HSRBzXHIC7C8UfPQdu15zEEoBGv0yWkhEwxqgPCHVUKUQ9NLHVGXkVrf65Uaj7UwmAkC1gQfkuVYvLlD//AnUQ==",
+    "node_modules/@opentelemetry/propagator-b3": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-b3/-/propagator-b3-2.7.1.tgz",
+      "integrity": "sha512-RJid6E2CKyeGfKBzXKF21ejabGMHypFkPAh3qZ+NvI+SGjuIye79t3PmiqcDgtRzdKH6ynXzbfslQ8DfpRUg2A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.207.0",
-        "@opentelemetry/otlp-transformer": "0.207.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@opentelemetry/core": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.207.0.tgz",
-      "integrity": "sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==",
+    "node_modules/@opentelemetry/propagator-jaeger": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-jaeger/-/propagator-jaeger-2.7.1.tgz",
+      "integrity": "sha512-KMjVBHzP4N60bOzxja76M1F1hZZ43lGPga5ix+mkv9+kk1nx9SbkxSvJsMbuVUxdPQmsPTqGShmhN8ulrMOg6Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.207.0"
+        "@opentelemetry/core": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.207.0.tgz",
-      "integrity": "sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==",
+    "node_modules/@opentelemetry/redis-common": {
+      "version": "0.38.3",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/redis-common/-/redis-common-0.38.3.tgz",
+      "integrity": "sha512-VCghU1JYs/4gP6Gqf/xro9MEsZ7LrMv2uONVsaESKL38ZOB9BqnI98FfS23wjMnHlpuE+TTaWSoAVNpTwYXzjw==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.207.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/resources": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.7.1.tgz",
+      "integrity": "sha512-DeT6KKolmC4e/dRQvMQ/RwlnzhaqeiFOXY5ngoOPJ07GgVVKxZOg9EcrNZb5aTzUn+iCrJldAgOfQm1O/QfPAQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
+        "@opentelemetry/core": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -14564,15 +11376,16 @@
         "@opentelemetry/api": ">=1.3.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.207.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.207.0.tgz",
-      "integrity": "sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==",
+    "node_modules/@opentelemetry/sdk-logs": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.218.0.tgz",
+      "integrity": "sha512-QvnNdugatFTVCJXH0Mcu7GOOJSylA9j127kIezOE4YwTI4YbowRons2K4WZTv5FMS8T4q9P0NdaRHdkSmeAIag==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.207.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14581,14 +11394,14 @@
         "@opentelemetry/api": ">=1.4.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
+    "node_modules/@opentelemetry/sdk-metrics": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.7.1.tgz",
+      "integrity": "sha512-MpDJdkiFDs3Pm1RHO3KByuZbuBdJEXEAkiC0+yJdsZGVCdf1RpHR6n+LHDcS7ffmfrt5kVCzJSCfm4z2C7v0uQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -14597,14 +11410,36 @@
         "@opentelemetry/api": ">=1.9.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
+    "node_modules/@opentelemetry/sdk-node": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-node/-/sdk-node-0.218.0.tgz",
+      "integrity": "sha512-tPMjHrLV5gsfNdYqoRHjeGbCAZBXXD9c1Qo/2ut7VwnUABDNh76xNxrT0SEhkIIJuCN45bbN1vZnYL1gY0IkOg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.218.0",
+        "@opentelemetry/configuration": "0.218.0",
+        "@opentelemetry/context-async-hooks": "2.7.1",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/exporter-logs-otlp-grpc": "0.218.0",
+        "@opentelemetry/exporter-logs-otlp-http": "0.218.0",
+        "@opentelemetry/exporter-logs-otlp-proto": "0.218.0",
+        "@opentelemetry/exporter-metrics-otlp-grpc": "0.218.0",
+        "@opentelemetry/exporter-metrics-otlp-http": "0.218.0",
+        "@opentelemetry/exporter-metrics-otlp-proto": "0.218.0",
+        "@opentelemetry/exporter-prometheus": "0.218.0",
+        "@opentelemetry/exporter-trace-otlp-grpc": "0.218.0",
+        "@opentelemetry/exporter-trace-otlp-http": "0.218.0",
+        "@opentelemetry/exporter-trace-otlp-proto": "0.218.0",
+        "@opentelemetry/exporter-zipkin": "2.7.1",
+        "@opentelemetry/instrumentation": "0.218.0",
+        "@opentelemetry/otlp-exporter-base": "0.218.0",
+        "@opentelemetry/propagator-b3": "2.7.1",
+        "@opentelemetry/propagator-jaeger": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
+        "@opentelemetry/sdk-logs": "0.218.0",
+        "@opentelemetry/sdk-metrics": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1",
+        "@opentelemetry/sdk-trace-node": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -14614,98 +11449,107 @@
         "@opentelemetry/api": ">=1.3.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.6.1.tgz",
-      "integrity": "sha512-r86ut4T1e8vNwB35CqCcKd45yzqH6/6Wzvpk2/cZB8PsPLlZFTvrh8yfOS3CYZYcUmAx4hHTZJ8AO8Dj8nrdhw==",
+    "node_modules/@opentelemetry/sdk-node/node_modules/@opentelemetry/instrumentation": {
+      "version": "0.218.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.218.0.tgz",
+      "integrity": "sha512-mIZil8Es+sYDK5m+DQiwAwF57F14TF2YlEqvIjZ/RQWcxDBwRGsKfdK2Tv65OU9meQKCMzSIFS9mxAcnAb6Bkg==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@opentelemetry/core": "2.6.1",
-        "@opentelemetry/resources": "2.6.1",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/api-logs": "0.218.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": "^1.3.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-trace-node": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-node/-/sdk-trace-node-2.2.0.tgz",
-      "integrity": "sha512-+OaRja3f0IqGG2kptVeYsrZQK9nKRSpfFrKtRBq4uh6nIB8bTBgaGvYQrQoRrQWQMA5dK5yLhDMDc0dvYvCOIQ==",
+    "node_modules/@opentelemetry/sdk-node/node_modules/import-in-the-middle": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.0.1.tgz",
+      "integrity": "sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/context-async-hooks": "2.2.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "acorn": "^8.15.0",
+        "acorn-import-attributes": "^1.9.5",
+        "cjs-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
       },
       "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@opentelemetry/sdk-trace-node/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+    "node_modules/@opentelemetry/sdk-trace-base": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.7.1.tgz",
+      "integrity": "sha512-NAYIlsF8MPUsKqJMiDQJTMPOmlbawC1Iz/omMLygZ1C9am8fTKYjTaI+OZM+WTY3t3Glo0wnOg/6/pac6RGPPw==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/resources": "2.7.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-trace-node/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+    "node_modules/@opentelemetry/sdk-trace-node": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-node/-/sdk-trace-node-2.7.1.tgz",
+      "integrity": "sha512-pCpQxU68lV+I9s9svqMyVu5iHdDDUnqUpSxqwyCU8A9ejEsSnMPCbearwsUO4yk08ZJzAIUCFuReMdVQvHrdvg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/context-async-hooks": "2.7.1",
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
-    "node_modules/@opentelemetry/sdk-trace-node/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+    "node_modules/@opentelemetry/sdk-trace-web": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.7.1.tgz",
+      "integrity": "sha512-K806OouCSOjMd8Nr7+ZCq3QT22tdAzzS/7h8vprfiKjkgFQ99/dvwU8d12WJANA6D5Qtme65hyBAqAu9CkQuxQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
+        "@opentelemetry/core": "2.7.1",
+        "@opentelemetry/sdk-trace-base": "2.7.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
     "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.39.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.39.0.tgz",
-      "integrity": "sha512-R5R9tb2AXs2IRLNKLBJDynhkfmx7mX0vi8NkhZb3gUkPWHn6HXk5J8iQ/dql0U3ApfWym4kXXmBDRGO+oeOfjg==",
+      "version": "1.41.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.41.1.tgz",
+      "integrity": "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
       }
     },
+    "node_modules/@oxc-project/types": {
+      "version": "0.133.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
+      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
     "node_modules/@paralleldrive/cuid2": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.2.2.tgz",
@@ -14767,7 +11611,8 @@
     "node_modules/@protobufjs/aspromise": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ=="
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+      "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/base64": {
       "version": "1.1.2",
@@ -14786,12 +11631,12 @@
       "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q=="
     },
     "node_modules/@protobufjs/fetch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
-      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1",
-        "@protobufjs/inquire": "^1.1.0"
+        "@protobufjs/aspromise": "^1.1.1"
       }
     },
     "node_modules/@protobufjs/float": {
@@ -14800,9 +11645,9 @@
       "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ=="
     },
     "node_modules/@protobufjs/inquire": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.1.tgz",
-      "integrity": "sha512-mnzgDV26ueAvk7rsbt9L7bE0SuAoqyuys/sMMrmVcN5x9VsxpcG3rqAUSgDyLp0UZlmNfIbQ4fHfCtreVBk8Ew==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.2.tgz",
+      "integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/path": {
@@ -14821,6 +11666,19 @@
       "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/@quansync/fs": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@quansync/fs/-/fs-1.0.0.tgz",
+      "integrity": "sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "quansync": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/@quilted/events": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/@quilted/events/-/events-2.1.3.tgz",
@@ -18708,9 +15566,9 @@
       }
     },
     "node_modules/@remix-run/router": {
-      "version": "1.23.2",
-      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.2.tgz",
-      "integrity": "sha512-Ic6m2U/rMjTkhERIa/0ZtXJP17QUi2CbWE7cqx4J58M8aA3QTfW+2UlQ4psvTX9IO1RfNVhK3pcpdjej7L+t2w==",
+      "version": "1.23.3",
+      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
+      "integrity": "sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==",
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"
@@ -18771,10 +15629,304 @@
         }
       }
     },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
+      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
+      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
+      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
+      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
+      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
+      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
+      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
+      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
+      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
+      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
+      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
+      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
+      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
+      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
+      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
     "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.0-rc.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.3.tgz",
-      "integrity": "sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
       "dev": true,
       "license": "MIT"
     },
@@ -18798,6 +15950,33 @@
         }
       }
     },
+    "node_modules/@rollup/plugin-babel": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-6.1.0.tgz",
+      "integrity": "sha512-dFZNuFD2YRcoomP4oYf+DvQNSUA9ih+A3vUqopQx5EdtPGo3WBnQcI/S8pwpz91UsGfL0HsMSOlaMld8HrbubA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.18.6",
+        "@rollup/pluginutils": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0",
+        "@types/babel__core": "^7.1.9",
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/babel__core": {
+          "optional": true
+        },
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@rollup/plugin-commonjs": {
       "version": "29.0.0",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.0.tgz",
@@ -18946,17 +16125,18 @@
       }
     },
     "node_modules/@rollup/plugin-terser": {
-      "version": "0.4.4",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-0.4.4.tgz",
-      "integrity": "sha512-XHeJC5Bgvs8LfukDwWZp7yeqin6ns8RTl2B9avbejt6tZqsqvVoWI7ZTQrcNsfKEDWBTnTxM8nMDkO2IFFbd0A==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-1.0.0.tgz",
+      "integrity": "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "serialize-javascript": "^6.0.1",
+        "serialize-javascript": "^7.0.3",
         "smob": "^1.0.0",
         "terser": "^5.17.4"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.0.0"
       },
       "peerDependencies": {
         "rollup": "^2.0.0||^3.0.0||^4.0.0"
@@ -19379,6 +16559,39 @@
       "hasInstallScript": true,
       "license": "Apache-2.0"
     },
+    "node_modules/@sentry/core": {
+      "version": "8.55.2",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-8.55.2.tgz",
+      "integrity": "sha512-YlEBwybUcOQ/KjMHDmof1vwweVnBtBxYlQp7DE3fOdtW4pqqdHWTnTntQs4VgYfxzjJYgtkd9LHlGtg8qy+JVQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.18"
+      }
+    },
+    "node_modules/@sentry/types": {
+      "version": "8.55.2",
+      "resolved": "https://registry.npmjs.org/@sentry/types/-/types-8.55.2.tgz",
+      "integrity": "sha512-6MH7sKopaAY1XAIoOirjkkhHZfH3TBuIyErtUH29jvHcdHQFQPk42vX82jBL6csGB8wbsHCWjrBh6y2KqtaknA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "8.55.2"
+      },
+      "engines": {
+        "node": ">=14.18"
+      }
+    },
+    "node_modules/@sentry/utils": {
+      "version": "8.55.2",
+      "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-8.55.2.tgz",
+      "integrity": "sha512-biW6W+/KGaNkNnNlw8yExGM1uQ1+PI+L9Rb99LzJcavm1TGHpmSfGOzqj6y08P6Iw/+JmM2Dj2hvmns2fIwTWw==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "8.55.2"
+      },
+      "engines": {
+        "node": ">=14.18"
+      }
+    },
     "node_modules/@sinclair/typebox": {
       "version": "0.27.8",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz",
@@ -19476,58 +16689,13 @@
       }
     },
     "node_modules/@smithy/core": {
-      "version": "3.23.17",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.17.tgz",
-      "integrity": "sha512-x7BlLbUFL8NWCGjMF9C+1N5cVCxcPa7g6Tv9B4A2luWx3be3oU8hQ96wIwxe/s7OhIzvoJH73HAUSg5JXVlEtQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
-        "@smithy/uuid": "^1.1.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/core/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/core/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/core/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
+      "version": "3.25.1",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.25.1.tgz",
+      "integrity": "sha512-zpDbpXBCBsxfLtG2GEUyfgvHvSFrw5CwDZSNzL0v52gx/c3oPlPbm+7W7num8xs6vyiUBn+bvYPHcQDOXZynCQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
+        "@aws-crypto/crc32": "5.2.0",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -19535,15 +16703,13 @@
       }
     },
     "node_modules/@smithy/credential-provider-imds": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.14.tgz",
-      "integrity": "sha512-Au28zBN48ZAoXdooGUHemuVBrkE+Ie6RPmGNIAJsFqj33Vhb6xAgRifUydZ2aY+M+KaMAETAlKk5NC5h1G7wpg==",
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.4.1.tgz",
+      "integrity": "sha512-TSAF5NHgxEsllbErYWbK8aLnl5L601NGc5VYJlSPsKnf3YlkhdoBN+geGcaU00oiw2OK3QO5LA3QNXiiWhCidQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
+        "@smithy/core": "^3.25.1",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -19621,15 +16787,13 @@
       }
     },
     "node_modules/@smithy/fetch-http-handler": {
-      "version": "5.3.17",
-      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.17.tgz",
-      "integrity": "sha512-bXOvQzaSm6MnmLaWA1elgfQcAtN4UP3vXqV97bHuoOrHQOJiLT3ds6o9eo5bqd0TJfRFpzdGnDQdW3FACiAVdw==",
+      "version": "5.5.1",
+      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.5.1.tgz",
+      "integrity": "sha512-96JrD1q71anokymx9Iblb+zKmNQYNstlV/25A9ZYIJ2A0rp1r7/GZAIm0bDWSmVvz3DpNOCZuabzsiL+w0UHhw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/querystring-builder": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
+        "@smithy/core": "^3.25.1",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -19930,14 +17094,13 @@
       }
     },
     "node_modules/@smithy/node-http-handler": {
-      "version": "4.6.1",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.6.1.tgz",
-      "integrity": "sha512-iB+orM4x3xrr57X3YaXazfKnntl0LHlZB1kcXSGzMV1Tt0+YwEjGlbjk/44qEGtBzXAz6yFDzkYTKSV6Pj2HUg==",
+      "version": "4.8.1",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.8.1.tgz",
+      "integrity": "sha512-emtXvoky671puri18ETf64AFIQUGIEA093F2drXpBgB0OGnBLjcwNR3CA2mYu62IAqNsS56xa5lnTxAgPq7cjw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/querystring-builder": "^4.2.14",
-        "@smithy/types": "^4.14.1",
+        "@smithy/core": "^3.25.1",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -20023,56 +17186,13 @@
       }
     },
     "node_modules/@smithy/signature-v4": {
-      "version": "5.3.14",
-      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.14.tgz",
-      "integrity": "sha512-1D9Y/nmlVjCeSivCbhZ7hgEpmHyY1h0GvpSZt3l0xcD9JjmjVC1CHOozS6+Gh+/ldMH8JuJ6cujObQqfayAVFA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-hex-encoding": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-uri-escape": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/signature-v4/node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
+      "version": "5.5.1",
+      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.5.1.tgz",
+      "integrity": "sha512-X9rVls3En0z3NtrmguTmpRM0/NqtWUxBjal6fcAkwtsub+gOdLZ6kD+V7xhUgFMGdG14bHbZ7M5QjaRI1+DatQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/signature-v4/node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/signature-v4/node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
+        "@smithy/core": "^3.25.1",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -20098,9 +17218,9 @@
       }
     },
     "node_modules/@smithy/types": {
-      "version": "4.14.1",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.1.tgz",
-      "integrity": "sha512-59b5HtSVrVR/eYNei3BUj3DCPKD/G7EtDDe7OEJE7i7FtQFugYo6MxbotS8mVJkLNVf8gYaAlEBwwtJ9HzhWSg==",
+      "version": "4.15.0",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.15.0.tgz",
+      "integrity": "sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -20426,29 +17546,6 @@
       "resolved": "https://registry.npmjs.org/@stitches/core/-/core-1.2.8.tgz",
       "integrity": "sha512-Gfkvwk9o9kE9r9XNBmJRfV8zONvXThnm1tcuojL04Uy5uRyqg93DC83lDebl0rocZCfKSjUv+fWYtMQmEDJldg=="
     },
-    "node_modules/@surma/rollup-plugin-off-main-thread": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@surma/rollup-plugin-off-main-thread/-/rollup-plugin-off-main-thread-2.2.3.tgz",
-      "integrity": "sha512-lR8q/9W7hZpMWweNiAKU7NQerBnzQQLvi8qnTDU/fxItPhtZVMbPV3lbCwjhIlNBe9Bbr5V+KHshvWmVSG9cxQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "ejs": "^3.1.6",
-        "json5": "^2.2.0",
-        "magic-string": "^0.25.0",
-        "string.prototype.matchall": "^4.0.6"
-      }
-    },
-    "node_modules/@surma/rollup-plugin-off-main-thread/node_modules/magic-string": {
-      "version": "0.25.9",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.9.tgz",
-      "integrity": "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sourcemap-codec": "^1.4.8"
-      }
-    },
     "node_modules/@swc/helpers": {
       "version": "0.5.17",
       "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.17.tgz",
@@ -20745,6 +17842,22 @@
       "resolved": "https://registry.npmjs.org/@tokenizer/token/-/token-0.3.0.tgz",
       "integrity": "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A=="
     },
+    "node_modules/@trickfilm400/rollup-plugin-off-main-thread": {
+      "version": "3.0.0-pre1",
+      "resolved": "https://registry.npmjs.org/@trickfilm400/rollup-plugin-off-main-thread/-/rollup-plugin-off-main-thread-3.0.0-pre1.tgz",
+      "integrity": "sha512-/67zpWDBLV+oYAEL682s1ktXL0HgqX76f6gaVGkGnVZlBbm1zd0v4Bz8MFF2GGhoX9rvfq3KSQHubFHwa6w6/Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "ejs": "^3.1.10",
+        "json5": "^2.2.3",
+        "magic-string": "^0.30.21",
+        "string.prototype.matchall": "^4.0.12"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/@tsconfig/node10": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.11.tgz",
@@ -20769,6 +17882,90 @@
       "integrity": "sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==",
       "devOptional": true
     },
+    "node_modules/@turbo/darwin-64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-64/-/darwin-64-2.9.17.tgz",
+      "integrity": "sha512-io5jn5RDeU+9YV78rWhwG++HD/OZ/Lxg1sg93+jDGKQNP3UDxY6RX2dmarbCILhNxNuAM8FH3WgGMY9E96Mf8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@turbo/darwin-arm64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-arm64/-/darwin-arm64-2.9.17.tgz",
+      "integrity": "sha512-83YZTYmN2sxFWf2LTMOwqbOvR3qZMa/TSFwnB6BHVBbIWyoPPe+TAdSTd8KevEx8ml8KkycJ/9A70DFVReyUww==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@turbo/linux-64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-64/-/linux-64-2.9.17.tgz",
+      "integrity": "sha512-teKfwJg0zSC+C2ZSOsX3VnAJGVgcN+pgKNmnGWzcpXQ9eIkAQtYP+getrQ2f1Tw/ePudnreQhq8tVP8S73Vy6Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@turbo/linux-arm64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-arm64/-/linux-arm64-2.9.17.tgz",
+      "integrity": "sha512-mqO36x2CNtJ9CCbEf5xOqH662tVSc1wB0mxh7dopBpgXg0fEifdzwX0IEAUW1WUAaNH986L7iEUUgw3HNqUWgg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@turbo/windows-64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-64/-/windows-64-2.9.17.tgz",
+      "integrity": "sha512-jbyoNePufyMoSSrvVr+/mglcjmya/MOgoIrSHPr67iZ1VFgrlMQXHXtptR2lR48gi+86b1XBvsviJZ9A7zrydg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@turbo/windows-arm64": {
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-arm64/-/windows-arm64-2.9.17.tgz",
+      "integrity": "sha512-+ql0wYc99Y2AMvyHCcC/P+xtyV4nz522L+C9HDnyi7ryHXBGM+ZjBP28M7SLBGMDImgpN8sk2szpgbvreMeXVA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.1",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
@@ -20854,6 +18051,19 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/cookiejar": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@types/cookiejar/-/cookiejar-2.1.5.tgz",
+      "integrity": "sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/css-font-loading-module": {
+      "version": "0.0.7",
+      "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
+      "integrity": "sha512-nl09VhutdjINdWyXxHWN/w9zlNCfr60JUqJbd24YXUuCwgeL0TpFSdElCwb6cxfB6ybE19Gjj4g0jsgkXxKv1Q==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3": {
       "version": "7.4.3",
       "resolved": "https://registry.npmjs.org/@types/d3/-/d3-7.4.3.tgz",
@@ -21244,6 +18454,13 @@
         "parse5": "^7.0.0"
       }
     },
+    "node_modules/@types/jsesc": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@types/jsesc/-/jsesc-2.5.1.tgz",
+      "integrity": "sha512-9VN+6yxLOPLOav+7PwjZbxiID2bVaeq0ED4qSQmdQTdjnXJSaCVKTR58t15oqH1H5t8Ng2ZX1SabJVoN9Q34bw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -21293,6 +18510,13 @@
         "@types/unist": "*"
       }
     },
+    "node_modules/@types/methods": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@types/methods/-/methods-1.1.4.tgz",
+      "integrity": "sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/mime": {
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
@@ -21314,11 +18538,12 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "20.11.16",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.16.tgz",
-      "integrity": "sha512-gKb0enTmRCzXSSUJDq6/sPcqrfCv2mkkG6Jt/clpn5eiCbKTY+SgZUxo+p8ZKMof5dCp9vHQUAB7wOUTod22wQ==",
+      "version": "24.12.4",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.4.tgz",
+      "integrity": "sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA==",
+      "license": "MIT",
       "dependencies": {
-        "undici-types": "~5.26.4"
+        "undici-types": "~7.16.0"
       }
     },
     "node_modules/@types/node-fetch": {
@@ -21464,6 +18689,30 @@
       "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
       "dev": true
     },
+    "node_modules/@types/superagent": {
+      "version": "8.1.10",
+      "resolved": "https://registry.npmjs.org/@types/superagent/-/superagent-8.1.10.tgz",
+      "integrity": "sha512-nbt4IWXABhW0jGmmpRzCFNlbmwCTzZ2gTUsNIr+X+ItdqPms+PAJZbWsNzpS2USqXjcoNLQcO6nXo60zcPQiIg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/cookiejar": "^2.1.5",
+        "@types/methods": "^1.1.4",
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
+    "node_modules/@types/supertest": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@types/supertest/-/supertest-7.2.0.tgz",
+      "integrity": "sha512-uh2Lv57xvggst6lCqNdFAmDSvoMG7M/HDtX4iUCquxQ5EGPtaPM5PL5Hmi7LCvOG8db7YaCPNJEeoI8s/WzIQw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/methods": "^1.1.4",
+        "@types/superagent": "^8.1.0"
+      }
+    },
     "node_modules/@types/testing-library__jest-dom": {
       "version": "5.14.9",
       "resolved": "https://registry.npmjs.org/@types/testing-library__jest-dom/-/testing-library__jest-dom-5.14.9.tgz",
@@ -21579,21 +18828,20 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.24.0.tgz",
-      "integrity": "sha512-aFcXEJJCI4gUdXgoo/j9udUYIHgF23MFkg09LFz2dzEmU0+1Plk4rQWv/IYKvPHAtlkkGoB3m5e6oUp+JPsNaQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.1.tgz",
+      "integrity": "sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/type-utils": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "graphemer": "^1.4.0",
-        "ignore": "^5.3.1",
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/type-utils": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.0.1"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21603,23 +18851,33 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.0.0 || ^8.0.0-alpha.0",
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "@typescript-eslint/parser": "^8.60.1",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.24.0.tgz",
-      "integrity": "sha512-MFDaO9CYiard9j9VepMNa9MTcqVvSny2N4hkY6roquzj8pdCBRENhErrteaQuu7Yjn1ppk0v1/ZF9CG3KIlrTA==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.60.1.tgz",
+      "integrity": "sha512-A0M6ua6H252bVjPvvtSgl2QA4+ET9S5Mtkb2GDyTxIhH/C4qDItT7RQNO5PhMC6NXGYXOR9dIalcDDgBKT7oFA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/typescript-estree": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "debug": "^4.3.4"
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "debug": "^4.4.3"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21629,19 +18887,41 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.1.tgz",
+      "integrity": "sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.60.1",
+        "@typescript-eslint/types": "^8.60.1",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.24.0.tgz",
-      "integrity": "sha512-HZIX0UByphEtdVBKaQBgTDdn9z16l4aTUz8e8zPQnyxwHBtf5vtl1L+OhH+m1FGV9DrRmoDuYKqzVrvWDcDozw==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.1.tgz",
+      "integrity": "sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0"
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21651,17 +18931,35 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.1.tgz",
+      "integrity": "sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.24.0.tgz",
-      "integrity": "sha512-8fitJudrnY8aq0F1wMiPM1UUgiXQRJ5i8tFjq9kGfRajU+dbPyOuHbl0qRopLEidy0MwqgTHDt6CnSeXanNIwA==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.60.1.tgz",
+      "integrity": "sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/typescript-estree": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0",
-        "debug": "^4.3.4",
-        "ts-api-utils": "^2.0.1"
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21671,14 +18969,14 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.24.0.tgz",
-      "integrity": "sha512-VacJCBTyje7HGAw7xp11q439A+zeGG0p0/p2zsZwpnMzjPB5WteaWqt4g2iysgGFafrqvyLWqq6ZPZAOCoefCw==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.1.tgz",
+      "integrity": "sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21690,20 +18988,21 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.24.0.tgz",
-      "integrity": "sha512-ITjYcP0+8kbsvT9bysygfIfb+hBj6koDsu37JZG7xrCiy3fPJyNmfVtaGsgTUSEuTzcvME5YI5uyL5LD1EV5ZQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.1.tgz",
+      "integrity": "sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "debug": "^4.3.4",
-        "fast-glob": "^3.3.2",
-        "is-glob": "^4.0.3",
-        "minimatch": "^9.0.4",
-        "semver": "^7.6.0",
-        "ts-api-utils": "^2.0.1"
+        "@typescript-eslint/project-service": "8.60.1",
+        "@typescript-eslint/tsconfig-utils": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21713,46 +19012,59 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <5.8.0"
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.24.0.tgz",
-      "integrity": "sha512-07rLuUBElvvEb1ICnafYWr4hk8/U7X9RDCOqd9JcAMtjh/9oRmcfN4yGzbPVirgMR0+HLVHehmu19CWeh7fsmQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.60.1.tgz",
+      "integrity": "sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/eslint-utils": "^4.4.0",
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/typescript-estree": "8.24.0"
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21762,19 +19074,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.24.0.tgz",
-      "integrity": "sha512-kArLq83QxGLbuHrTMoOEWO+l2MwsNS2TGISEdx8xgqpkbytB07XmlQyQdNDrCc1ecSqx0cnmhGvpX+VBwqqSkg==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.1.tgz",
+      "integrity": "sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "eslint-visitor-keys": "^4.2.0"
+        "@typescript-eslint/types": "8.60.1",
+        "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -21785,13 +19097,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
-      "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "funding": {
         "url": "https://opencollective.com/eslint"
@@ -22113,6 +19425,12 @@
         "node": ">=10.0.0"
       }
     },
+    "node_modules/@xstate/fsm": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@xstate/fsm/-/fsm-1.6.5.tgz",
+      "integrity": "sha512-b5o1I6aLNeYlU/3CPlj/Z91ybk1gUsKT+5NAJI+2W4UjvS5KLG28K9v5UvNoFVjHV8PajVZ00RH3vnjyQO7ZAw==",
+      "license": "MIT"
+    },
     "node_modules/abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
@@ -22313,6 +19631,16 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/ansis": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ansis/-/ansis-4.3.1.tgz",
+      "integrity": "sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/any-promise": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
@@ -22578,6 +19906,84 @@
         "node": ">=0.8"
       }
     },
+    "node_modules/ast-kit": {
+      "version": "3.0.0-beta.1",
+      "resolved": "https://registry.npmjs.org/ast-kit/-/ast-kit-3.0.0-beta.1.tgz",
+      "integrity": "sha512-trmleAnZ2PxN/loHWVhhx1qeOHSRXq4TDsBBxq3GqeJitfk3+jTQ+v/C1km/KYq9M7wKqCewMh+/NAvVH7m+bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-beta.4",
+        "estree-walker": "^3.0.3",
+        "pathe": "^2.0.3"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
     "node_modules/ast-types-flow": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
@@ -22864,22 +20270,6 @@
         "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
       }
     },
-    "node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
-        "browserslist": "^4.24.0",
-        "lru-cache": "^5.1.1",
-        "semver": "^6.3.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider": {
       "version": "0.6.8",
       "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.8.tgz",
@@ -23148,6 +20538,15 @@
         "bare-path": "^3.0.0"
       }
     },
+    "node_modules/base64-arraybuffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
+      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
     "node_modules/base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -23208,6 +20607,22 @@
         "node": ">=8"
       }
     },
+    "node_modules/bintrees": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/bintrees/-/bintrees-1.0.2.tgz",
+      "integrity": "sha512-VOMgTMwjAaUG580SXn3LacVgjurrbMme7ZZNYGSSV7mmtY6QQRh0Eg3pwIcntQ77DErK1L0NxkbetjcoXzVwKw==",
+      "license": "MIT"
+    },
+    "node_modules/birpc": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/birpc/-/birpc-4.0.0.tgz",
+      "integrity": "sha512-LShSxJP0KTmd101b6DRyGBj57LZxSDYWKitQNW/mi8GRMvZb078Uf9+pveax1DrVL89vm7mWe+TovdI/UDOuPw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/bluebird": {
       "version": "3.4.7",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.4.7.tgz",
@@ -23398,13 +20813,13 @@
       }
     },
     "node_modules/browserify-sign": {
-      "version": "4.2.5",
-      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz",
-      "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==",
+      "version": "4.2.6",
+      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.6.tgz",
+      "integrity": "sha512-sd+Q65fjlWCYWtZKXiKfrUc8d+4jtp/8f0W2NkwzLtoW4bI6UDnWusLWIurHnmurW0XShIRxpwiOX4EoPtXUAg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "bn.js": "^5.2.2",
+        "bn.js": "^5.2.3",
         "browserify-rsa": "^4.1.1",
         "create-hash": "^1.2.0",
         "create-hmac": "^1.1.7",
@@ -23623,6 +21038,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/cac": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/cac/-/cac-7.0.0.tgz",
+      "integrity": "sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
     "node_modules/call-bind": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -23684,6 +21109,7 @@
       "version": "6.3.0",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
       "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true,
       "engines": {
         "node": ">=10"
       },
@@ -25627,14 +23053,6 @@
         }
       }
     },
-    "node_modules/decamelize": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
-      "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/decimal.js": {
       "version": "10.6.0",
       "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
@@ -25787,6 +23205,13 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/defu": {
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/delaunator": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.0.1.tgz",
@@ -26066,6 +23491,27 @@
       "resolved": "https://registry.npmjs.org/downloadjs/-/downloadjs-1.4.7.tgz",
       "integrity": "sha512-LN1gO7+u9xjU5oEScGFKvXhYf7Y/empUIIEAGBs1LzUq/rg5duiDrkuH5A2lQGd5jfMOb9X9usDa2oVXwJ0U/Q=="
     },
+    "node_modules/dts-resolver": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/dts-resolver/-/dts-resolver-3.0.0.tgz",
+      "integrity": "sha512-1T1f+z+4tl9XD+m+0HBgWoL/nm0bOIffyWaUuUSBlFg/86IWvfx+wjNaO/ybU0AJzG9/Mi5hBUgGV6zCmWEN7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "oxc-resolver": ">=11.0.0"
+      },
+      "peerDependenciesMeta": {
+        "oxc-resolver": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/duck": {
       "version": "0.1.12",
       "resolved": "https://registry.npmjs.org/duck/-/duck-0.1.12.tgz",
@@ -26170,6 +23616,16 @@
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
       "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
     },
+    "node_modules/empathic": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.1.tgz",
+      "integrity": "sha512-YGRs8knHhKHVShLkFET/rWAU8kmHbOV5LwN938RHI0pljAJ1Gf6SzXsSmRaEzcXTtOOmVqJ5+WtQPL5uigY50Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/enabled": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
@@ -27059,19 +24515,6 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/esquery": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.5.0.tgz",
@@ -27129,6 +24572,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/eta": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/eta/-/eta-4.6.0.tgz",
+      "integrity": "sha512-lW6is4T1NFOYnmqGZIfvixqj7A7sSvScF+DN8EK6K58xI5MZ5UvYe0GjopxOXQtZvUn4eDdVuZ8XSoYWTMEKwA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/bgub/eta?sponsor=1"
+      }
+    },
     "node_modules/etag": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
@@ -27682,6 +25138,12 @@
         "node": "^12.20 || >= 14.13"
       }
     },
+    "node_modules/fflate": {
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.7.4.tgz",
+      "integrity": "sha512-5u2V/CDW15QM1XbbgS+0DfPxVB+jUKhWEKuuFuHncbk3tEEqzmoXL+2KyOFuKGqOnmdIy0/davWF1CkuwtibCw==",
+      "license": "MIT"
+    },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
@@ -27714,9 +25176,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
+      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27958,11 +25420,12 @@
       }
     },
     "node_modules/foreground-child": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.1.1.tgz",
-      "integrity": "sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==",
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "license": "ISC",
       "dependencies": {
-        "cross-spawn": "^7.0.0",
+        "cross-spawn": "^7.0.6",
         "signal-exit": "^4.0.1"
       },
       "engines": {
@@ -27984,16 +25447,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -28045,6 +25508,12 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/forwarded-parse": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/forwarded-parse/-/forwarded-parse-2.1.2.tgz",
+      "integrity": "sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==",
+      "license": "MIT"
+    },
     "node_modules/fraction.js": {
       "version": "5.3.4",
       "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-5.3.4.tgz",
@@ -28059,14 +25528,13 @@
       }
     },
     "node_modules/framer-motion": {
-      "version": "12.23.9",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.23.9.tgz",
-      "integrity": "sha512-TqEHXj8LWfQSKqfdr5Y4mYltYLw96deu6/K9kGDd+ysqRJPNwF9nb5mZcrLmybHbU7gcJ+HQar41U3UTGanbbQ==",
+      "version": "12.40.0",
+      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.40.0.tgz",
+      "integrity": "sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "motion-dom": "^12.23.9",
-        "motion-utils": "^12.23.6",
+        "motion-dom": "^12.40.0",
+        "motion-utils": "^12.39.0",
         "tslib": "^2.4.0"
       },
       "peerDependencies": {
@@ -28086,23 +25554,6 @@
         }
       }
     },
-    "node_modules/framer-motion/node_modules/motion-dom": {
-      "version": "12.23.9",
-      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.23.9.tgz",
-      "integrity": "sha512-6Sv++iWS8XMFCgU1qwKj9l4xuC47Hp4+2jvPfyTXkqDg2tTzSgX6nWKD4kNFXk0k7llO59LZTPuJigza4A2K1A==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "motion-utils": "^12.23.6"
-      }
-    },
-    "node_modules/framer-motion/node_modules/motion-utils": {
-      "version": "12.23.6",
-      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-12.23.6.tgz",
-      "integrity": "sha512-eAWoPgr4eFEOFfg2WjIsMoqJTW6Z8MTUCgn/GZ3VRpClWBdnbjryiA3ZSNLyxCTmCQx4RmYX6jX1iWHbenUPNQ==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/fresh": {
       "version": "0.5.2",
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
@@ -28310,7 +25761,6 @@
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
       "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -28390,9 +25840,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28496,6 +25946,7 @@
       "version": "6.1.1",
       "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-6.1.1.tgz",
       "integrity": "sha512-a4tiq7E0/5fTjxPAaH4jpjkSv/uCaU2p5KC6HVGrvl0cDjA8iBZv4vv1gyzlmK0ZUKqwpOyQMKzZQe3lTit77A==",
+      "license": "Apache-2.0",
       "dependencies": {
         "gaxios": "^6.1.1",
         "google-logging-utils": "^0.0.2",
@@ -28509,6 +25960,7 @@
       "version": "0.0.2",
       "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-0.0.2.tgz",
       "integrity": "sha512-NEgUnEcBiP5HrPzufUkBzJOD/Sxsco3rLNo1F1TNf7ieU8ryUzBhqba8r756CjLX7rn3fHl6iLEwPYuqpoKgQQ==",
+      "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
       }
@@ -28531,13 +25983,6 @@
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true
     },
-    "node_modules/graphemer": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
-      "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/gtoken": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/gtoken/-/gtoken-7.1.0.tgz",
@@ -28728,9 +26173,10 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
       },
@@ -28993,14 +26439,21 @@
       "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
     },
     "node_modules/hono": {
-      "version": "4.12.18",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.18.tgz",
-      "integrity": "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==",
+      "version": "4.12.25",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
+      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
       }
     },
+    "node_modules/hookable": {
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/hookable/-/hookable-6.1.1.tgz",
+      "integrity": "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/hookified": {
       "version": "1.12.1",
       "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.12.1.tgz",
@@ -29385,6 +26838,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/import-without-cache": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/import-without-cache/-/import-without-cache-0.4.0.tgz",
+      "integrity": "sha512-NkJQA7oZ4YHQhd2+H3BoRFKF3d/XNsiKpHZCQEMH9pDX27hQQLsTyOocyRgaIVtf8gHX3Nt3LPkR4e5EdtPAGQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@@ -29877,9 +27343,9 @@
       }
     },
     "node_modules/is-network-error": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.1.tgz",
-      "integrity": "sha512-6QCxa49rQbmUWLfk0nuGqzql9U8uaV2H6279bRErPBHe/109hCzsLUBUHfbEtvLIHBd6hyXbgedBSHevm43Edw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz",
+      "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==",
       "license": "MIT",
       "engines": {
         "node": ">=16"
@@ -30385,27 +27851,33 @@
       }
     },
     "node_modules/jest-junit": {
-      "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/jest-junit/-/jest-junit-16.0.0.tgz",
-      "integrity": "sha512-A94mmw6NfJab4Fg/BlvVOUXzXgF0XIH6EmTgJ5NDPp4xoKq0Kr7sErb+4Xs9nZvu58pJojz5RFGpqnZYJTrRfQ==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/jest-junit/-/jest-junit-17.0.0.tgz",
+      "integrity": "sha512-RYWCkq4j59gUXj5DsgbIE7xFBZzu1gtibPhyjSjMmGaOTLnqlXhg7x9zuGCwgbCuMAyoyvk0Mi8wSrRR5uOeLA==",
       "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
         "mkdirp": "^1.0.4",
         "strip-ansi": "^6.0.1",
-        "uuid": "^8.3.2",
+        "uuid": "^14.0.0",
         "xml": "^1.0.1"
       },
       "engines": {
-        "node": ">=10.12.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/jest-junit/node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
       "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/jest-matcher-utils": {
@@ -31564,17 +29036,19 @@
       }
     },
     "node_modules/js-cookie": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/js-cookie/-/js-cookie-3.0.5.tgz",
-      "integrity": "sha512-cEiJEAEoIbWfCZYKWhVwFuvPX1gETRYPw6LlaTKoxD3s2AkXzkCjnp6h0V77ozyqj0jakteJ4YqDJT830+lVGw==",
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/js-cookie/-/js-cookie-3.0.7.tgz",
+      "integrity": "sha512-z/wZZgDrkNV1eA0ULjM/F9/50Ya8fbzgKneSpoPsXSGd0KnpdtHfOZWK+GcwLk+EZbS4F9RBhU+K2RgzuDaItw==",
+      "license": "MIT",
       "engines": {
-        "node": ">=14"
+        "node": ">=20"
       }
     },
     "node_modules/js-tiktoken": {
-      "version": "1.0.14",
-      "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.14.tgz",
-      "integrity": "sha512-Pk3l3WOgM9joguZY2k52+jH82RtABRgB5RdGFZNUGbOKGMVlNmafcPA3b0ITcCZPu1L9UclP1tne6aw7ZI4Myg==",
+      "version": "1.0.21",
+      "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
+      "integrity": "sha512-biOj/6M5qdgx5TKjDnFT1ymSpM5tbd3ylwDtrQvFQSu0Z7bBYko2dF+W/aUkXUPuk6IVpRxk/3Q2sHOzGlS36g==",
+      "license": "MIT",
       "dependencies": {
         "base64-js": "^1.5.1"
       }
@@ -31585,9 +29059,19 @@
       "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -31668,13 +29152,6 @@
       "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
       "dev": true
     },
-    "node_modules/json-schema": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
-      "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
-      "dev": true,
-      "license": "(AFL-2.1 OR BSD-3-Clause)"
-    },
     "node_modules/json-schema-to-ts": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
@@ -31706,6 +29183,12 @@
       "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "dev": true
     },
+    "node_modules/json-stringify-safe": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
+      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
+      "license": "ISC"
+    },
     "node_modules/json5": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -31981,9 +29464,9 @@
       "integrity": "sha512-Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A=="
     },
     "node_modules/langsmith": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.6.0.tgz",
-      "integrity": "sha512-GGaj5IMRfLv2HXXFzGk9diISMYLTpSTh6fzCZGKxWYW/NqEztIFtnXLq6G/RVhzFRmCykLap1fuC67LVKoQLcg==",
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.6.3.tgz",
+      "integrity": "sha512-pXrQ4/4myQvjFFOAUmt5pWRrLEZR20gzIJD7MNdUH+5/S5nLI4ZRBo/SYKC6coaYj9pYTfQdBIzcs+3kfJ5uDA==",
       "license": "MIT",
       "dependencies": {
         "p-queue": "6.6.2"
@@ -32031,6 +29514,15 @@
         "node": ">=0.10"
       }
     },
+    "node_modules/launder": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/launder/-/launder-1.7.1.tgz",
+      "integrity": "sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==",
+      "license": "MIT",
+      "dependencies": {
+        "dayjs": "^1.11.7"
+      }
+    },
     "node_modules/layout-base": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/layout-base/-/layout-base-1.0.2.tgz",
@@ -32124,6 +29616,279 @@
         "immediate": "~3.0.5"
       }
     },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/lilconfig": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
@@ -32843,13 +30608,13 @@
       }
     },
     "node_modules/magic-string": {
-      "version": "0.30.17",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.17.tgz",
-      "integrity": "sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==",
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0"
+        "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
     "node_modules/make-dir": {
@@ -34458,6 +32223,12 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
+    "node_modules/mitt": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-1.2.0.tgz",
+      "integrity": "sha512-r6lj77KlwqLhIUku9UWYes7KJtsczvolZkzp8hbaDPPaE24OmWl5s539Mytlj22siEQKosZ26qCBgda2PKwoJw==",
+      "license": "MIT"
+    },
     "node_modules/mkdirp": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
@@ -34730,18 +32501,18 @@
       }
     },
     "node_modules/motion-dom": {
-      "version": "11.18.1",
-      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-11.18.1.tgz",
-      "integrity": "sha512-g76KvA001z+atjfxczdRtw/RXOM3OMSdd1f4DL77qCTF/+avrRJiawSG4yDibEQ215sr9kpinSlX2pCTJ9zbhw==",
+      "version": "12.40.0",
+      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.40.0.tgz",
+      "integrity": "sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==",
       "license": "MIT",
       "dependencies": {
-        "motion-utils": "^11.18.1"
+        "motion-utils": "^12.39.0"
       }
     },
     "node_modules/motion-utils": {
-      "version": "11.18.1",
-      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-11.18.1.tgz",
-      "integrity": "sha512-49Kt+HKjtbJKLtgO/LKj9Ld+6vw9BjH5d9sc40R/kVyH8GLAXgT42M2NnuPcJNuA3s9ZfZBUcwIgpmZWGEE+hA==",
+      "version": "12.39.0",
+      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-12.39.0.tgz",
+      "integrity": "sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==",
       "license": "MIT"
     },
     "node_modules/mpath": {
@@ -34769,9 +32540,9 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
     },
     "node_modules/multer": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz",
-      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz",
+      "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
@@ -34791,6 +32562,7 @@
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
       "integrity": "sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==",
+      "license": "MIT",
       "bin": {
         "mustache": "bin/mustache"
       }
@@ -35057,9 +32829,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.5.tgz",
-      "integrity": "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
+      "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -35329,6 +33101,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/obug": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.2.tgz",
+      "integrity": "sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/okapibm25": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/okapibm25/-/okapibm25-1.4.1.tgz",
@@ -37995,6 +35781,19 @@
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
       "license": "MIT"
     },
+    "node_modules/prom-client": {
+      "version": "15.1.3",
+      "resolved": "https://registry.npmjs.org/prom-client/-/prom-client-15.1.3.tgz",
+      "integrity": "sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.4.0",
+        "tdigest": "^0.1.1"
+      },
+      "engines": {
+        "node": "^16 || ^18 || >=20"
+      }
+    },
     "node_modules/promise.series": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/promise.series/-/promise.series-0.2.0.tgz",
@@ -38030,9 +35829,9 @@
       }
     },
     "node_modules/protobufjs": {
-      "version": "7.5.8",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz",
-      "integrity": "sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA==",
+      "version": "7.5.9",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.9.tgz",
+      "integrity": "sha512-Od4muIm3HW1AouyHF5lONOf1FWo3hY1NbFDoy191X9GzhpgW1clCoaFjfVs2rKJNFYpTNJbje4cbAIDBZJ63ZA==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -38040,9 +35839,9 @@
         "@protobufjs/base64": "^1.1.2",
         "@protobufjs/codegen": "^2.0.5",
         "@protobufjs/eventemitter": "^1.1.0",
-        "@protobufjs/fetch": "^1.1.0",
+        "@protobufjs/fetch": "^1.1.1",
         "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.1",
+        "@protobufjs/inquire": "^1.1.2",
         "@protobufjs/path": "^1.1.2",
         "@protobufjs/pool": "^1.1.0",
         "@protobufjs/utf8": "^1.1.1",
@@ -38125,9 +35924,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
-      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
+      "version": "6.15.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -38139,6 +35938,23 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quansync": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/quansync/-/quansync-1.0.0.tgz",
+      "integrity": "sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/antfu"
+        },
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/sxzz"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/querystring-es3": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/querystring-es3/-/querystring-es3-0.2.1.tgz",
@@ -38605,16 +36421,6 @@
         }
       }
     },
-    "node_modules/react-refresh": {
-      "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.18.0.tgz",
-      "integrity": "sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/react-remove-scroll": {
       "version": "2.5.5",
       "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.5.5.tgz",
@@ -38672,12 +36478,12 @@
       }
     },
     "node_modules/react-router": {
-      "version": "6.30.3",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.3.tgz",
-      "integrity": "sha512-XRnlbKMTmktBkjCLE8/XcZFlnHvr2Ltdr1eJX4idL55/9BbORzyZEaIkBFDhFGCEWBBItsVrDxwx3gnisMitdw==",
+      "version": "6.30.4",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.4.tgz",
+      "integrity": "sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.2"
+        "@remix-run/router": "1.23.3"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -38687,13 +36493,13 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "6.30.3",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.3.tgz",
-      "integrity": "sha512-pxPcv1AczD4vso7G4Z3TKcvlxK7g7TNt3/FNGMhfqyntocvYKj+GCatfigGDjbLozC4baguJ0ReCigoDJXb0ag==",
+      "version": "6.30.4",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.4.tgz",
+      "integrity": "sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.2",
-        "react-router": "6.30.3"
+        "@remix-run/router": "1.23.3",
+        "react-router": "6.30.4"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -39932,6 +37738,40 @@
       "integrity": "sha512-IXgzBWvWQwE6PrDI05OvmXUIruQTcoMDzRsOd5CDvHCVLcLHMTSYvOK5Cm46kWqlV3yAbuSpBZdJ5oP5OUoStg==",
       "license": "Unlicense"
     },
+    "node_modules/rolldown": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
+      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.133.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.0.3",
+        "@rolldown/binding-darwin-arm64": "1.0.3",
+        "@rolldown/binding-darwin-x64": "1.0.3",
+        "@rolldown/binding-freebsd-x64": "1.0.3",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
+        "@rolldown/binding-linux-arm64-musl": "1.0.3",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-musl": "1.0.3",
+        "@rolldown/binding-openharmony-arm64": "1.0.3",
+        "@rolldown/binding-wasm32-wasi": "1.0.3",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
+        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+      }
+    },
     "node_modules/rollup": {
       "version": "4.59.0",
       "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
@@ -40144,6 +37984,20 @@
         "node": ">= 18"
       }
     },
+    "node_modules/rrweb": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/rrweb/-/rrweb-1.1.3.tgz",
+      "integrity": "sha512-F2qp8LteJLyycsv+lCVJqtVpery63L3U+/ogqMA0da8R7Jx57o6gT+HpjrzdeeGMIBZR7kKNaKyJwDupTTu5KA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/css-font-loading-module": "0.0.7",
+        "@xstate/fsm": "^1.4.0",
+        "base64-arraybuffer": "^1.0.1",
+        "fflate": "^0.4.4",
+        "mitt": "^1.1.3",
+        "rrweb-snapshot": "^1.1.14"
+      }
+    },
     "node_modules/rrweb-cssom": {
       "version": "0.8.0",
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
@@ -40151,6 +38005,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/rrweb-snapshot": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/rrweb-snapshot/-/rrweb-snapshot-1.1.14.tgz",
+      "integrity": "sha512-eP5pirNjP5+GewQfcOQY4uBiDnpqxNRc65yKPW0eSoU1XamDfc4M8oqpXGMyUyvLyxFDB0q0+DChuxxiU2FXBQ==",
+      "license": "MIT"
+    },
+    "node_modules/rrweb/node_modules/fflate": {
+      "version": "0.4.8",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.4.8.tgz",
+      "integrity": "sha512-FJqqoDBR00Mdj9ppamLa/Y7vxm+PRmNWA67N846RvsoYVMKB4q3y/de5PA7gUmRMYK/8CMz2GDZQmCRN1wBcWA==",
+      "license": "MIT"
+    },
     "node_modules/run-applescript": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.0.0.tgz",
@@ -40286,15 +38152,16 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "node_modules/sanitize-html": {
-      "version": "2.17.3",
-      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.3.tgz",
-      "integrity": "sha512-Kn4srCAo2+wZyvCNKCSyB2g8RQ8IkX/gQs2uqoSRNu5t9I2qvUyAVvRDiFUVAiX3N3PNuwStY0eNr+ooBHVWEg==",
+      "version": "2.17.4",
+      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.4.tgz",
+      "integrity": "sha512-2HW7v2ol/uAM7sX4hbD8Z59OGWmAPrvjL8E71UWlBcj6m+kcF6ilQBLny+cIgY214QJeJT5tQuxKKqX0SQqjGQ==",
       "license": "MIT",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "escape-string-regexp": "^4.0.0",
         "htmlparser2": "^10.1.0",
         "is-plain-object": "^5.0.0",
+        "launder": "^1.7.1",
         "parse-srcset": "^1.0.2",
         "postcss": "^8.3.11"
       }
@@ -40332,9 +38199,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.2.tgz",
+      "integrity": "sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -40560,6 +38427,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/shimmer": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/shimmer/-/shimmer-1.2.1.tgz",
+      "integrity": "sha512-sQTKC1Re/rM6XyFM6fIAGHRPVGvyXfgzIDvzoq608vM+jeyVD0Tu1E6Np0Kc2zAIFWIj963V2800iF/9LPieQw==",
+      "license": "BSD-2-Clause"
+    },
     "node_modules/side-channel": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
@@ -40782,14 +38655,6 @@
         "source-map": "^0.6.0"
       }
     },
-    "node_modules/sourcemap-codec": {
-      "version": "1.4.8",
-      "resolved": "https://registry.npmjs.org/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
-      "integrity": "sha512-9NykojV5Uih4lgo5So5dtw+f0JgJX30KCNI8gwhz2J9A15wD0Ml6tjHKwf6fTSa6fAdVBdZeNOs9eJ71qCk8vA==",
-      "deprecated": "Please use @jridgewell/sourcemap-codec instead",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/space-separated-tokens": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
@@ -40814,9 +38679,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/sse.js": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/sse.js/-/sse.js-2.5.0.tgz",
-      "integrity": "sha512-I7zYndqOOkNpz9KIdFZ8c8A7zs1YazNewBr8Nsi/tqThfJkVPuP1q7UE2h4B0RwoWZxbBYpd06uoW3NI3SaZXg==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/sse.js/-/sse.js-2.8.0.tgz",
+      "integrity": "sha512-35RyyFYpzzHZgMw9D5GxwADbL6gnntSwW/rKXcuIy1KkYCPjW6oia0moNdNRhs34oVHU1Sjgovj3l7uIEZjrKA==",
       "license": "Apache-2.0"
     },
     "node_modules/stable": {
@@ -41740,6 +39605,15 @@
         }
       }
     },
+    "node_modules/tdigest": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
+      "integrity": "sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==",
+      "license": "MIT",
+      "dependencies": {
+        "bintrees": "1.0.2"
+      }
+    },
     "node_modules/teex": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
@@ -41919,23 +39793,23 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -42077,15 +39951,14 @@
         "node": ">=18"
       }
     },
-    "node_modules/traverse": {
-      "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.6.8.tgz",
-      "integrity": "sha512-aXJDbk6SnumuaZSANd21XAo15ucCDE38H4fkqiGsc3MhCK+wOlZvLP9cB/TvpHT0mOyWgC4Z8EwRlzqYSUzdsA==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+    "node_modules/tree-kill": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/tree-kill/-/tree-kill-1.2.2.tgz",
+      "integrity": "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "tree-kill": "cli.js"
       }
     },
     "node_modules/trim-lines": {
@@ -42121,9 +39994,9 @@
       "license": "MIT"
     },
     "node_modules/ts-api-utils": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.0.1.tgz",
-      "integrity": "sha512-dnlgjFSVetynI8nzgJ+qF62efpglpWRk8isUEWZGWlJYySCTD6aKvbUDu+zbPeDakk3bg5H4XpitHukgfL1m9w==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -42252,106 +40125,22 @@
       "license": "MIT"
     },
     "node_modules/turbo": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.8.12.tgz",
-      "integrity": "sha512-auUAMLmi0eJhxDhQrxzvuhfEbICnVt0CTiYQYY8WyRJ5nwCDZxD0JG8bCSxT4nusI2CwJzmZAay5BfF6LmK7Hw==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.9.17.tgz",
+      "integrity": "sha512-91Q3KxfHJn7esFu2Ic6j9pkvQqWjncQCOp7r1gCKChRSb/+T/yIjsavAmbGLmFRKAzSjmWW/FMrcknmJ4hEOPA==",
       "dev": true,
       "license": "MIT",
       "bin": {
         "turbo": "bin/turbo"
       },
       "optionalDependencies": {
-        "turbo-darwin-64": "2.8.12",
-        "turbo-darwin-arm64": "2.8.12",
-        "turbo-linux-64": "2.8.12",
-        "turbo-linux-arm64": "2.8.12",
-        "turbo-windows-64": "2.8.12",
-        "turbo-windows-arm64": "2.8.12"
-      }
-    },
-    "node_modules/turbo-darwin-64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-darwin-64/-/turbo-darwin-64-2.8.12.tgz",
-      "integrity": "sha512-EiHJmW2MeQQx+21x8hjMHw/uPhXt9PIxvDrxzOtyVwrXzL0tQmsxtO4qHf2l7uA+K6PUJ4+TjY1MHZDuCvWXrw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/turbo-darwin-arm64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-darwin-arm64/-/turbo-darwin-arm64-2.8.12.tgz",
-      "integrity": "sha512-cbqqGN0vd7ly2TeuaM8k9AK9u1CABO4kBA5KPSqovTiLL3sORccn/mZzJSbvQf0EsYRfU34MgW5FotfwW3kx8Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/turbo-linux-64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-linux-64/-/turbo-linux-64-2.8.12.tgz",
-      "integrity": "sha512-jXKw9j4r4q6s0goSXuKI3aKbQK2qiNeP25lGGEnq018TM6SWRW1CCpPMxyG91aCKrub7wDm/K45sGNT4ZFBcFQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/turbo-linux-arm64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-linux-arm64/-/turbo-linux-arm64-2.8.12.tgz",
-      "integrity": "sha512-BRJCMdyXjyBoL0GYpvj9d2WNfMHwc3tKmJG5ATn2Efvil9LsiOsd/93/NxDqW0jACtHFNVOPnd/CBwXRPiRbwA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/turbo-windows-64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-windows-64/-/turbo-windows-64-2.8.12.tgz",
-      "integrity": "sha512-vyFOlpFFzQFkikvSVhVkESEfzIopgs2J7J1rYvtSwSHQ4zmHxkC95Q8Kjkus8gg+8X2mZyP1GS5jirmaypGiPw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/turbo-windows-arm64": {
-      "version": "2.8.12",
-      "resolved": "https://registry.npmjs.org/turbo-windows-arm64/-/turbo-windows-arm64-2.8.12.tgz",
-      "integrity": "sha512-9nRnlw5DF0LkJClkIws1evaIF36dmmMEO84J5Uj4oQ8C0QTHwlH7DNe5Kq2Jdmu8GXESCNDNuUYG8Cx6W/vm3g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+        "@turbo/darwin-64": "2.9.17",
+        "@turbo/darwin-arm64": "2.9.17",
+        "@turbo/linux-64": "2.9.17",
+        "@turbo/linux-arm64": "2.9.17",
+        "@turbo/windows-64": "2.9.17",
+        "@turbo/windows-arm64": "2.9.17"
+      }
     },
     "node_modules/type": {
       "version": "2.7.3",
@@ -42499,10 +40288,11 @@
       "license": "MIT"
     },
     "node_modules/typescript": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.3.tgz",
-      "integrity": "sha512-pXWcraxM0uxAS+tN0AG/BF2TyqmHO014Z070UsJ+pFvYuRSq8KH8DmWpnbXe0pEPDHXZV3FcAbJkijJ5oNEnWw==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
+      "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -42512,15 +40302,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.24.0.tgz",
-      "integrity": "sha512-/lmv4366en/qbB32Vz5+kCNZEMf6xYHwh1z48suBwZvAtnXKbP+YhGe8OLE2BqC67LMqKkCNLtjejdwsdW6uOQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.60.1.tgz",
+      "integrity": "sha512-6m5hkkRAp8lKvhVpcprAIn5KkehQEh+47oHH2VGnExEh7dhNxXlg6GPAOIu6TxbVQxhebrJDvjl3020ooiWCMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.24.0",
-        "@typescript-eslint/parser": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0"
+        "@typescript-eslint/eslint-plugin": "8.60.1",
+        "@typescript-eslint/parser": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -42530,8 +40321,8 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/ua-parser-js": {
@@ -42621,6 +40412,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/unconfig-core": {
+      "version": "7.5.0",
+      "resolved": "https://registry.npmjs.org/unconfig-core/-/unconfig-core-7.5.0.tgz",
+      "integrity": "sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@quansync/fs": "^1.0.0",
+        "quansync": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/undefsafe": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",
@@ -42634,18 +40439,19 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "7.24.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.1.tgz",
-      "integrity": "sha512-5xoBibbmnjlcR3jdqtY2Lnx7WbrD/tHlT01TmvqZUFVc9Q1w4+j5hbnapTqbcXITMH1ovjq/W7BkqBilHiVAaA==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "license": "MIT"
     },
     "node_modules/unicode-canonical-property-names-ecmascript": {
       "version": "2.0.1",
@@ -43286,10 +41092,88 @@
         "node": ">=4"
       }
     },
+    "node_modules/vite": {
+      "version": "8.0.16",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
+      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.32.0",
+        "picomatch": "^4.0.4",
+        "postcss": "^8.5.15",
+        "rolldown": "1.0.3",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.1.18",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/vite-plugin-compression2": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/vite-plugin-compression2/-/vite-plugin-compression2-2.2.1.tgz",
-      "integrity": "sha512-LMDkgheJaFBmb8cB8ymgUpXHXnd3m4kmjEInvp59fOZMSaT/9oDUtqpO0ihr4ExGsnWfYcRe13/TNN3BEk2t/g==",
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/vite-plugin-compression2/-/vite-plugin-compression2-2.5.3.tgz",
+      "integrity": "sha512-ItPgqQWkcnBbVw7is9OKwiZ8v6+ju9rYROl5Lp6QfQDEx/d55AwJQb/KLpsQqsU9HoigYBsZ8tK6I02UwJNvEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -43297,6 +41181,67 @@
         "tar-mini": "^0.2.0"
       }
     },
+    "node_modules/vite-plugin-node-polyfills": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/vite-plugin-node-polyfills/-/vite-plugin-node-polyfills-0.28.0.tgz",
+      "integrity": "sha512-NXct/ci2ef4fRyCfTb8fk2HmR80Rv7icLd+cRH41TnUugDzdKMFKqFPpZYCFUInZMMem9bkLv5pkq02+7Xu7+w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/plugin-inject": "^5.0.5",
+        "node-stdlib-browser": "^1.3.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/davidmyersdev"
+      },
+      "peerDependencies": {
+        "vite": "^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/vite-plugin-pwa": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/vite-plugin-pwa/-/vite-plugin-pwa-1.3.0.tgz",
+      "integrity": "sha512-c5kMgN+ITrOtHXp8PAtk2uOIEea6XjP/unCGxOWWBzQ6qa65qj/awHg0wf+QF9E/2u9vh86LqxPwzEPNbM2r5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.3.6",
+        "pretty-bytes": "^6.1.1",
+        "tinyglobby": "^0.2.10",
+        "workbox-build": "^7.4.1",
+        "workbox-window": "^7.4.1"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "@vite-pwa/assets-generator": "^1.0.0",
+        "vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0",
+        "workbox-build": "^7.4.1",
+        "workbox-window": "^7.4.1"
+      },
+      "peerDependenciesMeta": {
+        "@vite-pwa/assets-generator": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/vm-browserify": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vm-browserify/-/vm-browserify-1.1.2.tgz",
@@ -43358,6 +41303,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/web-vitals": {
+      "version": "3.5.2",
+      "resolved": "https://registry.npmjs.org/web-vitals/-/web-vitals-3.5.2.tgz",
+      "integrity": "sha512-c0rhqNcHXRkY/ogGDJQxZ9Im9D19hDihbzSQJrsioex+KnFgmMzBiy57Z1EjkhX/+OjyBpclDCzz2ITtjokFmg==",
+      "license": "Apache-2.0"
+    },
     "node_modules/webidl-conversions": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
@@ -43581,30 +41532,30 @@
       "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q=="
     },
     "node_modules/workbox-background-sync": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-background-sync/-/workbox-background-sync-7.4.0.tgz",
-      "integrity": "sha512-8CB9OxKAgKZKyNMwfGZ1XESx89GryWTfI+V5yEj8sHjFH8MFelUwYXEyldEK6M6oKMmn807GoJFUEA1sC4XS9w==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-background-sync/-/workbox-background-sync-7.4.1.tgz",
+      "integrity": "sha512-HhT7KE8tOWDm02wRNshXUnUPofMlhenF2DBdUnDPOubhizzPeItkYTmAB6td1Z2cjYPa98vzEiPLEuzn5hN66g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "idb": "^7.0.1",
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-broadcast-update": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-broadcast-update/-/workbox-broadcast-update-7.4.0.tgz",
-      "integrity": "sha512-+eZQwoktlvo62cI0b+QBr40v5XjighxPq3Fzo9AWMiAosmpG5gxRHgTbGGhaJv/q/MFVxwFNGh/UwHZ/8K88lA==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-broadcast-update/-/workbox-broadcast-update-7.4.1.tgz",
+      "integrity": "sha512-uAlgslKLvbQY+suirIdnBCSYrcgBhjp81Nj4l1lj/Jmj0MJO2CJERnCJjT0GFVwmReV0N+zs78K6gqd5gr9/+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-build": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-build/-/workbox-build-7.4.0.tgz",
-      "integrity": "sha512-Ntk1pWb0caOFIvwz/hfgrov/OJ45wPEhI5PbTywQcYjyZiVhT3UrwwUPl6TRYbTm4moaFYithYnl1lvZ8UjxcA==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-build/-/workbox-build-7.4.1.tgz",
+      "integrity": "sha512-SDhxIvEAde9Gy/5w4Yo1Jh/M49Z0qE3q0oteyE8zGq0DScxFqVBcCtIXFuLtmtxRQZCMbf0prco4VyEu3KBQuw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -43612,39 +41563,39 @@
         "@babel/core": "^7.24.4",
         "@babel/preset-env": "^7.11.0",
         "@babel/runtime": "^7.11.2",
-        "@rollup/plugin-babel": "^5.2.0",
-        "@rollup/plugin-node-resolve": "^15.2.3",
-        "@rollup/plugin-replace": "^2.4.1",
-        "@rollup/plugin-terser": "^0.4.3",
-        "@surma/rollup-plugin-off-main-thread": "^2.2.3",
+        "@rollup/plugin-babel": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^16.0.3",
+        "@rollup/plugin-replace": "^6.0.3",
+        "@rollup/plugin-terser": "^1.0.0",
+        "@trickfilm400/rollup-plugin-off-main-thread": "^3.0.0-pre1",
         "ajv": "^8.6.0",
         "common-tags": "^1.8.0",
+        "eta": "^4.5.1",
         "fast-json-stable-stringify": "^2.1.0",
         "fs-extra": "^9.0.1",
         "glob": "^11.0.1",
-        "lodash": "^4.17.20",
         "pretty-bytes": "^5.3.0",
-        "rollup": "^2.79.2",
+        "rollup": "^4.53.3",
         "source-map": "^0.8.0-beta.0",
         "stringify-object": "^3.3.0",
         "strip-comments": "^2.0.1",
         "tempy": "^0.6.0",
         "upath": "^1.2.0",
-        "workbox-background-sync": "7.4.0",
-        "workbox-broadcast-update": "7.4.0",
-        "workbox-cacheable-response": "7.4.0",
-        "workbox-core": "7.4.0",
-        "workbox-expiration": "7.4.0",
-        "workbox-google-analytics": "7.4.0",
-        "workbox-navigation-preload": "7.4.0",
-        "workbox-precaching": "7.4.0",
-        "workbox-range-requests": "7.4.0",
-        "workbox-recipes": "7.4.0",
-        "workbox-routing": "7.4.0",
-        "workbox-strategies": "7.4.0",
-        "workbox-streams": "7.4.0",
-        "workbox-sw": "7.4.0",
-        "workbox-window": "7.4.0"
+        "workbox-background-sync": "7.4.1",
+        "workbox-broadcast-update": "7.4.1",
+        "workbox-cacheable-response": "7.4.1",
+        "workbox-core": "7.4.1",
+        "workbox-expiration": "7.4.1",
+        "workbox-google-analytics": "7.4.1",
+        "workbox-navigation-preload": "7.4.1",
+        "workbox-precaching": "7.4.1",
+        "workbox-range-requests": "7.4.1",
+        "workbox-recipes": "7.4.1",
+        "workbox-routing": "7.4.1",
+        "workbox-strategies": "7.4.1",
+        "workbox-streams": "7.4.1",
+        "workbox-sw": "7.4.1",
+        "workbox-window": "7.4.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -43660,69 +41611,53 @@
         "node": ">=18"
       }
     },
-    "node_modules/workbox-build/node_modules/@rollup/plugin-babel": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-5.3.1.tgz",
-      "integrity": "sha512-WFfdLWU/xVWKeRQnKmIAQULUI7Il0gZnBIH/ZFO069wYIfPu+8zrfp/KMW0atmELoRDq8FbiP3VCss9MhCut7Q==",
+    "node_modules/workbox-build/node_modules/@rollup/plugin-node-resolve": {
+      "version": "16.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
+      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.10.4",
-        "@rollup/pluginutils": "^3.1.0"
+        "@rollup/pluginutils": "^5.0.1",
+        "@types/resolve": "1.20.2",
+        "deepmerge": "^4.2.2",
+        "is-module": "^1.0.0",
+        "resolve": "^1.22.1"
       },
       "engines": {
-        "node": ">= 10.0.0"
+        "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "@babel/core": "^7.0.0",
-        "@types/babel__core": "^7.1.9",
-        "rollup": "^1.20.0||^2.0.0"
+        "rollup": "^2.78.0||^3.0.0||^4.0.0"
       },
       "peerDependenciesMeta": {
-        "@types/babel__core": {
+        "rollup": {
           "optional": true
         }
       }
     },
     "node_modules/workbox-build/node_modules/@rollup/plugin-replace": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-2.4.2.tgz",
-      "integrity": "sha512-IGcu+cydlUMZ5En85jxHH4qj2hta/11BHq95iHEyb2sbgiN0eCdzvUcHw5gt9pBL5lTi4JDYJ1acCoMGpTvEZg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@rollup/pluginutils": "^3.1.0",
-        "magic-string": "^0.25.7"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0 || ^2.0.0"
-      }
-    },
-    "node_modules/workbox-build/node_modules/@rollup/pluginutils": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-3.1.0.tgz",
-      "integrity": "sha512-GksZ6pr6TpIjHm8h9lSQ8pi8BE9VeubNT0OMJ3B5uZJ8pz73NPiqOtCog/x2/QzM1ENChPKxMDhiQuRHsqc+lg==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-6.0.3.tgz",
+      "integrity": "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "0.0.39",
-        "estree-walker": "^1.0.1",
-        "picomatch": "^2.2.2"
+        "@rollup/pluginutils": "^5.0.1",
+        "magic-string": "^0.30.3"
       },
       "engines": {
-        "node": ">= 8.0.0"
+        "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0"
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
       }
     },
-    "node_modules/workbox-build/node_modules/@types/estree": {
-      "version": "0.0.39",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.39.tgz",
-      "integrity": "sha512-EYNwp3bU+98cpU4lAWYYL7Zz+2gryWH1qbdDTidVd6hkiR6weksdbMadyXKXNPEkQFhXM+hVO9ZygomHXp+AIw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/workbox-build/node_modules/balanced-match": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
@@ -43734,9 +41669,9 @@
       }
     },
     "node_modules/workbox-build/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -43746,30 +41681,6 @@
         "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/workbox-build/node_modules/estree-walker": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-1.0.1.tgz",
-      "integrity": "sha512-1fMXF3YP4pZZVozF8j/ZLfvnR8NSIljt56UhbZ5PeeDmmGHpgpdwQt7ITlGvYaQukCvuBRMLEiKiYC+oeIg4cg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/workbox-build/node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/workbox-build/node_modules/fs-extra": {
       "version": "9.1.0",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
@@ -43828,33 +41739,23 @@
       }
     },
     "node_modules/workbox-build/node_modules/lru-cache": {
-      "version": "11.2.6",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
-      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
       }
     },
-    "node_modules/workbox-build/node_modules/magic-string": {
-      "version": "0.25.9",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.9.tgz",
-      "integrity": "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sourcemap-codec": "^1.4.8"
-      }
-    },
     "node_modules/workbox-build/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -43893,35 +41794,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/workbox-build/node_modules/rollup": {
-      "version": "2.80.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.80.0.tgz",
-      "integrity": "sha512-cIFJOD1DESzpjOBl763Kp1AH7UE/0fcdHe6rZXUdQ9c50uvgigvW97u3IcSeBwOkgqL/PXPBktBCh0KEu5L8XQ==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "rollup": "dist/bin/rollup"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.2"
-      }
-    },
-    "node_modules/workbox-build/node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/workbox-build/node_modules/source-map": {
       "version": "0.8.0-beta.0",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.8.0-beta.0.tgz",
@@ -43966,140 +41838,140 @@
       }
     },
     "node_modules/workbox-cacheable-response": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-cacheable-response/-/workbox-cacheable-response-7.4.0.tgz",
-      "integrity": "sha512-0Fb8795zg/x23ISFkAc7lbWes6vbw34DGFIMw31cwuHPgDEC/5EYm6m/ZkylLX0EnEbbOyOCLjKgFS/Z5g0HeQ==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-cacheable-response/-/workbox-cacheable-response-7.4.1.tgz",
+      "integrity": "sha512-8xaFoJdDc2OjrlbbL3gEeBO1WKcMwRqwLRupgqahYXu75yXajPLuwrbXMrIGZuWYXrQwk0xDjOxZ/ujCy/oJYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-core": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-core/-/workbox-core-7.4.0.tgz",
-      "integrity": "sha512-6BMfd8tYEnN4baG4emG9U0hdXM4gGuDU3ectXuVHnj71vwxTFI7WOpQJC4siTOlVtGqCUtj0ZQNsrvi6kZZTAQ==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-core/-/workbox-core-7.4.1.tgz",
+      "integrity": "sha512-DT+vu46eh/2vRsSHTY4Xmc32Z1rr9PRlQUXr1Dx30ZuXRWwOsvZgGgcwxcasubQLQmbTNYZjv44LkBAQ4tT5tQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/workbox-expiration": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-expiration/-/workbox-expiration-7.4.0.tgz",
-      "integrity": "sha512-V50p4BxYhtA80eOvulu8xVfPBgZbkxJ1Jr8UUn0rvqjGhLDqKNtfrDfjJKnLz2U8fO2xGQJTx/SKXNTzHOjnHw==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-expiration/-/workbox-expiration-7.4.1.tgz",
+      "integrity": "sha512-lRKUF7b+OGbeXkQk1s6MHXOa3d7Xxf7Of31W6c6hCfipfIyrtdWZ89stq21AHZMaoG7VNFoHply4Ox+rU31TWg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "idb": "^7.0.1",
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-google-analytics": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-google-analytics/-/workbox-google-analytics-7.4.0.tgz",
-      "integrity": "sha512-MVPXQslRF6YHkzGoFw1A4GIB8GrKym/A5+jYDUSL+AeJw4ytQGrozYdiZqUW1TPQHW8isBCBtyFJergUXyNoWQ==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-google-analytics/-/workbox-google-analytics-7.4.1.tgz",
+      "integrity": "sha512-Mks1JwLEt++ZAkF6sS1OpSh9RtAMIsiDgRpK+codiHGIPXeaUOgi4cPc3GFadUl8V5QPeypEk8Oxgl3HlwVzHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-background-sync": "7.4.0",
-        "workbox-core": "7.4.0",
-        "workbox-routing": "7.4.0",
-        "workbox-strategies": "7.4.0"
+        "workbox-background-sync": "7.4.1",
+        "workbox-core": "7.4.1",
+        "workbox-routing": "7.4.1",
+        "workbox-strategies": "7.4.1"
       }
     },
     "node_modules/workbox-navigation-preload": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-navigation-preload/-/workbox-navigation-preload-7.4.0.tgz",
-      "integrity": "sha512-etzftSgdQfjMcfPgbfaZCfM2QuR1P+4o8uCA2s4rf3chtKTq/Om7g/qvEOcZkG6v7JZOSOxVYQiOu6PbAZgU6w==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-navigation-preload/-/workbox-navigation-preload-7.4.1.tgz",
+      "integrity": "sha512-C4KVsjPcYKJOhr631AxR9XoG2rLF3QiTk5aMv36MXOjtWvm8axwNFAtKUPGsWUwLXXAMgYM1En7fsvndaXeXRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-precaching": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-precaching/-/workbox-precaching-7.4.0.tgz",
-      "integrity": "sha512-VQs37T6jDqf1rTxUJZXRl3yjZMf5JX/vDPhmx2CPgDDKXATzEoqyRqhYnRoxl6Kr0rqaQlp32i9rtG5zTzIlNg==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-precaching/-/workbox-precaching-7.4.1.tgz",
+      "integrity": "sha512-cdr/9qByww7yzEp7zg/qI4ukUrrNjQLgN+ONQRpjy/VqGQXwkgHwr00KksGJK8v0VifwDXBb8a4cWNZH71jn3Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0",
-        "workbox-routing": "7.4.0",
-        "workbox-strategies": "7.4.0"
+        "workbox-core": "7.4.1",
+        "workbox-routing": "7.4.1",
+        "workbox-strategies": "7.4.1"
       }
     },
     "node_modules/workbox-range-requests": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-range-requests/-/workbox-range-requests-7.4.0.tgz",
-      "integrity": "sha512-3Vq854ZNuP6Y0KZOQWLaLC9FfM7ZaE+iuQl4VhADXybwzr4z/sMmnLgTeUZLq5PaDlcJBxYXQ3U91V7dwAIfvw==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-range-requests/-/workbox-range-requests-7.4.1.tgz",
+      "integrity": "sha512-7i2oxAUE82gHdAJBCAQ04JzNOdRPqzuOzGfoUyJpFSmeqBNYGPrAH8GPoPjUQTfp+NycwrD2H68VtuF8qxv0vQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-recipes": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-recipes/-/workbox-recipes-7.4.0.tgz",
-      "integrity": "sha512-kOkWvsAn4H8GvAkwfJTbwINdv4voFoiE9hbezgB1sb/0NLyTG4rE7l6LvS8lLk5QIRIto+DjXLuAuG3Vmt3cxQ==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-recipes/-/workbox-recipes-7.4.1.tgz",
+      "integrity": "sha512-gnbVfmV4/TtmQaM4x9AtuXhcdstJsep3XMVeztOrQVPT+R6+6DeBjGTCQ7fFCXm+4GEHUA5VEBTyi5+4gWGeog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-cacheable-response": "7.4.0",
-        "workbox-core": "7.4.0",
-        "workbox-expiration": "7.4.0",
-        "workbox-precaching": "7.4.0",
-        "workbox-routing": "7.4.0",
-        "workbox-strategies": "7.4.0"
+        "workbox-cacheable-response": "7.4.1",
+        "workbox-core": "7.4.1",
+        "workbox-expiration": "7.4.1",
+        "workbox-precaching": "7.4.1",
+        "workbox-routing": "7.4.1",
+        "workbox-strategies": "7.4.1"
       }
     },
     "node_modules/workbox-routing": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-routing/-/workbox-routing-7.4.0.tgz",
-      "integrity": "sha512-C/ooj5uBWYAhAqwmU8HYQJdOjjDKBp9MzTQ+otpMmd+q0eF59K+NuXUek34wbL0RFrIXe/KKT+tUWcZcBqxbHQ==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-routing/-/workbox-routing-7.4.1.tgz",
+      "integrity": "sha512-yubJGErZOusuidAenaL5ypfhQOa7urxP/f8E0ws7FPb4039RiWXUWBAyUkmUoOL/BcQGen3h0J8872d51IYxtA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-strategies": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-strategies/-/workbox-strategies-7.4.0.tgz",
-      "integrity": "sha512-T4hVqIi5A4mHi92+5EppMX3cLaVywDp8nsyUgJhOZxcfSV/eQofcOA6/EMo5rnTNmNTpw0rUgjAI6LaVullPpg==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-strategies/-/workbox-strategies-7.4.1.tgz",
+      "integrity": "sha512-GZxpaw9NbmOelj7667uZ2kpk5BFpOGbO4X0qjwh5ls8XQ8C+Lha5LQchTiUzsTFSS+NlUpftYAyOVXvQUrcqOQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/workbox-streams": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-streams/-/workbox-streams-7.4.0.tgz",
-      "integrity": "sha512-QHPBQrey7hQbnTs5GrEVoWz7RhHJXnPT+12qqWM378orDMo5VMJLCkCM1cnCk+8Eq92lccx/VgRZ7WAzZWbSLg==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-streams/-/workbox-streams-7.4.1.tgz",
+      "integrity": "sha512-HWWtraKUbJknd9kgqGcpQ3G114HOPYvqs8HaJMDs2ebLNAimDkVDaWfAXE6Ybl+m8U6KsCE6pWyLYuigWmnAXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "workbox-core": "7.4.0",
-        "workbox-routing": "7.4.0"
+        "workbox-core": "7.4.1",
+        "workbox-routing": "7.4.1"
       }
     },
     "node_modules/workbox-sw": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-sw/-/workbox-sw-7.4.0.tgz",
-      "integrity": "sha512-ltU+Kr3qWR6BtbdlMnCjobZKzeV1hN+S6UvDywBrwM19TTyqA03X66dzw1tEIdJvQ4lYKkBFox6IAEhoSEZ8Xw==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-sw/-/workbox-sw-7.4.1.tgz",
+      "integrity": "sha512-fez5f2DUlDJWTFYkCWQpY10N8gtztd849NswCbVFk0QlcSM4HT5A8x4g4ii650yem4I8tHY0R7JZahwp3ltIPw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/workbox-window": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/workbox-window/-/workbox-window-7.4.0.tgz",
-      "integrity": "sha512-/bIYdBLAVsNR3v7gYGaV4pQW3M3kEPx5E8vDxGvxo6khTrGtSSCS7QiFKv9ogzBgZiy0OXLP9zO28U/1nF1mfw==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/workbox-window/-/workbox-window-7.4.1.tgz",
+      "integrity": "sha512-notZDH2u8VXaqyuD7xaqIfEFi6SRM4SUSd7ewe9PDsVqADuepxX2ZMY3uvuZGxzY5ZOsGC/vD3A/3smFtJt4/A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/trusted-types": "^2.0.2",
-        "workbox-core": "7.4.0"
+        "workbox-core": "7.4.1"
       }
     },
     "node_modules/wrap-ansi": {
@@ -44230,9 +42102,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -44471,162 +42343,595 @@
         "pend": "~1.2.0"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=12"
+      }
+    },
+    "node_modules/yn": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
+      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
+      "devOptional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/zod": {
+      "version": "3.25.67",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.67.tgz",
+      "integrity": "sha512-idA2YXwpCdqUSKRCACDE6ItZD9TZzy3OZMtpfLoh6oPR47lipysRrJfjzMqFxQ3uJuUPyUeWe1r9vLH33xO/Qw==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/zod-to-json-schema": {
+      "version": "3.25.1",
+      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.1.tgz",
+      "integrity": "sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA==",
+      "license": "ISC",
+      "peerDependencies": {
+        "zod": "^3.25 || ^4"
+      }
+    },
+    "node_modules/zone.js": {
+      "version": "0.16.2",
+      "resolved": "https://registry.npmjs.org/zone.js/-/zone.js-0.16.2.tgz",
+      "integrity": "sha512-Eky7p2Z1Ig3NnbfodSPoARCjKBSTFMnE/ACsP1L/XJEfY4SdOFce19BsUCWVwL6K5ABZFy5J3bjcMWffX+YM3Q==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/zwitch": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
+      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "packages/api": {
+      "name": "@librechat/api",
+      "version": "1.7.34",
+      "license": "ISC",
+      "devDependencies": {
+        "@babel/preset-env": "^7.29.5",
+        "@babel/preset-react": "^7.18.6",
+        "@babel/preset-typescript": "^7.21.0",
+        "@rollup/plugin-alias": "^5.1.0",
+        "@rollup/plugin-commonjs": "^29.0.0",
+        "@rollup/plugin-json": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^15.1.0",
+        "@rollup/plugin-replace": "^5.0.5",
+        "@rollup/plugin-typescript": "^12.1.2",
+        "@types/bun": "^1.2.15",
+        "@types/express": "^5.0.0",
+        "@types/express-session": "^1.18.2",
+        "@types/jest": "^29.5.2",
+        "@types/jsonwebtoken": "^9.0.0",
+        "@types/multer": "^1.4.13",
+        "@types/node": "^24.12.4",
+        "@types/node-fetch": "^2.6.13",
+        "@types/react": "^18.2.18",
+        "@types/sanitize-html": "^2.13.0",
+        "@types/supertest": "^7.2.0",
+        "@types/winston": "^2.4.4",
+        "@types/yauzl": "^2.10.3",
+        "aws-sdk-client-mock": "^4.1.0",
+        "dedent": "^1.5.3",
+        "get-stream": "^6.0.1",
+        "jest": "^30.2.0",
+        "jest-junit": "^17.0.0",
+        "jszip": "^3.10.1",
+        "librechat-data-provider": "*",
+        "lodash": "^4.17.23",
+        "mammoth": "^1.11.0",
+        "mongodb": "^6.14.2",
+        "nanoid": "^3.3.7",
+        "pdfjs-dist": "^5.4.624",
+        "rimraf": "^6.1.3",
+        "rollup": "^4.34.9",
+        "rollup-plugin-peer-deps-external": "^2.2.4",
+        "sanitize-html": "^2.13.0",
+        "ts-node": "^10.9.2",
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3",
+        "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
+        "yauzl": "^3.2.1"
+      },
+      "peerDependencies": {
+        "@anthropic-ai/vertex-sdk": "^0.16.0",
+        "@aws-sdk/client-bedrock-runtime": "^3.1013.0",
+        "@aws-sdk/client-cloudfront": "^3.1042.0",
+        "@aws-sdk/client-s3": "^3.980.0",
+        "@aws-sdk/cloudfront-signer": "^3.1036.0",
+        "@aws-sdk/credential-providers": "^3.1045.0",
+        "@aws-sdk/s3-request-presigner": "^3.758.0",
+        "@azure/identity": "^4.13.1",
+        "@azure/search-documents": "^12.0.0",
+        "@azure/storage-blob": "^12.30.0",
+        "@google/genai": "^2.8.0",
+        "@keyv/redis": "^4.3.3",
+        "@librechat/agents": "^3.2.46",
+        "@librechat/data-schemas": "*",
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/instrumentation-express": "^0.56.0",
+        "@opentelemetry/instrumentation-http": "^0.207.0",
+        "@opentelemetry/instrumentation-ioredis": "^0.55.0",
+        "@opentelemetry/instrumentation-mongodb": "^0.60.0",
+        "@opentelemetry/instrumentation-mongoose": "^0.54.0",
+        "@opentelemetry/instrumentation-undici": "^0.18.0",
+        "@opentelemetry/resources": "^2.6.1",
+        "@opentelemetry/sdk-node": "^0.218.0",
+        "@opentelemetry/semantic-conventions": "^1.39.0",
+        "@smithy/node-http-handler": "^4.4.5",
+        "ai-tokenizer": "^1.0.6",
+        "axios": "^1.16.0",
+        "connect-redis": "^8.1.0",
+        "dedent": "^1.5.3",
+        "eventsource": "^3.0.2",
+        "express": "^5.1.0",
+        "express-session": "^1.18.2",
+        "firebase": "^11.0.2",
+        "form-data": "^4.0.4",
+        "get-stream": "^6.0.1",
+        "google-auth-library": "^9.15.1",
+        "https-proxy-agent": "^7.0.6",
+        "ioredis": "^5.3.2",
+        "js-yaml": "^4.2.0",
+        "jsonwebtoken": "^9.0.0",
+        "jszip": "^3.10.1",
+        "jwks-rsa": "^3.2.0",
+        "keyv": "^5.3.2",
+        "keyv-file": "^5.1.2",
+        "librechat-data-provider": "*",
+        "lodash": "^4.17.23",
+        "mammoth": "^1.11.0",
+        "mathjs": "^15.2.0",
+        "memorystore": "^1.6.7",
+        "mongodb": "^6.14.2",
+        "mongoose": "^8.23.1",
+        "nanoid": "^3.3.7",
+        "node-fetch": "2.7.0",
+        "pdfjs-dist": "^5.4.624",
+        "prom-client": "^15.1.3",
+        "rate-limit-redis": "^4.2.0",
+        "sanitize-html": "^2.13.0",
+        "sharp": "^0.33.5",
+        "undici": "^7.24.1",
+        "yauzl": "^3.2.1",
+        "zod": "^3.22.4"
+      }
+    },
+    "packages/api/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@keyv/redis": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/@keyv/redis/-/redis-4.6.0.tgz",
+      "integrity": "sha512-FP3FP42RiQ3j0UC6f4Maf7ISTLAIivm37/SdfG5xvhqceMMq3kabtC6T4a2h5byMnh4S8PjP51DY/9CpyrcfsQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@redis/client": "^1.6.0",
+        "cluster-key-slot": "^1.1.2",
+        "hookified": "^1.10.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "keyv": "^5.3.4"
+      }
+    },
+    "packages/api/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/api/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/yn": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
-      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
-      "devOptional": true,
+    "packages/api/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=6"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/yocto-queue": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+    "packages/api/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/zod": {
-      "version": "3.25.67",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.67.tgz",
-      "integrity": "sha512-idA2YXwpCdqUSKRCACDE6ItZD9TZzy3OZMtpfLoh6oPR47lipysRrJfjzMqFxQ3uJuUPyUeWe1r9vLH33xO/Qw==",
+    "packages/api/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
-    "node_modules/zod-to-json-schema": {
-      "version": "3.25.1",
-      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.1.tgz",
-      "integrity": "sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA==",
-      "license": "ISC",
-      "peerDependencies": {
-        "zod": "^3.25 || ^4"
-      }
-    },
-    "node_modules/zwitch": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
-      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "packages/api": {
-      "name": "@librechat/api",
-      "version": "1.7.30",
-      "license": "ISC",
-      "devDependencies": {
-        "@babel/preset-env": "^7.29.5",
-        "@babel/preset-react": "^7.18.6",
-        "@babel/preset-typescript": "^7.21.0",
-        "@rollup/plugin-alias": "^5.1.0",
-        "@rollup/plugin-commonjs": "^29.0.0",
-        "@rollup/plugin-json": "^6.1.0",
-        "@rollup/plugin-node-resolve": "^15.1.0",
-        "@rollup/plugin-replace": "^5.0.5",
-        "@rollup/plugin-typescript": "^12.1.2",
-        "@types/bun": "^1.2.15",
-        "@types/express": "^5.0.0",
-        "@types/express-session": "^1.18.2",
-        "@types/jest": "^29.5.2",
-        "@types/jsonwebtoken": "^9.0.0",
-        "@types/multer": "^1.4.13",
-        "@types/node": "^20.3.0",
-        "@types/node-fetch": "^2.6.13",
-        "@types/react": "^18.2.18",
-        "@types/sanitize-html": "^2.13.0",
-        "@types/winston": "^2.4.4",
-        "@types/yauzl": "^2.10.3",
-        "aws-sdk-client-mock": "^4.1.0",
-        "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
-        "jszip": "^3.10.1",
-        "librechat-data-provider": "*",
-        "mammoth": "^1.11.0",
-        "mongodb": "^6.14.2",
-        "pdfjs-dist": "^5.4.624",
-        "rimraf": "^6.1.3",
-        "rollup": "^4.34.9",
-        "rollup-plugin-peer-deps-external": "^2.2.4",
-        "sanitize-html": "^2.13.0",
-        "ts-node": "^10.9.2",
-        "typescript": "^5.0.4",
-        "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
-        "yauzl": "^3.2.1"
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
       },
-      "peerDependencies": {
-        "@anthropic-ai/vertex-sdk": "^0.16.0",
-        "@aws-sdk/client-bedrock-runtime": "^3.1013.0",
-        "@aws-sdk/client-cloudfront": "^3.1042.0",
-        "@aws-sdk/client-s3": "^3.980.0",
-        "@aws-sdk/cloudfront-signer": "^3.1036.0",
-        "@azure/identity": "^4.13.1",
-        "@azure/search-documents": "^12.0.0",
-        "@azure/storage-blob": "^12.30.0",
-        "@google/genai": "^2.0.1",
-        "@keyv/redis": "^4.3.3",
-        "@librechat/agents": "^3.1.86",
-        "@librechat/data-schemas": "*",
-        "@modelcontextprotocol/sdk": "^1.29.0",
-        "@smithy/node-http-handler": "^4.4.5",
-        "ai-tokenizer": "^1.0.6",
-        "axios": "^1.16.0",
-        "connect-redis": "^8.1.0",
-        "eventsource": "^3.0.2",
-        "express": "^5.1.0",
-        "express-session": "^1.18.2",
-        "firebase": "^11.0.2",
-        "form-data": "^4.0.4",
-        "google-auth-library": "^9.15.1",
-        "https-proxy-agent": "^7.0.6",
-        "ioredis": "^5.3.2",
-        "js-yaml": "^4.1.1",
-        "jsonwebtoken": "^9.0.0",
-        "jwks-rsa": "^3.2.0",
-        "keyv": "^5.3.2",
-        "keyv-file": "^5.1.2",
-        "librechat-data-provider": "*",
-        "mammoth": "^1.11.0",
-        "mathjs": "^15.2.0",
-        "memorystore": "^1.6.7",
-        "mongoose": "^8.23.1",
-        "node-fetch": "2.7.0",
-        "pdfjs-dist": "^5.4.624",
-        "rate-limit-redis": "^4.2.0",
-        "sanitize-html": "^2.13.0",
-        "sharp": "^0.33.5",
-        "undici": "^7.24.1",
-        "yauzl": "^3.2.1",
-        "zod": "^3.22.4"
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "packages/api/node_modules/@keyv/redis": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/@keyv/redis/-/redis-4.6.0.tgz",
-      "integrity": "sha512-FP3FP42RiQ3j0UC6f4Maf7ISTLAIivm37/SdfG5xvhqceMMq3kabtC6T4a2h5byMnh4S8PjP51DY/9CpyrcfsQ==",
+    "packages/api/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@redis/client": "^1.6.0",
-        "cluster-key-slot": "^1.1.2",
-        "hookified": "^1.10.0"
-      },
       "engines": {
-        "node": ">= 18"
+        "node": ">=12"
       },
-      "peerDependencies": {
-        "keyv": "^5.3.4"
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
     "packages/api/node_modules/rimraf": {
@@ -44649,9 +42954,160 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "packages/api/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/api/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/api/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
     "packages/client": {
       "name": "@librechat/client",
-      "version": "0.4.59",
+      "version": "0.4.63",
       "devDependencies": {
         "@babel/core": "^7.28.5",
         "@babel/preset-env": "^7.29.5",
@@ -44666,6 +43122,7 @@
         "@tanstack/react-virtual": "^3.13.13",
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^14.0.0",
+        "@tsdown/css": "^0.22.2",
         "@types/jest": "^29.5.14",
         "@types/react": "^18.2.11",
         "@types/react-dom": "^18.2.4",
@@ -44688,11 +43145,12 @@
         "rollup-plugin-postcss": "^4.0.2",
         "rollup-plugin-typescript2": "^0.37.0",
         "tailwindcss-radix": "^2.8.0",
-        "typescript": "^5.0.0"
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
       },
       "peerDependencies": {
-        "@ariakit/react": "^0.4.16",
-        "@ariakit/react-core": "^0.4.17",
+        "@ariakit/react": "^0.4.29",
+        "@ariakit/react-core": "^0.4.26",
         "@dicebear/collection": "^9.4.1",
         "@dicebear/core": "^9.4.1",
         "@headlessui/react": "^2.1.2",
@@ -44721,7 +43179,7 @@
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "dompurify": "^3.4.0",
-        "framer-motion": "^12.23.6",
+        "framer-motion": "^12.40.0",
         "i18next": "^24.2.2 || ^25.3.2",
         "i18next-browser-languagedetector": "^8.2.0",
         "input-otp": "^1.4.2",
@@ -44746,6 +43204,88 @@
       "dev": true,
       "license": "MIT"
     },
+    "packages/client/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/generator/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/parser/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
     "packages/client/node_modules/@babel/plugin-transform-react-display-name": {
       "version": "7.28.0",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.28.0.tgz",
@@ -44836,6 +43376,310 @@
         "@babel/core": "^7.0.0-0"
       }
     },
+    "packages/client/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/client/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
     "packages/client/node_modules/@tanstack/react-table": {
       "version": "8.21.3",
       "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-8.21.3.tgz",
@@ -44976,6 +43820,49 @@
         }
       }
     },
+    "packages/client/node_modules/@tsdown/css": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/@tsdown/css/-/css-0.22.2.tgz",
+      "integrity": "sha512-Go3Im9TaQnoX68vfU8Jv0OVzlxAkbKcAhTHBSkO0oC3ULClKcKETFqF4GN3P5Tcsu43NlyzOnob5po5zKSFNCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.32.0",
+        "postcss-load-config": "^6.0.1",
+        "rolldown": "~1.1.0"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.0",
+        "postcss-import": "^16.0.0",
+        "postcss-modules": "^6.0.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "tsdown": "0.22.2"
+      },
+      "peerDependenciesMeta": {
+        "postcss": {
+          "optional": true
+        },
+        "postcss-import": {
+          "optional": true
+        },
+        "postcss-modules": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        }
+      }
+    },
     "packages/client/node_modules/@types/jest": {
       "version": "29.5.14",
       "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
@@ -45032,6 +43919,22 @@
         "dequal": "^2.0.3"
       }
     },
+    "packages/client/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
     "packages/client/node_modules/i18next": {
       "version": "24.2.3",
       "resolved": "https://registry.npmjs.org/i18next/-/i18next-24.2.3.tgz",
@@ -45064,48 +43967,725 @@
         }
       }
     },
-    "packages/client/node_modules/pretty-format": {
-      "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
-      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+    "packages/client/node_modules/lilconfig": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antonk52"
+      }
+    },
+    "packages/client/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "packages/client/node_modules/postcss-load-config": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz",
+      "integrity": "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "lilconfig": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "jiti": ">=1.21.0",
+        "postcss": ">=8.0.9",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        },
+        "postcss": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "packages/client/node_modules/pretty-format": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
+      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1",
+        "ansi-styles": "^5.0.0",
+        "react-is": "^17.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "packages/client/node_modules/react-hook-form": {
+      "version": "7.60.0",
+      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.60.0.tgz",
+      "integrity": "sha512-SBrYOvMbDB7cV8ZfNpaiLcgjH/a1c7aK0lK+aNigpf4xWLO8q+o4tcvVurv3c4EOyzn/3dCsYt4GKD42VvJ/+A==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/react-hook-form"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17 || ^18 || ^19"
+      }
+    },
+    "packages/client/node_modules/react-is": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "packages/client/node_modules/rimraf": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
+      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "glob": "^13.0.3",
+        "package-json-from-dist": "^1.0.1"
+      },
+      "bin": {
+        "rimraf": "dist/esm/bin.mjs"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/client/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/client/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/client/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
+    "packages/data-provider": {
+      "name": "librechat-data-provider",
+      "version": "0.8.509",
+      "license": "ISC",
+      "dependencies": {
+        "axios": "^1.16.0",
+        "dayjs": "^1.11.13",
+        "js-yaml": "^4.2.0",
+        "zod": "^3.22.4"
+      },
+      "devDependencies": {
+        "@babel/preset-env": "^7.21.5",
+        "@babel/preset-react": "^7.18.6",
+        "@babel/preset-typescript": "^7.21.0",
+        "@rollup/plugin-alias": "^5.1.0",
+        "@rollup/plugin-commonjs": "^29.0.0",
+        "@rollup/plugin-json": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^15.1.0",
+        "@rollup/plugin-replace": "^5.0.5",
+        "@types/jest": "^29.5.2",
+        "@types/js-yaml": "^4.0.9",
+        "@types/node": "^24.12.4",
+        "@types/react": "^18.2.18",
+        "@types/winston": "^2.4.4",
+        "jest": "^30.2.0",
+        "jest-junit": "^17.0.0",
+        "openapi-types": "^12.1.3",
+        "rimraf": "^6.1.3",
+        "rollup": "^4.34.9",
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
+      },
+      "peerDependencies": {
+        "@tanstack/react-query": "^4.28.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/data-provider/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.1",
-        "ansi-styles": "^5.0.0",
-        "react-is": "^17.0.1"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "packages/client/node_modules/react-hook-form": {
-      "version": "7.60.0",
-      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.60.0.tgz",
-      "integrity": "sha512-SBrYOvMbDB7cV8ZfNpaiLcgjH/a1c7aK0lK+aNigpf4xWLO8q+o4tcvVurv3c4EOyzn/3dCsYt4GKD42VvJ/+A==",
+    "packages/data-provider/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.20.0"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/react-hook-form"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17 || ^18 || ^19"
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "packages/client/node_modules/react-is": {
-      "version": "17.0.2",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
-      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+    "packages/data-provider/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
-      "peer": true
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
     },
-    "packages/client/node_modules/rimraf": {
+    "packages/data-provider/node_modules/rimraf": {
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
       "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
@@ -45125,90 +44705,160 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "packages/data-provider": {
-      "name": "librechat-data-provider",
-      "version": "0.8.502",
-      "license": "ISC",
-      "dependencies": {
-        "axios": "^1.16.0",
-        "dayjs": "^1.11.13",
-        "js-yaml": "^4.1.1",
-        "zod": "^3.22.4"
-      },
-      "devDependencies": {
-        "@babel/preset-env": "^7.21.5",
-        "@babel/preset-react": "^7.18.6",
-        "@babel/preset-typescript": "^7.21.0",
-        "@rollup/plugin-alias": "^5.1.0",
-        "@rollup/plugin-commonjs": "^29.0.0",
-        "@rollup/plugin-json": "^6.1.0",
-        "@rollup/plugin-node-resolve": "^15.1.0",
-        "@rollup/plugin-replace": "^5.0.5",
-        "@rollup/plugin-terser": "^1.0.0",
-        "@types/jest": "^29.5.2",
-        "@types/js-yaml": "^4.0.9",
-        "@types/node": "^20.3.0",
-        "@types/react": "^18.2.18",
-        "@types/winston": "^2.4.4",
-        "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
-        "openapi-types": "^12.1.3",
-        "rimraf": "^6.1.3",
-        "rollup": "^4.34.9",
-        "rollup-plugin-peer-deps-external": "^2.2.4",
-        "rollup-plugin-typescript2": "^0.37.0",
-        "typescript": "^5.0.4"
-      },
-      "peerDependencies": {
-        "@tanstack/react-query": "^4.28.0"
-      }
-    },
-    "packages/data-provider/node_modules/@rollup/plugin-terser": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-1.0.0.tgz",
-      "integrity": "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ==",
+    "packages/data-provider/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "serialize-javascript": "^7.0.3",
-        "smob": "^1.0.0",
-        "terser": "^5.17.4"
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/data-provider/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
       },
       "peerDependencies": {
-        "rollup": "^2.0.0||^3.0.0||^4.0.0"
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
       },
       "peerDependenciesMeta": {
-        "rollup": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
           "optional": true
         }
       }
     },
-    "packages/data-provider/node_modules/rimraf": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
-      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
+    "packages/data-provider/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "MIT",
       "dependencies": {
-        "glob": "^13.0.3",
-        "package-json-from-dist": "^1.0.1"
-      },
-      "bin": {
-        "rimraf": "dist/esm/bin.mjs"
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "^22.18.0 || >=24.0.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
       }
     },
     "packages/data-schemas": {
       "name": "@librechat/data-schemas",
-      "version": "0.0.51",
+      "version": "0.0.56",
       "license": "MIT",
       "devDependencies": {
         "@rollup/plugin-alias": "^5.1.0",
@@ -45220,16 +44870,17 @@
         "@rollup/plugin-typescript": "^12.1.2",
         "@types/express": "^5.0.0",
         "@types/jest": "^29.5.2",
-        "@types/node": "^20.3.0",
+        "@types/node": "^24.12.4",
         "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "mongodb-memory-server": "^11.0.1",
         "rimraf": "^6.1.3",
         "rollup": "^4.34.9",
         "rollup-plugin-peer-deps-external": "^2.2.4",
         "rollup-plugin-typescript2": "^0.37.0",
         "ts-node": "^10.9.2",
-        "typescript": "^5.0.4"
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
       },
       "peerDependencies": {
         "jsonwebtoken": "^9.0.2",
@@ -45243,27 +44894,392 @@
         "winston-daily-rotate-file": "^5.0.0"
       }
     },
-    "packages/data-schemas/node_modules/@rollup/plugin-terser": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-terser/-/plugin-terser-1.0.0.tgz",
-      "integrity": "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ==",
+    "packages/data-schemas/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "serialize-javascript": "^7.0.3",
-        "smob": "^1.0.0",
-        "terser": "^5.17.4"
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
       },
       "peerDependencies": {
-        "rollup": "^2.0.0||^3.0.0||^4.0.0"
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/data-schemas/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
       },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
     "packages/data-schemas/node_modules/logform": {
@@ -45292,6 +45308,19 @@
         "node": ">= 6"
       }
     },
+    "packages/data-schemas/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "packages/data-schemas/node_modules/rimraf": {
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
@@ -45312,6 +45341,157 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "packages/data-schemas/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/data-schemas/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/data-schemas/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
     "packages/data-schemas/node_modules/winston": {
       "version": "3.17.0",
       "resolved": "https://registry.npmjs.org/winston/-/winston-3.17.0.tgz",
diff --git a/package.json b/package.json
index 597cf5b2b72..a22677bb8f3 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "LibreChat",
-  "version": "v0.8.6-rc1",
+  "version": "v0.8.7",
   "description": "",
-  "packageManager": "npm@11.10.0",
+  "packageManager": "npm@11.13.0",
   "workspaces": [
     "api",
     "client",
@@ -53,24 +53,33 @@
     "frontend": "npm run build:data-provider && npm run build:data-schemas && npm run build:api && npm run build:client-package && cd client && npm run build",
     "frontend:ci": "npm run build:data-provider && npm run build:client-package && cd client && npm run build:ci",
     "frontend:dev": "cd client && npm run dev",
-    "e2e": "playwright test --config=e2e/playwright.config.local.ts",
-    "e2e:headed": "playwright test --config=e2e/playwright.config.local.ts --headed",
-    "e2e:a11y": "playwright test --config=e2e/playwright.config.a11y.ts --headed",
-    "e2e:ci": "playwright test --config=e2e/playwright.config.ts",
-    "e2e:debug": "cross-env PWDEBUG=1 playwright test --config=e2e/playwright.config.local.ts",
-    "e2e:codegen": "npx playwright codegen --load-storage=e2e/storageState.json http://localhost:3080/c/new",
-    "e2e:login": "npx playwright codegen --save-storage=e2e/auth.json http://localhost:3080/login",
+    "e2e:prepare": "npm run frontend",
+    "e2e": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.local.ts",
+    "e2e:headed": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.local.ts --headed",
+    "e2e:a11y": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.a11y.ts --headed",
+    "e2e:ci": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.ts",
+    "e2e:mock": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.mock.ts",
+    "e2e:mock:enforce": "npm run e2e:prepare && cross-env E2E_MODEL_SPECS_ENFORCE=true playwright test --config=e2e/playwright.config.mock.ts enforced-model-specs.spec.ts",
+    "e2e:mock:ci": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.mock.ts",
+    "e2e:debug": "npm run e2e:prepare && cross-env PWDEBUG=1 playwright test --config=e2e/playwright.config.local.ts",
+    "e2e:record": "npm run e2e:prepare && cross-env E2E_BASE_URL=http://localhost:3333 node e2e/setup/record.js",
+    "e2e:record:local": "npm run e2e:prepare && node e2e/setup/record.js --profile=local",
+    "e2e:codegen": "npx playwright codegen --target=playwright-test --test-id-attribute=data-testid --load-storage=e2e/storageState.json http://localhost:3080/c/new",
+    "e2e:login": "npx playwright codegen --save-storage=e2e/storageState.json http://localhost:3080/login",
     "e2e:github": "act -W .github/workflows/playwright.yml --secret-file my.secrets",
     "test:client": "cd client && npm run test:ci",
     "test:api": "cd api && npm run test:ci",
     "test:packages:api": "cd packages/api && npm run test:ci",
     "test:packages:data-provider": "cd packages/data-provider && npm run test:ci",
     "test:packages:data-schemas": "cd packages/data-schemas && npm run test:ci",
+    "test:config": "jest --config config/jest.config.js",
     "test:all": "npm run test:client && npm run test:api && npm run test:packages:api && npm run test:packages:data-provider && npm run test:packages:data-schemas",
-    "e2e:update": "playwright test --config=e2e/playwright.config.js --update-snapshots",
+    "e2e:update": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.local.ts --update-snapshots",
     "e2e:report": "npx playwright show-report e2e/playwright-report",
     "lint:fix": "eslint --fix \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
     "lint": "eslint \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
+    "sort-imports": "node scripts/sort-imports.mts",
+    "sort-imports:check": "node scripts/sort-imports.mts --check",
     "format": "npx prettier --write \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
     "b:api": "NODE_ENV=production bun run api/server/index.js",
     "b:api-inspect": "NODE_ENV=production bun --inspect run api/server/index.js",
@@ -94,6 +103,9 @@
     "migrate:prompt-permissions:dry-run": "node config/migrate-prompt-permissions.js --dry-run",
     "migrate:prompt-permissions": "node config/migrate-prompt-permissions.js",
     "migrate:prompt-permissions:batch": "node config/migrate-prompt-permissions.js --batch-size=50",
+    "migrate:shared-link-permissions:dry-run": "node config/migrate-shared-link-permissions.js --dry-run",
+    "migrate:shared-link-permissions": "node config/migrate-shared-link-permissions.js",
+    "migrate:shared-link-permissions:batch": "node config/migrate-shared-link-permissions.js --batch-size=50",
     "migrate:orphaned-agent-files:dry-run": "node config/migrate-orphaned-agent-files.js --dry-run",
     "migrate:orphaned-agent-files": "node config/migrate-orphaned-agent-files.js",
     "migrate:orphaned-agent-files:batch": "node config/migrate-orphaned-agent-files.js --batch-size=50"
@@ -135,13 +147,13 @@
     "lint-staged": "^15.4.3",
     "prettier": "^3.5.0",
     "prettier-plugin-tailwindcss": "^0.6.11",
-    "turbo": "^2.8.12",
-    "typescript-eslint": "^8.24.0"
+    "turbo": "^2.9.17",
+    "typescript-eslint": "^8.60.1"
   },
   "overrides": {
     "@xmldom/xmldom": "^0.8.13",
     "elliptic": "^6.6.1",
-    "form-data": "^4.0.4",
+    "form-data": "^4.0.6",
     "langsmith": "^0.6.0",
     "postcss": "^8.5.13",
     "tslib": "^2.8.1",
@@ -168,12 +180,14 @@
       "ajv": "6.14.0"
     },
     "underscore": "1.13.8",
-    "hono": "^4.12.18",
+    "hono": "^4.12.25",
     "@hono/node-server": "^1.19.10",
     "monaco-editor": {
       "dompurify": "3.4.0"
     },
-    "svgo": "^2.8.2"
+    "svgo": "^2.8.2",
+    "js-yaml": "^4.2.0",
+    "ws": "^8.21.0"
   },
   "nodemonConfig": {
     "ignore": [
diff --git a/packages/api/jest.config.mjs b/packages/api/jest.config.mjs
index b0029fe1a65..c6dfe06d925 100644
--- a/packages/api/jest.config.mjs
+++ b/packages/api/jest.config.mjs
@@ -1,3 +1,11 @@
+const esModules = [
+  '@langchain/langgraph',
+  '@langchain/langgraph-checkpoint',
+  '@langchain/langgraph-sdk',
+  '@mistralai/mistralai',
+  'uuid',
+].join('|');
+
 export default {
   collectCoverageFrom: ['src/**/*.{js,jsx,ts,tsx}', '!<rootDir>/node_modules/'],
   coveragePathIgnorePatterns: ['/node_modules/', '/dist/'],
@@ -23,6 +31,7 @@ export default {
       },
     ],
   },
+  transformIgnorePatterns: [`/node_modules/(?!(${esModules})/).*/`],
   moduleNameMapper: {
     '^@src/(.*)$': '<rootDir>/src/$1',
     '~/(.*)': '<rootDir>/src/$1',
diff --git a/packages/api/package.json b/packages/api/package.json
index 34a06401cb2..39e00f71982 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -1,23 +1,30 @@
 {
   "name": "@librechat/api",
-  "version": "1.7.30",
+  "version": "1.7.34",
   "type": "commonjs",
   "description": "MCP services for LibreChat",
-  "main": "dist/index.js",
-  "module": "dist/index.es.js",
-  "types": "./dist/types/index.d.ts",
+  "main": "dist/index.cjs",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "require": "./dist/index.js",
-      "types": "./dist/types/index.d.ts"
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./telemetry": {
+      "require": {
+        "types": "./dist/telemetry.d.cts",
+        "default": "./dist/telemetry.cjs"
+      }
     }
   },
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --bundleConfigAsCjs",
-    "build:dev": "npm run clean && NODE_ENV=development rollup -c --bundleConfigAsCjs",
-    "build:watch": "NODE_ENV=development rollup -c -w --bundleConfigAsCjs",
-    "build:watch:prod": "rollup -c -w --bundleConfigAsCjs",
+    "build": "npm run clean && tsdown",
+    "build:dev": "npm run clean && tsdown",
+    "build:watch": "tsdown --watch",
+    "build:watch:prod": "tsdown --watch",
     "test": "jest --coverage --watch --testPathIgnorePatterns=\"\\.*integration\\.|\\.*helper\\.|__tests__/helpers/|\\.*manual\\.spec\\.\"",
     "test:ci": "jest --coverage --ci --testPathIgnorePatterns=\"\\.*integration\\.|\\.*helper\\.|__tests__/helpers/|\\.*manual\\.spec\\.\"",
     "test:cache-integration:core": "jest --testPathPatterns=\"src/cache/.*\\.cache_integration\\.spec\\.ts$\" --coverage=false",
@@ -28,8 +35,8 @@
     "test:s3-integration": "jest --testPathPatterns=\"src/storage/s3/.*\\.integration\\.spec\\.ts$\" --coverage=false --runInBand",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs",
-    "b:build:dev": "bun run b:clean && NODE_ENV=development bun run rollup -c --silent --bundleConfigAsCjs",
+    "b:build": "bun run b:clean && bun run tsdown",
+    "b:build:dev": "bun run b:clean && bun run tsdown",
     "start:everything-sse": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/examples/everything/sse.ts",
     "start:everything": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/demo/everything.ts",
     "start:filesystem": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/demo/filesystem.ts",
@@ -61,26 +68,32 @@
     "@types/jest": "^29.5.2",
     "@types/jsonwebtoken": "^9.0.0",
     "@types/multer": "^1.4.13",
-    "@types/node": "^20.3.0",
+    "@types/node": "^24.12.4",
     "@types/node-fetch": "^2.6.13",
     "@types/react": "^18.2.18",
     "@types/sanitize-html": "^2.13.0",
+    "@types/supertest": "^7.2.0",
     "@types/winston": "^2.4.4",
     "@types/yauzl": "^2.10.3",
     "aws-sdk-client-mock": "^4.1.0",
+    "dedent": "^1.5.3",
+    "get-stream": "^6.0.1",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "jszip": "^3.10.1",
     "librechat-data-provider": "*",
+    "lodash": "^4.17.23",
     "mammoth": "^1.11.0",
     "mongodb": "^6.14.2",
+    "nanoid": "^3.3.7",
     "pdfjs-dist": "^5.4.624",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
     "rollup-plugin-peer-deps-external": "^2.2.4",
     "sanitize-html": "^2.13.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "yauzl": "^3.2.1"
   },
@@ -93,38 +106,57 @@
     "@aws-sdk/client-cloudfront": "^3.1042.0",
     "@aws-sdk/client-s3": "^3.980.0",
     "@aws-sdk/cloudfront-signer": "^3.1036.0",
+    "@aws-sdk/credential-providers": "^3.1045.0",
+    "@aws-sdk/s3-request-presigner": "^3.758.0",
     "@azure/identity": "^4.13.1",
     "@azure/search-documents": "^12.0.0",
     "@azure/storage-blob": "^12.30.0",
-    "@google/genai": "^2.0.1",
+    "@google/genai": "^2.8.0",
     "@keyv/redis": "^4.3.3",
-    "@librechat/agents": "^3.1.86",
+    "@librechat/agents": "^3.2.46",
     "@librechat/data-schemas": "*",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/instrumentation-express": "^0.56.0",
+    "@opentelemetry/instrumentation-http": "^0.207.0",
+    "@opentelemetry/instrumentation-ioredis": "^0.55.0",
+    "@opentelemetry/instrumentation-mongodb": "^0.60.0",
+    "@opentelemetry/instrumentation-mongoose": "^0.54.0",
+    "@opentelemetry/instrumentation-undici": "^0.18.0",
+    "@opentelemetry/resources": "^2.6.1",
+    "@opentelemetry/sdk-node": "^0.218.0",
+    "@opentelemetry/semantic-conventions": "^1.39.0",
     "@smithy/node-http-handler": "^4.4.5",
     "ai-tokenizer": "^1.0.6",
     "axios": "^1.16.0",
     "connect-redis": "^8.1.0",
+    "dedent": "^1.5.3",
     "eventsource": "^3.0.2",
     "express": "^5.1.0",
     "express-session": "^1.18.2",
     "firebase": "^11.0.2",
     "form-data": "^4.0.4",
+    "get-stream": "^6.0.1",
     "google-auth-library": "^9.15.1",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "jsonwebtoken": "^9.0.0",
+    "jszip": "^3.10.1",
     "jwks-rsa": "^3.2.0",
     "keyv": "^5.3.2",
     "keyv-file": "^5.1.2",
     "librechat-data-provider": "*",
+    "lodash": "^4.17.23",
     "mammoth": "^1.11.0",
     "mathjs": "^15.2.0",
     "memorystore": "^1.6.7",
+    "mongodb": "^6.14.2",
     "mongoose": "^8.23.1",
+    "nanoid": "^3.3.7",
     "node-fetch": "2.7.0",
     "pdfjs-dist": "^5.4.624",
+    "prom-client": "^15.1.3",
     "rate-limit-redis": "^4.2.0",
     "sanitize-html": "^2.13.0",
     "sharp": "^0.33.5",
diff --git a/packages/api/rollup.config.js b/packages/api/rollup.config.js
deleted file mode 100644
index 9a9de35e8fa..00000000000
--- a/packages/api/rollup.config.js
+++ /dev/null
@@ -1,65 +0,0 @@
-// rollup.config.js
-import { readFileSync } from 'fs';
-import json from '@rollup/plugin-json';
-import replace from '@rollup/plugin-replace';
-import commonjs from '@rollup/plugin-commonjs';
-import resolve from '@rollup/plugin-node-resolve';
-import typescript from '@rollup/plugin-typescript';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-
-const pkg = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8'));
-
-/**
- * Check if we're in development mode
- */
-const isDevelopment = process.env.NODE_ENV === 'development';
-
-const plugins = [
-  peerDepsExternal(),
-  resolve({
-    preferBuiltins: true,
-    skipSelf: true,
-  }),
-  replace({
-    __IS_DEV__: isDevelopment,
-    preventAssignment: true,
-  }),
-  commonjs({
-    transformMixedEsModules: true,
-    requireReturnsDefault: 'auto',
-  }),
-  typescript({
-    tsconfig: './tsconfig.build.json',
-    outDir: './dist',
-    sourceMap: true,
-    /**
-     * Remove inline sourcemaps - they conflict with external sourcemaps
-     */
-    inlineSourceMap: false,
-    /**
-     * Always include source content in sourcemaps for better debugging
-     */
-    inlineSources: true,
-  }),
-  json(),
-];
-
-const cjsBuild = {
-  input: 'src/index.ts',
-  output: {
-    dir: 'dist',
-    format: 'cjs',
-    sourcemap: true,
-    exports: 'named',
-    entryFileNames: '[name].js',
-    /**
-     * Always include sources in sourcemap for better debugging
-     */
-    sourcemapExcludeSources: false,
-  },
-  external: [...Object.keys(pkg.dependencies || {}), ...Object.keys(pkg.devDependencies || {})],
-  preserveSymlinks: true,
-  plugins,
-};
-
-export default cjsBuild;
diff --git a/packages/api/src/acl/accessControlService.spec.ts b/packages/api/src/acl/accessControlService.spec.ts
index ad1dcf18acf..4af5fab7772 100644
--- a/packages/api/src/acl/accessControlService.spec.ts
+++ b/packages/api/src/acl/accessControlService.spec.ts
@@ -810,6 +810,66 @@ describe('AccessControlService', () => {
     });
   });
 
+  describe('hasPublicAccess', () => {
+    const publicResource = new Types.ObjectId();
+    const privateResource = new Types.ObjectId();
+
+    beforeEach(async () => {
+      await service.grantPermission({
+        principalType: PrincipalType.PUBLIC,
+        principalId: null,
+        resourceType: ResourceType.AGENT,
+        resourceId: publicResource,
+        accessRoleId: AccessRoleIds.AGENT_VIEWER,
+        grantedBy: grantedById,
+      });
+
+      await service.grantPermission({
+        principalType: PrincipalType.USER,
+        principalId: userId,
+        resourceType: ResourceType.AGENT,
+        resourceId: privateResource,
+        accessRoleId: AccessRoleIds.AGENT_OWNER,
+        grantedBy: grantedById,
+      });
+    });
+
+    test('should return true for resource with PUBLIC AclEntry', async () => {
+      const findPublicResourceIdsSpy = jest.spyOn(service['_dbMethods'], 'findPublicResourceIds');
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: publicResource,
+      });
+      expect(result).toBe(true);
+      expect(findPublicResourceIdsSpy).not.toHaveBeenCalled();
+      findPublicResourceIdsSpy.mockRestore();
+    });
+
+    test('should return false for resource with only user AclEntry', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: privateResource,
+      });
+      expect(result).toBe(false);
+    });
+
+    test('should return false for non-existent resource', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: new Types.ObjectId(),
+      });
+      expect(result).toBe(false);
+    });
+
+    test('should return false for invalid resource type', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: 'invalid' as ResourceType,
+        resourceId: publicResource,
+      });
+      expect(result).toBe(false);
+    });
+  });
+
   describe('checkPermission', () => {
     const testResource = new Types.ObjectId();
     const groupResource = new Types.ObjectId();
diff --git a/packages/api/src/acl/accessControlService.ts b/packages/api/src/acl/accessControlService.ts
index 57d072561ac..bc5e2a41b70 100644
--- a/packages/api/src/acl/accessControlService.ts
+++ b/packages/api/src/acl/accessControlService.ts
@@ -1,13 +1,21 @@
-import { Types, ClientSession, DeleteResult } from 'mongoose';
-import { AllMethods, IAclEntry, createMethods, logger } from '@librechat/data-schemas';
-import { AccessRoleIds, PrincipalType, ResourceType } from 'librechat-data-provider';
+import { Types } from 'mongoose';
+import { createMethods, logger } from '@librechat/data-schemas';
+import {
+  AccessRoleIds,
+  PermissionBits,
+  PrincipalType,
+  ResourceType,
+} from 'librechat-data-provider';
+import type { AllMethods, IAclEntry } from '@librechat/data-schemas';
+import type { ClientSession, DeleteResult } from 'mongoose';
+
+import type { ResolvedPrincipal } from '~/types/principal';
 
 export class AccessControlService {
   private _dbMethods: AllMethods;
-  private _aclModel;
+
   constructor(mongoose: typeof import('mongoose')) {
     this._dbMethods = createMethods(mongoose);
-    this._aclModel = mongoose.models.AclEntry;
   }
 
   /**
@@ -20,6 +28,7 @@ export class AccessControlService {
    * @param {string} params.accessRoleId - The ID of the role (e.g., AccessRoleIds.AGENT_VIEWER, AccessRoleIds.AGENT_EDITOR)
    * @param {Types.ObjectId} params.grantedBy - User ID granting the permission
    * @param {ClientSession} [params.session] - Optional MongoDB session for transactions
+   * @param {Date} [params.expiredAt] - Optional expiration for resource-tied permissions
    * @returns {Promise<IAclEntry>} The created or updated ACL entry
    */
   public async grantPermission(args: {
@@ -29,9 +38,10 @@ export class AccessControlService {
     resourceId: string | Types.ObjectId;
     accessRoleId: AccessRoleIds;
 
-    grantedBy: string | Types.ObjectId;
+    grantedBy?: string | Types.ObjectId;
     session?: ClientSession;
     roleId?: string | Types.ObjectId;
+    expiredAt?: Date;
   }): Promise<IAclEntry | null> {
     const {
       principalType,
@@ -41,6 +51,7 @@ export class AccessControlService {
       accessRoleId,
       grantedBy,
       session,
+      expiredAt,
     } = args;
     try {
       if (!Object.values(PrincipalType).includes(principalType)) {
@@ -93,6 +104,7 @@ export class AccessControlService {
         grantedBy,
         session,
         role._id,
+        expiredAt,
       );
     } catch (error) {
       logger.error(
@@ -122,6 +134,44 @@ export class AccessControlService {
     role?: string;
     resourceType: string;
     requiredPermissions: number;
+  }): Promise<Types.ObjectId[]> {
+    try {
+      const principalsList = await this.getUserPrincipals({ userId, role });
+      return await this.findAccessibleResourcesForPrincipals({
+        principalsList,
+        resourceType,
+        requiredPermissions,
+      });
+    } catch (error) {
+      if (error instanceof Error) {
+        logger.error(`[PermissionService.findAccessibleResources] Error: ${error.message}`);
+        // Re-throw validation errors
+        if (error.message.includes('requiredPermissions must be')) {
+          throw error;
+        }
+      }
+      return [];
+    }
+  }
+
+  public async getUserPrincipals({
+    userId,
+    role,
+  }: {
+    userId: string | Types.ObjectId;
+    role?: string;
+  }): Promise<ResolvedPrincipal[]> {
+    return await this._dbMethods.getUserPrincipals({ userId, role });
+  }
+
+  public async findAccessibleResourcesForPrincipals({
+    principalsList,
+    resourceType,
+    requiredPermissions,
+  }: {
+    principalsList: ResolvedPrincipal[];
+    resourceType: string;
+    requiredPermissions: number;
   }): Promise<Types.ObjectId[]> {
     try {
       if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
@@ -130,12 +180,10 @@ export class AccessControlService {
 
       this.validateResourceType(resourceType as ResourceType);
 
-      // Get all principals for the user (user + groups + public)
-      const principalsList = await this._dbMethods.getUserPrincipals({ userId, role });
-
       if (principalsList.length === 0) {
         return [];
       }
+
       return await this._dbMethods.findAccessibleResources(
         principalsList,
         resourceType,
@@ -143,8 +191,9 @@ export class AccessControlService {
       );
     } catch (error) {
       if (error instanceof Error) {
-        logger.error(`[PermissionService.findAccessibleResources] Error: ${error.message}`);
-        // Re-throw validation errors
+        logger.error(
+          `[PermissionService.findAccessibleResourcesForPrincipals] Error: ${error.message}`,
+        );
         if (error.message.includes('requiredPermissions must be')) {
           throw error;
         }
@@ -266,7 +315,7 @@ export class AccessControlService {
         throw new Error(`Invalid resource ID: ${resourceId}`);
       }
 
-      const result = await this._aclModel.deleteMany({
+      const result = await this._dbMethods.deleteAclEntries({
         resourceType,
         resourceId,
       });
@@ -335,6 +384,33 @@ export class AccessControlService {
     }
   }
 
+  /**
+   * Check if a resource has a PUBLIC AclEntry (accessible to everyone).
+   * Unlike checkPermission, this does not require a user context.
+   */
+  public async hasPublicAccess({
+    resourceType,
+    resourceId,
+  }: {
+    resourceType: ResourceType;
+    resourceId: string | Types.ObjectId;
+  }): Promise<boolean> {
+    try {
+      this.validateResourceType(resourceType);
+      return await this._dbMethods.hasPermission(
+        [{ principalType: PrincipalType.PUBLIC }],
+        resourceType,
+        resourceId,
+        PermissionBits.VIEW,
+      );
+    } catch (error) {
+      if (error instanceof Error) {
+        logger.error(`[PermissionService.hasPublicAccess] Error: ${error.message}`);
+      }
+      return false;
+    }
+  }
+
   /**
    * Validates that the resourceType is one of the supported enum values
    * @param {string} resourceType - The resource type to validate
diff --git a/packages/api/src/actions/credentials.spec.ts b/packages/api/src/actions/credentials.spec.ts
new file mode 100644
index 00000000000..d10b0410ca5
--- /dev/null
+++ b/packages/api/src/actions/credentials.spec.ts
@@ -0,0 +1,183 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    AuthTypeEnum: {
+      ServiceHttp: 'service_http',
+      OAuth: 'oauth',
+      None: 'none',
+    },
+    AuthorizationTypeEnum: {
+      Bearer: 'bearer',
+    },
+    TokenExchangeMethodEnum: {
+      DefaultPost: 'default_post',
+    },
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { servers?: Array<{ url?: string }> };
+      return {
+        status: true,
+        spec,
+        serverUrl: spec.servers?.[0]?.url,
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import {
+  AuthTypeEnum,
+  AuthorizationTypeEnum,
+  TokenExchangeMethodEnum,
+} from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import { mergeActionMetadataForUpdate } from './credentials';
+
+const specFor = (serverUrl: string): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: serverUrl }],
+    paths: {
+      '/echo': {
+        get: {
+          operationId: 'echo',
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const serviceMetadata = (serverUrl = 'https://api.example.com/v1'): ActionMetadata => ({
+  domain: 'https://api.example.com',
+  raw_spec: specFor(serverUrl),
+  api_key: 'encrypted-owner-key',
+  auth: {
+    type: AuthTypeEnum.ServiceHttp,
+    authorization_type: AuthorizationTypeEnum.Bearer,
+  },
+});
+
+describe('mergeActionMetadataForUpdate', () => {
+  it('preserves existing service credentials when the action target is unchanged', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v1'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(false);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBe('encrypted-owner-key');
+  });
+
+  it('requires a fresh service credential when the domain changes', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://attacker.example',
+      raw_spec: specFor('https://attacker.example/v1'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('treats OpenAPI server path changes as target changes', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/debug'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('allows target changes when the request supplies a fresh service credential', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v2'),
+      api_key: 'encrypted-new-key',
+      auth: {
+        type: AuthTypeEnum.ServiceHttp,
+        authorization_type: AuthorizationTypeEnum.Bearer,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBe('encrypted-new-key');
+  });
+
+  it('allows target changes when auth is explicitly removed', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v2'),
+      auth: {
+        type: AuthTypeEnum.None,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('requires fresh OAuth client credentials when OAuth endpoints change', () => {
+    const storedMetadata: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v1'),
+      oauth_client_id: 'encrypted-client-id',
+      oauth_client_secret: 'encrypted-client-secret',
+      auth: {
+        type: AuthTypeEnum.OAuth,
+        authorization_url: 'https://auth.example.com/authorize',
+        client_url: 'https://auth.example.com/token',
+        scope: 'read',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+    };
+    const incomingMetadata: ActionMetadata = {
+      auth: {
+        type: AuthTypeEnum.OAuth,
+        authorization_url: 'https://evil.example/authorize',
+        client_url: 'https://evil.example/token',
+        scope: 'read',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata,
+      incomingMetadata,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.oauth_client_id).toBeUndefined();
+    expect(result.metadata.oauth_client_secret).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/actions/credentials.ts b/packages/api/src/actions/credentials.ts
new file mode 100644
index 00000000000..ad53d21c8b1
--- /dev/null
+++ b/packages/api/src/actions/credentials.ts
@@ -0,0 +1,194 @@
+import { AuthTypeEnum, validateAndParseOpenAPISpec } from 'librechat-data-provider';
+import type { ActionAuth, ActionMetadata } from 'librechat-data-provider';
+
+const authBoundaryFields: Array<keyof ActionAuth> = [
+  'type',
+  'authorization_type',
+  'custom_auth_header',
+  'authorization_url',
+  'client_url',
+  'scope',
+  'token_exchange_method',
+];
+
+export type ActionMetadataUpdateResult = {
+  metadata: ActionMetadata;
+  targetChanged: boolean;
+  requiresCredentialRefresh: boolean;
+};
+
+export type ActionMetadataUpdateParams = {
+  storedMetadata: ActionMetadata;
+  incomingMetadata: ActionMetadata;
+};
+
+function hasOwn<T extends object, K extends PropertyKey>(
+  obj: T | null | undefined,
+  key: K,
+): obj is T & Record<K, unknown> {
+  return obj != null && Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function hasValue(value: string | undefined): boolean {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function normalizeUrlTarget(value: string | undefined): string {
+  if (!value) {
+    return '';
+  }
+
+  try {
+    const url = new URL(value);
+    const pathname = url.pathname.replace(/\/+$/, '');
+    return `${url.protocol}//${url.host.toLowerCase()}${pathname}${url.search}`;
+  } catch {
+    return value.trim().toLowerCase().replace(/\/+$/, '');
+  }
+}
+
+function normalizeDomainTarget(value: string | undefined): string {
+  if (!value) {
+    return '';
+  }
+
+  const urlValue = value.includes('://') ? value : `https://${value}`;
+  try {
+    const url = new URL(urlValue);
+    return `${url.protocol}//${url.host.toLowerCase()}`;
+  } catch {
+    return value.trim().toLowerCase().replace(/\/+$/, '');
+  }
+}
+
+function getSpecServerTarget(rawSpec: string | undefined): string {
+  if (!rawSpec) {
+    return '';
+  }
+
+  const result = validateAndParseOpenAPISpec(rawSpec);
+  return normalizeUrlTarget(result.serverUrl);
+}
+
+function didDomainChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'domain')) {
+    return false;
+  }
+
+  return (
+    normalizeDomainTarget(storedMetadata.domain) !== normalizeDomainTarget(incomingMetadata.domain)
+  );
+}
+
+function didSpecServerChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'raw_spec')) {
+    return false;
+  }
+
+  return (
+    getSpecServerTarget(storedMetadata.raw_spec) !== getSpecServerTarget(incomingMetadata.raw_spec)
+  );
+}
+
+function didAuthBoundaryChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'auth')) {
+    return false;
+  }
+
+  return authBoundaryFields.some(
+    (field) => storedMetadata.auth?.[field] !== incomingMetadata.auth?.[field],
+  );
+}
+
+function getTargetChanged(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  return (
+    didDomainChange(storedMetadata, incomingMetadata) ||
+    didSpecServerChange(storedMetadata, incomingMetadata) ||
+    didAuthBoundaryChange(storedMetadata, incomingMetadata)
+  );
+}
+
+function getNextAuthType(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): AuthTypeEnum | undefined {
+  return incomingMetadata.auth?.type ?? storedMetadata.auth?.type;
+}
+
+function requiresCredentialRefresh(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  const authType = getNextAuthType(storedMetadata, incomingMetadata);
+
+  if (authType === AuthTypeEnum.ServiceHttp) {
+    return hasValue(storedMetadata.api_key) && !hasValue(incomingMetadata.api_key);
+  }
+
+  if (authType === AuthTypeEnum.OAuth) {
+    return (
+      (hasValue(storedMetadata.oauth_client_id) && !hasValue(incomingMetadata.oauth_client_id)) ||
+      (hasValue(storedMetadata.oauth_client_secret) &&
+        !hasValue(incomingMetadata.oauth_client_secret))
+    );
+  }
+
+  return false;
+}
+
+function removeUnsubmittedCredentials(
+  metadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): ActionMetadata {
+  const sanitized = { ...metadata };
+
+  if (!hasValue(incomingMetadata.api_key)) {
+    delete sanitized.api_key;
+  }
+
+  if (!hasValue(incomingMetadata.oauth_client_id)) {
+    delete sanitized.oauth_client_id;
+  }
+
+  if (!hasValue(incomingMetadata.oauth_client_secret)) {
+    delete sanitized.oauth_client_secret;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Preserves saved credentials only while an Action continues to point at the
+ * same request/auth boundary. A changed domain, OpenAPI server URL, or auth
+ * endpoint must come with fresh credentials or explicitly remove auth.
+ */
+export function mergeActionMetadataForUpdate({
+  storedMetadata,
+  incomingMetadata,
+}: ActionMetadataUpdateParams): ActionMetadataUpdateResult {
+  const targetChanged = getTargetChanged(storedMetadata, incomingMetadata);
+  const refreshRequired = targetChanged
+    ? requiresCredentialRefresh(storedMetadata, incomingMetadata)
+    : false;
+  const mergedMetadata = { ...storedMetadata, ...incomingMetadata };
+
+  return {
+    targetChanged,
+    requiresCredentialRefresh: refreshRequired,
+    metadata: targetChanged
+      ? removeUnsubmittedCredentials(mergedMetadata, incomingMetadata)
+      : mergedMetadata,
+  };
+}
diff --git a/packages/api/src/actions/index.ts b/packages/api/src/actions/index.ts
new file mode 100644
index 00000000000..bd6bb74bd5d
--- /dev/null
+++ b/packages/api/src/actions/index.ts
@@ -0,0 +1,3 @@
+export * from './credentials';
+export * from './tools';
+export * from './update';
diff --git a/packages/api/src/actions/tools.spec.ts b/packages/api/src/actions/tools.spec.ts
new file mode 100644
index 00000000000..2b4747de646
--- /dev/null
+++ b/packages/api/src/actions/tools.spec.ts
@@ -0,0 +1,92 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    actionDelimiter: '_action_',
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { paths?: Record<string, unknown> };
+      return {
+        status: true,
+        message: 'OpenAPI spec is valid.',
+        spec,
+        serverUrl: 'https://api.example.com',
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import { mergeAgentActionTools } from './tools';
+
+const specFor = (operationId: string): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: 'https://api.example.com' }],
+    paths: {
+      '/items': {
+        get: {
+          operationId,
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const toolFor = (name: string) => ({
+  function: {
+    name,
+  },
+});
+
+describe('mergeAgentActionTools', () => {
+  it('preserves other action tools that share the previous domain', () => {
+    const result = mergeAgentActionTools({
+      existingTools: [
+        'listItems_action_shared_domain',
+        'echoMessage_action_shared_domain',
+        'echoMessage_action_legacy_domain',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      encodedDomain: 'new_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousLegacyDomain: 'legacy_domain',
+      previousRawSpec: specFor('echoMessage'),
+    });
+
+    expect(result).toEqual(['listItems_action_shared_domain', 'echoMessage_action_new_domain']);
+  });
+
+  it('removes previous operation names when an action function is renamed', () => {
+    const result = mergeAgentActionTools({
+      existingTools: ['oldName_action_shared_domain', 'unrelated_action_shared_domain'],
+      incomingFunctions: [toolFor('newName')],
+      encodedDomain: 'shared_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousRawSpec: specFor('oldName'),
+    });
+
+    expect(result).toEqual(['unrelated_action_shared_domain', 'newName_action_shared_domain']);
+  });
+
+  it('removes legacy action-id keyed entries without dropping unrelated tools', () => {
+    const result = mergeAgentActionTools({
+      existingTools: [
+        'legacy-action-a',
+        'listItems_action_shared_domain',
+        'echoMessage_action_shared_domain',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      encodedDomain: 'shared_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousRawSpec: specFor('echoMessage'),
+    });
+
+    expect(result).toEqual(['listItems_action_shared_domain', 'echoMessage_action_shared_domain']);
+  });
+});
diff --git a/packages/api/src/actions/tools.ts b/packages/api/src/actions/tools.ts
new file mode 100644
index 00000000000..2647d5cde50
--- /dev/null
+++ b/packages/api/src/actions/tools.ts
@@ -0,0 +1,127 @@
+import { actionDelimiter, validateAndParseOpenAPISpec } from 'librechat-data-provider';
+
+export type ActionToolLike = {
+  function?: {
+    name?: string;
+  };
+};
+
+export type MergeAgentActionToolsParams = {
+  existingTools: string[];
+  incomingFunctions: ActionToolLike[];
+  encodedDomain: string;
+  actionId: string;
+  requestedActionId?: string;
+  legacyDomain?: string;
+  previousEncodedDomain?: string;
+  previousLegacyDomain?: string;
+  previousRawSpec?: string;
+};
+
+const httpMethods = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace']);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function sanitizeOperationId(input: string): string {
+  return input.replace(/[^a-zA-Z0-9_-]/g, '');
+}
+
+function getFunctionNames(functions: ActionToolLike[]): string[] {
+  const names = new Set<string>();
+
+  for (const tool of functions) {
+    const name = tool.function?.name;
+    if (typeof name === 'string' && name.length > 0) {
+      names.add(name);
+    }
+  }
+
+  return [...names];
+}
+
+function getSpecOperationNames(rawSpec?: string): string[] {
+  if (!rawSpec) {
+    return [];
+  }
+
+  const result = validateAndParseOpenAPISpec(rawSpec);
+  if (!result.status || !isRecord(result.spec?.paths)) {
+    return [];
+  }
+
+  const names = new Set<string>();
+  for (const [path, methods] of Object.entries(result.spec.paths)) {
+    if (!isRecord(methods)) {
+      continue;
+    }
+
+    for (const [method, operation] of Object.entries(methods)) {
+      if (!httpMethods.has(method.toLowerCase()) || !isRecord(operation)) {
+        continue;
+      }
+
+      const operationId = operation.operationId;
+      names.add(
+        typeof operationId === 'string' && operationId.length > 0
+          ? operationId
+          : sanitizeOperationId(`${method}_${path}`),
+      );
+    }
+  }
+
+  return [...names];
+}
+
+function getUniqueValues(values: Array<string | undefined>): string[] {
+  return [...new Set(values.filter((value): value is string => !!value))];
+}
+
+export function mergeAgentActionTools({
+  existingTools,
+  incomingFunctions,
+  encodedDomain,
+  actionId,
+  requestedActionId,
+  legacyDomain,
+  previousEncodedDomain,
+  previousLegacyDomain,
+  previousRawSpec,
+}: MergeAgentActionToolsParams): string[] {
+  const incomingNames = getFunctionNames(incomingFunctions);
+  const domainsToReplace = getUniqueValues([
+    encodedDomain,
+    legacyDomain,
+    previousEncodedDomain,
+    previousLegacyDomain,
+  ]);
+  const namesToReplace = getUniqueValues([
+    ...incomingNames,
+    ...getSpecOperationNames(previousRawSpec),
+  ]);
+  const toolsToReplace = new Set<string>();
+
+  for (const name of namesToReplace) {
+    for (const domain of domainsToReplace) {
+      toolsToReplace.add(`${name}${actionDelimiter}${domain}`);
+    }
+  }
+
+  const actionIdsToReplace = getUniqueValues([actionId, requestedActionId]);
+  const retainedTools = existingTools.filter((tool) => {
+    if (!tool) {
+      return false;
+    }
+
+    if (toolsToReplace.has(tool)) {
+      return false;
+    }
+
+    return !actionIdsToReplace.some((id) => tool.includes(id));
+  });
+
+  return retainedTools.concat(
+    incomingNames.map((name) => `${name}${actionDelimiter}${encodedDomain}`),
+  );
+}
diff --git a/packages/api/src/actions/update.spec.ts b/packages/api/src/actions/update.spec.ts
new file mode 100644
index 00000000000..ed356100aff
--- /dev/null
+++ b/packages/api/src/actions/update.spec.ts
@@ -0,0 +1,152 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    actionDelimiter: '_action_',
+    actionDomainSeparator: '---',
+    Constants: {
+      ENCODED_DOMAIN_LENGTH: 64,
+    },
+    AuthTypeEnum: {
+      ServiceHttp: 'service_http',
+      OAuth: 'oauth',
+      None: 'none',
+    },
+    AuthorizationTypeEnum: {
+      Bearer: 'bearer',
+    },
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { servers?: Array<{ url?: string }> };
+      return {
+        status: true,
+        message: 'OpenAPI spec is valid.',
+        spec,
+        serverUrl: spec.servers?.[0]?.url,
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import { AuthTypeEnum, AuthorizationTypeEnum } from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import {
+  buildActionOAuthTokenDeleteQueries,
+  legacyActionDomainEncode,
+  planAgentActionUpdate,
+} from './update';
+
+const specFor = (serverUrl: string, operationId = 'echoMessage'): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: serverUrl }],
+    paths: {
+      '/echo': {
+        get: {
+          operationId,
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const toolFor = (name: string) => ({
+  function: {
+    name,
+  },
+});
+
+const storedServiceMetadata: ActionMetadata = {
+  domain: 'https://api.example.com',
+  raw_spec: specFor('https://api.example.com/v1'),
+  api_key: 'encrypted-owner-key',
+  auth: {
+    type: AuthTypeEnum.ServiceHttp,
+    authorization_type: AuthorizationTypeEnum.Bearer,
+  },
+};
+
+describe('planAgentActionUpdate', () => {
+  it('requires refreshed credentials when an existing target changes without new credentials', () => {
+    const result = planAgentActionUpdate({
+      agentActions: ['api---example---com_action_action-1'],
+      agentTools: ['echoMessage_action_api---example---com'],
+      incomingFunctions: [toolFor('echoMessage')],
+      incomingMetadata: {
+        domain: 'https://other.example.com',
+        raw_spec: specFor('https://other.example.com/v1'),
+      },
+      actionId: 'action-1',
+      requestedActionId: 'action-1',
+      encodedDomain: 'other---example---com',
+      legacyDomain: legacyActionDomainEncode('https://other.example.com'),
+      previousLegacyDomain: legacyActionDomainEncode('https://api.example.com'),
+      storedAction: {
+        metadata: storedServiceMetadata,
+      },
+    });
+
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.targetChanged).toBe(true);
+    expect(result.deleteOAuthTokens).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('plans a stable-id target update while preserving unrelated same-domain tools', () => {
+    const result = planAgentActionUpdate({
+      agentActions: ['api---example---com_action_action-1', 'api---example---com_action_action-2'],
+      agentTools: [
+        'echoMessage_action_api---example---com',
+        'listItems_action_api---example---com',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      incomingMetadata: {
+        domain: 'https://other.example.com',
+        raw_spec: specFor('https://other.example.com/v1'),
+        api_key: 'encrypted-new-key',
+        auth: {
+          type: AuthTypeEnum.ServiceHttp,
+          authorization_type: AuthorizationTypeEnum.Bearer,
+        },
+      },
+      actionId: 'action-1',
+      requestedActionId: 'action-1',
+      encodedDomain: 'other---example---com',
+      legacyDomain: legacyActionDomainEncode('https://other.example.com'),
+      previousLegacyDomain: legacyActionDomainEncode('https://api.example.com'),
+      storedAction: {
+        metadata: storedServiceMetadata,
+      },
+    });
+
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.actionId).toBe('action-1');
+    expect(result.deleteOAuthTokens).toBe(true);
+    expect(result.actions).toEqual([
+      'api---example---com_action_action-2',
+      'other---example---com_action_action-1',
+    ]);
+    expect(result.tools).toEqual([
+      'listItems_action_api---example---com',
+      'echoMessage_action_other---example---com',
+    ]);
+  });
+});
+
+describe('buildActionOAuthTokenDeleteQueries', () => {
+  it('builds escaped access and refresh token identifier queries', () => {
+    const [accessQuery, refreshQuery] = buildActionOAuthTokenDeleteQueries('action.1');
+
+    expect(accessQuery).toEqual({
+      type: 'oauth',
+      identifier: expect.any(RegExp),
+    });
+    expect(refreshQuery).toEqual({
+      type: 'oauth_refresh',
+      identifier: expect.any(RegExp),
+    });
+    expect(accessQuery.identifier.test('user-1:action.1')).toBe(true);
+    expect(accessQuery.identifier.test('user-1:actionx1')).toBe(false);
+    expect(refreshQuery.identifier.test('user-1:action.1:refresh')).toBe(true);
+  });
+});
diff --git a/packages/api/src/actions/update.ts b/packages/api/src/actions/update.ts
new file mode 100644
index 00000000000..03bb3ba8617
--- /dev/null
+++ b/packages/api/src/actions/update.ts
@@ -0,0 +1,163 @@
+import { Constants, actionDelimiter, actionDomainSeparator } from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import type { ActionToolLike } from './tools';
+import { mergeActionMetadataForUpdate } from './credentials';
+import { mergeAgentActionTools } from './tools';
+
+export const ACTION_CREDENTIAL_REFRESH_MESSAGE =
+  'Action credentials must be re-entered when changing the domain, OpenAPI server URL, or authentication settings';
+
+type StoredActionForUpdate = {
+  metadata?: ActionMetadata | null;
+};
+
+export type PlanAgentActionUpdateParams = {
+  agentActions: string[];
+  agentTools: string[];
+  incomingFunctions: ActionToolLike[];
+  incomingMetadata: ActionMetadata;
+  actionId: string;
+  requestedActionId?: string;
+  encodedDomain: string;
+  legacyDomain?: string;
+  previousLegacyDomain?: string;
+  storedAction?: StoredActionForUpdate | null;
+};
+
+export type PlannedAgentActionUpdate = {
+  actionId: string;
+  metadata: ActionMetadata;
+  actions: string[];
+  tools: string[];
+  targetChanged: boolean;
+  requiresCredentialRefresh: boolean;
+  deleteOAuthTokens: boolean;
+};
+
+export type ActionOAuthTokenDeleteQuery = {
+  type: 'oauth' | 'oauth_refresh';
+  identifier: RegExp;
+};
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function getUpdatedAgentActionRefs({
+  agentActions,
+  actionId,
+  requestedActionId,
+  encodedDomain,
+}: Pick<
+  PlanAgentActionUpdateParams,
+  'agentActions' | 'actionId' | 'requestedActionId' | 'encodedDomain'
+>): {
+  actions: string[];
+  previousEncodedDomain?: string;
+} {
+  const actions: string[] = [];
+  let previousEncodedDomain: string | undefined;
+
+  for (const action of agentActions) {
+    const [actionDomain, currentActionId] = action.split(actionDelimiter);
+    if (
+      (requestedActionId && currentActionId === requestedActionId) ||
+      currentActionId === actionId
+    ) {
+      previousEncodedDomain = actionDomain;
+      continue;
+    }
+
+    actions.push(action);
+  }
+
+  actions.push(`${encodedDomain}${actionDelimiter}${actionId}`);
+
+  return {
+    actions,
+    previousEncodedDomain,
+  };
+}
+
+export function legacyActionDomainEncode(domain?: string): string {
+  if (!domain) {
+    return '';
+  }
+
+  if (domain.length <= Constants.ENCODED_DOMAIN_LENGTH) {
+    return domain.replace(/\./g, actionDomainSeparator);
+  }
+
+  const modifiedDomain = Buffer.from(domain).toString('base64');
+  return modifiedDomain.substring(0, Constants.ENCODED_DOMAIN_LENGTH);
+}
+
+export function buildActionOAuthTokenDeleteQueries(
+  actionId: string,
+): ActionOAuthTokenDeleteQuery[] {
+  const escapedActionId = escapeRegExp(actionId);
+
+  return [
+    {
+      type: 'oauth',
+      identifier: new RegExp(`^[^:]+:${escapedActionId}$`),
+    },
+    {
+      type: 'oauth_refresh',
+      identifier: new RegExp(`^[^:]+:${escapedActionId}:refresh$`),
+    },
+  ];
+}
+
+export function planAgentActionUpdate({
+  agentActions,
+  agentTools,
+  incomingFunctions,
+  incomingMetadata,
+  actionId,
+  requestedActionId,
+  encodedDomain,
+  legacyDomain,
+  previousLegacyDomain,
+  storedAction,
+}: PlanAgentActionUpdateParams): PlannedAgentActionUpdate {
+  const metadataUpdate = storedAction
+    ? mergeActionMetadataForUpdate({
+        storedMetadata: storedAction.metadata ?? {},
+        incomingMetadata,
+      })
+    : {
+        metadata: incomingMetadata,
+        targetChanged: false,
+        requiresCredentialRefresh: false,
+      };
+
+  const { actions, previousEncodedDomain } = getUpdatedAgentActionRefs({
+    agentActions,
+    actionId,
+    requestedActionId,
+    encodedDomain,
+  });
+
+  const tools = mergeAgentActionTools({
+    existingTools: agentTools,
+    incomingFunctions,
+    encodedDomain,
+    actionId,
+    requestedActionId,
+    legacyDomain,
+    previousEncodedDomain,
+    previousLegacyDomain,
+    previousRawSpec: storedAction?.metadata?.raw_spec,
+  });
+
+  return {
+    actionId,
+    actions,
+    tools,
+    metadata: metadataUpdate.metadata,
+    targetChanged: metadataUpdate.targetChanged,
+    requiresCredentialRefresh: metadataUpdate.requiresCredentialRefresh,
+    deleteOAuthTokens: Boolean(metadataUpdate.targetChanged && requestedActionId),
+  };
+}
diff --git a/packages/api/src/admin/auditLog.spec.ts b/packages/api/src/admin/auditLog.spec.ts
new file mode 100644
index 00000000000..5c5134bf6a3
--- /dev/null
+++ b/packages/api/src/admin/auditLog.spec.ts
@@ -0,0 +1,491 @@
+import { Types } from 'mongoose';
+import { EventEmitter } from 'events';
+import { MAX_AUDIT_EXPORT_ROWS, MAX_AUDIT_VERIFY_ROWS } from '@librechat/data-schemas';
+import type {
+  AdminAuditLogEntry,
+  AuditChainVerification,
+  AuditLogPage,
+} from '@librechat/data-schemas';
+import type { Response } from 'express';
+import type { AdminAuditLogDeps } from './auditLog';
+import type { ServerRequest } from '~/types/http';
+import { createAdminAuditLogHandlers } from './auditLog';
+
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() },
+}));
+
+const validObjectId = new Types.ObjectId().toString();
+
+function mockEntry(overrides: Partial<AdminAuditLogEntry> = {}): AdminAuditLogEntry {
+  return {
+    id: new Types.ObjectId().toString(),
+    schemaVersion: 1,
+    category: 'grant',
+    action: 'grant.assigned',
+    outcome: 'success',
+    severity: 'warning',
+    actor: { type: 'user', id: new Types.ObjectId().toString(), name: 'Alice Admin' },
+    target: { type: 'role', id: 'ADMIN', name: 'ADMIN' },
+    metadata: { capability: 'manage:users' },
+    context: { ip: '10.0.0.1', requestId: 'req-1' },
+    integrity: { seq: 1, hash: 'a'.repeat(64), prevHash: '0'.repeat(64) },
+    timestamp: new Date('2025-01-15T10:30:00.000Z').toISOString(),
+    ...overrides,
+  };
+}
+
+function mockPage(overrides: Partial<AuditLogPage> = {}): AuditLogPage {
+  return { entries: [], total: 0, nextCursor: null, ...overrides };
+}
+
+function mockVerification(overrides: Partial<AuditChainVerification> = {}): AuditChainVerification {
+  return {
+    ok: true,
+    chainKey: 'tenant-a',
+    checked: 3,
+    range: { firstSeq: 1, lastSeq: 3 },
+    ...overrides,
+  };
+}
+
+function createReqRes(
+  overrides: {
+    params?: Record<string, string>;
+    query?: Record<string, string | string[]>;
+    user?: { _id?: Types.ObjectId; id?: string; role?: string; tenantId?: string } | undefined;
+  } = {},
+) {
+  const req = {
+    params: overrides.params ?? {},
+    query: overrides.query ?? {},
+    body: {},
+    user: 'user' in overrides ? overrides.user : { _id: new Types.ObjectId(), role: 'admin' },
+  } as unknown as ServerRequest;
+
+  const emitter = new EventEmitter();
+  const reqEmitter = new EventEmitter();
+  const json = jest.fn();
+  const status = jest.fn().mockReturnValue({ json });
+  const res = Object.assign(emitter, {
+    status,
+    json,
+    removeListener: emitter.removeListener.bind(emitter),
+  }) as unknown as Response;
+  const eventReq = Object.assign(reqEmitter, req, {
+    removeListener: reqEmitter.removeListener.bind(reqEmitter),
+  }) as unknown as ServerRequest;
+
+  return { req: eventReq, res, status, json, emitter, reqEmitter };
+}
+
+interface CsvCaptureContext {
+  req: ServerRequest;
+  res: Response;
+  emitter: EventEmitter;
+  reqEmitter: EventEmitter;
+  chunks: string[];
+  endCalled: () => boolean;
+  emitClose: () => void;
+}
+
+/**
+ * Wraps request/response in EventEmitter shims so the streaming handler can
+ * register `close` / `aborted` / `drain` listeners and the test can drive them.
+ */
+function createCsvContext(
+  overrides: {
+    query?: Record<string, string | string[]>;
+    user?: { _id?: Types.ObjectId; id?: string; role?: string; tenantId?: string } | undefined;
+    writeReturns?: boolean;
+  } = {},
+): CsvCaptureContext {
+  const emitter = new EventEmitter();
+  const reqEmitter = new EventEmitter();
+  const chunks: string[] = [];
+  let ended = false;
+
+  const res = Object.assign(emitter, {
+    setHeader: jest.fn(),
+    write: jest.fn((chunk: string) => {
+      chunks.push(chunk);
+      return overrides.writeReturns ?? true;
+    }),
+    end: jest.fn(() => {
+      ended = true;
+    }),
+    headersSent: false,
+    status: jest.fn().mockReturnValue({ json: jest.fn() }),
+    removeListener: emitter.removeListener.bind(emitter),
+  }) as unknown as Response;
+
+  const req = Object.assign(reqEmitter, {
+    params: {},
+    query: overrides.query ?? {},
+    body: {},
+    user: 'user' in overrides ? overrides.user : { _id: new Types.ObjectId(), role: 'admin' },
+    removeListener: reqEmitter.removeListener.bind(reqEmitter),
+  }) as unknown as ServerRequest;
+
+  return {
+    req,
+    res,
+    emitter,
+    reqEmitter,
+    chunks,
+    endCalled: () => ended,
+    emitClose: () => emitter.emit('close'),
+  };
+}
+
+function createDeps(overrides: Partial<AdminAuditLogDeps> = {}): AdminAuditLogDeps {
+  return {
+    listAuditLogPage: jest.fn<Promise<AuditLogPage>, unknown[]>().mockResolvedValue(mockPage()),
+    findAuditLogEntry: jest
+      .fn<Promise<AdminAuditLogEntry | null>, unknown[]>()
+      .mockResolvedValue(null),
+    streamAuditLogEntries: jest
+      .fn<Promise<{ count: number; truncated: boolean }>, unknown[]>()
+      .mockResolvedValue({ count: 0, truncated: false }),
+    verifyAuditChain: jest
+      .fn<Promise<AuditChainVerification>, unknown[]>()
+      .mockResolvedValue(mockVerification()),
+    ...overrides,
+  };
+}
+
+describe('createAdminAuditLogHandlers', () => {
+  describe('listAuditLog', () => {
+    it('returns 401 when req.user is missing', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status, json } = createReqRes({ user: undefined });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(401);
+      expect(json).toHaveBeenCalledWith({ error: 'Authentication required' });
+    });
+
+    it('returns 200 with the page payload', async () => {
+      const page = mockPage({ entries: [mockEntry()], total: 1, nextCursor: 5 });
+      const deps = createDeps({ listAuditLogPage: jest.fn().mockResolvedValue(page) });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status, json } = createReqRes();
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(200);
+      expect(json).toHaveBeenCalledWith(page);
+    });
+
+    it('rejects malformed `from` with 400', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status, json } = createReqRes({ query: { from: '2025-01-01 10:00' } });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+      expect(json.mock.calls[0][0].error).toMatch(/from/);
+      expect(deps.listAuditLogPage).not.toHaveBeenCalled();
+    });
+
+    it('rejects local-time ISO without a zone offset', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ query: { to: '2025-01-01T10:00:00' } });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+    });
+
+    it('accepts ISO timestamps with a `+HH:MM` offset', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ query: { from: '2025-01-01T10:00:00+02:00' } });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(200);
+    });
+
+    it('widens a date-only `to` filter to the end of the day UTC', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res } = createReqRes({ query: { to: '2025-01-15' } });
+      await handlers.listAuditLog(req, res);
+      const filtersArg = (deps.listAuditLogPage as jest.Mock).mock.calls[0][1];
+      expect((filtersArg.to as Date).toISOString()).toBe('2025-01-15T23:59:59.999Z');
+    });
+
+    it('rejects an inverted date range with 400', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({
+        query: { from: '2025-02-01', to: '2025-01-01' },
+      });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+    });
+
+    it('rejects an out-of-range date-only value instead of normalizing it', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status } = createReqRes({ query: { from: '2025-02-31' } });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+      expect(deps.listAuditLogPage).not.toHaveBeenCalled();
+    });
+
+    it('rejects an out-of-range day in a full ISO timestamp', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status } = createReqRes({ query: { to: '2025-02-31T00:00:00Z' } });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+      expect(deps.listAuditLogPage).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      ['action', { action: 'nope' }],
+      ['category', { category: 'nope' }],
+      ['outcome', { outcome: 'nope' }],
+      ['severity', { severity: 'nope' }],
+      ['actorType', { actorType: 'nope' }],
+    ])('rejects an unknown %s value with 400', async (_label, query) => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ query });
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+    });
+
+    it('passes a multi-value action filter through as an array', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res } = createReqRes({
+        query: { action: ['grant.assigned', 'grant.removed'] },
+      });
+      await handlers.listAuditLog(req, res);
+      const filtersArg = (deps.listAuditLogPage as jest.Mock).mock.calls[0][1];
+      expect(filtersArg.action).toEqual(['grant.assigned', 'grant.removed']);
+    });
+
+    it('rejects limit over the cap, negative offset, and cursor < 1', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const over = createReqRes({ query: { limit: '600' } });
+      await handlers.listAuditLog(over.req, over.res);
+      expect(over.status).toHaveBeenCalledWith(400);
+
+      const neg = createReqRes({ query: { offset: '-1' } });
+      await handlers.listAuditLog(neg.req, neg.res);
+      expect(neg.status).toHaveBeenCalledWith(400);
+
+      const badCursor = createReqRes({ query: { cursor: '0' } });
+      await handlers.listAuditLog(badCursor.req, badCursor.res);
+      expect(badCursor.status).toHaveBeenCalledWith(400);
+    });
+
+    it('passes limit/offset/cursor through to the data layer', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res } = createReqRes({ query: { limit: '10', cursor: '42' } });
+      await handlers.listAuditLog(req, res);
+      const filtersArg = (deps.listAuditLogPage as jest.Mock).mock.calls[0][1];
+      expect(filtersArg.limit).toBe(10);
+      expect(filtersArg.cursor).toBe(42);
+    });
+
+    it('sources tenant scope from the JWT and ignores a forged ?tenantId', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const req = {
+        params: {},
+        query: { tenantId: 'forged-tenant' },
+        body: {},
+        user: { _id: new Types.ObjectId(), role: 'admin', tenantId: 'real-tenant' },
+      } as unknown as ServerRequest;
+      const json = jest.fn();
+      const res = { status: jest.fn().mockReturnValue({ json }), json } as unknown as Response;
+      await handlers.listAuditLog(req, res);
+      expect((deps.listAuditLogPage as jest.Mock).mock.calls[0][0]).toBe('real-tenant');
+    });
+
+    it('returns 500 when the data layer throws', async () => {
+      const deps = createDeps({
+        listAuditLogPage: jest.fn().mockRejectedValue(new Error('db down')),
+      });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status } = createReqRes();
+      await handlers.listAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(500);
+    });
+  });
+
+  describe('getAuditLogEntry', () => {
+    it('returns 401 when unauthenticated', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ user: undefined, params: { id: validObjectId } });
+      await handlers.getAuditLogEntry(req, res);
+      expect(status).toHaveBeenCalledWith(401);
+    });
+
+    it('returns 400 for a non-ObjectId id', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ params: { id: 'nope' } });
+      await handlers.getAuditLogEntry(req, res);
+      expect(status).toHaveBeenCalledWith(400);
+    });
+
+    it('returns 404 when not found', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ params: { id: validObjectId } });
+      await handlers.getAuditLogEntry(req, res);
+      expect(status).toHaveBeenCalledWith(404);
+    });
+
+    it('returns 200 with the entry', async () => {
+      const entry = mockEntry();
+      const deps = createDeps({ findAuditLogEntry: jest.fn().mockResolvedValue(entry) });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status, json } = createReqRes({ params: { id: validObjectId } });
+      await handlers.getAuditLogEntry(req, res);
+      expect(status).toHaveBeenCalledWith(200);
+      expect(json).toHaveBeenCalledWith({ entry });
+    });
+  });
+
+  describe('verifyAuditLog', () => {
+    it('returns 401 when unauthenticated', async () => {
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      const { req, res, status } = createReqRes({ user: undefined });
+      await handlers.verifyAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(401);
+    });
+
+    it('returns the verification result scoped to the caller tenant', async () => {
+      const verification = mockVerification({ ok: false, brokenAt: 2, reason: 'hash mismatch' });
+      const deps = createDeps({ verifyAuditChain: jest.fn().mockResolvedValue(verification) });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status, json } = createReqRes({
+        user: { _id: new Types.ObjectId(), role: 'admin', tenantId: 'real-tenant' },
+      });
+      await handlers.verifyAuditLog(req, res);
+      expect((deps.verifyAuditChain as jest.Mock).mock.calls[0][0]).toBe('real-tenant');
+      expect((deps.verifyAuditChain as jest.Mock).mock.calls[0][1].maxRows).toBe(
+        MAX_AUDIT_VERIFY_ROWS,
+      );
+      expect(status).toHaveBeenCalledWith(200);
+      expect(json).toHaveBeenCalledWith(verification);
+    });
+
+    it('threads cancellation into verification and skips the response after client close', async () => {
+      const ctx = createReqRes();
+      const deps = createDeps({
+        verifyAuditChain: jest.fn(async (_tenantId, options) => {
+          ctx.emitter.emit('close');
+          options?.isCancelled?.();
+          return mockVerification({ ok: false, reason: 'verification cancelled' });
+        }),
+      });
+      const handlers = createAdminAuditLogHandlers(deps);
+      await handlers.verifyAuditLog(ctx.req, ctx.res);
+      const optionsArg = (deps.verifyAuditChain as jest.Mock).mock.calls[0][1];
+      expect(optionsArg.isCancelled()).toBe(true);
+      expect(ctx.status).not.toHaveBeenCalled();
+    });
+
+    it('returns 500 when verification throws', async () => {
+      const deps = createDeps({
+        verifyAuditChain: jest.fn().mockRejectedValue(new Error('boom')),
+      });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const { req, res, status } = createReqRes();
+      await handlers.verifyAuditLog(req, res);
+      expect(status).toHaveBeenCalledWith(500);
+    });
+  });
+
+  describe('exportAuditLogCsv', () => {
+    function streamFrom(entries: AdminAuditLogEntry[]): AdminAuditLogDeps['streamAuditLogEntries'] {
+      return jest.fn(async (_tenantId, _filters, onEntry, options) => {
+        let count = 0;
+        for (const entry of entries) {
+          if (options?.isCancelled?.()) break;
+          await onEntry(entry);
+          count++;
+        }
+        return { count, truncated: false };
+      });
+    }
+
+    it('returns 401 when unauthenticated', async () => {
+      const ctx = createCsvContext({ user: undefined });
+      const handlers = createAdminAuditLogHandlers(createDeps());
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      expect(ctx.res.status as jest.Mock).toHaveBeenCalledWith(401);
+    });
+
+    it('writes a BOM, header row, and CRLF line endings', async () => {
+      const deps = createDeps({ streamAuditLogEntries: streamFrom([mockEntry()]) });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext();
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      expect(ctx.chunks[0]).toBe('');
+      expect(ctx.chunks[1]).toContain('Timestamp');
+      expect(ctx.chunks[1]).toContain('Hash');
+      expect(ctx.chunks[2]).toBe('\r\n');
+      expect(ctx.endCalled()).toBe(true);
+    });
+
+    it('defangs formula-injection cells and quotes special characters', async () => {
+      const entry = mockEntry({
+        actor: { type: 'user', id: 'x', name: '=cmd()' },
+        target: { type: 'role', id: 'r', name: 'Ops, North' },
+      });
+      const deps = createDeps({ streamAuditLogEntries: streamFrom([entry]) });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext();
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      const body = ctx.chunks.join('');
+      expect(body).toContain("'=cmd()");
+      expect(body).toContain('"Ops, North"');
+    });
+
+    it('threads cancellation and a row cap into the stream', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext();
+      const promise = handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      ctx.emitClose();
+      await promise;
+      const streamMock = deps.streamAuditLogEntries as jest.Mock;
+      const optionsArg = streamMock.mock.calls[0][3];
+      expect(optionsArg.isCancelled()).toBe(true);
+      expect(optionsArg.maxRows).toBeGreaterThan(0);
+    });
+
+    it('returns 400 on malformed filters before streaming', async () => {
+      const deps = createDeps();
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext({ query: { from: 'garbage' } });
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      expect(ctx.res.status as jest.Mock).toHaveBeenCalledWith(400);
+      expect(deps.streamAuditLogEntries).not.toHaveBeenCalled();
+    });
+
+    it('appends an explicit marker when the export is truncated', async () => {
+      const deps = createDeps({
+        streamAuditLogEntries: jest
+          .fn()
+          .mockResolvedValue({ count: MAX_AUDIT_EXPORT_ROWS, truncated: true }),
+      });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext();
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      expect(ctx.chunks.join('')).toContain('TRUNCATED');
+      expect(ctx.endCalled()).toBe(true);
+    });
+
+    it('does not mark an exact-cap export as truncated', async () => {
+      const deps = createDeps({
+        streamAuditLogEntries: jest
+          .fn()
+          .mockResolvedValue({ count: MAX_AUDIT_EXPORT_ROWS, truncated: false }),
+      });
+      const handlers = createAdminAuditLogHandlers(deps);
+      const ctx = createCsvContext();
+      await handlers.exportAuditLogCsv(ctx.req, ctx.res);
+      expect(ctx.chunks.join('')).not.toContain('TRUNCATED');
+      expect(ctx.endCalled()).toBe(true);
+    });
+  });
+});
diff --git a/packages/api/src/admin/auditLog.ts b/packages/api/src/admin/auditLog.ts
new file mode 100644
index 00000000000..570e70ddf07
--- /dev/null
+++ b/packages/api/src/admin/auditLog.ts
@@ -0,0 +1,460 @@
+import {
+  logger,
+  AUDIT_ACTIONS,
+  AUDIT_CATEGORIES,
+  AUDIT_OUTCOMES,
+  AUDIT_SEVERITIES,
+  AUDIT_ACTOR_TYPES,
+  MAX_AUDIT_EXPORT_ROWS,
+  MAX_AUDIT_LOG_LIMIT,
+  MAX_AUDIT_VERIFY_ROWS,
+} from '@librechat/data-schemas';
+import type {
+  AdminAuditLogEntry,
+  AuditAction,
+  AuditActorType,
+  AuditCategory,
+  AuditChainVerification,
+  AuditLogFilters,
+  AuditLogPage,
+  AuditOutcome,
+  AuditSeverity,
+} from '@librechat/data-schemas';
+import type { Response } from 'express';
+import type { ServerRequest } from '~/types/http';
+
+const FORMULA_PREFIX = /^[=+\-@\t\r]/;
+/** UTF-8 BOM, written first so Excel recognizes the encoding on import. Spelled
+ * as a Unicode escape so readers can see the constant in editors that hide the
+ * zero-width glyph. */
+const CSV_BOM = '';
+
+const VALID_ACTIONS = new Set<string>(AUDIT_ACTIONS);
+const VALID_CATEGORIES = new Set<string>(AUDIT_CATEGORIES);
+const VALID_OUTCOMES = new Set<string>(AUDIT_OUTCOMES);
+const VALID_SEVERITIES = new Set<string>(AUDIT_SEVERITIES);
+const VALID_ACTOR_TYPES = new Set<string>(AUDIT_ACTOR_TYPES);
+
+/**
+ * Accepts `YYYY-MM-DD` (interpreted as UTC by the downstream Date parse) or a
+ * full ISO 8601 / RFC 3339 timestamp that includes either `Z` or a `±HH:MM`
+ * offset. Local-time strings without a zone are rejected so every input maps to
+ * an unambiguous instant.
+ */
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d{1,3})?)?(Z|[+-]\d{2}:\d{2}))?$/;
+const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
+const OBJECT_ID_RE = /^[a-fA-F0-9]{24}$/;
+
+export interface AdminAuditLogDeps {
+  listAuditLogPage: (
+    tenantId: string | undefined,
+    filters: AuditLogFilters,
+  ) => Promise<AuditLogPage>;
+  findAuditLogEntry: (
+    tenantId: string | undefined,
+    id: string,
+  ) => Promise<AdminAuditLogEntry | null>;
+  streamAuditLogEntries: (
+    tenantId: string | undefined,
+    filters: Omit<AuditLogFilters, 'offset' | 'limit' | 'cursor'>,
+    onEntry: (entry: AdminAuditLogEntry) => void | Promise<void>,
+    options?: { isCancelled?: () => boolean; maxRows?: number },
+  ) => Promise<{ count: number; truncated: boolean }>;
+  verifyAuditChain: (
+    tenantId: string | undefined,
+    options?: { isCancelled?: () => boolean; maxRows?: number },
+  ) => Promise<AuditChainVerification>;
+}
+
+interface CallerContext {
+  userId: string;
+  role: string;
+  tenantId?: string;
+}
+
+function resolveCaller(req: ServerRequest): CallerContext | null {
+  const user = req.user;
+  if (!user) return null;
+  const userId = user._id?.toString() ?? user.id;
+  if (!userId || !user.role) return null;
+  return { userId, role: user.role, tenantId: user.tenantId };
+}
+
+function asStringArray(v: unknown): string[] | undefined {
+  if (v == null) return undefined;
+  if (Array.isArray(v)) return v.filter((x): x is string => typeof x === 'string');
+  if (typeof v === 'string') return [v];
+  return undefined;
+}
+
+type ParseResult<T> = { ok: true; value: T } | { ok: false; error: string };
+
+/** Parses a repeatable enum filter (`?action=a&action=b`) against a whitelist. */
+function parseEnumArray<T extends string>(
+  raw: unknown,
+  valid: Set<string>,
+  label: string,
+): ParseResult<T[] | undefined> {
+  const arr = asStringArray(raw);
+  if (!arr || arr.length === 0) return { ok: true, value: undefined };
+  const invalid = arr.find((a) => !valid.has(a));
+  if (invalid != null) return { ok: false, error: `Unknown ${label}: ${invalid}` };
+  return { ok: true, value: arr as T[] };
+}
+
+function parseEnum<T extends string>(
+  raw: unknown,
+  valid: Set<string>,
+  label: string,
+): ParseResult<T | undefined> {
+  if (raw == null || raw === '') return { ok: true, value: undefined };
+  if (typeof raw !== 'string') return { ok: false, error: `${label} must be a string` };
+  if (!valid.has(raw)) return { ok: false, error: `Unknown ${label}: ${raw}` };
+  return { ok: true, value: raw as T };
+}
+
+/**
+ * Parses a filter date. `boundary` controls how a bare `YYYY-MM-DD` is widened:
+ * `start` leaves it at 00:00:00.000Z (default for `from`), `end` snaps it to
+ * 23:59:59.999Z so `to=2025-01-15` includes everything on January 15 instead of
+ * cutting off at midnight. Full ISO timestamps are honored exactly.
+ */
+function parseIsoDate(
+  raw: unknown,
+  boundary: 'start' | 'end' = 'start',
+): ParseResult<Date | undefined> {
+  if (raw == null || raw === '') return { ok: true, value: undefined };
+  if (typeof raw !== 'string') return { ok: false, error: 'Date must be a string' };
+  if (!ISO_DATE_RE.test(raw)) return { ok: false, error: 'Date must be ISO 8601' };
+  const d = new Date(raw);
+  if (Number.isNaN(d.getTime())) return { ok: false, error: 'Invalid date' };
+  /**
+   * `new Date('2025-02-31')` (and the timestamp form `2025-02-31T00:00:00Z`)
+   * silently normalizes to March 3 rather than throwing. Validate the literal
+   * calendar tokens — independent of any time/zone, so legitimate offset shifts
+   * are unaffected — so an out-of-range day is rejected instead of quietly
+   * shifting the queried window.
+   */
+  const [year, month, day] = raw.slice(0, 10).split('-').map(Number);
+  const lastDayOfMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+  if (month < 1 || month > 12 || day < 1 || day > lastDayOfMonth) {
+    return { ok: false, error: 'Invalid date' };
+  }
+  if (boundary === 'end' && DATE_ONLY_RE.test(raw)) {
+    d.setUTCHours(23, 59, 59, 999);
+  }
+  return { ok: true, value: d };
+}
+
+function parseIntInRange(
+  raw: unknown,
+  label: string,
+  min: number,
+  max?: number,
+): ParseResult<number | undefined> {
+  if (raw == null || raw === '') return { ok: true, value: undefined };
+  const n = typeof raw === 'number' ? raw : Number.parseInt(String(raw), 10);
+  if (!Number.isFinite(n)) return { ok: false, error: `${label} must be a number` };
+  if (n < min) return { ok: false, error: `${label} must be >= ${min}` };
+  if (max != null && n > max) return { ok: false, error: `${label} must be <= ${max}` };
+  return { ok: true, value: Math.floor(n) };
+}
+
+function pickString(raw: unknown, maxLen = 256): string | undefined {
+  if (typeof raw !== 'string') return undefined;
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  return trimmed.slice(0, maxLen);
+}
+
+function escapeCsvCell(value: string): string {
+  if (value === '') return '';
+  const guarded = FORMULA_PREFIX.test(value) ? `'${value}` : value;
+  if (/[",\n\r]/.test(guarded)) {
+    return `"${guarded.replace(/"/g, '""')}"`;
+  }
+  return guarded;
+}
+
+function stringifyMetaValue(value: unknown): string {
+  if (value == null) return '';
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+  return '';
+}
+
+const CSV_COLUMNS: ReadonlyArray<{ label: string; value: (e: AdminAuditLogEntry) => string }> = [
+  { label: 'Timestamp', value: (e) => e.timestamp },
+  { label: 'Category', value: (e) => e.category },
+  { label: 'Action', value: (e) => e.action },
+  { label: 'Outcome', value: (e) => e.outcome },
+  { label: 'Severity', value: (e) => e.severity },
+  { label: 'Actor type', value: (e) => e.actor.type },
+  { label: 'Actor', value: (e) => e.actor.name },
+  { label: 'Actor ID', value: (e) => e.actor.id ?? '' },
+  { label: 'Target type', value: (e) => e.target.type },
+  { label: 'Target', value: (e) => e.target.name ?? '' },
+  { label: 'Target ID', value: (e) => e.target.id ?? '' },
+  { label: 'Capability', value: (e) => stringifyMetaValue(e.metadata?.capability) },
+  { label: 'Details', value: (e) => (e.metadata ? JSON.stringify(e.metadata) : '') },
+  { label: 'IP', value: (e) => e.context?.ip ?? '' },
+  { label: 'Request ID', value: (e) => e.context?.requestId ?? '' },
+  { label: 'Seq', value: (e) => String(e.integrity.seq) },
+  { label: 'Hash', value: (e) => e.integrity.hash },
+];
+
+function formatCsvHeader(): string {
+  return CSV_COLUMNS.map((c) => escapeCsvCell(c.label)).join(',');
+}
+
+function formatCsvRow(entry: AdminAuditLogEntry): string {
+  return CSV_COLUMNS.map((c) => escapeCsvCell(c.value(entry))).join(',');
+}
+
+type ParsedFilters = Omit<AuditLogFilters, 'offset' | 'limit' | 'cursor'>;
+
+interface AuditLogQuery {
+  search?: string;
+  category?: string | string[];
+  action?: string | string[];
+  outcome?: string | string[];
+  severity?: string | string[];
+  actorType?: string;
+  actorQuery?: string;
+  targetType?: string;
+  targetQuery?: string;
+  capability?: string;
+  from?: string;
+  to?: string;
+  limit?: string;
+  offset?: string;
+  cursor?: string;
+}
+
+function parseFilters(query: AuditLogQuery): ParseResult<ParsedFilters> {
+  const from = parseIsoDate(query.from, 'start');
+  if (!from.ok) return { ok: false, error: `from: ${from.error}` };
+  const to = parseIsoDate(query.to, 'end');
+  if (!to.ok) return { ok: false, error: `to: ${to.error}` };
+  if (from.value && to.value && from.value > to.value) {
+    return { ok: false, error: '`from` must be earlier than `to`' };
+  }
+
+  const category = parseEnumArray<AuditCategory>(query.category, VALID_CATEGORIES, 'category');
+  if (!category.ok) return { ok: false, error: category.error };
+  const action = parseEnumArray<AuditAction>(query.action, VALID_ACTIONS, 'action');
+  if (!action.ok) return { ok: false, error: action.error };
+  const outcome = parseEnumArray<AuditOutcome>(query.outcome, VALID_OUTCOMES, 'outcome');
+  if (!outcome.ok) return { ok: false, error: outcome.error };
+  const severity = parseEnumArray<AuditSeverity>(query.severity, VALID_SEVERITIES, 'severity');
+  if (!severity.ok) return { ok: false, error: severity.error };
+  const actorType = parseEnum<AuditActorType>(query.actorType, VALID_ACTOR_TYPES, 'actorType');
+  if (!actorType.ok) return { ok: false, error: actorType.error };
+
+  return {
+    ok: true,
+    value: {
+      search: pickString(query.search, 200),
+      category: category.value,
+      action: action.value,
+      outcome: outcome.value,
+      severity: severity.value,
+      actorType: actorType.value,
+      actorQuery: pickString(query.actorQuery, 128),
+      targetType: pickString(query.targetType, 128),
+      targetQuery: pickString(query.targetQuery, 128),
+      capability: pickString(query.capability, 256),
+      from: from.value,
+      to: to.value,
+    },
+  };
+}
+
+export function createAdminAuditLogHandlers(deps: AdminAuditLogDeps): {
+  listAuditLog: (req: ServerRequest, res: Response) => Promise<Response>;
+  getAuditLogEntry: (req: ServerRequest, res: Response) => Promise<Response>;
+  verifyAuditLog: (req: ServerRequest, res: Response) => Promise<Response>;
+  exportAuditLogCsv: (req: ServerRequest, res: Response) => Promise<Response | void>;
+} {
+  const { listAuditLogPage, findAuditLogEntry, streamAuditLogEntries, verifyAuditChain } = deps;
+
+  async function listAuditLogHandler(req: ServerRequest, res: Response) {
+    try {
+      const caller = resolveCaller(req);
+      if (!caller) return res.status(401).json({ error: 'Authentication required' });
+
+      const query = req.query as AuditLogQuery;
+      const filters = parseFilters(query);
+      if (!filters.ok) return res.status(400).json({ error: filters.error });
+
+      const limit = parseIntInRange(query.limit, 'limit', 1, MAX_AUDIT_LOG_LIMIT);
+      if (!limit.ok) return res.status(400).json({ error: limit.error });
+      const offset = parseIntInRange(query.offset, 'offset', 0);
+      if (!offset.ok) return res.status(400).json({ error: offset.error });
+      const cursor = parseIntInRange(query.cursor, 'cursor', 1);
+      if (!cursor.ok) return res.status(400).json({ error: cursor.error });
+
+      const page = await listAuditLogPage(caller.tenantId, {
+        ...filters.value,
+        offset: offset.value,
+        limit: limit.value,
+        cursor: cursor.value,
+      });
+
+      return res.status(200).json(page);
+    } catch (err) {
+      logger.error('[adminAuditLog] list error:', err);
+      return res.status(500).json({ error: 'Failed to fetch audit log' });
+    }
+  }
+
+  async function getAuditLogEntryHandler(req: ServerRequest, res: Response) {
+    try {
+      const caller = resolveCaller(req);
+      if (!caller) return res.status(401).json({ error: 'Authentication required' });
+
+      const { id } = req.params as { id?: string };
+      if (!id || !OBJECT_ID_RE.test(id)) {
+        return res.status(400).json({ error: 'Invalid id' });
+      }
+
+      const entry = await findAuditLogEntry(caller.tenantId, id);
+      if (!entry) return res.status(404).json({ error: 'Not found' });
+      return res.status(200).json({ entry });
+    } catch (err) {
+      logger.error('[adminAuditLog] get error:', err);
+      return res.status(500).json({ error: 'Failed to fetch audit log entry' });
+    }
+  }
+
+  async function verifyAuditLogHandler(req: ServerRequest, res: Response) {
+    try {
+      const caller = resolveCaller(req);
+      if (!caller) return res.status(401).json({ error: 'Authentication required' });
+
+      let clientAborted = false;
+      const markAborted = () => {
+        clientAborted = true;
+      };
+      res.once('close', markAborted);
+      req.once('aborted', markAborted);
+
+      try {
+        const result = await verifyAuditChain(caller.tenantId, {
+          isCancelled: () => clientAborted,
+          maxRows: MAX_AUDIT_VERIFY_ROWS,
+        });
+
+        if (clientAborted) return res;
+        return res.status(200).json(result);
+      } finally {
+        res.removeListener('close', markAborted);
+        req.removeListener('aborted', markAborted);
+      }
+    } catch (err) {
+      logger.error('[adminAuditLog] verify error:', err);
+      return res.status(500).json({ error: 'Failed to verify audit log integrity' });
+    }
+  }
+
+  async function exportAuditLogCsvHandler(req: ServerRequest, res: Response) {
+    try {
+      const caller = resolveCaller(req);
+      if (!caller) return res.status(401).json({ error: 'Authentication required' });
+
+      const filters = parseFilters(req.query as AuditLogQuery);
+      if (!filters.ok) return res.status(400).json({ error: filters.error });
+
+      const filenameStamp = new Date().toISOString().slice(0, 10);
+      res.setHeader('Content-Type', 'text/csv; charset=utf-8');
+      res.setHeader('Content-Disposition', `attachment; filename="audit-log-${filenameStamp}.csv"`);
+      res.setHeader('Cache-Control', 'no-store');
+
+      /**
+       * The socket-`close` listener is the canonical signal — it fires on client
+       * TCP RST as well as on graceful end. `req.aborted` (deprecated) is kept as
+       * a belt-and-braces fallback for Node versions that emit it before the
+       * response sees `close`.
+       */
+      let clientAborted = false;
+      const markAborted = () => {
+        clientAborted = true;
+      };
+      res.once('close', markAborted);
+      req.once('aborted', markAborted);
+      const isCancelled = () => clientAborted;
+
+      /**
+       * Wait for `drain` when the socket buffer is full so we never queue an
+       * unbounded amount of CSV in Node memory for slow consumers. Race against
+       * `close` so a destroyed socket can't strand the handler on a `drain` that
+       * will never fire.
+       */
+      const writeChunk = (chunk: string): Promise<void> => {
+        if (clientAborted) return Promise.resolve();
+        if (res.write(chunk)) return Promise.resolve();
+        return new Promise<void>((resolve) => {
+          const onDrain = () => {
+            res.removeListener('close', onClose);
+            resolve();
+          };
+          const onClose = () => {
+            res.removeListener('drain', onDrain);
+            resolve();
+          };
+          res.once('drain', onDrain);
+          res.once('close', onClose);
+        });
+      };
+
+      await writeChunk(CSV_BOM);
+      await writeChunk(formatCsvHeader());
+      await writeChunk('\r\n');
+
+      const { truncated } = await streamAuditLogEntries(
+        caller.tenantId,
+        filters.value,
+        async (entry) => {
+          if (clientAborted) return;
+          await writeChunk(formatCsvRow(entry));
+          await writeChunk('\r\n');
+        },
+        { isCancelled, maxRows: MAX_AUDIT_EXPORT_ROWS },
+      );
+
+      res.removeListener('close', markAborted);
+      req.removeListener('aborted', markAborted);
+      if (!clientAborted) {
+        /**
+         * `truncated` is true only when rows existed beyond the cap (an exact-cap
+         * match is reported as complete). Surfacing this is a compliance
+         * requirement — a silently truncated export reads as a complete record.
+         * Emit an explicit trailing marker and log it; callers should narrow the
+         * date range for the full set.
+         */
+        if (truncated) {
+          logger.warn('[adminAuditLog] CSV export truncated at row cap', {
+            maxRows: MAX_AUDIT_EXPORT_ROWS,
+          });
+          await writeChunk(
+            `# TRUNCATED: export capped at ${MAX_AUDIT_EXPORT_ROWS} rows — narrow the from/to range to export the complete set\r\n`,
+          );
+        }
+        res.end();
+      }
+    } catch (err) {
+      logger.error('[adminAuditLog] export error:', err);
+      if (!res.headersSent) {
+        return res.status(500).json({ error: 'Failed to export audit log' });
+      }
+      res.end();
+    }
+  }
+
+  return {
+    listAuditLog: listAuditLogHandler,
+    getAuditLogEntry: getAuditLogEntryHandler,
+    verifyAuditLog: verifyAuditLogHandler,
+    exportAuditLogCsv: exportAuditLogCsvHandler,
+  };
+}
diff --git a/packages/api/src/admin/config.handler.spec.ts b/packages/api/src/admin/config.handler.spec.ts
index 8f4e2002a5a..b44ee085bac 100644
--- a/packages/api/src/admin/config.handler.spec.ts
+++ b/packages/api/src/admin/config.handler.spec.ts
@@ -49,10 +49,14 @@ function createHandlers(overrides = {}) {
     patchConfigFields: jest
       .fn()
       .mockResolvedValue({ _id: 'c1', overrides: { registration: { enabled: false } } }),
+    tombstoneConfigField: jest
+      .fn()
+      .mockResolvedValue({ _id: 'c1', tombstones: ['mcpServers.github'] }),
     unsetConfigField: jest.fn().mockResolvedValue({ _id: 'c1', overrides: {} }),
     deleteConfig: jest.fn().mockResolvedValue({ _id: 'c1' }),
     toggleConfigActive: jest.fn().mockResolvedValue({ _id: 'c1', isActive: false }),
     hasConfigCapability: jest.fn().mockResolvedValue(true),
+    hasCapability: jest.fn().mockResolvedValue(true),
 
     getAppConfig: jest.fn().mockResolvedValue({ interface: { modelSelect: true } }),
     ...overrides,
@@ -191,6 +195,29 @@ describe('createAdminConfigHandlers', () => {
       expect(savedOverrides.interface).toEqual({ modelSelect: false });
     });
 
+    it('preserves skillSync sections in admin overrides', async () => {
+      const { handlers, deps } = createHandlers({
+        upsertConfig: jest.fn().mockResolvedValue({ _id: 'c1', configVersion: 1 }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          overrides: {
+            skillSync: { github: { enabled: true } },
+            interface: { modelSelect: false },
+          },
+        },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(201);
+      const savedOverrides = deps.upsertConfig.mock.calls[0][3];
+      expect(savedOverrides.skillSync).toEqual({ github: { enabled: true } });
+      expect(savedOverrides.interface).toEqual({ modelSelect: false });
+    });
+
     it('preserves UI sub-keys in composite permission fields like mcpServers', async () => {
       const { handlers, deps } = createHandlers({
         upsertConfig: jest.fn().mockResolvedValue({ _id: 'c1', configVersion: 1 }),
@@ -335,6 +362,24 @@ describe('createAdminConfigHandlers', () => {
       expect(deps.unsetConfigField).not.toHaveBeenCalled();
     });
 
+    it('allows deleting skillSync field paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        query: { fieldPath: 'skillSync.github.enabled' },
+      });
+      const res = mockRes();
+
+      await handlers.deleteConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.unsetConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        'skillSync.github.enabled',
+      );
+    });
+
     it('allows deleting interface UI field paths', async () => {
       const { handlers, deps } = createHandlers();
       const req = mockReq({
@@ -377,6 +422,78 @@ describe('createAdminConfigHandlers', () => {
     });
   });
 
+  describe('tombstoneConfigField', () => {
+    it('writes an explicit tombstone for a valid field path', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.tombstoneConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        'mcpServers.github',
+        10,
+      );
+    });
+
+    it('uses the existing config priority when priority is omitted', async () => {
+      const { handlers, deps } = createHandlers({
+        findConfigByPrincipal: jest.fn().mockResolvedValue({ _id: 'c1', priority: 42 }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(deps.tombstoneConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        'mcpServers.github',
+        42,
+      );
+    });
+
+    it('blocks interface permission paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'interface.mcpServers.use' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.body!.message).toBeDefined();
+      expect(deps.tombstoneConfigField).not.toHaveBeenCalled();
+    });
+
+    it('rejects unsafe field paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: '__proto__.polluted' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(400);
+      expect(deps.tombstoneConfigField).not.toHaveBeenCalled();
+    });
+  });
+
   describe('patchConfigField', () => {
     it('returns 403 when user lacks capability for section', async () => {
       const { handlers } = createHandlers({
@@ -414,6 +531,27 @@ describe('createAdminConfigHandlers', () => {
       expect(patchedFields['interface.prompts']).toBeUndefined();
     });
 
+    it('preserves skillSync field entries in patches', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [
+            { fieldPath: 'skillSync.github.enabled', value: true },
+            { fieldPath: 'interface.modelSelect', value: false },
+          ],
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const patchedFields = deps.patchConfigFields.mock.calls[0][3];
+      expect(patchedFields['skillSync.github.enabled']).toBe(true);
+      expect(patchedFields['interface.modelSelect']).toBe(false);
+    });
+
     it('blocks peoplePicker permission sub-key paths', async () => {
       const { handlers, deps } = createHandlers();
       const req = mockReq({
@@ -510,10 +648,179 @@ describe('createAdminConfigHandlers', () => {
     });
   });
 
+  describe('patchConfigField: section-scoped priority preservation', () => {
+    it('ignores request-supplied priority when caller lacks broad manage:configs', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn(async (_user, section) => section === 'memory'),
+        findConfigByPrincipal: jest
+          .fn()
+          .mockResolvedValue({ _id: 'c1', priority: 7, overrides: {} }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [{ fieldPath: 'memory.context', value: 'updated' }],
+          priority: 999,
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.patchConfigFields.mock.calls[0];
+      expect(priorityArg).toBe(7);
+    });
+
+    it('falls back to default priority when no existing doc and caller lacks broad manage', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn(async (_user, section) => section === 'memory'),
+        findConfigByPrincipal: jest.fn().mockResolvedValue(null),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [{ fieldPath: 'memory.context', value: 'updated' }],
+          priority: 999,
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.patchConfigFields.mock.calls[0];
+      expect(priorityArg).toBe(10);
+    });
+
+    it('honors request-supplied priority when caller holds broad manage:configs', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [{ fieldPath: 'memory.context', value: 'updated' }],
+          priority: 999,
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.patchConfigFields.mock.calls[0];
+      expect(priorityArg).toBe(999);
+      expect(deps.findConfigByPrincipal).not.toHaveBeenCalled();
+    });
+
+    it('preserves priority 0 when broad caller supplies it', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [{ fieldPath: 'memory.context', value: 'updated' }],
+          priority: 0,
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.patchConfigFields.mock.calls[0];
+      expect(priorityArg).toBe(0);
+    });
+
+    it('preserves existing priority 0 for section-scoped callers', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn(async (_user, section) => section === 'memory'),
+        findConfigByPrincipal: jest
+          .fn()
+          .mockResolvedValue({ _id: 'c1', priority: 0, overrides: {} }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [{ fieldPath: 'memory.context', value: 'updated' }],
+          priority: 999,
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.patchConfigFields.mock.calls[0];
+      expect(priorityArg).toBe(0);
+    });
+  });
+
+  describe('tombstoneConfigField: section-scoped priority preservation', () => {
+    it('ignores request-supplied priority when caller lacks broad manage:configs', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn(async (_user, section) => section === 'memory'),
+        findConfigByPrincipal: jest
+          .fn()
+          .mockResolvedValue({ _id: 'c1', priority: 7, overrides: {} }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'memory.context', priority: 999 },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.tombstoneConfigField.mock.calls[0];
+      expect(priorityArg).toBe(7);
+    });
+
+    it('falls back to default priority when no existing doc and caller lacks broad manage', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn(async (_user, section) => section === 'memory'),
+        findConfigByPrincipal: jest.fn().mockResolvedValue(null),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'memory.context', priority: 999 },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.tombstoneConfigField.mock.calls[0];
+      expect(priorityArg).toBe(10);
+    });
+
+    it('honors request-supplied priority when caller holds broad manage:configs', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'memory.context', priority: 999 },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const [, , , , priorityArg] = deps.tombstoneConfigField.mock.calls[0];
+      expect(priorityArg).toBe(999);
+      expect(deps.findConfigByPrincipal).not.toHaveBeenCalled();
+    });
+  });
+
   describe('upsertConfigOverrides — Bug 2 regression', () => {
     it('returns 403 for empty overrides when user lacks MANAGE_CONFIGS', async () => {
       const { handlers } = createHandlers({
         hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(false),
       });
       const req = mockReq({
         params: { principalType: 'role', principalId: 'admin' },
@@ -548,7 +855,15 @@ describe('createAdminConfigHandlers', () => {
       expect(res.statusCode).toBe(201);
       expect(res.body).toHaveProperty('config');
       expect(res.body?.config).toHaveProperty('_id', 'c1');
-      expect(upsertConfig).toHaveBeenCalledWith('role', 'admin', expect.anything(), {}, 5);
+      expect(upsertConfig).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        {},
+        5,
+        undefined,
+        expect.objectContaining({ expectEmpty: expect.any(Boolean) }),
+      );
     });
 
     it('returns no-op message when overrides is empty and no priority is provided', async () => {
@@ -587,6 +902,7 @@ describe('createAdminConfigHandlers', () => {
     it('returns 403 for empty overrides with priority when user lacks MANAGE_CONFIGS', async () => {
       const { handlers } = createHandlers({
         hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(false),
       });
       const req = mockReq({
         params: { principalType: 'role', principalId: 'admin' },
@@ -641,6 +957,13 @@ describe('createAdminConfigHandlers', () => {
         query: { fieldPath: 'interface.modelSelect' },
       },
     },
+    {
+      name: 'tombstoneConfigField',
+      reqOverrides: {
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      },
+    },
     {
       name: 'deleteConfigOverrides',
       reqOverrides: {
@@ -656,28 +979,487 @@ describe('createAdminConfigHandlers', () => {
     },
   ];
 
-  describe('invariant: all mutation handlers return 401 without auth', () => {
-    for (const { name, reqOverrides } of MUTATION_HANDLERS) {
-      it(`${name} returns 401 when user is missing`, async () => {
-        const { handlers } = createHandlers();
-        const req = mockReq({ ...reqOverrides, user: undefined });
-        const res = mockRes();
+  describe('upsertConfigOverrides: scope-lifecycle auth (ASSIGN_CONFIGS)', () => {
+    it('allows empty-overrides scope creation when caller has ASSIGN_CONFIGS only', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
 
-        await (handlers as Record<string, (...args: unknown[]) => Promise<unknown>>)[name](
-          req,
-          res,
-        );
+      await handlers.upsertConfigOverrides(req, res);
 
-        expect(res.statusCode).toBe(401);
+      expect(res.statusCode).toBe(201);
+      expect(deps.upsertConfig).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        {},
+        10,
+        undefined,
+        { expectEmpty: true, preservePriority: true },
+      );
+    });
+
+    it('requests atomic priority preservation for ASSIGN_CONFIGS-only empty-overrides upsert', async () => {
+      const findConfigByPrincipal = jest
+        .fn()
+        .mockResolvedValue({ _id: 'c1', priority: 7, overrides: {} });
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        findConfigByPrincipal,
       });
-    }
-  });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 999 },
+      });
+      const res = mockRes();
 
-  describe('invariant: all mutation handlers return 403 without capability', () => {
-    for (const { name, reqOverrides } of MUTATION_HANDLERS) {
-      it(`${name} returns 403 when user lacks capability`, async () => {
-        const { handlers } = createHandlers({
-          hasConfigCapability: jest.fn().mockResolvedValue(false),
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(201);
+      expect(deps.upsertConfig).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        {},
+        10,
+        undefined,
+        { expectEmpty: true, preservePriority: true },
+      );
+      expect(findConfigByPrincipal).not.toHaveBeenCalled();
+    });
+
+    it('rejects non-empty overrides for ASSIGN_CONFIGS-only caller', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: { memory: { enabled: true } } },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).not.toHaveBeenCalled();
+    });
+
+    it('rejects empty-overrides scope creation when caller has neither grant', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(false),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('deleteConfigOverrides: accepts ASSIGN_CONFIGS', () => {
+    it('allows delete when caller has ASSIGN_CONFIGS only', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.deleteConfig).toHaveBeenCalled();
+    });
+
+    it('rejects delete when caller has neither broad manage nor ASSIGN_CONFIGS', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(false),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.deleteConfig).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('toggleConfig: accepts ASSIGN_CONFIGS', () => {
+    it('allows toggle when caller has ASSIGN_CONFIGS only', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { isActive: false },
+      });
+      const res = mockRes();
+
+      await handlers.toggleConfig(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.toggleConfigActive).toHaveBeenCalled();
+    });
+
+    it('rejects toggle when caller has neither broad manage nor ASSIGN_CONFIGS', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(false),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { isActive: false },
+      });
+      const res = mockRes();
+
+      await handlers.toggleConfig(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.toggleConfigActive).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('scope-lifecycle: parameterized assign:configs check', () => {
+    it('allows upsert when caller holds assign:configs:<principalType>', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn(async (_user, cap) => cap === 'assign:configs:role'),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(201);
+      expect(deps.upsertConfig).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        {},
+        10,
+        undefined,
+        { expectEmpty: true, preservePriority: true },
+      );
+    });
+
+    it('rejects upsert when parameterized grant targets a different principalType', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn(async (_user, cap) => cap === 'assign:configs:user'),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).not.toHaveBeenCalled();
+    });
+
+    it('queries hasCapability with the principalType-parameterized form', async () => {
+      const hasCap = jest.fn().mockResolvedValue(true);
+      const { handlers } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: hasCap,
+      });
+      const req = mockReq({
+        params: { principalType: 'group', principalId: 'engineers' },
+        body: { isActive: false },
+      });
+      const res = mockRes();
+
+      await handlers.toggleConfig(req, res);
+
+      const queriedCapabilities = hasCap.mock.calls.map((call) => call[1]);
+      expect(queriedCapabilities).toContain('assign:configs:group');
+    });
+  });
+
+  describe('scope-lifecycle: __base__ short-circuit', () => {
+    it('upsert against __base__ returns 403 for assign-only caller', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: '__base__' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).not.toHaveBeenCalled();
+    });
+
+    it('delete against __base__ returns 403 for assign-only caller', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: '__base__' },
+      });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.deleteConfig).not.toHaveBeenCalled();
+    });
+
+    it('toggle against __base__ returns 403 for assign-only caller', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: '__base__' },
+        body: { isActive: false },
+      });
+      const res = mockRes();
+
+      await handlers.toggleConfig(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.toggleConfigActive).not.toHaveBeenCalled();
+    });
+
+    it('upsert against __base__ succeeds for broad-manage caller', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(true),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: '__base__' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(201);
+      expect(deps.upsertConfig).toHaveBeenCalled();
+    });
+  });
+
+  describe('scope-lifecycle: atomic empty-state guard for assign-only callers', () => {
+    it('empty-overrides upsert is rejected when atomic filter mismatches (existing doc not empty)', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        upsertConfig: jest.fn(async (_pt, _pi, _pm, _o, _p, _session, opts) => {
+          return opts?.expectEmpty ? null : { _id: 'c1', configVersion: 1 };
+        }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        expect.anything(),
+        expect.anything(),
+        expect.anything(),
+        undefined,
+        { expectEmpty: true, preservePriority: true },
+      );
+    });
+
+    it('delete is rejected with 403 when atomic filter mismatches and doc still exists', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        deleteConfig: jest.fn(async (_pt, _pi, _session, opts) => {
+          return opts?.expectEmpty ? null : { _id: 'c1' };
+        }),
+        findConfigByPrincipal: jest.fn().mockResolvedValue({
+          _id: 'c1',
+          overrides: { endpoints: { custom: true } },
+        }),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.deleteConfig).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        undefined,
+        { expectEmpty: true },
+      );
+    });
+
+    it('toggle is rejected with 403 when atomic filter mismatches and doc still exists', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        toggleConfigActive: jest.fn(async (_pt, _pi, _isActive, _session, opts) => {
+          return opts?.expectEmpty ? null : { _id: 'c1', isActive: false };
+        }),
+        findConfigByPrincipal: jest.fn().mockResolvedValue({
+          _id: 'c1',
+          tombstones: ['endpoints.openai.apiKey'],
+        }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { isActive: false },
+      });
+      const res = mockRes();
+
+      await handlers.toggleConfig(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.toggleConfigActive).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        expect.anything(),
+        undefined,
+        { expectEmpty: true },
+      );
+    });
+
+    it('delete returns 404 when atomic filter mismatches and doc does not exist', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        deleteConfig: jest.fn().mockResolvedValue(null),
+        findConfigByPrincipal: jest.fn().mockResolvedValue(null),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(404);
+      expect(deps.findConfigByPrincipal).toHaveBeenCalled();
+    });
+
+    it('delete succeeds for assign-only caller when atomic filter matches', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+        hasCapability: jest.fn().mockResolvedValue(true),
+        deleteConfig: jest.fn().mockResolvedValue({ _id: 'c1', overrides: {} }),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.deleteConfig).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        undefined,
+        { expectEmpty: true },
+      );
+    });
+
+    it('broad-manage caller calls destructive op without expectEmpty option', async () => {
+      const { handlers, deps } = createHandlers({
+        hasConfigCapability: jest.fn().mockResolvedValue(true),
+        deleteConfig: jest.fn().mockResolvedValue({
+          _id: 'c1',
+          overrides: { endpoints: { custom: true } },
+        }),
+      });
+      const req = mockReq({ params: { principalType: 'role', principalId: 'admin' } });
+      const res = mockRes();
+
+      await handlers.deleteConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.deleteConfig).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        undefined,
+        { expectEmpty: false },
+      );
+    });
+  });
+
+  describe('AdminConfigDeps.hasCapability is optional', () => {
+    it('factory accepts deps without hasCapability and falls back to broad-manage-only auth', async () => {
+      const deps = {
+        listAllConfigs: jest.fn().mockResolvedValue([]),
+        findConfigByPrincipal: jest.fn().mockResolvedValue(null),
+        upsertConfig: jest.fn().mockResolvedValue({ _id: 'c1', configVersion: 1 }),
+        patchConfigFields: jest.fn(),
+        tombstoneConfigField: jest.fn(),
+        unsetConfigField: jest.fn(),
+        deleteConfig: jest.fn().mockResolvedValue({ _id: 'c1' }),
+        toggleConfigActive: jest.fn().mockResolvedValue({ _id: 'c1', isActive: false }),
+        hasConfigCapability: jest.fn().mockResolvedValue(false),
+      };
+      const handlers = createAdminConfigHandlers(deps);
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { overrides: {}, priority: 5 },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(403);
+      expect(deps.upsertConfig).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('invariant: all mutation handlers return 401 without auth', () => {
+    for (const { name, reqOverrides } of MUTATION_HANDLERS) {
+      it(`${name} returns 401 when user is missing`, async () => {
+        const { handlers } = createHandlers();
+        const req = mockReq({ ...reqOverrides, user: undefined });
+        const res = mockRes();
+
+        await (handlers as Record<string, (...args: unknown[]) => Promise<unknown>>)[name](
+          req,
+          res,
+        );
+
+        expect(res.statusCode).toBe(401);
+      });
+    }
+  });
+
+  describe('invariant: all mutation handlers return 403 without capability', () => {
+    for (const { name, reqOverrides } of MUTATION_HANDLERS) {
+      it(`${name} returns 403 when user lacks capability`, async () => {
+        const { handlers } = createHandlers({
+          hasConfigCapability: jest.fn().mockResolvedValue(false),
+          hasCapability: jest.fn().mockResolvedValue(false),
         });
         const req = mockReq(reqOverrides);
         const res = mockRes();
@@ -769,5 +1551,40 @@ describe('createAdminConfigHandlers', () => {
       expect(res.statusCode).toBe(200);
       expect(res.body!.config).toEqual({ interface: { modelSelect: true } });
     });
+
+    it('forwards baseOnly=true to getAppConfig when query param is the literal string "true"', async () => {
+      const getAppConfig = jest.fn().mockResolvedValue({ interface: { modelSelect: true } });
+      const { handlers } = createHandlers({ getAppConfig });
+      const req = mockReq({ query: { baseOnly: 'true' } });
+      const res = mockRes();
+
+      await handlers.getBaseConfig(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(getAppConfig).toHaveBeenCalledWith(expect.objectContaining({ baseOnly: true }));
+    });
+
+    it('forwards baseOnly=false when the query param is missing, non-"true", or an array', async () => {
+      const cases: Array<Record<string, unknown>> = [
+        {},
+        { baseOnly: 'false' },
+        { baseOnly: '1' },
+        { baseOnly: ['true'] },
+        { baseOnly: ['true', 'true'] },
+        { baseOnly: { nested: 'true' } },
+      ];
+
+      for (const query of cases) {
+        const getAppConfig = jest.fn().mockResolvedValue({ interface: { modelSelect: true } });
+        const { handlers } = createHandlers({ getAppConfig });
+        const req = mockReq({ query });
+        const res = mockRes();
+
+        await handlers.getBaseConfig(req, res);
+
+        expect(res.statusCode).toBe(200);
+        expect(getAppConfig).toHaveBeenCalledWith(expect.objectContaining({ baseOnly: false }));
+      }
+    });
   });
 });
diff --git a/packages/api/src/admin/config.ts b/packages/api/src/admin/config.ts
index c1ce2cb13fc..30d3a4d79c0 100644
--- a/packages/api/src/admin/config.ts
+++ b/packages/api/src/admin/config.ts
@@ -1,12 +1,13 @@
-import { logger } from '@librechat/data-schemas';
+import { logger, BASE_CONFIG_PRINCIPAL_ID } from '@librechat/data-schemas';
 import {
+  BASE_ONLY_CONFIG_SECTIONS,
   PrincipalType,
   PrincipalModel,
   INTERFACE_PERMISSION_FIELDS,
   PERMISSION_SUB_KEYS,
 } from 'librechat-data-provider';
+import type { AppConfig, ConfigSection, IConfig, SystemCapability } from '@librechat/data-schemas';
 import type { TCustomConfig } from 'librechat-data-provider';
-import type { AppConfig, ConfigSection, IConfig } from '@librechat/data-schemas';
 import type { Types, ClientSession } from 'mongoose';
 import type { Response } from 'express';
 import type { CapabilityUser } from '~/middleware/capabilities';
@@ -15,6 +16,7 @@ import type { ServerRequest } from '~/types/http';
 const UNSAFE_SEGMENTS = /(?:^|\.)(__[\w]*|constructor|prototype)(?:\.|$)/;
 const MAX_PATCH_ENTRIES = 100;
 const DEFAULT_PRIORITY = 10;
+const BASE_ONLY_OVERRIDE_SECTIONS = new Set<string>(BASE_ONLY_CONFIG_SECTIONS);
 
 export function isValidFieldPath(path: string): boolean {
   return (
@@ -31,6 +33,10 @@ export function getTopLevelSection(fieldPath: string): string {
   return fieldPath.split('.')[0];
 }
 
+function isBaseOnlyFieldPath(fieldPath: string): boolean {
+  return BASE_ONLY_OVERRIDE_SECTIONS.has(getTopLevelSection(fieldPath));
+}
+
 /**
  * Returns true if `fieldPath` targets an interface permission field or permission sub-key.
  *
@@ -73,6 +79,7 @@ export interface AdminConfigDeps {
     overrides: Partial<TCustomConfig>,
     priority: number,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean; preservePriority?: boolean },
   ) => Promise<IConfig | null>;
   patchConfigFields: (
     principalType: PrincipalType,
@@ -82,6 +89,14 @@ export interface AdminConfigDeps {
     priority: number,
     session?: ClientSession,
   ) => Promise<IConfig | null>;
+  tombstoneConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
   unsetConfigField: (
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
@@ -92,22 +107,26 @@ export interface AdminConfigDeps {
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean },
   ) => Promise<IConfig | null>;
   toggleConfigActive: (
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
     isActive: boolean,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean },
   ) => Promise<IConfig | null>;
   hasConfigCapability: (
     user: CapabilityUser,
     section: ConfigSection | null,
     verb?: 'manage' | 'read',
   ) => Promise<boolean>;
+  hasCapability?: (user: CapabilityUser, capability: SystemCapability) => Promise<boolean>;
   getAppConfig?: (options?: {
     role?: string;
     userId?: string;
     tenantId?: string;
+    baseOnly?: boolean;
   }) => Promise<AppConfig>;
   /** Invalidate all config-related caches after a mutation. */
   invalidateConfigCaches?: (tenantId?: string) => Promise<void>;
@@ -156,16 +175,28 @@ function getCapabilityUser(req: ServerRequest): CapabilityUser | null {
 
 // ── Handler factory ──────────────────────────────────────────────────
 
-export function createAdminConfigHandlers(deps: AdminConfigDeps) {
+export function createAdminConfigHandlers(deps: AdminConfigDeps): {
+  listConfigs: (req: ServerRequest, res: Response) => Promise<Response>;
+  getBaseConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+  getConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+  upsertConfigOverrides: (req: ServerRequest, res: Response) => Promise<Response>;
+  patchConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  tombstoneConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteConfigOverrides: (req: ServerRequest, res: Response) => Promise<Response>;
+  toggleConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listAllConfigs,
     findConfigByPrincipal,
     upsertConfig,
     patchConfigFields,
+    tombstoneConfigField: writeConfigTombstone,
     unsetConfigField,
     deleteConfig,
     toggleConfigActive,
     hasConfigCapability,
+    hasCapability = async () => false,
     getAppConfig,
     invalidateConfigCaches,
   } = deps;
@@ -173,7 +204,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * GET / — List all active config overrides.
    */
-  async function listConfigs(req: ServerRequest, res: Response) {
+  async function listConfigs(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const user = getCapabilityUser(req);
       if (!user) {
@@ -196,7 +227,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
    * GET /base — Return the raw AppConfig (YAML + DB base merged).
    * This is the full config structure admins can edit, NOT the startup payload.
    */
-  async function getBaseConfig(req: ServerRequest, res: Response) {
+  async function getBaseConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const user = getCapabilityUser(req);
       if (!user) {
@@ -211,8 +242,10 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(501).json({ error: 'Base config endpoint not configured' });
       }
 
+      const baseOnly = (req.query as Record<string, unknown>).baseOnly === 'true';
       const appConfig = await getAppConfig({
         tenantId: user.tenantId,
+        baseOnly,
       });
       return res.status(200).json({ config: appConfig });
     } catch (error) {
@@ -224,7 +257,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * GET /:principalType/:principalId — Get config for a specific principal.
    */
-  async function getConfig(req: ServerRequest, res: Response) {
+  async function getConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -261,7 +294,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PUT /:principalType/:principalId — Replace entire overrides for a principal.
    */
-  async function upsertConfigOverrides(req: ServerRequest, res: Response) {
+  async function upsertConfigOverrides(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -290,11 +323,31 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(401).json({ error: 'Authentication required' });
       }
 
-      if (!(await hasConfigCapability(user, null, 'manage'))) {
+      const hasBroadManage = await hasConfigCapability(user, null, 'manage');
+
+      if (principalId === BASE_CONFIG_PRINCIPAL_ID && !hasBroadManage) {
+        return res.status(403).json({ error: 'Insufficient permissions' });
+      }
+
+      const hasAssignConfigs =
+        hasBroadManage ||
+        (await hasCapability(user, `assign:configs:${principalType}` as SystemCapability));
+
+      if (!hasAssignConfigs) {
         return res.status(403).json({ error: 'Insufficient permissions' });
       }
 
-      let filteredOverrides = overrides;
+      const filteredOverrides = {
+        ...(overrides as Record<string, unknown>),
+      } as Partial<TCustomConfig>;
+      for (const section of BASE_ONLY_OVERRIDE_SECTIONS) {
+        if (section in filteredOverrides) {
+          delete (filteredOverrides as Record<string, unknown>)[section];
+          logger.warn(
+            `[adminConfig] Stripping base-only config section "${section}" - configure it in librechat.yaml instead`,
+          );
+        }
+      }
       const iface = (overrides as Record<string, unknown>).interface;
       if (iface != null && typeof iface === 'object' && !Array.isArray(iface)) {
         const filteredIface: Record<string, unknown> = {};
@@ -323,7 +376,6 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
             );
           }
         }
-        filteredOverrides = { ...(overrides as Record<string, unknown>) } as Partial<TCustomConfig>;
         if (Object.keys(filteredIface).length > 0) {
           (filteredOverrides as Record<string, unknown>).interface = filteredIface;
         } else {
@@ -337,25 +389,33 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(200).json({ message: 'No actionable override sections provided' });
       }
 
-      if (overrideSections.length > 0) {
-        const allowed = await Promise.all(
-          overrideSections.map((s) => hasConfigCapability(user, s as ConfigSection, 'manage')),
+      if (overrideSections.length > 0 && !hasBroadManage) {
+        return res.status(403).json({ error: 'Insufficient permissions' });
+      }
+
+      if (priority != null && !hasBroadManage) {
+        logger.warn(
+          `[adminConfig] Ignoring caller-supplied priority on assign-only scope lifecycle upsert to ${principalType}/${principalId}: only broad manage:configs may modify document priority`,
         );
-        const denied = overrideSections.find((_, i) => !allowed[i]);
-        if (denied) {
-          return res.status(403).json({
-            error: `Insufficient permissions for config section: ${denied}`,
-          });
-        }
       }
 
+      const requestedPriority = hasBroadManage ? (priority ?? DEFAULT_PRIORITY) : DEFAULT_PRIORITY;
+      const upsertOptions = hasBroadManage
+        ? { expectEmpty: false }
+        : { expectEmpty: true, preservePriority: true };
+
       const config = await upsertConfig(
         principalType,
         principalId,
         principalModel(principalType),
         filteredOverrides,
-        priority ?? DEFAULT_PRIORITY,
+        requestedPriority,
+        undefined,
+        upsertOptions,
       );
+      if (!config && !hasBroadManage) {
+        return res.status(403).json({ error: 'Insufficient permissions' });
+      }
 
       invalidateConfigCaches?.(user.tenantId)?.catch((err) =>
         logger.error('[adminConfig] Cache invalidation failed after upsert:', err),
@@ -370,7 +430,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PATCH /:principalType/:principalId/fields — Set individual fields via dot-paths.
    */
-  async function patchConfigField(req: ServerRequest, res: Response) {
+  async function patchConfigField(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -414,6 +474,12 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
       }
 
       const validEntries = entries.filter((entry) => {
+        if (isBaseOnlyFieldPath(entry.fieldPath)) {
+          logger.warn(
+            `[adminConfig] Stripping base-only config field "${entry.fieldPath}" - configure it in librechat.yaml instead`,
+          );
+          return false;
+        }
         if (isInterfacePermissionPath(entry.fieldPath)) {
           logger.warn(
             `[adminConfig] Stripping interface permission field "${entry.fieldPath}" — use role permissions instead`,
@@ -423,14 +489,16 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return true;
       });
 
+      const hasBroadManage = await hasConfigCapability(user, null, 'manage');
+
       if (validEntries.length === 0) {
-        if (!(await hasConfigCapability(user, null, 'manage'))) {
+        if (!hasBroadManage) {
           return res.status(403).json({ error: 'Insufficient permissions' });
         }
         return res.status(200).json({ message: 'No actionable field entries provided' });
       }
 
-      if (!(await hasConfigCapability(user, null, 'manage'))) {
+      if (!hasBroadManage) {
         const sections = [...new Set(validEntries.map((e) => getTopLevelSection(e.fieldPath)))];
         const allowed = await Promise.all(
           sections.map((s) => hasConfigCapability(user, s as ConfigSection, 'manage')),
@@ -453,8 +521,15 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         fields[entry.fieldPath] = entry.value;
       }
 
+      if (priority != null && !hasBroadManage) {
+        logger.warn(
+          `[adminConfig] Ignoring caller-supplied priority on section-scoped patch to ${principalType}/${principalId}: only broad manage:configs may modify document priority`,
+        );
+      }
+      const requestedPriority = hasBroadManage ? priority : undefined;
+
       const existing =
-        priority == null
+        requestedPriority == null
           ? await findConfigByPrincipal(principalType, principalId, { includeInactive: true })
           : null;
 
@@ -463,7 +538,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         principalId,
         principalModel(principalType),
         fields,
-        priority ?? existing?.priority ?? DEFAULT_PRIORITY,
+        requestedPriority ?? existing?.priority ?? DEFAULT_PRIORITY,
       );
 
       invalidateConfigCaches?.(user.tenantId)?.catch((err) =>
@@ -476,10 +551,95 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
     }
   }
 
+  /**
+   * POST /:principalType/:principalId/fields/tombstone — Suppress an inherited config path.
+   */
+  async function tombstoneConfigField(req: ServerRequest, res: Response): Promise<Response> {
+    try {
+      const { principalType, principalId } = req.params as {
+        principalType: string;
+        principalId: string;
+      };
+
+      if (!validatePrincipalType(principalType)) {
+        return res.status(400).json({ error: `Invalid principalType: ${principalType}` });
+      }
+
+      const { fieldPath, priority } = req.body as {
+        fieldPath?: string;
+        priority?: number;
+      };
+
+      if (!fieldPath || typeof fieldPath !== 'string') {
+        return res.status(400).json({ error: 'fieldPath is required' });
+      }
+
+      if (priority != null && (typeof priority !== 'number' || priority < 0)) {
+        return res.status(400).json({ error: 'priority must be a non-negative number' });
+      }
+
+      if (!isValidFieldPath(fieldPath)) {
+        return res.status(400).json({ error: `Invalid or unsafe field path: ${fieldPath}` });
+      }
+
+      const user = getCapabilityUser(req);
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required' });
+      }
+
+      const section = getTopLevelSection(fieldPath);
+
+      const hasBroadManage = await hasConfigCapability(user, null, 'manage');
+      if (
+        !hasBroadManage &&
+        !(await hasConfigCapability(user, section as ConfigSection, 'manage'))
+      ) {
+        return res.status(403).json({
+          error: `Insufficient permissions for config section: ${section}`,
+        });
+      }
+
+      if (isInterfacePermissionPath(fieldPath)) {
+        logger.warn(
+          `[adminConfig] Ignoring tombstone for interface permission field "${fieldPath}" — use role permissions instead`,
+        );
+        return res.status(200).json({ message: 'No actionable field path provided' });
+      }
+
+      if (priority != null && !hasBroadManage) {
+        logger.warn(
+          `[adminConfig] Ignoring caller-supplied priority on section-scoped tombstone for ${principalType}/${principalId}: only broad manage:configs may modify document priority`,
+        );
+      }
+      const requestedPriority = hasBroadManage ? priority : undefined;
+
+      const existing =
+        requestedPriority == null
+          ? await findConfigByPrincipal(principalType, principalId, { includeInactive: true })
+          : null;
+
+      const config = await writeConfigTombstone(
+        principalType,
+        principalId,
+        principalModel(principalType),
+        fieldPath,
+        requestedPriority ?? existing?.priority ?? DEFAULT_PRIORITY,
+      );
+
+      invalidateConfigCaches?.(user.tenantId)?.catch((err) =>
+        logger.error('[adminConfig] Cache invalidation failed after field tombstone:', err),
+      );
+      return res.status(200).json({ config });
+    } catch (error) {
+      logger.error('[adminConfig] tombstoneConfigField error:', error);
+      return res.status(500).json({ error: 'Failed to tombstone config field' });
+    }
+  }
+
   /**
    * DELETE /:principalType/:principalId/fields?fieldPath=dotted.path
    */
-  async function deleteConfigField(req: ServerRequest, res: Response) {
+  async function deleteConfigField(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -512,6 +672,13 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         });
       }
 
+      if (isBaseOnlyFieldPath(fieldPath)) {
+        logger.warn(
+          `[adminConfig] Ignoring delete for base-only config field "${fieldPath}" - configure it in librechat.yaml instead`,
+        );
+        return res.status(200).json({ message: 'No actionable field path provided' });
+      }
+
       if (isInterfacePermissionPath(fieldPath)) {
         logger.warn(
           `[adminConfig] Ignoring delete for interface permission field "${fieldPath}" — use role permissions instead`,
@@ -537,7 +704,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * DELETE /:principalType/:principalId — Delete an entire config override.
    */
-  async function deleteConfigOverrides(req: ServerRequest, res: Response) {
+  async function deleteConfigOverrides(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -553,12 +720,31 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(401).json({ error: 'Authentication required' });
       }
 
-      if (!(await hasConfigCapability(user, null, 'manage'))) {
+      const hasBroadManage = await hasConfigCapability(user, null, 'manage');
+
+      if (principalId === BASE_CONFIG_PRINCIPAL_ID && !hasBroadManage) {
         return res.status(403).json({ error: 'Insufficient permissions' });
       }
 
-      const config = await deleteConfig(principalType, principalId);
+      const allowed =
+        hasBroadManage ||
+        (await hasCapability(user, `assign:configs:${principalType}` as SystemCapability));
+      if (!allowed) {
+        return res.status(403).json({ error: 'Insufficient permissions' });
+      }
+
+      const config = await deleteConfig(principalType, principalId, undefined, {
+        expectEmpty: !hasBroadManage,
+      });
       if (!config) {
+        if (!hasBroadManage) {
+          const exists = await findConfigByPrincipal(principalType, principalId, {
+            includeInactive: true,
+          });
+          if (exists) {
+            return res.status(403).json({ error: 'Insufficient permissions' });
+          }
+        }
         return res.status(404).json({ error: 'Config not found' });
       }
 
@@ -575,7 +761,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PATCH /:principalType/:principalId/active — Toggle isActive.
    */
-  async function toggleConfig(req: ServerRequest, res: Response) {
+  async function toggleConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -596,12 +782,31 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(401).json({ error: 'Authentication required' });
       }
 
-      if (!(await hasConfigCapability(user, null, 'manage'))) {
+      const hasBroadManage = await hasConfigCapability(user, null, 'manage');
+
+      if (principalId === BASE_CONFIG_PRINCIPAL_ID && !hasBroadManage) {
         return res.status(403).json({ error: 'Insufficient permissions' });
       }
 
-      const config = await toggleConfigActive(principalType, principalId, isActive);
+      const allowed =
+        hasBroadManage ||
+        (await hasCapability(user, `assign:configs:${principalType}` as SystemCapability));
+      if (!allowed) {
+        return res.status(403).json({ error: 'Insufficient permissions' });
+      }
+
+      const config = await toggleConfigActive(principalType, principalId, isActive, undefined, {
+        expectEmpty: !hasBroadManage,
+      });
       if (!config) {
+        if (!hasBroadManage) {
+          const exists = await findConfigByPrincipal(principalType, principalId, {
+            includeInactive: true,
+          });
+          if (exists) {
+            return res.status(403).json({ error: 'Insufficient permissions' });
+          }
+        }
         return res.status(404).json({ error: 'Config not found' });
       }
 
@@ -621,6 +826,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
     getConfig,
     upsertConfigOverrides,
     patchConfigField,
+    tombstoneConfigField,
     deleteConfigField,
     deleteConfigOverrides,
     toggleConfig,
diff --git a/packages/api/src/admin/context.ts b/packages/api/src/admin/context.ts
new file mode 100644
index 00000000000..2ab67107534
--- /dev/null
+++ b/packages/api/src/admin/context.ts
@@ -0,0 +1,21 @@
+import type { AuditContext } from '@librechat/data-schemas';
+import type { ServerRequest } from '~/types/http';
+
+/** Normalizes a possibly-repeated header to its first string value. */
+function firstHeaderValue(value: string | string[] | undefined): string | undefined {
+  if (Array.isArray(value)) return value[0];
+  return typeof value === 'string' ? value : undefined;
+}
+
+/** Extracts forensic request context (IP, user agent, correlation id) for an
+ * audit record. Fields are undefined when the data isn't available. */
+export function buildAuditContext(req: ServerRequest): AuditContext {
+  const headers = req.headers ?? {};
+  const forwarded = firstHeaderValue(headers['x-forwarded-for']);
+  const forwardedIp = forwarded ? forwarded.split(',')[0]?.trim() : undefined;
+  return {
+    ip: req.ip || forwardedIp || req.socket?.remoteAddress || undefined,
+    userAgent: firstHeaderValue(headers['user-agent']),
+    requestId: firstHeaderValue(headers['x-request-id'] ?? headers['x-correlation-id']),
+  };
+}
diff --git a/packages/api/src/admin/grants.spec.ts b/packages/api/src/admin/grants.spec.ts
index cd6d1e8d38b..fd22a2c7f39 100644
--- a/packages/api/src/admin/grants.spec.ts
+++ b/packages/api/src/admin/grants.spec.ts
@@ -53,8 +53,8 @@ function createDeps(overrides: Partial<AdminGrantsDeps> = {}): AdminGrantsDeps {
     countGrants: jest.fn().mockResolvedValue(0),
     getCapabilitiesForPrincipal: jest.fn().mockResolvedValue([]),
     getCapabilitiesForPrincipals: jest.fn().mockResolvedValue([]),
-    grantCapability: jest.fn().mockResolvedValue(mockGrant()),
-    revokeCapability: jest.fn().mockResolvedValue(undefined),
+    grantCapability: jest.fn().mockResolvedValue({ grant: mockGrant(), created: true }),
+    revokeCapability: jest.fn().mockResolvedValue({ deletedCount: 1 }),
     getUserPrincipals: jest.fn().mockResolvedValue([
       { principalType: PrincipalType.USER, principalId: new Types.ObjectId() },
       { principalType: PrincipalType.ROLE, principalId: 'admin' },
@@ -599,7 +599,9 @@ describe('createAdminGrantsHandlers', () => {
 
     it('assigns a grant and returns 201', async () => {
       const grant = mockGrant();
-      const deps = createDeps({ grantCapability: jest.fn().mockResolvedValue(grant) });
+      const deps = createDeps({
+        grantCapability: jest.fn().mockResolvedValue({ grant, created: true }),
+      });
       const handlers = createAdminGrantsHandlers(deps);
       const { req, res, status, json } = createReqRes({ body: validBody });
 
@@ -652,7 +654,7 @@ describe('createAdminGrantsHandlers', () => {
         capability: 'manage:configs:endpoints' as ISystemGrant['capability'],
       });
       const deps = createDeps({
-        grantCapability: jest.fn().mockResolvedValue(grant),
+        grantCapability: jest.fn().mockResolvedValue({ grant, created: true }),
         getHeldCapabilities: jest
           .fn()
           .mockResolvedValue(
@@ -672,7 +674,7 @@ describe('createAdminGrantsHandlers', () => {
     it('accepts config assignment capabilities', async () => {
       const grant = mockGrant({ capability: 'assign:configs:group' as ISystemGrant['capability'] });
       const deps = createDeps({
-        grantCapability: jest.fn().mockResolvedValue(grant),
+        grantCapability: jest.fn().mockResolvedValue({ grant, created: true }),
         getHeldCapabilities: jest
           .fn()
           .mockResolvedValue(new Set([SystemCapabilities.MANAGE_ROLES, 'assign:configs:group'])),
@@ -935,7 +937,7 @@ describe('createAdminGrantsHandlers', () => {
 
     it('returns 500 when grantCapability returns null', async () => {
       const deps = createDeps({
-        grantCapability: jest.fn().mockResolvedValue(null),
+        grantCapability: jest.fn().mockResolvedValue({ grant: null, created: false }),
       });
       const handlers = createAdminGrantsHandlers(deps);
       const { req, res, status, json } = createReqRes({ body: validBody });
@@ -967,9 +969,11 @@ describe('createAdminGrantsHandlers', () => {
       capability: SystemCapabilities.READ_USERS,
     };
 
-    it('returns 200 idempotently even if the grant does not exist', async () => {
+    it('returns 200 idempotently and skips audit emission when the grant does not exist', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
       const deps = createDeps({
-        revokeCapability: jest.fn().mockResolvedValue(undefined),
+        revokeCapability: jest.fn().mockResolvedValue({ deletedCount: 0 }),
+        recordAuditEntry,
       });
       const handlers = createAdminGrantsHandlers(deps);
       const { req, res, status, json } = createReqRes({ params: validParams });
@@ -978,6 +982,9 @@ describe('createAdminGrantsHandlers', () => {
 
       expect(status).toHaveBeenCalledWith(200);
       expect(json).toHaveBeenCalledWith({ success: true });
+      /** A no-op revoke must not produce an audit row. The whole point of the
+       * `deletedCount > 0` gate is to avoid logging fictitious revocations. */
+      expect(recordAuditEntry).not.toHaveBeenCalled();
     });
 
     it('revokes a grant and returns 200', async () => {
@@ -1165,4 +1172,152 @@ describe('createAdminGrantsHandlers', () => {
       expect(json).toHaveBeenCalledWith({ error: 'Failed to revoke grant' });
     });
   });
+
+  describe('audit emission', () => {
+    const assignBody = {
+      principalType: PrincipalType.ROLE,
+      principalId: 'editor',
+      capability: SystemCapabilities.READ_USERS,
+    };
+
+    function reqUser(overrides: { name?: string; username?: string; email?: string } = {}) {
+      return {
+        _id: new Types.ObjectId(),
+        role: 'admin',
+        tenantId: 'tenant-1',
+        ...overrides,
+      } as { _id: Types.ObjectId; role: string; tenantId?: string };
+    }
+
+    it('emits a grant.assigned entry after a successful assignment', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({ recordAuditEntry });
+      const handlers = createAdminGrantsHandlers(deps);
+      const user = reqUser({ name: 'Alice Admin' });
+      const { req, res } = createReqRes({ body: assignBody, user });
+
+      await handlers.assignGrant(req, res);
+
+      expect(recordAuditEntry).toHaveBeenCalledTimes(1);
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.objectContaining({
+          action: 'grant.assigned',
+          outcome: 'success',
+          actor: { type: 'user', id: user._id.toString(), name: 'Alice Admin' },
+          /** ROLE targets carry the human-readable name in `principalId`, so the
+           * audit target id and name are both that role name. */
+          target: { type: PrincipalType.ROLE, id: 'editor', name: 'editor' },
+          metadata: { capability: SystemCapabilities.READ_USERS },
+          tenantId: 'tenant-1',
+        }),
+      );
+    });
+
+    it('emits a grant.removed entry when deletedCount > 0', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({
+        revokeCapability: jest.fn().mockResolvedValue({ deletedCount: 1 }),
+        recordAuditEntry,
+      });
+      const handlers = createAdminGrantsHandlers(deps);
+      const user = reqUser({ username: 'alice' });
+      const { req, res } = createReqRes({ params: assignBody, user });
+
+      await handlers.revokeGrant(req, res);
+
+      expect(recordAuditEntry).toHaveBeenCalledTimes(1);
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.objectContaining({
+          action: 'grant.removed',
+          actor: expect.objectContaining({ type: 'user', name: 'alice' }),
+          target: { type: PrincipalType.ROLE, id: 'editor', name: 'editor' },
+        }),
+      );
+    });
+
+    it('does not emit when recordAuditEntry is not configured', async () => {
+      const deps = createDeps();
+      const handlers = createAdminGrantsHandlers(deps);
+      const { req, res, status } = createReqRes({ body: assignBody, user: reqUser() });
+
+      await handlers.assignGrant(req, res);
+
+      expect(status).toHaveBeenCalledWith(201);
+    });
+
+    it('does not audit re-assigning a capability the role already holds', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({
+        recordAuditEntry,
+        // the upsert reports created:false → idempotent re-assert, no change
+        grantCapability: jest.fn().mockResolvedValue({ grant: mockGrant(), created: false }),
+      });
+      const handlers = createAdminGrantsHandlers(deps);
+      const { req, res, status } = createReqRes({ body: assignBody, user: reqUser() });
+
+      await handlers.assignGrant(req, res);
+
+      expect(status).toHaveBeenCalledWith(201);
+      expect(recordAuditEntry).not.toHaveBeenCalled();
+    });
+
+    it('fail-open: a failed audit write does not fail the grant', async () => {
+      const recordAuditEntry = jest.fn().mockRejectedValue(new Error('audit down'));
+      const deps = createDeps({ recordAuditEntry });
+      const handlers = createAdminGrantsHandlers(deps);
+      const { req, res, status } = createReqRes({ body: assignBody, user: reqUser() });
+
+      await handlers.assignGrant(req, res);
+
+      expect(status).toHaveBeenCalledWith(201);
+    });
+
+    it('fail-closed: a failed assign audit rolls back the grant and 500s', async () => {
+      const recordAuditEntry = jest.fn().mockRejectedValue(new Error('audit down'));
+      const deps = createDeps({ recordAuditEntry, auditFailClosed: true });
+      const handlers = createAdminGrantsHandlers(deps);
+      const { req, res, status } = createReqRes({ body: assignBody, user: reqUser() });
+
+      await handlers.assignGrant(req, res);
+
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({ failClosed: true }),
+      );
+      // compensating rollback removes the grant we just created
+      expect(deps.revokeCapability).toHaveBeenCalledWith(
+        expect.objectContaining({
+          principalType: PrincipalType.ROLE,
+          principalId: 'editor',
+          capability: SystemCapabilities.READ_USERS,
+        }),
+      );
+      expect(status).toHaveBeenCalledWith(500);
+    });
+
+    it('fail-closed: a failed revoke audit restores the grant and 500s', async () => {
+      const recordAuditEntry = jest.fn().mockRejectedValue(new Error('audit down'));
+      const grantCapability = jest.fn().mockResolvedValue({ grant: { id: 'g1' }, created: true });
+      const deps = createDeps({
+        recordAuditEntry,
+        auditFailClosed: true,
+        grantCapability,
+        revokeCapability: jest.fn().mockResolvedValue({ deletedCount: 1 }),
+      });
+      const handlers = createAdminGrantsHandlers(deps);
+      const { req, res, status } = createReqRes({ params: assignBody, user: reqUser() });
+
+      await handlers.revokeGrant(req, res);
+
+      // compensating re-grant restores access removed before the audit failed
+      expect(grantCapability).toHaveBeenCalledWith(
+        expect.objectContaining({
+          principalType: PrincipalType.ROLE,
+          principalId: 'editor',
+          capability: SystemCapabilities.READ_USERS,
+        }),
+      );
+      expect(status).toHaveBeenCalledWith(500);
+    });
+  });
 });
diff --git a/packages/api/src/admin/grants.ts b/packages/api/src/admin/grants.ts
index b7205d6c7cc..bba4495cfbb 100644
--- a/packages/api/src/admin/grants.ts
+++ b/packages/api/src/admin/grants.ts
@@ -5,12 +5,20 @@ import {
   SystemCapabilities,
   expandImplications,
 } from '@librechat/data-schemas';
-import type { ISystemGrant, SystemCapability } from '@librechat/data-schemas';
+import type {
+  AuditAction,
+  AuditContext,
+  ISystemGrant,
+  RecordAuditEntryInput,
+  RecordAuditEntryOptions,
+  SystemCapability,
+} from '@librechat/data-schemas';
 import type { Response } from 'express';
 import type { Types } from 'mongoose';
 import type { ResolvedPrincipal } from '~/types/principal';
 import type { ServerRequest } from '~/types/http';
 import { parsePagination } from './pagination';
+import { buildAuditContext } from './context';
 
 interface GrantRequestBody {
   principalType?: string;
@@ -44,13 +52,13 @@ export interface AdminGrantsDeps {
     capability: SystemCapability;
     tenantId?: string;
     grantedBy?: string | Types.ObjectId;
-  }) => Promise<ISystemGrant | null>;
+  }) => Promise<{ grant: ISystemGrant | null; created: boolean }>;
   revokeCapability: (params: {
     principalType: PrincipalType;
     principalId: string | Types.ObjectId;
     capability: SystemCapability;
     tenantId?: string;
-  }) => Promise<void>;
+  }) => Promise<{ deletedCount: number }>;
   getUserPrincipals: (params: {
     userId: string;
     role?: string | null;
@@ -72,13 +80,32 @@ export interface AdminGrantsDeps {
     tenantId?: string;
   }) => ResolvedPrincipal[] | undefined;
   checkRoleExists?: (roleId: string) => Promise<boolean>;
+  /** Optional audit emission. Failure is logged but does not roll back the grant
+   * unless `auditFailClosed` is set. */
+  recordAuditEntry?: (
+    input: RecordAuditEntryInput,
+    options?: RecordAuditEntryOptions,
+  ) => Promise<void>;
+  /**
+   * When true, a failed audit write surfaces as a 5xx instead of being
+   * swallowed. The grant itself is already persisted (and grant writes are
+   * idempotent upserts), so a client retry is safe; an operator must reconcile
+   * the missing audit row. Defaults to fail-open.
+   */
+  auditFailClosed?: boolean;
 }
 
 /** Currently ROLE-only; Record/Set structure preserved for future principal-type expansion. */
 export type GrantPrincipalType = PrincipalType.ROLE;
 
 /** Creates admin grant handlers with dependency injection for the /api/admin/grants routes. */
-export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
+export function createAdminGrantsHandlers(deps: AdminGrantsDeps): {
+  listGrants: (req: ServerRequest, res: Response) => Promise<Response>;
+  getEffectiveCapabilities: (req: ServerRequest, res: Response) => Promise<Response>;
+  getPrincipalGrants: (req: ServerRequest, res: Response) => Promise<Response>;
+  assignGrant: (req: ServerRequest, res: Response) => Promise<Response>;
+  revokeGrant: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listGrants,
     countGrants,
@@ -91,8 +118,46 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
     getHeldCapabilities,
     getCachedPrincipals,
     checkRoleExists,
+    recordAuditEntry,
+    auditFailClosed,
   } = deps;
 
+  async function emitAudit(args: {
+    action: AuditAction;
+    caller: { userId: string; actorName: string; role: string; tenantId?: string };
+    principalType: PrincipalType;
+    principalId: string;
+    capability: SystemCapability;
+    context?: AuditContext;
+  }): Promise<void> {
+    if (!recordAuditEntry) return;
+    /** The grants surface is ROLE-only today (see `MANAGE_CAPABILITY_BY_TYPE`),
+     * and SystemGrant stores the human-readable role name in `principalId` for
+     * ROLE principals, so the audit target's id and name are both `principalId`.
+     * When USER and GROUP grants are enabled, resolve the display name here. */
+    const input: RecordAuditEntryInput = {
+      action: args.action,
+      outcome: 'success',
+      severity: 'warning',
+      actor: { type: 'user', id: args.caller.userId, name: args.caller.actorName },
+      target: { type: args.principalType, id: args.principalId, name: args.principalId },
+      metadata: { capability: args.capability },
+      context: args.context,
+      tenantId: args.caller.tenantId,
+    };
+    if (auditFailClosed) {
+      /** Let the failure propagate to the handler (→ 5xx); see `auditFailClosed`. */
+      await recordAuditEntry(input, { failClosed: true });
+      return;
+    }
+    try {
+      await recordAuditEntry(input);
+    } catch (err) {
+      /** Fail-open: audit failure must not roll back the grant. */
+      logger.error('[adminGrants] audit write failed', err);
+    }
+  }
+
   const MANAGE_CAPABILITY_BY_TYPE: Record<GrantPrincipalType, SystemCapability> = {
     [PrincipalType.ROLE]: SystemCapabilities.MANAGE_ROLES,
   };
@@ -107,7 +172,7 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
 
   function resolveUser(
     req: ServerRequest,
-  ): { userId: string; role: string; tenantId?: string } | null {
+  ): { userId: string; role: string; actorName: string; tenantId?: string } | null {
     const user = req.user;
     if (!user) {
       return null;
@@ -116,7 +181,10 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
     if (!userId || !user.role) {
       return null;
     }
-    return { userId, role: user.role, tenantId: user.tenantId };
+    /** JWT-loaded `req.user` already carries name/username/email, so the actor
+     * display name is available without a database round-trip. */
+    const actorName = user.name || user.username || user.email || userId;
+    return { userId, role: user.role, actorName, tenantId: user.tenantId };
   }
 
   async function resolvePrincipals(user: {
@@ -336,7 +404,11 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
         }
       }
 
-      const grant = await grantCapability({
+      /** `created` comes from the atomic upsert result, so a re-assert of a
+       * capability the role already holds (or a concurrent double-assign) is not
+       * audited as a new change — and a new tenant-scoped grant is correctly
+       * distinguished from an inherited platform-level one. */
+      const { grant, created } = await grantCapability({
         principalType,
         principalId,
         capability,
@@ -346,6 +418,29 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
       if (!grant) {
         return res.status(500).json({ error: 'Grant operation returned no result' });
       }
+      if (created) {
+        try {
+          await emitAudit({
+            action: 'grant.assigned',
+            caller,
+            principalType,
+            principalId,
+            capability,
+            context: buildAuditContext(req),
+          });
+        } catch (auditErr) {
+          /** Fail-closed only (emitAudit rethrows here): roll back the grant we
+           * just created so a 5xx never leaves an unaudited grant in place. */
+          await revokeCapability({ principalType, principalId, capability, tenantId }).catch((e) =>
+            logger.error('[adminGrants] compensating revoke after audit failure failed', e),
+          );
+          logger.error(
+            '[adminGrants] assignGrant audit failed (fail-closed) — rolled back grant',
+            auditErr,
+          );
+          return res.status(500).json({ error: 'Failed to record audit entry' });
+        }
+      }
       return res.status(201).json({ grant });
     } catch (error) {
       logger.error('[adminGrants] assignGrant error:', error);
@@ -386,12 +481,46 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
         return res.status(403).json({ error: 'Insufficient permissions' });
       }
 
-      await revokeCapability({
+      const revokeResult = await revokeCapability({
         principalType: principalType as PrincipalType,
         principalId,
         capability: capability as SystemCapability,
         tenantId,
       });
+      // Only emit the audit entry when a grant document was actually deleted —
+      // a no-op revoke (the grant never existed) must not appear in the audit
+      // trail or the forensic record becomes misleading.
+      if (revokeResult.deletedCount > 0) {
+        try {
+          await emitAudit({
+            action: 'grant.removed',
+            caller,
+            principalType: principalType as PrincipalType,
+            principalId,
+            capability: capability as SystemCapability,
+            context: buildAuditContext(req),
+          });
+        } catch (auditErr) {
+          /** Fail-closed only (emitAudit rethrows here): restore the grant we
+           * just removed so a 5xx never leaves an unaudited revoke. The original
+           * `grantedBy`/`grantedAt` are not recoverable here; restoring access is
+           * the priority on this rare error path. */
+          await grantCapability({
+            principalType: principalType as PrincipalType,
+            principalId,
+            capability: capability as SystemCapability,
+            tenantId,
+            grantedBy: caller.userId,
+          }).catch((e) =>
+            logger.error('[adminGrants] compensating re-grant after audit failure failed', e),
+          );
+          logger.error(
+            '[adminGrants] revokeGrant audit failed (fail-closed) — restored grant',
+            auditErr,
+          );
+          return res.status(500).json({ error: 'Failed to record audit entry' });
+        }
+      }
       return res.status(200).json({ success: true });
     } catch (error) {
       logger.error('[adminGrants] revokeGrant error:', error);
diff --git a/packages/api/src/admin/groups.ts b/packages/api/src/admin/groups.ts
index 41dfba6cac2..d37ca3d294a 100644
--- a/packages/api/src/admin/groups.ts
+++ b/packages/api/src/admin/groups.ts
@@ -84,7 +84,16 @@ export interface AdminGroupsDeps {
   }) => Promise<DeleteResult>;
 }
 
-export function createAdminGroupsHandlers(deps: AdminGroupsDeps) {
+export function createAdminGroupsHandlers(deps: AdminGroupsDeps): {
+  listGroups: (req: ServerRequest, res: Response) => Promise<Response>;
+  getGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  createGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  getGroupMembers: (req: ServerRequest, res: Response) => Promise<Response>;
+  addGroupMember: (req: ServerRequest, res: Response) => Promise<Response>;
+  removeGroupMember: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listGroups,
     countGroups,
diff --git a/packages/api/src/admin/index.ts b/packages/api/src/admin/index.ts
index 4eb7f3d2765..807333c4a1f 100644
--- a/packages/api/src/admin/index.ts
+++ b/packages/api/src/admin/index.ts
@@ -2,11 +2,15 @@ export { createAdminConfigHandlers } from './config';
 export { createAdminGrantsHandlers } from './grants';
 export { createAdminGroupsHandlers } from './groups';
 export { createAdminRolesHandlers } from './roles';
+export { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } from './skills';
 export { createAdminUsersHandlers } from './users';
+export { createAdminAuditLogHandlers } from './auditLog';
 export { createAdminUserStatsHandlers } from './user.stats';
 export type { AdminConfigDeps } from './config';
 export type { AdminGrantsDeps, GrantPrincipalType } from './grants';
 export type { AdminGroupsDeps } from './groups';
 export type { AdminRolesDeps } from './roles';
+export type { AdminSkillSyncAccessDeps, AdminSkillSyncDeps } from './skills';
 export type { AdminUsersDeps } from './users';
+export type { AdminAuditLogDeps } from './auditLog';
 export type { AdminUserStatsDeps } from './user.stats';
diff --git a/packages/api/src/admin/roles.spec.ts b/packages/api/src/admin/roles.spec.ts
index edbd14ba0b2..dc96975b418 100644
--- a/packages/api/src/admin/roles.spec.ts
+++ b/packages/api/src/admin/roles.spec.ts
@@ -75,7 +75,7 @@ function createDeps(overrides: Partial<AdminRolesDeps> = {}): AdminRolesDeps {
     countUsersByRole: jest.fn().mockResolvedValue(0),
     deleteConfig: jest.fn().mockResolvedValue(null),
     deleteAclEntries: jest.fn().mockResolvedValue(undefined),
-    deleteGrantsForPrincipal: jest.fn().mockResolvedValue(undefined),
+    deleteGrantsForPrincipal: jest.fn().mockResolvedValue([]),
     ...overrides,
   };
 }
@@ -990,6 +990,84 @@ describe('createAdminRolesHandlers', () => {
       expect(json).toHaveBeenCalledWith({ success: true });
     });
 
+    it('emits a grant.removed audit entry for each grant removed by the cascade', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({
+        deleteGrantsForPrincipal: jest.fn().mockResolvedValue([
+          { capability: 'manage:users', tenantId: 'tenant-1' },
+          { capability: 'read:users', tenantId: 'tenant-1' },
+        ]),
+        recordAuditEntry,
+      });
+      const handlers = createAdminRolesHandlers(deps);
+      const userId = new Types.ObjectId();
+      const { req, res, status } = createReqRes({
+        params: { name: 'editor' },
+        user: { _id: userId, role: 'admin', tenantId: 'tenant-1' },
+      });
+
+      await handlers.deleteRole(req, res);
+
+      expect(status).toHaveBeenCalledWith(200);
+      expect(recordAuditEntry).toHaveBeenCalledTimes(2);
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.objectContaining({
+          action: 'grant.removed',
+          actor: expect.objectContaining({ type: 'user', id: userId.toString() }),
+          target: { type: PrincipalType.ROLE, id: 'editor', name: 'editor' },
+          metadata: { capability: 'manage:users' },
+          tenantId: 'tenant-1',
+        }),
+      );
+    });
+
+    it('scopes each cascade audit entry to the removed grant’s own tenant', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({
+        // a platform admin (no tenantId) deletes a role holding both a
+        // platform-level grant and a tenant-scoped one
+        deleteGrantsForPrincipal: jest
+          .fn()
+          .mockResolvedValue([
+            { capability: 'read:users' },
+            { capability: 'manage:users', tenantId: 'tenant-x' },
+          ]),
+        recordAuditEntry,
+      });
+      const handlers = createAdminRolesHandlers(deps);
+      const { req, res, status } = createReqRes({
+        params: { name: 'editor' },
+        user: { _id: new Types.ObjectId(), role: 'admin' },
+      });
+
+      await handlers.deleteRole(req, res);
+
+      expect(status).toHaveBeenCalledWith(200);
+      // platform grant → platform chain (tenantId undefined)
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.objectContaining({ metadata: { capability: 'read:users' }, tenantId: undefined }),
+      );
+      // tenant grant → that tenant's chain, not the caller's (undefined) scope
+      expect(recordAuditEntry).toHaveBeenCalledWith(
+        expect.objectContaining({ metadata: { capability: 'manage:users' }, tenantId: 'tenant-x' }),
+      );
+    });
+
+    it('does not audit when the deleted role had no grants', async () => {
+      const recordAuditEntry = jest.fn().mockResolvedValue(undefined);
+      const deps = createDeps({ recordAuditEntry });
+      const handlers = createAdminRolesHandlers(deps);
+      const { req, res, status } = createReqRes({
+        params: { name: 'editor' },
+        user: { _id: new Types.ObjectId(), role: 'admin' },
+      });
+
+      await handlers.deleteRole(req, res);
+
+      expect(status).toHaveBeenCalledWith(200);
+      expect(recordAuditEntry).not.toHaveBeenCalled();
+    });
+
     it('succeeds even when all cascade operations fail', async () => {
       const deps = createDeps({
         deleteConfig: jest.fn().mockRejectedValue(new Error('config cleanup failed')),
diff --git a/packages/api/src/admin/roles.ts b/packages/api/src/admin/roles.ts
index db592c02d02..484e1efe2f9 100644
--- a/packages/api/src/admin/roles.ts
+++ b/packages/api/src/admin/roles.ts
@@ -1,10 +1,19 @@
 import { PrincipalType, SystemRoles } from 'librechat-data-provider';
 import { logger, isValidObjectIdString, RoleConflictError } from '@librechat/data-schemas';
-import type { IRole, IUser, IConfig, AdminMember } from '@librechat/data-schemas';
+import type {
+  IRole,
+  IUser,
+  IConfig,
+  AdminMember,
+  ISystemGrant,
+  RecordAuditEntryInput,
+  RecordAuditEntryOptions,
+} from '@librechat/data-schemas';
 import type { FilterQuery, Types } from 'mongoose';
 import type { Response } from 'express';
 import type { ServerRequest } from '~/types/http';
 import { parsePagination } from './pagination';
+import { buildAuditContext } from './context';
 
 const systemRoleValues = new Set<string>(Object.values(SystemRoles));
 
@@ -115,15 +124,32 @@ export interface AdminRolesDeps {
     principalType: PrincipalType;
     principalId: string | Types.ObjectId;
   }) => Promise<void>;
-  /** Removes all system capability grants held by this principal. */
+  /** Removes all system capability grants held by this principal and returns
+   * the removed grants so each can be audited. */
   deleteGrantsForPrincipal: (
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
     options?: { tenantId?: string },
+  ) => Promise<ISystemGrant[]>;
+  /** Optional audit emission for grants removed by the role-deletion cascade.
+   * Failure is logged but never blocks the deletion (which has already happened). */
+  recordAuditEntry?: (
+    input: RecordAuditEntryInput,
+    options?: RecordAuditEntryOptions,
   ) => Promise<void>;
 }
 
-export function createAdminRolesHandlers(deps: AdminRolesDeps) {
+export function createAdminRolesHandlers(deps: AdminRolesDeps): {
+  listRoles: (req: ServerRequest, res: Response) => Promise<Response>;
+  getRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  createRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateRolePermissions: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  getRoleMembers: (req: ServerRequest, res: Response) => Promise<Response>;
+  addRoleMember: (req: ServerRequest, res: Response) => Promise<Response>;
+  removeRoleMember: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listRoles,
     countRoles,
@@ -142,8 +168,45 @@ export function createAdminRolesHandlers(deps: AdminRolesDeps) {
     deleteConfig,
     deleteAclEntries,
     deleteGrantsForPrincipal,
+    recordAuditEntry,
   } = deps;
 
+  /** Emits a `grant.removed` audit entry for each grant the role-deletion cascade
+   * removed, so the cascade leaves the same forensic trail as an explicit revoke.
+   * Fail-open: the role is already deleted, so a failed audit is logged, not
+   * propagated. Sequential to keep the per-tenant hash chain ordered. */
+  async function emitGrantRemovals(
+    req: ServerRequest,
+    roleName: string,
+    grants: ISystemGrant[],
+  ): Promise<void> {
+    if (!recordAuditEntry || grants.length === 0) return;
+    const user = req.user;
+    const userId = user?._id?.toString() ?? user?.id;
+    if (!user || !userId) return;
+    const actorName = user.name || user.username || user.email || userId;
+    const context = buildAuditContext(req);
+    for (const grant of grants) {
+      try {
+        await recordAuditEntry({
+          action: 'grant.removed',
+          outcome: 'success',
+          severity: 'warning',
+          actor: { type: 'user', id: userId, name: actorName },
+          target: { type: PrincipalType.ROLE, id: roleName, name: roleName },
+          metadata: { capability: grant.capability },
+          context,
+          /** Scope each entry to the removed grant's own tenant — a platform
+           * admin's role deletion can remove tenant-scoped grants, and those
+           * removals must land in the affected tenant's chain, not the caller's. */
+          tenantId: grant.tenantId,
+        });
+      } catch (err) {
+        logger.error('[adminRoles] grant.removed audit failed during role deletion', err);
+      }
+    }
+  }
+
   async function listRolesHandler(req: ServerRequest, res: Response) {
     try {
       const { limit, offset } = parsePagination(req.query);
@@ -388,16 +451,19 @@ export function createAdminRolesHandlers(deps: AdminRolesDeps) {
       }
 
       const tenantId = req.user?.tenantId;
-      const cleanupResults = await Promise.allSettled([
+      const [configResult, aclResult, grantsResult] = await Promise.allSettled([
         deleteConfig(PrincipalType.ROLE, name),
         deleteAclEntries({ principalType: PrincipalType.ROLE, principalId: name }),
         deleteGrantsForPrincipal(PrincipalType.ROLE, name, { tenantId }),
       ]);
-      for (const result of cleanupResults) {
+      for (const result of [configResult, aclResult, grantsResult]) {
         if (result.status === 'rejected') {
           logger.error('[adminRoles] cascade cleanup failed for role:', name, result.reason);
         }
       }
+      if (grantsResult.status === 'fulfilled') {
+        await emitGrantRemovals(req, name, grantsResult.value);
+      }
 
       return res.status(200).json({ success: true });
     } catch (error) {
diff --git a/packages/api/src/admin/skills.spec.ts b/packages/api/src/admin/skills.spec.ts
new file mode 100644
index 00000000000..ce5e970d5ba
--- /dev/null
+++ b/packages/api/src/admin/skills.spec.ts
@@ -0,0 +1,454 @@
+import { SystemCapabilities } from '@librechat/data-schemas';
+import type { ISkillSyncStatus } from '@librechat/data-schemas';
+import type { NextFunction, Response } from 'express';
+import { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } from './skills';
+
+function createResponse() {
+  const res = {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+  };
+  return res as unknown as Response & {
+    status: jest.Mock;
+    json: jest.Mock;
+  };
+}
+
+function createNext(): NextFunction & jest.Mock {
+  return jest.fn() as NextFunction & jest.Mock;
+}
+
+type SourceStatus = ISkillSyncStatus & { credentialPresent: boolean };
+
+function createSourceStatus(overrides: Partial<SourceStatus> = {}): SourceStatus {
+  return {
+    provider: 'github',
+    sourceId: 'tenant-skills',
+    tenantId: 'tenant-a',
+    status: 'idle',
+    credentialKey: 'github-skills-prod',
+    credentialPresent: true,
+    owner: 'LibreChat',
+    repo: 'skills',
+    ref: 'main',
+    paths: ['skills'],
+    syncedSkillCount: 0,
+    syncedFileCount: 0,
+    deletedSkillCount: 0,
+    deletedFileCount: 0,
+    errorCode: undefined,
+    errorMessage: undefined,
+    startedAt: undefined,
+    finishedAt: undefined,
+    lastSuccessAt: undefined,
+    lastFailureAt: undefined,
+    createdAt: undefined,
+    updatedAt: undefined,
+    ...overrides,
+  };
+}
+
+function createHandlers({
+  statusErrorCode,
+  statusErrorMessage,
+}: { statusErrorCode?: string; statusErrorMessage?: string } = {}) {
+  const runner = {
+    getStatus: jest.fn(async () => ({
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        createSourceStatus({
+          errorCode: statusErrorCode,
+          errorMessage: statusErrorMessage,
+        }),
+      ],
+      credentials: [
+        {
+          provider: 'github' as const,
+          credentialKey: 'github-skills-prod',
+          credentialPresent: true,
+          tokenFingerprint: 'abc123',
+        },
+      ],
+      fineGrainedTokenRecommendation: 'Use a fine-grained token.',
+    })),
+    runOnce: jest.fn(async () => ({
+      status: 'completed' as const,
+      sources: [
+        createSourceStatus({
+          status: 'succeeded',
+          syncedSkillCount: 1,
+          syncedFileCount: 2,
+          errorCode: statusErrorCode,
+          errorMessage: statusErrorMessage,
+        }),
+      ],
+    })),
+  };
+  const handlers = createAdminSkillsSyncHandlers({
+    runner,
+    upsertCredential: jest.fn(),
+    deleteCredential: jest.fn(),
+  });
+  return { handlers, runner };
+}
+
+describe('createAdminSkillsSyncHandlers', () => {
+  it('omits credential summaries and source credential metadata for tenant-scoped status reads', async () => {
+    const { handlers } = createHandlers();
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentials: [],
+        sources: [
+          expect.objectContaining({
+            credentialKey: undefined,
+            credentialPresent: false,
+            owner: undefined,
+            repo: undefined,
+            ref: undefined,
+            paths: undefined,
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('filters tenant-scoped status reads to the request tenant and unscoped sources', async () => {
+    const runner = {
+      getStatus: jest.fn(async () => ({
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          createSourceStatus({
+            sourceId: 'tenant-a-source',
+            tenantId: 'tenant-a',
+            status: 'succeeded',
+            syncedSkillCount: 4,
+            syncedFileCount: 8,
+          }),
+          createSourceStatus({
+            sourceId: 'shared-source',
+            tenantId: undefined,
+            status: 'succeeded',
+            syncedSkillCount: 2,
+            syncedFileCount: 3,
+          }),
+          createSourceStatus({
+            sourceId: 'tenant-b-source',
+            tenantId: 'tenant-b',
+            status: 'failed',
+            errorCode: 'PARSE_ERROR',
+            errorMessage: 'Failed to parse skills/private-b/SKILL.md',
+            syncedSkillCount: 7,
+            syncedFileCount: 11,
+            deletedSkillCount: 1,
+            deletedFileCount: 2,
+          }),
+        ],
+        credentials: [],
+        fineGrainedTokenRecommendation: 'Use a fine-grained token.',
+      })),
+      runOnce: jest.fn(),
+    };
+    const handlers = createAdminSkillsSyncHandlers({
+      runner,
+      upsertCredential: jest.fn(),
+      deleteCredential: jest.fn(),
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            sourceId: 'tenant-a-source',
+            tenantId: 'tenant-a',
+            status: 'succeeded',
+            syncedSkillCount: 4,
+            syncedFileCount: 8,
+          }),
+          expect.objectContaining({
+            sourceId: 'shared-source',
+            tenantId: undefined,
+            status: 'succeeded',
+            syncedSkillCount: 2,
+            syncedFileCount: 3,
+          }),
+        ],
+      }),
+    );
+    const response = res.json.mock.calls[0]?.[0] as { sources: Array<{ tenantId?: string }> };
+    expect(response.sources).toHaveLength(2);
+    expect(response.sources).toEqual([
+      expect.objectContaining({ sourceId: 'tenant-a-source' }),
+      expect.objectContaining({ sourceId: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('redacts credential-related errors from tenant-scoped status reads', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub token environment variable "GITHUB_SKILLS_TOKEN"',
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            errorCode: 'MISSING_CREDENTIAL',
+            errorMessage: 'GitHub skill sync credentials are not available',
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('includes credential summaries and source credential metadata for platform status reads', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub credential "github-skills-prod"',
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus({ skillSyncCanReadCredentials: true } as never, res);
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentials: [expect.objectContaining({ credentialKey: 'github-skills-prod' })],
+        sources: [
+          expect.objectContaining({
+            credentialKey: 'github-skills-prod',
+            credentialPresent: true,
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            errorMessage: 'Missing GitHub credential "github-skills-prod"',
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('omits source credential metadata from tenant-scoped manual run responses', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub credential "github-skills-prod"',
+    });
+    const res = createResponse();
+
+    await handlers.runSync(
+      {
+        skillSyncAllowServerCredentials: true,
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            credentialKey: undefined,
+            credentialPresent: false,
+            errorMessage: 'GitHub skill sync credentials are not available',
+          }),
+        ],
+      }),
+    );
+  });
+});
+
+describe('createAdminSkillsSyncAccess', () => {
+  const baseSkillSync = {
+    github: {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          id: 'base-skills',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          token: '${GITHUB_SKILLS_TOKEN}',
+        },
+      ],
+    },
+  };
+
+  function createAccess({
+    hasCapability = jest.fn().mockResolvedValue(true),
+    getAppConfig = jest.fn().mockResolvedValue({ skillSync: undefined }),
+  }: {
+    hasCapability?: jest.Mock;
+    getAppConfig?: jest.Mock;
+  } = {}) {
+    return {
+      access: createAdminSkillsSyncAccess({ getAppConfig, hasCapability }),
+      getAppConfig,
+      hasCapability,
+    };
+  }
+
+  it('attaches the base skill sync config for override comparison', async () => {
+    const getAppConfig = jest.fn().mockResolvedValue({ skillSync: baseSkillSync });
+    const { access } = createAccess({ getAppConfig });
+    const req = { config: { skillSync: undefined, config: { endpoints: {} } } };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.attachBaseSkillSyncConfig(req as never, res, next);
+
+    expect(getAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+    expect(req.config.config).toEqual({ endpoints: {}, skillSync: baseSkillSync });
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('marks credential metadata hidden for tenant-scoped status reads', async () => {
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.READ_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = { user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' } };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireReadSkills(req as never, res, next);
+    await access.attachCredentialReadAccess(req as never, res, next);
+
+    expect(req).toMatchObject({
+      skillSyncCanReadCredentials: false,
+      skillSyncAllowServerCredentials: false,
+    });
+    expect(hasCapability).toHaveBeenCalledWith(
+      { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      SystemCapabilities.READ_SKILLS,
+    );
+    expect(hasCapability).toHaveBeenCalledWith(
+      { id: 'user-1', role: 'ADMIN' },
+      SystemCapabilities.READ_SKILLS,
+    );
+  });
+
+  it('prevents tenant admins from running overrides that require server credentials', async () => {
+    const tenantSkillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.MANAGE_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: tenantSkillSync, config: {} },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      message: 'Tenant-scoped manual skill sync requires platform credential access',
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('prevents tenant admins from manually running base skill sync config', async () => {
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.MANAGE_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: baseSkillSync, config: { skillSync: baseSkillSync } },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('allows platform admins to manually run base skill sync config with server credentials', async () => {
+    const { access } = createAccess();
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: baseSkillSync, config: { skillSync: baseSkillSync } },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(req).toMatchObject({
+      skillSyncAllowServerCredentials: true,
+      skillSyncCanReadCredentials: true,
+    });
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/admin/skills.ts b/packages/api/src/admin/skills.ts
new file mode 100644
index 00000000000..8d481047f8d
--- /dev/null
+++ b/packages/api/src/admin/skills.ts
@@ -0,0 +1,410 @@
+import { SystemCapabilities } from '@librechat/data-schemas';
+import { skillSyncConfigSchema } from 'librechat-data-provider';
+import type {
+  TGitHubSkillSyncStatusResponse,
+  TGitHubSkillSyncSourceStatus,
+  TGitHubSkillSyncCredentialSummary,
+  TGitHubSkillSyncManualRunResponse,
+  SkillSyncConfig,
+} from 'librechat-data-provider';
+import type {
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+  SystemCapability,
+} from '@librechat/data-schemas';
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+import type { Types } from 'mongoose';
+import type { GitHubSkillSyncRunner } from '~/skills/sync';
+
+export type AdminSkillsRequest = Request & {
+  user?: {
+    _id?: Types.ObjectId;
+    id?: string;
+    tenantId?: string;
+  };
+  skillSyncAllowServerCredentials?: boolean;
+  skillSyncCanReadCredentials?: boolean;
+};
+
+type SkillSyncConfigContainer = {
+  skillSync?: unknown;
+  config?: {
+    skillSync?: unknown;
+  } & Record<string, unknown>;
+} & Record<string, unknown>;
+
+type AdminSkillSyncAccessRequest = Request & {
+  user?: {
+    _id?: Types.ObjectId | { toString(): string };
+    id?: string;
+    role?: string;
+    tenantId?: string;
+  };
+  config?: SkillSyncConfigContainer;
+  skillSyncAllowServerCredentials?: boolean;
+  skillSyncCanReadCredentials?: boolean;
+};
+
+type SkillSyncCapabilityUser = {
+  id: string;
+  role: string;
+  tenantId?: string;
+};
+
+export type AdminSkillSyncDeps = {
+  runner?: GitHubSkillSyncRunner;
+  getRunner?: (req: Request) => GitHubSkillSyncRunner;
+  upsertCredential: (input: UpsertSkillSyncCredentialInput) => Promise<SkillSyncCredentialSummary>;
+  deleteCredential: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<{ deleted: boolean }>;
+};
+
+export type AdminSkillSyncAccessDeps = {
+  getAppConfig: (options: { baseOnly: true }) => Promise<{ skillSync?: unknown } | undefined>;
+  hasCapability: (user: SkillSyncCapabilityUser, capability: SystemCapability) => Promise<boolean>;
+};
+
+type AdminSkillsSyncHandler = (req: AdminSkillsRequest, res: Response) => Promise<Response>;
+
+export type AdminSkillsSyncHandlers = {
+  getSyncStatus: AdminSkillsSyncHandler;
+  runSync: AdminSkillsSyncHandler;
+  setCredential: AdminSkillsSyncHandler;
+  deleteCredential: (req: Request, res: Response) => Promise<Response>;
+};
+
+export type AdminSkillsSyncAccess = {
+  attachBaseSkillSyncConfig: RequestHandler;
+  attachCredentialReadAccess: RequestHandler;
+  requireReadSkills: RequestHandler;
+  requirePlatformManageSkills: RequestHandler;
+  requireSyncRunCapability: RequestHandler;
+};
+
+const CREDENTIAL_KEY_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+
+function toIso(date: Date | undefined): string | undefined {
+  return date ? date.toISOString() : undefined;
+}
+
+function serializeCredential(
+  credential: SkillSyncCredentialSummary,
+): TGitHubSkillSyncCredentialSummary {
+  return {
+    provider: credential.provider,
+    credentialKey: credential.credentialKey,
+    credentialPresent: credential.credentialPresent,
+    tokenFingerprint: credential.tokenFingerprint,
+    createdAt: toIso(credential.createdAt),
+    updatedAt: toIso(credential.updatedAt),
+  };
+}
+
+function isCredentialError(status: ISkillSyncStatus): boolean {
+  if (status.errorCode === 'MISSING_CREDENTIAL') {
+    return true;
+  }
+  return /credential|token environment variable|server github credentials/i.test(
+    status.errorMessage ?? '',
+  );
+}
+
+function serializeErrorMessage(
+  status: ISkillSyncStatus,
+  { includeCredentialMetadata }: { includeCredentialMetadata: boolean },
+): string | undefined {
+  if (includeCredentialMetadata || !isCredentialError(status)) {
+    return status.errorMessage;
+  }
+  return 'GitHub skill sync credentials are not available';
+}
+
+function serializeSourceStatus(
+  status: ISkillSyncStatus & { credentialPresent?: boolean },
+  { includeCredentialMetadata = true }: { includeCredentialMetadata?: boolean } = {},
+): TGitHubSkillSyncSourceStatus {
+  const includePrivateSourceMetadata = includeCredentialMetadata;
+  return {
+    provider: status.provider,
+    sourceId: status.sourceId,
+    tenantId: status.tenantId,
+    status: status.status,
+    credentialKey: includeCredentialMetadata ? status.credentialKey : undefined,
+    credentialPresent: includeCredentialMetadata ? (status.credentialPresent ?? false) : false,
+    owner: includePrivateSourceMetadata ? status.owner : undefined,
+    repo: includePrivateSourceMetadata ? status.repo : undefined,
+    ref: includePrivateSourceMetadata ? status.ref : undefined,
+    paths: includePrivateSourceMetadata ? status.paths : undefined,
+    startedAt: toIso(status.startedAt),
+    finishedAt: toIso(status.finishedAt),
+    lastSuccessAt: toIso(status.lastSuccessAt),
+    lastFailureAt: toIso(status.lastFailureAt),
+    errorCode: status.errorCode,
+    errorMessage: serializeErrorMessage(status, { includeCredentialMetadata }),
+    syncedSkillCount: status.syncedSkillCount,
+    syncedFileCount: status.syncedFileCount,
+    deletedSkillCount: status.deletedSkillCount,
+    deletedFileCount: status.deletedFileCount,
+    createdAt: toIso(status.createdAt),
+    updatedAt: toIso(status.updatedAt),
+  };
+}
+
+function getRequestTenantId(req: AdminSkillsRequest): string | undefined {
+  const tenantId = req.user?.tenantId;
+  return typeof tenantId === 'string' && tenantId ? tenantId : undefined;
+}
+
+function getVisibleSourceStatuses<T extends ISkillSyncStatus>(
+  req: AdminSkillsRequest,
+  sources: T[],
+): T[] {
+  if (req.skillSyncCanReadCredentials !== false) {
+    return sources;
+  }
+  const tenantId = getRequestTenantId(req);
+  if (!tenantId) {
+    return [];
+  }
+  return sources.filter((source) => !source.tenantId || source.tenantId === tenantId);
+}
+
+function isCredentialKey(value: unknown): value is string {
+  return typeof value === 'string' && CREDENTIAL_KEY_PATTERN.test(value);
+}
+
+function getUserObjectId(req: AdminSkillsRequest): Types.ObjectId | undefined {
+  return req.user?._id;
+}
+
+function getCapabilityUser(
+  req: AdminSkillSyncAccessRequest,
+  { platformOnly = false }: { platformOnly?: boolean } = {},
+): SkillSyncCapabilityUser | null {
+  const id = req.user?.id ?? req.user?._id?.toString?.();
+  if (!id) {
+    return null;
+  }
+  return {
+    id,
+    role: req.user?.role ?? '',
+    ...(platformOnly ? {} : { tenantId: req.user?.tenantId }),
+  };
+}
+
+function parseSkillSyncConfig(raw: unknown): SkillSyncConfig | undefined {
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  return parsed.success ? parsed.data : undefined;
+}
+
+function isSameSkillSyncConfig(left: SkillSyncConfig, right: SkillSyncConfig): boolean {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function hasResolvedSkillSyncOverride(req: AdminSkillSyncAccessRequest): boolean {
+  const resolved = parseSkillSyncConfig(req.config?.skillSync);
+  const base = parseSkillSyncConfig(req.config?.config?.skillSync);
+  return Boolean(resolved?.github && !isSameSkillSyncConfig(resolved, base));
+}
+
+function sendInternalServerError(res: Response): void {
+  res.status(500).json({ message: 'Internal Server Error' });
+}
+
+export function createAdminSkillsSyncAccess(deps: AdminSkillSyncAccessDeps): AdminSkillsSyncAccess {
+  async function hasSkillCapability(
+    req: AdminSkillSyncAccessRequest,
+    capability: SystemCapability,
+    { platformOnly = false }: { platformOnly?: boolean } = {},
+  ): Promise<boolean> {
+    const user = getCapabilityUser(req, { platformOnly });
+    if (!user) {
+      return false;
+    }
+    return deps.hasCapability(user, capability);
+  }
+
+  function requireSkillCapability(
+    capability: SystemCapability,
+    { platformOnly = false }: { platformOnly?: boolean } = {},
+  ): RequestHandler {
+    return async (
+      req: AdminSkillSyncAccessRequest,
+      res: Response,
+      next: NextFunction,
+    ): Promise<void> => {
+      try {
+        const user = getCapabilityUser(req, { platformOnly });
+        if (!user) {
+          res.status(401).json({ message: 'Authentication required' });
+          return;
+        }
+        if (await deps.hasCapability(user, capability)) {
+          next();
+          return;
+        }
+        res.status(403).json({ message: 'Forbidden' });
+      } catch {
+        sendInternalServerError(res);
+      }
+    };
+  }
+
+  const attachBaseSkillSyncConfig: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const baseConfig = await deps.getAppConfig({ baseOnly: true });
+      const existingConfig = req.config ?? {};
+      req.config = {
+        ...existingConfig,
+        config: {
+          ...(existingConfig.config ?? {}),
+          skillSync: baseConfig?.skillSync,
+        },
+      };
+      next();
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  const attachCredentialReadAccess: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const canReadCredentials = await hasSkillCapability(req, SystemCapabilities.READ_SKILLS, {
+        platformOnly: true,
+      });
+      req.skillSyncCanReadCredentials = canReadCredentials;
+      req.skillSyncAllowServerCredentials = canReadCredentials;
+      next();
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  const requireSyncRunCapability: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const canManagePlatform = await hasSkillCapability(req, SystemCapabilities.MANAGE_SKILLS, {
+        platformOnly: true,
+      });
+      if (canManagePlatform) {
+        req.skillSyncAllowServerCredentials = true;
+        req.skillSyncCanReadCredentials = true;
+        next();
+        return;
+      }
+      if (
+        hasResolvedSkillSyncOverride(req) &&
+        (await hasSkillCapability(req, SystemCapabilities.MANAGE_SKILLS))
+      ) {
+        res.status(403).json({
+          message: 'Tenant-scoped manual skill sync requires platform credential access',
+        });
+        return;
+      }
+      res.status(403).json({ message: 'Forbidden' });
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  return {
+    attachBaseSkillSyncConfig,
+    attachCredentialReadAccess,
+    requireReadSkills: requireSkillCapability(SystemCapabilities.READ_SKILLS),
+    requirePlatformManageSkills: requireSkillCapability(SystemCapabilities.MANAGE_SKILLS, {
+      platformOnly: true,
+    }),
+    requireSyncRunCapability,
+  };
+}
+
+export function createAdminSkillsSyncHandlers(deps: AdminSkillSyncDeps): AdminSkillsSyncHandlers {
+  function getRunner(req: Request): GitHubSkillSyncRunner {
+    const runner = deps.getRunner?.(req) ?? deps.runner;
+    if (!runner) {
+      throw new Error('GitHub skill sync runner is not configured');
+    }
+    return runner;
+  }
+
+  async function getSyncStatus(req: AdminSkillsRequest, res: Response) {
+    const includeCredentialMetadata = req.skillSyncCanReadCredentials !== false;
+    const status = await getRunner(req).getStatus();
+    const response: TGitHubSkillSyncStatusResponse = {
+      enabled: status.enabled,
+      intervalMinutes: status.intervalMinutes,
+      runOnStartup: status.runOnStartup,
+      sources: getVisibleSourceStatuses(req, status.sources).map((source) =>
+        serializeSourceStatus(source, { includeCredentialMetadata }),
+      ),
+      credentials: includeCredentialMetadata ? status.credentials.map(serializeCredential) : [],
+      fineGrainedTokenRecommendation: status.fineGrainedTokenRecommendation,
+    };
+    return res.status(200).json(response);
+  }
+
+  async function runSync(req: AdminSkillsRequest, res: Response) {
+    const includeCredentialMetadata = req.skillSyncCanReadCredentials === true;
+    const result = await getRunner(req).runOnce();
+    const response: TGitHubSkillSyncManualRunResponse = {
+      status: result.status,
+      message: result.message,
+      sources: result.sources.map((source) =>
+        serializeSourceStatus(source, { includeCredentialMetadata }),
+      ),
+    };
+    return res.status(result.status === 'skipped' ? 202 : 200).json(response);
+  }
+
+  async function setCredential(req: AdminSkillsRequest, res: Response) {
+    const { credentialKey } = req.params;
+    if (!isCredentialKey(credentialKey)) {
+      return res.status(400).json({ error: 'Invalid credential key' });
+    }
+    const token = (req.body as { token?: unknown } | undefined)?.token;
+    if (typeof token !== 'string' || token.trim().length === 0) {
+      return res.status(400).json({ error: 'GitHub token is required' });
+    }
+    const credential = await deps.upsertCredential({
+      provider: 'github',
+      credentialKey,
+      token: token.trim(),
+      userId: getUserObjectId(req),
+    });
+    return res.status(200).json(serializeCredential(credential));
+  }
+
+  async function deleteCredential(req: Request, res: Response) {
+    const { credentialKey } = req.params;
+    if (!isCredentialKey(credentialKey)) {
+      return res.status(400).json({ error: 'Invalid credential key' });
+    }
+    const result = await deps.deleteCredential('github', credentialKey);
+    return res.status(200).json({ credentialKey, deleted: result.deleted });
+  }
+
+  return {
+    getSyncStatus,
+    runSync,
+    setCredential,
+    deleteCredential,
+  };
+}
diff --git a/packages/api/src/admin/user.stats.ts b/packages/api/src/admin/user.stats.ts
index de6032d08e6..b08e5a9bbe0 100644
--- a/packages/api/src/admin/user.stats.ts
+++ b/packages/api/src/admin/user.stats.ts
@@ -56,11 +56,7 @@ function parseStatsDateQueryValue(raw: string | undefined): Date | undefined | '
       return 'invalid';
     }
     const local = new Date(y, monthIndex, day, hour, minute, second);
-    if (
-      local.getFullYear() !== y ||
-      local.getMonth() !== monthIndex ||
-      local.getDate() !== day
-    ) {
+    if (local.getFullYear() !== y || local.getMonth() !== monthIndex || local.getDate() !== day) {
       return 'invalid';
     }
     return local;
@@ -73,10 +69,12 @@ function parseStatsDateQueryValue(raw: string | undefined): Date | undefined | '
   return parsed;
 }
 
-function createGetUsersStatsHandler(deps: AdminUserStatsDeps) {
+function createGetUsersStatsHandler(
+  deps: AdminUserStatsDeps,
+): (req: ServerRequest, res: Response) => Promise<Response> {
   const { getAdminUsersStats } = deps;
 
-  return   async function getUsersStatsHandler(req: ServerRequest, res: Response) {
+  return async function getUsersStatsHandler(req: ServerRequest, res: Response) {
     try {
       const startRaw = firstQueryString(req.query.startDate);
       const endRaw = firstQueryString(req.query.endDate);
@@ -91,8 +89,7 @@ function createGetUsersStatsHandler(deps: AdminUserStatsDeps) {
       }
       if (endParsed === 'invalid') {
         return res.status(400).json({
-          error:
-            'Invalid endDate: use YYYY/MM/DD HH:mm:ss (e.g. 2026/04/16 23:59:59) or ISO 8601',
+          error: 'Invalid endDate: use YYYY/MM/DD HH:mm:ss (e.g. 2026/04/16 23:59:59) or ISO 8601',
         });
       }
 
@@ -126,7 +123,9 @@ function createGetUsersStatsHandler(deps: AdminUserStatsDeps) {
   };
 }
 
-export function createAdminUserStatsHandlers(deps: AdminUserStatsDeps) {
+export function createAdminUserStatsHandlers(deps: AdminUserStatsDeps): {
+  getUsersStats: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   return {
     getUsersStats: createGetUsersStatsHandler(deps),
   };
diff --git a/packages/api/src/admin/users.ts b/packages/api/src/admin/users.ts
index 6fc13fd97fd..d24eb1b7594 100644
--- a/packages/api/src/admin/users.ts
+++ b/packages/api/src/admin/users.ts
@@ -42,7 +42,11 @@ export interface AdminUsersDeps {
   }) => Promise<void>;
 }
 
-export function createAdminUsersHandlers(deps: AdminUsersDeps) {
+export function createAdminUsersHandlers(deps: AdminUsersDeps): {
+  listUsers: (req: ServerRequest, res: Response) => Promise<Response>;
+  searchUsers: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteUser: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const { findUsers, countUsers, deleteUserById, deleteConfig, deleteAclEntries } = deps;
 
   async function listUsersHandler(req: ServerRequest, res: Response) {
diff --git a/packages/api/src/agents/__tests__/estimateMediaTokensForMessage.spec.ts b/packages/api/src/agents/__tests__/estimateMediaTokensForMessage.spec.ts
index 370168ea5d8..1e4077fb9a2 100644
--- a/packages/api/src/agents/__tests__/estimateMediaTokensForMessage.spec.ts
+++ b/packages/api/src/agents/__tests__/estimateMediaTokensForMessage.spec.ts
@@ -8,12 +8,8 @@ jest.mock('@librechat/agents', () => ({
     }
     return null;
   }),
-  estimateAnthropicImageTokens: jest.fn(
-    (w: number, h: number) => Math.ceil((w * h) / 750),
-  ),
-  estimateOpenAIImageTokens: jest.fn(
-    (w: number, h: number) => Math.ceil((w * h) / 512) + 85,
-  ),
+  estimateAnthropicImageTokens: jest.fn((w: number, h: number) => Math.ceil((w * h) / 750)),
+  estimateOpenAIImageTokens: jest.fn((w: number, h: number) => Math.ceil((w * h) / 512) + 85),
 }));
 
 const fakeTokenCount = (text: string) => Math.ceil(text.length / 4);
@@ -72,14 +68,18 @@ describe('estimateMediaTokensForMessage', () => {
     });
 
     it('estimates tokens from decoded dimensions (OpenAI path)', () => {
-      const content = [{ type: 'image_url', image_url: 'data:image/png;base64,VALID_PNG_LONG_DATA' }];
+      const content = [
+        { type: 'image_url', image_url: 'data:image/png;base64,VALID_PNG_LONG_DATA' },
+      ];
       const result = estimateMediaTokensForMessage(content, false);
       expect(result).toBeGreaterThan(0);
       expect(result).not.toBe(1024);
     });
 
     it('estimates tokens from decoded dimensions (Claude path)', () => {
-      const content = [{ type: 'image_url', image_url: { url: 'data:image/png;base64,VALID_PNG_LONG_DATA' } }];
+      const content = [
+        { type: 'image_url', image_url: { url: 'data:image/png;base64,VALID_PNG_LONG_DATA' } },
+      ];
       const result = estimateMediaTokensForMessage(content, true);
       expect(result).toBeGreaterThan(0);
       expect(result).not.toBe(1024);
@@ -114,78 +114,92 @@ describe('estimateMediaTokensForMessage', () => {
 
   describe('document blocks - LangChain format (source_type)', () => {
     it('counts tokens for text source_type with getTokenCount', () => {
-      const content = [{
-        type: 'document',
-        source_type: 'text',
-        text: 'a'.repeat(400),
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'text',
+          text: 'a'.repeat(400),
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, false, fakeTokenCount)).toBe(100);
     });
 
     it('falls back to length/4 without getTokenCount', () => {
-      const content = [{
-        type: 'document',
-        source_type: 'text',
-        text: 'a'.repeat(400),
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'text',
+          text: 'a'.repeat(400),
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, false)).toBe(100);
     });
 
     it('estimates PDF pages for base64 source_type with application/pdf mime', () => {
       const pdfData = 'x'.repeat(150_000);
-      const content = [{
-        type: 'document',
-        source_type: 'base64',
-        data: pdfData,
-        mime_type: 'application/pdf',
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'base64',
+          data: pdfData,
+          mime_type: 'application/pdf',
+        },
+      ];
       const result = estimateMediaTokensForMessage(content, false);
       expect(result).toBe(2 * 1500);
     });
 
     it('uses Claude PDF rate when isClaude is true', () => {
       const pdfData = 'x'.repeat(150_000);
-      const content = [{
-        type: 'document',
-        source_type: 'base64',
-        data: pdfData,
-        mime_type: 'application/pdf',
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'base64',
+          data: pdfData,
+          mime_type: 'application/pdf',
+        },
+      ];
       const result = estimateMediaTokensForMessage(content, true);
       expect(result).toBe(2 * 2000);
     });
 
     it('defaults to PDF estimation for empty mime_type', () => {
       const pdfData = 'x'.repeat(10);
-      const content = [{
-        type: 'document',
-        source_type: 'base64',
-        data: pdfData,
-        mime_type: '',
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'base64',
+          data: pdfData,
+          mime_type: '',
+        },
+      ];
       const result = estimateMediaTokensForMessage(content, false);
       expect(result).toBe(1 * 1500);
     });
 
     it('handles image/* mime inside base64 source_type', () => {
-      const content = [{
-        type: 'document',
-        source_type: 'base64',
-        data: 'VALID_PNG',
-        mime_type: 'image/png',
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'base64',
+          data: 'VALID_PNG',
+          mime_type: 'image/png',
+        },
+      ];
       const result = estimateMediaTokensForMessage(content, true);
       expect(result).toBeGreaterThan(0);
       expect(result).not.toBe(1024);
     });
 
     it('falls back to 1024 for undecodable image in base64 source_type', () => {
-      const content = [{
-        type: 'document',
-        source_type: 'base64',
-        data: 'BAD_DATA',
-        mime_type: 'image/jpeg',
-      }];
+      const content = [
+        {
+          type: 'document',
+          source_type: 'base64',
+          data: 'BAD_DATA',
+          mime_type: 'image/jpeg',
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, false)).toBe(1024);
     });
 
@@ -197,50 +211,60 @@ describe('estimateMediaTokensForMessage', () => {
 
   describe('document blocks - Anthropic format (source object)', () => {
     it('counts tokens for text source type with getTokenCount', () => {
-      const content = [{
-        type: 'document',
-        source: { type: 'text', data: 'a'.repeat(800) },
-      }];
+      const content = [
+        {
+          type: 'document',
+          source: { type: 'text', data: 'a'.repeat(800) },
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, true, fakeTokenCount)).toBe(200);
     });
 
     it('falls back to length/4 for text source without getTokenCount', () => {
-      const content = [{
-        type: 'document',
-        source: { type: 'text', data: 'a'.repeat(800) },
-      }];
+      const content = [
+        {
+          type: 'document',
+          source: { type: 'text', data: 'a'.repeat(800) },
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, true)).toBe(200);
     });
 
     it('estimates PDF pages for base64 source with application/pdf', () => {
       const pdfData = 'x'.repeat(225_000);
-      const content = [{
-        type: 'document',
-        source: { type: 'base64', data: pdfData, media_type: 'application/pdf' },
-      }];
+      const content = [
+        {
+          type: 'document',
+          source: { type: 'base64', data: pdfData, media_type: 'application/pdf' },
+        },
+      ];
       const result = estimateMediaTokensForMessage(content, true);
       expect(result).toBe(3 * 2000);
     });
 
     it('returns URL fallback for url source type', () => {
-      const content = [{
-        type: 'document',
-        source: { type: 'url' },
-      }];
+      const content = [
+        {
+          type: 'document',
+          source: { type: 'url' },
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, false)).toBe(2000);
     });
 
     it('handles content source type with nested images', () => {
-      const content = [{
-        type: 'document',
-        source: {
-          type: 'content',
-          content: [
-            { type: 'image', source: { type: 'base64', data: 'VALID_PNG' } },
-            { type: 'image', source: { type: 'base64', data: 'UNDECODABLE' } },
-          ],
+      const content = [
+        {
+          type: 'document',
+          source: {
+            type: 'content',
+            content: [
+              { type: 'image', source: { type: 'base64', data: 'VALID_PNG' } },
+              { type: 'image', source: { type: 'base64', data: 'UNDECODABLE' } },
+            ],
+          },
         },
-      }];
+      ];
       const result = estimateMediaTokensForMessage(content, true);
       expect(result).toBeGreaterThan(1024);
     });
@@ -253,11 +277,13 @@ describe('estimateMediaTokensForMessage', () => {
 
   describe('file blocks', () => {
     it('uses same logic as document for file type blocks', () => {
-      const content = [{
-        type: 'file',
-        source_type: 'text',
-        text: 'a'.repeat(120),
-      }];
+      const content = [
+        {
+          type: 'file',
+          source_type: 'text',
+          text: 'a'.repeat(120),
+        },
+      ];
       expect(estimateMediaTokensForMessage(content, false, fakeTokenCount)).toBe(30);
     });
 
diff --git a/packages/api/src/agents/__tests__/initialize.test.ts b/packages/api/src/agents/__tests__/initialize.test.ts
index b98af340aa1..61e1a8afb25 100644
--- a/packages/api/src/agents/__tests__/initialize.test.ts
+++ b/packages/api/src/agents/__tests__/initialize.test.ts
@@ -11,7 +11,7 @@ jest.mock('@librechat/agents', () => ({
     parameters: {
       type: 'object',
       properties: {
-        file_path: {
+        path: {
           type: 'string',
           description: 'For skill files: "{skillName}/{path}".',
         },
@@ -33,26 +33,41 @@ jest.mock('@librechat/agents', () => ({
 }));
 
 import { Providers } from '@librechat/agents';
-import { EModelEndpoint } from 'librechat-data-provider';
+import { EModelEndpoint, EToolResources, Tools } from 'librechat-data-provider';
+import type { IMongoFile } from '@librechat/data-schemas';
 import type { Agent } from 'librechat-data-provider';
 import type { ServerRequest, InitializeResultBase, EndpointTokenConfig } from '~/types';
 import type { InitializeAgentDbMethods } from '../initialize';
 import { DEFAULT_MAX_CONTEXT_TOKENS } from '../initialize';
 
-// Mock logger
+// Mock logger — `format` must be a callable factory so @librechat/data-schemas
+// dist module-load completes cleanly; see api/test/__mocks__/logger.js.
 jest.mock('winston', () => ({
   createLogger: jest.fn(() => ({
     debug: jest.fn(),
     warn: jest.fn(),
     error: jest.fn(),
+    info: jest.fn(),
   })),
-  format: {
-    combine: jest.fn(),
-    colorize: jest.fn(),
-    simple: jest.fn(),
-  },
+  format: Object.assign(
+    jest.fn((fn) => () => ({ transform: fn })),
+    {
+      combine: jest.fn(),
+      colorize: jest.fn(),
+      simple: jest.fn(),
+      label: jest.fn(),
+      timestamp: jest.fn(),
+      printf: jest.fn(),
+      errors: jest.fn(),
+      splat: jest.fn(),
+      json: jest.fn(),
+    },
+  ),
+  addColors: jest.fn(),
   transports: {
     Console: jest.fn(),
+    DailyRotateFile: jest.fn(),
+    File: jest.fn(),
   },
 }));
 
@@ -112,6 +127,13 @@ function createMocks(overrides?: {
   maxOutputTokens?: number;
   endpointTokenConfig?: EndpointTokenConfig;
   useRealTokenLookup?: boolean;
+  providerTools?: unknown[];
+  loadedToolDefinitions?: Array<{
+    name: string;
+    description?: string;
+    parameters?: object;
+  }>;
+  structuredTools?: unknown[];
 }) {
   const {
     provider = Providers.OPENAI,
@@ -122,6 +144,9 @@ function createMocks(overrides?: {
     maxOutputTokens = 4096,
     endpointTokenConfig,
     useRealTokenLookup = false,
+    providerTools,
+    loadedToolDefinitions = [],
+    structuredTools = [],
   } = overrides ?? {};
 
   const resolvedOverrideProvider = overrideProvider ?? provider;
@@ -144,6 +169,7 @@ function createMocks(overrides?: {
   const mockGetOptions = jest.fn().mockResolvedValue({
     llmConfig: { model, maxTokens: maxOutputTokens },
     endpointTokenConfig,
+    ...(providerTools !== undefined ? { tools: providerTools } : {}),
   } satisfies InitializeResultBase);
 
   mockGetProviderConfig.mockReturnValue({
@@ -167,12 +193,12 @@ function createMocks(overrides?: {
   mockOptionalChainWithEmptyCheck.mockImplementation(realUtils.optionalChainWithEmptyCheck);
 
   const loadTools = jest.fn().mockResolvedValue({
-    tools: [],
+    tools: structuredTools,
     toolContextMap: {},
     dynamicToolContextMap: {},
     userMCPAuthMap: undefined,
     toolRegistry: undefined,
-    toolDefinitions: [],
+    toolDefinitions: loadedToolDefinitions,
     hasDeferredTools: false,
   });
 
@@ -188,6 +214,43 @@ function createMocks(overrides?: {
   return { agent, req, res, loadTools, db };
 }
 
+function countNamedWebSearchTools(tools: unknown[] | undefined): number {
+  return (
+    tools?.filter((tool) => {
+      if (tool == null || typeof tool !== 'object') {
+        return false;
+      }
+      const { name } = tool as { name?: unknown };
+      return name === Tools.web_search;
+    }).length ?? 0
+  );
+}
+
+function countGoogleSearchTools(tools: unknown[] | undefined): number {
+  return (
+    tools?.filter((tool) => {
+      if (tool == null || typeof tool !== 'object') {
+        return false;
+      }
+      return 'googleSearch' in tool || 'googleSearchRetrieval' in tool;
+    }).length ?? 0
+  );
+}
+
+function countWebSearchDefinitions(toolDefinitions: Array<{ name: string }> | undefined): number {
+  return (
+    toolDefinitions?.filter((toolDefinition) => toolDefinition.name === Tools.web_search).length ??
+    0
+  );
+}
+
+function countUrlContextTools(tools: unknown[] | undefined): number {
+  return (
+    tools?.filter((tool) => tool != null && typeof tool === 'object' && 'urlContext' in tool)
+      .length ?? 0
+  );
+}
+
 describe('initializeAgent — custom provider token lookup', () => {
   const CUSTOM_PROVIDER = 'EduGPT';
 
@@ -262,6 +325,381 @@ describe('initializeAgent — custom provider token lookup', () => {
   });
 });
 
+describe('initializeAgent — provider web_search precedence', () => {
+  const nativeWebSearchTool = {
+    type: 'web_search_20250305',
+    name: Tools.web_search,
+  };
+  const nativeGoogleSearchTool = { googleSearch: {} };
+  const libreChatWebSearchDefinition = {
+    name: Tools.web_search,
+    description: 'Search the web',
+    parameters: { type: 'object', properties: {} },
+  };
+  const mcpToolDefinition = {
+    name: 'mcp_lookup',
+    description: 'Lookup context',
+    parameters: { type: 'object', properties: {} },
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  async function initializeGoogleMixedToolAgent(model: string, provider = Providers.GOOGLE) {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider,
+      model,
+      providerTools: [nativeGoogleSearchTool],
+      loadedToolDefinitions: [mcpToolDefinition],
+    });
+    agent.tools = ['mcp_lookup'];
+
+    return initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([provider]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+  }
+
+  it('keeps Anthropic native web_search when LibreChat search is not selected', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.ANTHROPIC,
+      providerTools: [nativeWebSearchTool],
+    });
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.ANTHROPIC]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([nativeWebSearchTool]);
+    expect(countNamedWebSearchTools(result.tools)).toBe(1);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(0);
+  });
+
+  it('keeps LibreChat web_search definitions when native Anthropic search is not enabled', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.ANTHROPIC,
+      loadedToolDefinitions: [libreChatWebSearchDefinition],
+    });
+    agent.tools = [Tools.web_search];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.ANTHROPIC]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([]);
+    expect(countNamedWebSearchTools(result.tools)).toBe(0);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(1);
+  });
+
+  it('prefers LibreChat web_search when Anthropic native search is also enabled', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.ANTHROPIC,
+      providerTools: [nativeWebSearchTool],
+      loadedToolDefinitions: [libreChatWebSearchDefinition],
+    });
+    agent.tools = [Tools.web_search];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.ANTHROPIC]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([]);
+    expect(countNamedWebSearchTools(result.tools)).toBe(0);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(1);
+  });
+
+  it('keeps Google native search when LibreChat web_search is not selected', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
+      providerTools: [nativeGoogleSearchTool],
+      loadedToolDefinitions: [mcpToolDefinition],
+    });
+    agent.tools = ['mcp_lookup'];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(countGoogleSearchTools(result.tools)).toBe(1);
+    expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it('includes the mixed-tool flag for Vertex AI native search with external tools', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.VERTEXAI,
+      model: 'gemini-3.5-flash',
+      providerTools: [nativeGoogleSearchTool],
+      loadedToolDefinitions: [mcpToolDefinition],
+    });
+    agent.tools = ['mcp_lookup'];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.VERTEXAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it.each([
+    'gemini-3-flash-preview',
+    'gemini-3-pro-preview',
+    'gemini-3.1-pro-preview',
+    'gemini-3.1-pro-preview-customtools',
+    'gemini-3.1-flash-lite',
+    'gemini-3.1-flash-lite-preview',
+    'gemini-3.5-flash',
+    'google/gemini-3.5-flash-latest',
+    'models/gemini-3.10-pro-preview',
+    'gemini-4-pro-preview',
+  ])('allows Google mixed tools for supported Gemini text model %s', async (model) => {
+    const result = await initializeGoogleMixedToolAgent(model);
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it('sets the mixed-tool flag when the skill catalog adds the external tool', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
+      providerTools: [nativeGoogleSearchTool],
+    });
+    const { Types } = await import('mongoose');
+    const skillId = new Types.ObjectId();
+    const author = {
+      toString: () => req.user?.id,
+    } as unknown as import('mongoose').Types.ObjectId;
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+        accessibleSkillIds: [skillId],
+      },
+      {
+        ...db,
+        listSkillsByAccess: jest.fn().mockResolvedValue({
+          skills: [
+            {
+              _id: skillId,
+              name: 'research-helper',
+              description: 'Research current information.',
+              author,
+            },
+          ],
+          has_more: false,
+          after: null,
+        }),
+      },
+    );
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions?.map((toolDefinition) => toolDefinition.name)).toContain('skill');
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it.each([
+    'gemini-2.5-flash',
+    'gemini-3',
+    'gemini-3.1',
+    'gemini-3-pro-image-preview',
+    'gemini-3.1-flash-image',
+    'gemini-3.5-flash-live',
+    'gemini-4-pro-tts',
+  ])('rejects Google mixed tools for unsupported Gemini model %s', async (model) => {
+    await expect(initializeGoogleMixedToolAgent(model)).rejects.toThrow(/google_tool_conflict/);
+  });
+
+  it('prefers LibreChat web_search when Google native search is also enabled', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      providerTools: [nativeGoogleSearchTool],
+      loadedToolDefinitions: [libreChatWebSearchDefinition],
+    });
+    agent.tools = [Tools.web_search];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([]);
+    expect(countGoogleSearchTools(result.tools)).toBe(0);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(1);
+  });
+
+  it('leaves providers without a native web search conflict unchanged', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.OPENAI,
+      providerTools: [nativeWebSearchTool],
+      loadedToolDefinitions: [libreChatWebSearchDefinition],
+    });
+    agent.tools = [Tools.web_search];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([nativeWebSearchTool]);
+    expect(countNamedWebSearchTools(result.tools)).toBe(1);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(1);
+  });
+
+  it('treats the Google urlContext tool as a native provider tool', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      model: 'gemini-1.5-flash',
+      providerTools: [{ urlContext: {} }],
+    });
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([{ urlContext: {} }]);
+    expect(countUrlContextTools(result.tools)).toBe(1);
+  });
+
+  it('preserves the Google urlContext tool when LibreChat web_search is also enabled', async () => {
+    /**
+     * url_context is unrelated to web search, so the LibreChat web_search conflict
+     * resolver must not strip the native urlContext tool. The combination of a
+     * provider tool with an agent tool requires a combination-capable Gemini model.
+     */
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
+      providerTools: [{ urlContext: {} }],
+      loadedToolDefinitions: [libreChatWebSearchDefinition],
+    });
+    agent.tools = [Tools.web_search];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([{ urlContext: {} }]);
+    expect(countUrlContextTools(result.tools)).toBe(1);
+    expect(countWebSearchDefinitions(result.toolDefinitions)).toBe(1);
+  });
+});
+
 describe('initializeAgent — stable and dynamic instruction fields', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -289,6 +727,31 @@ describe('initializeAgent — stable and dynamic instruction fields', () => {
     expect(result.additional_instructions).toBe('Conversation opened at 2023-12-31T23:59:58.000Z');
   });
 
+  it('resolves temporal special vars in the request timezone', async () => {
+    const { agent, req, res, loadTools, db } = createMocks();
+    agent.instructions = 'It is currently {{current_datetime}}.';
+    req.conversationCreatedAt = '2024-01-15T18:30:00.000Z';
+    req.body = { timezone: 'America/New_York' };
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.instructions).toBeUndefined();
+    expect(result.additional_instructions).toBe(
+      'It is currently 2024-01-15 13:30:00 -05:00 (Monday).',
+    );
+  });
+
   it('keeps non-temporal special vars in stable instructions', async () => {
     const { agent, req, res, loadTools, db } = createMocks();
     agent.instructions = 'You are helping {{current_user}}.';
@@ -339,6 +802,92 @@ describe('initializeAgent — stable and dynamic instruction fields', () => {
   });
 });
 
+describe('initializeAgent — attachment scoping', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('keeps request attachments separate from agent context attachments', async () => {
+    const { primeResources } = jest.requireMock('../resources') as {
+      primeResources: jest.Mock;
+    };
+    const requestFile = { file_id: 'request-file', filename: 'request.txt' };
+    const agentContextFile = { file_id: 'agent-context-file', filename: 'agent-context.txt' };
+    primeResources.mockResolvedValueOnce({
+      attachments: [agentContextFile, requestFile],
+      requestAttachments: [requestFile],
+      agentContextAttachments: [agentContextFile],
+      tool_resources: undefined,
+    });
+
+    const { agent, req, res, loadTools, db } = createMocks();
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.attachments).toEqual([agentContextFile, requestFile]);
+    expect(result.requestAttachments).toEqual([requestFile]);
+    expect(result.agentContextAttachments).toEqual([agentContextFile]);
+  });
+
+  it('owner-scopes request file usage updates while preserving trusted tool files', async () => {
+    const requestFile = { file_id: 'request-file', filename: 'request.txt' } as IMongoFile;
+    const toolFile = { file_id: 'tool-file', filename: 'tool.txt' } as IMongoFile;
+    const { agent, req, res, loadTools, db } = createMocks();
+
+    agent.tools = [EToolResources.file_search];
+    mockExtractLibreChatParams.mockReturnValueOnce({
+      resendFiles: true,
+      maxContextTokens: undefined,
+      modelOptions: { model: agent.model },
+    });
+    (db.getConvoFiles as jest.Mock).mockResolvedValueOnce([toolFile.file_id]);
+    (db.getToolFilesByIds as jest.Mock).mockResolvedValueOnce([toolFile]);
+    (db.updateFilesUsage as jest.Mock)
+      .mockResolvedValueOnce([requestFile])
+      .mockResolvedValueOnce([toolFile]);
+
+    await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        requestFiles: [requestFile],
+        conversationId: 'conversation-1',
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(db.getToolFilesByIds).toHaveBeenCalledWith(
+      [toolFile.file_id],
+      new Set([EToolResources.file_search]),
+      { userId: 'user-1', tenantId: undefined },
+    );
+    expect(db.updateFilesUsage).toHaveBeenNthCalledWith(1, [requestFile], undefined, {
+      user: 'user-1',
+      tenantId: undefined,
+    });
+    expect(db.updateFilesUsage).toHaveBeenNthCalledWith(2, [toolFile], undefined, {
+      user: 'user-1',
+      tenantId: undefined,
+    });
+  });
+});
+
 describe('initializeAgent — maxContextTokens', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -956,13 +1505,11 @@ describe('initializeAgent — skill `allowed-tools` union (Phase 6)', () => {
     expect(definedNames).not.toContain('mcp__broken__tool');
   });
 
-  it('falls through to empty toolDefinitions when BOTH the union and base-only loadTools calls return undefined', async () => {
+  it('falls back to host-provided skill authoring tools when BOTH loadTools calls return undefined', async () => {
     /* Worst-case silent-failure path: production loaders catch errors
        and return undefined. If the agent's own tools fail to load AND
-       the retry without extras also fails, we have nothing to give the
-       LLM. The current behavior is to fall through to the `?? {}`
-       fallback rather than throw — pinning that contract here so the
-       turn doesn't crash hard but the agent simply has no tools. */
+       the retry without extras also fails, loaded registry tools drop out,
+       but host-provided file authoring remains available for skill access. */
     const { agent, req, res, loadTools, db } = createMocks();
     agent.tools = ['web_search'];
     const { Types } = await import('mongoose');
@@ -988,16 +1535,18 @@ describe('initializeAgent — skill `allowed-tools` union (Phase 6)', () => {
         allowedProviders: new Set([Providers.OPENAI]),
         isInitialAgent: true,
         accessibleSkillIds: [skillId],
+        skillAuthoringAvailable: true,
         manualSkills: ['broken-skill'],
       },
       { ...db, listSkillsByAccess: emptyListSkillsByAccess, getSkillByName },
     );
 
-    /* Two attempts (initial + retry), both undefined → empty fallback.
-       The agent gets no tool definitions for the turn but does NOT
-       crash; downstream code handles the empty case. */
+    /* Two attempts (initial + retry), both undefined. Registry-backed tools
+       fall away, but read/create/edit_file are registered by the initializer
+       so skill authoring still works. */
     expect(loadTools).toHaveBeenCalledTimes(2);
-    expect(result.toolDefinitions).toEqual([]);
+    const definedNames = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(definedNames).toEqual(['read_file', 'create_file', 'edit_file']);
   });
 
   it('propagates the error when loadTools fails AND there are no skill-added extras to drop', async () => {
@@ -1079,6 +1628,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).toContain('bash_tool');
     expect(names).toContain('read_file');
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
     /* The legacy `execute_code` tool def is no longer registered by this
        path — the string stays in `agent.tools` as the capability trigger
        but never appears in the tool definitions the LLM sees. */
@@ -1087,6 +1638,12 @@ describe('initializeAgent — execute_code capability expansion', () => {
     expect(readFile?.description).toContain('code-execution sandbox');
     expect(readFile?.description).not.toContain('{skillName}');
     expect(readFile?.description).not.toContain('SKILL.md');
+    const createFile = result.toolDefinitions?.find((d) => d.name === 'create_file');
+    expect(createFile?.description).toContain('code-execution sandbox');
+    expect(createFile?.description).toContain('/mnt/data/');
+    expect(createFile?.description).not.toContain('skills/');
+    expect(result.skillAuthoringAvailable).toBe(false);
+    expect(result.fileAuthoringToolNames).toEqual(new Set(['create_file', 'edit_file']));
   });
 
   it('upgrades read_file to the skill-aware description when active skills are in scope', async () => {
@@ -1127,8 +1684,92 @@ describe('initializeAgent — execute_code capability expansion', () => {
 
     const readFile = result.toolDefinitions?.find((d) => d.name === 'read_file');
     expect(readFile?.description).toContain('{skillName}/{filePath}');
+    expect(readFile?.description).toContain('skills/{skillName}/');
+    expect(readFile?.description).toContain('SKILL.md');
+    const names = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(names).toContain('skill');
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
+  });
+
+  it('keeps skill authoring tools hidden for read-only skill access', async () => {
+    const { agent, req, res, loadTools, db } = createMocks();
+    agent.tools = [];
+    const { Types } = await import('mongoose');
+    const skillId = new Types.ObjectId();
+    const author = { toString: () => req.user?.id } as unknown as import('mongoose').Types.ObjectId;
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+        codeEnvAvailable: false,
+        accessibleSkillIds: [skillId],
+        skillAuthoringAvailable: false,
+      },
+      {
+        ...db,
+        listSkillsByAccess: jest.fn().mockResolvedValue({
+          skills: [
+            {
+              _id: skillId,
+              name: 'read-only-skill',
+              description: 'Read-only skill.',
+              author,
+            },
+          ],
+          has_more: false,
+          after: null,
+        }),
+      },
+    );
+
+    const names = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(names).toContain('skill');
+    expect(names).toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
+    expect(names).not.toContain('bash_tool');
+    expect(result.skillAuthoringAvailable).toBe(false);
+  });
+
+  it('registers skill authoring tools for first-time skill creators', async () => {
+    const { agent, req, res, loadTools, db } = createMocks();
+    agent.tools = [];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+        accessibleSkillIds: [],
+        skillAuthoringAvailable: true,
+        codeEnvAvailable: false,
+      },
+      db,
+    );
+
+    const names = (result.toolDefinitions ?? []).map((d) => d.name);
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
+    expect(names).toContain('read_file');
+    expect(names).not.toContain('bash_tool');
+    const readFile = result.toolDefinitions?.find((d) => d.name === 'read_file');
+    expect(readFile?.description).toContain('skills/{skillName}/');
     expect(readFile?.description).toContain('SKILL.md');
-    expect(result.toolDefinitions?.map((d) => d.name)).toContain('skill');
+    const createFile = result.toolDefinitions?.find((d) => d.name === 'create_file');
+    expect(createFile?.description).toContain('skills/');
+    expect(result.skillAuthoringAvailable).toBe(true);
+    expect(result.fileAuthoringToolNames).toEqual(new Set(['create_file', 'edit_file']));
   });
 
   it('does not register bash_tool + read_file when codeEnvAvailable=false', async () => {
@@ -1152,6 +1793,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).not.toContain('bash_tool');
     expect(names).not.toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
   });
 
   it('does not register bash_tool + read_file when agent does not request execute_code', async () => {
@@ -1175,6 +1818,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).not.toContain('bash_tool');
     expect(names).not.toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
   });
 
   it('narrows codeEnvAvailable on InitializedAgent to the per-agent effective value', async () => {
@@ -1254,27 +1899,21 @@ describe('initializeAgent — execute_code capability expansion', () => {
     expect(neitherAgent.codeEnvAvailable).toBe(false);
   });
 
-  it('trips GOOGLE_TOOL_CONFLICT on Google/Vertex when execute_code expands alongside provider tools', async () => {
-    /* Pre-Phase 8, an `execute_code`-only agent on Google/Vertex with
-       `options.tools` populated would throw GOOGLE_TOOL_CONFLICT because
-       `CodeExecutionToolDefinition` populated `toolDefinitions` and
-       `hasAgentTools` was true. After dropping that registry entry, the
-       check is now gated on the runtime-expanded `bash_tool` + `read_file`
-       pair — so the expansion MUST happen before `hasAgentTools` is
-       computed or the guard silently goes away for this scenario. */
+  it('allows Google provider tools alongside execute_code definitions', async () => {
     const { agent, req, res, loadTools, db } = createMocks({
       provider: Providers.GOOGLE,
       overrideProvider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
     });
     agent.tools = ['execute_code'];
 
     /* Surface an options.tools array from the provider config — this is
-       the `google_search` / `url_context` built-in LLM tooling that
+       the `googleSearch` / `urlContext` built-in LLM tooling that
        Google/Vertex exposes via provider options. */
     mockGetProviderConfig.mockReturnValue({
       getOptions: jest.fn().mockResolvedValue({
-        llmConfig: { model: 'test-model', maxTokens: 4096 },
-        tools: [{ google_search: {} }],
+        llmConfig: { model: 'gemini-3.5-flash', maxTokens: 4096 },
+        tools: [{ googleSearch: {} }],
       } satisfies InitializeResultBase),
       overrideProvider: Providers.GOOGLE,
     });
@@ -1293,7 +1932,58 @@ describe('initializeAgent — execute_code capability expansion', () => {
         },
         db,
       ),
-    ).rejects.toThrow(/google_tool_conflict/);
+    ).resolves.toEqual(
+      expect.objectContaining({
+        tools: [{ googleSearch: {} }],
+        model_parameters: expect.objectContaining({
+          includeServerSideToolInvocations: true,
+        }),
+        toolDefinitions: expect.arrayContaining([
+          expect.objectContaining({ name: 'bash_tool' }),
+          expect.objectContaining({ name: 'read_file' }),
+        ]),
+      }),
+    );
+  });
+
+  it('combines Google provider tools with structured external tools', async () => {
+    const structuredTool = {
+      name: 'weather',
+      description: 'Get weather',
+      schema: { type: 'object', properties: {} },
+    };
+    const providerTool = { googleSearch: {} };
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      overrideProvider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
+      providerTools: [providerTool],
+      structuredTools: [structuredTool],
+    });
+    agent.tools = ['weather'];
+
+    await expect(
+      initializeAgent(
+        {
+          req,
+          res,
+          agent,
+          loadTools,
+          endpointOption: { endpoint: EModelEndpoint.agents },
+          allowedProviders: new Set([Providers.GOOGLE]),
+          isInitialAgent: true,
+          codeEnvAvailable: false,
+        },
+        db,
+      ),
+    ).resolves.toEqual(
+      expect.objectContaining({
+        tools: [structuredTool, providerTool],
+        model_parameters: expect.objectContaining({
+          includeServerSideToolInvocations: true,
+        }),
+      }),
+    );
   });
 });
 
@@ -1374,13 +2064,17 @@ describe('initializeAgent — code-generated file thread filter (regression)', (
     );
 
     expect(getCodeGeneratedFiles).toHaveBeenCalledTimes(1);
-    expect(getCodeGeneratedFiles).toHaveBeenCalledWith('conv-1', [
-      'file-pptx-skill',
-      'file-output-csv',
-    ]);
+    expect(getCodeGeneratedFiles).toHaveBeenCalledWith(
+      'conv-1',
+      ['file-pptx-skill', 'file-output-csv'],
+      { userId: 'user-1', tenantId: undefined },
+    );
     /* Both functions now share the same primary anchor — symmetric
      * design that closes the sibling-branch hole. */
-    expect(getUserCodeFiles).toHaveBeenCalledWith(['file-pptx-skill', 'file-output-csv']);
+    expect(getUserCodeFiles).toHaveBeenCalledWith(['file-pptx-skill', 'file-output-csv'], {
+      userId: 'user-1',
+      tenantId: undefined,
+    });
   });
 
   it('selects messages.attachments alongside messages.files (regression)', async () => {
@@ -1468,10 +2162,64 @@ describe('initializeAgent — code-generated file thread filter (regression)', (
       { ...db, getMessages, getCodeGeneratedFiles, getUserCodeFiles },
     );
 
-    expect(getCodeGeneratedFiles).toHaveBeenCalledWith('conv-1', []);
+    expect(getCodeGeneratedFiles).toHaveBeenCalledWith('conv-1', [], {
+      userId: 'user-1',
+      tenantId: undefined,
+    });
     /* `getUserCodeFiles` is gated on a non-empty array at the call site,
      * so it shouldn't be invoked at all. `getCodeGeneratedFiles`'s own
      * empty-guard is exercised by data-schemas tests. */
     expect(getUserCodeFiles).not.toHaveBeenCalled();
   });
 });
+
+describe('initializeAgent — run-scoped MCP tool definitions', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('carries mcpAvailableTools from the loadTools result onto the initialized agent', async () => {
+    /** Regression guard for the request-scoped MCP/PTC handoff: dropping this
+     *  field at the destructure boundary forces per-call reinitialization
+     *  downstream and can storm the MCP circuit breaker. */
+    const { agent, req, res, loadTools, db } = createMocks();
+    const mcpTool = 'list_tables_mcp_ClickHouse';
+    const mcpAvailableTools = {
+      ClickHouse: {
+        [mcpTool]: {
+          type: 'function' as const,
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object' as const, properties: {} },
+          },
+        },
+      },
+    };
+    loadTools.mockResolvedValue({
+      tools: [],
+      toolContextMap: {},
+      dynamicToolContextMap: {},
+      userMCPAuthMap: undefined,
+      toolRegistry: undefined,
+      toolDefinitions: [],
+      hasDeferredTools: false,
+      mcpAvailableTools,
+    });
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.mcpAvailableTools).toEqual(mcpAvailableTools);
+  });
+});
diff --git a/packages/api/src/agents/__tests__/load.spec.ts b/packages/api/src/agents/__tests__/load.spec.ts
index b7c6142d695..705c5e8ef78 100644
--- a/packages/api/src/agents/__tests__/load.spec.ts
+++ b/packages/api/src/agents/__tests__/load.spec.ts
@@ -1,10 +1,17 @@
 import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
-import { Constants } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import { Constants, FileSources } from 'librechat-data-provider';
 import { agentSchema, createMethods } from '@librechat/data-schemas';
-import type { AgentModelParameters } from 'librechat-data-provider';
+import type {
+  Agent as LibreChatAgent,
+  AgentModelParameters,
+  TEphemeralAgent,
+  TConversation,
+} from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
 import type { LoadAgentParams, LoadAgentDeps } from '../load';
+import { loadAddedAgent } from '../added';
 import { loadAgent } from '../load';
 
 let Agent: mongoose.Model<unknown>;
@@ -14,7 +21,7 @@ let getAgent: ReturnType<typeof createMethods>['getAgent'];
 const mockGetMCPServerTools = jest.fn();
 
 const deps: LoadAgentDeps = {
-  getAgent: (searchParameter) => getAgent(searchParameter),
+  getAgent: (searchParameter) => getAgent(searchParameter) as Promise<LibreChatAgent | null>,
   getMCPServerTools: mockGetMCPServerTools,
 };
 
@@ -122,6 +129,44 @@ describe('loadAgent', () => {
     }
   });
 
+  test('should skip cached tools for servers made request-scoped by a config overlay', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    mockGetMCPServerTools.mockResolvedValue({ tool1_mcp_server1: {} });
+
+    const mockReq = {
+      user: { id: 'user123' },
+      config: {
+        mcpConfig: {
+          'body-scoped': {
+            type: 'streamable-http' as const,
+            url: 'https://mcp.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+          },
+        },
+      } as unknown as AppConfig,
+      body: {
+        ephemeralAgent: {
+          mcp: ['body-scoped', 'server1'],
+        },
+      },
+    };
+
+    const result = await loadAgent(
+      {
+        req: mockReq,
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(mockGetMCPServerTools).toHaveBeenCalledTimes(1);
+    expect(mockGetMCPServerTools).toHaveBeenCalledWith('user123', 'server1');
+    expect(result?.tools).toContain(`${Constants.mcp_all}${Constants.mcp_delimiter}body-scoped`);
+    expect(result?.tools).toContain('tool1_mcp_server1');
+  });
+
   test('should return null for non-existent agent', async () => {
     const mockReq = { user: { id: 'user123' } };
     const result = await loadAgent(
@@ -233,6 +278,356 @@ describe('loadAgent', () => {
     }
   });
 
+  test('should use parsed promptPrefix for ephemeral agent instructions', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: { user: { id: 'user123' }, body: {} },
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: {
+          model: 'gpt-4',
+          promptPrefix: 'Server-side model spec instructions',
+        } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.instructions).toBe('Server-side model spec instructions');
+    expect(result?.model_parameters).not.toHaveProperty('promptPrefix');
+  });
+
+  test('should enable full skill scope for ephemeral model spec with skills true', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {
+            ephemeralAgent: {
+              subagents: { enabled: false, agent_ids: ['agent_tampered'] },
+            } as unknown as TEphemeralAgent,
+          },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'skills-on',
+                  label: 'Skills On',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: true,
+                },
+              ],
+            },
+          },
+        },
+        spec: 'skills-on',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toBeUndefined();
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should initialize an empty allowlist for ephemeral model spec skill names', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {},
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'scoped-skills',
+                  label: 'Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['finance-analyst', 'brand-writer'],
+                },
+              ],
+            },
+          },
+        },
+        spec: 'scoped-skills',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+  });
+
+  test('should apply subagent config for ephemeral model specs', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {},
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'self-spawn',
+                  label: 'Self Spawn',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        spec: 'self-spawn',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toEqual(subagents);
+  });
+
+  test('should ignore request subagents for ephemeral agents', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {
+            ephemeralAgent: {
+              subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_other'] },
+            } as unknown as TEphemeralAgent,
+          },
+        },
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should ignore request subagents when added agent mirrors ephemeral primary tools', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          ephemeralAgent: { subagents: { enabled: true, allowSelf: true, agent_ids: [] } },
+        } as unknown as TConversation,
+        primaryAgent: { id: EPHEMERAL_AGENT_ID as string, tools: ['web_search'] } as LibreChatAgent,
+      },
+      deps,
+    );
+
+    expect(result?.tools).toEqual(['web_search']);
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should ignore request subagents for added ephemeral agents', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          ephemeralAgent: { subagents: { enabled: true, allowSelf: true, agent_ids: [] } },
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should enable full skill scope for added ephemeral model spec with skills true', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-skills-on',
+                  label: 'Added Skills On',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: true,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-skills-on',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toBeUndefined();
+  });
+
+  test('should initialize an empty allowlist for added ephemeral model spec skill names', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-scoped-skills',
+                  label: 'Added Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['finance-analyst', 'brand-writer'],
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-scoped-skills',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+  });
+
+  test('should apply subagent config for added ephemeral model specs', async () => {
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-self-spawn',
+                  label: 'Added Self Spawn',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-self-spawn',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toEqual(subagents);
+  });
+
+  test('should apply model spec skills when added agent mirrors ephemeral primary tools', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'mirrored-scoped-skills',
+                  label: 'Mirrored Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['brand-writer'],
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'mirrored-scoped-skills',
+        } as unknown as TConversation,
+        primaryAgent: { id: EPHEMERAL_AGENT_ID as string, tools: ['web_search'] } as LibreChatAgent,
+      },
+      deps,
+    );
+
+    expect(result?.tools).toEqual(['web_search']);
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+    expect(result?.subagents).toEqual(subagents);
+  });
+
   test('should handle ephemeral agent with undefined ephemeralAgent in body', async () => {
     const { EPHEMERAL_AGENT_ID } = Constants;
 
diff --git a/packages/api/src/agents/__tests__/memory.test.ts b/packages/api/src/agents/__tests__/memory.test.ts
index dabe6de629a..25551020574 100644
--- a/packages/api/src/agents/__tests__/memory.test.ts
+++ b/packages/api/src/agents/__tests__/memory.test.ts
@@ -5,19 +5,35 @@ import type { MemoryArtifact } from 'librechat-data-provider';
 import { createMemoryTool, processMemory } from '../memory';
 
 // Mock the logger
+// `winston.format` must be a callable factory (real winston returns a Format
+// constructor) so that `@librechat/data-schemas` dist code can complete its
+// module-load — see api/test/__mocks__/logger.js for the canonical shape.
 jest.mock('winston', () => ({
   createLogger: jest.fn(() => ({
     debug: jest.fn(),
     warn: jest.fn(),
     error: jest.fn(),
+    info: jest.fn(),
   })),
-  format: {
-    combine: jest.fn(),
-    colorize: jest.fn(),
-    simple: jest.fn(),
-  },
+  format: Object.assign(
+    jest.fn((fn) => () => ({ transform: fn })),
+    {
+      combine: jest.fn(),
+      colorize: jest.fn(),
+      simple: jest.fn(),
+      label: jest.fn(),
+      timestamp: jest.fn(),
+      printf: jest.fn(),
+      errors: jest.fn(),
+      splat: jest.fn(),
+      json: jest.fn(),
+    },
+  ),
+  addColors: jest.fn(),
   transports: {
     Console: jest.fn(),
+    DailyRotateFile: jest.fn(),
+    File: jest.fn(),
   },
 }));
 
@@ -394,6 +410,7 @@ describe('processMemory - GPT-5+ handling', () => {
           llmConfig: expect.objectContaining({
             model: 'gpt-4.1-mini',
             temperature: 0.4, // Default temperature should remain
+            maxRetries: 0,
           }),
         }),
       }),
diff --git a/packages/api/src/agents/__tests__/run-summarization.test.ts b/packages/api/src/agents/__tests__/run-summarization.test.ts
index 1aa8e0d58d5..868010b1e80 100644
--- a/packages/api/src/agents/__tests__/run-summarization.test.ts
+++ b/packages/api/src/agents/__tests__/run-summarization.test.ts
@@ -1,15 +1,16 @@
 import { logger } from '@librechat/data-schemas';
-import type { AppConfig } from '@librechat/data-schemas';
-import type { SummarizationConfig, TEndpoint } from 'librechat-data-provider';
 import {
   EModelEndpoint,
   FileSources,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_RUN_CONFIGS,
 } from 'librechat-data-provider';
+import type { SummarizationConfig, TEndpoint } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
 import { createRun } from '~/agents/run';
 
-// Mock winston logger
+// Mock winston logger — `format` must be callable so @librechat/data-schemas
+// dist module-load completes cleanly; see api/test/__mocks__/logger.js.
 jest.mock('winston', () => ({
   createLogger: jest.fn(() => ({
     debug: jest.fn(),
@@ -17,8 +18,26 @@ jest.mock('winston', () => ({
     error: jest.fn(),
     info: jest.fn(),
   })),
-  format: { combine: jest.fn(), colorize: jest.fn(), simple: jest.fn() },
-  transports: { Console: jest.fn() },
+  format: Object.assign(
+    jest.fn((fn) => () => ({ transform: fn })),
+    {
+      combine: jest.fn(),
+      colorize: jest.fn(),
+      simple: jest.fn(),
+      label: jest.fn(),
+      timestamp: jest.fn(),
+      printf: jest.fn(),
+      errors: jest.fn(),
+      splat: jest.fn(),
+      json: jest.fn(),
+    },
+  ),
+  addColors: jest.fn(),
+  transports: {
+    Console: jest.fn(),
+    DailyRotateFile: jest.fn(),
+    File: jest.fn(),
+  },
 }));
 
 // Mock env utilities so header resolution doesn't fail
@@ -186,6 +205,39 @@ beforeEach(() => {
   jest.clearAllMocks();
 });
 
+// ---------------------------------------------------------------------------
+// Suite: custom endpoint stream usage defaults
+// ---------------------------------------------------------------------------
+describe('custom endpoint stream usage defaults', () => {
+  it('disables streamUsage by default for OpenAI-compatible custom endpoints', async () => {
+    const agents = await callAndCapture({
+      agents: [makeAgent({ endpoint: 'LiteLLM' })],
+    });
+    const clientOptions = agents[0].clientOptions as Record<string, unknown>;
+
+    expect(clientOptions.streamUsage).toBe(false);
+    expect(clientOptions.usage).toBe(true);
+  });
+
+  it('respects explicit streamUsage from endpoint-resolved model parameters', async () => {
+    const agents = await callAndCapture({
+      agents: [
+        makeAgent({
+          endpoint: 'LiteLLM',
+          model_parameters: {
+            model: 'gpt-4o',
+            streamUsage: true,
+          },
+        }),
+      ],
+    });
+    const clientOptions = agents[0].clientOptions as Record<string, unknown>;
+
+    expect(clientOptions.streamUsage).toBe(true);
+    expect(clientOptions.usage).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Suite 1: reserveRatio
 // ---------------------------------------------------------------------------
@@ -1051,39 +1103,88 @@ describe('subagentConfigs', () => {
   });
 });
 
+/**
+ * Captures the top-level `Run.create` config (not just agentInputs) so tests
+ * can assert presence/absence of run-level options.
+ */
+async function callAndCaptureRunConfig({
+  overrides,
+  user,
+  tenantId,
+}: {
+  overrides?: Record<string, unknown>;
+  user?: Record<string, unknown>;
+  tenantId?: string;
+} = {}): Promise<Record<string, unknown>> {
+  const agents = [makeAgent(overrides)];
+  const signal = new AbortController().signal;
+
+  await createRun({
+    agents: agents as never,
+    signal,
+    streaming: true,
+    streamUsage: true,
+    user: user as never,
+    tenantId,
+  });
+
+  const createMock = Run.create as jest.Mock;
+  expect(createMock).toHaveBeenCalledTimes(1);
+  return createMock.mock.calls[0][0] as Record<string, unknown>;
+}
+
 // ---------------------------------------------------------------------------
-// Suite: toolOutputReferences gating
+// Suite: Langfuse run config
 // ---------------------------------------------------------------------------
-describe('toolOutputReferences gating', () => {
-  /**
-   * Captures the top-level `Run.create` config (not just agentInputs) so the
-   * test can assert presence/absence of the `toolOutputReferences` key.
-   */
-  async function callAndCaptureRunConfig(
-    overrides?: Record<string, unknown>,
-  ): Promise<Record<string, unknown>> {
-    const agents = [makeAgent(overrides)];
-    const signal = new AbortController().signal;
+describe('Langfuse run config', () => {
+  it('passes deterministic Langfuse trace config without tenant metadata by default', async () => {
+    const callArgs = await callAndCaptureRunConfig();
+    expect(callArgs.langfuse).toEqual({ deterministicTraceId: true });
+  });
 
-    await createRun({
-      agents: agents as never,
-      signal,
-      streaming: true,
-      streamUsage: true,
+  it('adds the explicit request tenant id to Langfuse trace metadata and tags', async () => {
+    const callArgs = await callAndCaptureRunConfig({
+      user: {
+        id: 'user-1',
+      },
+      tenantId: 'tenant-1',
     });
+    expect(callArgs.langfuse).toEqual({
+      deterministicTraceId: true,
+      metadata: { 'librechat.tenant.id': 'tenant-1' },
+      tags: ['tenant:tenant-1'],
+    });
+  });
 
-    const createMock = Run.create as jest.Mock;
-    expect(createMock).toHaveBeenCalledTimes(1);
-    return createMock.mock.calls[0][0] as Record<string, unknown>;
-  }
+  it('falls back to a full user tenant id for direct createRun callers', async () => {
+    const callArgs = await callAndCaptureRunConfig({
+      user: {
+        tenantId: 'tenant-2',
+      },
+    });
+    expect(callArgs.langfuse).toEqual({
+      deterministicTraceId: true,
+      metadata: { 'librechat.tenant.id': 'tenant-2' },
+      tags: ['tenant:tenant-2'],
+    });
+  });
+});
 
+// ---------------------------------------------------------------------------
+// Suite: toolOutputReferences gating
+// ---------------------------------------------------------------------------
+describe('toolOutputReferences gating', () => {
   it('passes toolOutputReferences when agent has codeEnvAvailable=true', async () => {
-    const callArgs = await callAndCaptureRunConfig({ codeEnvAvailable: true });
+    const callArgs = await callAndCaptureRunConfig({
+      overrides: { codeEnvAvailable: true },
+    });
     expect(callArgs.toolOutputReferences).toEqual({ enabled: true });
   });
 
   it('omits toolOutputReferences when codeEnvAvailable is false', async () => {
-    const callArgs = await callAndCaptureRunConfig({ codeEnvAvailable: false });
+    const callArgs = await callAndCaptureRunConfig({
+      overrides: { codeEnvAvailable: false },
+    });
     expect(callArgs).not.toHaveProperty('toolOutputReferences');
   });
 
diff --git a/packages/api/src/agents/__tests__/skills.test.ts b/packages/api/src/agents/__tests__/skills.test.ts
index 3142273f7cf..87c849fc8f6 100644
--- a/packages/api/src/agents/__tests__/skills.test.ts
+++ b/packages/api/src/agents/__tests__/skills.test.ts
@@ -38,12 +38,14 @@ import {
   scopeSkillIds,
   resolveSkillActive,
   resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
   injectSkillCatalog,
   buildSkillPrimeMessage,
   resolveManualSkills,
   resolveAlwaysApplySkills,
   injectManualSkillPrimes,
   injectSkillPrimes,
+  collectFreshSkillPrimeNames,
   extractManualSkills,
   isSkillPrimeMessage,
   buildSkillPrimeContentParts,
@@ -252,9 +254,9 @@ describe('scopeSkillIds', () => {
     expect(scopeSkillIds(accessible, null)).toBe(accessible);
   });
 
-  it('returns [] when agentSkills is an empty array (explicit none)', () => {
+  it('returns the full set when agentSkills is an empty array (no allowlist)', () => {
     const accessible = [makeId(), makeId()];
-    expect(scopeSkillIds(accessible, [])).toEqual([]);
+    expect(scopeSkillIds(accessible, [])).toBe(accessible);
   });
 
   it('returns intersection when agentSkills overlaps accessibleSkillIds', () => {
@@ -312,9 +314,11 @@ describe('resolveAgentScopedSkillIds', () => {
   });
   const ephemeralAgent = (
     skills?: string[],
+    skills_enabled?: boolean,
   ): { id: string; skills?: string[]; skills_enabled?: boolean } => ({
     id: 'ephemeral_convo_xyz',
     skills,
+    skills_enabled,
   });
 
   it('returns [] when the skills capability is disabled, even with every other signal on', () => {
@@ -366,14 +370,50 @@ describe('resolveAgentScopedSkillIds', () => {
       expect(scoped.map((o) => o.toString()).sort()).toEqual([a.toString(), b.toString()].sort());
     });
 
-    it('ignores any `skills` field on an ephemeral agent (toggle is the only signal)', () => {
+    it('returns the full accessible catalog when a model spec enables skills', () => {
+      const a = makeId();
+      const b = makeId();
+      const scoped = resolveAgentScopedSkillIds({
+        agent: ephemeralAgent(undefined, true),
+        accessibleSkillIds: [a, b],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+      });
+      expect(scoped.map((o) => o.toString()).sort()).toEqual([a.toString(), b.toString()].sort());
+    });
+
+    it('returns the model-spec allowlist intersection when configured', () => {
+      const a = makeId();
+      const b = makeId();
+      const scoped = resolveAgentScopedSkillIds({
+        agent: ephemeralAgent([a.toString()], true),
+        accessibleSkillIds: [a, b],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+      });
+      expect(scoped.map((o) => o.toString())).toEqual([a.toString()]);
+    });
+
+    it('treats an empty model-spec allowlist as explicit none', () => {
       const a = makeId();
       expect(
         resolveAgentScopedSkillIds({
-          agent: ephemeralAgent([a.toString()]),
+          agent: ephemeralAgent([], true),
           accessibleSkillIds: [a],
           skillsCapabilityEnabled: true,
-          ephemeralSkillsToggle: false,
+          ephemeralSkillsToggle: true,
+        }),
+      ).toEqual([]);
+    });
+
+    it('lets an explicit model-spec skills=false override the badge toggle', () => {
+      const a = makeId();
+      expect(
+        resolveAgentScopedSkillIds({
+          agent: ephemeralAgent(undefined, false),
+          accessibleSkillIds: [a],
+          skillsCapabilityEnabled: true,
+          ephemeralSkillsToggle: true,
         }),
       ).toEqual([]);
     });
@@ -470,6 +510,95 @@ describe('resolveAgentScopedSkillIds', () => {
   });
 });
 
+describe('resolveModelSpecSkillIds', () => {
+  const userObjectId = new Types.ObjectId();
+
+  it('resolves configured names against accessible skills and skips misses without failing', async () => {
+    const knownId = new Types.ObjectId();
+    const getSkillByName = jest.fn(async (name: string) => {
+      if (name === 'known-skill') {
+        return {
+          _id: knownId,
+          name,
+          body: 'body',
+          author: userObjectId,
+        };
+      }
+      if (name === 'throws') {
+        throw new Error('lookup failed');
+      }
+      return null;
+    });
+
+    const result = await resolveModelSpecSkillIds({
+      names: [' known-skill ', 'missing-skill', 'throws', 'known-skill'],
+      accessibleSkillIds: [knownId],
+      getSkillByName,
+    });
+
+    expect(result.map((id) => id.toString())).toEqual([knownId.toString()]);
+    expect(getSkillByName).toHaveBeenCalledTimes(3);
+    expect(getSkillByName).toHaveBeenCalledWith('known-skill', [knownId], {
+      preferModelInvocable: true,
+    });
+  });
+
+  it('resolves configured names sequentially to avoid query bursts', async () => {
+    const firstId = new Types.ObjectId();
+    const secondId = new Types.ObjectId();
+    const order: string[] = [];
+    let releaseFirst!: () => void;
+    const firstLookup = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    const getSkillByName = jest.fn(async (name: string) => {
+      order.push(`start:${name}`);
+      if (name === 'first') {
+        await firstLookup;
+        order.push(`end:${name}`);
+        return {
+          _id: firstId,
+          name,
+          body: 'body',
+          author: userObjectId,
+        };
+      }
+      order.push(`end:${name}`);
+      return {
+        _id: secondId,
+        name,
+        body: 'body',
+        author: userObjectId,
+      };
+    });
+
+    const promise = resolveModelSpecSkillIds({
+      names: ['first', 'second'],
+      accessibleSkillIds: [firstId, secondId],
+      getSkillByName,
+    });
+
+    await Promise.resolve();
+    expect(order).toEqual(['start:first']);
+
+    releaseFirst();
+    const result = await promise;
+
+    expect(result.map((id) => id.toString())).toEqual([firstId.toString(), secondId.toString()]);
+    expect(order).toEqual(['start:first', 'end:first', 'start:second', 'end:second']);
+  });
+
+  it('returns [] when no skill lookup is available', async () => {
+    const result = await resolveModelSpecSkillIds({
+      names: ['known-skill'],
+      accessibleSkillIds: [new Types.ObjectId()],
+      getSkillByName: undefined,
+    });
+
+    expect(result).toEqual([]);
+  });
+});
+
 describe('resolveSkillActive', () => {
   const makeSkill = (author: Types.ObjectId) => ({ _id: new Types.ObjectId(), author });
 
@@ -523,6 +652,30 @@ describe('resolveSkillActive', () => {
     ).toBe(false);
   });
 
+  it('respects explicit override = false even for deployment skills', () => {
+    const deploymentSkill = { ...makeSkill(new Types.ObjectId()), deployment: true };
+    expect(
+      resolveSkillActive({
+        skill: deploymentSkill,
+        skillStates: { [deploymentSkill._id.toString()]: false },
+        userId: undefined,
+        defaultActiveOnShare: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('defaults deployment skills to active without ownership or shared defaults', () => {
+    const deploymentSkill = { ...makeSkill(new Types.ObjectId()), deployment: true };
+    expect(
+      resolveSkillActive({
+        skill: deploymentSkill,
+        skillStates: {},
+        userId: undefined,
+        defaultActiveOnShare: false,
+      }),
+    ).toBe(true);
+  });
+
   it('owned skills default to active when no override is present', () => {
     const userObjectId = new Types.ObjectId();
     const userId = userObjectId.toString();
@@ -744,6 +897,26 @@ describe('injectSkillCatalog', () => {
     expect(agent.additional_instructions).toContain('desc-my-skill');
   });
 
+  it('honors a configured maxCatalogSkills below the default hard limit', async () => {
+    const first = makeSkill('first-skill', userObjectId);
+    const second = makeSkill('second-skill', userObjectId);
+    const third = makeSkill('third-skill', userObjectId);
+    const listSkillsByAccess = buildPager([[first, second, third]]);
+    const agent = makeAgent();
+    const result = await injectSkillCatalog(
+      baseParams({ listSkillsByAccess, agent, maxCatalogSkills: 2 }),
+    );
+
+    expect(result.skillCount).toBe(2);
+    expect(result.activeSkillIds.map((id) => id.toString())).toEqual([
+      first._id.toString(),
+      second._id.toString(),
+    ]);
+    expect(agent.additional_instructions).toContain('first-skill');
+    expect(agent.additional_instructions).toContain('second-skill');
+    expect(agent.additional_instructions).not.toContain('third-skill');
+  });
+
   it('fails closed when userId is absent (shared skills drop, owned would need override)', async () => {
     const owned = makeSkill('my-skill', userObjectId);
     const shared = makeSkill('shared-skill', new Types.ObjectId());
@@ -990,6 +1163,7 @@ describe('resolveManualSkills', () => {
     author: Types.ObjectId;
     allowedTools?: string[];
     userInvocable?: boolean;
+    deployment?: boolean;
   };
 
   const buildGetSkillByName =
@@ -1199,6 +1373,21 @@ describe('resolveManualSkills', () => {
     expect(result).toEqual([{ _id: shared._id, name: 'shared', body: 'shared-body' }]);
   });
 
+  it('allows deployment skills even when shared skills default inactive', async () => {
+    const deployment = {
+      ...mkSkill('deployment', otherAuthor, 'deployment-body'),
+      deployment: true,
+    };
+    const result = await resolveManualSkills({
+      names: ['deployment'],
+      getSkillByName: buildGetSkillByName({ deployment }),
+      accessibleSkillIds: [deployment._id],
+      userId,
+      defaultActiveOnShare: false,
+    });
+    expect(result).toEqual([{ _id: deployment._id, name: 'deployment', body: 'deployment-body' }]);
+  });
+
   it('drops explicitly-deactivated skills (skillStates override wins over ownership default)', async () => {
     const owned = mkSkill('owned-off', userOid);
     const result = await resolveManualSkills({
@@ -1633,6 +1822,7 @@ describe('resolveAlwaysApplySkills', () => {
     body: string;
     author: Types.ObjectId | string;
     allowedTools?: string[];
+    deployment?: boolean;
   };
 
   const mkRow = (
@@ -1720,6 +1910,22 @@ describe('resolveAlwaysApplySkills', () => {
     expect(result).toEqual([{ _id: shared._id, name: 'shared-on', body: 'shared-body' }]);
   });
 
+  it('allows deployment always-apply skills even when shared skills default inactive', async () => {
+    const deployment: AlwaysApplyRow = {
+      ...mkRow('deployment-always', otherAuthor, 'deployment body'),
+      deployment: true,
+    };
+    const result = await resolveAlwaysApplySkills({
+      listAlwaysApplySkills: buildLister([deployment]),
+      accessibleSkillIds: [deployment._id],
+      userId,
+      defaultActiveOnShare: false,
+    });
+    expect(result).toEqual([
+      { _id: deployment._id, name: 'deployment-always', body: 'deployment body' },
+    ]);
+  });
+
   it('honors explicit deactivation override even for owned skills', async () => {
     const owned = mkRow('owned-off', userOid);
     const result = await resolveAlwaysApplySkills({
@@ -2042,3 +2248,45 @@ describe('injectSkillPrimes', () => {
     expect(result.inserted).toBe(2);
   });
 });
+
+describe('collectFreshSkillPrimeNames', () => {
+  it('returns the union of manual + always-apply prime names', () => {
+    const names = collectFreshSkillPrimeNames({
+      manualSkillPrimes: [{ name: 'pdf-analyzer' }, { name: 'code-review' }],
+      alwaysApplySkillPrimes: [{ name: 'clickhouse-best-practices' }],
+    });
+    expect(names).toEqual(new Set(['pdf-analyzer', 'code-review', 'clickhouse-best-practices']));
+  });
+
+  it('dedupes a skill that is both manual and always-apply', () => {
+    const names = collectFreshSkillPrimeNames({
+      manualSkillPrimes: [{ name: 'clickhouse-best-practices' }],
+      alwaysApplySkillPrimes: [{ name: 'clickhouse-best-practices' }],
+    });
+    expect(names.size).toBe(1);
+    expect(names.has('clickhouse-best-practices')).toBe(true);
+  });
+
+  it('handles undefined / empty inputs', () => {
+    expect(collectFreshSkillPrimeNames({}).size).toBe(0);
+    expect(
+      collectFreshSkillPrimeNames({
+        manualSkillPrimes: [],
+        alwaysApplySkillPrimes: [],
+      }).size,
+    ).toBe(0);
+  });
+
+  it('collects names from only one side when the other is absent', () => {
+    expect(
+      collectFreshSkillPrimeNames({
+        alwaysApplySkillPrimes: [{ name: 'only-always' }],
+      }),
+    ).toEqual(new Set(['only-always']));
+    expect(
+      collectFreshSkillPrimeNames({
+        manualSkillPrimes: [{ name: 'only-manual' }],
+      }),
+    ).toEqual(new Set(['only-manual']));
+  });
+});
diff --git a/packages/api/src/agents/added.ts b/packages/api/src/agents/added.ts
index 587f3bc437e..85485ad958e 100644
--- a/packages/api/src/agents/added.ts
+++ b/packages/api/src/agents/added.ts
@@ -1,5 +1,4 @@
 import { logger } from '@librechat/data-schemas';
-import type { AppConfig } from '@librechat/data-schemas';
 import {
   Tools,
   Constants,
@@ -8,13 +7,43 @@ import {
   appendAgentIdSuffix,
   encodeEphemeralAgentId,
 } from 'librechat-data-provider';
-import type { Agent, TConversation } from 'librechat-data-provider';
+import type { Agent, TConversation, TModelSpec } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { requiresEphemeralUserConnection } from '~/mcp/utils';
 import { getCustomEndpointConfig } from '~/app/config';
 
 const { mcp_all, mcp_delimiter } = Constants;
 
 export const ADDED_AGENT_ID = 'added_agent';
 
+function applyModelSpecSkills(
+  result: Record<string, unknown>,
+  modelSpec: Pick<TModelSpec, 'skills'> | null | undefined,
+): void {
+  if (!modelSpec || !Object.prototype.hasOwnProperty.call(modelSpec, 'skills')) {
+    return;
+  }
+  if (modelSpec.skills === true) {
+    result.skills_enabled = true;
+    delete result.skills;
+  } else if (modelSpec.skills === false) {
+    result.skills_enabled = false;
+    result.skills = [];
+  } else if (Array.isArray(modelSpec.skills)) {
+    result.skills_enabled = true;
+    result.skills = [];
+  }
+}
+
+function applyModelSpecSubagents(
+  result: Record<string, unknown>,
+  modelSpec: Pick<TModelSpec, 'subagents'> | null | undefined,
+): void {
+  if (modelSpec?.subagents) {
+    result.subagents = modelSpec.subagents;
+  }
+}
+
 export interface LoadAddedAgentDeps {
   getAgent: (searchParameter: { id: string }) => Promise<Agent | null>;
   getMCPServerTools: (
@@ -79,6 +108,15 @@ export async function loadAddedAgent(
   }
 
   const appConfig = req.config as AppConfig | undefined;
+  const ephemeralAgent = rest.ephemeralAgent as
+    | {
+        mcp?: string[];
+        execute_code?: boolean;
+        file_search?: boolean;
+        web_search?: boolean;
+        artifacts?: unknown;
+      }
+    | undefined;
 
   const primaryIsEphemeral = primaryAgent && isEphemeralAgentId(primaryAgent.id);
   if (primaryIsEphemeral && Array.isArray(primaryAgent.tools)) {
@@ -95,8 +133,7 @@ export async function loadAddedAgent(
       }
     }
 
-    const modelSpecs = (appConfig?.modelSpecs as { list?: Array<{ name: string; label?: string }> })
-      ?.list;
+    const modelSpecs = (appConfig?.modelSpecs as { list?: TModelSpec[] })?.list;
     const modelSpec = spec != null && spec !== '' ? modelSpecs?.find((s) => s.name === spec) : null;
     const sender =
       rest.modelLabel ??
@@ -105,40 +142,23 @@ export async function loadAddedAgent(
       '';
     const ephemeralId = encodeEphemeralAgentId({ endpoint, model, sender, index: 1 });
 
-    return {
+    const result: Record<string, unknown> = {
       id: ephemeralId,
       instructions: promptPrefix || '',
       provider: endpoint,
       model_parameters: {},
       model,
       tools: [...primaryAgent.tools],
-    } as unknown as Agent;
+    };
+    applyModelSpecSkills(result, modelSpec);
+    applyModelSpecSubagents(result, modelSpec);
+    return result as unknown as Agent;
   }
 
-  const ephemeralAgent = rest.ephemeralAgent as
-    | {
-        mcp?: string[];
-        execute_code?: boolean;
-        file_search?: boolean;
-        web_search?: boolean;
-        artifacts?: unknown;
-      }
-    | undefined;
   const mcpServers = new Set<string>(ephemeralAgent?.mcp);
   const userId = req.user?.id ?? '';
 
-  const modelSpecs = (
-    appConfig?.modelSpecs as {
-      list?: Array<{
-        name: string;
-        label?: string;
-        mcpServers?: string[];
-        executeCode?: boolean;
-        fileSearch?: boolean;
-        webSearch?: boolean;
-      }>;
-    }
-  )?.list;
+  const modelSpecs = (appConfig?.modelSpecs as { list?: TModelSpec[] })?.list;
   let modelSpec: (typeof modelSpecs extends Array<infer T> | undefined ? T : never) | null = null;
   if (spec != null && spec !== '') {
     modelSpec = modelSpecs?.find((s) => s.name === spec) ?? null;
@@ -165,7 +185,13 @@ export async function loadAddedAgent(
     if (addedServers.has(mcpServer)) {
       continue;
     }
-    const serverTools = await deps.getMCPServerTools(userId, mcpServer);
+    /** Request-tier overlays are invisible to the cache service's registry
+     *  resolver — overlay-scoped servers expand fresh via `mcp_all` instead */
+    const overlayConfig = appConfig?.mcpConfig?.[mcpServer];
+    const serverTools =
+      overlayConfig && requiresEphemeralUserConnection(overlayConfig)
+        ? null
+        : await deps.getMCPServerTools(userId, mcpServer);
     if (!serverTools) {
       tools.push(`${mcp_all}${mcp_delimiter}${mcpServer}`);
       addedServers.add(mcpServer);
@@ -225,6 +251,8 @@ export async function loadAddedAgent(
   if (ephemeralAgent?.artifacts != null && ephemeralAgent.artifacts) {
     result.artifacts = ephemeralAgent.artifacts;
   }
+  applyModelSpecSubagents(result, modelSpec);
+  applyModelSpecSkills(result, modelSpec);
 
   return result as unknown as Agent;
 }
diff --git a/packages/api/src/agents/attachments.test.ts b/packages/api/src/agents/attachments.test.ts
new file mode 100644
index 00000000000..88bc4d1105d
--- /dev/null
+++ b/packages/api/src/agents/attachments.test.ts
@@ -0,0 +1,81 @@
+import { FileSources } from 'librechat-data-provider';
+import type { IMongoFile } from '@librechat/data-schemas';
+import type { ServerRequest } from '~/types';
+import {
+  collectFileIds,
+  buildAgentScopedContext,
+  getAgentContextAttachments,
+  buildAgentContextAttachmentsByAgentId,
+} from './attachments';
+
+const makeTextFile = (file_id: string, filename: string, text: string): IMongoFile =>
+  ({
+    file_id,
+    filename,
+    text,
+    source: FileSources.text,
+  }) as IMongoFile;
+
+describe('agent attachment helpers', () => {
+  it('collects file ids from attachment-like files', () => {
+    const fileIds = collectFileIds([
+      { file_id: 'file-1' },
+      null,
+      { file_id: '' },
+      { file_id: 'file-2' },
+      { file_id: 'file-1' },
+    ]);
+
+    expect(Array.from(fileIds)).toEqual(['file-1', 'file-2']);
+  });
+
+  it('builds an agent context attachment map from initialized configs', () => {
+    const file = makeTextFile('context-file', 'context.txt', 'context');
+    const attachmentsByAgentId = buildAgentContextAttachmentsByAgentId([
+      { id: 'agent-a', agentContextAttachments: [file] },
+      { id: 'agent-b', agentContextAttachments: [] },
+      { id: null, agentContextAttachments: [file] },
+      undefined,
+    ]);
+
+    expect(attachmentsByAgentId.size).toBe(1);
+    expect(attachmentsByAgentId.get('agent-a')).toEqual([file]);
+  });
+
+  it('filters shared request files out of scoped context attachments', () => {
+    const shared = makeTextFile('shared-file', 'shared.txt', 'shared');
+    const scoped = makeTextFile('scoped-file', 'scoped.txt', 'scoped');
+
+    const attachments = getAgentContextAttachments({
+      agentId: 'agent-a',
+      attachmentsByAgentId: new Map([['agent-a', [shared, scoped]]]),
+      excludeFileIds: new Set(['shared-file']),
+    });
+
+    expect(attachments).toEqual([scoped]);
+  });
+
+  it('builds scoped context only from non-shared context documents', async () => {
+    const shared = makeTextFile('shared-file', 'shared.txt', 'Shared duplicate context');
+    const scoped = makeTextFile('scoped-file', 'scoped.txt', 'Scoped private context');
+    const req = {
+      body: { fileTokenLimit: 1000 },
+      config: {},
+    } as ServerRequest;
+
+    const scopedContext = await buildAgentScopedContext({
+      agentIds: ['agent-a', 'agent-b'],
+      attachmentsByAgentId: new Map([
+        ['agent-a', [shared, scoped]],
+        ['agent-b', [shared]],
+      ]),
+      sharedRunAttachmentIds: new Set(['shared-file']),
+      req,
+      tokenCountFn: (text) => text.length,
+    });
+
+    expect(scopedContext.get('agent-a')).toContain('Scoped private context');
+    expect(scopedContext.get('agent-a')).not.toContain('Shared duplicate context');
+    expect(scopedContext.has('agent-b')).toBe(false);
+  });
+});
diff --git a/packages/api/src/agents/attachments.ts b/packages/api/src/agents/attachments.ts
new file mode 100644
index 00000000000..4513d5b6e0c
--- /dev/null
+++ b/packages/api/src/agents/attachments.ts
@@ -0,0 +1,112 @@
+import type { IMongoFile } from '@librechat/data-schemas';
+import type { ServerRequest } from '~/types';
+import type { TokenCountFn } from '~/utils/text';
+import { countTokens } from '~/utils/tokenizer';
+import { extractFileContext } from '~/files';
+
+type FileWithId = {
+  file_id?: string | null;
+};
+
+export type AgentContextAttachmentCarrier<TFile extends FileWithId = IMongoFile> = {
+  id?: string | null;
+  agentContextAttachments?: TFile[] | null;
+};
+
+export type AgentContextAttachmentsByAgentId<TFile extends FileWithId = IMongoFile> =
+  | Map<string, TFile[]>
+  | Record<string, TFile[] | undefined>
+  | null
+  | undefined;
+
+export function collectFileIds<TFile extends FileWithId>(
+  files?: Array<TFile | null | undefined> | null,
+): Set<string> {
+  const fileIds = new Set<string>();
+  for (const file of files ?? []) {
+    if (file?.file_id) {
+      fileIds.add(file.file_id);
+    }
+  }
+  return fileIds;
+}
+
+export function buildAgentContextAttachmentsByAgentId<TFile extends FileWithId>(
+  configs: Iterable<AgentContextAttachmentCarrier<TFile> | null | undefined>,
+): Map<string, TFile[]> {
+  const attachmentsByAgentId = new Map<string, TFile[]>();
+
+  for (const config of configs) {
+    if (!config?.id || !Array.isArray(config.agentContextAttachments)) {
+      continue;
+    }
+    if (config.agentContextAttachments.length === 0) {
+      continue;
+    }
+    attachmentsByAgentId.set(config.id, config.agentContextAttachments);
+  }
+
+  return attachmentsByAgentId;
+}
+
+export function getAgentContextAttachments<TFile extends FileWithId>({
+  agentId,
+  attachmentsByAgentId,
+  excludeFileIds,
+}: {
+  agentId: string;
+  attachmentsByAgentId: AgentContextAttachmentsByAgentId<TFile>;
+  excludeFileIds?: Set<string>;
+}): TFile[] {
+  if (!attachmentsByAgentId) {
+    return [];
+  }
+
+  const attachments: TFile[] =
+    attachmentsByAgentId instanceof Map
+      ? (attachmentsByAgentId.get(agentId) ?? [])
+      : (attachmentsByAgentId[agentId] ?? []);
+
+  if (!excludeFileIds || excludeFileIds.size === 0) {
+    return attachments;
+  }
+
+  return attachments.filter((file) => !file?.file_id || !excludeFileIds.has(file.file_id));
+}
+
+export async function buildAgentScopedContext({
+  agentIds,
+  attachmentsByAgentId,
+  sharedRunAttachmentIds,
+  req,
+  tokenCountFn = countTokens,
+}: {
+  agentIds: string[];
+  attachmentsByAgentId: AgentContextAttachmentsByAgentId<IMongoFile>;
+  sharedRunAttachmentIds?: Set<string>;
+  req?: ServerRequest;
+  tokenCountFn?: TokenCountFn;
+}): Promise<Map<string, string>> {
+  const uniqueAgentIds = Array.from(new Set(agentIds.filter(Boolean)));
+  const entries = await Promise.all(
+    uniqueAgentIds.map(async (agentId) => {
+      const attachments = getAgentContextAttachments({
+        agentId,
+        attachmentsByAgentId,
+        excludeFileIds: sharedRunAttachmentIds,
+      });
+      if (attachments.length === 0) {
+        return [agentId, ''] as const;
+      }
+
+      const context = await extractFileContext({
+        attachments,
+        req,
+        tokenCountFn,
+      });
+      return [agentId, context ?? ''] as const;
+    }),
+  );
+
+  return new Map(entries.filter(([, context]) => Boolean(context)));
+}
diff --git a/packages/api/src/agents/chain.ts b/packages/api/src/agents/chain.ts
index e00d5373259..62eb697d776 100644
--- a/packages/api/src/agents/chain.ts
+++ b/packages/api/src/agents/chain.ts
@@ -14,7 +14,7 @@ const DEFAULT_PROMPT_TEMPLATE = `Based on the following conversation and analysi
  */
 export async function createSequentialChainEdges(
   agentIds: string[],
-  promptTemplate = DEFAULT_PROMPT_TEMPLATE,
+  promptTemplate: string = DEFAULT_PROMPT_TEMPLATE,
 ): Promise<GraphEdge[]> {
   const edges: GraphEdge[] = [];
 
diff --git a/packages/api/src/agents/cleanup.spec.ts b/packages/api/src/agents/cleanup.spec.ts
index 077007de3bb..19ec9ac4d0d 100644
--- a/packages/api/src/agents/cleanup.spec.ts
+++ b/packages/api/src/agents/cleanup.spec.ts
@@ -77,6 +77,16 @@ describe('cleanCodeToolOutput', () => {
     expect(output).toMatch(/- \/mnt\/data\/test_folder\/\.dirkeep/);
   });
 
+  it('preserves the compact session-file summary', () => {
+    const summary =
+      'Session files: 4 persisted file(s) are available in /mnt/data, including 1 image(s). ' +
+      'Use known /mnt/data paths directly in later code-tool calls. ' +
+      'The app displays files/images automatically; do not invent download links or wrap generated images in Markdown.';
+    const input = ['stdout:', 'Report generated', '', 'Generated files:', summary].join('\n');
+    const output = cleanCodeToolOutput(input);
+    expect(output).toBe(input);
+  });
+
   it('passes through output that contains no boilerplate (no false positives)', () => {
     const input = 'stdout:\nHello, world!\n';
     expect(cleanCodeToolOutput(input)).toBe('stdout:\nHello, world!');
diff --git a/packages/api/src/agents/cleanup.ts b/packages/api/src/agents/cleanup.ts
index 9025d2ea7c9..ffb051901c2 100644
--- a/packages/api/src/agents/cleanup.ts
+++ b/packages/api/src/agents/cleanup.ts
@@ -3,8 +3,8 @@
  * tool output before LibreChat re-injects it into the assistant's
  * conversation history.
  *
- * The bash executor in `@librechat/agents` appends two kinds of noise
- * to every successful run:
+ * Older bash executor output from `@librechat/agents` appended two
+ * kinds of noise to successful runs:
  *
  * 1. **Trailing "Note:" paragraphs** — long behavioral hints repeating
  *    rules the agent already has via its system prompt
@@ -21,12 +21,14 @@
  *    per-file annotations are redundant *and* phrased inconsistently
  *    ("downloaded" vs. "displayed" vs. "known to the user").
  *
- * Stripping happens in LibreChat (this file), not upstream, so the
- * cleaning is reversible — pin to a specific upstream version and the
- * patterns adjust here without releasing a new agents build. The
- * patterns are anchored conservatively: only the documented forms are
- * matched, so a future upstream string change leaves user-authored
- * `Note:` lines (or legitimate `|`-delimited filenames) untouched.
+ * Newer compact summaries under `Generated files:` intentionally do
+ * not list `- /...` paths and pass through unchanged. Stripping happens
+ * in LibreChat (this file), not upstream, so the cleaning is reversible
+ * — pin to a specific upstream version and the patterns adjust here
+ * without releasing a new agents build. The patterns are anchored
+ * conservatively: only the documented forms are matched, so a future
+ * upstream string change leaves user-authored `Note:` lines (or
+ * legitimate `|`-delimited filenames) untouched.
  */
 
 /**
diff --git a/packages/api/src/agents/client.spec.ts b/packages/api/src/agents/client.spec.ts
new file mode 100644
index 00000000000..0b77831926b
--- /dev/null
+++ b/packages/api/src/agents/client.spec.ts
@@ -0,0 +1,115 @@
+import { ContentTypes } from 'librechat-data-provider';
+import { prependFileContext, prependQuotes, type FormattedMessageWithContent } from './client';
+
+describe('prependFileContext', () => {
+  it('prepends file context to string content', () => {
+    const message: FormattedMessageWithContent = { content: 'Answer this question.' };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(message.content).toBe('Attached file text\nAnswer this question.');
+  });
+
+  it('prepends file context to the first text content part', () => {
+    const message: FormattedMessageWithContent = {
+      content: [
+        { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+        { type: ContentTypes.TEXT, text: 'Answer this question.' },
+      ],
+    };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(Array.isArray(message.content)).toBe(true);
+    if (!Array.isArray(message.content)) {
+      throw new Error('Expected array content');
+    }
+    expect(message.content[1].text).toBe('Attached file text\nAnswer this question.');
+    expect(message.content[0]).toEqual({
+      type: ContentTypes.IMAGE_URL,
+      image_url: { url: 'data:image/png;base64,abc' },
+    });
+  });
+
+  it('adds a text content part when an array has no text part', () => {
+    const message: FormattedMessageWithContent = {
+      content: [{ type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } }],
+    };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(message.content).toEqual([
+      { type: ContentTypes.TEXT, text: 'Attached file text' },
+      { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+    ]);
+  });
+
+  it('leaves content unchanged when file context is empty', () => {
+    const message: FormattedMessageWithContent = { content: 'Answer this question.' };
+
+    prependFileContext(message, '');
+
+    expect(message.content).toBe('Answer this question.');
+  });
+});
+
+describe('prependQuotes', () => {
+  it('prepends a single quote as a blockquote to string content', () => {
+    const message: FormattedMessageWithContent = { content: 'Explain this.' };
+
+    prependQuotes(message, ['the selected text']);
+
+    expect(message.content).toBe('> the selected text\n\nExplain this.');
+  });
+
+  it('separates multiple quotes with a blank line', () => {
+    const message: FormattedMessageWithContent = { content: 'Compare these.' };
+
+    prependQuotes(message, ['first', 'second']);
+
+    expect(message.content).toBe('> first\n\n> second\n\nCompare these.');
+  });
+
+  it('prepends to the first text part of array content, leaving other parts intact', () => {
+    const message: FormattedMessageWithContent = {
+      content: [
+        { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+        { type: ContentTypes.TEXT, text: 'Explain this.' },
+      ],
+    };
+
+    prependQuotes(message, ['excerpt']);
+
+    if (!Array.isArray(message.content)) {
+      throw new Error('Expected array content');
+    }
+    expect(message.content[1].text).toBe('> excerpt\n\nExplain this.');
+    expect(message.content[0]).toEqual({
+      type: ContentTypes.IMAGE_URL,
+      image_url: { url: 'data:image/png;base64,abc' },
+    });
+  });
+
+  it('adds a text part when an array has none', () => {
+    const message: FormattedMessageWithContent = {
+      content: [{ type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } }],
+    };
+
+    prependQuotes(message, ['excerpt']);
+
+    expect(message.content).toEqual([
+      { type: ContentTypes.TEXT, text: '> excerpt' },
+      { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+    ]);
+  });
+
+  it('leaves content unchanged when there are no quotes', () => {
+    const message: FormattedMessageWithContent = { content: 'Explain this.' };
+
+    prependQuotes(message, []);
+    expect(message.content).toBe('Explain this.');
+
+    prependQuotes(message, null);
+    expect(message.content).toBe('Explain this.');
+  });
+});
diff --git a/packages/api/src/agents/client.ts b/packages/api/src/agents/client.ts
index e4969bf7fac..4adf953bfbc 100644
--- a/packages/api/src/agents/client.ts
+++ b/packages/api/src/agents/client.ts
@@ -11,10 +11,10 @@ import type { BaseMessage } from '@librechat/agents/langchain/messages';
 import type { MessageContentComplex } from '@librechat/agents';
 import type { Agent, TMessage } from 'librechat-data-provider';
 import type { ServerRequest } from '~/types';
+import { logAxiosError, mergeQuotedText, formatQuotesAsMarkdown } from '~/utils';
 import Tokenizer from '~/utils/tokenizer';
-import { logAxiosError } from '~/utils';
 
-export const omitTitleOptions = new Set([
+export const omitTitleOptions: Set<string> = new Set([
   'stream',
   'thinking',
   'streaming',
@@ -26,7 +26,13 @@ export const omitTitleOptions = new Set([
   'additionalModelRequestFields',
 ]);
 
-export function payloadParser({ req, endpoint }: { req: ServerRequest; endpoint: string }) {
+export function payloadParser({
+  req,
+  endpoint,
+}: {
+  req: ServerRequest;
+  endpoint: string;
+}): Record<string, unknown> | undefined {
   if (isAgentsEndpoint(endpoint)) {
     return;
   }
@@ -56,6 +62,80 @@ type ContentBlock = {
   tool_call?: { name?: string; args?: string; output?: string };
 };
 
+export type FormattedMessageContentPart = {
+  type?: string;
+  text?: string;
+  [key: string]: unknown;
+};
+
+export type FormattedMessageWithContent = {
+  content?: string | FormattedMessageContentPart[];
+};
+
+export function prependFileContext(
+  formattedMessage: FormattedMessageWithContent,
+  fileContext?: string | null,
+): void {
+  if (!fileContext) {
+    return;
+  }
+
+  if (typeof formattedMessage.content === 'string') {
+    formattedMessage.content = `${fileContext}\n${formattedMessage.content}`;
+    return;
+  }
+
+  if (!Array.isArray(formattedMessage.content)) {
+    return;
+  }
+
+  const textPart = formattedMessage.content.find((part) => part.type === ContentTypes.TEXT);
+  if (textPart != null && typeof textPart.text === 'string') {
+    textPart.text = `${fileContext}\n${textPart.text}`;
+    return;
+  }
+
+  formattedMessage.content.unshift({ type: ContentTypes.TEXT, text: fileContext });
+}
+
+/**
+ * Prepends quoted excerpts (the "Add to chat" selections persisted on
+ * `message.quotes`) to a formatted message's content as Markdown blockquotes.
+ * Applied to every user message that carries quotes — current and historical —
+ * so the model durably receives the referenced context and the token count
+ * stays consistent with what was persisted. The stored `message.text` is left
+ * clean; the excerpts live on `message.quotes` for the UI.
+ */
+export function prependQuotes(
+  formattedMessage: FormattedMessageWithContent,
+  quotes?: string[] | null,
+): void {
+  if (quotes == null || quotes.length === 0) {
+    return;
+  }
+  const block = formatQuotesAsMarkdown(quotes);
+  if (block.length === 0) {
+    return;
+  }
+
+  if (typeof formattedMessage.content === 'string') {
+    formattedMessage.content = mergeQuotedText(formattedMessage.content, quotes);
+    return;
+  }
+
+  if (!Array.isArray(formattedMessage.content)) {
+    return;
+  }
+
+  const textPart = formattedMessage.content.find((part) => part.type === ContentTypes.TEXT);
+  if (textPart != null && typeof textPart.text === 'string') {
+    textPart.text = mergeQuotedText(textPart.text, quotes);
+    return;
+  }
+
+  formattedMessage.content.unshift({ type: ContentTypes.TEXT, text: block });
+}
+
 function estimateImageDataTokens(data: string, isClaude: boolean): number {
   const dims = extractImageDimensions(data);
   if (dims == null) {
@@ -267,7 +347,7 @@ export function countFormattedMessageTokens(
 export function createTokenCounter(encoding: Parameters<typeof Tokenizer.getTokenCount>[1]) {
   const isClaude = encoding === 'claude';
   const countTokens = (text: string) => Tokenizer.getTokenCount(text, encoding);
-  return function (message: BaseMessage) {
+  return function (message: BaseMessage): number {
     const count = getTokenCountForMessage(
       message,
       countTokens,
@@ -277,7 +357,7 @@ export function createTokenCounter(encoding: Parameters<typeof Tokenizer.getToke
   };
 }
 
-export function logToolError(_graph: unknown, error: unknown, toolId: string) {
+export function logToolError(_graph: unknown, error: unknown, toolId: string): void {
   logAxiosError({
     error,
     message: `[api/server/controllers/agents/client.js #chatCompletion] Tool Error "${toolId}"`,
diff --git a/packages/api/src/agents/discovery.ts b/packages/api/src/agents/discovery.ts
index 57321a4cb3d..a627fdd5dda 100644
--- a/packages/api/src/agents/discovery.ts
+++ b/packages/api/src/agents/discovery.ts
@@ -69,6 +69,11 @@ export interface DiscoverConnectedAgentsParams {
    * allowlist (or the full accessible set when scoping is disabled).
    */
   computeAccessibleSkillIds?: (agent: Agent) => InitializeAgentParams['accessibleSkillIds'];
+  /** Optional per-sub-agent skill authoring gate, paired with the scoped skill IDs. */
+  computeSkillAuthoringAvailable?: (
+    agent: Agent,
+    accessibleSkillIds: InitializeAgentParams['accessibleSkillIds'],
+  ) => InitializeAgentParams['skillAuthoringAvailable'];
   /** Per-user skill active/inactive state, forwarded to each sub-agent. */
   skillStates?: InitializeAgentParams['skillStates'];
   /** Default active-on-share flag, forwarded to each sub-agent. */
@@ -148,6 +153,7 @@ export async function discoverConnectedAgents(
     parentMessageId,
     resourceType = ResourceType.AGENT,
     computeAccessibleSkillIds,
+    computeSkillAuthoringAvailable,
     skillStates,
     defaultActiveOnShare,
     codeEnvAvailable,
@@ -237,6 +243,7 @@ export async function discoverConnectedAgents(
       endpoint: EModelEndpoint.agents,
     };
 
+    const scopedSkillIds = computeAccessibleSkillIds?.(agent);
     const config = await initializeAgent(
       {
         req,
@@ -248,7 +255,8 @@ export async function discoverConnectedAgents(
         parentMessageId,
         endpointOption: subAgentEndpointOption,
         allowedProviders,
-        accessibleSkillIds: computeAccessibleSkillIds?.(agent),
+        accessibleSkillIds: scopedSkillIds,
+        skillAuthoringAvailable: computeSkillAuthoringAvailable?.(agent, scopedSkillIds),
         skillStates,
         defaultActiveOnShare,
         codeEnvAvailable,
diff --git a/packages/api/src/agents/handlers.spec.ts b/packages/api/src/agents/handlers.spec.ts
index 41200f31cd5..f195837735e 100644
--- a/packages/api/src/agents/handlers.spec.ts
+++ b/packages/api/src/agents/handlers.spec.ts
@@ -1,4 +1,5 @@
 import { Constants } from '@librechat/agents';
+import { logger } from '@librechat/data-schemas';
 import type {
   ToolExecuteBatchRequest,
   ToolExecuteResult,
@@ -6,10 +7,16 @@ import type {
 } from '@librechat/agents';
 import { createToolExecuteHandler, ToolExecuteOptions } from './handlers';
 
-function createMockTool(name: string, capturedConfigs: Record<string, unknown>[]) {
+function createMockTool(
+  name: string,
+  capturedConfigs: Record<string, unknown>[],
+  options: { schema?: unknown; capturedArgs?: unknown[] } = {},
+) {
   return {
     name,
+    schema: options.schema,
     invoke: jest.fn(async (_args: unknown, config: Record<string, unknown>) => {
+      options.capturedArgs?.push(_args);
       capturedConfigs.push({ ...(config.toolCall as Record<string, unknown>) });
       return {
         content: `stdout:\n${name} executed\n`,
@@ -44,6 +51,22 @@ function invokeHandler(
   });
 }
 
+function invokeHandlerWithConfig(
+  handler: ReturnType<typeof createToolExecuteHandler>,
+  toolCalls: ToolCallRequest[],
+  configurable: Record<string, unknown>,
+): Promise<ToolExecuteResult[]> {
+  return new Promise((resolve, reject) => {
+    const request: ToolExecuteBatchRequest = {
+      toolCalls,
+      configurable,
+      resolve,
+      reject,
+    };
+    handler.handle('on_tool_execute', request);
+  });
+}
+
 /**
  * Sentinel non-empty `accessibleSkillIds` for fixtures that need to opt
  * into "skills are effectively in scope". The `read_file` handler short-
@@ -244,12 +267,90 @@ describe('createToolExecuteHandler', () => {
     });
   });
 
+  describe('tool argument normalization', () => {
+    it('parses JSON-string args for object-schema tools before invocation', async () => {
+      const capturedArgs: unknown[] = [];
+      const tool = createMockTool(Constants.BASH_PROGRAMMATIC_TOOL_CALLING, [], {
+        capturedArgs,
+        schema: {
+          type: 'object',
+          properties: {
+            code: { type: 'string' },
+            timeout: { type: 'number' },
+          },
+          required: ['code'],
+        },
+      });
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [tool] as never[],
+      }));
+      const handler = createToolExecuteHandler({ loadTools });
+
+      await invokeHandler(handler, [
+        {
+          id: 'call_bash_json_string',
+          name: Constants.BASH_PROGRAMMATIC_TOOL_CALLING,
+          args: '{"code":"echo hi","timeout":30000}' as unknown as ToolCallRequest['args'],
+        },
+      ]);
+
+      expect(capturedArgs).toEqual([{ code: 'echo hi', timeout: 30000 }]);
+    });
+
+    it('preserves JSON-looking strings for string-schema tools', async () => {
+      const capturedArgs: unknown[] = [];
+      const payload = '{"serviceId":"svc","query":"SELECT price / 10.0 FROM default.uk_prices_3"}';
+      const tool = createMockTool('raw_string_tool', [], {
+        capturedArgs,
+        schema: { type: 'string' },
+      });
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [tool] as never[],
+      }));
+      const handler = createToolExecuteHandler({ loadTools });
+
+      await invokeHandler(handler, [
+        {
+          id: 'call_raw_string',
+          name: 'raw_string_tool',
+          args: payload as unknown as ToolCallRequest['args'],
+        },
+      ]);
+
+      expect(capturedArgs).toEqual([payload]);
+    });
+
+    it('preserves JSON-looking strings when a tool accepts string or object input', async () => {
+      const capturedArgs: unknown[] = [];
+      const payload = '{"query":"SELECT * FROM t WHERE name IN (\'a\',\'b\')"}';
+      const tool = createMockTool('union_tool', [], {
+        capturedArgs,
+        schema: { anyOf: [{ type: 'string' }, { type: 'object' }] },
+      });
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [tool] as never[],
+      }));
+      const handler = createToolExecuteHandler({ loadTools });
+
+      await invokeHandler(handler, [
+        {
+          id: 'call_union',
+          name: 'union_tool',
+          args: payload as unknown as ToolCallRequest['args'],
+        },
+      ]);
+
+      expect(capturedArgs).toEqual([payload]);
+    });
+  });
+
   describe('programmatic tool config', () => {
     it('injects tool definitions for the legacy PTC tool name', async () => {
       const capturedConfigs: Record<string, unknown>[] = [];
       const legacyPtcTool = createMockTool(Constants.PROGRAMMATIC_TOOL_CALLING, capturedConfigs);
       const toolRegistry = new Map([
         ['custom_tool', { name: 'custom_tool' }],
+        ['create_file', { name: 'create_file' }],
         [Constants.PROGRAMMATIC_TOOL_CALLING, { name: Constants.PROGRAMMATIC_TOOL_CALLING }],
         [
           Constants.BASH_PROGRAMMATIC_TOOL_CALLING,
@@ -260,7 +361,11 @@ describe('createToolExecuteHandler', () => {
       const ptcToolMap = new Map([['custom_tool', createMockTool('custom_tool', [])]]);
       const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
         loadedTools: [legacyPtcTool] as never[],
-        configurable: { toolRegistry, ptcToolMap },
+        configurable: {
+          toolRegistry,
+          ptcToolMap,
+          fileAuthoringToolNames: new Set(['create_file']),
+        },
       }));
       const handler = createToolExecuteHandler({ loadTools });
 
@@ -278,6 +383,167 @@ describe('createToolExecuteHandler', () => {
     });
   });
 
+  describe('host file authoring collisions', () => {
+    it('invokes a loaded user tool named create_file when host file authoring is not active', async () => {
+      const capturedArgs: unknown[] = [];
+      const capturedConfigs: Record<string, unknown>[] = [];
+      const tool = createMockTool('create_file', capturedConfigs, { capturedArgs });
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [tool] as never[],
+        configurable: { fileAuthoringToolNames: new Set<string>() },
+      }));
+      const handler = createToolExecuteHandler({ loadTools });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_user_create_file',
+          name: 'create_file',
+          args: { custom: true },
+          codeSessionContext: {
+            session_id: 'ignored-session',
+            files: [
+              {
+                id: 'ignored-file',
+                name: 'ignored.txt',
+                storage_session_id: 'ignored-session',
+                resource_id: 'user-1',
+                kind: 'user',
+              },
+            ],
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('create_file executed');
+      expect(capturedArgs).toEqual([{ custom: true }]);
+      expect(capturedConfigs[0].session_id).toBeUndefined();
+      expect(capturedConfigs[0]._injected_files).toBeUndefined();
+    });
+  });
+
+  describe('tool error handling', () => {
+    it('truncates oversized tool errors in the result and log context', async () => {
+      const oversizedMessage = `tool failed: ${'x'.repeat(15_000)}`;
+      const thrown = new Error(oversizedMessage);
+      thrown.stack = `Error: ${oversizedMessage}\n${'stack-line\n'.repeat(600)}`;
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [
+          {
+            name: 'bad_tool',
+            invoke: jest.fn(async () => {
+              throw thrown;
+            }),
+          },
+        ] as never[],
+      }));
+      const errorSpy = jest.spyOn(logger, 'error').mockReturnValue(logger);
+      try {
+        const handler = createToolExecuteHandler({ loadTools });
+        const [result] = await invokeHandler(handler, [
+          {
+            id: 'call_bad',
+            name: 'bad_tool',
+            args: {},
+          },
+        ]);
+
+        expect(result.status).toBe('error');
+        expect(result.errorMessage).toContain('truncated');
+        expect(result.errorMessage!.length).toBeLessThanOrEqual(12_000);
+        expect(errorSpy).toHaveBeenCalledWith(
+          '[ON_TOOL_EXECUTE] Tool bad_tool error',
+          expect.objectContaining({
+            messageTruncated: true,
+            messageLength: oversizedMessage.length,
+          }),
+        );
+        const [, logContext] = errorSpy.mock.calls[0] as unknown as [string, { stack?: string }];
+        expect(logContext.stack!.length).toBeLessThanOrEqual(4_000);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    it('returns a per-tool error when thrown value stringification fails', async () => {
+      const thrown = {
+        toString() {
+          throw new Error('toString failed');
+        },
+      };
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [
+          {
+            name: 'bad_to_string_tool',
+            invoke: jest.fn(async () => {
+              throw thrown;
+            }),
+          },
+        ] as never[],
+      }));
+      const errorSpy = jest.spyOn(logger, 'error').mockReturnValue(logger);
+      try {
+        const handler = createToolExecuteHandler({ loadTools });
+        const [result] = await invokeHandler(handler, [
+          {
+            id: 'call_bad_to_string',
+            name: 'bad_to_string_tool',
+            args: {},
+          },
+        ]);
+
+        expect(result.status).toBe('error');
+        expect(result.errorMessage).toBe('[Thrown value could not be converted to string]');
+        expect(errorSpy).toHaveBeenCalledWith(
+          '[ON_TOOL_EXECUTE] Tool bad_to_string_tool error',
+          expect.objectContaining({
+            name: 'object',
+            messageTruncated: false,
+          }),
+        );
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    it('preserves message from thrown plain objects', async () => {
+      const thrown = { message: 'plain object timeout' };
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [
+          {
+            name: 'plain_object_tool',
+            invoke: jest.fn(async () => {
+              throw thrown;
+            }),
+          },
+        ] as never[],
+      }));
+      const errorSpy = jest.spyOn(logger, 'error').mockReturnValue(logger);
+      try {
+        const handler = createToolExecuteHandler({ loadTools });
+        const [result] = await invokeHandler(handler, [
+          {
+            id: 'call_plain_object',
+            name: 'plain_object_tool',
+            args: {},
+          },
+        ]);
+
+        expect(result.status).toBe('error');
+        expect(result.errorMessage).toBe('plain object timeout');
+        expect(errorSpy).toHaveBeenCalledWith(
+          '[ON_TOOL_EXECUTE] Tool plain_object_tool error',
+          expect.objectContaining({
+            message: 'plain object timeout',
+            messageTruncated: false,
+          }),
+        );
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+  });
+
   describe('skill tool model-invocation gate', () => {
     function createSkillHandler(getSkillByName: ToolExecuteOptions['getSkillByName']) {
       const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
@@ -407,7 +673,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_5',
           name: Constants.READ_FILE,
-          args: { file_path: 'maybe-disabled-read/SKILL.md' },
+          args: { path: 'maybe-disabled-read/SKILL.md' },
         },
       ]);
 
@@ -451,7 +717,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_6',
           name: Constants.READ_FILE,
-          args: { file_path: 'manually-primed/references/foo.md' },
+          args: { path: 'manually-primed/references/foo.md' },
         },
       ]);
 
@@ -500,7 +766,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_1',
           name: Constants.READ_FILE,
-          args: { file_path: 'pii-redactor/SKILL.md' },
+          args: { path: 'pii-redactor/SKILL.md' },
         },
       ]);
 
@@ -529,7 +795,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_2',
           name: Constants.READ_FILE,
-          args: { file_path: 'normal-skill/SKILL.md' },
+          args: { path: 'normal-skill/SKILL.md' },
         },
       ]);
 
@@ -567,7 +833,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_3',
           name: Constants.READ_FILE,
-          args: { file_path: 'manual-only-skill/SKILL.md' },
+          args: { path: 'manual-only-skill/SKILL.md' },
         },
       ]);
 
@@ -603,7 +869,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_4',
           name: Constants.READ_FILE,
-          args: { file_path: 'other-disabled-skill/SKILL.md' },
+          args: { path: 'other-disabled-skill/SKILL.md' },
         },
       ]);
 
@@ -645,7 +911,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_always',
           name: Constants.READ_FILE,
-          args: { file_path: 'always-applied-legal/SKILL.md' },
+          args: { path: 'always-applied-legal/SKILL.md' },
         },
       ]);
 
@@ -681,7 +947,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_read_pin',
           name: Constants.READ_FILE,
-          args: { file_path: 'collides/SKILL.md' },
+          args: { path: 'collides/SKILL.md' },
         },
       ]);
 
@@ -769,165 +1035,1367 @@ describe('createToolExecuteHandler', () => {
     });
   });
 
-  describe('read_file sandbox fallback (code-env paths + non-skill segments)', () => {
-    function makeReadFileHandler(params: {
-      codeEnvAvailable?: boolean;
-      accessibleSkillIds?: unknown[];
-      activeSkillNames?: Set<string>;
-      skillPrimedIdsByName?: Record<string, string>;
-      readSandboxFile?: ToolExecuteOptions['readSandboxFile'];
-      getSkillByName?: ToolExecuteOptions['getSkillByName'];
-    }) {
+  describe('file authoring tools for skills', () => {
+    const { Types } = jest.requireActual('mongoose') as typeof import('mongoose');
+    const SKILL_ID = new Types.ObjectId();
+    const req = {
+      user: {
+        id: 'user-1',
+        _id: new Types.ObjectId(),
+        role: 'USER',
+        name: 'Test User',
+      },
+      config: {},
+    } as never;
+
+    function makeAuthoringHandler(
+      params: Partial<ToolExecuteOptions>,
+      configurable?: Record<string, unknown>,
+    ) {
+      const toolConfigurable = {
+        req,
+        accessibleSkillIds: skillsInScope(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        ...(configurable ?? {}),
+      };
       const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
         loadedTools: [],
-        configurable: {
-          codeEnvAvailable: params.codeEnvAvailable === true,
-          accessibleSkillIds: params.accessibleSkillIds ?? [],
-          activeSkillNames: params.activeSkillNames,
-          skillPrimedIdsByName: params.skillPrimedIdsByName,
-        },
+        configurable: toolConfigurable,
       }));
       return createToolExecuteHandler({
         loadTools,
-        getSkillByName: params.getSkillByName,
-        readSandboxFile: params.readSandboxFile,
+        canCreateSkill: jest.fn(async () => true),
+        canEditSkill: jest.fn(async () => true),
+        grantSkillOwner: jest.fn(async () => undefined),
+        ...params,
       });
     }
 
-    it('routes /mnt/data/ paths to the sandbox fallback when codeEnv is available', async () => {
-      const readSandboxFile = jest.fn(async () => ({ content: 'hello-world' }));
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: true,
-        accessibleSkillIds: skillsInScope(),
-        readSandboxFile,
+    it('creates a new SKILL.md through create_file', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'new-skill',
+          body: '# New skill',
+          version: 1,
+        },
+      }));
+      const grantSkillOwner = jest.fn(async () => undefined);
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+        grantSkillOwner,
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_mnt_1',
-          name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/sentinel.txt' },
-          codeSessionContext: {
-            session_id: 'sess-X',
-            files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+          id: 'call_create_skill',
+          name: 'create_file',
+          args: {
+            path: 'skills/new-skill/SKILL.md',
+            content:
+              '---\nname: new-skill\ndescription: Use for tests\ndisable-model-invocation: true\nallowed-tools:\n  - execute_code\n---\n# New skill\n',
           },
-        } as unknown as ToolCallRequest,
+        },
       ]);
 
-      expect(readSandboxFile).toHaveBeenCalledWith({
-        file_path: '/mnt/data/sentinel.txt',
-        session_id: 'sess-X',
-        files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
-      });
       expect(result.status).toBe('success');
-      expect(result.content).toContain('hello-world');
+      expect(result.content).toContain('Created skills/new-skill/SKILL.md');
+      expect(result.artifact).toMatchObject({
+        path: 'skills/new-skill/SKILL.md',
+        created: true,
+      });
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'new-skill',
+          description: 'Use for tests',
+          frontmatter: expect.objectContaining({
+            name: 'new-skill',
+            description: 'Use for tests',
+            'disable-model-invocation': true,
+            'allowed-tools': ['execute_code'],
+          }),
+        }),
+      );
+      expect(grantSkillOwner).toHaveBeenCalledWith({ req, skillId: SKILL_ID });
     });
 
-    it('returns a clear error for /mnt/data/ when codeEnv is not available', async () => {
-      const readSandboxFile = jest.fn();
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: false,
-        accessibleSkillIds: skillsInScope(),
-        readSandboxFile,
+    it('adds required SKILL.md frontmatter when create_file only provides markdown', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'auto-skill',
+          body: '# Auto skill',
+          version: 1,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_mnt_2',
-          name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/sentinel.txt' },
+          id: 'call_create_auto_frontmatter',
+          name: 'create_file',
+          args: {
+            path: 'skills/auto-skill/SKILL.md',
+            content: '# Auto skill\nUse this skill when testing generated frontmatter.\n',
+          },
         },
       ]);
 
-      expect(readSandboxFile).not.toHaveBeenCalled();
-      expect(result.status).toBe('error');
-      expect(result.errorMessage).toContain('code-execution sandbox path');
+      expect(result.status).toBe('success');
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'auto-skill',
+          description: 'Use this skill when testing generated frontmatter.',
+          body: expect.stringContaining('name: auto-skill'),
+          frontmatter: expect.objectContaining({
+            name: 'auto-skill',
+            description: 'Use this skill when testing generated frontmatter.',
+          }),
+        }),
+      );
     });
 
-    it('falls back to sandbox when first segment is not a known skill name', async () => {
-      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-data' }));
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: true,
-        accessibleSkillIds: skillsInScope(),
-        activeSkillNames: new Set(['only-real-skill']),
-        readSandboxFile,
+    it('preserves block-scalar SKILL.md descriptions when creating skills', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'block-description-skill',
+          body: '# Block description skill',
+          version: 1,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_unknown_skill',
-          name: Constants.READ_FILE,
-          args: { file_path: 'not-a-skill/foo.md' },
-          codeSessionContext: { session_id: 'sess-Y' },
-        } as unknown as ToolCallRequest,
+          id: 'call_create_block_description',
+          name: 'create_file',
+          args: {
+            path: 'skills/block-description-skill/SKILL.md',
+            content:
+              '---\nname: block-description-skill\ndescription: |-\n  Use this skill for long descriptions.\n  Keep both lines searchable.\n---\n# Block description skill\n',
+          },
+        },
       ]);
 
-      expect(readSandboxFile).toHaveBeenCalledWith(
-        expect.objectContaining({ file_path: 'not-a-skill/foo.md', session_id: 'sess-Y' }),
-      );
       expect(result.status).toBe('success');
-      expect(result.content).toContain('sandbox-data');
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'block-description-skill',
+          description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+          frontmatter: expect.objectContaining({
+            description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+          }),
+        }),
+      );
     });
 
-    it('does NOT misroute primed skills outside the catalog cap to the sandbox', async () => {
-      /**
-       * Regression for review P2 #2: manual ($-popover) and always-apply
-       * primes are intentionally resolved off the wider `accessibleSkillIds`
-       * ACL set BEFORE catalog injection — see `resolveManualSkills`.
-       * A primed skill name can therefore legitimately be ABSENT from
-       * `activeSkillNames` (which reflects the catalog after the
-       * `SKILL_CATALOG_LIMIT` cap and active filter).
-       *
-       * Without the primed-bypass, the `activeSkillNames` shortcut would
-       * misroute `read_file("primed-only-skill/references/foo.md")` to
-       * the sandbox even though the primed skill is in scope and
-       * `getSkillByName` would resolve it via the pinned `_id`.
-       */
-      const primedHex = '507f1f77bcf86cd799439060';
-      const getSkillByName = jest.fn(async () => ({
-        _id: primedHex as unknown as never,
-        name: 'primed-only-skill',
-        body: '# Primed skill body',
-        fileCount: 1,
+    it('can add bundled files to a newly created skill in the same tool batch', async () => {
+      const createdSkill = {
+        _id: SKILL_ID,
+        name: 'new-skill',
+        body: '# New skill',
+        fileCount: 0,
         version: 1,
+      };
+      const createSkill = jest.fn(async () => ({
+        skill: createdSkill,
       }));
-      const readSandboxFile = jest.fn();
-      const getSkillFileByPath = jest.fn(async () => ({
-        content: 'references content',
-        mimeType: 'text/markdown',
-        bytes: 18,
-        filepath: 'references/foo.md',
-        source: 'local',
-        relativePath: 'references/foo.md',
-        isBinary: false,
+      const getSkillByName = jest.fn(async () => createdSkill);
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 12,
+        relativePath: 'references/a.md',
       }));
-      const handler = createToolExecuteHandler({
-        loadTools: jest.fn(async () => ({
-          loadedTools: [],
-          configurable: {
-            codeEnvAvailable: true,
-            accessibleSkillIds: skillsInScope(),
-            /* Catalog visible names DO NOT include the primed skill — it's
-               outside the cap. */
-            activeSkillNames: new Set(['some-other-skill']),
-            /* But the prime resolver authorized it for this turn. */
-            skillPrimedIdsByName: { 'primed-only-skill': primedHex },
-          },
-        })),
-        getSkillByName,
-        getSkillFileByPath,
-        readSandboxFile,
-      });
-
-      const [result] = await invokeHandler(handler, [
+      const handler = makeAuthoringHandler(
         {
-          id: 'call_primed_outside_catalog',
-          name: Constants.READ_FILE,
-          args: { file_path: 'primed-only-skill/references/foo.md' },
+          getSkillByName,
+          createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+          getSkillFileByPath: jest.fn(async () => null),
+          saveSkillFileContent,
         },
-      ]);
-
-      // Primed skill resolved through the existing skill path, not the
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['stale-skill']),
+        },
+      );
+
+      const results = await invokeHandler(handler, [
+        {
+          id: 'call_create_skill',
+          name: 'create_file',
+          args: {
+            path: 'skills/new-skill/SKILL.md',
+            content: '---\nname: new-skill\ndescription: Use for tests\n---\n# New skill\n',
+          },
+        },
+        {
+          id: 'call_create_reference',
+          name: 'create_file',
+          args: {
+            path: 'skills/new-skill/references/a.md',
+            content: 'reference text',
+          },
+        },
+      ]);
+
+      expect(results.map((r) => r.status)).toEqual(['success', 'success']);
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          skillId: SKILL_ID,
+          relativePath: 'references/a.md',
+          content: 'reference text',
+        }),
+      );
+    });
+
+    it('preserves newly authored skills across later tool execution rounds', async () => {
+      const createdSkill = {
+        _id: SKILL_ID,
+        name: 'round-skill',
+        body: '---\nname: round-skill\ndescription: Use for tests\n---\n# Round skill\n',
+        fileCount: 0,
+        version: 1,
+      };
+      const runtimeConfigurable = {
+        req,
+        accessibleSkillIds: [],
+        skillPrimedIdsByName: {},
+        activeSkillNames: new Set<string>(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+      };
+      const staleLoadedConfigurable = {
+        req,
+        accessibleSkillIds: [],
+        skillPrimedIdsByName: {},
+        activeSkillNames: new Set<string>(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+      };
+      let created = false;
+      const createSkill = jest.fn(async () => {
+        created = true;
+        return { skill: createdSkill };
+      });
+      const getSkillByName = jest.fn(async () => (created ? createdSkill : null));
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: staleLoadedConfigurable,
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools,
+        canCreateSkill: jest.fn(async () => true),
+        canEditSkill: jest.fn(async () => true),
+        grantSkillOwner: jest.fn(async () => undefined),
+        getSkillByName,
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+      });
+
+      const [createResult] = await invokeHandlerWithConfig(
+        handler,
+        [
+          {
+            id: 'call_create_round_skill',
+            name: 'create_file',
+            args: {
+              path: 'skills/round-skill/SKILL.md',
+              content: createdSkill.body,
+            },
+          },
+        ],
+        runtimeConfigurable,
+      );
+      const [readResult] = await invokeHandlerWithConfig(
+        handler,
+        [
+          {
+            id: 'call_read_round_skill',
+            name: Constants.READ_FILE,
+            args: { path: 'skills/round-skill/SKILL.md' },
+          },
+        ],
+        runtimeConfigurable,
+      );
+
+      expect(createResult.status).toBe('success');
+      expect(readResult.status).toBe('success');
+      expect(readResult.content).toContain('Round skill');
+      const lookupCalls = getSkillByName.mock.calls as unknown as Array<
+        [string, import('mongoose').Types.ObjectId[], Record<string, unknown>]
+      >;
+      const lastLookup = lookupCalls[lookupCalls.length - 1];
+      const lookupIds = lastLookup?.[1];
+      expect(lastLookup?.[0]).toBe('round-skill');
+      expect(lookupIds?.[0].toString()).toBe(SKILL_ID.toString());
+      expect(lastLookup?.[2]).toEqual({});
+    });
+
+    it('refuses to overwrite an existing SKILL.md without overwrite: true', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'existing-skill',
+          body: '# Existing',
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_create_existing',
+          name: 'create_file',
+          args: {
+            path: 'skills/existing-skill/SKILL.md',
+            content: '---\nname: existing-skill\ndescription: Use for tests\n---\n# Updated\n',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('rehydrates same-author existing skills before refusing a duplicate create_file', async () => {
+      const existingSkill = {
+        _id: SKILL_ID,
+        name: 'stale-skill',
+        body: '---\nname: stale-skill\ndescription: Existing\n---\n# Existing\n',
+        fileCount: 0,
+        version: 3,
+      };
+      const updateSkill = jest.fn();
+      const getAuthorSkillByName = jest.fn(async () => existingSkill);
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName,
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['stale-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_duplicate_stale_skill',
+          name: 'create_file',
+          args: {
+            path: 'skills/stale-skill/SKILL.md',
+            content: '---\nname: stale-skill\ndescription: Replacement\n---\n# Replacement\n',
+          },
+        },
+      ]);
+
+      expect(getAuthorSkillByName).toHaveBeenCalledWith({ req, name: 'stale-skill' });
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('already exists');
+      expect(result.errorMessage).toContain('edit_file');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('does not rehydrate same-author skills outside the current agent scope', async () => {
+      const updateSkill = jest.fn();
+      const getAuthorSkillByName = jest.fn(async () => ({
+        _id: SKILL_ID,
+        name: 'excluded-skill',
+        body: '---\nname: excluded-skill\ndescription: Excluded\n---\n# Excluded\n',
+        fileCount: 0,
+        version: 1,
+      }));
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName,
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-recovered-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_excluded_skill',
+          name: 'edit_file',
+          args: {
+            path: 'skills/excluded-skill/SKILL.md',
+            old_text: '# Excluded',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('not found or not accessible');
+      expect(getAuthorSkillByName).not.toHaveBeenCalled();
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('does not treat stale same-author recovery as a hidden-skill prime', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'hidden-recovered-skill',
+            body: '---\nname: hidden-recovered-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-recovered-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_recovered_hidden_skill',
+          name: 'edit_file',
+          args: {
+            path: 'skills/hidden-recovered-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('cannot be authored by the model');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('edits a bundled skill file and returns strategies plus a diff', async () => {
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 10,
+        relativePath: 'references/a.md',
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'hello old\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_file',
+          name: 'edit_file',
+          args: {
+            path: 'skills/edit-skill/references/a.md',
+            old_text: 'hello old',
+            new_text: 'hello new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Strategies: exact');
+      expect(result.content).toContain('-hello old');
+      expect(result.content).toContain('+hello new');
+      expect(result.artifact).toMatchObject({
+        path: 'skills/edit-skill/references/a.md',
+        edits: 1,
+        strategies: ['exact'],
+      });
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          relativePath: 'references/a.md',
+          content: 'hello new\n',
+          mimeType: 'text/markdown',
+        }),
+      );
+    });
+
+    it('rejects bundled skill file writes when the skill version changed after reading', async () => {
+      const getSkillByName = jest
+        .fn()
+        .mockResolvedValueOnce({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })
+        .mockResolvedValueOnce({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing changed elsewhere',
+          fileCount: 1,
+          version: 2,
+        });
+      const saveSkillFileContent = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName,
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'hello old\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_stale_bundled_file',
+          name: 'edit_file',
+          args: {
+            path: 'skills/edit-skill/references/a.md',
+            old_text: 'hello old',
+            new_text: 'hello new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('changed while editing');
+      expect(result.errorMessage).toContain('skills/edit-skill/references/a.md');
+      expect(saveSkillFileContent).not.toHaveBeenCalled();
+    });
+
+    it('passes structured frontmatter when editing SKILL.md', async () => {
+      const oldBody =
+        '---\nname: runtime-skill\ndescription: Use before\naction: ignored\n---\n# Body\n';
+      const currentBody =
+        '---\nname: runtime-skill\ndescription: Use before\nuser-invocable: true\ndisable-model-invocation: false\nallowed-tools:\n  - web_search\nalways-apply: true\n---\n# Body\n';
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: currentBody,
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_frontmatter',
+          name: 'edit_file',
+          args: {
+            path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'description: Use before\naction: ignored',
+            new_text:
+              'description: Use before\nuser-invocable: false\ndisable-model-invocation: true\nallowed-tools:\n  - execute_code\nalways-apply: true',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          update: expect.objectContaining({
+            alwaysApply: true,
+            frontmatter: expect.objectContaining({
+              name: 'runtime-skill',
+              description: 'Use before',
+              'user-invocable': false,
+              'disable-model-invocation': true,
+              'allowed-tools': ['execute_code'],
+              'always-apply': true,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('preserves block-scalar SKILL.md descriptions when editing skills', async () => {
+      const oldBody = '---\nname: runtime-skill\ndescription: Use before\n---\n# Runtime skill\n';
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_block_description',
+          name: 'edit_file',
+          args: {
+            path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'description: Use before',
+            new_text:
+              'description: |-\n  Use this skill for long descriptions.\n  Keep both lines searchable.',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          update: expect.objectContaining({
+            description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+            frontmatter: expect.objectContaining({
+              description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('rejects edit_file attempts to rename a skill through SKILL.md frontmatter', async () => {
+      const oldBody = '---\nname: runtime-skill\ndescription: Use before\n---\n# Runtime skill\n';
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_name',
+          name: 'edit_file',
+          args: {
+            path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'name: runtime-skill',
+            new_text: 'name: dev-toolkit',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain(
+        'frontmatter name "dev-toolkit" must match path skill name "runtime-skill"',
+      );
+      expect(result.errorMessage).toContain('edit_file cannot rename skills');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('fails loudly when edit_file old_text is ambiguous', async () => {
+      const saveSkillFileContent = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'ambiguous-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'same\nsame\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_ambiguous',
+          name: 'edit_file',
+          args: {
+            path: 'skills/ambiguous-skill/references/a.md',
+            old_text: 'same',
+            new_text: 'different',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('matched 2 locations');
+      expect(saveSkillFileContent).not.toHaveBeenCalled();
+    });
+
+    it('blocks authoring hidden skills unless they were primed this turn', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'hidden-skill',
+            body: '---\nname: hidden-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+        },
+        {
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_hidden_skill',
+          name: 'edit_file',
+          args: {
+            path: 'skills/hidden-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('cannot be authored by the model');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('allows authoring a hidden skill that was primed this turn', async () => {
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'primed-hidden-skill',
+          body: '---\nname: primed-hidden-skill\ndescription: Hidden\n---\n# Changed\n',
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'primed-hidden-skill',
+            body: '---\nname: primed-hidden-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+        },
+        {
+          skillPrimedIdsByName: { 'primed-hidden-skill': SKILL_ID.toString() },
+          activeSkillNames: new Set(['primed-hidden-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_primed_hidden_skill',
+          name: 'edit_file',
+          args: {
+            path: 'skills/primed-hidden-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalled();
+    });
+
+    it('overwrites large bundled skill files without reading the old content', async () => {
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 11,
+        relativePath: 'references/large.md',
+      }));
+      const getStrategyFunctions = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'large-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 600 * 1024,
+          filepath: '/tmp/large.md',
+          source: 'local',
+          relativePath: 'references/large.md',
+        })),
+        getStrategyFunctions,
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_overwrite_large',
+          name: 'create_file',
+          args: {
+            path: 'skills/large-skill/references/large.md',
+            content: 'replacement',
+            overwrite: true,
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Updated skills/large-skill/references/large.md');
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          relativePath: 'references/large.md',
+          content: 'replacement',
+        }),
+      );
+      expect(getStrategyFunctions).not.toHaveBeenCalled();
+    });
+
+    it('serializes same-file authoring calls so later edits see prior writes', async () => {
+      let storedContent = 'one\n';
+      const saveSkillFileContent = jest.fn(async ({ content }: { content: string }) => {
+        storedContent = content;
+        return {
+          bytes: Buffer.byteLength(content, 'utf8'),
+          relativePath: 'references/a.md',
+        };
+      });
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'serial-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: storedContent,
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: Buffer.byteLength(storedContent, 'utf8'),
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const results = await invokeHandler(handler, [
+        {
+          id: 'call_edit_one',
+          name: 'edit_file',
+          args: {
+            path: 'skills/serial-skill/references/a.md',
+            old_text: 'one',
+            new_text: 'two',
+          },
+        },
+        {
+          id: 'call_edit_two',
+          name: 'edit_file',
+          args: {
+            path: 'skills/serial-skill/references/a.md',
+            old_text: 'two',
+            new_text: 'three',
+          },
+        },
+      ]);
+
+      expect(results.map((r) => r.status)).toEqual(['success', 'success']);
+      expect(storedContent).toBe('three\n');
+      expect(saveSkillFileContent).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('file authoring tools for code-exec sandbox files', () => {
+    const req = {
+      user: { id: 'user-1' },
+      config: {},
+    } as never;
+
+    function makeSandboxAuthoringHandler(params: Partial<ToolExecuteOptions>) {
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req,
+          codeEnvAvailable: true,
+          accessibleSkillIds: [],
+          skillAuthoringAvailable: false,
+          fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        },
+      }));
+      return createToolExecuteHandler({
+        loadTools,
+        ...params,
+      });
+    }
+
+    it('creates a sandbox file when it does not already exist', async () => {
+      const readSandboxFile = jest.fn(async () => {
+        throw new Error('cat: /mnt/data/new.txt: No such file or directory');
+      });
+      const writeSandboxFile = jest.fn(async () => ({
+        stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt', storage_session_id: 'sess-new' }],
+      }));
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile,
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_create_sandbox',
+          name: 'create_file',
+          args: {
+            path: '/mnt/data/new.txt',
+            content: 'hello world',
+          },
+          codeSessionContext: {
+            session_id: 'sess-prev',
+            files: [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }],
+          },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Created /mnt/data/new.txt');
+      expect(result.artifact).toMatchObject({
+        path: '/mnt/data/new.txt',
+        created: true,
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt' }],
+      });
+      expect(writeSandboxFile).toHaveBeenCalledWith({
+        file_path: '/mnt/data/new.txt',
+        content: 'hello world',
+        session_id: 'sess-prev',
+        files: [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }],
+        req,
+      });
+    });
+
+    it('refuses to overwrite an existing sandbox file without overwrite: true', async () => {
+      const writeSandboxFile = jest.fn();
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile: jest.fn(async () => ({ content: 'existing text\n' })),
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_create_existing_sandbox',
+          name: 'create_file',
+          args: {
+            path: '/mnt/data/existing.txt',
+            content: 'new text\n',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+
+    it('edits a sandbox file and returns diff, strategies, and session artifact', async () => {
+      const writeSandboxFile = jest.fn(async () => ({
+        stdout: 'WROTE 10 bytes to /mnt/data/edit.txt\n',
+        session_id: 'sess-edit',
+        files: [{ id: 'file-edit', name: 'edit.txt', storage_session_id: 'sess-edit' }],
+      }));
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile: jest.fn(async () => ({ content: 'alpha old\n' })),
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_sandbox',
+          name: 'edit_file',
+          args: {
+            path: '/mnt/data/edit.txt',
+            old_text: 'alpha old',
+            new_text: 'alpha new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Strategies: exact');
+      expect(result.content).toContain('-alpha old');
+      expect(result.content).toContain('+alpha new');
+      expect(result.artifact).toMatchObject({
+        path: '/mnt/data/edit.txt',
+        edits: 1,
+        strategies: ['exact'],
+        session_id: 'sess-edit',
+      });
+      expect(writeSandboxFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          file_path: '/mnt/data/edit.txt',
+          content: 'alpha new\n',
+        }),
+      );
+    });
+
+    it('propagates newly created sandbox sessions to queued same-path authoring calls', async () => {
+      let readCount = 0;
+      let writeCount = 0;
+      const sandboxFiles = [
+        { id: 'file-queued', name: 'queued.txt', storage_session_id: 'sess-new' },
+      ];
+      const readSandboxFile = jest.fn(
+        async ({
+          session_id,
+          files,
+        }: {
+          session_id?: string;
+          files?: Array<{ id: string; name: string; storage_session_id?: string }>;
+        }) => {
+          readCount++;
+          if (readCount === 1) {
+            throw new Error('cat: /mnt/data/queued.txt: No such file or directory');
+          }
+
+          expect(session_id).toBe('sess-new');
+          expect(files).toEqual(sandboxFiles);
+          return { content: 'hello world\n' };
+        },
+      );
+      const writeSandboxFile = jest.fn(
+        async ({
+          session_id,
+          files,
+          content,
+        }: {
+          session_id?: string;
+          files?: Array<{ id: string; name: string; storage_session_id?: string }>;
+          content: string;
+        }) => {
+          writeCount++;
+          if (writeCount === 1) {
+            expect(session_id).toBeUndefined();
+            expect(files).toBeUndefined();
+            expect(content).toBe('hello world\n');
+          } else {
+            expect(session_id).toBe('sess-new');
+            expect(files).toEqual(sandboxFiles);
+            expect(content).toBe('goodbye world\n');
+          }
+          return {
+            stdout: `WROTE ${content.length} bytes to /mnt/data/queued.txt\n`,
+            session_id: 'sess-new',
+            files: sandboxFiles,
+          };
+        },
+      );
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile,
+        writeSandboxFile,
+      });
+
+      const results = await invokeHandler(handler, [
+        {
+          id: 'call_create_queued_sandbox',
+          name: 'create_file',
+          args: {
+            path: '/mnt/data/queued.txt',
+            content: 'hello world\n',
+          },
+        },
+        {
+          id: 'call_edit_queued_sandbox',
+          name: 'edit_file',
+          args: {
+            path: '/mnt/data/queued.txt',
+            old_text: 'hello world',
+            new_text: 'goodbye world',
+          },
+        },
+      ]);
+
+      expect(results.map((result) => result.status)).toEqual(['success', 'success']);
+      expect(readSandboxFile).toHaveBeenCalledTimes(2);
+      expect(writeSandboxFile).toHaveBeenCalledTimes(2);
+    });
+
+    it('rejects non-skill paths when code execution is unavailable', async () => {
+      const writeSandboxFile = jest.fn();
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req,
+          codeEnvAvailable: false,
+          accessibleSkillIds: [],
+          skillAuthoringAvailable: false,
+          fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        },
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools,
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_no_code_env_authoring',
+          name: 'create_file',
+          args: {
+            path: '/mnt/data/nope.txt',
+            content: 'nope',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('code execution enabled');
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+
+    it('rejects skills/ paths for code-exec-only agents', async () => {
+      const createSkill = jest.fn();
+      const writeSandboxFile = jest.fn();
+      const handler = makeSandboxAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_code_only_skill_path',
+          name: 'create_file',
+          args: {
+            path: 'skills/nope/SKILL.md',
+            content: '---\nname: nope\ndescription: Nope\n---\n# Nope\n',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('Skill file authoring is not available');
+      expect(createSkill).not.toHaveBeenCalled();
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('read_file sandbox fallback (code-env paths + non-skill segments)', () => {
+    function makeReadFileHandler(params: {
+      codeEnvAvailable?: boolean;
+      accessibleSkillIds?: unknown[];
+      activeSkillNames?: Set<string>;
+      skillPrimedIdsByName?: Record<string, string>;
+      skillAuthoringAvailable?: boolean;
+      req?: unknown;
+      readSandboxFile?: ToolExecuteOptions['readSandboxFile'];
+      getSkillByName?: ToolExecuteOptions['getSkillByName'];
+      getAuthorSkillByName?: ToolExecuteOptions['getAuthorSkillByName'];
+    }) {
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req: params.req,
+          codeEnvAvailable: params.codeEnvAvailable === true,
+          accessibleSkillIds: params.accessibleSkillIds ?? [],
+          activeSkillNames: params.activeSkillNames,
+          skillPrimedIdsByName: params.skillPrimedIdsByName,
+          skillAuthoringAvailable: params.skillAuthoringAvailable === true,
+        },
+      }));
+      return createToolExecuteHandler({
+        loadTools,
+        getSkillByName: params.getSkillByName,
+        getAuthorSkillByName: params.getAuthorSkillByName,
+        readSandboxFile: params.readSandboxFile,
+      });
+    }
+
+    it('routes /mnt/data/ paths to the sandbox fallback when codeEnv is available', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'hello-world' }));
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_mnt_1',
+          name: Constants.READ_FILE,
+          args: { path: '/mnt/data/sentinel.txt' },
+          codeSessionContext: {
+            session_id: 'sess-X',
+            files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+          },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(readSandboxFile).toHaveBeenCalledWith({
+        file_path: '/mnt/data/sentinel.txt',
+        session_id: 'sess-X',
+        files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+      });
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('hello-world');
+    });
+
+    it('returns a clear error for /mnt/data/ when codeEnv is not available', async () => {
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: false,
+        accessibleSkillIds: skillsInScope(),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_mnt_2',
+          name: Constants.READ_FILE,
+          args: { path: '/mnt/data/sentinel.txt' },
+        },
+      ]);
+
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('code-execution sandbox path');
+    });
+
+    it('falls back to sandbox when first segment is not a known skill name', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-data' }));
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['only-real-skill']),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_unknown_skill',
+          name: Constants.READ_FILE,
+          args: { path: 'not-a-skill/foo.md' },
+          codeSessionContext: { session_id: 'sess-Y' },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(readSandboxFile).toHaveBeenCalledWith(
+        expect.objectContaining({ file_path: 'not-a-skill/foo.md', session_id: 'sess-Y' }),
+      );
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('sandbox-data');
+    });
+
+    it('does NOT misroute primed skills outside the catalog cap to the sandbox', async () => {
+      /**
+       * Regression for review P2 #2: manual ($-popover) and always-apply
+       * primes are intentionally resolved off the wider `accessibleSkillIds`
+       * ACL set BEFORE catalog injection — see `resolveManualSkills`.
+       * A primed skill name can therefore legitimately be ABSENT from
+       * `activeSkillNames` (which reflects the catalog after the
+       * `SKILL_CATALOG_LIMIT` cap and active filter).
+       *
+       * Without the primed-bypass, the `activeSkillNames` shortcut would
+       * misroute `read_file("primed-only-skill/references/foo.md")` to
+       * the sandbox even though the primed skill is in scope and
+       * `getSkillByName` would resolve it via the pinned `_id`.
+       */
+      const primedHex = '507f1f77bcf86cd799439060';
+      const getSkillByName = jest.fn(async () => ({
+        _id: primedHex as unknown as never,
+        name: 'primed-only-skill',
+        body: '# Primed skill body',
+        fileCount: 1,
+        version: 1,
+      }));
+      const readSandboxFile = jest.fn();
+      const getSkillFileByPath = jest.fn(async () => ({
+        content: 'references content',
+        mimeType: 'text/markdown',
+        bytes: 18,
+        filepath: 'references/foo.md',
+        source: 'local',
+        relativePath: 'references/foo.md',
+        isBinary: false,
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools: jest.fn(async () => ({
+          loadedTools: [],
+          configurable: {
+            codeEnvAvailable: true,
+            accessibleSkillIds: skillsInScope(),
+            /* Catalog visible names DO NOT include the primed skill — it's
+               outside the cap. */
+            activeSkillNames: new Set(['some-other-skill']),
+            /* But the prime resolver authorized it for this turn. */
+            skillPrimedIdsByName: { 'primed-only-skill': primedHex },
+          },
+        })),
+        getSkillByName,
+        getSkillFileByPath,
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_primed_outside_catalog',
+          name: Constants.READ_FILE,
+          args: { path: 'primed-only-skill/references/foo.md' },
+        },
+      ]);
+
+      // Primed skill resolved through the existing skill path, not the
       // sandbox shortcut.
       expect(readSandboxFile).not.toHaveBeenCalled();
       expect(getSkillByName).toHaveBeenCalledWith('primed-only-skill', expect.any(Array), {});
@@ -935,6 +2403,58 @@ describe('createToolExecuteHandler', () => {
       expect(result.content).toContain('references content');
     });
 
+    it('rehydrates same-author skills when activeSkillNames is stale', async () => {
+      const { Types } = jest.requireActual('mongoose') as typeof import('mongoose');
+      const skillId = new Types.ObjectId();
+      const req = {
+        user: {
+          id: 'user-1',
+          _id: new Types.ObjectId(),
+          role: 'USER',
+        },
+      } as never;
+      const recoveredSkill = {
+        _id: skillId,
+        name: 'stale-catalog-skill',
+        body: '# Recovered Body',
+        fileCount: 0,
+        version: 4,
+      };
+      const getAuthorSkillByName = jest.fn(async () => recoveredSkill);
+      const getSkillByName = jest.fn(async (_name: string, ids: unknown[]) =>
+        ids.some((id) => id?.toString() === skillId.toString()) ? recoveredSkill : null,
+      );
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        req,
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['stale-catalog-skill']),
+        readSandboxFile,
+        getAuthorSkillByName,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_stale_catalog_skill',
+          name: Constants.READ_FILE,
+          args: { path: 'stale-catalog-skill/SKILL.md' },
+        },
+      ]);
+
+      expect(getAuthorSkillByName).toHaveBeenCalledWith({ req, name: 'stale-catalog-skill' });
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(getSkillByName).toHaveBeenCalledWith(
+        'stale-catalog-skill',
+        expect.arrayContaining([skillId]),
+        expect.objectContaining({ preferModelInvocable: true }),
+      );
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Recovered Body');
+    });
+
     it('routes through sandbox when skills are not effectively enabled (empty accessibleSkillIds)', async () => {
       /**
        * `accessibleSkillIds: []` is what `resolveAgentScopedSkillIds`
@@ -955,7 +2475,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_skills_off',
           name: Constants.READ_FILE,
-          args: { file_path: 'whatever/path.md' },
+          args: { path: 'whatever/path.md' },
         },
       ]);
 
@@ -975,7 +2495,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_no_route',
           name: Constants.READ_FILE,
-          args: { file_path: 'whatever/path.md' },
+          args: { path: 'whatever/path.md' },
         },
       ]);
 
@@ -1004,7 +2524,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_real_skill',
           name: Constants.READ_FILE,
-          args: { file_path: 'real-skill/SKILL.md' },
+          args: { path: 'real-skill/SKILL.md' },
         },
       ]);
 
@@ -1014,6 +2534,66 @@ describe('createToolExecuteHandler', () => {
       expect(result.content).toContain('Real Body');
     });
 
+    it('resolves authored skills/{skillName}/... paths without falling back to sandbox', async () => {
+      const getSkillByName = jest.fn(async () => ({
+        _id: 'real-skill-id' as unknown as never,
+        name: 'real-skill',
+        body: '# Real Body',
+        fileCount: 0,
+        version: 1,
+      }));
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['real-skill']),
+        readSandboxFile,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_real_skill_namespace',
+          name: Constants.READ_FILE,
+          args: { path: 'skills/real-skill/SKILL.md' },
+        },
+      ]);
+
+      expect(getSkillByName).toHaveBeenCalledWith(
+        'real-skill',
+        expect.any(Array),
+        expect.objectContaining({ preferModelInvocable: true }),
+      );
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('File: skills/real-skill/SKILL.md');
+      expect(result.content).toContain('Real Body');
+    });
+
+    it('does not route explicit skills/ paths to the sandbox when skills are unavailable', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-content' }));
+      const getSkillByName = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: [],
+        readSandboxFile,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_explicit_skill_namespace_off',
+          name: Constants.READ_FILE,
+          args: { path: 'skills/whatever/SKILL.md' },
+        },
+      ]);
+
+      expect(getSkillByName).not.toHaveBeenCalled();
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('Skill files are not available');
+    });
+
     it('falls back to sandbox for trailing-slash paths (empty relativePath, codeEnv on)', async () => {
       /**
        * Regression for review Finding #4: `read_file("output/")` is
@@ -1033,7 +2613,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_trailing_slash',
           name: Constants.READ_FILE,
-          args: { file_path: 'output/' },
+          args: { path: 'output/' },
         },
       ]);
 
@@ -1055,7 +2635,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_trailing_slash_no_env',
           name: Constants.READ_FILE,
-          args: { file_path: 'output/' },
+          args: { path: 'output/' },
         },
       ]);
 
@@ -1075,7 +2655,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_no_callback',
           name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/x.txt' },
+          args: { path: '/mnt/data/x.txt' },
         },
       ]);
 
@@ -1104,7 +2684,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_huge_file',
           name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/huge.log' },
+          args: { path: '/mnt/data/huge.log' },
         },
       ]);
 
@@ -1132,7 +2712,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_small_file',
           name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/sentinel.txt' },
+          args: { path: '/mnt/data/sentinel.txt' },
         },
       ]);
 
@@ -1153,7 +2733,7 @@ describe('createToolExecuteHandler', () => {
         {
           id: 'call_null_result',
           name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/missing.txt' },
+          args: { path: '/mnt/data/missing.txt' },
         },
       ]);
 
@@ -1184,7 +2764,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_png',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/simple_graph.png' },
+            args: { path: '/mnt/data/simple_graph.png' },
             codeSessionContext: { session_id: 'sess-Z' },
           } as unknown as ToolCallRequest,
         ]);
@@ -1209,7 +2789,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_zip',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/archive.zip' },
+            args: { path: '/mnt/data/archive.zip' },
           },
         ]);
 
@@ -1233,7 +2813,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_uppercase',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/CHART.PNG' },
+            args: { path: '/mnt/data/CHART.PNG' },
           },
         ]);
 
@@ -1260,7 +2840,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_nul_sniff',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/mystery_file' },
+            args: { path: '/mnt/data/mystery_file' },
           },
         ]);
 
@@ -1284,7 +2864,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_text',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/notes.txt' },
+            args: { path: '/mnt/data/notes.txt' },
           },
         ]);
 
@@ -1308,7 +2888,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_dotted_dir',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/proj.v1/notes' },
+            args: { path: '/mnt/data/proj.v1/notes' },
           },
         ]);
 
@@ -1336,7 +2916,7 @@ describe('createToolExecuteHandler', () => {
           {
             id: 'call_svg',
             name: Constants.READ_FILE,
-            args: { file_path: '/mnt/data/icon.svg' },
+            args: { path: '/mnt/data/icon.svg' },
           },
         ]);
 
@@ -1348,3 +2928,108 @@ describe('createToolExecuteHandler', () => {
     });
   });
 });
+
+describe('per-call onResult reporting', () => {
+  function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+    let resolveFn!: (value: T) => void;
+    const promise = new Promise<T>((res) => {
+      resolveFn = res;
+    });
+    return { promise, resolve: resolveFn };
+  }
+
+  it('reports each result as it settles, before the batch resolves', async () => {
+    const slowGate = deferred<void>();
+    const timeline: string[] = [];
+
+    const fastTool = {
+      name: 'fast_tool',
+      invoke: jest.fn(async () => {
+        timeline.push('fast:done');
+        return { content: 'fast result' };
+      }),
+    };
+    const slowTool = {
+      name: 'slow_tool',
+      invoke: jest.fn(async () => {
+        await slowGate.promise;
+        timeline.push('slow:done');
+        return { content: 'slow result' };
+      }),
+    };
+
+    const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+      loadedTools: [fastTool, slowTool] as never[],
+    }));
+    const handler = createToolExecuteHandler({ loadTools });
+
+    const reported: ToolExecuteResult[] = [];
+    const batchPromise = new Promise<ToolExecuteResult[]>((resolve, reject) => {
+      const request = {
+        toolCalls: [
+          { id: 'call_fast', name: 'fast_tool', args: {} },
+          { id: 'call_slow', name: 'slow_tool', args: {} },
+        ],
+        resolve,
+        reject,
+        onResult: (result: ToolExecuteResult) => {
+          reported.push(result);
+          timeline.push(`reported:${result.toolCallId}`);
+        },
+      } as ToolExecuteBatchRequest & {
+        onResult: (result: ToolExecuteResult) => void;
+      };
+      handler.handle('on_tool_execute', request);
+    });
+
+    // Let the fast tool settle and report while the slow tool is gated.
+    await new Promise((res) => setTimeout(res, 0));
+    expect(reported.map((r) => r.toolCallId)).toEqual(['call_fast']);
+
+    slowGate.resolve();
+    const results = await batchPromise;
+
+    expect(reported.map((r) => r.toolCallId)).toEqual(['call_fast', 'call_slow']);
+    expect(timeline.indexOf('reported:call_fast')).toBeLessThan(timeline.indexOf('slow:done'));
+    expect(results.map((r) => r.toolCallId).sort()).toEqual(['call_fast', 'call_slow']);
+    expect(results.find((r) => r.toolCallId === 'call_fast')?.content).toBe('fast result');
+  });
+
+  it('keeps the batch resolving when onResult throws', async () => {
+    const tool = {
+      name: 'sturdy_tool',
+      invoke: jest.fn(async () => ({ content: 'ok' })),
+    };
+    const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+      loadedTools: [tool] as never[],
+    }));
+    const handler = createToolExecuteHandler({ loadTools });
+
+    const results = await new Promise<ToolExecuteResult[]>((resolve, reject) => {
+      const request = {
+        toolCalls: [{ id: 'call_1', name: 'sturdy_tool', args: {} }],
+        resolve,
+        reject,
+        onResult: () => {
+          throw new Error('listener exploded');
+        },
+      } as ToolExecuteBatchRequest & { onResult: () => void };
+      handler.handle('on_tool_execute', request);
+    });
+
+    expect(results).toHaveLength(1);
+    expect(results[0]).toMatchObject({ toolCallId: 'call_1', content: 'ok' });
+  });
+
+  it('behaves identically when no onResult is provided', async () => {
+    const capturedConfigs: Record<string, unknown>[] = [];
+    const handler = createHandler(capturedConfigs);
+
+    const results = await invokeHandler(handler, [
+      { id: 'call_1', name: Constants.EXECUTE_CODE, args: { lang: 'py', code: '1' } },
+    ]);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].status).toBe('success');
+  });
+});
diff --git a/packages/api/src/agents/handlers.ts b/packages/api/src/agents/handlers.ts
index 5a6e3834bf0..8605ef498e5 100644
--- a/packages/api/src/agents/handlers.ts
+++ b/packages/api/src/agents/handlers.ts
@@ -1,5 +1,7 @@
+import yaml from 'js-yaml';
+import { Types } from 'mongoose';
 import { logger } from '@librechat/data-schemas';
-import { GraphEvents, Constants, CODE_EXECUTION_TOOLS } from '@librechat/agents';
+import { GraphEvents, Constants } from '@librechat/agents';
 import type {
   LCTool,
   EventHandler,
@@ -9,12 +11,18 @@ import type {
   ToolExecuteResult,
   ToolExecuteBatchRequest,
 } from '@librechat/agents';
-import { Types } from 'mongoose';
-import type { CodeEnvRef } from 'librechat-data-provider';
 import type { StructuredToolInterface } from '@librechat/agents/langchain/tools';
+import type { CodeEnvRef } from 'librechat-data-provider';
 import type { SkillFileRecord } from './skillFiles';
 import type { ServerRequest } from '~/types';
+import {
+  CREATE_FILE_TOOL_NAME,
+  EDIT_FILE_TOOL_NAME,
+  HOST_FILE_AUTHORING_ARTIFACT_KEY,
+  isCodeSessionToolName,
+} from './tools';
 import { logAxiosError, runOutsideTracing } from '~/utils';
+import { parseFrontmatter } from '../skills/import';
 import { buildSkillPrimeMessage } from './skills';
 import { cleanCodeToolOutput } from './cleanup';
 import { primeSkillFiles } from './skillFiles';
@@ -74,6 +82,8 @@ export interface ToolExecuteOptions {
      *  prior cache entry. */
     version: number;
     fileCount: number;
+    /** True for deployment-directory skills that are loaded in memory. */
+    deployment?: boolean;
     /**
      * Set when the skill author opted out of model invocation. The handler
      * rejects the call and returns an instructive error so the model knows
@@ -82,6 +92,81 @@ export interface ToolExecuteOptions {
      */
     disableModelInvocation?: boolean;
   } | null>;
+  /**
+   * Loads a skill by name when the current user is the author. This is a
+   * narrow recovery path for freshly-authored skills whose runtime catalog
+   * snapshot has not caught up yet; normal skill resolution still goes
+   * through `accessibleSkillIds`.
+   */
+  getAuthorSkillByName?: (params: { req: ServerRequest; name: string }) => Promise<{
+    body: string;
+    name: string;
+    _id: Types.ObjectId;
+    version: number;
+    fileCount: number;
+    disableModelInvocation?: boolean;
+  } | null>;
+  /** Creates a skill from a tool-authored SKILL.md body. */
+  createSkill?: (data: {
+    name: string;
+    description: string;
+    body: string;
+    frontmatter?: Record<string, unknown>;
+    author: Types.ObjectId;
+    authorName: string;
+    alwaysApply?: boolean;
+    tenantId?: string;
+  }) => Promise<{
+    skill: {
+      _id: Types.ObjectId;
+      name: string;
+      body: string;
+      version: number;
+    };
+  }>;
+  /** Updates a skill body and derived metadata from a tool-authored SKILL.md body. */
+  updateSkill?: (params: {
+    id: string;
+    expectedVersion: number;
+    update: {
+      body?: string;
+      description?: string;
+      frontmatter?: Record<string, unknown>;
+      alwaysApply?: boolean;
+    };
+  }) => Promise<
+    | {
+        status: 'updated';
+        skill: { _id: Types.ObjectId; name: string; body: string; version: number };
+      }
+    | { status: 'conflict'; current: { _id: Types.ObjectId; name: string; version: number } }
+    | { status: 'not_found' }
+  >;
+  /** Checks role-level skill creation permission for the current user. */
+  canCreateSkill?: (params: { req: ServerRequest }) => Promise<boolean>;
+  /** Checks resource-level edit permission for an existing skill. */
+  canEditSkill?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+  }) => Promise<boolean>;
+  /** Grants SKILL_OWNER to the current user after a tool-created skill is inserted. */
+  grantSkillOwner?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+  }) => Promise<void>;
+  /** Deletes a freshly-created skill if owner-permission setup fails. */
+  deleteSkill?: (id: string) => Promise<{ deleted: boolean }>;
+  /** Saves or replaces a bundled skill file in configured storage and metadata. */
+  saveSkillFileContent?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+    relativePath: string;
+    content: string;
+    mimeType: string;
+  }) => Promise<{
+    bytes: number;
+    relativePath: string;
+  }>;
   /** Lists files bundled with a skill (for code env priming) */
   listSkillFiles?: (skillId: Types.ObjectId | string) => Promise<SkillFileRecord[]>;
   /** Storage strategy resolver for skill file streaming */
@@ -146,275 +231,2276 @@ export interface ToolExecuteOptions {
   readSandboxFile?: (params: {
     file_path: string;
     session_id?: string;
-    files?: Array<{ id: string; name: string; session_id?: string }>;
+    files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
     req?: ServerRequest;
   }) => Promise<{ content: string } | null>;
+  /**
+   * Writes a UTF-8 text file into the code-execution sandbox via the
+   * sandbox `/exec` endpoint. Mirrors `readSandboxFile` session forwarding
+   * so host-side file-authoring tools can operate in the same sandbox
+   * session as `bash_tool` / `read_file`.
+   */
+  writeSandboxFile?: (params: {
+    file_path: string;
+    content: string;
+    session_id?: string;
+    files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
+    req?: ServerRequest;
+  }) => Promise<{
+    stdout?: string;
+    stderr?: string;
+    session_id?: string;
+    files?: Array<{ id: string; name: string; storage_session_id?: string; session_id?: string }>;
+  } | null>;
 }
 
 const MAX_READABLE_BYTES = 262_144;
 const MAX_BINARY_BYTES = 5 * 1024 * 1024;
 const MAX_CACHE_BYTES = 512 * 1024;
+const MAX_AUTHORING_BYTES = 10 * 1024 * 1024;
+const MAX_TOOL_ERROR_MESSAGE_CHARS = 12_000;
+const MAX_TOOL_ERROR_STACK_CHARS = 4_000;
+const SKILL_FILE_PREFIX = 'skills/';
+const SKILL_MD = 'SKILL.md';
 
 const IMAGE_MIMES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
 
+type ToolInputSchemaKind = {
+  object: boolean;
+  string: boolean;
+};
+
+function truncateMiddle(value: string, maxChars: number): string {
+  if (value.length <= maxChars) {
+    return value;
+  }
+
+  const indicator = `\n\n... [truncated: ${value.length} chars exceeded ${maxChars} limit] ...\n\n`;
+  const available = maxChars - indicator.length;
+  if (available <= 0) {
+    return value.slice(0, maxChars);
+  }
+
+  const headSize = Math.ceil(available * 0.7);
+  const tailSize = available - headSize;
+  return value.slice(0, headSize) + indicator + value.slice(value.length - tailSize);
+}
+
+function stringifyThrownValue(error: unknown): string {
+  try {
+    return String(error);
+  } catch {
+    return '[Thrown value could not be converted to string]';
+  }
+}
+
+function getThrownValueMessage(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message;
+  }
+
+  if (error != null && typeof error === 'object') {
+    try {
+      const message = (error as { message?: unknown }).message;
+      if (typeof message === 'string') {
+        return message;
+      }
+      if (message != null) {
+        return stringifyThrownValue(message);
+      }
+    } catch {
+      // Fall through to whole-value stringification.
+    }
+  }
+
+  return stringifyThrownValue(error);
+}
+
+function getSafeToolError(error: unknown): {
+  message: string;
+  logContext: Record<string, unknown>;
+} {
+  const rawMessage = getThrownValueMessage(error);
+  const message = truncateMiddle(rawMessage, MAX_TOOL_ERROR_MESSAGE_CHARS);
+  const stack = error instanceof Error && error.stack ? error.stack : undefined;
+
+  return {
+    message,
+    logContext: {
+      name: error instanceof Error ? error.name : typeof error,
+      message,
+      messageLength: rawMessage.length,
+      messageTruncated: message.length !== rawMessage.length,
+      stack: stack ? truncateMiddle(stack, MAX_TOOL_ERROR_STACK_CHARS) : undefined,
+    },
+  };
+}
+
+function mergeSchemaKind(target: ToolInputSchemaKind, source: ToolInputSchemaKind): void {
+  target.object ||= source.object;
+  target.string ||= source.string;
+}
+
+function detectToolInputSchemaKind(schema: unknown): ToolInputSchemaKind {
+  const kind: ToolInputSchemaKind = { object: false, string: false };
+
+  if (!schema || typeof schema !== 'object') {
+    return kind;
+  }
+
+  const jsonSchemaType = (schema as { type?: unknown }).type;
+  if (jsonSchemaType === 'object') {
+    kind.object = true;
+  } else if (jsonSchemaType === 'string') {
+    kind.string = true;
+  } else if (Array.isArray(jsonSchemaType)) {
+    kind.object = jsonSchemaType.includes('object');
+    kind.string = jsonSchemaType.includes('string');
+  }
+
+  for (const compositeKey of ['anyOf', 'oneOf', 'allOf'] as const) {
+    const options = (schema as Record<typeof compositeKey, unknown>)[compositeKey];
+    if (Array.isArray(options)) {
+      for (const option of options) {
+        mergeSchemaKind(kind, detectToolInputSchemaKind(option));
+      }
+    }
+  }
+
+  const zodDef = (schema as { _def?: unknown })._def;
+  if (!zodDef || typeof zodDef !== 'object') {
+    return kind;
+  }
+
+  const zodType = (zodDef as { type?: unknown; typeName?: unknown }).type;
+  const zodTypeName = (zodDef as { type?: unknown; typeName?: unknown }).typeName;
+
+  if (zodType === 'object' || zodTypeName === 'ZodObject') {
+    kind.object = true;
+  } else if (zodType === 'string' || zodTypeName === 'ZodString') {
+    kind.string = true;
+  }
+
+  const innerSchema =
+    (zodDef as { innerType?: unknown; schema?: unknown }).innerType ??
+    (zodDef as { schema?: unknown }).schema;
+  if (innerSchema) {
+    mergeSchemaKind(kind, detectToolInputSchemaKind(innerSchema));
+  }
+
+  const zodOptions = (zodDef as { options?: unknown }).options;
+  if (Array.isArray(zodOptions)) {
+    for (const option of zodOptions) {
+      mergeSchemaKind(kind, detectToolInputSchemaKind(option));
+    }
+  }
+
+  return kind;
+}
+
+function getToolInputSchemaKind(tool: StructuredToolInterface): ToolInputSchemaKind {
+  const constructorName = (tool as { constructor?: { name?: string } }).constructor?.name;
+  if (constructorName === 'DynamicTool') {
+    return { object: false, string: true };
+  }
+
+  return detectToolInputSchemaKind((tool as { schema?: unknown }).schema);
+}
+
+function normalizeToolInvokeArgs(args: unknown, tool: StructuredToolInterface): unknown {
+  const schemaKind = getToolInputSchemaKind(tool);
+
+  if (typeof args !== 'string') {
+    if (!schemaKind.string || schemaKind.object) {
+      return args;
+    }
+
+    const inputValue = (args as { input?: unknown })?.input;
+    return typeof inputValue === 'string' ? args : JSON.stringify(args);
+  }
+
+  if (!schemaKind.object || schemaKind.string) {
+    return args;
+  }
+
+  const trimmed = args.trim();
+  if (!trimmed.startsWith('{')) {
+    return args;
+  }
+
+  try {
+    const parsed = JSON.parse(trimmed) as unknown;
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    return args;
+  }
+
+  return args;
+}
+
+function getValueShape(value: unknown): string {
+  if (value === null) {
+    return 'null';
+  }
+  if (Array.isArray(value)) {
+    return 'array';
+  }
+  return typeof value;
+}
+
 function addLineNumbers(content: string): string {
   const lines = content.split('\n');
   const w = String(lines.length).length;
   return lines.map((l, i) => `${String(i + 1).padStart(w, ' ')} | ${l}`).join('\n');
 }
 
-/**
- * Extensions whose contents `read_file` must never serialize as text. `cat`
- * on a PNG inside the sandbox returns the raw bytes as stdout, JSON-encoded
- * by codeapi with lossy UTF-8 replacement and then line-numbered by us —
- * the result is a multi-KB blob of mojibake that pollutes the LLM context
- * and exposes the raw bytes anyway. Short-circuit before the network call.
- *
- * Image categories surface a "use the existing attachment" message because
- * the file was already attached to the conversation as part of the
- * code-execution artifact pipeline — re-attaching here would dup it.
- */
-const BINARY_EXTENSIONS_NEVER_READABLE = new Set([
-  // Raster images (already attached as artifacts by the code-execution
-  // pipeline). `.svg` is intentionally NOT in this list — it's an XML
-  // text format with no mojibake risk, and there are legitimate reasons
-  // for the model to inspect or edit a generated SVG. The post-fetch
-  // NUL-byte sniff still catches anything that turns out to be binary
-  // despite a `.svg` extension.
-  '.png',
-  '.jpg',
-  '.jpeg',
-  '.gif',
-  '.webp',
-  '.bmp',
-  '.tiff',
-  '.tif',
-  '.ico',
-  '.heic',
-  '.heif',
-  '.avif',
-  // Documents (binary container formats)
-  '.pdf',
-  '.doc',
-  '.docx',
-  '.xls',
-  '.xlsx',
-  '.ppt',
-  '.pptx',
-  '.odt',
-  '.ods',
-  '.odp',
-  // Archives
-  '.zip',
-  '.tar',
-  '.gz',
-  '.tgz',
-  '.bz2',
-  '.xz',
-  '.7z',
-  '.rar',
-  '.lz4',
-  '.zst',
-  // Audio / video
-  '.mp3',
-  '.wav',
-  '.flac',
-  '.ogg',
-  '.m4a',
-  '.aac',
-  '.wma',
-  '.mp4',
-  '.mkv',
-  '.mov',
-  '.avi',
-  '.webm',
-  '.flv',
-  '.m4v',
-  // Executables / object files / native libs
-  '.exe',
-  '.dll',
-  '.so',
-  '.dylib',
-  '.o',
-  '.obj',
-  '.a',
-  '.lib',
-  '.bin',
-  '.class',
-  '.jar',
-  // Other byte-soup formats
-  '.parquet',
-  '.bson',
-  '.db',
-  '.sqlite',
-  '.sqlite3',
-  '.pyc',
-  '.pyo',
-  '.wasm',
-  '.ttf',
-  '.otf',
-  '.woff',
-  '.woff2',
-  '.eot',
-]);
+type AuthoringSkill = NonNullable<
+  Awaited<ReturnType<NonNullable<ToolExecuteOptions['getSkillByName']>>>
+>;
+
+type AuthoringResult = Promise<ToolExecuteResult>;
+
+type ParsedSkillAuthoringPath = {
+  skillName: string;
+  relativePath: string;
+  displayPath: string;
+};
+
+type TextEdit = {
+  old_text: string;
+  new_text: string;
+};
+
+type MatchStatus =
+  | { status: 'matched'; index: number; length: number; strategy: string }
+  | { status: 'none' }
+  | { status: 'ambiguous'; strategy: string; count: number };
+
+type LoadedSkillText =
+  | { status: 'loaded'; content: string; bytes: number }
+  | { status: 'missing' }
+  | { status: 'error'; message: string };
+
+type ExistingSkillFile =
+  | { status: 'present'; oldContent?: string }
+  | { status: 'missing' }
+  | { status: 'error'; message: string };
+
+type LoadedSandboxText = LoadedSkillText;
+
+type SandboxSessionContext = {
+  session_id?: string;
+  files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
+};
+
+const MIME_MAP: Readonly<Record<string, string>> = Object.freeze({
+  '.md': 'text/markdown',
+  '.txt': 'text/plain',
+  '.json': 'application/json',
+  '.js': 'application/javascript',
+  '.mjs': 'application/javascript',
+  '.cjs': 'application/javascript',
+  '.ts': 'application/typescript',
+  '.tsx': 'application/typescript',
+  '.jsx': 'application/javascript',
+  '.py': 'text/x-python',
+  '.sh': 'application/x-sh',
+  '.yaml': 'application/yaml',
+  '.yml': 'application/yaml',
+  '.css': 'text/css',
+  '.html': 'text/html',
+  '.xml': 'application/xml',
+  '.csv': 'text/csv',
+  '.toml': 'text/toml',
+  '.ini': 'text/ini',
+  '.svg': 'image/svg+xml',
+});
+
+function errorResult(tc: ToolCallRequest, errorMessage: string): ToolExecuteResult {
+  return {
+    toolCallId: tc.id,
+    status: 'error',
+    content: '',
+    errorMessage,
+  };
+}
 
-const IMAGE_EXTENSIONS_FOR_HINT = new Set([
-  '.png',
-  '.jpg',
-  '.jpeg',
-  '.gif',
-  '.webp',
-  '.bmp',
-  '.tiff',
-  '.tif',
-  '.ico',
-  '.heic',
-  '.heif',
-  '.avif',
-]);
+function successResult(
+  tc: ToolCallRequest,
+  content: string,
+  artifact?: unknown,
+): ToolExecuteResult {
+  const result: ToolExecuteResult = {
+    toolCallId: tc.id,
+    status: 'success',
+    content,
+  };
+  if (artifact !== undefined) {
+    result.artifact = artifact;
+  }
+  return result;
+}
 
-function lowercaseExtension(filePath: string): string {
-  const dot = filePath.lastIndexOf('.');
-  const slash = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'));
-  if (dot < 0 || dot < slash) return '';
-  return filePath.slice(dot).toLowerCase();
+function guessMimeType(filename: string): string {
+  return MIME_MAP[lowercaseExtension(filename)] ?? 'application/octet-stream';
 }
 
-/**
- * Builds the model-visible error returned when `read_file` is invoked on
- * a binary path. Phrasing is tuned for the LLM: states the fact (file is
- * binary, can't be read as text), points at the correct affordance for
- * each common case (image already in the chat; bash for everything else),
- * and includes the path verbatim so the model can copy-paste into its
- * next call.
- */
-function buildBinaryFileError(filePath: string, ext: string): string {
-  if (IMAGE_EXTENSIONS_FOR_HINT.has(ext)) {
-    return `"${filePath}" is an image file (${ext}) and cannot be read as text. The image is already attached to the conversation and visible to the user. To process it programmatically, use \`bash_tool\` (e.g. \`file ${filePath}\` for metadata, or \`python3 -c '...'\` to operate on the bytes).`;
+function isValidSkillName(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+
+function isValidSkillFileRelativePath(value: string): boolean {
+  if (!value || value.length > 500) {
+    return false;
   }
-  return `"${filePath}" is a binary file (${ext}) and cannot be read as text by \`read_file\`. Use \`bash_tool\` to process it (e.g. \`file ${filePath}\` for metadata, or a runtime-appropriate command for the format).`;
+  if (value.startsWith('/') || value.startsWith('\\')) {
+    return false;
+  }
+  if (!/^[a-zA-Z0-9._\-/]+$/.test(value)) {
+    return false;
+  }
+  const segments = value.split('/');
+  if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+    return false;
+  }
+  return value !== SKILL_MD && segments[0] !== SKILL_MD;
 }
 
-/**
- * True when the first chunk of a string contains a NUL byte. Used as a
- * post-fetch safety net for files whose extension didn't match the
- * blocklist (no extension, novel format, etc.) — sniffs `cat` stdout to
- * avoid ever forwarding mangled bytes to the LLM. 8KB is the same
- * window the skill-file path uses; enough for any reasonable magic
- * number while bounded enough to stay cheap.
+function parseSkillAuthoringPath(filePath: string): ParsedSkillAuthoringPath | string {
+  if (!filePath.startsWith(SKILL_FILE_PREFIX)) {
+    return `Only skill file paths are supported. Use "skills/{skillName}/SKILL.md" or "skills/{skillName}/{path}".`;
+  }
+
+  const rest = filePath.slice(SKILL_FILE_PREFIX.length);
+  const slashIdx = rest.indexOf('/');
+  const skillName = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
+  const relativePath = slashIdx === -1 ? SKILL_MD : rest.slice(slashIdx + 1) || SKILL_MD;
+
+  if (!isValidSkillName(skillName)) {
+    return `Invalid skill name "${skillName}". Skill names must be kebab-case.`;
+  }
+  if (relativePath !== SKILL_MD && !isValidSkillFileRelativePath(relativePath)) {
+    return (
+      `Invalid skill file path "${relativePath}". ` +
+      'Paths must be relative and cannot contain empty, "." or ".." segments.'
+    );
+  }
+
+  return {
+    skillName,
+    relativePath,
+    displayPath: `${SKILL_FILE_PREFIX}${skillName}/${relativePath}`,
+  };
+}
+
+function deriveSkillDescription(body: string, skillName: string): string {
+  const fallback = `Use this skill for ${skillName.replace(/-/g, ' ')}.`;
+  const headingCandidates: string[] = [];
+  for (const line of body.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const withoutMarkdown = trimmed
+      .replace(/^#{1,6}\s+/, '')
+      .replace(/^[*>-]\s+/, '')
+      .trim();
+    if (!withoutMarkdown) {
+      continue;
+    }
+    if (/^#{1,6}\s+/.test(trimmed)) {
+      headingCandidates.push(withoutMarkdown);
+      continue;
+    }
+    return truncateMiddle(withoutMarkdown.replace(/\s+/g, ' '), 180);
+  }
+  const heading = headingCandidates[0];
+  return heading ? truncateMiddle(heading.replace(/\s+/g, ' '), 180) : fallback;
+}
+
+function splitSkillFrontmatter(content: string):
+  | {
+      block: string;
+      body: string;
+    }
+  | { error: string }
+  | null {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith('---')) {
+    return null;
+  }
+  const afterOpening = trimmed.slice(3);
+  const closingIdx = afterOpening.indexOf('\n---');
+  if (closingIdx === -1) {
+    return { error: `Invalid ${SKILL_MD} frontmatter: missing closing "---".` };
+  }
+  const afterClosing = afterOpening.slice(closingIdx + '\n---'.length);
+  return {
+    block: afterOpening.slice(0, closingIdx),
+    body: afterClosing.startsWith('\n') ? afterClosing.slice(1) : afterClosing,
+  };
+}
+
+function buildSkillMdContent(frontmatter: Record<string, unknown>, body: string): string {
+  const dumped = yaml.dump(frontmatter, { lineWidth: -1 }).trimEnd();
+  const normalizedBody = body.trimStart();
+  return `---\n${dumped}\n---\n${normalizedBody}`;
+}
+
+function skillNameMismatchError(frontmatterName: string, skillName: string): string {
+  return `${SKILL_MD} frontmatter name "${frontmatterName}" must match path skill name "${skillName}". edit_file cannot rename skills; keep the name unchanged or create a new skills/{newName}/SKILL.md.`;
+}
+
+function normalizeSkillMdContent(
+  content: string,
+  skillName: string,
+): { status: 'success'; content: string } | { status: 'error'; error: string } {
+  const split = splitSkillFrontmatter(content);
+  if (split && 'error' in split) {
+    return { status: 'error', error: split.error };
+  }
+
+  let normalizedContent = content;
+  if (!split) {
+    normalizedContent = buildSkillMdContent(
+      {
+        name: skillName,
+        description: deriveSkillDescription(content, skillName),
+      },
+      content,
+    );
+  } else {
+    const structured = parseStructuredSkillFrontmatter(content);
+    if (structured.error) {
+      return { status: 'error', error: structured.error };
+    }
+    const frontmatter = { ...(structured.frontmatter ?? {}) };
+    const parsed = parseFrontmatter(content);
+    const frontmatterName =
+      typeof frontmatter.name === 'string' ? frontmatter.name : parsed.name || undefined;
+    if (frontmatterName && frontmatterName !== skillName) {
+      return {
+        status: 'error',
+        error: skillNameMismatchError(frontmatterName, skillName),
+      };
+    }
+    frontmatter.name = skillName;
+    const frontmatterDescription =
+      typeof frontmatter.description === 'string'
+        ? frontmatter.description
+        : parsed.description || undefined;
+    frontmatter.description =
+      frontmatterDescription || deriveSkillDescription(split.body, skillName);
+    normalizedContent = buildSkillMdContent(frontmatter, split.body);
+  }
+
+  const parsed = parseFrontmatter(normalizedContent);
+  if (!parsed.name || !parsed.description) {
+    return {
+      status: 'error',
+      error: `${SKILL_MD} must include YAML frontmatter with "name" and "description".`,
+    };
+  }
+  if (parsed.name !== skillName) {
+    return {
+      status: 'error',
+      error: skillNameMismatchError(parsed.name, skillName),
+    };
+  }
+  if (parsed.invalidBooleans.length > 0) {
+    return {
+      status: 'error',
+      error: parsed.invalidBooleans
+        .map((key) => `"${key}" in ${SKILL_MD} frontmatter must be a boolean`)
+        .join('; '),
+    };
+  }
+  return { status: 'success', content: normalizedContent };
+}
+
+function extractSkillFrontmatterBlock(content: string): string | null {
+  const split = splitSkillFrontmatter(content);
+  if (!split || 'error' in split) {
+    return null;
+  }
+  return split.block;
+}
+
+function parseStructuredSkillFrontmatter(
+  content: string,
+):
+  | { frontmatter?: Record<string, unknown>; error?: undefined }
+  | { frontmatter?: undefined; error: string } {
+  const block = extractSkillFrontmatterBlock(content);
+  if (block == null) {
+    return {};
+  }
+  try {
+    const parsed = yaml.load(block);
+    if (parsed == null) {
+      return { frontmatter: {} };
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return { error: `${SKILL_MD} frontmatter must be a YAML mapping.` };
+    }
+    return { frontmatter: parsed as Record<string, unknown> };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { error: `Invalid ${SKILL_MD} frontmatter: ${message}` };
+  }
+}
+
+function parseSkillMdUpdate(content: string): {
+  description: string;
+  frontmatter?: Record<string, unknown>;
+  alwaysApply?: boolean;
+} {
+  const parsed = parseFrontmatter(content);
+  const structured = parseStructuredSkillFrontmatter(content);
+  const structuredDescription =
+    typeof structured.frontmatter?.description === 'string'
+      ? structured.frontmatter.description
+      : undefined;
+  return {
+    description: structuredDescription ?? parsed.description,
+    ...(structured.frontmatter !== undefined ? { frontmatter: structured.frontmatter } : {}),
+    ...(parsed.alwaysApply !== undefined ? { alwaysApply: parsed.alwaysApply } : {}),
+  };
+}
+
+function getAuthorInfo(req: ServerRequest): {
+  author: Types.ObjectId;
+  authorName: string;
+  tenantId?: string;
+} | null {
+  const user = req.user as
+    | {
+        id?: string;
+        _id?: Types.ObjectId | string;
+        name?: string;
+        username?: string;
+        tenantId?: string;
+      }
+    | undefined;
+  if (!user?.id) {
+    return null;
+  }
+  return {
+    author: (user._id ?? user.id) as Types.ObjectId,
+    authorName: user.name ?? user.username ?? 'Unknown',
+    ...(user.tenantId ? { tenantId: user.tenantId } : {}),
+  };
+}
+
+function normalizeEditArgs(args: {
+  old_text?: unknown;
+  new_text?: unknown;
+  edits?: unknown;
+}): TextEdit[] | string {
+  if (Array.isArray(args.edits) && args.edits.length > 0) {
+    const edits: TextEdit[] = [];
+    for (const edit of args.edits) {
+      if (!edit || typeof edit !== 'object') {
+        return 'Each edit must be an object with old_text and new_text.';
+      }
+      const entry = edit as { old_text?: unknown; new_text?: unknown };
+      if (typeof entry.old_text !== 'string' || typeof entry.new_text !== 'string') {
+        return 'Each edit requires string old_text and new_text.';
+      }
+      if (entry.old_text.length === 0) {
+        return 'old_text cannot be empty.';
+      }
+      edits.push({ old_text: entry.old_text, new_text: entry.new_text });
+    }
+    return edits;
+  }
+
+  if (typeof args.old_text !== 'string' || typeof args.new_text !== 'string') {
+    return 'Provide old_text and new_text, or a non-empty edits array.';
+  }
+  if (args.old_text.length === 0) {
+    return 'old_text cannot be empty.';
+  }
+  return [{ old_text: args.old_text, new_text: args.new_text }];
+}
+
+function countExactOccurrences(content: string, needle: string): number[] {
+  const indexes: number[] = [];
+  let start = 0;
+  while (start <= content.length) {
+    const index = content.indexOf(needle, start);
+    if (index === -1) {
+      break;
+    }
+    indexes.push(index);
+    start = index + Math.max(1, needle.length);
+  }
+  return indexes;
+}
+
+function findExactMatch(content: string, needle: string): MatchStatus {
+  const matches = countExactOccurrences(content, needle);
+  if (matches.length === 1) {
+    return { status: 'matched', index: matches[0], length: needle.length, strategy: 'exact' };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy: 'exact', count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function lineStarts(content: string): number[] {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === '\n') {
+      starts.push(i + 1);
+    }
+  }
+  return starts;
+}
+
+function commonIndent(lines: string[]): number {
+  const indents = lines
+    .filter((line) => line.trim().length > 0)
+    .map((line) => {
+      const match = /^(\s*)/.exec(line);
+      return match ? match[1].length : 0;
+    });
+  return indents.length > 0 ? Math.min(...indents) : 0;
+}
+
+function stripCommonIndent(text: string): string {
+  const lines = text.split('\n');
+  const indent = commonIndent(lines);
+  if (indent === 0) {
+    return text;
+  }
+  return lines.map((line) => line.slice(Math.min(indent, line.length))).join('\n');
+}
+
+function findLineWindowMatch(
+  content: string,
+  needle: string,
+  strategy: 'line-trimmed' | 'indentation-flexible',
+): MatchStatus {
+  const contentLines = content.split('\n');
+  const needleLines = needle.split('\n');
+  if (needleLines.length > contentLines.length) {
+    return { status: 'none' };
+  }
+
+  const starts = lineStarts(content);
+  const normalizedNeedle =
+    strategy === 'line-trimmed'
+      ? needleLines.map((line) => line.trimEnd()).join('\n')
+      : stripCommonIndent(needle);
+  const matches: Array<{ index: number; length: number }> = [];
+
+  for (let i = 0; i <= contentLines.length - needleLines.length; i++) {
+    const windowLines = contentLines.slice(i, i + needleLines.length);
+    const candidate =
+      strategy === 'line-trimmed'
+        ? windowLines.map((line) => line.trimEnd()).join('\n')
+        : stripCommonIndent(windowLines.join('\n'));
+    if (candidate !== normalizedNeedle) {
+      continue;
+    }
+    const index = starts[i];
+    const endLine = i + needleLines.length;
+    const end = endLine < starts.length ? starts[endLine] - 1 : content.length;
+    matches.push({ index, length: end - index });
+  }
+
+  if (matches.length === 1) {
+    return { status: 'matched', ...matches[0], strategy };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy, count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function findWhitespaceNormalizedMatch(content: string, needle: string): MatchStatus {
+  const tokens = needle.trim().split(/\s+/).filter(Boolean);
+  if (tokens.length < 2) {
+    return { status: 'none' };
+  }
+  const pattern = tokens.map(escapeRegExp).join('\\s+');
+  const regex = new RegExp(pattern, 'g');
+  const matches: Array<{ index: number; length: number }> = [];
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(content)) != null) {
+    matches.push({ index: match.index, length: match[0].length });
+    if (match[0].length === 0) {
+      regex.lastIndex += 1;
+    }
+  }
+  if (matches.length === 1) {
+    return { status: 'matched', ...matches[0], strategy: 'whitespace-normalized' };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy: 'whitespace-normalized', count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function findReplacementMatch(content: string, needle: string): MatchStatus {
+  const exact = findExactMatch(content, needle);
+  if (exact.status !== 'none') {
+    return exact;
+  }
+  const lineTrimmed = findLineWindowMatch(content, needle, 'line-trimmed');
+  if (lineTrimmed.status !== 'none') {
+    return lineTrimmed;
+  }
+  const whitespaceNormalized = findWhitespaceNormalizedMatch(content, needle);
+  if (whitespaceNormalized.status !== 'none') {
+    return whitespaceNormalized;
+  }
+  return findLineWindowMatch(content, needle, 'indentation-flexible');
+}
+
+function applyTextEdits(
+  content: string,
+  edits: TextEdit[],
+): { content: string; strategies: string[] } {
+  let working = content;
+  const strategies: string[] = [];
+
+  for (const edit of edits) {
+    const match = findReplacementMatch(working, edit.old_text);
+    if (match.status === 'none') {
+      throw new Error('old_text did not match the file content.');
+    }
+    if (match.status === 'ambiguous') {
+      throw new Error(
+        `old_text matched ${match.count} locations with ${match.strategy}; make it unique before retrying.`,
+      );
+    }
+    working =
+      working.slice(0, match.index) + edit.new_text + working.slice(match.index + match.length);
+    strategies.push(match.strategy);
+  }
+
+  return { content: working, strategies };
+}
+
+function formatRange(start: number, count: number): string {
+  return count === 1 ? String(start) : `${start},${count}`;
+}
+
+function createUnifiedDiff(filePath: string, oldContent: string, newContent: string): string {
+  if (oldContent === newContent) {
+    return '';
+  }
+
+  const oldLines = oldContent.split('\n');
+  const newLines = newContent.split('\n');
+  let prefix = 0;
+  while (
+    prefix < oldLines.length &&
+    prefix < newLines.length &&
+    oldLines[prefix] === newLines[prefix]
+  ) {
+    prefix += 1;
+  }
+
+  let oldSuffix = oldLines.length - 1;
+  let newSuffix = newLines.length - 1;
+  while (
+    oldSuffix >= prefix &&
+    newSuffix >= prefix &&
+    oldLines[oldSuffix] === newLines[newSuffix]
+  ) {
+    oldSuffix -= 1;
+    newSuffix -= 1;
+  }
+
+  const contextStart = Math.max(0, prefix - 3);
+  const oldContextEnd = Math.min(oldLines.length - 1, oldSuffix + 3);
+  const newContextEnd = Math.min(newLines.length - 1, newSuffix + 3);
+  const oldCount = oldContextEnd >= contextStart ? oldContextEnd - contextStart + 1 : 0;
+  const newCount = newContextEnd >= contextStart ? newContextEnd - contextStart + 1 : 0;
+  const lines = [
+    `--- a/${filePath}`,
+    `+++ b/${filePath}`,
+    `@@ -${formatRange(contextStart + 1, oldCount)} +${formatRange(contextStart + 1, newCount)} @@`,
+  ];
+
+  for (let i = contextStart; i < prefix; i++) {
+    lines.push(` ${oldLines[i]}`);
+  }
+  for (let i = prefix; i <= oldSuffix; i++) {
+    lines.push(`-${oldLines[i]}`);
+  }
+  for (let i = prefix; i <= newSuffix; i++) {
+    lines.push(`+${newLines[i]}`);
+  }
+  for (let i = oldSuffix + 1; i <= oldContextEnd; i++) {
+    lines.push(` ${oldLines[i]}`);
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * Extensions whose contents `read_file` must never serialize as text. `cat`
+ * on a PNG inside the sandbox returns the raw bytes as stdout, JSON-encoded
+ * by codeapi with lossy UTF-8 replacement and then line-numbered by us —
+ * the result is a multi-KB blob of mojibake that pollutes the LLM context
+ * and exposes the raw bytes anyway. Short-circuit before the network call.
+ *
+ * Image categories surface a "use the existing attachment" message because
+ * the file was already attached to the conversation as part of the
+ * code-execution artifact pipeline — re-attaching here would dup it.
  */
-function looksBinary(content: string): boolean {
-  const limit = Math.min(content.length, 8192);
-  for (let i = 0; i < limit; i++) {
-    if (content.charCodeAt(i) === 0) return true;
+const BINARY_EXTENSIONS_NEVER_READABLE = new Set([
+  // Raster images (already attached as artifacts by the code-execution
+  // pipeline). `.svg` is intentionally NOT in this list — it's an XML
+  // text format with no mojibake risk, and there are legitimate reasons
+  // for the model to inspect or edit a generated SVG. The post-fetch
+  // NUL-byte sniff still catches anything that turns out to be binary
+  // despite a `.svg` extension.
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.bmp',
+  '.tiff',
+  '.tif',
+  '.ico',
+  '.heic',
+  '.heif',
+  '.avif',
+  // Documents (binary container formats)
+  '.pdf',
+  '.doc',
+  '.docx',
+  '.xls',
+  '.xlsx',
+  '.ppt',
+  '.pptx',
+  '.odt',
+  '.ods',
+  '.odp',
+  // Archives
+  '.zip',
+  '.tar',
+  '.gz',
+  '.tgz',
+  '.bz2',
+  '.xz',
+  '.7z',
+  '.rar',
+  '.lz4',
+  '.zst',
+  // Audio / video
+  '.mp3',
+  '.wav',
+  '.flac',
+  '.ogg',
+  '.m4a',
+  '.aac',
+  '.wma',
+  '.mp4',
+  '.mkv',
+  '.mov',
+  '.avi',
+  '.webm',
+  '.flv',
+  '.m4v',
+  // Executables / object files / native libs
+  '.exe',
+  '.dll',
+  '.so',
+  '.dylib',
+  '.o',
+  '.obj',
+  '.a',
+  '.lib',
+  '.bin',
+  '.class',
+  '.jar',
+  // Other byte-soup formats
+  '.parquet',
+  '.bson',
+  '.db',
+  '.sqlite',
+  '.sqlite3',
+  '.pyc',
+  '.pyo',
+  '.wasm',
+  '.ttf',
+  '.otf',
+  '.woff',
+  '.woff2',
+  '.eot',
+]);
+
+const IMAGE_EXTENSIONS_FOR_HINT = new Set([
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.bmp',
+  '.tiff',
+  '.tif',
+  '.ico',
+  '.heic',
+  '.heif',
+  '.avif',
+]);
+
+function lowercaseExtension(filePath: string): string {
+  const dot = filePath.lastIndexOf('.');
+  const slash = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'));
+  if (dot < 0 || dot < slash) return '';
+  return filePath.slice(dot).toLowerCase();
+}
+
+/**
+ * Builds the model-visible error returned when `read_file` is invoked on
+ * a binary path. Phrasing is tuned for the LLM: states the fact (file is
+ * binary, can't be read as text), points at the correct affordance for
+ * each common case (image already in the chat; bash for everything else),
+ * and includes the path verbatim so the model can copy-paste into its
+ * next call.
+ */
+function buildBinaryFileError(filePath: string, ext: string): string {
+  if (IMAGE_EXTENSIONS_FOR_HINT.has(ext)) {
+    return `"${filePath}" is an image file (${ext}) and cannot be read as text. The image is already attached to the conversation and visible to the user. To process it programmatically, use \`bash_tool\` (e.g. \`file ${filePath}\` for metadata, or \`python3 -c '...'\` to operate on the bytes).`;
+  }
+  return `"${filePath}" is a binary file (${ext}) and cannot be read as text by \`read_file\`. Use \`bash_tool\` to process it (e.g. \`file ${filePath}\` for metadata, or a runtime-appropriate command for the format).`;
+}
+
+/**
+ * True when the first chunk of a string contains a NUL byte. Used as a
+ * post-fetch safety net for files whose extension didn't match the
+ * blocklist (no extension, novel format, etc.) — sniffs `cat` stdout to
+ * avoid ever forwarding mangled bytes to the LLM. 8KB is the same
+ * window the skill-file path uses; enough for any reasonable magic
+ * number while bounded enough to stay cheap.
+ */
+function looksBinary(content: string): boolean {
+  const limit = Math.min(content.length, 8192);
+  for (let i = 0; i < limit; i++) {
+    if (content.charCodeAt(i) === 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Routes a `read_file` call to the code-execution sandbox via the
+ * host-provided `readSandboxFile` callback. The sandbox session id and
+ * primed file refs come from `tc.codeSessionContext` (emitted by ToolNode
+ * for `read_file` tool calls in agents v3.1.72+) so the read lands in the
+ * same session that holds the agent's prior-turn artifacts. Returns a
+ * `ToolExecuteResult` with the file content (line-numbered) on success,
+ * or an instructive error pointing the model at `bash_tool` when the
+ * sandbox isn't reachable from this configuration.
+ *
+ * Two binary guards keep `cat`-on-a-PNG-style mojibake out of the LLM
+ * context: (1) an extension precheck that short-circuits known binary
+ * types BEFORE any network call, and (2) a NUL-byte content sniff after
+ * the read for unknown extensions. The codeapi `/exec` transport is JSON,
+ * which already lossily down-converts non-UTF-8 stdout to replacement
+ * characters — the bytes are unrecoverable here, so the goal is to fail
+ * fast with an instructive message rather than ship garbage.
+ */
+async function handleSandboxFileFallback(
+  tc: ToolCallRequest,
+  filePath: string,
+  options: ToolExecuteOptions,
+  req?: ServerRequest,
+): Promise<ToolExecuteResult> {
+  const ext = lowercaseExtension(filePath);
+  if (BINARY_EXTENSIONS_NEVER_READABLE.has(ext)) {
+    return {
+      toolCallId: tc.id,
+      status: 'error',
+      content: '',
+      errorMessage: buildBinaryFileError(filePath, ext),
+    };
+  }
+
+  const { readSandboxFile } = options;
+  if (!readSandboxFile) {
+    return {
+      toolCallId: tc.id,
+      status: 'error',
+      content: '',
+      errorMessage: `Path "${filePath}" is not a skill file. Use \`bash_tool\` to read code-execution sandbox files (e.g. \`cat ${filePath}\`).`,
+    };
+  }
+
+  const ctx = tc.codeSessionContext as SandboxSessionContext | undefined;
+  try {
+    const result = await readSandboxFile({
+      file_path: filePath,
+      session_id: ctx?.session_id,
+      files: ctx?.files,
+      ...(req ? { req } : {}),
+    });
+    if (!result || result.content == null) {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Failed to read "${filePath}" from the code-execution sandbox. Try \`bash_tool\` (e.g. \`cat ${filePath}\`).`,
+      };
+    }
+    if (looksBinary(result.content)) {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `"${filePath}" appears to be a binary file and cannot be read as text. Use \`bash_tool\` to process it (e.g. \`file ${filePath}\` for metadata).`,
+      };
+    }
+    /**
+     * Cap before line-numbering. `addLineNumbers` allocates a SECOND
+     * full-size string with per-line prefixes, so a multi-MB log read
+     * would materialize ~2x in memory before downstream truncation
+     * kicks in. Match the skill-file path's `MAX_READABLE_BYTES`
+     * (256KB) ceiling: truncate the raw content first, then number,
+     * and surface the truncation to the model so it can use
+     * `bash_tool head` / `tail` for the rest.
+     */
+    let payload = result.content;
+    let truncated = false;
+    if (payload.length > MAX_READABLE_BYTES) {
+      payload = payload.slice(0, MAX_READABLE_BYTES);
+      truncated = true;
+    }
+    let numbered = addLineNumbers(payload);
+    if (truncated) {
+      numbered += `\n\n[truncated at ${MAX_READABLE_BYTES} bytes — use \`bash_tool\` (e.g. \`head -c\` / \`tail\`) to read the rest of "${filePath}"]`;
+    }
+    return {
+      toolCallId: tc.id,
+      status: 'success',
+      content: numbered,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    logger.warn(`[handleReadFileCall] Sandbox fallback failed for "${filePath}": ${message}`);
+    return {
+      toolCallId: tc.id,
+      status: 'error',
+      content: '',
+      errorMessage: `Error reading "${filePath}" from the code-execution sandbox: ${message}. Try \`bash_tool\` (e.g. \`cat ${filePath}\`).`,
+    };
+  }
+}
+
+function sandboxSessionContext(
+  tc: ToolCallRequest,
+  override?: SandboxSessionContext,
+): SandboxSessionContext | undefined {
+  return override ?? (tc.codeSessionContext as SandboxSessionContext | undefined);
+}
+
+function cloneSandboxSessionContext(
+  context: SandboxSessionContext | undefined,
+): SandboxSessionContext {
+  return {
+    ...(context?.session_id ? { session_id: context.session_id } : {}),
+    ...(context?.files ? { files: context.files.map((file) => ({ ...file })) } : {}),
+  };
+}
+
+function mergeSandboxSessionArtifact(
+  context: SandboxSessionContext,
+  artifact: ToolExecuteResult['artifact'],
+): void {
+  if (!artifact || typeof artifact !== 'object') {
+    return;
+  }
+  const value = artifact as {
+    session_id?: unknown;
+    files?: unknown;
+  };
+  if (typeof value.session_id === 'string' && value.session_id.length > 0) {
+    context.session_id = value.session_id;
+  }
+  if (!Array.isArray(value.files)) {
+    return;
+  }
+
+  const files: SandboxSessionContext['files'] = [];
+  for (const file of value.files) {
+    if (!file || typeof file !== 'object') {
+      continue;
+    }
+    const ref = file as {
+      id?: unknown;
+      name?: unknown;
+      session_id?: unknown;
+      storage_session_id?: unknown;
+    };
+    if (typeof ref.id !== 'string' || typeof ref.name !== 'string') {
+      continue;
+    }
+    files.push({
+      id: ref.id,
+      name: ref.name,
+      ...(typeof ref.session_id === 'string' ? { session_id: ref.session_id } : {}),
+      ...(typeof ref.storage_session_id === 'string'
+        ? { storage_session_id: ref.storage_session_id }
+        : {}),
+    });
+  }
+  if (files.length > 0) {
+    context.files = files;
+  }
+}
+
+function isSandboxMissingFileError(error: unknown): boolean {
+  const message = getThrownValueMessage(error).toLowerCase();
+  return (
+    message.includes('no such file or directory') ||
+    message.includes('cannot access') ||
+    message.includes('not found')
+  );
+}
+
+function invalidSandboxAuthoringPath(filePath: string): string | null {
+  if (filePath.length === 0) {
+    return 'path is required';
+  }
+  if (filePath.includes('\0')) {
+    return 'path cannot contain NUL bytes';
+  }
+  if (filePath.endsWith('/')) {
+    return `File path "${filePath}" points to a directory. Provide a file path.`;
+  }
+  return null;
+}
+
+async function loadSandboxTextForAuthoring({
+  filePath,
+  tc,
+  options,
+  req,
+  sandboxContext,
+}: {
+  filePath: string;
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  sandboxContext?: SandboxSessionContext;
+}): Promise<LoadedSandboxText> {
+  const ext = lowercaseExtension(filePath);
+  if (BINARY_EXTENSIONS_NEVER_READABLE.has(ext)) {
+    return { status: 'error', message: buildBinaryFileError(filePath, ext) };
+  }
+  if (!options.readSandboxFile) {
+    return {
+      status: 'error',
+      message: `Sandbox file reading is not configured. Use \`bash_tool\` to inspect "${filePath}".`,
+    };
+  }
+
+  const ctx = sandboxSessionContext(tc, sandboxContext);
+  try {
+    const result = await options.readSandboxFile({
+      file_path: filePath,
+      session_id: ctx?.session_id,
+      files: ctx?.files,
+      ...(req ? { req } : {}),
+    });
+    if (!result || result.content == null) {
+      return {
+        status: 'error',
+        message: `Failed to read "${filePath}" from the code-execution sandbox.`,
+      };
+    }
+    if (looksBinary(result.content)) {
+      return {
+        status: 'error',
+        message: `"${filePath}" appears to be binary and cannot be edited as text.`,
+      };
+    }
+    if (Buffer.byteLength(result.content, 'utf8') > MAX_AUTHORING_BYTES) {
+      return {
+        status: 'error',
+        message: `File "${filePath}" is too large to edit directly (${Buffer.byteLength(
+          result.content,
+          'utf8',
+        )} bytes, limit: ${MAX_AUTHORING_BYTES}).`,
+      };
+    }
+    return {
+      status: 'loaded',
+      content: result.content,
+      bytes: Buffer.byteLength(result.content, 'utf8'),
+    };
+  } catch (error) {
+    if (isSandboxMissingFileError(error)) {
+      return { status: 'missing' };
+    }
+    const message = getThrownValueMessage(error);
+    logger.warn(`[file_authoring] Sandbox read failed for "${filePath}": ${message}`);
+    return {
+      status: 'error',
+      message: `Error reading "${filePath}" from the code-execution sandbox: ${message}.`,
+    };
+  }
+}
+
+async function writeSandboxTextForAuthoring({
+  tc,
+  options,
+  req,
+  filePath,
+  content,
+  oldContent,
+  created,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  content: string;
+  oldContent?: string;
+  created: boolean;
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  if (!options.writeSandboxFile) {
+    return errorResult(
+      tc,
+      `Sandbox file writing is not configured. Use \`bash_tool\` to write "${filePath}".`,
+    );
+  }
+  const ctx = sandboxSessionContext(tc, sandboxContext);
+  let writeResult: Awaited<ReturnType<NonNullable<ToolExecuteOptions['writeSandboxFile']>>>;
+  try {
+    writeResult = await options.writeSandboxFile({
+      file_path: filePath,
+      content,
+      session_id: ctx?.session_id,
+      files: ctx?.files,
+      ...(req ? { req } : {}),
+    });
+  } catch (error) {
+    const message = getThrownValueMessage(error);
+    logger.warn(`[file_authoring] Sandbox write failed for "${filePath}": ${message}`);
+    return errorResult(
+      tc,
+      `Error writing "${filePath}" to the code-execution sandbox: ${message}.`,
+    );
+  }
+  if (!writeResult) {
+    return errorResult(tc, `Failed to write "${filePath}" to the code-execution sandbox.`);
+  }
+
+  const diff =
+    oldContent !== undefined ? createUnifiedDiff(filePath, oldContent, content) : undefined;
+  const action = created ? 'Created' : 'Updated';
+  const summary = `${action} ${filePath} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: filePath,
+    [HOST_FILE_AUTHORING_ARTIFACT_KEY]: true,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created,
+    ...(diff ? { diff } : {}),
+    ...(writeResult.session_id ? { session_id: writeResult.session_id } : {}),
+    ...(writeResult.files ? { files: writeResult.files } : {}),
+  });
+}
+
+async function resolveSkillForAuthoring(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+): Promise<AuthoringSkill | null> {
+  const { getSkillByName } = options;
+  if (!getSkillByName) {
+    return null;
+  }
+
+  const skillPrimedIdsByName =
+    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  const primedIdString = skillPrimedIdsByName[skillName];
+  if (primedIdString) {
+    return await getSkillByName(skillName, [new Types.ObjectId(primedIdString)], {});
+  }
+
+  const accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
+  if (accessibleIds.length === 0) {
+    return null;
+  }
+
+  return await getSkillByName(skillName, accessibleIds, { preferModelInvocable: true });
+}
+
+async function resolveAuthorSkillForCurrentUser({
+  skillName,
+  mergedConfigurable,
+  sourceConfigurable,
+  options,
+  req,
+}: {
+  skillName: string;
+  mergedConfigurable: Record<string, unknown>;
+  sourceConfigurable?: Record<string, unknown>;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<AuthoringSkill | null> {
+  if (!req || !options.getAuthorSkillByName) {
+    return null;
+  }
+  if (!isSkillKnownToCurrentRun(skillName, mergedConfigurable)) {
+    return null;
+  }
+  const skill = await options.getAuthorSkillByName({ req, name: skillName });
+  if (!skill) {
+    return null;
+  }
+  rememberAuthoredSkill([mergedConfigurable, sourceConfigurable], skill, { prime: false });
+  return skill;
+}
+
+function isDuplicateSkillNameError(error: unknown): boolean {
+  const maybeError = error as { code?: string | number; message?: string } | undefined;
+  return (
+    maybeError?.code === 11000 ||
+    /skill with name .* already exists/i.test(maybeError?.message ?? '')
+  );
+}
+
+function isSkillAuthoringAvailable(mergedConfigurable: Record<string, unknown>): boolean {
+  return mergedConfigurable.skillAuthoringAvailable === true;
+}
+
+function getFileAuthoringToolNames(
+  mergedConfigurable: Record<string, unknown>,
+): Set<string> | undefined {
+  const names = mergedConfigurable.fileAuthoringToolNames;
+  return names instanceof Set ? (names as Set<string>) : undefined;
+}
+
+function isHostFileAuthoringToolCall(
+  toolName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  return getFileAuthoringToolNames(mergedConfigurable)?.has(toolName) === true;
+}
+
+function isCodeSessionAwareToolCall(
+  toolName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  return isCodeSessionToolName(toolName, getFileAuthoringToolNames(mergedConfigurable));
+}
+
+function isSkillPrimedForAuthoring(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  const skillPrimedIdsByName =
+    (mergedConfigurable.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  return typeof skillPrimedIdsByName[skillName] === 'string';
+}
+
+function isSkillKnownToCurrentRun(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  if (isSkillPrimedForAuthoring(skillName, mergedConfigurable)) {
+    return true;
+  }
+  const activeSkillNames = mergedConfigurable.activeSkillNames;
+  return activeSkillNames instanceof Set && activeSkillNames.has(skillName);
+}
+
+function hiddenSkillAuthoringDenied(
+  tc: ToolCallRequest,
+  skill: AuthoringSkill | null,
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): ToolExecuteResult | null {
+  if (
+    skill?.disableModelInvocation !== true ||
+    isSkillPrimedForAuthoring(skillName, mergedConfigurable)
+  ) {
+    return null;
+  }
+  return errorResult(tc, `Skill "${skillName}" cannot be authored by the model`);
+}
+
+function mergeAccessibleSkillIds(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Types.ObjectId[] | undefined {
+  const values = [
+    ...(Array.isArray(loaded?.accessibleSkillIds)
+      ? (loaded.accessibleSkillIds as Types.ObjectId[])
+      : []),
+    ...(Array.isArray(base?.accessibleSkillIds)
+      ? (base.accessibleSkillIds as Types.ObjectId[])
+      : []),
+  ];
+  if (values.length === 0) {
+    return undefined;
+  }
+  const seen = new Set<string>();
+  const merged: Types.ObjectId[] = [];
+  for (const value of values) {
+    const key = value.toString();
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    merged.push(value);
+  }
+  return merged;
+}
+
+function mergeSkillPrimedIdsByName(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Record<string, string> | undefined {
+  const loadedPrimed = loaded?.skillPrimedIdsByName as Record<string, string> | undefined;
+  const basePrimed = base?.skillPrimedIdsByName as Record<string, string> | undefined;
+  const merged = { ...(loadedPrimed ?? {}), ...(basePrimed ?? {}) };
+  return Object.keys(merged).length > 0 ? merged : undefined;
+}
+
+function mergeActiveSkillNames(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Set<string> | undefined {
+  const names = new Set<string>();
+  const loadedNames = loaded?.activeSkillNames;
+  if (loadedNames instanceof Set) {
+    for (const name of loadedNames) {
+      names.add(name);
+    }
+  }
+  const baseNames = base?.activeSkillNames;
+  if (baseNames instanceof Set) {
+    for (const name of baseNames) {
+      names.add(name);
+    }
+  }
+  return names.size > 0 ? names : undefined;
+}
+
+function mergeToolConfigurables(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const merged = { ...base, ...loaded };
+  const accessibleSkillIds = mergeAccessibleSkillIds(base, loaded);
+  if (accessibleSkillIds) {
+    merged.accessibleSkillIds = accessibleSkillIds;
+  }
+  const skillPrimedIdsByName = mergeSkillPrimedIdsByName(base, loaded);
+  if (skillPrimedIdsByName) {
+    merged.skillPrimedIdsByName = skillPrimedIdsByName;
+  }
+  const activeSkillNames = mergeActiveSkillNames(base, loaded);
+  if (activeSkillNames) {
+    merged.activeSkillNames = activeSkillNames;
+  }
+  return merged;
+}
+
+function rememberAuthoredSkill(
+  configurables: Array<Record<string, unknown> | undefined>,
+  skill: { _id: Types.ObjectId; name: string },
+  options: { prime?: boolean } = {},
+): void {
+  const prime = options.prime !== false;
+  const idString = skill._id.toString();
+  for (const configurable of configurables) {
+    if (!configurable) {
+      continue;
+    }
+
+    const accessibleIds = Array.isArray(configurable.accessibleSkillIds)
+      ? (configurable.accessibleSkillIds as Types.ObjectId[])
+      : [];
+    if (!Array.isArray(configurable.accessibleSkillIds)) {
+      configurable.accessibleSkillIds = accessibleIds;
+    }
+    if (!accessibleIds.some((id) => id.toString() === idString)) {
+      accessibleIds.push(skill._id);
+    }
+
+    if (prime) {
+      const primedIds =
+        (configurable.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+      primedIds[skill.name] = idString;
+      configurable.skillPrimedIdsByName = primedIds;
+    }
+
+    const activeSkillNames = configurable.activeSkillNames as Set<string> | undefined;
+    if (activeSkillNames) {
+      activeSkillNames.add(skill.name);
+    } else {
+      configurable.activeSkillNames = new Set([skill.name]);
+    }
+  }
+}
+
+async function ensureCanEditSkill(
+  tc: ToolCallRequest,
+  options: ToolExecuteOptions,
+  req: ServerRequest | undefined,
+  skillId: Types.ObjectId | string,
+): Promise<ToolExecuteResult | null> {
+  if (!req) {
+    return errorResult(tc, 'Skill file editing is not configured for this request.');
+  }
+  if (!options.canEditSkill) {
+    return errorResult(tc, 'Skill file editing is not configured.');
+  }
+  const allowed = await options.canEditSkill({ req, skillId });
+  return allowed ? null : errorResult(tc, 'Insufficient permissions to edit this skill.');
+}
+
+async function ensureCanCreateSkill(
+  tc: ToolCallRequest,
+  options: ToolExecuteOptions,
+  req: ServerRequest | undefined,
+): Promise<ToolExecuteResult | null> {
+  if (!req) {
+    return errorResult(tc, 'Skill creation is not configured for this request.');
+  }
+  if (!options.canCreateSkill) {
+    return errorResult(tc, 'Skill creation is not configured.');
+  }
+  const allowed = await options.canCreateSkill({ req });
+  return allowed ? null : errorResult(tc, 'Insufficient permissions to create skills.');
+}
+
+async function loadSkillFileTextForAuthoring({
+  skill,
+  relativePath,
+  options,
+  req,
+}: {
+  skill: AuthoringSkill;
+  relativePath: string;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<LoadedSkillText> {
+  if (relativePath === SKILL_MD) {
+    return {
+      status: 'loaded',
+      content: skill.body ?? '',
+      bytes: Buffer.byteLength(skill.body ?? '', 'utf8'),
+    };
+  }
+
+  const { getSkillFileByPath, getStrategyFunctions, updateSkillFileContent } = options;
+  if (!getSkillFileByPath) {
+    return { status: 'error', message: 'Skill file reading is not configured.' };
+  }
+
+  const file = await getSkillFileByPath(skill._id, relativePath);
+  if (!file) {
+    return { status: 'missing' };
+  }
+  if (file.isBinary === true) {
+    return { status: 'error', message: `File "${relativePath}" is binary and cannot be edited.` };
+  }
+  if (file.content != null && file.content !== '') {
+    return {
+      status: 'loaded',
+      content: file.content,
+      bytes: Buffer.byteLength(file.content, 'utf8'),
+    };
+  }
+  if (file.bytes > MAX_CACHE_BYTES) {
+    return {
+      status: 'error',
+      message: `File "${relativePath}" is too large to edit directly (${file.bytes} bytes, limit: ${MAX_CACHE_BYTES}).`,
+    };
+  }
+  if (!getStrategyFunctions || !req) {
+    return { status: 'error', message: 'Storage access is not configured.' };
+  }
+
+  const strategy = getStrategyFunctions(file.source);
+  if (!strategy.getDownloadStream) {
+    return { status: 'error', message: 'Download is not supported for this storage backend.' };
+  }
+
+  const stream = await strategy.getDownloadStream(req, file.filepath);
+  const chunks: Uint8Array[] = [];
+  let streamedBytes = 0;
+  for await (const chunk of stream as AsyncIterable<Uint8Array>) {
+    streamedBytes += chunk.byteLength;
+    if (streamedBytes > MAX_CACHE_BYTES) {
+      if (
+        'destroy' in stream &&
+        typeof (stream as NodeJS.ReadableStream & { destroy?: () => void }).destroy === 'function'
+      ) {
+        (stream as NodeJS.ReadableStream & { destroy: () => void }).destroy();
+      }
+      return {
+        status: 'error',
+        message: `File "${relativePath}" exceeded edit limit (${MAX_CACHE_BYTES} bytes).`,
+      };
+    }
+    chunks.push(chunk);
+  }
+
+  const buffer = Buffer.concat(chunks);
+  const checkLen = Math.min(buffer.length, 8192);
+  for (let i = 0; i < checkLen; i++) {
+    if (buffer[i] === 0) {
+      if (updateSkillFileContent) {
+        updateSkillFileContent(skill._id, relativePath, { isBinary: true }).catch(
+          (err: unknown) => {
+            logAxiosError({
+              message: '[loadSkillFileTextForAuthoring] cache write failed',
+              error: err,
+            });
+          },
+        );
+      }
+      return { status: 'error', message: `File "${relativePath}" is binary and cannot be edited.` };
+    }
+  }
+
+  const text = buffer.toString('utf-8');
+  if (updateSkillFileContent) {
+    updateSkillFileContent(skill._id, relativePath, { content: text, isBinary: false }).catch(
+      (err: unknown) => {
+        logAxiosError({
+          message: '[loadSkillFileTextForAuthoring] cache write failed',
+          error: err,
+        });
+      },
+    );
+  }
+  return { status: 'loaded', content: text, bytes: buffer.length };
+}
+
+async function inspectBundledSkillFileForCreate({
+  skill,
+  relativePath,
+  options,
+  req,
+}: {
+  skill: AuthoringSkill;
+  relativePath: string;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<ExistingSkillFile> {
+  const { getSkillFileByPath } = options;
+  if (!getSkillFileByPath) {
+    return { status: 'error', message: 'Skill file reading is not configured.' };
+  }
+
+  const file = await getSkillFileByPath(skill._id, relativePath);
+  if (!file) {
+    return { status: 'missing' };
+  }
+  if (file.isBinary === true || file.bytes > MAX_CACHE_BYTES) {
+    return { status: 'present' };
+  }
+  if (file.content != null && file.content !== '') {
+    return { status: 'present', oldContent: file.content };
+  }
+  if (!options.getStrategyFunctions || !req) {
+    return { status: 'present' };
+  }
+
+  const loaded = await loadSkillFileTextForAuthoring({
+    skill,
+    relativePath,
+    options,
+    req,
+  });
+  if (loaded.status === 'missing') {
+    return { status: 'missing' };
+  }
+  if (loaded.status === 'error') {
+    return { status: 'present' };
+  }
+  return { status: 'present', oldContent: loaded.content };
+}
+
+async function ensureBundledSkillVersionCurrent({
+  tc,
+  options,
+  skill,
+  displayPath,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  skill: AuthoringSkill;
+  displayPath: string;
+}): Promise<ToolExecuteResult | null> {
+  if (!options.getSkillByName) {
+    return null;
+  }
+
+  const current = await options.getSkillByName(skill.name, [skill._id], {});
+  if (!current) {
+    return errorResult(tc, `Skill "${skill.name}" not found or not accessible.`);
+  }
+  if (current.version !== skill.version) {
+    return errorResult(
+      tc,
+      `Skill "${skill.name}" changed while editing. Re-read ${displayPath} and retry.`,
+    );
+  }
+  return null;
+}
+
+async function writeSkillMd({
+  tc,
+  options,
+  req,
+  mergedConfigurable,
+  sourceConfigurable,
+  skill,
+  skillName,
+  content,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  mergedConfigurable: Record<string, unknown>;
+  sourceConfigurable?: Record<string, unknown>;
+  skill: AuthoringSkill | null;
+  skillName: string;
+  content: string;
+}): AuthoringResult {
+  const normalized = normalizeSkillMdContent(content, skillName);
+  if (normalized.status === 'error') {
+    return errorResult(tc, normalized.error);
+  }
+  content = normalized.content;
+  const structured = parseStructuredSkillFrontmatter(content);
+  if (structured.error) {
+    return errorResult(tc, structured.error);
+  }
+
+  if (!skill) {
+    const createDenied = await ensureCanCreateSkill(tc, options, req);
+    if (createDenied) {
+      return createDenied;
+    }
+    if (!req || !options.createSkill || !options.grantSkillOwner) {
+      return errorResult(tc, 'Skill creation is not configured.');
+    }
+    const author = getAuthorInfo(req);
+    if (!author) {
+      return errorResult(tc, 'Authentication required to create a skill.');
+    }
+    const parsed = parseSkillMdUpdate(content);
+    let result: Awaited<ReturnType<NonNullable<ToolExecuteOptions['createSkill']>>>;
+    try {
+      result = await options.createSkill({
+        name: skillName,
+        description: parsed.description,
+        body: content,
+        ...(parsed.frontmatter !== undefined ? { frontmatter: parsed.frontmatter } : {}),
+        author: author.author,
+        authorName: author.authorName,
+        ...(parsed.alwaysApply !== undefined ? { alwaysApply: parsed.alwaysApply } : {}),
+        ...(author.tenantId ? { tenantId: author.tenantId } : {}),
+      });
+    } catch (error) {
+      if (isDuplicateSkillNameError(error)) {
+        return errorResult(
+          tc,
+          `Skill "${skillName}" already exists for this author. It cannot be created again or overwritten blindly. Read or enable the existing skill, then use edit_file for targeted changes, or choose a new skill name.`,
+        );
+      }
+      throw error;
+    }
+    try {
+      await options.grantSkillOwner({ req, skillId: result.skill._id });
+    } catch (error) {
+      if (options.deleteSkill) {
+        await options.deleteSkill(result.skill._id.toString()).catch((rollbackError: unknown) => {
+          logger.error('[create_file] Failed to roll back skill after permission error', {
+            rollbackError,
+          });
+        });
+      }
+      throw error;
+    }
+    rememberAuthoredSkill([mergedConfigurable, sourceConfigurable], result.skill);
+    return successResult(
+      tc,
+      `Created ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} (${content.length} chars).`,
+      {
+        path: `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+        bytes_written: Buffer.byteLength(content, 'utf8'),
+        created: true,
+      },
+    );
+  }
+
+  const editDenied = await ensureCanEditSkill(tc, options, req, skill._id);
+  if (editDenied) {
+    return editDenied;
+  }
+  if (!options.updateSkill) {
+    return errorResult(tc, 'Skill updating is not configured.');
+  }
+  const parsedUpdate = parseSkillMdUpdate(content);
+  const result = await options.updateSkill({
+    id: skill._id.toString(),
+    expectedVersion: skill.version,
+    update: {
+      body: content,
+      description: parsedUpdate.description,
+      ...(parsedUpdate.frontmatter !== undefined ? { frontmatter: parsedUpdate.frontmatter } : {}),
+      ...(parsedUpdate.alwaysApply !== undefined ? { alwaysApply: parsedUpdate.alwaysApply } : {}),
+    },
+  });
+  if (result.status === 'conflict') {
+    return errorResult(
+      tc,
+      `Skill "${skillName}" changed while editing. Re-read ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} and retry.`,
+    );
+  }
+  if (result.status === 'not_found') {
+    return errorResult(tc, `Skill "${skillName}" not found or not accessible.`);
+  }
+
+  const diff = createUnifiedDiff(
+    `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+    skill.body,
+    content,
+  );
+  const summary = `Updated ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created: false,
+    ...(diff ? { diff } : {}),
+  });
+}
+
+async function writeBundledSkillFile({
+  tc,
+  options,
+  req,
+  skill,
+  relativePath,
+  displayPath,
+  content,
+  oldContent,
+  created,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  skill: AuthoringSkill;
+  relativePath: string;
+  displayPath: string;
+  content: string;
+  oldContent?: string;
+  created: boolean;
+}): AuthoringResult {
+  const editDenied = await ensureCanEditSkill(tc, options, req, skill._id);
+  if (editDenied) {
+    return editDenied;
+  }
+  if (!req || !options.saveSkillFileContent) {
+    return errorResult(tc, 'Skill file writing is not configured.');
+  }
+  const staleDenied = await ensureBundledSkillVersionCurrent({
+    tc,
+    options,
+    skill,
+    displayPath,
+  });
+  if (staleDenied) {
+    return staleDenied;
+  }
+
+  await options.saveSkillFileContent({
+    req,
+    skillId: skill._id,
+    relativePath,
+    content,
+    mimeType: guessMimeType(relativePath),
+  });
+  const diff =
+    oldContent !== undefined ? createUnifiedDiff(displayPath, oldContent, content) : undefined;
+  const action = created ? 'Created' : 'Updated';
+  const summary = `${action} ${displayPath} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: displayPath,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created,
+    ...(diff ? { diff } : {}),
+  });
+}
+
+async function handleSandboxCreateFileCall({
+  tc,
+  options,
+  req,
+  filePath,
+  content,
+  overwrite,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  content: string;
+  overwrite: boolean;
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  const pathError = invalidSandboxAuthoringPath(filePath);
+  if (pathError) {
+    return errorResult(tc, pathError);
+  }
+
+  const current = await loadSandboxTextForAuthoring({
+    filePath,
+    tc,
+    options,
+    req,
+    sandboxContext,
+  });
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+  if (current.status === 'loaded' && !overwrite) {
+    return errorResult(tc, 'File already exists. Pass overwrite: true to replace.');
+  }
+
+  return await writeSandboxTextForAuthoring({
+    tc,
+    options,
+    req,
+    filePath,
+    content,
+    oldContent: current.status === 'loaded' ? current.content : undefined,
+    created: current.status === 'missing',
+    sandboxContext,
+  });
+}
+
+async function handleSandboxEditFileCall({
+  tc,
+  options,
+  req,
+  filePath,
+  edits,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  edits: TextEdit[];
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  const pathError = invalidSandboxAuthoringPath(filePath);
+  if (pathError) {
+    return errorResult(tc, pathError);
+  }
+
+  const current = await loadSandboxTextForAuthoring({
+    filePath,
+    tc,
+    options,
+    req,
+    sandboxContext,
+  });
+  if (current.status === 'missing') {
+    return errorResult(tc, `File not found: "${filePath}"`);
+  }
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+
+  let edited: { content: string; strategies: string[] };
+  try {
+    edited = applyTextEdits(current.content, edits);
+  } catch (error) {
+    return errorResult(tc, error instanceof Error ? error.message : 'Failed to edit file');
+  }
+  if (Buffer.byteLength(edited.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `edited content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  const result = await writeSandboxTextForAuthoring({
+    tc,
+    options,
+    req,
+    filePath,
+    content: edited.content,
+    oldContent: current.content,
+    created: false,
+    sandboxContext,
+  });
+  if (result.status === 'success') {
+    result.artifact = {
+      ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+      edits: edits.length,
+      strategies: edited.strategies,
+    };
+    result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
+  }
+  return result;
+}
+
+async function handleCreateFileCall(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+  req?: ServerRequest,
+  sourceConfigurable?: Record<string, unknown>,
+  sandboxContext?: SandboxSessionContext,
+): AuthoringResult {
+  const args = tc.args as { path?: unknown; content?: unknown; overwrite?: unknown };
+  if (typeof args.path !== 'string' || args.path.length === 0) {
+    return errorResult(tc, 'path is required');
+  }
+  if (typeof args.content !== 'string') {
+    return errorResult(tc, 'content is required');
+  }
+  if (Buffer.byteLength(args.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  const overwrite = args.overwrite === true;
+  if (!args.path.startsWith(SKILL_FILE_PREFIX)) {
+    if (mergedConfigurable?.codeEnvAvailable !== true) {
+      return errorResult(
+        tc,
+        `Path "${args.path}" is not a skill file, and this agent does not have code execution enabled.`,
+      );
+    }
+    return await handleSandboxCreateFileCall({
+      tc,
+      options,
+      req,
+      filePath: args.path,
+      content: args.content,
+      overwrite,
+      sandboxContext,
+    });
+  }
+
+  const parsed = parseSkillAuthoringPath(args.path);
+  if (typeof parsed === 'string') {
+    return errorResult(tc, parsed);
+  }
+  if (!isSkillAuthoringAvailable(mergedConfigurable)) {
+    return errorResult(tc, 'Skill file authoring is not available for this agent.');
+  }
+
+  let skill = await resolveSkillForAuthoring(parsed.skillName, mergedConfigurable, options);
+  if (!skill) {
+    skill = await resolveAuthorSkillForCurrentUser({
+      skillName: parsed.skillName,
+      mergedConfigurable,
+      sourceConfigurable,
+      options,
+      req,
+    });
+  }
+  const hiddenDenied = hiddenSkillAuthoringDenied(tc, skill, parsed.skillName, mergedConfigurable);
+  if (hiddenDenied) {
+    return hiddenDenied;
+  }
+  if (parsed.relativePath === SKILL_MD) {
+    if (skill && !overwrite) {
+      return errorResult(
+        tc,
+        `Skill "${parsed.skillName}" already exists. Use edit_file for targeted changes, or pass overwrite: true only if replacing the entire ${parsed.displayPath} is intended.`,
+      );
+    }
+    return await writeSkillMd({
+      tc,
+      options,
+      req,
+      mergedConfigurable,
+      sourceConfigurable,
+      skill,
+      skillName: parsed.skillName,
+      content: args.content,
+    });
+  }
+
+  if (!skill) {
+    return errorResult(tc, `Skill "${parsed.skillName}" not found or not accessible.`);
   }
-  return false;
+
+  const current = await inspectBundledSkillFileForCreate({
+    skill,
+    relativePath: parsed.relativePath,
+    options,
+    req,
+  });
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+  if (current.status === 'present' && !overwrite) {
+    return errorResult(tc, 'File already exists. Pass overwrite: true to replace.');
+  }
+  return await writeBundledSkillFile({
+    tc,
+    options,
+    req,
+    skill,
+    relativePath: parsed.relativePath,
+    displayPath: parsed.displayPath,
+    content: args.content,
+    oldContent: current.status === 'present' ? current.oldContent : undefined,
+    created: current.status === 'missing',
+  });
 }
 
-/**
- * Routes a `read_file` call to the code-execution sandbox via the
- * host-provided `readSandboxFile` callback. The sandbox session id and
- * primed file refs come from `tc.codeSessionContext` (emitted by ToolNode
- * for `read_file` tool calls in agents v3.1.72+) so the read lands in the
- * same session that holds the agent's prior-turn artifacts. Returns a
- * `ToolExecuteResult` with the file content (line-numbered) on success,
- * or an instructive error pointing the model at `bash_tool` when the
- * sandbox isn't reachable from this configuration.
- *
- * Two binary guards keep `cat`-on-a-PNG-style mojibake out of the LLM
- * context: (1) an extension precheck that short-circuits known binary
- * types BEFORE any network call, and (2) a NUL-byte content sniff after
- * the read for unknown extensions. The codeapi `/exec` transport is JSON,
- * which already lossily down-converts non-UTF-8 stdout to replacement
- * characters — the bytes are unrecoverable here, so the goal is to fail
- * fast with an instructive message rather than ship garbage.
- */
-async function handleSandboxFileFallback(
+async function handleEditFileCall(
   tc: ToolCallRequest,
-  filePath: string,
+  mergedConfigurable: Record<string, unknown>,
   options: ToolExecuteOptions,
   req?: ServerRequest,
-): Promise<ToolExecuteResult> {
-  const ext = lowercaseExtension(filePath);
-  if (BINARY_EXTENSIONS_NEVER_READABLE.has(ext)) {
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: buildBinaryFileError(filePath, ext),
-    };
+  sandboxContext?: SandboxSessionContext,
+): AuthoringResult {
+  const args = tc.args as {
+    path?: unknown;
+    old_text?: unknown;
+    new_text?: unknown;
+    edits?: unknown;
+  };
+  if (typeof args.path !== 'string' || args.path.length === 0) {
+    return errorResult(tc, 'path is required');
   }
 
-  const { readSandboxFile } = options;
-  if (!readSandboxFile) {
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Path "${filePath}" is not a skill file. Use \`bash_tool\` to read code-execution sandbox files (e.g. \`cat ${filePath}\`).`,
-    };
+  const edits = normalizeEditArgs(args);
+  if (typeof edits === 'string') {
+    return errorResult(tc, edits);
   }
 
-  const ctx = tc.codeSessionContext as
-    | { session_id?: string; files?: Array<{ id: string; name: string; session_id?: string }> }
-    | undefined;
+  if (!args.path.startsWith(SKILL_FILE_PREFIX)) {
+    if (mergedConfigurable?.codeEnvAvailable !== true) {
+      return errorResult(
+        tc,
+        `Path "${args.path}" is not a skill file, and this agent does not have code execution enabled.`,
+      );
+    }
+    return await handleSandboxEditFileCall({
+      tc,
+      options,
+      req,
+      filePath: args.path,
+      edits,
+      sandboxContext,
+    });
+  }
+
+  const parsed = parseSkillAuthoringPath(args.path);
+  if (typeof parsed === 'string') {
+    return errorResult(tc, parsed);
+  }
+  if (!isSkillAuthoringAvailable(mergedConfigurable)) {
+    return errorResult(tc, 'Skill file authoring is not available for this agent.');
+  }
+
+  let skill = await resolveSkillForAuthoring(parsed.skillName, mergedConfigurable, options);
+  if (!skill) {
+    skill = await resolveAuthorSkillForCurrentUser({
+      skillName: parsed.skillName,
+      mergedConfigurable,
+      options,
+      req,
+    });
+  }
+  if (!skill) {
+    return errorResult(tc, `Skill "${parsed.skillName}" not found or not accessible.`);
+  }
+  const hiddenDenied = hiddenSkillAuthoringDenied(tc, skill, parsed.skillName, mergedConfigurable);
+  if (hiddenDenied) {
+    return hiddenDenied;
+  }
+
+  const current = await loadSkillFileTextForAuthoring({
+    skill,
+    relativePath: parsed.relativePath,
+    options,
+    req,
+  });
+  if (current.status === 'missing') {
+    return errorResult(
+      tc,
+      `File not found: "${parsed.relativePath}" in skill "${parsed.skillName}"`,
+    );
+  }
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+
+  let edited: { content: string; strategies: string[] };
   try {
-    const result = await readSandboxFile({
-      file_path: filePath,
-      session_id: ctx?.session_id,
-      files: ctx?.files,
-      ...(req ? { req } : {}),
+    edited = applyTextEdits(current.content, edits);
+  } catch (error) {
+    return errorResult(tc, error instanceof Error ? error.message : 'Failed to edit file');
+  }
+  if (Buffer.byteLength(edited.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `edited content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  if (parsed.relativePath === SKILL_MD) {
+    const result = await writeSkillMd({
+      tc,
+      options,
+      req,
+      mergedConfigurable,
+      skill,
+      skillName: parsed.skillName,
+      content: edited.content,
     });
-    if (!result || result.content == null) {
-      return {
-        toolCallId: tc.id,
-        status: 'error',
-        content: '',
-        errorMessage: `Failed to read "${filePath}" from the code-execution sandbox. Try \`bash_tool\` (e.g. \`cat ${filePath}\`).`,
+    if (result.status === 'success') {
+      result.artifact = {
+        ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+        edits: edits.length,
+        strategies: edited.strategies,
       };
+      result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
     }
-    if (looksBinary(result.content)) {
-      return {
-        toolCallId: tc.id,
-        status: 'error',
-        content: '',
-        errorMessage: `"${filePath}" appears to be a binary file and cannot be read as text. Use \`bash_tool\` to process it (e.g. \`file ${filePath}\` for metadata).`,
-      };
-    }
-    /**
-     * Cap before line-numbering. `addLineNumbers` allocates a SECOND
-     * full-size string with per-line prefixes, so a multi-MB log read
-     * would materialize ~2x in memory before downstream truncation
-     * kicks in. Match the skill-file path's `MAX_READABLE_BYTES`
-     * (256KB) ceiling: truncate the raw content first, then number,
-     * and surface the truncation to the model so it can use
-     * `bash_tool head` / `tail` for the rest.
-     */
-    let payload = result.content;
-    let truncated = false;
-    if (payload.length > MAX_READABLE_BYTES) {
-      payload = payload.slice(0, MAX_READABLE_BYTES);
-      truncated = true;
-    }
-    let numbered = addLineNumbers(payload);
-    if (truncated) {
-      numbered += `\n\n[truncated at ${MAX_READABLE_BYTES} bytes — use \`bash_tool\` (e.g. \`head -c\` / \`tail\`) to read the rest of "${filePath}"]`;
-    }
-    return {
-      toolCallId: tc.id,
-      status: 'success',
-      content: numbered,
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.warn(`[handleReadFileCall] Sandbox fallback failed for "${filePath}": ${message}`);
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Error reading "${filePath}" from the code-execution sandbox: ${message}. Try \`bash_tool\` (e.g. \`cat ${filePath}\`).`,
+    return result;
+  }
+
+  const result = await writeBundledSkillFile({
+    tc,
+    options,
+    req,
+    skill,
+    relativePath: parsed.relativePath,
+    displayPath: parsed.displayPath,
+    content: edited.content,
+    oldContent: current.content,
+    created: false,
+  });
+  if (result.status === 'success') {
+    result.artifact = {
+      ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+      edits: edits.length,
+      strategies: edited.strategies,
     };
+    result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
   }
+  return result;
 }
 
 async function handleReadFileCall(
@@ -425,75 +2511,126 @@ async function handleReadFileCall(
 ): Promise<ToolExecuteResult> {
   const { getSkillByName, getSkillFileByPath, getStrategyFunctions, updateSkillFileContent } =
     options;
-  const args = tc.args as { file_path?: string };
-  if (!args.file_path) {
+  const args = tc.args as { path?: string };
+  if (!args.path) {
     return {
       toolCallId: tc.id,
       status: 'error',
       content: '',
-      errorMessage: 'file_path is required',
+      errorMessage: 'path is required',
     };
   }
 
   const codeEnvAvailable = mergedConfigurable?.codeEnvAvailable === true;
-  const accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
-  /**
-   * `accessibleSkillIds` is the resolver's authoritative output (admin
-   * capability AND ACL access AND ephemeral badge / persisted
-   * `skills_enabled`). Empty ⇒ skills are not effectively in scope, so we
-   * skip skill resolution entirely and route to the sandbox fallback when
-   * the agent has code-execution available.
-   */
-  const skillsEffectivelyEnabled = accessibleIds.length > 0;
+  let accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
 
   /**
    * Short-circuit absolute code-env paths: the path can never be a skill
    * reference (skill paths are relative `{skillName}/...`), and consulting
    * `getSkillByName` would just burn a DB round-trip on a guaranteed miss.
    */
-  if (args.file_path.startsWith('/mnt/data/')) {
+  if (args.path.startsWith('/mnt/data/')) {
     if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+      return handleSandboxFileFallback(tc, args.path, options, req);
     }
     return {
       toolCallId: tc.id,
       status: 'error',
       content: '',
-      errorMessage: `Path "${args.file_path}" is a code-execution sandbox path, but this agent does not have code execution enabled.`,
+      errorMessage: `Path "${args.path}" is a code-execution sandbox path, but this agent does not have code execution enabled.`,
     };
   }
 
-  const slashIdx = args.file_path.indexOf('/');
-  if (slashIdx < 1) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+  let skillName: string;
+  let relativePath: string;
+  const explicitSkillNamespace = args.path.startsWith(SKILL_FILE_PREFIX);
+  if (explicitSkillNamespace) {
+    const parsed = parseSkillAuthoringPath(args.path);
+    if (typeof parsed === 'string') {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: parsed,
+      };
+    }
+    skillName = parsed.skillName;
+    relativePath = parsed.relativePath;
+  } else {
+    const slashIdx = args.path.indexOf('/');
+    if (slashIdx < 1) {
+      if (codeEnvAvailable) {
+        return handleSandboxFileFallback(tc, args.path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Invalid file path "${args.path}". Use format: {skillName}/{path}`,
+      };
+    }
+
+    skillName = args.path.slice(0, slashIdx);
+    relativePath = args.path.slice(slashIdx + 1);
+    if (!relativePath) {
+      /**
+       * `read_file("output/")`: a malformed-but-unambiguously-not-a-skill
+       * path. Stay consistent with the other malformed-path branches and
+       * route to the sandbox when code execution is available, instead of
+       * dead-ending with a skill-centric error message.
+       */
+      if (codeEnvAvailable) {
+        return handleSandboxFileFallback(tc, args.path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: 'Missing file path after skill name',
+      };
     }
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Invalid file path "${args.file_path}". Use format: {skillName}/{path}`,
-    };
   }
 
-  const skillName = args.file_path.slice(0, slashIdx);
-  const relativePath = args.file_path.slice(slashIdx + 1);
-  if (!relativePath) {
-    /**
-     * `read_file("output/")`: a malformed-but-unambiguously-not-a-skill
-     * path. Stay consistent with the other malformed-path branches and
-     * route to the sandbox when code execution is available, instead of
-     * dead-ending with a skill-centric error message.
-     */
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+  let skillPrimedIdsByName =
+    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  let primedIdString = skillPrimedIdsByName[skillName];
+  let isPrimedThisTurn = primedIdString != null;
+  const refreshSkillReadScope = () => {
+    accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
+    skillPrimedIdsByName =
+      (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+    primedIdString = skillPrimedIdsByName[skillName];
+    isPrimedThisTurn = primedIdString != null;
+  };
+  let recoveredAuthorSkill: AuthoringSkill | null | undefined;
+  const recoverAuthorSkill = async () => {
+    if (recoveredAuthorSkill !== undefined) {
+      return recoveredAuthorSkill;
     }
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: 'Missing file path after skill name',
-    };
+    recoveredAuthorSkill = await resolveAuthorSkillForCurrentUser({
+      skillName,
+      mergedConfigurable,
+      options,
+      req,
+    });
+    refreshSkillReadScope();
+    return recoveredAuthorSkill;
+  };
+  /**
+   * `accessibleSkillIds` is the resolver's normal output (admin
+   * capability AND ACL access AND ephemeral badge / persisted
+   * `skills_enabled`). A skill authored earlier in this run is also
+   * resolvable through `skillPrimedIdsByName`, even when the run started
+   * with an empty accessible set for a first-time creator.
+   */
+  let skillsEffectivelyEnabled = accessibleIds.length > 0 || isPrimedThisTurn;
+  if (
+    !skillsEffectivelyEnabled &&
+    explicitSkillNamespace &&
+    isSkillAuthoringAvailable(mergedConfigurable)
+  ) {
+    await recoverAuthorSkill();
+    skillsEffectivelyEnabled = accessibleIds.length > 0 || isPrimedThisTurn;
   }
 
   /**
@@ -504,8 +2641,8 @@ async function handleReadFileCall(
    * the lookup truly has nowhere to go.
    */
   if (!skillsEffectivelyEnabled) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+    if (codeEnvAvailable && !explicitSkillNamespace) {
+      return handleSandboxFileFallback(tc, args.path, options, req);
     }
     return {
       toolCallId: tc.id,
@@ -531,11 +2668,6 @@ async function handleReadFileCall(
    * shortcut would misroute `read_file("primed-skill/references/foo.md")`
    * to the sandbox even though the primed skill is in scope.
    */
-  const skillPrimedIdsByName =
-    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
-  const primedIdString = skillPrimedIdsByName[skillName];
-  const isPrimedThisTurn = primedIdString != null;
-
   /**
    * Skills are in scope, but the first segment isn't a name we know.
    * Use the catalog-derived `activeSkillNames` Set (no DB read) to detect
@@ -546,15 +2678,18 @@ async function handleReadFileCall(
    */
   const activeSkillNames = mergedConfigurable?.activeSkillNames as Set<string> | undefined;
   if (activeSkillNames && !activeSkillNames.has(skillName) && !isPrimedThisTurn) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+    const recovered = await recoverAuthorSkill();
+    if (!recovered) {
+      if (codeEnvAvailable && !explicitSkillNamespace) {
+        return handleSandboxFileFallback(tc, args.path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Skill "${skillName}" not found or not accessible`,
+      };
     }
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Skill "${skillName}" not found or not accessible`,
-    };
   }
 
   if (!getSkillByName) {
@@ -576,19 +2711,20 @@ async function handleReadFileCall(
      (rather than relying on mongoose's string auto-cast in `$in` queries)
      keeps the value correct for any future consumer that compares with
      `.equals()` or `===`. */
-  const lookupAccessibleIds = isPrimedThisTurn
-    ? [new Types.ObjectId(primedIdString)]
-    : accessibleIds;
+  const lookupAccessibleIds = primedIdString ? [new Types.ObjectId(primedIdString)] : accessibleIds;
   const lookupOptions: { preferUserInvocable?: boolean; preferModelInvocable?: boolean } =
-    isPrimedThisTurn ? {} : { preferModelInvocable: true };
-  const skill = await getSkillByName(skillName, lookupAccessibleIds, lookupOptions);
+    primedIdString ? {} : { preferModelInvocable: true };
+  let skill = await getSkillByName(skillName, lookupAccessibleIds, lookupOptions);
   if (!skill) {
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Skill "${skillName}" not found or not accessible`,
-    };
+    skill = await recoverAuthorSkill();
+    if (!skill) {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Skill "${skillName}" not found or not accessible`,
+      };
+    }
   }
 
   /**
@@ -627,7 +2763,7 @@ async function handleReadFileCall(
     return {
       toolCallId: tc.id,
       status: 'success',
-      content: `File: ${args.file_path}\n\n${addLineNumbers(skill.body)}`,
+      content: `File: ${args.path}\n\n${addLineNumbers(skill.body)}`,
     };
   }
 
@@ -658,7 +2794,7 @@ async function handleReadFileCall(
       return {
         toolCallId: tc.id,
         status: 'success',
-        content: `Binary file (${file.mimeType}, ${file.bytes} bytes). Use bash to process: /mnt/data/${args.file_path}`,
+        content: `Binary file (${file.mimeType}, ${file.bytes} bytes). Use bash to process: /mnt/data/${args.path}`,
       };
     }
   }
@@ -668,7 +2804,7 @@ async function handleReadFileCall(
     return {
       toolCallId: tc.id,
       status: 'success',
-      content: `File: ${args.file_path} (${file.bytes} bytes)\n\n${addLineNumbers(file.content)}`,
+      content: `File: ${args.path} (${file.bytes} bytes)\n\n${addLineNumbers(file.content)}`,
     };
   }
 
@@ -678,14 +2814,14 @@ async function handleReadFileCall(
     return {
       toolCallId: tc.id,
       status: 'success',
-      content: `File "${args.file_path}" is too large to read directly (${file.bytes} bytes, limit: ${MAX_READABLE_BYTES}). Invoke the skill first, then use bash to read it at /mnt/data/${args.file_path}.`,
+      content: `File "${args.path}" is too large to read directly (${file.bytes} bytes, limit: ${MAX_READABLE_BYTES}). Invoke the skill first, then use bash to read it at /mnt/data/${args.path}.`,
     };
   }
   if (isImage && file.bytes > MAX_BINARY_BYTES) {
     return {
       toolCallId: tc.id,
       status: 'success',
-      content: `File too large (${file.bytes} bytes, limit: ${MAX_BINARY_BYTES}). Use bash to process: /mnt/data/${args.file_path}`,
+      content: `File too large (${file.bytes} bytes, limit: ${MAX_BINARY_BYTES}). Use bash to process: /mnt/data/${args.path}`,
     };
   }
 
@@ -729,7 +2865,7 @@ async function handleReadFileCall(
         return {
           toolCallId: tc.id,
           status: 'success',
-          content: `File "${args.file_path}" exceeded streaming limit (${streamLimit} bytes). Invoke the skill first, then use bash to read it at /mnt/data/${args.file_path}.`,
+          content: `File "${args.path}" exceeded streaming limit (${streamLimit} bytes). Invoke the skill first, then use bash to read it at /mnt/data/${args.path}.`,
         };
       }
       chunks.push(chunk);
@@ -767,7 +2903,7 @@ async function handleReadFileCall(
         return {
           toolCallId: tc.id,
           status: 'success',
-          content: `Image: ${args.file_path} (${buffer.length} bytes, ${file.mimeType})`,
+          content: `Image: ${args.path} (${buffer.length} bytes, ${file.mimeType})`,
           artifact: {
             content: [
               { type: 'image_url', image_url: { url: `data:${file.mimeType};base64,${base64}` } },
@@ -783,7 +2919,7 @@ async function handleReadFileCall(
       return {
         toolCallId: tc.id,
         status: 'success',
-        content: `Binary file (${file.mimeType}, ${buffer.length} bytes). Use bash to process: /mnt/data/${args.file_path}`,
+        content: `Binary file (${file.mimeType}, ${buffer.length} bytes). Use bash to process: /mnt/data/${args.path}`,
       };
     }
 
@@ -805,14 +2941,14 @@ async function handleReadFileCall(
       return {
         toolCallId: tc.id,
         status: 'success',
-        content: `File too large (${buffer.length} bytes, limit: ${MAX_READABLE_BYTES}). Use bash: cat /mnt/data/${args.file_path}`,
+        content: `File too large (${buffer.length} bytes, limit: ${MAX_READABLE_BYTES}). Use bash: cat /mnt/data/${args.path}`,
       };
     }
 
     return {
       toolCallId: tc.id,
       status: 'success',
-      content: `File: ${args.file_path} (${buffer.length} bytes)\n\n${addLineNumbers(text)}`,
+      content: `File: ${args.path} (${buffer.length} bytes)\n\n${addLineNumbers(text)}`,
     };
   } catch (error) {
     return {
@@ -983,6 +3119,27 @@ async function handleSkillToolCall(
   };
 }
 
+function getFileAuthoringQueueKey(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+): string | undefined {
+  if (!isHostFileAuthoringToolCall(tc.name, mergedConfigurable)) {
+    return undefined;
+  }
+  const args = tc.args as { path?: unknown };
+  if (typeof args.path !== 'string' || args.path.length === 0) {
+    return undefined;
+  }
+  if (!args.path.startsWith(SKILL_FILE_PREFIX)) {
+    return `sandbox:${args.path}`;
+  }
+  const parsed = parseSkillAuthoringPath(args.path);
+  if (typeof parsed === 'string') {
+    return `skill:${args.path}`;
+  }
+  return `skill:${parsed.skillName}`;
+}
+
 /**
  * Creates the ON_TOOL_EXECUTE handler for event-driven tool execution.
  * This handler receives batched tool calls, loads the required tools,
@@ -994,6 +3151,24 @@ export function createToolExecuteHandler(options: ToolExecuteOptions): EventHand
   return {
     handle: async (_event: string, data: ToolExecuteBatchRequest) => {
       const { toolCalls, agentId, configurable, metadata, resolve, reject } = data;
+      /** Optional per-call channel (agents SDK > 3.2.33); cast keeps older
+       * installed SDK typings compiling until the release lands. */
+      const onResult = (
+        data as ToolExecuteBatchRequest & {
+          onResult?: (result: ToolExecuteResult) => void;
+        }
+      ).onResult;
+      /** Reports a settled result so the agent graph can emit that call's
+       * completion immediately instead of waiting for the whole batch;
+       * `resolve` below remains the authoritative batch outcome. */
+      const reportResult = (result: ToolExecuteResult): ToolExecuteResult => {
+        try {
+          onResult?.(result);
+        } catch (callbackError) {
+          logger.warn('[ON_TOOL_EXECUTE] onResult callback error:', callbackError);
+        }
+        return result;
+      };
 
       try {
         await runOutsideTracing(async () => {
@@ -1004,206 +3179,322 @@ export function createToolExecuteHandler(options: ToolExecuteOptions): EventHand
               agentId,
             );
             const toolMap = new Map(loadedTools.map((t) => [t.name, t]));
-            const mergedConfigurable = { ...configurable, ...toolConfigurable };
+            const sourceConfigurable = configurable as Record<string, unknown> | undefined;
+            const loadedConfigurable = toolConfigurable as Record<string, unknown> | undefined;
+            const mergedConfigurable = mergeToolConfigurables(
+              sourceConfigurable,
+              loadedConfigurable,
+            );
+            const authoringQueues = new Map<string, Promise<void>>();
+            const sandboxAuthoringContexts = new Map<string, SandboxSessionContext>();
 
             const results: ToolExecuteResult[] = await Promise.all(
               toolCalls.map(async (tc: ToolCallRequest) => {
-                if (tc.name === Constants.SKILL_TOOL || tc.name === Constants.READ_FILE) {
-                  const req = mergedConfigurable?.req as ServerRequest | undefined;
-                  const handlerResult =
-                    tc.name === Constants.SKILL_TOOL
-                      ? await handleSkillToolCall(tc, mergedConfigurable, options, req)
-                      : await handleReadFileCall(tc, mergedConfigurable, options, req);
-
-                  if (toolEndCallback && handlerResult.artifact) {
-                    await toolEndCallback(
-                      {
-                        output: {
-                          name: tc.name,
-                          tool_call_id: tc.id,
-                          content: handlerResult.content,
-                          artifact: handlerResult.artifact,
+                const execute = async (
+                  sandboxContext?: SandboxSessionContext,
+                ): Promise<ToolExecuteResult> => {
+                  const isFileAuthoringCall = isHostFileAuthoringToolCall(
+                    tc.name,
+                    mergedConfigurable,
+                  );
+                  const isSandboxFileAuthoringCall =
+                    isFileAuthoringCall &&
+                    typeof (tc.args as { path?: unknown }).path === 'string' &&
+                    !(tc.args as { path: string }).path.startsWith(SKILL_FILE_PREFIX);
+                  if (
+                    tc.name === Constants.SKILL_TOOL ||
+                    tc.name === Constants.READ_FILE ||
+                    isFileAuthoringCall
+                  ) {
+                    const req = mergedConfigurable?.req as ServerRequest | undefined;
+                    let handlerResult: ToolExecuteResult;
+                    try {
+                      if (tc.name === Constants.SKILL_TOOL) {
+                        handlerResult = await handleSkillToolCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                        );
+                      } else if (tc.name === Constants.READ_FILE) {
+                        handlerResult = await handleReadFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                        );
+                      } else if (tc.name === CREATE_FILE_TOOL_NAME && isFileAuthoringCall) {
+                        handlerResult = await handleCreateFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                          sourceConfigurable,
+                          sandboxContext,
+                        );
+                      } else if (tc.name === EDIT_FILE_TOOL_NAME && isFileAuthoringCall) {
+                        handlerResult = await handleEditFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                          sandboxContext,
+                        );
+                      } else {
+                        handlerResult = errorResult(tc, `Tool ${tc.name} not found`);
+                      }
+                    } catch (toolError) {
+                      const { message, logContext } = getSafeToolError(toolError);
+                      logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error`, {
+                        ...logContext,
+                        toolCallArgsShape: getValueShape(tc.args),
+                      });
+                      return {
+                        toolCallId: tc.id,
+                        status: 'error' as const,
+                        content: '',
+                        errorMessage: message,
+                      };
+                    }
+
+                    if (
+                      isSandboxFileAuthoringCall &&
+                      handlerResult.status === 'success' &&
+                      sandboxContext
+                    ) {
+                      mergeSandboxSessionArtifact(sandboxContext, handlerResult.artifact);
+                    }
+
+                    if (toolEndCallback && handlerResult.artifact) {
+                      await toolEndCallback(
+                        {
+                          output: {
+                            name: tc.name,
+                            tool_call_id: tc.id,
+                            content: handlerResult.content,
+                            artifact: handlerResult.artifact,
+                          },
                         },
-                      },
-                      {
-                        run_id: (metadata as Record<string, unknown>)?.run_id as string | undefined,
-                        thread_id: (metadata as Record<string, unknown>)?.thread_id as
-                          | string
-                          | undefined,
-                        ...metadata,
-                      },
-                    );
-                  }
+                        {
+                          run_id: (metadata as Record<string, unknown>)?.run_id as
+                            | string
+                            | undefined,
+                          thread_id: (metadata as Record<string, unknown>)?.thread_id as
+                            | string
+                            | undefined,
+                          ...metadata,
+                        },
+                      );
+                    }
 
-                  return handlerResult;
-                }
+                    return handlerResult;
+                  }
 
-                const tool = toolMap.get(tc.name);
+                  const tool = toolMap.get(tc.name);
 
-                if (!tool) {
-                  logger.warn(
-                    `[ON_TOOL_EXECUTE] Tool "${tc.name}" not found. Available: ${[...toolMap.keys()].map((k) => `"${k}"`).join(', ')}`,
-                  );
-                  return {
-                    toolCallId: tc.id,
-                    status: 'error' as const,
-                    content: '',
-                    errorMessage: `Tool ${tc.name} not found`,
-                  };
-                }
+                  if (!tool) {
+                    logger.warn(
+                      `[ON_TOOL_EXECUTE] Tool "${tc.name}" not found. Available: ${[...toolMap.keys()].map((k) => `"${k}"`).join(', ')}`,
+                    );
+                    return {
+                      toolCallId: tc.id,
+                      status: 'error' as const,
+                      content: '',
+                      errorMessage: `Tool ${tc.name} not found`,
+                    };
+                  }
 
-                try {
-                  const toolCallConfig: Record<string, unknown> = {
-                    id: tc.id,
-                    stepId: tc.stepId,
-                    turn: tc.turn,
-                  };
-
-                  if (tc.codeSessionContext && CODE_EXECUTION_TOOLS.has(tc.name)) {
-                    toolCallConfig.session_id = tc.codeSessionContext.session_id;
-                    if (tc.codeSessionContext.files && tc.codeSessionContext.files.length > 0) {
-                      toolCallConfig._injected_files = tc.codeSessionContext.files;
-                      /* Last LC-controlled point before the wire. Mirrors
-                       * codeapi's validator context so the two log sides
-                       * correlate on a single grep. */
-                      const refs = tc.codeSessionContext.files as Array<{
-                        id?: unknown;
-                        resource_id?: unknown;
-                        storage_session_id?: unknown;
-                        kind?: unknown;
-                        version?: unknown;
-                        name?: unknown;
-                      }>;
-                      const summary = refs.map((f) => ({
-                        kind: f.kind,
-                        hasResourceId: typeof f.resource_id === 'string' && !!f.resource_id,
-                        hasStorageSessionId:
-                          typeof f.storage_session_id === 'string' && !!f.storage_session_id,
-                        hasVersion: typeof f.version === 'number',
-                      }));
-                      let missingResourceId = 0;
-                      let missingStorageSessionId = 0;
-                      let missingVersion = 0;
-                      const kindCounts: Record<string, number> = {};
-                      for (const s of summary) {
-                        if (!s.hasResourceId) missingResourceId++;
-                        if (!s.hasStorageSessionId) missingStorageSessionId++;
-                        if (!s.hasVersion) missingVersion++;
-                        const k = typeof s.kind === 'string' ? s.kind : 'unknown';
-                        kindCounts[k] = (kindCounts[k] ?? 0) + 1;
-                      }
-                      logger.debug(
-                        `[code-env:inject] tool=${tc.name} files=${refs.length} ` +
-                          `missingResourceId=${missingResourceId} ` +
-                          `missingStorageSessionId=${missingStorageSessionId} ` +
-                          `missingVersion=${missingVersion} ` +
-                          `kinds=${JSON.stringify(kindCounts)}`,
-                      );
-                      if (missingResourceId > 0) {
+                  try {
+                    const toolCallConfig: Record<string, unknown> = {
+                      id: tc.id,
+                      stepId: tc.stepId,
+                      turn: tc.turn,
+                    };
+
+                    if (
+                      tc.codeSessionContext &&
+                      isCodeSessionAwareToolCall(tc.name, mergedConfigurable)
+                    ) {
+                      toolCallConfig.session_id = tc.codeSessionContext.session_id;
+                      if (tc.codeSessionContext.files && tc.codeSessionContext.files.length > 0) {
+                        toolCallConfig._injected_files = tc.codeSessionContext.files;
+                        /* Last LC-controlled point before the wire. Mirrors
+                         * codeapi's validator context so the two log sides
+                         * correlate on a single grep. */
+                        const refs = tc.codeSessionContext.files as Array<{
+                          id?: unknown;
+                          resource_id?: unknown;
+                          storage_session_id?: unknown;
+                          kind?: unknown;
+                          version?: unknown;
+                          name?: unknown;
+                        }>;
+                        const summary = refs.map((f) => ({
+                          kind: f.kind,
+                          hasResourceId: typeof f.resource_id === 'string' && !!f.resource_id,
+                          hasStorageSessionId:
+                            typeof f.storage_session_id === 'string' && !!f.storage_session_id,
+                          hasVersion: typeof f.version === 'number',
+                        }));
+                        let missingResourceId = 0;
+                        let missingStorageSessionId = 0;
+                        let missingVersion = 0;
+                        const kindCounts: Record<string, number> = {};
+                        for (const s of summary) {
+                          if (!s.hasResourceId) missingResourceId++;
+                          if (!s.hasStorageSessionId) missingStorageSessionId++;
+                          if (!s.hasVersion) missingVersion++;
+                          const k = typeof s.kind === 'string' ? s.kind : 'unknown';
+                          kindCounts[k] = (kindCounts[k] ?? 0) + 1;
+                        }
+                        logger.debug(
+                          `[code-env:inject] tool=${tc.name} files=${refs.length} ` +
+                            `missingResourceId=${missingResourceId} ` +
+                            `missingStorageSessionId=${missingStorageSessionId} ` +
+                            `missingVersion=${missingVersion} ` +
+                            `kinds=${JSON.stringify(kindCounts)}`,
+                        );
+                        if (missingResourceId > 0) {
+                          logger.warn(
+                            `[code-env:inject] ${missingResourceId}/${refs.length} files missing resource_id ` +
+                              `for tool=${tc.name} — codeapi will reject with 400`,
+                            { summary },
+                          );
+                        }
+                      } else {
+                        /* Empty `_injected_files` on a code-execution tool
+                         * call. Almost always means the seeding chain
+                         * (primeCodeFiles → initialSessions →
+                         * CodeSessionContext) dropped the file upstream.
+                         * `session_id` is still emitted for continuity, but
+                         * concrete file refs must arrive through
+                         * `_injected_files`; agents no longer falls back to
+                         * `/files/<sid>`. Pair with `[primeCodeFiles]`
+                         * traces below to locate the layer that lost the ref. */
                         logger.warn(
-                          `[code-env:inject] ${missingResourceId}/${refs.length} files missing resource_id ` +
-                            `for tool=${tc.name} — codeapi will reject with 400`,
-                          { summary },
+                          `[code-env:inject] tool=${tc.name} _injected_files=0 — sandbox will see no input files`,
+                          {
+                            tool: tc.name,
+                            session_id: tc.codeSessionContext.session_id,
+                            codeSessionContextHasFiles: tc.codeSessionContext.files !== undefined,
+                            codeSessionContextFileCount: tc.codeSessionContext.files?.length ?? 0,
+                          },
                         );
                       }
-                    } else {
-                      /* Empty `_injected_files` on a code-execution tool
-                       * call. Almost always means the seeding chain
-                       * (primeCodeFiles → initialSessions →
-                       * CodeSessionContext) dropped the file upstream.
-                       * `session_id` is still emitted; agents falls
-                       * through to the `/files/<sid>` legacy fetch
-                       * which is post-cutover broken (returns 400).
-                       * Pair with `[primeCodeFiles]` traces below to
-                       * locate the layer that lost the ref. */
-                      logger.warn(
-                        `[code-env:inject] tool=${tc.name} _injected_files=0 — sandbox will see no input files`,
-                        {
-                          tool: tc.name,
-                          session_id: tc.codeSessionContext.session_id,
-                          codeSessionContextHasFiles: tc.codeSessionContext.files !== undefined,
-                          codeSessionContextFileCount: tc.codeSessionContext.files?.length ?? 0,
-                        },
-                      );
                     }
-                  }
 
-                  if (
-                    tc.name === Constants.BASH_PROGRAMMATIC_TOOL_CALLING ||
-                    tc.name === Constants.PROGRAMMATIC_TOOL_CALLING
-                  ) {
-                    const toolRegistry = mergedConfigurable?.toolRegistry as
-                      | LCToolRegistry
-                      | undefined;
-                    const ptcToolMap = mergedConfigurable?.ptcToolMap as
-                      | Map<string, StructuredToolInterface>
-                      | undefined;
-                    if (toolRegistry) {
-                      const toolDefs: LCTool[] = Array.from(toolRegistry.values()).filter(
-                        (t) =>
-                          t.name !== Constants.PROGRAMMATIC_TOOL_CALLING &&
-                          t.name !== Constants.BASH_PROGRAMMATIC_TOOL_CALLING &&
-                          t.name !== Constants.TOOL_SEARCH,
-                      );
-                      toolCallConfig.toolDefs = toolDefs;
-                      toolCallConfig.toolMap = ptcToolMap ?? toolMap;
+                    if (
+                      tc.name === Constants.BASH_PROGRAMMATIC_TOOL_CALLING ||
+                      tc.name === Constants.PROGRAMMATIC_TOOL_CALLING
+                    ) {
+                      const toolRegistry = mergedConfigurable?.toolRegistry as
+                        | LCToolRegistry
+                        | undefined;
+                      const ptcToolMap = mergedConfigurable?.ptcToolMap as
+                        | Map<string, StructuredToolInterface>
+                        | undefined;
+                      if (toolRegistry) {
+                        const fileAuthoringToolNames =
+                          getFileAuthoringToolNames(mergedConfigurable) ?? new Set<string>();
+                        const toolDefs: LCTool[] = Array.from(toolRegistry.values()).filter(
+                          (t) =>
+                            t.name !== Constants.PROGRAMMATIC_TOOL_CALLING &&
+                            t.name !== Constants.BASH_PROGRAMMATIC_TOOL_CALLING &&
+                            t.name !== Constants.TOOL_SEARCH &&
+                            !fileAuthoringToolNames.has(t.name),
+                        );
+                        toolCallConfig.toolDefs = toolDefs;
+                        toolCallConfig.toolMap = ptcToolMap ?? toolMap;
+                      }
                     }
-                  }
 
-                  const result = await tool.invoke(tc.args, {
-                    toolCall: toolCallConfig,
-                    configurable: mergedConfigurable,
-                    metadata,
-                  } as Record<string, unknown>);
-
-                  // Code-execution tools emit per-call boilerplate
-                  // ("Note: ..." paragraphs and `| <annotation>` per-file
-                  // suffixes) that wastes tokens when re-injected into
-                  // every subsequent model turn. Strip it here, *after*
-                  // the tool resolved but *before* downstream consumers
-                  // (model context, SSE forwarding, persistence) see it.
-                  // Non-code-execution tools pass through unchanged.
-                  const cleanedContent =
-                    CODE_EXECUTION_TOOLS.has(tc.name) && typeof result.content === 'string'
-                      ? cleanCodeToolOutput(result.content)
-                      : result.content;
-
-                  if (toolEndCallback) {
-                    await toolEndCallback(
-                      {
-                        output: {
-                          name: tc.name,
-                          tool_call_id: tc.id,
-                          content: cleanedContent,
-                          artifact: result.artifact,
+                    const result = await tool.invoke(normalizeToolInvokeArgs(tc.args, tool), {
+                      toolCall: toolCallConfig,
+                      configurable: mergedConfigurable,
+                      metadata,
+                    } as Record<string, unknown>);
+
+                    // Code-execution tools emit per-call boilerplate
+                    // ("Note: ..." paragraphs and `| <annotation>` per-file
+                    // suffixes) that wastes tokens when re-injected into
+                    // every subsequent model turn. Strip it here, *after*
+                    // the tool resolved but *before* downstream consumers
+                    // (model context, SSE forwarding, persistence) see it.
+                    // Non-code-execution tools pass through unchanged.
+                    const cleanedContent =
+                      isCodeSessionAwareToolCall(tc.name, mergedConfigurable) &&
+                      typeof result.content === 'string'
+                        ? cleanCodeToolOutput(result.content)
+                        : result.content;
+
+                    if (toolEndCallback) {
+                      await toolEndCallback(
+                        {
+                          output: {
+                            name: tc.name,
+                            tool_call_id: tc.id,
+                            content: cleanedContent,
+                            artifact: result.artifact,
+                          },
                         },
-                      },
-                      {
-                        run_id: (metadata as Record<string, unknown>)?.run_id as string | undefined,
-                        thread_id: (metadata as Record<string, unknown>)?.thread_id as
-                          | string
-                          | undefined,
-                        ...metadata,
-                      },
-                    );
+                        {
+                          run_id: (metadata as Record<string, unknown>)?.run_id as
+                            | string
+                            | undefined,
+                          thread_id: (metadata as Record<string, unknown>)?.thread_id as
+                            | string
+                            | undefined,
+                          ...metadata,
+                        },
+                      );
+                    }
+
+                    return {
+                      toolCallId: tc.id,
+                      content: cleanedContent,
+                      artifact: result.artifact,
+                      status: 'success' as const,
+                    };
+                  } catch (toolError) {
+                    const { message, logContext } = getSafeToolError(toolError);
+                    logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error`, {
+                      ...logContext,
+                      toolCallArgsShape: getValueShape(tc.args),
+                      toolInputSchemaKind: getToolInputSchemaKind(tool),
+                    });
+                    return {
+                      toolCallId: tc.id,
+                      status: 'error' as const,
+                      content: '',
+                      errorMessage: message,
+                    };
                   }
+                };
 
-                  return {
-                    toolCallId: tc.id,
-                    content: cleanedContent,
-                    artifact: result.artifact,
-                    status: 'success' as const,
-                  };
-                } catch (toolError) {
-                  const error = toolError as Error;
-                  logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error:`, error);
-                  return {
-                    toolCallId: tc.id,
-                    status: 'error' as const,
-                    content: '',
-                    errorMessage: error.message,
-                  };
+                const queueKey = getFileAuthoringQueueKey(tc, mergedConfigurable);
+                if (!queueKey) {
+                  return reportResult(await execute());
+                }
+                let sandboxContext: SandboxSessionContext | undefined;
+                if (queueKey.startsWith('sandbox:')) {
+                  sandboxContext =
+                    sandboxAuthoringContexts.get(queueKey) ??
+                    cloneSandboxSessionContext(sandboxSessionContext(tc));
+                  sandboxAuthoringContexts.set(queueKey, sandboxContext);
                 }
+                const previous = authoringQueues.get(queueKey) ?? Promise.resolve();
+                const resultPromise = previous.then(
+                  () => execute(sandboxContext),
+                  () => execute(sandboxContext),
+                );
+                authoringQueues.set(
+                  queueKey,
+                  resultPromise.then(
+                    () => undefined,
+                    () => undefined,
+                  ),
+                );
+                return reportResult(await resultPromise);
               }),
             );
 
diff --git a/packages/api/src/agents/index.ts b/packages/api/src/agents/index.ts
index 1a6ae696a03..14e0f480fd5 100644
--- a/packages/api/src/agents/index.ts
+++ b/packages/api/src/agents/index.ts
@@ -1,4 +1,5 @@
 export * from './avatars';
+export * from './attachments';
 export * from './chain';
 export * from './client';
 export * from './config';
@@ -21,6 +22,7 @@ export * from './skillConfigurable';
 export * from './skillFiles';
 export * from './codeFilesSession';
 export * from './run';
+export * from './testHook';
 export * from './tools';
 export * from './validation';
 export * from './added';
diff --git a/packages/api/src/agents/initialize.ts b/packages/api/src/agents/initialize.ts
index b4985d356e8..f7f99919512 100644
--- a/packages/api/src/agents/initialize.ts
+++ b/packages/api/src/agents/initialize.ts
@@ -15,34 +15,45 @@ import type {
   AgentToolResources,
   AgentToolOptions,
   TEndpointOption,
+  ReasoningResponseKey,
   TFile,
   Agent,
   TUser,
 } from 'librechat-data-provider';
 import type { GenericTool, LCToolRegistry, ToolMap, LCTool } from '@librechat/agents';
+import type { IMongoFile, FileOwnerScope } from '@librechat/data-schemas';
 import type { Response as ServerResponse } from 'express';
-import type { IMongoFile } from '@librechat/data-schemas';
-import type { InitializeResultBase, ServerRequest, EndpointDbMethods } from '~/types';
+import type {
+  ServerRequest,
+  EndpointDbMethods,
+  EndpointTokenConfig,
+  InitializeResultBase,
+} from '~/types';
+import type { LCAvailableTools, RequestScopedMCPConnectionStore } from '../mcp/types';
+import type { ResolvedManualSkill, ResolvedAlwaysApplySkill } from './skills';
+import type { TFilterFilesByAgentAccess } from './resources';
+import {
+  injectSkillCatalog,
+  resolveManualSkills,
+  resolveAlwaysApplySkills,
+  unionPrimeAllowedTools,
+  MAX_PRIMED_SKILLS_PER_TURN,
+} from './skills';
 import {
   optionalChainWithEmptyCheck,
   extractLibreChatParams,
   getModelMaxTokens,
   getThreadData,
 } from '~/utils';
+import {
+  registerCodeExecutionTools,
+  registerFileAuthoringTools,
+  isFileAuthoringToolDefinition,
+} from './tools';
 import { filterFilesByEndpointConfig } from '~/files';
 import { generateArtifactsPrompt } from '~/prompts';
 import { getProviderConfig } from '~/endpoints';
-import {
-  injectSkillCatalog,
-  resolveManualSkills,
-  resolveAlwaysApplySkills,
-  unionPrimeAllowedTools,
-  MAX_PRIMED_SKILLS_PER_TURN,
-} from './skills';
-import { registerCodeExecutionTools } from './tools';
 import { primeResources } from './resources';
-import type { ResolvedManualSkill, ResolvedAlwaysApplySkill } from './skills';
-import type { TFilterFilesByAgentAccess } from './resources';
 
 /**
  * Fraction of context budget reserved as headroom when no explicit maxContextTokens is set.
@@ -51,6 +62,15 @@ import type { TFilterFilesByAgentAccess } from './resources';
  */
 const DEFAULT_RESERVE_RATIO = 0.05;
 const temporalSpecialVarRegex = /{{\s*(current_date|current_datetime|iso_datetime)\s*}}/i;
+const geminiModelVersionRegex = /^gemini-(\d+)(?:\.(\d+))?(?:-|$)/;
+const googleToolCombinationTextModels = [
+  'gemini-3-flash-preview',
+  'gemini-3-pro-preview',
+  'gemini-3.1-flash-lite',
+  'gemini-3.1-pro-preview',
+];
+const googleToolCombinationExcludedModalityRegex =
+  /(?:^|-)image(?:-|$)|(?:^|-)live(?:-|$)|(?:^|-)tts(?:-|$)/;
 
 function hasTemporalSpecialVars(text: string): boolean {
   return temporalSpecialVarRegex.test(text);
@@ -65,12 +85,155 @@ function appendAdditionalInstructions(agent: Agent, text?: string | null): void
     .join('\n\n');
 }
 
+function getMaxCatalogSkills(req: ServerRequest): number | undefined {
+  const endpoints = req.config?.endpoints as
+    | Record<string, { skills?: { maxCatalogSkills?: number } } | undefined>
+    | undefined;
+  return endpoints?.[EModelEndpoint.agents]?.skills?.maxCatalogSkills;
+}
+
+function getToolName(tool: unknown): string | undefined {
+  if (tool == null || typeof tool !== 'object') {
+    return undefined;
+  }
+  const { name } = tool as { name?: unknown };
+  return typeof name === 'string' ? name : undefined;
+}
+
+function hasToolDefinition(toolDefinitions: LCTool[] | undefined, name: string): boolean {
+  return toolDefinitions?.some((toolDefinition) => toolDefinition.name === name) === true;
+}
+
+function hasGoogleSearchTool(tool: unknown): boolean {
+  if (tool == null || typeof tool !== 'object') {
+    return false;
+  }
+  return 'googleSearch' in tool || 'googleSearchRetrieval' in tool;
+}
+
+function normalizeGoogleModelName(model: string): string {
+  const normalized = model.trim().toLowerCase();
+  return normalized.split('/').pop() ?? normalized;
+}
+
+function isKnownGoogleToolCombinationTextModel(model: string): boolean {
+  return googleToolCombinationTextModels.some(
+    (knownModel) => model === knownModel || model.startsWith(`${knownModel}-`),
+  );
+}
+
+function isGemini35OrLater(model: string): boolean {
+  const match = geminiModelVersionRegex.exec(model);
+  if (!match) {
+    return false;
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2] ?? '0');
+  return major > 3 || (major === 3 && minor >= 5);
+}
+
+function supportsGoogleToolCombination(model: unknown): boolean {
+  if (typeof model !== 'string') {
+    return false;
+  }
+  const normalized = normalizeGoogleModelName(model);
+  if (googleToolCombinationExcludedModalityRegex.test(normalized)) {
+    return false;
+  }
+  return isKnownGoogleToolCombinationTextModel(normalized) || isGemini35OrLater(normalized);
+}
+
+function isGoogleToolCombinationProvider(provider?: string): boolean {
+  return provider === Providers.GOOGLE || provider === Providers.VERTEXAI;
+}
+
+function shouldIncludeGoogleServerSideToolInvocations({
+  provider,
+  hasProviderTools,
+  hasAgentTools,
+}: {
+  provider?: string;
+  hasProviderTools: boolean;
+  hasAgentTools: boolean;
+}): boolean {
+  return isGoogleToolCombinationProvider(provider) && hasProviderTools && hasAgentTools;
+}
+
+function assertGoogleToolCombinationSupport(model: unknown): void {
+  if (!supportsGoogleToolCombination(model)) {
+    throw new Error(`{ "type": "${ErrorTypes.GOOGLE_TOOL_CONFLICT}"}`);
+  }
+}
+
+function enableGoogleServerSideToolInvocations({
+  agent,
+  llmConfig,
+}: {
+  agent: Agent;
+  llmConfig: Record<string, unknown>;
+}): void {
+  llmConfig.includeServerSideToolInvocations = true;
+  if (agent.model_parameters) {
+    (agent.model_parameters as Record<string, unknown>).includeServerSideToolInvocations = true;
+  }
+}
+
+function resolveProviderToolConflicts({
+  provider,
+  tools,
+  toolDefinitions,
+}: {
+  provider?: string;
+  tools?: unknown[];
+  toolDefinitions?: LCTool[];
+}): unknown[] | undefined {
+  if (!tools?.length) {
+    return tools;
+  }
+
+  if (!hasToolDefinition(toolDefinitions, Tools.web_search)) {
+    return tools;
+  }
+
+  const shouldRemoveTool = (tool: unknown): boolean => {
+    if (provider === Providers.ANTHROPIC) {
+      return getToolName(tool) === Tools.web_search;
+    }
+    if (provider === Providers.GOOGLE || provider === Providers.VERTEXAI) {
+      return hasGoogleSearchTool(tool);
+    }
+    return false;
+  };
+
+  let removed = 0;
+  const resolvedTools = tools.filter((tool) => {
+    const shouldRemove = shouldRemoveTool(tool);
+    if (shouldRemove) {
+      removed += 1;
+    }
+    return !shouldRemove;
+  });
+
+  if (removed > 0) {
+    logger.debug(
+      `[initializeAgent] Removed ${removed} ${provider} native web search tool(s); LibreChat web_search is enabled.`,
+    );
+  }
+
+  return resolvedTools;
+}
+
 /**
  * Extended agent type with additional fields needed after initialization
  */
 export type InitializedAgent = Agent & {
   tools: GenericTool[];
+  /** @deprecated use requestAttachments or agentContextAttachments based on sharing semantics. */
   attachments: IMongoFile[];
+  /** Files attached to the current user message/run and safe to share across run agents. */
+  requestAttachments: IMongoFile[];
+  /** Files attached to this agent's permanent context via tool_resources. */
+  agentContextAttachments: IMongoFile[];
   toolContextMap: Record<string, unknown>;
   dynamicToolContextMap?: Record<string, unknown>;
   maxContextTokens: number;
@@ -84,6 +247,10 @@ export type InitializedAgent = Agent & {
   toolMap?: ToolMap;
   /** Tool registry for PTC and tool search (only present when MCP tools with env classification exist) */
   toolRegistry?: LCToolRegistry;
+  /** Run-scoped MCP tool definitions for request-scoped servers. */
+  mcpAvailableTools?: Record<string, LCAvailableTools>;
+  /** Run-scoped MCP connections for request-scoped servers. */
+  requestScopedConnections?: RequestScopedMCPConnectionStore;
   /** Serializable tool definitions for event-driven execution */
   toolDefinitions?: LCTool[];
   /** Precomputed flag indicating if any tools have defer_loading enabled (for efficient runtime checks) */
@@ -92,6 +259,10 @@ export type InitializedAgent = Agent & {
   actionsEnabled?: boolean;
   /** Maximum characters allowed in a single tool result before truncation. */
   maxToolResultChars?: number;
+  /** Response field to read model reasoning from for custom OpenAI-compatible endpoints. */
+  reasoningKey?: ReasoningResponseKey;
+  /** Whether to reconstruct `reasoning_content` from persisted history across turns (custom endpoint opt-in). */
+  includeReasoningHistory?: boolean;
   /**
    * Whether the code-execution environment is available *for this agent*.
    * Narrower than the incoming `params.codeEnvAvailable` admin flag — this
@@ -104,6 +275,10 @@ export type InitializedAgent = Agent & {
    * (`packages/api/src/agents/added.ts`), so the check is uniform.
    */
   codeEnvAvailable: boolean;
+  /** Whether host-side skill file authoring is available for this agent/run. */
+  skillAuthoringAvailable: boolean;
+  /** Host-side file authoring tool names registered for this run. */
+  fileAuthoringToolNames?: Set<string>;
   /** Accessible skill IDs for ACL checking at execute time */
   accessibleSkillIds?: import('mongoose').Types.ObjectId[];
   /**
@@ -143,6 +318,13 @@ export type InitializedAgent = Agent & {
    * call #1 the sandbox can't see the files at all.
    */
   primedCodeFiles?: import('@librechat/agents').CodeEnvFile[];
+  /**
+   * Resolved token/pricing config for this agent's endpoint (admin static
+   * `tokenConfig` and/or fetched custom-endpoint config). Surfaced from the
+   * provider `getOptions` result so the AgentClient bills, prices, and resolves
+   * context limits with the same numbers the UI shows — not default rates.
+   */
+  endpointTokenConfig?: EndpointTokenConfig;
 };
 
 export const DEFAULT_MAX_CONTEXT_TOKENS = 32000;
@@ -181,6 +363,8 @@ export interface InitializeAgentParams {
     dynamicToolContextMap?: Record<string, unknown>;
     userMCPAuthMap?: Record<string, Record<string, string>>;
     toolRegistry?: LCToolRegistry;
+    mcpAvailableTools?: Record<string, LCAvailableTools>;
+    requestScopedConnections?: RequestScopedMCPConnectionStore;
     /** Serializable tool definitions for event-driven mode */
     toolDefinitions?: LCTool[];
     hasDeferredTools?: boolean;
@@ -202,6 +386,8 @@ export interface InitializeAgentParams {
   isInitialAgent?: boolean;
   /** Accessible skill IDs for this user (pre-computed by the caller via ACL query) */
   accessibleSkillIds?: import('mongoose').Types.ObjectId[];
+  /** Whether skill file authoring should be exposed even before a user has viewable skills. */
+  skillAuthoringAvailable?: boolean;
   /** Whether the code execution environment is available (execute_code capability enabled) */
   codeEnvAvailable?: boolean;
   /** Per-user skill active/inactive overrides for filtering the skill catalog. */
@@ -224,21 +410,33 @@ export interface InitializeAgentParams {
  */
 export interface InitializeAgentDbMethods extends EndpointDbMethods {
   /** Update usage tracking for multiple files */
-  updateFilesUsage: (files: Array<{ file_id: string }>, fileIds?: string[]) => Promise<unknown[]>;
+  updateFilesUsage: (
+    files: Array<{ file_id: string }>,
+    fileIds?: string[],
+    options?: { user?: string; tenantId?: string | null },
+  ) => Promise<unknown[]>;
   /** Get files from database */
   getFiles: (filter: unknown, sort: unknown, select: unknown) => Promise<unknown[]>;
   /** Filter files by agent access permissions (ownership or agent attachment) */
   filterFilesByAgentAccess?: TFilterFilesByAgentAccess;
   /** Get tool files by IDs (user-uploaded files only, code files handled separately) */
-  getToolFilesByIds: (fileIds: string[], toolSet: Set<EToolResources>) => Promise<unknown[]>;
+  getToolFilesByIds: (
+    fileIds: string[],
+    toolSet: Set<EToolResources>,
+    ownerScope?: FileOwnerScope,
+  ) => Promise<unknown[]>;
   /** Get conversation file IDs */
   getConvoFiles: (conversationId: string) => Promise<string[] | null>;
   /** Get code-generated files by conversation ID and the file_ids
    *  referenced from messages in the current thread (collected via
    *  `messages.files[].file_id` during thread walk). */
-  getCodeGeneratedFiles?: (conversationId: string, threadFileIds?: string[]) => Promise<unknown[]>;
+  getCodeGeneratedFiles?: (
+    conversationId: string,
+    threadFileIds?: string[],
+    ownerScope?: FileOwnerScope,
+  ) => Promise<unknown[]>;
   /** Get user-uploaded execute_code files by file IDs (from message.files in thread) */
-  getUserCodeFiles?: (fileIds: string[]) => Promise<unknown[]>;
+  getUserCodeFiles?: (fileIds: string[], ownerScope: FileOwnerScope) => Promise<unknown[]>;
   /** Get messages for a conversation (supports select for field projection) */
   getMessages?: (
     filter: { conversationId: string },
@@ -270,6 +468,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
        * by the manual-invocation resolver. Defaults to `true`.
        */
       userInvocable?: boolean;
+      /** True for deployment-directory skills that are loaded in memory. */
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -315,6 +515,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
      * caller can't bypass the popover-side filter.
      */
     userInvocable?: boolean;
+    /** True for deployment-directory skills that are loaded in memory. */
+    deployment?: boolean;
   } | null>;
   /**
    * Load accessible skills with `alwaysApply: true`, eagerly including
@@ -334,6 +536,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
       body: string;
       author: import('mongoose').Types.ObjectId;
       allowedTools?: string[];
+      /** True for deployment-directory skills that are loaded in memory. */
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -368,6 +572,10 @@ export async function initializeAgent(
     allowedProviders,
     isInitialAgent = false,
   } = params;
+  const requestFileOwnerId = req.user?.id;
+  const requestFileOwnerScope: FileOwnerScope | undefined = requestFileOwnerId
+    ? { userId: requestFileOwnerId, tenantId: req.user?.tenantId }
+    : undefined;
 
   if (!db) {
     throw new Error('initializeAgent requires db methods to be passed');
@@ -415,7 +623,13 @@ export async function initializeAgent(
       }
     }
 
-    const toolFiles = (await db.getToolFilesByIds(fileIds, toolResourceSet)) as IMongoFile[];
+    const toolFiles = requestFileOwnerScope
+      ? ((await db.getToolFilesByIds(
+          fileIds,
+          toolResourceSet,
+          requestFileOwnerScope,
+        )) as IMongoFile[])
+      : [];
 
     /**
      * Retrieve execute_code files filtered to the current thread.
@@ -456,23 +670,57 @@ export async function initializeAgent(
        *  which sibling first generated them — see `getCodeGeneratedFiles`
        *  for the branched-conversation rationale. */
       if (db.getCodeGeneratedFiles) {
-        codeGeneratedFiles = (await db.getCodeGeneratedFiles(
-          conversationId,
-          threadFileIds,
-        )) as IMongoFile[];
+        codeGeneratedFiles = requestFileOwnerScope
+          ? ((await db.getCodeGeneratedFiles(
+              conversationId,
+              threadFileIds,
+              requestFileOwnerScope,
+            )) as IMongoFile[])
+          : [];
       }
 
-      if (db.getUserCodeFiles && threadFileIds && threadFileIds.length > 0) {
-        userCodeFiles = (await db.getUserCodeFiles(threadFileIds)) as IMongoFile[];
+      if (
+        db.getUserCodeFiles &&
+        requestFileOwnerScope &&
+        threadFileIds &&
+        threadFileIds.length > 0
+      ) {
+        userCodeFiles = (await db.getUserCodeFiles(
+          threadFileIds,
+          requestFileOwnerScope,
+        )) as IMongoFile[];
       }
     }
 
     const allToolFiles = toolFiles.concat(codeGeneratedFiles, userCodeFiles);
     if (requestFiles.length || allToolFiles.length) {
-      currentFiles = (await db.updateFilesUsage(requestFiles.concat(allToolFiles))) as IMongoFile[];
+      const requestUsageFiles =
+        requestFiles.length && requestFileOwnerId
+          ? ((await db.updateFilesUsage(requestFiles, undefined, {
+              user: requestFileOwnerId,
+              tenantId: req.user?.tenantId,
+            })) as IMongoFile[])
+          : [];
+      const requestUsageFileIds = new Set(requestUsageFiles.map((file) => file.file_id));
+      const trustedToolFiles = allToolFiles.filter(
+        (file) => !requestUsageFileIds.has(file.file_id),
+      );
+      let toolUsageFiles: IMongoFile[] = [];
+      if (trustedToolFiles.length > 0 && requestFileOwnerId) {
+        toolUsageFiles = (await db.updateFilesUsage(trustedToolFiles, undefined, {
+          user: requestFileOwnerId,
+          tenantId: req.user?.tenantId,
+        })) as IMongoFile[];
+      }
+      currentFiles = requestUsageFiles.concat(toolUsageFiles);
     }
   } else if (requestFiles.length) {
-    currentFiles = (await db.updateFilesUsage(requestFiles)) as IMongoFile[];
+    currentFiles = requestFileOwnerId
+      ? ((await db.updateFilesUsage(requestFiles, undefined, {
+          user: requestFileOwnerId,
+          tenantId: req.user?.tenantId,
+        })) as IMongoFile[])
+      : [];
   }
 
   if (currentFiles && currentFiles.length) {
@@ -488,7 +736,12 @@ export async function initializeAgent(
     });
   }
 
-  const { attachments: primedAttachments, tool_resources } = await primeResources({
+  const {
+    attachments: primedAttachments,
+    requestAttachments: primedRequestAttachments,
+    agentContextAttachments: primedAgentContextAttachments,
+    tool_resources,
+  } = await primeResources({
     req: req as never,
     getFiles: db.getFiles as never,
     filterFiles: db.filterFilesByAgentAccess,
@@ -522,7 +775,8 @@ export async function initializeAgent(
    * go first so their names win on dedup (primes earlier in the list
    * contribute before the same name gets deduped on a later prime).
    */
-  const hasSkillAccess = params.accessibleSkillIds && params.accessibleSkillIds.length > 0;
+  const hasSkillAccess = (params.accessibleSkillIds?.length ?? 0) > 0;
+  const skillAuthoringAvailable = params.skillAuthoringAvailable === true;
   let manualSkillPrimes: ResolvedManualSkill[] | undefined;
   let alwaysApplySkillPrimes: ResolvedAlwaysApplySkill[] | undefined;
   let extraAllowedToolNames: string[] = [];
@@ -676,6 +930,8 @@ export async function initializeAgent(
     dynamicToolContextMap,
     userMCPAuthMap,
     toolDefinitions: loadedToolDefinitions,
+    mcpAvailableTools,
+    requestScopedConnections,
     hasDeferredTools,
     actionsEnabled,
     tools: structuredTools,
@@ -686,6 +942,8 @@ export async function initializeAgent(
     dynamicToolContextMap: {},
     userMCPAuthMap: undefined,
     toolRegistry: undefined,
+    mcpAvailableTools: undefined,
+    requestScopedConnections: undefined,
     toolDefinitions: [],
     hasDeferredTools: false,
     actionsEnabled: undefined,
@@ -790,9 +1048,9 @@ export async function initializeAgent(
    * never accidentally registers `bash_tool` or primes sandbox files
    * just because the admin globally enabled code execution.
    *
-   * Done BEFORE the `hasAgentTools` / GOOGLE_TOOL_CONFLICT gate so
-   * execute-code-only agents on Google/Vertex still trip the conflict
-   * guard when provider-specific tools are also configured. Also before
+   * Done before provider-tool merging so execute-code-only agents on
+   * Google/Vertex still surface as external function definitions when
+   * provider-specific tools are also configured. Also before
    * `injectSkillCatalog` so the skill path's own
    * `registerCodeExecutionTools` call upgrades `read_file` from the
    * code-only description to the skill-aware description without adding a
@@ -823,27 +1081,61 @@ export async function initializeAgent(
     );
   }
 
+  if (skillAuthoringAvailable) {
+    const skillReadResult = registerCodeExecutionTools({
+      toolRegistry,
+      toolDefinitions,
+      includeBash: false,
+      includeSkillFileInstructions: true,
+      enableToolOutputReferences: effectiveCodeEnvAvailable,
+    });
+    toolDefinitions = skillReadResult.toolDefinitions;
+  }
+
+  if (effectiveCodeEnvAvailable || skillAuthoringAvailable) {
+    const fileAuthoringResult = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions,
+      includeSkillFileInstructions: skillAuthoringAvailable,
+    });
+    toolDefinitions = fileAuthoringResult.toolDefinitions;
+  }
+
   /** Check for tool presence from either full instances or definitions (event-driven mode) */
   const hasAgentTools = (structuredTools?.length ?? 0) > 0 || (toolDefinitions?.length ?? 0) > 0;
+  const providerTools = resolveProviderToolConflicts({
+    provider: agent.provider,
+    tools: options.tools,
+    toolDefinitions,
+  });
+  const hasProviderTools = (providerTools?.length ?? 0) > 0;
 
-  let tools: GenericTool[] = options.tools?.length
-    ? (options.tools as GenericTool[])
+  let tools: GenericTool[] = hasProviderTools
+    ? (providerTools as GenericTool[])
     : (structuredTools ?? []);
 
-  if (
-    (agent.provider === Providers.GOOGLE || agent.provider === Providers.VERTEXAI) &&
-    options.tools?.length &&
-    hasAgentTools
-  ) {
-    throw new Error(`{ "type": "${ErrorTypes.GOOGLE_TOOL_CONFLICT}"}`);
+  if (isGoogleToolCombinationProvider(agent.provider) && hasProviderTools && hasAgentTools) {
+    assertGoogleToolCombinationSupport(llmConfig.model);
+    if (
+      shouldIncludeGoogleServerSideToolInvocations({
+        provider: agent.provider,
+        hasProviderTools,
+        hasAgentTools,
+      })
+    ) {
+      enableGoogleServerSideToolInvocations({ agent, llmConfig });
+    }
+    if (structuredTools?.length) {
+      tools = structuredTools.concat(providerTools as GenericTool[]);
+    }
   } else if (
     (agent.provider === Providers.OPENAI ||
       agent.provider === Providers.AZURE ||
       agent.provider === Providers.ANTHROPIC) &&
-    options.tools?.length &&
+    hasProviderTools &&
     structuredTools?.length
   ) {
-    tools = structuredTools.concat(options.tools as GenericTool[]);
+    tools = structuredTools.concat(providerTools as GenericTool[]);
   }
 
   agent.model_parameters = { ...options.llmConfig } as Agent['model_parameters'];
@@ -856,6 +1148,7 @@ export async function initializeAgent(
       text: agent.instructions,
       user: req.user ? (req.user as unknown as TUser) : null,
       now: req.conversationCreatedAt,
+      timezone: req.body?.timezone,
     });
     if (hasTemporalSpecialVars(agent.instructions)) {
       agent.instructions = undefined;
@@ -895,6 +1188,7 @@ export async function initializeAgent(
       userId: req.user?.id,
       skillStates: params.skillStates,
       defaultActiveOnShare: params.defaultActiveOnShare,
+      maxCatalogSkills: getMaxCatalogSkills(req),
     });
     toolDefinitions = skillResult.toolDefinitions;
     skillCount = skillResult.skillCount;
@@ -902,13 +1196,36 @@ export async function initializeAgent(
     activeSkillNames = skillResult.activeSkillNames;
   }
 
+  const hasFinalAgentTools =
+    (structuredTools?.length ?? 0) > 0 || (toolDefinitions?.length ?? 0) > 0;
+  if (isGoogleToolCombinationProvider(agent.provider) && hasProviderTools && hasFinalAgentTools) {
+    assertGoogleToolCombinationSupport(llmConfig.model);
+    if (
+      shouldIncludeGoogleServerSideToolInvocations({
+        provider: agent.provider,
+        hasProviderTools,
+        hasAgentTools: hasFinalAgentTools,
+      })
+    ) {
+      enableGoogleServerSideToolInvocations({ agent, llmConfig });
+    }
+  }
+
   const agentMaxContextNum = Number(agentMaxContextTokens) || DEFAULT_MAX_CONTEXT_TOKENS;
   const maxOutputTokensNum = Number(maxOutputTokens) || 0;
   const baseContextTokens = Math.max(0, agentMaxContextNum - maxOutputTokensNum);
 
-  const finalAttachments: IMongoFile[] = (primedAttachments ?? [])
-    .filter((a): a is TFile => a != null)
-    .map((a) => a as unknown as IMongoFile);
+  const toMongoFiles = (files: Array<TFile | undefined> | undefined): IMongoFile[] =>
+    (files ?? []).filter((a): a is TFile => a != null).map((a) => a as unknown as IMongoFile);
+
+  const finalAttachments: IMongoFile[] = toMongoFiles(primedAttachments);
+  const requestAttachments: IMongoFile[] = toMongoFiles(primedRequestAttachments);
+  const agentContextAttachments: IMongoFile[] = toMongoFiles(primedAgentContextAttachments);
+
+  const compatibilityAttachments =
+    finalAttachments.length > 0
+      ? finalAttachments
+      : requestAttachments.concat(agentContextAttachments);
 
   const endpointConfigs = req.config?.endpoints;
   const providerConfig =
@@ -922,11 +1239,18 @@ export async function initializeAgent(
       : undefined;
   const maxToolResultCharsResolved =
     providerMaxToolResultChars ?? endpointConfigs?.all?.maxToolResultChars;
+  const fileAuthoringToolNames = new Set(
+    (toolDefinitions ?? [])
+      .filter((toolDefinition) => isFileAuthoringToolDefinition(toolDefinition))
+      .map((toolDefinition) => toolDefinition.name),
+  );
 
   const initializedAgent: InitializedAgent = {
     ...agent,
     resendFiles,
     toolRegistry,
+    mcpAvailableTools,
+    requestScopedConnections,
     tool_resources,
     userMCPAuthMap,
     toolDefinitions,
@@ -934,12 +1258,18 @@ export async function initializeAgent(
     actionsEnabled,
     baseContextTokens,
     codeEnvAvailable: effectiveCodeEnvAvailable,
+    reasoningKey: customEndpointConfig?.customParams?.reasoningKey,
+    includeReasoningHistory: customEndpointConfig?.customParams?.includeReasoningHistory,
+    skillAuthoringAvailable,
+    fileAuthoringToolNames: fileAuthoringToolNames.size > 0 ? fileAuthoringToolNames : undefined,
     skillCount,
     accessibleSkillIds: executableSkillIds,
     activeSkillNames,
     manualSkillPrimes,
     alwaysApplySkillPrimes,
-    attachments: finalAttachments,
+    attachments: compatibilityAttachments,
+    requestAttachments,
+    agentContextAttachments,
     toolContextMap: toolContextMap ?? {},
     dynamicToolContextMap: dynamicToolContextMap ?? {},
     useLegacyContent: !!options.useLegacyContent,
@@ -950,6 +1280,7 @@ export async function initializeAgent(
         ? maxContextTokens
         : Math.max(1024, Math.round(baseContextTokens * (1 - DEFAULT_RESERVE_RATIO))),
     primedCodeFiles,
+    endpointTokenConfig: options.endpointTokenConfig,
   };
 
   return initializedAgent;
diff --git a/packages/api/src/agents/load.ts b/packages/api/src/agents/load.ts
index 05746d1195f..dfd741428e2 100644
--- a/packages/api/src/agents/load.ts
+++ b/packages/api/src/agents/load.ts
@@ -1,5 +1,4 @@
 import { logger } from '@librechat/data-schemas';
-import type { AppConfig } from '@librechat/data-schemas';
 import {
   Tools,
   Constants,
@@ -13,9 +12,12 @@ import type {
   TModelSpec,
   Agent,
 } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { requiresEphemeralUserConnection } from '~/mcp/utils';
 import { getCustomEndpointConfig } from '~/app/config';
 
 const { mcp_all, mcp_delimiter } = Constants;
+type ModelParametersWithPromptPrefix = AgentModelParameters & { promptPrefix?: string | null };
 
 export interface LoadAgentDeps {
   getAgent: (searchParameter: { id: string }) => Promise<Agent | null>;
@@ -78,7 +80,13 @@ export async function loadEphemeralAgent(
       if (addedServers.has(mcpServer)) {
         continue;
       }
-      const serverTools = await deps.getMCPServerTools(userId, mcpServer);
+      /** Request-tier overlays are invisible to the cache service's registry
+       *  resolver — overlay-scoped servers expand fresh via `mcp_all` instead */
+      const overlayConfig = req.config?.mcpConfig?.[mcpServer];
+      const serverTools =
+        overlayConfig && requiresEphemeralUserConnection(overlayConfig)
+          ? null
+          : await deps.getMCPServerTools(userId, mcpServer);
       if (!serverTools) {
         tools.push(`${mcp_all}${mcp_delimiter}${mcpServer}`);
         addedServers.add(mcpServer);
@@ -89,7 +97,11 @@ export async function loadEphemeralAgent(
     }
   }
 
-  const instructions = req.body?.promptPrefix;
+  const requestPromptPrefix = req.body?.promptPrefix;
+  const { promptPrefix: modelPromptPrefix, ...safeModelParameters } =
+    model_parameters as ModelParametersWithPromptPrefix;
+  const instructions =
+    typeof modelPromptPrefix === 'string' ? modelPromptPrefix : requestPromptPrefix;
 
   // Get endpoint config for modelDisplayLabel fallback
   const appConfig = req.config;
@@ -122,7 +134,7 @@ export async function loadEphemeralAgent(
     id: ephemeralId,
     instructions,
     provider: endpoint,
-    model_parameters,
+    model_parameters: safeModelParameters as AgentModelParameters,
     model,
     tools,
   };
@@ -130,6 +142,20 @@ export async function loadEphemeralAgent(
   if (ephemeralAgent?.artifacts) {
     result.artifacts = ephemeralAgent.artifacts;
   }
+  if (modelSpec?.subagents) {
+    result.subagents = modelSpec.subagents;
+  }
+  if (modelSpec && Object.prototype.hasOwnProperty.call(modelSpec, 'skills')) {
+    if (modelSpec.skills === true) {
+      result.skills_enabled = true;
+    } else if (modelSpec.skills === false) {
+      result.skills_enabled = false;
+      result.skills = [];
+    } else if (Array.isArray(modelSpec.skills)) {
+      result.skills_enabled = true;
+      result.skills = [];
+    }
+  }
   return result as Agent;
 }
 
diff --git a/packages/api/src/agents/memory.spec.ts b/packages/api/src/agents/memory.spec.ts
index 622bc970d18..699d01017a8 100644
--- a/packages/api/src/agents/memory.spec.ts
+++ b/packages/api/src/agents/memory.spec.ts
@@ -27,12 +27,34 @@ const mockResolveHeaders = jest.fn((opts) => {
   return result;
 });
 
+type HeaderCarrier = { defaultHeaders?: Record<string, string> };
+const mockResolveConfigHeaders = jest.fn(
+  (opts: {
+    llmConfig?: { configuration?: HeaderCarrier; clientOptions?: HeaderCarrier };
+    user?: { id?: string; email?: string };
+  }) => {
+    const cfg = opts?.llmConfig;
+    if (cfg?.configuration?.defaultHeaders != null) {
+      cfg.configuration.defaultHeaders = mockResolveHeaders({
+        headers: cfg.configuration.defaultHeaders,
+        user: opts.user,
+      });
+    }
+    if (cfg?.clientOptions?.defaultHeaders != null) {
+      cfg.clientOptions.defaultHeaders = mockResolveHeaders({
+        headers: cfg.clientOptions.defaultHeaders,
+        user: opts.user,
+      });
+    }
+  },
+);
+
 jest.mock('~/utils', () => ({
   Tokenizer: {
     getTokenCount: jest.fn(() => 10),
   },
   createSafeUser: (user: unknown) => mockCreateSafeUser(user),
-  resolveHeaders: (opts: unknown) => mockResolveHeaders(opts),
+  resolveConfigHeaders: (opts: unknown) => mockResolveConfigHeaders(opts as never),
 }));
 
 const { createSafeUser } = jest.requireMock('~/utils');
diff --git a/packages/api/src/agents/memory.ts b/packages/api/src/agents/memory.ts
index d47ab2bf6e6..feecb6ab4fb 100644
--- a/packages/api/src/agents/memory.ts
+++ b/packages/api/src/agents/memory.ts
@@ -18,8 +18,9 @@ import type { DynamicStructuredTool } from '@librechat/agents/langchain/tools';
 import type { ObjectId, MemoryMethods, IUser } from '@librechat/data-schemas';
 import type { TAttachment, MemoryArtifact } from 'librechat-data-provider';
 import type { Response as ServerResponse } from 'express';
+import type { RunLLMConfig } from '~/types';
 import { GenerationJobManager } from '~/stream/GenerationJobManager';
-import { resolveHeaders, createSafeUser } from '~/utils';
+import { resolveConfigHeaders, createSafeUser } from '~/utils';
 import Tokenizer from '~/utils/tokenizer';
 
 type RequiredMemoryMethods = Pick<
@@ -355,6 +356,7 @@ ${memory ?? 'No existing memories'}`;
     const finalLLMConfig = {
       ...defaultLLMConfig,
       ...normalizeMemoryLLMConfig(llmConfig),
+      maxRetries: 0,
       /**
        * Ensure streaming is always disabled for memory processing
        */
@@ -404,13 +406,17 @@ ${memory ?? 'No existing memories'}`;
       delete (finalLLMConfig as Record<string, unknown>).temperature;
     }
 
-    const llmConfigWithHeaders = finalLLMConfig as OpenAIClientOptions;
-    if (llmConfigWithHeaders?.configuration?.defaultHeaders != null) {
-      llmConfigWithHeaders.configuration.defaultHeaders = resolveHeaders({
-        headers: llmConfigWithHeaders.configuration.defaultHeaders as Record<string, string>,
-        user: user ? createSafeUser(user) : undefined,
-      });
-    }
+    /**
+     * Resolve request-based headers across provider-specific carriers (OpenAI
+     * `configuration.defaultHeaders`, native Anthropic `clientOptions.defaultHeaders`)
+     * so gateway-fronted built-in providers receive resolved metadata/auth headers
+     * on memory extraction too. Native Google headers are resolved at init.
+     */
+    resolveConfigHeaders({
+      llmConfig: finalLLMConfig as unknown as RunLLMConfig,
+      user: user ? createSafeUser(user) : undefined,
+      body: { conversationId, messageId },
+    });
 
     const artifactPromises: Promise<TAttachment | null>[] = [];
     const memoryCallback = createMemoryCallback({ res, artifactPromises, streamId });
diff --git a/packages/api/src/agents/openai/service.spec.ts b/packages/api/src/agents/openai/service.spec.ts
new file mode 100644
index 00000000000..542ea54b6a6
--- /dev/null
+++ b/packages/api/src/agents/openai/service.spec.ts
@@ -0,0 +1,107 @@
+import { createAgentChatCompletion } from './service';
+import type { ChatCompletionDependencies } from './service';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    debug: jest.fn(),
+    error: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+  },
+}));
+
+type CreateRunArgs = { user?: Record<string, unknown> };
+type ProcessStreamConfig = { configurable?: Record<string, unknown> };
+
+function createMockReq(user?: Record<string, unknown>) {
+  return {
+    body: {
+      model: 'agent_test',
+      messages: [{ role: 'user', content: 'hi' }],
+      stream: false,
+    },
+    user,
+    on: jest.fn(),
+  } as unknown as Parameters<typeof createAgentChatCompletion>[0];
+}
+
+function createMockRes() {
+  const res: Record<string, unknown> = {
+    setHeader: jest.fn(),
+    flushHeaders: jest.fn(),
+    write: jest.fn(),
+    end: jest.fn(),
+    headersSent: false,
+  };
+  res.status = jest.fn(() => res);
+  res.json = jest.fn(() => res);
+  return res as unknown as Parameters<typeof createAgentChatCompletion>[1];
+}
+
+describe('createAgentChatCompletion - MCP permission user propagation', () => {
+  let createRun: jest.Mock;
+  let processStream: jest.Mock;
+  let deps: ChatCompletionDependencies;
+
+  beforeEach(() => {
+    processStream = jest.fn().mockResolvedValue(undefined);
+    createRun = jest.fn().mockResolvedValue({ processStream });
+
+    deps = {
+      getAgent: jest.fn().mockResolvedValue({
+        id: 'agent_test',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        tools: [],
+      }),
+      initializeAgent: jest.fn().mockResolvedValue({
+        id: 'agent_test',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        tools: [],
+        attachments: [],
+        toolContextMap: {},
+        maxContextTokens: 1000,
+        model_parameters: {},
+      }),
+      createRun: createRun as unknown as ChatCompletionDependencies['createRun'],
+    };
+  });
+
+  it('forwards the role-bearing safe user to createRun and configurable.user', async () => {
+    const req = createMockReq({
+      id: 'user-123',
+      role: 'ADMIN',
+      email: 'admin@example.com',
+      password: 'secret',
+    });
+
+    await createAgentChatCompletion(req, createMockRes(), deps);
+
+    expect(createRun).toHaveBeenCalledTimes(1);
+    const runArgs = createRun.mock.calls[0][0] as CreateRunArgs;
+    expect(runArgs.user).toMatchObject({ id: 'user-123', role: 'ADMIN' });
+    // createSafeUser must strip sensitive fields.
+    expect(runArgs.user).not.toHaveProperty('password');
+
+    expect(processStream).toHaveBeenCalledTimes(1);
+    const streamConfig = processStream.mock.calls[0][1] as ProcessStreamConfig;
+    expect(streamConfig.configurable?.user).toMatchObject({ id: 'user-123', role: 'ADMIN' });
+    expect(streamConfig.configurable?.user_id).toBe('user-123');
+  });
+
+  it('falls back to a bare id when no authenticated user is attached', async () => {
+    const req = createMockReq(undefined);
+
+    await createAgentChatCompletion(req, createMockRes(), deps);
+
+    expect(createRun).toHaveBeenCalledTimes(1);
+    const runArgs = createRun.mock.calls[0][0] as CreateRunArgs;
+    expect(runArgs.user).toEqual({ id: 'api-user' });
+
+    const streamConfig = processStream.mock.calls[0][1] as ProcessStreamConfig;
+    // No role present → the runtime MCP check fails closed.
+    expect(streamConfig.configurable?.user).toEqual({ id: 'api-user' });
+    expect(streamConfig.configurable?.user).not.toHaveProperty('role');
+  });
+});
diff --git a/packages/api/src/agents/openai/service.ts b/packages/api/src/agents/openai/service.ts
index 0d637f7a501..22b06226dda 100644
--- a/packages/api/src/agents/openai/service.ts
+++ b/packages/api/src/agents/openai/service.ts
@@ -31,6 +31,7 @@ import type {
   ToolCall,
 } from './types';
 import type { OpenAIStreamHandlerConfig, EventHandler } from './handlers';
+import type { ToolExecuteOptions } from '../handlers';
 import {
   createOpenAIContentAggregator,
   createOpenAIStreamTracker,
@@ -39,7 +40,7 @@ import {
   createChunk,
   writeSSE,
 } from './handlers';
-import type { ToolExecuteOptions } from '../handlers';
+import { createSafeUser } from '~/utils';
 
 /**
  * Dependencies for the chat completion service
@@ -174,6 +175,7 @@ type CreateRunFn = (params: {
   customHandlers: Record<string, EventHandler>;
   requestBody: Record<string, unknown>;
   user: Record<string, unknown>;
+  tenantId?: string;
   tokenCounter?: (message: unknown) => number;
 }) => Promise<{
   Graph?: unknown;
@@ -500,7 +502,17 @@ export async function createAgentChatCompletion(
 
     // Create and run the agent
     if (deps.createRun) {
-      const userId = (req as unknown as { user?: { id?: string } }).user?.id ?? 'api-user';
+      const reqUser = (req as unknown as { user?: Parameters<typeof createSafeUser>[0] }).user;
+      const userId = reqUser?.id ?? 'api-user';
+      /**
+       * Propagate the full safe user (id + role), matching the in-repo agent
+       * controllers (responses.js / openai.js). The runtime MCP permission
+       * check reads `configurable.user`; passing only `user_id` would make
+       * every MCP tool call fail closed for an authenticated caller. When the
+       * host app didn't attach a user, this falls back to a bare id, which
+       * correctly leaves MCP gated.
+       */
+      const safeUser: Record<string, unknown> = { ...createSafeUser(reqUser), id: userId };
 
       const run = await deps.createRun({
         agents: [initializedAgent],
@@ -512,7 +524,8 @@ export async function createAgentChatCompletion(
           messageId: requestId,
           conversationId,
         },
-        user: { id: userId },
+        user: safeUser,
+        tenantId: typeof reqUser?.tenantId === 'string' ? reqUser.tenantId : undefined,
       });
 
       if (run) {
@@ -523,6 +536,7 @@ export async function createAgentChatCompletion(
             configurable: {
               thread_id: conversationId,
               user_id: userId,
+              user: safeUser,
             },
             signal: abortController.signal,
             streamMode: 'values',
diff --git a/packages/api/src/agents/resources.test.ts b/packages/api/src/agents/resources.test.ts
index 718e5cbdec7..04849a51774 100644
--- a/packages/api/src/agents/resources.test.ts
+++ b/packages/api/src/agents/resources.test.ts
@@ -84,6 +84,8 @@ describe('primeResources', () => {
         agentId: 'agent_test',
       });
       expect(result.attachments).toEqual(mockOcrFiles);
+      expect(result.agentContextAttachments).toEqual(mockOcrFiles);
+      expect(result.requestAttachments).toBeUndefined();
       expect(result.tool_resources).toEqual({});
     });
   });
@@ -423,6 +425,8 @@ describe('primeResources', () => {
       expect(result.attachments).toHaveLength(2);
       expect(result.attachments?.[0]?.file_id).toBe('ocr-file-1');
       expect(result.attachments?.[1]?.file_id).toBe('file1');
+      expect(result.agentContextAttachments).toEqual(mockOcrFiles);
+      expect(result.requestAttachments).toEqual(mockAttachmentFiles);
     });
 
     it('should include both context (as `ocr` resource) files and attachment files', async () => {
@@ -475,6 +479,8 @@ describe('primeResources', () => {
       expect(result.attachments).toHaveLength(2);
       expect(result.attachments?.[0]?.file_id).toBe('ocr-file-1');
       expect(result.attachments?.[1]?.file_id).toBe('file1');
+      expect(result.agentContextAttachments).toEqual(mockOcrFiles);
+      expect(result.requestAttachments).toEqual(mockAttachmentFiles);
     });
 
     it('should prevent duplicate files when same file exists in context tool_resource and attachments', async () => {
@@ -528,6 +534,8 @@ describe('primeResources', () => {
       expect(result.attachments).toHaveLength(2);
       expect(result.attachments?.filter((f) => f?.file_id === 'shared-file-id')).toHaveLength(1);
       expect(result.attachments?.find((f) => f?.file_id === 'unique-file')).toBeDefined();
+      expect(result.agentContextAttachments).toEqual(mockOcrFiles);
+      expect(result.requestAttachments).toEqual(mockAttachmentFiles);
     });
 
     it('should still categorize duplicate files for tool_resources', async () => {
diff --git a/packages/api/src/agents/resources.ts b/packages/api/src/agents/resources.ts
index 56cd9b6c0d4..47239e54bbf 100644
--- a/packages/api/src/agents/resources.ts
+++ b/packages/api/src/agents/resources.ts
@@ -174,8 +174,12 @@ export const primeResources = async ({
   agentId?: string;
 }): Promise<{
   attachments: Array<TFile | undefined> | undefined;
+  requestAttachments: Array<TFile | undefined> | undefined;
+  agentContextAttachments: Array<TFile | undefined> | undefined;
   tool_resources: AgentToolResources | undefined;
 }> => {
+  const requestAttachments: Array<TFile> = [];
+  const agentContextAttachments: Array<TFile> = [];
   try {
     /**
      * Array to collect all unique files that will be returned as attachments
@@ -269,6 +273,7 @@ export const primeResources = async ({
 
         // Add to attachments
         attachments.push(file);
+        agentContextAttachments.push(file);
         attachmentFileIds.add(file.file_id);
 
         // Categorize for tool resources
@@ -282,10 +287,17 @@ export const primeResources = async ({
     }
 
     if (!_attachments) {
-      return { attachments: attachments.length > 0 ? attachments : undefined, tool_resources };
+      return {
+        attachments: attachments.length > 0 ? attachments : undefined,
+        requestAttachments: undefined,
+        agentContextAttachments:
+          agentContextAttachments.length > 0 ? agentContextAttachments : undefined,
+        tool_resources,
+      };
     }
 
     const files = await _attachments;
+    const requestAttachmentFileIds = new Set<string>();
 
     for (const file of files) {
       if (!file) {
@@ -300,16 +312,30 @@ export const primeResources = async ({
       });
 
       if (file.file_id && attachmentFileIds.has(file.file_id)) {
+        if (!requestAttachmentFileIds.has(file.file_id)) {
+          requestAttachments.push(file);
+          requestAttachmentFileIds.add(file.file_id);
+        }
         continue;
       }
 
       attachments.push(file);
+      if (!file.file_id || !requestAttachmentFileIds.has(file.file_id)) {
+        requestAttachments.push(file);
+      }
       if (file.file_id) {
         attachmentFileIds.add(file.file_id);
+        requestAttachmentFileIds.add(file.file_id);
       }
     }
 
-    return { attachments: attachments.length > 0 ? attachments : [], tool_resources };
+    return {
+      attachments: attachments.length > 0 ? attachments : [],
+      requestAttachments,
+      agentContextAttachments:
+        agentContextAttachments.length > 0 ? agentContextAttachments : undefined,
+      tool_resources,
+    };
   } catch (error) {
     logger.error('Error priming resources', error);
 
@@ -328,6 +354,9 @@ export const primeResources = async ({
 
     return {
       attachments: safeAttachments,
+      requestAttachments: safeAttachments,
+      agentContextAttachments:
+        agentContextAttachments.length > 0 ? agentContextAttachments : undefined,
       tool_resources: _tool_resources,
     };
   }
diff --git a/packages/api/src/agents/run.spec.ts b/packages/api/src/agents/run.spec.ts
index 59f8959f393..0900e445188 100644
--- a/packages/api/src/agents/run.spec.ts
+++ b/packages/api/src/agents/run.spec.ts
@@ -1,7 +1,13 @@
 import { Providers } from '@librechat/agents';
+import { ReasoningResponseKey } from 'librechat-data-provider';
 import { ToolMessage, AIMessage, HumanMessage } from '@librechat/agents/langchain/messages';
-
-import { extractDiscoveredToolsFromHistory, getReasoningKey } from './run';
+import {
+  extractDiscoveredToolsFromHistory,
+  getReasoningKey,
+  isDeepSeekReasoningProvider,
+  shouldReplayReasoningContent,
+  anyAgentReplaysReasoningContent,
+} from './run';
 
 describe('extractDiscoveredToolsFromHistory', () => {
   it('extracts tool names from tool_search JSON output', () => {
@@ -146,4 +152,219 @@ describe('getReasoningKey', () => {
 
     expect(reasoningKey).toBe('reasoning');
   });
+
+  it('keeps Vercel AI Gateway on ChatOpenAI normalized reasoning_content', () => {
+    const llmConfig = {
+      configuration: {
+        baseURL: 'https://ai-gateway.vercel.sh/v1',
+      },
+    } as Parameters<typeof getReasoningKey>[1];
+
+    const reasoningKey = getReasoningKey(Providers.OPENAI, llmConfig);
+
+    expect(reasoningKey).toBe('reasoning_content');
+  });
+
+  it('keeps Vercel custom endpoint names on ChatOpenAI normalized reasoning_content', () => {
+    const llmConfig = {} as Parameters<typeof getReasoningKey>[1];
+
+    const reasoningKey = getReasoningKey(Providers.OPENAI, llmConfig, 'Vercel');
+
+    expect(reasoningKey).toBe('reasoning_content');
+  });
+
+  it('uses explicit reasoning response keys for Vercel when configured', () => {
+    const llmConfig = {
+      configuration: {
+        baseURL: 'https://ai-gateway.vercel.sh/v1',
+      },
+    } as Parameters<typeof getReasoningKey>[1];
+
+    const reasoningKey = getReasoningKey(
+      Providers.OPENAI,
+      llmConfig,
+      'Vercel',
+      ReasoningResponseKey.reasoning,
+    );
+
+    expect(reasoningKey).toBe('reasoning');
+  });
+
+  it('uses explicit reasoning response keys for otherwise default OpenAI-compatible endpoints', () => {
+    const llmConfig = {} as Parameters<typeof getReasoningKey>[1];
+
+    const reasoningKey = getReasoningKey(
+      Providers.OPENAI,
+      llmConfig,
+      'Company Gateway',
+      ReasoningResponseKey.reasoning,
+    );
+
+    expect(reasoningKey).toBe('reasoning');
+  });
+});
+
+describe('isDeepSeekReasoningProvider', () => {
+  it('returns true for the direct deepseek provider regardless of model', () => {
+    expect(isDeepSeekReasoningProvider(Providers.DEEPSEEK)).toBe(true);
+    expect(isDeepSeekReasoningProvider(Providers.DEEPSEEK, 'deepseek-chat')).toBe(true);
+    expect(isDeepSeekReasoningProvider(Providers.DEEPSEEK, 'unrelated')).toBe(true);
+  });
+
+  it('returns true for openrouter when the model id is namespaced deepseek', () => {
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, 'deepseek/deepseek-v4-pro')).toBe(
+      true,
+    );
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, 'DeepSeek/DeepSeek-V4')).toBe(true);
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, 'deepseek-r1')).toBe(true);
+  });
+
+  it("strips OpenRouter's `~` latest-routing prefix before matching", () => {
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, '~deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, '~deepseek/r1')).toBe(true);
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, '~deepseek-chat')).toBe(true);
+  });
+
+  it('matches the provider string case-insensitively (custom endpoint names)', () => {
+    expect(isDeepSeekReasoningProvider('OpenRouter', 'deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider('OPENROUTER', 'deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider('DeepSeek')).toBe(true);
+  });
+
+  it('matches custom-named endpoints and direct DeepSeek-compatible proxies via the fallback', () => {
+    expect(isDeepSeekReasoningProvider('openai', 'deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider('MyCustomEndpoint', '~deepseek/r1')).toBe(true);
+    expect(isDeepSeekReasoningProvider(undefined, 'deepseek/deepseek-chat')).toBe(true);
+    expect(isDeepSeekReasoningProvider(null, 'deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider('', 'deepseek/deepseek-v4')).toBe(true);
+    expect(isDeepSeekReasoningProvider('openai', 'deepseek-chat')).toBe(true);
+    expect(isDeepSeekReasoningProvider('MyDeepSeekProxy', 'deepseek-reasoner')).toBe(true);
+    expect(isDeepSeekReasoningProvider(undefined, 'deepseek-r1')).toBe(true);
+    expect(isDeepSeekReasoningProvider(undefined, '~deepseek-chat')).toBe(true);
+  });
+
+  it('returns false for openrouter with non-deepseek models', () => {
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, 'anthropic/claude-opus-4-7')).toBe(
+      false,
+    );
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, 'openai/gpt-5')).toBe(false);
+    expect(
+      isDeepSeekReasoningProvider(Providers.OPENROUTER, 'meta-llama/llama-3.1-70b-instruct'),
+    ).toBe(false);
+  });
+
+  it('returns false when the model is missing on openrouter', () => {
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER)).toBe(false);
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, null)).toBe(false);
+    expect(isDeepSeekReasoningProvider(Providers.OPENROUTER, '')).toBe(false);
+  });
+
+  it('returns false for nullish provider input without a DeepSeek-prefixed model', () => {
+    expect(isDeepSeekReasoningProvider(undefined, 'gpt-5')).toBe(false);
+    expect(isDeepSeekReasoningProvider(null, 'claude-opus-4-7')).toBe(false);
+    expect(isDeepSeekReasoningProvider('', 'gemini-2.5-pro')).toBe(false);
+  });
+
+  it('does not match cloned/distilled slugs that merely contain "deepseek" later in the id', () => {
+    expect(
+      isDeepSeekReasoningProvider(Providers.OPENROUTER, 'community/not-a-deepseek-clone'),
+    ).toBe(false);
+    expect(
+      isDeepSeekReasoningProvider(Providers.OPENROUTER, 'mistral/deepseek-distilled-foo'),
+    ).toBe(false);
+    expect(isDeepSeekReasoningProvider(undefined, 'community/deepseek-r1')).toBe(false);
+  });
+});
+
+describe('shouldReplayReasoningContent', () => {
+  it('returns true when a custom endpoint opts in via includeReasoningHistory', () => {
+    expect(
+      shouldReplayReasoningContent({
+        provider: Providers.OPENAI,
+        model_parameters: { model: 'MiMo-V2.5' },
+        includeReasoningHistory: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('returns true for DeepSeek reasoning agents without the flag', () => {
+    expect(
+      shouldReplayReasoningContent({
+        provider: Providers.DEEPSEEK,
+        model_parameters: { model: 'deepseek-chat' },
+      }),
+    ).toBe(true);
+    expect(
+      shouldReplayReasoningContent({
+        provider: Providers.OPENROUTER,
+        model_parameters: { model: 'deepseek/deepseek-v4-pro' },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns false for a non-DeepSeek agent that has not opted in', () => {
+    expect(
+      shouldReplayReasoningContent({
+        provider: Providers.OPENAI,
+        model_parameters: { model: 'MiMo-V2.5' },
+      }),
+    ).toBe(false);
+    expect(
+      shouldReplayReasoningContent({
+        provider: Providers.OPENAI,
+        model_parameters: { model: 'MiMo-V2.5' },
+        includeReasoningHistory: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false for nullish agents', () => {
+    expect(shouldReplayReasoningContent(null)).toBe(false);
+    expect(shouldReplayReasoningContent(undefined)).toBe(false);
+  });
+});
+
+describe('anyAgentReplaysReasoningContent', () => {
+  const plainAgent = (id: string, extra = {}) =>
+    ({
+      id,
+      provider: Providers.OPENAI,
+      model_parameters: { model: 'MiMo-V2.5' },
+      ...extra,
+    }) as unknown as Parameters<typeof anyAgentReplaysReasoningContent>[0][number];
+
+  it('returns true when the primary agent opts in', () => {
+    expect(
+      anyAgentReplaysReasoningContent([plainAgent('a', { includeReasoningHistory: true })]),
+    ).toBe(true);
+  });
+
+  it('returns true when only a nested subagent opts in', () => {
+    const subagent = plainAgent('child', { includeReasoningHistory: true });
+    const primary = plainAgent('root', {
+      subagentAgentConfigs: [plainAgent('mid', { subagentAgentConfigs: [subagent] })],
+    });
+    expect(anyAgentReplaysReasoningContent([primary])).toBe(true);
+  });
+
+  it('returns false when no reachable agent opts in', () => {
+    const primary = plainAgent('root', {
+      subagentAgentConfigs: [plainAgent('child')],
+    });
+    expect(anyAgentReplaysReasoningContent([primary, null, undefined])).toBe(false);
+  });
+
+  it('is cycle-safe across subagent references', () => {
+    const a = plainAgent('a');
+    const b = plainAgent('b', { includeReasoningHistory: true });
+    (a as { subagentAgentConfigs?: unknown[] }).subagentAgentConfigs = [b];
+    (b as { subagentAgentConfigs?: unknown[] }).subagentAgentConfigs = [a];
+    expect(anyAgentReplaysReasoningContent([a])).toBe(true);
+
+    const x = plainAgent('x');
+    const y = plainAgent('y');
+    (x as { subagentAgentConfigs?: unknown[] }).subagentAgentConfigs = [y];
+    (y as { subagentAgentConfigs?: unknown[] }).subagentAgentConfigs = [x];
+    expect(anyAgentReplaysReasoningContent([x])).toBe(false);
+  });
 });
diff --git a/packages/api/src/agents/run.ts b/packages/api/src/agents/run.ts
index d90a623d27a..a0d0f548e8d 100644
--- a/packages/api/src/agents/run.ts
+++ b/packages/api/src/agents/run.ts
@@ -2,6 +2,7 @@ import { logger } from '@librechat/data-schemas';
 import { Run, Providers, Constants } from '@librechat/agents';
 import {
   KnownEndpoints,
+  EModelEndpoint,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_RUN_CONFIGS,
   extractEnvVariable,
@@ -26,14 +27,20 @@ import type {
   Agent,
   AgentModelParameters,
   AgentSubagentsConfig,
+  ReasoningResponseKey,
   SummarizationConfig,
 } from 'librechat-data-provider';
 import type { BaseMessage } from '@librechat/agents/langchain/messages';
 import type { AppConfig, IUser } from '@librechat/data-schemas';
+import type { SubagentUsageEvent } from '~/agents/usage';
 import type * as t from '~/types';
+import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm';
 import { getProviderConfig } from '~/endpoints/config/providers';
+import { extractDefaultParams } from '~/endpoints/openai/llm';
 import { resolveHeaders, createSafeUser } from '~/utils/env';
 import { getOpenAIConfig } from '~/endpoints/openai/config';
+import { resolveConfigHeaders } from '~/utils/headers';
+import { applyTestRunHook } from '~/agents/testHook';
 import { isUserProvided } from '~/utils/common';
 
 /** Expected shape of JSON tool search results */
@@ -212,6 +219,8 @@ const customProviders = new Set([
   KnownEndpoints.ollama,
 ]);
 
+type AgentReasoningKey = 'reasoning_content' | 'reasoning';
+
 function includesOpenRouter(value?: string | null): boolean {
   return typeof value === 'string' && value.toLowerCase().includes(KnownEndpoints.openrouter);
 }
@@ -220,8 +229,13 @@ export function getReasoningKey(
   provider: Providers,
   llmConfig: t.RunLLMConfig,
   agentEndpoint?: string | null,
-): 'reasoning_content' | 'reasoning' {
-  let reasoningKey: 'reasoning_content' | 'reasoning' = 'reasoning_content';
+  customReasoningKey?: ReasoningResponseKey,
+): AgentReasoningKey {
+  if (customReasoningKey) {
+    return customReasoningKey as AgentReasoningKey;
+  }
+
+  let reasoningKey: AgentReasoningKey = 'reasoning_content';
   if (provider === Providers.GOOGLE) {
     reasoningKey = 'reasoning';
   } else if (
@@ -238,6 +252,61 @@ export function getReasoningKey(
   return reasoningKey;
 }
 
+const DEEPSEEK_MODEL_PATTERN = /^deepseek(?:[-/]|$)/i;
+const OPENROUTER_LATEST_ROUTING_PREFIX = /^~/;
+
+function matchesDeepSeekModel(model?: string | null): boolean {
+  if (typeof model !== 'string' || model.length === 0) {
+    return false;
+  }
+  return DEEPSEEK_MODEL_PATTERN.test(model.replace(OPENROUTER_LATEST_ROUTING_PREFIX, ''));
+}
+
+/**
+ * Whether the (provider, model) pair targets DeepSeek's thinking-mode
+ * tool-calling contract, which requires `reasoning_content` to be replayed
+ * on every prior assistant message that emitted `tool_calls`.
+ * @see https://api-docs.deepseek.com/guides/thinking_mode#tool-calls
+ */
+export function isDeepSeekReasoningProvider(
+  provider: string | Providers | undefined | null,
+  model?: string | null,
+): boolean {
+  if (typeof provider === 'string' && provider.length > 0) {
+    const normalized = provider.toLowerCase();
+    if (normalized === Providers.DEEPSEEK) {
+      return true;
+    }
+    if (normalized === Providers.OPENROUTER) {
+      return matchesDeepSeekModel(model);
+    }
+  }
+  return matchesDeepSeekModel(model);
+}
+
+/**
+ * Whether prior assistant tool-call messages should have `reasoning_content`
+ * reconstructed when reformatting persisted history (cross-turn replay): either
+ * DeepSeek thinking-mode (#13366) or a custom OpenAI-compatible endpoint that
+ * opted in via `customParams.includeReasoningHistory` (e.g. Xiaomi MiMo, Kimi).
+ */
+export function shouldReplayReasoningContent(
+  agent?: {
+    provider?: string | Providers | null;
+    model?: string | null;
+    model_parameters?: { model?: string | null } | null;
+    includeReasoningHistory?: boolean | null;
+  } | null,
+): boolean {
+  if (agent == null) {
+    return false;
+  }
+  if (agent.includeReasoningHistory === true) {
+    return true;
+  }
+  return isDeepSeekReasoningProvider(agent.provider, agent.model_parameters?.model ?? agent.model);
+}
+
 type RunAgent = Omit<Agent, 'tools'> & {
   tools?: GenericTool[];
   maxContextTokens?: number;
@@ -261,6 +330,10 @@ type RunAgent = Omit<Agent, 'tools'> & {
   codeEnvAvailable?: boolean;
   /** Optional per-agent summarization overrides */
   summarization?: SummarizationConfig;
+  /** Response field to read model reasoning from for custom OpenAI-compatible endpoints. */
+  reasoningKey?: ReasoningResponseKey;
+  /** Whether to reconstruct `reasoning_content` from persisted history across turns. */
+  includeReasoningHistory?: boolean;
   /**
    * Maximum characters allowed in a single tool result before truncation.
    * Overrides the default computed from maxContextTokens.
@@ -412,6 +485,37 @@ function resolveSummarizationProvider(
             body: headerContext.requestBody,
           })
         : undefined;
+    /**
+     * Native Anthropic custom endpoints must build their config with the
+     * Anthropic client (`/v1/messages`), not `getOpenAIConfig` (which would emit
+     * OpenAI-shaped requests). The self-summarize case is handled earlier by
+     * `isSameEndpointAsAgent`; this covers summarizing against a *different*
+     * Anthropic-native custom endpoint.
+     */
+    if (customEndpointConfig.provider === EModelEndpoint.anthropic) {
+      const { llmConfig } = getAnthropicLLMConfig(apiKey, {
+        modelOptions: {},
+        proxy: process.env.PROXY ?? undefined,
+        reverseProxyUrl: baseURL,
+        headers: resolvedHeaders,
+        addParams: customEndpointConfig.addParams,
+        dropParams: customEndpointConfig.dropParams,
+        defaultParams: extractDefaultParams(customEndpointConfig.customParams?.paramDefinitions),
+      });
+      const { apiKey: resolvedApiKey, ...llmConfigOverrides } = llmConfig as Record<
+        string,
+        unknown
+      >;
+      const clientOverrides: SummarizationClientOverrides = { ...llmConfigOverrides };
+      if (typeof resolvedApiKey === 'string') {
+        clientOverrides.apiKey = resolvedApiKey;
+      }
+      /** Strip the default model so the user-supplied `summarization.model` wins. */
+      delete clientOverrides.model;
+      delete clientOverrides.modelName;
+      return { provider: Providers.ANTHROPIC, clientOverrides };
+    }
+
     /**
      * Run the endpoint config through `getOpenAIConfig` so summarization
      * inherits the same `headers`, `defaultQuery`, `addParams`/`dropParams`,
@@ -620,6 +724,36 @@ function anyAgentHasCodeEnv(agents: RunAgent[]): boolean {
   return false;
 }
 
+/**
+ * Whether any agent reachable in the run — primary, handoff/parallel, or a
+ * nested subagent — opts into cross-turn `reasoning_content` reconstruction.
+ * Walks `subagentAgentConfigs` like {@link anyAgentHasCodeEnv}, since an
+ * opted-in custom endpoint may appear only as a (possibly pruned) subagent.
+ */
+export function anyAgentReplaysReasoningContent(
+  agents: Array<RunAgent | null | undefined>,
+): boolean {
+  const visited = new Set<string>();
+  const pending = [...agents];
+
+  for (let index = 0; index < pending.length; index++) {
+    const agent = pending[index];
+    if (agent == null || visited.has(agent.id)) {
+      continue;
+    }
+    visited.add(agent.id);
+    if (shouldReplayReasoningContent(agent)) {
+      return true;
+    }
+    for (const child of agent.subagentAgentConfigs ?? []) {
+      if (!visited.has(child.id)) {
+        pending.push(child);
+      }
+    }
+  }
+  return false;
+}
+
 /**
  * Builds SubagentConfig entries for an agent: optional self-spawn plus any
  * explicit child agents loaded in `agent.subagentAgentConfigs`. Returns an empty
@@ -715,6 +849,17 @@ function buildSubagentConfigs(
   return configs;
 }
 
+function buildLangfuseConfig(tenantIdInput?: unknown) {
+  const tenantId = typeof tenantIdInput === 'string' ? tenantIdInput.trim() : '';
+  return {
+    deterministicTraceId: true,
+    ...(tenantId !== '' && {
+      metadata: { 'librechat.tenant.id': tenantId },
+      tags: [`tenant:${tenantId}`],
+    }),
+  };
+}
+
 /**
  * Creates a new Run instance with custom handlers and configuration.
  *
@@ -737,6 +882,7 @@ export async function createRun({
   messages,
   requestBody,
   user,
+  tenantId,
   tokenCounter,
   customHandlers,
   indexTokenCountMap,
@@ -745,6 +891,7 @@ export async function createRun({
   initialSummary,
   calibrationRatio,
   appConfig,
+  subagentUsageSink,
   streaming = true,
   streamUsage = true,
 }: {
@@ -755,6 +902,7 @@ export async function createRun({
   streamUsage?: boolean;
   requestBody?: t.RequestBody;
   user?: IUser;
+  tenantId?: string;
   /** Message history for extracting previously discovered tools */
   messages?: BaseMessage[];
   summarizationConfig?: SummarizationConfig;
@@ -767,6 +915,15 @@ export async function createRun({
    * (e.g. "Ollama") in the summarization config to SDK-recognized providers.
    */
   appConfig?: AppConfig;
+  /**
+   * Receives per-model-call usage from subagent child runs so hosts can bill
+   * them (child graphs execute outside the run's `streamEvents` loop, so
+   * their usage never reaches `customHandlers`). Typed structurally — not as
+   * `Pick<RunConfig, 'subagentUsageSink'>` — because the field ships in
+   * `@librechat/agents` > 3.2.33; older SDK versions ignore it at runtime.
+   * Switch to the `RunConfig` pick once the dependency is bumped.
+   */
+  subagentUsageSink?: (event: SubagentUsageEvent) => void;
 } & Pick<
   RunConfig,
   'tokenCounter' | 'customHandlers' | 'indexTokenCountMap' | 'initialSessions'
@@ -804,6 +961,10 @@ export async function createRun({
     );
 
     const modelParameters = normalizeAgentModelParameters(agent.model_parameters);
+    const hasExplicitStreamUsage = Object.prototype.hasOwnProperty.call(
+      modelParameters ?? {},
+      'streamUsage',
+    );
     const llmConfig = Object.assign(
       {
         provider,
@@ -829,25 +990,26 @@ export async function createRun({
       .trim();
 
     /**
-     * Resolve request-based headers for Custom Endpoints. Note: if this is added to
-     *  non-custom endpoints, needs consideration of varying provider header configs.
-     *  This is done at this step because the request body may contain dynamic values
-     *  that need to be resolved after agent initialization.
+     * Resolve request-based headers across provider-specific header locations
+     * (OpenAI `configuration.defaultHeaders`, Anthropic `clientOptions.defaultHeaders`,
+     * Google `customHeaders`). Done at this step because the request body may
+     * contain dynamic values (e.g. conversationId) that are only known after
+     * agent initialization.
      */
-    if (llmConfig?.configuration?.defaultHeaders != null) {
-      llmConfig.configuration.defaultHeaders = resolveHeaders({
-        headers: llmConfig.configuration.defaultHeaders as Record<string, string>,
-        user: createSafeUser(user),
-        body: requestBody,
-      });
-    }
+    resolveConfigHeaders({
+      llmConfig,
+      user: createSafeUser(user),
+      body: requestBody,
+    });
 
     /** Resolves issues with new OpenAI usage field */
     if (
       customProviders.has(agent.provider) ||
       (agent.provider === Providers.OPENAI && agent.endpoint !== agent.provider)
     ) {
-      llmConfig.streamUsage = false;
+      if (!hasExplicitStreamUsage) {
+        llmConfig.streamUsage = false;
+      }
       llmConfig.usage = true;
     }
 
@@ -908,7 +1070,7 @@ export async function createRun({
       agent.maxContextTokens,
     );
 
-    const reasoningKey = getReasoningKey(provider, llmConfig, agent.endpoint);
+    const reasoningKey = getReasoningKey(provider, llmConfig, agent.endpoint, agent.reasoningKey);
     return {
       provider,
       reasoningKey,
@@ -982,16 +1144,34 @@ export async function createRun({
    */
   const enableToolOutputReferences = anyAgentHasCodeEnv(agents);
 
-  return Run.create({
+  /**
+   * Built as a variable (not an inline literal) so the extra
+   * `subagentUsageSink` field passes assignability against SDK versions
+   * whose `RunConfig` predates it (<= 3.2.33, where it is ignored at
+   * runtime) — excess-property checks only apply to fresh literals. Inline
+   * the field at the call site once the dependency is bumped.
+   */
+  const runConfig = {
     runId,
     graphConfig,
     tokenCounter,
     customHandlers,
-    indexTokenCountMap,
     initialSessions,
     calibrationRatio,
+    indexTokenCountMap,
+    subagentUsageSink,
+    eagerEventToolExecution: { enabled: true },
+    // Derive the Langfuse trace id deterministically from runId so message
+    // feedback can be scored against the trace without a lookup (see the
+    // feedback route in api/server/routes/messages.js). No-op unless Langfuse
+    // tracing is enabled. Requires @librechat/agents >= 3.2.21.
+    langfuse: buildLangfuseConfig(tenantId ?? user?.tenantId),
     ...(enableToolOutputReferences && {
       toolOutputReferences: { enabled: true },
     }),
-  });
+  };
+  const run = await Run.create(runConfig);
+
+  applyTestRunHook(run, { messages, agents });
+  return run;
 }
diff --git a/packages/api/src/agents/skillConfigurable.spec.ts b/packages/api/src/agents/skillConfigurable.spec.ts
index 5b22a23cfa8..94bc5dbd28d 100644
--- a/packages/api/src/agents/skillConfigurable.spec.ts
+++ b/packages/api/src/agents/skillConfigurable.spec.ts
@@ -5,12 +5,10 @@ describe('enrichWithSkillConfigurable', () => {
   const accessibleSkillIds = ['skill-a', 'skill-b'];
 
   it('augments configurable with req, accessibleSkillIds, and codeEnvAvailable', () => {
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: [], configurable: { other: 'value' } },
-      req,
-      accessibleSkillIds,
-      true,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: { other: 'value' } },
+      context: { req, accessibleSkillIds, codeEnvAvailable: true },
+    });
 
     expect(result.configurable).toEqual({
       other: 'value',
@@ -18,21 +16,36 @@ describe('enrichWithSkillConfigurable', () => {
       codeEnvAvailable: true,
       accessibleSkillIds,
       skillPrimedIdsByName: undefined,
+      skillAuthoringAvailable: undefined,
+      fileAuthoringToolNames: undefined,
     });
   });
 
   it('propagates codeEnvAvailable=false verbatim (not coerced)', () => {
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: [], configurable: {} },
-      req,
-      accessibleSkillIds,
-      false,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: { req, accessibleSkillIds, codeEnvAvailable: false },
+    });
 
     expect(result.configurable.codeEnvAvailable).toBe(false);
   });
 
   it('threads skillPrimedIdsByName through unchanged', () => {
+    const primed = { 'brand-guidelines': 'abc123' };
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: {
+        req,
+        accessibleSkillIds,
+        codeEnvAvailable: true,
+        skillPrimedIdsByName: primed,
+      },
+    });
+
+    expect(result.configurable.skillPrimedIdsByName).toBe(primed);
+  });
+
+  it('supports the legacy positional shape', () => {
     const primed = { 'brand-guidelines': 'abc123' };
     const result = enrichWithSkillConfigurable(
       { loadedTools: [], configurable: {} },
@@ -45,14 +58,29 @@ describe('enrichWithSkillConfigurable', () => {
     expect(result.configurable.skillPrimedIdsByName).toBe(primed);
   });
 
+  it('threads skill authoring gates through unchanged', () => {
+    const fileAuthoringToolNames = new Set(['create_file', 'edit_file']);
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: {
+        req,
+        accessibleSkillIds,
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames,
+      },
+    });
+
+    expect(result.configurable.skillAuthoringAvailable).toBe(true);
+    expect(result.configurable.fileAuthoringToolNames).toBe(fileAuthoringToolNames);
+  });
+
   it('preserves loadedTools unchanged', () => {
     const tools = [{ name: 'x' }];
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: tools, configurable: undefined },
-      req,
-      accessibleSkillIds,
-      false,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: tools, configurable: undefined },
+      context: { req, accessibleSkillIds, codeEnvAvailable: false },
+    });
 
     expect(result.loadedTools).toBe(tools);
   });
diff --git a/packages/api/src/agents/skillConfigurable.ts b/packages/api/src/agents/skillConfigurable.ts
index 9157701c438..ada280d6a00 100644
--- a/packages/api/src/agents/skillConfigurable.ts
+++ b/packages/api/src/agents/skillConfigurable.ts
@@ -24,17 +24,16 @@
  * Empty/missing → no exception, the gate applies as normal and the
  * lookup uses the full ACL set.
  */
-export function enrichWithSkillConfigurable(
-  result: { loadedTools: unknown[]; configurable?: Record<string, unknown> },
-  req: { user?: { id?: string } },
-  accessibleSkillIds: unknown[],
-  codeEnvAvailable: boolean,
+export interface SkillConfigurableContext {
+  req: { user?: { id?: string } };
+  accessibleSkillIds?: unknown[];
+  codeEnvAvailable: boolean;
   /**
    * `{ [skillName]: skillIdString }` for every skill primed this turn
    * (manual or always-apply). The id pins same-name collision lookups to
    * the exact doc the resolver primed and relaxes the disable-model gate.
    */
-  skillPrimedIdsByName?: Record<string, string>,
+  skillPrimedIdsByName?: Record<string, string>;
   /**
    * Names of skills the runtime can resolve, captured at agent init by
    * `injectSkillCatalog`. Lets `read_file` decide whether a
@@ -45,17 +44,74 @@ export function enrichWithSkillConfigurable(
    * off, ephemeral badge off, or persisted `skills_enabled !== true`),
    * which is the same signal as `accessibleSkillIds.length === 0`.
    */
+  activeSkillNames?: Set<string>;
+  /** True when skills/{skillName}/... write paths are enabled for this run. */
+  skillAuthoringAvailable?: boolean;
+  /** Host file-authoring names registered by initializeAgent for this run. */
+  fileAuthoringToolNames?: Set<string>;
+}
+
+export interface SkillConfigurableLoadResult {
+  loadedTools: unknown[];
+  configurable?: Record<string, unknown>;
+}
+
+export interface EnrichWithSkillConfigurableParams {
+  result: SkillConfigurableLoadResult;
+  context: SkillConfigurableContext;
+}
+
+export function enrichWithSkillConfigurable(params: EnrichWithSkillConfigurableParams): {
+  loadedTools: unknown[];
+  configurable: Record<string, unknown>;
+};
+export function enrichWithSkillConfigurable(
+  result: SkillConfigurableLoadResult,
+  req: { user?: { id?: string } },
+  accessibleSkillIds: unknown[] | undefined,
+  codeEnvAvailable: boolean,
+  skillPrimedIdsByName?: Record<string, string>,
+  activeSkillNames?: Set<string>,
+  skillAuthoringAvailable?: boolean,
+  fileAuthoringToolNames?: Set<string>,
+): { loadedTools: unknown[]; configurable: Record<string, unknown> };
+export function enrichWithSkillConfigurable(
+  first: EnrichWithSkillConfigurableParams | SkillConfigurableLoadResult,
+  req?: { user?: { id?: string } },
+  accessibleSkillIds?: unknown[],
+  codeEnvAvailable?: boolean,
+  skillPrimedIdsByName?: Record<string, string>,
   activeSkillNames?: Set<string>,
+  skillAuthoringAvailable?: boolean,
+  fileAuthoringToolNames?: Set<string>,
 ): { loadedTools: unknown[]; configurable: Record<string, unknown> } {
+  const { result, context } =
+    'result' in first && 'context' in first
+      ? first
+      : {
+          result: first,
+          context: {
+            req: req ?? {},
+            accessibleSkillIds,
+            codeEnvAvailable: codeEnvAvailable === true,
+            skillPrimedIdsByName,
+            activeSkillNames,
+            skillAuthoringAvailable,
+            fileAuthoringToolNames,
+          },
+        };
+
   return {
     ...result,
     configurable: {
       ...result.configurable,
-      req,
-      codeEnvAvailable,
-      accessibleSkillIds,
-      skillPrimedIdsByName,
-      activeSkillNames,
+      req: context.req,
+      codeEnvAvailable: context.codeEnvAvailable,
+      accessibleSkillIds: context.accessibleSkillIds,
+      skillPrimedIdsByName: context.skillPrimedIdsByName,
+      activeSkillNames: context.activeSkillNames,
+      skillAuthoringAvailable: context.skillAuthoringAvailable,
+      fileAuthoringToolNames: context.fileAuthoringToolNames,
     },
   };
 }
diff --git a/packages/api/src/agents/skills.ts b/packages/api/src/agents/skills.ts
index 7112ee95920..b074daad5f6 100644
--- a/packages/api/src/agents/skills.ts
+++ b/packages/api/src/agents/skills.ts
@@ -11,10 +11,13 @@ import { registerCodeExecutionTools } from './tools';
 import { logAxiosError } from '~/utils';
 
 const SKILL_CATALOG_LIMIT = 100;
+const MIN_SKILL_CATALOG_LIMIT = 1;
 /** Max pages scanned per run when filtering out inactive skills. */
 const MAX_CATALOG_PAGES = 10;
 /** Page size used when paginating to fill the active-skill quota. */
 const CATALOG_PAGE_SIZE = 100;
+/** Hard ceiling on skill names a model spec can request by config. */
+const MAX_MODEL_SPEC_SKILLS = SKILL_CATALOG_LIMIT;
 /**
  * Hard ceiling on skill names resolved per request via `$` popover or
  * `always-apply`. The popover realistically surfaces only a few per turn;
@@ -98,9 +101,9 @@ export function isSkillPrimeMessage(msg: unknown): boolean {
  *
  * Semantics (pinned by unit tests):
  * - `undefined` / `null` → not configured, returns the full accessible catalog.
- * - `[]` (empty array) → explicitly none, returns `[]`. A user who narrows their
- *   agent to a subset and then removes all entries is explicitly opting out of
- *   the full catalog fallback.
+ * - `[]` (empty array) → no allowlist, returns the full accessible catalog.
+ *   Removing all selected skills in the builder restores the default full-catalog
+ *   behavior while `skills_enabled` remains true.
  * - non-empty array of skill `_id` hex strings → intersection of accessible IDs
  *   and agent-configured IDs.
  *
@@ -117,12 +120,102 @@ export function scopeSkillIds(
     return accessibleSkillIds;
   }
   if (agentSkills.length === 0) {
-    return [];
+    return accessibleSkillIds;
   }
   const agentSet = new Set(agentSkills);
   return accessibleSkillIds.filter((oid) => agentSet.has(oid.toString()));
 }
 
+function normalizeSkillCatalogLimit(limit: number | undefined): number {
+  if (typeof limit !== 'number' || !Number.isFinite(limit)) {
+    return SKILL_CATALOG_LIMIT;
+  }
+  return Math.min(SKILL_CATALOG_LIMIT, Math.max(MIN_SKILL_CATALOG_LIMIT, Math.floor(limit)));
+}
+
+export interface ResolveModelSpecSkillIdsParams {
+  /** Skill names configured on a model spec. */
+  names: string[];
+  /** Full VIEW-accessible skill IDs for this user before model-spec scoping. */
+  accessibleSkillIds: Types.ObjectId[];
+  /** DB lookup: name → skill doc constrained to the user's accessible IDs. */
+  getSkillByName?: InitializeAgentDbMethods['getSkillByName'];
+}
+
+/**
+ * Resolves model-spec skill names against the current user's accessible skill
+ * set. Config is advisory: unrecognized, inaccessible, malformed, or errored
+ * names are skipped with a warning so a stale model-spec entry never blocks
+ * the actual chat request.
+ */
+export async function resolveModelSpecSkillIds({
+  names,
+  accessibleSkillIds,
+  getSkillByName,
+}: ResolveModelSpecSkillIdsParams): Promise<Types.ObjectId[]> {
+  if (!names.length || accessibleSkillIds.length === 0 || !getSkillByName) {
+    return [];
+  }
+
+  const seenNames = new Set<string>();
+  const uniqueNames: string[] = [];
+  for (const name of names) {
+    if (typeof name !== 'string') {
+      continue;
+    }
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > MAX_SKILL_NAME_LENGTH || seenNames.has(trimmed)) {
+      continue;
+    }
+    seenNames.add(trimmed);
+    uniqueNames.push(trimmed);
+  }
+
+  let boundedNames = uniqueNames;
+  if (uniqueNames.length > MAX_MODEL_SPEC_SKILLS) {
+    logger.warn(
+      `[resolveModelSpecSkillIds] Truncating model spec skill list from ${uniqueNames.length} to ${MAX_MODEL_SPEC_SKILLS}.`,
+    );
+    boundedNames = uniqueNames.slice(0, MAX_MODEL_SPEC_SKILLS);
+  }
+
+  const resolved: Array<Types.ObjectId | null> = [];
+  for (const name of boundedNames) {
+    try {
+      const skill = await getSkillByName(name, accessibleSkillIds, {
+        preferModelInvocable: true,
+      });
+      if (!skill) {
+        logger.warn(
+          `[resolveModelSpecSkillIds] Skill "${name}" not found or not accessible for this user`,
+        );
+        resolved.push(null);
+        continue;
+      }
+      resolved.push(skill._id);
+    } catch (err) {
+      logger.warn(
+        `[resolveModelSpecSkillIds] Failed to resolve skill "${name}":`,
+        err instanceof Error ? err.message : err,
+      );
+      resolved.push(null);
+    }
+  }
+
+  const seenIds = new Set<string>();
+  return resolved.filter((id): id is Types.ObjectId => {
+    if (!id) {
+      return false;
+    }
+    const key = id.toString();
+    if (seenIds.has(key)) {
+      return false;
+    }
+    seenIds.add(key);
+    return true;
+  });
+}
+
 export interface ResolveAgentScopedSkillIdsParams {
   /** Agent being initialized. Reads `id`, `skills`, and `skills_enabled`. */
   agent: Pick<Agent, 'id' | 'skills' | 'skills_enabled'>;
@@ -137,8 +230,10 @@ export interface ResolveAgentScopedSkillIdsParams {
 /**
  * Strict opt-in resolver for per-agent skill scope. Activation requires an
  * explicit signal from the user or the agent author:
- *  - Ephemeral agent  → the skills badge toggle for this conversation.
- *    Toggle ON = full accessible catalog; OFF = no skills.
+ *  - Ephemeral agent  → model-spec `skills` wins when configured:
+ *    `true` = full accessible catalog, string list = scoped allowlist,
+ *    empty list / `false` = no skills. Otherwise the skills badge toggle
+ *    controls the full accessible catalog.
  *  - Persisted agent  → the builder's `skills_enabled` master switch.
  *    Enabled + empty allowlist = full catalog; enabled + non-empty
  *    allowlist = narrow to those ids; disabled (or undefined) = no skills.
@@ -158,6 +253,17 @@ export function resolveAgentScopedSkillIds(
     return [];
   }
   if (isEphemeralAgentId(agent.id)) {
+    if (agent.skills_enabled === false) {
+      return [];
+    }
+    if (agent.skills_enabled === true) {
+      if (Array.isArray(agent.skills) && agent.skills.length === 0) {
+        return [];
+      }
+      return Array.isArray(agent.skills)
+        ? scopeSkillIds(accessibleSkillIds, agent.skills)
+        : scopeSkillIds(accessibleSkillIds, undefined);
+    }
     return ephemeralSkillsToggle ? scopeSkillIds(accessibleSkillIds, undefined) : [];
   }
   if (agent.skills_enabled !== true) {
@@ -171,7 +277,7 @@ export function resolveAgentScopedSkillIds(
 
 export interface ResolveSkillActiveParams {
   /** Skill being evaluated. Only `_id` and `author` matter for resolution. */
-  skill: { _id: Types.ObjectId | string; author: Types.ObjectId | string };
+  skill: { _id: Types.ObjectId | string; author: Types.ObjectId | string; deployment?: boolean };
   /** Per-user overrides: `{ [skillId]: boolean }`. Missing entries use the default. */
   skillStates?: Record<string, boolean>;
   /** Current user ID. When absent, the function fails closed for all non-overridden skills. */
@@ -196,6 +302,9 @@ export function resolveSkillActive(params: ResolveSkillActiveParams): boolean {
   if (override !== undefined) {
     return override;
   }
+  if (skill.deployment === true) {
+    return true;
+  }
   if (!userId) {
     return false;
   }
@@ -217,6 +326,8 @@ export interface InjectSkillCatalogParams {
   skillStates?: Record<string, boolean>;
   /** Admin-configured default for shared skills. `true` = shared skills auto-activate. */
   defaultActiveOnShare?: boolean;
+  /** Admin-configured cap on the model-visible catalog. Defaults to 100. */
+  maxCatalogSkills?: number;
 }
 
 export interface InjectSkillCatalogResult {
@@ -268,7 +379,9 @@ export async function injectSkillCatalog(
     userId,
     skillStates,
     defaultActiveOnShare = false,
+    maxCatalogSkills,
   } = params;
+  const catalogLimit = normalizeSkillCatalogLimit(maxCatalogSkills);
 
   if (!listSkillsByAccess || accessibleSkillIds.length === 0) {
     return {
@@ -299,7 +412,7 @@ export async function injectSkillCatalog(
   let pages = 0;
   let reachedEnd = false;
 
-  while (visibleCount < SKILL_CATALOG_LIMIT && pages < MAX_CATALOG_PAGES) {
+  while (visibleCount < catalogLimit && pages < MAX_CATALOG_PAGES) {
     const page = await listSkillsByAccess({
       accessibleIds: accessibleSkillIds,
       limit: CATALOG_PAGE_SIZE,
@@ -307,7 +420,7 @@ export async function injectSkillCatalog(
     });
 
     for (const skill of page.skills) {
-      if (visibleCount >= SKILL_CATALOG_LIMIT) {
+      if (visibleCount >= catalogLimit) {
         break;
       }
       /**
@@ -344,9 +457,9 @@ export async function injectSkillCatalog(
     };
   }
 
-  if (!reachedEnd && visibleCount < SKILL_CATALOG_LIMIT) {
+  if (!reachedEnd && visibleCount < catalogLimit) {
     logger.warn(
-      `[injectSkillCatalog] Scanned ${MAX_CATALOG_PAGES} pages without filling the ${SKILL_CATALOG_LIMIT}-skill catalog. Some active skills may be excluded.`,
+      `[injectSkillCatalog] Scanned ${MAX_CATALOG_PAGES} pages without filling the ${catalogLimit}-skill catalog. Some active skills may be excluded.`,
     );
   }
 
@@ -508,6 +621,7 @@ export interface ResolveManualSkillsParams {
     name: string;
     body: string;
     author: Types.ObjectId | string;
+    deployment?: boolean;
     /**
      * Skill-declared tool allowlist, forwarded verbatim from the skill doc.
      * Surfaced on `ResolvedManualSkill` so future runtime enforcement can
@@ -678,7 +792,7 @@ export async function resolveManualSkills(
           return null;
         }
         const active = resolveSkillActive({
-          skill: { _id: skill._id, author: skill.author },
+          skill: { _id: skill._id, author: skill.author, deployment: skill.deployment },
           skillStates,
           userId,
           defaultActiveOnShare,
@@ -728,6 +842,7 @@ export interface ResolveAlwaysApplySkillsParams {
       body: string;
       author: Types.ObjectId | string;
       allowedTools?: string[];
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -826,7 +941,7 @@ export async function resolveAlwaysApplySkills(
         continue;
       }
       const active = resolveSkillActive({
-        skill: { _id: skill._id, author: skill.author },
+        skill: { _id: skill._id, author: skill.author, deployment: skill.deployment },
         skillStates,
         userId,
         defaultActiveOnShare,
@@ -972,6 +1087,32 @@ export function injectManualSkillPrimes(
   return { initialMessages, indexTokenCountMap, inserted: numPrimes, insertIdx };
 }
 
+/**
+ * Collects the set of skill names primed fresh this turn — the union of manual
+ * ($-popover) and always-apply (frontmatter) primes. Passed to
+ * `formatAgentMessages` as `skipSkillBodyNames` so a skill that is BOTH primed
+ * this turn AND present in history (as a `skill` tool_call) has its SKILL.md
+ * body injected exactly once — by the fresh prime via `injectSkillPrimes` — and
+ * is NOT also reconstructed from history. Names absent from this set still
+ * reconstruct from history, preserving sticky manual re-priming across turns.
+ */
+export function collectFreshSkillPrimeNames({
+  manualSkillPrimes,
+  alwaysApplySkillPrimes,
+}: {
+  manualSkillPrimes?: Pick<ResolvedManualSkill, 'name'>[];
+  alwaysApplySkillPrimes?: Pick<ResolvedAlwaysApplySkill, 'name'>[];
+}): Set<string> {
+  const names = new Set<string>();
+  for (const prime of manualSkillPrimes ?? []) {
+    names.add(prime.name);
+  }
+  for (const prime of alwaysApplySkillPrimes ?? []) {
+    names.add(prime.name);
+  }
+  return names;
+}
+
 export interface InjectSkillPrimesParams {
   /** Formatted LangChain messages produced by `formatAgentMessages`. Mutated in place. */
   initialMessages: BaseMessage[];
diff --git a/packages/api/src/agents/testHook.ts b/packages/api/src/agents/testHook.ts
new file mode 100644
index 00000000000..1599669c823
--- /dev/null
+++ b/packages/api/src/agents/testHook.ts
@@ -0,0 +1,40 @@
+import { logger } from '@librechat/data-schemas';
+import type { Run, IState } from '@librechat/agents';
+import type { BaseMessage } from '@librechat/agents/langchain/messages';
+
+/**
+ * Context handed to a test run hook so it can shape fake-model behavior from
+ * the conversation and the agents' advertised tools.
+ */
+export interface TestRunHookContext {
+  messages?: BaseMessage[];
+  agents: ReadonlyArray<{ tools?: ReadonlyArray<{ name: string }> }>;
+}
+
+export type TestRunHook = (run: Run<IState>, context: TestRunHookContext) => void;
+
+/**
+ * Env-gated extension point used only by the e2e harness. When
+ * `LIBRECHAT_TEST_RUN_HOOK` points at a module, it is loaded and invoked with
+ * the freshly created run so a test can swap in a fake model via
+ * `run.Graph.overrideTestModel(...)` instead of reaching a live provider. A
+ * no-op (returns immediately) in normal operation since the env var is unset.
+ */
+export function applyTestRunHook(run: Run<IState>, context: TestRunHookContext): void {
+  const hookPath = process.env.LIBRECHAT_TEST_RUN_HOOK;
+  if (!hookPath) {
+    return;
+  }
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const loaded = require(hookPath) as TestRunHook | { default?: TestRunHook };
+    const hook = typeof loaded === 'function' ? loaded : loaded.default;
+    if (typeof hook !== 'function') {
+      logger.warn(`[applyTestRunHook] ${hookPath} did not export a function`);
+      return;
+    }
+    hook(run, context);
+  } catch (error) {
+    logger.error(`[applyTestRunHook] Failed to apply hook from ${hookPath}`, error);
+  }
+}
diff --git a/packages/api/src/agents/tools.spec.ts b/packages/api/src/agents/tools.spec.ts
index 2ad9c30db9b..0650a4c0930 100644
--- a/packages/api/src/agents/tools.spec.ts
+++ b/packages/api/src/agents/tools.spec.ts
@@ -5,14 +5,14 @@
  * Mirrors the same pattern used in `__tests__/skills.test.ts`.
  */
 jest.mock('@librechat/agents', () => ({
-  ...jest.requireActual('@librechat/agents'),
+  CODE_EXECUTION_TOOLS: new Set(['execute_code', 'bash_tool']),
   ReadFileToolDefinition: {
     name: 'read_file',
     description: 'read skill files using {skillName}/{filePath} and SKILL.md',
     parameters: {
       type: 'object',
       properties: {
-        file_path: {
+        path: {
           type: 'string',
           description: 'For skill files: "{skillName}/{path}".',
         },
@@ -38,8 +38,34 @@ jest.mock('@librechat/agents', () => ({
     enableToolOutputReferences === true ? 'bash {{tool<idx>turn<turn>}}' : 'bash',
 }));
 
+import { CODE_EXECUTION_TOOLS } from '@librechat/agents';
 import type { LCTool, LCToolRegistry } from '@librechat/agents';
-import { buildToolSet, BuildToolSetConfig, registerCodeExecutionTools } from './tools';
+import {
+  buildToolSet,
+  BuildToolSetConfig,
+  registerCodeExecutionTools,
+  registerFileAuthoringTools,
+  FILE_AUTHORING_TOOL_NAMES,
+  isFileAuthoringToolDefinition,
+  isCodeSessionToolName,
+} from './tools';
+
+/** Portable ceiling for OpenAI-compatible tool description validators. */
+const TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH = 1024;
+
+function filePathDescription(tool?: LCTool): string {
+  const parameters = tool?.parameters as
+    | { properties?: { path?: { description?: string } } }
+    | undefined;
+  return parameters?.properties?.path?.description ?? '';
+}
+
+function maxToolDescriptionLength(definitions: LCTool[]): number {
+  return definitions.reduce((max, definition) => {
+    const length = definition.description?.length ?? Number.POSITIVE_INFINITY;
+    return Math.max(max, length);
+  }, 0);
+}
 
 describe('buildToolSet', () => {
   describe('event-driven mode (toolDefinitions)', () => {
@@ -211,8 +237,10 @@ describe('registerCodeExecutionTools', () => {
       const readFile = result.toolDefinitions.find((d) => d.name === 'read_file');
       expect(readFile?.description).toContain('code-execution sandbox');
       expect(readFile?.description).toContain('/mnt/data/');
+      expect(readFile?.description).toContain('Do not run ls/find');
+      expect(readFile?.description).toContain('/tmp is per-call scratch');
       expect(readFile?.description).toContain('truncated around 256KB');
-      expect(readFile?.description).toContain('may return an error');
+      expect(readFile?.description).toContain('true filesystem discovery');
       expect(readFile?.description).not.toContain('{skillName}');
       expect(readFile?.description).not.toContain('SKILL.md');
       expect(JSON.stringify(readFile?.parameters)).not.toContain('{skillName}');
@@ -236,6 +264,7 @@ describe('registerCodeExecutionTools', () => {
       const readFile = upgraded.toolDefinitions.find((d) => d.name === 'read_file');
       expect(upgraded.registered).toEqual([]);
       expect(readFile?.description).toContain('{skillName}/{filePath}');
+      expect(readFile?.description).toContain('skills/{skillName}/');
       expect(readFile?.description).toContain('SKILL.md');
       expect(toolRegistry.get('read_file')?.description).toBe(readFile?.description);
     });
@@ -254,6 +283,30 @@ describe('registerCodeExecutionTools', () => {
       const names = result.toolDefinitions.map((d) => d.name);
       expect(names).toEqual(['calculator', 'read_file', 'bash_tool']);
     });
+
+    it('keeps code-execution tool descriptions within provider advisory limits', () => {
+      const skillAwareWithRefs = registerCodeExecutionTools({
+        toolRegistry: makeRegistry(),
+        toolDefinitions: [],
+        includeBash: true,
+        includeSkillFileInstructions: true,
+        enableToolOutputReferences: true,
+      });
+      const codeOnlyWithoutRefs = registerCodeExecutionTools({
+        toolRegistry: makeRegistry(),
+        toolDefinitions: [],
+        includeBash: true,
+        includeSkillFileInstructions: false,
+        enableToolOutputReferences: false,
+      });
+
+      expect(
+        maxToolDescriptionLength([
+          ...skillAwareWithRefs.toolDefinitions,
+          ...codeOnlyWithoutRefs.toolDefinitions,
+        ]),
+      ).toBeLessThanOrEqual(TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH);
+    });
   });
 
   describe('idempotence (second call in same run)', () => {
@@ -419,3 +472,151 @@ describe('registerCodeExecutionTools', () => {
     });
   });
 });
+
+describe('registerFileAuthoringTools', () => {
+  const makeRegistry = (): LCToolRegistry => new Map() as unknown as LCToolRegistry;
+
+  it('recognizes host-side file authoring tools as code-session-aware without mutating the shared set', () => {
+    expect(isCodeSessionToolName('bash_tool')).toBe(true);
+    expect(isCodeSessionToolName('create_file')).toBe(false);
+    expect(isCodeSessionToolName('edit_file')).toBe(false);
+    expect(isCodeSessionToolName('create_file', FILE_AUTHORING_TOOL_NAMES)).toBe(true);
+    expect(isCodeSessionToolName('edit_file', FILE_AUTHORING_TOOL_NAMES)).toBe(true);
+    expect(CODE_EXECUTION_TOOLS.has('create_file')).toBe(false);
+    expect(CODE_EXECUTION_TOOLS.has('edit_file')).toBe(false);
+  });
+
+  it('registers create_file and edit_file with skill-aware descriptions', () => {
+    const toolRegistry = makeRegistry();
+    const result = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+
+    const names = result.toolDefinitions.map((d) => d.name).sort();
+    expect(names).toEqual(['create_file', 'edit_file']);
+    expect(result.registered.sort()).toEqual(['create_file', 'edit_file']);
+    expect(toolRegistry.has('create_file')).toBe(true);
+    expect(toolRegistry.has('edit_file')).toBe(true);
+    expect(result.toolDefinitions[0].responseFormat).toBe('content_and_artifact');
+    expect(result.toolDefinitions.map((d) => d.description).join('\n')).toContain('skills/');
+    expect(toolRegistry.get('create_file')?.description).toContain('frontmatter name must match');
+    expect(toolRegistry.get('create_file')?.description).toContain('trigger-friendly');
+    expect(toolRegistry.get('create_file')?.description).toContain('references/template.html');
+    expect(toolRegistry.get('create_file')?.description).toContain('templates/{file}');
+    expect(toolRegistry.get('edit_file')?.description).toContain('edit_file cannot rename skills');
+    expect(toolRegistry.get('edit_file')?.description).toContain('Keep SKILL.md concise');
+    expect(toolRegistry.get('edit_file')?.description).toContain('templates/');
+    expect(filePathDescription(toolRegistry.get('create_file'))).toContain(
+      'frontmatter name must match',
+    );
+    expect(filePathDescription(toolRegistry.get('edit_file'))).toContain(
+      'edit_file cannot rename skills',
+    );
+  });
+
+  it('registers code-only descriptions for code-exec-only agents', () => {
+    const toolRegistry = makeRegistry();
+    const result = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+
+    const createFile = result.toolDefinitions.find((d) => d.name === 'create_file');
+    const editFile = result.toolDefinitions.find((d) => d.name === 'edit_file');
+    expect(createFile?.description).toContain('code-execution sandbox');
+    expect(createFile?.description).toContain('/mnt/data/');
+    expect(createFile?.description).not.toContain('skills/');
+    expect(editFile?.description).toContain('code-execution sandbox');
+    expect(editFile?.description).toContain('/mnt/data/');
+    expect(editFile?.description).not.toContain('skills/');
+    expect(filePathDescription(createFile)).toContain('code-execution sandbox');
+    expect(filePathDescription(createFile)).not.toContain('skills/');
+    expect(filePathDescription(createFile)).not.toContain('SKILL.md');
+    expect(filePathDescription(editFile)).toContain('code-execution sandbox');
+    expect(filePathDescription(editFile)).not.toContain('skills/');
+    expect(filePathDescription(editFile)).not.toContain('rename skills');
+  });
+
+  it('is idempotent across repeated registration calls', () => {
+    const toolRegistry = makeRegistry();
+    const first = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+    });
+    const second = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: first.toolDefinitions,
+    });
+
+    expect(second.registered).toEqual([]);
+    expect(second.toolDefinitions).toHaveLength(2);
+  });
+
+  it('upgrades code-only definitions to skill-aware definitions', () => {
+    const toolRegistry = makeRegistry();
+    const codeOnly = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+    const upgraded = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: codeOnly.toolDefinitions,
+      includeSkillFileInstructions: true,
+    });
+
+    expect(upgraded.registered).toEqual([]);
+    expect(upgraded.toolDefinitions.find((d) => d.name === 'create_file')?.description).toContain(
+      'skills/',
+    );
+    expect(toolRegistry.get('edit_file')?.description).toContain('skills/');
+  });
+
+  it('keeps file-authoring tool descriptions within provider advisory limits', () => {
+    const skillAware = registerFileAuthoringTools({
+      toolRegistry: makeRegistry(),
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+    const codeOnlyRegistry = makeRegistry();
+    const codeOnly = registerFileAuthoringTools({
+      toolRegistry: codeOnlyRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+    const upgraded = registerFileAuthoringTools({
+      toolRegistry: codeOnlyRegistry,
+      toolDefinitions: codeOnly.toolDefinitions,
+      includeSkillFileInstructions: true,
+    });
+
+    expect(
+      maxToolDescriptionLength([
+        ...skillAware.toolDefinitions,
+        ...codeOnly.toolDefinitions,
+        ...upgraded.toolDefinitions,
+      ]),
+    ).toBeLessThanOrEqual(TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH);
+  });
+
+  it('distinguishes host file authoring definitions from user tools with matching names', () => {
+    const result = registerFileAuthoringTools({
+      toolRegistry: makeRegistry(),
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+    const createFile = result.toolDefinitions.find((d) => d.name === 'create_file');
+
+    expect(isFileAuthoringToolDefinition(createFile)).toBe(true);
+    expect(
+      isFileAuthoringToolDefinition({
+        name: 'create_file',
+        description: 'A user-defined create_file action',
+        parameters: { type: 'object', properties: {} } as LCTool['parameters'],
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/packages/api/src/agents/tools.ts b/packages/api/src/agents/tools.ts
index 268b7df01af..9b9cabb9c99 100644
--- a/packages/api/src/agents/tools.ts
+++ b/packages/api/src/agents/tools.ts
@@ -1,10 +1,26 @@
 import {
+  CODE_EXECUTION_TOOLS,
   BashExecutionToolDefinition,
   ReadFileToolDefinition,
   buildBashExecutionToolDescription,
 } from '@librechat/agents';
 import type { LCTool, LCToolRegistry } from '@librechat/agents';
 
+export const CREATE_FILE_TOOL_NAME = 'create_file';
+export const EDIT_FILE_TOOL_NAME = 'edit_file';
+export const HOST_FILE_AUTHORING_ARTIFACT_KEY = '__librechat_file_authoring';
+export const FILE_AUTHORING_TOOL_NAMES: ReadonlySet<string> = new Set([
+  CREATE_FILE_TOOL_NAME,
+  EDIT_FILE_TOOL_NAME,
+]);
+
+export function isCodeSessionToolName(
+  name: string,
+  hostFileAuthoringToolNames?: ReadonlySet<string>,
+): boolean {
+  return CODE_EXECUTION_TOOLS.has(name) || hostFileAuthoringToolNames?.has(name) === true;
+}
+
 interface ToolDefLike {
   name: string;
   [key: string]: unknown;
@@ -86,6 +102,19 @@ export interface RegisterCodeExecutionToolsResult {
   registered: string[];
 }
 
+export type RegisterFileAuthoringToolsResult = RegisterCodeExecutionToolsResult;
+
+export interface RegisterFileAuthoringToolsParams {
+  toolRegistry: LCToolRegistry | undefined;
+  toolDefinitions: LCTool[] | undefined;
+  /**
+   * When true, descriptions point the model at the skill file namespace
+   * (`skills/{skillName}/...`) in addition to sandbox paths. When false,
+   * descriptions stay focused on code-execution sandbox files.
+   */
+  includeSkillFileInstructions?: boolean;
+}
+
 /**
  * Hoisted module-level definition for skill-aware `read_file` so
  * `registerCodeExecutionTools` doesn't re-allocate on every call. The
@@ -93,35 +122,31 @@ export interface RegisterCodeExecutionToolsResult {
  * per-request state — so a single frozen object is safe to share across
  * every agent init.
  */
+const SKILL_READ_FILE_DESCRIPTION = `${ReadFileToolDefinition.description}
+
+Also accepts authored skill file paths using "skills/{skillName}/...", including "skills/{skillName}/SKILL.md".`;
+
 const READ_FILE_DEF: LCTool = Object.freeze({
   name: ReadFileToolDefinition.name,
-  description: ReadFileToolDefinition.description,
+  description: SKILL_READ_FILE_DESCRIPTION,
   parameters: ReadFileToolDefinition.parameters as unknown as LCTool['parameters'],
   responseFormat: ReadFileToolDefinition.responseFormat,
 }) as LCTool;
 
-const CODE_READ_FILE_DESCRIPTION = `Read the contents of a file from the code-execution sandbox or from prior code-execution output. Returns text content with line numbers for easy reference.
-
-BEHAVIOR:
-- Text files: returned with numbered lines.
-- Large text files are truncated around 256KB with a note to use bash_tool for the full content.
-- Binary files and formats that are not safe to serialize as text may return an error. Use bash_tool to inspect or process them.
+const CODE_READ_FILE_DESCRIPTION = `Read a known text file from the code-execution sandbox. Returns line-numbered text; large files may be truncated around 256KB.
 
-CONSTRAINTS:
-- Only files produced by code execution or attached to the code-execution sandbox are accessible.
-- Use paths returned by tool output or paths under /mnt/data/.
-- Do not guess file paths. Use bash_tool to inspect available sandbox files when needed.`;
+Use for text, CSV, JSON, Markdown, logs, and small source files at paths returned by tool output, just written, or under /mnt/data/. Do not run ls/find just to rediscover known paths. Use bash_tool for binary files, large files, transforms, metadata, or true filesystem discovery. /tmp is per-call scratch and unavailable later.`;
 
 const CODE_READ_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
   type: 'object',
   properties: {
-    file_path: {
+    path: {
       type: 'string',
       description:
         'Path to a file from code execution output, such as "/mnt/data/result.csv" or another path returned by the execution tool.',
     },
   },
-  required: ['file_path'],
+  required: ['path'],
 }) as LCTool['parameters'];
 
 const CODE_READ_FILE_DEF: LCTool = Object.freeze({
@@ -131,16 +156,216 @@ const CODE_READ_FILE_DEF: LCTool = Object.freeze({
   responseFormat: ReadFileToolDefinition.responseFormat,
 }) as LCTool;
 
+const SKILL_CREATE_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    path: {
+      type: 'string',
+      description:
+        'Path to write. Use "skills/{skillName}/..." for skill files when available, or a code-execution sandbox path such as "/mnt/data/result.txt" when code execution is enabled. For SKILL.md, the YAML frontmatter name must match {skillName}.',
+    },
+    content: {
+      type: 'string',
+      description: 'Complete file contents.',
+    },
+    overwrite: {
+      type: 'boolean',
+      description: 'Must be true to replace an existing file. Refuses otherwise.',
+      default: false,
+    },
+  },
+  required: ['path', 'content'],
+}) as LCTool['parameters'];
+
+const CODE_CREATE_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    path: {
+      type: 'string',
+      description:
+        'Path to write in the code-execution sandbox, such as "/mnt/data/result.txt". Prefer /mnt/data/{file} for files that should remain available to later sandbox calls.',
+    },
+    content: {
+      type: 'string',
+      description: 'Complete file contents.',
+    },
+    overwrite: {
+      type: 'boolean',
+      description: 'Must be true to replace an existing file. Refuses otherwise.',
+      default: false,
+    },
+  },
+  required: ['path', 'content'],
+}) as LCTool['parameters'];
+
+const SKILL_EDIT_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    path: {
+      type: 'string',
+      description:
+        'Path to edit. Use "skills/{skillName}/..." for skill files when available, or a code-execution sandbox path such as "/mnt/data/result.txt" when code execution is enabled. edit_file cannot rename skills; keep SKILL.md frontmatter name equal to {skillName}.',
+    },
+    old_text: {
+      type: 'string',
+      description: 'Exact text to find. Must match exactly one location in the file.',
+    },
+    new_text: {
+      type: 'string',
+      description: 'Replacement text.',
+    },
+    edits: {
+      type: 'array',
+      description: 'Optional batch of replacements. Each old_text must match exactly once.',
+      items: {
+        type: 'object',
+        properties: {
+          old_text: { type: 'string' },
+          new_text: { type: 'string' },
+        },
+        required: ['old_text', 'new_text'],
+      },
+    },
+  },
+  required: ['path'],
+}) as LCTool['parameters'];
+
+const CODE_EDIT_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    path: {
+      type: 'string',
+      description: 'Path to edit in the code-execution sandbox, such as "/mnt/data/result.txt".',
+    },
+    old_text: {
+      type: 'string',
+      description: 'Exact text to find. Must match exactly one location in the file.',
+    },
+    new_text: {
+      type: 'string',
+      description: 'Replacement text.',
+    },
+    edits: {
+      type: 'array',
+      description: 'Optional batch of replacements. Each old_text must match exactly once.',
+      items: {
+        type: 'object',
+        properties: {
+          old_text: { type: 'string' },
+          new_text: { type: 'string' },
+        },
+        required: ['old_text', 'new_text'],
+      },
+    },
+  },
+  required: ['path'],
+}) as LCTool['parameters'];
+
+const SKILL_CREATE_FILE_DESCRIPTION = `Create a new file, or overwrite an existing file with explicit intent.
+
+Use for new files and full rewrites. Requires overwrite: true to replace existing files.
+
+Paths starting with "skills/" write skill files:
+- skills/{skillName}/SKILL.md - main instructions; keep it lean with YAML frontmatter, trigger-friendly description, workflow steps, and short snippets.
+- skills/{skillName}/references/{file} - long docs, schemas, examples, large templates, HTML/CSS/JS dashboards.
+- skills/{skillName}/scripts/{file} - helper scripts.
+- skills/{skillName}/assets/{file} - static assets.
+- skills/{skillName}/templates/{file} - reusable output templates.
+
+For SKILL.md, frontmatter name must match {skillName}; create skills/{newName}/SKILL.md to rename. Put large runnable artifacts in bundled files such as references/template.html, and have SKILL.md tell the agent when to read or reuse them.
+
+Non-skills paths target the code-execution sandbox when enabled. Prefer /mnt/data/{file}.`;
+
+const CODE_CREATE_FILE_DESCRIPTION = `Create a new file, or overwrite an existing file with explicit intent.
+
+Use for new files and full rewrites where the change is larger than half the file. Requires overwrite: true to replace existing files. Refuses otherwise.
+
+Targets code-execution sandbox paths. Prefer /mnt/data/{file} for files that should remain available to later sandbox calls.`;
+
+const SKILL_EDIT_FILE_DESCRIPTION = `Apply targeted text replacements to an existing file.
+
+Use for small, precise changes. Each old_text must match exactly one location. Tries exact match first; falls back to whitespace-tolerant matching if needed. Reports which matching strategy was used. Returns a unified diff.
+
+For skills/{skillName}/SKILL.md, edit description, title, or body content, but keep YAML frontmatter name equal to {skillName}. edit_file cannot rename skills; create a new skills/{newName}/SKILL.md for a different skill name. Keep SKILL.md concise; move large templates, HTML/CSS/JS dashboards, examples, schemas, and long docs into references/, scripts/, assets/, or templates/ files and point to them from SKILL.md.
+
+Paths starting with "skills/" target the skill file system. When code execution is enabled, non-skills paths target the code-execution sandbox.`;
+
+const CODE_EDIT_FILE_DESCRIPTION = `Apply targeted text replacements to an existing file.
+
+Use for small, precise changes. Each old_text must match exactly one location. Tries exact match first; falls back to whitespace-tolerant matching if needed. Reports which matching strategy was used. Returns a unified diff.
+
+Targets code-execution sandbox paths, such as /mnt/data/result.txt.`;
+
+const SKILL_CREATE_FILE_DEF: LCTool = Object.freeze({
+  name: CREATE_FILE_TOOL_NAME,
+  description: SKILL_CREATE_FILE_DESCRIPTION,
+  parameters: SKILL_CREATE_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const CODE_CREATE_FILE_DEF: LCTool = Object.freeze({
+  name: CREATE_FILE_TOOL_NAME,
+  description: CODE_CREATE_FILE_DESCRIPTION,
+  parameters: CODE_CREATE_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const SKILL_EDIT_FILE_DEF: LCTool = Object.freeze({
+  name: EDIT_FILE_TOOL_NAME,
+  description: SKILL_EDIT_FILE_DESCRIPTION,
+  parameters: SKILL_EDIT_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const CODE_EDIT_FILE_DEF: LCTool = Object.freeze({
+  name: EDIT_FILE_TOOL_NAME,
+  description: CODE_EDIT_FILE_DESCRIPTION,
+  parameters: CODE_EDIT_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
 function buildReadFileDef(includeSkillFileInstructions: boolean): LCTool {
   return includeSkillFileInstructions ? READ_FILE_DEF : CODE_READ_FILE_DEF;
 }
 
+function buildFileAuthoringDefs(includeSkillFileInstructions: boolean): LCTool[] {
+  return includeSkillFileInstructions
+    ? [SKILL_CREATE_FILE_DEF, SKILL_EDIT_FILE_DEF]
+    : [CODE_CREATE_FILE_DEF, CODE_EDIT_FILE_DEF];
+}
+
 function isCodeOnlyReadFileDef(def: LCTool | undefined): boolean {
   return (
     def?.name === ReadFileToolDefinition.name && def?.description === CODE_READ_FILE_DESCRIPTION
   );
 }
 
+function isCodeOnlyFileAuthoringDef(def: LCTool | undefined): boolean {
+  if (def?.name === CREATE_FILE_TOOL_NAME) {
+    return def.description === CODE_CREATE_FILE_DESCRIPTION;
+  }
+  if (def?.name === EDIT_FILE_TOOL_NAME) {
+    return def.description === CODE_EDIT_FILE_DESCRIPTION;
+  }
+  return false;
+}
+
+export function isFileAuthoringToolDefinition(def: LCTool | undefined): boolean {
+  if (def?.name === CREATE_FILE_TOOL_NAME) {
+    return (
+      def.description === CODE_CREATE_FILE_DESCRIPTION ||
+      def.description === SKILL_CREATE_FILE_DESCRIPTION
+    );
+  }
+  if (def?.name === EDIT_FILE_TOOL_NAME) {
+    return (
+      def.description === CODE_EDIT_FILE_DESCRIPTION ||
+      def.description === SKILL_EDIT_FILE_DESCRIPTION
+    );
+  }
+  return false;
+}
+
 /**
  * The `bash_tool` description varies along exactly one axis — whether
  * the LLM-facing `{{tool<idx>turn<turn>}}` reference syntax guide is
@@ -247,3 +472,54 @@ export function registerCodeExecutionTools(
     registered,
   };
 }
+
+export function registerFileAuthoringTools(
+  params: RegisterFileAuthoringToolsParams,
+): RegisterFileAuthoringToolsResult {
+  const { toolRegistry, toolDefinitions, includeSkillFileInstructions = true } = params;
+
+  const candidates = buildFileAuthoringDefs(includeSkillFileInstructions);
+  const inputDefinitions = toolDefinitions ?? [];
+  let workingDefinitions = inputDefinitions;
+
+  const registered: string[] = [];
+  const newDefs: LCTool[] = [];
+  for (const def of candidates) {
+    const existingIndex = workingDefinitions.findIndex((d) => d.name === def.name);
+    const existingDef = existingIndex >= 0 ? workingDefinitions[existingIndex] : undefined;
+    const registryDef = toolRegistry?.get(def.name);
+
+    if (
+      includeSkillFileInstructions &&
+      (isCodeOnlyFileAuthoringDef(existingDef) || isCodeOnlyFileAuthoringDef(registryDef))
+    ) {
+      if (isCodeOnlyFileAuthoringDef(existingDef)) {
+        workingDefinitions =
+          workingDefinitions === inputDefinitions ? [...inputDefinitions] : workingDefinitions;
+        workingDefinitions[existingIndex] = def;
+      }
+      if (isCodeOnlyFileAuthoringDef(registryDef)) {
+        toolRegistry?.set(def.name, def);
+      }
+      continue;
+    }
+
+    const inRegistry = toolRegistry?.has(def.name) === true;
+    const inDefs = existingIndex >= 0;
+    if (inRegistry || inDefs) {
+      continue;
+    }
+
+    toolRegistry?.set(def.name, def);
+    newDefs.push(def);
+    registered.push(def.name);
+  }
+
+  if (newDefs.length === 0) {
+    return { toolDefinitions: workingDefinitions, registered };
+  }
+  return {
+    toolDefinitions: [...workingDefinitions, ...newDefs],
+    registered,
+  };
+}
diff --git a/packages/api/src/agents/usage.bulk-parity.spec.ts b/packages/api/src/agents/usage.bulk-parity.spec.ts
index a18565ba0db..5520b667949 100644
--- a/packages/api/src/agents/usage.bulk-parity.spec.ts
+++ b/packages/api/src/agents/usage.bulk-parity.spec.ts
@@ -223,12 +223,17 @@ describe('recordCollectedUsage — bulk path parity', () => {
   });
 
   describe('cache token handling - Anthropic format', () => {
-    it('should route Anthropic cache entries to structured path — same input_tokens as legacy', async () => {
+    it('routes Anthropic cache entries to structured path and subtracts cache from input', async () => {
+      /** Production Anthropic wire: input_tokens is cache-inclusive (140 =
+       *  100 fresh + 25 write + 15 read) and provider is tagged. The billed
+       *  input must be the fresh 100, not 140 — otherwise cache is charged
+       *  twice (full input rate + cache rate). Regression for LibreChat#13795. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 100,
+          input_tokens: 140,
           output_tokens: 50,
           model: 'claude-3',
+          provider: 'anthropic',
           cache_creation_input_tokens: 25,
           cache_read_input_tokens: 15,
         },
@@ -236,7 +241,7 @@ describe('recordCollectedUsage — bulk path parity', () => {
 
       const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
 
-      expect(result?.input_tokens).toBe(140); // 100 + 25 + 15
+      expect(result?.input_tokens).toBe(140);
       expect(mockInsertMany).toHaveBeenCalledTimes(1);
       expect(mockSpendStructuredTokens).not.toHaveBeenCalled();
 
@@ -339,34 +344,48 @@ describe('recordCollectedUsage — bulk path parity', () => {
     });
 
     it('should handle cache tokens with multiple tool calls — same totals as legacy', async () => {
+      /** Cache-inclusive Anthropic wire (input_tokens = fresh + write + read).
+       *  The billed input on each call is the fresh portion only. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 788,
+          input_tokens: 31596, // 788 fresh + 30808 write
           output_tokens: 163,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 0, cache_creation: 30808 },
         },
         {
-          input_tokens: 3802,
+          input_tokens: 35378, // 3802 fresh + 30808 read + 768 write
           output_tokens: 149,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 30808, cache_creation: 768 },
         },
         {
-          input_tokens: 26808,
+          input_tokens: 58384, // 26808 fresh + 31576 read
           output_tokens: 225,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 31576, cache_creation: 0 },
         },
       ];
 
       const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
 
-      expect(result?.input_tokens).toBe(31596); // 788 + 30808 + 0
+      expect(result?.input_tokens).toBe(31596); // total prompt of first call
       expect(result?.output_tokens).toBe(537); // 163 + 149 + 225
       expect(mockInsertMany).toHaveBeenCalledTimes(1);
       expect(mockSpendStructuredTokens).not.toHaveBeenCalled();
       expect(mockSpendTokens).not.toHaveBeenCalled();
+
+      /** Each prompt doc bills only the fresh portion — cache is never folded
+       *  into inputTokens on top of its own write/read charge. */
+      const promptDocs = mockInsertMany.mock.calls[0][0].filter(
+        (d: { tokenType: string }) => d.tokenType === 'prompt',
+      );
+      expect(promptDocs.map((d: { inputTokens: number }) => d.inputTokens)).toEqual([
+        -788, -3802, -26808,
+      ]);
     });
   });
 
diff --git a/packages/api/src/agents/usage.spec.ts b/packages/api/src/agents/usage.spec.ts
index bee0c5248b8..a9a33151463 100644
--- a/packages/api/src/agents/usage.spec.ts
+++ b/packages/api/src/agents/usage.spec.ts
@@ -1,7 +1,18 @@
+import type { TContextUsageEvent, TTokenUsageEvent } from 'librechat-data-provider';
+import type { RecordUsageDeps, RecordUsageParams, SubagentUsageEvent } from './usage';
 import type { UsageMetadata } from '../stream/interfaces/IJobStore';
-import type { RecordUsageDeps, RecordUsageParams } from './usage';
 import type { BulkWriteDeps, PricingFns } from './transactions';
-import { recordCollectedUsage } from './usage';
+import {
+  computeUsageCostUSD,
+  aggregateEmittedUsage,
+  createSubagentUsageSink,
+  recordCollectedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+  buildAbortedResponseMetadata,
+  computeSummaryUsedTokens,
+  priorRunOutputTokens,
+} from './usage';
 
 describe('recordCollectedUsage', () => {
   let mockSpendTokens: jest.Mock;
@@ -148,6 +159,140 @@ describe('recordCollectedUsage', () => {
     });
   });
 
+  describe('subagent usage segregation', () => {
+    it('bills subagent entries under separate context while excluding them from reported totals', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'message',
+          input_tokens: 120,
+          output_tokens: 40,
+          model: 'gpt-4',
+        },
+        {
+          usage_type: 'subagent',
+          input_tokens: 900,
+          output_tokens: 700,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+        },
+        {
+          usage_type: 'subagent',
+          input_tokens: 1100,
+          output_tokens: 300,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      /**
+       * `input_tokens` comes from the first MESSAGE usage; `output_tokens`
+       * excludes subagent completions — the result becomes the parent
+       * response message's tokenCount, and child output the parent never
+       * saw must not distort next-turn context accounting.
+       */
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      /** ...but every subagent call is still billed against balance. */
+      expect(mockSpendTokens).toHaveBeenCalledTimes(3);
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        { promptTokens: 900, completionTokens: 700 },
+      );
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        3,
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        { promptTokens: 1100, completionTokens: 300 },
+      );
+    });
+
+    it('bills hidden sequential-agent usage but excludes it from reported totals', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        { usage_type: 'message', input_tokens: 120, output_tokens: 40, model: 'gpt-4' },
+        { usage_type: 'sequential', input_tokens: 800, output_tokens: 250, model: 'gpt-4' },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      /** Hidden intermediate output stays out of the parent's tokenCount... */
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      /** ...but is still billed under its own context. */
+      expect(mockSpendTokens).toHaveBeenCalledTimes(2);
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({ context: 'sequential', model: 'gpt-4' }),
+        { promptTokens: 800, completionTokens: 250 },
+      );
+    });
+
+    it('does not let a leading subagent entry hijack reported input_tokens', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'subagent',
+          input_tokens: 5000,
+          output_tokens: 900,
+          model: 'claude-haiku-4-5',
+        },
+        {
+          input_tokens: 120,
+          output_tokens: 40,
+          model: 'gpt-4',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      expect(mockSpendTokens).toHaveBeenCalledTimes(2);
+    });
+
+    it('uses structured spend for subagent entries with cache tokens', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        { input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
+        {
+          usage_type: 'subagent',
+          input_tokens: 200,
+          output_tokens: 80,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+          input_token_details: { cache_creation: 60, cache_read: 30 },
+        },
+      ];
+
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledTimes(1);
+      /** Anthropic input_tokens is cache-inclusive, so cache is subtracted out
+       *  of the billed input: 200 − 60 − 30 = 110 (not double-charged). */
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        {
+          promptTokens: { input: 110, write: 60, read: 30 },
+          completionTokens: 80,
+        },
+      );
+    });
+  });
+
   describe('parallel execution (multiple agents)', () => {
     it('should handle parallel agents with independent input tokens', async () => {
       const collectedUsage: UsageMetadata[] = [
@@ -336,11 +481,13 @@ describe('recordCollectedUsage', () => {
 
   describe('cache token handling - Anthropic format', () => {
     it('should use spendStructuredTokens for cache tokens (cache_*_input_tokens)', async () => {
+      /** Cache-inclusive input_tokens (140 = 100 fresh + 25 write + 15 read). */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 100,
+          input_tokens: 140,
           output_tokens: 50,
           model: 'claude-3',
+          provider: 'anthropic',
           cache_creation_input_tokens: 25,
           cache_read_input_tokens: 15,
         },
@@ -360,7 +507,7 @@ describe('recordCollectedUsage', () => {
           completionTokens: 50,
         },
       );
-      expect(result?.input_tokens).toBe(140); // 100 + 25 + 15
+      expect(result?.input_tokens).toBe(140);
     });
   });
 
@@ -478,10 +625,10 @@ describe('recordCollectedUsage', () => {
         collectedUsage,
       });
 
-      expect(mockSpendTokens).toHaveBeenCalledWith(
-        expect.anything(),
-        { promptTokens: 100, completionTokens: 50 },
-      );
+      expect(mockSpendTokens).toHaveBeenCalledWith(expect.anything(), {
+        promptTokens: 100,
+        completionTokens: 50,
+      });
       expect(result?.output_tokens).toBe(50);
     });
   });
@@ -565,23 +712,27 @@ describe('recordCollectedUsage', () => {
     });
 
     it('should handle cache tokens with multiple tool calls', async () => {
+      /** Cache-inclusive Anthropic wire: input_tokens = fresh + write + read. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 788,
+          input_tokens: 31596, // 788 fresh + 30808 write
           output_tokens: 163,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 0, cache_creation: 30808 },
         },
         {
-          input_tokens: 3802,
+          input_tokens: 35378, // 3802 fresh + 30808 read + 768 write
           output_tokens: 149,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 30808, cache_creation: 768 },
         },
         {
-          input_tokens: 26808,
+          input_tokens: 58384, // 26808 fresh + 31576 read
           output_tokens: 225,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 31576, cache_creation: 0 },
         },
       ];
@@ -591,7 +742,7 @@ describe('recordCollectedUsage', () => {
         collectedUsage,
       });
 
-      // input_tokens = 788 + 30808 + 0 = 31596
+      // input_tokens = total prompt of first call (cache-inclusive)
       expect(result?.input_tokens).toBe(31596);
       // output_tokens = 163 + 149 + 225 = 537
       expect(result?.output_tokens).toBe(537);
@@ -669,6 +820,77 @@ describe('recordCollectedUsage', () => {
       );
     });
 
+    it('prices each usage with its agent endpoint config (multi-endpoint graph)', async () => {
+      /** Two endpoints share a model id but bill at different rates. */
+      const primaryConfig = { 'shared-model': { prompt: 0.01, completion: 0.03, context: 8192 } };
+      const subagentConfig = { 'shared-model': { prompt: 0.05, completion: 0.15, context: 8192 } };
+      const byAgent: Record<string, typeof primaryConfig> = {
+        primary: primaryConfig,
+        sub: subagentConfig,
+      };
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'message',
+          agentId: 'primary',
+          input_tokens: 100,
+          output_tokens: 50,
+          model: 'shared-model',
+        },
+        {
+          usage_type: 'subagent',
+          agentId: 'sub',
+          input_tokens: 200,
+          output_tokens: 80,
+          model: 'shared-model',
+        },
+      ];
+
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+        endpointTokenConfig: primaryConfig,
+        resolveEndpointTokenConfig: (usage) =>
+          usage.agentId != null ? byAgent[usage.agentId] : undefined,
+      });
+
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'message',
+          model: 'shared-model',
+          endpointTokenConfig: primaryConfig,
+        }),
+        { promptTokens: 100, completionTokens: 50 },
+      );
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'shared-model',
+          endpointTokenConfig: subagentConfig,
+        }),
+        { promptTokens: 200, completionTokens: 80 },
+      );
+    });
+
+    it('trusts the resolver result, including undefined (built-in pricing for known agents)', async () => {
+      const batch = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage: [
+          { agentId: 'known-openai', input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
+        ],
+        endpointTokenConfig: batch,
+        /** A known agent with no configured rates: the resolver returns undefined
+         *  and the billing path must honor it (built-in pricing), NOT re-apply
+         *  the batch/primary config. */
+        resolveEndpointTokenConfig: () => undefined,
+      });
+
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ endpointTokenConfig: undefined }),
+        { promptTokens: 100, completionTokens: 50 },
+      );
+    });
+
     it('should use default context "message" when not provided', async () => {
       const collectedUsage: UsageMetadata[] = [
         { input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
@@ -988,6 +1210,107 @@ describe('recordCollectedUsage', () => {
     });
   });
 
+  describe('Bedrock prompt caching — completion token inflation regression', () => {
+    it('does not fold cache_creation into completion on the first cached step', async () => {
+      // Bedrock: total = input + output + cache_creation (additive, not subset).
+      // Before fix: resolveCompletionTokens returned output + cache_creation (5500)
+      // instead of output (500).
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 100,
+          output_tokens: 500,
+          total_tokens: 5600,
+          cache_creation_input_tokens: 5000,
+          cache_read_input_tokens: 0,
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ model: 'claude-sonnet-4-6' }),
+        {
+          promptTokens: { input: 100, write: 5000, read: 0 },
+          completionTokens: 500,
+        },
+      );
+      expect(result?.output_tokens).toBe(500);
+    });
+
+    it('does not fold cache_read into completion on subsequent cached steps', async () => {
+      // Bedrock: total = input + output + cache_read on every read step.
+      // Before fix: each step returned output + cache_read instead of output.
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 200,
+          output_tokens: 300,
+          total_tokens: 4500,
+          cache_read_input_tokens: 4000,
+          cache_creation_input_tokens: 0,
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ model: 'claude-sonnet-4-6' }),
+        {
+          promptTokens: { input: 200, write: 0, read: 4000 },
+          completionTokens: 300,
+        },
+      );
+      expect(result?.output_tokens).toBe(300);
+    });
+
+    it('handles cache tokens in input_token_details format (alternate field path)', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 200,
+          output_tokens: 300,
+          total_tokens: 4500,
+          input_token_details: { cache_read: 4000, cache_creation: 0 },
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(result?.output_tokens).toBe(300);
+    });
+
+    it('accumulates only true output across a multi-step cached agent run', async () => {
+      // 1 write step + 4 read steps. Without the fix, each step folds its
+      // cache tokens into completion, inflating the total by the full cache size.
+      const writeStep: UsageMetadata = {
+        input_tokens: 100,
+        output_tokens: 500,
+        total_tokens: 5600,
+        cache_creation_input_tokens: 5000,
+        cache_read_input_tokens: 0,
+        model: 'claude-sonnet-4-6',
+      };
+      const readSteps: UsageMetadata[] = Array.from({ length: 4 }, (_, i) => ({
+        input_tokens: 200,
+        output_tokens: 300 + i * 50,
+        total_tokens: 200 + (300 + i * 50) + 5000,
+        cache_read_input_tokens: 5000,
+        cache_creation_input_tokens: 0,
+        model: 'claude-sonnet-4-6',
+      }));
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage: [writeStep, ...readSteps],
+      });
+
+      // True output: 500 + 300 + 350 + 400 + 450 = 2000
+      const trueOutput = 500 + readSteps.reduce((sum, s) => sum + (s.output_tokens ?? 0), 0);
+      expect(result?.output_tokens).toBe(trueOutput);
+    });
+  });
+
   describe('bulk write with summarization usage', () => {
     let mockInsertMany: jest.Mock;
     let mockUpdateBalance: jest.Mock;
@@ -1114,3 +1437,657 @@ describe('recordCollectedUsage', () => {
     });
   });
 });
+
+describe('createSubagentUsageSink', () => {
+  const makeEvent = (overrides: Partial<SubagentUsageEvent> = {}): SubagentUsageEvent => ({
+    usage: { input_tokens: 900, output_tokens: 700, total_tokens: 1600 },
+    model: 'claude-haiku-4-5',
+    provider: 'anthropic',
+    subagentType: 'researcher',
+    subagentRunId: 'run-1_sub_abc',
+    subagentAgentId: 'researcher',
+    runId: 'run-1',
+    ...overrides,
+  });
+
+  it('pushes usage tagged with usage_type subagent and the child model/provider', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent());
+
+    expect(collectedUsage).toEqual([
+      {
+        usage_type: 'subagent',
+        input_tokens: 900,
+        output_tokens: 700,
+        total_tokens: 1600,
+        model: 'claude-haiku-4-5',
+        provider: 'anthropic',
+        agentId: 'researcher',
+      },
+    ]);
+  });
+
+  it('tags the child agent id so the host can price with the subagent endpoint config', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const emitted: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage, (u) => emitted.push(u));
+
+    sink(makeEvent({ subagentAgentId: 'agent_xyz' }));
+
+    expect(collectedUsage[0].agentId).toBe('agent_xyz');
+    /** The same tagged object is handed to onUsage (the live emitter). */
+    expect(emitted[0]).toBe(collectedUsage[0]);
+    expect(emitted[0].agentId).toBe('agent_xyz');
+  });
+
+  it('preserves cache token details from the child call', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(
+      makeEvent({
+        usage: {
+          input_tokens: 200,
+          output_tokens: 80,
+          total_tokens: 280,
+          input_token_details: { cache_creation: 60, cache_read: 30 },
+        } as SubagentUsageEvent['usage'],
+      }),
+    );
+
+    expect(collectedUsage[0].input_token_details).toEqual({
+      cache_creation: 60,
+      cache_read: 30,
+    });
+  });
+
+  it('omits model/provider tags when the event carries none', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent({ model: undefined, provider: undefined }));
+
+    expect(collectedUsage).toHaveLength(1);
+    expect(collectedUsage[0].usage_type).toBe('subagent');
+    expect(collectedUsage[0]).not.toHaveProperty('model');
+    expect(collectedUsage[0]).not.toHaveProperty('provider');
+  });
+
+  it('ignores events without usage', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent({ usage: undefined as unknown as SubagentUsageEvent['usage'] }));
+
+    expect(collectedUsage).toEqual([]);
+  });
+
+  it('round-trips into recordCollectedUsage as billed subagent transactions', async () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    /** Parent's own call, collected by ModelEndHandler as usual. */
+    collectedUsage.push({ input_tokens: 120, output_tokens: 40, model: 'gpt-4' });
+    /** Child calls reported through the sink mid-run. */
+    sink(makeEvent());
+    sink(
+      makeEvent({
+        usage: { input_tokens: 1100, output_tokens: 300, total_tokens: 1400 },
+      }),
+    );
+
+    const spendTokens = jest.fn().mockResolvedValue(undefined);
+    const spendStructuredTokens = jest.fn().mockResolvedValue(undefined);
+    const result = await recordCollectedUsage(
+      { spendTokens, spendStructuredTokens },
+      {
+        user: 'user-123',
+        conversationId: 'convo-123',
+        model: 'gpt-4',
+        collectedUsage,
+      },
+    );
+
+    /** All three calls billed; child output excluded from reported totals. */
+    expect(spendTokens).toHaveBeenCalledTimes(3);
+    expect(spendTokens).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({ context: 'subagent', model: 'claude-haiku-4-5' }),
+      { promptTokens: 900, completionTokens: 700 },
+    );
+    expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+  });
+});
+
+describe('computeUsageCostUSD', () => {
+  /** Stub pricing: base prompt 3 / completion 15, cache write 3.75 / read 0.3;
+   *  a premium tier above 200k input prompt tokens (8 / 40). Mirrors the
+   *  shape of the real getMultiplier(inputTokenCount) premium switch. */
+  const pricing: PricingFns = {
+    getMultiplier: ({ tokenType, inputTokenCount }) => {
+      const premium = (inputTokenCount ?? 0) > 200000;
+      if (tokenType === 'completion') {
+        return premium ? 40 : 15;
+      }
+      return premium ? 8 : 3;
+    },
+    getCacheMultiplier: ({ cacheType }) => (cacheType === 'write' ? 3.75 : 0.3),
+  };
+
+  it('prices a standard call at base rates', () => {
+    const cost = computeUsageCostUSD(
+      { input_tokens: 1000, output_tokens: 500, model: 'gpt-4', provider: 'openAI' },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((1000 * 3 + 500 * 15) / 1e6);
+  });
+
+  it('applies the premium tier when the call exceeds the input threshold', () => {
+    /** The exact gap finding A flagged: a long-context call bills premium */
+    const cost = computeUsageCostUSD(
+      { input_tokens: 300000, output_tokens: 1000, model: 'gpt-5.5', provider: 'openAI' },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((300000 * 8 + 1000 * 40) / 1e6);
+  });
+
+  it('prices cache-inclusive Anthropic input by subtracting cache, then cache at its own rates', () => {
+    /** input_tokens is cache-inclusive (13000 = 1000 fresh + 2000 write + 10000
+     *  read). The fresh 1000 is billed at the input rate, the cache at its own
+     *  rates — never the cache portion at the input rate too (LibreChat#13795). */
+    const cost = computeUsageCostUSD(
+      {
+        input_tokens: 13000,
+        output_tokens: 500,
+        model: 'claude-haiku-4-5',
+        provider: 'anthropic',
+        input_token_details: { cache_creation: 2000, cache_read: 10000 },
+      },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((1000 * 3 + 2000 * 3.75 + 10000 * 0.3 + 500 * 15) / 1e6);
+  });
+});
+
+describe('aggregateEmittedUsage', () => {
+  it('returns null for no emitted events', () => {
+    expect(aggregateEmittedUsage([])).toBeNull();
+  });
+
+  it('normalizes each call into display units (input excludes cache) and sums cost', () => {
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        total_tokens: 120,
+        model: 'gpt-4o-mini',
+        provider: 'openAI',
+        cost: 0.001,
+      },
+      {
+        input_tokens: 150,
+        output_tokens: 10,
+        total_tokens: 160,
+        input_token_details: { cache_creation: 30, cache_read: 50 },
+        model: 'gpt-4o-mini',
+        provider: 'openAI',
+        cost: 0.002,
+      },
+    ];
+    /** openAI is cache-subset: input excludes cache (150−30−50=70) */
+    expect(aggregateEmittedUsage(events)).toEqual({
+      input: 170,
+      output: 30,
+      cacheWrite: 30,
+      cacheRead: 50,
+      cost: 0.003,
+    });
+  });
+
+  it('omits cost when no event carried it (contextCost off)', () => {
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI' },
+    ]);
+    expect(rollup).toEqual({ input: 100, output: 20, cacheWrite: 0, cacheRead: 0 });
+    expect(rollup?.cost).toBeUndefined();
+  });
+
+  it('omits cost when any call lacked it (partial pricing failure)', () => {
+    /** One call priced, one missing cost (e.g. computeUsageCostUSD threw) →
+     *  the sum would under-report, so coverage is incomplete and cost omitted. */
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 100, output_tokens: 20, provider: 'openAI', cost: 0.01 },
+      { input_tokens: 50, output_tokens: 10, provider: 'openAI' },
+    ]);
+    expect(rollup?.cost).toBeUndefined();
+    expect(rollup?.input).toBe(150);
+    expect(rollup?.output).toBe(30);
+  });
+
+  it('normalizes mixed-provider calls per their own provider before summing', () => {
+    /** bedrock is additive (cache separate from input), openAI is subset */
+    const rollup = aggregateEmittedUsage([
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        provider: 'bedrock',
+        input_token_details: { cache_read: 40 },
+        cost: 0.01,
+      },
+      {
+        input_tokens: 90,
+        output_tokens: 5,
+        usage_type: 'subagent',
+        provider: 'openAI',
+        input_token_details: { cache_read: 30 },
+        cost: 0.02,
+      },
+    ]);
+    /** bedrock input stays 100 (additive); openAI input 90−30=60 → 160 */
+    expect(rollup?.input).toBe(160);
+    expect(rollup?.output).toBe(25);
+    expect(rollup?.cacheRead).toBe(70);
+    expect(rollup?.cost).toBeCloseTo(0.03);
+  });
+
+  it('uses the magnitude fallback for provider-less cached events (matches live)', () => {
+    /** No provider: the client's normalizeUsageUnits uses a magnitude heuristic
+     *  (cache ≤ input ⇒ input includes cache), so the rollup must too — billing
+     *  splitUsage would treat it as additive and leave input at 1000, diverging
+     *  from the live display after reload. */
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 1000, output_tokens: 100, input_token_details: { cache_read: 400 } },
+    ]);
+    expect(rollup).toEqual({ input: 600, output: 100, cacheWrite: 0, cacheRead: 400 });
+  });
+});
+
+describe('buildPersistedContextUsage', () => {
+  const baseSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 8000,
+      instructionTokens: 100,
+      systemMessageTokens: 80,
+      dynamicInstructionTokens: 20,
+      toolSchemaTokens: 30,
+      summaryTokens: 0,
+      toolCount: 2,
+      messageCount: 3,
+      messageTokens: 500,
+      availableForMessages: 7000,
+      toolTokenCounts: { add: 15, noop: 0 },
+    },
+    contextBudget: 7800,
+  };
+
+  it('trims zero-valued per-tool counts', () => {
+    const result = buildPersistedContextUsage(baseSnapshot);
+    expect(result.breakdown.toolTokenCounts).toEqual({ add: 15 });
+    expect(result.contextBudget).toBe(7800);
+  });
+
+  it('drops the tool counts object entirely when all are zero', () => {
+    const result = buildPersistedContextUsage({
+      ...baseSnapshot,
+      breakdown: { ...baseSnapshot.breakdown, toolTokenCounts: { add: 0 } },
+    });
+    expect(result.breakdown.toolTokenCounts).toBeUndefined();
+  });
+
+  it('passes through a snapshot without tool counts', () => {
+    const { toolTokenCounts: _omit, ...breakdown } = baseSnapshot.breakdown;
+    const result = buildPersistedContextUsage({ ...baseSnapshot, breakdown });
+    expect(result.breakdown.toolTokenCounts).toBeUndefined();
+    expect(result.breakdown.messageTokens).toBe(500);
+  });
+
+  it('records the final primary call output as completedOutputTokens', () => {
+    /** The latest snapshot precedes the final call, so its post-snapshot delta
+     *  is that call's output — not the full multi-call response tokenCount. */
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 40, total_tokens: 140, provider: 'openAI' },
+      { input_tokens: 200, output_tokens: 25, total_tokens: 225, provider: 'openAI' },
+      {
+        input_tokens: 50,
+        output_tokens: 12,
+        usage_type: 'subagent',
+        provider: 'openAI',
+      },
+    ];
+    const result = buildPersistedContextUsage(baseSnapshot, events);
+    /** Last PRIMARY call's completion (25), skipping the trailing subagent event */
+    expect(result.completedOutputTokens).toBe(25);
+  });
+
+  it('omits completedOutputTokens when there are no primary calls', () => {
+    expect(buildPersistedContextUsage(baseSnapshot, []).completedOutputTokens).toBeUndefined();
+  });
+
+  it('reconciles the inflated estimate to the final call’s real prompt tokens', () => {
+    /** Real web-search + summarization turn: calibration pinned at 5 inflated
+     *  messageTokens to 187471 (used 213375), but the answer call's true prompt was
+     *  55773 (Anthropic input_tokens is cache-inclusive; 2071 of it is cache read).
+     *  The persisted blob must show the real context so a reload isn't stuck
+     *  several× too high. */
+    const inflated: TContextUsageEvent = {
+      runId: 'run-1',
+      breakdown: {
+        maxContextTokens: 250000,
+        instructionTokens: 4205,
+        systemMessageTokens: 384,
+        dynamicInstructionTokens: 1525,
+        toolSchemaTokens: 2296,
+        summaryTokens: 1938,
+        toolCount: 1,
+        messageCount: 2,
+        messageTokens: 187471,
+        availableForMessages: 233295,
+      },
+      contextBudget: 237500,
+      remainingContextTokens: 24125,
+      calibrationRatio: 5,
+    };
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 55773, // cache-inclusive: 53702 fresh + 2071 read
+        output_tokens: 3780,
+        input_token_details: { cache_read: 2071, cache_creation: 0 },
+        provider: 'anthropic',
+        runId: 'run-1',
+      },
+    ];
+    const result = buildPersistedContextUsage(inflated, events);
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(55773);
+    expect(result.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    expect(result.completedOutputTokens).toBe(3780);
+  });
+
+  it('attributes completedOutputTokens to the snapshot run, not a parallel run', () => {
+    /** Parallel/direct runs interleave: this snapshot is run-1, but run-2 emits a
+     *  later primary usage. The persisted delta must be run-1's own output (40),
+     *  never run-2's trailing output (99). */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 40,
+        total_tokens: 140,
+        provider: 'openAI',
+        runId: 'run-1',
+      },
+      {
+        input_tokens: 200,
+        output_tokens: 99,
+        total_tokens: 299,
+        provider: 'openAI',
+        runId: 'run-2',
+      },
+    ];
+    const result = buildPersistedContextUsage(baseSnapshot, events);
+    expect(result.completedOutputTokens).toBe(40);
+  });
+
+  it('omits completedOutputTokens when only other runs emitted usage', () => {
+    /** The snapshot run never completed (no matching primary); a sibling run's
+     *  output must not be borrowed — fall back to the per-message estimate. */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 200,
+        output_tokens: 99,
+        total_tokens: 299,
+        provider: 'openAI',
+        runId: 'run-2',
+      },
+    ];
+    expect(buildPersistedContextUsage(baseSnapshot, events).completedOutputTokens).toBeUndefined();
+  });
+
+  it('matches untagged usage events for back-compat (older lib / resume)', () => {
+    /** Events without a runId predate run tagging; they match any snapshot so the
+     *  last primary (25) is still recorded. */
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 40, total_tokens: 140, provider: 'openAI' },
+      { input_tokens: 200, output_tokens: 25, total_tokens: 225, provider: 'openAI' },
+    ];
+    expect(buildPersistedContextUsage(baseSnapshot, events).completedOutputTokens).toBe(25);
+  });
+});
+
+describe('computeSummaryUsedTokens', () => {
+  const summarized = (over?: Partial<TContextUsageEvent>): TContextUsageEvent => ({
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 1000,
+      instructionTokens: 50,
+      systemMessageTokens: 50,
+      dynamicInstructionTokens: 0,
+      toolSchemaTokens: 0,
+      summaryTokens: 80,
+      toolCount: 0,
+      messageCount: 1,
+      messageTokens: 20,
+      availableForMessages: 900,
+    },
+    contextBudget: 1000,
+    remainingContextTokens: 700,
+    effectiveInstructionTokens: 50,
+    ...over,
+  });
+
+  it('uses contextBudget − remainingContextTokens when available', () => {
+    expect(computeSummaryUsedTokens(summarized())).toBe(300);
+  });
+
+  it('falls back to instructions + summary + messages, including summaryTokens', () => {
+    /** summaryTokens is a separate breakdown field, so the no-remaining fallback
+     *  must add it: 50 + 80 + 20 = 150, not 70. */
+    expect(computeSummaryUsedTokens(summarized({ remainingContextTokens: undefined }))).toBe(150);
+  });
+
+  it('returns undefined when the turn did not summarize', () => {
+    expect(
+      computeSummaryUsedTokens(
+        summarized({ breakdown: { ...summarized().breakdown, summaryTokens: 0 } }),
+      ),
+    ).toBeUndefined();
+    expect(computeSummaryUsedTokens(null)).toBeUndefined();
+    expect(computeSummaryUsedTokens(undefined)).toBeUndefined();
+  });
+
+  it('subtracts the response’s earlier tool-loop outputs from the marker', () => {
+    /** 300 baseUsed − 90 earlier outputs = 210, so the client estimate
+     *  (summaryBaseline + full response tokenCount) doesn’t double-count them. */
+    expect(computeSummaryUsedTokens(summarized(), 90)).toBe(210);
+  });
+
+  it('clamps to undefined when the prior outputs exceed the baseline', () => {
+    expect(computeSummaryUsedTokens(summarized(), 5000)).toBeUndefined();
+  });
+});
+
+describe('priorRunOutputTokens', () => {
+  const ev = (over: Partial<TTokenUsageEvent>): TTokenUsageEvent => ({
+    input_tokens: 10,
+    output_tokens: 0,
+    total_tokens: 10,
+    provider: 'openAI',
+    ...over,
+  });
+
+  it('sums primary outputs before the index for the matching run', () => {
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }),
+      ev({ output_tokens: 30, runId: 'run-1' }),
+      ev({ output_tokens: 99, runId: 'run-1' }), // at/after the index — excluded
+    ];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(50);
+  });
+
+  it('counts run-matched primary + summarization, skips subagent/sequential and other runs', () => {
+    /** Both the primary and the summarization output are in this run's tokenCount
+     *  AND baseline, so both are subtracted; subagent/sequential are excluded from
+     *  the reported output total; a parallel run's primary is not this snapshot's. */
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }), // primary, matches
+      ev({ output_tokens: 8, runId: 'run-1', usage_type: 'summarization' }), // counted
+      ev({ output_tokens: 5, runId: 'run-1', usage_type: 'subagent' }), // skipped
+      ev({ output_tokens: 7, runId: 'run-1', usage_type: 'sequential' }), // skipped
+      ev({ output_tokens: 40, runId: 'run-2' }), // other-run primary — skipped
+    ];
+    expect(priorRunOutputTokens(events, 5, 'run-1')).toBe(28);
+  });
+
+  it('does not subtract a parallel sibling run’s summarization output', () => {
+    /** The summarize detour inherits the graph run id (traceConfig), so a sibling
+     *  run's summary carries a DIFFERENT runId; its summary is in the sibling's
+     *  baseline, not this snapshot's, so subtracting it would under-report. */
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }),
+      ev({ output_tokens: 8, runId: 'run-2', usage_type: 'summarization' }), // sibling — skipped
+    ];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(20);
+  });
+
+  it('matches untagged events for back-compat and returns 0 with no prior calls', () => {
+    const events = [ev({ output_tokens: 20 }), ev({ output_tokens: 30 })];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(50);
+    expect(priorRunOutputTokens(events, 0, 'run-1')).toBe(0);
+  });
+});
+
+describe('buildAbortedResponseMetadata', () => {
+  it('returns undefined for an empty job', () => {
+    expect(buildAbortedResponseMetadata(undefined)).toBeUndefined();
+    expect(buildAbortedResponseMetadata({})).toBeUndefined();
+    expect(buildAbortedResponseMetadata({ tokenUsage: 'not json' })).toBeUndefined();
+  });
+
+  it('rebuilds the usage/cost rollup from the job’s persisted emitted usage', () => {
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI', cost: 0.001 },
+    ];
+    const result = buildAbortedResponseMetadata({ tokenUsage: JSON.stringify(events) });
+    expect(result?.usage).toEqual({
+      input: 100,
+      output: 20,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.001,
+    });
+  });
+
+  it('never persists a breakdown for a stopped response (avoids final-call over-count)', () => {
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI' },
+    ];
+    const result = buildAbortedResponseMetadata({ tokenUsage: JSON.stringify(events) });
+    expect(result).toEqual({ usage: { input: 100, output: 20, cacheWrite: 0, cacheRead: 0 } });
+    expect((result as { contextUsage?: unknown }).contextUsage).toBeUndefined();
+  });
+
+  const abortSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 1000,
+      instructionTokens: 50,
+      systemMessageTokens: 50,
+      dynamicInstructionTokens: 0,
+      toolSchemaTokens: 0,
+      summaryTokens: 80,
+      toolCount: 0,
+      messageCount: 1,
+      messageTokens: 20,
+      availableForMessages: 900,
+    },
+    contextBudget: 1000,
+    remainingContextTokens: 700,
+  };
+
+  it('persists the summary marker (but not the full snapshot) for a stopped summarized turn', () => {
+    /** A single-call stopped turn: the interrupted call emitted no usage, so the
+     *  marker is the full baseUsed (300) with nothing to subtract. */
+    const result = buildAbortedResponseMetadata({
+      tokenUsage: JSON.stringify([]),
+      contextUsage: JSON.stringify(abortSnapshot),
+    });
+    expect(result?.summaryUsedTokens).toBe(300);
+    /** The full snapshot stays off the abort path (completedOutputTokens ambiguity). */
+    expect((result as { contextUsage?: unknown }).contextUsage).toBeUndefined();
+  });
+
+  it('does not subtract any output from the marker on a stopped turn', () => {
+    /** The abort tokenCount comes from countTokens(text) or is absent — it does
+     *  NOT fold in summarization/earlier-call output the way recordCollectedUsage
+     *  does. So the marker is the full baseUsed (300); subtracting the summarization
+     *  (8) or the primary (20) here would under-report after reload. */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        total_tokens: 120,
+        provider: 'openAI',
+        runId: 'run-1',
+      },
+      {
+        input_tokens: 60,
+        output_tokens: 8,
+        total_tokens: 68,
+        provider: 'openAI',
+        runId: 'run-1',
+        usage_type: 'summarization',
+      },
+    ];
+    const result = buildAbortedResponseMetadata({
+      tokenUsage: JSON.stringify(events),
+      contextUsage: JSON.stringify(abortSnapshot),
+    });
+    expect(result?.summaryUsedTokens).toBe(300);
+  });
+});
+
+describe('resolveAgentTokenConfig', () => {
+  const primary = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+  const subagent = { 'gpt-4': { prompt: 0.05, completion: 0.15, context: 8192 } };
+
+  it('returns the producing agent’s own config', () => {
+    const byAgentId = new Map([
+      ['primary', primary],
+      ['sub', subagent],
+    ]);
+    expect(resolveAgentTokenConfig({ agentId: 'sub', byAgentId, fallback: primary })).toBe(
+      subagent,
+    );
+  });
+
+  it('returns undefined for a known agent with no configured rates (built-in pricing)', () => {
+    /** A known non-custom agent (e.g. a normal OpenAI agent) is recorded with an
+     *  undefined config; it must NOT inherit the custom-primary rates. */
+    const byAgentId = new Map<string, typeof primary | undefined>([
+      ['primary', primary],
+      ['known-openai', undefined],
+    ]);
+    expect(
+      resolveAgentTokenConfig({ agentId: 'known-openai', byAgentId, fallback: primary }),
+    ).toBeUndefined();
+  });
+
+  it('falls back to the primary config for an untagged usage', () => {
+    const byAgentId = new Map([['primary', primary]]);
+    expect(resolveAgentTokenConfig({ agentId: undefined, byAgentId, fallback: primary })).toBe(
+      primary,
+    );
+  });
+
+  it('falls back to the primary config for an unknown agent id', () => {
+    const byAgentId = new Map([['primary', primary]]);
+    expect(resolveAgentTokenConfig({ agentId: 'ghost', byAgentId, fallback: primary })).toBe(
+      primary,
+    );
+  });
+
+  it('returns the fallback when there is no per-agent map (single-endpoint graphs)', () => {
+    expect(resolveAgentTokenConfig({ agentId: 'primary', fallback: primary })).toBe(primary);
+  });
+});
diff --git a/packages/api/src/agents/usage.ts b/packages/api/src/agents/usage.ts
index 3d8ddf37991..6e6b1c14f3d 100644
--- a/packages/api/src/agents/usage.ts
+++ b/packages/api/src/agents/usage.ts
@@ -1,6 +1,16 @@
 import { logger } from '@librechat/data-schemas';
-import { Providers } from 'librechat-data-provider';
-import type { TCustomConfig, TTransactionsConfig } from 'librechat-data-provider';
+import {
+  inputTokensIncludesCache,
+  reconcileContextUsage,
+  promptTokensFromUsage,
+} from 'librechat-data-provider';
+import type {
+  TCustomConfig,
+  TResponseUsage,
+  TTokenUsageEvent,
+  TContextUsageEvent,
+  TTransactionsConfig,
+} from 'librechat-data-provider';
 import type {
   StructuredTokenUsage,
   BulkWriteDeps,
@@ -23,33 +33,6 @@ type SpendStructuredTokensFn = (
   tokenUsage: StructuredTokenUsage,
 ) => Promise<unknown>;
 
-/**
- * Providers whose `usage_metadata.input_tokens` ALREADY INCLUDES cached tokens
- * (i.e. `input_token_details.cache_*` is a subset, not an additional charge):
- *
- *   - Google / Vertex AI: `input_tokens` = `promptTokenCount` (includes `cachedContentTokenCount`)
- *   - OpenAI / Azure OpenAI: `input_tokens` = `prompt_tokens` (includes `prompt_tokens_details.cached_tokens`)
- *   - xAI, DeepSeek, OpenRouter, Moonshot: extend `ChatOpenAI`, same semantics
- *
- * Anthropic and Bedrock keep cache values separate from `input_tokens`, so they
- * must be added back to compute the total prompt size — that's the historical
- * additive default. Providers not listed here fall through to additive.
- */
-const SUBSET_PROVIDERS: ReadonlySet<string> = new Set([
-  Providers.OPENAI,
-  Providers.AZURE,
-  Providers.GOOGLE,
-  Providers.VERTEXAI,
-  Providers.XAI,
-  Providers.DEEPSEEK,
-  Providers.OPENROUTER,
-  Providers.MOONSHOT,
-]);
-
-function inputTokensIncludesCache(provider?: string): boolean {
-  return provider != null && SUBSET_PROVIDERS.has(provider);
-}
-
 /**
  * Resolves `completionTokens` for billing, repairing providers whose
  * `usage_metadata.output_tokens` undercounts.
@@ -58,22 +41,43 @@ function inputTokensIncludesCache(provider?: string): boolean {
  * `total_tokens === input_tokens + output_tokens`. Compliant providers
  * (OpenAI, Anthropic, Google API via agents' `CustomChatGoogleGenerativeAI`)
  * include any reasoning/thinking tokens inside `output_tokens` already,
- * so the invariant holds.
+ * so the invariant holds and this function is a no-op for them.
  *
- * Vertex AI Gemini through `@langchain/google-common`'s streaming path
- * emits `output_tokens = candidatesTokenCount` and drops `thoughtsTokenCount`,
- * leaving `total - input > output`. When that gap shows up we use the
- * invariant to recover the correct billable output (`total - input`).
- * Compliant providers have a zero gap, so this is a no-op for them.
+ * **Vertex AI undercount (issue #13006):** `@langchain/google-common`'s streaming
+ * path emits `output_tokens = candidatesTokenCount` and drops `thoughtsTokenCount`,
+ * so `total - input > output`. The gap is recovered as `total - input`.
  *
- * Tracked in: https://github.com/danny-avila/LibreChat/issues/13006
+ * **Bedrock cache inflation:** additive providers keep cache tokens
+ * separate from `input_tokens`, making
+ * `total = input + output + cache_read + cache_creation`. Without adjustment
+ * the Vertex recovery fires on every cached step and returns
+ * `output + cache_read + cache_creation` instead of `output`, inflating
+ * completion counts by orders of magnitude. The fix subtracts the cache
+ * adjustment before the gap test — but only for additive providers; subset
+ * providers (Anthropic, Google, OpenAI, …) already include cache inside
+ * `input_tokens` so their `cacheAdjustment` is zero and the Vertex recovery
+ * is unaffected.
  */
 function resolveCompletionTokens(usage: UsageMetadata): number {
   const output = Number(usage.output_tokens) || 0;
   const total = Number(usage.total_tokens) || 0;
   const input = Number(usage.input_tokens) || 0;
-  if (total > input + output) {
-    return total - input;
+
+  // For additive providers (Bedrock), cache tokens are separate
+  // from input_tokens and are included in total_tokens, widening the gap
+  // independently of any missing thinking tokens. Subtract them so the gap
+  // check only fires when output_tokens genuinely undercounts (Vertex case).
+  // Subset providers fold cache into input_tokens, so their adjustment is 0.
+  const cacheRead =
+    Number(usage.input_token_details?.cache_read) || Number(usage.cache_read_input_tokens) || 0;
+  const cacheCreation =
+    Number(usage.input_token_details?.cache_creation) ||
+    Number(usage.cache_creation_input_tokens) ||
+    0;
+  const cacheAdjustment = inputTokensIncludesCache(usage.provider) ? 0 : cacheRead + cacheCreation;
+
+  if (total > input + output + cacheAdjustment) {
+    return total - input - cacheAdjustment;
   }
   return output;
 }
@@ -123,6 +127,356 @@ export interface RecordUsageDeps {
   bulkWriteOps?: BulkWriteDeps;
 }
 
+/**
+ * Authoritative USD cost of one model call. Reuses the exact billing
+ * functions (`prepareTokenSpend`/`prepareStructuredTokenSpend` → `getMultiplier`
+ * with `inputTokenCount` for premium tiers) so the figure emitted to the
+ * client matches what is charged against balance — the client must not
+ * re-derive pricing from base rates. `tokenValue` is credits (USD × 1e6).
+ */
+export function computeUsageCostUSD(
+  usage: UsageMetadata,
+  pricing: PricingFns,
+  endpointTokenConfig?: EndpointTokenConfig,
+): number {
+  const { inputOnly, cacheCreation, cacheRead, completion } = splitUsage(usage);
+  /** user/context/conversationId only populate the transaction doc, which is
+   *  discarded here — only `tokenValue` (credits) is summed */
+  const txData: TxMetadata = {
+    user: '',
+    context: 'message',
+    conversationId: '',
+    model: usage.model,
+    endpointTokenConfig,
+  };
+  const entries =
+    cacheCreation > 0 || cacheRead > 0
+      ? prepareStructuredTokenSpend(
+          txData,
+          {
+            promptTokens: { input: inputOnly, write: cacheCreation, read: cacheRead },
+            completionTokens: completion,
+          },
+          pricing,
+        )
+      : prepareTokenSpend(
+          txData,
+          { promptTokens: inputOnly, completionTokens: completion },
+          pricing,
+        );
+  const credits = entries.reduce((sum, entry) => sum + Math.abs(entry.tokenValue), 0);
+  return credits / 1e6;
+}
+
+/**
+ * Aggregates the per-model-call `on_token_usage` payloads emitted for one
+ * response into a single rollup, persisted on `responseMessage.metadata.usage`.
+ *
+ * Each event is normalized into display units with the SAME logic the live
+ * client uses (`splitUsage`: input excludes cache, output is repaired) BEFORE
+ * summing, so the rollup reproduces the live branch/total usage exactly even
+ * when a turn mixes providers (e.g. a summarization or subagent call on a
+ * different provider than the primary). `cost` is the additive sum of the
+ * authoritative per-event cost, included only when at least one event carried
+ * it (i.e. `interface.contextCost` was on).
+ */
+export function aggregateEmittedUsage(
+  events: ReadonlyArray<TTokenUsageEvent>,
+): TResponseUsage | null {
+  if (events.length === 0) {
+    return null;
+  }
+  let input = 0;
+  let output = 0;
+  let cacheWrite = 0;
+  let cacheRead = 0;
+  let cost = 0;
+  /** Persist cost only with COMPLETE coverage — every call priced. A partial
+   *  sum (e.g. one call's `computeUsageCostUSD` threw and emitted without cost)
+   *  would read back as authoritative and under-report; omitting it makes the
+   *  client treat coverage as unknown and hide the cost, matching the live fold.
+   *  Naturally false when `contextCost` is off (no event carries cost). */
+  let allHaveCost = true;
+  for (const event of events) {
+    const units = normalizeEventUnits(event);
+    input += units.input;
+    output += units.output;
+    cacheWrite += units.cacheWrite;
+    cacheRead += units.cacheRead;
+    if (event.cost != null) {
+      cost += event.cost;
+    } else {
+      allHaveCost = false;
+    }
+  }
+  const rollup: TResponseUsage = { input, output, cacheWrite, cacheRead };
+  if (allHaveCost) {
+    rollup.cost = cost;
+  }
+  return rollup;
+}
+
+/**
+ * Per-event display-unit normalization, mirroring the client's
+ * `normalizeUsageUnits` EXACTLY — including the magnitude fallback when
+ * `provider` is absent — so a reloaded rollup matches what the live client
+ * folded. This is deliberately distinct from billing `splitUsage`, which treats
+ * a missing provider as additive (no magnitude fallback); the divergence only
+ * surfaces for provider-less cached events (e.g. some OpenAI-compatible/custom
+ * payloads), where the client subtracts cache from input but `splitUsage`
+ * would not. Keep in sync with `normalizeUsageUnits` in client/src/utils/tokens.ts.
+ */
+function normalizeEventUnits(event: TTokenUsageEvent): {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+} {
+  const rawInput = event.input_tokens ?? 0;
+  const rawOutput = event.output_tokens ?? 0;
+  const total = event.total_tokens ?? 0;
+  const cacheWrite = event.input_token_details?.cache_creation ?? 0;
+  const cacheRead = event.input_token_details?.cache_read ?? 0;
+  const includesCache =
+    event.provider != null
+      ? inputTokensIncludesCache(event.provider)
+      : cacheWrite + cacheRead <= rawInput;
+  const cacheAdjustment = includesCache ? 0 : cacheRead + cacheWrite;
+  const output =
+    total > rawInput + rawOutput + cacheAdjustment ? total - rawInput - cacheAdjustment : rawOutput;
+  return {
+    input: includesCache ? Math.max(0, rawInput - cacheRead - cacheWrite) : rawInput,
+    output,
+    cacheWrite,
+    cacheRead,
+  };
+}
+
+/** The final primary (non-tagged) model call belonging to the snapshot's run —
+ *  the call the latest pre-invoke snapshot precedes. Filtering by `runId` prevents
+ *  a parallel run's later usage from being attributed to this snapshot; untagged
+ *  events (older lib / resume) match any run for back-compat. */
+function finalPrimaryCall(
+  events: ReadonlyArray<TTokenUsageEvent>,
+  runId?: string,
+): TTokenUsageEvent | undefined {
+  for (let i = events.length - 1; i >= 0; i--) {
+    const event = events[i];
+    if (event.usage_type != null) {
+      continue;
+    }
+    if (runId != null && event.runId != null && event.runId !== runId) {
+      continue;
+    }
+    return event;
+  }
+  return undefined;
+}
+
+/**
+ * Projects the latest live context snapshot into the blob persisted on
+ * `responseMessage.metadata.contextUsage`. Reconciles the calibrated estimate to
+ * the final call's ACTUAL prompt tokens (the SDK multiplier over-inflates
+ * `messageTokens`, badly so when a provider injects server-side content like web
+ * search), so a reloaded turn shows the real context — not a several×-too-high
+ * number. Trims zero-valued per-tool counts (privacy/size) and records the final
+ * call's output as `completedOutputTokens` so rehydration adds the same
+ * post-snapshot delta the live gauge did. The client re-anchors the blob to the
+ * response message id on load.
+ */
+export function buildPersistedContextUsage(
+  snapshot: TContextUsageEvent,
+  usageEvents: ReadonlyArray<TTokenUsageEvent> = [],
+): TContextUsageEvent {
+  const finalCall = finalPrimaryCall(usageEvents, snapshot.runId);
+  const completedOutputTokens = finalCall ? normalizeEventUnits(finalCall).output : 0;
+  const reconciled = finalCall
+    ? reconcileContextUsage(snapshot, promptTokensFromUsage(finalCall))
+    : snapshot;
+  const { breakdown } = reconciled;
+  let toolTokenCounts = breakdown.toolTokenCounts;
+  if (toolTokenCounts != null) {
+    const trimmed: Record<string, number> = {};
+    for (const [name, count] of Object.entries(toolTokenCounts)) {
+      if (count > 0) {
+        trimmed[name] = count;
+      }
+    }
+    toolTokenCounts = Object.keys(trimmed).length > 0 ? trimmed : undefined;
+  }
+  return {
+    ...reconciled,
+    breakdown: { ...breakdown, toolTokenCounts },
+    ...(completedOutputTokens > 0 && { completedOutputTokens }),
+  };
+}
+
+/**
+ * Sum of this response's output tokens already folded into a later snapshot's
+ * pre-invoke baseline that the response message's `tokenCount` ALSO carries — the
+ * overlap `computeSummaryUsedTokens` subtracts from the marker so the live-path
+ * client estimate (`summaryBaseline + responseTokenCount`) doesn't double-count:
+ *  - earlier tool-loop PRIMARY calls: a multi-call turn's first output sits in the
+ *    kept-message context of the next call's snapshot AND in `tokenCount`.
+ *  - the SUMMARIZATION call's generated summary: it sits in the snapshot baseline
+ *    as `summaryTokens` AND in `tokenCount` (`recordCollectedUsage` folds
+ *    summarization completion into the reported output total; subagent/sequential
+ *    are kept out of that total, so they are excluded here too).
+ *
+ * Both are matched by `runId` and bounded by `beforeIndex` to the calls that
+ * preceded the snapshot. The summarize detour inherits the graph run id
+ * (`traceConfig` spreads `config.metadata.run_id`), so it shares the snapshot's
+ * `runId`; a parallel sibling run's summary carries a DIFFERENT `runId` and must
+ * NOT be subtracted (its summary lives in the sibling's baseline, not this one).
+ * Untagged events (older lib / resume) match any run for back-compat.
+ *
+ * Only the live path (which builds `tokenCount` via `recordCollectedUsage`) calls
+ * this; the abort path subtracts nothing — see {@link buildAbortedResponseMetadata}.
+ */
+export function priorRunOutputTokens(
+  events: ReadonlyArray<TTokenUsageEvent>,
+  beforeIndex: number,
+  runId?: string,
+): number {
+  let total = 0;
+  const end = Math.min(beforeIndex, events.length);
+  for (let i = 0; i < end; i++) {
+    const event = events[i];
+    if (event.usage_type != null && event.usage_type !== 'summarization') {
+      continue;
+    }
+    if (runId != null && event.runId != null && event.runId !== runId) {
+      continue;
+    }
+    total += normalizeEventUnits(event).output;
+  }
+  return total;
+}
+
+/**
+ * Pre-invoke compacted context size for a summarized turn (instructions +
+ * summary + kept messages), or `undefined` when the turn did not summarize.
+ * Persisted as the lightweight `summaryUsedTokens` marker so the client estimate
+ * fallback caps the discarded pre-summary history instead of re-summing it (the
+ * gauge otherwise reads 100% in perpetuity after a compaction). Pre-invoke, so
+ * it carries none of the `completedOutputTokens` ambiguity that keeps the full
+ * snapshot off some save paths. `summaryTokens` is a SEPARATE breakdown field, so
+ * the non-`remainingContextTokens` fallback adds it explicitly.
+ *
+ * `priorOutputTokens` (this response's earlier tool-loop outputs, see
+ * {@link priorRunOutputTokens}) is subtracted: those tokens are inside the
+ * baseline's kept messages AND in the response message's `tokenCount` the client
+ * adds on top, so leaving them in the marker double-counts them on a tool-loop
+ * summarized turn. Single-call turns pass 0 and are unaffected.
+ */
+export function computeSummaryUsedTokens(
+  snapshot: TContextUsageEvent | null | undefined,
+  priorOutputTokens = 0,
+): number | undefined {
+  const summaryTokens = snapshot?.breakdown?.summaryTokens ?? 0;
+  if (!snapshot || summaryTokens <= 0) {
+    return undefined;
+  }
+  const maxTokens = snapshot.contextBudget ?? snapshot.breakdown.maxContextTokens ?? 0;
+  const baseUsed =
+    snapshot.remainingContextTokens != null
+      ? maxTokens - snapshot.remainingContextTokens
+      : (snapshot.effectiveInstructionTokens ?? snapshot.breakdown.instructionTokens ?? 0) +
+        summaryTokens +
+        (snapshot.breakdown.messageTokens ?? 0);
+  const adjusted = baseUsed - Math.max(0, priorOutputTokens);
+  return adjusted > 0 ? Math.round(adjusted) : undefined;
+}
+
+function parseUsageEvents(value?: string | null): TTokenUsageEvent[] {
+  if (typeof value !== 'string' || value.length === 0) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? (parsed as TTokenUsageEvent[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Builds the response `metadata` for a STOPPED generation from the job's
+ * persisted emitted usage, so a stopped reply keeps its accurate cost rollup on
+ * reload (finding: stopped responses otherwise lose cost). Shared by every abort
+ * save path (agents abort route + legacy abort middleware).
+ *
+ * Deliberately omits the full `contextUsage`: unlike the live path, the abort
+ * path can't tell whether the FINAL call (the one the latest snapshot precedes)
+ * emitted usage — the job stores only the latest snapshot, not the snapshot
+ * count. If the final call emitted none, `completedOutputTokens` would reuse an
+ * earlier call's output the snapshot already counts → reload over-reports. So a
+ * stopped response falls back to the per-message gauge estimate on reload.
+ *
+ * It DOES persist the `summaryUsedTokens` marker when the stopped turn had
+ * summarized: that marker is pre-invoke (no `completedOutputTokens` ambiguity),
+ * and without it the fallback estimate re-sums the history the compaction
+ * discarded — leaving a stopped summarized turn pinned at 100%. Unlike the live
+ * path, the abort `tokenCount` comes from `countTokens(text)` (abortMiddleware) or
+ * is absent (agents abort route) — it does NOT fold in the summarization or
+ * earlier-call output the way `recordCollectedUsage` does. So the marker subtracts
+ * NOTHING: the full pre-invoke baseline is correct, and the client adds only the
+ * partial answer text on top (no overlap to cancel).
+ */
+export function buildAbortedResponseMetadata(
+  job: { tokenUsage?: string | null; contextUsage?: string | null } | null | undefined,
+): { usage?: TResponseUsage; summaryUsedTokens?: number } | undefined {
+  const events = parseUsageEvents(job?.tokenUsage);
+  const usage = aggregateEmittedUsage(events);
+
+  let snapshot: TContextUsageEvent | null = null;
+  if (typeof job?.contextUsage === 'string' && job.contextUsage.length > 0) {
+    try {
+      snapshot = JSON.parse(job.contextUsage) as TContextUsageEvent;
+    } catch {
+      snapshot = null;
+    }
+  }
+  /** Subtract nothing: the abort `tokenCount` (countTokens(text) or absent) does
+   *  not fold in summarization/earlier-call output, so the full baseline is the
+   *  marker and the client's partial-text addition has no overlap to cancel. */
+  const summaryUsedTokens = computeSummaryUsedTokens(snapshot);
+
+  const metadata: { usage?: TResponseUsage; summaryUsedTokens?: number } = {};
+  if (usage) {
+    metadata.usage = usage;
+  }
+  if (summaryUsedTokens != null) {
+    metadata.summaryUsedTokens = summaryUsedTokens;
+  }
+  return Object.keys(metadata).length > 0 ? metadata : undefined;
+}
+
+/**
+ * Resolves the endpoint token config for a usage item by its producing agent.
+ * Multi-endpoint graphs tag each call with `agentId`; that agent's resolved
+ * config is authoritative — including `undefined`, which means "no configured
+ * rates, use built-in pricing" (e.g. a non-custom agent in a custom-primary
+ * graph). Only an untagged or unknown agent falls back to `fallback` (the
+ * primary config), so single-endpoint graphs are unchanged. `byAgentId` must
+ * hold an entry for every known agent (value may be `undefined`) so `has`
+ * distinguishes "known, no rates" from "unknown".
+ */
+export function resolveAgentTokenConfig({
+  agentId,
+  byAgentId,
+  fallback,
+}: {
+  agentId?: string | null;
+  byAgentId?: Map<string, EndpointTokenConfig | undefined>;
+  fallback?: EndpointTokenConfig;
+}): EndpointTokenConfig | undefined {
+  if (agentId != null && byAgentId?.has(agentId)) {
+    return byAgentId.get(agentId);
+  }
+  return fallback;
+}
+
 export interface RecordUsageParams {
   user: string;
   conversationId: string;
@@ -133,6 +487,15 @@ export interface RecordUsageParams {
   balance?: Partial<TCustomConfig['balance']> | null;
   transactions?: Partial<TTransactionsConfig>;
   endpointTokenConfig?: EndpointTokenConfig;
+  /**
+   * Per-usage endpoint token config resolver for multi-endpoint graphs. Called
+   * with each usage item; when provided it is authoritative — its result prices
+   * that item, including `undefined` (built-in pricing for a known agent with no
+   * configured rates). It owns its own fallback to the primary config for
+   * untagged/unknown agents (see {@link resolveAgentTokenConfig}). Single-config
+   * callers (responses.js / openai.js) omit it and use `endpointTokenConfig`.
+   */
+  resolveEndpointTokenConfig?: (usage: UsageMetadata) => EndpointTokenConfig | undefined;
 }
 
 export interface RecordUsageResult {
@@ -160,6 +523,7 @@ export async function recordCollectedUsage(
     conversationId,
     collectedUsage,
     endpointTokenConfig,
+    resolveEndpointTokenConfig,
     context = 'message',
   } = params;
 
@@ -169,11 +533,23 @@ export async function recordCollectedUsage(
 
   const messageUsages: UsageMetadata[] = [];
   const summarizationUsages: UsageMetadata[] = [];
+  const subagentUsages: UsageMetadata[] = [];
+  /** Hidden sequential-agent calls: billed, but excluded from the reported
+   *  output total since their output never reaches the visible message */
+  const sequentialUsages: UsageMetadata[] = [];
   for (const usage of collectedUsage) {
     if (usage == null) {
       continue;
     }
-    (usage.usage_type === 'summarization' ? summarizationUsages : messageUsages).push(usage);
+    if (usage.usage_type === 'summarization') {
+      summarizationUsages.push(usage);
+    } else if (usage.usage_type === 'subagent') {
+      subagentUsages.push(usage);
+    } else if (usage.usage_type === 'sequential') {
+      sequentialUsages.push(usage);
+    } else {
+      messageUsages.push(usage);
+    }
   }
 
   const firstUsage = messageUsages[0];
@@ -188,6 +564,7 @@ export async function recordCollectedUsage(
     usages: UsageMetadata[],
     usageContext: string,
     docs: PreparedEntry[],
+    options?: { excludeFromOutputTotal?: boolean },
   ): void => {
     for (const usage of usages) {
       if (!usage) {
@@ -196,7 +573,9 @@ export async function recordCollectedUsage(
 
       const { inputOnly, cacheCreation, cacheRead, completion } = splitUsage(usage);
 
-      total_output_tokens += completion;
+      if (options?.excludeFromOutputTotal !== true) {
+        total_output_tokens += completion;
+      }
 
       const txMetadata: TxMetadata = {
         user,
@@ -204,7 +583,12 @@ export async function recordCollectedUsage(
         messageId,
         transactions,
         conversationId,
-        endpointTokenConfig,
+        /** Price with the producing agent's endpoint config when a resolver is
+         *  provided (multi-endpoint graphs); it owns the fallback to the primary
+         *  config, so `undefined` here means built-in pricing, not the batch one. */
+        endpointTokenConfig: resolveEndpointTokenConfig
+          ? resolveEndpointTokenConfig(usage)
+          : endpointTokenConfig,
         context: usageContext,
         model: usage.model ?? model,
       };
@@ -272,6 +656,15 @@ export async function recordCollectedUsage(
   const allDocs: PreparedEntry[] = [];
   processUsageGroup(messageUsages, context, allDocs);
   processUsageGroup(summarizationUsages, 'summarization', allDocs);
+  /**
+   * Subagent child-run usage is billed in full (transactions + balance) but
+   * excluded from the reported output total: the result's `output_tokens`
+   * becomes the parent response message's `tokenCount` (see BaseClient's
+   * `getStreamUsage` consumer), and child output the parent never saw would
+   * distort next-turn context accounting by orders of magnitude.
+   */
+  processUsageGroup(subagentUsages, 'subagent', allDocs, { excludeFromOutputTotal: true });
+  processUsageGroup(sequentialUsages, 'sequential', allDocs, { excludeFromOutputTotal: true });
   if (useBulk && allDocs.length > 0) {
     try {
       await bulkWriteTransactions({ user, docs: allDocs }, bulkWriteOps);
@@ -285,3 +678,66 @@ export async function recordCollectedUsage(
     output_tokens: total_output_tokens,
   };
 }
+
+/**
+ * Structural mirror of the agents SDK's `SubagentUsageEvent` (added after
+ * `@librechat/agents` 3.2.33). Defined locally so type-checking does not
+ * depend on the unreleased SDK — replace with
+ * `import type { SubagentUsageEvent } from '@librechat/agents'` once the
+ * dependency is bumped.
+ */
+export interface SubagentUsageEvent {
+  /** Usage metadata reported by the child's model call. */
+  usage: UsageMetadata;
+  /** Model that produced this usage (per-call, falls back to the child config's model). */
+  model?: string;
+  /** Provider enum value of the subagent's configured agent. */
+  provider?: string;
+  /** Subagent `type` identifier from the SubagentConfig. */
+  subagentType: string;
+  /** Child run ID (unique per subagent execution). */
+  subagentRunId: string;
+  /** Child agent ID assigned to this subagent execution. */
+  subagentAgentId: string;
+  /** Parent run ID under which the subagent was spawned. */
+  runId: string;
+}
+
+/**
+ * Builds the host-side `subagentUsageSink` for `Run.create`. Subagent child
+ * graphs execute outside the run's `streamEvents` loop, so their model calls
+ * never reach the `CHAT_MODEL_END` handler (`ModelEndHandler`) — the SDK
+ * reports them through this sink instead. Each event is tagged
+ * `usage_type: 'subagent'` with the child's model/provider and pushed onto
+ * the same `collectedUsage` array the handler fills, so
+ * {@link recordCollectedUsage} bills child calls (transactions + balance)
+ * alongside the parent's.
+ */
+export function createSubagentUsageSink(
+  collectedUsage: UsageMetadata[],
+  onUsage?: (usage: UsageMetadata) => void,
+): (event: SubagentUsageEvent) => void {
+  return (event) => {
+    if (event?.usage == null) {
+      return;
+    }
+    const usage: UsageMetadata = { ...event.usage, usage_type: 'subagent' };
+    if (event.model != null && event.model !== '') {
+      usage.model = event.model;
+    }
+    if (event.provider != null && event.provider !== '') {
+      usage.provider = event.provider;
+    }
+    /** Tag the child's agent id so the host can price this usage with the
+     *  subagent's own endpoint token config (its endpoint may differ from the
+     *  parent's). The same tagged object is pushed AND handed to `onUsage`. */
+    if (event.subagentAgentId != null && event.subagentAgentId !== '') {
+      usage.agentId = event.subagentAgentId;
+    }
+    collectedUsage.push(usage);
+    /** Lets the host stream the billed child usage to the client (tagged
+     *  `subagent`, so it folds into session cost/totals but not the live
+     *  gauge) — child runs never reach ModelEndHandler's emit path. */
+    onUsage?.(usage);
+  };
+}
diff --git a/packages/api/src/agents/validation.ts b/packages/api/src/agents/validation.ts
index 30b1da7d099..8fc63414e59 100644
--- a/packages/api/src/agents/validation.ts
+++ b/packages/api/src/agents/validation.ts
@@ -11,24 +11,212 @@ import type { Request, Response } from 'express';
 type LooseRequest = Request<unknown, unknown, unknown>;
 
 /** Avatar schema shared between create and update */
-export const agentAvatarSchema = z.object({
+export const agentAvatarSchema: z.ZodObject<
+  {
+    filepath: z.ZodString;
+    source: z.ZodString;
+  },
+  'strip'
+> = z.object({
   filepath: z.string(),
   source: z.string(),
 });
 
 /** Base resource schema for tool resources */
-export const agentBaseResourceSchema = z.object({
+export const agentBaseResourceSchema: z.ZodObject<
+  {
+    file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+  },
+  'strip'
+> = z.object({
   file_ids: z.array(z.string()).optional(),
-  files: z.array(z.any()).optional(), // Files are populated at runtime, not from user input
+  files: z.array(z.unknown()).optional(), // Files are populated at runtime, not from user input
 });
 
 /** File resource schema extends base with vector_store_ids */
-export const agentFileResourceSchema = agentBaseResourceSchema.extend({
+export const agentFileResourceSchema: z.ZodObject<
+  {
+    file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+  } & {
+    vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+  },
+  'strip'
+> = agentBaseResourceSchema.extend({
   vector_store_ids: z.array(z.string()).optional(),
 });
 
 /** Tool resources schema matching AgentToolResources interface */
-export const agentToolResourcesSchema = z
+export const agentToolResourcesSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      image_edit: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      execute_code: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      file_search: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          } & {
+            vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        >
+      >;
+      context: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      /** @deprecated Use context instead */
+      ocr: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      ocr?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      context?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      execute_code?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      file_search?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        | undefined;
+      image_edit?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+    },
+    {
+      ocr?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      context?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      execute_code?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      file_search?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        | undefined;
+      image_edit?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+    }
+  >
+> = z
   .object({
     image_edit: agentBaseResourceSchema.optional(),
     execute_code: agentBaseResourceSchema.optional(),
@@ -40,7 +228,24 @@ export const agentToolResourcesSchema = z
   .optional();
 
 /** Support contact schema for agent */
-export const agentSupportContactSchema = z
+export const agentSupportContactSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      name: z.ZodOptional<z.ZodString>;
+      email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      name?: string | undefined;
+      email?: string | undefined;
+    },
+    {
+      name?: string | undefined;
+      email?: string | undefined;
+    }
+  >
+> = z
   .object({
     name: z.string().optional(),
     email: z.union([z.literal(''), z.string().email()]).optional(),
@@ -48,7 +253,24 @@ export const agentSupportContactSchema = z
   .optional();
 
 /** Graph edge schema for agent handoffs */
-export const graphEdgeSchema = z.object({
+export const graphEdgeSchema: z.ZodObject<
+  {
+    from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+    to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+    description: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+    prompt: z.ZodEffects<
+      z.ZodOptional<
+        z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+      >,
+      string | ((...args: unknown[]) => unknown) | undefined,
+      string | ((...args: unknown[]) => unknown) | undefined
+    >;
+    excludeResults: z.ZodOptional<z.ZodBoolean>;
+    promptKey: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+  },
+  'strip'
+> = z.object({
   from: z.union([z.string(), z.array(z.string())]),
   to: z.union([z.string(), z.array(z.string())]),
   description: z
@@ -68,13 +290,39 @@ export const graphEdgeSchema = z.object({
 });
 
 /** Per-tool options schema (defer_loading, allowed_callers) */
-export const toolOptionsSchema = z.object({
+export const toolOptionsSchema: z.ZodObject<
+  {
+    defer_loading: z.ZodOptional<z.ZodBoolean>;
+    allowed_callers: z.ZodOptional<z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>>;
+  },
+  'strip'
+> = z.object({
   defer_loading: z.boolean().optional(),
   allowed_callers: z.array(z.enum(['direct', 'code_execution'])).optional(),
 });
 
 /** Agent tool options - map of tool_id to tool options */
-export const agentToolOptionsSchema = z.record(z.string(), toolOptionsSchema).optional();
+export const agentToolOptionsSchema: z.ZodOptional<
+  z.ZodRecord<
+    z.ZodString,
+    z.ZodObject<
+      {
+        defer_loading: z.ZodOptional<z.ZodBoolean>;
+        allowed_callers: z.ZodOptional<z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>>;
+      },
+      'strip',
+      z.ZodTypeAny,
+      {
+        defer_loading?: boolean | undefined;
+        allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+      },
+      {
+        defer_loading?: boolean | undefined;
+        allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+      }
+    >
+  >
+> = z.record(z.string(), toolOptionsSchema).optional();
 
 /**
  * Subagent spawning configuration for an agent. `agent_ids` is capped at
@@ -82,7 +330,27 @@ export const agentToolOptionsSchema = z.record(z.string(), toolOptionsSchema).op
  * of `processAgent` calls (DB lookup + permission check + tool loading).
  * The UI enforces the same cap, so legitimate payloads never hit the bound.
  */
-export const agentSubagentsSchema = z
+export const agentSubagentsSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      enabled: z.ZodOptional<z.ZodBoolean>;
+      allowSelf: z.ZodOptional<z.ZodBoolean>;
+      agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      enabled?: boolean | undefined;
+      agent_ids?: string[] | undefined;
+      allowSelf?: boolean | undefined;
+    },
+    {
+      enabled?: boolean | undefined;
+      agent_ids?: string[] | undefined;
+      allowSelf?: boolean | undefined;
+    }
+  >
+> = z
   .object({
     enabled: z.boolean().optional(),
     allowSelf: z.boolean().optional(),
@@ -91,7 +359,327 @@ export const agentSubagentsSchema = z
   .optional();
 
 /** Base agent schema with all common fields */
-export const agentBaseSchema = z.object({
+export const agentBaseSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    avatar: z.ZodOptional<
+      z.ZodNullable<
+        z.ZodObject<
+          {
+            filepath: z.ZodString;
+            source: z.ZodString;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            source: string;
+            filepath: string;
+          },
+          {
+            source: string;
+            filepath: string;
+          }
+        >
+      >
+    >;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    /** @deprecated Use edges instead */
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  },
+  'strip'
+> = z.object({
   name: z.string().nullable().optional(),
   description: z.string().nullable().optional(),
   instructions: z.string().nullable().optional(),
@@ -116,14 +704,661 @@ export const agentBaseSchema = z.object({
 });
 
 /** Create schema extends base with required fields for creation */
-export const agentCreateSchema = agentBaseSchema.extend({
+export const agentCreateSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    avatar: z.ZodOptional<
+      z.ZodNullable<
+        z.ZodObject<
+          {
+            filepath: z.ZodString;
+            source: z.ZodString;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            source: string;
+            filepath: string;
+          },
+          {
+            source: string;
+            filepath: string;
+          }
+        >
+      >
+    >;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  } & {
+    provider: z.ZodString;
+    model: z.ZodNullable<z.ZodString>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>>;
+  },
+  'strip'
+> = agentBaseSchema.extend({
   provider: z.string(),
   model: z.string().nullable(),
   tools: z.array(z.string()).optional().default([]),
 });
 
 /** Update schema extends base with all fields optional and additional update-only fields */
-export const agentUpdateSchema = agentBaseSchema.extend({
+export const agentUpdateSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  } & {
+    avatar: z.ZodOptional<
+      z.ZodUnion<
+        [
+          z.ZodObject<
+            {
+              filepath: z.ZodString;
+              source: z.ZodString;
+            },
+            'strip',
+            z.ZodTypeAny,
+            {
+              source: string;
+              filepath: string;
+            },
+            {
+              source: string;
+              filepath: string;
+            }
+          >,
+          z.ZodNull,
+        ]
+      >
+    >;
+    provider: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  },
+  'strip'
+> = agentBaseSchema.extend({
   avatar: z.union([agentAvatarSchema, z.null()]).optional(),
   provider: z.string().optional(),
   model: z.string().nullable().optional(),
diff --git a/packages/api/src/apiKeys/handlers.ts b/packages/api/src/apiKeys/handlers.ts
index 61d23ccde9c..1e3b12a7d50 100644
--- a/packages/api/src/apiKeys/handlers.ts
+++ b/packages/api/src/apiKeys/handlers.ts
@@ -1,6 +1,6 @@
+import { logger } from '@librechat/data-schemas';
 import type { Request, Response } from 'express';
 import type { Types } from 'mongoose';
-import { logger } from '@librechat/data-schemas';
 
 export interface ApiKeyHandlerDependencies {
   createAgentApiKey: (params: {
@@ -49,8 +49,16 @@ interface AuthenticatedRequest extends Request {
   };
 }
 
-export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
-  async function createApiKey(req: AuthenticatedRequest, res: Response) {
+export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies): {
+  createApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+  listApiKeys: (req: AuthenticatedRequest, res: Response) => Promise<void>;
+  getApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+  deleteApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+} {
+  async function createApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const { name, expiresAt } = req.body;
 
@@ -80,7 +88,7 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function listApiKeys(req: AuthenticatedRequest, res: Response) {
+  async function listApiKeys(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
       const keys = await deps.listAgentApiKeys(req.user?.id || '');
       res.status(200).json({ keys });
@@ -90,7 +98,10 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function getApiKey(req: AuthenticatedRequest, res: Response) {
+  async function getApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const key = await deps.getAgentApiKeyById(req.params.id, req.user?.id || '');
 
@@ -105,7 +116,10 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function deleteApiKey(req: AuthenticatedRequest, res: Response) {
+  async function deleteApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const deleted = await deps.deleteAgentApiKey(req.params.id, req.user?.id || '');
 
diff --git a/packages/api/src/apiKeys/middleware.ts b/packages/api/src/apiKeys/middleware.ts
index 2a503536483..626a8dd5dfd 100644
--- a/packages/api/src/apiKeys/middleware.ts
+++ b/packages/api/src/apiKeys/middleware.ts
@@ -36,7 +36,11 @@ export interface RemoteAgentAccessRequest extends ApiKeyAuthRequest {
 }
 
 export function createRequireApiKeyAuth(deps: ApiKeyAuthDependencies) {
-  return async (req: ApiKeyAuthRequest, res: Response, next: NextFunction) => {
+  return async (
+    req: ApiKeyAuthRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<Response | undefined> => {
     const authHeader = req.headers.authorization;
 
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
@@ -105,7 +109,11 @@ export function createRequireApiKeyAuth(deps: ApiKeyAuthDependencies) {
 }
 
 export function createCheckRemoteAgentAccess(deps: RemoteAgentAccessDependencies) {
-  return async (req: RemoteAgentAccessRequest, res: Response, next: NextFunction) => {
+  return async (
+    req: RemoteAgentAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<Response | undefined> => {
     const agentId = req.body?.model || req.params?.model;
 
     if (!agentId) {
diff --git a/packages/api/src/apiKeys/permissions.spec.ts b/packages/api/src/apiKeys/permissions.spec.ts
index 69441fa800b..bcf6f642f75 100644
--- a/packages/api/src/apiKeys/permissions.spec.ts
+++ b/packages/api/src/apiKeys/permissions.spec.ts
@@ -5,7 +5,7 @@ import {
   PermissionBits,
   AccessRoleIds,
 } from 'librechat-data-provider';
-import { permissionBitSupersets } from '@librechat/data-schemas';
+import { permissionBitSupersets, tenantStorage } from '@librechat/data-schemas';
 import { enrichRemoteAgentPrincipals } from './permissions';
 import type { EnricherDependencies, Principal } from './permissions';
 
@@ -57,8 +57,8 @@ describe('enrichRemoteAgentPrincipals', () => {
 
       await enrichRemoteAgentPrincipals(deps, resourceId, []);
 
-      const pipeline = aggregateAclEntries.mock.calls[0][0];
-      const matchStage = pipeline[0].$match;
+      const pipeline = aggregateAclEntries.mock.calls[0][0] as Record<string, unknown>[];
+      const matchStage = pipeline[0].$match as Record<string, unknown>;
       expect(matchStage.resourceType).toBe(ResourceType.AGENT);
       expect(matchStage.principalType).toBe(PrincipalType.USER);
       expect(matchStage.resourceId).toBeInstanceOf(Types.ObjectId);
@@ -100,6 +100,33 @@ describe('enrichRemoteAgentPrincipals', () => {
       expect(matchStage.resourceId).toBeInstanceOf(Types.ObjectId);
       expect((matchStage.resourceId as Types.ObjectId).toString()).toBe(hexId);
     });
+
+    test('keeps the user lookup in simple localField/foreignField form', async () => {
+      const aggregateAclEntries = jest.fn().mockResolvedValue([]);
+      const deps: EnricherDependencies = {
+        aggregateAclEntries,
+        bulkWriteAclEntries: jest.fn(),
+        findRoleByIdentifier: jest.fn(),
+        logger: { error: jest.fn() },
+      };
+
+      await enrichRemoteAgentPrincipals(deps, resourceId, []);
+
+      const pipeline = aggregateAclEntries.mock.calls[0][0] as Record<string, unknown>[];
+      const lookupStage = pipeline.find((stage) => '$lookup' in stage) as
+        | { $lookup: Record<string, unknown> }
+        | undefined;
+      expect(lookupStage).toMatchObject({
+        $lookup: {
+          from: 'users',
+          localField: 'principalId',
+          foreignField: '_id',
+          as: 'userInfo',
+        },
+      });
+      expect(lookupStage?.$lookup).not.toHaveProperty('let');
+      expect(lookupStage?.$lookup).not.toHaveProperty('pipeline');
+    });
   });
 
   describe('enrichment behavior', () => {
@@ -136,6 +163,25 @@ describe('enrichRemoteAgentPrincipals', () => {
       expect(result.entriesToBackfill).toHaveLength(0);
     });
 
+    test('skips joined userInfo outside the current request context', async () => {
+      const deps = makeDeps([
+        {
+          principalId: ownerUserId,
+          userInfo: makeUserInfo(ownerUserId, {
+            tenantId: 'tenant-b',
+            email: 'outside-user@example.com',
+          }),
+        },
+      ]);
+
+      const result = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+        enrichRemoteAgentPrincipals(deps, resourceId, []),
+      );
+
+      expect(result.principals).toHaveLength(0);
+      expect(result.entriesToBackfill).toHaveLength(0);
+    });
+
     test('does not duplicate a principal already present in the input list', async () => {
       const existing: Principal = {
         type: PrincipalType.USER,
diff --git a/packages/api/src/apiKeys/permissions.ts b/packages/api/src/apiKeys/permissions.ts
index 3d8a05b3b9d..a64a9f4a51b 100644
--- a/packages/api/src/apiKeys/permissions.ts
+++ b/packages/api/src/apiKeys/permissions.ts
@@ -5,7 +5,7 @@ import {
   PermissionBits,
   AccessRoleIds,
 } from 'librechat-data-provider';
-import { permissionBitSupersets } from '@librechat/data-schemas';
+import { SYSTEM_TENANT_ID, getTenantId, permissionBitSupersets } from '@librechat/data-schemas';
 import type { PipelineStage, AnyBulkWriteOperation } from 'mongoose';
 
 export interface Principal {
@@ -37,6 +37,13 @@ export interface EnrichResult {
   entriesToBackfill: Types.ObjectId[];
 }
 
+function matchesCurrentTenant(principal: Record<string, unknown>, tenantId?: string): boolean {
+  if (!tenantId || tenantId === SYSTEM_TENANT_ID) {
+    return true;
+  }
+  return principal.tenantId === tenantId;
+}
+
 /** Enriches REMOTE_AGENT principals with implicit AGENT owners */
 export async function enrichRemoteAgentPrincipals(
   deps: EnricherDependencies,
@@ -47,6 +54,7 @@ export async function enrichRemoteAgentPrincipals(
     typeof resourceId === 'string' && /^[a-f\d]{24}$/i.test(resourceId)
       ? Types.ObjectId.createFromHexString(resourceId)
       : resourceId;
+  const tenantId = getTenantId();
 
   /**
    * Filter `permBits` with `$in: permissionBitSupersets(SHARE)` instead of
@@ -87,6 +95,10 @@ export async function enrichRemoteAgentPrincipals(
     }
 
     const userInfo = entry.userInfo as Record<string, unknown>;
+    if (!matchesCurrentTenant(userInfo, tenantId)) {
+      continue;
+    }
+
     const principalId = entry.principalId as Types.ObjectId;
 
     const alreadyIncluded = enrichedPrincipals.some(
diff --git a/packages/api/src/apiKeys/service.ts b/packages/api/src/apiKeys/service.ts
index 30ae0afb53d..4038e510fb5 100644
--- a/packages/api/src/apiKeys/service.ts
+++ b/packages/api/src/apiKeys/service.ts
@@ -1,6 +1,11 @@
 import { createMethods } from '@librechat/data-schemas';
 import { ResourceType, PermissionBits, hasPermissions } from 'librechat-data-provider';
-import type { AllMethods, IUser } from '@librechat/data-schemas';
+import type {
+  AgentApiKeyListItem,
+  AgentApiKeyCreateResult,
+  AllMethods,
+  IUser,
+} from '@librechat/data-schemas';
 import type { Types } from 'mongoose';
 
 export interface ApiKeyServiceDependencies {
@@ -36,19 +41,25 @@ export class AgentApiKeyService {
     userId: string | Types.ObjectId;
     name: string;
     expiresAt?: Date | null;
-  }) {
+  }): Promise<AgentApiKeyCreateResult> {
     return this.deps.createAgentApiKey(params);
   }
 
-  async listApiKeys(userId: string | Types.ObjectId) {
+  async listApiKeys(userId: string | Types.ObjectId): Promise<AgentApiKeyListItem[]> {
     return this.deps.listAgentApiKeys(userId);
   }
 
-  async deleteApiKey(keyId: string | Types.ObjectId, userId: string | Types.ObjectId) {
+  async deleteApiKey(
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ): Promise<boolean> {
     return this.deps.deleteAgentApiKey(keyId, userId);
   }
 
-  async getApiKeyById(keyId: string | Types.ObjectId, userId: string | Types.ObjectId) {
+  async getApiKeyById(
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ): Promise<AgentApiKeyListItem | null> {
     return this.deps.getAgentApiKeyById(keyId, userId);
   }
 
diff --git a/packages/api/src/app/AppService.spec.ts b/packages/api/src/app/AppService.spec.ts
index 2c07460b849..7c06fcd40f6 100644
--- a/packages/api/src/app/AppService.spec.ts
+++ b/packages/api/src/app/AppService.spec.ts
@@ -9,6 +9,7 @@ import {
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
 import type { TCustomConfig } from 'librechat-data-provider';
+import type { FunctionTool } from '@librechat/data-schemas';
 
 jest.mock('@librechat/data-schemas', () => ({
   ...jest.requireActual('@librechat/data-schemas'),
@@ -60,7 +61,7 @@ const azureGroups = [
 ];
 
 describe('AppService', () => {
-  const mockSystemTools = {
+  const mockSystemTools: Record<string, FunctionTool> = {
     ExampleTool: {
       type: 'function',
       function: {
@@ -598,9 +599,9 @@ describe('AppService', () => {
     );
 
     // Verify that optional fields are not set when not provided
-    expect(result.endpoints[EModelEndpoint.openAI].titlePrompt).toBeUndefined();
-    expect(result.endpoints[EModelEndpoint.openAI].titlePromptTemplate).toBeUndefined();
-    expect(result.endpoints[EModelEndpoint.openAI].titleMethod).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titlePrompt).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titlePromptTemplate).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titleMethod).toBeUndefined();
   });
 
   it('should correctly configure titleEndpoint when specified', async () => {
@@ -859,7 +860,7 @@ describe('AppService updating app config and issuing warnings', () => {
     );
 
     // Verify excludedIds is undefined when not provided
-    expect(result.endpoints.assistants.excludedIds).toBeUndefined();
+    expect(result.endpoints!.assistants!.excludedIds).toBeUndefined();
   });
 
   it('should not parse environment variable references in OCR config', async () => {
diff --git a/packages/api/src/app/build.spec.ts b/packages/api/src/app/build.spec.ts
new file mode 100644
index 00000000000..629710e4da8
--- /dev/null
+++ b/packages/api/src/app/build.spec.ts
@@ -0,0 +1,64 @@
+import { resolveBuildInfo, __resetBuildInfoCacheForTests } from './build';
+
+describe('resolveBuildInfo', () => {
+  const originalEnv = { ...process.env };
+
+  beforeEach(() => {
+    __resetBuildInfoCacheForTests();
+    delete process.env.BUILD_COMMIT;
+    delete process.env.BUILD_BRANCH;
+    delete process.env.BUILD_DATE;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('prefers BUILD_* env vars over git', () => {
+    process.env.BUILD_COMMIT = 'abcdef1234567890abcdef1234567890abcdef12';
+    process.env.BUILD_BRANCH = 'release/v1.0';
+    process.env.BUILD_DATE = '2026-04-20T12:00:00Z';
+
+    const info = resolveBuildInfo();
+
+    expect(info.commit).toBe('abcdef1234567890abcdef1234567890abcdef12');
+    expect(info.commitShort).toBe('abcdef1');
+    expect(info.branch).toBe('release/v1.0');
+    expect(info.buildDate).toBe('2026-04-20T12:00:00Z');
+  });
+
+  it('returns null for any field that cannot be resolved', () => {
+    __resetBuildInfoCacheForTests();
+    const info = resolveBuildInfo();
+    // commit/branch may or may not resolve depending on whether the test env has git —
+    // but buildDate has no fallback, so it must be null here.
+    expect(info.buildDate).toBeNull();
+  });
+
+  it('treats empty/whitespace env vars as unset', () => {
+    process.env.BUILD_COMMIT = '   ';
+    process.env.BUILD_BRANCH = '';
+    process.env.BUILD_DATE = '   ';
+
+    const info = resolveBuildInfo();
+
+    expect(info.buildDate).toBeNull();
+    // commit/branch will fall back to git or null — can't assert exact value, just that empty env was ignored
+    expect(info.commit).not.toBe('   ');
+    expect(info.branch).not.toBe('');
+  });
+
+  it('normalizes detached-HEAD branch to null', () => {
+    process.env.BUILD_BRANCH = 'HEAD';
+    const info = resolveBuildInfo();
+    expect(info.branch).toBeNull();
+  });
+
+  it('caches result across calls', () => {
+    process.env.BUILD_COMMIT = 'cached1234567890cached1234567890cached12';
+    const first = resolveBuildInfo();
+    process.env.BUILD_COMMIT = 'different1234567890different1234567890de';
+    const second = resolveBuildInfo();
+    expect(second.commit).toBe(first.commit);
+  });
+});
diff --git a/packages/api/src/app/build.ts b/packages/api/src/app/build.ts
new file mode 100644
index 00000000000..d8445bff03d
--- /dev/null
+++ b/packages/api/src/app/build.ts
@@ -0,0 +1,71 @@
+import { execFileSync } from 'child_process';
+import { logger } from '@librechat/data-schemas';
+
+export interface BuildInfo {
+  commit: string | null;
+  commitShort: string | null;
+  branch: string | null;
+  buildDate: string | null;
+}
+
+let cached: BuildInfo | null = null;
+
+function safeGit(args: string[]): string | null {
+  try {
+    const out = execFileSync('git', args, {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+      encoding: 'utf8',
+    });
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+
+function normalize(value: string | undefined): string | null {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+/**
+ * Resolves the current deployment's build info from (in order): explicit env vars,
+ * then local git metadata. Used by `/api/config` to expose commit/branch to clients
+ * when `interface.buildInfo` is enabled.
+ */
+export function resolveBuildInfo(): BuildInfo {
+  if (cached) {
+    return cached;
+  }
+
+  const commit = normalize(process.env.BUILD_COMMIT) ?? safeGit(['rev-parse', 'HEAD']);
+  const branch =
+    normalize(process.env.BUILD_BRANCH) ?? safeGit(['rev-parse', '--abbrev-ref', 'HEAD']);
+  const buildDate = normalize(process.env.BUILD_DATE);
+
+  const info: BuildInfo = {
+    commit,
+    commitShort: commit ? commit.slice(0, 7) : null,
+    branch: branch === 'HEAD' ? null : branch,
+    buildDate,
+  };
+
+  cached = info;
+
+  if (!info.commit && !info.branch && !info.buildDate) {
+    logger.debug(
+      '[buildInfo] no BUILD_* env vars set and git metadata unavailable; buildInfo will be empty',
+    );
+  }
+
+  return info;
+}
+
+/** Test hook — resets the in-process cache. Not exported from the package barrel. */
+export function __resetBuildInfoCacheForTests(): void {
+  cached = null;
+}
diff --git a/packages/api/src/app/checks.ts b/packages/api/src/app/checks.ts
index 50312267acb..019d2a1f567 100644
--- a/packages/api/src/app/checks.ts
+++ b/packages/api/src/app/checks.ts
@@ -30,7 +30,10 @@ const deprecatedVariables = [
   },
 ];
 
-export const deprecatedAzureVariables = [
+export const deprecatedAzureVariables: {
+  key: string;
+  description: string;
+}[] = [
   /* "related to" precedes description text */
   { key: 'AZURE_OPENAI_DEFAULT_MODEL', description: 'setting a default model' },
   { key: 'AZURE_OPENAI_MODELS', description: 'setting models' },
@@ -59,7 +62,9 @@ export const deprecatedAzureVariables = [
   },
 ];
 
-export const conflictingAzureVariables = [
+export const conflictingAzureVariables: {
+  key: string;
+}[] = [
   {
     key: 'INSTANCE_NAME',
   },
@@ -100,7 +105,7 @@ function checkPasswordReset() {
  * @param {Function} options.isEnabled - Function to check if a feature is enabled
  * @param {Function} options.checkEmailConfig - Function to check email configuration
  */
-export function checkVariables() {
+export function checkVariables(): void {
   let hasDefaultSecrets = false;
   for (const [key, value] of Object.entries(secretDefaults)) {
     if (process.env[key] === value) {
@@ -134,7 +139,7 @@ export function checkVariables() {
  * Checks the health of auxiliary API's by attempting a fetch request to their respective `/health` endpoints.
  * Logs information or warning based on the API's availability and response.
  */
-export async function checkHealth() {
+export async function checkHealth(): Promise<void> {
   try {
     const response = await fetch(`${process.env.RAG_API_URL}/health`);
     if (response?.ok && response?.status === 200) {
@@ -169,7 +174,7 @@ function checkAzureVariables() {
   });
 }
 
-export function checkInterfaceConfig(appConfig: AppConfig) {
+export function checkInterfaceConfig(appConfig: AppConfig): void {
   const interfaceConfig = appConfig.interfaceConfig;
   let i = 0;
   const logSettings = () => {
@@ -220,7 +225,7 @@ export function checkInterfaceConfig(appConfig: AppConfig) {
  * This should be called during application startup before initializing services.
  * @param [appConfig] - The application configuration object.
  */
-export async function performStartupChecks(appConfig?: AppConfig) {
+export async function performStartupChecks(appConfig?: AppConfig): Promise<void> {
   checkVariables();
   if (appConfig?.endpoints?.azureOpenAI) {
     checkAzureVariables();
@@ -244,7 +249,7 @@ export async function performStartupChecks(appConfig?: AppConfig) {
  * Performs basic checks on the loaded config object.
  * @param config - The loaded custom configuration.
  */
-export function checkConfig(config: Partial<TCustomConfig>) {
+export function checkConfig(config: Partial<TCustomConfig>): void {
   if (config.version !== Constants.CONFIG_VERSION) {
     logger.info(
       `\nOutdated Config version: ${config.version}
@@ -263,7 +268,9 @@ Latest version: ${Constants.CONFIG_VERSION}
  * Logs debug information for properly configured environment variable references.
  * @param webSearchConfig - The loaded web search configuration object.
  */
-export function checkWebSearchConfig(webSearchConfig?: Partial<TCustomConfig['webSearch']> | null) {
+export function checkWebSearchConfig(
+  webSearchConfig?: Partial<TCustomConfig['webSearch']> | null,
+): void {
   if (!webSearchConfig) {
     return;
   }
diff --git a/packages/api/src/app/index.ts b/packages/api/src/app/index.ts
index 8d8802f016c..b5380612d2d 100644
--- a/packages/api/src/app/index.ts
+++ b/packages/api/src/app/index.ts
@@ -1,6 +1,10 @@
 export * from './service';
 export * from './config';
+export * from './metrics';
 export * from './permissions';
 export * from './cdn';
 export * from './checks';
 export * from './resolve';
+export * from './shutdown';
+export { resolveBuildInfo } from './build';
+export type { BuildInfo } from './build';
diff --git a/packages/api/src/app/limits.ts b/packages/api/src/app/limits.ts
index a38a3c6310a..1f1ad583f52 100644
--- a/packages/api/src/app/limits.ts
+++ b/packages/api/src/app/limits.ts
@@ -5,7 +5,7 @@ import type { TCustomConfig } from 'librechat-data-provider';
  *
  * @param rateLimits
  */
-export const handleRateLimits = (rateLimits?: TCustomConfig['rateLimits']) => {
+export const handleRateLimits = (rateLimits?: TCustomConfig['rateLimits']): void => {
   if (!rateLimits) {
     return;
   }
diff --git a/packages/api/src/app/metrics.spec.ts b/packages/api/src/app/metrics.spec.ts
new file mode 100644
index 00000000000..ebb12675047
--- /dev/null
+++ b/packages/api/src/app/metrics.spec.ts
@@ -0,0 +1,413 @@
+/// <reference types="jest" />
+import express from 'express';
+import request from 'supertest';
+import { EventEmitter } from 'events';
+import type { Request, Response } from 'express';
+import {
+  createMetrics,
+  instrumentMongooseQueryMetrics,
+  normalizePath,
+  recordGenerationJob,
+  recordGenerationStreamResumePendingEvents,
+  recordGenerationStreamSubscription,
+  recordOpenIDUserLookup,
+  recordRumProxyRequest,
+  setGenerationJobsInFlight,
+} from './metrics';
+
+describe('normalizePath', () => {
+  it.each([
+    // Known high-cardinality routes
+    ['/api/messages/507f1f77bcf86cd799439011', '/api/messages/#id'],
+    ['/api/messages/507f1f77bcf86cd799439011/507f1f77bcf86cd799439012', '/api/messages/#id/#id'],
+    ['/api/messages/artifact/507f1f77bcf86cd799439012', '/api/messages/artifact/#id'],
+    ['/api/convos/507f1f77bcf86cd799439011', '/api/convos/#id'],
+    ['/api/files/507f1f77bcf86cd799439011', '/api/files/#id'],
+    ['/api/files/507f1f77bcf86cd799439011/preview', '/api/files/#id/preview'],
+    ['/api/files/download/user-123/file-456', '/api/files/download/#id/#id'],
+    ['/api/files/download-url/user-123/file-456', '/api/files/download-url/#id/#id'],
+    ['/api/files/code/download/session-123/file-456', '/api/files/code/download/#id/#id'],
+    ['/api/agents/507f1f77bcf86cd799439011', '/api/agents/#id'],
+    ['/api/agents/chat/stream/stream-123', '/api/agents/chat/stream/#id'],
+    ['/api/agents/chat/status/convo-123', '/api/agents/chat/status/#id'],
+    ['/api/agents/v1/chat/completions', '/api/agents/v1/chat/completions'],
+    ['/api/agents/v1/responses', '/api/agents/v1/responses'],
+    ['/api/assistants/507f1f77bcf86cd799439011', '/api/assistants/#id'],
+    ['/api/skills/507f1f77bcf86cd799439011/files/reference.md', '/api/skills/#id/files'],
+    ['/api/share/some-token-value', '/api/share/#token'],
+    ['/share/shareId-with_nanoidChars', '/share/#id'],
+    ['/share/shareId-with_nanoidChars/edit', '/share/#id/edit'],
+    // Known API routes with dynamic IDs
+    ['/api/tags/507f1f77bcf86cd799439011', '/api/tags/#id'],
+    ['/api/tags/507F1F77BCF86CD799439011', '/api/tags/#id'],
+    ['/api/tools/507f1f77bcf86cd799439011', '/api/tools/#id'],
+    ['/api/runs/507f1f77bcf86cd799439011', '/api/runs/#id'],
+    // Catch-all: UUID in unknown routes
+    ['/api/tools/123e4567-e89b-12d3-a456-426614174000', '/api/tools/#id'],
+    ['/api/sessions/123E4567-E89B-12D3-A456-426614174000', '/api/sessions/#id'],
+    // Multiple dynamic segments
+    [
+      '/api/convos/507f1f77bcf86cd799439011/messages/507f1f77bcf86cd799439012',
+      '/api/convos/#id/messages/#id',
+    ],
+    // Static paths are not modified
+    ['/api/auth/login', '/api/auth/login'],
+    ['/api/config', '/api/config'],
+    ['/health', '/health'],
+    ['/metrics', '/metrics'],
+    ['/', '/'],
+    // Unknown/user-generated routes collapse into bounded label buckets
+    ['/api/not-a-real-route/user-generated-value', '/api/#path'],
+    ['/images/user-123/avatar-1700000000000.png', '/images/#path'],
+    ['/avatars/user-123/avatar-1700000000000.png', '/avatars/#path'],
+    ['/t/tenant-a/images/user-123/avatar-1700000000000.png', '/t/#path'],
+    ['/unknown/shareId-with_nanoidChars', '/#path'],
+    ['/api/messages/507f1f77bcf86cd799439011/user-generated-value/extra', '/api/#path'],
+    ['/api/messages/artifact/507f1f77bcf86cd799439012/user-generated-value', '/api/#path'],
+  ])('normalizes %s -> %s', (input: string, normalized: string) => {
+    expect(normalizePath(input)).toBe(normalized);
+  });
+});
+
+describe('createMetrics', () => {
+  afterEach(() => {
+    delete process.env.METRICS_SECRET;
+  });
+
+  it('uses a no-op middleware and unauthorized router when metrics are not configured', async () => {
+    const app = express();
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    const res = new EventEmitter();
+    const next = jest.fn();
+
+    metricsMiddleware(
+      { headers: {}, method: 'GET', path: '/api/slow-response' } as Request,
+      res as unknown as Response,
+      next,
+    );
+    app.use('/metrics', metricsRouter);
+
+    await request(app).get('/metrics').expect(401);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.listenerCount('finish')).toBe(0);
+    expect(res.listenerCount('close')).toBe(0);
+  });
+
+  it('tracks request counts, in-flight gauges, and request body sizes', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    app.use(metricsMiddleware);
+    app.use(express.text({ type: '*/*' }));
+    app.post('/api/files/:id', (_req, res) => {
+      res.status(201).send('ok');
+    });
+    app.use('/metrics', metricsRouter);
+
+    await request(app)
+      .post('/api/files/507f1f77bcf86cd799439011')
+      .set('Content-Type', 'text/plain')
+      .send('x'.repeat(42))
+      .expect(201);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /http_requests_total\{method="POST",path="\/api\/files\/#id",status="201"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /http_requests_in_flight\{method="POST",path="\/api\/files\/#id"\} 0/,
+    );
+    expect(response.text).toMatch(
+      /http_request_body_bytes_count\{method="POST",path="\/api\/files\/#id"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /http_request_body_bytes_sum\{method="POST",path="\/api\/files\/#id"\} 42/,
+    );
+  });
+
+  it('tracks SSE stream counts, active gauges, and stream duration', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    app.use(metricsMiddleware);
+    app.get('/api/agents/chat/stream/:streamId', (_req, res) => {
+      res.setHeader('Content-Type', 'text/event-stream');
+      res.write('event: message\ndata: {}\n\n');
+      res.end();
+    });
+    app.use('/metrics', metricsRouter);
+
+    await request(app).get('/api/agents/chat/stream/stream-123').expect(200);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /sse_streams_total\{method="GET",path="\/api\/agents\/chat\/stream\/#id",status="200"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /sse_streams_in_flight\{method="GET",path="\/api\/agents\/chat\/stream\/#id"\} 0/,
+    );
+    expect(response.text).toMatch(
+      /sse_stream_duration_seconds_count\{method="GET",path="\/api\/agents\/chat\/stream\/#id",status="200"\} 1/,
+    );
+  });
+
+  it('tracks upload counts, active gauges, duration, and upload bytes', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    app.use(metricsMiddleware);
+    app.post('/api/files', (_req, res) => {
+      res.status(201).send('ok');
+    });
+    app.use('/metrics', metricsRouter);
+
+    await request(app)
+      .post('/api/files')
+      .attach('file', Buffer.from('uploaded body'), 'test.txt')
+      .expect(201);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /upload_requests_total\{method="POST",path="\/api\/files",status="201"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /upload_requests_in_flight\{method="POST",path="\/api\/files"\} 0/,
+    );
+    expect(response.text).toMatch(
+      /upload_request_duration_seconds_count\{method="POST",path="\/api\/files",status="201"\} 1/,
+    );
+    expect(response.text).toMatch(/upload_bytes_total\{method="POST",path="\/api\/files"\} \d+/);
+  });
+
+  it('does not track non-upload methods on upload paths as uploads', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    app.use(metricsMiddleware);
+    app.delete('/api/files', (_req, res) => {
+      res.status(204).end();
+    });
+    app.use('/metrics', metricsRouter);
+
+    await request(app).delete('/api/files').expect(204);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).not.toMatch(/upload_requests_total\{method="DELETE"/);
+    expect(response.text).not.toMatch(/upload_bytes_total\{method="DELETE"/);
+  });
+
+  it('labels requests closed before finish as client-aborted', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsMiddleware, metricsRouter } = createMetrics();
+    const headers = new Map<string, unknown>();
+    const res = Object.assign(new EventEmitter(), {
+      destroyed: false,
+      getHeader: (name: string) => headers.get(name.toLowerCase()),
+      setHeader(name: string, value: unknown) {
+        headers.set(name.toLowerCase(), value);
+        return this;
+      },
+      statusCode: 200,
+      writableEnded: false,
+      writeHead() {
+        return this;
+      },
+    });
+    const next = jest.fn();
+
+    metricsMiddleware(
+      { headers: {}, method: 'GET', path: '/api/slow-response' } as Request,
+      res as unknown as Response,
+      next,
+    );
+    res.emit('close');
+    app.use('/metrics', metricsRouter);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(response.text).toMatch(
+      /http_requests_total\{method="GET",path="\/api\/#path",status="499"\} 1/,
+    );
+    expect(response.text).not.toMatch(
+      /http_requests_total\{method="GET",path="\/api\/#path",status="200"\}/,
+    );
+  });
+
+  it('tracks OpenID user lookup outcomes and latency', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    recordOpenIDUserLookup('found', 0.2);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(/openid_user_lookup_total\{result="found"\} 1/);
+    expect(response.text).toMatch(/openid_user_lookup_duration_seconds_count\{result="found"\} 1/);
+    expect(response.text).toMatch(/openid_user_lookup_duration_seconds_sum\{result="found"\} 0.2/);
+  });
+
+  it('tracks RUM proxy request outcomes', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    recordRumProxyRequest('traces', 'success');
+    recordRumProxyRequest('traces', 'auth_drop');
+    recordRumProxyRequest('logs', 'auth_error');
+    recordRumProxyRequest('logs', 'collector_5xx');
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="traces",result="success"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="traces",result="auth_drop"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="logs",result="auth_error"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="logs",result="collector_5xx"\} 1/,
+    );
+  });
+
+  it('tracks mongoose query counts and latency by model and operation', async () => {
+    class FakeQuery {
+      model = { modelName: 'User' };
+      op = 'findOne';
+
+      exec() {
+        return Promise.resolve({ _id: 'user-1' });
+      }
+    }
+
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    instrumentMongooseQueryMetrics({ Query: FakeQuery } as never);
+    await new FakeQuery().exec();
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /mongoose_queries_total\{model="User",operation="findOne",status="success"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /mongoose_query_duration_seconds_count\{model="User",operation="findOne",status="success"\} 1/,
+    );
+  });
+
+  it('does not instrument mongoose queries when metrics are not configured', async () => {
+    class FakeQuery {
+      model = { modelName: 'User' };
+      op = 'findOne';
+
+      exec() {
+        return Promise.resolve({ _id: 'user-1' });
+      }
+    }
+
+    const originalExec = FakeQuery.prototype.exec;
+
+    instrumentMongooseQueryMetrics({ Query: FakeQuery } as never);
+
+    expect(FakeQuery.prototype.exec).toBe(originalExec);
+  });
+
+  it('tracks mongoose query errors thrown before a promise is returned', async () => {
+    class ThrowingQuery {
+      model = { modelName: 'User' };
+      op = 'findOne';
+
+      exec() {
+        throw new Error('sync database error');
+      }
+    }
+
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    instrumentMongooseQueryMetrics({ Query: ThrowingQuery } as never);
+    expect(() => new ThrowingQuery().exec()).toThrow('sync database error');
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /mongoose_queries_total\{model="User",operation="findOne",status="error"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /mongoose_query_duration_seconds_count\{model="User",operation="findOne",status="error"\} 1/,
+    );
+  });
+
+  it('tracks generation job and stream resume metrics', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    recordGenerationJob('memory', 'created');
+    setGenerationJobsInFlight('memory', 2);
+    recordGenerationStreamSubscription('redis', 'resume', 'not_found');
+    recordGenerationStreamSubscription('redis', 'resume_state', 'missing');
+    recordGenerationStreamResumePendingEvents('memory', 3);
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(/generation_jobs_total\{store="memory",result="created"\} 1/);
+    expect(response.text).toMatch(/generation_jobs_in_flight\{store="memory"\} 2/);
+    expect(response.text).toMatch(
+      /generation_stream_subscriptions_total\{store="redis",type="resume",result="not_found"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /generation_stream_subscriptions_total\{store="redis",type="resume_state",result="missing"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /generation_stream_resume_pending_events_total\{store="memory"\} 3/,
+    );
+  });
+});
diff --git a/packages/api/src/app/metrics.ts b/packages/api/src/app/metrics.ts
new file mode 100644
index 00000000000..da2ce635d33
--- /dev/null
+++ b/packages/api/src/app/metrics.ts
@@ -0,0 +1,667 @@
+import { Router } from 'express';
+import { timingSafeEqual } from 'crypto';
+import { logger } from '@librechat/data-schemas';
+import { Registry, collectDefaultMetrics, Counter, Gauge, Histogram } from 'prom-client';
+import type { Request, Response, NextFunction, RequestHandler } from 'express';
+import type { Mongoose } from 'mongoose';
+
+const PATH_NORMALIZATIONS: [RegExp, string][] = [
+  [/^\/api\/agents\/chat\/stream\/[^/]+(?=\/|$)/, '/api/agents/chat/stream/#id'],
+  [/^\/api\/agents\/chat\/status\/[^/]+(?=\/|$)/, '/api/agents/chat/status/#id'],
+  [/^\/api\/files\/code\/download\/[^/]+\/[^/]+(?=\/|$)/, '/api/files/code/download/#id/#id'],
+  [/^\/api\/files\/download-url\/[^/]+\/[^/]+(?=\/|$)/, '/api/files/download-url/#id/#id'],
+  [/^\/api\/files\/download\/[^/]+\/[^/]+(?=\/|$)/, '/api/files/download/#id/#id'],
+  [/^\/api\/files\/[^/]+\/preview(?=\/|$)/, '/api/files/#id/preview'],
+  [/^\/api\/skills\/[^/]+\/files(?:\/.*)?(?=\/|$)/, '/api/skills/#id/files'],
+  [/^\/api\/messages\/artifact\/[^/]+(?=\/|$)/, '/api/messages/artifact/#id'],
+  [/^\/api\/messages\/[^/]+\/[^/]+(?=\/|$)/, '/api/messages/#id/#id'],
+  [/^\/api\/convos\/[^/]+\/messages\/[^/]+(?=\/|$)/, '/api/convos/#id/messages/#id'],
+  [/^\/api\/messages\/[^/]+(?=\/|$)/, '/api/messages/#id'],
+  [/^\/api\/convos\/[^/]+(?=\/|$)/, '/api/convos/#id'],
+  [/^\/api\/files\/[^/]+(?=\/|$)/, '/api/files/#id'],
+  [/^\/api\/agents\/[^/]+(?=\/|$)/, '/api/agents/#id'],
+  [/^\/api\/assistants\/[^/]+(?=\/|$)/, '/api/assistants/#id'],
+  [/^\/api\/share\/[^/]+(?=\/|$)/, '/api/share/#token'],
+  [/^\/share\/[^/]+(?=\/|$)/, '/share/#id'],
+  [/^\/api\/(tags|tools|runs|sessions)\/[0-9a-f]{24}(?=\/|$)/i, '/api/$1/#id'],
+  [
+    /^\/api\/(tools|sessions)\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?=\/|$)/i,
+    '/api/$1/#id',
+  ],
+];
+
+const STATIC_PATHS = new Set([
+  '/',
+  '/health',
+  '/metrics',
+  '/api/auth/login',
+  '/api/config',
+  '/api/agents/chat/abort',
+  '/api/agents/chat/active',
+  '/api/agents/v1/chat/completions',
+  '/api/agents/v1/responses',
+  '/api/files',
+  '/api/files/config',
+  '/api/files/images',
+  '/api/files/images/avatar',
+  '/api/files/speech/stt',
+]);
+
+const UPLOAD_PATHS = new Set([
+  '/api/files',
+  '/api/files/images',
+  '/api/files/images/avatar',
+  '/api/files/speech/stt',
+  '/api/skills/#id/files',
+]);
+
+const UPLOAD_METHODS = new Set(['POST', 'PUT', 'PATCH']);
+
+const LOW_CARDINALITY_PATHS: RegExp[] = [
+  /^\/api\/agents\/chat\/stream\/#id$/,
+  /^\/api\/agents\/chat\/status\/#id$/,
+  /^\/api\/files\/#id\/preview$/,
+  /^\/api\/files\/(code\/download|download-url|download)\/#id\/#id$/,
+  /^\/api\/skills\/#id\/files$/,
+  /^\/api\/messages\/#id$/,
+  /^\/api\/messages\/#id\/#id$/,
+  /^\/api\/messages\/artifact\/#id$/,
+  /^\/api\/convos\/#id$/,
+  /^\/api\/convos\/#id\/messages\/#id$/,
+  /^\/api\/(files|agents|assistants|tags|tools|runs|sessions)\/#id$/,
+  /^\/api\/share\/#token$/,
+  /^\/share\/#id(?:\/edit)?$/,
+];
+
+const isLowCardinalityPath = (path: string): boolean =>
+  STATIC_PATHS.has(path) || LOW_CARDINALITY_PATHS.some((pattern) => pattern.test(path));
+
+const normalizeKnownPath = (path: string): string => {
+  for (const [pattern, replacement] of PATH_NORMALIZATIONS) {
+    if (pattern.test(path)) {
+      return path.replace(pattern, replacement);
+    }
+  }
+
+  return path;
+};
+
+const normalizeUnknownPath = (path: string): string => {
+  if (STATIC_PATHS.has(path)) {
+    return path;
+  }
+
+  if (path === '/api' || path.startsWith('/api/')) {
+    return '/api/#path';
+  }
+
+  if (path === '/images' || path.startsWith('/images/')) {
+    return '/images/#path';
+  }
+
+  if (path === '/avatars' || path.startsWith('/avatars/')) {
+    return '/avatars/#path';
+  }
+
+  if (path === '/t' || path.startsWith('/t/')) {
+    return '/t/#path';
+  }
+
+  return '/#path';
+};
+
+export const normalizePath = (rawPath: string): string => {
+  const [pathWithoutQuery] = rawPath.split('?');
+  const path = pathWithoutQuery.startsWith('/') ? pathWithoutQuery : `/${pathWithoutQuery}`;
+  const normalized = normalizeKnownPath(path || '/');
+
+  if (isLowCardinalityPath(normalized)) {
+    return normalized;
+  }
+
+  return normalizeUnknownPath(path);
+};
+
+export interface PrometheusMetrics {
+  metricsMiddleware: (req: Request, res: Response, next: NextFunction) => void;
+  metricsRouter: Router;
+}
+
+export type OpenIDUserLookupResult = 'found' | 'not_found' | 'migration' | 'auth_failed' | 'error';
+export type GenerationJobStore = 'memory' | 'redis';
+export type GenerationJobResult = 'created' | 'completed' | 'error' | 'aborted' | 'abort_failed';
+export type GenerationStreamSubscriptionType = 'initial' | 'resume' | 'resume_state';
+export type GenerationStreamSubscriptionResult =
+  | 'success'
+  | 'not_found'
+  | 'error'
+  | 'found'
+  | 'missing';
+export type RumProxyEndpoint = 'traces' | 'logs' | 'unknown';
+export type RumProxyResult =
+  | 'success'
+  | 'auth_drop'
+  | 'auth_error'
+  | 'bad_request'
+  | 'not_configured'
+  | 'collector_4xx'
+  | 'collector_5xx'
+  | 'collector_error'
+  | 'collector_timeout';
+
+type OpenIDUserLookupMetrics = {
+  recordLookup: (result: OpenIDUserLookupResult, durationSeconds: number) => void;
+};
+
+let openIDUserLookupMetrics: OpenIDUserLookupMetrics = {
+  recordLookup: () => undefined,
+};
+
+export function recordOpenIDUserLookup(
+  result: OpenIDUserLookupResult,
+  durationSeconds: number,
+): void {
+  openIDUserLookupMetrics.recordLookup(result, durationSeconds);
+}
+
+type MongooseQueryMetrics = {
+  recordQuery: (model: string, operation: string, status: string, durationSeconds: number) => void;
+};
+
+let mongooseQueryMetrics: MongooseQueryMetrics = {
+  recordQuery: () => undefined,
+};
+
+type GenerationJobMetrics = {
+  recordJob: (store: GenerationJobStore, result: GenerationJobResult) => void;
+  setJobsInFlight: (store: GenerationJobStore, count: number) => void;
+  recordSubscription: (
+    store: GenerationJobStore,
+    type: GenerationStreamSubscriptionType,
+    result: GenerationStreamSubscriptionResult,
+  ) => void;
+  recordResumePendingEvents: (store: GenerationJobStore, count: number) => void;
+};
+
+let generationJobMetrics: GenerationJobMetrics = {
+  recordJob: () => undefined,
+  setJobsInFlight: () => undefined,
+  recordSubscription: () => undefined,
+  recordResumePendingEvents: () => undefined,
+};
+
+type RumProxyMetrics = {
+  recordRequest: (endpoint: RumProxyEndpoint, result: RumProxyResult) => void;
+};
+
+let rumProxyMetrics: RumProxyMetrics = {
+  recordRequest: () => undefined,
+};
+
+const resetMetricRecorders = (): void => {
+  openIDUserLookupMetrics = {
+    recordLookup: () => undefined,
+  };
+  mongooseQueryMetrics = {
+    recordQuery: () => undefined,
+  };
+  generationJobMetrics = {
+    recordJob: () => undefined,
+    setJobsInFlight: () => undefined,
+    recordSubscription: () => undefined,
+    recordResumePendingEvents: () => undefined,
+  };
+  rumProxyMetrics = {
+    recordRequest: () => undefined,
+  };
+};
+
+export function recordGenerationJob(store: GenerationJobStore, result: GenerationJobResult): void {
+  generationJobMetrics.recordJob(store, result);
+}
+
+export function setGenerationJobsInFlight(store: GenerationJobStore, count: number): void {
+  generationJobMetrics.setJobsInFlight(store, count);
+}
+
+export function recordGenerationStreamSubscription(
+  store: GenerationJobStore,
+  type: GenerationStreamSubscriptionType,
+  result: GenerationStreamSubscriptionResult,
+): void {
+  generationJobMetrics.recordSubscription(store, type, result);
+}
+
+export function recordGenerationStreamResumePendingEvents(
+  store: GenerationJobStore,
+  count: number,
+): void {
+  generationJobMetrics.recordResumePendingEvents(store, count);
+}
+
+export function recordRumProxyRequest(endpoint: RumProxyEndpoint, result: RumProxyResult): void {
+  rumProxyMetrics.recordRequest(endpoint, result);
+}
+
+const getElapsedSeconds = (startedAt: bigint): number =>
+  Number(process.hrtime.bigint() - startedAt) / 1_000_000_000;
+
+export const isMetricsConfigured = (): boolean => Boolean(process.env.METRICS_SECRET);
+
+const createUnauthorizedMetricsRouter = (): Router => {
+  const metricsRouter = Router();
+  metricsRouter.get('/', (_req, res) => {
+    res.status(401).end();
+  });
+  return metricsRouter;
+};
+
+const normalizeMongooseLabel = (value: unknown): string => {
+  if (typeof value !== 'string' || !value) return 'unknown';
+  return value.replace(/[^a-zA-Z0-9_:-]/g, '_').slice(0, 64) || 'unknown';
+};
+
+const getHeader = (headers: Record<string, unknown>, name: string): unknown => {
+  const lowerName = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === lowerName) return value;
+  }
+  return undefined;
+};
+
+const headerIncludes = (value: unknown, expected: string): boolean => {
+  if (Array.isArray(value)) {
+    return value.some((entry) => headerIncludes(entry, expected));
+  }
+  return typeof value === 'string' && value.toLowerCase().includes(expected);
+};
+
+const isEventStreamContentType = (value: unknown): boolean =>
+  headerIncludes(value, 'text/event-stream');
+
+const isMultipartContentType = (value: unknown): boolean =>
+  headerIncludes(value, 'multipart/form-data');
+
+const getRequestContentLength = (req: Request): number | null => {
+  const contentLength = req.headers['content-length'];
+  const rawContentLength = Array.isArray(contentLength) ? contentLength[0] : contentLength;
+  const bodyBytes = rawContentLength == null ? NaN : Number(rawContentLength);
+  return Number.isFinite(bodyBytes) && bodyBytes >= 0 ? bodyBytes : null;
+};
+
+const isUploadRequest = (req: Request, normalizedPath: string): boolean => {
+  if (!UPLOAD_METHODS.has(req.method)) return false;
+  if (isMultipartContentType(req.headers['content-type'])) return true;
+  return UPLOAD_PATHS.has(normalizedPath);
+};
+
+export function recordMongooseQuery(
+  model: string,
+  operation: string,
+  status: string,
+  durationSeconds: number,
+): void {
+  mongooseQueryMetrics.recordQuery(
+    normalizeMongooseLabel(model),
+    normalizeMongooseLabel(operation),
+    normalizeMongooseLabel(status),
+    durationSeconds,
+  );
+}
+
+export function instrumentMongooseQueryMetrics(mongoose: Mongoose): void {
+  if (!isMetricsConfigured()) return;
+
+  const instrumented = Symbol.for('librechat.mongooseQueryMetrics.instrumented');
+  const queryPrototype = mongoose.Query?.prototype as
+    | (typeof mongoose.Query.prototype & { [instrumented]?: boolean })
+    | undefined;
+
+  if (!queryPrototype || queryPrototype[instrumented]) return;
+
+  const originalExec = queryPrototype.exec;
+  queryPrototype.exec = function instrumentedExec(
+    this: typeof queryPrototype & {
+      model?: { modelName?: string };
+      op?: string;
+    },
+    ...args: Parameters<typeof originalExec>
+  ) {
+    const startedAt = process.hrtime.bigint();
+    const model = normalizeMongooseLabel(this.model?.modelName);
+    const operation = normalizeMongooseLabel(this.op);
+
+    let result: ReturnType<typeof originalExec>;
+    try {
+      result = originalExec.apply(this, args);
+    } catch (error) {
+      recordMongooseQuery(model, operation, 'error', getElapsedSeconds(startedAt));
+      throw error;
+    }
+
+    return Promise.resolve(result).then(
+      (result) => {
+        recordMongooseQuery(model, operation, 'success', getElapsedSeconds(startedAt));
+        return result;
+      },
+      (error) => {
+        recordMongooseQuery(model, operation, 'error', getElapsedSeconds(startedAt));
+        throw error;
+      },
+    );
+  } as typeof originalExec;
+  queryPrototype[instrumented] = true;
+}
+
+export function createMetrics(): PrometheusMetrics {
+  if (!isMetricsConfigured()) {
+    resetMetricRecorders();
+    return {
+      metricsMiddleware: (_req: Request, _res: Response, next: NextFunction) => next(),
+      metricsRouter: createUnauthorizedMetricsRouter(),
+    };
+  }
+
+  const registry = new Registry();
+  collectDefaultMetrics({ register: registry });
+
+  const httpRequests = new Counter({
+    name: 'http_requests_total',
+    help: 'Total HTTP requests',
+    labelNames: ['method', 'path', 'status'] as const,
+    registers: [registry],
+  });
+
+  const httpDuration = new Histogram({
+    name: 'http_request_duration_seconds',
+    help: 'HTTP request latency in seconds',
+    labelNames: ['method', 'path', 'status'] as const,
+    buckets: [0.05, 0.1, 0.3, 0.5, 1, 2, 5],
+    registers: [registry],
+  });
+
+  const httpRequestsInFlight = new Gauge({
+    name: 'http_requests_in_flight',
+    help: 'HTTP requests currently being handled',
+    labelNames: ['method', 'path'] as const,
+    registers: [registry],
+  });
+
+  const httpRequestBodyBytes = new Histogram({
+    name: 'http_request_body_bytes',
+    help: 'HTTP request body size in bytes from the Content-Length header',
+    labelNames: ['method', 'path'] as const,
+    buckets: [1_000, 10_000, 100_000, 1_000_000, 5_000_000, 10_000_000, 25_000_000, 50_000_000],
+    registers: [registry],
+  });
+
+  const sseStreams = new Counter({
+    name: 'sse_streams_total',
+    help: 'Total SSE streams opened',
+    labelNames: ['method', 'path', 'status'] as const,
+    registers: [registry],
+  });
+
+  const sseStreamsInFlight = new Gauge({
+    name: 'sse_streams_in_flight',
+    help: 'SSE streams currently open',
+    labelNames: ['method', 'path'] as const,
+    registers: [registry],
+  });
+
+  const sseStreamDuration = new Histogram({
+    name: 'sse_stream_duration_seconds',
+    help: 'SSE stream open duration in seconds',
+    labelNames: ['method', 'path', 'status'] as const,
+    buckets: [1, 5, 10, 30, 60, 120, 300, 600, 1_200, 1_800],
+    registers: [registry],
+  });
+
+  const uploadRequests = new Counter({
+    name: 'upload_requests_total',
+    help: 'Total upload requests',
+    labelNames: ['method', 'path', 'status'] as const,
+    registers: [registry],
+  });
+
+  const uploadRequestsInFlight = new Gauge({
+    name: 'upload_requests_in_flight',
+    help: 'Upload requests currently being handled',
+    labelNames: ['method', 'path'] as const,
+    registers: [registry],
+  });
+
+  const uploadRequestDuration = new Histogram({
+    name: 'upload_request_duration_seconds',
+    help: 'Upload request duration in seconds',
+    labelNames: ['method', 'path', 'status'] as const,
+    buckets: [0.1, 0.3, 0.5, 1, 2, 5, 10, 30, 60, 120, 300],
+    registers: [registry],
+  });
+
+  const uploadBytes = new Counter({
+    name: 'upload_bytes_total',
+    help: 'Upload request bytes from the Content-Length header',
+    labelNames: ['method', 'path'] as const,
+    registers: [registry],
+  });
+
+  const openIDUserLookupTotal = new Counter({
+    name: 'openid_user_lookup_total',
+    help: 'OpenID user lookup attempts',
+    labelNames: ['result'] as const,
+    registers: [registry],
+  });
+
+  const openIDUserLookupDuration = new Histogram({
+    name: 'openid_user_lookup_duration_seconds',
+    help: 'OpenID user lookup latency in seconds',
+    labelNames: ['result'] as const,
+    buckets: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60],
+    registers: [registry],
+  });
+
+  openIDUserLookupMetrics = {
+    recordLookup: (result, durationSeconds) => {
+      openIDUserLookupTotal.inc({ result });
+      openIDUserLookupDuration.observe({ result }, durationSeconds);
+    },
+  };
+
+  const mongooseQueries = new Counter({
+    name: 'mongoose_queries_total',
+    help: 'Mongoose queries by model, operation, and status',
+    labelNames: ['model', 'operation', 'status'] as const,
+    registers: [registry],
+  });
+
+  const mongooseQueryDuration = new Histogram({
+    name: 'mongoose_query_duration_seconds',
+    help: 'Mongoose query duration in seconds by model, operation, and status',
+    labelNames: ['model', 'operation', 'status'] as const,
+    buckets: [0.001, 0.003, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60],
+    registers: [registry],
+  });
+
+  mongooseQueryMetrics = {
+    recordQuery: (model, operation, status, durationSeconds) => {
+      const labels = { model, operation, status };
+      mongooseQueries.inc(labels);
+      mongooseQueryDuration.observe(labels, durationSeconds);
+    },
+  };
+
+  const generationJobs = new Counter({
+    name: 'generation_jobs_total',
+    help: 'Generation jobs by backing store and result',
+    labelNames: ['store', 'result'] as const,
+    registers: [registry],
+  });
+
+  const generationJobsInFlight = new Gauge({
+    name: 'generation_jobs_in_flight',
+    help: 'Generation jobs currently running in this process',
+    labelNames: ['store'] as const,
+    registers: [registry],
+  });
+
+  const generationStreamSubscriptions = new Counter({
+    name: 'generation_stream_subscriptions_total',
+    help: 'Generation stream subscription attempts by backing store, type, and result',
+    labelNames: ['store', 'type', 'result'] as const,
+    registers: [registry],
+  });
+
+  const generationStreamResumePendingEvents = new Counter({
+    name: 'generation_stream_resume_pending_events_total',
+    help: 'Pending events delivered while resuming generation streams',
+    labelNames: ['store'] as const,
+    registers: [registry],
+  });
+
+  const rumProxyRequests = new Counter({
+    name: 'rum_proxy_requests_total',
+    help: 'RUM proxy requests by endpoint and result',
+    labelNames: ['endpoint', 'result'] as const,
+    registers: [registry],
+  });
+
+  generationJobMetrics = {
+    recordJob: (store, result) => generationJobs.inc({ store, result }),
+    setJobsInFlight: (store, count) => generationJobsInFlight.set({ store }, count),
+    recordSubscription: (store, type, result) =>
+      generationStreamSubscriptions.inc({ store, type, result }),
+    recordResumePendingEvents: (store, count) =>
+      generationStreamResumePendingEvents.inc({ store }, count),
+  };
+
+  rumProxyMetrics = {
+    recordRequest: (endpoint, result) => rumProxyRequests.inc({ endpoint, result }),
+  };
+
+  const metricsMiddleware = (req: Request, res: Response, next: NextFunction): void => {
+    const end = httpDuration.startTimer();
+    const labels = { method: req.method, path: normalizePath(req.path) };
+    const uploadTracked = isUploadRequest(req, labels.path);
+    const uploadStartedAt = uploadTracked ? process.hrtime.bigint() : null;
+    let sseTracked = false;
+    let sseStartedAt: bigint | null = null;
+    let completed = false;
+
+    const markSSEStream = () => {
+      if (completed || res.writableEnded || res.destroyed) return;
+      if (sseTracked) return;
+      sseTracked = true;
+      sseStartedAt = process.hrtime.bigint();
+      sseStreamsInFlight.inc(labels);
+    };
+
+    const originalSetHeader = res.setHeader;
+    res.setHeader = function setHeader(this: Response, ...args: Parameters<Response['setHeader']>) {
+      const [name, value] = args;
+      const result = originalSetHeader.apply(this, args);
+      if (String(name).toLowerCase() === 'content-type' && isEventStreamContentType(value)) {
+        markSSEStream();
+      }
+      return result;
+    } as Response['setHeader'];
+
+    const originalWriteHead = res.writeHead;
+    res.writeHead = function writeHead(this: Response, ...args: [number, unknown?, unknown?]) {
+      const [, reasonPhrase, headers] = args;
+      const responseHeaders =
+        typeof reasonPhrase === 'object' && reasonPhrase != null ? reasonPhrase : headers;
+      if (
+        isEventStreamContentType(
+          getHeader((responseHeaders ?? {}) as Record<string, unknown>, 'content-type'),
+        ) ||
+        isEventStreamContentType(res.getHeader('content-type'))
+      ) {
+        markSSEStream();
+      }
+      return originalWriteHead.apply(this, args as Parameters<typeof originalWriteHead>);
+    } as Response['writeHead'];
+
+    httpRequestsInFlight.inc(labels);
+    if (uploadTracked) {
+      uploadRequestsInFlight.inc(labels);
+    }
+
+    const complete = (completedBy: 'finish' | 'close') => {
+      if (completed) return;
+      completed = true;
+
+      const requestLabels = { ...labels, status: completedBy === 'close' ? 499 : res.statusCode };
+      httpRequests.inc(requestLabels);
+      end(requestLabels);
+      httpRequestsInFlight.dec(labels);
+
+      const bodyBytes = getRequestContentLength(req);
+      if (bodyBytes != null) {
+        httpRequestBodyBytes.observe(labels, bodyBytes);
+      }
+
+      if (sseTracked) {
+        sseStreams.inc(requestLabels);
+        sseStreamsInFlight.dec(labels);
+        if (sseStartedAt) {
+          sseStreamDuration.observe(requestLabels, getElapsedSeconds(sseStartedAt));
+        }
+      }
+
+      if (uploadTracked) {
+        uploadRequests.inc(requestLabels);
+        uploadRequestsInFlight.dec(labels);
+        if (uploadStartedAt) {
+          uploadRequestDuration.observe(requestLabels, getElapsedSeconds(uploadStartedAt));
+        }
+        if (bodyBytes != null) {
+          uploadBytes.inc(labels, bodyBytes);
+        }
+      }
+    };
+
+    res.once('finish', () => complete('finish'));
+    res.once('close', () => complete('close'));
+    next();
+  };
+
+  const metricsRouter = Router();
+  const metricsHandler: RequestHandler = (req, res): void => {
+    const secret = process.env.METRICS_SECRET;
+    const auth = req.headers['authorization'];
+    if (!secret || !auth) {
+      res.status(401).end();
+      return;
+    }
+    const bearerToken = auth.match(/^bearer\s+(.+)$/i);
+    if (!bearerToken) {
+      res.status(401).end();
+      return;
+    }
+
+    const token = bearerToken[1];
+    const encode = (s: string) => new TextEncoder().encode(s);
+    const expected = encode(secret);
+    const actual = encode(token);
+    if (expected.byteLength !== actual.byteLength || !timingSafeEqual(expected, actual)) {
+      res.status(401).end();
+      return;
+    }
+
+    void registry
+      .metrics()
+      .then((metrics) => {
+        res.set('Content-Type', registry.contentType);
+        res.end(metrics);
+      })
+      .catch((err) => {
+        logger.error('[metrics] Failed to collect metrics:', err);
+        res.status(500).end();
+      });
+  };
+
+  metricsRouter.get('/', metricsHandler);
+
+  return { metricsMiddleware, metricsRouter };
+}
diff --git a/packages/api/src/app/permissions.spec.ts b/packages/api/src/app/permissions.spec.ts
index 01a6b11e42c..b93efe64d3b 100644
--- a/packages/api/src/app/permissions.spec.ts
+++ b/packages/api/src/app/permissions.spec.ts
@@ -99,6 +99,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -112,6 +113,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -152,6 +158,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -165,6 +172,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -269,6 +281,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -282,6 +295,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -322,6 +340,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -335,6 +354,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -425,6 +449,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -438,6 +463,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -478,6 +508,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -491,6 +522,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -594,6 +630,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -607,6 +644,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -647,6 +689,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -660,6 +703,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -750,6 +798,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -763,6 +812,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -803,6 +857,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -816,6 +871,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -911,6 +971,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -924,6 +985,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -952,6 +1018,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -965,6 +1032,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -1077,6 +1149,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -1090,6 +1163,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -1122,6 +1200,7 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -1135,6 +1214,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -2180,6 +2264,111 @@ describe('updateInterfacePermissions - permissions', () => {
     expect(userCall[1][PermissionTypes.MCP_SERVERS]).not.toHaveProperty(Permissions.SHARE);
   });
 
+  it('should backfill MCP_SERVERS.CONFIGURE_OBO for existing roles (post-OBO permission addition)', async () => {
+    // Existing deployment: MCP_SERVERS row already present from before CONFIGURE_OBO existed.
+    // initializeRoles only fills missing permission *types*, not sub-keys, so backfill is needed.
+    mockGetRoleByName.mockImplementation(async (roleName: string) => {
+      if (roleName === SystemRoles.USER) {
+        return {
+          permissions: {
+            [PermissionTypes.MCP_SERVERS]: {
+              [Permissions.USE]: true,
+              [Permissions.CREATE]: false,
+              [Permissions.SHARE]: false,
+              [Permissions.SHARE_PUBLIC]: false,
+              // CONFIGURE_OBO intentionally absent
+            },
+          },
+        };
+      }
+      return {
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+            [Permissions.CREATE]: true,
+            [Permissions.SHARE]: true,
+            [Permissions.SHARE_PUBLIC]: true,
+            // CONFIGURE_OBO intentionally absent
+          },
+        },
+      };
+    });
+
+    const config = { interface: {} };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+    const adminCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.ADMIN,
+    );
+
+    expect(userCall?.[1]?.[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO]).toBe(false);
+    expect(adminCall?.[1]?.[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO]).toBe(true);
+  });
+
+  it('should not overwrite an admin-set CONFIGURE_OBO value during backfill', async () => {
+    // Operator explicitly set USER.CONFIGURE_OBO=true via the role permissions editor.
+    mockGetRoleByName.mockImplementation(async (roleName: string) => {
+      if (roleName === SystemRoles.USER) {
+        return {
+          permissions: {
+            [PermissionTypes.MCP_SERVERS]: {
+              [Permissions.USE]: true,
+              [Permissions.CREATE]: false,
+              [Permissions.SHARE]: false,
+              [Permissions.SHARE_PUBLIC]: false,
+              [Permissions.CONFIGURE_OBO]: true,
+            },
+          },
+        };
+      }
+      return {
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+            [Permissions.CREATE]: true,
+            [Permissions.SHARE]: true,
+            [Permissions.SHARE_PUBLIC]: true,
+            [Permissions.CONFIGURE_OBO]: true,
+          },
+        },
+      };
+    });
+
+    const config = { interface: {} };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+
+    // Either no update was queued, or the queued update does not flip CONFIGURE_OBO.
+    if (userCall) {
+      const queuedMcp = userCall[1]?.[PermissionTypes.MCP_SERVERS];
+      if (queuedMcp && Permissions.CONFIGURE_OBO in queuedMcp) {
+        expect(queuedMcp[Permissions.CONFIGURE_OBO]).toBe(true);
+      }
+    }
+  });
+
   it('should apply explicit remoteAgents config to USER permissions (regression: loadDefaultInterface omission)', async () => {
     const config = {
       interface: {
@@ -2451,6 +2640,7 @@ describe('updateInterfacePermissions - permissions', () => {
       [Permissions.CREATE]: false,
       [Permissions.SHARE]: false,
       [Permissions.SHARE_PUBLIC]: false,
+      [Permissions.CONFIGURE_OBO]: false,
     });
 
     expect(adminCall[1][PermissionTypes.MCP_SERVERS]).toEqual({
@@ -2458,6 +2648,7 @@ describe('updateInterfacePermissions - permissions', () => {
       [Permissions.CREATE]: true,
       [Permissions.SHARE]: true,
       [Permissions.SHARE_PUBLIC]: true,
+      [Permissions.CONFIGURE_OBO]: true,
     });
   });
 
@@ -2490,6 +2681,7 @@ describe('updateInterfacePermissions - permissions', () => {
 
     expect(userCall[1][PermissionTypes.MCP_SERVERS]).toEqual({
       [Permissions.CREATE]: false,
+      [Permissions.CONFIGURE_OBO]: false,
     });
   });
 
@@ -2531,10 +2723,15 @@ describe('updateInterfacePermissions - permissions', () => {
 
     expect(userCall[1][PermissionTypes.MCP_SERVERS]).toEqual({
       [Permissions.CREATE]: false,
+      [Permissions.CONFIGURE_OBO]: false,
     });
     expect(userCall[1]).not.toHaveProperty(PermissionTypes.AGENTS);
 
-    expect(adminCall[1]).not.toHaveProperty(PermissionTypes.MCP_SERVERS);
+    // Admin's MCP_SERVERS doesn't migrate CREATE (already true) but does receive
+    // the CONFIGURE_OBO backfill since the mocked role doc lacked that sub-key.
+    expect(adminCall[1][PermissionTypes.MCP_SERVERS]).toEqual({
+      [Permissions.CONFIGURE_OBO]: true,
+    });
     expect(adminCall[1]).not.toHaveProperty(PermissionTypes.AGENTS);
   });
 
@@ -2571,4 +2768,78 @@ describe('updateInterfacePermissions - permissions', () => {
 
     expect(userCall[1][PermissionTypes.MCP_SERVERS][Permissions.CREATE]).toBe(true);
   });
+
+  it('should disable all SHARED_LINKS permissions when sharedLinks: false (boolean)', async () => {
+    mockGetRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.CREATE]: true,
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: true,
+        },
+      },
+    });
+
+    const config = {
+      interface: {
+        sharedLinks: false,
+      },
+    };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+
+    expect(userCall[1][PermissionTypes.SHARED_LINKS]).toEqual({
+      [Permissions.CREATE]: false,
+      [Permissions.SHARE]: false,
+      [Permissions.SHARE_PUBLIC]: false,
+    });
+  });
+
+  it('should enable all SHARED_LINKS permissions when sharedLinks: true (boolean)', async () => {
+    mockGetRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.CREATE]: false,
+          [Permissions.SHARE]: false,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      },
+    });
+
+    const config = {
+      interface: {
+        sharedLinks: true,
+      },
+    };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+
+    expect(userCall[1][PermissionTypes.SHARED_LINKS]).toEqual({
+      [Permissions.CREATE]: true,
+      [Permissions.SHARE]: true,
+      [Permissions.SHARE_PUBLIC]: true,
+    });
+  });
 });
diff --git a/packages/api/src/app/permissions.ts b/packages/api/src/app/permissions.ts
index 129ac882a73..dcc626143ce 100644
--- a/packages/api/src/app/permissions.ts
+++ b/packages/api/src/app/permissions.ts
@@ -47,6 +47,8 @@ function hasExplicitConfig(
       return interfaceConfig?.remoteAgents !== undefined;
     case PermissionTypes.SKILLS:
       return interfaceConfig?.skills !== undefined;
+    case PermissionTypes.SHARED_LINKS:
+      return interfaceConfig?.sharedLinks !== undefined;
     default:
       return false;
   }
@@ -151,9 +153,7 @@ export async function updateInterfacePermissions({
         } else if (isMemoryDisabled) {
           logger.debug(`Role '${roleName}': Disabling memories as memory.disabled is true`);
         } else if (isMemoryReenabling) {
-          logger.debug(
-            `Role '${roleName}': Re-enabling memories due to memory configuration`,
-          );
+          logger.debug(`Role '${roleName}': Re-enabling memories due to memory configuration`);
         }
       } else {
         logger.debug(`Role '${roleName}': Preserving existing permissions for '${permType}'`);
@@ -199,6 +199,12 @@ export async function updateInterfacePermissions({
       typeof defaults.agents === 'object' ? defaults.agents?.public : undefined;
     const skillsDefaultPublic =
       typeof defaults.skills === 'object' ? defaults.skills?.public : undefined;
+    const sharedLinksDefaultCreate =
+      typeof defaults.sharedLinks === 'boolean' ? undefined : defaults.sharedLinks?.create;
+    const sharedLinksDefaultShare =
+      typeof defaults.sharedLinks === 'object' ? defaults.sharedLinks?.share : undefined;
+    const sharedLinksDefaultPublic =
+      typeof defaults.sharedLinks === 'object' ? defaults.sharedLinks?.public : undefined;
 
     const allPermissions: Partial<Record<PermissionTypes, Record<string, boolean | undefined>>> = {
       [PermissionTypes.PROMPTS]: {
@@ -404,6 +410,17 @@ export async function updateInterfacePermissions({
               ),
             }
           : {}),
+        ...((typeof interfaceConfig?.mcpServers === 'object' &&
+          'configureObo' in interfaceConfig.mcpServers) ||
+        !existingPermissions?.[PermissionTypes.MCP_SERVERS]
+          ? {
+              [Permissions.CONFIGURE_OBO]: getPermissionValue(
+                loadedInterface.mcpServers?.configureObo,
+                defaultPerms[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO],
+                undefined,
+              ),
+            }
+          : {}),
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: getPermissionValue(
@@ -474,6 +491,43 @@ export async function updateInterfacePermissions({
             }
           : {}),
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        ...(typeof interfaceConfig?.sharedLinks === 'boolean' ||
+        (typeof interfaceConfig?.sharedLinks === 'object' &&
+          'create' in interfaceConfig.sharedLinks) ||
+        !existingPermissions?.[PermissionTypes.SHARED_LINKS]
+          ? {
+              [Permissions.CREATE]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigCreate(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.CREATE],
+                sharedLinksDefaultCreate ?? true,
+              ),
+            }
+          : {}),
+        ...(typeof interfaceConfig?.sharedLinks === 'boolean' ||
+        (typeof interfaceConfig?.sharedLinks === 'object' &&
+          ('share' in interfaceConfig.sharedLinks || 'public' in interfaceConfig.sharedLinks)) ||
+        !existingPermissions?.[PermissionTypes.SHARED_LINKS]
+          ? {
+              [Permissions.SHARE]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigShare(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE],
+                sharedLinksDefaultShare,
+              ),
+              [Permissions.SHARE_PUBLIC]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigPublic(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE_PUBLIC],
+                sharedLinksDefaultPublic,
+              ),
+            }
+          : {}),
+      },
     };
 
     // Check and add each permission type if needed
@@ -568,6 +622,21 @@ export async function updateInterfacePermissions({
           ),
         },
       ],
+      [
+        PermissionTypes.SHARED_LINKS,
+        {
+          [Permissions.SHARE]: getPermissionValue(
+            getConfigShare(loadedInterface.sharedLinks),
+            defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE],
+            sharedLinksDefaultShare,
+          ),
+          [Permissions.SHARE_PUBLIC]: getPermissionValue(
+            getConfigPublic(loadedInterface.sharedLinks),
+            defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE_PUBLIC],
+            sharedLinksDefaultPublic,
+          ),
+        },
+      ],
     ];
 
     for (const [permType, shareDefaults] of shareBackfill) {
@@ -623,6 +692,39 @@ export async function updateInterfacePermissions({
       }
     }
 
+    /**
+     * Backfill MCP_SERVERS.CONFIGURE_OBO for existing roles that pre-date the permission.
+     * The MCP_SERVERS permission type already exists on these role docs, so the
+     * `addPermissionIfNeeded` block above does not re-seed it. Only fill in the field
+     * when it is literally absent — never overwrite an admin-set value.
+     */
+    {
+      const existingMcpPerms = existingPermissions?.[PermissionTypes.MCP_SERVERS];
+      const oboExplicit =
+        typeof interfaceConfig?.mcpServers === 'object' &&
+        'configureObo' in interfaceConfig.mcpServers;
+      const alreadyQueued =
+        permissionsToUpdate[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO] !== undefined;
+      if (
+        existingMcpPerms &&
+        existingMcpPerms[Permissions.CONFIGURE_OBO] === undefined &&
+        !oboExplicit &&
+        !alreadyQueued
+      ) {
+        const backfillValue =
+          defaultPerms[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO];
+        if (backfillValue !== undefined) {
+          logger.debug(
+            `Role '${roleName}': Backfilling MCP_SERVERS.CONFIGURE_OBO=${backfillValue}`,
+          );
+          permissionsToUpdate[PermissionTypes.MCP_SERVERS] = {
+            ...permissionsToUpdate[PermissionTypes.MCP_SERVERS],
+            [Permissions.CONFIGURE_OBO]: backfillValue,
+          };
+        }
+      }
+    }
+
     // Update permissions if any need updating
     if (Object.keys(permissionsToUpdate).length > 0) {
       await updateAccessPermissions(roleName, permissionsToUpdate, existingRole);
diff --git a/packages/api/src/app/service.spec.ts b/packages/api/src/app/service.spec.ts
index b692aa6eb28..248d42dacd0 100644
--- a/packages/api/src/app/service.spec.ts
+++ b/packages/api/src/app/service.spec.ts
@@ -327,6 +327,51 @@ describe('createAppConfigService', () => {
 
         expect(deps.getApplicableConfigs).toHaveBeenCalledWith([]);
       });
+
+      it('scopes the override cache key to the ALS tenant when no tenantId param is given', async () => {
+        const { tenantStorage } = jest.requireActual('@librechat/data-schemas');
+        const deps = createDeps({
+          getApplicableConfigs: jest
+            .fn()
+            .mockResolvedValue([{ priority: 10, overrides: { x: 1 }, isActive: true }]),
+        });
+        const { getAppConfig } = createAppConfigService(deps);
+
+        await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          getAppConfig({ role: 'USER' }),
+        );
+
+        const overrideKey = [...deps._cache._store.keys()].find((k: string) =>
+          k.includes('_OVERRIDE_:'),
+        );
+        expect(overrideKey).toBe('app_config:_OVERRIDE_:tenant-a:USER');
+        expect(overrideKey).not.toContain('__default__');
+      });
+
+      it('does not serve one tenant a cached config built for another tenant', async () => {
+        const { tenantStorage, getTenantId } = jest.requireActual('@librechat/data-schemas');
+        // Each tenant's DB overrides carry a marker derived from the active ALS tenant.
+        const deps = createDeps({
+          getApplicableConfigs: jest
+            .fn()
+            .mockImplementation(async () => [
+              { priority: 10, overrides: { whoami: getTenantId() }, isActive: true },
+            ]),
+        });
+        const { getAppConfig } = createAppConfigService(deps);
+
+        const configA = (await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          getAppConfig({ role: 'USER' }),
+        )) as TestConfig & { whoami?: string };
+        const configB = (await tenantStorage.run({ tenantId: 'tenant-b' }, async () =>
+          getAppConfig({ role: 'USER' }),
+        )) as TestConfig & { whoami?: string };
+
+        expect(configA.whoami).toBe('tenant-a');
+        expect(configB.whoami).toBe('tenant-b');
+        // A cache collision would short-circuit the second tenant's DB read.
+        expect(deps.getApplicableConfigs).toHaveBeenCalledTimes(2);
+      });
     });
 
     it('does not cache on buildPrincipals error — retries on next request', async () => {
diff --git a/packages/api/src/app/service.ts b/packages/api/src/app/service.ts
index 613c428fca7..87556f25673 100644
--- a/packages/api/src/app/service.ts
+++ b/packages/api/src/app/service.ts
@@ -5,8 +5,8 @@ import {
   mergeConfigOverrides,
   BASE_CONFIG_PRINCIPAL_ID,
 } from '@librechat/data-schemas';
-import type { Types } from 'mongoose';
 import type { AppConfig, IConfig } from '@librechat/data-schemas';
+import type { Types } from 'mongoose';
 
 const BASE_CONFIG_KEY = '_BASE_';
 
@@ -73,7 +73,10 @@ export function _resetOverrideStrictCache(): void {
 }
 
 function overrideCacheKey(role?: string, userId?: string, tenantId?: string): string {
-  const tenant = tenantId || '__default__';
+  // Fall back to the ALS tenant context before `__default__`: callers that rely on the
+  // tenant middleware (the common path) pass no explicit tenantId, so without this the
+  // entry is keyed under the shared `__default__` bucket and leaks across tenants.
+  const tenant = tenantId || getTenantId() || '__default__';
   if (userId && role) {
     return `_OVERRIDE_:${tenant}:${role}:${userId}`;
   }
@@ -88,7 +91,11 @@ function overrideCacheKey(role?: string, userId?: string, tenantId?: string): st
 
 // ── Service factory ──────────────────────────────────────────────────
 
-export function createAppConfigService(deps: AppConfigServiceDeps) {
+export function createAppConfigService(deps: AppConfigServiceDeps): {
+  getAppConfig: (options?: GetAppConfigOptions) => Promise<AppConfig>;
+  clearAppConfigCache: () => Promise<void>;
+  clearOverrideCache: (tenantId?: string) => Promise<void>;
+} {
   const {
     loadBaseConfig,
     setCachedTools,
@@ -174,16 +181,16 @@ export function createAppConfigService(deps: AppConfigServiceDeps) {
       return baseConfig;
     }
 
-    // Strict-isolation + no tenant (param or ALS) = pathological path (middleware bypass or
-    // unauthenticated startup). Pre-tenant calls use baseOnly:true; admin calls carry tenantId.
-    // If ALS has a tenant, Mongoose scopes queries to that tenant's overrides — must fall through.
-    // Not cached: the cache key doesn't include ALS context, so a cached __default__ entry would
-    // be served to later ALS-scoped calls that share the same param-derived key.
+    // Strict isolation + no tenant anywhere (neither param nor ALS) is pathological: a
+    // middleware bypass or an unauthenticated startup call. Pre-tenant calls should use
+    // baseOnly:true and admin calls carry an explicit tenantId. Return the base config
+    // without caching it under the shared `__default__` bucket. When ALS has a tenant,
+    // overrideCacheKey scopes the key to it, so we fall through and cache per-tenant.
     if (principals.length === 0 && !tenantId && !getTenantId() && isStrictOverrideMode()) {
       return baseConfig;
     }
 
-    if (!tenantId && isStrictOverrideMode() && !_warnedNoTenantInStrictMode) {
+    if (!tenantId && !getTenantId() && isStrictOverrideMode() && !_warnedNoTenantInStrictMode) {
       _warnedNoTenantInStrictMode = true;
       logger.warn(
         '[getAppConfig] No tenantId in strict mode — falling back to __default__. ' +
diff --git a/packages/api/src/app/shutdown.spec.ts b/packages/api/src/app/shutdown.spec.ts
new file mode 100644
index 00000000000..2dba3d3fbe2
--- /dev/null
+++ b/packages/api/src/app/shutdown.spec.ts
@@ -0,0 +1,261 @@
+/// <reference types="jest" />
+import http from 'http';
+import {
+  setupGracefulShutdown,
+  registerShutdownTask,
+  __resetShutdownStateForTests,
+} from './shutdown';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+}));
+
+const triggerSignal = (signal: NodeJS.Signals): void => {
+  const listeners = process.listeners(signal) as NodeJS.SignalsListener[];
+  listeners.forEach((listener) => listener(signal));
+};
+
+const flush = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+
+describe('setupGracefulShutdown', () => {
+  let server: http.Server;
+  let exitSpy: jest.SpyInstance;
+  let originalSigterm: NodeJS.SignalsListener[];
+  let originalSigint: NodeJS.SignalsListener[];
+  let originalSigquit: NodeJS.SignalsListener[];
+  let originalSighup: NodeJS.SignalsListener[];
+
+  beforeEach(() => {
+    server = http.createServer();
+    // Most tests exercise the close path, so we fake `listening` to true.
+    // Tests that want to exercise the not-listening short-circuit override
+    // this back to false.
+    Object.defineProperty(server, 'listening', { value: true, configurable: true });
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation((() => undefined) as never);
+    originalSigterm = process.listeners('SIGTERM').slice() as NodeJS.SignalsListener[];
+    originalSigint = process.listeners('SIGINT').slice() as NodeJS.SignalsListener[];
+    originalSigquit = process.listeners('SIGQUIT').slice() as NodeJS.SignalsListener[];
+    originalSighup = process.listeners('SIGHUP').slice() as NodeJS.SignalsListener[];
+    process.removeAllListeners('SIGTERM');
+    process.removeAllListeners('SIGINT');
+    process.removeAllListeners('SIGQUIT');
+    process.removeAllListeners('SIGHUP');
+    __resetShutdownStateForTests();
+  });
+
+  afterEach(() => {
+    process.removeAllListeners('SIGTERM');
+    process.removeAllListeners('SIGINT');
+    process.removeAllListeners('SIGQUIT');
+    process.removeAllListeners('SIGHUP');
+    originalSigterm.forEach((listener) => process.on('SIGTERM', listener));
+    originalSigint.forEach((listener) => process.on('SIGINT', listener));
+    originalSigquit.forEach((listener) => process.on('SIGQUIT', listener));
+    originalSighup.forEach((listener) => process.on('SIGHUP', listener));
+    exitSpy.mockRestore();
+    if (server.listening) {
+      server.close();
+    }
+    __resetShutdownStateForTests();
+    jest.useRealTimers();
+  });
+
+  it('registers handlers for SIGTERM, SIGINT, SIGQUIT, and SIGHUP', () => {
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGQUIT', 'SIGHUP'] as NodeJS.Signals[]) {
+      expect(process.listenerCount(signal)).toBe(0);
+    }
+    setupGracefulShutdown(server);
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGQUIT', 'SIGHUP'] as NodeJS.Signals[]) {
+      expect(process.listenerCount(signal)).toBe(1);
+    }
+  });
+
+  it('closes the server and exits 0 on SIGTERM', async () => {
+    const closeSpy = jest
+      .spyOn(server, 'close')
+      .mockImplementation((cb?: (err?: Error) => void) => {
+        if (cb) {
+          setImmediate(() => cb());
+        }
+        return server;
+      });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(closeSpy).toHaveBeenCalled();
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('closes the server and exits 0 on SIGINT', async () => {
+    const closeSpy = jest
+      .spyOn(server, 'close')
+      .mockImplementation((cb?: (err?: Error) => void) => {
+        if (cb) {
+          setImmediate(() => cb());
+        }
+        return server;
+      });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGINT');
+    await flush();
+    await flush();
+    expect(closeSpy).toHaveBeenCalled();
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('exits 1 if server.close yields an error', async () => {
+    const closeErr = new Error('close failed');
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      if (cb) {
+        setImmediate(() => cb(closeErr));
+      }
+      return server;
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it('treats ERR_SERVER_NOT_RUNNING from close() as a successful shutdown', async () => {
+    const notRunning: NodeJS.ErrnoException = Object.assign(new Error('Server is not running.'), {
+      code: 'ERR_SERVER_NOT_RUNNING',
+    });
+    // Force listening=true so the pre-check doesn't short-circuit;
+    // we want to exercise the post-check that ignores ERR_SERVER_NOT_RUNNING.
+    Object.defineProperty(server, 'listening', { value: true, configurable: true });
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      if (cb) {
+        setImmediate(() => cb(notRunning));
+      }
+      return server;
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('skips close() entirely when the server is not listening yet', async () => {
+    // SIGTERM during the startup window (before app.listen finishes binding
+    // the socket) must not be treated as a failed shutdown.
+    Object.defineProperty(server, 'listening', { value: false, configurable: true });
+    const closeSpy = jest.spyOn(server, 'close');
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    expect(closeSpy).not.toHaveBeenCalled();
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('is idempotent — a second signal does not trigger another shutdown', async () => {
+    const closeSpy = jest.spyOn(server, 'close');
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    triggerSignal('SIGTERM');
+    await flush();
+    expect(closeSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('force-exits with code 1 if shutdown exceeds the timeout', () => {
+    jest.useFakeTimers();
+    jest.spyOn(server, 'close').mockImplementation(() => server);
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    jest.advanceTimersByTime(60_000);
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it('runs registered tasks after server.close and before exit', async () => {
+    const calls: string[] = [];
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      calls.push('server.close');
+      if (cb) {
+        setImmediate(() => cb());
+      }
+      return server;
+    });
+    registerShutdownTask('task-a', () => {
+      calls.push('task-a');
+    });
+    registerShutdownTask('task-b', () => {
+      calls.push('task-b');
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(calls).toEqual(['server.close', 'task-a', 'task-b']);
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('runs tasks in registration order', async () => {
+    const order: string[] = [];
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      if (cb) {
+        setImmediate(() => cb());
+      }
+      return server;
+    });
+    ['first', 'second', 'third'].forEach((name) => {
+      registerShutdownTask(name, () => {
+        order.push(name);
+      });
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(order).toEqual(['first', 'second', 'third']);
+  });
+
+  it('continues subsequent tasks and still exits if one task throws', async () => {
+    const calls: string[] = [];
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      if (cb) {
+        setImmediate(() => cb());
+      }
+      return server;
+    });
+    registerShutdownTask('ok-before', () => {
+      calls.push('ok-before');
+    });
+    registerShutdownTask('throws', () => {
+      calls.push('throws');
+      throw new Error('boom');
+    });
+    registerShutdownTask('ok-after', () => {
+      calls.push('ok-after');
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    expect(calls).toEqual(['ok-before', 'throws', 'ok-after']);
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it('awaits async tasks before exiting', async () => {
+    const calls: string[] = [];
+    jest.spyOn(server, 'close').mockImplementation((cb?: (err?: Error) => void) => {
+      if (cb) {
+        setImmediate(() => cb());
+      }
+      return server;
+    });
+    registerShutdownTask('async-task', async () => {
+      await new Promise((resolve) => setImmediate(resolve));
+      calls.push('async-done');
+    });
+    setupGracefulShutdown(server);
+    triggerSignal('SIGTERM');
+    await flush();
+    await flush();
+    await flush();
+    expect(calls).toEqual(['async-done']);
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+});
diff --git a/packages/api/src/app/shutdown.ts b/packages/api/src/app/shutdown.ts
new file mode 100644
index 00000000000..8ae79c979c6
--- /dev/null
+++ b/packages/api/src/app/shutdown.ts
@@ -0,0 +1,111 @@
+import { logger } from '@librechat/data-schemas';
+import type { Server } from 'http';
+
+const SHUTDOWN_TIMEOUT_MS = 60_000;
+const SIGNALS: NodeJS.Signals[] = ['SIGTERM', 'SIGINT', 'SIGQUIT', 'SIGHUP'];
+
+type ShutdownTask = {
+  name: string;
+  fn: () => void | Promise<void>;
+};
+
+const tasks: ShutdownTask[] = [];
+let isShuttingDown = false;
+let httpServer: Server | null = null;
+
+/**
+ * Register a cleanup task to run after the HTTP server has closed.
+ * Tasks run in registration order; if one throws, subsequent tasks
+ * and the final exit are not blocked. Use this instead of attaching
+ * `process.on('SIGTERM', ...)` handlers directly — multiple competing
+ * signal handlers race with the HTTP drain because Node dispatches
+ * listeners in registration order and any one of them can call
+ * `process.exit` before the HTTP server has finished closing.
+ */
+export function registerShutdownTask(name: string, fn: () => void | Promise<void>): void {
+  tasks.push({ name, fn });
+}
+
+/**
+ * Wires SIGTERM, SIGINT, SIGQUIT, and SIGHUP to a graceful shutdown
+ * sequence: close the HTTP server (stop accepting new connections, let
+ * in-flight requests finish), run any tasks registered via
+ * `registerShutdownTask`, then `process.exit(0)`. After
+ * SHUTDOWN_TIMEOUT_MS the process is force-exited with code 1 — a
+ * safety net for long-lived connections such as SSE streams that may
+ * not finish in time.
+ */
+export function setupGracefulShutdown(server: Server): void {
+  httpServer = server;
+  for (const signal of SIGNALS) {
+    process.on(signal, () => {
+      void shutdown(signal);
+    });
+  }
+}
+
+/**
+ * @internal Reset module state for tests. Not part of the public API.
+ */
+export function __resetShutdownStateForTests(): void {
+  tasks.length = 0;
+  isShuttingDown = false;
+  httpServer = null;
+}
+
+async function shutdown(signal: NodeJS.Signals): Promise<void> {
+  if (isShuttingDown) {
+    return;
+  }
+  isShuttingDown = true;
+  logger.info(`Received ${signal}, draining HTTP server...`);
+
+  const forceExit = setTimeout(() => {
+    logger.warn(`Graceful shutdown exceeded ${SHUTDOWN_TIMEOUT_MS}ms, forcing exit`);
+    process.exit(1);
+  }, SHUTDOWN_TIMEOUT_MS);
+  forceExit.unref();
+
+  let exitCode = 0;
+
+  try {
+    await closeHttpServer();
+  } catch (err) {
+    logger.error('Error closing HTTP server during graceful shutdown:', err);
+    exitCode = 1;
+  }
+
+  for (const task of tasks) {
+    try {
+      logger.info(`Running shutdown task: ${task.name}`);
+      await task.fn();
+    } catch (err) {
+      logger.error(`Shutdown task "${task.name}" failed:`, err);
+    }
+  }
+
+  clearTimeout(forceExit);
+  logger.info('Graceful shutdown complete, exiting');
+  process.exit(exitCode);
+}
+
+function closeHttpServer(): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (!httpServer || !httpServer.listening) {
+      // SIGTERM can arrive during startup before the listen socket is open,
+      // in which case there is nothing to drain. Node also surfaces this as
+      // an ERR_SERVER_NOT_RUNNING error in the close callback — treated
+      // below as a successful close so a routine shutdown doesn't trip
+      // orchestrator restart/backoff with exit code 1.
+      resolve();
+      return;
+    }
+    httpServer.close((err) => {
+      if (!err || (err as NodeJS.ErrnoException).code === 'ERR_SERVER_NOT_RUNNING') {
+        resolve();
+        return;
+      }
+      reject(err);
+    });
+  });
+}
diff --git a/packages/api/src/artifacts/index.ts b/packages/api/src/artifacts/index.ts
new file mode 100644
index 00000000000..c37c258c7c1
--- /dev/null
+++ b/packages/api/src/artifacts/index.ts
@@ -0,0 +1 @@
+export * from './update';
diff --git a/packages/api/src/artifacts/update.ts b/packages/api/src/artifacts/update.ts
new file mode 100644
index 00000000000..b91e6b0fee1
--- /dev/null
+++ b/packages/api/src/artifacts/update.ts
@@ -0,0 +1,296 @@
+export const ARTIFACT_START = ':::artifact';
+export const ARTIFACT_END = ':::';
+
+type TextPart = {
+  type?: string;
+  text?: string;
+};
+
+type ArtifactMessage = {
+  content?: TextPart[];
+  text?: string;
+};
+
+export type ArtifactBoundary = {
+  start: number;
+  end: number;
+  source: 'content' | 'text';
+  partIndex?: number;
+  text: string;
+};
+
+type ArtifactCloseRange = {
+  start: number;
+  end: number;
+};
+
+type CodeFence = {
+  marker: string;
+  length: number;
+};
+
+type SearchRange = {
+  searchStart: number;
+  searchEnd: number;
+};
+
+const getLineEnd = (text: string, start: number): number => {
+  const index = text.indexOf('\n', start);
+  return index === -1 ? text.length : index;
+};
+
+const getNextLineStart = (text: string, lineEnd: number): number =>
+  lineEnd >= text.length ? text.length : lineEnd + 1;
+
+const getCloseRange = (
+  text: string,
+  lineStart: number,
+  lineEnd: number,
+): ArtifactCloseRange | null => {
+  const line = text.slice(lineStart, lineEnd);
+  const contentStart = line.search(/\S/);
+  if (contentStart === -1) {
+    return null;
+  }
+
+  const markerStart = lineStart + contentStart;
+  const markerText = text.slice(markerStart);
+  if (!markerText.startsWith(ARTIFACT_END) || markerText.startsWith(ARTIFACT_START)) {
+    return null;
+  }
+
+  return {
+    start: markerStart,
+    end: markerStart + ARTIFACT_END.length,
+  };
+};
+
+const getCodeFence = (line: string): CodeFence | null => {
+  const match = line.trimStart().match(/^(`{3,}|~{3,})/);
+  if (!match) {
+    return null;
+  }
+  return {
+    marker: match[1][0],
+    length: match[1].length,
+  };
+};
+
+const isClosingCodeFence = (line: string, openingFence: CodeFence): boolean => {
+  const closePattern = new RegExp(`^\\${openingFence.marker}{${openingFence.length},}\\s*$`);
+  return closePattern.test(line.trim());
+};
+
+const findArtifactClose = (text: string, start: number): ArtifactCloseRange | null => {
+  const openingLineEnd = getLineEnd(text, start);
+  let currentIndex = getNextLineStart(text, openingLineEnd);
+  let codeFence: CodeFence | null = null;
+  let fallbackClose: ArtifactCloseRange | null = null;
+
+  while (currentIndex < text.length) {
+    const lineEnd = getLineEnd(text, currentIndex);
+    const line = text.slice(currentIndex, lineEnd);
+    const closeRange = getCloseRange(text, currentIndex, lineEnd);
+
+    if (closeRange) {
+      if (!codeFence) {
+        return closeRange;
+      }
+      fallbackClose = fallbackClose ?? closeRange;
+    }
+
+    const fence = getCodeFence(line);
+    if (fence && !codeFence) {
+      codeFence = fence;
+    } else if (codeFence && isClosingCodeFence(line, codeFence)) {
+      codeFence = null;
+      fallbackClose = null;
+    }
+
+    currentIndex = getNextLineStart(text, lineEnd);
+  }
+
+  return codeFence ? fallbackClose : null;
+};
+
+const findArtifactEnd = (text: string, start: number): number => {
+  return findArtifactClose(text, start)?.end ?? text.length;
+};
+
+const getOpeningCodeFence = (
+  text: string,
+  contentStart: number,
+  contentEnd: number,
+): (CodeFence & { contentStart: number }) | null => {
+  const content = text.slice(contentStart, contentEnd);
+  const firstContentMatch = content.match(/\S/);
+  if (!firstContentMatch) {
+    return null;
+  }
+
+  const fenceStart = contentStart + (firstContentMatch.index ?? 0);
+  const lineEnd = getLineEnd(text, fenceStart);
+  const line = text.slice(fenceStart, lineEnd);
+  const fence = getCodeFence(line);
+
+  if (!fence || !line.trimStart().startsWith(fence.marker.repeat(fence.length))) {
+    return null;
+  }
+
+  return {
+    ...fence,
+    contentStart: getNextLineStart(text, lineEnd),
+  };
+};
+
+const findClosingCodeFenceStart = (
+  text: string,
+  start: number,
+  end: number,
+  openingFence: CodeFence,
+): number => {
+  let currentIndex = start;
+
+  while (currentIndex < end) {
+    const lineEnd = getLineEnd(text, currentIndex);
+    const line = text.slice(currentIndex, lineEnd);
+
+    if (isClosingCodeFence(line, openingFence)) {
+      return currentIndex;
+    }
+
+    currentIndex = getNextLineStart(text, lineEnd);
+  }
+
+  return -1;
+};
+
+const getSearchRange = (artifactContent: string): SearchRange | null => {
+  const openingLineEnd = getLineEnd(artifactContent, artifactContent.indexOf(ARTIFACT_START));
+  if (openingLineEnd >= artifactContent.length) {
+    return null;
+  }
+
+  const contentStart = getNextLineStart(artifactContent, openingLineEnd);
+  const artifactClose = findArtifactClose(artifactContent, 0);
+  const contentEnd = artifactClose?.start ?? artifactContent.length;
+  const openingFence = getOpeningCodeFence(artifactContent, contentStart, contentEnd);
+
+  if (!openingFence) {
+    return { searchStart: contentStart, searchEnd: contentEnd };
+  }
+
+  const closingFenceStart = findClosingCodeFenceStart(
+    artifactContent,
+    openingFence.contentStart,
+    contentEnd,
+    openingFence,
+  );
+
+  if (closingFenceStart === -1) {
+    return { searchStart: openingFence.contentStart, searchEnd: contentEnd };
+  }
+
+  const closingLineEnd = getLineEnd(artifactContent, closingFenceStart);
+  const trailingContent = artifactContent.slice(closingLineEnd, contentEnd);
+  if (trailingContent.trim().length > 0) {
+    return { searchStart: contentStart, searchEnd: contentEnd };
+  }
+
+  const searchEnd =
+    artifactContent[closingFenceStart - 1] === '\n' ? closingFenceStart - 1 : closingFenceStart;
+  return { searchStart: openingFence.contentStart, searchEnd };
+};
+
+const replaceRange = (
+  originalText: string,
+  start: number,
+  end: number,
+  updated: string,
+): string => {
+  const endText = originalText.substring(end);
+  const separator = endText.startsWith('\n') || updated.endsWith('\n') ? '' : '\n';
+  return originalText.substring(0, start) + updated + separator + endText;
+};
+
+export const findAllArtifacts = (message: ArtifactMessage): ArtifactBoundary[] => {
+  const artifacts: ArtifactBoundary[] = [];
+
+  if (message.content?.length) {
+    message.content.forEach((part, partIndex) => {
+      if (part.type !== 'text' || typeof part.text !== 'string') {
+        return;
+      }
+
+      let currentIndex = 0;
+      let start = part.text.indexOf(ARTIFACT_START, currentIndex);
+
+      while (start !== -1) {
+        const end = findArtifactEnd(part.text, start);
+        artifacts.push({
+          start,
+          end,
+          source: 'content',
+          partIndex,
+          text: part.text,
+        });
+
+        currentIndex = end;
+        start = part.text.indexOf(ARTIFACT_START, currentIndex);
+      }
+    });
+  }
+
+  if (!artifacts.length && message.text) {
+    let currentIndex = 0;
+    let start = message.text.indexOf(ARTIFACT_START, currentIndex);
+
+    while (start !== -1) {
+      const end = findArtifactEnd(message.text, start);
+      artifacts.push({
+        start,
+        end,
+        source: 'text',
+        text: message.text,
+      });
+
+      currentIndex = end;
+      start = message.text.indexOf(ARTIFACT_START, currentIndex);
+    }
+  }
+
+  return artifacts;
+};
+
+export const replaceArtifactContent = (
+  originalText: string,
+  artifact: ArtifactBoundary,
+  original: string,
+  updated: string,
+): string | null => {
+  const artifactContent = artifact.text.substring(artifact.start, artifact.end);
+  const range = getSearchRange(artifactContent);
+  if (!range) {
+    return null;
+  }
+
+  const { searchStart, searchEnd } = range;
+  const innerContent = artifactContent.substring(searchStart, searchEnd);
+  const originalTrimmed = original.replace(/\n$/, '');
+  const relativeIndex =
+    originalTrimmed === '' && innerContent.trim().length > 0
+      ? -1
+      : innerContent.indexOf(originalTrimmed);
+
+  if (relativeIndex === -1) {
+    return null;
+  }
+
+  const absoluteIndex = artifact.start + searchStart + relativeIndex;
+  return replaceRange(
+    originalText,
+    absoluteIndex,
+    absoluteIndex + originalTrimmed.length,
+    updated,
+  ).replace(/\n+(?=```\n:::)/g, '\n');
+};
diff --git a/packages/api/src/auth/adminPkce.spec.ts b/packages/api/src/auth/adminPkce.spec.ts
index 906b7d400ba..57d643a61af 100644
--- a/packages/api/src/auth/adminPkce.spec.ts
+++ b/packages/api/src/auth/adminPkce.spec.ts
@@ -21,6 +21,8 @@ function makeReq(overrides: Partial<PkceStrippableRequest> = {}): PkceStrippable
 
 describe('stripCodeChallenge', () => {
   const challenge = 'a'.repeat(64);
+  const callbackUrl = 'https://admin.example.com/auth/openid/callback';
+  const encodedCallbackUrl = 'https%3A%2F%2Fadmin.example.com%2Fauth%2Fopenid%2Fcallback';
 
   it('removes code_challenge from req.query and both URL strings (sole param)', () => {
     const req = makeReq({
@@ -36,6 +38,48 @@ describe('stripCodeChallenge', () => {
     expect(req.url).toBe('/oauth/openid');
   });
 
+  it('removes admin-panel-only params before the request reaches Passport', () => {
+    const originalUrl =
+      `/api/admin/oauth/openid?code_challenge=${challenge}` +
+      `&redirect_uri=${encodedCallbackUrl}&redirectTo=%2Fsettings&foo=bar`;
+    const url =
+      `/oauth/openid?code_challenge=${challenge}` +
+      `&redirect_uri=${encodedCallbackUrl}&redirectTo=%2Fsettings&foo=bar`;
+    const req = makeReq({
+      query: {
+        code_challenge: challenge,
+        redirect_uri: callbackUrl,
+        redirectTo: '/settings',
+        foo: 'bar',
+      },
+      originalUrl,
+      url,
+    });
+
+    stripCodeChallenge(req);
+
+    expect(req.query.code_challenge).toBeUndefined();
+    expect(req.query.redirect_uri).toBeUndefined();
+    expect(req.query.redirectTo).toBeUndefined();
+    expect(req.query.foo).toBe('bar');
+    expect(req.originalUrl).toBe('/api/admin/oauth/openid?foo=bar');
+    expect(req.url).toBe('/oauth/openid?foo=bar');
+  });
+
+  it('removes redirect_uri when it is the only admin-panel-only param', () => {
+    const req = makeReq({
+      query: { redirect_uri: callbackUrl },
+      originalUrl: `/oauth/openid?redirect_uri=${encodedCallbackUrl}`,
+      url: `/oauth/openid?redirect_uri=${encodedCallbackUrl}`,
+    });
+
+    stripCodeChallenge(req);
+
+    expect(req.query.redirect_uri).toBeUndefined();
+    expect(req.originalUrl).toBe('/oauth/openid');
+    expect(req.url).toBe('/oauth/openid');
+  });
+
   it('preserves other params when code_challenge is last', () => {
     const req = makeReq({
       query: { foo: 'bar', code_challenge: challenge },
@@ -123,14 +167,20 @@ describe('stripCodeChallenge', () => {
 
 describe('storeAndStripChallenge', () => {
   const challenge = 'a'.repeat(64);
+  const callbackUrl = 'https://admin.example.com/auth/openid/callback';
+  const encodedCallbackUrl = 'https%3A%2F%2Fadmin.example.com%2Fauth%2Fopenid%2Fcallback';
 
   it('stores valid challenge in cache and strips from request', async () => {
     const cache = new Keyv();
     const setSpy = jest.spyOn(cache, 'set');
+    const url = `/oauth/openid?code_challenge=${challenge}&redirect_uri=${encodedCallbackUrl}`;
     const req = makeReq({
-      query: { code_challenge: challenge },
-      originalUrl: `/oauth/openid?code_challenge=${challenge}`,
-      url: `/oauth/openid?code_challenge=${challenge}`,
+      query: {
+        code_challenge: challenge,
+        redirect_uri: callbackUrl,
+      },
+      originalUrl: url,
+      url,
     });
 
     const result = await storeAndStripChallenge(cache, req, 'test-state', 'openid');
@@ -138,6 +188,7 @@ describe('storeAndStripChallenge', () => {
     expect(result).toBe(true);
     expect(setSpy).toHaveBeenCalledWith(`pkce:test-state`, challenge, expect.any(Number));
     expect(req.query.code_challenge).toBeUndefined();
+    expect(req.query.redirect_uri).toBeUndefined();
     expect(req.originalUrl).toBe('/oauth/openid');
     expect(req.url).toBe('/oauth/openid');
   });
@@ -162,10 +213,14 @@ describe('storeAndStripChallenge', () => {
   it('strips and returns true when code_challenge is invalid (not 64 hex)', async () => {
     const cache = new Keyv();
     const setSpy = jest.spyOn(cache, 'set');
+    const url = `/oauth/openid?code_challenge=too-short&redirect_uri=${encodedCallbackUrl}`;
     const req = makeReq({
-      query: { code_challenge: 'too-short' },
-      originalUrl: '/oauth/openid?code_challenge=too-short',
-      url: '/oauth/openid?code_challenge=too-short',
+      query: {
+        code_challenge: 'too-short',
+        redirect_uri: callbackUrl,
+      },
+      originalUrl: url,
+      url,
     });
 
     const result = await storeAndStripChallenge(cache, req, 'test-state', 'openid');
@@ -173,6 +228,7 @@ describe('storeAndStripChallenge', () => {
     expect(result).toBe(true);
     expect(setSpy).not.toHaveBeenCalled();
     expect(req.query.code_challenge).toBeUndefined();
+    expect(req.query.redirect_uri).toBeUndefined();
     expect(req.originalUrl).toBe('/oauth/openid');
     expect(req.url).toBe('/oauth/openid');
   });
@@ -180,18 +236,23 @@ describe('storeAndStripChallenge', () => {
   it('returns false and does not strip on cache failure', async () => {
     const cache = new Keyv();
     jest.spyOn(cache, 'set').mockRejectedValueOnce(new Error('cache down'));
+    const url = `/oauth/openid?code_challenge=${challenge}&redirect_uri=${encodedCallbackUrl}`;
     const req = makeReq({
-      query: { code_challenge: challenge },
-      originalUrl: `/oauth/openid?code_challenge=${challenge}`,
-      url: `/oauth/openid?code_challenge=${challenge}`,
+      query: {
+        code_challenge: challenge,
+        redirect_uri: callbackUrl,
+      },
+      originalUrl: url,
+      url,
     });
 
     const result = await storeAndStripChallenge(cache, req, 'test-state', 'openid');
 
     expect(result).toBe(false);
     expect(req.query.code_challenge).toBe(challenge);
-    expect(req.originalUrl).toBe(`/oauth/openid?code_challenge=${challenge}`);
-    expect(req.url).toBe(`/oauth/openid?code_challenge=${challenge}`);
+    expect(req.query.redirect_uri).toBe(callbackUrl);
+    expect(req.originalUrl).toBe(url);
+    expect(req.url).toBe(url);
   });
 
   it('reads code_challenge before stripping (ordering guarantee)', async () => {
diff --git a/packages/api/src/auth/agent.spec.ts b/packages/api/src/auth/agent.spec.ts
index 0764f7aa2f6..f74542c6c82 100644
--- a/packages/api/src/auth/agent.spec.ts
+++ b/packages/api/src/auth/agent.spec.ts
@@ -11,7 +11,11 @@ import http from 'node:http';
 import type { LookupFunction } from 'node:net';
 import { createSSRFSafeAgents, createSSRFSafeUndiciConnect } from './agent';
 
-type LookupCallback = (err: NodeJS.ErrnoException | null, address: string, family: number) => void;
+type LookupCallback = (
+  err: NodeJS.ErrnoException | null,
+  address: string | dns.LookupAddress[],
+  family?: number,
+) => void;
 
 const mockedDnsLookup = dns.lookup as jest.MockedFunction<typeof dns.lookup>;
 const httpAgentPrototype = http.Agent.prototype as unknown as {
@@ -28,6 +32,16 @@ function mockDnsResult(address: string, family: number): void {
   }) as never);
 }
 
+function mockDnsAllResult(addresses: dns.LookupAddress[]): void {
+  mockedDnsLookup.mockImplementation(((
+    _hostname: string,
+    _options: unknown,
+    callback: LookupCallback,
+  ) => {
+    callback(null, addresses);
+  }) as never);
+}
+
 function mockDnsError(err: NodeJS.ErrnoException): void {
   mockedDnsLookup.mockImplementation(((
     _hostname: string,
@@ -123,6 +137,73 @@ describe('createSSRFSafeUndiciConnect', () => {
     expect(result.address).toBe('93.184.216.34');
   });
 
+  it('lookup should block private IPs when DNS returns all addresses', async () => {
+    mockDnsAllResult([{ address: '127.0.0.1', family: 4 }]);
+    const connect = createSSRFSafeUndiciConnect();
+
+    const result = await new Promise<{ err: NodeJS.ErrnoException | null }>((resolve) => {
+      connect.lookup('localhost', { all: true }, (err) => {
+        resolve({ err });
+      });
+    });
+
+    expect(result.err).toBeTruthy();
+    expect(result.err!.code).toBe('ESSRF');
+  });
+
+  it('lookup should allow public IPs when DNS returns all addresses', async () => {
+    const addresses = [{ address: '93.184.216.34', family: 4 }];
+    mockDnsAllResult(addresses);
+    const connect = createSSRFSafeUndiciConnect();
+
+    const result = await new Promise<{
+      err: NodeJS.ErrnoException | null;
+      address: string | dns.LookupAddress[];
+    }>((resolve) => {
+      connect.lookup('example.com', { all: true }, (err, address) => {
+        resolve({ err, address });
+      });
+    });
+
+    expect(result.err).toBeNull();
+    expect(result.address).toEqual(addresses);
+  });
+
+  it('lookup should block mixed public and private all-address results', async () => {
+    mockDnsAllResult([
+      { address: '93.184.216.34', family: 4 },
+      { address: '10.0.0.1', family: 4 },
+    ]);
+    const connect = createSSRFSafeUndiciConnect();
+
+    const result = await new Promise<{ err: NodeJS.ErrnoException | null }>((resolve) => {
+      connect.lookup('rebinding.example.com', { all: true }, (err) => {
+        resolve({ err });
+      });
+    });
+
+    expect(result.err).toBeTruthy();
+    expect(result.err!.code).toBe('ESSRF');
+  });
+
+  it('lookup should honor allowedAddresses when DNS returns all addresses', async () => {
+    const addresses = [{ address: '10.0.0.5', family: 4 }];
+    mockDnsAllResult(addresses);
+    const connect = createSSRFSafeUndiciConnect(['10.0.0.5:11434'], '11434');
+
+    const result = await new Promise<{
+      err: NodeJS.ErrnoException | null;
+      address: string | dns.LookupAddress[];
+    }>((resolve) => {
+      connect.lookup('private.example.com', { all: true }, (err, address) => {
+        resolve({ err, address });
+      });
+    });
+
+    expect(result.err).toBeNull();
+    expect(result.address).toEqual(addresses);
+  });
+
   it('lookup should forward DNS errors', async () => {
     const dnsError = Object.assign(new Error('ENOTFOUND'), {
       code: 'ENOTFOUND',
diff --git a/packages/api/src/auth/agent.ts b/packages/api/src/auth/agent.ts
index 8337a7d071c..7222d8de645 100644
--- a/packages/api/src/auth/agent.ts
+++ b/packages/api/src/auth/agent.ts
@@ -9,6 +9,37 @@ import {
 } from './allowedAddresses';
 import { isPrivateIP } from './ip';
 
+type LookupResult = string | dns.LookupAddress[];
+
+function createSSRFLookupError(hostname: string, address: string): NodeJS.ErrnoException {
+  return Object.assign(
+    new Error(`SSRF protection: ${hostname} resolved to blocked address ${address}`),
+    { code: 'ESSRF' },
+  ) as NodeJS.ErrnoException;
+}
+
+function getBlockedLookupAddress(
+  lookupResult: LookupResult,
+  hostnameAllowed: boolean,
+  exemptSet: Set<string> | null,
+  normalizedPort: string,
+): string | null {
+  if (hostnameAllowed) {
+    return null;
+  }
+
+  const addresses = Array.isArray(lookupResult)
+    ? lookupResult.map(({ address }) => address)
+    : [lookupResult];
+
+  return (
+    addresses.find(
+      (address) =>
+        isPrivateIP(address) && !isAddressInAllowedSet(address, exemptSet, normalizedPort),
+    ) ?? null
+  );
+}
+
 /**
  * Builds a DNS lookup wrapper that blocks resolution to private/reserved IP
  * addresses. When `allowedAddresses` is provided, hostname/IP + port pairs
@@ -34,20 +65,19 @@ function buildSSRFSafeLookup(
         callback(err, '', 0);
         return;
       }
-      if (
-        !hostnameAllowed &&
-        typeof address === 'string' &&
-        isPrivateIP(address) &&
-        !isAddressInAllowedSet(address, exemptSet, normalizedPort)
-      ) {
-        const ssrfError = Object.assign(
-          new Error(`SSRF protection: ${hostname} resolved to blocked address ${address}`),
-          { code: 'ESSRF' },
-        ) as NodeJS.ErrnoException;
-        callback(ssrfError, address, family as number);
+
+      const blockedAddress = getBlockedLookupAddress(
+        address,
+        hostnameAllowed,
+        exemptSet,
+        normalizedPort,
+      );
+      if (blockedAddress) {
+        callback(createSSRFLookupError(hostname, blockedAddress), blockedAddress, family);
         return;
       }
-      callback(null, address as string, family as number);
+
+      callback(null, address, family);
     });
   };
 }
diff --git a/packages/api/src/auth/exchange.ts b/packages/api/src/auth/exchange.ts
index 650b006e385..53db548f68a 100644
--- a/packages/api/src/auth/exchange.ts
+++ b/packages/api/src/auth/exchange.ts
@@ -178,13 +178,40 @@ export async function exchangeAdminCode(
 }
 
 /** PKCE challenge cache TTL: 5 minutes (enough for user to authenticate with IdP) */
-export const PKCE_CHALLENGE_TTL = 5 * 60 * 1000;
+export const PKCE_CHALLENGE_TTL: number = 5 * 60 * 1000;
 /** Regex pattern for valid PKCE challenges: 64 hex characters (SHA-256 hex digest) */
-export const PKCE_CHALLENGE_PATTERN = /^[a-f0-9]{64}$/;
+export const PKCE_CHALLENGE_PATTERN: RegExp = /^[a-f0-9]{64}$/;
 
-/** Removes `code_challenge` from a single URL string, preserving other query params. */
-const stripChallengeFromUrl = (url: string): string =>
-  url.replace(/\?code_challenge=[^&]*&/, '?').replace(/[?&]code_challenge=[^&]*/, '');
+const ADMIN_OAUTH_STRIPPED_QUERY_PARAMS = new Set(['code_challenge', 'redirect_uri', 'redirectTo']);
+
+const getQueryParamName = (param: string): string => {
+  const separatorIndex = param.indexOf('=');
+  return separatorIndex === -1 ? param : param.slice(0, separatorIndex);
+};
+
+/** Removes admin-panel-only query params from a single URL string. */
+const stripAdminOAuthParamsFromUrl = (url: string): string => {
+  const hashIndex = url.indexOf('#');
+  const urlWithoutHash = hashIndex === -1 ? url : url.slice(0, hashIndex);
+  const hash = hashIndex === -1 ? '' : url.slice(hashIndex);
+  const queryIndex = urlWithoutHash.indexOf('?');
+
+  if (queryIndex === -1) {
+    return url;
+  }
+
+  const path = urlWithoutHash.slice(0, queryIndex);
+  const query = urlWithoutHash.slice(queryIndex + 1);
+  const params = query.split('&').filter((param) => {
+    if (!param) {
+      return false;
+    }
+
+    return !ADMIN_OAUTH_STRIPPED_QUERY_PARAMS.has(getQueryParamName(param));
+  });
+
+  return params.length > 0 ? `${path}?${params.join('&')}${hash}` : `${path}${hash}`;
+};
 
 /** Minimal request shape needed by {@link stripCodeChallenge}. */
 export interface PkceStrippableRequest {
@@ -194,29 +221,31 @@ export interface PkceStrippableRequest {
 }
 
 /**
- * Strips `code_challenge` from the request query and URL strings.
+ * Strips admin-panel-only params from the request query and URL strings.
  *
  * openid-client v6's Passport Strategy uses `currentUrl.searchParams.size === 0`
  * to distinguish an initial authorization request from an OAuth callback.
- * The admin-panel-specific `code_challenge` query parameter would cause the
- * strategy to misclassify the request as a callback and return 401.
+ * Admin-panel-specific query params would cause the strategy to misclassify the
+ * request as a callback and return 401.
  *
  * Applied defensively to all providers to ensure the admin-panel-private
- * `code_challenge` parameter never reaches any Passport strategy.
+ * parameters never reach any Passport strategy.
  */
 export function stripCodeChallenge(req: PkceStrippableRequest): void {
   delete req.query.code_challenge;
-  req.originalUrl = stripChallengeFromUrl(req.originalUrl);
-  req.url = stripChallengeFromUrl(req.url);
+  delete req.query.redirect_uri;
+  delete req.query.redirectTo;
+  req.originalUrl = stripAdminOAuthParamsFromUrl(req.originalUrl);
+  req.url = stripAdminOAuthParamsFromUrl(req.url);
 }
 
 /**
- * Stores the admin-panel PKCE challenge in cache, then strips `code_challenge`
- * from the request so it doesn't interfere with the Passport strategy.
+ * Stores the admin-panel PKCE challenge in cache, then strips admin-panel-only
+ * params from the request so they don't interfere with the Passport strategy.
  *
  * Must be called before `passport.authenticate()` — the two operations are
  * logically atomic: read the challenge from the query, persist it, then remove
- * the parameter from the request URL.
+ * those parameters from the request URL.
  * @param cache - The Keyv cache instance for storing PKCE challenges.
  * @param req - The Express request to read and mutate.
  * @param state - The OAuth state value (cache key).
diff --git a/packages/api/src/auth/index.ts b/packages/api/src/auth/index.ts
index d3e08deb148..f51f5c40813 100644
--- a/packages/api/src/auth/index.ts
+++ b/packages/api/src/auth/index.ts
@@ -1,8 +1,10 @@
 export * from './domain';
 export * from './openid';
+export * from './proxy';
 export * from './exchange';
 export * from './refresh';
 export * from './agent';
 export * from './password';
 export * from './invite';
 export * from './codeapi';
+export * from './openidRoleSync';
diff --git a/packages/api/src/auth/openid.spec.ts b/packages/api/src/auth/openid.spec.ts
index deaba8c5c04..543fa94fe38 100644
--- a/packages/api/src/auth/openid.spec.ts
+++ b/packages/api/src/auth/openid.spec.ts
@@ -1,7 +1,11 @@
-import { Types } from 'mongoose';
-import { logger } from '@librechat/data-schemas';
+import mongoose, { Types } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { logger, createMethods, createModels } from '@librechat/data-schemas';
 import { ErrorTypes } from 'librechat-data-provider';
 import type { IUser, UserMethods } from '@librechat/data-schemas';
+import type { CommandStartedEvent } from 'mongodb';
+import type { FilterQuery } from 'mongoose';
+import { recordOpenIDUserLookup } from '~/app/metrics';
 import { findOpenIDUser, getOpenIdEmail, getOpenIdIssuer, normalizeOpenIdIssuer } from './openid';
 
 function newId() {
@@ -16,6 +20,11 @@ jest.mock('@librechat/data-schemas', () => ({
   },
 }));
 
+jest.mock('~/app/metrics', () => ({
+  isMetricsConfigured: jest.fn(() => true),
+  recordOpenIDUserLookup: jest.fn(),
+}));
+
 describe('normalizeOpenIdIssuer', () => {
   it('normalizes blank, trailing-slash, and discovery-document issuers', () => {
     expect(normalizeOpenIdIssuer('')).toBeUndefined();
@@ -100,13 +109,15 @@ describe('findOpenIDUser', () => {
       });
 
       expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [{ openidId: 'openid_123', openidIssuer: issuer }],
+        openidId: 'openid_123',
+        openidIssuer: issuer,
       });
       expect(result).toEqual({
         user: mockUser,
         error: null,
         migration: false,
       });
+      expect(recordOpenIDUserLookup).toHaveBeenCalledWith('found', expect.any(Number));
     });
 
     it('should find user by idOnTheSource', async () => {
@@ -118,7 +129,7 @@ describe('findOpenIDUser', () => {
         username: 'testuser',
       } as IUser;
 
-      mockFindUser.mockResolvedValueOnce(mockUser);
+      mockFindUser.mockResolvedValueOnce(null).mockResolvedValueOnce(mockUser);
 
       const result = await findOpenIDUser({
         openidId: 'openid_123',
@@ -127,11 +138,13 @@ describe('findOpenIDUser', () => {
         idOnTheSource: 'source_123',
       });
 
-      expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [
-          { openidId: 'openid_123', openidIssuer: issuer },
-          { idOnTheSource: 'source_123', openidIssuer: issuer },
-        ],
+      expect(mockFindUser).toHaveBeenNthCalledWith(1, {
+        openidId: 'openid_123',
+        openidIssuer: issuer,
+      });
+      expect(mockFindUser).toHaveBeenNthCalledWith(2, {
+        idOnTheSource: 'source_123',
+        openidIssuer: issuer,
       });
       expect(result).toEqual({
         user: mockUser,
@@ -161,11 +174,10 @@ describe('findOpenIDUser', () => {
         email: 'user@example.com',
       });
 
+      expect(mockFindUser).toHaveBeenCalledTimes(1);
       expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [
-          { openidId: 'openid_123', openidIssuer: issuer },
-          { idOnTheSource: 'source_123', openidIssuer: issuer },
-        ],
+        openidId: 'openid_123',
+        openidIssuer: issuer,
       });
       expect(result).toEqual({
         user: mockUser,
@@ -194,7 +206,8 @@ describe('findOpenIDUser', () => {
       });
 
       expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [{ openidId: 'openid_123', openidIssuer: 'https://issuer.example.com' }],
+        openidId: 'openid_123',
+        openidIssuer: 'https://issuer.example.com',
       });
       expect(result).toEqual({
         user: mockUser,
@@ -213,7 +226,7 @@ describe('findOpenIDUser', () => {
         username: 'testuser',
       } as IUser;
 
-      mockFindUser.mockResolvedValueOnce(mockUser);
+      mockFindUser.mockResolvedValueOnce(null).mockResolvedValueOnce(mockUser);
 
       const result = await findOpenIDUser({
         openidId: 'openid_123',
@@ -221,18 +234,13 @@ describe('findOpenIDUser', () => {
         findUser: mockFindUser,
       });
 
-      expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [
-          { openidId: 'openid_123', openidIssuer: 'https://issuer.example.com' },
-          {
-            openidId: 'openid_123',
-            $or: [
-              { openidIssuer: { $exists: false } },
-              { openidIssuer: null },
-              { openidIssuer: '' },
-            ],
-          },
-        ],
+      expect(mockFindUser).toHaveBeenNthCalledWith(1, {
+        openidId: 'openid_123',
+        openidIssuer: 'https://issuer.example.com',
+      });
+      expect(mockFindUser).toHaveBeenNthCalledWith(2, {
+        openidId: 'openid_123',
+        openidIssuer: { $exists: false },
       });
       expect(result).toEqual({
         user: { ...mockUser, openidIssuer: 'https://issuer.example.com' },
@@ -251,7 +259,7 @@ describe('findOpenIDUser', () => {
         username: 'testuser',
       } as IUser;
 
-      mockFindUser.mockResolvedValueOnce(mockUser);
+      mockFindUser.mockResolvedValueOnce(null).mockResolvedValueOnce(mockUser);
 
       const result = await findOpenIDUser({
         openidId: 'openid_123',
@@ -259,18 +267,13 @@ describe('findOpenIDUser', () => {
         findUser: mockFindUser,
       });
 
-      expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [
-          { openidId: 'openid_123', openidIssuer: 'https://issuer.example.com' },
-          {
-            openidId: 'openid_123',
-            $or: [
-              { openidIssuer: { $exists: false } },
-              { openidIssuer: null },
-              { openidIssuer: '' },
-            ],
-          },
-        ],
+      expect(mockFindUser).toHaveBeenNthCalledWith(1, {
+        openidId: 'openid_123',
+        openidIssuer: 'https://issuer.example.com',
+      });
+      expect(mockFindUser).toHaveBeenNthCalledWith(2, {
+        openidId: 'openid_123',
+        openidIssuer: { $exists: false },
       });
       expect(result).toEqual({
         user: { ...mockUser, openidIssuer: 'https://issuer.example.com' },
@@ -320,9 +323,12 @@ describe('findOpenIDUser', () => {
       });
 
       expect(mockFindUser).toHaveBeenNthCalledWith(1, {
-        $or: [{ openidId: 'openid_123', openidIssuer: issuer }],
+        openidId: 'openid_123',
+        openidIssuer: issuer,
+      });
+      expect(mockFindUser).toHaveBeenNthCalledWith(2, {
+        email: 'user@example.com',
       });
-      expect(mockFindUser).toHaveBeenNthCalledWith(2, { email: 'user@example.com' });
       expect(result).toEqual({
         user: mockUser,
         error: null,
@@ -361,7 +367,8 @@ describe('findOpenIDUser', () => {
 
       expect(mockFindUser).toHaveBeenCalledTimes(1);
       expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [{ openidId: 'openid_123', openidIssuer: issuer }],
+        openidId: 'openid_123',
+        openidIssuer: issuer,
       });
       expect(result).toEqual({
         user: null,
@@ -674,7 +681,8 @@ describe('findOpenIDUser', () => {
       });
 
       expect(mockFindUser).toHaveBeenCalledWith({
-        $or: [{ openidId: 'openid_123', openidIssuer: issuer }],
+        openidId: 'openid_123',
+        openidIssuer: issuer,
       });
       expect(result).toEqual({
         user: null,
@@ -733,6 +741,7 @@ describe('findOpenIDUser', () => {
           findUser: mockFindUser,
         }),
       ).rejects.toThrow('Database error');
+      expect(recordOpenIDUserLookup).toHaveBeenCalledWith('error', expect.any(Number));
     });
 
     it('should reject email fallback when openidId is empty and user has a stored openidId', async () => {
@@ -763,6 +772,153 @@ describe('findOpenIDUser', () => {
   });
 });
 
+type CapturedFindCommand = {
+  find?: unknown;
+  filter?: unknown;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function planContainsStage(value: unknown, stage: string): boolean {
+  if (!isRecord(value)) return false;
+  if (value.stage === stage) return true;
+
+  return Object.values(value).some((entry) => {
+    if (Array.isArray(entry)) return entry.some((item) => planContainsStage(item, stage));
+    return planContainsStage(entry, stage);
+  });
+}
+
+function getTotalDocsExamined(explain: unknown): number | undefined {
+  if (!isRecord(explain)) return undefined;
+  const executionStats = explain.executionStats;
+  if (!isRecord(executionStats)) return undefined;
+  const totalDocsExamined = executionStats.totalDocsExamined;
+  return typeof totalDocsExamined === 'number' ? totalDocsExamined : undefined;
+}
+
+describe('findOpenIDUser Mongo compatibility', () => {
+  let mongoServer: MongoMemoryServer;
+  let User: mongoose.Model<IUser>;
+  let methods: ReturnType<typeof createMethods>;
+
+  const issuer = 'https://issuer.example.com';
+  const originalOpenIdIssuer = process.env.OPENID_ISSUER;
+
+  async function seedUsers(count: number) {
+    await User.insertMany(
+      Array.from({ length: count }, (_, index) => ({
+        email: `filler-${index}@example.com`,
+        provider: 'openid',
+        openidId: `filler-sub-${index}`,
+        openidIssuer: issuer,
+        idOnTheSource: `filler-oid-${index}`,
+      })),
+    );
+  }
+
+  async function captureFindFilters<T>(run: () => Promise<T>): Promise<{
+    result: T;
+    filters: unknown[];
+  }> {
+    const filters: unknown[] = [];
+    const client = mongoose.connection.getClient();
+    const listener = (event: CommandStartedEvent) => {
+      const command = event.command as CapturedFindCommand;
+      if (event.commandName === 'find' && command.find === User.collection.name) {
+        filters.push(command.filter);
+      }
+    };
+
+    client.on('commandStarted', listener);
+    try {
+      const result = await run();
+      return { result, filters };
+    } finally {
+      client.off('commandStarted', listener);
+    }
+  }
+
+  beforeAll(async () => {
+    mongoServer = await MongoMemoryServer.create();
+    await mongoose.connect(mongoServer.getUri(), { monitorCommands: true });
+    createModels(mongoose);
+    User = mongoose.models.User as mongoose.Model<IUser>;
+    methods = createMethods(mongoose);
+  });
+
+  afterAll(async () => {
+    if (originalOpenIdIssuer == null) {
+      delete process.env.OPENID_ISSUER;
+    } else {
+      process.env.OPENID_ISSUER = originalOpenIdIssuer;
+    }
+    await mongoose.disconnect();
+    await mongoServer.stop();
+  });
+
+  beforeEach(async () => {
+    process.env.OPENID_ISSUER = issuer;
+    await mongoose.connection.dropDatabase();
+    await User.syncIndexes();
+  });
+
+  it('keeps exact issuer lookup indexable on a seeded user collection', async () => {
+    await seedUsers(1500);
+    await User.create({
+      email: 'target@example.com',
+      provider: 'openid',
+      openidId: 'target-sub',
+      openidIssuer: issuer,
+      idOnTheSource: 'target-oid',
+    });
+
+    const { result, filters } = await captureFindFilters(() =>
+      findOpenIDUser({
+        openidId: 'target-sub',
+        idOnTheSource: 'target-oid',
+        openidIssuer: issuer,
+        findUser: methods.findUser,
+      }),
+    );
+
+    expect(result.user?.email).toBe('target@example.com');
+    expect(filters).toEqual([{ openidId: 'target-sub', openidIssuer: issuer }]);
+
+    const explain = await User.findOne(filters[0] as FilterQuery<IUser>).explain('executionStats');
+    expect(planContainsStage(explain, 'IXSCAN')).toBe(true);
+    expect(getTotalDocsExamined(explain)).toBeLessThanOrEqual(1);
+  });
+
+  it('resolves legacy issuer-less users without nested or disjunctive filters', async () => {
+    await User.create({
+      email: 'legacy@example.com',
+      provider: 'openid',
+      openidId: 'legacy-sub',
+      idOnTheSource: 'legacy-oid',
+    });
+
+    const { result, filters } = await captureFindFilters(() =>
+      findOpenIDUser({
+        openidId: 'legacy-sub',
+        idOnTheSource: 'legacy-oid',
+        openidIssuer: issuer,
+        findUser: methods.findUser,
+      }),
+    );
+
+    expect(result.user?.email).toBe('legacy@example.com');
+    expect(result.migration).toBe(true);
+    expect(filters).toEqual([
+      { openidId: 'legacy-sub', openidIssuer: issuer },
+      { idOnTheSource: 'legacy-oid', openidIssuer: issuer },
+      { openidId: 'legacy-sub', openidIssuer: { $exists: false } },
+    ]);
+  });
+});
+
 describe('getOpenIdEmail', () => {
   const originalEmailClaim = process.env.OPENID_EMAIL_CLAIM;
 
diff --git a/packages/api/src/auth/openid.ts b/packages/api/src/auth/openid.ts
index 89432e6dd79..4d346a7591f 100644
--- a/packages/api/src/auth/openid.ts
+++ b/packages/api/src/auth/openid.ts
@@ -2,6 +2,8 @@ import { logger } from '@librechat/data-schemas';
 import { ErrorTypes } from 'librechat-data-provider';
 import type { IUser, UserMethods } from '@librechat/data-schemas';
 import type { FilterQuery } from 'mongoose';
+import { isMetricsConfigured, recordOpenIDUserLookup } from '~/app/metrics';
+import type { OpenIDUserLookupResult } from '~/app/metrics';
 
 export type OpenIdEmailClaims = {
   email?: unknown;
@@ -20,6 +22,11 @@ type OpenIdLookupField = 'openidId' | 'idOnTheSource';
 type OpenIdUserResolution = { user: IUser | null; error: string | null; migration: boolean };
 
 const OPENID_DISCOVERY_PATH = '/.well-known/openid-configuration';
+const LEGACY_ISSUER_FILTERS: Array<FilterQuery<IUser>['openidIssuer']> = [
+  { $exists: false },
+  null,
+  '',
+];
 
 export function normalizeOpenIdIssuer(issuer: string | undefined): string | undefined {
   const normalized = issuer?.trim().replace(/\/+$/, '');
@@ -56,24 +63,79 @@ function isLegacyOpenIdIssuer(openidIssuer: string | undefined): boolean {
   return openidIssuer != null && loginIssuer != null && openidIssuer === loginIssuer;
 }
 
+function hasOpenIdLookupValue(value: string | undefined): value is string {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function getElapsedSeconds(startedAt: bigint): number {
+  return Number(process.hrtime.bigint() - startedAt) / 1_000_000_000;
+}
+
+function getOpenIDUserLookupResult(resolution: OpenIdUserResolution): OpenIDUserLookupResult {
+  if (resolution.error) return 'auth_failed';
+  if (resolution.migration) return 'migration';
+  if (resolution.user) return 'found';
+  return 'not_found';
+}
+
+function getIssuerExactCondition(
+  field: OpenIdLookupField,
+  value: string | undefined,
+  openidIssuer: string | undefined,
+): FilterQuery<IUser> | null {
+  if (!hasOpenIdLookupValue(value) || !openidIssuer) return null;
+  return { [field]: value, openidIssuer };
+}
+
+function getLegacyIssuerConditions(
+  field: OpenIdLookupField,
+  value: string | undefined,
+  openidIssuer: string | undefined,
+): FilterQuery<IUser>[] {
+  if (!hasOpenIdLookupValue(value) || !isLegacyOpenIdIssuer(openidIssuer)) return [];
+  return LEGACY_ISSUER_FILTERS.map((issuerFilter) => ({
+    [field]: value,
+    openidIssuer: issuerFilter,
+  }));
+}
+
 export function getIssuerBoundConditions(
   field: OpenIdLookupField,
   value: string | undefined,
   openidIssuer: string | undefined,
 ): FilterQuery<IUser>[] {
-  if (!value || typeof value !== 'string') return [];
-  if (!openidIssuer) return [];
+  const exactCondition = getIssuerExactCondition(field, value, openidIssuer);
+  if (!exactCondition) return [];
+  return [exactCondition, ...getLegacyIssuerConditions(field, value, openidIssuer)];
+}
 
-  const conditions: FilterQuery<IUser>[] = [{ [field]: value, openidIssuer }];
+function getPrimaryLookupConditions(
+  openidId: string | undefined,
+  idOnTheSource: string | undefined,
+  openidIssuer: string | undefined,
+): FilterQuery<IUser>[] {
+  const exactConditions = [
+    getIssuerExactCondition('openidId', openidId, openidIssuer),
+    getIssuerExactCondition('idOnTheSource', idOnTheSource, openidIssuer),
+  ].filter((condition): condition is FilterQuery<IUser> => condition != null);
+
+  return [
+    ...exactConditions,
+    ...getLegacyIssuerConditions('openidId', openidId, openidIssuer),
+    ...getLegacyIssuerConditions('idOnTheSource', idOnTheSource, openidIssuer),
+  ];
+}
 
-  if (isLegacyOpenIdIssuer(openidIssuer)) {
-    conditions.push({
-      [field]: value,
-      $or: [{ openidIssuer: { $exists: false } }, { openidIssuer: null }, { openidIssuer: '' }],
-    });
+async function findFirstOpenIdUser(
+  findUser: UserMethods['findUser'],
+  conditions: FilterQuery<IUser>[],
+): Promise<IUser | null> {
+  for (const condition of conditions) {
+    const user = await findUser(condition);
+    if (user) return user;
   }
 
-  return conditions;
+  return null;
 }
 
 export function isUserIssuerAllowed(user: IUser, openidIssuer: string | undefined): boolean {
@@ -159,64 +221,79 @@ export async function findOpenIDUser({
   idOnTheSource?: string;
   strategyName?: string;
 }): Promise<OpenIdUserResolution> {
-  const normalizedIssuer = normalizeOpenIdIssuer(openidIssuer);
-  const primaryConditions = [
-    ...getIssuerBoundConditions('openidId', openidId, normalizedIssuer),
-    ...getIssuerBoundConditions('idOnTheSource', idOnTheSource, normalizedIssuer),
-  ];
-
-  let user = null;
-  if (primaryConditions.length > 0) {
-    user = await findUser({ $or: primaryConditions });
-  }
-
-  const primaryIssuerResolution = resolveIssuerBoundUser(
-    user,
-    normalizedIssuer,
-    strategyName,
-    'OpenID lookup',
-  );
-  if (primaryIssuerResolution) return primaryIssuerResolution;
-
-  if (!user && email) {
-    user = await findUser({ email });
-    logger.warn(
-      `[${strategyName}] user ${user ? 'found' : 'not found'} with email: ${email} for openidId: ${openidId}`,
-    );
-
-    // If user found by email, check if they're allowed to use OpenID provider
-    if (user && user.provider && user.provider !== 'openid') {
-      logger.warn(
-        `[${strategyName}] Attempted OpenID login by user ${user.email}, was registered with "${user.provider}" provider`,
+  const lookupStartedAt = isMetricsConfigured() ? process.hrtime.bigint() : null;
+  const finish = (resolution: OpenIdUserResolution): OpenIdUserResolution => {
+    if (lookupStartedAt != null) {
+      recordOpenIDUserLookup(
+        getOpenIDUserLookupResult(resolution),
+        getElapsedSeconds(lookupStartedAt),
       );
-      return { user: null, error: ErrorTypes.AUTH_FAILED, migration: false };
     }
+    return resolution;
+  };
 
-    if (user?.openidId && user.openidId !== openidId) {
-      logger.warn(
-        `[${strategyName}] Rejected email fallback for ${user.email}: stored openidId does not match token sub`,
-      );
-      return { user: null, error: ErrorTypes.AUTH_FAILED, migration: false };
+  try {
+    const normalizedIssuer = normalizeOpenIdIssuer(openidIssuer);
+    const primaryConditions = getPrimaryLookupConditions(openidId, idOnTheSource, normalizedIssuer);
+
+    let user: IUser | null = null;
+    if (primaryConditions.length > 0) {
+      user = await findFirstOpenIdUser(findUser, primaryConditions);
     }
 
-    const emailIssuerResolution = resolveIssuerBoundUser(
+    const primaryIssuerResolution = resolveIssuerBoundUser(
       user,
       normalizedIssuer,
       strategyName,
-      'email fallback',
+      'OpenID lookup',
     );
-    if (emailIssuerResolution) return emailIssuerResolution;
+    if (primaryIssuerResolution) return finish(primaryIssuerResolution);
+
+    if (!user && email) {
+      user = await findUser({ email });
+      logger.warn(
+        `[${strategyName}] user ${user ? 'found' : 'not found'} with email: ${email} for openidId: ${openidId}`,
+      );
 
-    if (user && !user.openidId) {
-      logger.info(
-        `[${strategyName}] Preparing user ${user.email} for migration to OpenID with sub: ${openidId}`,
+      // If user found by email, check if they're allowed to use OpenID provider
+      if (user && user.provider && user.provider !== 'openid') {
+        logger.warn(
+          `[${strategyName}] Attempted OpenID login by user ${user.email}, was registered with "${user.provider}" provider`,
+        );
+        return finish({ user: null, error: ErrorTypes.AUTH_FAILED, migration: false });
+      }
+
+      if (user?.openidId && user.openidId !== openidId) {
+        logger.warn(
+          `[${strategyName}] Rejected email fallback for ${user.email}: stored openidId does not match token sub`,
+        );
+        return finish({ user: null, error: ErrorTypes.AUTH_FAILED, migration: false });
+      }
+
+      const emailIssuerResolution = resolveIssuerBoundUser(
+        user,
+        normalizedIssuer,
+        strategyName,
+        'email fallback',
       );
-      user.provider = 'openid';
-      user.openidId = openidId;
-      if (normalizedIssuer) user.openidIssuer = normalizedIssuer;
-      return { user, error: null, migration: true };
+      if (emailIssuerResolution) return finish(emailIssuerResolution);
+
+      if (user && !user.openidId) {
+        logger.info(
+          `[${strategyName}] Preparing user ${user.email} for migration to OpenID with sub: ${openidId}`,
+        );
+        user.provider = 'openid';
+        user.openidId = openidId;
+        if (normalizedIssuer) user.openidIssuer = normalizedIssuer;
+        return finish({ user, error: null, migration: true });
+      }
     }
-  }
 
-  return { user, error: null, migration: false };
+    return finish({ user, error: null, migration: false });
+  } catch (error) {
+    if (lookupStartedAt != null) {
+      recordOpenIDUserLookup('error', getElapsedSeconds(lookupStartedAt));
+    }
+    throw error;
+  }
 }
diff --git a/packages/api/src/auth/openidRoleSync.spec.ts b/packages/api/src/auth/openidRoleSync.spec.ts
new file mode 100644
index 00000000000..4451d31f762
--- /dev/null
+++ b/packages/api/src/auth/openidRoleSync.spec.ts
@@ -0,0 +1,398 @@
+import { SystemRoles } from 'librechat-data-provider';
+import {
+  getOpenIdRoleSyncOptions,
+  getOpenIdRolesForOpenIdSync,
+  getLibreChatRolesForOpenIdSync,
+  selectOpenIdRole,
+} from './openidRoleSync';
+
+describe('getOpenIdRoleSyncOptions', () => {
+  it('defaults role sync and API role sync to disabled', () => {
+    expect(getOpenIdRoleSyncOptions({})).toEqual({
+      enabled: false,
+      apiEnabled: false,
+      claimSource: 'id',
+      claim: undefined,
+      rolePriority: [],
+      fallbackRole: undefined,
+    });
+  });
+
+  it('parses enabled config and comma-separated priority roles', () => {
+    expect(
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_ENABLED: 'true',
+        OPENID_ROLE_SYNC_API_ENABLED: 'true',
+        OPENID_ROLE_SYNC_SOURCE: 'access',
+        OPENID_ROLE_SYNC_CLAIM: 'roles',
+        OPENID_ROLE_SYNC_ROLE_PRIORITY: 'STANDARD-USER, BASIC-USER',
+        OPENID_ROLE_SYNC_FALLBACK_ROLE: SystemRoles.USER,
+      }),
+    ).toEqual({
+      enabled: true,
+      apiEnabled: true,
+      claimSource: 'access',
+      claim: 'roles',
+      rolePriority: ['STANDARD-USER', 'BASIC-USER'],
+      fallbackRole: SystemRoles.USER,
+    });
+  });
+
+  it('requires claim when role sync is enabled', () => {
+    expect(() => getOpenIdRoleSyncOptions({ OPENID_ROLE_SYNC_ENABLED: 'true' })).toThrow(
+      'OPENID_ROLE_SYNC_CLAIM is required',
+    );
+  });
+
+  it('rejects invalid claim sources when enabled', () => {
+    expect(() =>
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_ENABLED: 'true',
+        OPENID_ROLE_SYNC_CLAIM: 'roles',
+        OPENID_ROLE_SYNC_SOURCE: 'profile',
+      }),
+    ).toThrow('OPENID_ROLE_SYNC_SOURCE must be one of');
+  });
+
+  it('ignores role-sync-specific settings when the feature is disabled', () => {
+    expect(
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_SOURCE: 'profile',
+        OPENID_ROLE_SYNC_ROLE_PRIORITY: SystemRoles.ADMIN,
+        OPENID_ROLE_SYNC_FALLBACK_ROLE: SystemRoles.ADMIN,
+      }),
+    ).toMatchObject({ enabled: false, apiEnabled: false });
+  });
+
+  it('rejects API role sync when global role sync is disabled', () => {
+    expect(() =>
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_API_ENABLED: 'true',
+      }),
+    ).toThrow('OPENID_ROLE_SYNC_API_ENABLED requires OPENID_ROLE_SYNC_ENABLED=true');
+  });
+
+  it('rejects ADMIN in role priority and fallback role when enabled', () => {
+    expect(() =>
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_ENABLED: 'true',
+        OPENID_ROLE_SYNC_CLAIM: 'roles',
+        OPENID_ROLE_SYNC_ROLE_PRIORITY: `STANDARD-USER,${SystemRoles.ADMIN}`,
+      }),
+    ).toThrow('OPENID_ROLE_SYNC_ROLE_PRIORITY cannot include ADMIN');
+
+    expect(() =>
+      getOpenIdRoleSyncOptions({
+        OPENID_ROLE_SYNC_ENABLED: 'true',
+        OPENID_ROLE_SYNC_CLAIM: 'roles',
+        OPENID_ROLE_SYNC_FALLBACK_ROLE: SystemRoles.ADMIN,
+      }),
+    ).toThrow('OPENID_ROLE_SYNC_FALLBACK_ROLE cannot be ADMIN');
+  });
+});
+
+describe('getOpenIdRolesForOpenIdSync', () => {
+  const options = {
+    enabled: true,
+    apiEnabled: false,
+    claimSource: 'id' as const,
+    claim: 'roles',
+    rolePriority: ['STANDARD-USER'],
+  };
+
+  it('extracts a configured claim from the selected source', async () => {
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options,
+        idToken: 'id-token',
+        decodeToken: () => ({ roles: ['STANDARD-USER'] }),
+      }),
+    ).resolves.toEqual(['STANDARD-USER']);
+  });
+
+  it('returns an empty list when the source lacks a usable claim value (applies fallback)', async () => {
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options,
+        idToken: 'id-token',
+        decodeToken: () => ({ roles: { STANDARD_USER: true } }),
+      }),
+    ).resolves.toEqual([]);
+  });
+
+  it('returns undefined when no token source is available (skips sync)', async () => {
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options,
+        decodeToken: () => ({ roles: ['STANDARD-USER'] }),
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it('uses overage resolution for id token groups', async () => {
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options: { ...options, claim: 'groups' },
+        idToken: 'id-token',
+        decodeToken: () => ({ hasgroups: true }),
+        resolveGroupOverage: async () => ['group-a'],
+      }),
+    ).resolves.toEqual(['group-a']);
+  });
+
+  it('decodes only the configured access token source', async () => {
+    const decodeToken = jest.fn((token: string) => ({ token }));
+
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options: { ...options, claimSource: 'access' },
+        accessToken: 'access-token',
+        idToken: 'id-token',
+        decodeToken,
+      }),
+    ).resolves.toEqual([]);
+    expect(decodeToken).toHaveBeenCalledTimes(1);
+  });
+
+  it('resolves group overage from an access token source (not just id)', async () => {
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options: { ...options, claimSource: 'access', claim: 'groups' },
+        accessClaims: {
+          _claim_names: { groups: 'src1' },
+          _claim_sources: { src1: { endpoint: 'https://graph' } },
+        },
+        decodeToken: () => ({}),
+        resolveGroupOverage: async () => ['group-a'],
+      }),
+    ).resolves.toEqual(['group-a']);
+  });
+
+  it('uses claims for the id source when no id token is available', async () => {
+    const decodeToken = jest.fn();
+    const claims = { roles: ['STANDARD-USER'] };
+
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options,
+        claims,
+        decodeToken,
+      }),
+    ).resolves.toEqual(['STANDARD-USER']);
+    expect(decodeToken).not.toHaveBeenCalled();
+  });
+
+  it('uses userinfo directly for the userinfo source', async () => {
+    const userinfo = { roles: ['STANDARD-USER'] };
+
+    await expect(
+      getOpenIdRolesForOpenIdSync({
+        options: { ...options, claimSource: 'userinfo' },
+        userinfo,
+        decodeToken: jest.fn(),
+      }),
+    ).resolves.toEqual(['STANDARD-USER']);
+  });
+});
+
+describe('getLibreChatRolesForOpenIdSync', () => {
+  it('deduplicates configured roles and returns canonical role names', async () => {
+    const getRolesByNames = jest.fn(async (roleNames: string[]) =>
+      roleNames.map((roleName) => ({
+        name: roleName.toLowerCase() === 'standard-user' ? 'STANDARD-USER' : roleName,
+      })),
+    );
+
+    await expect(
+      getLibreChatRolesForOpenIdSync({
+        getRolesByNames,
+        rolePriority: [' standard-user ', 'STANDARD-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).resolves.toEqual({
+      rolePriority: ['STANDARD-USER', 'STANDARD-USER'],
+      fallbackRole: SystemRoles.USER,
+    });
+    expect(getRolesByNames).toHaveBeenCalledTimes(1);
+    expect(getRolesByNames).toHaveBeenCalledWith(['standard-user', SystemRoles.USER], 'name');
+  });
+
+  it('rejects configured roles that do not exist', async () => {
+    const getRolesByNames = jest.fn(async (roleNames: string[]) =>
+      roleNames
+        .filter((roleName) => roleName !== 'MISSING')
+        .map((roleName) => ({ name: roleName })),
+    );
+
+    await expect(
+      getLibreChatRolesForOpenIdSync({
+        getRolesByNames,
+        rolePriority: ['STANDARD-USER', 'MISSING'],
+        logPrefix: '[openidStrategy]',
+      }),
+    ).rejects.toThrow('[openidStrategy] OpenID role sync configured roles do not exist: MISSING');
+  });
+
+  it('accepts a system fallback role even when a tenant-scoped lookup omits it', async () => {
+    // Tenant-scoped getRolesByNames returns only the tenant's own roles, not the
+    // globally-provisioned system USER role.
+    const getRolesByNames = jest.fn(async (roleNames: string[]) =>
+      roleNames
+        .filter((roleName) => roleName === 'STANDARD-USER')
+        .map((roleName) => ({ name: roleName })),
+    );
+
+    await expect(
+      getLibreChatRolesForOpenIdSync({
+        getRolesByNames,
+        rolePriority: ['STANDARD-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).resolves.toEqual({
+      rolePriority: ['STANDARD-USER'],
+      fallbackRole: SystemRoles.USER,
+    });
+  });
+});
+
+describe('selectOpenIdRole', () => {
+  it('selects the highest-priority configured role from matching OpenID values', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: SystemRoles.USER,
+        openIdRoleValues: 'BASIC-USER STANDARD-USER',
+        rolePriority: ['STANDARD-USER', 'BASIC-USER'],
+      }),
+    ).toEqual({
+      selectedRole: 'STANDARD-USER',
+      reason: 'matched_priority',
+    });
+  });
+
+  it('matches roles case-insensitively and returns the configured canonical role name', () => {
+    expect(
+      selectOpenIdRole({
+        openIdRoleValues: ['standard-user'],
+        rolePriority: ['STANDARD-USER'],
+      }).selectedRole,
+    ).toBe('STANDARD-USER');
+  });
+
+  it('uses rolePriority as the ordered assignable role list', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: 'BASIC-USER',
+        openIdRoleValues: ['BASIC-USER', 'STANDARD-USER'],
+        rolePriority: ['BASIC-USER', 'STANDARD-USER'],
+      }),
+    ).toEqual({
+      selectedRole: 'BASIC-USER',
+      reason: 'matched_priority',
+    });
+  });
+
+  it('ignores token values that are not in rolePriority or fallbackRole', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: SystemRoles.USER,
+        openIdRoleValues: ['BASIC-USER', 'STANDARD-USER'],
+        rolePriority: [],
+      }),
+    ).toEqual({
+      reason: 'no_matching_role',
+    });
+  });
+
+  it('applies fallback only when no configured role matches', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: 'BASIC-USER',
+        openIdRoleValues: ['UNKNOWN'],
+        rolePriority: ['BASIC-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).toEqual({
+      selectedRole: SystemRoles.USER,
+      reason: 'fallback',
+    });
+  });
+
+  it('does not apply fallback when a priority role already matches', () => {
+    expect(
+      selectOpenIdRole({
+        openIdRoleValues: ['BASIC-USER'],
+        rolePriority: ['BASIC-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).toEqual({
+      selectedRole: 'BASIC-USER',
+      reason: 'matched_priority',
+    });
+  });
+
+  it('keeps the current fallback role when it is present in the OpenID values', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: SystemRoles.USER,
+        openIdRoleValues: [SystemRoles.USER],
+        rolePriority: ['BASIC-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).toEqual({
+      selectedRole: SystemRoles.USER,
+      reason: 'kept_current',
+    });
+  });
+
+  it('does not keep a current role that is outside rolePriority and fallbackRole', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: 'LOCAL-ROLE',
+        openIdRoleValues: ['LOCAL-ROLE'],
+        rolePriority: ['STANDARD-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).toEqual({
+      selectedRole: SystemRoles.USER,
+      reason: 'fallback',
+    });
+  });
+
+  it('selects fallback when the fallback role is present and no priority role matches', () => {
+    expect(
+      selectOpenIdRole({
+        currentRole: 'BASIC-USER',
+        openIdRoleValues: [SystemRoles.USER],
+        rolePriority: ['STANDARD-USER'],
+        fallbackRole: SystemRoles.USER,
+      }),
+    ).toEqual({
+      selectedRole: SystemRoles.USER,
+      reason: 'fallback',
+    });
+  });
+
+  it('excludes ADMIN from generic matching and fallback assignment', () => {
+    expect(
+      selectOpenIdRole({
+        openIdRoleValues: [SystemRoles.ADMIN],
+        rolePriority: [SystemRoles.ADMIN],
+        fallbackRole: SystemRoles.ADMIN,
+      }),
+    ).toEqual({
+      reason: 'no_matching_role',
+    });
+  });
+
+  it('ignores unknown normalized values without affecting priority selection', () => {
+    expect(
+      selectOpenIdRole({
+        openIdRoleValues: ['UNKNOWN', 'unknown', 'BASIC-USER', 'ignored'],
+        rolePriority: ['BASIC-USER'],
+      }),
+    ).toEqual({
+      selectedRole: 'BASIC-USER',
+      reason: 'matched_priority',
+    });
+  });
+});
diff --git a/packages/api/src/auth/openidRoleSync.ts b/packages/api/src/auth/openidRoleSync.ts
new file mode 100644
index 00000000000..3f028213eef
--- /dev/null
+++ b/packages/api/src/auth/openidRoleSync.ts
@@ -0,0 +1,314 @@
+import { get } from 'lodash';
+import { SystemRoles } from 'librechat-data-provider';
+import { isEnabled } from '~/utils';
+
+export type OpenIdRoleSyncClaimSource = 'access' | 'id' | 'userinfo';
+
+export type OpenIdRoleSyncOptions = {
+  enabled: boolean;
+  apiEnabled: boolean;
+  claimSource: OpenIdRoleSyncClaimSource;
+  claim?: string;
+  rolePriority: string[];
+  fallbackRole?: string;
+};
+
+type OpenIdRoleSyncSelectionInput = {
+  currentRole?: string;
+  openIdRoleValues?: string | unknown[];
+  rolePriority: string[];
+  fallbackRole?: string;
+};
+
+export type OpenIdRoleSyncSelectionResult = {
+  selectedRole?: string;
+  reason?: 'matched_priority' | 'kept_current' | 'fallback' | 'no_matching_role';
+};
+
+type OpenIdRolesForOpenIdSyncInput = {
+  options: OpenIdRoleSyncOptions;
+  accessToken?: string;
+  accessClaims?: unknown;
+  idToken?: string;
+  claims?: unknown;
+  userinfo?: unknown;
+  decodeToken: (token: string) => unknown;
+  resolveGroupOverage?: () => Promise<string[] | null>;
+};
+
+type OpenIdRoleSyncRolesLookup = (
+  roleNames: string[],
+  fieldsToSelect?: string | string[] | null,
+) => Promise<Array<{ name?: string | null }> | null | undefined>;
+
+type LibreChatRolesForOpenIdSyncInput = {
+  rolePriority: string[];
+  fallbackRole?: string;
+  getRolesByNames: OpenIdRoleSyncRolesLookup;
+  logPrefix?: string;
+};
+
+type LibreChatRolesForOpenIdSync = {
+  rolePriority: string[];
+  fallbackRole?: string;
+};
+
+/**
+ * Reads and validates the OPENID_ROLE_SYNC_* environment configuration.
+ */
+export function getOpenIdRoleSyncOptions(
+  env: NodeJS.ProcessEnv = process.env,
+): OpenIdRoleSyncOptions {
+  const enabled = isEnabled(env.OPENID_ROLE_SYNC_ENABLED);
+  const apiEnabled = isEnabled(env.OPENID_ROLE_SYNC_API_ENABLED);
+  const rawSource = env.OPENID_ROLE_SYNC_SOURCE?.trim() || 'id';
+  const claimSource = rawSource as OpenIdRoleSyncClaimSource;
+  const claim = env.OPENID_ROLE_SYNC_CLAIM?.trim() || undefined;
+  const rolePriority =
+    env.OPENID_ROLE_SYNC_ROLE_PRIORITY?.split(',')
+      .map((role) => role.trim())
+      .filter(Boolean) ?? [];
+  const fallbackRole = env.OPENID_ROLE_SYNC_FALLBACK_ROLE?.trim() || undefined;
+
+  if (apiEnabled && !enabled) {
+    throw new Error(
+      '[openidRoleSync] OPENID_ROLE_SYNC_API_ENABLED requires OPENID_ROLE_SYNC_ENABLED=true',
+    );
+  }
+
+  /**
+   * Only validate role-sync-specific settings once the feature is enabled. A
+   * disabled deployment must not fail OpenID login just because a stale or
+   * mistyped OPENID_ROLE_SYNC_* value is left in the environment.
+   */
+  if (!enabled) {
+    return { enabled, apiEnabled, claimSource, claim, rolePriority, fallbackRole };
+  }
+
+  if (!['access', 'id', 'userinfo'].includes(claimSource)) {
+    throw new Error(
+      `[openidRoleSync] OPENID_ROLE_SYNC_SOURCE must be one of: access, id, userinfo`,
+    );
+  }
+
+  if (!claim) {
+    throw new Error(
+      '[openidRoleSync] OPENID_ROLE_SYNC_CLAIM is required when role sync is enabled',
+    );
+  }
+
+  if (rolePriority.some((role) => role.toLowerCase() === SystemRoles.ADMIN.toLowerCase())) {
+    throw new Error('[openidRoleSync] OPENID_ROLE_SYNC_ROLE_PRIORITY cannot include ADMIN');
+  }
+
+  if (fallbackRole?.toLowerCase() === SystemRoles.ADMIN.toLowerCase()) {
+    throw new Error('[openidRoleSync] OPENID_ROLE_SYNC_FALLBACK_ROLE cannot be ADMIN');
+  }
+
+  return { enabled, apiEnabled, claimSource, claim, rolePriority, fallbackRole };
+}
+
+/**
+ * Extracts the configured role claim from the configured OpenID source.
+ * Callers provide token decoding and optional group-overage resolution.
+ */
+export async function getOpenIdRolesForOpenIdSync({
+  options,
+  accessToken,
+  accessClaims,
+  idToken,
+  claims,
+  userinfo,
+  decodeToken,
+  resolveGroupOverage,
+}: OpenIdRolesForOpenIdSyncInput): Promise<string | unknown[] | undefined> {
+  let source: unknown;
+
+  switch (options.claimSource) {
+    case 'access':
+      source = accessClaims ?? (accessToken ? decodeToken(accessToken) : undefined);
+      break;
+    case 'id':
+      source = idToken ? decodeToken(idToken) : claims;
+      break;
+    case 'userinfo':
+      source = userinfo;
+      break;
+  }
+
+  if (!source || !options.claim) {
+    return;
+  }
+
+  /**
+   * Azure AD/Entra moves an oversized `groups` claim into `_claim_names`/`_claim_sources`
+   * for both ID and access tokens, so overage resolution must cover both sources — not
+   * just the ID token — or `access`-sourced syncs silently see no groups for those users.
+   */
+  const supportsGroupOverage =
+    options.claim === 'groups' &&
+    (options.claimSource === 'id' || options.claimSource === 'access');
+  if (supportsGroupOverage) {
+    const claimsData = source as {
+      hasgroups?: unknown;
+      _claim_names?: { groups?: string };
+      _claim_sources?: Record<string, unknown>;
+    };
+    const groupSource = claimsData._claim_names?.groups;
+    const hasGroupOverage = Boolean(
+      claimsData.hasgroups || (groupSource && claimsData._claim_sources?.[groupSource]),
+    );
+
+    if (hasGroupOverage) {
+      return (await resolveGroupOverage?.()) ?? undefined;
+    }
+  }
+
+  const openIdRoleValues = get(source, options.claim);
+  if (Array.isArray(openIdRoleValues) || typeof openIdRoleValues === 'string') {
+    return openIdRoleValues;
+  }
+  /**
+   * The source is available but carries no usable value for the configured claim
+   * (absent, null, or a non-string/array type). Return an empty list rather than
+   * `undefined` so callers still run selection and apply the configured fallback,
+   * instead of leaving a stale elevated role in place.
+   */
+  return [];
+}
+
+/**
+ * Gets the configured LibreChat roles that OpenID role sync is allowed to assign.
+ * The names are read from config, checked against storage, and returned as canonical role names.
+ */
+export async function getLibreChatRolesForOpenIdSync(
+  input: LibreChatRolesForOpenIdSyncInput,
+): Promise<LibreChatRolesForOpenIdSync> {
+  const roleNames = input.fallbackRole
+    ? [...input.rolePriority, input.fallbackRole]
+    : input.rolePriority;
+  const uniqueRoleNames: string[] = [];
+  const seenRoleKeys = new Set<string>();
+
+  for (const roleName of roleNames) {
+    const trimmed = roleName.trim();
+    const key = trimmed.toLowerCase();
+
+    if (!trimmed || seenRoleKeys.has(key)) {
+      continue;
+    }
+
+    seenRoleKeys.add(key);
+    uniqueRoleNames.push(trimmed);
+  }
+
+  const roles = (await input.getRolesByNames(uniqueRoleNames, 'name')) ?? [];
+  const existingRoleNames = new Map(
+    roles
+      .filter((role): role is { name: string } => typeof role?.name === 'string')
+      .map((role) => [role.name.trim().toLowerCase(), role.name.trim()]),
+  );
+  /**
+   * System roles (e.g. USER) are provisioned globally at startup without a tenant
+   * context, so a tenant-scoped lookup may not return them even though they exist.
+   * Treat them as always-available canonical names so a documented system fallback
+   * role does not fail validation for tenant users.
+   */
+  for (const systemRole of Object.values(SystemRoles)) {
+    const key = systemRole.toLowerCase();
+    if (!existingRoleNames.has(key)) {
+      existingRoleNames.set(key, systemRole);
+    }
+  }
+  const missingRoleNames = uniqueRoleNames.filter(
+    (roleName) => !existingRoleNames.has(roleName.toLowerCase()),
+  );
+
+  if (missingRoleNames.length > 0) {
+    throw new Error(
+      `${input.logPrefix ?? '[openidRoleSync]'} OpenID role sync configured roles do not exist: ${missingRoleNames.join(', ')}`,
+    );
+  }
+
+  return {
+    rolePriority: input.rolePriority.map(
+      (roleName) => existingRoleNames.get(roleName.trim().toLowerCase()) ?? roleName.trim(),
+    ),
+    fallbackRole: input.fallbackRole
+      ? (existingRoleNames.get(input.fallbackRole.trim().toLowerCase()) ??
+        input.fallbackRole.trim())
+      : undefined,
+  };
+}
+
+/**
+ * Chooses the LibreChat role to assign from normalized OpenID token values and validated config.
+ * Priority roles win first, then the current fallback role can be preserved, then fallback applies.
+ */
+export function selectOpenIdRole(
+  input: OpenIdRoleSyncSelectionInput,
+): OpenIdRoleSyncSelectionResult {
+  const assignableRoles = input.fallbackRole
+    ? [...input.rolePriority, input.fallbackRole]
+    : input.rolePriority;
+  const openIdRoleValues = Array.isArray(input.openIdRoleValues)
+    ? input.openIdRoleValues
+    : (input.openIdRoleValues?.split(/[\s,]+/) ?? []);
+  const assignableRoleKeys = new Set(
+    assignableRoles
+      .map((role) => role.trim().toLowerCase())
+      .filter((role) => role && role !== SystemRoles.ADMIN.toLowerCase()),
+  );
+  const openIdRoleKeys = new Set<string>();
+
+  // Keep only OpenID roles that can map to configured LibreChat roles.
+  for (const value of openIdRoleValues) {
+    if (typeof value !== 'string') {
+      continue;
+    }
+
+    const trimmed = value.trim();
+    const key = trimmed.toLowerCase();
+
+    if (
+      !trimmed ||
+      key === SystemRoles.ADMIN.toLowerCase() ||
+      (assignableRoleKeys.size > 0 && !assignableRoleKeys.has(key))
+    ) {
+      continue;
+    }
+
+    openIdRoleKeys.add(key);
+  }
+
+  for (const role of input.rolePriority) {
+    const trimmed = role.trim();
+
+    if (
+      trimmed &&
+      trimmed.toLowerCase() !== SystemRoles.ADMIN.toLowerCase() &&
+      openIdRoleKeys.has(trimmed.toLowerCase())
+    ) {
+      return { selectedRole: trimmed, reason: 'matched_priority' };
+    }
+  }
+
+  if (
+    input.currentRole &&
+    input.fallbackRole &&
+    input.currentRole.trim().toLowerCase() === input.fallbackRole.trim().toLowerCase() &&
+    openIdRoleKeys.has(input.currentRole.trim().toLowerCase())
+  ) {
+    return { selectedRole: input.currentRole, reason: 'kept_current' };
+  }
+
+  if (input.fallbackRole) {
+    const trimmed = input.fallbackRole.trim();
+
+    if (trimmed && trimmed.toLowerCase() !== SystemRoles.ADMIN.toLowerCase()) {
+      return { selectedRole: trimmed, reason: 'fallback' };
+    }
+  }
+
+  return { reason: 'no_matching_role' };
+}
diff --git a/packages/api/src/auth/proxy.ts b/packages/api/src/auth/proxy.ts
new file mode 100644
index 00000000000..4fb33c5fd02
--- /dev/null
+++ b/packages/api/src/auth/proxy.ts
@@ -0,0 +1 @@
+export { getOpenIdProxyDispatcher } from '~/utils/proxy';
diff --git a/packages/api/src/auth/refresh.spec.ts b/packages/api/src/auth/refresh.spec.ts
index aa7ff8ebd90..683b40e4f82 100644
--- a/packages/api/src/auth/refresh.spec.ts
+++ b/packages/api/src/auth/refresh.spec.ts
@@ -19,6 +19,7 @@ const SUB = 'idp-sub-12345';
 
 const ORIGINAL_OPENID_SCOPE = process.env.OPENID_SCOPE;
 const ORIGINAL_OPENID_REFRESH_AUDIENCE = process.env.OPENID_REFRESH_AUDIENCE;
+const ORIGINAL_OPENID_ISSUER = process.env.OPENID_ISSUER;
 
 function makeUser(overrides: Partial<IUser> = {}): IUser {
   const _id = overrides._id ?? new Types.ObjectId();
@@ -75,6 +76,12 @@ describe('buildOpenIDRefreshParams', () => {
     } else {
       process.env.OPENID_REFRESH_AUDIENCE = ORIGINAL_OPENID_REFRESH_AUDIENCE;
     }
+
+    if (ORIGINAL_OPENID_ISSUER === undefined) {
+      delete process.env.OPENID_ISSUER;
+    } else {
+      process.env.OPENID_ISSUER = ORIGINAL_OPENID_ISSUER;
+    }
   });
 
   it('returns scope-only params when OPENID_SCOPE is set', () => {
@@ -296,10 +303,9 @@ describe('applyAdminRefresh', () => {
       });
 
       const [filter] = (deps.findUsers as jest.Mock).mock.calls[0];
-      expect(filter).toMatchObject({
-        $or: expect.arrayContaining([
-          { openidId: SUB, openidIssuer: 'https://issuer.example.com' },
-        ]),
+      expect(filter).toEqual({
+        openidId: SUB,
+        openidIssuer: 'https://issuer.example.com',
       });
     });
 
@@ -316,6 +322,54 @@ describe('applyAdminRefresh', () => {
       );
     });
 
+    it('selects the most recently updated user across legacy issuer fallback filters', async () => {
+      const previousOpenIDIssuer = process.env.OPENID_ISSUER;
+      process.env.OPENID_ISSUER = 'https://issuer.example.com';
+      try {
+        const olderMissingIssuer = makeUser({
+          email: 'older@example.com',
+          openidIssuer: undefined,
+          updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+        });
+        const newerEmptyIssuer = makeUser({
+          email: 'newer@example.com',
+          openidIssuer: '',
+          updatedAt: new Date('2026-02-01T00:00:00.000Z'),
+        });
+        const findUsers = jest
+          .fn()
+          .mockImplementation(async (filter: { openidIssuer?: unknown }) => {
+            if (filter.openidIssuer === '') return [newerEmptyIssuer];
+            if (
+              typeof filter.openidIssuer === 'object' &&
+              filter.openidIssuer != null &&
+              '$exists' in filter.openidIssuer
+            ) {
+              return [olderMissingIssuer];
+            }
+            return [];
+          });
+        const deps = makeDeps(undefined, { findUsers });
+        const tokenset = makeTokenset({
+          claims: () => ({ sub: SUB, iss: 'https://issuer.example.com' }),
+        });
+
+        const result = await applyAdminRefresh(tokenset, deps, {
+          expectedIssuer: 'https://issuer.example.com',
+        });
+
+        expect(result.user.email).toBe('newer@example.com');
+        expect(deps.mintToken).toHaveBeenCalledWith(newerEmptyIssuer, tokenset);
+        expect(findUsers).toHaveBeenCalledTimes(4);
+      } finally {
+        if (previousOpenIDIssuer === undefined) {
+          delete process.env.OPENID_ISSUER;
+        } else {
+          process.env.OPENID_ISSUER = previousOpenIDIssuer;
+        }
+      }
+    });
+
     it('throws USER_ID_MISMATCH when direct user_id resolves but issuer differs', async () => {
       const id = new Types.ObjectId();
       const user = makeUser({ _id: id, openidIssuer: 'https://other-issuer.example.com' });
diff --git a/packages/api/src/auth/refresh.ts b/packages/api/src/auth/refresh.ts
index c1b2f101cfc..2ae5ca0f0ae 100644
--- a/packages/api/src/auth/refresh.ts
+++ b/packages/api/src/auth/refresh.ts
@@ -133,6 +133,38 @@ export function buildOpenIDRefreshParams(): OpenIDRefreshParams {
   return params;
 }
 
+function applyTenantFilter(
+  filter: FilterQuery<IUser>,
+  tenantId: string | undefined,
+): FilterQuery<IUser> {
+  return tenantId ? ({ ...filter, tenantId } as FilterQuery<IUser>) : filter;
+}
+
+async function findLatestAdminUser(
+  deps: AdminRefreshDeps,
+  filters: FilterQuery<IUser>[],
+  tenantId: string | undefined,
+): Promise<IUser | undefined> {
+  let latestUser: IUser | undefined;
+
+  for (const baseFilter of filters) {
+    const [user] = await deps.findUsers(
+      applyTenantFilter(baseFilter, tenantId),
+      SAFE_USER_PROJECTION,
+      {
+        sort: { updatedAt: -1 },
+        limit: 1,
+      },
+    );
+    if (!user) continue;
+    if (!latestUser || (user.updatedAt?.getTime() ?? 0) > (latestUser.updatedAt?.getTime() ?? 0)) {
+      latestUser = user;
+    }
+  }
+
+  return latestUser;
+}
+
 async function resolveAdminUser(
   deps: AdminRefreshDeps,
   openidId: string,
@@ -173,17 +205,10 @@ async function resolveAdminUser(
   }
 
   const issuerBound = getIssuerBoundConditions('openidId', openidId, normalizedIssuer);
-  const baseFilter: FilterQuery<IUser> =
-    issuerBound.length > 0 ? { $or: issuerBound } : ({ openidId } as FilterQuery<IUser>);
-  const filter: FilterQuery<IUser> = expectedTenantId
-    ? ({ ...baseFilter, tenantId: expectedTenantId } as FilterQuery<IUser>)
-    : baseFilter;
-
-  const [user] = await deps.findUsers(filter, SAFE_USER_PROJECTION, {
-    sort: { updatedAt: -1 },
-    limit: 1,
-  });
-  return user;
+  const filters =
+    issuerBound.length > 0 ? issuerBound : ([{ openidId }] as Array<FilterQuery<IUser>>);
+
+  return findLatestAdminUser(deps, filters, expectedTenantId);
 }
 
 function readClaims(tokenset: RefreshTokenset): AdminRefreshClaims {
diff --git a/packages/api/src/cache/__tests__/cacheConfig.spec.ts b/packages/api/src/cache/__tests__/cacheConfig.spec.ts
index 0488cfecfc3..820815b5f51 100644
--- a/packages/api/src/cache/__tests__/cacheConfig.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheConfig.spec.ts
@@ -12,6 +12,7 @@ describe('cacheConfig', () => {
     delete process.env.USE_REDIS;
     delete process.env.USE_REDIS_STREAMS;
     delete process.env.USE_REDIS_CLUSTER;
+    delete process.env.REDIS_CLUSTER_SAFE_DELETE;
     delete process.env.REDIS_PING_INTERVAL;
     delete process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES;
 
@@ -131,6 +132,27 @@ describe('cacheConfig', () => {
     });
   });
 
+  describe('REDIS_CLUSTER_SAFE_DELETE configuration', () => {
+    test('should default to false when REDIS_CLUSTER_SAFE_DELETE is not set', async () => {
+      const { cacheConfig } = await import('../cacheConfig');
+      expect(cacheConfig.REDIS_CLUSTER_SAFE_DELETE).toBe(false);
+    });
+
+    test('should be false when REDIS_CLUSTER_SAFE_DELETE is set to false', async () => {
+      process.env.REDIS_CLUSTER_SAFE_DELETE = 'false';
+
+      const { cacheConfig } = await import('../cacheConfig');
+      expect(cacheConfig.REDIS_CLUSTER_SAFE_DELETE).toBe(false);
+    });
+
+    test('should be true when REDIS_CLUSTER_SAFE_DELETE is set to true', async () => {
+      process.env.REDIS_CLUSTER_SAFE_DELETE = 'true';
+
+      const { cacheConfig } = await import('../cacheConfig');
+      expect(cacheConfig.REDIS_CLUSTER_SAFE_DELETE).toBe(true);
+    });
+  });
+
   describe('USE_REDIS_STREAMS configuration', () => {
     test('should default to USE_REDIS value when USE_REDIS_STREAMS is not set', async () => {
       process.env.USE_REDIS = 'true';
diff --git a/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
index 52cfee1f078..9ccc830a7bd 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import type { RedisStore } from 'rate-limit-redis';
+import { closeRedisClients } from '../redisClients.helper';
 
 describe('limiterCache', () => {
   let originalEnv: NodeJS.ProcessEnv;
@@ -20,6 +21,7 @@ describe('limiterCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
index 99c0d69b375..a16556f75d4 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
@@ -1,5 +1,6 @@
 import type { MemoryStore, SessionData } from 'express-session';
 import type { RedisStore as ConnectRedis } from 'connect-redis';
+import { closeRedisClients } from '../redisClients.helper';
 
 interface TestSessionData {
   [key: string]: unknown;
@@ -49,6 +50,7 @@ describe('sessionCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
index 563b52341a3..325bcd3e0fc 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import type { Keyv } from 'keyv';
+import { closeRedisClients } from '../redisClients.helper';
 
 // Mock GLOBAL_PREFIX_SEPARATOR from cacheConfig
 jest.mock('../../cacheConfig', () => {
@@ -79,6 +80,7 @@ describe('standardCache', () => {
       testCache = null;
     }
 
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
index 1978620c247..03254eb0b51 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
@@ -1,3 +1,5 @@
+import { closeRedisClients } from '../redisClients.helper';
+
 interface ViolationData {
   count?: number;
   timestamp?: number;
@@ -57,6 +59,7 @@ describe('violationCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts b/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
index 77e8c01436a..b3f1288117b 100644
--- a/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
@@ -1,5 +1,7 @@
-import type { Redis, Cluster } from 'ioredis';
+/* eslint jest/expect-expect: ["warn", { "assertFunctionNames": ["expect", "testRedisOperations"] }] */
 import type { RedisClientType, RedisClusterType } from '@redis/client';
+import type { Redis, Cluster } from 'ioredis';
+import { closeRedisClients } from './redisClients.helper';
 
 type RedisClient = RedisClientType | RedisClusterType | Redis | Cluster;
 
@@ -64,27 +66,10 @@ describe('redisClients Integration Tests', () => {
       }
     }
 
-    // Cleanup Redis connections
-    if (ioredisClient) {
-      try {
-        if (ioredisClient.status === 'ready') {
-          ioredisClient.disconnect();
-        }
-      } catch (error) {
-        console.warn('Error disconnecting ioredis client:', (error as Error).message);
-      }
-      ioredisClient = null;
-    }
-
-    if (keyvRedisClient) {
-      try {
-        // Try to disconnect - keyv/redis client doesn't have an isReady property
-        await keyvRedisClient.disconnect();
-      } catch (error) {
-        console.warn('Error disconnecting keyv redis client:', (error as Error).message);
-      }
-      keyvRedisClient = null;
-    }
+    // Close BOTH clients created by the module import, not just the one the test exercised
+    await closeRedisClients();
+    ioredisClient = null;
+    keyvRedisClient = null;
 
     process.env = originalEnv;
     jest.resetModules();
diff --git a/packages/api/src/cache/__tests__/redisClients.helper.ts b/packages/api/src/cache/__tests__/redisClients.helper.ts
new file mode 100644
index 00000000000..d9bca706cc2
--- /dev/null
+++ b/packages/api/src/cache/__tests__/redisClients.helper.ts
@@ -0,0 +1,25 @@
+export type RedisClientsModule = typeof import('~/cache/redisClients');
+
+/**
+ * Closes the Redis clients owned by a `redisClients` module instance so the jest process can
+ * exit once the suite finishes. Importing `redisClients` constructs and connects both
+ * `ioredisClient` and `keyvRedisClient` as module side effects, so every instance created
+ * through `jest.resetModules()` + re-import must be closed or its sockets and timers keep the
+ * (in-band) test process alive after all tests pass.
+ *
+ * Pass the captured module object when `jest.resetModules()` already dropped the instance from
+ * the registry (e.g. closing a `beforeAll` instance from `afterAll`); otherwise the current
+ * registry instance is used.
+ */
+export async function closeRedisClients(clients?: RedisClientsModule): Promise<void> {
+  const { ioredisClient, keyvRedisClient, keyvRedisClientReady } =
+    clients ?? (await import('~/cache/redisClients'));
+
+  if (keyvRedisClientReady) {
+    await keyvRedisClientReady.catch(() => undefined);
+  }
+  if (keyvRedisClient?.isOpen) {
+    await keyvRedisClient.disconnect().catch(() => undefined);
+  }
+  ioredisClient?.disconnect();
+}
diff --git a/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts b/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
index 659723c0c18..34e28a91e4c 100644
--- a/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import { batchDeleteKeys, scanKeys } from '../redisUtils';
+import { closeRedisClients } from './redisClients.helper';
 
 describe('redisUtils Integration Tests', () => {
   let keyvRedisClient: Awaited<typeof import('../redisClients')>['keyvRedisClient'];
@@ -44,8 +45,8 @@ describe('redisUtils Integration Tests', () => {
   });
 
   afterAll(async () => {
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   describe('batchDeleteKeys', () => {
diff --git a/packages/api/src/cache/cacheConfig.ts b/packages/api/src/cache/cacheConfig.ts
index 7b4a899e98a..21fe1e7d034 100644
--- a/packages/api/src/cache/cacheConfig.ts
+++ b/packages/api/src/cache/cacheConfig.ts
@@ -70,7 +70,77 @@ const getRedisCA = (): string | null => {
   }
 };
 
-const cacheConfig = {
+const cacheConfig: {
+  FORCED_IN_MEMORY_CACHE_NAMESPACES: string[];
+  USE_REDIS: boolean;
+  USE_REDIS_STREAMS: boolean;
+  REDIS_URI: string | undefined;
+  REDIS_USERNAME: string | undefined;
+  REDIS_PASSWORD: string | undefined;
+  REDIS_CA: string | null;
+  REDIS_KEY_PREFIX: string;
+  GLOBAL_PREFIX_SEPARATOR: string;
+  REDIS_MAX_LISTENERS: number;
+  REDIS_PING_INTERVAL: number;
+  /** Max delay between reconnection attempts in ms */
+  REDIS_RETRY_MAX_DELAY: number;
+  /** Max number of reconnection attempts (0 = infinite) */
+  REDIS_RETRY_MAX_ATTEMPTS: number;
+  /** Connection timeout in ms */
+  REDIS_CONNECT_TIMEOUT: number;
+  /** Queue commands when disconnected */
+  REDIS_ENABLE_OFFLINE_QUEUE: boolean;
+  /** flag to modify redis connection by adding dnsLookup this is required when connecting to elasticache for ioredis
+   * see "Special Note: Aws Elasticache Clusters with TLS" on this webpage:  https://www.npmjs.com/package/ioredis **/
+  REDIS_USE_ALTERNATIVE_DNS_LOOKUP: boolean;
+  /** Enable redis cluster without the need of multiple URIs */
+  USE_REDIS_CLUSTER: boolean;
+  /**
+   * Force cluster-safe (key-by-key) deletion even when connecting as a single-node Redis instance.
+   * Needed for managed services like ElastiCache Serverless that present a single endpoint
+   * but shard keys internally, causing CROSSSLOT errors on multi-key DEL commands.
+   * Has no effect when USE_REDIS_CLUSTER is already true.
+   */
+  REDIS_CLUSTER_SAFE_DELETE: boolean;
+  CI: boolean;
+  DEBUG_MEMORY_CACHE: boolean;
+  BAN_DURATION: number; // 2 hours
+  /**
+   * Number of keys to delete in each batch during Redis DEL operations.
+   * In cluster mode, keys are deleted individually in parallel chunks to avoid CROSSSLOT errors.
+   * In single-node mode, keys are deleted in batches using DEL with arrays.
+   * Lower values reduce memory usage but increase number of Redis calls.
+   * @default 1000
+   */
+  REDIS_DELETE_CHUNK_SIZE: number;
+  /**
+   * Number of keys to update in each batch during Redis SET operations.
+   * In cluster mode, keys are updated individually in parallel chunks to avoid CROSSSLOT errors.
+   * In single-node mode, keys are updated in batches using transactions (multi/exec).
+   * Lower values reduce memory usage but increase number of Redis calls.
+   * @default 1000
+   */
+  REDIS_UPDATE_CHUNK_SIZE: number;
+  /**
+   * COUNT hint for Redis SCAN operations when scanning keys by pattern.
+   * This is a hint to Redis about how many keys to scan in each iteration.
+   * Higher values can reduce round trips but increase memory usage and latency per call.
+   * Note: Redis may return more or fewer keys than this count depending on internal heuristics.
+   * @default 1000
+   */
+  REDIS_SCAN_COUNT: number;
+  /**
+   * TTL in milliseconds for MCP registry caches. Used by both:
+   * - `MCPServersRegistry` read-through caches (`readThroughCache`/`readThroughCacheAll`)
+   * - `ServerConfigsCacheRedisAggregateKey` local snapshot (avoids redundant Redis GETs)
+   *
+   * Both layers use this value, so the effective max cross-instance staleness is up
+   * to 2× this value in multi-instance deployments. Set to 0 to disable the local
+   * snapshot entirely (every `getAll()` hits Redis directly).
+   * @default 5000 (5 seconds)
+   */
+  MCP_REGISTRY_CACHE_TTL: number;
+} = {
   FORCED_IN_MEMORY_CACHE_NAMESPACES,
   USE_REDIS,
   USE_REDIS_STREAMS,
@@ -95,6 +165,13 @@ const cacheConfig = {
   REDIS_USE_ALTERNATIVE_DNS_LOOKUP: isEnabled(process.env.REDIS_USE_ALTERNATIVE_DNS_LOOKUP),
   /** Enable redis cluster without the need of multiple URIs */
   USE_REDIS_CLUSTER: isEnabled(process.env.USE_REDIS_CLUSTER ?? 'false'),
+  /**
+   * Force cluster-safe (key-by-key) deletion even when connecting as a single-node Redis instance.
+   * Needed for managed services like ElastiCache Serverless that present a single endpoint
+   * but shard keys internally, causing CROSSSLOT errors on multi-key DEL commands.
+   * Has no effect when USE_REDIS_CLUSTER is already true.
+   */
+  REDIS_CLUSTER_SAFE_DELETE: isEnabled(process.env.REDIS_CLUSTER_SAFE_DELETE ?? 'false'),
   CI: isEnabled(process.env.CI),
   DEBUG_MEMORY_CACHE: isEnabled(process.env.DEBUG_MEMORY_CACHE),
 
diff --git a/packages/api/src/cache/keyvFiles.ts b/packages/api/src/cache/keyvFiles.ts
index 94fe9b7cabe..5652df63146 100644
--- a/packages/api/src/cache/keyvFiles.ts
+++ b/packages/api/src/cache/keyvFiles.ts
@@ -1,6 +1,6 @@
 import { KeyvFile } from 'keyv-file';
 
-export const logFile = new KeyvFile({ filename: './data/logs.json' }).setMaxListeners(20);
-export const violationFile = new KeyvFile({ filename: './data/violations.json' }).setMaxListeners(
-  20,
-);
+export const logFile: KeyvFile = new KeyvFile({ filename: './data/logs.json' }).setMaxListeners(20);
+export const violationFile: KeyvFile = new KeyvFile({
+  filename: './data/violations.json',
+}).setMaxListeners(20);
diff --git a/packages/api/src/cache/keyvMongo.ts b/packages/api/src/cache/keyvMongo.ts
index 4c0a08bf639..d020cdedc4c 100644
--- a/packages/api/src/cache/keyvMongo.ts
+++ b/packages/api/src/cache/keyvMongo.ts
@@ -271,7 +271,7 @@ class KeyvMongoCustom extends EventEmitter {
   }
 }
 
-const keyvMongo = new KeyvMongoCustom({
+const keyvMongo: KeyvMongoCustom = new KeyvMongoCustom({
   collection: 'logs',
 });
 
diff --git a/packages/api/src/cache/redisClients.ts b/packages/api/src/cache/redisClients.ts
index fca4365f7f7..eef63689f53 100644
--- a/packages/api/src/cache/redisClients.ts
+++ b/packages/api/src/cache/redisClients.ts
@@ -1,9 +1,9 @@
 import IoRedis from 'ioredis';
-import type { Redis, Cluster } from 'ioredis';
 import { logger } from '@librechat/data-schemas';
 import { createClient, createCluster } from '@keyv/redis';
-import type { RedisClientType, RedisClusterType } from '@redis/client';
 import type { ScanCommandOptions } from '@redis/client/dist/lib/commands/SCAN';
+import type { RedisClientType, RedisClusterType } from '@redis/client';
+import type { Redis, Cluster } from 'ioredis';
 import { cacheConfig } from './cacheConfig';
 
 const urls = cacheConfig.REDIS_URI?.split(',').map((uri) => new URL(uri)) || [];
@@ -217,7 +217,6 @@ if (cacheConfig.USE_REDIS) {
 
   keyvRedisClientReady.catch((err): void => {
     logger.error('@keyv/redis initial connection failed:', err);
-    throw err;
   });
 }
 
diff --git a/packages/api/src/cache/redisUtils.ts b/packages/api/src/cache/redisUtils.ts
index 334fe1e82a1..de37c8ba5cd 100644
--- a/packages/api/src/cache/redisUtils.ts
+++ b/packages/api/src/cache/redisUtils.ts
@@ -31,11 +31,21 @@ export async function batchDeleteKeys(
   }
 
   const size = chunkSize ?? cacheConfig.REDIS_DELETE_CHUNK_SIZE;
-  const mode = cacheConfig.USE_REDIS_CLUSTER ? 'cluster' : 'single-node';
-  const deletePromises = [];
+  const clusterSafe = cacheConfig.USE_REDIS_CLUSTER || cacheConfig.REDIS_CLUSTER_SAFE_DELETE;
+  let mode = 'single-node';
 
   if (cacheConfig.USE_REDIS_CLUSTER) {
-    // Cluster mode: Delete each key individually in parallel chunks to avoid CROSSSLOT errors
+    mode = 'cluster';
+  } else if (cacheConfig.REDIS_CLUSTER_SAFE_DELETE) {
+    mode = 'cluster-safe';
+  }
+
+  const deletePromises = [];
+
+  if (clusterSafe) {
+    // Cluster / cluster-safe mode: Delete each key individually in parallel chunks to avoid CROSSSLOT errors.
+    // Also used when REDIS_CLUSTER_SAFE_DELETE=true for managed services like ElastiCache Serverless that
+    // shard keys internally while presenting a single-node connection endpoint.
     for (let i = 0; i < keys.length; i += size) {
       const chunk = keys.slice(i, i + size);
       deletePromises.push(Promise.all(chunk.map((key) => client.del(key))));
diff --git a/packages/api/src/cdn/__tests__/cloudfront-cookies.test.ts b/packages/api/src/cdn/__tests__/cloudfront-cookies.test.ts
index b9d22048e3b..940dece049c 100644
--- a/packages/api/src/cdn/__tests__/cloudfront-cookies.test.ts
+++ b/packages/api/src/cdn/__tests__/cloudfront-cookies.test.ts
@@ -840,6 +840,10 @@ describe('maybeRefreshCloudFrontAuthCookies', () => {
 
     expect(result).toMatchObject({ enabled: false, attempted: false, refreshed: false });
     expect(mockGetSignedCookies).not.toHaveBeenCalled();
+    expect(mockLogger.debug).not.toHaveBeenCalledWith(
+      '[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies skipped',
+      expect.any(Object),
+    );
   });
 
   it('does not refresh when imageSigning is not cookies', () => {
@@ -851,6 +855,10 @@ describe('maybeRefreshCloudFrontAuthCookies', () => {
 
     expect(result).toMatchObject({ enabled: false, attempted: false, refreshed: false });
     expect(mockGetSignedCookies).not.toHaveBeenCalled();
+    expect(mockLogger.debug).not.toHaveBeenCalledWith(
+      '[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies skipped',
+      expect.any(Object),
+    );
   });
 
   it('force-refreshes even when the scope cookie is fresh without calling OIDC refresh', () => {
diff --git a/packages/api/src/cdn/azure.ts b/packages/api/src/cdn/azure.ts
index 247530286ca..1a0f96e0e48 100644
--- a/packages/api/src/cdn/azure.ts
+++ b/packages/api/src/cdn/azure.ts
@@ -47,7 +47,7 @@ export const initializeAzureBlobService = async (): Promise<BlobServiceClient |
  * @returns The Azure ContainerClient.
  */
 export const getAzureContainerClient = async (
-  containerName = process.env.AZURE_CONTAINER_NAME || 'files',
+  containerName: string = process.env.AZURE_CONTAINER_NAME || 'files',
 ): Promise<ContainerClient | null> => {
   const serviceClient = await initializeAzureBlobService();
   return serviceClient ? serviceClient.getContainerClient(containerName) : null;
diff --git a/packages/api/src/cdn/cloudfront-cookies.ts b/packages/api/src/cdn/cloudfront-cookies.ts
index 98de321043f..eaa4e706b18 100644
--- a/packages/api/src/cdn/cloudfront-cookies.ts
+++ b/packages/api/src/cdn/cloudfront-cookies.ts
@@ -1,12 +1,10 @@
-import { getSignedCookies } from '@aws-sdk/cloudfront-signer';
 import { logger } from '@librechat/data-schemas';
-
+import { getSignedCookies } from '@aws-sdk/cloudfront-signer';
 import type { NextFunction, Response } from 'express';
-
 import { INLINE_AVATAR_PATH_PREFIX, INLINE_IMAGE_PATH_PREFIX } from '~/storage/constants';
 import { assertPathSegment } from '~/storage/validation';
-import { s3Config } from '~/storage/s3/s3Config';
 import { getCloudFrontConfig } from './cloudfront';
+import { s3Config } from '~/storage/s3/s3Config';
 
 const DEFAULT_COOKIE_EXPIRY = 1800;
 
@@ -147,11 +145,17 @@ function getConfiguredCookieExpiry(): number {
   return config?.cookieExpiry ?? DEFAULT_COOKIE_EXPIRY;
 }
 
-export function getCloudFrontCookieRefreshWindowSec(cookieExpiry = getConfiguredCookieExpiry()) {
+export function getCloudFrontCookieRefreshWindowSec(
+  cookieExpiry: number = getConfiguredCookieExpiry(),
+): number {
   return Math.min(300, Math.floor(cookieExpiry / 4));
 }
 
-export function getCloudFrontCookieTiming() {
+export function getCloudFrontCookieTiming(): {
+  expiresInSec: number;
+  refreshAfterSec: number;
+  refreshWindowSec: number;
+} {
   const expiresInSec = getConfiguredCookieExpiry();
   const refreshWindowSec = getCloudFrontCookieRefreshWindowSec(expiresInSec);
   return {
@@ -312,6 +316,10 @@ function getCloudFrontCookieSkipReason(scope: CloudFrontCookieScope): string | n
   return null;
 }
 
+function shouldLogCloudFrontCookieSkip(reason: string): boolean {
+  return reason !== 'cloudfront_disabled';
+}
+
 function getScopeRefreshReason(
   previousScope: CloudFrontCookieScope | null,
   currentScope: CloudFrontCookieScope,
@@ -516,10 +524,6 @@ export function setCloudFrontCookies(
       path: '/',
     });
 
-    logger.debug(
-      `[setCloudFrontCookies] Issued signed CloudFront cookies (paths=${signedCookieSets.length}, expiresInSec=${cookieExpiry}).`,
-    );
-
     return true;
   } catch (error) {
     logger.error('[setCloudFrontCookies] Failed to generate signed cookies:', error);
@@ -540,14 +544,16 @@ export function maybeRefreshCloudFrontAuthCookies(
     const timing = getCloudFrontCookieTiming();
 
     if (skipReason) {
-      logger.debug('[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies skipped', {
-        attempted: false,
-        refreshed: false,
-        reason: skipReason,
-        has_user_id: Boolean(scope.userId),
-        has_tenant_scope: Boolean(scope.tenantId),
-        has_storage_region: Boolean(scope.storageRegion),
-      });
+      if (shouldLogCloudFrontCookieSkip(skipReason)) {
+        logger.debug('[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies skipped', {
+          attempted: false,
+          refreshed: false,
+          reason: skipReason,
+          has_user_id: Boolean(scope.userId),
+          has_tenant_scope: Boolean(scope.tenantId),
+          has_storage_region: Boolean(scope.storageRegion),
+        });
+      }
       return {
         enabled: false,
         attempted: false,
@@ -565,12 +571,6 @@ export function maybeRefreshCloudFrontAuthCookies(
       : getScopeRefreshReason(previousScope, effectiveScope, refreshWindowSec);
 
     if (!refreshReason) {
-      logger.debug('[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies still fresh', {
-        attempted: false,
-        refreshed: false,
-        reason: 'fresh',
-        refresh_window_sec: refreshWindowSec,
-      });
       return {
         enabled: true,
         attempted: false,
@@ -593,10 +593,14 @@ export function maybeRefreshCloudFrontAuthCookies(
     };
 
     if (cookiesSet) {
-      logger.debug(
-        '[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookies refreshed',
-        logPayload,
-      );
+      return {
+        enabled: true,
+        attempted: true,
+        refreshed: true,
+        reason: refreshReason,
+        expiresInSec: timing.expiresInSec,
+        refreshAfterSec: timing.refreshAfterSec,
+      };
     } else {
       logger.warn(
         '[maybeRefreshCloudFrontAuthCookies] CloudFront auth cookie refresh failed',
@@ -607,8 +611,8 @@ export function maybeRefreshCloudFrontAuthCookies(
     return {
       enabled: true,
       attempted: true,
-      refreshed: cookiesSet,
-      reason: cookiesSet ? refreshReason : 'set_failed',
+      refreshed: false,
+      reason: 'set_failed',
       expiresInSec: timing.expiresInSec,
       refreshAfterSec: timing.refreshAfterSec,
     };
diff --git a/packages/api/src/cdn/firebase.ts b/packages/api/src/cdn/firebase.ts
index 30fca65b1b5..066f295c5da 100644
--- a/packages/api/src/cdn/firebase.ts
+++ b/packages/api/src/cdn/firebase.ts
@@ -7,7 +7,7 @@ import type { FirebaseApp } from 'firebase/app';
 let firebaseInitCount = 0;
 let firebaseApp: FirebaseApp | null = null;
 
-export const initializeFirebase = () => {
+export const initializeFirebase = (): firebase.FirebaseApp | null => {
   if (firebaseApp) {
     return firebaseApp;
   }
diff --git a/packages/api/src/cluster/LeaderElection.ts b/packages/api/src/cluster/LeaderElection.ts
index 726c56b1858..e40a95cde8b 100644
--- a/packages/api/src/cluster/LeaderElection.ts
+++ b/packages/api/src/cluster/LeaderElection.ts
@@ -1,7 +1,7 @@
-import { keyvRedisClient } from '~/cache/redisClients';
+import { logger } from '@librechat/data-schemas';
 import { cacheConfig as cache } from '~/cache/cacheConfig';
+import { keyvRedisClient } from '~/cache/redisClients';
 import { clusterConfig as cluster } from './config';
-import { logger } from '@librechat/data-schemas';
 
 /**
  * Distributed leader election implementation using Redis for coordination across multiple server instances.
@@ -21,7 +21,7 @@ import { logger } from '@librechat/data-schemas';
  */
 export class LeaderElection {
   // We can't use Keyv namespace here because we need direct Redis access for atomic operations
-  static readonly LEADER_KEY = `${cache.REDIS_KEY_PREFIX}${cache.GLOBAL_PREFIX_SEPARATOR}LeadingServerUUID`;
+  static readonly LEADER_KEY: string = `${cache.REDIS_KEY_PREFIX}${cache.GLOBAL_PREFIX_SEPARATOR}LeadingServerUUID`;
   private static _instance = new LeaderElection();
 
   readonly UUID: string = crypto.randomUUID();
diff --git a/packages/api/src/cluster/config.ts b/packages/api/src/cluster/config.ts
index d4a99b32170..44a0aa56f91 100644
--- a/packages/api/src/cluster/config.ts
+++ b/packages/api/src/cluster/config.ts
@@ -1,6 +1,15 @@
 import { math } from '~/utils';
 
-const clusterConfig = {
+const clusterConfig: {
+  /** Duration in seconds that the leader lease is valid before it expires */
+  LEADER_LEASE_DURATION: number;
+  /** Interval in seconds at which the leader renews its lease */
+  LEADER_RENEW_INTERVAL: number;
+  /** Maximum number of retry attempts when renewing the lease fails */
+  LEADER_RENEW_ATTEMPTS: number;
+  /** Delay in seconds between retry attempts when renewing the lease */
+  LEADER_RENEW_RETRY_DELAY: number;
+} = {
   /** Duration in seconds that the leader lease is valid before it expires */
   LEADER_LEASE_DURATION: math(process.env.LEADER_LEASE_DURATION, 25),
   /** Interval in seconds at which the leader renews its lease */
diff --git a/packages/api/src/db/utils.ts b/packages/api/src/db/utils.ts
index b53478d0455..aa7b802c91e 100644
--- a/packages/api/src/db/utils.ts
+++ b/packages/api/src/db/utils.ts
@@ -42,6 +42,7 @@ export async function ensureRequiredCollectionsExist(db: mongo.Db): Promise<void
     'agents', // Agents collection
     'promptgroups', // Prompt groups collection
     'projects', // Projects collection
+    'chatprojects', // Private chat organization projects
   ];
 
   logger.debug('Ensuring required collections exist for permission system');
diff --git a/packages/api/src/endpoints/anthropic/helpers.ts b/packages/api/src/endpoints/anthropic/helpers.ts
index 612d947a22b..33431b30e1d 100644
--- a/packages/api/src/endpoints/anthropic/helpers.ts
+++ b/packages/api/src/endpoints/anthropic/helpers.ts
@@ -5,6 +5,7 @@ import {
   ThinkingDisplay,
   AnthropicEffort,
   anthropicSettings,
+  isMythosClassModel,
   resolveThinkingDisplay,
   supportsAdaptiveThinking,
 } from 'librechat-data-provider';
@@ -49,7 +50,8 @@ function checkPromptCacheSupport(modelName: string): boolean {
     /claude-3-(?:sonnet|haiku|opus)?/.test(modelMatch) ||
     /claude-(?:sonnet|opus|haiku)-[4-9]/.test(modelMatch) ||
     /claude-[4-9]-(?:sonnet|opus|haiku)?/.test(modelMatch) ||
-    /claude-4(?:-(?:sonnet|opus|haiku))?/.test(modelMatch)
+    /claude-4(?:-(?:sonnet|opus|haiku))?/.test(modelMatch) ||
+    isMythosClassModel(modelMatch)
   );
 }
 
diff --git a/packages/api/src/endpoints/anthropic/initialize.spec.ts b/packages/api/src/endpoints/anthropic/initialize.spec.ts
new file mode 100644
index 00000000000..32e4e0d940b
--- /dev/null
+++ b/packages/api/src/endpoints/anthropic/initialize.spec.ts
@@ -0,0 +1,109 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { AnthropicClientOptions } from '@librechat/agents';
+import type { BaseInitializeParams, ServerRequest } from '~/types';
+import { FINE_GRAINED_TOOL_STREAMING_BETA } from './helpers';
+import { initializeAnthropic } from './initialize';
+
+const getDefaultHeaders = (llmConfig: unknown): Record<string, string> =>
+  ((llmConfig as AnthropicClientOptions).clientOptions?.defaultHeaders ?? {}) as Record<
+    string,
+    string
+  >;
+
+function createParams(
+  endpointsConfig: Record<string, unknown>,
+  env: Record<string, string | undefined> = {},
+): { params: BaseInitializeParams; restore: () => void } {
+  const savedEnv: Record<string, string | undefined> = {};
+  for (const key of Object.keys(env)) {
+    savedEnv[key] = process.env[key];
+  }
+  Object.assign(process.env, env);
+
+  const params: BaseInitializeParams = {
+    req: {
+      user: { id: 'user-42' },
+      body: { conversationId: 'convo-xyz' },
+      config: { endpoints: endpointsConfig },
+    } as unknown as ServerRequest,
+    endpoint: EModelEndpoint.anthropic,
+    model_parameters: { model: 'claude-sonnet-4-5' },
+    db: {
+      getUserKey: jest.fn(),
+      getUserKeyValues: jest.fn(),
+    },
+  };
+
+  const restore = () => {
+    for (const key of Object.keys(env)) {
+      if (savedEnv[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = savedEnv[key];
+      }
+    }
+  };
+
+  return { params, restore };
+}
+
+describe('initializeAnthropic – custom headers', () => {
+  it('threads configured headers into clientOptions.defaultHeaders without resolving placeholders', async () => {
+    const { params, restore } = createParams(
+      {
+        [EModelEndpoint.anthropic]: {
+          headers: { 'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+        },
+      },
+      { ANTHROPIC_API_KEY: 'sk-ant-test', ANTHROPIC_REVERSE_PROXY: 'https://gateway.example.com' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      const defaultHeaders = getDefaultHeaders(result.llmConfig);
+      /** Placeholder kept intact — resolved at request time, not init time */
+      expect(defaultHeaders['X-Conversation-Id']).toBe('{{LIBRECHAT_BODY_CONVERSATIONID}}');
+      /** Provider-managed beta header preserved alongside the custom header */
+      expect(defaultHeaders['anthropic-beta']).toBe(FINE_GRAINED_TOOL_STREAMING_BETA);
+      /** Reverse proxy still wired through native Anthropic config */
+      expect(result.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    } finally {
+      restore();
+    }
+  });
+
+  it('merges endpoints.all headers beneath endpoint-specific headers', async () => {
+    const { params, restore } = createParams(
+      {
+        all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+        [EModelEndpoint.anthropic]: { headers: { 'X-Override': 'anthropic' } },
+      },
+      { ANTHROPIC_API_KEY: 'sk-ant-test' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      const defaultHeaders = getDefaultHeaders(result.llmConfig);
+      expect(defaultHeaders['X-Common']).toBe('all');
+      expect(defaultHeaders['X-Override']).toBe('anthropic');
+    } finally {
+      restore();
+    }
+  });
+
+  it('leaves defaultHeaders provider-managed when no custom headers are configured', async () => {
+    const { params, restore } = createParams(
+      { [EModelEndpoint.anthropic]: {} },
+      { ANTHROPIC_API_KEY: 'sk-ant-test' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      expect(getDefaultHeaders(result.llmConfig)).toEqual({
+        'anthropic-beta': FINE_GRAINED_TOOL_STREAMING_BETA,
+      });
+    } finally {
+      restore();
+    }
+  });
+});
diff --git a/packages/api/src/endpoints/anthropic/initialize.ts b/packages/api/src/endpoints/anthropic/initialize.ts
index 8bebd8467b9..94a86294a22 100644
--- a/packages/api/src/endpoints/anthropic/initialize.ts
+++ b/packages/api/src/endpoints/anthropic/initialize.ts
@@ -1,7 +1,7 @@
 import { EModelEndpoint, AuthKeys } from 'librechat-data-provider';
 import type { BaseInitializeParams, InitializeResultBase, AnthropicConfigOptions } from '~/types';
-import { checkUserKeyExpiry, isEnabled } from '~/utils';
 import { loadAnthropicVertexCredentials, getVertexCredentialOptions } from './vertex';
+import { checkUserKeyExpiry, isEnabled, mergeHeaders } from '~/utils';
 import { getLLMConfig } from './llm';
 
 /**
@@ -64,6 +64,11 @@ export async function initializeAnthropic({
     credentials[AuthKeys.ANTHROPIC_API_KEY] = anthropicApiKey;
   }
 
+  const anthropicConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic];
+  const allConfig = appConfig?.endpoints?.all;
+
+  const headers = mergeHeaders(allConfig?.headers, anthropicConfig?.headers);
+
   const clientOptions: AnthropicConfigOptions = {
     proxy: PROXY ?? undefined,
     reverseProxyUrl: ANTHROPIC_REVERSE_PROXY ?? undefined,
@@ -71,15 +76,13 @@ export async function initializeAnthropic({
       ...(model_parameters ?? {}),
       user: req.user?.id,
     },
+    ...(headers && { headers }),
     // Pass Vertex AI options if configured
     ...(vertexOptions && { vertexOptions }),
     // Pass full Vertex AI config including model mappings
     ...(vertexConfig && { vertexConfig }),
   };
 
-  const anthropicConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic];
-  const allConfig = appConfig?.endpoints?.all;
-
   const result = getLLMConfig(credentials, clientOptions);
 
   if (anthropicConfig?.streamRate) {
diff --git a/packages/api/src/endpoints/anthropic/llm.spec.ts b/packages/api/src/endpoints/anthropic/llm.spec.ts
index 9ab4ef11e8e..062d9062948 100644
--- a/packages/api/src/endpoints/anthropic/llm.spec.ts
+++ b/packages/api/src/endpoints/anthropic/llm.spec.ts
@@ -29,9 +29,68 @@ describe('getLLMConfig', () => {
 
     expect(result.llmConfig.clientOptions).toHaveProperty('fetchOptions');
     expect(result.llmConfig.clientOptions?.fetchOptions).toHaveProperty('dispatcher');
-    expect(result.llmConfig.clientOptions?.fetchOptions?.dispatcher).toBeDefined();
-    expect(result.llmConfig.clientOptions?.fetchOptions?.dispatcher.constructor.name).toBe(
-      'ProxyAgent',
+    const dispatcher = result.llmConfig.clientOptions?.fetchOptions?.dispatcher;
+    expect(dispatcher).toBeDefined();
+    expect(dispatcher?.constructor.name).toBe('ProxyAgent');
+  });
+
+  it('should harden user-provided reverse proxy URLs with a connect-time dispatcher and disabled redirects', () => {
+    const result = getLLMConfig('test-api-key', {
+      modelOptions: {},
+      reverseProxyUrl: 'https://user-provider.example.com',
+      baseURLIsUserProvided: true,
+      allowedAddresses: ['10.0.0.5:443'],
+    });
+
+    const fetchOptions = result.llmConfig.clientOptions?.fetchOptions as
+      | { dispatcher?: unknown; redirect?: string }
+      | undefined;
+    expect(fetchOptions).toEqual(
+      expect.objectContaining({
+        dispatcher: expect.any(Object),
+        redirect: 'error',
+      }),
+    );
+  });
+
+  it('should keep the SSRF-safe dispatcher when a proxy is configured for a user-provided URL', () => {
+    const result = getLLMConfig('test-api-key', {
+      modelOptions: {},
+      proxy: 'http://proxy:8080',
+      reverseProxyUrl: 'https://user-provider.example.com',
+      baseURLIsUserProvided: true,
+    });
+
+    const fetchOptions = result.llmConfig.clientOptions?.fetchOptions as
+      | { dispatcher?: { constructor: { name: string } }; redirect?: string }
+      | undefined;
+    expect(fetchOptions?.dispatcher?.constructor.name).toBe('Agent');
+    expect(fetchOptions).toEqual(expect.objectContaining({ redirect: 'error' }));
+  });
+
+  it('should keep SSRF fetch options when clientOptions are dropped for a user-provided URL', () => {
+    const result = getLLMConfig('test-api-key', {
+      modelOptions: {},
+      reverseProxyUrl: 'https://user-provider.example.com',
+      baseURLIsUserProvided: true,
+      dropParams: ['clientOptions'],
+    });
+
+    const clientOptions = result.llmConfig.clientOptions as
+      | {
+          baseURL?: string;
+          defaultHeaders?: Record<string, string>;
+          fetchOptions?: { dispatcher?: unknown; redirect?: string };
+        }
+      | undefined;
+    expect(result.llmConfig.anthropicApiUrl).toBe('https://user-provider.example.com');
+    expect(clientOptions?.baseURL).toBeUndefined();
+    expect(clientOptions?.defaultHeaders).toBeUndefined();
+    expect(clientOptions?.fetchOptions).toEqual(
+      expect.objectContaining({
+        dispatcher: expect.any(Object),
+        redirect: 'error',
+      }),
     );
   });
 
@@ -333,10 +392,9 @@ describe('getLLMConfig', () => {
 
       expect(result.llmConfig.clientOptions).toHaveProperty('fetchOptions');
       expect(result.llmConfig.clientOptions?.fetchOptions).toHaveProperty('dispatcher');
-      expect(result.llmConfig.clientOptions?.fetchOptions?.dispatcher).toBeDefined();
-      expect(result.llmConfig.clientOptions?.fetchOptions?.dispatcher.constructor.name).toBe(
-        'ProxyAgent',
-      );
+      const dispatcher = result.llmConfig.clientOptions?.fetchOptions?.dispatcher;
+      expect(dispatcher).toBeDefined();
+      expect(dispatcher?.constructor.name).toBe('ProxyAgent');
       expect(result.llmConfig.clientOptions).toHaveProperty('baseURL', 'https://reverse-proxy.com');
       expect(result.llmConfig).toHaveProperty('anthropicApiUrl', 'https://reverse-proxy.com');
     });
@@ -356,6 +414,46 @@ describe('getLLMConfig', () => {
       expect(result.llmConfig.promptCache).toBe(true);
     });
 
+    it('should pass promptCacheTtl to llmConfig when configured', () => {
+      const result = getLLMConfig('test-api-key', {
+        modelOptions: {
+          model: 'claude-3-5-sonnet',
+          promptCache: true,
+          promptCacheTtl: '1h',
+        },
+      });
+
+      expect(result.llmConfig.promptCache).toBe(true);
+      expect((result.llmConfig as Record<string, unknown>).promptCacheTtl).toBe('1h');
+    });
+
+    it('should omit promptCacheTtl when unset so the agents SDK applies its default', () => {
+      const result = getLLMConfig('test-api-key', {
+        modelOptions: {
+          model: 'claude-3-5-sonnet',
+          promptCache: true,
+        },
+      });
+
+      expect(result.llmConfig.promptCache).toBe(true);
+      expect((result.llmConfig as Record<string, unknown>).promptCacheTtl).toBeUndefined();
+    });
+
+    it('should drop promptCacheTtl when promptCache is dropped via dropParams', () => {
+      const result = getLLMConfig('test-api-key', {
+        modelOptions: {
+          model: 'claude-3-5-sonnet',
+          promptCache: true,
+          promptCacheTtl: '1h',
+        },
+        dropParams: ['promptCache'],
+      });
+
+      /** A dropped cache must not leave an orphaned TTL on the request. */
+      expect(result.llmConfig.promptCache).toBeUndefined();
+      expect((result.llmConfig as Record<string, unknown>).promptCacheTtl).toBeUndefined();
+    });
+
     it('should handle thinking and thinkingBudget options', () => {
       const result = getLLMConfig('test-api-key', {
         modelOptions: {
@@ -494,9 +592,8 @@ describe('getLLMConfig', () => {
           },
         });
         expect(result.llmConfig.clientOptions?.fetchOptions).toHaveProperty('dispatcher');
-        expect(result.llmConfig.clientOptions?.fetchOptions?.dispatcher.constructor.name).toBe(
-          'ProxyAgent',
-        );
+        const dispatcher = result.llmConfig.clientOptions?.fetchOptions?.dispatcher;
+        expect(dispatcher?.constructor.name).toBe('ProxyAgent');
       });
 
       it('should handle Anthropic with reverse proxy like initialize.js', () => {
@@ -888,7 +985,7 @@ describe('getLLMConfig', () => {
         expect(opus64kResult.llmConfig.maxTokens).toBe(64000);
 
         // opus-4-6+ get 128K
-        const opus128kModels = ['claude-opus-4-7', 'claude-opus-4-10'];
+        const opus128kModels = ['claude-opus-4-7', 'claude-opus-4-8', 'claude-opus-4-10'];
         opus128kModels.forEach((model) => {
           const result = getLLMConfig('test-key', {
             modelOptions: { model },
@@ -1066,6 +1163,58 @@ describe('getLLMConfig', () => {
         expect(thinking.display).toBe('summarized');
       });
 
+      it('should omit sampling parameters for Opus 4.8', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: {
+            model: 'claude-opus-4-8',
+            thinking: false,
+            temperature: 0.7,
+            topP: 0.9,
+            topK: 40,
+          },
+        });
+
+        expect(result.llmConfig).not.toHaveProperty('temperature');
+        expect(result.llmConfig).not.toHaveProperty('topP');
+        expect(result.llmConfig).not.toHaveProperty('topK');
+      });
+
+      it('should set adaptive thinking with summarized display for Fable 5', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: { model: 'claude-fable-5', thinking: true },
+        });
+
+        const thinking = result.llmConfig.thinking as unknown as {
+          type: string;
+          display?: string;
+        };
+        expect(thinking.type).toBe('adaptive');
+        expect(thinking.display).toBe('summarized');
+      });
+
+      it('should default Fable 5 max output tokens to 128K', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: { model: 'claude-fable-5', thinking: true },
+        });
+        expect(result.llmConfig.maxTokens).toBe(128000);
+      });
+
+      it('should omit sampling parameters for Fable 5', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: {
+            model: 'claude-fable-5',
+            thinking: true,
+            temperature: 0.7,
+            topP: 0.9,
+            topK: 40,
+          },
+        });
+
+        expect(result.llmConfig).not.toHaveProperty('temperature');
+        expect(result.llmConfig).not.toHaveProperty('topP');
+        expect(result.llmConfig).not.toHaveProperty('topK');
+      });
+
       it('should NOT set thinking.display for pre-Opus-4.7 adaptive models', () => {
         const pre47Models = ['claude-opus-4-6', 'claude-sonnet-4-6'];
 
@@ -1809,4 +1958,55 @@ describe('getLLMConfig', () => {
       });
     });
   });
+
+  describe('custom headers', () => {
+    it('attaches admin-configured headers while preserving native Anthropic formatting', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-sonnet-4-5' },
+        reverseProxyUrl: 'https://gateway.example.com',
+        headers: {
+          'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}',
+        },
+      });
+
+      const clientOptions = result.llmConfig.clientOptions;
+      /** Provider-managed beta header is preserved */
+      expect((clientOptions?.defaultHeaders as Record<string, string>)['anthropic-beta']).toBe(
+        FINE_GRAINED_TOOL_STREAMING_BETA,
+      );
+      /** Custom header is attached, placeholders kept intact for request-time resolution */
+      expect((clientOptions?.defaultHeaders as Record<string, string>)['cf-aig-metadata']).toBe(
+        '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}',
+      );
+      /** Native request shaping is untouched */
+      expect(result.llmConfig).toHaveProperty('model', 'claude-sonnet-4-5');
+      expect(result.llmConfig).toHaveProperty('stream', true);
+      expect(result.llmConfig.invocationKwargs?.metadata).toEqual({ user_id: undefined });
+      expect(result.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    });
+
+    it('does not let custom headers override the provider-managed anthropic-beta header', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-3-5-sonnet' },
+        headers: { 'anthropic-beta': 'custom-beta' },
+      });
+
+      const beta = (result.llmConfig.clientOptions?.defaultHeaders as Record<string, string>)[
+        'anthropic-beta'
+      ];
+      /** Custom beta is unioned with managed betas rather than clobbering them */
+      expect(beta).toContain(FINE_GRAINED_TOOL_STREAMING_BETA);
+      expect(beta).toContain('custom-beta');
+    });
+
+    it('does not attach custom headers when clientOptions are dropped', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-3-opus' },
+        dropParams: ['clientOptions'],
+        headers: { 'cf-aig-metadata': 'x' },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('clientOptions');
+    });
+  });
 });
diff --git a/packages/api/src/endpoints/anthropic/llm.ts b/packages/api/src/endpoints/anthropic/llm.ts
index 0c4929621ef..17dcf73c8e6 100644
--- a/packages/api/src/endpoints/anthropic/llm.ts
+++ b/packages/api/src/endpoints/anthropic/llm.ts
@@ -1,12 +1,14 @@
-import { Dispatcher, ProxyAgent } from 'undici';
+import { Agent } from 'undici';
 import { logger } from '@librechat/data-schemas';
 import { AnthropicClientOptions } from '@librechat/agents';
 import {
   anthropicSettings,
+  omitsSamplingParameters,
   removeNullishValues,
   ThinkingDisplay,
   AuthKeys,
 } from 'librechat-data-provider';
+import type { Dispatcher } from 'undici';
 import type {
   AnthropicLLMConfigResult,
   AnthropicConfigOptions,
@@ -25,9 +27,44 @@ import {
   isAnthropicVertexCredentials,
   getVertexDeploymentName,
 } from './vertex';
+import { createSSRFSafeUndiciConnect } from '~/auth';
+import { getProxyDispatcher } from '~/utils/proxy';
+import { mergeHeaders } from '~/utils/headers';
 
 const WEB_SEARCH_BETA = 'web-search-2025-03-05';
 
+type FetchOptions = { dispatcher?: Dispatcher; redirect?: RequestRedirect };
+
+function getEffectiveURLPort(baseURL: string): string | null {
+  try {
+    const parsed = new URL(baseURL);
+    if (parsed.port) {
+      return parsed.port;
+    }
+    if (parsed.protocol === 'http:') {
+      return '80';
+    }
+    if (parsed.protocol === 'https:') {
+      return '443';
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
+function mergeFetchOptions(
+  clientOptions: NonNullable<AnthropicClientOptions['clientOptions']>,
+  options: FetchOptions,
+): void {
+  const currentOptions = (clientOptions.fetchOptions ?? {}) as FetchOptions;
+  clientOptions.fetchOptions = {
+    ...currentOptions,
+    ...options,
+  } as NonNullable<AnthropicClientOptions['clientOptions']>['fetchOptions'];
+}
+
 /**
  * Parses credentials from string or object format
  * - If a valid JSON string is passed, it parses and returns the object
@@ -51,7 +88,7 @@ function parseCredentials(
 }
 
 /** Known Anthropic parameters that map directly to the client config */
-export const knownAnthropicParams = new Set([
+export const knownAnthropicParams: Set<string> = new Set([
   'model',
   'temperature',
   'topP',
@@ -111,6 +148,8 @@ function getLLMConfig(
   const systemOptions = {
     thinking: options.modelOptions?.thinking ?? anthropicSettings.thinking.default,
     promptCache: options.modelOptions?.promptCache ?? anthropicSettings.promptCache.default,
+    promptCacheTtl:
+      options.modelOptions?.promptCacheTtl ?? anthropicSettings.promptCacheTtl.default,
     thinkingBudget:
       options.modelOptions?.thinkingBudget ?? anthropicSettings.thinkingBudget.default,
     effort: options.modelOptions?.effort ?? anthropicSettings.effort.default,
@@ -123,6 +162,7 @@ function getLLMConfig(
   if (options.modelOptions) {
     delete options.modelOptions.thinking;
     delete options.modelOptions.promptCache;
+    delete options.modelOptions.promptCacheTtl;
     delete options.modelOptions.thinkingBudget;
     delete options.modelOptions.effort;
     delete options.modelOptions.thinkingDisplay;
@@ -177,9 +217,12 @@ function getLLMConfig(
     );
   }
 
+  const resolvedModel = requestOptions.model ?? mergedOptions.model;
+  const shouldOmitSamplingParameters = omitsSamplingParameters(resolvedModel);
+
   requestOptions = configureReasoning(requestOptions, systemOptions);
 
-  if (supportsAdaptiveThinking(mergedOptions.model)) {
+  if (supportsAdaptiveThinking(resolvedModel)) {
     if (
       systemOptions.effort &&
       (systemOptions.effort as string) !== '' &&
@@ -204,8 +247,8 @@ function getLLMConfig(
 
   const hasActiveThinking = requestOptions.thinking != null;
   const isThinkingModel =
-    /claude-3[-.]7/.test(mergedOptions.model) || supportsAdaptiveThinking(mergedOptions.model);
-  if (!isThinkingModel || !hasActiveThinking) {
+    /claude-3[-.]7/.test(resolvedModel) || supportsAdaptiveThinking(resolvedModel);
+  if (!shouldOmitSamplingParameters && (!isThinkingModel || !hasActiveThinking)) {
     requestOptions.topP = mergedOptions.topP;
     requestOptions.topK = mergedOptions.topK;
   }
@@ -216,6 +259,10 @@ function getLLMConfig(
   /** Pass promptCache boolean for downstream cache_control application */
   if (supportsCacheControl) {
     (requestOptions as Record<string, unknown>).promptCache = true;
+    /** Pass an explicit TTL when configured; otherwise the agents SDK defaults to 1h */
+    if (systemOptions.promptCacheTtl != null) {
+      (requestOptions as Record<string, unknown>).promptCacheTtl = systemOptions.promptCacheTtl;
+    }
   }
 
   const headers = getClaudeHeaders(requestOptions.model ?? '', supportsCacheControl);
@@ -223,11 +270,13 @@ function getLLMConfig(
     requestOptions.clientOptions.defaultHeaders = headers;
   }
 
-  if (options.proxy && requestOptions.clientOptions) {
-    const proxyAgent = new ProxyAgent(options.proxy);
-    requestOptions.clientOptions.fetchOptions = {
-      dispatcher: proxyAgent,
-    };
+  const shouldProtectUserBaseURL =
+    options.baseURLIsUserProvided === true && !!options.reverseProxyUrl;
+  const proxyDispatcher = getProxyDispatcher(options.proxy);
+  if (proxyDispatcher && !shouldProtectUserBaseURL && requestOptions.clientOptions) {
+    mergeFetchOptions(requestOptions.clientOptions, {
+      dispatcher: proxyDispatcher,
+    });
   }
 
   if (options.reverseProxyUrl && requestOptions.clientOptions) {
@@ -291,6 +340,17 @@ function getLLMConfig(
         delete (requestOptions.invocationKwargs as Record<string, unknown>)[param];
       }
     });
+
+    /** A TTL is meaningless without caching — drop it alongside promptCache. */
+    if (options.dropParams.includes('promptCache')) {
+      delete (requestOptions as Record<string, unknown>).promptCacheTtl;
+    }
+  }
+
+  if (shouldOmitSamplingParameters) {
+    delete requestOptions.temperature;
+    delete requestOptions.topP;
+    delete requestOptions.topK;
   }
 
   const tools = [];
@@ -323,6 +383,36 @@ function getLLMConfig(
     );
   }
 
+  /**
+   * Attach admin-configured custom headers (e.g. AI-gateway metadata) beneath
+   * the provider-managed headers above, so beta/protocol headers always win.
+   * Placeholders are kept intact here and resolved at request time.
+   */
+  if (options.headers && Object.keys(options.headers).length > 0 && !shouldDropClientOptions) {
+    if (!requestOptions.clientOptions) {
+      requestOptions.clientOptions = {};
+    }
+    requestOptions.clientOptions.defaultHeaders = mergeHeaders(
+      options.headers,
+      requestOptions.clientOptions.defaultHeaders as Record<string, string> | undefined,
+    );
+  }
+
+  if (shouldProtectUserBaseURL) {
+    if (!requestOptions.clientOptions) {
+      requestOptions.clientOptions = {};
+    }
+    mergeFetchOptions(requestOptions.clientOptions, {
+      dispatcher: new Agent({
+        connect: createSSRFSafeUndiciConnect(
+          options.allowedAddresses,
+          getEffectiveURLPort(options.reverseProxyUrl ?? ''),
+        ),
+      }),
+      redirect: 'error',
+    });
+  }
+
   return {
     tools,
     llmConfig: removeNullishValues(
diff --git a/packages/api/src/endpoints/bedrock/initialize.spec.ts b/packages/api/src/endpoints/bedrock/initialize.spec.ts
index decf9a7df93..a07fd9195a3 100644
--- a/packages/api/src/endpoints/bedrock/initialize.spec.ts
+++ b/packages/api/src/endpoints/bedrock/initialize.spec.ts
@@ -1,11 +1,12 @@
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 import {
   AuthType,
   EModelEndpoint,
   BEDROCK_OUTPUT_128K_BETA,
   BEDROCK_FINE_GRAINED_TOOL_STREAMING_BETA,
 } from 'librechat-data-provider';
-import { initializeBedrock } from './initialize';
 import type { BaseInitializeParams, BedrockLLMConfigResult } from '~/types';
+import { initializeBedrock } from './initialize';
 import { checkUserKeyExpiry } from '~/utils';
 
 jest.mock('https-proxy-agent', () => ({
@@ -16,6 +17,13 @@ jest.mock('@smithy/node-http-handler', () => ({
   NodeHttpHandler: jest.fn().mockImplementation((options) => ({ ...options })),
 }));
 
+jest.mock('@aws-sdk/credential-providers', () => ({
+  fromNodeProviderChain: jest.fn().mockImplementation((config) => {
+    const provider = jest.fn();
+    return Object.assign(provider, { config });
+  }),
+}));
+
 jest.mock('@aws-sdk/client-bedrock-runtime', () => ({
   BedrockRuntimeClient: jest.fn().mockImplementation((config) => ({
     ...config,
@@ -28,6 +36,7 @@ jest.mock('~/utils', () => ({
 }));
 
 const mockedCheckUserKeyExpiry = jest.mocked(checkUserKeyExpiry);
+const mockedFromNodeProviderChain = jest.mocked(fromNodeProviderChain);
 const BEDROCK_CLAUDE_4_BETAS = [BEDROCK_OUTPUT_128K_BETA, BEDROCK_FINE_GRAINED_TOOL_STREAMING_BETA];
 
 const createMockParams = (
@@ -66,6 +75,18 @@ describe('initializeBedrock', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     process.env = { ...originalEnv };
+    delete process.env.BEDROCK_AWS_BEARER_TOKEN;
+    delete process.env.BEDROCK_AWS_PROFILE;
+    delete process.env.BEDROCK_AWS_SESSION_TOKEN;
+    delete process.env.BEDROCK_REVERSE_PROXY;
+    delete process.env.PROXY;
+    delete process.env.proxy;
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.NO_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
     process.env.BEDROCK_AWS_ACCESS_KEY_ID = 'test-access-key';
     process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = 'test-secret-key';
     process.env.BEDROCK_AWS_DEFAULT_REGION = 'us-east-1';
@@ -121,6 +142,34 @@ describe('initializeBedrock', () => {
         sessionToken: 'test-session-token',
       });
     });
+
+    it('should pass BEDROCK_AWS_BEARER_TOKEN as a BedrockRuntimeClient token', async () => {
+      process.env.BEDROCK_AWS_BEARER_TOKEN = 'test-bedrock-api-key';
+      const params = createMockParams();
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(result.llmConfig).toHaveProperty('client');
+      expect(result.llmConfig.client).toHaveProperty('_isBedrockClient', true);
+      expect(result.llmConfig.client).toHaveProperty('token', {
+        token: 'test-bedrock-api-key',
+      });
+      expect(result.llmConfig.client).toHaveProperty('authSchemePreference', ['httpBearerAuth']);
+      expect(result.llmConfig).not.toHaveProperty('credentials');
+      expect(result.llmConfig).not.toHaveProperty('profile');
+    });
+
+    it('should pass AWS profile to ChatBedrockConverse when static credentials are unset', async () => {
+      delete process.env.BEDROCK_AWS_ACCESS_KEY_ID;
+      delete process.env.BEDROCK_AWS_SECRET_ACCESS_KEY;
+      process.env.BEDROCK_AWS_PROFILE = 'dev-profile';
+      const params = createMockParams();
+      const result = await initializeBedrock(params);
+
+      expect(result.llmConfig).toHaveProperty('profile', 'dev-profile');
+      expect(result.llmConfig).not.toHaveProperty('credentials');
+      expect(result.llmConfig).not.toHaveProperty('client');
+      expect(mockedFromNodeProviderChain).not.toHaveBeenCalled();
+    });
   });
 
   describe('GuardrailConfig', () => {
@@ -129,6 +178,7 @@ describe('initializeBedrock', () => {
         guardrailIdentifier: 'test-guardrail-id',
         guardrailVersion: '1',
         trace: 'enabled' as const,
+        streamProcessingMode: 'async',
       };
 
       const params = createMockParams({
@@ -209,6 +259,125 @@ describe('initializeBedrock', () => {
       expect(result.llmConfig.guardrailConfig).toEqual(guardrailConfig);
       expect(result.llmConfig.guardrailConfig?.trace).toBe('enabled_full');
     });
+
+    it.each([
+      {
+        description: 'guardrailIdentifier only',
+        envVars: { GUARDRAIL_ID: 'gr-abc123xyz' },
+        input: {
+          guardrailIdentifier: '${GUARDRAIL_ID}',
+          guardrailVersion: '1',
+        },
+        expected: {
+          guardrailIdentifier: 'gr-abc123xyz',
+          guardrailVersion: '1',
+        },
+      },
+      {
+        description: 'guardrailVersion only',
+        envVars: { GUARDRAIL_VERSION: 'DRAFT' },
+        input: {
+          guardrailIdentifier: 'static-guardrail-id',
+          guardrailVersion: '${GUARDRAIL_VERSION}',
+        },
+        expected: {
+          guardrailIdentifier: 'static-guardrail-id',
+          guardrailVersion: 'DRAFT',
+        },
+      },
+      {
+        description: 'both guardrailIdentifier and guardrailVersion',
+        envVars: { PROD_GUARDRAIL_ID: 'gr-production-123', PROD_GUARDRAIL_VERSION: '5' },
+        input: {
+          guardrailIdentifier: '${PROD_GUARDRAIL_ID}',
+          guardrailVersion: '${PROD_GUARDRAIL_VERSION}',
+          trace: 'enabled' as const,
+        },
+        expected: {
+          guardrailIdentifier: 'gr-production-123',
+          guardrailVersion: '5',
+          trace: 'enabled',
+        },
+      },
+      {
+        description: 'direct values when no env variable syntax is used',
+        envVars: {},
+        input: {
+          guardrailIdentifier: 'direct-guardrail-id',
+          guardrailVersion: '3',
+        },
+        expected: {
+          guardrailIdentifier: 'direct-guardrail-id',
+          guardrailVersion: '3',
+        },
+      },
+      {
+        description: 'fallback to original string when env variable is not set',
+        envVars: {},
+        deleteEnvVars: ['NONEXISTENT_GUARDRAIL_ID'],
+        input: {
+          guardrailIdentifier: '${NONEXISTENT_GUARDRAIL_ID}',
+          guardrailVersion: '1',
+        },
+        expected: {
+          guardrailIdentifier: '${NONEXISTENT_GUARDRAIL_ID}',
+          guardrailVersion: '1',
+        },
+      },
+      {
+        description: 'env variable with whitespace around it',
+        envVars: { TRIMMED_GUARDRAIL_ID: 'gr-trimmed-123' },
+        input: {
+          guardrailIdentifier: '  ${TRIMMED_GUARDRAIL_ID}  ',
+          guardrailVersion: '2',
+        },
+        expected: {
+          guardrailIdentifier: 'gr-trimmed-123',
+          guardrailVersion: '2',
+        },
+      },
+      {
+        description: 'preserve trace field when resolving env variables',
+        envVars: { GUARDRAIL_WITH_TRACE: 'gr-with-trace' },
+        input: {
+          guardrailIdentifier: '${GUARDRAIL_WITH_TRACE}',
+          guardrailVersion: '1',
+          trace: 'enabled_full' as const,
+        },
+        expected: {
+          guardrailIdentifier: 'gr-with-trace',
+          guardrailVersion: '1',
+          trace: 'enabled_full',
+        },
+      },
+    ])(
+      'should resolve environment variables: $description',
+      async ({ envVars, deleteEnvVars, input, expected }) => {
+        // Set up environment variables
+        Object.entries(envVars).forEach(([key, value]) => {
+          process.env[key] = value;
+        });
+
+        // Delete specified environment variables
+        deleteEnvVars?.forEach((key) => {
+          delete process.env[key];
+        });
+
+        const params = createMockParams({
+          config: {
+            endpoints: {
+              [EModelEndpoint.bedrock]: {
+                guardrailConfig: input,
+              },
+            },
+          },
+        });
+
+        const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+        expect(result.llmConfig.guardrailConfig).toEqual(expected);
+      },
+    );
   });
 
   describe('Proxy Configuration', () => {
@@ -234,6 +403,34 @@ describe('initializeBedrock', () => {
         'https://custom-bedrock-endpoint.com',
       );
     });
+
+    it('should honor NO_PROXY for reverse proxy endpoints when PROXY is set', async () => {
+      process.env.PROXY = 'http://proxy:8080';
+      process.env.NO_PROXY = 'custom-bedrock-endpoint.com';
+      process.env.BEDROCK_REVERSE_PROXY = 'custom-bedrock-endpoint.com';
+      const params = createMockParams();
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(result.llmConfig).not.toHaveProperty('client');
+      expect(result.llmConfig).toHaveProperty('endpointHost', 'custom-bedrock-endpoint.com');
+    });
+
+    it('should use AWS profile provider when PROXY is set and static credentials are unset', async () => {
+      delete process.env.BEDROCK_AWS_ACCESS_KEY_ID;
+      delete process.env.BEDROCK_AWS_SECRET_ACCESS_KEY;
+      process.env.BEDROCK_AWS_PROFILE = 'dev-profile';
+      process.env.PROXY = 'http://proxy:8080';
+      const params = createMockParams();
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(mockedFromNodeProviderChain).toHaveBeenCalledWith({ profile: 'dev-profile' });
+      expect(result.llmConfig).toHaveProperty('client');
+      expect(result.llmConfig).not.toHaveProperty('credentials');
+
+      const client = result.llmConfig.client as unknown as Record<string, unknown>;
+      const credentials = client.credentials as { config?: Record<string, string> };
+      expect(credentials.config).toEqual({ profile: 'dev-profile' });
+    });
   });
 
   describe('Reverse Proxy Configuration', () => {
@@ -249,6 +446,7 @@ describe('initializeBedrock', () => {
 
   describe('User-Provided Credentials', () => {
     it('should fetch credentials from database when user-provided', async () => {
+      process.env.BEDROCK_AWS_ACCESS_KEY_ID = AuthType.USER_PROVIDED;
       process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = AuthType.USER_PROVIDED;
       const params = createMockParams({
         body: { key: '2024-12-31T23:59:59Z' },
@@ -277,6 +475,100 @@ describe('initializeBedrock', () => {
 
       expect(mockedCheckUserKeyExpiry).toHaveBeenCalledWith(expiresAt, EModelEndpoint.bedrock);
     });
+
+    it('should fetch a user-provided Bedrock API key from database', async () => {
+      process.env.BEDROCK_AWS_BEARER_TOKEN = AuthType.USER_PROVIDED;
+      const params = createMockParams();
+      (params.db.getUserKey as jest.Mock).mockResolvedValue(
+        JSON.stringify({
+          apiKey: JSON.stringify({
+            bearerToken: 'user-bedrock-api-key',
+          }),
+        }),
+      );
+
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(params.db.getUserKey).toHaveBeenCalledWith({
+        userId: 'test-user-id',
+        name: EModelEndpoint.bedrock,
+      });
+      expect(result.llmConfig).toHaveProperty('client');
+      expect(result.llmConfig.client).toHaveProperty('token', {
+        token: 'user-bedrock-api-key',
+      });
+      expect(result.llmConfig.client).toHaveProperty('authSchemePreference', ['httpBearerAuth']);
+      expect(result.llmConfig).not.toHaveProperty('credentials');
+    });
+
+    it('should reject a non-string user-provided Bedrock API key', async () => {
+      process.env.BEDROCK_AWS_BEARER_TOKEN = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_ACCESS_KEY_ID = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = AuthType.USER_PROVIDED;
+      const params = createMockParams();
+      (params.db.getUserKey as jest.Mock).mockResolvedValue(
+        JSON.stringify({
+          apiKey: JSON.stringify({
+            bearerToken: {},
+            accessKeyId: 'user-access-key',
+            secretAccessKey: 'user-secret-key',
+          }),
+        }),
+      );
+
+      await expect(initializeBedrock(params)).rejects.toThrow(
+        'Bedrock credentials not provided. Please provide them again.',
+      );
+    });
+
+    it('should not use stored access keys when only bearer token mode is configured', async () => {
+      process.env.BEDROCK_AWS_BEARER_TOKEN = AuthType.USER_PROVIDED;
+      const params = createMockParams();
+
+      await expect(initializeBedrock(params)).rejects.toThrow(
+        'Bedrock credentials not provided. Please provide them again.',
+      );
+    });
+
+    it('should merge user-provided access key ID with static secret access key', async () => {
+      process.env.BEDROCK_AWS_ACCESS_KEY_ID = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = 'static-secret-key';
+      const params = createMockParams();
+      (params.db.getUserKey as jest.Mock).mockResolvedValue(
+        JSON.stringify({
+          apiKey: JSON.stringify({
+            accessKeyId: 'user-access-key',
+            bearerToken: 'ignored-bedrock-api-key',
+          }),
+        }),
+      );
+
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(result.llmConfig.credentials).toEqual({
+        accessKeyId: 'user-access-key',
+        secretAccessKey: 'static-secret-key',
+      });
+      expect(result.llmConfig).not.toHaveProperty('client');
+    });
+
+    it('should reject non-string user-provided access key values', async () => {
+      process.env.BEDROCK_AWS_ACCESS_KEY_ID = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = AuthType.USER_PROVIDED;
+      const params = createMockParams();
+      (params.db.getUserKey as jest.Mock).mockResolvedValue(
+        JSON.stringify({
+          apiKey: JSON.stringify({
+            accessKeyId: {},
+            secretAccessKey: 'user-secret-key',
+          }),
+        }),
+      );
+
+      await expect(initializeBedrock(params)).rejects.toThrow(
+        'Bedrock credentials not provided. Please provide them again.',
+      );
+    });
   });
 
   describe('Credentials Edge Cases', () => {
@@ -298,6 +590,15 @@ describe('initializeBedrock', () => {
       expect(result.llmConfig.credentials).toBeUndefined();
     });
 
+    it('should throw when only one static credential value is set', async () => {
+      delete process.env.BEDROCK_AWS_SECRET_ACCESS_KEY;
+      const params = createMockParams();
+
+      await expect(initializeBedrock(params)).rejects.toThrow(
+        'Both BEDROCK_AWS_ACCESS_KEY_ID and BEDROCK_AWS_SECRET_ACCESS_KEY must be provided together.',
+      );
+    });
+
     it('should throw error when user-provided credentials are not found', async () => {
       process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = AuthType.USER_PROVIDED;
       const params = createMockParams();
diff --git a/packages/api/src/endpoints/bedrock/initialize.ts b/packages/api/src/endpoints/bedrock/initialize.ts
index f3ba459ba58..09307dfba06 100644
--- a/packages/api/src/endpoints/bedrock/initialize.ts
+++ b/packages/api/src/endpoints/bedrock/initialize.ts
@@ -1,5 +1,5 @@
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 import { BedrockRuntimeClient } from '@aws-sdk/client-bedrock-runtime';
 import {
   AuthType,
@@ -9,6 +9,7 @@ import {
   bedrockOutputParser,
   removeNullishValues,
 } from 'librechat-data-provider';
+import type { BedrockRuntimeClientConfig } from '@aws-sdk/client-bedrock-runtime';
 import type {
   BaseInitializeParams,
   InitializeResultBase,
@@ -16,8 +17,69 @@ import type {
   GuardrailConfiguration,
   InferenceProfileConfig,
 } from '~/types';
+import { getHttpsProxyAgent } from '~/utils/proxy';
 import { checkUserKeyExpiry } from '~/utils';
 
+const BEDROCK_CREDENTIALS_ERROR = 'Bedrock credentials not provided. Please provide them again.';
+
+type UserCredentialKey = 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'bearerToken';
+type UserCredentialValue = string | number | boolean | object | null;
+type ParsedBedrockUserCredentials = Partial<Record<UserCredentialKey, UserCredentialValue>> & {
+  apiKey?: string;
+};
+
+function getBedrockProxyTarget(region?: string, reverseProxy?: string): string | undefined {
+  const trimmedReverseProxy = reverseProxy?.trim();
+  if (trimmedReverseProxy) return `https://${trimmedReverseProxy}`;
+
+  const trimmedRegion = region?.trim();
+  if (!trimmedRegion) return undefined;
+
+  return `https://bedrock-runtime.${trimmedRegion}.amazonaws.com`;
+}
+
+function isParsedBedrockUserCredentials(value: unknown): value is ParsedBedrockUserCredentials {
+  return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function parseBedrockUserCredentials(userKey: string): ParsedBedrockUserCredentials {
+  const storedCredentials = JSON.parse(userKey) as unknown;
+  if (!isParsedBedrockUserCredentials(storedCredentials)) {
+    throw new Error(BEDROCK_CREDENTIALS_ERROR);
+  }
+
+  if (typeof storedCredentials.apiKey !== 'string') {
+    return storedCredentials;
+  }
+
+  const nestedCredentials = JSON.parse(storedCredentials.apiKey) as unknown;
+  if (!isParsedBedrockUserCredentials(nestedCredentials)) {
+    throw new Error(BEDROCK_CREDENTIALS_ERROR);
+  }
+
+  return nestedCredentials;
+}
+
+function getUserCredentialValue(
+  credentials: ParsedBedrockUserCredentials,
+  key: UserCredentialKey,
+): string | undefined {
+  if (!Object.prototype.hasOwnProperty.call(credentials, key)) {
+    return undefined;
+  }
+
+  const value = credentials[key];
+  if (value === '') {
+    return undefined;
+  }
+
+  if (typeof value !== 'string') {
+    throw new Error(BEDROCK_CREDENTIALS_ERROR);
+  }
+
+  return value;
+}
+
 /**
  * Initializes Bedrock endpoint configuration.
  *
@@ -25,8 +87,8 @@ import { checkUserKeyExpiry } from '~/utils';
  * HTTP/HTTPS proxies and reverse proxies.
  *
  * Proxy Support:
- * - When the PROXY environment variable is set, creates a custom BedrockRuntimeClient
- *   with an HttpsProxyAgent to route all Bedrock API calls through the specified proxy
+ * - When proxy env vars are set, creates a custom BedrockRuntimeClient
+ *   with an HttpsProxyAgent to route Bedrock API calls through the resolved proxy
  * - The custom client is fully configured with credentials, region, and endpoint,
  *   and is passed directly to ChatBedrockConverse via the 'client' parameter
  *
@@ -61,38 +123,97 @@ export async function initializeBedrock({
     BEDROCK_AWS_SECRET_ACCESS_KEY,
     BEDROCK_AWS_ACCESS_KEY_ID,
     BEDROCK_AWS_SESSION_TOKEN,
+    BEDROCK_AWS_PROFILE,
+    BEDROCK_AWS_BEARER_TOKEN,
     BEDROCK_REVERSE_PROXY,
     BEDROCK_AWS_DEFAULT_REGION,
-    PROXY,
   } = process.env;
 
   const { key: expiresAt } = req.body;
-  const isUserProvided = BEDROCK_AWS_SECRET_ACCESS_KEY === AuthType.USER_PROVIDED;
-
-  let credentials: BedrockCredentials | undefined = isUserProvided
-    ? await db
-        .getUserKey({ userId: req.user?.id ?? '', name: EModelEndpoint.bedrock })
-        .then((key) => JSON.parse(key) as BedrockCredentials)
-    : {
-        accessKeyId: BEDROCK_AWS_ACCESS_KEY_ID,
-        secretAccessKey: BEDROCK_AWS_SECRET_ACCESS_KEY,
-        ...(BEDROCK_AWS_SESSION_TOKEN && { sessionToken: BEDROCK_AWS_SESSION_TOKEN }),
-      };
+  const userProvidesAccessKeyId = BEDROCK_AWS_ACCESS_KEY_ID === AuthType.USER_PROVIDED;
+  const userProvidesSecretAccessKey = BEDROCK_AWS_SECRET_ACCESS_KEY === AuthType.USER_PROVIDED;
+  const userProvidesSessionToken = BEDROCK_AWS_SESSION_TOKEN === AuthType.USER_PROVIDED;
+  const userProvidesBearerToken = BEDROCK_AWS_BEARER_TOKEN === AuthType.USER_PROVIDED;
+  const isUserProvided =
+    userProvidesAccessKeyId ||
+    userProvidesSecretAccessKey ||
+    userProvidesSessionToken ||
+    userProvidesBearerToken;
+  const staticAccessKeyId = userProvidesAccessKeyId ? undefined : BEDROCK_AWS_ACCESS_KEY_ID;
+  const staticSecretAccessKey = userProvidesSecretAccessKey
+    ? undefined
+    : BEDROCK_AWS_SECRET_ACCESS_KEY;
+  const staticSessionToken = userProvidesSessionToken ? undefined : BEDROCK_AWS_SESSION_TOKEN;
+  const staticBearerToken = userProvidesBearerToken ? undefined : BEDROCK_AWS_BEARER_TOKEN;
 
-  if (!credentials) {
-    throw new Error('Bedrock credentials not provided. Please provide them again.');
-  }
+  const hasAccessKey = staticAccessKeyId != null && staticAccessKeyId !== '';
+  const hasSecretKey = staticSecretAccessKey != null && staticSecretAccessKey !== '';
 
-  if (
-    !isUserProvided &&
-    (credentials.accessKeyId === undefined || credentials.accessKeyId === '') &&
-    (credentials.secretAccessKey === undefined || credentials.secretAccessKey === '')
-  ) {
-    credentials = undefined;
-  }
+  let credentials: BedrockCredentials | undefined;
+  let bearerToken: string | undefined;
 
-  if (expiresAt && isUserProvided) {
-    checkUserKeyExpiry(expiresAt, EModelEndpoint.bedrock);
+  if (isUserProvided) {
+    const userKey = await db.getUserKey({
+      userId: req.user?.id ?? '',
+      name: EModelEndpoint.bedrock,
+    });
+
+    if (!userKey) {
+      throw new Error(BEDROCK_CREDENTIALS_ERROR);
+    }
+
+    let userCredentials: ParsedBedrockUserCredentials;
+    try {
+      userCredentials = parseBedrockUserCredentials(userKey);
+    } catch {
+      throw new Error(BEDROCK_CREDENTIALS_ERROR);
+    }
+
+    const userBearerToken = userProvidesBearerToken
+      ? getUserCredentialValue(userCredentials, 'bearerToken')
+      : undefined;
+
+    if (userBearerToken) {
+      bearerToken = userBearerToken;
+    } else {
+      const canUseAccessKeys =
+        userProvidesAccessKeyId || userProvidesSecretAccessKey || userProvidesSessionToken;
+      const accessKeyId = userProvidesAccessKeyId
+        ? getUserCredentialValue(userCredentials, 'accessKeyId')
+        : staticAccessKeyId;
+      const secretAccessKey = userProvidesSecretAccessKey
+        ? getUserCredentialValue(userCredentials, 'secretAccessKey')
+        : staticSecretAccessKey;
+      const sessionToken = userProvidesSessionToken
+        ? getUserCredentialValue(userCredentials, 'sessionToken')
+        : staticSessionToken;
+
+      if (!canUseAccessKeys || !accessKeyId || !secretAccessKey) {
+        throw new Error(BEDROCK_CREDENTIALS_ERROR);
+      }
+
+      credentials = {
+        accessKeyId,
+        secretAccessKey,
+        ...(sessionToken && { sessionToken }),
+      };
+    }
+
+    if (expiresAt) {
+      checkUserKeyExpiry(expiresAt, EModelEndpoint.bedrock);
+    }
+  } else if (staticBearerToken) {
+    bearerToken = staticBearerToken;
+  } else if (hasAccessKey !== hasSecretKey) {
+    throw new Error(
+      'Both BEDROCK_AWS_ACCESS_KEY_ID and BEDROCK_AWS_SECRET_ACCESS_KEY must be provided together.',
+    );
+  } else if (hasAccessKey && hasSecretKey) {
+    credentials = {
+      accessKeyId: staticAccessKeyId,
+      secretAccessKey: staticSecretAccessKey,
+      ...(staticSessionToken && { sessionToken: staticSessionToken }),
+    };
   }
 
   const requestOptions: Record<string, unknown> = {
@@ -115,12 +236,17 @@ export async function initializeBedrock({
     client?: BedrockRuntimeClient;
     credentials?: BedrockCredentials;
     endpointHost?: string;
+    profile?: string;
     guardrailConfig?: GuardrailConfiguration;
     applicationInferenceProfile?: string;
   };
 
   if (bedrockConfig?.guardrailConfig) {
-    llmConfig.guardrailConfig = bedrockConfig.guardrailConfig;
+    llmConfig.guardrailConfig = {
+      ...bedrockConfig.guardrailConfig,
+      guardrailIdentifier: extractEnvVariable(bedrockConfig.guardrailConfig.guardrailIdentifier),
+      guardrailVersion: extractEnvVariable(bedrockConfig.guardrailConfig.guardrailVersion),
+    };
   }
 
   const model = model_parameters?.model as string | undefined;
@@ -136,28 +262,51 @@ export async function initializeBedrock({
     credentials.accessKeyId !== '' &&
     typeof credentials.secretAccessKey === 'string' &&
     credentials.secretAccessKey !== '';
+  const hasBearerToken = typeof bearerToken === 'string' && bearerToken !== '';
 
-  if (PROXY) {
-    const proxyAgent = new HttpsProxyAgent(PROXY);
+  const bedrockRegion = typeof llmConfig.region === 'string' ? llmConfig.region : undefined;
+  const proxyAgent = getHttpsProxyAgent(
+    getBedrockProxyTarget(bedrockRegion, BEDROCK_REVERSE_PROXY),
+  );
+  if (proxyAgent || hasBearerToken) {
+    const credentialProvider =
+      !hasCompleteCredentials && !hasBearerToken && BEDROCK_AWS_PROFILE
+        ? fromNodeProviderChain({ profile: BEDROCK_AWS_PROFILE })
+        : undefined;
 
-    // Create a custom BedrockRuntimeClient with proxy-enabled request handler.
+    // Create a custom BedrockRuntimeClient for proxy routing or Bedrock API keys.
     // ChatBedrockConverse will use this pre-configured client directly instead of
     // creating its own. Credentials are only set if explicitly provided; otherwise
     // the AWS SDK's default credential provider chain is used (instance profiles,
     // AWS profiles, environment variables, etc.)
-    const customClient = new BedrockRuntimeClient({
+    const customClientConfig: BedrockRuntimeClientConfig = {
       region: (llmConfig.region as string) ?? BEDROCK_AWS_DEFAULT_REGION,
-      ...(hasCompleteCredentials && {
-        credentials: credentials as { accessKeyId: string; secretAccessKey: string },
-      }),
-      requestHandler: new NodeHttpHandler({
+    };
+
+    if (hasBearerToken && bearerToken) {
+      customClientConfig.token = { token: bearerToken };
+      customClientConfig.authSchemePreference = ['httpBearerAuth'];
+    } else if (hasCompleteCredentials) {
+      customClientConfig.credentials = credentials as {
+        accessKeyId: string;
+        secretAccessKey: string;
+      };
+    } else if (credentialProvider) {
+      customClientConfig.credentials = credentialProvider;
+    }
+
+    if (proxyAgent) {
+      customClientConfig.requestHandler = new NodeHttpHandler({
         httpAgent: proxyAgent,
         httpsAgent: proxyAgent,
-      }),
-      ...(BEDROCK_REVERSE_PROXY && {
-        endpoint: `https://${BEDROCK_REVERSE_PROXY}`,
-      }),
-    });
+      });
+    }
+
+    if (BEDROCK_REVERSE_PROXY) {
+      customClientConfig.endpoint = `https://${BEDROCK_REVERSE_PROXY}`;
+    }
+
+    const customClient = new BedrockRuntimeClient(customClientConfig);
 
     llmConfig.client = customClient;
   } else {
@@ -167,6 +316,10 @@ export async function initializeBedrock({
       llmConfig.credentials = credentials;
     }
 
+    if (!credentials && BEDROCK_AWS_PROFILE) {
+      llmConfig.profile = BEDROCK_AWS_PROFILE;
+    }
+
     if (BEDROCK_REVERSE_PROXY) {
       llmConfig.endpointHost = BEDROCK_REVERSE_PROXY;
     }
diff --git a/packages/api/src/endpoints/config/endpoints.spec.ts b/packages/api/src/endpoints/config/endpoints.spec.ts
index b01b5c1c500..10feda40347 100644
--- a/packages/api/src/endpoints/config/endpoints.spec.ts
+++ b/packages/api/src/endpoints/config/endpoints.spec.ts
@@ -1,17 +1,45 @@
+import { Types } from 'mongoose';
 import {
+  AuthType,
   AgentCapabilities,
   EModelEndpoint,
+  PrincipalType,
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
-import { createEndpointsConfigService } from './endpoints';
-import type { AppConfig } from '@librechat/data-schemas';
+
+import type { AppConfig, IConfig } from '@librechat/data-schemas';
+import type { AppConfigServiceDeps } from '~/app/service';
 import type { EndpointsConfigDeps } from './endpoints';
 import type { ServerRequest } from '~/types';
 
+import { createEndpointsConfigService } from './endpoints';
+import { createAppConfigService } from '~/app/service';
+
 function appConfig(partial: Record<string, unknown>): AppConfig {
   return partial as unknown as AppConfig;
 }
 
+function configDoc(partial: Record<string, unknown>): IConfig {
+  return partial as unknown as IConfig;
+}
+
+function createAppConfigCache() {
+  const store = new Map<string, unknown>();
+  return {
+    get: jest.fn((key: string) => Promise.resolve(store.get(key))),
+    set: jest.fn((key: string, value: unknown) => {
+      store.set(key, value);
+      return Promise.resolve(undefined);
+    }),
+    delete: jest.fn((key: string) => {
+      store.delete(key);
+      return Promise.resolve(true);
+    }),
+  };
+}
+
+type ConfigPrincipals = NonNullable<Parameters<AppConfigServiceDeps['getApplicableConfigs']>[0]>;
+
 function createMockDeps(overrides: Partial<EndpointsConfigDeps> = {}): EndpointsConfigDeps {
   return {
     getAppConfig: jest.fn().mockResolvedValue(appConfig({ endpoints: {} })),
@@ -23,7 +51,13 @@ function createMockDeps(overrides: Partial<EndpointsConfigDeps> = {}): Endpoints
   };
 }
 
-function fakeReq(overrides: Partial<ServerRequest> = {}): ServerRequest {
+type TestRequestOverrides = {
+  body?: Partial<ServerRequest['body']>;
+  config?: AppConfig;
+  user?: { id?: string; role?: string; tenantId?: string };
+};
+
+function fakeReq(overrides: TestRequestOverrides = {}): ServerRequest {
   return { user: { id: 'u1', role: 'USER' }, ...overrides } as ServerRequest;
 }
 
@@ -163,6 +197,47 @@ describe('createEndpointsConfigService', () => {
       ]);
     });
 
+    it('exposes Bedrock user-provided credential options', async () => {
+      const previousEnv = {
+        BEDROCK_AWS_ACCESS_KEY_ID: process.env.BEDROCK_AWS_ACCESS_KEY_ID,
+        BEDROCK_AWS_SECRET_ACCESS_KEY: process.env.BEDROCK_AWS_SECRET_ACCESS_KEY,
+        BEDROCK_AWS_SESSION_TOKEN: process.env.BEDROCK_AWS_SESSION_TOKEN,
+        BEDROCK_AWS_BEARER_TOKEN: process.env.BEDROCK_AWS_BEARER_TOKEN,
+      };
+
+      process.env.BEDROCK_AWS_ACCESS_KEY_ID = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_SESSION_TOKEN = AuthType.USER_PROVIDED;
+      process.env.BEDROCK_AWS_BEARER_TOKEN = AuthType.USER_PROVIDED;
+
+      try {
+        const deps = createMockDeps({
+          loadDefaultEndpointsConfig: jest.fn().mockResolvedValue({
+            [EModelEndpoint.bedrock]: { userProvide: false, order: 0 },
+          }),
+        });
+        const { getEndpointsConfig } = createEndpointsConfigService(deps);
+        const result = await getEndpointsConfig(fakeReq());
+
+        expect(result?.[EModelEndpoint.bedrock]).toEqual(
+          expect.objectContaining({
+            userProvideAccessKeyId: true,
+            userProvideSecretAccessKey: true,
+            userProvideSessionToken: true,
+            userProvideBearerToken: true,
+          }),
+        );
+      } finally {
+        Object.entries(previousEnv).forEach(([key, value]) => {
+          if (value == null) {
+            delete process.env[key];
+          } else {
+            process.env[key] = value;
+          }
+        });
+      }
+    });
+
     it('uses req.config when available instead of calling getAppConfig', async () => {
       const mockGetAppConfig = jest.fn();
       const deps = createMockDeps({ getAppConfig: mockGetAppConfig });
@@ -172,6 +247,81 @@ describe('createEndpointsConfigService', () => {
 
       expect(mockGetAppConfig).not.toHaveBeenCalled();
     });
+
+    it('passes userId when resolving scoped endpoint config', async () => {
+      const mockGetAppConfig = jest.fn().mockResolvedValue(appConfig({ endpoints: {} }));
+      const deps = createMockDeps({ getAppConfig: mockGetAppConfig });
+      const { getEndpointsConfig } = createEndpointsConfigService(deps);
+
+      await getEndpointsConfig(fakeReq({ user: { id: 'u1', role: 'USER', tenantId: 'tenant-a' } }));
+
+      expect(mockGetAppConfig).toHaveBeenCalledWith({
+        role: 'USER',
+        userId: 'u1',
+        tenantId: 'tenant-a',
+      });
+    });
+
+    it('exposes custom endpoints from group-scoped overrides for grouped users', async () => {
+      const groupId = new Types.ObjectId('6a0aea2172e2d59d4658c9d2');
+      const getUserPrincipals = jest.fn().mockResolvedValue([
+        { principalType: PrincipalType.ROLE, principalId: 'USER' },
+        { principalType: PrincipalType.USER, principalId: 'u1' },
+        { principalType: PrincipalType.GROUP, principalId: groupId },
+      ]);
+      const getApplicableConfigs = jest.fn((principals: ConfigPrincipals = []) =>
+        Promise.resolve(
+          principals.some(
+            (principal) =>
+              principal.principalType === PrincipalType.GROUP &&
+              String(principal.principalId) === groupId.toString(),
+          )
+            ? [
+                configDoc({
+                  principalType: PrincipalType.GROUP,
+                  principalId: groupId,
+                  priority: 20,
+                  isActive: true,
+                  overrides: {
+                    endpoints: {
+                      custom: [
+                        {
+                          name: 'FOO',
+                          apiKey: '${FOO_KEY}',
+                          baseURL: '${FOO_URL}',
+                          models: { fetch: true },
+                        },
+                      ],
+                    },
+                  },
+                }),
+              ]
+            : [],
+        ),
+      );
+      const { getAppConfig } = createAppConfigService({
+        loadBaseConfig: jest.fn().mockResolvedValue(appConfig({ endpoints: {} })),
+        setCachedTools: jest.fn().mockResolvedValue(undefined),
+        getCache: jest.fn().mockReturnValue(createAppConfigCache()),
+        cacheKeys: { APP_CONFIG: 'app_config' },
+        getApplicableConfigs,
+        getUserPrincipals,
+      });
+      const { getEndpointsConfig } = createEndpointsConfigService({
+        getAppConfig,
+        loadDefaultEndpointsConfig: jest.fn().mockResolvedValue({}),
+      });
+
+      const result = await getEndpointsConfig(fakeReq({ user: { id: 'u1', role: 'USER' } }));
+
+      expect(getUserPrincipals).toHaveBeenCalledWith({ userId: 'u1', role: 'USER' });
+      expect(getApplicableConfigs).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({ principalType: PrincipalType.GROUP, principalId: groupId }),
+        ]),
+      );
+      expect(result?.FOO).toEqual(expect.objectContaining({ type: EModelEndpoint.custom }));
+    });
   });
 
   describe('checkCapability', () => {
diff --git a/packages/api/src/endpoints/config/endpoints.ts b/packages/api/src/endpoints/config/endpoints.ts
index 1a6b98d195c..32ec6769a54 100644
--- a/packages/api/src/endpoints/config/endpoints.ts
+++ b/packages/api/src/endpoints/config/endpoints.ts
@@ -1,25 +1,33 @@
 import {
+  AuthType,
   EModelEndpoint,
   isAgentsEndpoint,
   orderEndpointsConfig,
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
-import type { AppConfig } from '@librechat/data-schemas';
 import type { AgentCapabilities, TEndpointsConfig, TConfig } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
 import type { ServerRequest, TCustomEndpointsConfig } from '~/types';
 import { loadCustomEndpointsConfig as defaultLoadCustomEndpoints } from '~/endpoints/custom';
 
-type PartialEndpointEntry = Partial<TConfig>;
+type PartialEndpointEntry = Partial<TConfig> & Record<string, unknown>;
 type DefaultEndpointsResult = Record<string, PartialEndpointEntry | false | null>;
 type MutableEndpointsConfig = Record<string, PartialEndpointEntry | false | null | undefined>;
 
 export interface EndpointsConfigDeps {
-  getAppConfig: (params: { role?: string | null; tenantId?: string }) => Promise<AppConfig>;
+  getAppConfig: (params: {
+    role?: string;
+    userId?: string;
+    tenantId?: string;
+  }) => Promise<AppConfig>;
   loadDefaultEndpointsConfig: (appConfig: AppConfig) => Promise<DefaultEndpointsResult>;
   loadCustomEndpointsConfig?: (custom: unknown) => TCustomEndpointsConfig | undefined;
 }
 
-export function createEndpointsConfigService(deps: EndpointsConfigDeps) {
+export function createEndpointsConfigService(deps: EndpointsConfigDeps): {
+  getEndpointsConfig: (req: ServerRequest) => Promise<TEndpointsConfig>;
+  checkCapability: (req: ServerRequest, capability: AgentCapabilities) => Promise<boolean>;
+} {
   const {
     getAppConfig,
     loadDefaultEndpointsConfig,
@@ -28,7 +36,12 @@ export function createEndpointsConfigService(deps: EndpointsConfigDeps) {
 
   async function getEndpointsConfig(req: ServerRequest): Promise<TEndpointsConfig> {
     const appConfig =
-      req.config ?? (await getAppConfig({ role: req.user?.role, tenantId: req.user?.tenantId }));
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
     const defaultEndpointsConfig = await loadDefaultEndpointsConfig(appConfig);
     const customEndpointsConfig = loadCustomEndpointsConfig(appConfig?.endpoints?.custom);
 
@@ -100,6 +113,17 @@ export function createEndpointsConfigService(deps: EndpointsConfigDeps) {
       };
     }
 
+    if (mergedConfig[EModelEndpoint.bedrock]) {
+      mergedConfig[EModelEndpoint.bedrock] = {
+        ...mergedConfig[EModelEndpoint.bedrock],
+        userProvideAccessKeyId: process.env.BEDROCK_AWS_ACCESS_KEY_ID === AuthType.USER_PROVIDED,
+        userProvideSecretAccessKey:
+          process.env.BEDROCK_AWS_SECRET_ACCESS_KEY === AuthType.USER_PROVIDED,
+        userProvideSessionToken: process.env.BEDROCK_AWS_SESSION_TOKEN === AuthType.USER_PROVIDED,
+        userProvideBearerToken: process.env.BEDROCK_AWS_BEARER_TOKEN === AuthType.USER_PROVIDED,
+      };
+    }
+
     return orderEndpointsConfig(mergedConfig as TEndpointsConfig);
   }
 
diff --git a/packages/api/src/endpoints/config/models.spec.ts b/packages/api/src/endpoints/config/models.spec.ts
new file mode 100644
index 00000000000..1f748bfcbe3
--- /dev/null
+++ b/packages/api/src/endpoints/config/models.spec.ts
@@ -0,0 +1,299 @@
+import { AuthType, EModelEndpoint } from 'librechat-data-provider';
+import type { ServerRequest } from '~/types';
+
+const mockValidateEndpointURL = jest.fn().mockResolvedValue(undefined);
+jest.mock('~/auth', () => ({
+  validateEndpointURL: (...args: unknown[]) => mockValidateEndpointURL(...args),
+}));
+
+jest.mock('~/utils', () => {
+  const original = jest.requireActual('~/utils');
+  return {
+    ...original,
+    // Inline literal — jest.mock() factory may not reference imports.
+    isUserProvided: (val: string) => val === 'user_provided',
+  };
+});
+
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from '../keys';
+import { createLoadConfigModels } from './models';
+
+describe('createLoadConfigModels – user-provided baseURL header guard', () => {
+  const fetchModels = jest.fn().mockResolvedValue([]);
+
+  const buildAppConfig = (endpointOverrides: Record<string, unknown>) => ({
+    endpoints: {
+      [EModelEndpoint.custom]: [
+        {
+          name: 'TestProxy',
+          baseURL: AuthType.USER_PROVIDED,
+          apiKey: AuthType.USER_PROVIDED,
+          models: { fetch: true },
+          ...endpointOverrides,
+        },
+      ],
+    },
+  });
+
+  beforeEach(() => {
+    fetchModels.mockReset().mockResolvedValue([]);
+    mockValidateEndpointURL.mockReset().mockResolvedValue(undefined);
+  });
+
+  it('does NOT forward configured headers when baseURL is user-provided', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(buildAppConfig({ headers })),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: 'https://user-controlled.example.com/v1',
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1', email: 'user@example.com' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    expect(mockValidateEndpointURL).toHaveBeenCalledWith(
+      'https://user-controlled.example.com/v1',
+      'TestProxy',
+      undefined,
+    );
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'TestProxy',
+        baseURL: 'https://user-controlled.example.com/v1',
+        baseURLIsUserProvided: true,
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('uses the user API key when baseURL is user-provided', async () => {
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(
+        buildAppConfig({
+          apiKey: 'sk-system-key',
+        }),
+      ),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: 'https://user-controlled.example.com/v1',
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1', email: 'user@example.com' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'TestProxy',
+        apiKey: 'sk-user-key',
+        baseURL: 'https://user-controlled.example.com/v1',
+      }),
+    );
+    expect(fetchModels).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        apiKey: 'sk-system-key',
+      }),
+    );
+  });
+
+  it('does NOT call fetchModels when user-provided baseURL validation fails', async () => {
+    mockValidateEndpointURL.mockRejectedValueOnce(new Error('blocked SSRF target'));
+
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(buildAppConfig({})),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: 'http://127.0.0.1:11434/v1',
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    const modelsConfig = await loadConfigModels(req);
+
+    expect(fetchModels).not.toHaveBeenCalled();
+    expect(modelsConfig.TestProxy).toEqual([]);
+  });
+
+  it('DOES forward configured headers when baseURL is admin-trusted (only apiKey is user-provided)', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+    };
+
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'TrustedProxy',
+              baseURL: 'https://admin-trusted.example.com/v1',
+              apiKey: AuthType.USER_PROVIDED,
+              models: { fetch: true },
+              headers,
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: undefined,
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'TrustedProxy',
+        baseURL: 'https://admin-trusted.example.com/v1',
+        baseURLIsUserProvided: false,
+        headers,
+      }),
+    );
+  });
+
+  it('tenant-scopes the fetched token config cache key for system-defined endpoints', async () => {
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(
+        buildAppConfig({
+          baseURL: 'https://admin-trusted.example.com/v1',
+          apiKey: 'sk-system-key',
+        }),
+      ),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    const tokenKey = fetchModels.mock.calls[0][0].tokenKey;
+    expect(fetchModels.mock.calls[0][0].name).toBe('TestProxy');
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-a:TestProxy');
+    expect(tokenKey).not.toContain('tenant-a');
+    expect(tokenKey).not.toContain('TestProxy');
+  });
+});
+
+describe('createLoadConfigModels – in-request fetch coalescing', () => {
+  const fetchModels = jest.fn().mockResolvedValue([]);
+
+  beforeEach(() => {
+    fetchModels.mockReset().mockResolvedValue([]);
+  });
+
+  it('does NOT coalesce two endpoints with the same baseURL+apiKey but different headers', async () => {
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'TenantA',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: { 'X-Tenant': 'a' },
+            },
+            {
+              name: 'TenantB',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: { 'X-Tenant': 'b' },
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(2);
+    const headersByName = new Map<string, Record<string, string> | undefined>();
+    for (const call of fetchModels.mock.calls) {
+      headersByName.set(call[0].name, call[0].headers);
+    }
+    expect(headersByName.get('TenantA')).toEqual({ 'X-Tenant': 'a' });
+    expect(headersByName.get('TenantB')).toEqual({ 'X-Tenant': 'b' });
+  });
+
+  it('still coalesces two endpoints that share baseURL+apiKey AND identical headers', async () => {
+    const sharedHeaders = { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' };
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'AliasOne',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: sharedHeaders,
+            },
+            {
+              name: 'AliasTwo',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: sharedHeaders,
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    // Same baseURL + apiKey + headers → one fetch shared across both endpoints.
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/endpoints/config/models.ts b/packages/api/src/endpoints/config/models.ts
index 2d87d5d242a..27707e10978 100644
--- a/packages/api/src/endpoints/config/models.ts
+++ b/packages/api/src/endpoints/config/models.ts
@@ -1,3 +1,4 @@
+import crypto from 'crypto';
 import { logger } from '@librechat/data-schemas';
 import {
   ErrorTypes,
@@ -10,8 +11,28 @@ import type { AppConfig } from '@librechat/data-schemas';
 import type { ServerRequest, GetUserKeyValuesFunction, UserKeyValues } from '~/types';
 import type { FetchModelsParams } from '~/endpoints/models';
 import { fetchModels as defaultFetchModels } from '~/endpoints/models';
+import { getTokenConfigKey } from '~/endpoints/custom/initialize';
+import { validateEndpointURL } from '~/auth';
+import { tokenConfigCache } from '~/cache';
 import { isUserProvided } from '~/utils';
 
+/**
+ * Stable fingerprint of a headers object, used to disambiguate the
+ * in-request fetch-coalescing key. Two endpoints that share the same
+ * baseURL+apiKey but configure different headers must NOT share a fetch
+ * promise, otherwise the first endpoint's filtered /models response would
+ * be reused for the other in the same request.
+ */
+function headersFingerprint(headers: Record<string, string> | undefined): string {
+  if (!headers || Object.keys(headers).length === 0) {
+    return '';
+  }
+  const ordered = Object.keys(headers)
+    .sort()
+    .map((k) => [k, headers[k]]);
+  return crypto.createHash('sha256').update(JSON.stringify(ordered)).digest('hex').slice(0, 16);
+}
+
 interface ResolvedEndpoint {
   name: string;
   endpoint: TEndpoint;
@@ -22,7 +43,11 @@ interface ResolvedEndpoint {
 }
 
 export interface LoadConfigModelsDeps {
-  getAppConfig: (params: { role?: string | null; tenantId?: string }) => Promise<AppConfig>;
+  getAppConfig: (params: {
+    role?: string;
+    userId?: string;
+    tenantId?: string;
+  }) => Promise<AppConfig>;
   getUserKeyValues: GetUserKeyValuesFunction;
   fetchModels?: (params: FetchModelsParams) => Promise<string[]>;
 }
@@ -31,10 +56,13 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
   const { getAppConfig, getUserKeyValues, fetchModels = defaultFetchModels } = deps;
 
   return async function loadConfigModels(req: ServerRequest): Promise<TModelsConfig> {
-    const appConfig = await getAppConfig({
-      role: req.user?.role,
-      tenantId: req.user?.tenantId,
-    });
+    const appConfig =
+      req.config ??
+      (await getAppConfig({
+        role: req.user?.role,
+        userId: req.user?.id,
+        tenantId: req.user?.tenantId,
+      }));
     if (!appConfig) {
       return {};
     }
@@ -71,7 +99,11 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
 
     const fetchPromisesMap: Record<string, Promise<string[]>> = {};
     const uniqueKeyToEndpointsMap: Record<string, string[]> = {};
+    /** tokenKey the deduped fetch cached its token config under, so siblings
+     *  sharing the fetch can be backfilled with the same config afterward */
+    const uniqueKeyToTokenKey: Record<string, string> = {};
     const endpointsMap: Record<string, TEndpoint> = {};
+    const tenantId = req.user?.tenantId;
 
     const resolved: ResolvedEndpoint[] = [];
     const userKeyEndpoints: ResolvedEndpoint[] = [];
@@ -142,21 +174,32 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
       baseURLIsUserProvided,
     } of resolved) {
       const { models, headers: endpointHeaders } = endpoint;
-      const uniqueKey = `${BASE_URL}__${API_KEY}`;
+      // Include a fingerprint of the configured headers so two admin-trusted
+      // endpoints that happen to share the same baseURL+apiKey but configure
+      // different (potentially user-bound) headers don't reuse each other's
+      // fetched model list within the same request.
+      const uniqueKey = `${BASE_URL}__${API_KEY}__${headersFingerprint(endpointHeaders)}`;
 
       if (models?.fetch && !apiKeyIsUserProvided && !baseURLIsUserProvided) {
-        fetchPromisesMap[uniqueKey] =
-          fetchPromisesMap[uniqueKey] ||
-          fetchModels({
+        if (!fetchPromisesMap[uniqueKey]) {
+          /** User-scoped when configured headers resolve per user — the
+           *  derived token config must not be cached under the shared name */
+          const tokenKey = getTokenConfigKey(endpoint, name, req.user?.id ?? '', tenantId);
+          uniqueKeyToTokenKey[uniqueKey] = tokenKey;
+          fetchPromisesMap[uniqueKey] = fetchModels({
             name,
             apiKey: API_KEY,
             baseURL: BASE_URL,
+            baseURLIsUserProvided: false,
+            allowedAddresses: appConfig.endpoints?.allowedAddresses,
             user: req.user?.id,
             userObject: req.user,
             headers: endpointHeaders,
             direct: endpoint.directEndpoint,
             userIdQuery: models.userIdQuery,
+            tokenKey,
           });
+        }
         uniqueKeyToEndpointsMap[uniqueKey] = uniqueKeyToEndpointsMap[uniqueKey] || [];
         uniqueKeyToEndpointsMap[uniqueKey].push(name);
         continue;
@@ -164,24 +207,44 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
 
       if (models?.fetch && userKeyMap.has(name)) {
         const userKeyValues = userKeyMap.get(name);
-        const resolvedApiKey = apiKeyIsUserProvided ? userKeyValues?.apiKey : API_KEY;
+        const resolvedApiKey =
+          apiKeyIsUserProvided || baseURLIsUserProvided ? userKeyValues?.apiKey : API_KEY;
         const resolvedBaseURL = baseURLIsUserProvided ? userKeyValues?.baseURL : BASE_URL;
 
         if (resolvedApiKey && resolvedBaseURL) {
           const userFetchKey = `user:${req.user?.id}:${name}`;
           fetchPromisesMap[userFetchKey] =
             fetchPromisesMap[userFetchKey] ||
-            fetchModels({
-              name,
-              apiKey: resolvedApiKey,
-              baseURL: resolvedBaseURL,
-              user: req.user?.id,
-              userObject: req.user,
-              headers: endpointHeaders,
-              direct: endpoint.directEndpoint,
-              userIdQuery: models.userIdQuery,
-              skipCache: true,
-            });
+            (async () => {
+              if (baseURLIsUserProvided) {
+                await validateEndpointURL(
+                  resolvedBaseURL,
+                  name,
+                  appConfig.endpoints?.allowedAddresses,
+                );
+              }
+              return fetchModels({
+                name,
+                apiKey: resolvedApiKey,
+                baseURL: resolvedBaseURL,
+                baseURLIsUserProvided,
+                allowedAddresses: appConfig.endpoints?.allowedAddresses,
+                user: req.user?.id,
+                userObject: req.user,
+                // Do not forward header overrides when the base URL is
+                // user-supplied: configured templates such as
+                // {{LIBRECHAT_OPENID_ID_TOKEN}} would otherwise resolve and be
+                // sent to a destination the user controls, leaking the user's
+                // identity token. Header overrides are only safe for endpoints
+                // whose base URL is admin-trusted.
+                headers: baseURLIsUserProvided ? undefined : endpointHeaders,
+                direct: endpoint.directEndpoint,
+                userIdQuery: models.userIdQuery,
+                skipCache: true,
+                /** Fetched with the user's key/URL — always user-scoped */
+                tokenKey: getTokenConfigKey(endpoint, name, req.user?.id ?? '', tenantId),
+              });
+            })();
           uniqueKeyToEndpointsMap[userFetchKey] = uniqueKeyToEndpointsMap[userFetchKey] || [];
           uniqueKeyToEndpointsMap[userFetchKey].push(name);
           continue;
@@ -214,6 +277,28 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
         );
         modelsConfig[name] = !modelData?.length ? defaults : modelData;
       }
+
+      /** A shared fetch caches token config under one endpoint's tokenKey;
+       *  copy it to the siblings so /token-config resolves each by its own
+       *  name (the query is staleTime:Infinity and won't recover otherwise) */
+      const winnerTokenKey = uniqueKeyToTokenKey[currentKey];
+      if (settled.status === 'fulfilled' && winnerTokenKey != null && associatedNames.length > 1) {
+        const cache = tokenConfigCache();
+        const config = await cache.get(winnerTokenKey);
+        if (config != null) {
+          for (const name of associatedNames) {
+            const siblingKey = getTokenConfigKey(
+              endpointsMap[name],
+              name,
+              req.user?.id ?? '',
+              tenantId,
+            );
+            if (siblingKey !== winnerTokenKey) {
+              await cache.set(siblingKey, config);
+            }
+          }
+        }
+      }
     }
 
     return modelsConfig;
diff --git a/packages/api/src/endpoints/config/providers.spec.ts b/packages/api/src/endpoints/config/providers.spec.ts
index 7d8ba9241b6..ecd3bfa76a4 100644
--- a/packages/api/src/endpoints/config/providers.spec.ts
+++ b/packages/api/src/endpoints/config/providers.spec.ts
@@ -1,10 +1,10 @@
 import { Providers } from '@librechat/agents';
 import { EModelEndpoint } from 'librechat-data-provider';
 import type { AppConfig } from '@librechat/data-schemas';
-import { getProviderConfig, providerConfigMap } from './providers';
+import { getProviderConfig, providerConfigMap, resolveTitleTiming } from './providers';
 
 const buildAppConfig = (
-  customEndpoints: Array<{ name: string; baseURL?: string; apiKey?: string }>,
+  customEndpoints: Array<{ name: string; baseURL?: string; apiKey?: string; provider?: string }>,
 ): AppConfig =>
   ({
     endpoints: {
@@ -96,4 +96,140 @@ describe('getProviderConfig', () => {
       getProviderConfig({ provider: 'openrouter', appConfig: buildAppConfig([]) }),
     ).toThrow('Provider openrouter not supported');
   });
+
+  it('routes a custom endpoint with provider:anthropic to the Anthropic client', () => {
+    const appConfig = buildAppConfig([
+      {
+        name: 'Claude-Compatible',
+        baseURL: 'https://gateway.example.com',
+        apiKey: 'sk-ant',
+        provider: EModelEndpoint.anthropic,
+      },
+    ]);
+
+    const result = getProviderConfig({ provider: 'Claude-Compatible', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.ANTHROPIC);
+    expect(result.customEndpointConfig?.provider).toBe(EModelEndpoint.anthropic);
+  });
+
+  it('defaults a custom endpoint without provider to the OpenAI-compatible client', () => {
+    const appConfig = buildAppConfig([
+      { name: 'My-LLM', baseURL: 'https://api.example.com/v1', apiKey: 'sk-test' },
+    ]);
+
+    const result = getProviderConfig({ provider: 'My-LLM', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.OPENAI);
+    expect(result.customEndpointConfig?.name).toBe('My-LLM');
+  });
+
+  it('applies provider:anthropic even when the endpoint name collides with a known custom provider', () => {
+    // `openrouter` resolves via `providerConfigMap` first (skipping the generic
+    // custom branch); the override must still be re-applied from the config so
+    // overrideProvider-derived values (token/context budget) use the Anthropic map.
+    const appConfig = buildAppConfig([
+      {
+        name: 'openrouter',
+        baseURL: 'https://gateway.example.com',
+        apiKey: 'sk-ant',
+        provider: EModelEndpoint.anthropic,
+      },
+    ]);
+
+    const result = getProviderConfig({ provider: 'openrouter', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.ANTHROPIC);
+  });
+});
+
+describe('resolveTitleTiming', () => {
+  const withEndpoints = (endpoints: Record<string, unknown>): AppConfig =>
+    ({ endpoints }) as unknown as AppConfig;
+
+  it("defaults to 'immediate' when no config is provided", () => {
+    expect(resolveTitleTiming({})).toBe('immediate');
+  });
+
+  it("defaults to 'immediate' when endpoints is missing", () => {
+    expect(resolveTitleTiming({ appConfig: {} as AppConfig })).toBe('immediate');
+  });
+
+  it("defaults to 'immediate' when no titleTiming is set", () => {
+    const appConfig = withEndpoints({ [EModelEndpoint.agents]: { titleConvo: true } });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('immediate');
+  });
+
+  it("returns 'final' from the global `all` config", () => {
+    const appConfig = withEndpoints({ all: { titleTiming: 'final' } });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('final');
+  });
+
+  it("returns 'final' from the per-endpoint config when `all` is unset", () => {
+    const appConfig = withEndpoints({ [EModelEndpoint.agents]: { titleTiming: 'final' } });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('final');
+  });
+
+  it('lets `all` take precedence over the per-endpoint value', () => {
+    const appConfig = withEndpoints({
+      all: { titleTiming: 'immediate' },
+      [EModelEndpoint.agents]: { titleTiming: 'final' },
+    });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('immediate');
+  });
+
+  it('does not let unrelated `all` config block a per-endpoint value', () => {
+    const appConfig = withEndpoints({
+      all: { titleConvo: true },
+      [EModelEndpoint.agents]: { titleTiming: 'final' },
+    });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('final');
+  });
+
+  it('checks endpoint candidates in order before provider fallback', () => {
+    const appConfig = withEndpoints({
+      [EModelEndpoint.agents]: { titleTiming: 'final' },
+      [EModelEndpoint.openAI]: { titleTiming: 'immediate' },
+    });
+    expect(
+      resolveTitleTiming({
+        appConfig,
+        endpoint: [EModelEndpoint.agents, EModelEndpoint.openAI],
+      }),
+    ).toBe('final');
+  });
+
+  it('falls back to backing provider timing when agents has no titleTiming', () => {
+    const appConfig = withEndpoints({
+      [EModelEndpoint.agents]: { titleConvo: true },
+      [EModelEndpoint.openAI]: { titleTiming: 'final' },
+    });
+    expect(
+      resolveTitleTiming({
+        appConfig,
+        endpoint: [EModelEndpoint.agents, EModelEndpoint.openAI],
+      }),
+    ).toBe('final');
+  });
+
+  it("returns 'immediate' for an endpoint with no override and no `all`", () => {
+    const appConfig = withEndpoints({ [EModelEndpoint.openAI]: { titleTiming: 'final' } });
+    expect(resolveTitleTiming({ appConfig, endpoint: EModelEndpoint.agents })).toBe('immediate');
+  });
+
+  it("resolves 'final' from a custom endpoint config (endpoints.custom[])", () => {
+    const appConfig = withEndpoints({
+      [EModelEndpoint.custom]: [{ name: 'MyProvider', titleTiming: 'final' }],
+    });
+    expect(resolveTitleTiming({ appConfig, endpoint: 'MyProvider' })).toBe('final');
+  });
+
+  it('resolves a normalized custom provider name (openrouter -> OpenRouter)', () => {
+    const appConfig = withEndpoints({
+      [EModelEndpoint.custom]: [
+        { name: 'OpenRouter', baseURL: 'https://openrouter.ai/api/v1', titleTiming: 'final' },
+      ],
+    });
+    expect(resolveTitleTiming({ appConfig, endpoint: 'openrouter' })).toBe('final');
+  });
 });
diff --git a/packages/api/src/endpoints/config/providers.ts b/packages/api/src/endpoints/config/providers.ts
index 8ef4073805b..b0d34abfe78 100644
--- a/packages/api/src/endpoints/config/providers.ts
+++ b/packages/api/src/endpoints/config/providers.ts
@@ -49,6 +49,69 @@ export const providerConfigMap: Record<string, InitializeFn> = {
   [EModelEndpoint.anthropic]: initializeAnthropic,
 };
 
+export type TitleTiming = 'immediate' | 'final';
+
+/**
+ * Resolves when conversation titles are generated for a given endpoint.
+ *
+ * `endpoints.all.titleTiming`, when present, is the global override. Otherwise,
+ * endpoint candidates are checked in order so the public endpoint (for example
+ * `agents`) can override the backing provider, with provider/custom config used
+ * as a fallback. Resolving custom providers via `getProviderConfig` picks up its
+ * case-insensitive fallback for normalized provider names (e.g. `openrouter` →
+ * `OpenRouter`). Defaults to `immediate`.
+ */
+export function resolveTitleTiming({
+  appConfig,
+  endpoint,
+}: {
+  appConfig?: AppConfig;
+  endpoint?: string | Array<string | undefined>;
+}): TitleTiming {
+  const endpoints = appConfig?.endpoints;
+  const resolveConfiguredTiming = (config?: Partial<TEndpoint>): TitleTiming | undefined =>
+    config?.titleTiming === 'final' || config?.titleTiming === 'immediate'
+      ? config.titleTiming
+      : undefined;
+
+  const globalTiming = resolveConfiguredTiming(endpoints?.all);
+  if (globalTiming) {
+    return globalTiming;
+  }
+
+  const endpointCandidates = (Array.isArray(endpoint) ? endpoint : [endpoint]).filter(
+    (value): value is string => !!value,
+  );
+
+  for (const endpointCandidate of endpointCandidates) {
+    const endpointConfig = endpoints?.[endpointCandidate as keyof NonNullable<typeof endpoints>] as
+      | Partial<TEndpoint>
+      | undefined;
+    const endpointTiming = resolveConfiguredTiming(endpointConfig);
+    if (endpointTiming) {
+      return endpointTiming;
+    }
+  }
+
+  for (const endpointCandidate of endpointCandidates) {
+    if (!appConfig) {
+      continue;
+    }
+    try {
+      const providerTiming = resolveConfiguredTiming(
+        getProviderConfig({ provider: endpointCandidate, appConfig }).customEndpointConfig,
+      );
+      if (providerTiming) {
+        return providerTiming;
+      }
+    } catch {
+      // Unsupported providers fall back to the default timing.
+    }
+  }
+
+  return 'immediate';
+}
+
 /**
  * Result from getProviderConfig
  */
@@ -135,6 +198,18 @@ export function getProviderConfig({
     }
   }
 
+  /**
+   * Custom endpoints default to the OpenAI-compatible client. An explicit
+   * `provider: anthropic` routes them through the native Anthropic `/v1/messages`
+   * client (`initializeCustom` builds the right config). Applied here — after all
+   * `customEndpointConfig` resolution — so it also wins when the endpoint name
+   * collides with a known custom-provider (e.g. `openrouter`), ensuring
+   * `overrideProvider`-derived values (token/context budget) use the Anthropic map.
+   */
+  if (customEndpointConfig?.provider === EModelEndpoint.anthropic) {
+    overrideProvider = Providers.ANTHROPIC;
+  }
+
   return {
     getOptions,
     overrideProvider,
diff --git a/packages/api/src/endpoints/custom/config.spec.ts b/packages/api/src/endpoints/custom/config.spec.ts
new file mode 100644
index 00000000000..b0154b3b41b
--- /dev/null
+++ b/packages/api/src/endpoints/custom/config.spec.ts
@@ -0,0 +1,85 @@
+import { AuthType, EModelEndpoint } from 'librechat-data-provider';
+import type { TCustomEndpoints } from 'librechat-data-provider';
+import { loadCustomEndpointsConfig } from './config';
+
+const baseEndpoint = {
+  apiKey: 'sk-test',
+  baseURL: 'https://gateway.example.com',
+  models: { default: ['claude-sonnet-4-5'] },
+};
+
+describe('loadCustomEndpointsConfig – native provider param set', () => {
+  it('synthesizes defaultParamsEndpoint from provider so the UI shows the right params', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'Claude-Compatible', provider: EModelEndpoint.anthropic },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['Claude-Compatible']?.customParams?.defaultParamsEndpoint).toBe(
+      EModelEndpoint.anthropic,
+    );
+  });
+
+  it('does not set defaultParamsEndpoint for endpoints without a provider', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'My-LLM' },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['My-LLM']?.customParams).toBeUndefined();
+  });
+
+  it('respects an explicit non-default defaultParamsEndpoint over the provider', () => {
+    const config = loadCustomEndpointsConfig([
+      {
+        ...baseEndpoint,
+        name: 'Claude-Compatible',
+        provider: EModelEndpoint.anthropic,
+        customParams: { defaultParamsEndpoint: EModelEndpoint.google },
+      },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['Claude-Compatible']?.customParams?.defaultParamsEndpoint).toBe(
+      EModelEndpoint.google,
+    );
+  });
+});
+
+describe('loadCustomEndpointsConfig – user credential prompts', () => {
+  it('requires a user key when the custom base URL is user-provided', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'User URL', baseURL: AuthType.USER_PROVIDED },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['User URL']).toEqual(
+      expect.objectContaining({
+        userProvide: true,
+        userProvideURL: true,
+      }),
+    );
+  });
+
+  it('requires a user key when the custom API key is user-provided', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'User Key', apiKey: AuthType.USER_PROVIDED },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['User Key']).toEqual(
+      expect.objectContaining({
+        userProvide: true,
+        userProvideURL: false,
+      }),
+    );
+  });
+
+  it('does not require a user key for admin-trusted credentials and base URL', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'Admin Trusted' },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['Admin Trusted']).toEqual(
+      expect.objectContaining({
+        userProvide: false,
+        userProvideURL: false,
+      }),
+    );
+  });
+});
diff --git a/packages/api/src/endpoints/custom/config.ts b/packages/api/src/endpoints/custom/config.ts
index 5b3bd88ce2f..fdf829ad7ca 100644
--- a/packages/api/src/endpoints/custom/config.ts
+++ b/packages/api/src/endpoints/custom/config.ts
@@ -35,17 +35,32 @@ export function loadCustomEndpointsConfig(
         iconURL,
         modelDisplayLabel,
         customParams,
+        provider,
       } = endpoint;
       const name = normalizeEndpointName(configName);
 
       const resolvedApiKey = extractEnvVariable(apiKey ?? '');
       const resolvedBaseURL = extractEnvVariable(baseURL ?? '');
+      const userProvideURL = isUserProvided(resolvedBaseURL);
+
+      /**
+       * A native `provider` (e.g. anthropic) implies its parameter set. Surface it
+       * as `defaultParamsEndpoint` so the client param panel shows the right fields
+       * (e.g. `maxOutputTokens`/`thinking` for Anthropic, not OpenAI `max_tokens`),
+       * unless an admin explicitly chose a non-default `defaultParamsEndpoint`.
+       */
+      const resolvedCustomParams =
+        provider != null &&
+        (customParams?.defaultParamsEndpoint == null ||
+          customParams.defaultParamsEndpoint === EModelEndpoint.custom)
+          ? { ...customParams, defaultParamsEndpoint: provider }
+          : customParams;
 
       customEndpointsConfig[name] = {
         type: EModelEndpoint.custom,
-        userProvide: isUserProvided(resolvedApiKey),
-        userProvideURL: isUserProvided(resolvedBaseURL),
-        customParams,
+        userProvide: isUserProvided(resolvedApiKey) || userProvideURL,
+        userProvideURL,
+        customParams: resolvedCustomParams,
         modelDisplayLabel,
         iconURL,
       };
diff --git a/packages/api/src/endpoints/custom/initialize.spec.ts b/packages/api/src/endpoints/custom/initialize.spec.ts
index 3c384bf0361..d52d2aea742 100644
--- a/packages/api/src/endpoints/custom/initialize.spec.ts
+++ b/packages/api/src/endpoints/custom/initialize.spec.ts
@@ -2,8 +2,16 @@ import { AuthType, ErrorTypes } from 'librechat-data-provider';
 import type { BaseInitializeParams } from '~/types';
 
 const mockValidateEndpointURL = jest.fn();
+const mockCreateSSRFSafeUndiciConnect = jest.fn(
+  (_allowedAddresses?: string[] | null, _port?: string | number | null) => ({
+    lookup: jest.fn(),
+  }),
+);
 jest.mock('~/auth', () => ({
   validateEndpointURL: (...args: unknown[]) => mockValidateEndpointURL(...args),
+  createSSRFSafeUndiciConnect: (
+    ...args: [allowedAddresses?: string[] | null, port?: string | number | null]
+  ) => mockCreateSSRFSafeUndiciConnect(...args),
 }));
 
 const mockGetOpenAIConfig = jest.fn().mockReturnValue({
@@ -33,7 +41,8 @@ jest.mock('~/app/config', () => ({
   getCustomEndpointConfig: (...args: unknown[]) => mockGetCustomEndpointConfig(...args),
 }));
 
-import { initializeCustom } from './initialize';
+import { getTokenConfigKey, initializeCustom } from './initialize';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from '../keys';
 
 function createParams(overrides: {
   apiKey?: string;
@@ -41,6 +50,7 @@ function createParams(overrides: {
   userBaseURL?: string;
   userApiKey?: string;
   expiresAt?: string;
+  headers?: Record<string, string>;
 }): BaseInitializeParams {
   const { apiKey = 'sk-test-key', baseURL = 'https://api.example.com/v1' } = overrides;
 
@@ -48,6 +58,7 @@ function createParams(overrides: {
     apiKey,
     baseURL,
     models: {},
+    headers: overrides.headers,
   });
 
   const db = {
@@ -114,6 +125,11 @@ describe('initializeCustom – Agents API user key resolution', () => {
       name: 'test-custom',
     });
     expect(checkUserKeyExpiry).not.toHaveBeenCalled();
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'sk-user-key',
+      expect.any(Object),
+      'test-custom',
+    );
   });
 
   it('should still check key expiry when expiresAt is provided (UI flow)', async () => {
@@ -160,6 +176,103 @@ describe('initializeCustom – Agents API user key resolution', () => {
   });
 });
 
+describe('initializeCustom – OpenAI-compatible header forwarding', () => {
+  const userControlledHeaderCases: Array<{
+    headerType: string;
+    headers: Record<string, string>;
+  }> = [
+    {
+      headerType: 'Authorization',
+      headers: { Authorization: 'Bearer static-gateway-token' },
+    },
+    {
+      headerType: 'env-secret',
+      headers: { 'X-Env-Secret': '${GATEWAY_SECRET}' },
+    },
+    {
+      headerType: 'user-placeholder',
+      headers: { 'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}' },
+    },
+  ];
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('preserves configured headers for admin-trusted base URLs', async () => {
+    const headers = {
+      Authorization: 'Bearer static-gateway-token',
+      'X-Env-Secret': '${GATEWAY_SECRET}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+    const params = createParams({
+      apiKey: 'sk-system-key',
+      baseURL: 'https://gateway.example.com/v1',
+      headers,
+    });
+
+    await initializeCustom(params);
+
+    const clientOptions = mockGetOpenAIConfig.mock.calls[0][1] as {
+      headers?: Record<string, string>;
+    };
+    expect(clientOptions.headers).toEqual(headers);
+  });
+
+  it('uses the user API key when the user supplies the base URL', async () => {
+    const params = createParams({
+      apiKey: 'sk-system-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userApiKey: 'sk-user-owned-key',
+      userBaseURL: 'https://user-controlled.example.com/v1',
+    });
+
+    await initializeCustom(params);
+
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'sk-user-owned-key',
+      expect.any(Object),
+      'test-custom',
+    );
+    expect(mockGetOpenAIConfig).not.toHaveBeenCalledWith(
+      'sk-system-key',
+      expect.any(Object),
+      'test-custom',
+    );
+  });
+
+  it('throws NO_USER_KEY when the user supplies the base URL without an API key', async () => {
+    const params = createParams({
+      apiKey: 'sk-system-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userApiKey: '',
+      userBaseURL: 'https://user-controlled.example.com/v1',
+    });
+
+    await expect(initializeCustom(params)).rejects.toThrow(ErrorTypes.NO_USER_KEY);
+    expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
+  });
+
+  it.each(userControlledHeaderCases)(
+    'withholds configured $headerType headers when the user supplies the base URL',
+    async ({ headers }) => {
+      const params = createParams({
+        apiKey: 'sk-system-key',
+        baseURL: AuthType.USER_PROVIDED,
+        userBaseURL: 'https://user-controlled.example.com/v1',
+        headers,
+      });
+
+      await initializeCustom(params);
+
+      const clientOptions = mockGetOpenAIConfig.mock.calls[0][1] as {
+        headers?: Record<string, string>;
+      };
+      expect(clientOptions.headers).toBeUndefined();
+    },
+  );
+});
+
 describe('initializeCustom – SSRF guard wiring', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -210,3 +323,382 @@ describe('initializeCustom – SSRF guard wiring', () => {
     expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
   });
 });
+
+describe('initializeCustom – token-config fetch header forwarding', () => {
+  const { fetchModels } = jest.requireMock('~/endpoints/models');
+
+  function createTokenConfigParams(overrides: {
+    apiKey?: string;
+    baseURL?: string;
+    userBaseURL?: string;
+    headers?: Record<string, string>;
+    tenantId?: string;
+  }): BaseInitializeParams {
+    const { apiKey = 'sk-test-key', baseURL = 'https://openrouter.ai/api/v1' } = overrides;
+
+    mockGetCustomEndpointConfig.mockReturnValue({
+      apiKey,
+      baseURL,
+      models: { fetch: true },
+      headers: overrides.headers,
+    });
+
+    const db = {
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: overrides.userBaseURL ?? 'https://user-api.example.com/v1',
+      }),
+    } as unknown as BaseInitializeParams['db'];
+
+    return {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com', tenantId: overrides.tenantId },
+        body: { key: '2099-01-01' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      // openrouter is in FetchTokenConfig, so the fetchModels call is reached
+      endpoint: 'openrouter',
+      model_parameters: { model: 'gpt-4' },
+      db,
+    };
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    fetchModels.mockReset().mockResolvedValue([]);
+  });
+
+  it('forwards configured headers and user object to fetchModels for admin-trusted base URL', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      headers,
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        headers,
+        userObject: params.req.user,
+        baseURLIsUserProvided: false,
+      }),
+    );
+  });
+
+  it('drops headers when base URL is user-provided (token leak guard)', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+    };
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userBaseURL: 'https://user-controlled.example.com/v1',
+      headers,
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        apiKey: 'sk-user-key',
+        headers: undefined,
+        userObject: params.req.user,
+        baseURLIsUserProvided: true,
+      }),
+    );
+  });
+
+  it('uses the unscoped endpoint tokenKey when no user-bound headers are configured', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        tokenKey: 'openrouter',
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('tenant-scopes the tokenKey when a tenant id is present', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      tenantId: 'tenant-a',
+    });
+
+    await initializeCustom(params);
+
+    const tokenKey = fetchModels.mock.calls[0][0].tokenKey;
+    expect(fetchModels.mock.calls[0][0].name).toBe('openrouter');
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-a:openrouter');
+  });
+
+  it('user-scopes the tokenKey when headers will be forwarded (admin-trusted base URL)', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tokenKey: 'openrouter:user-1',
+      }),
+    );
+  });
+
+  it('does NOT user-scope the tokenKey when headers are dropped (user-provided base URL)', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userBaseURL: 'https://user-controlled.example.com/v1',
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    });
+
+    await initializeCustom(params);
+
+    // baseURL is user-provided so tokenKey is already user-scoped via the
+    // existing rule, not via the new headers signal. Either way the value
+    // should be the user-scoped key.
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tokenKey: 'openrouter:user-1',
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('uses a static tokenConfig for billing and skips the model fetch', async () => {
+    const tokenConfig = {
+      'gpt-4': { prompt: 1.5, completion: 4.5, context: 32000, cacheRead: 0.3, cacheWrite: 1.8 },
+    };
+    mockGetCustomEndpointConfig.mockReturnValue({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      models: { fetch: true },
+      tokenConfig,
+    });
+
+    const params: BaseInitializeParams = {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com' },
+        body: { key: '2099-01-01' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      endpoint: 'openrouter',
+      model_parameters: { model: 'gpt-4' },
+      db: {
+        getUserKeyValues: jest.fn(),
+      } as unknown as BaseInitializeParams['db'],
+    };
+
+    const result = (await initializeCustom(params)) as {
+      endpointTokenConfig?: Record<string, Record<string, number>>;
+    };
+
+    expect(fetchModels).not.toHaveBeenCalled();
+    /** Original rates pass through, plus the billing-shape cache keys so
+     *  getCacheMultiplier (which reads `write`/`read`) finds them */
+    expect(result.endpointTokenConfig?.['gpt-4']).toEqual({
+      prompt: 1.5,
+      completion: 4.5,
+      context: 32000,
+      cacheRead: 0.3,
+      cacheWrite: 1.8,
+      write: 1.8,
+      read: 0.3,
+    });
+  });
+});
+
+describe('getTokenConfigKey – tenant fallback', () => {
+  const endpointConfig = {
+    apiKey: 'sk-test-key',
+    baseURL: 'https://openrouter.ai/api/v1',
+  };
+
+  it('keeps legacy shared keys when tenant context is unavailable or empty', () => {
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      expect(getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', tenantId)).toBe(
+        'openrouter',
+      );
+    }
+  });
+
+  it('keeps legacy user-scoped keys when tenant context is unavailable or empty', () => {
+    const userScopedConfig = {
+      ...endpointConfig,
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    };
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      expect(getTokenConfigKey(userScopedConfig, 'openrouter', 'user-1', tenantId)).toBe(
+        'openrouter:user-1',
+      );
+    }
+  });
+
+  it('adds tenant scope only when tenant context is non-empty', () => {
+    const key = getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', ' tenant-a ');
+
+    expect(key.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(key).not.toBe('tenant:tenant-a:openrouter');
+    expect(key).not.toContain('openrouter');
+    expect(key).not.toContain('tenant-a');
+    expect(key).toBe(getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', 'tenant-a'));
+  });
+});
+
+describe('initializeCustom – native Anthropic provider', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function createAnthropicParams(
+    config: Record<string, unknown>,
+    model_parameters: Record<string, unknown> = { model: 'claude-sonnet-4-5' },
+  ): BaseInitializeParams {
+    mockGetCustomEndpointConfig.mockReturnValue(config);
+    return {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com' },
+        body: { conversationId: 'convo-1' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      endpoint: 'Claude-Compatible',
+      model_parameters,
+      db: {
+        getUserKeyValues: jest.fn().mockResolvedValue({
+          apiKey: 'sk-user-key',
+          baseURL: 'https://user-controlled.example.com',
+        }),
+        getUserKey: jest.fn(),
+      } as unknown as BaseInitializeParams['db'],
+    };
+  }
+
+  it('builds a native Anthropic config pointed at the custom baseURL/apiKey', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: 'https://gateway.example.com',
+      headers: { 'anthropic-version': '2023-06-01' },
+      models: { default: ['claude-sonnet-4-5'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    /** Routed to the native Anthropic client, not the OpenAI-compatible one */
+    expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
+    expect(options.provider).toBe('anthropic');
+    /** Custom baseURL/key wired into the native Anthropic config */
+    expect(options.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    expect(options.llmConfig).toHaveProperty('apiKey', 'sk-ant-custom');
+    /** Configured header attached (kept unresolved for request-time resolution) */
+    const defaultHeaders = (
+      options.llmConfig as { clientOptions?: { defaultHeaders?: Record<string, string> } }
+    ).clientOptions?.defaultHeaders;
+    expect(defaultHeaders?.['anthropic-version']).toBe('2023-06-01');
+    /** Native Anthropic path must NOT use OpenAI legacy content formatting */
+    expect(options.useLegacyContent).toBeUndefined();
+  });
+
+  it('withholds configured headers when the user supplies the base URL', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: AuthType.USER_PROVIDED,
+      headers: {
+        Authorization: 'Bearer ${GATEWAY_SECRET}',
+        'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+      },
+      models: { default: ['claude-sonnet-4-5'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    expect(mockValidateEndpointURL).toHaveBeenCalledWith(
+      'https://user-controlled.example.com',
+      'Claude-Compatible',
+      undefined,
+    );
+    expect(options.llmConfig).toHaveProperty(
+      'anthropicApiUrl',
+      'https://user-controlled.example.com',
+    );
+    expect(options.llmConfig).toHaveProperty('apiKey', 'sk-user-key');
+    const defaultHeaders = (
+      options.llmConfig as { clientOptions?: { defaultHeaders?: Record<string, string> } }
+    ).clientOptions?.defaultHeaders;
+    expect(defaultHeaders?.Authorization).toBeUndefined();
+    expect(defaultHeaders?.['X-User-Email']).toBeUndefined();
+    const fetchOptions = (
+      options.llmConfig as {
+        clientOptions?: { fetchOptions?: { dispatcher?: unknown; redirect?: string } };
+      }
+    ).clientOptions?.fetchOptions;
+    expect(fetchOptions).toEqual(
+      expect.objectContaining({
+        dispatcher: expect.any(Object),
+        redirect: 'error',
+      }),
+    );
+  });
+
+  it('applies customParams.paramDefinitions defaults on the native path', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: 'https://gateway.example.com',
+      models: { default: ['claude-sonnet-4-5'] },
+      customParams: {
+        defaultParamsEndpoint: 'anthropic',
+        paramDefinitions: [{ key: 'web_search', default: true }],
+      },
+    });
+
+    const options = await initializeCustom(params);
+
+    /** `web_search: true` default flows through to the Anthropic web_search tool */
+    expect(options.tools).toEqual(
+      expect.arrayContaining([expect.objectContaining({ name: 'web_search' })]),
+    );
+  });
+
+  it('still uses the OpenAI-compatible client when no provider is set', async () => {
+    const params = createAnthropicParams({
+      apiKey: 'sk-test',
+      baseURL: 'https://api.example.com/v1',
+      models: { default: ['gpt-4o'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'sk-test',
+      expect.any(Object),
+      'Claude-Compatible',
+    );
+    expect(options.useLegacyContent).toBe(true);
+    expect(options.provider).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/custom/initialize.ts b/packages/api/src/endpoints/custom/initialize.ts
index cc5ab14a9f1..e25b5e1d344 100644
--- a/packages/api/src/endpoints/custom/initialize.ts
+++ b/packages/api/src/endpoints/custom/initialize.ts
@@ -1,14 +1,24 @@
+import { Providers } from '@librechat/agents';
 import {
   ErrorTypes,
   envVarRegex,
+  EModelEndpoint,
   FetchTokenConfig,
   extractEnvVariable,
 } from 'librechat-data-provider';
 import type { TEndpoint } from 'librechat-data-provider';
 import type { AppConfig } from '@librechat/data-schemas';
-import type { BaseInitializeParams, InitializeResultBase, EndpointTokenConfig } from '~/types';
-import { getOpenAIConfig } from '~/endpoints/openai/config';
+import type {
+  BaseInitializeParams,
+  InitializeResultBase,
+  EndpointTokenConfig,
+  AnthropicModelOptions,
+} from '~/types';
+import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm';
+import { extractDefaultParams } from '~/endpoints/openai/llm';
 import { isUserProvided, checkUserKeyExpiry } from '~/utils';
+import { getOpenAIConfig } from '~/endpoints/openai/config';
+import { getScopedTokenConfigKey } from '~/endpoints/keys';
 import { getCustomEndpointConfig } from '~/app/config';
 import { fetchModels } from '~/endpoints/models';
 import { validateEndpointURL } from '~/auth';
@@ -16,6 +26,67 @@ import { tokenConfigCache } from '~/cache';
 
 const { PROXY } = process.env;
 
+function getTenantTokenScope(tenantId?: string | null): string {
+  const normalizedTenantId = typeof tenantId === 'string' ? tenantId.trim() : '';
+  return normalizedTenantId;
+}
+
+/**
+ * Cache key for an endpoint's fetched token config. User-scoped when the
+ * model fetch can resolve per-user: user-provided key/URL, or header
+ * templates forwarded against an admin-trusted base URL — making the
+ * response, and therefore the derived token config, user-specific. Otherwise
+ * tenant-scoped when a tenant id is available because custom endpoint config
+ * is resolved per tenant.
+ */
+export function getTokenConfigKey(
+  endpointConfig: Partial<TEndpoint>,
+  endpoint: string,
+  userId: string,
+  tenantId?: string | null,
+): string {
+  const hasTokenConfig = endpointConfig.tokenConfig != null;
+  if (hasTokenConfig) {
+    return endpoint;
+  }
+
+  const userProvidesKey = isUserProvided(extractEnvVariable(endpointConfig.apiKey ?? ''));
+  const userProvidesURL = isUserProvided(extractEnvVariable(endpointConfig.baseURL ?? ''));
+  const willForwardUserScopedHeaders = !!endpointConfig?.headers && !userProvidesURL;
+  const tenantScope = getTenantTokenScope(tenantId);
+
+  if (userProvidesKey || userProvidesURL || willForwardUserScopedHeaders) {
+    return tenantScope
+      ? getScopedTokenConfigKey('tenant-user', [tenantScope, endpoint, userId])
+      : `${endpoint}:${userId}`;
+  }
+
+  return tenantScope ? getScopedTokenConfigKey('tenant', [tenantScope, endpoint]) : endpoint;
+}
+
+/**
+ * Maps an admin-facing static `tokenConfig` to the billing shape: the UI uses
+ * `cacheWrite`/`cacheRead`, but `getCacheMultiplier` indexes `write`/`read`.
+ * Adds those keys (preserving the originals) so cache tokens bill at the
+ * configured rate instead of the prompt-rate fallback.
+ */
+function toBillingTokenConfig(
+  tokenConfig: Record<string, Record<string, number>>,
+): EndpointTokenConfig {
+  const result: EndpointTokenConfig = {};
+  for (const [model, rates] of Object.entries(tokenConfig)) {
+    const mapped = { ...rates } as Record<string, number>;
+    if (rates.cacheWrite != null) {
+      mapped.write = rates.cacheWrite;
+    }
+    if (rates.cacheRead != null) {
+      mapped.read = rates.cacheRead;
+    }
+    result[model] = mapped as EndpointTokenConfig[string];
+  }
+  return result;
+}
+
 /**
  * Builds custom options from endpoint configuration
  */
@@ -23,9 +94,9 @@ function buildCustomOptions(
   endpointConfig: Partial<TEndpoint>,
   appConfig?: AppConfig,
   endpointTokenConfig?: Record<string, unknown>,
+  forwardHeaders = true,
 ) {
   const customOptions: Record<string, unknown> = {
-    headers: endpointConfig.headers,
     addParams: endpointConfig.addParams,
     dropParams: endpointConfig.dropParams,
     customParams: endpointConfig.customParams,
@@ -39,6 +110,10 @@ function buildCustomOptions(
     endpointTokenConfig,
   };
 
+  if (forwardHeaders) {
+    customOptions.headers = endpointConfig.headers;
+  }
+
   const allConfig = appConfig?.endpoints?.all;
   if (allConfig) {
     customOptions.streamRate = allConfig.streamRate;
@@ -47,6 +122,48 @@ function buildCustomOptions(
   return customOptions;
 }
 
+/**
+ * Builds a native Anthropic (`/v1/messages`) config for a custom endpoint that
+ * declares `provider: anthropic`, pointing the Anthropic client at the custom
+ * `baseURL`/`apiKey`. Returns `provider: anthropic` so the agent uses the native
+ * Anthropic client instead of the OpenAI-compatible one. Headers stay unresolved
+ * here and resolve at request time via `resolveConfigHeaders`.
+ */
+function buildAnthropicCustomConfig({
+  apiKey,
+  baseURL,
+  modelOptions,
+  endpointConfig,
+  userProvidesURL,
+  allowedAddresses,
+}: {
+  apiKey: string;
+  baseURL: string;
+  modelOptions: AnthropicModelOptions;
+  endpointConfig: Partial<TEndpoint>;
+  userProvidesURL: boolean;
+  allowedAddresses?: string[] | null;
+}): InitializeResultBase {
+  const result = getAnthropicLLMConfig(apiKey, {
+    modelOptions,
+    proxy: PROXY ?? undefined,
+    reverseProxyUrl: baseURL,
+    baseURLIsUserProvided: userProvidesURL,
+    allowedAddresses,
+    headers: userProvidesURL ? undefined : endpointConfig.headers,
+    addParams: endpointConfig.addParams,
+    dropParams: endpointConfig.dropParams,
+    /** Apply admin `customParams.paramDefinitions` defaults (e.g. promptCache,
+     *  web_search, thinking) the OpenAI-compatible path gets via `getOpenAIConfig`. */
+    defaultParams: extractDefaultParams(endpointConfig.customParams?.paramDefinitions),
+  });
+  return {
+    llmConfig: result.llmConfig as InitializeResultBase['llmConfig'],
+    tools: result.tools,
+    provider: Providers.ANTHROPIC,
+  };
+}
+
 /**
  * Initializes a custom endpoint client configuration.
  * This function handles custom endpoints defined in librechat.yaml, including
@@ -100,10 +217,10 @@ export async function initializeCustom({
     userValues = await db.getUserKeyValues({ userId: req.user?.id ?? '', name: endpoint });
   }
 
-  const apiKey = userProvidesKey ? userValues?.apiKey : CUSTOM_API_KEY;
+  const apiKey = userProvidesKey || userProvidesURL ? userValues?.apiKey : CUSTOM_API_KEY;
   const baseURL = userProvidesURL ? userValues?.baseURL : CUSTOM_BASE_URL;
 
-  if (userProvidesKey && !apiKey) {
+  if ((userProvidesKey || userProvidesURL) && !apiKey) {
     throw new Error(
       JSON.stringify({
         type: ErrorTypes.NO_USER_KEY,
@@ -134,19 +251,26 @@ export async function initializeCustom({
   let endpointTokenConfig: EndpointTokenConfig | undefined;
 
   const userId = req.user?.id ?? '';
+  const tenantId = req.user?.tenantId;
 
   const cache = tokenConfigCache();
-  /** tokenConfig is an optional extended property on custom endpoints */
-  const hasTokenConfig = (endpointConfig as Record<string, unknown>).tokenConfig != null;
-  const tokenKey =
-    !hasTokenConfig && (userProvidesKey || userProvidesURL) ? `${endpoint}:${userId}` : endpoint;
-
-  const cachedConfig =
-    !hasTokenConfig &&
-    FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
-    (await cache.get(tokenKey));
+  const hasTokenConfig = endpointConfig.tokenConfig != null;
+  const tokenKey = getTokenConfigKey(endpointConfig, endpoint, userId, tenantId);
 
-  endpointTokenConfig = (cachedConfig as EndpointTokenConfig) || undefined;
+  if (hasTokenConfig) {
+    /** A static override is authoritative — use it for the agent's billing
+     *  and balance checks, not just the advertised UI token config. Mirror
+     *  the admin-facing `cacheWrite`/`cacheRead` keys onto the `write`/`read`
+     *  keys the billing multiplier reads. */
+    endpointTokenConfig = toBillingTokenConfig(
+      endpointConfig.tokenConfig as Record<string, Record<string, number>>,
+    );
+  } else {
+    const cachedConfig =
+      FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
+      (await cache.get(tokenKey));
+    endpointTokenConfig = (cachedConfig as EndpointTokenConfig) || undefined;
+  }
 
   if (
     FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
@@ -154,28 +278,70 @@ export async function initializeCustom({
     endpointConfig.models?.fetch &&
     !endpointTokenConfig
   ) {
-    await fetchModels({ apiKey, baseURL, name: endpoint, user: userId, tokenKey });
+    await fetchModels({
+      apiKey,
+      baseURL,
+      baseURLIsUserProvided: userProvidesURL,
+      allowedAddresses: appConfig?.endpoints?.allowedAddresses,
+      name: endpoint,
+      user: userId,
+      tokenKey,
+      userObject: req.user,
+      // Mirror the security guard in `loadConfigModels`: never forward
+      // header overrides when the base URL is user-supplied — configured
+      // templates like {{LIBRECHAT_OPENID_ID_TOKEN}} would otherwise resolve
+      // and leak the user's identity token to a destination the user controls.
+      headers: userProvidesURL ? undefined : endpointConfig.headers,
+      // Note: when both `headers` and `userObject` are supplied below, the
+      // MODEL_QUERIES cache inside `fetchModels` is automatically skipped,
+      // which prevents a per-user filtered model list from leaking across
+      // users. The token-config cache key (`tokenKey`) is also user-scoped
+      // above when these headers will be forwarded.
+    });
     endpointTokenConfig = (await cache.get(tokenKey)) as EndpointTokenConfig | undefined;
   }
 
-  const customOptions = buildCustomOptions(endpointConfig, appConfig, endpointTokenConfig);
+  const customOptions = buildCustomOptions(
+    endpointConfig,
+    appConfig,
+    endpointTokenConfig,
+    !userProvidesURL,
+  );
 
   const clientOptions: Record<string, unknown> = {
     reverseProxyUrl: baseURL ?? null,
+    baseURLIsUserProvided: userProvidesURL,
+    allowedAddresses: appConfig?.endpoints?.allowedAddresses,
     proxy: PROXY ?? null,
     ...customOptions,
   };
 
   const modelOptions = { ...(model_parameters ?? {}), user: userId };
-  const finalClientOptions = {
-    modelOptions,
-    ...clientOptions,
-  };
 
-  const options = getOpenAIConfig(apiKey, finalClientOptions, endpoint);
-  if (options != null) {
-    (options as InitializeResultBase).useLegacyContent = true;
-    (options as InitializeResultBase).endpointTokenConfig = endpointTokenConfig;
+  let options: InitializeResultBase;
+  if (endpointConfig.provider === EModelEndpoint.anthropic) {
+    /** Native Anthropic `/v1/messages` client against the custom baseURL/apiKey.
+     *  `useLegacyContent` is intentionally left unset (matches the built-in
+     *  Anthropic endpoint, which uses native content formatting). */
+    options = buildAnthropicCustomConfig({
+      apiKey,
+      baseURL,
+      modelOptions: modelOptions as AnthropicModelOptions,
+      endpointConfig,
+      userProvidesURL,
+      allowedAddresses: appConfig?.endpoints?.allowedAddresses,
+    });
+    options.endpointTokenConfig = endpointTokenConfig;
+  } else {
+    const finalClientOptions = {
+      modelOptions,
+      ...clientOptions,
+    };
+    options = getOpenAIConfig(apiKey, finalClientOptions, endpoint);
+    if (options != null) {
+      options.useLegacyContent = true;
+      options.endpointTokenConfig = endpointTokenConfig;
+    }
   }
 
   const streamRate = clientOptions.streamRate as number | undefined;
diff --git a/packages/api/src/endpoints/google/index.ts b/packages/api/src/endpoints/google/index.ts
index 46ec1068696..339fada2ef7 100644
--- a/packages/api/src/endpoints/google/index.ts
+++ b/packages/api/src/endpoints/google/index.ts
@@ -1,2 +1,3 @@
 export * from './llm';
 export * from './initialize';
+export * from './youtube';
diff --git a/packages/api/src/endpoints/google/initialize.spec.ts b/packages/api/src/endpoints/google/initialize.spec.ts
new file mode 100644
index 00000000000..a6239805efd
--- /dev/null
+++ b/packages/api/src/endpoints/google/initialize.spec.ts
@@ -0,0 +1,167 @@
+import { Providers } from '@librechat/agents';
+import { AuthKeys, EModelEndpoint } from 'librechat-data-provider';
+import type { EndpointDbMethods, ServerRequest } from '~/types';
+
+const mockGetGoogleConfig = jest.fn(
+  (_credentials?: unknown, _options?: unknown, _acceptRawApiKey?: unknown) => ({
+    provider: Providers.VERTEXAI,
+    llmConfig: { model: 'gemini-2.5-flash' },
+  }),
+);
+const mockIsEnabled = jest.fn();
+const mockLoadServiceKey = jest.fn();
+const mockCheckUserKeyExpiry = jest.fn();
+
+jest.mock('./llm', () => ({
+  getGoogleConfig: (credentials: unknown, options: unknown, acceptRawApiKey?: unknown) =>
+    mockGetGoogleConfig(credentials, options, acceptRawApiKey),
+}));
+
+jest.mock('~/utils', () => ({
+  ...jest.requireActual('~/utils'),
+  isEnabled: (value: unknown) => mockIsEnabled(value),
+  loadServiceKey: (keyPath: unknown) => mockLoadServiceKey(keyPath),
+  checkUserKeyExpiry: (expiresAt: unknown, endpoint: unknown) =>
+    mockCheckUserKeyExpiry(expiresAt, endpoint),
+}));
+
+import { initializeGoogle } from './initialize';
+
+function createDb(): EndpointDbMethods {
+  return {
+    getUserKey: jest.fn().mockResolvedValue('user-google-key'),
+    getUserKeyValues: jest.fn().mockResolvedValue({}),
+  };
+}
+
+function createReq(): ServerRequest {
+  return {
+    body: {},
+    config: {},
+    user: { id: 'user-1' },
+  } as ServerRequest;
+}
+
+function getGoogleConfigCall(): [Record<string, unknown>, Record<string, unknown>] {
+  expect(mockGetGoogleConfig).toHaveBeenCalled();
+  return mockGetGoogleConfig.mock.calls[0] as unknown as [
+    Record<string, unknown>,
+    Record<string, unknown>,
+  ];
+}
+
+describe('initializeGoogle', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    delete process.env.GOOGLE_KEY;
+    delete process.env.GOOGLE_REVERSE_PROXY;
+    delete process.env.GOOGLE_AUTH_HEADER;
+    delete process.env.GOOGLE_SERVICE_KEY_FILE;
+    delete process.env.VERTEX_PROJECT_ID;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    delete process.env.GCLOUD_PROJECT;
+    delete process.env.GOOGLE_PROJECT_ID;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('forces Vertex AI ADC config and ignores GOOGLE_KEY for vertexai endpoint', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+    process.env.VERTEX_PROJECT_ID = 'fiery-catwalk-385918';
+    mockLoadServiceKey.mockResolvedValue(null);
+
+    const db = createDb();
+
+    await initializeGoogle({
+      req: createReq(),
+      endpoint: Providers.VERTEXAI,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db,
+    });
+
+    expect(mockLoadServiceKey).toHaveBeenCalledTimes(1);
+    expect(db.getUserKey).not.toHaveBeenCalled();
+    expect(mockCheckUserKeyExpiry).not.toHaveBeenCalled();
+
+    const [credentials, options] = getGoogleConfigCall();
+    expect(credentials).toEqual({
+      [AuthKeys.GOOGLE_SERVICE_KEY]: {},
+    });
+    expect(credentials).not.toHaveProperty(AuthKeys.GOOGLE_API_KEY);
+    expect(options).toEqual(
+      expect.objectContaining({
+        forceVertex: true,
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: { model: 'gemini-2.5-flash' },
+      }),
+    );
+  });
+
+  it('keeps Google API-key config for the google endpoint', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+    process.env.VERTEX_PROJECT_ID = 'fiery-catwalk-385918';
+
+    await initializeGoogle({
+      req: createReq(),
+      endpoint: EModelEndpoint.google,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db: createDb(),
+    });
+
+    expect(mockLoadServiceKey).not.toHaveBeenCalled();
+
+    const [credentials, options] = getGoogleConfigCall();
+    expect(credentials).toEqual({
+      [AuthKeys.GOOGLE_SERVICE_KEY]: {},
+      [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+    });
+    expect(options).toEqual(
+      expect.objectContaining({
+        forceVertex: false,
+        projectId: undefined,
+        modelOptions: { model: 'gemini-2.5-flash' },
+      }),
+    );
+  });
+
+  it('resolves configured headers at init (merged over endpoints.all) before getGoogleConfig', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+
+    const req = {
+      body: { conversationId: 'convo-9' },
+      user: { id: 'user-1' },
+      config: {
+        endpoints: {
+          all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+          [EModelEndpoint.google]: {
+            headers: {
+              'X-Override': 'google',
+              'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+              'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+            },
+          },
+        },
+      },
+    } as unknown as ServerRequest;
+
+    await initializeGoogle({
+      req,
+      endpoint: EModelEndpoint.google,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db: createDb(),
+    });
+
+    const [, options] = getGoogleConfigCall();
+    expect(options.headers).toEqual({
+      'X-Common': 'all',
+      'X-Override': 'google',
+      'X-Conversation-Id': 'convo-9',
+      'X-User-Id': 'user-1',
+    });
+  });
+});
diff --git a/packages/api/src/endpoints/google/initialize.ts b/packages/api/src/endpoints/google/initialize.ts
index dcf750bb878..41c2f65298e 100644
--- a/packages/api/src/endpoints/google/initialize.ts
+++ b/packages/api/src/endpoints/google/initialize.ts
@@ -1,4 +1,5 @@
 import path from 'path';
+import { Providers } from '@librechat/agents';
 import { EModelEndpoint, AuthKeys } from 'librechat-data-provider';
 import type {
   BaseInitializeParams,
@@ -6,7 +7,13 @@ import type {
   GoogleConfigOptions,
   GoogleCredentials,
 } from '~/types';
-import { isEnabled, loadServiceKey, checkUserKeyExpiry } from '~/utils';
+import {
+  isEnabled,
+  loadServiceKey,
+  checkUserKeyExpiry,
+  mergeHeaders,
+  resolveHeaders,
+} from '~/utils';
 import { getGoogleConfig } from './llm';
 
 /**
@@ -23,14 +30,15 @@ export async function initializeGoogle({
   model_parameters,
   db,
 }: BaseInitializeParams): Promise<InitializeResultBase> {
-  void endpoint;
   const appConfig = req.config;
   const { GOOGLE_KEY, GOOGLE_REVERSE_PROXY, GOOGLE_AUTH_HEADER, PROXY } = process.env;
   const isUserProvided = GOOGLE_KEY === 'user_provided';
+  const isVertexEndpoint = endpoint === Providers.VERTEXAI;
+  const useUserProvidedGoogleKey = !isVertexEndpoint && isUserProvided;
   const { key: expiresAt } = req.body;
 
   let userKey = null;
-  if (expiresAt && isUserProvided) {
+  if (expiresAt && useUserProvidedGoogleKey) {
     checkUserKeyExpiry(expiresAt, EModelEndpoint.google);
     userKey = await db.getUserKey({ userId: req.user?.id ?? '', name: EModelEndpoint.google });
   }
@@ -39,9 +47,10 @@ export async function initializeGoogle({
 
   /** Check if GOOGLE_KEY is provided at all (including 'user_provided') */
   const isGoogleKeyProvided =
-    (GOOGLE_KEY && GOOGLE_KEY.trim() !== '') || (isUserProvided && userKey != null);
+    !isVertexEndpoint &&
+    ((GOOGLE_KEY && GOOGLE_KEY.trim() !== '') || (useUserProvidedGoogleKey && userKey != null));
 
-  if (!isGoogleKeyProvided && loadServiceKey) {
+  if ((isVertexEndpoint || !isGoogleKeyProvided) && loadServiceKey) {
     /** Only attempt to load service key if GOOGLE_KEY is not provided */
     try {
       const serviceKeyPath =
@@ -56,11 +65,11 @@ export async function initializeGoogle({
     }
   }
 
-  const credentials: GoogleCredentials = isUserProvided
+  const credentials: GoogleCredentials = useUserProvidedGoogleKey
     ? (userKey as GoogleCredentials)
     : {
         [AuthKeys.GOOGLE_SERVICE_KEY]: serviceKey,
-        [AuthKeys.GOOGLE_API_KEY]: GOOGLE_KEY,
+        ...(!isVertexEndpoint && { [AuthKeys.GOOGLE_API_KEY]: GOOGLE_KEY }),
       };
 
   let clientOptions: GoogleConfigOptions = {};
@@ -79,11 +88,34 @@ export async function initializeGoogle({
     clientOptions.streamRate = allConfig.streamRate;
   }
 
+  /**
+   * Resolve configured Google headers at init (not at request time): the native
+   * Google auth header (`GOOGLE_AUTH_HEADER`) is built from the API key in
+   * `getGoogleConfig` and lives in the same `customHeaders` map. Resolving the
+   * admin templates here — before that key-derived header is added — keeps the
+   * key out of placeholder/env expansion (a user-provided `${ENV}` key can't leak
+   * server env) while still resolving admin headers (env, user, conversationId).
+   * `req.body` lacks the assistant message id at init, so `{{LIBRECHAT_BODY_MESSAGEID}}`
+   * is the one body placeholder unavailable here.
+   */
+  const mergedHeaders = mergeHeaders(allConfig?.headers, googleConfig?.headers);
+  const headers = mergedHeaders
+    ? resolveHeaders({ headers: mergedHeaders, user: req.user, body: req.body })
+    : undefined;
+
   clientOptions = {
     reverseProxyUrl: GOOGLE_REVERSE_PROXY ?? undefined,
     authHeader: isEnabled(GOOGLE_AUTH_HEADER) ?? undefined,
     proxy: PROXY ?? undefined,
+    ...(headers && { headers }),
     modelOptions: model_parameters ?? {},
+    forceVertex: isVertexEndpoint,
+    projectId: isVertexEndpoint
+      ? (process.env.VERTEX_PROJECT_ID ??
+        process.env.GOOGLE_CLOUD_PROJECT ??
+        process.env.GCLOUD_PROJECT ??
+        process.env.GOOGLE_PROJECT_ID)
+      : undefined,
     ...clientOptions,
   };
 
diff --git a/packages/api/src/endpoints/google/llm.spec.ts b/packages/api/src/endpoints/google/llm.spec.ts
index edfa74f0442..483d08f665d 100644
--- a/packages/api/src/endpoints/google/llm.spec.ts
+++ b/packages/api/src/endpoints/google/llm.spec.ts
@@ -1,5 +1,6 @@
 import { Providers } from '@librechat/agents';
 import { AuthKeys, ThinkingLevel } from 'librechat-data-provider';
+import type { GoogleClientOptions } from '@librechat/agents';
 import type * as t from '~/types';
 import { getGoogleConfig, getSafetySettings, knownGoogleParams } from './llm';
 
@@ -64,6 +65,23 @@ describe('getGoogleConfig', () => {
       expect(result.llmConfig).toHaveProperty('apiKey', 'raw-api-key-string');
     });
 
+    it('should not let project id force Vertex AI without the force flag', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.GOOGLE);
+      expect(result.llmConfig).toHaveProperty('apiKey', 'test-api-key');
+      expect(result.llmConfig).not.toHaveProperty('authOptions');
+    });
+
     it('should handle model options including temperature and topP/topK', () => {
       const credentials = {
         [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
@@ -99,6 +117,87 @@ describe('getGoogleConfig', () => {
     });
   });
 
+  describe('Model-aware maxOutputTokens default', () => {
+    const credentials = {
+      [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+    };
+    const vertexCredentials = {
+      [AuthKeys.GOOGLE_SERVICE_KEY]: {
+        project_id: 'test-project',
+        client_email: 'test@test-project.iam.gserviceaccount.com',
+        private_key: 'test-private-key',
+      },
+    };
+
+    it('defaults current Gemini models to 65535 when unset', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.5-pro' },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 65535);
+    });
+
+    it('defaults Gemini 3.5 Flash to 65535 when unset', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-3.5-flash' },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 65535);
+    });
+
+    it('defaults Gemini image models to 32768 when unset', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.5-flash-image' },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 32768);
+    });
+
+    it('defaults legacy Gemini models to 8192 when unset', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.0-flash' },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 8192);
+    });
+
+    it('keeps the Vertex default within the model output limit', () => {
+      const result = getGoogleConfig(vertexCredentials, {
+        modelOptions: { model: 'gemini-2.5-flash' },
+      });
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 65535);
+    });
+
+    it('preserves an explicit maxOutputTokens value', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.5-pro', maxOutputTokens: 1024 },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 1024);
+    });
+
+    it('lets a configured defaultParams maxOutputTokens take precedence over the model default', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.5-pro' },
+        defaultParams: { maxOutputTokens: 2048 },
+      });
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 2048);
+    });
+
+    it('omits maxOutputTokens when listed in dropParams', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-2.5-pro' },
+        dropParams: ['maxOutputTokens'],
+      });
+      expect(result.llmConfig).not.toHaveProperty('maxOutputTokens');
+    });
+
+    it('bases the default on the final model after an addParams override', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-1.5-flash' },
+        addParams: { model: 'gemini-2.5-pro' },
+      });
+      expect(result.llmConfig).toHaveProperty('model', 'gemini-2.5-pro');
+      expect(result.llmConfig).toHaveProperty('maxOutputTokens', 65535);
+    });
+  });
+
   describe('Empty String Handling (Issue Fix)', () => {
     it('should remove empty string maxOutputTokens from config', () => {
       const credentials = {
@@ -237,6 +336,53 @@ describe('getGoogleConfig', () => {
       expect(result.llmConfig).toHaveProperty('location', 'us-central1');
     });
 
+    it('should force Vertex AI ADC config with a project id even when an API key is present', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        forceVertex: true,
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.llmConfig).not.toHaveProperty('apiKey');
+      expect((result.llmConfig as Record<string, unknown>).authOptions).toEqual({
+        projectId: 'fiery-catwalk-385918',
+      });
+    });
+
+    it('should force Vertex AI service-account config when an API key is also present', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+        [AuthKeys.GOOGLE_SERVICE_KEY]: {
+          project_id: 'test-project',
+          client_email: 'test@test-project.iam.gserviceaccount.com',
+          private_key: 'test-private-key',
+        },
+      };
+
+      const result = getGoogleConfig(credentials, {
+        forceVertex: true,
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.llmConfig).not.toHaveProperty('apiKey');
+      expect((result.llmConfig as Record<string, unknown>).authOptions).toMatchObject({
+        projectId: 'test-project',
+        credentials: expect.objectContaining({
+          project_id: 'test-project',
+        }),
+      });
+    });
+
     it('should use GOOGLE_LOC env variable for Vertex AI location', () => {
       process.env.GOOGLE_LOC = 'europe-west1';
 
@@ -628,6 +774,150 @@ describe('getGoogleConfig', () => {
       });
     });
 
+    it('should default Gemini 3.5 Flash to medium thinkingLevel', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3.5-flash',
+        },
+      });
+
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).toMatchObject({
+        includeThoughts: true,
+        thinkingLevel: 'MEDIUM',
+      });
+    });
+
+    it('should preserve explicit Gemini 3.5 Flash thinkingLevel', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3.5-flash',
+          thinkingLevel: ThinkingLevel.low,
+        },
+      });
+
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).toMatchObject({
+        includeThoughts: true,
+        thinkingLevel: 'LOW',
+      });
+    });
+
+    it('should apply Gemini 3.5 Flash overrides to versioned aliases', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'google/gemini-3.5-flash-latest',
+          temperature: 0.7,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('temperature');
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).toMatchObject({
+        includeThoughts: true,
+        thinkingLevel: 'MEDIUM',
+      });
+    });
+
+    it('should remove legacy sampling params for Gemini 3.5 Flash', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const modelOptions = {
+        model: 'gemini-3.5-flash',
+        temperature: 0.7,
+        topP: 0.9,
+        topK: 40,
+        top_p: 0.9,
+        top_k: 40,
+        thinking_budget: 5000,
+      } as unknown as t.GoogleParameters;
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions,
+        defaultParams: {
+          temperature: 0.5,
+          topP: 0.8,
+          topK: 20,
+        },
+        addParams: {
+          temperature: 0.2,
+          topP: 0.6,
+          topK: 10,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('temperature');
+      expect(result.llmConfig).not.toHaveProperty('topP');
+      expect(result.llmConfig).not.toHaveProperty('topK');
+      expect(result.llmConfig).not.toHaveProperty('top_p');
+      expect(result.llmConfig).not.toHaveProperty('top_k');
+      expect(result.llmConfig).not.toHaveProperty('thinking_budget');
+    });
+
+    it('should respect dropParams for Gemini 3.5 Flash thinkingConfig', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3.5-flash',
+        },
+        dropParams: ['thinkingConfig'],
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('thinkingConfig');
+    });
+
+    it('should respect dropParams for Gemini 3.5 Flash includeThoughts', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_SERVICE_KEY]: {
+          project_id: 'test-project',
+        },
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3.5-flash',
+        },
+        dropParams: ['includeThoughts'],
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('includeThoughts');
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).toMatchObject({
+        thinkingLevel: 'MEDIUM',
+      });
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).not.toHaveProperty(
+        'includeThoughts',
+      );
+    });
+
+    it('should remove empty Gemini 3.5 Flash thinkingConfig when all fields are dropped', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3.5-flash',
+        },
+        dropParams: ['includeThoughts', 'thinkingLevel'],
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('thinkingConfig');
+    });
+
     it('should omit thinkingLevel when unset (empty string) for Gemini 3', () => {
       const credentials = {
         [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
@@ -724,6 +1014,43 @@ describe('getGoogleConfig', () => {
       expect(config).toMatchObject({ includeThoughts: true });
     });
 
+    it('should use thinkingLevel for Gemma 4 models', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemma-4-31b-it',
+          thinking: true,
+          thinkingLevel: ThinkingLevel.high,
+        },
+      });
+
+      expect((result.llmConfig as Record<string, unknown>).thinkingConfig).toMatchObject({
+        includeThoughts: true,
+        thinkingLevel: 'HIGH',
+      });
+    });
+
+    it('should ignore thinkingBudget for Gemma 4 models', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemma-4-31b-it',
+          thinking: true,
+          thinkingBudget: 5000,
+        },
+      });
+
+      const config = (result.llmConfig as Record<string, unknown>).thinkingConfig;
+      expect(config).not.toHaveProperty('thinkingBudget');
+      expect(config).toMatchObject({ includeThoughts: true });
+    });
+
     it('should NOT classify gemini-2.9-flash as Gemini 3+', () => {
       const credentials = {
         [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
@@ -852,6 +1179,181 @@ describe('getGoogleConfig', () => {
     });
   });
 
+  describe('URL Context Functionality', () => {
+    const credentials = {
+      [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+    };
+
+    it('should enable the urlContext tool when url_context is true', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          url_context: true,
+        },
+      });
+
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+
+    it('should not include the urlContext tool when url_context is false', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          url_context: false,
+        },
+      });
+
+      expect(result.tools).not.toContainEqual({ urlContext: {} });
+    });
+
+    it('should not include the urlContext tool when url_context is unset', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.tools).not.toContainEqual({ urlContext: {} });
+    });
+
+    it('should enable url context via defaultParams', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+        defaultParams: {
+          url_context: true,
+        },
+      });
+
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+
+    it('should enable url context via addParams', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+        addParams: {
+          url_context: true,
+        },
+      });
+
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+
+    it('should let addParams override a defaultParams url_context', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+        defaultParams: {
+          url_context: true,
+        },
+        addParams: {
+          url_context: false,
+        },
+      });
+
+      expect(result.tools).not.toContainEqual({ urlContext: {} });
+    });
+
+    it('should disable url context via dropParams', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          url_context: true,
+        },
+        dropParams: ['url_context'],
+      });
+
+      expect(result.tools).not.toContainEqual({ urlContext: {} });
+    });
+
+    it('should not leak url_context into the llmConfig', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          url_context: true,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('url_context');
+    });
+
+    it('should enable both googleSearch and urlContext tools together', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          web_search: true,
+          url_context: true,
+        },
+      });
+
+      expect(result.tools).toContainEqual({ googleSearch: {} });
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+
+    it('should not include the urlContext tool on models that do not support it (Gemini < 2.5)', () => {
+      for (const model of ['gemini-2.0-flash', 'gemini-1.5-pro']) {
+        const result = getGoogleConfig(credentials, {
+          modelOptions: {
+            model,
+            url_context: true,
+          },
+        });
+        expect(result.tools).not.toContainEqual({ urlContext: {} });
+      }
+    });
+
+    it('should enable the urlContext tool on Gemini 3.x models', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: {
+          model: 'gemini-3-pro-preview',
+          url_context: true,
+        },
+      });
+
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+
+    it('should not include the urlContext tool on non-text modality variants', () => {
+      for (const model of [
+        'gemini-2.5-flash-image',
+        'gemini-3-pro-image-preview',
+        'gemini-3.5-flash-live',
+        'gemini-2.5-flash-tts',
+        'gemini-2.5-flash-preview-native-audio-dialog',
+      ]) {
+        const result = getGoogleConfig(credentials, {
+          modelOptions: {
+            model,
+            url_context: true,
+          },
+        });
+        expect(result.tools).not.toContainEqual({ urlContext: {} });
+      }
+    });
+
+    it('should enable the urlContext tool for the Vertex AI provider', () => {
+      const vertexCredentials = {
+        [AuthKeys.GOOGLE_SERVICE_KEY]: {
+          project_id: 'test-project',
+        },
+      };
+
+      const result = getGoogleConfig(vertexCredentials, {
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+          url_context: true,
+        },
+      });
+
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.tools).toContainEqual({ urlContext: {} });
+    });
+  });
+
   describe('Default and Add Parameters', () => {
     it('should apply default parameters when fields are undefined', () => {
       const credentials = {
@@ -1180,4 +1682,34 @@ describe('knownGoogleParams', () => {
     expect(knownGoogleParams.has('frequency_penalty')).toBe(false);
     expect(knownGoogleParams.has('presence_penalty')).toBe(false);
   });
+
+  describe('custom headers', () => {
+    const credentials = { [AuthKeys.GOOGLE_API_KEY]: 'test-api-key' };
+
+    it('attaches admin-configured headers to customHeaders, keeping placeholders intact', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-1.5-flash' },
+        headers: {
+          'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}"}',
+        },
+      });
+
+      expect((result.llmConfig as GoogleClientOptions).customHeaders).toEqual({
+        'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}"}',
+      });
+    });
+
+    it('does not let custom headers override the provider-managed Authorization header', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-1.5-flash' },
+        authHeader: true,
+        headers: { Authorization: 'Bearer attacker', 'X-Conversation-Id': 'cid' },
+      });
+
+      expect((result.llmConfig as GoogleClientOptions).customHeaders).toEqual({
+        Authorization: 'Bearer test-api-key',
+        'X-Conversation-Id': 'cid',
+      });
+    });
+  });
 });
diff --git a/packages/api/src/endpoints/google/llm.ts b/packages/api/src/endpoints/google/llm.ts
index 460dc742524..d6ce10ce56e 100644
--- a/packages/api/src/endpoints/google/llm.ts
+++ b/packages/api/src/endpoints/google/llm.ts
@@ -1,16 +1,30 @@
 import { Providers } from '@librechat/agents';
+import { logger } from '@librechat/data-schemas';
 import { googleSettings, AuthKeys, removeNullishValues } from 'librechat-data-provider';
 import type { GoogleClientOptions, VertexAIClientOptions } from '@librechat/agents';
 import type { GoogleAIToolType } from '@librechat/agents/langchain/google-common';
 import type * as t from '~/types';
+import { mergeHeaders } from '~/utils/headers';
 import { isEnabled } from '~/utils';
 
 type GoogleThinkingLevel = 'THINKING_LEVEL_UNSPECIFIED' | 'MINIMAL' | 'LOW' | 'MEDIUM' | 'HIGH';
 type GoogleThinkingConfig = {
-  includeThoughts: boolean;
+  includeThoughts?: boolean;
   thinkingLevel?: GoogleThinkingLevel;
 };
 
+const GEMINI_3_5_FLASH = 'gemini-3.5-flash';
+const GEMINI_3_5_FLASH_DEFAULT_THINKING_LEVEL: GoogleThinkingLevel = 'MEDIUM';
+const gemini35FlashLegacyParams = [
+  'temperature',
+  'topP',
+  'topK',
+  'top_p',
+  'top_k',
+  'thinkingBudget',
+  'thinking_budget',
+] as const;
+
 const googleThinkingLevels = new Set<GoogleThinkingLevel>([
   'THINKING_LEVEL_UNSPECIFIED',
   'MINIMAL',
@@ -40,7 +54,7 @@ type GoogleModelOptions = Partial<t.GoogleParameters> &
   Partial<Record<BlockedModelOptionParam, unknown>>;
 
 /** Known Google/Vertex AI parameters that map directly to the client config */
-export const knownGoogleParams = new Set([
+export const knownGoogleParams: Set<string> = new Set([
   'model',
   'modelName',
   'temperature',
@@ -116,6 +130,36 @@ function normalizeGoogleThinkingLevel(value: unknown): GoogleThinkingLevel | und
   return normalized;
 }
 
+function isGemini35Flash(model: string) {
+  const normalized = model.toLowerCase();
+  const modelId = normalized.split('/').pop() ?? normalized;
+  return modelId === GEMINI_3_5_FLASH || modelId.startsWith(`${GEMINI_3_5_FLASH}-`);
+}
+
+const urlContextModelRegex = /gemini-(\d+)(?:\.(\d+))?/i;
+const urlContextExcludedModalityRegex = /(?:^|-)(?:image|live|tts|audio)(?:-|$)/;
+
+/**
+ * The native URL Context tool is supported only on text Gemini 2.5+ and 3.x models
+ * (https://ai.google.dev/gemini-api/docs/url-context#supported_models). Modality-specific
+ * variants (image, live, TTS) do not accept it, mirroring the Google tool-combination exclusion.
+ * Enabling it on an unsupported model returns a provider-side error, so we skip the tool there.
+ */
+function supportsUrlContext(model: string): boolean {
+  const normalized = model.trim().toLowerCase();
+  const modelId = normalized.split('/').pop() ?? normalized;
+  if (urlContextExcludedModalityRegex.test(modelId)) {
+    return false;
+  }
+  const match = urlContextModelRegex.exec(modelId);
+  if (!match) {
+    return false;
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2] ?? '0');
+  return major > 2 || (major === 2 && minor >= 5);
+}
+
 function getVertexMultiRegionEndpoint(location: string): string | undefined {
   return vertexMultiRegionEndpoints.get(location);
 }
@@ -128,6 +172,68 @@ function sanitizeModelOptions(modelOptions: Partial<t.GoogleParameters> | undefi
   return sanitizedOptions;
 }
 
+function applyGemini35FlashOverrides({
+  config,
+  provider,
+  thinking,
+  dropParams,
+}: {
+  config: GoogleClientOptions | VertexAIClientOptions;
+  provider: Providers;
+  thinking: boolean;
+  dropParams?: string[];
+}) {
+  const mutableConfig = config as Record<string, unknown>;
+  const model = mutableConfig.model;
+  if (typeof model !== 'string' || !isGemini35Flash(model)) {
+    return;
+  }
+
+  gemini35FlashLegacyParams.forEach((param) => {
+    delete mutableConfig[param];
+  });
+
+  if (!thinking) {
+    return;
+  }
+
+  const droppedParams = new Set(dropParams ?? []);
+  if (droppedParams.has('thinkingConfig')) {
+    return;
+  }
+
+  const shouldDropIncludeThoughts = droppedParams.has('includeThoughts');
+  const shouldDropThinkingLevel = droppedParams.has('thinkingLevel');
+  const configWithThinking = config as { thinkingConfig?: GoogleThinkingConfig };
+  const thinkingConfig: GoogleThinkingConfig = { ...(configWithThinking.thinkingConfig ?? {}) };
+
+  if (shouldDropIncludeThoughts) {
+    delete thinkingConfig.includeThoughts;
+  }
+
+  if (shouldDropThinkingLevel) {
+    delete thinkingConfig.thinkingLevel;
+  }
+
+  if (!shouldDropIncludeThoughts && thinkingConfig.includeThoughts == null) {
+    thinkingConfig.includeThoughts = true;
+  }
+
+  if (!shouldDropThinkingLevel && !thinkingConfig.thinkingLevel) {
+    thinkingConfig.thinkingLevel = GEMINI_3_5_FLASH_DEFAULT_THINKING_LEVEL;
+  }
+
+  if (Object.keys(thinkingConfig).length > 0) {
+    configWithThinking.thinkingConfig = thinkingConfig;
+  } else {
+    delete configWithThinking.thinkingConfig;
+  }
+
+  if (provider === Providers.VERTEXAI && !shouldDropIncludeThoughts) {
+    (config as VertexAIClientOptions).includeThoughts = true;
+  }
+}
+
 function isAllowedVertexEndpoint(endpoint: string): boolean {
   if (!/^[a-z0-9][a-z0-9.-]*[a-z0-9]$/.test(endpoint)) {
     return false;
@@ -184,6 +290,10 @@ function applyVertexMultiRegionEndpoint(config: VertexAIClientOptions & { endpoi
   }
 }
 
+function hasServiceKeyCredentials(serviceKey: Record<string, unknown>): boolean {
+  return Object.keys(serviceKey).length > 0;
+}
+
 export function getSafetySettings(
   model?: string,
 ): Array<{ category: string; threshold: string }> | undefined {
@@ -236,7 +346,14 @@ export function getGoogleConfig(
   credentials: string | t.GoogleCredentials | undefined,
   options: t.GoogleConfigOptions = {},
   acceptRawApiKey = false,
-) {
+): {
+  /** @type {GoogleAIToolType[]} */
+  tools: GoogleAIToolType[];
+  /** @type {Providers.GOOGLE | Providers.VERTEXAI} */
+  provider: Providers.VERTEXAI | Providers.GOOGLE;
+  /** @type {GoogleClientOptions | VertexAIClientOptions} */
+  llmConfig: VertexAIClientOptions | GoogleClientOptions;
+} {
   let creds: t.GoogleCredentials = {};
   if (acceptRawApiKey && typeof credentials === 'string') {
     creds[AuthKeys.GOOGLE_API_KEY] = credentials;
@@ -257,13 +374,19 @@ export function getGoogleConfig(
     typeof serviceKeyRaw === 'string' ? JSON.parse(serviceKeyRaw) : (serviceKeyRaw ?? {});
 
   const apiKey = creds[AuthKeys.GOOGLE_API_KEY] ?? null;
-  const project_id = !apiKey ? (serviceKey?.project_id ?? null) : null;
+  let project_id = null;
+  if (options.forceVertex === true) {
+    project_id = options.projectId ?? serviceKey?.project_id ?? null;
+  } else if (!apiKey) {
+    project_id = serviceKey?.project_id ?? null;
+  }
 
   const reverseProxyUrl = options.reverseProxyUrl;
   const authHeader = options.authHeader;
 
   const {
     web_search,
+    url_context,
     thinkingLevel,
     thinking = googleSettings.thinking.default,
     thinkingBudget = googleSettings.thinkingBudget.default,
@@ -271,6 +394,7 @@ export function getGoogleConfig(
   } = sanitizeModelOptions(options.modelOptions);
 
   let enableWebSearch = web_search;
+  let enableUrlContext = url_context;
 
   const llmConfig = removeNullishValues(
     {
@@ -293,7 +417,7 @@ export function getGoogleConfig(
 
   let provider;
 
-  if (project_id) {
+  if (options.forceVertex === true || project_id) {
     provider = Providers.VERTEXAI;
   } else {
     provider = Providers.GOOGLE;
@@ -301,10 +425,13 @@ export function getGoogleConfig(
 
   // If we have a GCP project => Vertex AI
   if (provider === Providers.VERTEXAI) {
-    (llmConfig as VertexAIClientOptions).authOptions = {
-      credentials: { ...serviceKey },
-      projectId: project_id,
-    };
+    (llmConfig as VertexAIClientOptions).authOptions = removeNullishValues(
+      {
+        ...(hasServiceKeyCredentials(serviceKey) && { credentials: { ...serviceKey } }),
+        projectId: project_id,
+      },
+      true,
+    );
     const location = process.env.GOOGLE_LOC || 'us-central1';
     (llmConfig as VertexAIClientOptions).location = location;
   } else if (apiKey && provider === Providers.GOOGLE) {
@@ -318,18 +445,18 @@ export function getGoogleConfig(
   const modelName = (modelOptions?.model ?? '') as string;
 
   /**
-   * Gemini 3+ uses a qualitative `thinkingLevel` ('minimal'|'low'|'medium'|'high')
-   * instead of the numeric `thinkingBudget` used by Gemini 2.5 and earlier.
+   * Gemini 3+ and Gemma 4+ use a qualitative `thinkingLevel` ('minimal'|'low'|'medium'|'high')
+   * instead of the numeric `thinkingBudget` used by earlier models.
    * When `thinking` is enabled (default: true), we always send `thinkingConfig`
-   * with `includeThoughts: true`. The `thinkingBudget` param is ignored for Gemini 3+.
+   * with `includeThoughts: true`. The `thinkingBudget` param is ignored for these models.
    *
    * For Vertex AI, top-level `includeThoughts` is still required because
    * `@librechat/agents/langchain/google-common`'s `formatGenerationConfig` reads it separately
    * from `thinkingConfig` — they serve different purposes in the request pipeline.
    */
-  const isGemini3Plus = /gemini-([3-9]|\d{2,})/i.test(modelName);
+  const supportsThinkingLevel = /gemini-([3-9]|\d{2,})|gemma-([4-9]|\d{2,})/i.test(modelName);
 
-  if (isGemini3Plus && thinking) {
+  if (supportsThinkingLevel && thinking) {
     const thinkingConfig: GoogleThinkingConfig = {
       includeThoughts: true,
     };
@@ -343,7 +470,7 @@ export function getGoogleConfig(
       (llmConfig as { thinkingConfig?: GoogleThinkingConfig }).thinkingConfig = thinkingConfig;
       (llmConfig as VertexAIClientOptions).includeThoughts = true;
     }
-  } else if (!isGemini3Plus) {
+  } else if (!supportsThinkingLevel) {
     const shouldEnableThinking =
       thinking && thinkingBudget != null && (thinkingBudget > 0 || thinkingBudget === -1);
 
@@ -390,6 +517,19 @@ export function getGoogleConfig(
     };
   }
 
+  /**
+   * Attach admin-configured custom headers (e.g. AI-gateway metadata) beneath
+   * the provider-managed `Authorization` header above, so auth always wins.
+   * `options.headers` are already resolved by `initializeGoogle`, keeping the
+   * key-derived `Authorization` out of placeholder/env expansion.
+   */
+  if (options.headers && Object.keys(options.headers).length > 0) {
+    (llmConfig as GoogleClientOptions).customHeaders = mergeHeaders(
+      options.headers,
+      (llmConfig as GoogleClientOptions).customHeaders as Record<string, string> | undefined,
+    );
+  }
+
   /** Handle defaultParams first - only process Google-native params if undefined */
   if (options.defaultParams && typeof options.defaultParams === 'object') {
     for (const [key, value] of Object.entries(options.defaultParams)) {
@@ -401,6 +541,14 @@ export function getGoogleConfig(
         continue;
       }
 
+      /** Handle url_context separately - resolved to a native tool, not config */
+      if (key === 'url_context') {
+        if (enableUrlContext === undefined && typeof value === 'boolean') {
+          enableUrlContext = value;
+        }
+        continue;
+      }
+
       if (knownGoogleParams.has(key)) {
         /** Route known Google params to llmConfig only if undefined */
         applyDefaultParams(llmConfig as Record<string, unknown>, { [key]: value });
@@ -423,6 +571,14 @@ export function getGoogleConfig(
         continue;
       }
 
+      /** Handle url_context separately - resolved to a native tool, not config */
+      if (key === 'url_context') {
+        if (typeof value === 'boolean') {
+          enableUrlContext = value;
+        }
+        continue;
+      }
+
       if (knownGoogleParams.has(key)) {
         /** Route known Google params to llmConfig */
         (llmConfig as Record<string, unknown>)[key] = value;
@@ -442,6 +598,11 @@ export function getGoogleConfig(
         return;
       }
 
+      if (param === 'url_context') {
+        enableUrlContext = false;
+        return;
+      }
+
       if (param === 'endpoint') {
         shouldSyncVertexEndpoint = false;
         hasCustomVertexEndpoint = false;
@@ -453,6 +614,33 @@ export function getGoogleConfig(
     });
   }
 
+  /**
+   * Apply the model-aware `maxOutputTokens` default last, so an explicit value,
+   * `defaultParams`, and `addParams` all take precedence and a `dropParams` entry
+   * is respected. Only fill in when the field is genuinely unset (`undefined`/`null`);
+   * an empty-string value stays stripped per Gemini empty-payload handling. Without
+   * this, current Gemini models would inherit the legacy 8K default instead of their
+   * documented limit.
+   */
+  const maxOutputDropped =
+    Array.isArray(options.dropParams) && options.dropParams.includes('maxOutputTokens');
+  if (
+    !maxOutputDropped &&
+    modelOptions?.maxOutputTokens == null &&
+    (llmConfig as Record<string, unknown>).maxOutputTokens == null
+  ) {
+    const resolvedModel = (llmConfig as { model?: string }).model || modelName;
+    (llmConfig as GoogleClientOptions).maxOutputTokens =
+      googleSettings.maxOutputTokens.reset(resolvedModel);
+  }
+
+  applyGemini35FlashOverrides({
+    config: llmConfig,
+    provider,
+    thinking,
+    dropParams: Array.isArray(options.dropParams) ? options.dropParams : undefined,
+  });
+
   if (provider === Providers.VERTEXAI && shouldSyncVertexEndpoint && !hasCustomVertexEndpoint) {
     applyVertexMultiRegionEndpoint(llmConfig as VertexAIClientOptions & { endpoint?: string });
   }
@@ -463,6 +651,17 @@ export function getGoogleConfig(
     tools.push({ googleSearch: {} });
   }
 
+  if (enableUrlContext) {
+    const urlContextModel = ((llmConfig as { model?: string }).model || modelName) ?? '';
+    if (supportsUrlContext(urlContextModel)) {
+      tools.push({ urlContext: {} });
+    } else {
+      logger.debug(
+        `[getGoogleConfig] url_context enabled but model "${urlContextModel}" does not support the URL Context tool (Gemini 2.5+ only); skipping.`,
+      );
+    }
+  }
+
   // Return the final shape
   return {
     /** @type {GoogleAIToolType[]} */
diff --git a/packages/api/src/endpoints/google/youtube.spec.ts b/packages/api/src/endpoints/google/youtube.spec.ts
new file mode 100644
index 00000000000..84fe7c230e3
--- /dev/null
+++ b/packages/api/src/endpoints/google/youtube.spec.ts
@@ -0,0 +1,526 @@
+import { Providers } from '@librechat/agents';
+import { ContentTypes } from 'librechat-data-provider';
+import type { MessageContentComplex } from '@librechat/agents';
+import {
+  hasUrlContextTool,
+  extractYouTubeUrls,
+  appendYouTubeVideoParts,
+  DEFAULT_MAX_YOUTUBE_PARTS,
+  resolveYouTubeInjectionConfig,
+} from './youtube';
+
+const WATCH = (id: string) => `https://www.youtube.com/watch?v=${id}`;
+
+describe('extractYouTubeUrls', () => {
+  it('extracts a standard watch URL', () => {
+    expect(extractYouTubeUrls('Watch https://www.youtube.com/watch?v=dQw4w9WgXcQ now')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('extracts youtu.be short links (with tracking params)', () => {
+    expect(extractYouTubeUrls('see https://youtu.be/dQw4w9WgXcQ?si=abc123')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('extracts shorts URLs', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/shorts/dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('extracts live URLs', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/live/dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('extracts embed URLs', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/embed/dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('handles watch URLs with leading/trailing query params', () => {
+    expect(
+      extractYouTubeUrls('https://www.youtube.com/watch?list=PLxyz&v=dQw4w9WgXcQ&t=42'),
+    ).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('handles m. and scheme-less hosts', () => {
+    expect(extractYouTubeUrls('m.youtube.com/watch?v=dQw4w9WgXcQ')).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('handles other YouTube subdomains (music., gaming.)', () => {
+    expect(extractYouTubeUrls('https://music.youtube.com/watch?v=dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+    expect(extractYouTubeUrls('https://gaming.youtube.com/watch?v=dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('handles youtube-nocookie embed URLs', () => {
+    expect(extractYouTubeUrls('https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('preserves order across multiple distinct videos', () => {
+    const text = 'https://youtu.be/aaaaaaaaaaa then https://www.youtube.com/watch?v=bbbbbbbbbbb';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('aaaaaaaaaaa'), WATCH('bbbbbbbbbbb')]);
+  });
+
+  it('de-duplicates the same video id across different URL forms', () => {
+    const text =
+      'https://youtu.be/dQw4w9WgXcQ and https://www.youtube.com/watch?v=dQw4w9WgXcQ&t=10';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('extracts both URLs from a comma-separated pair in one token', () => {
+    const text = 'https://youtu.be/aaaaaaaaaaa,https://youtu.be/bbbbbbbbbbb';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('aaaaaaaaaaa'), WATCH('bbbbbbbbbbb')]);
+  });
+
+  it('extracts adjacent markdown-style links', () => {
+    const text = '[a](https://youtu.be/aaaaaaaaaaa)[b](https://youtu.be/bbbbbbbbbbb)';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('aaaaaaaaaaa'), WATCH('bbbbbbbbbbb')]);
+  });
+
+  it('extracts adjacent links separated by semicolons or pipes', () => {
+    expect(extractYouTubeUrls('https://youtu.be/aaaaaaaaaaa;https://youtu.be/bbbbbbbbbbb')).toEqual(
+      [WATCH('aaaaaaaaaaa'), WATCH('bbbbbbbbbbb')],
+    );
+    expect(extractYouTubeUrls('https://youtu.be/aaaaaaaaaaa|https://youtu.be/bbbbbbbbbbb')).toEqual(
+      [WATCH('aaaaaaaaaaa'), WATCH('bbbbbbbbbbb')],
+    );
+  });
+
+  it('finds a nested youtu.be link inside an unrecognized YouTube URL', () => {
+    const text = 'https://www.youtube.com/redirect?q=https://youtu.be/dQw4w9WgXcQ';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('finds a nested youtu.be link inside a watch URL with no own v=', () => {
+    const text = 'https://www.youtube.com/watch?url=https://youtu.be/dQw4w9WgXcQ';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('skips a malformed v= and uses a later valid one', () => {
+    const text = 'https://www.youtube.com/watch?v=tooShort&list=x&v=dQw4w9WgXcQ';
+    expect(extractYouTubeUrls(text)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('ignores unrecognized YouTube routes with no nested video', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/results?search_query=cats')).toEqual([]);
+    expect(extractYouTubeUrls('https://www.youtube.com/@SomeChannel')).toEqual([]);
+  });
+
+  it('matches capitalized watch/embed paths (case-insensitive)', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/WATCH?v=dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+    expect(extractYouTubeUrls('https://www.youtube.com/EMBED/dQw4w9WgXcQ')).toEqual([
+      WATCH('dQw4w9WgXcQ'),
+    ]);
+  });
+
+  it('ignores non-YouTube URLs', () => {
+    expect(extractYouTubeUrls('https://example.com/watch?v=dQw4w9WgXcQ')).toEqual([]);
+  });
+
+  it('ignores look-alike hosts (e.g. notyoutube.com, evil-youtube.com)', () => {
+    expect(extractYouTubeUrls('https://notyoutube.com/watch?v=dQw4w9WgXcQ')).toEqual([]);
+    expect(extractYouTubeUrls('https://evil-youtube.com/watch?v=dQw4w9WgXcQ')).toEqual([]);
+    expect(extractYouTubeUrls('https://youtube.com.evil.com/watch?v=dQw4w9WgXcQ')).toEqual([]);
+  });
+
+  it('ignores ids that are not exactly 11 valid characters', () => {
+    expect(extractYouTubeUrls('https://www.youtube.com/watch?v=tooShort')).toEqual([]);
+  });
+
+  it('returns an empty array for empty / nullish input', () => {
+    expect(extractYouTubeUrls('')).toEqual([]);
+    expect(extractYouTubeUrls(undefined)).toEqual([]);
+    expect(extractYouTubeUrls(null)).toEqual([]);
+  });
+
+  it('caps the number of returned URLs at the default', () => {
+    const ids = Array.from(
+      { length: DEFAULT_MAX_YOUTUBE_PARTS + 3 },
+      (_, i) => `vid${String(i).padStart(8, '0')}`,
+    );
+    const text = ids.map((id) => `https://youtu.be/${id}`).join(' ');
+    expect(extractYouTubeUrls(text)).toHaveLength(DEFAULT_MAX_YOUTUBE_PARTS);
+  });
+
+  it('honors a custom max', () => {
+    const text = 'https://youtu.be/aaaaaaaaaaa https://youtu.be/bbbbbbbbbbb';
+    expect(extractYouTubeUrls(text, 1)).toEqual([WATCH('aaaaaaaaaaa')]);
+  });
+
+  it('returns an empty array when max is zero', () => {
+    expect(extractYouTubeUrls('https://youtu.be/dQw4w9WgXcQ', 0)).toEqual([]);
+  });
+});
+
+describe('hasUrlContextTool', () => {
+  it('returns true when a urlContext tool is present', () => {
+    expect(hasUrlContextTool([{ urlContext: {} }])).toBe(true);
+  });
+
+  it('returns true when mixed with other provider tools', () => {
+    expect(hasUrlContextTool([{ googleSearch: {} }, { urlContext: {} }])).toBe(true);
+  });
+
+  it('returns false when only other provider tools are present', () => {
+    expect(hasUrlContextTool([{ googleSearch: {} }])).toBe(false);
+  });
+
+  it('returns false for empty / non-array inputs', () => {
+    expect(hasUrlContextTool([])).toBe(false);
+    expect(hasUrlContextTool(undefined)).toBe(false);
+    expect(hasUrlContextTool(null)).toBe(false);
+    expect(hasUrlContextTool('urlContext')).toBe(false);
+  });
+});
+
+describe('appendYouTubeVideoParts', () => {
+  const youtubeText = 'Summarize https://www.youtube.com/watch?v=dQw4w9WgXcQ for me';
+
+  it('returns content unchanged when disabled', () => {
+    const result = appendYouTubeVideoParts({
+      enabled: false,
+      text: youtubeText,
+      content: youtubeText,
+    });
+    expect(result).toBe(youtubeText);
+  });
+
+  it('returns content unchanged when there are no YouTube URLs', () => {
+    const text = 'Read https://example.com/article';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text });
+    expect(result).toBe(text);
+  });
+
+  it('upgrades string content to a parts array, stripping the URL from text', () => {
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text: youtubeText,
+      content: youtubeText,
+    });
+
+    expect(Array.isArray(result)).toBe(true);
+    const parts = result as MessageContentComplex[];
+    /** The YouTube URL is removed from the text since it now flows through video understanding. */
+    expect(parts[0]).toEqual({ type: ContentTypes.TEXT, text: 'Summarize for me' });
+
+    const mediaPart = parts[1] as Record<string, unknown>;
+    expect(mediaPart.type).toBe('media');
+    expect(mediaPart.fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+    /** The agents media converter requires the `mimeType` key to be present. */
+    expect('mimeType' in mediaPart).toBe(true);
+    expect(mediaPart.mimeType).toBeUndefined();
+  });
+
+  it('strips the YouTube URL from an existing text part but leaves other parts intact', () => {
+    const content: MessageContentComplex[] = [
+      { type: ContentTypes.TEXT, text: youtubeText } as MessageContentComplex,
+      {
+        type: 'image_url',
+        image_url: { url: 'data:image/png;base64,AAAA' },
+      } as MessageContentComplex,
+    ];
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text: youtubeText,
+      content,
+    }) as MessageContentComplex[];
+
+    expect(result).toHaveLength(3);
+    expect(result[0]).toEqual({ type: ContentTypes.TEXT, text: 'Summarize for me' });
+    expect(result[1]).toEqual(content[1]);
+    expect((result[2] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+
+  it('strips YouTube links from text but leaves non-YouTube URLs intact for urlContext', () => {
+    const text = 'Watch https://youtu.be/dQw4w9WgXcQ and read https://example.com/article please';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text });
+
+    const parts = result as MessageContentComplex[];
+    const textPart = parts[0] as { type: string; text: string };
+    expect(textPart.text).not.toContain('youtu.be');
+    expect(textPart.text).not.toContain('dQw4w9WgXcQ');
+    expect(textPart.text).toContain('https://example.com/article');
+    expect(textPart.text).toBe('Watch and read https://example.com/article please');
+
+    const mediaParts = parts.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+
+  it('drops a text part that becomes empty after stripping a sole YouTube URL', () => {
+    const text = 'https://youtu.be/dQw4w9WgXcQ';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text });
+
+    const parts = result as MessageContentComplex[];
+    expect(parts).toHaveLength(1);
+    expect((parts[0] as Record<string, unknown>).type).toBe('media');
+    expect((parts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+
+  it('keeps over-limit YouTube links in the text (only injected ones are stripped)', () => {
+    const text = 'https://youtu.be/aaaaaaaaaaa and https://youtu.be/bbbbbbbbbbb';
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text,
+      content: text,
+      max: 1,
+    }) as MessageContentComplex[];
+
+    const mediaParts = result.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('aaaaaaaaaaa'));
+
+    const textPart = result.find((p) => (p as Record<string, unknown>).type === 'text') as {
+      text: string;
+    };
+    /** The injected link is stripped; the over-limit link is preserved for the model. */
+    expect(textPart.text).not.toContain('aaaaaaaaaaa');
+    expect(textPart.text).toContain('bbbbbbbbbbb');
+  });
+
+  it('keeps a timestamped YouTube link in the text so the moment cue survives', () => {
+    const text = 'what happens here https://youtu.be/dQw4w9WgXcQ?t=90';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text });
+
+    const parts = result as MessageContentComplex[];
+    const textPart = parts.find((p) => (p as Record<string, unknown>).type === 'text') as {
+      text: string;
+    };
+    expect(textPart.text).toContain('t=90');
+
+    const mediaParts = parts.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+
+  it('keeps a timestamp that precedes the video id in the watch URL', () => {
+    const text = 'jump to https://www.youtube.com/watch?t=90&v=dQw4w9WgXcQ';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text });
+
+    const parts = result as MessageContentComplex[];
+    const textPart = parts.find((p) => (p as Record<string, unknown>).type === 'text') as {
+      text: string;
+    };
+    expect(textPart.text).toContain('t=90');
+    expect(textPart.text).toContain('dQw4w9WgXcQ');
+
+    const mediaParts = parts.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+  });
+
+  it('does not duplicate a video already present as a media part', () => {
+    const content: MessageContentComplex[] = [
+      { type: ContentTypes.TEXT, text: youtubeText } as MessageContentComplex,
+      {
+        type: 'media',
+        mimeType: undefined,
+        fileUri: WATCH('dQw4w9WgXcQ'),
+      } as MessageContentComplex,
+    ];
+    const result = appendYouTubeVideoParts({ enabled: true, text: youtubeText, content });
+    expect(result).toBe(content);
+  });
+
+  it('de-duplicates against an existing fileData part', () => {
+    const content: MessageContentComplex[] = [
+      { type: ContentTypes.TEXT, text: youtubeText } as MessageContentComplex,
+      {
+        type: 'media',
+        fileData: { fileUri: WATCH('dQw4w9WgXcQ') },
+      } as unknown as MessageContentComplex,
+    ];
+    const result = appendYouTubeVideoParts({ enabled: true, text: youtubeText, content });
+    expect(result).toBe(content);
+  });
+
+  it('stamps the provided mimeType on the media part (Vertex)', () => {
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text: youtubeText,
+      content: youtubeText,
+      mimeType: 'video/mp4',
+    }) as MessageContentComplex[];
+
+    const mediaPart = result[result.length - 1] as Record<string, unknown>;
+    expect(mediaPart.type).toBe('media');
+    expect(mediaPart.mimeType).toBe('video/mp4');
+  });
+
+  it('respects max=1 even when the message has multiple YouTube links', () => {
+    const text = 'https://youtu.be/aaaaaaaaaaa and https://youtu.be/bbbbbbbbbbb';
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text,
+      content: text,
+      max: 1,
+    }) as MessageContentComplex[];
+
+    const mediaParts = result.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('aaaaaaaaaaa'));
+  });
+
+  it('strips a watch URL fully when it has a URL-valued param after the id (no orphan)', () => {
+    const text =
+      'summarize https://www.youtube.com/watch?v=dQw4w9WgXcQ&next=https://example.com please';
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text, max: 5 });
+
+    const parts = result as MessageContentComplex[];
+    const textPart = parts.find((p) => (p as Record<string, unknown>).type === 'text') as {
+      text: string;
+    };
+    expect(textPart.text).toBe('summarize please');
+    expect(textPart.text).not.toContain('example.com');
+
+    const mediaParts = parts.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+});
+
+describe('resolveYouTubeInjectionConfig', () => {
+  it('caps Vertex at one video and sets a video/mp4 mimeType', () => {
+    expect(
+      resolveYouTubeInjectionConfig({ provider: Providers.VERTEXAI, model: 'gemini-2.5-flash' }),
+    ).toEqual({
+      max: 1,
+      mimeType: 'video/mp4',
+    });
+  });
+
+  it('allows multiple videos with no mimeType for Gemini 2.5+ on the Developer API', () => {
+    expect(
+      resolveYouTubeInjectionConfig({ provider: Providers.GOOGLE, model: 'gemini-2.5-flash' }),
+    ).toEqual({
+      max: DEFAULT_MAX_YOUTUBE_PARTS,
+    });
+    expect(
+      resolveYouTubeInjectionConfig({ provider: Providers.GOOGLE, model: 'gemini-3-pro-preview' }),
+    ).toEqual({
+      max: DEFAULT_MAX_YOUTUBE_PARTS,
+    });
+  });
+
+  it('caps pre-2.5 and unknown Developer API models at one video', () => {
+    expect(
+      resolveYouTubeInjectionConfig({ provider: Providers.GOOGLE, model: 'gemini-2.0-flash' }),
+    ).toEqual({
+      max: 1,
+    });
+    expect(
+      resolveYouTubeInjectionConfig({ provider: Providers.GOOGLE, model: 'gemini-1.5-pro' }),
+    ).toEqual({
+      max: 1,
+    });
+    expect(resolveYouTubeInjectionConfig({ provider: Providers.GOOGLE })).toEqual({ max: 1 });
+  });
+});
+
+describe('ReDoS safety', () => {
+  it('returns quickly for a long malformed watch token with no v= parameter', () => {
+    /** One ~600KB non-whitespace token; before the fix this exhibited quadratic backtracking. */
+    const malicious = 'https://www.youtube.com/watch?'.repeat(20000);
+    const start = Date.now();
+    const result = extractYouTubeUrls(malicious, 5);
+    const elapsed = Date.now() - start;
+
+    expect(result).toEqual([]);
+    expect(elapsed).toBeLessThan(1000);
+  });
+
+  it('returns quickly for a malformed path of millions of slashes', () => {
+    const malicious = `https://www.youtube.com/${'/'.repeat(3_000_000)}`;
+    const start = Date.now();
+    const result = extractYouTubeUrls(malicious, 5);
+
+    expect(result).toEqual([]);
+    expect(Date.now() - start).toBeLessThan(1000);
+  });
+
+  it('returns quickly for many medium malformed watch tokens', () => {
+    const token = 'https://www.youtube.com/watch?'.repeat(50); // ~1.5KB malformed token
+    const malicious = `${token} `.repeat(2000); // ~3MB of whitespace-separated malformed tokens
+    const start = Date.now();
+    const result = extractYouTubeUrls(malicious, 5);
+
+    expect(result).toEqual([]);
+    expect(Date.now() - start).toBeLessThan(1000);
+  });
+
+  it('still extracts a valid URL that appears before a huge token', () => {
+    const text = `https://youtu.be/dQw4w9WgXcQ ${'x'.repeat(60000)}`;
+    expect(extractYouTubeUrls(text, 5)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('injects + strips quickly when a valid URL is followed by a huge malformed token', () => {
+    const text = `https://youtu.be/dQw4w9WgXcQ ${'https://www.youtube.com/watch?'.repeat(20000)}`;
+    const start = Date.now();
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text, max: 5 });
+    const elapsed = Date.now() - start;
+
+    expect(elapsed).toBeLessThan(1000);
+    const mediaParts = (result as MessageContentComplex[]).filter(
+      (p) => (p as Record<string, unknown>).type === 'media',
+    );
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+
+  it('strips quickly when a valid URL precedes ~3MB of medium malformed tokens', () => {
+    /** Exercises the strip path: extraction finds the valid URL, then strip must stay bounded. */
+    const tail = `${'https://www.youtube.com/watch?'.repeat(50)} `.repeat(2000);
+    const text = `https://youtu.be/dQw4w9WgXcQ ${tail}`;
+    const start = Date.now();
+    const result = appendYouTubeVideoParts({ enabled: true, text, content: text, max: 5 });
+    const elapsed = Date.now() - start;
+
+    expect(elapsed).toBeLessThan(1000);
+    const mediaParts = (result as MessageContentComplex[]).filter(
+      (p) => (p as Record<string, unknown>).type === 'media',
+    );
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+});
+
+describe('long-text handling (no content discarded)', () => {
+  it('extracts a URL that appears far into a long prompt', () => {
+    const text = `${'word '.repeat(40000)}see https://youtu.be/dQw4w9WgXcQ`; // ~200KB before the URL
+    expect(extractYouTubeUrls(text, 5)).toEqual([WATCH('dQw4w9WgXcQ')]);
+  });
+
+  it('strips the injected URL even when large context is prepended to the content', () => {
+    /** Mirrors AgentClient prepending file/quote context to `content` while extraction uses `text`. */
+    const prompt = 'summarize https://youtu.be/dQw4w9WgXcQ';
+    const prependedContext = 'attached context line.\n'.repeat(8000); // ~180KB preamble
+    const result = appendYouTubeVideoParts({
+      enabled: true,
+      text: prompt,
+      content: prependedContext + prompt,
+      max: 5,
+    });
+
+    const parts = result as MessageContentComplex[];
+    const textPart = parts.find((p) => (p as Record<string, unknown>).type === 'text') as {
+      text: string;
+    };
+    expect(textPart.text).not.toContain('youtu.be/dQw4w9WgXcQ');
+    expect(textPart.text).toContain('attached context line.');
+    const mediaParts = parts.filter((p) => (p as Record<string, unknown>).type === 'media');
+    expect(mediaParts).toHaveLength(1);
+    expect((mediaParts[0] as Record<string, unknown>).fileUri).toBe(WATCH('dQw4w9WgXcQ'));
+  });
+});
diff --git a/packages/api/src/endpoints/google/youtube.ts b/packages/api/src/endpoints/google/youtube.ts
new file mode 100644
index 00000000000..34cbb88534c
--- /dev/null
+++ b/packages/api/src/endpoints/google/youtube.ts
@@ -0,0 +1,303 @@
+import { Providers } from '@librechat/agents';
+import { ContentTypes } from 'librechat-data-provider';
+import type { MessageContentComplex } from '@librechat/agents';
+
+/**
+ * Native YouTube -> Gemini video-understanding support for the Google `url_context` param.
+ *
+ * The Gemini URL Context tool does NOT support YouTube as a content type; YouTube must be
+ * passed as a video part (`fileData.fileUri`) via the video-understanding path. When
+ * `url_context` is enabled we detect YouTube URLs in the user's message and inject them as
+ * `{ type: 'media', fileUri }` content blocks, which the `@librechat/agents` Google content
+ * formatter converts into `fileData` parts. All other URLs keep flowing through the native
+ * `urlContext` tool.
+ */
+
+/** Per-message cap on auto-injected YouTube video parts for Gemini 2.5+ (the API allows up to 10). */
+export const DEFAULT_MAX_YOUTUBE_PARTS = 5;
+
+/** A Gemini video-understanding content block (becomes a `fileData` part downstream). */
+export interface YouTubeVideoPart {
+  type: 'media';
+  /**
+   * Always present as a key so the agents `messageContentMedia` `'mimeType' in content` guard
+   * passes. The Gemini Developer API omits it for YouTube (value `undefined`, dropped on JSON
+   * serialization); Vertex samples set `video/mp4`.
+   */
+  mimeType?: string;
+  fileUri: string;
+}
+
+const GEMINI_VERSION_REGEX = /gemini-(\d+)(?:\.(\d+))?/i;
+
+/** Gemini 2.5+ models accept up to 10 YouTube videos per request; earlier models accept 1. */
+function isGemini25OrLater(model?: string): boolean {
+  if (typeof model !== 'string') {
+    return false;
+  }
+  const match = GEMINI_VERSION_REGEX.exec(model);
+  if (!match) {
+    return false;
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2] ?? '0');
+  return major > 2 || (major === 2 && minor >= 5);
+}
+
+/**
+ * Resolves provider/model-aware YouTube injection limits.
+ * - Vertex: every Vertex sample sets a `video/mp4` mimeType on YouTube fileData, and Vertex is
+ *   capped conservatively at a single YouTube URL per request.
+ * - Gemini Developer API: omits the mimeType; 2.5+ models accept multiple videos, earlier ones one.
+ */
+export function resolveYouTubeInjectionConfig(params: { provider?: string; model?: string }): {
+  max: number;
+  mimeType?: string;
+} {
+  if (params.provider === Providers.VERTEXAI) {
+    return { max: 1, mimeType: 'video/mp4' };
+  }
+  return { max: isGemini25OrLater(params.model) ? DEFAULT_MAX_YOUTUBE_PARTS : 1 };
+}
+
+/** 11-char video id. */
+const ID = '[A-Za-z0-9_-]{11}';
+/**
+ * Allowlist of characters that occur in a YouTube URL path/query; anything else ends the match.
+ * The detection tail excludes `:` — it never appears in a real YouTube path/query, but `://` of a
+ * *nested* URL does, so excluding it lets the scan stop and find e.g.
+ * `watch?url=https://youtu.be/<id>`. The strip tail re-adds `:` so the whole URL token (including a
+ * trailing URL-valued param like `&next=https://example.com`) is consumed and nothing is orphaned.
+ */
+const DETECT_TAIL = '[A-Za-z0-9\\-._~%/?&=#@+]*';
+const STRIP_TAIL = '[A-Za-z0-9\\-._~%/?&=#@+:]*';
+
+/**
+ * Builds the linear YouTube URL matcher (restricted to recognized single-video forms):
+ *   - `youtu.be/<id>`                                      (group 1 = id)
+ *   - `youtube[-nocookie].com/(shorts|live|embed|v)/<id>`  (group 2 = id)
+ *   - `youtube[-nocookie].com/watch?<query>`               (group 3 = query, `v=` parsed afterwards)
+ *
+ * Properties that matter:
+ *   - Linear (no ReDoS): each branch consumes its match in a single greedy pass, the `v=` location
+ *     is parsed from the captured query (not re-scanned per occurrence), and the subdomain
+ *     repetition is bounded (`{1,63}` label x `{0,10}` labels). Needs no scan caps.
+ *   - Restricting to recognized routes means an UNrecognized YouTube URL (e.g. `/redirect?q=...`)
+ *     does not match, so the global scan continues and still finds a nested `youtu.be/<id>`.
+ *   - The path/query allowlist ends the match at prose delimiters, so adjacent links in one token
+ *     (comma/semicolon/pipe-separated, markdown `](url1)](url2)`) are matched separately.
+ *   - The leading lookbehind rejects hosts embedded in a longer domain (`notyoutube.com`,
+ *     `evil-youtube.com`).
+ */
+function createYouTubeRegex(tail: string): RegExp {
+  return new RegExp(
+    '(?<![\\w.-])(?:https?:\\/\\/)?(?:' +
+      `youtu\\.be\\/(${ID})(?![A-Za-z0-9_-])${tail}` +
+      '|(?:(?:[a-z0-9-]{1,63}\\.){0,10}youtube\\.com|(?:www\\.)?youtube-nocookie\\.com)\\/(?:' +
+      `(?:shorts|live|embed|v)\\/(${ID})(?![A-Za-z0-9_-])${tail}` +
+      `|watch\\?(${tail})` +
+      '))',
+    'gi',
+  );
+}
+
+/** Detection matcher: `:`-excluded tail so nested video URLs are discoverable. */
+const YOUTUBE_URL_REGEX = createYouTubeRegex(DETECT_TAIL);
+/** Strip matcher: `:`-inclusive tail so a matched URL is removed whole (no orphaned `://...`). */
+const YOUTUBE_STRIP_REGEX = createYouTubeRegex(STRIP_TAIL);
+
+/** Matches an 11-char video id at the start of a string, rejecting longer id-like tokens. */
+const VIDEO_ID_REGEX = /^([A-Za-z0-9_-]{11})(?![A-Za-z0-9_-])/;
+/** Iterates every `v` query parameter value (global; values length-bounded — an id is 11 chars). */
+const V_PARAM_REGEX = /(?:^|&)v=([A-Za-z0-9_-]{1,64})/gi;
+/** A YouTube link carries a user-selected moment (e.g. `?t=90`, `&start=90`, before or after `v=`). */
+const YOUTUBE_TIMESTAMP_REGEX = /[?&](?:t|start)=/i;
+
+/**
+ * Resolves the 11-char video id from the matcher's capture groups. The path-based ids (groups 1
+ * and 2) are already validated by the regex; the watch query (group 3) is scanned for the first
+ * `v=` whose value is a valid id, so a malformed earlier `v=` does not shadow a later valid one.
+ */
+function videoIdFromGroups(
+  youtuBeId?: string,
+  pathId?: string,
+  watchQuery?: string,
+): string | null {
+  const directId = youtuBeId ?? pathId;
+  if (directId != null) {
+    return directId;
+  }
+  if (watchQuery == null) {
+    return null;
+  }
+  for (const paramMatch of watchQuery.matchAll(V_PARAM_REGEX)) {
+    const id = VIDEO_ID_REGEX.exec(paramMatch[1])?.[1];
+    if (id != null) {
+      return id;
+    }
+  }
+  return null;
+}
+
+/**
+ * Removes from text only the YouTube URL tokens whose video id was injected as a video part and
+ * that do not carry a timestamp. Over-limit links (not injected) and timestamped links are kept so
+ * the model can still see/reason about them. Tidies leftover horizontal whitespace when changed.
+ */
+function stripYouTubeUrls(text: string, injectedIds: Set<string>): string {
+  if (text.length === 0) {
+    return text;
+  }
+  let changed = false;
+  const replaced = text.replace(YOUTUBE_STRIP_REGEX, (match, youtuBeId, pathId, watchQuery) => {
+    const id = videoIdFromGroups(youtuBeId, pathId, watchQuery);
+    if (id == null || !injectedIds.has(id)) {
+      return match;
+    }
+    /** Test the whole URL: the timestamp can precede `v=` (e.g. `watch?t=90&v=<id>`). */
+    if (YOUTUBE_TIMESTAMP_REGEX.test(match)) {
+      return match;
+    }
+    changed = true;
+    return '';
+  });
+  if (!changed) {
+    return text;
+  }
+  return replaced
+    .replace(/[ \t]{2,}/g, ' ')
+    .replace(/[ \t]+$/gm, '')
+    .trim();
+}
+
+function resolveLimit(max?: number): number {
+  if (max == null || !Number.isFinite(max)) {
+    return DEFAULT_MAX_YOUTUBE_PARTS;
+  }
+  return Math.max(0, Math.floor(max));
+}
+
+/**
+ * Extracts YouTube URLs from text, normalized to canonical `watch?v=<id>` form, de-duplicated
+ * by video id (first occurrence wins), and capped at `max` (default {@link DEFAULT_MAX_YOUTUBE_PARTS}).
+ */
+export function extractYouTubeUrls(text?: string | null, max?: number): string[] {
+  const limit = resolveLimit(max);
+  if (limit === 0 || typeof text !== 'string' || text.length === 0) {
+    return [];
+  }
+
+  const seen = new Set<string>();
+  const urls: string[] = [];
+  YOUTUBE_URL_REGEX.lastIndex = 0;
+  let match: RegExpExecArray | null;
+  while ((match = YOUTUBE_URL_REGEX.exec(text)) !== null) {
+    const videoId = videoIdFromGroups(match[1], match[2], match[3]);
+    if (videoId == null || seen.has(videoId)) {
+      continue;
+    }
+    seen.add(videoId);
+    urls.push(`https://www.youtube.com/watch?v=${videoId}`);
+    if (urls.length >= limit) {
+      break;
+    }
+  }
+  return urls;
+}
+
+/** True when the resolved provider tool list contains the native Google `urlContext` tool. */
+export function hasUrlContextTool(tools: unknown): boolean {
+  if (!Array.isArray(tools)) {
+    return false;
+  }
+  return tools.some((tool) => tool != null && typeof tool === 'object' && 'urlContext' in tool);
+}
+
+function toBaseParts(content: string | MessageContentComplex[]): MessageContentComplex[] {
+  if (Array.isArray(content)) {
+    return content;
+  }
+  if (typeof content === 'string' && content.length > 0) {
+    return [{ type: ContentTypes.TEXT, text: content } as MessageContentComplex];
+  }
+  return [];
+}
+
+function stripYouTubeFromTextParts(
+  parts: MessageContentComplex[],
+  injectedIds: Set<string>,
+): MessageContentComplex[] {
+  const result: MessageContentComplex[] = [];
+  for (const part of parts) {
+    const record = part as Record<string, unknown>;
+    if (record != null && record.type === ContentTypes.TEXT && typeof record.text === 'string') {
+      const stripped = stripYouTubeUrls(record.text, injectedIds);
+      if (stripped.length > 0) {
+        result.push({ ...record, text: stripped } as MessageContentComplex);
+      }
+      continue;
+    }
+    result.push(part);
+  }
+  return result;
+}
+
+function collectFileUris(parts: MessageContentComplex[]): Set<string> {
+  const uris = new Set<string>();
+  for (const part of parts) {
+    if (part == null || typeof part !== 'object') {
+      continue;
+    }
+    const record = part as Record<string, unknown>;
+    if (typeof record.fileUri === 'string') {
+      uris.add(record.fileUri);
+    }
+    const fileData = record.fileData as { fileUri?: unknown } | undefined;
+    if (fileData != null && typeof fileData.fileUri === 'string') {
+      uris.add(fileData.fileUri);
+    }
+  }
+  return uris;
+}
+
+/**
+ * Appends YouTube video parts to a message's content when `url_context` is enabled, and removes
+ * the matched YouTube URLs from the prompt text so the `urlContext` tool (which reads URLs from
+ * the text and cannot fetch YouTube) does not spend its URL budget on them. Non-YouTube URLs are
+ * left intact for the tool. No-ops when disabled, when no YouTube URLs are found, or when every
+ * URL is already present as a media part. A string content is upgraded to a parts array only when
+ * something is added.
+ */
+export function appendYouTubeVideoParts(params: {
+  enabled: boolean;
+  text?: string | null;
+  content: string | MessageContentComplex[];
+  max?: number;
+  mimeType?: string;
+}): string | MessageContentComplex[] {
+  const { enabled, text, content, max, mimeType } = params;
+  if (!enabled) {
+    return content;
+  }
+
+  const urls = extractYouTubeUrls(text, max);
+  if (urls.length === 0) {
+    return content;
+  }
+
+  const baseParts = toBaseParts(content);
+  const existing = collectFileUris(baseParts);
+  const newParts = urls
+    .filter((url) => !existing.has(url))
+    .map((fileUri) => ({ type: 'media', mimeType, fileUri }) as MessageContentComplex);
+
+  if (newParts.length === 0) {
+    return content;
+  }
+
+  /** Only strip the links actually routed to video (capped + deduped set); over-limit links stay. */
+  const injectedIds = new Set(
+    urls.map((url) => new URL(url).searchParams.get('v')).filter((id): id is string => id != null),
+  );
+  return [...stripYouTubeFromTextParts(baseParts, injectedIds), ...newParts];
+}
diff --git a/packages/api/src/endpoints/index.ts b/packages/api/src/endpoints/index.ts
index 208181168ec..4be03df1e38 100644
--- a/packages/api/src/endpoints/index.ts
+++ b/packages/api/src/endpoints/index.ts
@@ -5,3 +5,6 @@ export * from './custom';
 export * from './google';
 export * from './models';
 export * from './openai';
+export * from './pricing';
+export * from './projection';
+export * from './tokenConfig';
diff --git a/packages/api/src/endpoints/keys.ts b/packages/api/src/endpoints/keys.ts
new file mode 100644
index 00000000000..14075618cd3
--- /dev/null
+++ b/packages/api/src/endpoints/keys.ts
@@ -0,0 +1,19 @@
+import crypto from 'crypto';
+
+/** NUL-delimited scoped keys cannot collide with legacy endpoint-name keys. */
+export const SCOPED_TOKEN_CONFIG_KEY_PREFIX = '\u0000token-config:v2\u0000';
+
+type TokenConfigScope = 'tenant' | 'tenant-user';
+
+export function getScopedTokenConfigKey(scope: TokenConfigScope, parts: string[]): string {
+  const digest = crypto.createHash('sha256').update(JSON.stringify(parts)).digest('hex');
+  return `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}${scope}\u0000${digest}`;
+}
+
+export function getModelCacheTokenConfigKey(cacheKey: string): string {
+  return `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models\u0000${cacheKey}`;
+}
+
+export function isScopedTokenConfigKey(tokenKey: string): boolean {
+  return tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX);
+}
diff --git a/packages/api/src/endpoints/models.spec.ts b/packages/api/src/endpoints/models.spec.ts
index bb359968abe..30e1d7546af 100644
--- a/packages/api/src/endpoints/models.spec.ts
+++ b/packages/api/src/endpoints/models.spec.ts
@@ -8,16 +8,38 @@ import {
   getBedrockModels,
   getAnthropicModels,
 } from './models';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from './keys';
 
 jest.mock('axios');
 
+const mockValidateEndpointURL = jest.fn().mockResolvedValue(undefined);
+const mockHttpAgent = { type: 'ssrf-http-agent' };
+const mockHttpsAgent = { type: 'ssrf-https-agent' };
+const mockCreateSSRFSafeAgents = jest.fn((_allowedAddresses?: string[] | null) => ({
+  httpAgent: mockHttpAgent,
+  httpsAgent: mockHttpsAgent,
+}));
+jest.mock('~/auth', () => ({
+  validateEndpointURL: (
+    ...args: [url: string, endpoint: string, allowedAddresses?: string[] | null]
+  ) => mockValidateEndpointURL(...args),
+  createSSRFSafeAgents: (...args: [allowedAddresses?: string[] | null]) =>
+    mockCreateSSRFSafeAgents(...args),
+}));
+
 const mockCacheGet = jest.fn().mockResolvedValue(undefined);
 const mockCacheSet = jest.fn().mockResolvedValue(true);
+const mockTokenConfigGet = jest.fn().mockResolvedValue(undefined);
+const mockTokenConfigSet = jest.fn().mockResolvedValue(true);
 jest.mock('~/cache', () => ({
   standardCache: jest.fn().mockImplementation(() => ({
     get: mockCacheGet,
     set: mockCacheSet,
   })),
+  tokenConfigCache: jest.fn().mockImplementation(() => ({
+    get: mockTokenConfigGet,
+    set: mockTokenConfigSet,
+  })),
 }));
 
 jest.mock('~/utils', () => {
@@ -51,6 +73,10 @@ mockedAxios.get.mockResolvedValue({
 beforeEach(() => {
   mockCacheGet.mockReset().mockResolvedValue(undefined);
   mockCacheSet.mockReset().mockResolvedValue(true);
+  mockTokenConfigGet.mockReset().mockResolvedValue(undefined);
+  mockTokenConfigSet.mockReset().mockResolvedValue(true);
+  mockValidateEndpointURL.mockReset().mockResolvedValue(undefined);
+  mockCreateSSRFSafeAgents.mockClear();
 });
 
 describe('fetchModels', () => {
@@ -149,6 +175,154 @@ describe('fetchModels', () => {
     );
   });
 
+  it('should resolve template variables in custom headers on the OpenAI-compatible path', async () => {
+    const customHeaders = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+    const userObject = { id: 'user123', email: 'user@example.com' };
+
+    (resolveHeaders as jest.Mock).mockReturnValueOnce({
+      Authorization: 'Bearer resolved-jwt',
+      'X-User-Email': 'user@example.com',
+    });
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+      userObject,
+    });
+
+    expect(resolveHeaders).toHaveBeenCalledWith({
+      headers: customHeaders,
+      user: userObject,
+    });
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer resolved-jwt',
+          'X-User-Email': 'user@example.com',
+        }),
+      }),
+    );
+  });
+
+  it('should preserve a config-supplied Authorization header instead of overwriting with the apiKey default', async () => {
+    const customHeaders = {
+      Authorization: 'Bearer user-jwt-token',
+    };
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer user-jwt-token',
+        }),
+      }),
+    );
+    expect(mockedAxios.get).not.toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer testApiKey',
+        }),
+      }),
+    );
+  });
+
+  it('should treat Authorization header case-insensitively when skipping the apiKey default', async () => {
+    const customHeaders = {
+      authorization: 'Bearer lower-case-user-jwt',
+    };
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+    });
+
+    const lastCall = mockedAxios.get.mock.calls[mockedAxios.get.mock.calls.length - 1];
+    const sentHeaders = lastCall[1]?.headers ?? {};
+    expect(sentHeaders.authorization).toBe('Bearer lower-case-user-jwt');
+    expect(sentHeaders.Authorization).toBeUndefined();
+  });
+
+  it('validates and hardens user-provided base URL model fetches', async () => {
+    const savedEnv = {
+      PROXY: process.env.PROXY,
+      HTTP_PROXY: process.env.HTTP_PROXY,
+      HTTPS_PROXY: process.env.HTTPS_PROXY,
+      NO_PROXY: process.env.NO_PROXY,
+    };
+    delete process.env.PROXY;
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.NO_PROXY;
+
+    try {
+      await fetchModels({
+        user: 'user123',
+        apiKey: 'testApiKey',
+        baseURL: 'https://api.test.com',
+        baseURLIsUserProvided: true,
+        allowedAddresses: ['10.0.0.5:443'],
+        name: 'TestAPI',
+      });
+    } finally {
+      for (const [key, value] of Object.entries(savedEnv)) {
+        if (value === undefined) {
+          delete process.env[key];
+        } else {
+          process.env[key] = value;
+        }
+      }
+    }
+
+    expect(mockValidateEndpointURL).toHaveBeenCalledWith('https://api.test.com', 'TestAPI', [
+      '10.0.0.5:443',
+    ]);
+    expect(mockCreateSSRFSafeAgents).toHaveBeenCalledWith(['10.0.0.5:443']);
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      'https://api.test.com/models',
+      expect.objectContaining({
+        httpAgent: mockHttpAgent,
+        httpsAgent: mockHttpsAgent,
+        maxRedirects: 0,
+        proxy: false,
+      }),
+    );
+  });
+
+  it('rejects a blocked user-provided base URL before any model fetch request', async () => {
+    mockValidateEndpointURL.mockRejectedValueOnce(new Error('blocked SSRF target'));
+
+    await expect(
+      fetchModels({
+        user: 'user123',
+        apiKey: 'testApiKey',
+        baseURL: 'http://127.0.0.1:11434/v1',
+        baseURLIsUserProvided: true,
+        name: 'TestAPI',
+      }),
+    ).rejects.toThrow('blocked SSRF target');
+
+    expect(mockedAxios.get).not.toHaveBeenCalled();
+  });
+
   afterEach(() => {
     jest.clearAllMocks();
   });
@@ -177,6 +351,7 @@ describe('fetchModels with createTokenConfig true', () => {
   };
 
   beforeEach(() => {
+    mockedAxios.get.mockClear();
     mockedAxios.get.mockResolvedValue({ data });
   });
 
@@ -192,6 +367,59 @@ describe('fetchModels with createTokenConfig true', () => {
     expect(processModelData).toHaveBeenCalled();
     expect(processModelData).toHaveBeenCalledWith(data);
   });
+
+  it('backfills requested token config when model cache hits', async () => {
+    const endpointTokenConfig = {
+      'model-1': { prompt: 2000, completion: 1000, context: 1024 },
+    };
+    mockCacheGet.mockResolvedValue(['model-1']);
+    mockTokenConfigGet.mockResolvedValue(endpointTokenConfig);
+
+    const models = await fetchModels({
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      tokenKey: `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000abc123`,
+    });
+
+    expect(models).toEqual(['model-1']);
+    expect(mockedAxios.get).not.toHaveBeenCalled();
+    expect(
+      mockTokenConfigGet.mock.calls[0][0].startsWith(`${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models`),
+    ).toBe(true);
+    expect(mockTokenConfigSet).toHaveBeenCalledWith(
+      `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000abc123`,
+      endpointTokenConfig,
+    );
+  });
+
+  it('fetches and writes token config when scoped token key is missing on model cache hit', async () => {
+    mockCacheGet.mockResolvedValue(['cached-model']);
+    mockTokenConfigGet.mockResolvedValue(undefined);
+
+    const models = await fetchModels({
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      tokenKey: `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000def456`,
+    });
+
+    expect(models).toEqual(['model-1', 'model-2']);
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.any(Object),
+    );
+    expect(mockTokenConfigSet).toHaveBeenCalledWith(
+      `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000def456`,
+      expect.objectContaining({
+        'model-1': expect.objectContaining({ context: 1024 }),
+      }),
+    );
+    const sourceSetCall = mockTokenConfigSet.mock.calls.find(([key]) =>
+      key.startsWith(`${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models`),
+    );
+    expect(sourceSetCall).toBeDefined();
+  });
 });
 
 describe('getOpenAIModels', () => {
@@ -209,7 +437,7 @@ describe('getOpenAIModels', () => {
 
   it('returns default models when no environment configurations are provided (and fetch fails)', async () => {
     const models = await getOpenAIModels({ user: 'user456' });
-    expect(models).toContain('gpt-4');
+    expect(models).toContain('gpt-5.5');
   });
 
   it('returns default models when OpenAI API key is user provided', async () => {
@@ -220,7 +448,7 @@ describe('getOpenAIModels', () => {
 
     expect(mockedAxios.get).not.toHaveBeenCalled();
     expect(models).not.toContain('should-not-appear');
-    expect(models).toContain('gpt-4');
+    expect(models).toContain('gpt-5.5');
   });
 
   it('fetches models when OpenAI API key is provided through options', async () => {
@@ -257,6 +485,24 @@ describe('getOpenAIModels', () => {
     expect(models).toEqual(['gpt-env-key']);
   });
 
+  it('forwards configured custom headers to the OpenAI model fetch', async () => {
+    mockedAxios.get.mockResolvedValue({ data: { data: [{ id: 'gpt-x' }] } });
+    process.env.OPENAI_API_KEY = 'sk-env';
+
+    await getOpenAIModels({
+      user: 'user456',
+      headers: { 'cf-aig-token': 'tok' },
+      userObject: { id: 'user456' },
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.openai.com/v1/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'cf-aig-token': 'tok' }),
+      }),
+    );
+  });
+
   it('returns `AZURE_OPENAI_MODELS` with `azure` flag (and fetch fails)', async () => {
     process.env.AZURE_OPENAI_MODELS = 'azure-model,azure-model-2';
     const models = await getOpenAIModels({ azure: true });
@@ -335,6 +581,26 @@ describe('getOpenAIModels sorting behavior', () => {
     ];
     expect(models).toEqual(expectedOrder);
   });
+
+  it('keeps chat-latest when filtering official OpenAI results', async () => {
+    mockedAxios.get.mockResolvedValue({
+      data: {
+        data: [
+          { id: 'chat-latest' },
+          { id: 'gpt-5.5' },
+          { id: 'dall-e-3' },
+          { id: 'gpt-realtime-2' },
+        ],
+      },
+    });
+
+    const models = await getOpenAIModels({ user: 'user456' });
+
+    expect(models).toContain('chat-latest');
+    expect(models).toContain('gpt-5.5');
+    expect(models).not.toContain('dall-e-3');
+    expect(models).not.toContain('gpt-realtime-2');
+  });
 });
 
 describe('fetchModels with Ollama specific logic', () => {
@@ -631,7 +897,7 @@ describe('getAnthropicModels', () => {
     );
   });
 
-  it('should pass custom headers for Anthropic endpoint', async () => {
+  it('forwards custom headers for the Anthropic endpoint alongside managed auth', async () => {
     const customHeaders = {
       'X-Custom-Header': 'custom-value',
     };
@@ -654,12 +920,32 @@ describe('getAnthropicModels', () => {
       expect.any(String),
       expect.objectContaining({
         headers: {
+          'X-Custom-Header': 'custom-value',
           'x-api-key': 'test-anthropic-key',
           'anthropic-version': expect.any(String),
         },
       }),
     );
   });
+
+  it('threads configured headers through getAnthropicModels to the fetch', async () => {
+    delete process.env.ANTHROPIC_MODELS;
+    process.env.ANTHROPIC_API_KEY = 'test-anthropic-key';
+    mockedAxios.get.mockResolvedValue({ data: { data: [{ id: 'claude-3' }] } });
+
+    await getAnthropicModels({
+      user: 'user123',
+      headers: { 'cf-aig-token': 'tok' },
+      userObject: { id: 'user123' },
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'cf-aig-token': 'tok' }),
+      }),
+    );
+  });
 });
 
 describe('getGoogleModels', () => {
@@ -778,4 +1064,41 @@ describe('fetchModels caching behavior', () => {
       expect.any(Number),
     );
   });
+
+  it('skips MODEL_QUERIES cache when both headers and userObject are supplied (user-scoped response)', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: { Authorization: 'Bearer some-user-token' },
+      userObject: { id: 'user-1' },
+    });
+
+    expect(mockCacheGet).not.toHaveBeenCalled();
+    expect(mockCacheSet).not.toHaveBeenCalled();
+  });
+
+  it('still uses cache when headers are supplied without a userObject (no per-user resolution)', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: { 'X-Static-Header': 'static-value' },
+    });
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(mockCacheSet).toHaveBeenCalled();
+  });
+
+  it('still uses cache when userObject is supplied without headers', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      userObject: { id: 'user-1' },
+    });
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(mockCacheSet).toHaveBeenCalled();
+  });
 });
diff --git a/packages/api/src/endpoints/models.ts b/packages/api/src/endpoints/models.ts
index aac168ad7a9..55fe926a42d 100644
--- a/packages/api/src/endpoints/models.ts
+++ b/packages/api/src/endpoints/models.ts
@@ -1,7 +1,6 @@
-import crypto from 'crypto';
 import axios from 'axios';
+import crypto from 'crypto';
 import { logger } from '@librechat/data-schemas';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import {
   Time,
   CacheKeys,
@@ -10,6 +9,7 @@ import {
   defaultModels,
 } from 'librechat-data-provider';
 import type { IUser } from '@librechat/data-schemas';
+import type { AxiosRequestConfig } from 'axios';
 import {
   processModelData,
   extractBaseURL,
@@ -18,9 +18,14 @@ import {
   deriveBaseURL,
   logAxiosError,
   inputSchema,
+  applyAxiosProxyConfig,
 } from '~/utils';
+import { getModelCacheTokenConfigKey, isScopedTokenConfigKey } from '~/endpoints/keys';
+import { createSSRFSafeAgents, validateEndpointURL } from '~/auth';
 import { standardCache, tokenConfigCache } from '~/cache';
 
+type SSRFSafeAgents = ReturnType<typeof createSSRFSafeAgents>;
+
 export interface FetchModelsParams {
   /** User ID for API requests */
   user?: string;
@@ -28,6 +33,10 @@ export interface FetchModelsParams {
   apiKey: string;
   /** Base URL for the API */
   baseURL?: string;
+  /** Whether the base URL came from a user-stored credential */
+  baseURLIsUserProvided?: boolean;
+  /** Admin-approved internal host:port exemptions for user-provided base URLs */
+  allowedAddresses?: string[] | null;
   /** Endpoint name (defaults to 'openAI') */
   name?: string;
   /** Whether directEndpoint was configured */
@@ -48,6 +57,23 @@ export interface FetchModelsParams {
   skipCache?: boolean;
 }
 
+function applyUserProvidedBaseURLProtection(
+  options: AxiosRequestConfig,
+  ssrfAgents?: SSRFSafeAgents,
+): AxiosRequestConfig {
+  if (!ssrfAgents) {
+    return options;
+  }
+
+  options.maxRedirects = 0;
+
+  options.proxy = false;
+  options.httpAgent = ssrfAgents.httpAgent;
+  options.httpsAgent = ssrfAgents.httpsAgent;
+
+  return options;
+}
+
 /**
  * Fetches Ollama models from the specified base API path.
  * @param baseURL - The Ollama server URL
@@ -56,7 +82,11 @@ export interface FetchModelsParams {
  */
 async function fetchOllamaModels(
   baseURL: string,
-  options: { headers?: Record<string, string> | null; user?: Partial<IUser> } = {},
+  options: {
+    headers?: Record<string, string> | null;
+    ssrfAgents?: SSRFSafeAgents;
+    user?: Partial<IUser>;
+  } = {},
 ): Promise<string[]> {
   if (!baseURL) {
     return [];
@@ -69,17 +99,36 @@ async function fetchOllamaModels(
     user: options.user,
   });
 
+  const requestOptions: AxiosRequestConfig & {
+    headers: Record<string, string>;
+    timeout: number;
+  } = {
+    headers: resolvedHeaders,
+    timeout: 5000,
+  };
+  applyUserProvidedBaseURLProtection(requestOptions, options.ssrfAgents);
+
   const response = await axios.get<{ models: Array<{ name: string }> }>(
     `${ollamaEndpoint}/api/tags`,
-    {
-      headers: resolvedHeaders,
-      timeout: 5000,
-    },
+    requestOptions,
   );
 
   return response.data.models.map((tag) => tag.name);
 }
 
+async function backfillTokenConfigFromModelCache(
+  cacheKey: string,
+  tokenKey: string,
+): Promise<boolean> {
+  const cachedTokenConfig = await tokenConfigCache().get(getModelCacheTokenConfigKey(cacheKey));
+  if (cachedTokenConfig == null) {
+    return false;
+  }
+
+  await tokenConfigCache().set(tokenKey, cachedTokenConfig);
+  return true;
+}
+
 /**
  * Splits a string by commas and trims each resulting value.
  * @param input - The input string to split.
@@ -105,6 +154,8 @@ export async function fetchModels({
   user,
   apiKey,
   baseURL: _baseURL,
+  baseURLIsUserProvided = false,
+  allowedAddresses,
   name = EModelEndpoint.openAI,
   direct = false,
   azure = false,
@@ -126,20 +177,47 @@ export async function fetchModels({
     return models;
   }
 
-  const shouldCache = !skipCache && !(userIdQuery && user);
+  const ssrfAgents = baseURLIsUserProvided ? createSSRFSafeAgents(allowedAddresses) : undefined;
+  if (baseURLIsUserProvided && baseURL) {
+    await validateEndpointURL(baseURL, name, allowedAddresses);
+  }
+
+  // The MODEL_QUERIES cache is keyed by baseURL+apiKey only. That's safe
+  // when the response is identical for every caller, but fails when callers
+  // forward header templates that resolve to a user-bound value (e.g.
+  // `Authorization: Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}`): one user's
+  // filtered list could otherwise be served to the next request that
+  // shares the same baseURL+apiKey. Skip the cache whenever both `headers`
+  // and `userObject` are supplied, since that's the signal the caller is
+  // resolving headers against a specific user's identity.
+  const hasUserScopedHeaders = !!headers && Object.keys(headers).length > 0 && !!userObject;
+  const shouldCache = !skipCache && !(userIdQuery && user) && !hasUserScopedHeaders;
   const cacheKey = shouldCache ? modelsCacheKey(baseURL ?? '', apiKey) : '';
   const modelsCache = shouldCache ? standardCache(CacheKeys.MODEL_QUERIES) : null;
   if (modelsCache && cacheKey) {
     const cachedModels = await modelsCache.get(cacheKey);
     if (cachedModels) {
-      return cachedModels as string[];
+      if (createTokenConfig && tokenKey) {
+        const tokenConfigBackfilled = await backfillTokenConfigFromModelCache(cacheKey, tokenKey);
+        if (!tokenConfigBackfilled && isScopedTokenConfigKey(tokenKey)) {
+          models = cachedModels as string[];
+        } else {
+          return cachedModels as string[];
+        }
+      } else {
+        return cachedModels as string[];
+      }
     }
   }
 
   if (name && name.toLowerCase().startsWith(KnownEndpoints.ollama)) {
     let ollamaModels: string[] | null = null;
     try {
-      ollamaModels = await fetchOllamaModels(baseURL ?? '', { headers, user: userObject });
+      ollamaModels = await fetchOllamaModels(baseURL ?? '', {
+        headers,
+        ssrfAgents,
+        user: userObject,
+      });
     } catch (ollamaError) {
       logAxiosError({
         message:
@@ -156,28 +234,43 @@ export async function fetchModels({
   }
 
   try {
-    const options: {
+    // Resolve template variables (e.g. {{LIBRECHAT_OPENID_ID_TOKEN}}) in the
+    // configured headers, mirroring fetchOllamaModels above. Without this,
+    // placeholder strings are forwarded literally on the model-fetch path.
+    const resolvedHeaders = resolveHeaders({
+      headers: headers ?? undefined,
+      user: userObject,
+    });
+
+    const options: AxiosRequestConfig & {
       headers: Record<string, string>;
       timeout: number;
-      httpsAgent?: HttpsProxyAgent<string>;
     } = {
       headers: {
-        ...(headers ?? {}),
+        ...resolvedHeaders,
       },
       timeout: 5000,
     };
 
     if (name === EModelEndpoint.anthropic) {
+      // Keep configured custom headers (e.g. gateway metadata) while the
+      // provider-managed auth/version headers stay authoritative.
       options.headers = {
+        ...resolvedHeaders,
         'x-api-key': apiKey,
         'anthropic-version': process.env.ANTHROPIC_VERSION || '2023-06-01',
       };
     } else {
-      options.headers.Authorization = `Bearer ${apiKey}`;
-    }
-
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
+      // Only fall back to the apiKey-based Bearer when the configured
+      // headers did not already supply an Authorization. This lets
+      // auth-aware proxies (e.g. LiteLLM with JWT auth) receive the user's
+      // token on /v1/models so they can return a per-user filtered list.
+      const hasAuthHeader = Object.keys(options.headers).some(
+        (k) => k.toLowerCase() === 'authorization',
+      );
+      if (!hasAuthHeader) {
+        options.headers.Authorization = `Bearer ${apiKey}`;
+      }
     }
 
     if (process.env.OPENAI_ORGANIZATION && baseURL?.includes('openai')) {
@@ -188,6 +281,8 @@ export async function fetchModels({
     if (user && userIdQuery) {
       url.searchParams.append('user', user);
     }
+    applyAxiosProxyConfig(options, url);
+    applyUserProvidedBaseURLProtection(options, ssrfAgents);
     const res = await axios.get(url.toString(), options);
 
     const input = res.data;
@@ -195,7 +290,11 @@ export async function fetchModels({
     const validationResult = inputSchema.safeParse(input);
     if (validationResult.success && createTokenConfig) {
       const endpointTokenConfig = processModelData(input);
-      await tokenConfigCache().set(tokenKey ?? name, endpointTokenConfig);
+      const cache = tokenConfigCache();
+      await cache.set(tokenKey ?? name, endpointTokenConfig);
+      if (modelsCache && cacheKey) {
+        await cache.set(getModelCacheTokenConfigKey(cacheKey), endpointTokenConfig);
+      }
     }
     models = input.data.map((item: { id: string }) => item.id);
   } catch (error) {
@@ -226,6 +325,10 @@ export interface GetOpenAIModelsOptions {
   openAIApiKey?: string;
   /** Skip MODEL_QUERIES cache (e.g., for user-provided keys) */
   skipCache?: boolean;
+  /** Configured custom headers forwarded to the (gateway-fronted) provider */
+  headers?: Record<string, string> | null;
+  /** User object for resolving header placeholders */
+  userObject?: Partial<IUser>;
 }
 
 function resolveOpenAIApiKey(opts: GetOpenAIModelsOptions): string | undefined {
@@ -266,6 +369,8 @@ export async function fetchOpenAIModels(
       user: opts.user,
       name: EModelEndpoint.openAI,
       skipCache: opts.skipCache,
+      headers: opts.headers,
+      userObject: opts.userObject,
     });
   }
 
@@ -274,7 +379,7 @@ export async function fetchOpenAIModels(
   }
 
   if (baseURL === openaiBaseURL) {
-    const regex = /(text-davinci-003|gpt-|o\d+)/;
+    const regex = /(text-davinci-003|gpt-|o\d+|chat-latest)/;
     const excludeRegex = /audio|realtime/;
     models = models.filter((model) => regex.test(model) && !excludeRegex.test(model));
     const instructModels = models.filter((model) => model.includes('instruct'));
@@ -326,7 +431,12 @@ export async function getOpenAIModels(opts: GetOpenAIModelsOptions = {}): Promis
  * @returns Promise resolving to array of model IDs
  */
 export async function fetchAnthropicModels(
-  opts: { user?: string; skipCache?: boolean } = {},
+  opts: {
+    user?: string;
+    skipCache?: boolean;
+    headers?: Record<string, string> | null;
+    userObject?: Partial<IUser>;
+  } = {},
   _models: string[] = [],
 ): Promise<string[]> {
   let models = _models.slice() ?? [];
@@ -351,6 +461,8 @@ export async function fetchAnthropicModels(
       name: EModelEndpoint.anthropic,
       tokenKey: EModelEndpoint.anthropic,
       skipCache: opts.skipCache,
+      headers: opts.headers,
+      userObject: opts.userObject,
     });
   }
 
@@ -367,7 +479,12 @@ export async function fetchAnthropicModels(
  * @returns Promise resolving to array of model IDs
  */
 export async function getAnthropicModels(
-  opts: { user?: string; vertexModels?: string[] } = {},
+  opts: {
+    user?: string;
+    vertexModels?: string[];
+    headers?: Record<string, string> | null;
+    userObject?: Partial<IUser>;
+  } = {},
 ): Promise<string[]> {
   const models = defaultModels[EModelEndpoint.anthropic];
 
diff --git a/packages/api/src/endpoints/openai/config.backward-compat.spec.ts b/packages/api/src/endpoints/openai/config.backward-compat.spec.ts
index f19540481f2..acc3496b2b4 100644
--- a/packages/api/src/endpoints/openai/config.backward-compat.spec.ts
+++ b/packages/api/src/endpoints/openai/config.backward-compat.spec.ts
@@ -10,7 +10,7 @@ describe('getOpenAIConfig - Backward Compatibility', () => {
   describe('OpenAI endpoint', () => {
     it('should handle GPT-5 model with reasoning and web search', () => {
       const apiKey = 'sk-proj-somekey';
-      const endpoint = undefined;
+      const endpoint = EModelEndpoint.openAI;
       const options = {
         modelOptions: {
           model: 'gpt-5-nano',
@@ -138,7 +138,7 @@ describe('getOpenAIConfig - Backward Compatibility', () => {
 
     it('should handle Azure OpenAI with Responses API and reasoning', () => {
       const apiKey = 'some_azure_key';
-      const endpoint = undefined;
+      const endpoint = EModelEndpoint.azureOpenAI;
       const options = {
         modelOptions: {
           model: 'gpt-5',
@@ -339,6 +339,7 @@ describe('getOpenAIConfig - Backward Compatibility', () => {
           model: 'DeepSeek-R1',
           user: 'some_user_id',
           apiKey: 'some_azure_key',
+          includeReasoningContent: true,
         },
         configOptions: {
           baseURL: 'https://some_endpoint_name.models.ai.azure.com/v1/',
@@ -394,6 +395,7 @@ describe('getOpenAIConfig - Backward Compatibility', () => {
         modelOptions: {
           model: '@cf/deepseek-ai/deepseek-r1-distill-qwen-32b',
           user: 'some-user',
+          reasoning_effort: ReasoningEffort.high,
         },
         reverseProxyUrl:
           'https://gateway.ai.cloudflare.com/v1/${CF_ACCOUNT_ID}/${CF_GATEWAY_ID}/workers-ai/v1',
@@ -418,6 +420,9 @@ describe('getOpenAIConfig - Backward Compatibility', () => {
           user: 'some-user',
           disableStreaming: true,
           apiKey: 'someKey',
+          modelKwargs: {
+            reasoning_effort: ReasoningEffort.high,
+          },
         },
         configOptions: {
           baseURL:
diff --git a/packages/api/src/endpoints/openai/config.google.spec.ts b/packages/api/src/endpoints/openai/config.google.spec.ts
index 85336722774..20e283510af 100644
--- a/packages/api/src/endpoints/openai/config.google.spec.ts
+++ b/packages/api/src/endpoints/openai/config.google.spec.ts
@@ -213,6 +213,120 @@ describe('getOpenAIConfig - Google Compatibility', () => {
       });
     });
 
+    describe('URL Context Support via addParams', () => {
+      const apiKey = JSON.stringify({ GOOGLE_API_KEY: 'test-google-key' });
+      const endpoint = 'Gemini (Custom)';
+      const reverseProxyUrl = 'https://generativelanguage.googleapis.com/v1beta/openai';
+
+      it('should enable urlContext tool when url_context: true in addParams', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash' },
+            customParams: { defaultParamsEndpoint: 'google' },
+            addParams: { url_context: true },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toEqual([{ urlContext: {} }]);
+      });
+
+      it('should disable urlContext tool when url_context: false in addParams', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash', url_context: true },
+            customParams: { defaultParamsEndpoint: 'google' },
+            addParams: { url_context: false },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toEqual([]);
+      });
+
+      it('should disable urlContext when in dropParams', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash', url_context: true },
+            customParams: { defaultParamsEndpoint: 'google' },
+            dropParams: ['url_context'],
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toEqual([]);
+      });
+
+      it('should filter out urlContext when url_context is only in modelOptions', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash', url_context: true },
+            customParams: { defaultParamsEndpoint: 'google' },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        /** urlContext is filtered since url_context was not explicitly added via addParams/defaultParams */
+        expect(result.tools).toEqual([]);
+      });
+
+      it('should not enable urlContext on a model that does not support it (Gemini < 2.5)', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.0-flash-exp' },
+            customParams: { defaultParamsEndpoint: 'google' },
+            addParams: { url_context: true },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toEqual([]);
+      });
+
+      it('should enable urlContext via defaultParams', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash' },
+            customParams: {
+              defaultParamsEndpoint: 'google',
+              paramDefinitions: [{ key: 'url_context', default: true }],
+            },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toEqual([{ urlContext: {} }]);
+      });
+
+      it('should preserve both googleSearch and urlContext when both are enabled via addParams', () => {
+        const result = getOpenAIConfig(
+          apiKey,
+          {
+            modelOptions: { model: 'gemini-2.5-flash' },
+            customParams: { defaultParamsEndpoint: 'google' },
+            addParams: { web_search: true, url_context: true },
+            reverseProxyUrl,
+          },
+          endpoint,
+        );
+
+        expect(result.tools).toContainEqual({ googleSearch: {} });
+        expect(result.tools).toContainEqual({ urlContext: {} });
+      });
+    });
+
     describe('defaultParams Support via customParams', () => {
       it('should apply defaultParams when fields are undefined', () => {
         const apiKey = JSON.stringify({ GOOGLE_API_KEY: 'test-google-key' });
diff --git a/packages/api/src/endpoints/openai/config.spec.ts b/packages/api/src/endpoints/openai/config.spec.ts
index 9de28d4049b..15f81ef0346 100644
--- a/packages/api/src/endpoints/openai/config.spec.ts
+++ b/packages/api/src/endpoints/openai/config.spec.ts
@@ -3,6 +3,8 @@ import {
   EModelEndpoint,
   ReasoningEffort,
   ReasoningSummary,
+  ReasoningResponseKey,
+  ReasoningParameterFormat,
 } from 'librechat-data-provider';
 import type { RequestInit } from 'undici';
 import type { OpenAIParameters, AzureOptions } from '~/types';
@@ -79,7 +81,7 @@ describe('getOpenAIConfig', () => {
     expect(result.llmConfig.modelKwargs).toBeUndefined();
   });
 
-  it('should handle reasoning params for `useResponsesApi`', () => {
+  it('should pass custom endpoint reasoning object through modelKwargs for `useResponsesApi`', () => {
     const modelOptions = {
       reasoning_effort: ReasoningEffort.high,
       reasoning_summary: ReasoningSummary.detailed,
@@ -89,27 +91,29 @@ describe('getOpenAIConfig', () => {
       modelOptions: { ...modelOptions, useResponsesApi: true },
     });
 
-    expect(result.llmConfig.reasoning).toEqual({
-      effort: ReasoningEffort.high,
-      summary: ReasoningSummary.detailed,
+    expect(result.llmConfig.reasoning).toBeUndefined();
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning: {
+        effort: ReasoningEffort.high,
+        summary: ReasoningSummary.detailed,
+      },
     });
     expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
     expect((result.llmConfig as Record<string, unknown>).reasoning_summary).toBeUndefined();
   });
 
-  it('should handle reasoning params without `useResponsesApi`', () => {
+  it('should pass custom endpoint reasoning through modelKwargs without `useResponsesApi`', () => {
     const modelOptions = {
       reasoning_effort: ReasoningEffort.high,
       reasoning_summary: ReasoningSummary.detailed,
     };
 
-    const result = getOpenAIConfig(mockApiKey, { modelOptions });
+    const result = getOpenAIConfig(mockApiKey, { modelOptions }, 'custom-endpoint');
 
-    /** When no endpoint is specified, it's treated as non-openAI/azureOpenAI, so uses reasoning object */
-    expect(result.llmConfig.reasoning).toEqual({
-      effort: ReasoningEffort.high,
-      summary: ReasoningSummary.detailed,
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning_effort: ReasoningEffort.high,
     });
+    expect(result.llmConfig.reasoning).toBeUndefined();
     expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
   });
 
@@ -173,7 +177,7 @@ describe('getOpenAIConfig', () => {
     expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
   });
 
-  it('should use reasoning object for non-openAI/azureOpenAI endpoints', () => {
+  it('should pass reasoning_effort through modelKwargs for non-openAI/azureOpenAI endpoints', () => {
     const modelOptions = {
       reasoning_effort: ReasoningEffort.high,
       reasoning_summary: ReasoningSummary.detailed,
@@ -181,13 +185,180 @@ describe('getOpenAIConfig', () => {
 
     const result = getOpenAIConfig(mockApiKey, { modelOptions }, 'custom-endpoint');
 
-    expect(result.llmConfig.reasoning).toEqual({
-      effort: ReasoningEffort.high,
-      summary: ReasoningSummary.detailed,
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning_effort: ReasoningEffort.high,
+    });
+    expect(result.llmConfig.reasoning).toBeUndefined();
+    expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
+  });
+
+  it('should support custom endpoint reasoning object format', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        customParams: {
+          reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        },
+        modelOptions: {
+          reasoning_effort: ReasoningEffort.high,
+          reasoning_summary: ReasoningSummary.detailed,
+        },
+      },
+      'custom-endpoint',
+    );
+
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning: {
+        effort: ReasoningEffort.high,
+        summary: ReasoningSummary.detailed,
+      },
     });
+    expect(result.llmConfig.reasoning).toBeUndefined();
     expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
   });
 
+  it('should replay reasoning content when custom endpoint enables includeReasoningContent', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        customParams: {
+          reasoningKey: ReasoningResponseKey.reasoningContent,
+          includeReasoningContent: true,
+        },
+        modelOptions: {
+          model: 'MiMo-VL-7B-RL',
+        },
+      },
+      'custom-endpoint',
+    );
+
+    expect(result.llmConfig).toHaveProperty('includeReasoningContent', true);
+  });
+
+  it('should enable within-run replay when custom endpoint enables includeReasoningHistory', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        customParams: {
+          reasoningKey: ReasoningResponseKey.reasoningContent,
+          includeReasoningHistory: true,
+        },
+        modelOptions: {
+          model: 'MiMo-VL-7B-RL',
+        },
+      },
+      'custom-endpoint',
+    );
+
+    expect(result.llmConfig).toHaveProperty('includeReasoningContent', true);
+  });
+
+  it('should enable within-run replay for non-OpenAI param-format gateways (anthropic/google)', () => {
+    const anthropic = getOpenAIConfig(
+      mockApiKey,
+      {
+        customParams: {
+          defaultParamsEndpoint: EModelEndpoint.anthropic,
+          includeReasoningContent: true,
+        },
+        modelOptions: { model: 'claude-3-7-sonnet' },
+      },
+      'custom-endpoint',
+    );
+    expect(anthropic.llmConfig).toHaveProperty('includeReasoningContent', true);
+
+    const google = getOpenAIConfig(
+      mockApiKey,
+      {
+        customParams: {
+          defaultParamsEndpoint: EModelEndpoint.google,
+          includeReasoningHistory: true,
+        },
+        modelOptions: { model: 'gemini-2.5-pro' },
+      },
+      'custom-endpoint',
+    );
+    expect(google.llmConfig).toHaveProperty('includeReasoningContent', true);
+  });
+
+  it('should not replay reasoning content for custom endpoints by default', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        modelOptions: {
+          model: 'MiMo-VL-7B-RL',
+        },
+      },
+      'custom-endpoint',
+    );
+
+    expect(result.llmConfig).not.toHaveProperty('includeReasoningContent');
+  });
+
+  it('should default Vercel custom endpoints to reasoning object format', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        reverseProxyUrl: 'https://ai-gateway.vercel.sh/v1',
+        modelOptions: {
+          reasoning_effort: ReasoningEffort.high,
+        },
+      },
+      'Vercel',
+    );
+
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning: {
+        effort: ReasoningEffort.high,
+      },
+    });
+    expect(result.llmConfig.reasoning).toBeUndefined();
+    expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
+  });
+
+  it('should apply Vercel reasoning format to custom default params', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        reverseProxyUrl: 'https://ai-gateway.vercel.sh/v1',
+        customParams: {
+          paramDefinitions: [{ key: 'reasoning_effort', default: ReasoningEffort.low }],
+        },
+        modelOptions: {
+          model: 'openai/gpt-5-mini',
+        },
+      },
+      'Vercel',
+    );
+
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning: {
+        effort: ReasoningEffort.low,
+      },
+    });
+    expect((result.llmConfig as Record<string, unknown>).reasoning_effort).toBeUndefined();
+  });
+
+  it('should allow Vercel reasoning format override', () => {
+    const result = getOpenAIConfig(
+      mockApiKey,
+      {
+        reverseProxyUrl: 'https://ai-gateway.vercel.sh/v1',
+        customParams: {
+          reasoningFormat: ReasoningParameterFormat.reasoningEffort,
+        },
+        modelOptions: {
+          reasoning_effort: ReasoningEffort.high,
+        },
+      },
+      'Vercel',
+    );
+
+    expect(result.llmConfig.modelKwargs).toEqual({
+      reasoning_effort: ReasoningEffort.high,
+    });
+  });
+
   it('should handle OpenRouter configuration', () => {
     const reverseProxyUrl = 'https://openrouter.ai/api/v1';
 
@@ -382,6 +553,43 @@ describe('getOpenAIConfig', () => {
     expect((result.configOptions?.fetchOptions as RequestInit).dispatcher).toBeDefined();
   });
 
+  it('should harden user-provided base URLs with a connect-time dispatcher and disabled redirects', () => {
+    const result = getOpenAIConfig(mockApiKey, {
+      reverseProxyUrl: 'https://user-provider.example.com/v1',
+      baseURLIsUserProvided: true,
+      allowedAddresses: ['10.0.0.5:443'],
+    });
+
+    expect(result.configOptions?.baseURL).toBe('https://user-provider.example.com/v1');
+    expect(result.configOptions?.fetchOptions).toEqual(
+      expect.objectContaining({
+        dispatcher: expect.any(Object),
+        redirect: 'error',
+      }),
+    );
+  });
+
+  it('should keep the SSRF-safe dispatcher when a proxy is configured for a user-provided URL', () => {
+    const result = getOpenAIConfig(mockApiKey, {
+      reverseProxyUrl: 'https://user-provider.example.com/v1',
+      baseURLIsUserProvided: true,
+      proxy: 'http://proxy.example.com:8080',
+    });
+
+    const unproxiedResult = getOpenAIConfig(mockApiKey, {
+      reverseProxyUrl: 'https://user-provider.example.com/v1',
+      baseURLIsUserProvided: true,
+    });
+
+    expect(result.configOptions?.fetchOptions?.dispatcher).toBeDefined();
+    expect(result.configOptions?.fetchOptions?.dispatcher?.constructor.name).toBe(
+      unproxiedResult.configOptions?.fetchOptions?.dispatcher?.constructor.name,
+    );
+    expect(result.configOptions?.fetchOptions).toEqual(
+      expect.objectContaining({ redirect: 'error' }),
+    );
+  });
+
   it('should handle headers and defaultQuery', () => {
     const headers = { 'X-Custom-Header': 'value' };
     const defaultQuery = { customParam: 'value' };
@@ -828,6 +1036,46 @@ describe('getOpenAIConfig', () => {
       expect(result.provider).toBe('openrouter');
     });
 
+    it('should honor a TTL-only selection for OpenRouter (promptCache defaulted on)', () => {
+      /**
+       * Reproduces selecting only the promptCacheTtl dropdown without toggling
+       * the promptCache switch: modelOptions carries the TTL but not promptCache.
+       * OPENROUTER_DEFAULT_PARAMS still resolves caching on, so the TTL survives.
+       */
+      const result = getOpenAIConfig(
+        mockApiKey,
+        {
+          modelOptions: {
+            model: 'anthropic/claude-sonnet-4.6',
+            promptCacheTtl: '1h',
+          } as Record<string, unknown>,
+        },
+        'openrouter',
+      );
+
+      expect(result.llmConfig.promptCache).toBe(true);
+      expect((result.llmConfig as Record<string, unknown>).promptCacheTtl).toBe('1h');
+      expect(result.provider).toBe('openrouter');
+    });
+
+    it('should drop the OpenRouter TTL when promptCache is explicitly disabled', () => {
+      const result = getOpenAIConfig(
+        mockApiKey,
+        {
+          modelOptions: {
+            model: 'anthropic/claude-sonnet-4.6',
+            promptCache: false,
+            promptCacheTtl: '1h',
+          } as Record<string, unknown>,
+        },
+        'openrouter',
+      );
+
+      expect(result.llmConfig.promptCache).toBeUndefined();
+      expect((result.llmConfig as Record<string, unknown>).promptCacheTtl).toBeUndefined();
+      expect(result.provider).toBe('openrouter');
+    });
+
     it('should handle web_search with OpenRouter using plugins format', () => {
       const modelOptions = {
         model: 'gpt-4',
@@ -1006,11 +1254,12 @@ describe('getOpenAIConfig', () => {
         const result = getOpenAIConfig(mockApiKey, {
           modelOptions: { ...modelOptions, useResponsesApi: true } as Partial<OpenAIParameters>,
         });
+        const reasoning = result.llmConfig?.reasoning ?? result.llmConfig?.modelKwargs?.reasoning;
 
         if (shouldHaveReasoning) {
-          expect(result.llmConfig?.reasoning).toBeDefined();
+          expect(reasoning).toBeDefined();
         } else {
-          expect(result.llmConfig?.reasoning).toBeUndefined();
+          expect(reasoning).toBeUndefined();
         }
       });
     });
@@ -1088,6 +1337,7 @@ describe('getOpenAIConfig', () => {
           frequency_penalty: 0.5,
           presence_penalty: 0.6,
           max_tokens: 1000,
+          reasoning_effort: ReasoningEffort.high,
           custom_param: 'should-remain',
         };
 
@@ -1102,6 +1352,7 @@ describe('getOpenAIConfig', () => {
         /** `presence_penalty` is converted to `presencePenalty` */
         expect(result.llmConfig.maxTokens).toBe(1000); // max_tokens is allowed
         expect((result.llmConfig as Record<string, unknown>).custom_param).toBe('should-remain');
+        expect(result.llmConfig.modelKwargs).toBeUndefined();
       });
     });
 
@@ -1209,9 +1460,11 @@ describe('getOpenAIConfig', () => {
         streaming: false,
         useResponsesApi: true, // From web_search
       });
+      expect(result.llmConfig.reasoning).toBeUndefined();
       expect(result.llmConfig.maxTokens).toBe(2000);
       expect(result.llmConfig.modelKwargs).toEqual({
         text: { verbosity: Verbosity.medium },
+        reasoning: { effort: ReasoningEffort.high },
         customParam: 'custom-value',
       });
       expect(result.tools).toEqual([{ type: 'web_search' }]);
diff --git a/packages/api/src/endpoints/openai/config.ts b/packages/api/src/endpoints/openai/config.ts
index b239a2b7d05..13e324d7ffa 100644
--- a/packages/api/src/endpoints/openai/config.ts
+++ b/packages/api/src/endpoints/openai/config.ts
@@ -1,15 +1,21 @@
-import { ProxyAgent } from 'undici';
+import { Agent } from 'undici';
 import { Providers } from '@librechat/agents';
-import { KnownEndpoints, EModelEndpoint } from 'librechat-data-provider';
+import { KnownEndpoints, EModelEndpoint, ReasoningParameterFormat } from 'librechat-data-provider';
+import type { Dispatcher } from 'undici';
 import type * as t from '~/types';
 import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm';
+import { createSSRFSafeAgents, createSSRFSafeUndiciConnect } from '~/auth';
 import { getOpenAILLMConfig, extractDefaultParams } from './llm';
 import { getGoogleConfig } from '~/endpoints/google/llm';
 import { transformToOpenAIConfig } from './transform';
+import { getProxyDispatcher } from '~/utils/proxy';
 import { constructAzureURL } from '~/utils/azure';
 import { createFetch } from '~/utils/generators';
+import { mergeHeaders } from '~/utils/headers';
 
 type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+type FetchOptions = RequestInit & { dispatcher?: Dispatcher };
+type OpenAIConfiguration = NonNullable<t.OpenAIConfiguration>;
 
 const OPENROUTER_DEFAULT_PARAMS = { promptCache: true };
 
@@ -34,24 +40,47 @@ function getDefaultParams({
   };
 }
 
-function mergeHeadersPreservingAnthropicBeta(
-  headers: Record<string, string> | undefined,
-  defaultHeaders: Record<string, string>,
-): Record<string, string> {
-  const mergedHeaders = Object.assign({}, headers ?? {}, defaultHeaders);
-  const existingBetaHeader = headers?.['anthropic-beta'];
-  const defaultBetaHeader = defaultHeaders['anthropic-beta'];
-
-  if (existingBetaHeader && defaultBetaHeader) {
-    const betaValues = [existingBetaHeader, defaultBetaHeader]
-      .flatMap((value) => value.split(','))
-      .map((value) => value.trim())
-      .filter(Boolean);
-
-    mergedHeaders['anthropic-beta'] = Array.from(new Set(betaValues)).join(',');
+function getReasoningFormat({
+  customFormat,
+  isVercel,
+}: {
+  customFormat?: ReasoningParameterFormat;
+  isVercel: boolean;
+}): ReasoningParameterFormat | undefined {
+  if (customFormat) {
+    return customFormat;
+  }
+  if (isVercel) {
+    return ReasoningParameterFormat.reasoningObject;
+  }
+  return undefined;
+}
+
+function getEffectiveURLPort(baseURL: string): string | null {
+  try {
+    const parsed = new URL(baseURL);
+    if (parsed.port) {
+      return parsed.port;
+    }
+    if (parsed.protocol === 'http:') {
+      return '80';
+    }
+    if (parsed.protocol === 'https:') {
+      return '443';
+    }
+  } catch {
+    return null;
   }
 
-  return mergedHeaders;
+  return null;
+}
+
+function mergeFetchOptions(configOptions: OpenAIConfiguration, options: FetchOptions): void {
+  const currentOptions = (configOptions.fetchOptions ?? {}) as FetchOptions;
+  configOptions.fetchOptions = {
+    ...currentOptions,
+    ...options,
+  } as OpenAIConfiguration['fetchOptions'];
 }
 
 /**
@@ -76,6 +105,10 @@ export function getOpenAIConfig(
     modelOptions = {},
     reverseProxyUrl: baseURL,
   } = options;
+  const shouldProtectUserBaseURL = options.baseURLIsUserProvided === true && !!baseURL;
+  const ssrfAgents = shouldProtectUserBaseURL
+    ? createSSRFSafeAgents(options.allowedAddresses)
+    : undefined;
 
   let llmConfig: t.OAIClientOptions;
   let tools: t.LLMConfigResult['tools'];
@@ -118,7 +151,7 @@ export function getOpenAIConfig(
     llmConfig = transformed.llmConfig;
     tools = anthropicResult.tools;
     if (transformed.configOptions?.defaultHeaders) {
-      headers = mergeHeadersPreservingAnthropicBeta(
+      headers = mergeHeaders(
         headers,
         transformed.configOptions.defaultHeaders as Record<string, string>,
       );
@@ -159,12 +192,29 @@ export function getOpenAIConfig(
       defaultParams,
       modelOptions,
       useOpenRouter,
+      reasoningFormat: getReasoningFormat({
+        customFormat: options.customParams?.reasoningFormat,
+        isVercel: Boolean(isVercel),
+      }),
     });
     llmConfig = openaiResult.llmConfig;
     azure = openaiResult.azure;
     tools = openaiResult.tools;
   }
 
+  /**
+   * Within-run `reasoning_content` replay applies across every param-format
+   * branch above (OpenAI / Anthropic / Google gateway modes all resolve to the
+   * OpenAI client). `includeReasoningHistory` implies it, since reconstructed
+   * history reasoning is only sent when the within-run flag is set.
+   */
+  if (
+    options.customParams?.includeReasoningContent === true ||
+    options.customParams?.includeReasoningHistory === true
+  ) {
+    llmConfig.includeReasoningContent = true;
+  }
+
   const configOptions: t.OpenAIConfiguration = {};
   if (baseURL) {
     configOptions.baseURL = baseURL;
@@ -187,11 +237,21 @@ export function getOpenAIConfig(
     configOptions.defaultQuery = defaultQuery;
   }
 
-  if (proxy) {
-    const proxyAgent = new ProxyAgent(proxy);
-    configOptions.fetchOptions = {
-      dispatcher: proxyAgent,
-    };
+  if (shouldProtectUserBaseURL) {
+    mergeFetchOptions(configOptions, {
+      dispatcher: new Agent({
+        connect: createSSRFSafeUndiciConnect(
+          options.allowedAddresses,
+          getEffectiveURLPort(baseURL),
+        ),
+      }),
+      redirect: 'error',
+    });
+  }
+
+  const proxyDispatcher = getProxyDispatcher(proxy);
+  if (proxyDispatcher && !shouldProtectUserBaseURL) {
+    mergeFetchOptions(configOptions, { dispatcher: proxyDispatcher });
   }
 
   if (azure && !isAnthropic) {
@@ -228,6 +288,8 @@ export function getOpenAIConfig(
     configOptions.fetch = createFetch({
       directEndpoint: directEndpoint,
       reverseProxyUrl: configOptions?.baseURL,
+      ssrfAgents,
+      redirect: shouldProtectUserBaseURL ? 'error' : undefined,
     }) as unknown as Fetch;
   }
 
diff --git a/packages/api/src/endpoints/openai/initialize.spec.ts b/packages/api/src/endpoints/openai/initialize.spec.ts
index 85c8c1e8965..980dc8cfe49 100644
--- a/packages/api/src/endpoints/openai/initialize.spec.ts
+++ b/packages/api/src/endpoints/openai/initialize.spec.ts
@@ -15,12 +15,14 @@ jest.mock('./config', () => ({
 }));
 
 jest.mock('~/utils', () => ({
+  ...jest.requireActual('~/utils'),
   getAzureCredentials: jest.fn(),
   resolveHeaders: jest.fn(() => ({})),
   isUserProvided: (val: string) => val === 'user_provided',
   checkUserKeyExpiry: jest.fn(),
 }));
 
+import { getAzureCredentials } from '~/utils';
 import { initializeOpenAI } from './initialize';
 
 function createParams(env: Record<string, string | undefined>): BaseInitializeParams {
@@ -84,6 +86,15 @@ describe('initializeOpenAI – SSRF guard wiring', () => {
       EModelEndpoint.openAI,
       undefined,
     );
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'sk-test',
+      expect.objectContaining({
+        reverseProxyUrl: 'https://user-proxy.example.com/v1',
+        baseURLIsUserProvided: true,
+        allowedAddresses: undefined,
+      }),
+      EModelEndpoint.openAI,
+    );
   });
 
   it('should NOT call validateEndpointURL when OPENAI_REVERSE_PROXY is a system URL', async () => {
@@ -133,4 +144,126 @@ describe('initializeOpenAI – SSRF guard wiring', () => {
 
     expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
   });
+
+  it('should not validate a stale user Azure URL when an admin model group baseURL is selected', async () => {
+    const params = createParams({
+      AZURE_API_KEY: 'az-env-key',
+      AZURE_OPENAI_BASEURL: AuthType.USER_PROVIDED,
+    });
+    params.endpoint = EModelEndpoint.azureOpenAI;
+    params.model_parameters = { model: 'gpt-4o' };
+    params.req.config = {
+      endpoints: {
+        [EModelEndpoint.azureOpenAI]: {
+          modelGroupMap: {
+            'gpt-4o': { group: 'serverless-group' },
+          },
+          groupMap: {
+            'serverless-group': {
+              apiKey: 'az-admin-key',
+              baseURL: 'https://admin-azure.example.com/openai/deployments/gpt-4o',
+              version: '2024-10-21',
+              serverless: true,
+            },
+          },
+        },
+      },
+    } as unknown as BaseInitializeParams['req']['config'];
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    expect(mockValidateEndpointURL).not.toHaveBeenCalled();
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'az-admin-key',
+      expect.objectContaining({
+        reverseProxyUrl: 'https://admin-azure.example.com/openai/deployments/gpt-4o',
+        baseURLIsUserProvided: false,
+      }),
+      EModelEndpoint.azureOpenAI,
+    );
+  });
+});
+
+describe('initializeOpenAI – custom headers', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('forwards configured endpoint headers (merged over endpoints.all) to getOpenAIConfig', async () => {
+    const params = createParams({ OPENAI_API_KEY: 'sk-test' });
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+      [EModelEndpoint.openAI]: {
+        headers: { 'X-Override': 'openai', 'cf-aig-metadata': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+      },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toEqual({
+      'X-Common': 'all',
+      'X-Override': 'openai',
+      'cf-aig-metadata': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+    });
+  });
+
+  it('does not set headers when none are configured', async () => {
+    const params = createParams({ OPENAI_API_KEY: 'sk-test' });
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toBeUndefined();
+  });
+
+  it('withholds configured headers when the user supplies the base URL', async () => {
+    const params = createParams({
+      OPENAI_API_KEY: 'sk-test',
+      OPENAI_REVERSE_PROXY: AuthType.USER_PROVIDED,
+    });
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      [EModelEndpoint.openAI]: { headers: { 'X-Secret': '${GATEWAY_SECRET}' } },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toBeUndefined();
+  });
+
+  it('applies endpoints.all headers to the env-based Azure path, unresolved at init', async () => {
+    (getAzureCredentials as jest.Mock).mockReturnValueOnce({ azureOpenAIApiKey: 'az-key' });
+    const params = createParams({ AZURE_API_KEY: 'az-key' });
+    params.endpoint = EModelEndpoint.azureOpenAI;
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      all: { headers: { 'X-Global': '{{LIBRECHAT_USER_ID}}' } },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    // Left unresolved here; request-time resolveConfigHeaders resolves it once
+    expect(options.headers).toEqual({ 'X-Global': '{{LIBRECHAT_USER_ID}}' });
+  });
 });
diff --git a/packages/api/src/endpoints/openai/initialize.ts b/packages/api/src/endpoints/openai/initialize.ts
index 1b852deb1fa..9e9418e037f 100644
--- a/packages/api/src/endpoints/openai/initialize.ts
+++ b/packages/api/src/endpoints/openai/initialize.ts
@@ -5,7 +5,13 @@ import type {
   OpenAIConfigOptions,
   UserKeyValues,
 } from '~/types';
-import { getAzureCredentials, resolveHeaders, isUserProvided, checkUserKeyExpiry } from '~/utils';
+import {
+  mergeHeaders,
+  resolveHeaders,
+  isUserProvided,
+  checkUserKeyExpiry,
+  getAzureCredentials,
+} from '~/utils';
 import { validateEndpointURL } from '~/auth';
 import { getOpenAIConfig } from './config';
 
@@ -24,6 +30,8 @@ export async function initializeOpenAI({
   db,
 }: BaseInitializeParams): Promise<InitializeResultBase> {
   const appConfig = req.config;
+  const openAIConfig = appConfig?.endpoints?.[EModelEndpoint.openAI];
+  const allConfig = appConfig?.endpoints?.all;
   const { PROXY, OPENAI_API_KEY, AZURE_API_KEY, OPENAI_REVERSE_PROXY, AZURE_OPENAI_BASEURL } =
     process.env;
 
@@ -56,16 +64,26 @@ export async function initializeOpenAI({
     ? userValues?.baseURL
     : baseURLOptions[endpoint as keyof typeof baseURLOptions];
 
-  if (userProvidesURL && baseURL) {
-    await validateEndpointURL(baseURL, endpoint, appConfig?.endpoints?.allowedAddresses);
-  }
-
   const clientOptions: OpenAIConfigOptions = {
     proxy: PROXY ?? undefined,
     reverseProxyUrl: baseURL || undefined,
+    baseURLIsUserProvided: userProvidesURL,
+    allowedAddresses: appConfig?.endpoints?.allowedAddresses,
     streaming: true,
   };
 
+  /**
+   * Custom headers are forwarded only when the destination URL is admin-trusted.
+   * When the user supplies the base URL, withhold them — they may carry
+   * `${SECRET}` gateway values or user/OpenID token placeholders resolved later
+   * by `resolveConfigHeaders`, which must not reach a user-controlled endpoint.
+   */
+  const trustedURL = !userProvidesURL;
+  const globalHeaders = trustedURL ? allConfig?.headers : undefined;
+  const openAIHeaders = trustedURL
+    ? mergeHeaders(allConfig?.headers, openAIConfig?.headers)
+    : undefined;
+
   const isAzureOpenAI = endpoint === EModelEndpoint.azureOpenAI;
   const azureConfig = isAzureOpenAI && appConfig?.endpoints?.[EModelEndpoint.azureOpenAI];
   let isServerless = false;
@@ -85,10 +103,20 @@ export async function initializeOpenAI({
     isServerless = serverless === true;
 
     clientOptions.reverseProxyUrl = configBaseURL ?? clientOptions.reverseProxyUrl;
+    if (configBaseURL) {
+      clientOptions.baseURLIsUserProvided = false;
+    }
     clientOptions.headers = resolveHeaders({
       headers: { ...headers, ...(clientOptions.headers ?? {}) },
       user: req.user,
     });
+    /** `endpoints.all` headers apply globally, but stay unresolved here — they are
+     *  resolved once at request time by `resolveConfigHeaders`. Resolving them now
+     *  (in addition) would re-expand already-substituted user values, violating the
+     *  env-before-user invariant. Azure-managed headers stay authoritative. */
+    if (globalHeaders) {
+      clientOptions.headers = mergeHeaders(globalHeaders, clientOptions.headers);
+    }
 
     const groupName = modelGroupMap[modelName || '']?.group;
     if (groupName && groupMap[groupName]) {
@@ -113,6 +141,27 @@ export async function initializeOpenAI({
     clientOptions.azure =
       userProvidesKey && userValues?.apiKey ? JSON.parse(userValues.apiKey) : getAzureCredentials();
     apiKey = clientOptions.azure ? clientOptions.azure.azureOpenAIApiKey : undefined;
+    /** Env-var Azure path has no per-model headers; still honor global `all` headers. */
+    if (globalHeaders) {
+      clientOptions.headers = { ...globalHeaders };
+    }
+  } else {
+    /**
+     * Attach admin-configured custom headers for the built-in OpenAI endpoint
+     * (endpoint over global `all`). Kept unresolved here so request-body
+     * placeholders resolve at request time via `resolveConfigHeaders`.
+     */
+    if (openAIHeaders) {
+      clientOptions.headers = openAIHeaders;
+    }
+  }
+
+  if (clientOptions.baseURLIsUserProvided && clientOptions.reverseProxyUrl) {
+    await validateEndpointURL(
+      clientOptions.reverseProxyUrl,
+      endpoint,
+      appConfig?.endpoints?.allowedAddresses,
+    );
   }
 
   if (userProvidesKey && !apiKey) {
@@ -145,8 +194,6 @@ export async function initializeOpenAI({
     (options as InitializeResultBase).useLegacyContent = true;
   }
 
-  const openAIConfig = appConfig?.endpoints?.[EModelEndpoint.openAI];
-  const allConfig = appConfig?.endpoints?.all;
   const azureRate = modelName?.includes('gpt-4') ? 30 : 17;
 
   let streamRate: number | undefined;
diff --git a/packages/api/src/endpoints/openai/llm.spec.ts b/packages/api/src/endpoints/openai/llm.spec.ts
index e6553e96c06..ec6330e0eae 100644
--- a/packages/api/src/endpoints/openai/llm.spec.ts
+++ b/packages/api/src/endpoints/openai/llm.spec.ts
@@ -3,9 +3,10 @@ import {
   EModelEndpoint,
   ReasoningEffort,
   ReasoningSummary,
+  ReasoningParameterFormat,
 } from 'librechat-data-provider';
-import { getOpenAILLMConfig, extractDefaultParams, applyDefaultParams } from './llm';
 import type * as t from '~/types';
+import { getOpenAILLMConfig, extractDefaultParams, applyDefaultParams } from './llm';
 
 describe('getOpenAILLMConfig', () => {
   describe('Basic Configuration', () => {
@@ -463,23 +464,159 @@ describe('getOpenAILLMConfig', () => {
       expect(result.llmConfig).toHaveProperty('reasoning_effort', ReasoningEffort.high);
     });
 
-    it('should use reasoning object for non-OpenAI endpoints', () => {
+    it('should pass reasoning_effort through modelKwargs for custom endpoints', () => {
       const result = getOpenAILLMConfig({
         apiKey: 'test-api-key',
         streaming: true,
         endpoint: 'custom',
         modelOptions: {
-          model: 'o1',
+          model: 'provider/reasoning-model',
+          reasoning_effort: ReasoningEffort.high,
+        },
+      });
+
+      expect(result.llmConfig.modelKwargs).toHaveProperty('reasoning_effort', ReasoningEffort.high);
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig).not.toHaveProperty('reasoning_effort');
+    });
+
+    it('should support reasoning object passthrough for custom endpoints', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        modelOptions: {
+          model: 'provider/reasoning-model',
           reasoning_effort: ReasoningEffort.high,
           reasoning_summary: ReasoningSummary.concise,
         },
       });
 
-      expect(result.llmConfig).toHaveProperty('reasoning');
-      expect(result.llmConfig.reasoning).toEqual({
+      expect(result.llmConfig.modelKwargs).toHaveProperty('reasoning', {
         effort: ReasoningEffort.high,
         summary: ReasoningSummary.concise,
       });
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig).not.toHaveProperty('reasoning_effort');
+    });
+
+    it('should apply reasoning format to default reasoning params', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        defaultParams: {
+          reasoning_effort: ReasoningEffort.low,
+          reasoning_summary: ReasoningSummary.concise,
+        },
+        modelOptions: {
+          model: 'provider/reasoning-model',
+        },
+      });
+
+      expect(result.llmConfig.modelKwargs).toHaveProperty('reasoning', {
+        effort: ReasoningEffort.low,
+        summary: ReasoningSummary.concise,
+      });
+      expect(result.llmConfig.modelKwargs).not.toHaveProperty('reasoning_effort');
+    });
+
+    it('should let addParams reasoning override default reasoning params before formatting', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        defaultParams: {
+          reasoning_effort: ReasoningEffort.low,
+        },
+        addParams: {
+          reasoning_effort: ReasoningEffort.high,
+        },
+        modelOptions: {
+          model: 'provider/reasoning-model',
+        },
+      });
+
+      expect(result.llmConfig.modelKwargs).toHaveProperty('reasoning', {
+        effort: ReasoningEffort.high,
+      });
+      expect(result.llmConfig.modelKwargs).not.toHaveProperty('reasoning_effort');
+    });
+
+    it('should allow custom endpoints to disable reasoning passthrough', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.disabled,
+        modelOptions: {
+          model: 'provider/reasoning-model',
+          reasoning_effort: ReasoningEffort.high,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig).not.toHaveProperty('reasoning_effort');
+      expect(result.llmConfig.modelKwargs).toBeUndefined();
+    });
+
+    it('should use Responses API reasoning when web_search enables Responses API', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        modelOptions: {
+          model: 'provider/reasoning-model',
+          reasoning_effort: ReasoningEffort.high,
+          reasoning_summary: ReasoningSummary.concise,
+          web_search: true,
+        },
+      });
+
+      expect(result.llmConfig).toHaveProperty('useResponsesApi', true);
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig.modelKwargs).toHaveProperty('reasoning', {
+        effort: ReasoningEffort.high,
+        summary: ReasoningSummary.concise,
+      });
+      expect(result.tools).toContainEqual({ type: 'web_search' });
+    });
+
+    it('should remove reasoning kwargs for GPT-4o search models', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        modelOptions: {
+          model: 'gpt-4o-search',
+          reasoning_effort: ReasoningEffort.high,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig).not.toHaveProperty('reasoning_effort');
+      expect(result.llmConfig.modelKwargs).toBeUndefined();
+    });
+
+    it('should honor dropParams after reasoning object conversion', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        endpoint: 'custom',
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+        dropParams: ['reasoning_effort'],
+        modelOptions: {
+          model: 'provider/reasoning-model',
+          reasoning_effort: ReasoningEffort.high,
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('reasoning');
+      expect(result.llmConfig).not.toHaveProperty('reasoning_effort');
+      expect(result.llmConfig.modelKwargs).toBeUndefined();
     });
 
     it('should use reasoning object when useResponsesApi is true', () => {
@@ -962,6 +1099,131 @@ describe('getOpenAILLMConfig', () => {
       expect(disabled.llmConfig).not.toHaveProperty('promptCache');
       expect(dropped.llmConfig).not.toHaveProperty('promptCache');
     });
+
+    it('should resolve OpenRouter promptCacheTtl default/add/drop params', () => {
+      const fromDefault = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        defaultParams: { promptCache: true, promptCacheTtl: '1h' },
+        modelOptions: {
+          model: 'anthropic/claude-sonnet-4.6',
+        },
+      });
+      const overridden = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        defaultParams: { promptCache: true, promptCacheTtl: '1h' },
+        addParams: { promptCacheTtl: '5m' },
+        modelOptions: {
+          model: 'anthropic/claude-sonnet-4.6',
+        },
+      });
+      const dropped = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        defaultParams: { promptCache: true, promptCacheTtl: '1h' },
+        dropParams: ['promptCacheTtl'],
+        modelOptions: {
+          model: 'anthropic/claude-sonnet-4.6',
+        },
+      });
+
+      expect((fromDefault.llmConfig as Record<string, unknown>).promptCacheTtl).toBe('1h');
+      expect((overridden.llmConfig as Record<string, unknown>).promptCacheTtl).toBe('5m');
+      /** promptCache stays on, but the TTL is dropped so the SDK applies its default */
+      expect(dropped.llmConfig).toHaveProperty('promptCache', true);
+      expect((dropped.llmConfig as Record<string, unknown>).promptCacheTtl).toBeUndefined();
+    });
+
+    it('should set includeReasoningContent for DeepSeek models via OpenRouter', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        modelOptions: {
+          model: 'deepseek/deepseek-v4-pro',
+        },
+      });
+
+      expect(result.llmConfig).toHaveProperty('includeReasoningContent', true);
+    });
+
+    it('should set includeReasoningContent case-insensitively for OpenRouter DeepSeek models', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        modelOptions: {
+          model: 'DeepSeek/DeepSeek-V4',
+        },
+      });
+
+      expect(result.llmConfig).toHaveProperty('includeReasoningContent', true);
+    });
+
+    it('should set includeReasoningContent for OpenRouter DeepSeek models with the latest-routing `~` prefix', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        modelOptions: {
+          model: '~deepseek/deepseek-v4-pro',
+        },
+      });
+
+      expect(result.llmConfig).toHaveProperty('includeReasoningContent', true);
+    });
+
+    it('should not set includeReasoningContent for non-DeepSeek OpenRouter models', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: true,
+        modelOptions: {
+          model: 'anthropic/claude-opus-4-7',
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('includeReasoningContent');
+    });
+
+    it('should set includeReasoningContent for DeepSeek-flavored models outside OpenRouter (custom proxies)', () => {
+      const directLike = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: false,
+        modelOptions: {
+          model: 'deepseek-chat',
+        },
+      });
+      expect(directLike.llmConfig).toHaveProperty('includeReasoningContent', true);
+
+      const customProxy = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: false,
+        modelOptions: {
+          model: 'deepseek/deepseek-v4-pro',
+        },
+      });
+      expect(customProxy.llmConfig).toHaveProperty('includeReasoningContent', true);
+    });
+
+    it('should not set includeReasoningContent for non-DeepSeek models outside OpenRouter', () => {
+      const result = getOpenAILLMConfig({
+        apiKey: 'test-api-key',
+        streaming: true,
+        useOpenRouter: false,
+        modelOptions: {
+          model: 'gpt-4',
+        },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('includeReasoningContent');
+    });
   });
 
   describe('Verbosity Handling', () => {
diff --git a/packages/api/src/endpoints/openai/llm.ts b/packages/api/src/endpoints/openai/llm.ts
index 0e27e3d95c2..ddbadc0853a 100644
--- a/packages/api/src/endpoints/openai/llm.ts
+++ b/packages/api/src/endpoints/openai/llm.ts
@@ -1,5 +1,6 @@
 import {
   EModelEndpoint,
+  ReasoningParameterFormat,
   removeNullishValues,
   supportsAdaptiveThinking,
 } from 'librechat-data-provider';
@@ -17,7 +18,7 @@ type OpenAILLMConfig = Omit<Partial<t.OAIClientOptions>, 'verbosity'> &
     verbosity?: string | null;
   };
 
-export const knownOpenAIParams = new Set([
+export const knownOpenAIParams: Set<string> = new Set([
   // Constructor/Instance Parameters
   'model',
   'modelName',
@@ -86,6 +87,78 @@ function hasReasoningParams({
   );
 }
 
+function getReasoningObject({
+  reasoningEffort,
+  reasoningSummary,
+}: {
+  reasoningEffort?: OpenAILLMConfig['reasoning_effort'];
+  reasoningSummary?: OpenAILLMConfig['reasoning_summary'];
+}): OpenAI.Reasoning {
+  return removeNullishValues(
+    {
+      effort: reasoningEffort,
+      summary: reasoningSummary,
+    },
+    true,
+  ) as OpenAI.Reasoning;
+}
+
+function isOpenAIEndpoint(endpoint?: EModelEndpoint | string | null): boolean {
+  return endpoint === EModelEndpoint.openAI || endpoint === EModelEndpoint.azureOpenAI;
+}
+
+function removeReasoningSummary(target: Record<string, unknown>) {
+  const { reasoning } = target;
+  if (reasoning == null || typeof reasoning !== 'object' || Array.isArray(reasoning)) {
+    return;
+  }
+
+  const rest = { ...(reasoning as Record<string, unknown>) };
+  delete rest.summary;
+  if (Object.keys(rest).length === 0) {
+    delete target.reasoning;
+    return;
+  }
+
+  target.reasoning = rest;
+}
+
+function removeReasoningPayload(target: Record<string, unknown>) {
+  delete target.reasoning;
+  delete target.reasoning_effort;
+}
+
+function deleteConfigParam({
+  param,
+  llmConfig,
+  modelKwargs,
+}: {
+  param: string;
+  llmConfig: OpenAILLMConfig;
+  modelKwargs: Record<string, unknown>;
+}) {
+  if (param === 'reasoning_effort') {
+    removeReasoningPayload(llmConfig as Record<string, unknown>);
+    removeReasoningPayload(modelKwargs);
+    return;
+  }
+
+  if (param === 'reasoning_summary') {
+    delete (llmConfig as Record<string, unknown>).reasoning_summary;
+    delete modelKwargs.reasoning_summary;
+    removeReasoningSummary(llmConfig as Record<string, unknown>);
+    removeReasoningSummary(modelKwargs);
+    return;
+  }
+
+  if (param in llmConfig) {
+    delete llmConfig[param as keyof t.OAIClientOptions];
+  }
+  if (param in modelKwargs) {
+    delete modelKwargs[param];
+  }
+}
+
 const openRouterAnthropicVerbosityByEffort: Record<
   string,
   NonNullable<OpenAILLMConfig['verbosity']>
@@ -204,6 +277,64 @@ function applyOpenRouterReasoningConfig({
   return true;
 }
 
+function applyReasoningConfig({
+  endpoint,
+  llmConfig,
+  modelKwargs,
+  reasoningEffort,
+  reasoningFormat,
+  reasoningSummary,
+}: {
+  endpoint?: EModelEndpoint | string | null;
+  llmConfig: OpenAILLMConfig;
+  modelKwargs: Record<string, unknown>;
+  reasoningEffort?: OpenAILLMConfig['reasoning_effort'];
+  reasoningFormat?: ReasoningParameterFormat;
+  reasoningSummary?: OpenAILLMConfig['reasoning_summary'];
+}): boolean {
+  if (
+    !hasReasoningParams({
+      reasoning_effort: reasoningEffort,
+      reasoning_summary: reasoningSummary,
+    })
+  ) {
+    return false;
+  }
+
+  const reasoning = getReasoningObject({ reasoningEffort, reasoningSummary });
+  if (reasoningFormat === ReasoningParameterFormat.disabled) {
+    return false;
+  }
+
+  if (isOpenAIEndpoint(endpoint)) {
+    if (llmConfig.useResponsesApi === true) {
+      llmConfig.reasoning = reasoning;
+      return false;
+    }
+    if (reasoningEffort) {
+      llmConfig.reasoning_effort = reasoningEffort;
+    }
+    return false;
+  }
+
+  if (llmConfig.useResponsesApi === true) {
+    modelKwargs.reasoning = reasoning;
+    return true;
+  }
+
+  if (reasoningFormat === ReasoningParameterFormat.reasoningObject) {
+    modelKwargs.reasoning = reasoning;
+    return true;
+  }
+
+  if (reasoningEffort) {
+    modelKwargs.reasoning_effort = reasoningEffort;
+    return true;
+  }
+
+  return false;
+}
+
 function getModelKwargsText(modelKwargs: Record<string, unknown>): Record<string, unknown> {
   const { text } = modelKwargs;
   if (text == null || typeof text !== 'object' || Array.isArray(text)) {
@@ -276,7 +407,7 @@ export function extractDefaultParams(
 export function applyDefaultParams(
   target: Record<string, unknown>,
   defaults: Record<string, unknown>,
-) {
+): void {
   for (const [key, value] of Object.entries(defaults)) {
     if (target[key] === undefined) {
       target[key] = value;
@@ -294,6 +425,7 @@ export function getOpenAILLMConfig({
   dropParams,
   defaultParams,
   useOpenRouter,
+  reasoningFormat = ReasoningParameterFormat.reasoningEffort,
   modelOptions: _modelOptions,
 }: {
   apiKey: string;
@@ -305,6 +437,7 @@ export function getOpenAILLMConfig({
   dropParams?: string[];
   defaultParams?: Record<string, unknown>;
   useOpenRouter?: boolean;
+  reasoningFormat?: ReasoningParameterFormat;
   azure?: false | t.AzureOptions;
 }): Pick<t.LLMConfigResult, 'llmConfig' | 'tools'> & {
   azure?: t.AzureOptions;
@@ -321,10 +454,13 @@ export function getOpenAILLMConfig({
     verbosity,
     web_search,
     promptCache,
+    promptCacheTtl,
     frequency_penalty,
     presence_penalty,
     ...modelOptions
-  } = cleanedModelOptions as Partial<t.OpenAIParameters & { promptCache?: boolean }>;
+  } = cleanedModelOptions as Partial<
+    t.OpenAIParameters & { promptCache?: boolean; promptCacheTtl?: '5m' | '1h' }
+  >;
 
   const llmConfig = Object.assign(
     {
@@ -343,6 +479,8 @@ export function getOpenAILLMConfig({
 
   const modelKwargs: Record<string, unknown> = {};
   let hasModelKwargs = false;
+  let reasoningEffort = reasoning_effort;
+  let reasoningSummary = reasoning_summary;
 
   if (verbosity != null && verbosity !== '' && useOpenRouter) {
     llmConfig.verbosity = verbosity;
@@ -353,6 +491,7 @@ export function getOpenAILLMConfig({
 
   let enableWebSearch = web_search;
   let enablePromptCache = promptCache;
+  let promptCacheTtlValue = promptCacheTtl;
 
   /** Apply defaultParams first - only if fields are undefined */
   if (defaultParams && typeof defaultParams === 'object') {
@@ -369,6 +508,24 @@ export function getOpenAILLMConfig({
         }
         continue;
       }
+      if (key === 'promptCacheTtl') {
+        if (promptCacheTtlValue === undefined && (value === '5m' || value === '1h')) {
+          promptCacheTtlValue = value;
+        }
+        continue;
+      }
+      if (key === 'reasoning_effort') {
+        if (!reasoningEffort && typeof value === 'string') {
+          reasoningEffort = value as OpenAILLMConfig['reasoning_effort'];
+        }
+        continue;
+      }
+      if (key === 'reasoning_summary') {
+        if (!reasoningSummary && typeof value === 'string') {
+          reasoningSummary = value as OpenAILLMConfig['reasoning_summary'];
+        }
+        continue;
+      }
       if (key === 'verbosity') {
         hasModelKwargs =
           applyVerbosityParam({
@@ -408,6 +565,24 @@ export function getOpenAILLMConfig({
         }
         continue;
       }
+      if (key === 'promptCacheTtl') {
+        if (value === '5m' || value === '1h') {
+          promptCacheTtlValue = value;
+        }
+        continue;
+      }
+      if (key === 'reasoning_effort') {
+        if (typeof value === 'string' || value == null) {
+          reasoningEffort = value as OpenAILLMConfig['reasoning_effort'];
+        }
+        continue;
+      }
+      if (key === 'reasoning_summary') {
+        if (typeof value === 'string' || value == null) {
+          reasoningSummary = value as OpenAILLMConfig['reasoning_summary'];
+        }
+        continue;
+      }
       if (key === 'verbosity') {
         hasModelKwargs =
           applyVerbosityParam({
@@ -437,25 +612,11 @@ export function getOpenAILLMConfig({
      */
     hasModelKwargs =
       applyOpenRouterReasoningConfig({
-        reasoningEffort: reasoning_effort,
+        reasoningEffort,
         model: modelOptions.model,
         modelKwargs,
         llmConfig,
       }) || hasModelKwargs;
-  } else if (
-    hasReasoningParams({ reasoning_effort, reasoning_summary }) &&
-    (llmConfig.useResponsesApi === true ||
-      (endpoint !== EModelEndpoint.openAI && endpoint !== EModelEndpoint.azureOpenAI))
-  ) {
-    llmConfig.reasoning = removeNullishValues(
-      {
-        effort: reasoning_effort,
-        summary: reasoning_summary,
-      },
-      true,
-    ) as OpenAI.Reasoning;
-  } else if (hasReasoningParams({ reasoning_effort })) {
-    llmConfig.reasoning_effort = reasoning_effort;
   }
 
   if (llmConfig.max_tokens != null) {
@@ -472,6 +633,9 @@ export function getOpenAILLMConfig({
   if (dropParams && dropParams.includes('promptCache')) {
     enablePromptCache = false;
   }
+  if (dropParams && dropParams.includes('promptCacheTtl')) {
+    promptCacheTtlValue = undefined;
+  }
 
   if (useOpenRouter && enableWebSearch) {
     /** OpenRouter expects web search as a plugins parameter */
@@ -484,6 +648,30 @@ export function getOpenAILLMConfig({
   }
   if (useOpenRouter && enablePromptCache === true) {
     llmConfig.promptCache = true;
+    /** Pass an explicit TTL when configured; otherwise the agents SDK defaults to 1h */
+    if (promptCacheTtlValue != null) {
+      llmConfig.promptCacheTtl = promptCacheTtlValue;
+    }
+  }
+
+  if (!useOpenRouter) {
+    hasModelKwargs =
+      applyReasoningConfig({
+        endpoint,
+        llmConfig,
+        modelKwargs,
+        reasoningFormat,
+        reasoningEffort,
+        reasoningSummary,
+      }) || hasModelKwargs;
+  }
+
+  /** DeepSeek thinking-mode requires `reasoning_content` replay on tool turns (#13366). */
+  const isDeepSeekModel =
+    typeof modelOptions.model === 'string' &&
+    /^deepseek(?:[-/]|$)/i.test(modelOptions.model.replace(/^~/, ''));
+  if (isDeepSeekModel) {
+    llmConfig.includeReasoningContent = true;
   }
 
   /**
@@ -507,11 +695,7 @@ export function getOpenAILLMConfig({
     const updatedDropParams = dropParams || [];
     const combinedDropParams = [...new Set([...updatedDropParams, ...reasoningExcludeParams])];
 
-    combinedDropParams.forEach((param) => {
-      if (param in llmConfig) {
-        delete llmConfig[param as keyof t.OAIClientOptions];
-      }
-    });
+    combinedDropParams.forEach((param) => deleteConfigParam({ param, llmConfig, modelKwargs }));
   } else if (modelOptions.model && /gpt-4o.*search/.test(modelOptions.model as string)) {
     /**
      * Note: OpenAI Web Search models do not support any known parameters besides `max_tokens`
@@ -536,17 +720,9 @@ export function getOpenAILLMConfig({
     const updatedDropParams = dropParams || [];
     const combinedDropParams = [...new Set([...updatedDropParams, ...searchExcludeParams])];
 
-    combinedDropParams.forEach((param) => {
-      if (param in llmConfig) {
-        delete llmConfig[param as keyof t.OAIClientOptions];
-      }
-    });
+    combinedDropParams.forEach((param) => deleteConfigParam({ param, llmConfig, modelKwargs }));
   } else if (dropParams && Array.isArray(dropParams)) {
-    dropParams.forEach((param) => {
-      if (param in llmConfig) {
-        delete llmConfig[param as keyof t.OAIClientOptions];
-      }
-    });
+    dropParams.forEach((param) => deleteConfigParam({ param, llmConfig, modelKwargs }));
   }
 
   hasModelKwargs =
@@ -568,7 +744,7 @@ export function getOpenAILLMConfig({
     hasModelKwargs = true;
   }
 
-  if (hasModelKwargs) {
+  if (hasModelKwargs && Object.keys(modelKwargs).length > 0) {
     llmConfig.modelKwargs = modelKwargs;
   }
 
diff --git a/packages/api/src/endpoints/openai/transform.ts b/packages/api/src/endpoints/openai/transform.ts
index 829d2bd740e..bc602358d19 100644
--- a/packages/api/src/endpoints/openai/transform.ts
+++ b/packages/api/src/endpoints/openai/transform.ts
@@ -16,7 +16,7 @@ const googleExcludeParams = new Set([
 ]);
 
 /** Google-specific tool types that have no OpenAI-compatible equivalent */
-const googleToolsToFilter = new Set(['googleSearch']);
+const googleToolsToFilter = new Set(['googleSearch', 'urlContext']);
 
 export type ConfigTools = Array<Record<string, unknown>> | Array<GoogleAIToolType>;
 
@@ -93,8 +93,8 @@ export function transformToOpenAIConfig({
 
   if (addParams && typeof addParams === 'object') {
     for (const [key, value] of Object.entries(addParams)) {
-      /** Skip web_search - it's handled separately as a tool */
-      if (key === 'web_search') {
+      /** Skip web_search / url_context - handled separately as native tools */
+      if (key === 'web_search' || key === 'url_context') {
         continue;
       }
 
@@ -113,8 +113,8 @@ export function transformToOpenAIConfig({
 
   if (dropParams && Array.isArray(dropParams)) {
     dropParams.forEach((param) => {
-      /** Skip web_search - handled separately */
-      if (param === 'web_search') {
+      /** Skip web_search / url_context - handled separately */
+      if (param === 'web_search' || param === 'url_context') {
         return;
       }
 
@@ -134,11 +134,14 @@ export function transformToOpenAIConfig({
 
   /**
    * Filter out provider-specific tools that have no OpenAI equivalent.
-   * Exception: If web_search was explicitly enabled via addParams or defaultParams,
-   * preserve googleSearch tools (pass through in Google-native format).
+   * Exception: If web_search / url_context was explicitly enabled via addParams
+   * or defaultParams, preserve the matching Google-native tool (pass through in
+   * Google-native format).
    */
   const webSearchExplicitlyEnabled =
     addParams?.web_search === true || defaultParams?.web_search === true;
+  const urlContextExplicitlyEnabled =
+    addParams?.url_context === true || defaultParams?.url_context === true;
 
   const filterGoogleTool = (tool: unknown): boolean => {
     if (!isGoogle) {
@@ -148,11 +151,15 @@ export function transformToOpenAIConfig({
       return false;
     }
     const toolKeys = Object.keys(tool as Record<string, unknown>);
-    const isGoogleSpecificTool = toolKeys.some((key) => googleToolsToFilter.has(key));
     /** Preserve googleSearch if web_search was explicitly enabled */
-    if (isGoogleSpecificTool && webSearchExplicitlyEnabled) {
+    if (webSearchExplicitlyEnabled && toolKeys.includes('googleSearch')) {
+      return true;
+    }
+    /** Preserve urlContext if url_context was explicitly enabled */
+    if (urlContextExplicitlyEnabled && toolKeys.includes('urlContext')) {
       return true;
     }
+    const isGoogleSpecificTool = toolKeys.some((key) => googleToolsToFilter.has(key));
     return !isGoogleSpecificTool;
   };
 
diff --git a/packages/api/src/endpoints/pricing.spec.ts b/packages/api/src/endpoints/pricing.spec.ts
new file mode 100644
index 00000000000..388b71a5090
--- /dev/null
+++ b/packages/api/src/endpoints/pricing.spec.ts
@@ -0,0 +1,119 @@
+import mongoose from 'mongoose';
+import { EModelEndpoint } from 'librechat-data-provider';
+import { createTxMethods } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { matchModelName, findMatchingPattern } from '~/utils';
+import { buildTokenConfigMap } from './pricing';
+
+/** Adapters: TxDeps types are looser than the utils signatures (string endpoint, undefined miss) */
+const { getValueKey, getMultiplier, getCacheMultiplier } = createTxMethods(mongoose, {
+  matchModelName: (model, endpoint) => matchModelName(model, endpoint as EModelEndpoint),
+  findMatchingPattern: (model, values) =>
+    findMatchingPattern(model, values as Record<string, number>) ?? undefined,
+});
+
+const deps = { getValueKey, getMultiplier, getCacheMultiplier };
+
+describe('buildTokenConfigMap', () => {
+  it('resolves context windows without pricing by default', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: {
+          [EModelEndpoint.openAI]: ['gpt-4o'],
+          [EModelEndpoint.anthropic]: ['claude-3-5-sonnet-20241022'],
+        },
+      },
+      deps,
+    );
+
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].context).toBeGreaterThan(100000);
+    expect(map[EModelEndpoint.anthropic]['claude-3-5-sonnet-20241022'].context).toBe(200000);
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].prompt).toBeUndefined();
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].completion).toBeUndefined();
+  });
+
+  it('includes pattern-matched pricing when enabled', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: {
+          [EModelEndpoint.anthropic]: ['claude-3-5-sonnet-20241022'],
+        },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    const tokenomics = map[EModelEndpoint.anthropic]['claude-3-5-sonnet-20241022'];
+    expect(tokenomics.prompt).toBe(3);
+    expect(tokenomics.completion).toBe(15);
+    expect(tokenomics.cacheWrite).toBe(3.75);
+    expect(tokenomics.cacheRead).toBe(0.3);
+  });
+
+  it('treats unknown endpoints as custom for context lookups', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['gpt-4o-mini'] },
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['gpt-4o-mini'].context).toBeGreaterThan(0);
+  });
+
+  it('prefers endpoint token config overrides for context and rates', () => {
+    const override: EndpointTokenConfig = {
+      'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 },
+    };
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['custom-model', 'gpt-4o-mini'] },
+        endpointTokenConfigs: { MyProxy: override },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model']).toEqual({
+      context: 32000,
+      prompt: 1.5,
+      completion: 4.5,
+    });
+    /** Models absent from the override fall back to static tables */
+    expect(map.MyProxy['gpt-4o-mini'].context).toBeGreaterThan(0);
+    expect(map.MyProxy['gpt-4o-mini'].prompt).toBeGreaterThan(0);
+  });
+
+  it('carries static cache rates from the override', () => {
+    const override: EndpointTokenConfig = {
+      'cached-model': {
+        prompt: 3,
+        completion: 15,
+        context: 200000,
+        cacheRead: 0.3,
+        cacheWrite: 3.75,
+      } as EndpointTokenConfig[string],
+    };
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['cached-model'] },
+        endpointTokenConfigs: { MyProxy: override },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['cached-model']).toEqual({
+      context: 200000,
+      prompt: 3,
+      completion: 15,
+      cacheRead: 0.3,
+      cacheWrite: 3.75,
+    });
+  });
+
+  it('skips endpoints with empty model lists', () => {
+    const map = buildTokenConfigMap({ modelsConfig: { [EModelEndpoint.agents]: [] } }, deps);
+    expect(map[EModelEndpoint.agents]).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/pricing.ts b/packages/api/src/endpoints/pricing.ts
new file mode 100644
index 00000000000..6bf2aa6b4a4
--- /dev/null
+++ b/packages/api/src/endpoints/pricing.ts
@@ -0,0 +1,106 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TModelsConfig, TTokenConfigMap, TModelTokenomics } from 'librechat-data-provider';
+import type { TxMethods } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { getModelMaxTokens, maxTokensMap } from '~/utils';
+
+export interface TokenomicsDeps {
+  getValueKey: TxMethods['getValueKey'];
+  getMultiplier: TxMethods['getMultiplier'];
+  getCacheMultiplier: TxMethods['getCacheMultiplier'];
+}
+
+export interface TokenConfigParams {
+  /** endpoint → model list, from the resolved models config */
+  modelsConfig: TModelsConfig;
+  /** Per-endpoint overrides: fetched (e.g. OpenRouter) or yaml `tokenConfig` */
+  endpointTokenConfigs?: Record<string, EndpointTokenConfig | undefined>;
+  /** Include USD-per-1M rates; gated by `interface.contextCost` */
+  includePricing?: boolean;
+}
+
+/**
+ * Resolves context windows (and optionally pricing) for every configured
+ * model, server-side, so the client never reimplements pattern matching.
+ */
+export function buildTokenConfigMap(
+  params: TokenConfigParams,
+  deps: TokenomicsDeps,
+): TTokenConfigMap {
+  const { modelsConfig, endpointTokenConfigs, includePricing = false } = params;
+  const map: TTokenConfigMap = {};
+
+  for (const [endpoint, models] of Object.entries(modelsConfig)) {
+    if (!Array.isArray(models) || models.length === 0) {
+      continue;
+    }
+    const override = endpointTokenConfigs?.[endpoint];
+    const endpointKey = (
+      maxTokensMap[endpoint] != null ? endpoint : EModelEndpoint.custom
+    ) as EModelEndpoint;
+
+    const entry: Record<string, TModelTokenomics> = {};
+    for (const model of models) {
+      const tokenomics: TModelTokenomics = {};
+      /** getModelMaxTokens falls back to the built-in map for models absent
+       *  from a partial override, so a single call covers both cases. */
+      const context = getModelMaxTokens(model, endpointKey, override);
+      if (context != null) {
+        tokenomics.context = context;
+      }
+
+      if (includePricing) {
+        const overrideRates = override?.[model];
+        if (overrideRates?.prompt != null || overrideRates?.completion != null) {
+          tokenomics.prompt = overrideRates.prompt;
+          tokenomics.completion = overrideRates.completion;
+          /** Carry admin-configured cache rates; client falls back to the
+           *  prompt rate for whichever cache rate is absent */
+          if (overrideRates.cacheWrite != null) {
+            tokenomics.cacheWrite = overrideRates.cacheWrite;
+          }
+          if (overrideRates.cacheRead != null) {
+            tokenomics.cacheRead = overrideRates.cacheRead;
+          }
+        } else {
+          const valueKey = deps.getValueKey(model, endpoint);
+          tokenomics.prompt = deps.getMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            tokenType: 'prompt',
+          });
+          tokenomics.completion = deps.getMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            tokenType: 'completion',
+          });
+          const cacheWrite = deps.getCacheMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            cacheType: 'write',
+          });
+          const cacheRead = deps.getCacheMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            cacheType: 'read',
+          });
+          if (cacheWrite != null) {
+            tokenomics.cacheWrite = cacheWrite;
+          }
+          if (cacheRead != null) {
+            tokenomics.cacheRead = cacheRead;
+          }
+        }
+      }
+
+      entry[model] = tokenomics;
+    }
+    map[endpoint] = entry;
+  }
+
+  return map;
+}
diff --git a/packages/api/src/endpoints/projection.spec.ts b/packages/api/src/endpoints/projection.spec.ts
new file mode 100644
index 00000000000..1fb7f91a4ce
--- /dev/null
+++ b/packages/api/src/endpoints/projection.spec.ts
@@ -0,0 +1,206 @@
+import { resolveContextProjection } from './projection';
+import { QUOTE_MAX_COUNT } from '~/utils/quotes';
+
+jest.mock('@librechat/agents', () => ({
+  Providers: { OPENAI: 'openai' },
+  createTokenCounter: jest.fn(async () => jest.fn(() => 1)),
+  projectAgentContextUsage: jest.fn(() => ({ tokenCount: 1, maxContextTokens: 1000 })),
+}));
+
+const GRAPH_SELECT = 'messageId parentMessageId metadata.summaryUsedTokens';
+const BODY_SELECT = 'messageId parentMessageId tokenCount isCreatedByUser text quotes';
+
+function textStats(messageId: string, textBytes = 5) {
+  return {
+    messageId,
+    textBytes,
+    quoteCount: 0,
+    quoteBytes: 0,
+    quoteLineCount: 0,
+    nonStringQuoteCount: 0,
+  };
+}
+
+describe('resolveContextProjection', () => {
+  const baseParams = {
+    conversationId: 'conversation-1',
+    messageId: 'message-1',
+    endpoint: 'openai',
+    maxContextTokens: 1000,
+    model: 'gpt-4o',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns null before tokenization when the conversation is too large', async () => {
+    const { createTokenCounter } = jest.requireMock('@librechat/agents');
+    const messages = Array.from({ length: 513 }, (_, index) => ({
+      messageId: `message-${index}`,
+      parentMessageId: index === 0 ? null : `message-${index - 1}`,
+      isCreatedByUser: true,
+      text: 'hello',
+    }));
+    const getMessages = jest.fn(async () => messages);
+    const getMessageTextStats = jest.fn();
+
+    const result = await resolveContextProjection(
+      { userId: 'user-1', getMessages, getMessageTextStats },
+      { ...baseParams, messageId: 'message-512' },
+    );
+
+    expect(result).toBeNull();
+    expect(getMessages).toHaveBeenCalledTimes(1);
+    expect(getMessages).toHaveBeenCalledWith(
+      { conversationId: 'conversation-1', user: 'user-1' },
+      GRAPH_SELECT,
+      { limit: 513, sort: false },
+    );
+    expect(getMessageTextStats).not.toHaveBeenCalled();
+    expect(createTokenCounter).not.toHaveBeenCalled();
+  });
+
+  it('returns null before tokenization when the branch is too long', async () => {
+    const { createTokenCounter } = jest.requireMock('@librechat/agents');
+    const messages = Array.from({ length: 257 }, (_, index) => ({
+      messageId: `message-${index}`,
+      parentMessageId: index === 0 ? null : `message-${index - 1}`,
+      isCreatedByUser: true,
+      text: 'hello',
+    }));
+    const getMessages = jest.fn(async () => messages);
+    const getMessageTextStats = jest.fn();
+
+    const result = await resolveContextProjection(
+      { userId: 'user-1', getMessages, getMessageTextStats },
+      { ...baseParams, messageId: 'message-256' },
+    );
+
+    expect(result).toBeNull();
+    expect(getMessages).toHaveBeenCalledTimes(1);
+    expect(getMessageTextStats).not.toHaveBeenCalled();
+    expect(createTokenCounter).not.toHaveBeenCalled();
+  });
+
+  it('returns null before loading bodies when the branch text is too large', async () => {
+    const { createTokenCounter } = jest.requireMock('@librechat/agents');
+    const getMessages = jest.fn(async () => [
+      {
+        messageId: 'message-1',
+        parentMessageId: null,
+      },
+    ]);
+    const getMessageTextStats = jest.fn(async () => [textStats('message-1', 512 * 1024 + 1)]);
+    const result = await resolveContextProjection(
+      {
+        userId: 'user-1',
+        getMessages,
+        getMessageTextStats,
+      },
+      baseParams,
+    );
+
+    expect(result).toBeNull();
+    expect(getMessages).toHaveBeenCalledTimes(1);
+    expect(getMessageTextStats).toHaveBeenCalledWith(
+      {
+        conversationId: 'conversation-1',
+        user: 'user-1',
+        messageId: { $in: ['message-1'] },
+      },
+      { limit: 1 },
+    );
+    expect(createTokenCounter).not.toHaveBeenCalled();
+  });
+
+  it('loads only branch message bodies after resolving the graph', async () => {
+    const graph = [
+      { messageId: 'message-1', parentMessageId: null },
+      { messageId: 'message-2', parentMessageId: 'message-1' },
+      { messageId: 'off-branch', parentMessageId: null },
+    ];
+    const bodies = [
+      {
+        messageId: 'message-1',
+        parentMessageId: null,
+        isCreatedByUser: true,
+        text: 'first',
+        tokenCount: 5,
+      },
+      {
+        messageId: 'message-2',
+        parentMessageId: 'message-1',
+        isCreatedByUser: false,
+        text: 'second',
+        tokenCount: 6,
+      },
+    ];
+    const getMessages = jest.fn(async (_filter: object, select?: string) =>
+      select === GRAPH_SELECT ? graph : bodies,
+    );
+    const getMessageTextStats = jest.fn(async () => [
+      textStats('message-1', 5),
+      textStats('message-2', 6),
+    ]);
+
+    const result = await resolveContextProjection(
+      { userId: 'user-1', getMessages, getMessageTextStats },
+      { ...baseParams, messageId: 'message-2' },
+    );
+
+    expect(result).toEqual({ tokenCount: 1, maxContextTokens: 1000 });
+    expect(getMessages).toHaveBeenNthCalledWith(
+      1,
+      { conversationId: 'conversation-1', user: 'user-1' },
+      GRAPH_SELECT,
+      { limit: 513, sort: false },
+    );
+    expect(getMessageTextStats).toHaveBeenCalledWith(
+      {
+        conversationId: 'conversation-1',
+        user: 'user-1',
+        messageId: { $in: ['message-1', 'message-2'] },
+      },
+      { limit: 2 },
+    );
+    expect(getMessages).toHaveBeenNthCalledWith(
+      2,
+      {
+        conversationId: 'conversation-1',
+        user: 'user-1',
+        messageId: { $in: ['message-1', 'message-2'] },
+      },
+      BODY_SELECT,
+      { limit: 2, sort: false },
+    );
+  });
+
+  it('returns null before loading bodies when a branch message has too many quotes', async () => {
+    const { createTokenCounter } = jest.requireMock('@librechat/agents');
+    const getMessages = jest.fn(async () => [
+      {
+        messageId: 'message-1',
+        parentMessageId: null,
+      },
+    ]);
+    const getMessageTextStats = jest.fn(async () => [
+      {
+        ...textStats('message-1'),
+        quoteCount: QUOTE_MAX_COUNT + 1,
+        quoteBytes: 10,
+        quoteLineCount: QUOTE_MAX_COUNT + 1,
+      },
+    ]);
+
+    const result = await resolveContextProjection(
+      { userId: 'user-1', getMessages, getMessageTextStats },
+      baseParams,
+    );
+
+    expect(result).toBeNull();
+    expect(getMessages).toHaveBeenCalledTimes(1);
+    expect(getMessageTextStats).toHaveBeenCalledTimes(1);
+    expect(createTokenCounter).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/api/src/endpoints/projection.ts b/packages/api/src/endpoints/projection.ts
new file mode 100644
index 00000000000..8622e4b9819
--- /dev/null
+++ b/packages/api/src/endpoints/projection.ts
@@ -0,0 +1,326 @@
+import { HumanMessage, AIMessage } from '@langchain/core/messages';
+import { Providers, createTokenCounter, projectAgentContextUsage } from '@librechat/agents';
+import type { TContextProjectionRequest, TContextUsageEvent } from 'librechat-data-provider';
+import type { BaseMessage } from '@langchain/core/messages';
+import { QUOTE_MAX_COUNT, mergeQuotedText } from '~/utils/quotes';
+
+const MAX_PROJECTION_MESSAGES = 512;
+const MAX_PROJECTION_BRANCH_MESSAGES = 256;
+const MAX_PROJECTION_BRANCH_TEXT_BYTES = 512 * 1024;
+const PROJECTION_GRAPH_SELECT = 'messageId parentMessageId metadata.summaryUsedTokens';
+const PROJECTION_BODY_SELECT = 'messageId parentMessageId tokenCount isCreatedByUser text quotes';
+
+interface ProjectionMessage {
+  messageId: string;
+  parentMessageId?: string | null;
+  tokenCount?: number;
+  isCreatedByUser?: boolean;
+  text?: string;
+  /** Quoted excerpts merged into the model-facing text by the live path; must be
+   *  included here so the context gauge counts the same prompt the model sees. */
+  quotes?: string[];
+  /** Compaction marker written by the live path (`agents/usage.ts`); its
+   *  presence means the next call sends the summary + tail, not this raw chain. */
+  metadata?: { summaryUsedTokens?: number };
+}
+
+interface ProjectionMessageFilter {
+  conversationId: string;
+  user?: string;
+  messageId?: string | { $in: string[] };
+}
+
+interface ProjectionMessageQueryOptions {
+  limit?: number;
+  sort?: false;
+}
+
+interface ProjectionMessageTextStats {
+  messageId: string;
+  textBytes: number;
+  quoteCount: number;
+  quoteBytes: number;
+  quoteLineCount: number;
+  nonStringQuoteCount: number;
+}
+
+interface ProjectionMessageTextStatsOptions {
+  limit?: number;
+}
+
+export interface ContextProjectionDeps {
+  /** Authenticated requester — branch lookups are scoped to this user. */
+  userId?: string;
+  getMessages: (
+    filter: ProjectionMessageFilter,
+    select?: string,
+    options?: ProjectionMessageQueryOptions,
+  ) => Promise<ProjectionMessage[]>;
+  getMessageTextStats: (
+    filter: ProjectionMessageFilter,
+    options?: ProjectionMessageTextStatsOptions,
+  ) => Promise<ProjectionMessageTextStats[]>;
+}
+
+/**
+ * Walks the parent chain from `tailId` to root and returns the branch messages
+ * oldest→newest. The visited set guards against cycles / self-referential links.
+ */
+function resolveBranch(messages: ProjectionMessage[], tailId: string): ProjectionMessage[] {
+  const byId = new Map<string, ProjectionMessage>();
+  for (const message of messages) {
+    byId.set(message.messageId, message);
+  }
+  const branch: ProjectionMessage[] = [];
+  const seen = new Set<string>();
+  let currentId: string | null | undefined = tailId;
+  while (currentId != null && !seen.has(currentId)) {
+    const message = byId.get(currentId);
+    if (message == null) {
+      break;
+    }
+    seen.add(currentId);
+    branch.push(message);
+    currentId = message.parentMessageId;
+  }
+  return branch.reverse();
+}
+
+function hasValidProjectionIds(params: TContextProjectionRequest): boolean {
+  return typeof params.conversationId === 'string' && typeof params.messageId === 'string';
+}
+
+function getProjectionText(message: ProjectionMessage): string | null {
+  const hasQuotes =
+    message.isCreatedByUser === true && Array.isArray(message.quotes) && message.quotes.length > 0;
+  if (!hasQuotes) {
+    return message.text ?? '';
+  }
+  if (message.quotes == null || message.quotes.length > QUOTE_MAX_COUNT) {
+    return null;
+  }
+  for (const quote of message.quotes) {
+    if (typeof quote !== 'string') {
+      return null;
+    }
+  }
+  return mergeQuotedText(message.text ?? '', message.quotes);
+}
+
+function hasExceededBranchTextLimit(branch: ProjectionMessage[]): boolean {
+  let bytes = 0;
+  for (const message of branch) {
+    const text = getProjectionText(message);
+    if (text == null) {
+      return true;
+    }
+    bytes += Buffer.byteLength(text, 'utf8');
+    if (bytes > MAX_PROJECTION_BRANCH_TEXT_BYTES) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function getEstimatedMergedTextBytes(stats: ProjectionMessageTextStats): number | null {
+  if (
+    stats.nonStringQuoteCount > 0 ||
+    stats.quoteCount > QUOTE_MAX_COUNT ||
+    stats.quoteLineCount < stats.quoteCount
+  ) {
+    return null;
+  }
+  if (stats.quoteCount === 0) {
+    return stats.textBytes;
+  }
+
+  const quotePrefixBytes = stats.quoteLineCount * 2;
+  const quoteLineBreakBytes = stats.quoteLineCount - stats.quoteCount;
+  const quoteSeparatorBytes = (stats.quoteCount - 1) * 2;
+  const bodySeparatorBytes = stats.textBytes > 0 ? 2 : 0;
+  return (
+    stats.textBytes +
+    stats.quoteBytes +
+    quotePrefixBytes +
+    quoteLineBreakBytes +
+    quoteSeparatorBytes +
+    bodySeparatorBytes
+  );
+}
+
+function hasExceededBranchTextStatsLimit(stats: ProjectionMessageTextStats[]): boolean {
+  let bytes = 0;
+  for (const messageStats of stats) {
+    const messageBytes = getEstimatedMergedTextBytes(messageStats);
+    if (messageBytes == null) {
+      return true;
+    }
+    bytes += messageBytes;
+    if (bytes > MAX_PROJECTION_BRANCH_TEXT_BYTES) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** Maps an endpoint/provider string to the agents `Providers` enum. */
+function resolveProvider(value?: string): Providers {
+  if (value == null || value === '') {
+    return Providers.OPENAI;
+  }
+  const lower = value.toLowerCase();
+  for (const provider of Object.values(Providers)) {
+    if (provider.toLowerCase() === lower) {
+      return provider;
+    }
+  }
+  if (lower.includes('anthropic') || lower.includes('claude')) {
+    return Providers.ANTHROPIC;
+  }
+  if (lower.includes('google') || lower.includes('gemini') || lower.includes('vertex')) {
+    return Providers.GOOGLE;
+  }
+  if (lower.includes('bedrock')) {
+    return Providers.BEDROCK;
+  }
+  return Providers.OPENAI;
+}
+
+async function getBranchMessages(
+  deps: ContextProjectionDeps,
+  baseFilter: ProjectionMessageFilter,
+  branch: ProjectionMessage[],
+): Promise<ProjectionMessage[] | null> {
+  const branchIds = branch.map((message) => message.messageId);
+  const stats = await deps.getMessageTextStats(
+    { ...baseFilter, messageId: { $in: branchIds } },
+    { limit: branchIds.length },
+  );
+  if (stats.length !== branchIds.length || hasExceededBranchTextStatsLimit(stats)) {
+    return null;
+  }
+
+  const stored = await deps.getMessages(
+    { ...baseFilter, messageId: { $in: branchIds } },
+    PROJECTION_BODY_SELECT,
+    { limit: branchIds.length, sort: false },
+  );
+  if (stored.length !== branchIds.length) {
+    return null;
+  }
+  const byId = new Map<string, ProjectionMessage>();
+  for (const message of stored) {
+    byId.set(message.messageId, message);
+  }
+  const ordered: ProjectionMessage[] = [];
+  for (const messageId of branchIds) {
+    const message = byId.get(messageId);
+    if (message == null) {
+      return null;
+    }
+    ordered.push(message);
+  }
+  return ordered;
+}
+
+/**
+ * Server-side context-usage projection: reconstructs the viewed branch and asks
+ * the agents SDK what the next call's context would be, WITHOUT invoking the
+ * model. Provider/model/window come from the (client-resolved) request — no
+ * agent or model-spec config is loaded here, so there is no cross-user config
+ * exposure. Reuses LibreChat's already-calibrated per-message `tokenCount`s (no
+ * re-tokenizing). Returns null when there is no resolvable context window.
+ * NOTE: this first cut targets message-windowing accuracy — instruction and
+ * tool-schema tokens (agent instructions, `promptPrefix`, model-spec presets,
+ * tool schemas) are NOT yet included; a follow-up will reuse the full
+ * `initializeAgent`/send path for exact overhead and proper access control.
+ */
+export async function resolveContextProjection(
+  deps: ContextProjectionDeps,
+  params: TContextProjectionRequest,
+): Promise<TContextUsageEvent | null> {
+  if (!hasValidProjectionIds(params)) {
+    return null;
+  }
+
+  const maxContextTokens = params.maxContextTokens;
+  if (maxContextTokens == null || maxContextTokens <= 0) {
+    return null;
+  }
+
+  const baseFilter = { conversationId: params.conversationId, user: deps.userId };
+  const stored = await deps.getMessages(baseFilter, PROJECTION_GRAPH_SELECT, {
+    limit: MAX_PROJECTION_MESSAGES + 1,
+    sort: false,
+  });
+  if (stored.length > MAX_PROJECTION_MESSAGES) {
+    return null;
+  }
+
+  const branch = resolveBranch(stored, params.messageId);
+  if (branch.length === 0) {
+    return null;
+  }
+  if (branch.length > MAX_PROJECTION_BRANCH_MESSAGES) {
+    return null;
+  }
+
+  /** A summarized/compacted branch's next call sends the saved summary + the
+   *  post-summary tail, NOT this raw parent chain — projecting from the full
+   *  history would prune/count the wrong context and omit the summary. Detect it
+   *  via the live path's `metadata.summaryUsedTokens` marker and fall back (null)
+   *  so the client's summary-baseline-aware estimate handles these branches until
+   *  a follow-up replays the summary boundary. */
+  if (branch.some((message) => (message.metadata?.summaryUsedTokens ?? 0) > 0)) {
+    return null;
+  }
+
+  const bodyBranch = await getBranchMessages(deps, baseFilter, branch);
+  if (bodyBranch == null || hasExceededBranchTextLimit(bodyBranch)) {
+    return null;
+  }
+
+  const model = params.model;
+  const encoding = (model ?? '').toLowerCase().includes('claude') ? 'claude' : 'o200k_base';
+  const tokenCounter = await createTokenCounter(encoding);
+
+  const messages: BaseMessage[] = [];
+  const indexTokenCountMap: Record<string, number> = {};
+  for (let i = 0; i < bodyBranch.length; i++) {
+    const message = bodyBranch[i];
+    /** Mirror the live path: prepend quoted excerpts into the user text the model
+     *  receives so the gauge counts the same prompt. */
+    const hasQuotes =
+      message.isCreatedByUser === true &&
+      Array.isArray(message.quotes) &&
+      message.quotes.length > 0;
+    const text = getProjectionText(message);
+    if (text == null) {
+      return null;
+    }
+    const lcMessage =
+      message.isCreatedByUser === true ? new HumanMessage(text) : new AIMessage(text);
+    messages.push(lcMessage);
+    /** Recount messages with no stored count (imported / pre-feature) rather
+     *  than charging 0 — a real 0 and "unknown" must not collapse, or the
+     *  snapshot-less histories this endpoint targets would under-report. Also
+     *  recount quoted messages: a text-only Save edit leaves a stale text-only
+     *  `tokenCount` that omits the quote block, so trust the merged recount. */
+    indexTokenCountMap[String(i)] =
+      !hasQuotes && message.tokenCount != null && message.tokenCount > 0
+        ? message.tokenCount
+        : tokenCounter(lcMessage);
+  }
+
+  return projectAgentContextUsage({
+    agent: {
+      agentId: params.agentId ?? 'projection',
+      provider: resolveProvider(params.endpoint),
+      maxContextTokens,
+    },
+    messages,
+    tokenCounter,
+    indexTokenCountMap,
+    calibrationRatio: params.calibrationRatio,
+  });
+}
diff --git a/packages/api/src/endpoints/tokenConfig.spec.ts b/packages/api/src/endpoints/tokenConfig.spec.ts
new file mode 100644
index 00000000000..76ffebeac02
--- /dev/null
+++ b/packages/api/src/endpoints/tokenConfig.spec.ts
@@ -0,0 +1,134 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import type { TokenomicsDeps } from './pricing';
+
+const mockCacheGet = jest.fn();
+jest.mock('~/cache', () => ({
+  tokenConfigCache: jest.fn(() => ({ get: (key: string) => mockCacheGet(key) })),
+}));
+
+import { resolveTokenConfigMap } from './tokenConfig';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from './keys';
+
+const deps: TokenomicsDeps = {
+  getValueKey: () => 'value-key',
+  getMultiplier: ({ tokenType }) => (tokenType === 'prompt' ? 5 : 15),
+  getCacheMultiplier: () => null,
+};
+
+function appConfigWith(custom: unknown[], contextCost = true): AppConfig {
+  return {
+    interfaceConfig: { contextCost },
+    endpoints: { [EModelEndpoint.custom]: custom },
+  } as unknown as AppConfig;
+}
+
+describe('resolveTokenConfigMap', () => {
+  beforeEach(() => mockCacheGet.mockReset().mockResolvedValue(null));
+
+  it('uses a static tokenConfig override without consulting the cache', async () => {
+    const appConfig = appConfigWith([
+      {
+        name: 'MyProxy',
+        tokenConfig: { 'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 } },
+      },
+    ]);
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model']).toEqual({ context: 32000, prompt: 1.5, completion: 4.5 });
+    expect(mockCacheGet).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the cached fetched config when no static override exists', async () => {
+    mockCacheGet.mockResolvedValue({ 'custom-model': { prompt: 2, completion: 6, context: 8000 } });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(map.MyProxy['custom-model'].context).toBe(8000);
+    expect(map.MyProxy['custom-model'].prompt).toBe(2);
+  });
+
+  it('uses a tenant-scoped cache key for fetched custom endpoint token config', async () => {
+    mockCacheGet.mockImplementation(async (key: string) => {
+      if (key.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)) {
+        return { 'custom-model': { prompt: 2, completion: 6, context: 16000 } };
+      }
+      if (key === 'MyProxy') {
+        return { 'custom-model': { prompt: 12, completion: 24, context: 111111 } };
+      }
+      return null;
+    });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+
+    const map = await resolveTokenConfigMap(
+      {
+        appConfig,
+        modelsConfig: { MyProxy: ['custom-model'] },
+        userId: 'user-2',
+        tenantId: 'tenant-b',
+      },
+      deps,
+    );
+
+    const tokenKey = mockCacheGet.mock.calls[0][0];
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-b:MyProxy');
+    expect(tokenKey).not.toContain('tenant-b');
+    expect(tokenKey).not.toContain('MyProxy');
+    expect(map.MyProxy['custom-model'].context).toBe(16000);
+    expect(map.MyProxy['custom-model'].prompt).toBe(2);
+  });
+
+  it('uses the legacy cache key when tenant context is unavailable or empty', async () => {
+    mockCacheGet.mockResolvedValue({ 'custom-model': { prompt: 2, completion: 6, context: 8000 } });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      mockCacheGet.mockClear();
+      const map = await resolveTokenConfigMap(
+        {
+          appConfig,
+          modelsConfig: { MyProxy: ['custom-model'] },
+          userId: 'user-1',
+          tenantId,
+        },
+        deps,
+      );
+
+      expect(mockCacheGet).toHaveBeenCalledWith('MyProxy');
+      expect(mockCacheGet.mock.calls.every(([key]) => key === 'MyProxy')).toBe(true);
+      expect(map.MyProxy['custom-model'].context).toBe(8000);
+    }
+  });
+
+  it('omits pricing when contextCost is disabled', async () => {
+    const appConfig = appConfigWith(
+      [
+        {
+          name: 'MyProxy',
+          tokenConfig: { 'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 } },
+        },
+      ],
+      false,
+    );
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model'].context).toBe(32000);
+    expect(map.MyProxy['custom-model'].prompt).toBeUndefined();
+    expect(map.MyProxy['custom-model'].completion).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/tokenConfig.ts b/packages/api/src/endpoints/tokenConfig.ts
new file mode 100644
index 00000000000..60ffd752b50
--- /dev/null
+++ b/packages/api/src/endpoints/tokenConfig.ts
@@ -0,0 +1,53 @@
+import { EModelEndpoint, normalizeEndpointName } from 'librechat-data-provider';
+import type { TModelsConfig, TTokenConfigMap, TEndpoint } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { buildTokenConfigMap, type TokenomicsDeps } from '~/endpoints/pricing';
+import { getTokenConfigKey } from '~/endpoints/custom/initialize';
+import { tokenConfigCache } from '~/cache';
+
+export interface ResolveTokenConfigParams {
+  appConfig?: AppConfig;
+  /** endpoint → model list, from the resolved models config */
+  modelsConfig: TModelsConfig;
+  userId: string;
+  tenantId?: string | null;
+}
+
+/**
+ * Server-side token-config resolution for the `/endpoints/token-config`
+ * route. Gathers each custom endpoint's override — a static yaml `tokenConfig`
+ * or the cached fetched config — then resolves context windows (and pricing,
+ * when `interface.contextCost` is enabled) via {@link buildTokenConfigMap}.
+ * Lives in TypeScript so the `/api` controller stays a thin wrapper.
+ */
+export async function resolveTokenConfigMap(
+  { appConfig, modelsConfig, userId, tenantId }: ResolveTokenConfigParams,
+  deps: TokenomicsDeps,
+): Promise<TTokenConfigMap> {
+  const includePricing = appConfig?.interfaceConfig?.contextCost === true;
+  const customEndpoints = (appConfig?.endpoints?.[EModelEndpoint.custom] ?? []) as TEndpoint[];
+  const cache = tokenConfigCache();
+  const endpointTokenConfigs: Record<string, EndpointTokenConfig | undefined> = {};
+
+  for (const endpointConfig of customEndpoints) {
+    /** Models config and the token-config cache key by the normalized name */
+    const name = normalizeEndpointName(endpointConfig?.name);
+    if (!name) {
+      continue;
+    }
+    if (endpointConfig.tokenConfig != null) {
+      endpointTokenConfigs[name] = endpointConfig.tokenConfig as EndpointTokenConfig;
+      continue;
+    }
+    /** Model fetches and chat initialization both store under this key —
+     *  user-scoped whenever the fetched config can be user-specific */
+    const tokenKey = getTokenConfigKey(endpointConfig, name, userId, tenantId);
+    const cached = (await cache.get(tokenKey)) as EndpointTokenConfig | undefined;
+    if (cached) {
+      endpointTokenConfigs[name] = cached;
+    }
+  }
+
+  return buildTokenConfigMap({ modelsConfig, endpointTokenConfigs, includePricing }, deps);
+}
diff --git a/packages/api/src/files/code/extract.spec.ts b/packages/api/src/files/code/extract.spec.ts
index 1baa2490f1b..e6a987ca1d3 100644
--- a/packages/api/src/files/code/extract.spec.ts
+++ b/packages/api/src/files/code/extract.spec.ts
@@ -3,6 +3,7 @@ import * as path from 'path';
 import {
   extractCodeArtifactText,
   getExtractedTextFormat,
+  resolveMaxTextExtractBytes,
   MAX_TEXT_CACHE_BYTES,
   MAX_TEXT_EXTRACT_BYTES,
 } from './extract';
@@ -421,11 +422,12 @@ describe('extractCodeArtifactText', () => {
       ['deck', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'],
     ])('routes extensionless office files by MIME alone (%s, %s)', async (name, mime) => {
       mockOfficeHtml.mockResolvedValueOnce('<!DOCTYPE html><body>x</body></html>');
-      const category = mime.includes('presentation')
-        ? 'pptx'
-        : mime.startsWith('text/')
-          ? 'utf8-text'
-          : 'document';
+      let category: 'pptx' | 'utf8-text' | 'document' = 'document';
+      if (mime.includes('presentation')) {
+        category = 'pptx';
+      } else if (mime.startsWith('text/')) {
+        category = 'utf8-text';
+      }
       const text = await extractCodeArtifactText(Buffer.from('PK'), name, mime, category);
       expect(mockOfficeHtml).toHaveBeenCalledWith(expect.any(Buffer), name, mime);
       expect(text).toContain('<body>');
@@ -676,3 +678,43 @@ describe('extractCodeArtifactText office-html concurrency', () => {
     expect(htmlCount).toBe(4);
   });
 });
+
+describe('resolveMaxTextExtractBytes', () => {
+  const TWO_MB = 2 * 1024 * 1024;
+
+  it('defaults to 2 MB when unset or blank', () => {
+    expect(resolveMaxTextExtractBytes(undefined)).toBe(TWO_MB);
+    expect(resolveMaxTextExtractBytes('')).toBe(TWO_MB);
+    expect(resolveMaxTextExtractBytes('   ')).toBe(TWO_MB);
+  });
+
+  it('honors a valid positive byte override', () => {
+    expect(resolveMaxTextExtractBytes('1048576')).toBe(1048576);
+    expect(resolveMaxTextExtractBytes('5242880')).toBe(5242880);
+  });
+
+  it('floors fractional values', () => {
+    expect(resolveMaxTextExtractBytes('1048576.9')).toBe(1048576);
+  });
+
+  it('falls back to the default on non-numeric or non-positive input', () => {
+    expect(resolveMaxTextExtractBytes('nope')).toBe(TWO_MB);
+    expect(resolveMaxTextExtractBytes('0')).toBe(TWO_MB);
+    expect(resolveMaxTextExtractBytes('-100')).toBe(TWO_MB);
+  });
+
+  it('falls back to the default for sub-byte values that floor to zero', () => {
+    expect(resolveMaxTextExtractBytes('0.5')).toBe(TWO_MB);
+    expect(resolveMaxTextExtractBytes('0.999')).toBe(TWO_MB);
+  });
+
+  it('wires the exported ceiling through the resolver for the current env', () => {
+    /* Asserting a literal 2 MB here would falsely fail when the suite runs
+     * with FILE_PREVIEW_MAX_EXTRACT_BYTES set (the export is initialized
+     * from the env at module load). Verify the export tracks the resolver
+     * instead; the `undefined` case above pins the 2 MB default. */
+    expect(MAX_TEXT_EXTRACT_BYTES).toBe(
+      resolveMaxTextExtractBytes(process.env.FILE_PREVIEW_MAX_EXTRACT_BYTES),
+    );
+  });
+});
diff --git a/packages/api/src/files/code/extract.ts b/packages/api/src/files/code/extract.ts
index e49ad61ad67..7cef9b19ae0 100644
--- a/packages/api/src/files/code/extract.ts
+++ b/packages/api/src/files/code/extract.ts
@@ -4,13 +4,45 @@ import * as fs from 'fs/promises';
 import { randomUUID } from 'crypto';
 import { logger } from '@librechat/data-schemas';
 import type { CodeArtifactCategory } from './classify';
-import { parseDocument } from '~/files/documents/crud';
 import { bufferToOfficeHtml, officeHtmlBucket } from '~/files/documents/html';
-import { isBinaryBuffer } from '~/skills/binary';
 import { createConcurrencyLimiter, withTimeout } from '~/utils/promise';
+import { parseDocument } from '~/files/documents/crud';
+import { isBinaryBuffer } from '~/skills/binary';
+
+export const MAX_TEXT_CACHE_BYTES: number = 512 * 1024;
+
+/** Default inline-preview extraction ceiling: 2 MB. Office/text artifacts
+ * larger than this skip inline preview and fall back to download-only. */
+const DEFAULT_MAX_TEXT_EXTRACT_BYTES = 2 * 1024 * 1024;
+
+/**
+ * Resolve the inline-preview extraction ceiling from
+ * `FILE_PREVIEW_MAX_EXTRACT_BYTES`, falling back to the 2 MB default when
+ * the value is missing, non-numeric, or non-positive. Raising it lets
+ * larger documents render an inline preview; the rendered HTML is still
+ * independently capped at {@link MAX_TEXT_CACHE_BYTES} (512 KB), so
+ * image-heavy files over that show the "too large" banner instead.
+ */
+export function resolveMaxTextExtractBytes(value: string | undefined): number {
+  if (value == null || value.trim() === '') {
+    return DEFAULT_MAX_TEXT_EXTRACT_BYTES;
+  }
+  /* Floor first, then validate: a fractional value in (0, 1) passes a
+   * `> 0` check but floors to 0, which would treat every non-empty
+   * artifact as oversized — fall back to the default instead. */
+  const floored = Math.floor(Number(value));
+  if (!Number.isFinite(floored) || floored < 1) {
+    logger.warn(
+      `[extract] Invalid FILE_PREVIEW_MAX_EXTRACT_BYTES "${value}"; using ${DEFAULT_MAX_TEXT_EXTRACT_BYTES} bytes.`,
+    );
+    return DEFAULT_MAX_TEXT_EXTRACT_BYTES;
+  }
+  return floored;
+}
 
-export const MAX_TEXT_CACHE_BYTES = 512 * 1024;
-export const MAX_TEXT_EXTRACT_BYTES = 1024 * 1024;
+export const MAX_TEXT_EXTRACT_BYTES: number = resolveMaxTextExtractBytes(
+  process.env.FILE_PREVIEW_MAX_EXTRACT_BYTES,
+);
 const DOCUMENT_PARSE_TIMEOUT_MS = 8_000;
 const OFFICE_HTML_TIMEOUT_MS = 12_000;
 const TRUNCATION_MARKER = '\n\n…[truncated]';
diff --git a/packages/api/src/files/context.ts b/packages/api/src/files/context.ts
index 1da6c387ce0..36209f34c11 100644
--- a/packages/api/src/files/context.ts
+++ b/packages/api/src/files/context.ts
@@ -3,6 +3,7 @@ import { FileSources, mergeFileConfig } from 'librechat-data-provider';
 import type { IMongoFile } from '@librechat/data-schemas';
 import type { ServerRequest } from '~/types';
 import { processTextWithTokenLimit } from '~/utils/text';
+import type { TokenCountFn } from '~/utils/text';
 
 /**
  * Extracts text context from attachments and returns formatted text.
@@ -20,7 +21,7 @@ export async function extractFileContext({
 }: {
   attachments: IMongoFile[];
   req?: ServerRequest;
-  tokenCountFn: (text: string) => number;
+  tokenCountFn: TokenCountFn;
 }): Promise<string | undefined> {
   if (!attachments || attachments.length === 0) {
     return undefined;
diff --git a/packages/api/src/files/documents/html.ts b/packages/api/src/files/documents/html.ts
index 7bac37804c2..96e41d91077 100644
--- a/packages/api/src/files/documents/html.ts
+++ b/packages/api/src/files/documents/html.ts
@@ -987,12 +987,12 @@ function renderPptxSlidesBody(slides: PptxSlide[]): string {
       const titleHtml = slide.title
         ? `<h2 class="lc-pptx-slide-title">${escapeHtml(slide.title)}</h2>`
         : '';
-      const bodyHtml =
-        slide.body.length > 0
-          ? `<ul class="lc-pptx-slide-body">${slide.body.map((line) => `<li>${escapeHtml(line)}</li>`).join('')}</ul>`
-          : !slide.title
-            ? '<p class="lc-pptx-slide-empty">(empty slide)</p>'
-            : '';
+      let bodyHtml = '';
+      if (slide.body.length > 0) {
+        bodyHtml = `<ul class="lc-pptx-slide-body">${slide.body.map((line) => `<li>${escapeHtml(line)}</li>`).join('')}</ul>`;
+      } else if (!slide.title) {
+        bodyHtml = '<p class="lc-pptx-slide-empty">(empty slide)</p>';
+      }
       return `<li class="lc-pptx-slide">
   <span class="lc-pptx-slide-number">Slide ${slide.number}</span>
   ${titleHtml}
@@ -1479,7 +1479,14 @@ async function pptxToSlideListHtmlInternal(buffer: Buffer): Promise<string> {
  * padded fixtures. Not part of the public API — callers in production
  * code should always go through `wordDocToHtml` / `pptxToHtml`.
  */
-export const _internal = {
+export const _internal: {
+  wordDocToHtmlViaCdn: typeof wordDocToHtmlViaCdn;
+  wordDocToHtmlViaMammoth: typeof wordDocToHtmlViaMammoth;
+  MAX_DOCX_CDN_BINARY_BYTES: number;
+  OFFICE_HTML_OUTPUT_CAP: number;
+  pptxToHtmlViaCdn: typeof pptxToHtmlViaCdn;
+  MAX_PPTX_CDN_BINARY_BYTES: number;
+} = {
   wordDocToHtmlViaCdn,
   wordDocToHtmlViaMammoth,
   MAX_DOCX_CDN_BINARY_BYTES,
diff --git a/packages/api/src/files/documents/libreoffice.ts b/packages/api/src/files/documents/libreoffice.ts
index aedbf624d1d..fff4f62ad75 100644
--- a/packages/api/src/files/documents/libreoffice.ts
+++ b/packages/api/src/files/documents/libreoffice.ts
@@ -1,7 +1,7 @@
-import { spawn } from 'child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
 import { tmpdir } from 'os';
 import { join } from 'path';
+import { spawn } from 'child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
 
 /**
  * LibreOffice-backed office preview pipeline.
@@ -196,7 +196,7 @@ export function _resetLibreOfficeProbeCache(): void {
 export const LIBREOFFICE_TIMEOUT_MS = 30_000;
 
 /** Maximum PDF output size; refuse anything larger so a runaway doc can't fill the disk. */
-export const MAX_LIBREOFFICE_PDF_BYTES = 50 * 1024 * 1024;
+export const MAX_LIBREOFFICE_PDF_BYTES: number = 50 * 1024 * 1024;
 
 /** Tag-distinct error so callers can distinguish "binary missing" from "conversion failed". */
 export class LibreOfficeUnavailableError extends Error {
diff --git a/packages/api/src/files/encode/document.spec.ts b/packages/api/src/files/encode/document.spec.ts
index f285d47d5d5..846b61eb888 100644
--- a/packages/api/src/files/encode/document.spec.ts
+++ b/packages/api/src/files/encode/document.spec.ts
@@ -749,6 +749,38 @@ describe('encodeAndFormatDocuments - fileConfig integration', () => {
         file_data: `data:application/pdf;base64,${mockContent}`,
       });
     });
+
+    it.each([Providers.GOOGLE, Providers.VERTEXAI] as const)(
+      'should format %s PDF as media block when responses API is enabled',
+      async (provider) => {
+        const req = createMockRequest(15, provider) as ServerRequest;
+        const file = createMockFile(10);
+
+        const mockContent = Buffer.from('test-pdf-content').toString('base64');
+        mockedGetFileStream.mockResolvedValue({
+          file,
+          content: mockContent,
+          metadata: file,
+        });
+
+        mockedValidatePdf.mockResolvedValue({ isValid: true });
+
+        const result = await encodeAndFormatDocuments(
+          req,
+          [file],
+          { provider, useResponsesApi: true },
+          mockStrategyFunctions,
+        );
+
+        expect(result.documents).toHaveLength(1);
+        expect(result.documents[0]).toMatchObject({
+          type: 'media',
+          mimeType: 'application/pdf',
+          data: mockContent,
+        });
+        expect(result.documents[0]).not.toHaveProperty('type', 'input_file');
+      },
+    );
   });
 
   describe('Generic document encoding path', () => {
diff --git a/packages/api/src/files/encode/document.ts b/packages/api/src/files/encode/document.ts
index f04ad43ef2d..9f595fee1ee 100644
--- a/packages/api/src/files/encode/document.ts
+++ b/packages/api/src/files/encode/document.ts
@@ -55,6 +55,14 @@ function formatDocumentBlock(
     return document;
   }
 
+  if (provider === Providers.GOOGLE || provider === Providers.VERTEXAI) {
+    return {
+      type: 'media',
+      mimeType,
+      data: content,
+    };
+  }
+
   const resolvedFilename = filename ?? 'document';
 
   if (useResponsesApi) {
@@ -65,14 +73,6 @@ function formatDocumentBlock(
     };
   }
 
-  if (provider === Providers.GOOGLE || provider === Providers.VERTEXAI) {
-    return {
-      type: 'media',
-      mimeType,
-      data: content,
-    };
-  }
-
   if (isOpenAILikeProvider(provider) && provider !== Providers.AZURE) {
     return {
       type: 'file',
@@ -86,6 +86,18 @@ function formatDocumentBlock(
   return null;
 }
 
+function getBase64DecodedByteCount(content: string): number {
+  let paddingChars = 0;
+
+  if (content.endsWith('==')) {
+    paddingChars = 2;
+  } else if (content.endsWith('=')) {
+    paddingChars = 1;
+  }
+
+  return Math.floor((content.length * 3) / 4) - paddingChars;
+}
+
 /**
  * Encodes and formats document files for various providers.
  *
@@ -208,8 +220,7 @@ export async function encodeAndFormatDocuments(
         result.files.push(metadata);
       }
     } else if (isDocSupported && !isBedrock) {
-      const paddingChars = content.endsWith('==') ? 2 : content.endsWith('=') ? 1 : 0;
-      const decodedByteCount = Math.floor((content.length * 3) / 4) - paddingChars;
+      const decodedByteCount = getBase64DecodedByteCount(content);
       if (configuredFileSizeLimit && decodedByteCount > configuredFileSizeLimit) {
         throw new Error(
           `File size (~${(decodedByteCount / 1024 / 1024).toFixed(1)}MB) exceeds the configured limit for ${provider}`,
diff --git a/packages/api/src/files/index.ts b/packages/api/src/files/index.ts
index 8200f21195f..0e9a23ff59d 100644
--- a/packages/api/src/files/index.ts
+++ b/packages/api/src/files/index.ts
@@ -9,5 +9,7 @@ export * from './mistral/crud';
 export * from './ocr';
 export * from './parse';
 export * from './rag';
+export * from './retention';
+export * from './sweep';
 export * from './validation';
 export * from './text';
diff --git a/packages/api/src/files/mistral/crud.spec.ts b/packages/api/src/files/mistral/crud.spec.ts
index 9556781063d..b401a852fad 100644
--- a/packages/api/src/files/mistral/crud.spec.ts
+++ b/packages/api/src/files/mistral/crud.spec.ts
@@ -1721,10 +1721,16 @@ describe('MistralOCR Service', () => {
 
   describe('Proxy Configuration', () => {
     const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalHttpsProxy = process.env.HTTPS_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
 
     beforeEach(() => {
       // Reset the HttpsProxyAgent mock to its default implementation
       (HttpsProxyAgent as unknown as jest.Mock).mockImplementation((url) => ({ proxyUrl: url }));
+      delete process.env.HTTP_PROXY;
+      delete process.env.HTTPS_PROXY;
+      delete process.env.NO_PROXY;
       // Clear any previous axios mock calls
       mockAxios.post!.mockClear();
       mockAxios.get!.mockClear();
@@ -1737,6 +1743,21 @@ describe('MistralOCR Service', () => {
       } else {
         delete process.env.PROXY;
       }
+      if (originalHttpProxy) {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      } else {
+        delete process.env.HTTP_PROXY;
+      }
+      if (originalHttpsProxy) {
+        process.env.HTTPS_PROXY = originalHttpsProxy;
+      } else {
+        delete process.env.HTTPS_PROXY;
+      }
+      if (originalNoProxy) {
+        process.env.NO_PROXY = originalNoProxy;
+      } else {
+        delete process.env.NO_PROXY;
+      }
       // Clear mocks after each test to prevent leaking
       mockAxios.post!.mockClear();
       mockAxios.get!.mockClear();
diff --git a/packages/api/src/files/mistral/crud.ts b/packages/api/src/files/mistral/crud.ts
index c818fab8b88..db08cde9aa6 100644
--- a/packages/api/src/files/mistral/crud.ts
+++ b/packages/api/src/files/mistral/crud.ts
@@ -2,7 +2,6 @@ import * as fs from 'fs';
 import * as path from 'path';
 import FormData from 'form-data';
 import { logger } from '@librechat/data-schemas';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import {
   FileSources,
   envVarRegex,
@@ -22,6 +21,7 @@ import type {
   OCRImage,
 } from '~/types';
 import { logAxiosError, createAxiosInstance } from '~/utils/axios';
+import { applyAxiosProxyConfig } from '~/utils/proxy';
 import { readFileAsBuffer } from '~/utils/files';
 import { loadServiceKey } from '~/utils/key';
 
@@ -88,9 +88,7 @@ export async function uploadDocumentToMistral({
     maxContentLength: Infinity,
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files`);
 
   return axios
     .post(`${baseURL}/files`, form, config)
@@ -117,9 +115,7 @@ export async function getSignedUrl({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files/${fileId}/url?expiry=${expiry}`);
 
   return axios
     .get(`${baseURL}/files/${fileId}/url?expiry=${expiry}`, config)
@@ -161,11 +157,8 @@ export async function performOCR({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
-
   const ocrURL = baseURL.endsWith('/ocr') ? baseURL : `${baseURL}/ocr`;
+  applyAxiosProxyConfig(config, ocrURL);
 
   return axios
     .post(
@@ -211,9 +204,7 @@ export async function deleteMistralFile({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files/${fileId}`);
 
   try {
     const result = await axios.delete(`${baseURL}/files/${fileId}`, config);
@@ -580,9 +571,7 @@ async function exchangeJWTForAccessToken(jwt: string): Promise<string> {
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, 'https://oauth2.googleapis.com/token');
 
   const response = await axios.post(
     'https://oauth2.googleapis.com/token',
@@ -653,9 +642,7 @@ async function performGoogleVertexOCR({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, baseURL);
 
   return axios
     .post(baseURL, requestBody, config)
diff --git a/packages/api/src/files/parse.ts b/packages/api/src/files/parse.ts
index f782f7e5e77..f931ec81e21 100644
--- a/packages/api/src/files/parse.ts
+++ b/packages/api/src/files/parse.ts
@@ -10,7 +10,7 @@ const imageExtensionRegex = /\.(jpg|jpeg|png|gif|bmp|tiff|svg|webp)$/i;
  * @returns The basename of the image file from the URL.
  * Returns an empty string if the URL does not contain a valid image basename.
  */
-export function getImageBasename(urlString: string) {
+export function getImageBasename(urlString: string): string {
   try {
     const url = new URL(urlString);
     const basename = path.basename(url.pathname);
@@ -29,7 +29,7 @@ export function getImageBasename(urlString: string) {
  * @returns The basename of the file from the URL.
  * Returns an empty string if the URL parsing fails.
  */
-export function getFileBasename(urlString: string) {
+export function getFileBasename(urlString: string): string {
   try {
     const url = new URL(urlString);
     return path.basename(url.pathname);
diff --git a/packages/api/src/files/rag.spec.ts b/packages/api/src/files/rag.spec.ts
index 9d8ea2d4b30..4a22d4dd3e5 100644
--- a/packages/api/src/files/rag.spec.ts
+++ b/packages/api/src/files/rag.spec.ts
@@ -1,21 +1,21 @@
 jest.mock('@librechat/data-schemas', () => ({
-	logger: {
-		debug: jest.fn(),
-		warn: jest.fn(),
-		error: jest.fn(),
-	},
+  logger: {
+    debug: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+  },
 }));
 
 jest.mock('~/crypto/jwt', () => ({
-	generateShortLivedToken: jest.fn().mockReturnValue('mock-jwt-token'),
+  generateShortLivedToken: jest.fn().mockReturnValue('mock-jwt-token'),
 }));
 
 jest.mock('axios', () => ({
-	delete: jest.fn(),
-	interceptors: {
-		request: { use: jest.fn(), eject: jest.fn() },
-		response: { use: jest.fn(), eject: jest.fn() },
-	},
+  delete: jest.fn(),
+  interceptors: {
+    request: { use: jest.fn(), eject: jest.fn() },
+    response: { use: jest.fn(), eject: jest.fn() },
+  },
 }));
 
 import axios from 'axios';
@@ -26,125 +26,125 @@ import { generateShortLivedToken } from '~/crypto/jwt';
 const mockedAxios = axios as jest.Mocked<typeof axios>;
 const mockedLogger = logger as jest.Mocked<typeof logger>;
 const mockedGenerateShortLivedToken = generateShortLivedToken as jest.MockedFunction<
-	typeof generateShortLivedToken
+  typeof generateShortLivedToken
 >;
 
 describe('deleteRagFile', () => {
-	const originalEnv = process.env;
-
-	beforeEach(() => {
-		jest.clearAllMocks();
-		process.env = { ...originalEnv };
-		process.env.RAG_API_URL = 'http://localhost:8000';
-	});
-
-	afterEach(() => {
-		process.env = originalEnv;
-	});
-
-	describe('when file is embedded and RAG_API_URL is configured', () => {
-		it('should delete the document from RAG API successfully', async () => {
-			const file = { file_id: 'file-123', embedded: true };
-			mockedAxios.delete.mockResolvedValueOnce({ status: 200 });
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(true);
-			expect(mockedGenerateShortLivedToken).toHaveBeenCalledWith('user123');
-			expect(mockedAxios.delete).toHaveBeenCalledWith('http://localhost:8000/documents', {
-				headers: {
-					Authorization: 'Bearer mock-jwt-token',
-					'Content-Type': 'application/json',
-					accept: 'application/json',
-				},
-				data: ['file-123'],
-			});
-			expect(mockedLogger.debug).toHaveBeenCalledWith(
-				'[deleteRagFile] Successfully deleted document file-123 from RAG API',
-			);
-		});
-
-		it('should return true and log warning when document is not found (404)', async () => {
-			const file = { file_id: 'file-not-found', embedded: true };
-			const error = new Error('Not Found') as Error & { response?: { status?: number } };
-			error.response = { status: 404 };
-			mockedAxios.delete.mockRejectedValueOnce(error);
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(true);
-			expect(mockedLogger.warn).toHaveBeenCalledWith(
-				'[deleteRagFile] Document file-not-found not found in RAG API, may have been deleted already',
-			);
-		});
-
-		it('should return false and log error on other errors', async () => {
-			const file = { file_id: 'file-error', embedded: true };
-			const error = new Error('Server Error') as Error & { response?: { status?: number } };
-			error.response = { status: 500 };
-			mockedAxios.delete.mockRejectedValueOnce(error);
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(false);
-			expect(mockedLogger.error).toHaveBeenCalledWith(
-				'[deleteRagFile] Error deleting document from RAG API:',
-				'Server Error',
-			);
-		});
-	});
-
-	describe('when file is not embedded', () => {
-		it('should skip RAG deletion and return true', async () => {
-			const file = { file_id: 'file-123', embedded: false };
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(true);
-			expect(mockedAxios.delete).not.toHaveBeenCalled();
-			expect(mockedGenerateShortLivedToken).not.toHaveBeenCalled();
-		});
-
-		it('should skip RAG deletion when embedded is undefined', async () => {
-			const file = { file_id: 'file-123' };
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(true);
-			expect(mockedAxios.delete).not.toHaveBeenCalled();
-		});
-	});
-
-	describe('when RAG_API_URL is not configured', () => {
-		it('should skip RAG deletion and return true', async () => {
-			delete process.env.RAG_API_URL;
-			const file = { file_id: 'file-123', embedded: true };
-
-			const result = await deleteRagFile({ userId: 'user123', file });
-
-			expect(result).toBe(true);
-			expect(mockedAxios.delete).not.toHaveBeenCalled();
-		});
-	});
-
-	describe('userId handling', () => {
-		it('should return false when no userId is provided', async () => {
-			const file = { file_id: 'file-123', embedded: true };
-
-			const result = await deleteRagFile({ userId: '', file });
-
-			expect(result).toBe(false);
-			expect(mockedLogger.error).toHaveBeenCalledWith('[deleteRagFile] No user ID provided');
-			expect(mockedAxios.delete).not.toHaveBeenCalled();
-		});
-
-		it('should return false when userId is undefined', async () => {
-			const file = { file_id: 'file-123', embedded: true };
-
-			const result = await deleteRagFile({ userId: undefined as unknown as string, file });
-
-			expect(result).toBe(false);
-			expect(mockedLogger.error).toHaveBeenCalledWith('[deleteRagFile] No user ID provided');
-		});
-	});
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    process.env.RAG_API_URL = 'http://localhost:8000';
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  describe('when file is embedded and RAG_API_URL is configured', () => {
+    it('should delete the document from RAG API successfully', async () => {
+      const file = { file_id: 'file-123', embedded: true };
+      mockedAxios.delete.mockResolvedValueOnce({ status: 200 });
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(true);
+      expect(mockedGenerateShortLivedToken).toHaveBeenCalledWith('user123');
+      expect(mockedAxios.delete).toHaveBeenCalledWith('http://localhost:8000/documents', {
+        headers: {
+          Authorization: 'Bearer mock-jwt-token',
+          'Content-Type': 'application/json',
+          accept: 'application/json',
+        },
+        data: ['file-123'],
+      });
+      expect(mockedLogger.debug).toHaveBeenCalledWith(
+        '[deleteRagFile] Successfully deleted document file-123 from RAG API',
+      );
+    });
+
+    it('should return true and log warning when document is not found (404)', async () => {
+      const file = { file_id: 'file-not-found', embedded: true };
+      const error = new Error('Not Found') as Error & { response?: { status?: number } };
+      error.response = { status: 404 };
+      mockedAxios.delete.mockRejectedValueOnce(error);
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(true);
+      expect(mockedLogger.warn).toHaveBeenCalledWith(
+        '[deleteRagFile] Document file-not-found not found in RAG API, may have been deleted already',
+      );
+    });
+
+    it('should return false and log error on other errors', async () => {
+      const file = { file_id: 'file-error', embedded: true };
+      const error = new Error('Server Error') as Error & { response?: { status?: number } };
+      error.response = { status: 500 };
+      mockedAxios.delete.mockRejectedValueOnce(error);
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(false);
+      expect(mockedLogger.error).toHaveBeenCalledWith(
+        '[deleteRagFile] Error deleting document from RAG API:',
+        'Server Error',
+      );
+    });
+  });
+
+  describe('when file is not embedded', () => {
+    it('should skip RAG deletion and return true', async () => {
+      const file = { file_id: 'file-123', embedded: false };
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(true);
+      expect(mockedAxios.delete).not.toHaveBeenCalled();
+      expect(mockedGenerateShortLivedToken).not.toHaveBeenCalled();
+    });
+
+    it('should skip RAG deletion when embedded is undefined', async () => {
+      const file = { file_id: 'file-123' };
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(true);
+      expect(mockedAxios.delete).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('when RAG_API_URL is not configured', () => {
+    it('should skip RAG deletion and return true', async () => {
+      delete process.env.RAG_API_URL;
+      const file = { file_id: 'file-123', embedded: true };
+
+      const result = await deleteRagFile({ userId: 'user123', file });
+
+      expect(result).toBe(true);
+      expect(mockedAxios.delete).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('userId handling', () => {
+    it('should return false when no userId is provided', async () => {
+      const file = { file_id: 'file-123', embedded: true };
+
+      const result = await deleteRagFile({ userId: '', file });
+
+      expect(result).toBe(false);
+      expect(mockedLogger.error).toHaveBeenCalledWith('[deleteRagFile] No user ID provided');
+      expect(mockedAxios.delete).not.toHaveBeenCalled();
+    });
+
+    it('should return false when userId is undefined', async () => {
+      const file = { file_id: 'file-123', embedded: true };
+
+      const result = await deleteRagFile({ userId: undefined as unknown as string, file });
+
+      expect(result).toBe(false);
+      expect(mockedLogger.error).toHaveBeenCalledWith('[deleteRagFile] No user ID provided');
+    });
+  });
 });
diff --git a/packages/api/src/files/rag.ts b/packages/api/src/files/rag.ts
index 7155f62c120..7876cda56dc 100644
--- a/packages/api/src/files/rag.ts
+++ b/packages/api/src/files/rag.ts
@@ -3,13 +3,13 @@ import { logger } from '@librechat/data-schemas';
 import { generateShortLivedToken } from '~/crypto/jwt';
 
 interface DeleteRagFileParams {
-	/** The user ID. Required for authentication. If not provided, the function returns false and logs an error. */
-	userId: string;
-	/** The file object. Must have `embedded` and `file_id` properties. */
-	file: {
-		file_id: string;
-		embedded?: boolean;
-	};
+  /** The user ID. Required for authentication. If not provided, the function returns false and logs an error. */
+  userId: string;
+  /** The file object. Must have `embedded` and `file_id` properties. */
+  file: {
+    file_id: string;
+    embedded?: boolean;
+  };
 }
 
 /**
@@ -23,38 +23,38 @@ interface DeleteRagFileParams {
  * @returns Returns true if deletion was successful or skipped, false if there was an error.
  */
 export async function deleteRagFile({ userId, file }: DeleteRagFileParams): Promise<boolean> {
-	if (!file.embedded || !process.env.RAG_API_URL) {
-		return true;
-	}
+  if (!file.embedded || !process.env.RAG_API_URL) {
+    return true;
+  }
 
-	if (!userId) {
-		logger.error('[deleteRagFile] No user ID provided');
-		return false;
-	}
+  if (!userId) {
+    logger.error('[deleteRagFile] No user ID provided');
+    return false;
+  }
 
-	const jwtToken = generateShortLivedToken(userId);
+  const jwtToken = generateShortLivedToken(userId);
 
-	try {
-		await axios.delete(`${process.env.RAG_API_URL}/documents`, {
-			headers: {
-				Authorization: `Bearer ${jwtToken}`,
-				'Content-Type': 'application/json',
-				accept: 'application/json',
-			},
-			data: [file.file_id],
-		});
-		logger.debug(`[deleteRagFile] Successfully deleted document ${file.file_id} from RAG API`);
-		return true;
-	} catch (error) {
-		const axiosError = error as { response?: { status?: number }; message?: string };
-		if (axiosError.response?.status === 404) {
-			logger.warn(
-				`[deleteRagFile] Document ${file.file_id} not found in RAG API, may have been deleted already`,
-			);
-			return true;
-		} else {
-			logger.error('[deleteRagFile] Error deleting document from RAG API:', axiosError.message);
-			return false;
-		}
-	}
+  try {
+    await axios.delete(`${process.env.RAG_API_URL}/documents`, {
+      headers: {
+        Authorization: `Bearer ${jwtToken}`,
+        'Content-Type': 'application/json',
+        accept: 'application/json',
+      },
+      data: [file.file_id],
+    });
+    logger.debug(`[deleteRagFile] Successfully deleted document ${file.file_id} from RAG API`);
+    return true;
+  } catch (error) {
+    const axiosError = error as { response?: { status?: number }; message?: string };
+    if (axiosError.response?.status === 404) {
+      logger.warn(
+        `[deleteRagFile] Document ${file.file_id} not found in RAG API, may have been deleted already`,
+      );
+      return true;
+    } else {
+      logger.error('[deleteRagFile] Error deleting document from RAG API:', axiosError.message);
+      return false;
+    }
+  }
 }
diff --git a/packages/api/src/files/retention.spec.ts b/packages/api/src/files/retention.spec.ts
new file mode 100644
index 00000000000..4722710a0c0
--- /dev/null
+++ b/packages/api/src/files/retention.spec.ts
@@ -0,0 +1,397 @@
+import { RetentionMode } from 'librechat-data-provider';
+import {
+  createMinimalRetentionRequest,
+  getAgentFileRetentionExpiry,
+  getConversationExpirationDate,
+  getRetentionExpiry,
+  getSharedLinkExpiration,
+  isActiveExpirationDate,
+  isBooleanOrStringTrue,
+  type RetentionDependencies,
+  type RetentionRequest,
+} from './retention';
+
+describe('retention helpers', () => {
+  const expirationDate = new Date('2030-01-01T00:00:00.000Z');
+  let dependencies: jest.Mocked<RetentionDependencies>;
+
+  beforeEach(() => {
+    dependencies = {
+      getConvo: jest.fn(),
+      createExpirationDate: jest.fn().mockReturnValue(expirationDate),
+      logger: {
+        error: jest.fn(),
+      },
+    };
+  });
+
+  const request = (overrides: RetentionRequest = {}): RetentionRequest => ({
+    user: {
+      id: 'user-1',
+      tenantId: 'tenant-1',
+      ...overrides.user,
+    },
+    body: {
+      conversationId: 'convo-1',
+      ...overrides.body,
+    },
+    config: {
+      interfaceConfig: {
+        ...overrides.config?.interfaceConfig,
+      },
+    },
+  });
+
+  it('returns expiry when retentionMode is ALL', async () => {
+    const result = await getRetentionExpiry(
+      request({ config: { interfaceConfig: { retentionMode: RetentionMode.ALL } } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.getConvo).not.toHaveBeenCalled();
+  });
+
+  it('returns a fresh expiry when the conversation has an active expiration', async () => {
+    dependencies.getConvo.mockResolvedValue({
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+    });
+
+    const result = await getRetentionExpiry(request(), dependencies);
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+  });
+
+  it('returns the conversation expiration when the conversation is already expired', async () => {
+    const expiredAt = new Date(Date.now() - 60 * 60 * 1000);
+    dependencies.getConvo.mockResolvedValue({ expiredAt });
+
+    const result = await getRetentionExpiry(request(), dependencies);
+
+    expect(result).toEqual({ expiredAt });
+    expect(dependencies.createExpirationDate).not.toHaveBeenCalled();
+  });
+
+  it('returns no retention fields when the conversation has no expiration', async () => {
+    dependencies.getConvo.mockResolvedValue({ expiredAt: null });
+
+    await expect(getRetentionExpiry(request(), dependencies)).resolves.toEqual({});
+  });
+
+  it('returns expiry when the conversation has no expiration but explicit temporary intent is present', async () => {
+    dependencies.getConvo.mockResolvedValue({ expiredAt: null });
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: 'convo-1', isTemporary: true } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+  });
+
+  it('returns no retention fields when conversation is missing and isTemporary is false', async () => {
+    dependencies.getConvo.mockResolvedValue(null);
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: 'convo-1', isTemporary: false } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({});
+  });
+
+  it('returns expiry when isTemporary is true', async () => {
+    dependencies.getConvo.mockResolvedValue(null);
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: 'convo-1', isTemporary: true } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+  });
+
+  it('returns expiry when isTemporary is the string "true"', async () => {
+    dependencies.getConvo.mockResolvedValue(null);
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: 'convo-1', isTemporary: 'true' } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+  });
+
+  it('returns no retention fields when conversation lookup throws without explicit temporary intent', async () => {
+    const error = new Error('database unavailable');
+    dependencies.getConvo.mockRejectedValue(error);
+
+    const result = await getRetentionExpiry(request(), dependencies);
+
+    expect(result).toEqual({});
+    expect(dependencies.logger?.error).toHaveBeenCalledWith(
+      '[getRetentionExpiry] Error checking conversation retention:',
+      error,
+    );
+  });
+
+  it('applies retention when explicit temporary intent is present and conversation lookup throws', async () => {
+    const error = new Error('database unavailable');
+    dependencies.getConvo.mockRejectedValue(error);
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: 'convo-1', isTemporary: true } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.logger?.error).toHaveBeenCalledWith(
+      '[getRetentionExpiry] Error checking conversation retention:',
+      error,
+    );
+  });
+
+  it('returns a fallback expiration when expiration creation throws', async () => {
+    const error = new Error('bad config');
+    const nowSpy = jest
+      .spyOn(Date, 'now')
+      .mockReturnValue(new Date('2026-01-01T00:00:00.000Z').getTime());
+    dependencies.createExpirationDate.mockImplementation(() => {
+      throw error;
+    });
+
+    const result = await getRetentionExpiry(
+      request({ body: { conversationId: undefined, isTemporary: true } }),
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: new Date('2026-01-31T00:00:00.000Z') });
+    expect(dependencies.logger?.error).toHaveBeenCalledWith(
+      '[getRetentionExpiry] Error creating file expiration date:',
+      error,
+    );
+    nowSpy.mockRestore();
+  });
+
+  it('memoizes retention lookup per request object', async () => {
+    dependencies.getConvo.mockResolvedValue({
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+    });
+    const req = request();
+
+    const first = await getRetentionExpiry(req, dependencies);
+    const second = await getRetentionExpiry(req, dependencies);
+
+    expect(first).toEqual({ expiredAt: expirationDate });
+    expect(second).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.getConvo).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns no retention fields when req is null or undefined', async () => {
+    await expect(getRetentionExpiry(null, dependencies)).resolves.toEqual({});
+    await expect(getRetentionExpiry(undefined, dependencies)).resolves.toEqual({});
+  });
+
+  it('skips persistent agent files in temporary retention mode when retainAgentFiles is disabled', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({
+          config: {
+            interfaceConfig: {
+              retentionMode: RetentionMode.TEMPORARY,
+              retainAgentFiles: false,
+            },
+          },
+        }),
+        messageAttachment: false,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({});
+    expect(dependencies.getConvo).not.toHaveBeenCalled();
+    expect(dependencies.createExpirationDate).not.toHaveBeenCalled();
+  });
+
+  it('skips persistent agent files in temporary retention mode when retainAgentFiles is enabled', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({
+          config: {
+            interfaceConfig: {
+              retentionMode: RetentionMode.TEMPORARY,
+              retainAgentFiles: true,
+            },
+          },
+        }),
+        messageAttachment: false,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({});
+    expect(dependencies.getConvo).not.toHaveBeenCalled();
+    expect(dependencies.createExpirationDate).not.toHaveBeenCalled();
+  });
+
+  it('applies all-data retention to persistent agent files when retainAgentFiles is disabled', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({
+          config: {
+            interfaceConfig: {
+              retentionMode: RetentionMode.ALL,
+              retainAgentFiles: false,
+            },
+          },
+        }),
+        messageAttachment: false,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.getConvo).not.toHaveBeenCalled();
+    expect(dependencies.createExpirationDate).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps current all-data retention behavior when retainAgentFiles is unset', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({ config: { interfaceConfig: { retentionMode: RetentionMode.ALL } } }),
+        messageAttachment: false,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.createExpirationDate).toHaveBeenCalledTimes(1);
+  });
+
+  it('skips all-data retention for persistent agent files when retainAgentFiles is enabled', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({
+          config: {
+            interfaceConfig: {
+              retentionMode: RetentionMode.ALL,
+              retainAgentFiles: true,
+            },
+          },
+        }),
+        messageAttachment: false,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({});
+    expect(dependencies.getConvo).not.toHaveBeenCalled();
+    expect(dependencies.createExpirationDate).not.toHaveBeenCalled();
+  });
+
+  it('still applies all-data retention to agent message attachments when retainAgentFiles is enabled', async () => {
+    const result = await getAgentFileRetentionExpiry(
+      {
+        req: request({
+          config: {
+            interfaceConfig: {
+              retentionMode: RetentionMode.ALL,
+              retainAgentFiles: true,
+            },
+          },
+        }),
+        messageAttachment: true,
+        toolResource: 'context',
+      },
+      dependencies,
+    );
+
+    expect(result).toEqual({ expiredAt: expirationDate });
+    expect(dependencies.createExpirationDate).toHaveBeenCalledTimes(1);
+  });
+
+  it('parses valid conversation expiration dates and ignores invalid ones', () => {
+    expect(getConversationExpirationDate({ expiredAt: expirationDate })).toBe(expirationDate);
+    expect(getConversationExpirationDate({ expiredAt: expirationDate.toISOString() })).toEqual(
+      expirationDate,
+    );
+    expect(getConversationExpirationDate({ expiredAt: 'not-a-date' })).toBeNull();
+    expect(getConversationExpirationDate({ expiredAt: null })).toBeNull();
+  });
+
+  it('compares active expiration dates against the provided clock', () => {
+    const now = new Date('2026-01-01T00:00:00.000Z');
+
+    expect(isActiveExpirationDate(new Date('2026-01-01T00:00:01.000Z'), now)).toBe(true);
+    expect(isActiveExpirationDate(new Date('2025-12-31T23:59:59.000Z'), now)).toBe(false);
+  });
+
+  it('uses strict temporary truthiness semantics', () => {
+    expect(isBooleanOrStringTrue(true)).toBe(true);
+    expect(isBooleanOrStringTrue('true')).toBe(true);
+    expect(isBooleanOrStringTrue(1)).toBe(false);
+    expect(isBooleanOrStringTrue('1')).toBe(false);
+  });
+
+  it('creates minimal retention requests for tool calls', () => {
+    expect(
+      createMinimalRetentionRequest({
+        user: { id: 'user-1', tenantId: 'tenant-1' },
+        body: { conversationId: 'convo-1', isTemporary: 'true' },
+        config: { interfaceConfig: { retentionMode: RetentionMode.TEMPORARY } },
+      }),
+    ).toEqual({
+      user: { id: 'user-1', tenantId: 'tenant-1' },
+      body: { conversationId: 'convo-1', isTemporary: 'true' },
+      config: { interfaceConfig: { retentionMode: RetentionMode.TEMPORARY } },
+    });
+
+    expect(createMinimalRetentionRequest()).toBeUndefined();
+  });
+
+  describe('getSharedLinkExpiration', () => {
+    it('returns undefined when the conversation id is missing', async () => {
+      await expect(
+        getSharedLinkExpiration({ req: request() }, dependencies),
+      ).resolves.toBeUndefined();
+      expect(dependencies.getConvo).not.toHaveBeenCalled();
+    });
+
+    it('returns null for non-retained conversations in temporary retention mode', async () => {
+      dependencies.getConvo.mockResolvedValue({ expiredAt: null });
+
+      await expect(
+        getSharedLinkExpiration({ req: request(), conversationId: 'convo-1' }, dependencies),
+      ).resolves.toBeNull();
+    });
+
+    it('returns a fresh expiry for retentionMode ALL conversations without an expiration', async () => {
+      dependencies.getConvo.mockResolvedValue({ expiredAt: null });
+
+      await expect(
+        getSharedLinkExpiration(
+          {
+            req: request({ config: { interfaceConfig: { retentionMode: RetentionMode.ALL } } }),
+            conversationId: 'convo-1',
+          },
+          dependencies,
+        ),
+      ).resolves.toBe(expirationDate);
+    });
+
+    it('returns an expired source conversation date so callers can reject the share', async () => {
+      const expiredAt = new Date(Date.now() - 60 * 60 * 1000);
+      dependencies.getConvo.mockResolvedValue({ expiredAt });
+
+      await expect(
+        getSharedLinkExpiration({ req: request(), conversationId: 'convo-1' }, dependencies),
+      ).resolves.toBe(expiredAt);
+      expect(dependencies.createExpirationDate).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/packages/api/src/files/retention.ts b/packages/api/src/files/retention.ts
new file mode 100644
index 00000000000..884f56fb2ef
--- /dev/null
+++ b/packages/api/src/files/retention.ts
@@ -0,0 +1,266 @@
+import { RetentionMode } from 'librechat-data-provider';
+import { createFallbackRetentionDate } from '@librechat/data-schemas';
+import type { AppConfig } from '@librechat/data-schemas';
+
+type InterfaceConfig = AppConfig['interfaceConfig'];
+
+const retentionExpiryCache = new WeakMap<
+  RetentionRequest,
+  {
+    key: string;
+    promise: Promise<RetentionExpiry>;
+  }
+>();
+
+export type RetentionConversation = {
+  expiredAt?: Date | string | number | null;
+};
+
+export type RetentionRequest = {
+  user?: {
+    id?: string;
+    tenantId?: string;
+  };
+  body?: {
+    conversationId?: string;
+    isTemporary?: boolean | string | null;
+  };
+  config?: {
+    interfaceConfig?: InterfaceConfig;
+  };
+};
+
+export type RetentionExpiry = {
+  expiredAt?: Date | null;
+};
+
+export type AgentFileRetentionRequest = {
+  req: RetentionRequest | null | undefined;
+  messageAttachment?: boolean | null;
+  toolResource?: string | null;
+};
+
+export type RetentionLogger = {
+  error: (message: string, error?: unknown) => void;
+};
+
+export type RetentionDependencies = {
+  getConvo: (
+    userId: string,
+    conversationId: string,
+  ) => Promise<RetentionConversation | null | undefined>;
+  createExpirationDate: (interfaceConfig?: InterfaceConfig) => Date;
+  logger?: RetentionLogger;
+};
+
+export type SharedLinkRetentionDependencies = {
+  getConvo: (
+    userId: string,
+    conversationId: string,
+  ) => Promise<RetentionConversation | null | undefined>;
+  createExpirationDate: (interfaceConfig?: InterfaceConfig) => Date;
+  logger?: RetentionLogger;
+};
+
+export const isBooleanOrStringTrue = (value: unknown): boolean =>
+  value === true || value === 'true';
+
+export const getConversationExpirationDate = (
+  convo?: RetentionConversation | null,
+): Date | null => {
+  if (convo?.expiredAt == null) {
+    return null;
+  }
+
+  const expiredAt = convo.expiredAt instanceof Date ? convo.expiredAt : new Date(convo.expiredAt);
+  return Number.isNaN(expiredAt.getTime()) ? null : expiredAt;
+};
+
+export const isActiveExpirationDate = (expiredAt: Date, now: Date = new Date()): boolean =>
+  expiredAt > now;
+
+const createRetentionExpiry = (
+  req: RetentionRequest | null | undefined,
+  { createExpirationDate, logger }: RetentionDependencies,
+): RetentionExpiry => {
+  try {
+    return { expiredAt: createExpirationDate(req?.config?.interfaceConfig) };
+  } catch (err) {
+    logger?.error('[getRetentionExpiry] Error creating file expiration date:', err);
+    return { expiredAt: createFallbackRetentionDate() };
+  }
+};
+
+const getRetentionCacheKey = (req: RetentionRequest): string =>
+  [
+    req.config?.interfaceConfig?.retentionMode ?? '',
+    req.user?.id ?? '',
+    req.body?.conversationId ?? '',
+    String(req.body?.isTemporary ?? ''),
+  ].join('|');
+
+async function computeRetentionExpiry(
+  req: RetentionRequest | null | undefined,
+  dependencies: RetentionDependencies,
+): Promise<RetentionExpiry> {
+  if (req?.config?.interfaceConfig?.retentionMode === RetentionMode.ALL) {
+    return createRetentionExpiry(req, dependencies);
+  }
+
+  const conversationId = req?.body?.conversationId;
+  const userId = req?.user?.id;
+
+  if (conversationId && userId) {
+    try {
+      const convo = await dependencies.getConvo(userId, conversationId);
+      if (convo) {
+        const expiredAt = getConversationExpirationDate(convo);
+        if (expiredAt == null) {
+          if (isBooleanOrStringTrue(req?.body?.isTemporary)) {
+            return createRetentionExpiry(req, dependencies);
+          }
+          return {};
+        }
+
+        if (!isActiveExpirationDate(expiredAt)) {
+          return { expiredAt };
+        }
+
+        return createRetentionExpiry(req, dependencies);
+      }
+    } catch (err) {
+      dependencies.logger?.error(
+        '[getRetentionExpiry] Error checking conversation retention:',
+        err,
+      );
+      if (isBooleanOrStringTrue(req?.body?.isTemporary)) {
+        return createRetentionExpiry(req, dependencies);
+      }
+      return {};
+    }
+  }
+
+  if (!isBooleanOrStringTrue(req?.body?.isTemporary)) {
+    return {};
+  }
+
+  return createRetentionExpiry(req, dependencies);
+}
+
+export async function getRetentionExpiry(
+  req: RetentionRequest | null | undefined,
+  dependencies: RetentionDependencies,
+): Promise<RetentionExpiry> {
+  if (!req) {
+    return {};
+  }
+
+  const key = getRetentionCacheKey(req);
+  const cached = retentionExpiryCache.get(req);
+  if (cached?.key === key) {
+    return cached.promise;
+  }
+
+  const promise = computeRetentionExpiry(req, dependencies);
+  retentionExpiryCache.set(req, { key, promise });
+  return promise;
+}
+
+const isPersistentAgentResourceUpload = ({
+  messageAttachment,
+  toolResource,
+}: Omit<AgentFileRetentionRequest, 'req'>): boolean => !messageAttachment && !!toolResource;
+
+const shouldRetainPersistentAgentFile = ({
+  req,
+  messageAttachment,
+  toolResource,
+}: AgentFileRetentionRequest): boolean => {
+  const interfaceConfig = req?.config?.interfaceConfig;
+  return (
+    isPersistentAgentResourceUpload({ messageAttachment, toolResource }) &&
+    (interfaceConfig?.retentionMode !== RetentionMode.ALL ||
+      interfaceConfig?.retainAgentFiles === true)
+  );
+};
+
+export async function getAgentFileRetentionExpiry(
+  params: AgentFileRetentionRequest,
+  dependencies: RetentionDependencies,
+): Promise<RetentionExpiry> {
+  if (shouldRetainPersistentAgentFile(params)) {
+    return {};
+  }
+
+  return await getRetentionExpiry(params.req, dependencies);
+}
+
+/**
+ * Resolves the retention deadline for a shared link derived from a conversation.
+ *
+ * Return values are intentionally tri-state:
+ * - `undefined`: no decision can be made because the conversation id or row is missing.
+ * - `null`: the share should be stored without an expiration.
+ * - `Date`: the share should expire at that date; callers reject already-expired dates.
+ */
+export async function getSharedLinkExpiration(
+  {
+    req,
+    conversationId,
+  }: {
+    req: RetentionRequest | null | undefined;
+    conversationId?: string | null;
+  },
+  dependencies: SharedLinkRetentionDependencies,
+): Promise<Date | null | undefined> {
+  const userId = req?.user?.id;
+  if (!conversationId || !userId) {
+    return undefined;
+  }
+
+  const isRetentionAll = req?.config?.interfaceConfig?.retentionMode === RetentionMode.ALL;
+  const convo = await dependencies.getConvo(userId, conversationId);
+  if (!convo) {
+    return undefined;
+  }
+
+  const conversationExpiredAt = getConversationExpirationDate(convo);
+  if (conversationExpiredAt == null) {
+    if (!isRetentionAll) {
+      return null;
+    }
+  } else if (!isActiveExpirationDate(conversationExpiredAt)) {
+    return conversationExpiredAt;
+  }
+
+  try {
+    return dependencies.createExpirationDate(req?.config?.interfaceConfig);
+  } catch (err) {
+    dependencies.logger?.error('[getSharedLinkExpiration] Error creating expiration date:', err);
+    return null;
+  }
+}
+
+export const createMinimalRetentionRequest = (
+  req?: RetentionRequest | null,
+): RetentionRequest | undefined => {
+  if (!req) {
+    return undefined;
+  }
+
+  return {
+    user: req.user
+      ? {
+          id: req.user.id,
+          tenantId: req.user.tenantId,
+        }
+      : undefined,
+    body: {
+      conversationId: req.body?.conversationId,
+      isTemporary: req.body?.isTemporary,
+    },
+    config: {
+      interfaceConfig: req.config?.interfaceConfig,
+    },
+  };
+};
diff --git a/packages/api/src/files/sweep.spec.ts b/packages/api/src/files/sweep.spec.ts
new file mode 100644
index 00000000000..4c5465f97e1
--- /dev/null
+++ b/packages/api/src/files/sweep.spec.ts
@@ -0,0 +1,96 @@
+import { EModelEndpoint, FileSources } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { getFileRetentionSweepInterval, startExpiredFileSweep, sweepExpiredFiles } from './sweep';
+
+describe('expired file sweep helpers', () => {
+  const logger = {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.FILE_RETENTION_SWEEP_INTERVAL_MS;
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    delete process.env.FILE_RETENTION_SWEEP_INTERVAL_MS;
+  });
+
+  it('loads endpoint config and deletes expired OpenAI storage files', async () => {
+    const getExpiredFiles = jest.fn().mockResolvedValue([
+      {
+        file_id: 'expired-openai-file',
+        source: FileSources.openai,
+        user: { toString: () => 'user-123' },
+        tenantId: 'tenant-a',
+      },
+    ]);
+    const processDeleteRequest = jest.fn().mockResolvedValue({
+      deletedFileIds: ['expired-openai-file'],
+      failedFileIds: [],
+    });
+    const loadAppConfig = jest.fn().mockResolvedValue({
+      endpoints: {
+        [EModelEndpoint.assistants]: { version: 'v3' },
+      },
+    } as AppConfig);
+
+    const result = await sweepExpiredFiles(
+      { appConfig: {} as AppConfig, loadAppConfig, limit: 1 },
+      { getExpiredFiles, processDeleteRequest, logger },
+    );
+
+    expect(loadAppConfig).toHaveBeenCalledTimes(1);
+    expect(processDeleteRequest).toHaveBeenCalledWith({
+      req: expect.objectContaining({
+        baseUrl: '/api/assistants/v3',
+        originalUrl: '/api/assistants/v3/files',
+        body: { endpoint: EModelEndpoint.assistants, version: '3' },
+        user: { id: 'user-123', tenantId: 'tenant-a' },
+      }),
+      files: [expect.objectContaining({ file_id: 'expired-openai-file' })],
+    });
+    expect(result).toEqual({ scanned: 1, deleted: 1, failed: 0 });
+  });
+
+  it('counts files without owners as failed without deleting them', async () => {
+    const getExpiredFiles = jest.fn().mockResolvedValue([{ file_id: 'orphaned-file' }]);
+    const processDeleteRequest = jest.fn();
+
+    const result = await sweepExpiredFiles(
+      { appConfig: {} as AppConfig, limit: 1 },
+      { getExpiredFiles, processDeleteRequest, logger },
+    );
+
+    expect(processDeleteRequest).not.toHaveBeenCalled();
+    expect(logger.warn).toHaveBeenCalledWith(
+      '[sweepExpiredFiles] Skipping expired file without user: orphaned-file',
+    );
+    expect(result).toEqual({ scanned: 1, deleted: 0, failed: 1 });
+  });
+
+  it('falls back to the default interval for sub-millisecond values', () => {
+    expect(getFileRetentionSweepInterval('0.5')).toBe(60 * 60 * 1000);
+  });
+
+  it('does not start the interval when the sweep is disabled', () => {
+    process.env.FILE_RETENTION_SWEEP_INTERVAL_MS = '0';
+
+    const interval = startExpiredFileSweep(
+      { appConfig: {} as AppConfig },
+      {
+        sweepExpiredFiles: jest.fn(),
+        runAsSystem: jest.fn((fn) => fn()),
+        logger,
+      },
+    );
+
+    expect(interval).toBeNull();
+    expect(logger.info).toHaveBeenCalledWith(
+      '[sweepExpiredFiles] Disabled by FILE_RETENTION_SWEEP_INTERVAL_MS=0',
+    );
+  });
+});
diff --git a/packages/api/src/files/sweep.ts b/packages/api/src/files/sweep.ts
new file mode 100644
index 00000000000..4128fe3aa47
--- /dev/null
+++ b/packages/api/src/files/sweep.ts
@@ -0,0 +1,289 @@
+import {
+  FileSources,
+  EModelEndpoint,
+  checkOpenAIStorage,
+  defaultAssistantsVersion,
+} from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+
+const DEFAULT_FILE_RETENTION_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+
+type ExpiredFile = {
+  file_id: string;
+  source?: string;
+  user?: string | { toString?: () => string };
+  tenantId?: string;
+};
+
+type SweepRequest = {
+  baseUrl: string;
+  originalUrl: string;
+  path: string;
+  method: string;
+  headers: Record<string, unknown>;
+  query: Record<string, unknown>;
+  params: Record<string, unknown>;
+  config?: AppConfig;
+  body: {
+    endpoint: string;
+    version: string;
+  };
+  user: {
+    id: string;
+    tenantId?: string;
+  };
+};
+
+type SweepLogger = {
+  info: (message: string) => void;
+  warn: (message: string) => void;
+  error: (message: string, error?: unknown) => void;
+};
+
+type VersionedEndpointConfig = {
+  version?: unknown;
+  assistants?: { version?: unknown } | boolean;
+};
+
+type SweepDependencies = {
+  getExpiredFiles: (limit: number) => Promise<ExpiredFile[] | null | undefined>;
+  processDeleteRequest: (params: {
+    req: SweepRequest;
+    files: ExpiredFile[];
+  }) => Promise<{ deletedFileIds: string[]; failedFileIds: string[] }>;
+  logger: SweepLogger;
+};
+
+type StartSweepDependencies = {
+  sweepExpiredFiles: (options?: ExpiredFileSweepOptions) => Promise<ExpiredFileSweepResult>;
+  runAsSystem: <T>(fn: () => Promise<T>) => Promise<T>;
+  logger: SweepLogger;
+};
+
+export type ExpiredFileSweepOptions = {
+  appConfig?: AppConfig;
+  limit?: number;
+  loadAppConfig?: () => Promise<AppConfig | undefined>;
+};
+
+export type ExpiredFileSweepResult = {
+  scanned: number;
+  deleted: number;
+  failed: number;
+};
+
+export function getFileRetentionSweepInterval(
+  interval: string | undefined = process.env.FILE_RETENTION_SWEEP_INTERVAL_MS,
+): number {
+  if (interval == null || interval.trim() === '') {
+    return DEFAULT_FILE_RETENTION_SWEEP_INTERVAL_MS;
+  }
+
+  const value = Number(interval);
+  if (!Number.isFinite(value) || value < 0 || (value > 0 && value < 1)) {
+    return DEFAULT_FILE_RETENTION_SWEEP_INTERVAL_MS;
+  }
+  return value;
+}
+
+export function getExpiredFileEndpoint(source?: string): string {
+  return source === FileSources.azure ? EModelEndpoint.azureAssistants : EModelEndpoint.assistants;
+}
+
+export function hasExpiredFileEndpointConfig(
+  appConfig: AppConfig | undefined,
+  source?: string,
+): boolean {
+  if (source === FileSources.azure) {
+    return Boolean(appConfig?.endpoints?.[EModelEndpoint.azureOpenAI]?.assistants);
+  }
+
+  return Boolean(appConfig?.endpoints?.[EModelEndpoint.assistants]);
+}
+
+export function getConfiguredExpiredFileAssistantVersion({
+  appConfig,
+  source,
+  endpoint,
+}: {
+  appConfig?: AppConfig;
+  source?: string;
+  endpoint: string;
+}): unknown {
+  const endpoints = appConfig?.endpoints as
+    | Record<string, VersionedEndpointConfig | undefined>
+    | undefined;
+  const endpointVersion = endpoints?.[endpoint]?.version;
+  if (endpointVersion != null) {
+    return endpointVersion;
+  }
+
+  if (source === FileSources.azure) {
+    const azureAssistantsConfig = endpoints?.[EModelEndpoint.azureOpenAI]?.assistants;
+    if (typeof azureAssistantsConfig === 'object' && azureAssistantsConfig?.version != null) {
+      return azureAssistantsConfig.version;
+    }
+  }
+
+  return undefined;
+}
+
+export function getExpiredFileAssistantVersion({
+  appConfig,
+  source,
+  endpoint,
+}: {
+  appConfig?: AppConfig;
+  source?: string;
+  endpoint: string;
+}): string {
+  const configuredVersion = getConfiguredExpiredFileAssistantVersion({
+    appConfig,
+    source,
+    endpoint,
+  });
+  const assistantVersions = defaultAssistantsVersion as Record<string, number | undefined>;
+  const fallbackVersion = assistantVersions[endpoint] ?? defaultAssistantsVersion.assistants ?? 2;
+
+  return String(configuredVersion ?? fallbackVersion).replace(/^v/, '');
+}
+
+export function createExpiredFileSweepRequest({
+  appConfig,
+  file,
+  userId,
+}: {
+  appConfig?: AppConfig;
+  file: ExpiredFile;
+  userId: string;
+}): SweepRequest {
+  const source = file.source ?? FileSources.local;
+  const endpoint = getExpiredFileEndpoint(source);
+  const version = getExpiredFileAssistantVersion({ appConfig, source, endpoint });
+  const baseUrl = `/api/assistants/v${version}`;
+
+  return {
+    baseUrl,
+    originalUrl: `${baseUrl}/files`,
+    path: '/files',
+    method: 'DELETE',
+    headers: {},
+    query: {},
+    params: {},
+    config: appConfig,
+    body: {
+      endpoint,
+      version,
+    },
+    user: {
+      id: userId,
+      tenantId: file.tenantId,
+    },
+  };
+}
+
+export async function resolveExpiredFileSweepConfig({
+  appConfig,
+  file,
+  loadAppConfig,
+}: {
+  appConfig?: AppConfig;
+  file: ExpiredFile;
+  loadAppConfig?: () => Promise<AppConfig | undefined>;
+}): Promise<AppConfig | undefined> {
+  const source = file.source ?? FileSources.local;
+  if (
+    !checkOpenAIStorage(source) ||
+    hasExpiredFileEndpointConfig(appConfig, source) ||
+    typeof loadAppConfig !== 'function'
+  ) {
+    return appConfig;
+  }
+
+  return (await loadAppConfig()) ?? appConfig;
+}
+
+export async function sweepExpiredFiles(
+  { appConfig, limit = 100, loadAppConfig }: ExpiredFileSweepOptions | undefined = {},
+  { getExpiredFiles, processDeleteRequest, logger }: SweepDependencies,
+): Promise<ExpiredFileSweepResult> {
+  const files = (await getExpiredFiles(limit)) ?? [];
+  let resolvedAppConfig = appConfig;
+  let deleted = 0;
+  let failed = 0;
+
+  for (const file of files) {
+    const userId = typeof file.user === 'string' ? file.user : file.user?.toString?.();
+    if (!userId) {
+      logger.warn(`[sweepExpiredFiles] Skipping expired file without user: ${file.file_id}`);
+      failed++;
+      continue;
+    }
+
+    try {
+      resolvedAppConfig = await resolveExpiredFileSweepConfig({
+        appConfig: resolvedAppConfig,
+        file,
+        loadAppConfig,
+      });
+      const req = createExpiredFileSweepRequest({ appConfig: resolvedAppConfig, file, userId });
+      const { deletedFileIds, failedFileIds } = await processDeleteRequest({ req, files: [file] });
+      if (failedFileIds.includes(file.file_id)) {
+        failed++;
+        continue;
+      }
+
+      if (deletedFileIds.includes(file.file_id)) {
+        deleted++;
+      } else {
+        failed++;
+        logger.error(
+          `[sweepExpiredFiles] Delete request finished without resolving expired file ${file.file_id}`,
+        );
+      }
+    } catch (error) {
+      failed++;
+      logger.error(`[sweepExpiredFiles] Error deleting expired file ${file.file_id}:`, error);
+    }
+  }
+
+  if (deleted > 0 || failed > 0) {
+    logger.info(
+      `[sweepExpiredFiles] Processed ${files.length} expired files: ${deleted} deleted, ${failed} failed`,
+    );
+  }
+
+  return { scanned: files.length, deleted, failed };
+}
+
+export function startExpiredFileSweep(
+  options: ExpiredFileSweepOptions | undefined = {},
+  { sweepExpiredFiles, runAsSystem, logger }: StartSweepDependencies,
+): NodeJS.Timeout | null {
+  const intervalMs = getFileRetentionSweepInterval();
+  if (intervalMs === 0) {
+    logger.info('[sweepExpiredFiles] Disabled by FILE_RETENTION_SWEEP_INTERVAL_MS=0');
+    return null;
+  }
+
+  let isSweeping = false;
+  const runSweep = async () => {
+    if (isSweeping) {
+      return;
+    }
+
+    isSweeping = true;
+    try {
+      await runAsSystem(() => sweepExpiredFiles(options));
+    } catch (error) {
+      logger.error('[sweepExpiredFiles] Background sweep failed:', error);
+    } finally {
+      isSweeping = false;
+    }
+  };
+
+  runSweep();
+  const interval = setInterval(runSweep, intervalMs);
+  interval.unref?.();
+  return interval;
+}
diff --git a/packages/api/src/flow/manager.test.ts b/packages/api/src/flow/manager.test.ts
index b34dcbafab9..d955f98f4e3 100644
--- a/packages/api/src/flow/manager.test.ts
+++ b/packages/api/src/flow/manager.test.ts
@@ -1,5 +1,5 @@
 import { Keyv } from 'keyv';
-import { FlowStateManager } from './manager';
+import { FlowStateManager, PENDING_STALE_MS } from './manager';
 import { FlowState } from './types';
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -71,6 +71,24 @@ describe('FlowStateManager', () => {
       expect(result2).toBe('result');
     });
 
+    it('should return the externally completed result when handler loses completion race', async () => {
+      const flowId = 'race-flow';
+      const type = 'test-type';
+
+      const result = await flowManager.createFlowWithHandler(flowId, type, async () => {
+        await flowManager.completeFlow(flowId, type, 'fresh-result');
+        return 'stale-result';
+      });
+
+      expect(result).toBe('fresh-result');
+      await expect(flowManager.getFlowState(flowId, type)).resolves.toEqual(
+        expect.objectContaining({
+          status: 'COMPLETED',
+          result: 'fresh-result',
+        }),
+      );
+    });
+
     it('should handle flow timeout correctly', async () => {
       const flowId = 'timeout-flow';
       const type = 'test-type';
@@ -157,6 +175,25 @@ describe('FlowStateManager', () => {
 
       await expect(flowPromise).rejects.toThrow('failure');
     }, 15000);
+
+    it('should not overwrite a completed flow with a late failure', async () => {
+      const flowId = 'completed-race-flow';
+      const type = 'test-type';
+      const flowKey = `${type}:${flowId}`;
+
+      await flowManager.initFlow(flowId, type);
+      await flowManager.completeFlow(flowId, type, 'success');
+
+      const result = await flowManager.failFlow(flowId, type, new Error('late failure'));
+      const state = await store.get(flowKey);
+
+      expect(result).toBe(true);
+      expect(state).toMatchObject({
+        status: 'COMPLETED',
+        result: 'success',
+      });
+      expect(state?.error).toBeUndefined();
+    });
   });
 
   describe('initFlow', () => {
@@ -965,21 +1002,21 @@ describe('FlowStateManager', () => {
       expect(result2.isStale).toBe(false);
     });
 
-    it('uses default threshold of 2 minutes when not specified', async () => {
-      const timestamp = Date.now() - 3 * 60 * 1000; // 3 minutes ago
+    it('uses the default PENDING_STALE_MS threshold when not specified', async () => {
+      const timestamp = Date.now() - (PENDING_STALE_MS + 60 * 1000); // just past the default
       await store.set(flowKey, {
         type,
         status: 'COMPLETED',
         metadata: {},
-        createdAt: Date.now() - 5 * 60 * 1000,
+        createdAt: Date.now() - (PENDING_STALE_MS + 3 * 60 * 1000),
         completedAt: timestamp,
       });
 
-      // Should use default 2 minute threshold
+      // Should use the default PENDING_STALE_MS threshold
       const result = await flowManager.isFlowStale(flowId, type);
 
       expect(result.isStale).toBe(true);
-      expect(result.age).toBeGreaterThan(2 * 60 * 1000);
+      expect(result.age).toBeGreaterThan(PENDING_STALE_MS);
     });
 
     it('falls back to createdAt when completedAt/failedAt are not present', async () => {
diff --git a/packages/api/src/flow/manager.ts b/packages/api/src/flow/manager.ts
index 544cba95601..bbf335fd97e 100644
--- a/packages/api/src/flow/manager.ts
+++ b/packages/api/src/flow/manager.ts
@@ -2,8 +2,18 @@ import { Keyv } from 'keyv';
 import { logger } from '@librechat/data-schemas';
 import type { StoredDataNoRaw } from 'keyv';
 import type { FlowState, FlowMetadata, FlowManagerOptions } from './types';
+import { registerShutdownTask } from '../app/shutdown';
+import { math } from '~/utils/math';
 
-export const PENDING_STALE_MS = 2 * 60 * 1000;
+/**
+ * Lifetime of a PENDING OAuth flow: how long the auth button stays valid and an
+ * in-flight flow can be reused before it is replaced. Mirrors
+ * `mcpConfig.OAUTH_HANDLING_TIMEOUT` (`MCP_OAUTH_HANDLING_TIMEOUT`) so the reuse
+ * window matches the wait the server grants the user. Default: 10 minutes.
+ */
+export const PENDING_STALE_MS: number = math(
+  process.env.MCP_OAUTH_HANDLING_TIMEOUT ?? 10 * 60 * 1000,
+);
 
 const SECONDS_THRESHOLD = 1e10;
 
@@ -40,17 +50,14 @@ export class FlowStateManager<T = unknown> {
   }
 
   private setupCleanupHandlers() {
-    const cleanup = () => {
+    // Register cleanup with the centralized graceful-shutdown coordinator
+    // (see ../app/shutdown.ts) rather than attaching direct signal
+    // handlers — multiple competing handlers race the HTTP drain.
+    registerShutdownTask('flow manager cleanup', () => {
       logger.info('Cleaning up FlowStateManager intervals...');
       this.intervals.forEach((interval) => clearInterval(interval));
       this.intervals.clear();
-      process.exit(0);
-    };
-
-    process.on('SIGTERM', cleanup);
-    process.on('SIGINT', cleanup);
-    process.on('SIGQUIT', cleanup);
-    process.on('SIGHUP', cleanup);
+    });
   }
 
   /**
@@ -347,6 +354,17 @@ export class FlowStateManager<T = unknown> {
       return false;
     }
 
+    if (flowState.status === 'COMPLETED') {
+      logger.debug(
+        '[FlowStateManager] Flow already completed, skipping failure to prevent overwrite',
+        {
+          flowId,
+          type,
+        },
+      );
+      return true;
+    }
+
     const updatedState: FlowState = {
       ...flowState,
       status: 'FAILED',
@@ -406,6 +424,10 @@ export class FlowStateManager<T = unknown> {
     try {
       const result = await handler();
       await this.completeFlow(flowId, type, result);
+      const completedState = (await this.keyv.get(flowKey)) as FlowState<T> | undefined;
+      if (completedState?.status === 'COMPLETED' && completedState.result !== undefined) {
+        return completedState.result;
+      }
       return result;
     } catch (error) {
       await this.failFlow(flowId, type, error instanceof Error ? error : new Error(String(error)));
diff --git a/packages/api/src/html/devtools.spec.ts b/packages/api/src/html/devtools.spec.ts
new file mode 100644
index 00000000000..307bf52b47c
--- /dev/null
+++ b/packages/api/src/html/devtools.spec.ts
@@ -0,0 +1,34 @@
+import type { QueryDevtoolsRequest } from './devtools';
+import {
+  QUERY_DEVTOOLS_HEADER,
+  maybeInjectQueryDevtoolsBootstrap,
+  shouldEnableQueryDevtools,
+} from './devtools';
+
+const createReq = (value?: string): QueryDevtoolsRequest => ({
+  get: (header) => (header === QUERY_DEVTOOLS_HEADER ? value : undefined),
+});
+
+describe('query devtools HTML bootstrap', () => {
+  const html =
+    '<!DOCTYPE html><html lang="en-US"><head><title>LibreChat</title></head><body></body></html>';
+
+  it('uses the documented debug header value as the opt-in signal', () => {
+    expect(shouldEnableQueryDevtools(createReq('1'))).toBe(true);
+    expect(shouldEnableQueryDevtools(createReq('true'))).toBe(false);
+    expect(shouldEnableQueryDevtools(createReq())).toBe(false);
+  });
+
+  it('does not inject the production devtools flag by default', () => {
+    expect(maybeInjectQueryDevtoolsBootstrap(html, createReq())).toBe(html);
+  });
+
+  it('injects a server-to-client flag when the debug header is present', () => {
+    const updatedHtml = maybeInjectQueryDevtoolsBootstrap(html, createReq('1'));
+
+    expect(updatedHtml).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(updatedHtml).toContain('data-librechat-query-devtools="true"');
+    expect(updatedHtml).toContain('"enableQueryDevtools":true');
+    expect(updatedHtml.indexOf('enableQueryDevtools')).toBeLessThan(updatedHtml.indexOf('</head>'));
+  });
+});
diff --git a/packages/api/src/html/devtools.ts b/packages/api/src/html/devtools.ts
new file mode 100644
index 00000000000..db1dad8b374
--- /dev/null
+++ b/packages/api/src/html/devtools.ts
@@ -0,0 +1,34 @@
+export const QUERY_DEVTOOLS_HEADER = 'x-librechat-enable-query-devtools';
+
+const QUERY_DEVTOOLS_SENTINEL = 'data-librechat-query-devtools="true"';
+const QUERY_DEVTOOLS_BOOTSTRAP = `<script ${QUERY_DEVTOOLS_SENTINEL}>window.__LIBRECHAT_CONFIG__=Object.assign({},window.__LIBRECHAT_CONFIG__,{"enableQueryDevtools":true});</script>`;
+
+export interface QueryDevtoolsRequest {
+  get(header: string): string | undefined;
+}
+
+export const shouldEnableQueryDevtools = (req: QueryDevtoolsRequest): boolean =>
+  req.get(QUERY_DEVTOOLS_HEADER) === '1';
+
+const injectQueryDevtoolsBootstrap = (html: string): string => {
+  if (html.includes(QUERY_DEVTOOLS_SENTINEL)) {
+    return html;
+  }
+
+  if (html.includes('</head>')) {
+    return html.replace('</head>', `${QUERY_DEVTOOLS_BOOTSTRAP}</head>`);
+  }
+
+  return html.replace(/<body([^>]*)>/i, `<body$1>${QUERY_DEVTOOLS_BOOTSTRAP}`);
+};
+
+export const maybeInjectQueryDevtoolsBootstrap = (
+  html: string,
+  req: QueryDevtoolsRequest,
+): string => {
+  if (!shouldEnableQueryDevtools(req)) {
+    return html;
+  }
+
+  return injectQueryDevtoolsBootstrap(html);
+};
diff --git a/packages/api/src/html/index.ts b/packages/api/src/html/index.ts
new file mode 100644
index 00000000000..9ea3e000b10
--- /dev/null
+++ b/packages/api/src/html/index.ts
@@ -0,0 +1 @@
+export * from './devtools';
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index 6369ce6ed43..ead04e0b877 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -1,4 +1,6 @@
 export * from './app';
+/* Artifacts */
+export * from './artifacts';
 /* Admin */
 export * from './admin';
 export * from './cdn';
@@ -7,6 +9,7 @@ export * from './auth';
 /* API Keys */
 export * from './apiKeys';
 /* MCP */
+export * from './mcp/mcpConfig';
 export * from './mcp/registry/MCPServersRegistry';
 export * from './mcp/MCPManager';
 export * from './mcp/connection';
@@ -16,12 +19,15 @@ export * from './mcp/zod';
 export * from './mcp/errors';
 export * from './mcp/cache';
 export * from './mcp/tools';
+export * from './mcp/request';
 /* Utilities */
 export * from './mcp/utils';
 export * from './utils';
 export { default as Tokenizer, countTokens } from './utils/tokenizer';
 export type { EncodingName } from './utils/tokenizer';
 export * from './db/utils';
+/* HTML */
+export * from './html';
 /* OAuth */
 export * from './oauth';
 export * from './mcp/oauth/OAuthReconnectionManager';
@@ -33,10 +39,16 @@ export * from './flow/manager';
 export * from './middleware';
 /* Memory */
 export * from './memory';
+/* Model Specs */
+export * from './modelSpecs';
 /* Agents */
 export * from './agents';
+/* Actions */
+export * from './actions';
 /* Prompts */
 export * from './prompts';
+/* Projects */
+export * from './projects';
 /* Skills */
 export * from './skills';
 /* Endpoints */
@@ -49,12 +61,20 @@ export * from './storage';
 export * from './tools';
 /* web search */
 export * from './web';
+/* Langfuse */
+export * from './langfuse';
 /* Cache */
 export * from './cache';
+/* Shared Links */
+export * from './shared-links/access';
+export * from './shared-links/service';
+export * from './shared-links/config';
 /* Stream */
 export * from './stream';
 /* Diagnostics */
 export { memoryDiagnostics } from './utils/memory';
+/* RUM */
+export * from './rum/proxy';
 /* types */
 export type * from './mcp/types';
 export type * from './flow/types';
diff --git a/packages/api/src/langfuse/feedback.spec.ts b/packages/api/src/langfuse/feedback.spec.ts
new file mode 100644
index 00000000000..3de2f727a4e
--- /dev/null
+++ b/packages/api/src/langfuse/feedback.spec.ts
@@ -0,0 +1,146 @@
+jest.mock(
+  '@librechat/data-schemas',
+  () => ({
+    logger: {
+      debug: jest.fn(),
+    },
+  }),
+  { virtual: true },
+);
+
+const langfuseEnvKeys = [
+  'LANGFUSE_PUBLIC_KEY',
+  'LANGFUSE_SECRET_KEY',
+  'LANGFUSE_BASE_URL',
+  'LANGFUSE_HOST',
+  'LANGFUSE_BASEURL',
+  'LANGFUSE_TRACING_ENABLED',
+  'LANGFUSE_SAMPLE_RATE',
+  'LANGFUSE_TRACING_ENVIRONMENT',
+];
+let fetchMock: jest.SpiedFunction<typeof fetch>;
+
+function clearLangfuseEnv() {
+  for (const key of langfuseEnvKeys) {
+    delete process.env[key];
+  }
+}
+
+function setLangfuseCredentials() {
+  process.env.LANGFUSE_PUBLIC_KEY = 'public-key';
+  process.env.LANGFUSE_SECRET_KEY = 'secret-key';
+}
+
+async function loadFeedback(): Promise<typeof import('./feedback')> {
+  jest.resetModules();
+  return import('./feedback');
+}
+
+function getFetchMock(): jest.SpiedFunction<typeof fetch> {
+  return fetchMock;
+}
+
+describe('Langfuse feedback scores', () => {
+  beforeEach(() => {
+    clearLangfuseEnv();
+    setLangfuseCredentials();
+    fetchMock = jest.spyOn(global, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+  });
+
+  afterEach(() => {
+    clearLangfuseEnv();
+    fetchMock.mockRestore();
+    jest.clearAllMocks();
+  });
+
+  it('posts feedback scores when Langfuse tracing is enabled by default', async () => {
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp', tag: 'helpful', text: 'nice' },
+      metadata: {
+        messageId: 'message-id',
+        conversationId: 'conversation-id',
+        sessionId: 'conversation-id',
+        userId: 'user-id',
+        endpoint: 'agents',
+        empty: '',
+        missing: undefined,
+      },
+      observationId: 'observation-id',
+    });
+
+    expect(getFetchMock()).toHaveBeenCalledWith(
+      'https://cloud.langfuse.com/api/public/scores',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: `Basic ${Buffer.from('public-key:secret-key').toString('base64')}`,
+          'Content-Type': 'application/json',
+        }),
+        body: expect.any(String),
+      }),
+    );
+    const [, init] = getFetchMock().mock.calls[0];
+    expect(JSON.parse(init?.body as string)).toMatchObject({
+      id: 'feedback-trace-id',
+      traceId: 'trace-id',
+      name: 'user-feedback',
+      value: 1,
+      dataType: 'BOOLEAN',
+      comment: 'helpful — nice',
+      observationId: 'observation-id',
+      metadata: {
+        rating: 'thumbsUp',
+        tag: 'helpful',
+        messageId: 'message-id',
+        conversationId: 'conversation-id',
+        sessionId: 'conversation-id',
+        userId: 'user-id',
+        endpoint: 'agents',
+      },
+    });
+    expect(JSON.parse(init?.body as string).metadata).not.toHaveProperty('empty');
+    expect(JSON.parse(init?.body as string).metadata).not.toHaveProperty('missing');
+  });
+
+  it('posts feedback scores to the configured Langfuse host', async () => {
+    process.env.LANGFUSE_HOST = 'http://langfuse-server:3000';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp' },
+    });
+
+    expect(getFetchMock()).toHaveBeenCalledWith(
+      'http://langfuse-server:3000/api/public/scores',
+      expect.objectContaining({ method: 'POST' }),
+    );
+  });
+
+  it('skips scores when Langfuse tracing is disabled', async () => {
+    process.env.LANGFUSE_TRACING_ENABLED = 'false';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsDown' },
+    });
+
+    expect(getFetchMock()).not.toHaveBeenCalled();
+  });
+
+  it('skips scores when Langfuse sampling is set to zero', async () => {
+    process.env.LANGFUSE_SAMPLE_RATE = '0';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp' },
+    });
+
+    expect(getFetchMock()).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/api/src/langfuse/feedback.ts b/packages/api/src/langfuse/feedback.ts
new file mode 100644
index 00000000000..14d80df048e
--- /dev/null
+++ b/packages/api/src/langfuse/feedback.ts
@@ -0,0 +1,108 @@
+import { logger } from '@librechat/data-schemas';
+
+export type LangfuseFeedback = {
+  rating?: 'thumbsUp' | 'thumbsDown';
+  tag?: string;
+  text?: string;
+};
+
+export type LangfuseFeedbackMetadata = Record<string, string | number | boolean | null | undefined>;
+
+export type SendFeedbackScoreParams = {
+  traceId: string;
+  feedback?: LangfuseFeedback | null;
+  metadata?: LangfuseFeedbackMetadata;
+  observationId?: string;
+};
+
+const DEFAULT_BASE_URL = 'https://cloud.langfuse.com';
+const BASE =
+  process.env.LANGFUSE_BASE_URL ??
+  process.env.LANGFUSE_HOST ??
+  process.env.LANGFUSE_BASEURL ??
+  DEFAULT_BASE_URL;
+
+function isFalseEnv(value?: string): boolean {
+  return value != null && ['0', 'false', 'no', 'off'].includes(value.trim().toLowerCase());
+}
+
+function isSampleRateEnabled(value?: string): boolean {
+  if (value == null || value.trim() === '') {
+    return true;
+  }
+  const parsed = Number(value);
+  return !Number.isFinite(parsed) || parsed !== 0;
+}
+
+const ENABLED =
+  Boolean(process.env.LANGFUSE_PUBLIC_KEY && process.env.LANGFUSE_SECRET_KEY) &&
+  !isFalseEnv(process.env.LANGFUSE_TRACING_ENABLED) &&
+  isSampleRateEnabled(process.env.LANGFUSE_SAMPLE_RATE);
+const AUTHORIZATION = ENABLED
+  ? 'Basic ' +
+    Buffer.from(`${process.env.LANGFUSE_PUBLIC_KEY}:${process.env.LANGFUSE_SECRET_KEY}`).toString(
+      'base64',
+    )
+  : undefined;
+const ENVIRONMENT = process.env.LANGFUSE_TRACING_ENVIRONMENT;
+
+function cleanMetadata(
+  metadata: LangfuseFeedbackMetadata,
+): Record<string, string | number | boolean> {
+  return Object.entries(metadata).reduce<Record<string, string | number | boolean>>(
+    (result, [key, value]) => {
+      if (value == null || (typeof value === 'string' && value.trim() === '')) {
+        return result;
+      }
+      result[key] = value;
+      return result;
+    },
+    {},
+  );
+}
+
+export async function sendFeedbackScore({
+  traceId,
+  feedback,
+  metadata = {},
+  observationId,
+}: SendFeedbackScoreParams): Promise<void> {
+  if (!ENABLED || !AUTHORIZATION || !traceId) {
+    return;
+  }
+
+  const scoreId = `feedback-${traceId}`;
+
+  if (!feedback?.rating) {
+    const res = await fetch(`${BASE}/api/public/scores/${encodeURIComponent(scoreId)}`, {
+      method: 'DELETE',
+      headers: { Authorization: AUTHORIZATION },
+    });
+    if (!res.ok && res.status !== 404) {
+      throw new Error(`langfuse score delete ${res.status}: ${await res.text()}`);
+    }
+    return;
+  }
+
+  const body = {
+    id: scoreId,
+    traceId,
+    name: 'user-feedback',
+    value: feedback.rating === 'thumbsUp' ? 1 : 0,
+    dataType: 'BOOLEAN',
+    comment: [feedback.tag, feedback.text].filter(Boolean).join(' — ') || undefined,
+    metadata: cleanMetadata({ ...metadata, rating: feedback.rating, tag: feedback.tag }),
+    ...(observationId ? { observationId } : {}),
+    ...(ENVIRONMENT ? { environment: ENVIRONMENT } : {}),
+  };
+
+  const res = await fetch(`${BASE}/api/public/scores`, {
+    method: 'POST',
+    headers: { Authorization: AUTHORIZATION, 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) {
+    throw new Error(`langfuse score create ${res.status}: ${await res.text()}`);
+  }
+  logger.debug(`[langfuse] feedback score sent for trace ${traceId} (${feedback.rating})`);
+}
diff --git a/packages/api/src/langfuse/index.ts b/packages/api/src/langfuse/index.ts
new file mode 100644
index 00000000000..b22dba46982
--- /dev/null
+++ b/packages/api/src/langfuse/index.ts
@@ -0,0 +1,2 @@
+export * from './feedback';
+export * from './trace';
diff --git a/packages/api/src/langfuse/trace.ts b/packages/api/src/langfuse/trace.ts
new file mode 100644
index 00000000000..0bc80633c87
--- /dev/null
+++ b/packages/api/src/langfuse/trace.ts
@@ -0,0 +1,5 @@
+import { createHash } from 'crypto';
+
+export function traceIdForMessage(messageId: string): string {
+  return createHash('sha256').update(messageId, 'utf8').digest('hex').slice(0, 32);
+}
diff --git a/packages/api/src/mcp/ConnectionsRepository.ts b/packages/api/src/mcp/ConnectionsRepository.ts
index 2c535af820f..7dd2695467d 100644
--- a/packages/api/src/mcp/ConnectionsRepository.ts
+++ b/packages/api/src/mcp/ConnectionsRepository.ts
@@ -1,8 +1,8 @@
 import { logger } from '@librechat/data-schemas';
 import type * as t from './types';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
+import { isUserSourced, requiresUserScopedConnection } from './utils';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { hasCustomUserVars, isUserSourced } from './utils';
 import { MCPConnection } from './connection';
 
 const CONNECT_CONCURRENCY = 3;
@@ -78,14 +78,16 @@ export class ConnectionsRepository {
       }
     }
     const registry = MCPServersRegistry.getInstance();
+    const { allowedDomains, allowedAddresses, useSSRFProtection } =
+      await registry.resolveAllowlists({ userId: this.ownerId });
     const connection = await MCPConnectionFactory.create(
       {
         serverName,
         serverConfig,
         dbSourced: isUserSourced(serverConfig as t.ParsedServerConfig),
-        useSSRFProtection: registry.shouldEnableSSRFProtection(),
-        allowedDomains: registry.getAllowedDomains(),
-        allowedAddresses: registry.getAllowedAddresses(),
+        useSSRFProtection,
+        allowedDomains,
+        allowedAddresses,
       },
       this.oauthOpts,
     );
@@ -147,6 +149,8 @@ export class ConnectionsRepository {
    * App-level (shared) connections cannot serve servers that need per-user context:
    * env/header placeholders like `{{MY_KEY}}` are only resolved by `processMCPEnv()`
    * when real `customUserVars` values exist — which requires a user-level connection.
+   * OBO servers also require a user-level connection because each tool call
+   * uses the current user's bearer token.
    */
   private isAllowedToConnectToServer(config: t.ParsedServerConfig) {
     if (config.inspectionFailed) {
@@ -154,7 +158,7 @@ export class ConnectionsRepository {
     }
     if (
       this.ownerId === undefined &&
-      (config.startup === false || config.requiresOAuth || hasCustomUserVars(config))
+      (config.startup === false || requiresUserScopedConnection(config))
     ) {
       return false;
     }
diff --git a/packages/api/src/mcp/MCPConnectionFactory.ts b/packages/api/src/mcp/MCPConnectionFactory.ts
index 0ca3526e980..178e4199c3a 100644
--- a/packages/api/src/mcp/MCPConnectionFactory.ts
+++ b/packages/api/src/mcp/MCPConnectionFactory.ts
@@ -1,17 +1,31 @@
-import { logger, getTenantId } from '@librechat/data-schemas';
+import { logger, getTenantId, tenantStorage } from '@librechat/data-schemas';
 import type { OAuthClientInformation } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { TokenMethods, TenantContext } from '@librechat/data-schemas';
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
-import type { TokenMethods } from '@librechat/data-schemas';
-import type { MCPOAuthTokens, OAuthMetadata, MCPOAuthFlowMetadata } from '~/mcp/oauth';
+import type {
+  MCPOAuthTokens,
+  OAuthMetadata,
+  MCPOAuthFlowMetadata,
+  OAuthProtectedResourceMetadata,
+} from '~/mcp/oauth';
+import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
 import type { FlowStateManager } from '~/flow/manager';
 import type * as t from './types';
-import { MCPTokenStorage, MCPOAuthHandler, ReauthenticationRequiredError } from '~/mcp/oauth';
+import {
+  MCPTokenStorage,
+  MCPOAuthHandler,
+  OboTokenResolutionError,
+  ReauthenticationRequiredError,
+  resolveOboToken,
+} from '~/mcp/oauth';
+import { sanitizeUrlForLogging, isClientRejectionMessage, isOAuthServer } from './utils';
 import { PENDING_STALE_MS, normalizeExpiresAt } from '~/flow/manager';
-import { sanitizeUrlForLogging, isClientRejectionMessage } from './utils';
+import { preProcessGraphTokens } from '~/utils/graph';
 import { enrichUserForMcpGroups } from './group';
 import { withTimeout } from '~/utils/promise';
 import { MCPConnection } from './connection';
 import { processMCPEnv } from '~/utils';
+import { mcpConfig } from './mcpConfig';
 
 export interface ToolDiscoveryResult {
   tools: Tool[] | null;
@@ -20,6 +34,14 @@ export interface ToolDiscoveryResult {
   oauthUrl: string | null;
 }
 
+type OAuthRequiredEvent = {
+  serverUrl?: string;
+  error?: unknown;
+  status?: number;
+  statusCode?: number;
+  skipSilentRefresh?: boolean;
+};
+
 /**
  * Factory for creating MCP connections with optional OAuth authentication.
  * Handles OAuth flows, token management, and connection retry logic.
@@ -33,29 +55,74 @@ export class MCPConnectionFactory {
   protected readonly useSSRFProtection: boolean;
   protected readonly allowedDomains?: string[] | null;
   protected readonly allowedAddresses?: string[] | null;
+  protected readonly ephemeralConnection: boolean;
 
   // OAuth-related properties (only set when useOAuth is true)
   protected readonly userId?: string;
+  protected readonly user?: t.OAuthConnectionOptions['user'];
   protected readonly flowManager?: FlowStateManager<MCPOAuthTokens | null>;
   protected readonly tokenMethods?: TokenMethods;
-  protected readonly signal?: AbortSignal;
-  protected readonly oauthStart?: (authURL: string) => Promise<void>;
-  protected readonly oauthEnd?: () => Promise<void>;
-  protected readonly returnOnOAuth?: boolean;
+  protected signal?: AbortSignal;
+  protected oauthStart?: t.OAuthStartHandler;
+  protected oauthEnd?: () => Promise<void>;
+  protected returnOnOAuth?: boolean;
   protected readonly connectionTimeout?: number;
+  protected readonly oboTokenResolver?: OboTokenResolver;
+  protected readonly oboTrustChecker?: OboTrustChecker;
+  private connectionReady = false;
+  /**
+   * Snapshot of the tenant context at factory construction time. Captured eagerly
+   * because the OAuth handler runs later inside an EventEmitter callback,
+   * outside the original request's async context - `getTenantId()` called
+   * from the listener would return the wrong tenant (or none at all).
+   */
+  protected readonly tenantId?: string;
+  protected readonly tenantContext?: TenantContext;
+
+  /**
+   * Process-local in-flight silent refresh promises, keyed by
+   * `tenantId:userId:serverName`. Coalesces concurrent `attemptSilentTokenRefresh`
+   * calls within this process so a single refresh-token redemption serves every
+   * waiter in the same tenant — important when multiple connections (or repeated
+   * 401s) race the same refresh and the OAuth provider rotates refresh tokens.
+   * The map only holds in-flight promises (no result caching), so each new 401
+   * after the previous attempt resolves triggers a fresh redemption.
+   *
+   * NOTE: this is a single-process lock. Across multiple worker processes the
+   * race with `getOAuthTokens()`'s `mcp_get_tokens` flow remains; that's an
+   * inherent limitation of process-local coalescing and tracked separately.
+   */
+  private static inflightSilentRefreshes = new Map<string, Promise<MCPOAuthTokens | null>>();
+
+  /**
+   * Silent refresh is a best-effort optimization before interactive OAuth.
+   * Keep the cap short so a stalled refresh still leaves most of the factory
+   * connect budget for OAuth discovery, registration, and `oauthStart`.
+   */
+  private static readonly SILENT_REFRESH_TIMEOUT_MS = 5_000;
+  private static readonly SILENT_REFRESH_ABORT_GRACE_MS = 1_000;
 
   /** Creates a new MCP connection with optional OAuth support */
   static async create(
     basic: t.BasicConnectionOptions,
-    oauth?: t.OAuthConnectionOptions,
+    oauth?: t.OAuthConnectionOptions | t.UserConnectionContext,
   ): Promise<MCPConnection> {
     const enrichedOAuth = oauth?.user
       ? { ...oauth, user: await enrichUserForMcpGroups(oauth.user) }
       : oauth;
-    const factory = new this(basic, enrichedOAuth);
+    const factory = new this(await this.prepareBasicConnectionOptions(basic, oauth), enrichedOAuth);
     return factory.createConnection();
   }
 
+  static attachRequestOAuthHandler(
+    basic: t.BasicConnectionOptions,
+    oauth: t.OAuthConnectionOptions,
+    connection: MCPConnection,
+  ): () => void {
+    const factory = new this(basic, oauth);
+    return factory.handleOAuthEvents(connection, 'oauthReauthenticationRequired');
+  }
+
   /**
    * Discovers tools from an MCP server, even when OAuth is required.
    * Per MCP spec, tool listing should be possible without authentication.
@@ -65,23 +132,51 @@ export class MCPConnectionFactory {
     basic: t.BasicConnectionOptions,
     options?: Omit<t.OAuthConnectionOptions, 'returnOnOAuth'> | t.UserConnectionContext,
   ): Promise<ToolDiscoveryResult> {
+    const preparedBasic = await this.prepareBasicConnectionOptions(basic, options);
     const enrichedOptions = options?.user
       ? { ...options, user: await enrichUserForMcpGroups(options.user) }
       : options;
     if (options != null && 'useOAuth' in options) {
       const oauthOptions = enrichedOptions as Omit<t.OAuthConnectionOptions, 'returnOnOAuth'>;
-      const factory = new this(basic, { ...oauthOptions, returnOnOAuth: true });
+      const factory = new this(preparedBasic, { ...oauthOptions, returnOnOAuth: true });
       return factory.discoverToolsInternal();
     }
-    const factory = new this(basic, enrichedOptions);
+    const factory = new this(preparedBasic, enrichedOptions);
     return factory.discoverToolsInternal();
   }
 
+  /**
+   * Together with the constructor's processMCPEnv pass, this mirrors
+   * UserConnectionManager.resolveRuntimeConfig — keep them in sync so the
+   * config validated there matches the one connected with here.
+   */
+  private static async prepareBasicConnectionOptions(
+    basic: t.BasicConnectionOptions,
+    options?: t.OAuthConnectionOptions | t.UserConnectionContext,
+  ): Promise<t.BasicConnectionOptions> {
+    if (basic.dbSourced || !options?.graphTokenResolver) {
+      return basic;
+    }
+
+    const serverConfig = await preProcessGraphTokens(basic.serverConfig, {
+      user: options.user,
+      graphTokenResolver: options.graphTokenResolver,
+      scopes: process.env.GRAPH_API_SCOPES,
+    });
+
+    return serverConfig === basic.serverConfig ? basic : { ...basic, serverConfig };
+  }
+
   protected async discoverToolsInternal(): Promise<ToolDiscoveryResult> {
     const oauthUrl: string | null = null;
     let oauthRequired = false;
 
-    const oauthTokens = this.useOAuth ? await this.getOAuthTokens() : null;
+    let oauthTokens: MCPOAuthTokens | null = null;
+    if (this.usesObo) {
+      oauthTokens = await this.getOboTokens();
+    } else if (this.useOAuth) {
+      oauthTokens = await this.getOAuthTokens();
+    }
     const connection = new MCPConnection({
       serverName: this.serverName,
       serverConfig: this.serverConfig,
@@ -89,6 +184,7 @@ export class MCPConnectionFactory {
       oauthTokens,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     const oauthHandler = () => {
@@ -162,6 +258,7 @@ export class MCPConnectionFactory {
       oauthTokens: null,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     unauthConnection.on('oauthRequired', () => {
@@ -200,22 +297,29 @@ export class MCPConnectionFactory {
     basic: t.BasicConnectionOptions,
     options?: t.OAuthConnectionOptions | t.UserConnectionContext,
   ) {
-    this.serverConfig = processMCPEnv({
-      user: options?.user,
-      body: options?.requestBody,
-      dbSourced: basic.dbSourced,
-      options: basic.serverConfig,
-      customUserVars: options?.customUserVars,
-    });
+    this.serverConfig = basic.skipEnvProcessing
+      ? basic.serverConfig
+      : processMCPEnv({
+          user: options?.user,
+          body: options?.requestBody,
+          dbSourced: basic.dbSourced,
+          options: basic.serverConfig,
+          customUserVars: options?.customUserVars,
+        });
     this.serverName = basic.serverName;
     this.useSSRFProtection = basic.useSSRFProtection === true;
     this.allowedDomains = basic.allowedDomains;
     this.allowedAddresses = basic.allowedAddresses;
+    this.ephemeralConnection = basic.ephemeralConnection === true;
     this.connectionTimeout = options?.connectionTimeout;
+    this.tenantContext = tenantStorage?.getStore?.();
+    this.tenantId = this.tenantContext?.tenantId ?? getTenantId();
     this.logPrefix = options?.user
       ? `[MCP][${basic.serverName}][${options.user.id}]`
       : `[MCP][${basic.serverName}]`;
 
+    this.user = options?.user;
+
     if (options != null && 'useOAuth' in options) {
       this.useOAuth = true;
       this.userId = options.user?.id;
@@ -225,14 +329,78 @@ export class MCPConnectionFactory {
       this.oauthStart = options.oauthStart;
       this.oauthEnd = options.oauthEnd;
       this.returnOnOAuth = options.returnOnOAuth;
+      this.oboTokenResolver = options.oboTokenResolver;
+      this.oboTrustChecker = options.oboTrustChecker;
     } else {
       this.useOAuth = false;
     }
   }
 
+  /** Resolves OBO tokens when the server config specifies obo, returns null otherwise */
+  protected async getOboTokens(): Promise<MCPOAuthTokens | null> {
+    const oboConfig = this.serverConfig.obo;
+    if (!oboConfig || !this.oboTokenResolver || !this.user) {
+      return null;
+    }
+
+    if (this.oboTrustChecker) {
+      const config = this.serverConfig as t.ParsedServerConfig;
+      const trusted = await this.oboTrustChecker({
+        source: config.source,
+        author: config.author,
+        dbId: config.dbId,
+      });
+      if (!trusted) {
+        logger.warn(
+          `${this.logPrefix} OBO config not trusted (author lacks CONFIGURE_OBO permission); skipping OBO token exchange`,
+        );
+        return null;
+      }
+    }
+
+    logger.info(`${this.logPrefix} Resolving OBO token for scopes: ${oboConfig.scopes}`);
+    return resolveOboToken(this.user, oboConfig, this.oboTokenResolver);
+  }
+
+  /** Returns true if this server uses OBO instead of standard OAuth */
+  protected get usesObo(): boolean {
+    return !!this.serverConfig.obo && !!this.oboTokenResolver && !!this.user;
+  }
+
+  protected createOboConnectionError(error: OboTokenResolutionError): Error {
+    let recoveryHint = 'Re-authenticate the user and retry.';
+
+    if (error.retryable) {
+      recoveryHint = 'Please retry.';
+    } else if (error.reason === 'exchange_failed') {
+      recoveryHint = 'Re-authenticate the user or verify the configured OBO scopes and retry.';
+    }
+
+    return new Error(
+      `${error.userMessage} Unable to connect to OBO server "${this.serverName}". ${recoveryHint}`,
+    );
+  }
+
   /** Creates the base MCP connection with OAuth tokens */
   protected async createConnection(): Promise<MCPConnection> {
-    const oauthTokens = this.useOAuth ? await this.getOAuthTokens() : null;
+    let oauthTokens: MCPOAuthTokens | null = null;
+
+    if (this.usesObo) {
+      try {
+        oauthTokens = await this.getOboTokens();
+      } catch (error) {
+        if (error instanceof OboTokenResolutionError) {
+          throw this.createOboConnectionError(error);
+        }
+        throw error;
+      }
+      if (!oauthTokens) {
+        throw new Error(`OBO token exchange failed for "${this.serverName}".`);
+      }
+    } else if (this.useOAuth) {
+      oauthTokens = await this.getOAuthTokens();
+    }
+
     const connection = new MCPConnection({
       serverName: this.serverName,
       serverConfig: this.serverConfig,
@@ -240,18 +408,34 @@ export class MCPConnectionFactory {
       oauthTokens,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     let cleanupOAuthHandlers: (() => void) | null = null;
-    if (this.useOAuth) {
+    if (this.useOAuth && !this.usesObo) {
       cleanupOAuthHandlers = this.handleOAuthEvents(connection);
+    } else {
+      const nonOAuthHandler = () => {
+        logger.info(
+          `${this.logPrefix} Server does not use OAuth; treating 401/403 as auth failure`,
+        );
+        connection.emit('oauthFailed', new Error('Server does not use OAuth'));
+      };
+      connection.on('oauthRequired', nonOAuthHandler);
+      cleanupOAuthHandlers = () => {
+        connection.removeListener('oauthRequired', nonOAuthHandler);
+      };
     }
 
     try {
-      await this.attemptToConnect(connection);
-      if (cleanupOAuthHandlers) {
-        cleanupOAuthHandlers();
+      if (this.shouldInitiateOAuthBeforeConnect(oauthTokens)) {
+        await this.initiateOAuthBeforeConnect(connection);
       }
+      await this.attemptToConnect(connection);
+      this.connectionReady = true;
+      // Keep the `oauthRequired` listener for cached-connection 401 recovery,
+      // but drop response/tool-call callbacks from the completed request.
+      this.releaseRequestScopedOAuthState();
       return connection;
     } catch (error) {
       if (cleanupOAuthHandlers) {
@@ -261,25 +445,138 @@ export class MCPConnectionFactory {
     }
   }
 
+  private shouldInitiateOAuthBeforeConnect(oauthTokens: MCPOAuthTokens | null): boolean {
+    if (!this.useOAuth || oauthTokens) {
+      return false;
+    }
+    return isOAuthServer(this.serverConfig);
+  }
+
+  protected releaseRequestScopedOAuthState(): void {
+    this.signal = undefined;
+    this.oauthStart = undefined;
+    this.oauthEnd = undefined;
+    this.returnOnOAuth = false;
+  }
+
+  private getServerUrl(): string | undefined {
+    return 'url' in this.serverConfig ? this.serverConfig.url : undefined;
+  }
+
+  private async initiateOAuthBeforeConnect(connection: MCPConnection): Promise<void> {
+    const serverUrl = this.getServerUrl();
+    if (!serverUrl) {
+      throw new Error(`${this.logPrefix} OAuth required but server URL is missing from config`);
+    }
+
+    const oauthTimeout = mcpConfig.OAUTH_HANDLING_TIMEOUT;
+    logger.info(
+      `${this.logPrefix} No stored tokens, proactively triggering OAuth flow before connecting (timeout: ${oauthTimeout}ms)`,
+    );
+
+    await new Promise<void>((resolve, reject) => {
+      let timeoutId: ReturnType<typeof setTimeout> | null = null;
+      let oauthHandledListener: (() => void) | null = null;
+      let oauthFailedListener: ((error: Error) => void) | null = null;
+
+      const cleanup = () => {
+        if (timeoutId) {
+          clearTimeout(timeoutId);
+        }
+        if (oauthHandledListener) {
+          connection.off('oauthHandled', oauthHandledListener);
+        }
+        if (oauthFailedListener) {
+          connection.off('oauthFailed', oauthFailedListener);
+        }
+      };
+
+      oauthHandledListener = () => {
+        cleanup();
+        resolve();
+      };
+
+      oauthFailedListener = (error: Error) => {
+        cleanup();
+        reject(error);
+      };
+
+      timeoutId = setTimeout(() => {
+        cleanup();
+        reject(new Error(`Proactive OAuth flow timeout after ${oauthTimeout}ms`));
+      }, oauthTimeout);
+
+      connection.once('oauthHandled', oauthHandledListener);
+      connection.once('oauthFailed', oauthFailedListener);
+
+      const emitted = connection.emit('oauthRequired', {
+        serverName: this.serverName,
+        error: new Error('OAuth tokens missing before connection'),
+        serverUrl,
+        userId: this.userId,
+        /** `getOAuthTokens` just exhausted the stored-token/refresh path; go straight to interactive OAuth */
+        skipSilentRefresh: true,
+      });
+
+      if (!emitted) {
+        cleanup();
+        reject(new Error('OAuth required but no handler is registered'));
+      }
+    });
+  }
+
+  private async runWithCapturedTenant<T>(fn: () => Promise<T>): Promise<T> {
+    const context = this.tenantContext ?? (this.tenantId ? { tenantId: this.tenantId } : undefined);
+    if (!context || !tenantStorage?.run) {
+      return fn();
+    }
+    return tenantStorage.run(context, fn);
+  }
+
+  private getConnectionOAuthTimeoutMs(): number {
+    const factoryConnectTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    const connectionOAuthTimeout = this.serverConfig.initTimeout ?? 60000 * 2;
+    return Math.min(factoryConnectTimeout, connectionOAuthTimeout);
+  }
+
+  private getSilentRefreshTimeoutMs(): number {
+    const oauthTimeout = this.getConnectionOAuthTimeoutMs();
+    const silentRefreshBudgetMs = Math.floor(oauthTimeout * 0.4);
+    return Math.max(
+      1,
+      Math.min(MCPConnectionFactory.SILENT_REFRESH_TIMEOUT_MS, silentRefreshBudgetMs),
+    );
+  }
+
+  private getBaseFlowId(): string {
+    return MCPOAuthHandler.generateFlowId(this.userId!, this.serverName, this.tenantId);
+  }
+
+  private getTokenFlowId(): string {
+    return MCPOAuthHandler.generateTokenFlowId(this.userId!, this.serverName, this.tenantId);
+  }
+
   /** Retrieves existing OAuth tokens from storage or returns null */
   protected async getOAuthTokens(): Promise<MCPOAuthTokens | null> {
     if (!this.tokenMethods?.findToken) return null;
 
     try {
-      const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+      const flowId = this.getTokenFlowId();
       const tokens = await this.flowManager!.createFlowWithHandler(
         flowId,
         'mcp_get_tokens',
         async () => {
-          return await MCPTokenStorage.getTokens({
-            userId: this.userId!,
-            serverName: this.serverName,
-            findToken: this.tokenMethods!.findToken!,
-            createToken: this.tokenMethods!.createToken,
-            updateToken: this.tokenMethods!.updateToken,
-            deleteTokens: this.tokenMethods!.deleteTokens,
-            refreshTokens: this.createRefreshTokensFunction(),
-          });
+          return await this.runWithCapturedTenant(async () =>
+            MCPTokenStorage.getTokens({
+              userId: this.userId!,
+              serverName: this.serverName,
+              findToken: this.tokenMethods!.findToken!,
+              createToken: this.tokenMethods!.createToken,
+              updateToken: this.tokenMethods!.updateToken,
+              deleteTokens: this.tokenMethods!.deleteTokens,
+              refreshTokens: this.createRefreshTokensFunction(),
+            }),
+          );
         },
         this.signal,
       );
@@ -306,9 +603,11 @@ export class MCPConnectionFactory {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
+    signal?: AbortSignal,
   ) => Promise<MCPOAuthTokens> {
-    return async (refreshToken, metadata) => {
+    return async (refreshToken, metadata, signal) => {
       return await MCPOAuthHandler.refreshOAuthTokens(
         refreshToken,
         {
@@ -317,24 +616,321 @@ export class MCPConnectionFactory {
           clientInfo: metadata.clientInfo,
           storedTokenEndpoint: metadata.storedTokenEndpoint,
           storedAuthMethods: metadata.storedAuthMethods,
+          resource: metadata.resource,
         },
         this.serverConfig.oauth_headers ?? {},
         this.serverConfig.oauth,
         this.allowedDomains,
         this.allowedAddresses,
+        signal,
       );
     };
   }
 
+  /**
+   * Attempts to silently refresh OAuth tokens using the stored refresh token,
+   * bypassing the local `expires_at` check. Use this when the server has
+   * signaled token invalidity (a 401 emitted as `oauthRequired`) to avoid
+   * forcing the user through an interactive OAuth flow when the refresh token
+   * is still valid.
+   *
+   * Coalesces via `inflightSilentRefreshes` rather than `FlowStateManager` —
+   * the latter caches the completed result for the new token's TTL, which
+   * would hand back stale tokens on a subsequent 401 (e.g. when the freshly
+   * minted token is revoked before its local expiry). Caching only the
+   * in-flight promise means every fresh 401 after settlement triggers a
+   * fresh redemption.
+   */
+  protected async attemptSilentTokenRefresh(): Promise<MCPOAuthTokens | null> {
+    if (!this.tokenMethods?.findToken || !this.tokenMethods?.createToken) {
+      return null;
+    }
+
+    // Scope the lock by tenant so two tenants that share the same `userId`
+    // and `serverName` (common with username-based IDs in multi-tenant setups)
+    // can never join each other's refresh and have those tokens applied to the
+    // wrong connection.
+    const lockKey = `${this.tenantId ?? ''}:${this.userId ?? ''}:${this.serverName}`;
+    const inflight = MCPConnectionFactory.inflightSilentRefreshes.get(lockKey);
+    if (inflight) {
+      logger.debug(`${this.logPrefix} Joining in-flight silent refresh attempt`);
+      return inflight;
+    }
+
+    const timeoutMs = this.getSilentRefreshTimeoutMs();
+    const abortController = new AbortController();
+    let timeoutId: ReturnType<typeof setTimeout> | null = null;
+    let abortGraceTimeoutId: ReturnType<typeof setTimeout> | null = null;
+    const refreshPromise = this.runSilentRefresh(abortController.signal);
+    const promise = new Promise<MCPOAuthTokens | null>((resolve) => {
+      timeoutId = setTimeout(() => {
+        abortController.abort();
+        abortGraceTimeoutId = setTimeout(
+          releaseLock,
+          MCPConnectionFactory.SILENT_REFRESH_ABORT_GRACE_MS,
+        );
+        logger.info(
+          `${this.logPrefix} Silent token refresh timed out after ${timeoutMs}ms, falling back to interactive OAuth`,
+        );
+        resolve(null);
+      }, timeoutMs);
+
+      refreshPromise.then(resolve, (error: unknown) => {
+        logger.info(
+          `${this.logPrefix} Silent token refresh failed, falling back to interactive OAuth`,
+          error,
+        );
+        resolve(null);
+      });
+    }).finally(() => {
+      if (timeoutId) {
+        clearTimeout(timeoutId);
+      }
+    });
+    function releaseLock() {
+      if (abortGraceTimeoutId) {
+        clearTimeout(abortGraceTimeoutId);
+        abortGraceTimeoutId = null;
+      }
+      if (MCPConnectionFactory.inflightSilentRefreshes.get(lockKey) === promise) {
+        MCPConnectionFactory.inflightSilentRefreshes.delete(lockKey);
+      }
+    }
+    MCPConnectionFactory.inflightSilentRefreshes.set(lockKey, promise);
+    void refreshPromise.then(releaseLock, releaseLock);
+    return await promise;
+  }
+
+  /**
+   * Executes a single force-refresh attempt against the OAuth provider and
+   * persists the new tokens. Called by `attemptSilentTokenRefresh` under the
+   * `inflightSilentRefreshes` coalescing lock.
+   */
+  private async runSilentRefresh(signal: AbortSignal): Promise<MCPOAuthTokens | null> {
+    try {
+      const tokens = await this.runWithCapturedTenant(async () =>
+        MCPTokenStorage.forceRefreshTokens({
+          userId: this.userId!,
+          serverName: this.serverName,
+          findToken: this.tokenMethods!.findToken!,
+          createToken: this.tokenMethods!.createToken,
+          updateToken: this.tokenMethods!.updateToken,
+          deleteTokens: this.tokenMethods!.deleteTokens,
+          refreshTokens: this.createRefreshTokensFunction(),
+          signal,
+        }),
+      );
+
+      if (tokens) {
+        // Drop any previously cached `mcp_get_tokens` result so the next call
+        // to `getOAuthTokens` reads the freshly persisted tokens from the
+        // token store rather than the now-stale flow-cached value.
+        await this.invalidateGetTokensFlow(tokens);
+      }
+
+      if (tokens) {
+        logger.info(`${this.logPrefix} Silent token refresh succeeded`);
+      } else {
+        logger.info(`${this.logPrefix} Silent token refresh returned no tokens`);
+      }
+      return tokens;
+    } catch (error) {
+      if (error instanceof ReauthenticationRequiredError) {
+        logger.info(`${this.logPrefix} ${error.message}, falling back to interactive OAuth`);
+      } else {
+        logger.info(
+          `${this.logPrefix} Silent token refresh failed, falling back to interactive OAuth`,
+          error,
+        );
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Clears stale token-fetch cache after fresh credentials are known. COMPLETED
+   * entries are deleted; PENDING entries are completed with fresh tokens so
+   * concurrent waiters do not fail or later publish server-rejected tokens.
+   */
+  protected async invalidateGetTokensFlow(freshTokens?: MCPOAuthTokens): Promise<void> {
+    if (!this.flowManager || !this.userId) {
+      return;
+    }
+    const flowId = this.getTokenFlowId();
+    try {
+      const state = await this.flowManager.getFlowState(flowId, 'mcp_get_tokens');
+      if (!state) {
+        return;
+      }
+      if (state.status === 'PENDING' && freshTokens) {
+        await this.flowManager.completeFlow(flowId, 'mcp_get_tokens', freshTokens);
+        return;
+      }
+      if (state.status !== 'COMPLETED') {
+        return;
+      }
+      await this.flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+    } catch (err) {
+      logger.debug(`${this.logPrefix} Failed to invalidate mcp_get_tokens cache`, err);
+    }
+  }
+
+  /**
+   * Drops any cached COMPLETED `mcp_oauth` flow state so that
+   * `handleOAuthRequired`'s recent-completion fast path can't re-serve the
+   * tokens that the resource server just rejected.
+   */
+  protected async invalidateCompletedOAuthFlow(): Promise<void> {
+    if (!this.flowManager || !this.userId) {
+      return;
+    }
+    const flowId = this.getBaseFlowId();
+    try {
+      const existing = await this.flowManager.getFlowState(flowId, 'mcp_oauth');
+      if (!existing || existing.status !== 'COMPLETED') {
+        return;
+      }
+      const meta = existing.metadata as MCPOAuthFlowMetadata | undefined;
+      if (!this.isCurrentTenantOAuthFlow(meta)) {
+        logger.debug(
+          `${this.logPrefix} Skipping completed mcp_oauth invalidation for a different tenant`,
+        );
+        return;
+      }
+      const oldState = meta?.state;
+      await this.flowManager.deleteFlow(flowId, 'mcp_oauth');
+      if (oldState) {
+        await MCPOAuthHandler.deleteStateMapping(oldState, this.flowManager);
+      }
+    } catch (err) {
+      logger.debug(`${this.logPrefix} Failed to invalidate completed mcp_oauth cache`, err);
+    }
+  }
+
+  private isCurrentTenantOAuthFlow(meta: MCPOAuthFlowMetadata | undefined): boolean {
+    const flowTenantId = meta?.tenantId;
+    if (!this.tenantId) {
+      return !flowTenantId;
+    }
+    return flowTenantId === this.tenantId;
+  }
+
+  private getOAuthRequiredStatusCode(data: OAuthRequiredEvent): number | undefined {
+    if (typeof data.status === 'number') {
+      return data.status;
+    }
+    if (typeof data.statusCode === 'number') {
+      return data.statusCode;
+    }
+
+    const error = data.error;
+    if (!error || typeof error !== 'object') {
+      return undefined;
+    }
+
+    const errorLike = error as {
+      code?: unknown;
+      status?: unknown;
+      statusCode?: unknown;
+      message?: unknown;
+    };
+    for (const value of [errorLike.code, errorLike.status, errorLike.statusCode]) {
+      if (typeof value === 'number' && Number.isInteger(value)) {
+        return value;
+      }
+    }
+
+    if (typeof errorLike.message === 'string') {
+      const statusMatch = errorLike.message.match(/\b(4\d{2}|5\d{2})\b/);
+      if (statusMatch) {
+        return Number.parseInt(statusMatch[1], 10);
+      }
+    }
+
+    return undefined;
+  }
+
+  private shouldAttemptSilentTokenRefresh(data: OAuthRequiredEvent): boolean {
+    const statusCode = this.getOAuthRequiredStatusCode(data);
+    if (statusCode === 403) {
+      logger.info(
+        `${this.logPrefix} OAuth server returned 403; skipping silent refresh and starting interactive OAuth`,
+      );
+      return false;
+    }
+
+    const error = data.error;
+    if (error && typeof error === 'object' && 'message' in error) {
+      const message = (error as { message?: unknown }).message;
+      if (typeof message === 'string') {
+        const normalized = message.toLowerCase();
+        if (
+          normalized.includes('insufficient_scope') ||
+          normalized.includes('insufficient scope')
+        ) {
+          logger.info(
+            `${this.logPrefix} OAuth server reported insufficient scope; skipping silent refresh`,
+          );
+          return false;
+        }
+      }
+    }
+
+    return true;
+  }
+
+  private getOAuthReplayExpiresAt(createdAt?: number): number | undefined {
+    if (!createdAt) {
+      return undefined;
+    }
+
+    const expiresAt = createdAt + PENDING_STALE_MS;
+    return expiresAt > Date.now() ? expiresAt : undefined;
+  }
+
   /** Sets up OAuth event handlers for the connection */
-  protected handleOAuthEvents(connection: MCPConnection): () => void {
-    const oauthHandler = async (data: { serverUrl?: string }) => {
+  protected handleOAuthEvents(
+    connection: MCPConnection,
+    eventName: 'oauthRequired' | 'oauthReauthenticationRequired' = 'oauthRequired',
+  ): () => void {
+    const oauthHandler = async (data: OAuthRequiredEvent) => {
       logger.info(`${this.logPrefix} oauthRequired event received`);
 
+      if (!data.skipSilentRefresh && this.shouldAttemptSilentTokenRefresh(data)) {
+        const refreshedTokens = await this.attemptSilentTokenRefresh();
+        if (refreshedTokens) {
+          connection.setOAuthTokens(refreshedTokens);
+          connection.emit('oauthHandled');
+          return;
+        }
+      }
+
+      // Silent refresh failed and we're about to fall through to interactive
+      // OAuth. Invalidate any COMPLETED `mcp_oauth` flow first so
+      // `handleOAuthRequired`'s recent-completion fast path can't re-serve the
+      // tokens the resource server just rejected (see the `PENDING_STALE_MS`
+      // window in `handleOAuthRequired`).
+      await this.invalidateCompletedOAuthFlow();
+
+      if (this.connectionReady) {
+        const emitted = connection.emit('oauthReauthenticationRequired', {
+          ...data,
+          skipSilentRefresh: true,
+        });
+        if (emitted) {
+          return;
+        }
+        logger.info(
+          `${this.logPrefix} Silent refresh did not recover cached connection; requiring fresh OAuth prompt`,
+        );
+        connection.emit('oauthFailed', new Error('OAuth reauthentication required'));
+        return;
+      }
+
       if (this.returnOnOAuth) {
         try {
           const config = this.serverConfig;
-          const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+          const flowId = this.getBaseFlowId();
           const existingFlow = await this.flowManager!.getFlowState(flowId, 'mcp_oauth');
 
           if (existingFlow?.status === 'PENDING') {
@@ -346,7 +942,24 @@ export class MCPConnectionFactory {
               logger.debug(
                 `${this.logPrefix} Recent PENDING OAuth flow exists (${Math.round(pendingAge / 1000)}s old), skipping new initiation`,
               );
-              connection.emit('oauthFailed', new Error('OAuth flow initiated - return early'));
+              const flowMeta = existingFlow.metadata as MCPOAuthFlowMetadata | undefined;
+              const storedAuthUrl = flowMeta?.authorizationUrl;
+              if (storedAuthUrl && typeof this.oauthStart === 'function') {
+                const expiresAt = this.getOAuthReplayExpiresAt(existingFlow.createdAt);
+                if (!expiresAt) {
+                  logger.debug(`${this.logPrefix} PENDING OAuth flow expired before replay`);
+                  connection.emit(
+                    'oauthFailed',
+                    new Error('Pending OAuth flow expired before replay'),
+                  );
+                  return;
+                }
+                logger.info(
+                  `${this.logPrefix} Re-issuing stored authorization URL while reusing PENDING flow`,
+                );
+                await this.oauthStart(storedAuthUrl, { expiresAt });
+              }
+              connection.emit('oauthFailed', new Error('Pending OAuth flow reused - return early'));
               return;
             }
 
@@ -359,29 +972,32 @@ export class MCPConnectionFactory {
             authorizationUrl,
             flowId: newFlowId,
             flowMetadata,
-          } = await MCPOAuthHandler.initiateOAuthFlow(
-            this.serverName,
-            data.serverUrl || '',
-            this.userId!,
-            config?.oauth_headers ?? {},
-            config?.oauth,
-            this.allowedDomains,
-            // Only reuse stored client when deleteTokens is available for stale-client cleanup
-            this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
-            this.allowedAddresses,
+          } = await this.runWithCapturedTenant(() =>
+            MCPOAuthHandler.initiateOAuthFlow(
+              this.serverName,
+              data.serverUrl || '',
+              this.userId!,
+              config?.oauth_headers ?? {},
+              config?.oauth,
+              this.allowedDomains,
+              // Only reuse stored client when deleteTokens is available for stale-client cleanup
+              this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
+              this.allowedAddresses,
+              this.tenantId,
+            ),
           );
 
           if (existingFlow) {
             const oldMeta = existingFlow.metadata as MCPOAuthFlowMetadata | undefined;
             const oldState = oldMeta?.state;
-            await this.flowManager!.deleteFlow(newFlowId, 'mcp_oauth');
+            await this.flowManager!.deleteFlow(flowId, 'mcp_oauth');
             if (oldState) {
               await MCPOAuthHandler.deleteStateMapping(oldState, this.flowManager!);
             }
           }
 
           // Store flow state BEFORE redirecting so the callback can find it
-          const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+          const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: this.tenantId };
           await this.flowManager!.initFlow(newFlowId, 'mcp_oauth', metadataWithUrl);
           await MCPOAuthHandler.storeStateMapping(flowMetadata.state, newFlowId, this.flowManager!);
 
@@ -412,18 +1028,29 @@ export class MCPConnectionFactory {
       const result = await this.handleOAuthRequired();
 
       if (result?.tokens && this.tokenMethods?.createToken) {
+        const { tokens } = result;
         try {
-          connection.setOAuthTokens(result.tokens);
-          await MCPTokenStorage.storeTokens({
-            userId: this.userId!,
-            serverName: this.serverName,
-            tokens: result.tokens,
-            createToken: this.tokenMethods.createToken,
-            updateToken: this.tokenMethods.updateToken,
-            findToken: this.tokenMethods.findToken,
-            clientInfo: result.clientInfo,
-            metadata: result.metadata,
-          });
+          connection.setOAuthTokens(tokens);
+          await this.runWithCapturedTenant(() =>
+            MCPTokenStorage.storeTokens({
+              userId: this.userId!,
+              serverName: this.serverName,
+              tokens,
+              createToken: this.tokenMethods!.createToken,
+              updateToken: this.tokenMethods!.updateToken,
+              findToken: this.tokenMethods!.findToken,
+              clientInfo: result.clientInfo,
+              metadata: MCPOAuthHandler.buildStoredClientMetadata(
+                result.metadata,
+                result.resourceMetadata,
+              ),
+            }),
+          );
+          // Same rationale as the silent-refresh success path: invalidate the
+          // `mcp_get_tokens` cache so the next `getOAuthTokens` reads the
+          // freshly stored tokens rather than the just-rejected ones the
+          // interactive flow replaced.
+          await this.invalidateGetTokensFlow(tokens);
           logger.info(`${this.logPrefix} OAuth tokens saved to storage`);
         } catch (error) {
           logger.error(`${this.logPrefix} Failed to save OAuth tokens to storage`, error);
@@ -440,16 +1067,25 @@ export class MCPConnectionFactory {
       }
     };
 
-    connection.on('oauthRequired', oauthHandler);
+    connection.on(eventName, oauthHandler);
 
     return () => {
-      connection.removeListener('oauthRequired', oauthHandler);
+      connection.removeListener(eventName, oauthHandler);
     };
   }
 
   /** Attempts to establish connection with timeout handling */
   protected async attemptToConnect(connection: MCPConnection): Promise<void> {
-    const connectTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    const baseTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    // OAuth servers may pause mid-connect to wait for the user to authorize in the browser.
+    // The transport connect itself is still bounded by initTimeout inside connection.connect(),
+    // so this floor only extends the window for an active OAuth wait, not ordinary failures.
+    // The grace covers the reconnect after `oauthHandled` (retry backoff + transport connect),
+    // which happens *after* the handling wait, so a user who authorizes near the deadline still
+    // gets a connection instead of a timeout.
+    const connectTimeout = this.useOAuth
+      ? Math.max(baseTimeout, mcpConfig.OAUTH_HANDLING_TIMEOUT + 60000)
+      : baseTimeout;
     await withTimeout(
       this.connectTo(connection),
       connectTimeout,
@@ -499,11 +1135,13 @@ export class MCPConnectionFactory {
     if (!MCPConnectionFactory.isClientRejection(error)) {
       return;
     }
-    await MCPTokenStorage.deleteClientRegistration({
-      userId: this.userId!,
-      serverName: this.serverName,
-      deleteTokens: this.tokenMethods.deleteTokens,
-    }).catch((err) => {
+    await this.runWithCapturedTenant(() =>
+      MCPTokenStorage.deleteClientRegistration({
+        userId: this.userId!,
+        serverName: this.serverName,
+        deleteTokens: this.tokenMethods!.deleteTokens,
+      }),
+    ).catch((err) => {
       logger.warn(`${this.logPrefix} Failed to clear stale client registration`, err);
     });
   }
@@ -549,10 +1187,18 @@ export class MCPConnectionFactory {
       if (message.includes('invalid_token')) {
         return true;
       }
+      // Check for invalid_grant (OAuth servers return this for expired/revoked grants)
+      if (message.includes('invalid_grant')) {
+        return true;
+      }
       // Check for authentication required
       if (message.includes('authentication required') || message.includes('unauthorized')) {
         return true;
       }
+      // Check for missing authorization values (e.g., Amazon Ads MCP returns HTTP 400 with this)
+      if (message.includes('no authorization')) {
+        return true;
+      }
     }
 
     return false;
@@ -563,6 +1209,7 @@ export class MCPConnectionFactory {
     tokens: MCPOAuthTokens | null;
     clientInfo?: OAuthClientInformation;
     metadata?: OAuthMetadata;
+    resourceMetadata?: OAuthProtectedResourceMetadata;
     reusedStoredClient?: boolean;
     error?: unknown;
   } | null> {
@@ -585,7 +1232,7 @@ export class MCPConnectionFactory {
       logger.debug(`${this.logPrefix} Checking for existing OAuth flow for ${this.serverName}...`);
 
       /** Flow ID to check if a flow already exists */
-      const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+      const flowId = this.getBaseFlowId();
 
       /** Check if there's already an ongoing OAuth flow for this flowId */
       const existingFlow = await this.flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -605,10 +1252,14 @@ export class MCPConnectionFactory {
 
             const storedAuthUrl = flowMeta?.authorizationUrl;
             if (storedAuthUrl && typeof this.oauthStart === 'function') {
+              const expiresAt = this.getOAuthReplayExpiresAt(existingFlow.createdAt);
+              if (!expiresAt) {
+                throw new Error('Pending OAuth flow expired before replay');
+              }
               logger.info(
                 `${this.logPrefix} Re-issuing stored authorization URL to caller while joining PENDING flow`,
               );
-              await this.oauthStart(storedAuthUrl);
+              await this.oauthStart(storedAuthUrl, { expiresAt });
             }
 
             reusedStoredClient = flowMeta?.reusedStoredClient === true;
@@ -623,6 +1274,7 @@ export class MCPConnectionFactory {
               tokens,
               clientInfo: flowMeta?.clientInfo,
               metadata: flowMeta?.metadata,
+              resourceMetadata: flowMeta?.resourceMetadata,
               reusedStoredClient,
             };
           }
@@ -649,6 +1301,7 @@ export class MCPConnectionFactory {
               tokens: cachedTokens,
               clientInfo: flowMeta?.clientInfo,
               metadata: flowMeta?.metadata,
+              resourceMetadata: flowMeta?.resourceMetadata,
             };
           }
         }
@@ -672,21 +1325,24 @@ export class MCPConnectionFactory {
         authorizationUrl,
         flowId: newFlowId,
         flowMetadata,
-      } = await MCPOAuthHandler.initiateOAuthFlow(
-        this.serverName,
-        serverUrl,
-        this.userId!,
-        this.serverConfig.oauth_headers ?? {},
-        this.serverConfig.oauth,
-        this.allowedDomains,
-        this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
-        this.allowedAddresses,
+      } = await this.runWithCapturedTenant(() =>
+        MCPOAuthHandler.initiateOAuthFlow(
+          this.serverName,
+          serverUrl,
+          this.userId!,
+          this.serverConfig.oauth_headers ?? {},
+          this.serverConfig.oauth,
+          this.allowedDomains,
+          this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
+          this.allowedAddresses,
+          this.tenantId,
+        ),
       );
 
       reusedStoredClient = flowMetadata.reusedStoredClient === true;
 
       // Store flow state BEFORE redirecting so the callback can find it
-      const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+      const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: this.tenantId };
       await this.flowManager.initFlow(newFlowId, 'mcp_oauth', metadataWithUrl);
       await MCPOAuthHandler.storeStateMapping(flowMetadata.state, newFlowId, this.flowManager);
 
@@ -711,6 +1367,7 @@ export class MCPConnectionFactory {
         tokens,
         clientInfo: flowMetadata.clientInfo,
         metadata: flowMetadata.metadata,
+        resourceMetadata: flowMetadata.resourceMetadata,
         reusedStoredClient,
       };
     } catch (error) {
diff --git a/packages/api/src/mcp/MCPManager.ts b/packages/api/src/mcp/MCPManager.ts
index bdc63a4b61c..2aed4fc37cd 100644
--- a/packages/api/src/mcp/MCPManager.ts
+++ b/packages/api/src/mcp/MCPManager.ts
@@ -1,15 +1,26 @@
 import pick from 'lodash/pick';
 import { logger } from '@librechat/data-schemas';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
 import { CallToolResultSchema, ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
 import type { RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
+import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
 import type { IUserGroup } from './types';
 import type { GraphTokenResolver } from '~/utils/graph';
 import type { FlowStateManager } from '~/flow/manager';
 import type { MCPOAuthTokens } from './oauth';
 import type { RequestBody } from '~/types';
 import type * as t from './types';
+import {
+  getMissingRuntimeBodyPlaceholderFields,
+  isOAuthServer,
+  isUserSourced,
+  requiresEphemeralUserConnection,
+  requiresOAuthMachinery,
+  requiresUserScopedConnection,
+} from './utils';
 import { MCPServersInitializer } from './registry/MCPServersInitializer';
+import { OboTokenResolutionError, resolveOboToken } from '~/mcp/oauth';
 import { MCPServerInspector } from './registry/MCPServerInspector';
 import { MCPServersRegistry } from './registry/MCPServersRegistry';
 import { UserConnectionManager } from './UserConnectionManager';
@@ -20,7 +31,22 @@ import { formatToolContent } from './parsers';
 import { MCPConnection } from './connection';
 import { enrichUserForMcpGroups } from './group';
 import { processMCPEnv } from '~/utils/env';
-import { isUserSourced } from './utils';
+
+function createOboToolCallErrorMessage(
+  logPrefix: string,
+  toolName: string,
+  error: OboTokenResolutionError,
+): string {
+  let failureSuffix = 'Re-authenticate the user and retry.';
+
+  if (error.retryable) {
+    failureSuffix = 'Please retry.';
+  } else if (error.reason === 'exchange_failed') {
+    failureSuffix = 'Re-authenticate the user or verify the configured OBO scopes and retry.';
+  }
+
+  return `${logPrefix} ${error.userMessage} Cannot execute tool ${toolName}. ${failureSuffix}`;
+}
 
 /**
  * Centralized manager for MCP server connections and tool execution.
@@ -44,7 +70,7 @@ export class MCPManager extends UserConnectionManager {
   }
 
   /** Initializes the MCPManager by setting up server registry and app connections */
-  public async initialize(configs: t.MCPServers) {
+  public async initialize(configs: t.MCPServers): Promise<void> {
     await MCPServersInitializer.initialize(configs);
     this.appConnections = new ConnectionsRepository(undefined);
   }
@@ -60,12 +86,29 @@ export class MCPManager extends UserConnectionManager {
       serverConfig?: t.ParsedServerConfig;
     } & Omit<t.OAuthConnectionOptions, 'useOAuth' | 'user' | 'flowManager'>,
   ): Promise<MCPConnection> {
+    const userId = args.user?.id;
+    const effectiveConfig =
+      args.serverConfig ??
+      (userId
+        ? await MCPServersRegistry.getInstance().getServerConfig(args.serverName, userId)
+        : undefined);
+
+    if (effectiveConfig && userId && requiresUserScopedConnection(effectiveConfig)) {
+      return this.getUserConnection({
+        ...args,
+        serverConfig: effectiveConfig,
+      } as Parameters<typeof this.getUserConnection>[0]);
+    }
+
     //the get method checks if the config is still valid as app level
     const existingAppConnection = await this.appConnections!.get(args.serverName);
     if (existingAppConnection) {
       return existingAppConnection;
-    } else if (args.user?.id) {
-      return this.getUserConnection(args as Parameters<typeof this.getUserConnection>[0]);
+    } else if (userId) {
+      return this.getUserConnection({
+        ...args,
+        serverConfig: effectiveConfig,
+      } as Parameters<typeof this.getUserConnection>[0]);
     } else {
       throw new McpError(
         ErrorCode.InvalidRequest,
@@ -104,12 +147,32 @@ export class MCPManager extends UserConnectionManager {
       return { tools: null, oauthRequired: false, oauthUrl: null };
     }
 
-    const useOAuth = Boolean(serverConfig.requiresOAuth || serverConfig.oauthMetadata);
+    const missingBodyFields = getMissingRuntimeBodyPlaceholderFields(
+      serverConfig,
+      args.requestBody,
+    );
+    if (missingBodyFields.length > 0) {
+      logger.warn(
+        `${logPrefix} [Discovery] Request body field(s) required to resolve runtime MCP placeholders: ${missingBodyFields.join(', ')}`,
+      );
+      return { tools: null, oauthRequired: false, oauthUrl: null };
+    }
 
     const registry = MCPServersRegistry.getInstance();
-    const useSSRFProtection = registry.shouldEnableSSRFProtection();
-    const allowedDomains = registry.getAllowedDomains();
-    const allowedAddresses = registry.getAllowedAddresses();
+    const { allowedDomains, allowedAddresses, useSSRFProtection } =
+      await registry.resolveAllowlists({ userId: user?.id, role: user?.role });
+    await this.assertResolvedRuntimeConfigAllowed({
+      config: serverConfig,
+      user,
+      customUserVars: args.customUserVars,
+      requestBody: args.requestBody,
+      graphTokenResolver: args.graphTokenResolver,
+      allowedDomains,
+      allowedAddresses,
+      logPrefix: `${logPrefix} [Discovery]`,
+    });
+
+    const useOAuth = requiresOAuthMachinery(serverConfig);
     const dbSourced = isUserSourced(serverConfig);
     const basic: t.BasicConnectionOptions = {
       dbSourced,
@@ -120,18 +183,32 @@ export class MCPManager extends UserConnectionManager {
       allowedAddresses,
     };
 
+    const finalizeDiscoveryResult = async (
+      result: Awaited<ReturnType<typeof MCPConnectionFactory.discoverTools>>,
+    ): Promise<t.ToolDiscoveryResult> => {
+      if (result.connection) {
+        try {
+          await result.connection.disconnect();
+        } catch (error) {
+          logger.warn(`${logPrefix} [Discovery] Failed to disconnect discovery connection`, error);
+        }
+      }
+      return {
+        tools: result.tools,
+        oauthRequired: result.oauthRequired,
+        oauthUrl: result.oauthUrl,
+      };
+    };
+
     if (!useOAuth) {
       const result = await MCPConnectionFactory.discoverTools(basic, {
         user: args.user,
         customUserVars: args.customUserVars,
         requestBody: args.requestBody,
+        graphTokenResolver: args.graphTokenResolver,
         connectionTimeout: args.connectionTimeout,
       });
-      return {
-        tools: result.tools,
-        oauthRequired: result.oauthRequired,
-        oauthUrl: result.oauthUrl,
-      };
+      return finalizeDiscoveryResult(result);
     }
 
     if (!user || !args.flowManager) {
@@ -148,10 +225,13 @@ export class MCPManager extends UserConnectionManager {
       oauthStart: args.oauthStart,
       customUserVars: args.customUserVars,
       requestBody: args.requestBody,
+      graphTokenResolver: args.graphTokenResolver,
       connectionTimeout: args.connectionTimeout,
+      oboTokenResolver: args.oboTokenResolver,
+      oboTrustChecker: args.oboTrustChecker,
     });
 
-    return { tools: result.tools, oauthRequired: result.oauthRequired, oauthUrl: result.oauthUrl };
+    return finalizeDiscoveryResult(result);
   }
 
   /** Returns all available tool functions from app-level connections */
@@ -271,11 +351,14 @@ Please follow these instructions when using tools from the respective MCP server
     options,
     tokenMethods,
     requestBody,
+    requestScopedConnections,
     flowManager,
     oauthStart,
     oauthEnd,
     customUserVars,
     graphTokenResolver,
+    oboTokenResolver,
+    oboTrustChecker,
   }: {
     user?: IUser | IUserGroup;
     serverName: string;
@@ -286,15 +369,20 @@ Please follow these instructions when using tools from the respective MCP server
     toolArguments?: Record<string, unknown>;
     options?: RequestOptions;
     requestBody?: RequestBody;
+    requestScopedConnections?: t.RequestScopedMCPConnectionStore;
     tokenMethods?: TokenMethods;
     customUserVars?: Record<string, string>;
     flowManager: FlowStateManager<MCPOAuthTokens | null>;
-    oauthStart?: (authURL: string) => Promise<void>;
+    oauthStart?: t.OAuthStartHandler;
     oauthEnd?: () => Promise<void>;
     graphTokenResolver?: GraphTokenResolver;
+    oboTokenResolver?: OboTokenResolver;
+    oboTrustChecker?: OboTrustChecker;
   }): Promise<t.FormattedToolResponse> {
     /** User-specific connection */
     let connection: MCPConnection | undefined;
+    let cleanupRequestOAuthHandler: (() => void) | undefined;
+    let disconnectAfterCall = false;
     const userId = user?.id;
     const logPrefix = userId ? `[MCP][User: ${userId}][${serverName}]` : `[MCP][${serverName}]`;
 
@@ -308,9 +396,13 @@ Please follow these instructions when using tools from the respective MCP server
         tokenMethods,
         oauthStart,
         oauthEnd,
+        oboTokenResolver,
+        oboTrustChecker,
+        graphTokenResolver,
         signal: options?.signal,
         customUserVars,
         requestBody,
+        requestScopedConnections,
         serverConfig: providedConfig,
       });
 
@@ -322,9 +414,8 @@ Please follow these instructions when using tools from the respective MCP server
         );
       }
 
-      const rawConfig =
-        providedConfig ??
-        (await MCPServersRegistry.getInstance().getServerConfig(serverName, userId));
+      const registry = MCPServersRegistry.getInstance();
+      const rawConfig = providedConfig ?? (await registry.getServerConfig(serverName, userId));
       if (!rawConfig) {
         throw new McpError(
           ErrorCode.InvalidRequest,
@@ -332,6 +423,8 @@ Please follow these instructions when using tools from the respective MCP server
         );
       }
       const isDbSourced = isUserSourced(rawConfig);
+      disconnectAfterCall =
+        !!userId && requiresEphemeralUserConnection(rawConfig) && !requestScopedConnections;
 
       /** Pre-process Graph token placeholders (async) before the synchronous processMCPEnv pass */
       const graphProcessedConfig = isDbSourced
@@ -349,10 +442,80 @@ Please follow these instructions when using tools from the respective MCP server
         options: graphProcessedConfig,
         customUserVars,
       });
-      if ('headers' in currentOptions) {
-        connection.setRequestHeaders(currentOptions.headers || {});
+
+      const resolvedHeaders: Record<string, string> =
+        'headers' in currentOptions ? { ...(currentOptions.headers || {}) } : {};
+
+      /** Refresh OBO token on each tool call to ensure it's current */
+      const oboConfig = rawConfig.obo;
+      if (oboConfig && oboTokenResolver && user) {
+        const oboTrusted = oboTrustChecker
+          ? await oboTrustChecker({
+              source: rawConfig.source,
+              author: rawConfig.author,
+              dbId: rawConfig.dbId,
+            })
+          : true;
+        if (!oboTrusted) {
+          logger.warn(
+            `${logPrefix} OBO config not trusted (author lacks ${PermissionTypes.MCP_SERVERS}.${Permissions.CONFIGURE_OBO}); refusing to mint a downstream token`,
+          );
+          throw new McpError(
+            ErrorCode.InternalError,
+            `${logPrefix} OBO is not permitted for server "${serverName}". The user who configured it no longer has permission to use OBO.`,
+          );
+        }
+        let oboTokens: MCPOAuthTokens;
+        try {
+          oboTokens = await resolveOboToken(user, oboConfig, oboTokenResolver);
+        } catch (error) {
+          if (error instanceof OboTokenResolutionError) {
+            throw new McpError(
+              ErrorCode.InternalError,
+              createOboToolCallErrorMessage(logPrefix, toolName, error),
+            );
+          }
+          throw error;
+        }
+
+        if (!oboTokens.access_token) {
+          throw new McpError(
+            ErrorCode.InternalError,
+            `${logPrefix} OBO token refresh failed. Cannot execute tool ${toolName}. Re-authenticate the user and retry.`,
+          );
+        }
+        resolvedHeaders['Authorization'] = `Bearer ${oboTokens.access_token}`;
+      }
+      if (userId && user && oauthStart && flowManager && isOAuthServer(currentOptions)) {
+        const { allowedDomains, allowedAddresses, useSSRFProtection } =
+          await registry.resolveAllowlists({ userId, role: user?.role });
+        cleanupRequestOAuthHandler = MCPConnectionFactory.attachRequestOAuthHandler(
+          {
+            serverName,
+            serverConfig: currentOptions,
+            dbSourced: isDbSourced,
+            skipEnvProcessing: true,
+            useSSRFProtection,
+            allowedDomains,
+            allowedAddresses,
+          },
+          {
+            useOAuth: true,
+            user,
+            flowManager,
+            tokenMethods,
+            signal: options?.signal,
+            oauthStart,
+            oauthEnd,
+            customUserVars,
+            requestBody,
+          },
+          connection,
+        );
       }
 
+      connection.setRequestHeaders(resolvedHeaders);
+
       const result = await connection.client.request(
         {
           method: 'tools/call',
@@ -378,6 +541,20 @@ Please follow these instructions when using tools from the respective MCP server
       logger.error(`${logPrefix}[${toolName}] Tool call failed`, error);
       // Rethrowing allows the caller (createMCPTool) to handle the final user message
       throw error;
+    } finally {
+      cleanupRequestOAuthHandler?.();
+      // Ephemeral connections are never stored in userConnections, so disconnecting
+      // is the only cleanup needed; removing the map entry here could orphan a
+      // still-connected cached connection from before a config change.
+      if (disconnectAfterCall && connection) {
+        try {
+          await connection.disconnect();
+        } catch (disconnectError) {
+          logger.warn(`${logPrefix}[${toolName}] Failed to disconnect ephemeral connection`, {
+            error: disconnectError,
+          });
+        }
+      }
     }
   }
 }
diff --git a/packages/api/src/mcp/UserConnectionManager.ts b/packages/api/src/mcp/UserConnectionManager.ts
index f352497f786..c083d799791 100644
--- a/packages/api/src/mcp/UserConnectionManager.ts
+++ b/packages/api/src/mcp/UserConnectionManager.ts
@@ -1,13 +1,43 @@
-import { logger } from '@librechat/data-schemas';
+import { logger, getTenantId } from '@librechat/data-schemas';
 import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import type { MCPOAuthFlowMetadata } from '~/mcp/oauth';
+import type { FlowState } from '~/flow/types';
 import type * as t from './types';
+import {
+  getMissingRuntimeBodyPlaceholderFields,
+  hasRuntimeUrlPlaceholders,
+  isUserSourced,
+  requiresEphemeralUserConnection,
+  requiresOAuthMachinery,
+} from './utils';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
+import { detectOAuthRequirement, MCPOAuthHandler } from '~/mcp/oauth';
 import { ConnectionsRepository } from '~/mcp/ConnectionsRepository';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { isUserSourced } from './utils';
+import { preProcessGraphTokens } from '~/utils/graph';
+import { isMCPDomainAllowed } from '~/auth/domain';
+import { PENDING_STALE_MS } from '~/flow/manager';
 import { MCPConnection } from './connection';
+import { processMCPEnv } from '~/utils/env';
 import { mcpConfig } from './mcpConfig';
 
+type PendingOAuthStart = {
+  authURL: string;
+  options?: t.OAuthStartOptions;
+};
+
+type PendingOAuthState = {
+  oauthStarts: Set<t.OAuthStartHandler>;
+  emittedAuthUrls: WeakMap<t.OAuthStartHandler, string>;
+  primaryOAuthStart?: t.OAuthStartHandler;
+  lastOAuthStart?: PendingOAuthStart;
+};
+
+type PendingConnection = {
+  promise: Promise<MCPConnection>;
+  oauth: PendingOAuthState;
+};
+
 /**
  * Abstract base class for managing user-specific MCP connections with lifecycle management.
  * Only meant to be extended by MCPManager.
@@ -23,7 +53,7 @@ export abstract class UserConnectionManager {
   /** Last activity timestamp for users (not per server) */
   protected userLastActivity: Map<string, number> = new Map();
   /** In-flight connection promises keyed by `userId:serverName` — coalesces concurrent attempts */
-  protected pendingConnections: Map<string, Promise<MCPConnection>> = new Map();
+  protected pendingConnections: Map<string, PendingConnection> = new Map();
 
   /** Updates the last activity timestamp for a user */
   protected updateUserLastActivity(userId: string): void {
@@ -35,45 +65,299 @@ export abstract class UserConnectionManager {
   }
 
   /** Gets or creates a connection for a specific user, coalescing concurrent attempts */
-  public async getUserConnection(
-    opts: {
-      serverName: string;
-      forceNew?: boolean;
-      /** Pre-resolved config for config-source servers not in YAML/DB */
-      serverConfig?: t.ParsedServerConfig;
-    } & Omit<t.OAuthConnectionOptions, 'useOAuth'>,
-  ): Promise<MCPConnection> {
+  public async getUserConnection(opts: t.UserMCPConnectionOptions): Promise<MCPConnection> {
     const { serverName, forceNew, user } = opts;
     const userId = user?.id;
     if (!userId) {
       throw new McpError(ErrorCode.InvalidRequest, `[MCP] User object missing id property`);
     }
 
+    const config =
+      opts.serverConfig ??
+      (await MCPServersRegistry.getInstance().getServerConfig(serverName, userId));
+    const missingBodyFields = config
+      ? getMissingRuntimeBodyPlaceholderFields(config, opts.requestBody)
+      : [];
+    if (missingBodyFields.length > 0) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `[MCP][User: ${userId}][${serverName}] Request body field(s) required to resolve runtime MCP placeholders: ${missingBodyFields.join(', ')}.`,
+      );
+    }
+    const ephemeralConnection = config ? requiresEphemeralUserConnection(config) : false;
+    const requestScopedConnections = ephemeralConnection
+      ? opts.requestScopedConnections
+      : undefined;
+    if (requestScopedConnections) {
+      const requestConnectionKey = `${userId}:${serverName}`;
+      const existing = requestScopedConnections.connections.get(requestConnectionKey) as
+        | MCPConnection
+        | undefined;
+      if (existing) {
+        if (!config || (config.updatedAt && existing.isStale(config.updatedAt))) {
+          await existing.disconnect().catch((error) => {
+            logger.warn(
+              `[MCP][User: ${userId}][${serverName}] Failed to disconnect stale request-scoped connection`,
+              error,
+            );
+          });
+          requestScopedConnections.connections.delete(requestConnectionKey);
+        } else if (await existing.isConnected()) {
+          logger.debug(`[MCP][User: ${userId}][${serverName}] Reusing request-scoped connection`);
+          this.updateUserLastActivity(userId);
+          return existing;
+        } else {
+          requestScopedConnections.connections.delete(requestConnectionKey);
+        }
+      }
+
+      const pending = requestScopedConnections.pending.get(requestConnectionKey) as
+        | Promise<MCPConnection>
+        | undefined;
+      if (pending) {
+        logger.debug(
+          `[MCP][User: ${userId}][${serverName}] Joining in-flight request-scoped connection attempt`,
+        );
+        return pending;
+      }
+
+      const pendingOAuth = this.createPendingOAuthState(opts.oauthStart);
+      const connectionPromise = this.createUserConnectionInternal(
+        {
+          ...opts,
+          forceNew: true,
+          ephemeralConnection: true,
+          serverConfig: config,
+          oauthStart: this.createPendingOAuthStart(serverName, userId, pendingOAuth),
+        },
+        userId,
+        forceNew === true,
+      ).then((connection) => {
+        requestScopedConnections.connections.set(requestConnectionKey, connection);
+        return connection;
+      });
+
+      requestScopedConnections.pending.set(
+        requestConnectionKey,
+        connectionPromise as Promise<unknown>,
+      );
+
+      try {
+        return await connectionPromise;
+      } finally {
+        if (requestScopedConnections.pending.get(requestConnectionKey) === connectionPromise) {
+          requestScopedConnections.pending.delete(requestConnectionKey);
+        }
+      }
+    }
+
+    const forceNewConnection = forceNew || ephemeralConnection;
+    const clearCooldown = forceNew === true;
+
     const lockKey = `${userId}:${serverName}`;
 
-    if (!forceNew) {
+    if (!forceNewConnection) {
       const pending = this.pendingConnections.get(lockKey);
       if (pending) {
         logger.debug(`[MCP][User: ${userId}][${serverName}] Joining in-flight connection attempt`);
-        return pending;
+        await this.addPendingOAuthStart(pending.oauth, opts, userId);
+        return pending.promise;
       }
     }
 
-    const connectionPromise = this.createUserConnectionInternal(opts, userId);
+    const pendingOAuth = this.createPendingOAuthState(opts.oauthStart);
+    const connectionPromise = this.createUserConnectionInternal(
+      {
+        ...opts,
+        forceNew: forceNewConnection,
+        ephemeralConnection,
+        serverConfig: config,
+        oauthStart: this.createPendingOAuthStart(serverName, userId, pendingOAuth),
+      },
+      userId,
+      clearCooldown,
+    );
 
-    if (!forceNew) {
-      this.pendingConnections.set(lockKey, connectionPromise);
+    if (!forceNewConnection) {
+      this.pendingConnections.set(lockKey, { promise: connectionPromise, oauth: pendingOAuth });
     }
 
     try {
       return await connectionPromise;
     } finally {
-      if (!forceNew && this.pendingConnections.get(lockKey) === connectionPromise) {
+      if (
+        !forceNewConnection &&
+        this.pendingConnections.get(lockKey)?.promise === connectionPromise
+      ) {
         this.pendingConnections.delete(lockKey);
       }
     }
   }
 
+  private createPendingOAuthState(oauthStart?: t.OAuthStartHandler): PendingOAuthState {
+    return {
+      oauthStarts: oauthStart ? new Set([oauthStart]) : new Set(),
+      emittedAuthUrls: new WeakMap<t.OAuthStartHandler, string>(),
+      primaryOAuthStart: oauthStart,
+    };
+  }
+
+  private createPendingOAuthStart(
+    serverName: string,
+    userId: string,
+    pendingOAuth: PendingOAuthState,
+  ): t.OAuthStartHandler {
+    return async (authURL, options) => {
+      pendingOAuth.lastOAuthStart = { authURL, options };
+
+      let primaryError: unknown;
+      const oauthStarts = Array.from(pendingOAuth.oauthStarts);
+      for (const oauthStart of oauthStarts) {
+        try {
+          await this.emitPendingOAuthStart(pendingOAuth, oauthStart, authURL, options);
+        } catch (error) {
+          if (oauthStart === pendingOAuth.primaryOAuthStart) {
+            primaryError = error;
+          } else {
+            logger.warn(
+              `[MCP][User: ${userId}][${serverName}] Failed to notify joined OAuth listener`,
+              error,
+            );
+          }
+        }
+      }
+
+      if (primaryError) {
+        throw primaryError;
+      }
+    };
+  }
+
+  private async addPendingOAuthStart(
+    pendingOAuth: PendingOAuthState,
+    opts: t.UserMCPConnectionOptions,
+    userId: string,
+  ): Promise<void> {
+    const { oauthStart, serverName } = opts;
+    if (typeof oauthStart !== 'function') {
+      return;
+    }
+
+    pendingOAuth.oauthStarts.add(oauthStart);
+    const lastOAuthStart = pendingOAuth.lastOAuthStart;
+    if (lastOAuthStart) {
+      try {
+        const pendingOAuthStart =
+          lastOAuthStart.options?.expiresAt == null
+            ? await this.getFlowPendingOAuthStart(opts, userId)
+            : undefined;
+        const replayOAuthStart =
+          pendingOAuthStart?.authURL === lastOAuthStart.authURL
+            ? pendingOAuthStart
+            : lastOAuthStart;
+        await this.emitPendingOAuthStart(
+          pendingOAuth,
+          oauthStart,
+          replayOAuthStart.authURL,
+          replayOAuthStart.options,
+        );
+      } catch (error) {
+        logger.warn(
+          `[MCP][User: ${userId}][${serverName}] Failed to re-issue pending OAuth URL`,
+          error,
+        );
+      }
+      return;
+    }
+
+    await this.reissuePendingOAuthStart(opts, userId, pendingOAuth);
+  }
+
+  private async emitPendingOAuthStart(
+    pendingOAuth: PendingOAuthState,
+    oauthStart: t.OAuthStartHandler,
+    authURL: string,
+    options?: t.OAuthStartOptions,
+  ): Promise<void> {
+    if (pendingOAuth.emittedAuthUrls.get(oauthStart) === authURL) {
+      return;
+    }
+    pendingOAuth.emittedAuthUrls.set(oauthStart, authURL);
+    await oauthStart(authURL, options);
+  }
+
+  private getPendingOAuthStart(flow: FlowState | null | undefined): PendingOAuthStart | undefined {
+    if (flow?.status !== 'PENDING') {
+      return undefined;
+    }
+
+    const expiresAt = flow.createdAt + PENDING_STALE_MS;
+    if (expiresAt <= Date.now()) {
+      return undefined;
+    }
+
+    const metadata = flow.metadata as MCPOAuthFlowMetadata | undefined;
+    const authorizationUrl = metadata?.authorizationUrl;
+    if (!authorizationUrl) {
+      return undefined;
+    }
+
+    return { authURL: authorizationUrl, options: { expiresAt } };
+  }
+
+  private async getFlowPendingOAuthStart(
+    { flowManager, serverName }: Pick<t.UserMCPConnectionOptions, 'flowManager' | 'serverName'>,
+    userId: string,
+  ): Promise<PendingOAuthStart | undefined> {
+    if (!flowManager) {
+      return undefined;
+    }
+
+    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+    const existingFlow = await flowManager.getFlowState(flowId, 'mcp_oauth');
+    return this.getPendingOAuthStart(existingFlow);
+  }
+
+  private async reissuePendingOAuthStart(
+    { flowManager, oauthStart, serverName }: t.UserMCPConnectionOptions,
+    userId: string,
+    pendingOAuth?: PendingOAuthState,
+  ): Promise<void> {
+    if (!flowManager || typeof oauthStart !== 'function') {
+      return;
+    }
+
+    try {
+      const pendingOAuthStart = await this.getFlowPendingOAuthStart(
+        { flowManager, serverName },
+        userId,
+      );
+      if (!pendingOAuthStart) {
+        return;
+      }
+
+      logger.info(
+        `[MCP][User: ${userId}][${serverName}] Re-issuing stored authorization URL while joining in-flight connection`,
+      );
+      if (pendingOAuth) {
+        pendingOAuth.lastOAuthStart = pendingOAuthStart;
+        await this.emitPendingOAuthStart(
+          pendingOAuth,
+          oauthStart,
+          pendingOAuthStart.authURL,
+          pendingOAuthStart.options,
+        );
+      } else {
+        await oauthStart(pendingOAuthStart.authURL, pendingOAuthStart.options);
+      }
+    } catch (error) {
+      logger.warn(
+        `[MCP][User: ${userId}][${serverName}] Failed to re-issue pending OAuth URL`,
+        error,
+      );
+    }
+  }
+
   private async createUserConnectionInternal(
     {
       serverName,
@@ -85,16 +369,17 @@ export abstract class UserConnectionManager {
       tokenMethods,
       oauthStart,
       oauthEnd,
+      oboTokenResolver,
+      oboTrustChecker,
       signal,
       returnOnOAuth = false,
       connectionTimeout,
+      graphTokenResolver,
+      ephemeralConnection = false,
       serverConfig: providedConfig,
-    }: {
-      serverName: string;
-      forceNew?: boolean;
-      serverConfig?: t.ParsedServerConfig;
-    } & Omit<t.OAuthConnectionOptions, 'useOAuth'>,
+    }: t.UserMCPConnectionOptions,
     userId: string,
+    clearCooldown: boolean,
   ): Promise<MCPConnection> {
     if (await this.appConnections!.has(serverName)) {
       throw new McpError(
@@ -109,7 +394,7 @@ export abstract class UserConnectionManager {
 
     const userServerMap = this.userConnections.get(userId);
     let connection = forceNew ? undefined : userServerMap?.get(serverName);
-    if (forceNew) {
+    if (clearCooldown) {
       MCPConnection.clearCooldown(serverName);
     }
     const now = Date.now();
@@ -160,17 +445,47 @@ export abstract class UserConnectionManager {
     logger.info(`[MCP][User: ${userId}][${serverName}] Establishing new connection`);
 
     try {
+      const runtimeConfig = await this.applyRuntimeOAuthDetection({
+        config,
+        user,
+        customUserVars,
+        requestBody,
+        graphTokenResolver,
+      });
       const registry = MCPServersRegistry.getInstance();
-      connection = await MCPConnectionFactory.create(
-        {
-          serverConfig: config,
-          serverName: serverName,
-          dbSourced: isUserSourced(config),
-          useSSRFProtection: registry.shouldEnableSSRFProtection(),
-          allowedDomains: registry.getAllowedDomains(),
-          allowedAddresses: registry.getAllowedAddresses(),
-        },
-        {
+      const { allowedDomains, allowedAddresses, useSSRFProtection } =
+        await registry.resolveAllowlists({ userId: user?.id, role: user?.role });
+      await this.assertResolvedRuntimeConfigAllowed({
+        config: runtimeConfig,
+        user,
+        customUserVars,
+        requestBody,
+        graphTokenResolver,
+        allowedDomains,
+        allowedAddresses,
+        logPrefix: `[MCP][User: ${userId}][${serverName}]`,
+      });
+      const basic: t.BasicConnectionOptions = {
+        serverConfig: runtimeConfig,
+        serverName: serverName,
+        dbSourced: isUserSourced(runtimeConfig),
+        useSSRFProtection,
+        allowedDomains,
+        allowedAddresses,
+        ephemeralConnection,
+      };
+
+      const useOAuth = requiresOAuthMachinery(runtimeConfig);
+      let connectionOptions: t.OAuthConnectionOptions | t.UserConnectionContext;
+      if (useOAuth) {
+        if (!flowManager) {
+          throw new McpError(
+            ErrorCode.InvalidRequest,
+            `[MCP][User: ${userId}] OAuth server "${serverName}" requires a flowManager`,
+          );
+        }
+
+        connectionOptions = {
           useOAuth: true,
           user: user,
           customUserVars: customUserVars,
@@ -179,20 +494,35 @@ export abstract class UserConnectionManager {
           signal: signal,
           oauthStart: oauthStart,
           oauthEnd: oauthEnd,
+          oboTokenResolver: oboTokenResolver,
+          oboTrustChecker: oboTrustChecker,
+          graphTokenResolver,
           returnOnOAuth: returnOnOAuth,
           requestBody: requestBody,
           connectionTimeout: connectionTimeout,
-        },
-      );
+        };
+      } else {
+        connectionOptions = {
+          user,
+          customUserVars,
+          requestBody,
+          graphTokenResolver,
+          connectionTimeout,
+        };
+      }
+
+      connection = await MCPConnectionFactory.create(basic, connectionOptions);
 
       if (!(await connection?.isConnected())) {
         throw new Error('Failed to establish connection after initialization attempt.');
       }
 
-      if (!this.userConnections.has(userId)) {
-        this.userConnections.set(userId, new Map());
+      if (!ephemeralConnection) {
+        if (!this.userConnections.has(userId)) {
+          this.userConnections.set(userId, new Map());
+        }
+        this.userConnections.get(userId)?.set(serverName, connection);
       }
-      this.userConnections.get(userId)?.set(serverName, connection);
 
       logger.info(`[MCP][User: ${userId}][${serverName}] Connection successfully established`);
       // Update timestamp on creation
@@ -213,8 +543,155 @@ export abstract class UserConnectionManager {
     }
   }
 
+  /**
+   * Mirrors the resolution MCPConnectionFactory performs internally
+   * (preProcessGraphTokens + processMCPEnv). Both must stay in sync so the
+   * config validated here matches the one the factory actually connects with.
+   */
+  protected async resolveRuntimeConfig({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+  }): Promise<t.ParsedServerConfig> {
+    const dbSourced = isUserSourced(config);
+    const graphProcessedConfig = dbSourced
+      ? config
+      : await preProcessGraphTokens(config, {
+          user,
+          graphTokenResolver,
+          scopes: process.env.GRAPH_API_SCOPES,
+        });
+
+    return processMCPEnv({
+      user,
+      body: requestBody,
+      dbSourced,
+      options: graphProcessedConfig,
+      customUserVars,
+    }) as t.ParsedServerConfig;
+  }
+
+  protected async assertResolvedRuntimeConfigAllowed({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+    allowedDomains,
+    allowedAddresses,
+    logPrefix,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+    allowedDomains?: string[] | null;
+    allowedAddresses?: string[] | null;
+    logPrefix: string;
+  }): Promise<t.ParsedServerConfig> {
+    const resolvedConfig = await this.resolveRuntimeConfig({
+      config,
+      user,
+      customUserVars,
+      requestBody,
+      graphTokenResolver,
+    });
+
+    if (!resolvedConfig.url) {
+      return resolvedConfig;
+    }
+
+    if (hasRuntimeUrlPlaceholders(resolvedConfig)) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `${logPrefix} Runtime URL still contains unresolved MCP placeholders after resolution.`,
+      );
+    }
+
+    const allowed = await isMCPDomainAllowed(resolvedConfig, allowedDomains, allowedAddresses);
+    if (!allowed) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `${logPrefix} Resolved MCP server URL is not allowed by the configured domain policy.`,
+      );
+    }
+
+    return resolvedConfig;
+  }
+
+  private async applyRuntimeOAuthDetection({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+  }): Promise<t.ParsedServerConfig> {
+    if (
+      config.requiresOAuth != null ||
+      config.apiKey?.source === 'admin' ||
+      !hasRuntimeUrlPlaceholders(config)
+    ) {
+      return config;
+    }
+
+    const resolvedConfig = await this.resolveRuntimeConfig({
+      config,
+      user,
+      customUserVars,
+      requestBody,
+      graphTokenResolver,
+    });
+
+    if (!resolvedConfig.url || hasRuntimeUrlPlaceholders(resolvedConfig)) {
+      logger.warn(
+        `[MCP][User: ${user?.id}][${config.url}] Runtime URL still contains placeholders after resolution; skipping OAuth detection`,
+      );
+      return config;
+    }
+
+    const registry = MCPServersRegistry.getInstance();
+    const { allowedDomains, allowedAddresses } = await registry.resolveAllowlists({
+      userId: user?.id,
+      role: user?.role,
+    });
+    const allowed = await isMCPDomainAllowed(resolvedConfig, allowedDomains, allowedAddresses);
+    if (!allowed) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `[MCP][User: ${user?.id}][${config.url}] Resolved MCP server URL is not allowed by the configured domain policy.`,
+      );
+    }
+
+    const result = await detectOAuthRequirement(
+      resolvedConfig.url,
+      allowedDomains,
+      allowedAddresses,
+    );
+
+    return {
+      ...config,
+      requiresOAuth: result.requiresOAuth,
+      oauthMetadata: result.metadata,
+    };
+  }
+
   /** Returns all connections for a specific user */
-  public getUserConnections(userId: string) {
+  public getUserConnections(userId: string): Map<string, MCPConnection> | undefined {
     return this.userConnections.get(userId);
   }
 
diff --git a/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts b/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
index 0a012bb4b53..73b88587deb 100644
--- a/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
+++ b/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
@@ -21,12 +21,20 @@ jest.mock('../MCPConnectionFactory', () => ({
 jest.mock('../connection');
 
 // Mock the registry
+const mockShouldEnableSSRFProtection = jest.fn().mockReturnValue(false);
+const mockGetAllowedDomains = jest.fn().mockReturnValue(null);
+const mockGetAllowedAddresses = jest.fn().mockReturnValue(null);
 const mockRegistryInstance = {
   getServerConfig: jest.fn(),
   getAllServerConfigs: jest.fn(),
-  shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
-  getAllowedDomains: jest.fn().mockReturnValue(null),
-  getAllowedAddresses: jest.fn().mockReturnValue(null),
+  shouldEnableSSRFProtection: mockShouldEnableSSRFProtection,
+  getAllowedDomains: mockGetAllowedDomains,
+  getAllowedAddresses: mockGetAllowedAddresses,
+  resolveAllowlists: jest.fn(async () => ({
+    allowedDomains: mockGetAllowedDomains(),
+    allowedAddresses: mockGetAllowedAddresses(),
+    useSSRFProtection: mockShouldEnableSSRFProtection(),
+  })),
 };
 
 jest.mock('../registry/MCPServersRegistry', () => ({
@@ -430,6 +438,18 @@ describe('ConnectionsRepository', () => {
         expect(await repository.has('customVarStartupServer')).toBe(false);
       });
 
+      it('should NOT allow connection to OBO servers', async () => {
+        mockServerConfigs.oboServer = {
+          type: 'streamable-http',
+          url: 'http://example.com',
+          obo: {
+            scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite',
+          },
+        };
+
+        expect(await repository.has('oboServer')).toBe(false);
+      });
+
       it('should disconnect existing connection when server becomes not allowed', async () => {
         // Initially setup as regular server
         mockServerConfigs.changingServer = {
@@ -523,6 +543,18 @@ describe('ConnectionsRepository', () => {
         expect(await repository.has('customVarServer')).toBe(true);
       });
 
+      it('should allow connection to OBO servers', async () => {
+        mockServerConfigs.oboServer = {
+          type: 'streamable-http',
+          url: 'http://example.com',
+          obo: {
+            scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite',
+          },
+        };
+
+        expect(await repository.has('oboServer')).toBe(true);
+      });
+
       it('should return null from get() when server config does not exist', async () => {
         const connection = await repository.get('nonexistent');
         expect(connection).toBeNull();
diff --git a/packages/api/src/mcp/__tests__/MCPConnection.test.ts b/packages/api/src/mcp/__tests__/MCPConnection.test.ts
index 5cb5606d570..6ba9d921712 100644
--- a/packages/api/src/mcp/__tests__/MCPConnection.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPConnection.test.ts
@@ -82,6 +82,10 @@ describe('MCPConnection Error Detection', () => {
       if (message.includes('authentication required') || message.includes('unauthorized')) {
         return true;
       }
+      // Check for missing authorization values (e.g., Amazon Ads MCP returns HTTP 400 with this)
+      if (message.includes('no authorization')) {
+        return true;
+      }
     }
 
     return false;
@@ -171,6 +175,24 @@ describe('MCPConnection Error Detection', () => {
       };
       expect(isOAuthError(error)).toBe(true);
     });
+
+    it('should detect OAuth error for "no authorization" in message (HTTP 400)', () => {
+      const error = {
+        message:
+          'Either no authorization values are specified or it could not be derived from the request',
+      };
+      expect(isOAuthError(error)).toBe(true);
+    });
+
+    it('should detect OAuth error for "No authorization" with different casing', () => {
+      const error = { message: 'No Authorization header provided' };
+      expect(isOAuthError(error)).toBe(true);
+    });
+
+    it('should not detect OAuth error for unrelated 400 errors', () => {
+      const error = { code: 400, message: 'Bad request: missing required field' };
+      expect(isOAuthError(error)).toBe(false);
+    });
   });
 
   describe('error type differentiation', () => {
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionAgentLifecycle.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionAgentLifecycle.test.ts
index c7b6b273ba1..19c972f0c67 100644
--- a/packages/api/src/mcp/__tests__/MCPConnectionAgentLifecycle.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPConnectionAgentLifecycle.test.ts
@@ -15,18 +15,17 @@
  *    are never closed — proving the fix is necessary.
  */
 
-import * as http from 'http';
 import * as net from 'net';
+import * as http from 'http';
 import { randomUUID } from 'crypto';
+import { logger } from '@librechat/data-schemas';
 import { Agent, fetch as undiciFetch } from 'undici';
-import { Server as McpServerCore } from '@modelcontextprotocol/sdk/server/index.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { Server as McpServerCore } from '@modelcontextprotocol/sdk/server/index.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { logger } from '@librechat/data-schemas';
-import { MCPConnection } from '~/mcp/connection';
-
 import type { Socket } from 'net';
+import { MCPConnection } from '~/mcp/connection';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -39,11 +38,19 @@ jest.mock('@librechat/data-schemas', () => ({
 
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
 jest.mock('~/mcp/mcpConfig', () => ({
-  mcpConfig: { CONNECTION_CHECK_TTL: 0 },
+  mcpConfig: {
+    CONNECTION_CHECK_TTL: 0,
+    TOOLS_LIST_MAX_PAGES: 50,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+  },
 }));
 
 const mockLogger = logger as jest.Mocked<typeof logger>;
@@ -538,11 +545,15 @@ describe('MCPConnection SSE 404 handling – session-aware', () => {
     });
   }
 
-  function fire404(conn: MCPConnection, transport: ReturnType<typeof makeTransportStub>) {
+  function fireSSEError(
+    conn: MCPConnection,
+    transport: ReturnType<typeof makeTransportStub>,
+    code = 404,
+  ) {
     (
       conn as unknown as { setupTransportErrorHandlers: (t: unknown) => void }
     ).setupTransportErrorHandlers(transport);
-    const sseError = Object.assign(new Error('Failed to open SSE stream'), { code: 404 });
+    const sseError = Object.assign(new Error('Failed to open SSE stream'), { code });
     transport.onerror?.(sseError);
   }
 
@@ -556,7 +567,7 @@ describe('MCPConnection SSE 404 handling – session-aware', () => {
     const transport = makeTransportStub();
     const emitSpy = jest.spyOn(conn, 'emit');
 
-    fire404(conn, transport);
+    fireSSEError(conn, transport);
 
     expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('no session'));
     expect(emitSpy).not.toHaveBeenCalledWith('connectionChange', 'error');
@@ -567,7 +578,7 @@ describe('MCPConnection SSE 404 handling – session-aware', () => {
     const transport = makeTransportStub('existing-session-id');
     const emitSpy = jest.spyOn(conn, 'emit');
 
-    fire404(conn, transport);
+    fireSSEError(conn, transport);
 
     expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('session lost'));
     expect(emitSpy).toHaveBeenCalledWith('connectionChange', 'error');
@@ -578,10 +589,32 @@ describe('MCPConnection SSE 404 handling – session-aware', () => {
     const transport = makeTransportStub('');
     const emitSpy = jest.spyOn(conn, 'emit');
 
-    fire404(conn, transport);
+    fireSSEError(conn, transport);
+
+    expect(emitSpy).not.toHaveBeenCalledWith('connectionChange', 'error');
+  });
+
+  it('treats a 406 before session establishment as an unsupported optional SSE stream', () => {
+    const conn = makeConn();
+    const transport = makeTransportStub();
+    const emitSpy = jest.spyOn(conn, 'emit');
+
+    fireSSEError(conn, transport, 406);
 
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('no session'));
     expect(emitSpy).not.toHaveBeenCalledWith('connectionChange', 'error');
   });
+
+  it('falls through on a 406 when a session already exists', () => {
+    const conn = makeConn();
+    const transport = makeTransportStub('existing-session-id');
+    const emitSpy = jest.spyOn(conn, 'emit');
+
+    fireSSEError(conn, transport, 406);
+
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('session lost'));
+    expect(emitSpy).toHaveBeenCalledWith('connectionChange', 'error');
+  });
 });
 
 describe('MCPConnection SSE stream disconnect handling', () => {
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts
new file mode 100644
index 00000000000..3ef669bb94f
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts
@@ -0,0 +1,277 @@
+import { Keyv } from 'keyv';
+import type { IUser } from '@librechat/data-schemas';
+import type {
+  OAuthClientInformation,
+  OAuthStoredClientMetadata,
+  MCPOAuthTokens,
+} from '~/mcp/oauth';
+import {
+  MockKeyv,
+  InMemoryTokenStore,
+  createOAuthMCPServer,
+  type OAuthTestServer,
+} from './helpers/oauthTestServer';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { FlowStateManager } from '~/flow/manager';
+import { MCPConnection } from '~/mcp/connection';
+import { MCPTokenStorage } from '~/mcp/oauth';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+  getTenantId: jest.fn(),
+  tenantStorage: {
+    getStore: jest.fn(),
+    run: jest.fn((_context, fn: () => Promise<unknown>) => fn()),
+  },
+  encryptV2: jest.fn(async (val: string) => `enc:${val}`),
+  decryptV2: jest.fn(async (val: string) => val.replace(/^enc:/, '')),
+}));
+
+jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
+  resolveHostnameSSRF: jest.fn(async () => false),
+}));
+
+jest.mock('~/mcp/mcpConfig', () => ({
+  mcpConfig: {
+    CONNECTION_CHECK_TTL: 0,
+    USER_CONNECTION_IDLE_TIMEOUT: 30 * 60 * 1000,
+    TOOLS_LIST_MAX_PAGES: 50,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+  },
+}));
+
+const SERVER_NAME = 'sdk-oauth-server';
+const USER_ID = 'sdk-user';
+const CLIENT_ID = 'librechat-sdk-test-client';
+
+async function safeDisconnect(conn: MCPConnection | null): Promise<void> {
+  if (!conn) {
+    return;
+  }
+  (conn as unknown as { shouldStopReconnecting: boolean }).shouldStopReconnecting = true;
+  conn.removeAllListeners();
+  await conn.disconnect().catch(() => undefined);
+}
+
+function createFlowManager(): FlowStateManager<MCPOAuthTokens | null> {
+  return new FlowStateManager(new MockKeyv<MCPOAuthTokens | null>() as unknown as Keyv, {
+    ttl: 30000,
+    ci: true,
+  });
+}
+
+async function issueTokens(server: OAuthTestServer, scope = 'read'): Promise<MCPOAuthTokens> {
+  const authUrl = new URL('authorize', server.url);
+  authUrl.searchParams.set('redirect_uri', 'http://localhost');
+  authUrl.searchParams.set('state', 'sdk-test');
+  authUrl.searchParams.set('client_id', CLIENT_ID);
+  authUrl.searchParams.set('scope', scope);
+  authUrl.searchParams.set('resource', server.resourceUrl);
+
+  const authRes = await fetch(authUrl, { redirect: 'manual' });
+  const location = authRes.headers.get('location');
+  if (!location) {
+    throw new Error(`Authorization failed with ${authRes.status}`);
+  }
+  const code = new URL(location).searchParams.get('code');
+  if (!code) {
+    throw new Error('Authorization response did not include a code');
+  }
+
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    client_id: CLIENT_ID,
+    resource: server.resourceUrl,
+  });
+  const tokenRes = await fetch(new URL('token', server.url), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  if (!tokenRes.ok) {
+    throw new Error(`Token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+  }
+  const tokens = (await tokenRes.json()) as {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+  };
+  return {
+    ...tokens,
+    obtained_at: Date.now(),
+    expires_at: Date.now() + tokens.expires_in * 1000,
+  };
+}
+
+async function storeTokens(
+  tokenStore: InMemoryTokenStore,
+  server: OAuthTestServer,
+  tokens: MCPOAuthTokens,
+  scope = 'read',
+): Promise<void> {
+  const clientInfo: OAuthClientInformation = {
+    client_id: CLIENT_ID,
+    redirect_uris: ['http://localhost'],
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+    scope,
+  };
+  const metadata: OAuthStoredClientMetadata = {
+    issuer: server.url.replace(/\/$/, ''),
+    authorization_endpoint: new URL('authorize', server.url).href,
+    token_endpoint: new URL('token', server.url).href,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    token_endpoint_auth_methods_supported: ['none'],
+    scopes_supported: scope.split(/\s+/).filter(Boolean),
+    resource: server.resourceUrl,
+  };
+
+  await MCPTokenStorage.storeTokens({
+    userId: USER_ID,
+    serverName: SERVER_NAME,
+    tokens,
+    createToken: tokenStore.createToken,
+    updateToken: tokenStore.updateToken,
+    findToken: tokenStore.findToken,
+    clientInfo,
+    metadata,
+  });
+}
+
+describe('MCPConnectionFactory OAuth against real SDK Streamable HTTP server', () => {
+  let server: OAuthTestServer;
+  let connection: MCPConnection | null;
+  let tokenStore: InMemoryTokenStore;
+
+  beforeEach(() => {
+    MCPConnection.clearCooldown(SERVER_NAME);
+    connection = null;
+    tokenStore = new InMemoryTokenStore();
+  });
+
+  afterEach(async () => {
+    await safeDisconnect(connection);
+    if (server) {
+      await server.close();
+    }
+    jest.clearAllMocks();
+  });
+
+  it('silently refreshes a server-rejected token and reconnects with the MCP resource parameter', async () => {
+    server = await createOAuthMCPServer({
+      issueRefreshTokens: true,
+      requireResourceParameter: true,
+      tokenScopes: ['read'],
+      scopesSupported: ['read'],
+    });
+    const initialTokens = await issueTokens(server);
+    await storeTokens(tokenStore, server, initialTokens);
+
+    server.issuedTokens.delete(initialTokens.access_token);
+
+    connection = await MCPConnectionFactory.create(
+      {
+        serverName: SERVER_NAME,
+        serverConfig: {
+          type: 'streamable-http',
+          url: server.url,
+          initTimeout: 15000,
+        },
+      },
+      {
+        useOAuth: true,
+        user: { id: USER_ID } as IUser,
+        flowManager: createFlowManager(),
+        tokenMethods: {
+          findToken: tokenStore.findToken,
+          createToken: tokenStore.createToken,
+          updateToken: tokenStore.updateToken,
+          deleteTokens: tokenStore.deleteTokens,
+        },
+      },
+    );
+
+    expect(await connection.isConnected()).toBe(true);
+    const tools = await connection.fetchTools();
+    expect(tools.some((tool) => tool.name === 'echo')).toBe(true);
+
+    const refreshRequest = server.tokenRequests.find(
+      (request) => request.grantType === 'refresh_token',
+    );
+    expect(refreshRequest).toEqual(
+      expect.objectContaining({
+        resource: server.resourceUrl,
+        clientId: CLIENT_ID,
+      }),
+    );
+
+    const storedAccessToken = await tokenStore.findToken({
+      userId: USER_ID,
+      type: 'mcp_oauth',
+      identifier: `mcp:${SERVER_NAME}`,
+    });
+    expect(storedAccessToken?.token).not.toBe(`enc:${initialTokens.access_token}`);
+  });
+
+  it('does not silently refresh an SDK insufficient_scope challenge before starting OAuth', async () => {
+    server = await createOAuthMCPServer({
+      issueRefreshTokens: true,
+      requireResourceParameter: true,
+      tokenScopes: ['read'],
+      requiredScopes: ['write'],
+      scopesSupported: ['write'],
+    });
+    const initialTokens = await issueTokens(server);
+    await storeTokens(tokenStore, server, initialTokens);
+
+    const oauthStart = jest.fn(async (_authorizationUrl: string): Promise<void> => undefined);
+    await expect(
+      MCPConnectionFactory.create(
+        {
+          serverName: SERVER_NAME,
+          serverConfig: {
+            type: 'streamable-http',
+            url: server.url,
+            initTimeout: 15000,
+          },
+        },
+        {
+          useOAuth: true,
+          user: { id: USER_ID } as IUser,
+          flowManager: createFlowManager(),
+          tokenMethods: {
+            findToken: tokenStore.findToken,
+            createToken: tokenStore.createToken,
+            updateToken: tokenStore.updateToken,
+            deleteTokens: tokenStore.deleteTokens,
+          },
+          returnOnOAuth: true,
+          oauthStart,
+        },
+      ),
+    ).rejects.toThrow();
+
+    expect(
+      server.tokenRequests.filter((request) => request.grantType === 'refresh_token'),
+    ).toHaveLength(0);
+    expect(oauthStart).toHaveBeenCalledTimes(1);
+    const authorizationUrl = new URL(oauthStart.mock.calls[0][0]);
+    expect(authorizationUrl.searchParams.get('resource')).toBe(server.resourceUrl);
+    expect(authorizationUrl.searchParams.get('scope')).toBe('write');
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
index 9ca8cc658b0..e64e9462951 100644
--- a/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
@@ -1,15 +1,21 @@
-import { logger, getTenantId } from '@librechat/data-schemas';
+import { logger, getTenantId, tenantStorage } from '@librechat/data-schemas';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { FlowStateManager } from '~/flow/manager';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
 import type * as t from '~/mcp/types';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { MCPConnection } from '~/mcp/connection';
 import { MCPOAuthHandler, MCPTokenStorage } from '~/mcp/oauth';
+import { preProcessGraphTokens } from '~/utils/graph';
+import { PENDING_STALE_MS } from '~/flow/manager';
+import { MCPConnection } from '~/mcp/connection';
 import { processMCPEnv } from '~/utils';
 
 jest.mock('~/mcp/connection');
 jest.mock('~/mcp/oauth');
+jest.mock('~/utils/graph', () => ({
+  ...jest.requireActual('~/utils/graph'),
+  preProcessGraphTokens: jest.fn(async (options) => options),
+}));
 jest.mock('~/utils');
 jest.mock('~/mcp/group', () => ({
   enrichUserForMcpGroups: jest.fn(
@@ -24,14 +30,52 @@ jest.mock('@librechat/data-schemas', () => ({
     debug: jest.fn(),
   },
   getTenantId: jest.fn(),
+  tenantStorage: {
+    getStore: jest.fn(),
+    run: jest.fn((_context, fn: () => Promise<unknown>) => fn()),
+  },
 }));
 
 const mockLogger = logger as jest.Mocked<typeof logger>;
+const mockTenantStorage = tenantStorage as unknown as {
+  getStore: jest.Mock;
+  run: jest.Mock;
+};
 const mockProcessMCPEnv = processMCPEnv as jest.MockedFunction<typeof processMCPEnv>;
+const mockPreProcessGraphTokens = preProcessGraphTokens as jest.MockedFunction<
+  typeof preProcessGraphTokens
+>;
 const mockMCPConnection = MCPConnection as jest.MockedClass<typeof MCPConnection>;
 const mockMCPOAuthHandler = MCPOAuthHandler as jest.Mocked<typeof MCPOAuthHandler>;
 const mockMCPTokenStorage = MCPTokenStorage as jest.Mocked<typeof MCPTokenStorage>;
 
+class InspectableMCPConnectionFactory extends MCPConnectionFactory {
+  public constructor(
+    basic: t.BasicConnectionOptions,
+    options?: t.OAuthConnectionOptions | t.UserConnectionContext,
+  ) {
+    super(basic, options);
+  }
+
+  public async createConnectionForTest(): Promise<MCPConnection> {
+    return await this.createConnection();
+  }
+
+  public getRequestScopedOAuthState(): {
+    signal?: AbortSignal;
+    oauthStart?: (authURL: string) => Promise<void>;
+    oauthEnd?: () => Promise<void>;
+    returnOnOAuth?: boolean;
+  } {
+    return {
+      signal: this.signal,
+      oauthStart: this.oauthStart,
+      oauthEnd: this.oauthEnd,
+      returnOnOAuth: this.returnOnOAuth,
+    };
+  }
+}
+
 describe('MCPConnectionFactory', () => {
   let mockUser: IUser | undefined;
   let mockServerConfig: t.MCPOptions;
@@ -40,6 +84,12 @@ describe('MCPConnectionFactory', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    // Clear process-local silent-refresh in-flight map so a leftover entry
+    // from a prior test (e.g. one that errored before its `finally` ran)
+    // cannot cause a later test to join a stale promise.
+    (
+      MCPConnectionFactory as unknown as { inflightSilentRefreshes: Map<string, unknown> }
+    ).inflightSilentRefreshes.clear();
     mockUser = {
       id: 'user123',
       email: 'test@example.com',
@@ -56,6 +106,7 @@ describe('MCPConnectionFactory', () => {
       createFlow: jest.fn(),
       createFlowWithHandler: jest.fn(),
       getFlowState: jest.fn(),
+      completeFlow: jest.fn().mockResolvedValue(true),
       deleteFlow: jest.fn().mockResolvedValue(true),
     } as unknown as jest.Mocked<FlowStateManager<MCPOAuthTokens | null>>;
 
@@ -71,7 +122,32 @@ describe('MCPConnectionFactory', () => {
     } as unknown as jest.Mocked<MCPConnection>;
 
     mockMCPConnection.mockImplementation(() => mockConnectionInstance);
+    mockPreProcessGraphTokens.mockImplementation(async (options) => options);
     mockProcessMCPEnv.mockReturnValue(mockServerConfig);
+    mockMCPOAuthHandler.generateFlowId.mockImplementation(
+      (userId: string, serverName: string, tenantId?: string) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+    );
+    mockMCPOAuthHandler.generateTokenFlowId.mockImplementation(
+      (userId: string, serverName: string, tenantId?: string) => {
+        const flowId = mockMCPOAuthHandler.generateFlowId(userId, serverName);
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+    );
+    mockMCPOAuthHandler.buildStoredClientMetadata.mockImplementation(
+      (metadata, resourceMetadata) =>
+        metadata
+          ? {
+              ...metadata,
+              ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+            }
+          : undefined,
+    );
+    mockTenantStorage.getStore.mockReturnValue(undefined);
+    mockTenantStorage.run.mockImplementation((_context, fn: () => Promise<unknown>) => fn());
+    (getTenantId as jest.Mock).mockReturnValue(undefined);
   });
 
   describe('static create method', () => {
@@ -96,10 +172,85 @@ describe('MCPConnectionFactory', () => {
         userId: undefined,
         oauthTokens: null,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
       expect(mockConnectionInstance.connect).toHaveBeenCalled();
     });
 
+    it('should pre-process Graph placeholders before connection config resolution', async () => {
+      const graphTokenResolver = jest.fn();
+      const serverConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp?token={{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+      };
+      const graphProcessedConfig: t.MCPOptions = {
+        ...serverConfig,
+        url: 'https://api.example.com/mcp?token=resolved-graph-token',
+      };
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig,
+      };
+
+      mockPreProcessGraphTokens.mockResolvedValue(graphProcessedConfig);
+      mockProcessMCPEnv.mockReturnValue(graphProcessedConfig);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create(basicOptions, {
+        user: mockUser,
+        graphTokenResolver,
+      });
+
+      expect(mockPreProcessGraphTokens).toHaveBeenCalledWith(
+        serverConfig,
+        expect.objectContaining({
+          user: mockUser,
+          graphTokenResolver,
+        }),
+      );
+      expect(mockProcessMCPEnv).toHaveBeenCalledWith(
+        expect.objectContaining({
+          options: graphProcessedConfig,
+        }),
+      );
+      expect(mockMCPConnection).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: graphProcessedConfig,
+        }),
+      );
+    });
+
+    it('should register fallback oauthRequired handler for non-OAuth connections', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create(basicOptions);
+
+      expect(mockConnectionInstance.on).toHaveBeenCalledWith('oauthRequired', expect.any(Function));
+
+      const onCall = (mockConnectionInstance.on as jest.Mock).mock.calls.find(
+        ([event]: [string]) => event === 'oauthRequired',
+      );
+      const handler = onCall![1] as () => void;
+      handler();
+
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
+        'oauthFailed',
+        expect.objectContaining({ message: 'Server does not use OAuth' }),
+      );
+      // The fallback `oauthRequired` listener is intentionally kept attached
+      // for the connection's lifetime so mid-session 401s are still handled.
+      expect(mockConnectionInstance.removeListener).not.toHaveBeenCalledWith(
+        'oauthRequired',
+        expect.any(Function),
+      );
+    });
+
     it('should create a connection with OAuth', async () => {
       const basicOptions = {
         serverName: 'test-server',
@@ -144,8 +295,44 @@ describe('MCPConnectionFactory', () => {
         userId: 'user123',
         oauthTokens: mockTokens,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
     });
+
+    it('should tenant-scope mcp_get_tokens flow locks', async () => {
+      mockTenantStorage.getStore.mockReturnValueOnce({ tenantId: 'tenant-a' });
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create(basicOptions, oauthOptions);
+
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+        expect.any(Function),
+        undefined,
+      );
+    });
   });
 
   describe('OAuth token handling', () => {
@@ -204,6 +391,8 @@ describe('MCPConnectionFactory', () => {
         userId: 'user123',
         oauthTokens: null,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
       expect(mockLogger.debug).toHaveBeenCalledWith(
         expect.stringContaining('No existing tokens found or error loading tokens'),
@@ -272,6 +461,7 @@ describe('MCPConnectionFactory', () => {
 
       expect(oauthRequiredHandler!).toBeDefined();
 
+      (getTenantId as jest.Mock).mockReturnValue(undefined);
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalledWith(
@@ -283,6 +473,7 @@ describe('MCPConnectionFactory', () => {
         undefined,
         oauthOptions.tokenMethods.findToken,
         undefined,
+        'test-tenant',
       );
 
       // initFlow must be awaited BEFORE the redirect to guarantee state is stored
@@ -377,7 +568,7 @@ describe('MCPConnectionFactory', () => {
       );
     });
 
-    it('should skip new OAuth flow initiation when a PENDING flow already exists (returnOnOAuth)', async () => {
+    it('should re-issue the stored OAuth URL when a PENDING flow already exists (returnOnOAuth)', async () => {
       const basicOptions = {
         serverName: 'test-server',
         serverConfig: mockServerConfig,
@@ -395,7 +586,10 @@ describe('MCPConnectionFactory', () => {
       mockFlowManager.getFlowState.mockResolvedValue({
         status: 'PENDING',
         type: 'mcp_oauth',
-        metadata: { codeVerifier: 'existing-verifier' },
+        metadata: {
+          codeVerifier: 'existing-verifier',
+          authorizationUrl: 'https://auth.example.com/existing',
+        },
         createdAt: Date.now(),
       });
       mockConnectionInstance.isConnected.mockResolvedValue(false);
@@ -417,10 +611,73 @@ describe('MCPConnectionFactory', () => {
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(oauthOptions.oauthStart).toHaveBeenCalledWith(
+        'https://auth.example.com/existing',
+        expect.objectContaining({ expiresAt: expect.any(Number) }),
+      );
       expect(mockFlowManager.deleteFlow).not.toHaveBeenCalled();
       expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
         'oauthFailed',
-        expect.objectContaining({ message: 'OAuth flow initiated - return early' }),
+        expect.objectContaining({ message: 'Pending OAuth flow reused - return early' }),
+      );
+    });
+
+    it('should emit oauthFailed when a PENDING flow expires before replay (returnOnOAuth)', async () => {
+      const createdAt = 1000;
+      const firstNow = createdAt + PENDING_STALE_MS - 1;
+      const expiredNow = createdAt + PENDING_STALE_MS;
+      jest
+        .spyOn(Date, 'now')
+        .mockReturnValueOnce(firstNow)
+        .mockReturnValueOnce(expiredNow)
+        .mockReturnValue(expiredNow);
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+        user: mockUser,
+      };
+
+      const oauthOptions: t.OAuthConnectionOptions = {
+        user: mockUser,
+        useOAuth: true,
+        returnOnOAuth: true,
+        oauthStart: jest.fn(),
+        flowManager: mockFlowManager,
+      };
+
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        type: 'mcp_oauth',
+        metadata: {
+          codeVerifier: 'existing-verifier',
+          authorizationUrl: 'https://auth.example.com/existing',
+        },
+        createdAt,
+      });
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(oauthOptions.oauthStart).not.toHaveBeenCalled();
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
+        'oauthFailed',
+        expect.objectContaining({ message: 'Pending OAuth flow expired before replay' }),
       );
     });
 
@@ -610,6 +867,7 @@ describe('MCPConnectionFactory', () => {
 
       // processMCPEnv must return config with url so handleOAuthRequired proceeds
       mockProcessMCPEnv.mockReturnValue(sseConfig);
+      (getTenantId as jest.Mock).mockReturnValue('test-tenant');
       mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
       mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
       mockFlowManager.getFlowState.mockResolvedValue(null);
@@ -630,13 +888,14 @@ describe('MCPConnectionFactory', () => {
         // Expected to fail
       }
 
+      (getTenantId as jest.Mock).mockReturnValue(undefined);
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       // initFlow must be called BEFORE oauthStart and createFlow
       expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
         'flow123',
         'mcp_oauth',
-        expect.objectContaining(mockFlowData.flowMetadata),
+        expect.objectContaining({ ...mockFlowData.flowMetadata, tenantId: 'test-tenant' }),
       );
       const initCallOrder = mockFlowManager.initFlow.mock.invocationCallOrder[0];
       const oauthStartCallOrder = (oauthOptions.oauthStart as jest.Mock).mock
@@ -741,28 +1000,17 @@ describe('MCPConnectionFactory', () => {
         undefined,
       );
     });
-  });
-
-  describe('connection retry logic', () => {
-    it('should establish connection successfully', async () => {
-      const basicOptions = {
-        serverName: 'test-server',
-        serverConfig: mockServerConfig, // Use default 5000ms timeout
-      };
-
-      mockConnectionInstance.connect.mockResolvedValue(undefined);
-      mockConnectionInstance.isConnected.mockResolvedValue(true);
-
-      const connection = await MCPConnectionFactory.create(basicOptions);
 
-      expect(connection).toBe(mockConnectionInstance);
-      expect(mockConnectionInstance.connect).toHaveBeenCalledTimes(1);
-    });
+    it('should silently refresh tokens on oauthRequired without invoking interactive flow', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
 
-    it('should handle OAuth errors during connection attempts', async () => {
       const basicOptions = {
         serverName: 'test-server',
-        serverConfig: mockServerConfig,
+        serverConfig: sseConfig,
       };
 
       const oauthOptions = {
@@ -778,33 +1026,74 @@ describe('MCPConnectionFactory', () => {
         },
       };
 
-      const oauthError = new Error('Non-200 status code (401)');
-      (oauthError as unknown as Record<string, unknown>).isOAuthError = true;
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
 
-      mockConnectionInstance.connect.mockRejectedValue(oauthError);
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // The silent refresh path: createFlowWithHandler executes the handler
+      // (which calls forceRefreshTokens) and returns the refreshed tokens.
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
       mockConnectionInstance.isConnected.mockResolvedValue(false);
 
-      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow(
-        'Non-200 status code (401)',
-      );
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
 
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('OAuth required, stopping connection attempts'),
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail because connection itself is mocked as not connected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          userId: 'user123',
+          serverName: 'test-server',
+          findToken: oauthOptions.tokenMethods.findToken,
+          createToken: oauthOptions.tokenMethods.createToken,
+        }),
       );
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // Silent refresh succeeded — interactive flow must NOT be initiated.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
     });
-  });
 
-  describe('isOAuthError method', () => {
-    it('should identify OAuth errors by message content', async () => {
+    it('should fall back to interactive OAuth when silent refresh returns null', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
       const basicOptions = {
         serverName: 'test-server',
-        serverConfig: mockServerConfig,
+        serverConfig: sseConfig,
       };
 
       const oauthOptions = {
         useOAuth: true as const,
         user: mockUser,
         flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
         tokenMethods: {
           findToken: jest.fn(),
           createToken: jest.fn(),
@@ -813,32 +1102,1846 @@ describe('MCPConnectionFactory', () => {
         },
       };
 
-      const error401 = new Error('401 Unauthorized');
+      const mockFlowData = {
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'random-state',
+        },
+      };
 
-      mockConnectionInstance.connect.mockRejectedValue(error401);
+      const interactiveTokens: MCPOAuthTokens = {
+        access_token: 'interactive-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Silent refresh attempt returns null (no refresh token / refresh failed).
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(interactiveTokens);
       mockConnectionInstance.isConnected.mockResolvedValue(false);
 
-      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow('401');
-      expect(mockLogger.info).toHaveBeenCalledWith(
-        expect.stringContaining('OAuth required, stopping connection attempts'),
-      );
-    });
-  });
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
 
-  describe('discoverTools static method', () => {
-    const mockTools = [
-      { name: 'tool1', description: 'First tool', inputSchema: { type: 'object' } },
-      { name: 'tool2', description: 'Second tool', inputSchema: { type: 'object' } },
-    ];
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail
+      }
 
-    it('should discover tools from a successfully connected server', async () => {
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Silent refresh was attempted, but yielded no tokens.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      // Fall-through behavior: interactive flow runs.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(interactiveTokens);
+    });
+
+    it('should silently refresh tokens for returnOnOAuth path without redirecting', async () => {
       const basicOptions = {
         serverName: 'test-server',
-        serverConfig: mockServerConfig,
+        serverConfig: {
+          ...mockServerConfig,
+          url: 'https://api.example.com',
+          type: 'sse' as const,
+        } as t.SSEOptions,
       };
 
-      mockConnectionInstance.connect.mockResolvedValue(undefined);
-      mockConnectionInstance.isConnected.mockResolvedValue(true);
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        returnOnOAuth: true,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // returnOnOAuth interactive path must NOT trigger when silent refresh succeeds.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(oauthOptions.oauthStart).not.toHaveBeenCalled();
+    });
+
+    it('should fall back to interactive OAuth when silent refresh throws unexpectedly', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const mockFlowData = {
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'random-state',
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Silent refresh path throws — must be swallowed and interactive runs.
+      mockMCPTokenStorage.forceRefreshTokens.mockRejectedValueOnce(new Error('refresh boom'));
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue({
+        access_token: 'fallback-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      } as MCPOAuthTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // The thrown silent refresh error must be swallowed and the interactive
+      // flow used as a fallback so the user is never stuck.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+    });
+
+    it('should bypass any flow cache on silent refresh and invalidate mcp_get_tokens cache (regression for stale cached token reuse)', async () => {
+      // Reproduces the cache-collision flagged by Codex on PR #13369: when an
+      // earlier `getOAuthTokens` call cached its (now server-rejected) tokens
+      // under the `mcp_get_tokens` flow, the silent refresh must NOT share or
+      // reuse that cache. The fix bypasses `FlowStateManager` entirely for the
+      // force-refresh, calls `MCPTokenStorage.forceRefreshTokens` directly,
+      // and invalidates the `mcp_get_tokens` cache afterwards so the next
+      // `getOAuthTokens` reads the freshly persisted tokens.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const staleCachedTokens: MCPOAuthTokens = {
+        access_token: 'stale-cached-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      const freshlyRefreshedTokens: MCPOAuthTokens = {
+        access_token: 'freshly-refreshed-access',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Simulate the real FlowStateManager cache behavior for `mcp_get_tokens`:
+      // a prior call cached `staleCachedTokens` and the cache is still
+      // non-expired, so `getOAuthTokens` returns it without re-running the
+      // handler. Silent refresh must NOT route through this cached flow.
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, _handler) => {
+        if (type === 'mcp_get_tokens') {
+          return staleCachedTokens;
+        }
+        return null;
+      });
+      // `invalidateGetTokensFlow` only deletes COMPLETED states (to avoid
+      // breaking concurrent PENDING joiners), so reflect that here.
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'COMPLETED' as const,
+        type: 'mcp_get_tokens',
+        metadata: {},
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: staleCachedTokens,
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(freshlyRefreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // The refresh runs against the token storage directly — not through any
+      // `createFlowWithHandler` flow that could return a stale cached value.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockFlowManager.createFlowWithHandler).not.toHaveBeenCalledWith(
+        expect.anything(),
+        'mcp_force_refresh_tokens',
+        expect.anything(),
+        expect.anything(),
+      );
+      // The connection receives the FRESHLY refreshed tokens, NOT the stale
+      // cached ones — that's the whole point of the fix.
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(freshlyRefreshedTokens);
+      expect(mockConnectionInstance.setOAuthTokens).not.toHaveBeenCalledWith(staleCachedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // The cached `mcp_get_tokens` flow state is dropped so the next
+      // `getOAuthTokens` call reads the freshly persisted tokens from storage.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_get_tokens');
+    });
+
+    it('should coalesce concurrent silent refresh attempts into a single redemption', async () => {
+      // Reproduces the concurrent-redemption race flagged by Codex on PR #13369:
+      // if two 401s for the same user/server race the silent refresh, they
+      // must share one in-flight refresh-token redemption — providers that
+      // rotate refresh tokens reject the second redemption, otherwise causing
+      // an unnecessary interactive OAuth fallback.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Hold a single in-flight refresh open until both concurrent callers
+      // have joined the lock. `mockImplementationOnce` (rather than the
+      // persistent `mockImplementation`) ensures this never-resolving promise
+      // does not leak into later tests' default mock behavior.
+      let resolveRefresh: ((tokens: MCPOAuthTokens) => void) | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce(
+        () =>
+          new Promise<MCPOAuthTokens>((res) => {
+            resolveRefresh = res;
+          }),
+      );
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      // Fire two concurrent oauthRequired events; both must share the same
+      // in-flight refresh attempt.
+      const first = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+      const second = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Let the in-flight lock register, then resolve the single redemption.
+      await Promise.resolve();
+      resolveRefresh!(refreshedTokens);
+      await Promise.all([first, second]);
+
+      // Exactly one refresh-token redemption was issued.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(1);
+      // Both callers set the connection's tokens with the same refreshed value.
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+    });
+
+    it('should keep the in-flight silent-refresh lock until the aborted refresh settles', async () => {
+      // A timed-out caller should fall back to interactive OAuth immediately,
+      // but the shared lock must remain briefly while the underlying abortable
+      // refresh settles so another 401 cannot immediately redeem the same
+      // rotating refresh token.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'late-refresh',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      let refreshSignal: AbortSignal | undefined;
+      let resolveRefresh: ((tokens: MCPOAuthTokens) => void) | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>((resolve) => {
+          resolveRefresh = resolve;
+        });
+      });
+      // Provide a no-op interactive fallback so the handler can complete.
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected — initial connection mocked to fail.
+      }
+
+      // Switch to fake timers only for the silent-refresh attempt so we can
+      // fast-forward past its timeout without slowing the test suite.
+      jest.useFakeTimers();
+      try {
+        const firstAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(2_001);
+        await firstAttempt;
+
+        const inflightMap = (
+          MCPConnectionFactory as unknown as {
+            inflightSilentRefreshes: Map<string, unknown>;
+          }
+        ).inflightSilentRefreshes;
+        expect(inflightMap.size).toBe(1);
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+
+        const secondAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await secondAttempt;
+        expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(1);
+
+        resolveRefresh!(refreshedTokens);
+        for (let i = 0; i < 10; i += 1) {
+          await Promise.resolve();
+        }
+        expect(inflightMap.size).toBe(0);
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should drop timed-out silent-refresh locks after abort grace if refresh stays hung', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let firstRefreshSignal: AbortSignal | undefined;
+      let secondRefreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens
+        .mockImplementationOnce((params) => {
+          firstRefreshSignal = params.signal;
+          return new Promise<MCPOAuthTokens>(() => {});
+        })
+        .mockImplementationOnce((params) => {
+          secondRefreshSignal = params.signal;
+          return Promise.resolve(null as unknown as MCPOAuthTokens);
+        });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const firstAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(2_001);
+        await firstAttempt;
+
+        const inflightMap = (
+          MCPConnectionFactory as unknown as {
+            inflightSilentRefreshes: Map<string, unknown>;
+          }
+        ).inflightSilentRefreshes;
+        expect(inflightMap.size).toBe(1);
+        expect(firstRefreshSignal?.aborted).toBe(true);
+
+        await jest.advanceTimersByTimeAsync(1_001);
+        expect(inflightMap.size).toBe(0);
+
+        const secondAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await secondAttempt;
+
+        expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(2);
+        expect(secondRefreshSignal).toBeDefined();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should reserve interactive OAuth fallback time when initTimeout is omitted', async () => {
+      const sseConfig = {
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let refreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>(() => {});
+      });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const attempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(5_001);
+        await attempt;
+
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should cap silent refresh below half of a small connection timeout', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+        initTimeout: 5000,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let refreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>(() => {});
+      });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const attempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(1_999);
+        expect(refreshSignal?.aborted).not.toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+
+        await jest.advanceTimersByTimeAsync(2);
+        await attempt;
+
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should skip silent refresh for 403 OAuth reauthorization failures', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      const forbiddenError = Object.assign(new Error('Non-200 status code (403)'), { code: 403 });
+      await oauthRequiredHandler!({
+        serverUrl: 'https://api.example.com',
+        error: forbiddenError,
+      });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).not.toHaveBeenCalled();
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+    });
+
+    it('should not process already resolved configs for request OAuth handlers', () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com/${SHOULD_NOT_EXPAND}',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+      mockProcessMCPEnv.mockClear();
+
+      const cleanup = MCPConnectionFactory.attachRequestOAuthHandler(
+        {
+          serverName: 'test-server',
+          serverConfig: sseConfig,
+          skipEnvProcessing: true,
+        },
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart: jest.fn(),
+        },
+        mockConnectionInstance,
+      );
+
+      expect(mockProcessMCPEnv).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.on).toHaveBeenCalledWith(
+        'oauthReauthenticationRequired',
+        expect.any(Function),
+      );
+
+      cleanup();
+    });
+
+    it('should not reuse request-scoped OAuth callbacks after connection is cached', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthStart = jest.fn();
+      const oauthEnd = jest.fn();
+      const requestAbortController = new AbortController();
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart,
+        oauthEnd,
+        signal: requestAbortController.signal,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      await MCPConnectionFactory.create(basicOptions, oauthOptions);
+
+      requestAbortController.abort();
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+
+      await oauthRequiredHandler!({
+        serverUrl: 'https://api.example.com',
+        error: new Error('Non-200 status code (401)'),
+      });
+
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockFlowManager.initFlow).not.toHaveBeenCalled();
+      expect(mockFlowManager.createFlow).not.toHaveBeenCalled();
+      expect(oauthStart).not.toHaveBeenCalled();
+      expect(oauthEnd).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
+        'oauthFailed',
+        expect.objectContaining({ message: 'OAuth reauthentication required' }),
+      );
+    });
+
+    it('should clear request-scoped OAuth callbacks after successful connection', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const oauthStart = jest.fn();
+      const oauthEnd = jest.fn();
+      const requestAbortController = new AbortController();
+      const factory = new InspectableMCPConnectionFactory(
+        {
+          serverName: 'test-server',
+          serverConfig: sseConfig,
+        },
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart,
+          oauthEnd,
+          signal: requestAbortController.signal,
+          returnOnOAuth: true,
+          tokenMethods: {
+            findToken: jest.fn(),
+            createToken: jest.fn(),
+            updateToken: jest.fn(),
+            deleteTokens: jest.fn(),
+          },
+        },
+      );
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await factory.createConnectionForTest();
+
+      expect(mockConnectionInstance.on).toHaveBeenCalledWith('oauthRequired', expect.any(Function));
+      expect(factory.getRequestScopedOAuthState()).toEqual({
+        signal: undefined,
+        oauthStart: undefined,
+        oauthEnd: undefined,
+        returnOnOAuth: false,
+      });
+    });
+
+    it('should let a live request handle cached-connection reauthentication with fresh callbacks', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const staleOAuthStart = jest.fn();
+      const liveOAuthStart = jest.fn();
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const callbackTokens: MCPOAuthTokens = {
+        access_token: 'callback-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockFlowManager.createFlow.mockResolvedValue(callbackTokens);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-live',
+          clientInfo: { client_id: 'client-live' },
+        },
+      });
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+      type Listener = (...args: unknown[]) => void;
+      const handlers: Record<string, Listener[]> = {};
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        (handlers[key] ??= []).push(handler as Listener);
+        return mockConnectionInstance;
+      });
+      mockConnectionInstance.removeListener.mockImplementation((event, handler) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        const list = handlers[key];
+        const index = list?.indexOf(handler as Listener) ?? -1;
+        if (list && index !== -1) {
+          list.splice(index, 1);
+        }
+        return mockConnectionInstance;
+      });
+      mockConnectionInstance.emit.mockImplementation((event, ...args) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        const list = handlers[key];
+        if (!list?.length) {
+          return false;
+        }
+        for (const fn of [...list]) {
+          fn(...args);
+        }
+        return true;
+      });
+
+      await MCPConnectionFactory.create(basicOptions, {
+        useOAuth: true,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: staleOAuthStart,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      });
+
+      const liveStarted = new Promise<void>((resolve) => {
+        liveOAuthStart.mockImplementation(async () => {
+          resolve();
+        });
+      });
+      const cleanup = MCPConnectionFactory.attachRequestOAuthHandler(
+        basicOptions,
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart: liveOAuthStart,
+          tokenMethods: {
+            findToken: jest.fn(),
+            createToken: jest.fn(),
+            updateToken: jest.fn(),
+            deleteTokens: jest.fn(),
+          },
+        },
+        mockConnectionInstance,
+      );
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+
+      mockConnectionInstance.emit('oauthRequired', {
+        serverUrl: 'https://api.example.com',
+        error: new Error('Non-200 status code (401)'),
+      });
+
+      await liveStarted;
+
+      expect(staleOAuthStart).not.toHaveBeenCalled();
+      expect(liveOAuthStart).toHaveBeenCalledWith('https://auth.example.com');
+      expect(handlers.oauthReauthenticationRequired.length).toBe(1);
+
+      cleanup();
+
+      expect(handlers.oauthReauthenticationRequired.length).toBe(0);
+    });
+
+    it('should invalidate completed mcp_oauth cache before falling through to interactive OAuth', async () => {
+      // Regression for the Codex finding "Bypass completed OAuth cache after a
+      // rejected token": when silent refresh returns null and the handler
+      // falls through to interactive OAuth, any recently COMPLETED mcp_oauth
+      // flow must be cleared so the fast-reuse path in `handleOAuthRequired`
+      // can't hand back the very tokens the resource server just rejected.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const completedFlowState = {
+        status: 'COMPLETED' as const,
+        type: 'mcp_oauth',
+        metadata: { state: 'old-csrf-state' },
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: {
+          access_token: 'just-rejected',
+          token_type: 'Bearer',
+          obtained_at: Date.now(),
+        } as MCPOAuthTokens,
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      // First lookup (from invalidateCompletedOAuthFlow) sees the stale
+      // COMPLETED state with the just-rejected tokens; the second lookup
+      // (inside handleOAuthRequired, after deletion) sees nothing and goes
+      // straight to a fresh interactive OAuth flow.
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(completedFlowState)
+        .mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'fresh-csrf-state',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue({
+        access_token: 'freshly-issued',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      } as MCPOAuthTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Completed `mcp_oauth` flow was deleted before the interactive path ran.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      // And the old CSRF state mapping was cleaned up alongside it.
+      expect(mockMCPOAuthHandler.deleteStateMapping).toHaveBeenCalledWith(
+        'old-csrf-state',
+        mockFlowManager,
+      );
+    });
+
+    it('should not invalidate a completed mcp_oauth flow from another tenant', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantBCompletedFlow = {
+        status: 'COMPLETED' as const,
+        type: 'mcp_oauth',
+        metadata: { state: 'tenant-b-state', tenantId: 'tenant-b' },
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: {
+          access_token: 'tenant-b-token',
+          token_type: 'Bearer',
+          obtained_at: Date.now(),
+        } as MCPOAuthTokens,
+      };
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(tenantBCompletedFlow)
+        .mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'tenant-a-state',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      expect(mockMCPOAuthHandler.deleteStateMapping).not.toHaveBeenCalledWith(
+        'tenant-b-state',
+        mockFlowManager,
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        'flow123',
+        'mcp_oauth',
+        expect.objectContaining({ tenantId: 'tenant-a' }),
+      );
+    });
+
+    it('should tenant-scope mcp_oauth flow lookup before completed-flow reuse', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantFlowId = 'tenant:tenant-a:user123:test-server';
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: tenantFlowId,
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'tenant-a-state',
+          tenantId: 'tenant-a',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(tenantFlowId, 'mcp_oauth');
+      expect(mockFlowManager.getFlowState).not.toHaveBeenCalledWith(
+        'user123:test-server',
+        'mcp_oauth',
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        tenantFlowId,
+        'mcp_oauth',
+        expect.objectContaining({ tenantId: 'tenant-a' }),
+      );
+    });
+
+    it('should scope the silent-refresh in-flight lock by tenant', async () => {
+      // Regression for the Codex finding "Scope silent refresh lock by
+      // tenant": two tenants that share the same `userId` and `serverName`
+      // (e.g. when IDs are username-based) must not join each other's
+      // in-flight refresh; otherwise tokens minted under tenant A's
+      // refresh-token would be applied to a tenant-B connection.
+      const tenantMock = getTenantId as jest.MockedFunction<typeof getTenantId>;
+
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantATokens: MCPOAuthTokens = {
+        access_token: 'tenant-a-access',
+        refresh_token: 'tenant-a-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const tenantBTokens: MCPOAuthTokens = {
+        access_token: 'tenant-b-access',
+        refresh_token: 'tenant-b-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      // Build a factory whose tenantId was captured as "tenant-a", trigger a
+      // refresh, then build a second factory under "tenant-b" with the same
+      // userId and serverName. Each refresh must call `forceRefreshTokens`
+      // independently and apply its own tokens.
+      tenantMock.mockReturnValue('tenant-a');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(tenantATokens);
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+      const tenantAHandler = oauthRequiredHandler!;
+
+      // Reset oauthRequiredHandler capture for the second factory.
+      tenantMock.mockReturnValue('tenant-b');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(tenantBTokens);
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+      const tenantBHandler = oauthRequiredHandler!;
+
+      await Promise.all([
+        tenantAHandler({ serverUrl: 'https://api.example.com' }),
+        tenantBHandler({ serverUrl: 'https://api.example.com' }),
+      ]);
+
+      // Each tenant ran its own refresh and applied its own tokens — no
+      // cross-tenant coalescing.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(2);
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(tenantATokens);
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(tenantBTokens);
+    });
+
+    it('should restore captured tenant context while silently refreshing tokens', async () => {
+      const capturedContext = {
+        tenantId: 'tenant-a',
+        userId: 'user123',
+        requestId: 'req-123',
+      };
+      mockTenantStorage.getStore.mockReturnValueOnce(capturedContext);
+
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'tenant-access',
+        refresh_token: 'tenant-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockTenantStorage.run).toHaveBeenCalledWith(capturedContext, expect.any(Function));
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+    });
+
+    it('should NOT delete a PENDING mcp_get_tokens flow after silent refresh', async () => {
+      // Regression for the Codex findings around active token-fetch flows:
+      // concurrent `getOAuthTokens` callers may be joined to a PENDING
+      // `mcp_get_tokens` flow via `monitorFlow`. Deleting it under them makes
+      // waiters fail; leaving it alone lets a stale handler publish rejected
+      // tokens later. Completing the flow with the fresh tokens solves both.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh789',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      // A concurrent `getOAuthTokens` for this user/server is currently
+      // PENDING — joiners are monitoring it via `monitorFlow`.
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING' as const,
+        type: 'mcp_get_tokens',
+        metadata: {},
+        createdAt: Date.now(),
+      });
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.completeFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+        refreshedTokens,
+      );
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+      );
+    });
+
+    it('should invalidate mcp_get_tokens cache after interactive OAuth stores fresh tokens', async () => {
+      // Regression for the Codex finding "Invalidate token cache after
+      // interactive fallback": when silent refresh fails but interactive OAuth
+      // succeeds, the old `mcp_get_tokens` flow cache could otherwise re-serve
+      // stale tokens to the next `getOAuthTokens` call.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const interactiveTokens: MCPOAuthTokens = {
+        access_token: 'interactive-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'fresh-csrf-state',
+        },
+      });
+      // First `getFlowState` (from `invalidateCompletedOAuthFlow`): no
+      // completed mcp_oauth flow → no-op. Second (from `handleOAuthRequired`):
+      // no existing flow either. Final (from `invalidateGetTokensFlow` after
+      // interactive store): a COMPLETED `mcp_get_tokens` cache exists and
+      // must be cleared so the next `getOAuthTokens` reads fresh tokens.
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(null)
+        .mockResolvedValueOnce(null)
+        .mockResolvedValueOnce({
+          status: 'COMPLETED' as const,
+          type: 'mcp_get_tokens',
+          metadata: {},
+          createdAt: Date.now(),
+          completedAt: Date.now(),
+          result: {
+            access_token: 'old-stale',
+            token_type: 'Bearer',
+            obtained_at: Date.now(),
+          } as MCPOAuthTokens,
+        });
+      mockFlowManager.createFlow.mockResolvedValue(interactiveTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(interactiveTokens);
+      // The stale `mcp_get_tokens` cache is cleared so the next
+      // `getOAuthTokens` reads the freshly persisted interactive tokens.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_get_tokens');
+    });
+  });
+
+  describe('connection retry logic', () => {
+    it('should establish connection successfully', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig, // Use default 5000ms timeout
+      };
+
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(basicOptions);
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockConnectionInstance.connect).toHaveBeenCalledTimes(1);
+    });
+
+    it('should handle OAuth errors during connection attempts', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const oauthError = new Error('Non-200 status code (401)');
+      (oauthError as unknown as Record<string, unknown>).isOAuthError = true;
+
+      mockConnectionInstance.connect.mockRejectedValue(oauthError);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow(
+        'Non-200 status code (401)',
+      );
+
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('OAuth required, stopping connection attempts'),
+      );
+    });
+  });
+
+  describe('isOAuthError method', () => {
+    it('should identify OAuth errors by message content', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const error401 = new Error('401 Unauthorized');
+
+      mockConnectionInstance.connect.mockRejectedValue(error401);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow('401');
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('OAuth required, stopping connection attempts'),
+      );
+    });
+
+    it('should identify "no authorization" errors as OAuth errors (HTTP 400)', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const noAuthError = new Error(
+        'Either no authorization values are specified or it could not be derived from the request',
+      );
+
+      mockConnectionInstance.connect.mockRejectedValue(noAuthError);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow(
+        'no authorization',
+      );
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('OAuth required, stopping connection attempts'),
+      );
+    });
+
+    it('should identify invalid_grant errors as OAuth errors', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const invalidGrantError = new Error(
+        'Streamable HTTP error: Error POSTing to endpoint: {"error":"invalid_grant"}',
+      );
+
+      mockConnectionInstance.connect.mockRejectedValue(invalidGrantError);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(MCPConnectionFactory.create(basicOptions, oauthOptions)).rejects.toThrow(
+        'invalid_grant',
+      );
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('OAuth required, stopping connection attempts'),
+      );
+    });
+  });
+
+  describe('discoverTools static method', () => {
+    const mockTools = [
+      { name: 'tool1', description: 'First tool', inputSchema: { type: 'object' } },
+      { name: 'tool2', description: 'Second tool', inputSchema: { type: 'object' } },
+    ];
+
+    it('should discover tools from a successfully connected server', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
       mockConnectionInstance.fetchTools = jest.fn().mockResolvedValue(mockTools);
 
       const result = await MCPConnectionFactory.discoverTools(basicOptions);
@@ -1011,4 +3114,426 @@ describe('MCPConnectionFactory', () => {
       expect(mockLogger.debug).toHaveBeenCalled();
     });
   });
+
+  describe('proactive OAuth flow', () => {
+    const makeOAuthServerConfig = (): t.MCPOptions =>
+      ({
+        type: 'streamable-http' as const,
+        url: 'https://bigquery.googleapis.com/mcp',
+        initTimeout: 5000,
+        requiresOAuth: true,
+      }) as unknown as t.MCPOptions;
+
+    const makeOAuthOptions = () => ({
+      useOAuth: true as const,
+      user: mockUser,
+      flowManager: mockFlowManager,
+      tokenMethods: {
+        findToken: jest.fn(),
+        createToken: jest.fn(),
+        updateToken: jest.fn(),
+        deleteTokens: jest.fn(),
+      },
+    });
+
+    function wireEventHandlers(instance: jest.Mocked<MCPConnection>) {
+      type Listener = (...args: unknown[]) => void;
+
+      const handlers: Record<string, Listener[]> = {};
+      const onceWrappers = new Map<Listener, Listener>();
+      const key = (event: string | symbol): string =>
+        typeof event === 'symbol' ? event.toString() : event;
+      const addHandler = (event: string | symbol, handler: Listener) => {
+        (handlers[key(event)] ??= []).push(handler);
+      };
+      const removeHandler = (event: string | symbol, handler: Listener) => {
+        const list = handlers[key(event)];
+        if (!list) {
+          return;
+        }
+        const wrapped = onceWrappers.get(handler);
+        const handlerToRemove = wrapped ?? handler;
+        const index = list.indexOf(handlerToRemove);
+        if (index !== -1) {
+          list.splice(index, 1);
+        }
+        if (wrapped) {
+          onceWrappers.delete(handler);
+        }
+      };
+
+      instance.on.mockImplementation((event: string | symbol, handler: Listener) => {
+        addHandler(event, handler);
+        return instance;
+      });
+
+      instance.once.mockImplementation((event: string | symbol, handler: Listener) => {
+        const wrapped: Listener = (...args) => {
+          removeHandler(event, handler);
+          handler(...args);
+        };
+        onceWrappers.set(handler, wrapped);
+        addHandler(event, wrapped);
+        return instance;
+      });
+
+      instance.off.mockImplementation((event: string | symbol, handler: Listener) => {
+        removeHandler(event, handler);
+        return instance;
+      });
+
+      instance.removeListener.mockImplementation((event: string | symbol, handler: Listener) => {
+        removeHandler(event, handler);
+        return instance;
+      });
+
+      instance.emit.mockImplementation((event: string | symbol, ...args: unknown[]) => {
+        const list = handlers[key(event)];
+        if (!list || list.length === 0) {
+          return false;
+        }
+        for (const fn of [...list]) {
+          fn(...args);
+        }
+        return true;
+      });
+
+      return handlers;
+    }
+
+    it('should trigger proactive OAuth when requiresOAuth and no tokens', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockRejectedValue(new Error('no tokens'));
+
+      const mockTokens: MCPOAuthTokens = {
+        access_token: 'bq-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      const mockFlowData = {
+        authorizationUrl: 'https://accounts.google.com/o/oauth2/auth?state=xyz',
+        flowId: 'flow-bq',
+        flowMetadata: {
+          serverName: 'bigquery',
+          userId: 'user123',
+          serverUrl: 'https://bigquery.googleapis.com/mcp',
+          state: 'state-xyz',
+          clientInfo: { client_id: 'bq-client' },
+        },
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow-bq');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(mockTokens);
+
+      wireEventHandlers(mockConnectionInstance);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'bigquery', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('proactively triggering OAuth flow'),
+      );
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(mockTokens);
+      expect(mockConnectionInstance.connect).toHaveBeenCalled();
+    });
+
+    it('should trigger proactive OAuth when oauth is configured without requiresOAuth', async () => {
+      const serverConfig = {
+        type: 'streamable-http' as const,
+        url: 'https://drivemcp.googleapis.com/mcp/v1',
+        initTimeout: 5000,
+        oauth: {
+          authorization_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+          token_url: 'https://oauth2.googleapis.com/token',
+        },
+      } as t.ParsedServerConfig;
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+
+      const mockTokens: MCPOAuthTokens = {
+        access_token: 'drive-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow-drive');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://accounts.google.com/o/oauth2/auth?state=drive',
+        flowId: 'flow-drive',
+        flowMetadata: {
+          serverName: 'drive',
+          userId: 'user123',
+          serverUrl: 'https://drivemcp.googleapis.com/mcp/v1',
+          state: 'state-drive',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(mockTokens);
+
+      wireEventHandlers(mockConnectionInstance);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'drive', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(mockTokens);
+      expect(mockConnectionInstance.connect).toHaveBeenCalled();
+    });
+
+    it('should not trigger proactive OAuth when only OAuth metadata is present', async () => {
+      const serverConfig = {
+        type: 'streamable-http' as const,
+        url: 'https://metadata-only.example.com/mcp',
+        initTimeout: 5000,
+        oauthMetadata: {
+          authorization_servers: ['https://auth.example.com/'],
+        },
+      } as t.ParsedServerConfig;
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'metadata-only', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.connect).toHaveBeenCalled();
+    });
+
+    it('should NOT trigger proactive OAuth when useOAuth is true but requiresOAuth is absent', async () => {
+      const serverConfig = {
+        command: 'node',
+        args: ['server.js'],
+        initTimeout: 5000,
+      } as t.MCPOptions;
+
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockRejectedValue(new Error('no tokens'));
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'test-server', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockLogger.info).not.toHaveBeenCalledWith(
+        expect.stringContaining('proactively triggering OAuth flow'),
+      );
+    });
+
+    it('should not trigger proactive OAuth when requiresOAuth is explicitly false', async () => {
+      const serverConfig = {
+        type: 'streamable-http' as const,
+        url: 'https://api.example.com/mcp',
+        initTimeout: 5000,
+        requiresOAuth: false,
+        oauth: {
+          authorization_url: 'https://auth.example.com/oauth/authorize',
+          token_url: 'https://auth.example.com/oauth/token',
+        },
+      } as t.MCPOptions;
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'test-server', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockLogger.info).not.toHaveBeenCalledWith(
+        expect.stringContaining('proactively triggering OAuth flow'),
+      );
+    });
+
+    it('should skip proactive OAuth when tokens already exist', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      const existingTokens: MCPOAuthTokens = {
+        access_token: 'existing-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(existingTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      const connection = await MCPConnectionFactory.create(
+        { serverName: 'bigquery', serverConfig },
+        oauthOptions,
+      );
+
+      expect(connection).toBe(mockConnectionInstance);
+      expect(mockLogger.info).not.toHaveBeenCalledWith(
+        expect.stringContaining('proactively triggering OAuth flow'),
+      );
+    });
+
+    it('should reject when proactive OAuth flow fails', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = {
+        ...makeOAuthOptions(),
+        returnOnOAuth: true,
+        oauthStart: jest.fn(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockRejectedValue(new Error('no tokens'));
+
+      const mockFlowData = {
+        authorizationUrl: 'https://accounts.google.com/o/oauth2/auth',
+        flowId: 'flow-bq',
+        flowMetadata: {
+          serverName: 'bigquery',
+          userId: 'user123',
+          serverUrl: 'https://bigquery.googleapis.com/mcp',
+          state: 'state-xyz',
+        },
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow-bq');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockReturnValue(new Promise(() => {}));
+
+      wireEventHandlers(mockConnectionInstance);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(
+        MCPConnectionFactory.create({ serverName: 'bigquery', serverConfig }, oauthOptions),
+      ).rejects.toThrow('OAuth flow initiated - return early');
+    });
+
+    it('should throw when requiresOAuth is true but url is missing', async () => {
+      const serverConfig = {
+        type: 'streamable-http' as const,
+        initTimeout: 5000,
+        requiresOAuth: true,
+      } as unknown as t.MCPOptions;
+
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockRejectedValue(new Error('no tokens'));
+
+      wireEventHandlers(mockConnectionInstance);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      await expect(
+        MCPConnectionFactory.create({ serverName: 'no-url', serverConfig }, oauthOptions),
+      ).rejects.toThrow('server URL is missing');
+    });
+
+    it('should reject when proactive OAuth has no registered handler', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.on.mockReturnValue(mockConnectionInstance);
+      mockConnectionInstance.once.mockReturnValue(mockConnectionInstance);
+      mockConnectionInstance.off.mockReturnValue(mockConnectionInstance);
+      mockConnectionInstance.emit.mockReturnValue(false);
+
+      await expect(
+        MCPConnectionFactory.create({ serverName: 'bigquery', serverConfig }, oauthOptions),
+      ).rejects.toThrow('OAuth required but no handler is registered');
+
+      expect(mockConnectionInstance.connect).not.toHaveBeenCalled();
+    });
+
+    it('should clean up cross-listeners when oauthHandled fires', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = makeOAuthOptions();
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockRejectedValue(new Error('no tokens'));
+
+      const mockTokens: MCPOAuthTokens = {
+        access_token: 'cleanup-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow-cleanup');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow-cleanup',
+        flowMetadata: {
+          serverName: 'bigquery',
+          userId: 'user123',
+          serverUrl: 'https://bigquery.googleapis.com/mcp',
+          state: 'state-cleanup',
+          clientInfo: { client_id: 'client-cleanup' },
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(mockTokens);
+
+      const handlers = wireEventHandlers(mockConnectionInstance);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create({ serverName: 'bigquery', serverConfig }, oauthOptions);
+
+      // After oauthHandled resolved, the oauthFailed listener should have been removed
+      const failedListeners = handlers['oauthFailed'] ?? [];
+      expect(failedListeners.length).toBe(0);
+    });
+
+    it('should not trigger proactive OAuth during tool discovery', async () => {
+      const serverConfig = makeOAuthServerConfig();
+      const oauthOptions = {
+        ...makeOAuthOptions(),
+        oauthStart: jest.fn(),
+      };
+      const mockTools = [
+        { name: 'tool1', description: 'First tool', inputSchema: { type: 'object' } },
+      ];
+
+      mockProcessMCPEnv.mockReturnValue(serverConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+      mockConnectionInstance.fetchTools = jest.fn().mockResolvedValue(mockTools);
+
+      const result = await MCPConnectionFactory.discoverTools(
+        { serverName: 'bigquery', serverConfig },
+        oauthOptions,
+      );
+
+      expect(result.tools).toEqual(mockTools);
+      expect(result.oauthRequired).toBe(false);
+      expect(oauthOptions.oauthStart).not.toHaveBeenCalled();
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionFetchTools.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionFetchTools.test.ts
new file mode 100644
index 00000000000..d0aec66fc98
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/MCPConnectionFetchTools.test.ts
@@ -0,0 +1,298 @@
+/**
+ * Unit tests for MCPConnection.fetchTools pagination.
+ *
+ * MCP `tools/list` is a paginated method: the server may return a page of tools
+ * plus a `nextCursor` that the client must follow to retrieve the rest. These
+ * tests verify that fetchTools walks every page, passes the cursor back
+ * unchanged, and is bounded against misbehaving servers (page cap + repeated
+ * cursor guard) while preserving the original single-page and error behavior.
+ */
+
+import { logger } from '@librechat/data-schemas';
+import { MCPConnection } from '~/mcp/connection';
+import { mcpConfig } from '~/mcp/mcpConfig';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
+  resolveHostnameSSRF: jest.fn(async () => false),
+}));
+
+/** Pin the page cap to a small value so the cap path is cheap to exercise. */
+jest.mock('~/mcp/mcpConfig', () => ({
+  mcpConfig: {
+    TOOLS_LIST_MAX_PAGES: 3,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+    CONNECTION_CHECK_TTL: 0,
+  },
+}));
+
+const mockLogger = logger as jest.Mocked<typeof logger>;
+
+const makeTool = (name: string) => ({
+  name,
+  description: `${name} description`,
+  inputSchema: { type: 'object' as const, properties: {} },
+});
+
+/** Build a bare MCPConnection (no real transport) with an injected, controllable client. */
+function createConnectionWithListTools(listTools: jest.Mock): MCPConnection {
+  const conn = new MCPConnection({
+    serverName: 'pagination-test',
+    serverConfig: { type: 'streamable-http', url: 'http://localhost/mcp' },
+    useSSRFProtection: false,
+  });
+  conn.client = { listTools } as unknown as MCPConnection['client'];
+  return conn;
+}
+
+function expectListToolsCall(
+  listTools: jest.Mock,
+  callNumber: number,
+  params: { cursor?: string } | undefined,
+): void {
+  expect(listTools).toHaveBeenNthCalledWith(
+    callNumber,
+    params,
+    expect.objectContaining({
+      timeout: expect.any(Number),
+      maxTotalTimeout: expect.any(Number),
+    }),
+  );
+}
+
+describe('MCPConnection.fetchTools pagination', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mcpConfig.TOOLS_LIST_MAX_TOOLS = 1000;
+    mcpConfig.TOOLS_LIST_MAX_BYTES = 5 * 1024 * 1024;
+    mcpConfig.TOOLS_LIST_TIMEOUT_MS = 30000;
+  });
+
+  it('returns the tools from a single page and makes one request when there is no nextCursor', async () => {
+    const listTools = jest.fn().mockResolvedValue({ tools: [makeTool('a'), makeTool('b')] });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b']);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    expectListToolsCall(listTools, 1, undefined);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
+  });
+
+  it('follows nextCursor across pages, concatenating every tool and passing the cursor back', async () => {
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      switch (params?.cursor) {
+        case undefined:
+          return { tools: [makeTool('a'), makeTool('b')], nextCursor: 'c1' };
+        case 'c1':
+          return { tools: [makeTool('c'), makeTool('d')], nextCursor: 'c2' };
+        case 'c2':
+          return { tools: [makeTool('e')] };
+        default:
+          throw new Error(`unexpected cursor: ${params?.cursor}`);
+      }
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b', 'c', 'd', 'e']);
+    expect(listTools).toHaveBeenCalledTimes(3);
+    expectListToolsCall(listTools, 1, undefined);
+    expectListToolsCall(listTools, 2, { cursor: 'c1' });
+    expectListToolsCall(listTools, 3, { cursor: 'c2' });
+    expect(mockLogger.warn).not.toHaveBeenCalled();
+  });
+
+  it('stops at the page cap and warns when a server keeps returning new cursors', async () => {
+    let page = 0;
+    const listTools = jest.fn(async () => {
+      page += 1;
+      return { tools: [makeTool(`t${page}`)], nextCursor: `cursor-${page}` };
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    // mcpConfig.TOOLS_LIST_MAX_PAGES is mocked to 3.
+    expect(listTools).toHaveBeenCalledTimes(3);
+    expect(tools.map((t) => t.name)).toEqual(['t1', 't2', 't3']);
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('pagination limit'));
+  });
+
+  it('stops at the aggregate tool-count budget and warns', async () => {
+    mcpConfig.TOOLS_LIST_MAX_TOOLS = 3;
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      if (params?.cursor == null) {
+        return { tools: [makeTool('a'), makeTool('b')], nextCursor: 'c1' };
+      }
+      return { tools: [makeTool('c'), makeTool('d')], nextCursor: 'c2' };
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b', 'c']);
+    expect(listTools).toHaveBeenCalledTimes(2);
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('tool count budget'));
+  });
+
+  it('does not request another page when the tool-count budget is exactly full', async () => {
+    mcpConfig.TOOLS_LIST_MAX_TOOLS = 2;
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      if (params?.cursor == null) {
+        return { tools: [makeTool('a'), makeTool('b')], nextCursor: 'c1' };
+      }
+      return { tools: [makeTool('c')] };
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b']);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('tool count budget'));
+  });
+
+  it('stops at the aggregate byte budget and warns', async () => {
+    mcpConfig.TOOLS_LIST_MAX_BYTES = 170;
+    const listTools = jest.fn(async () => ({
+      tools: [makeTool('a'), makeTool('b')],
+      nextCursor: 'c1',
+    }));
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a']);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('size budget'));
+  });
+
+  it('stops at the elapsed-time budget before requesting another page', async () => {
+    mcpConfig.TOOLS_LIST_TIMEOUT_MS = 1;
+    const listTools = jest.fn(async () => ({ tools: [makeTool('a')], nextCursor: 'c1' }));
+    const conn = createConnectionWithListTools(listTools);
+    const dateNow = jest
+      .spyOn(Date, 'now')
+      .mockReturnValueOnce(1000)
+      .mockReturnValueOnce(1000)
+      .mockReturnValueOnce(1001);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a']);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('time budget'));
+    dateNow.mockRestore();
+  });
+
+  it('passes the elapsed-time budget to the SDK request timeout', async () => {
+    mcpConfig.TOOLS_LIST_TIMEOUT_MS = 25;
+    const listTools = jest.fn(
+      async (
+        _params?: { cursor?: string },
+        _options?: { timeout: number; maxTotalTimeout: number },
+      ) => {
+        throw new Error('Request timed out');
+      },
+    );
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools).toEqual([]);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    const options = listTools.mock.calls[0][1]!;
+    expect(options.timeout).toBeGreaterThan(0);
+    expect(options.timeout).toBeLessThanOrEqual(25);
+    expect(options.maxTotalTimeout).toBe(options.timeout);
+    expect(mockLogger.error).toHaveBeenCalledWith(expect.stringContaining('Request timed out'));
+  });
+
+  it('stops and warns when the server repeats a cursor instead of looping forever', async () => {
+    const listTools = jest.fn().mockResolvedValue({ tools: [makeTool('x')], nextCursor: 'same' });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(listTools).toHaveBeenCalledTimes(2);
+    // The second page's tools are collected before the repeated cursor is detected, hence two copies.
+    expect(tools.map((t) => t.name)).toEqual(['x', 'x']);
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('repeated tools/list cursor'),
+    );
+  });
+
+  it('continues paginating across an empty intermediate page', async () => {
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      if (params?.cursor == null) {
+        return { tools: [], nextCursor: 'c1' };
+      }
+      return { tools: [makeTool('a')] };
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a']);
+    expect(listTools).toHaveBeenCalledTimes(2);
+  });
+
+  it('treats an empty-string nextCursor as a valid cursor, not end-of-list', async () => {
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      if (params?.cursor == null) {
+        return { tools: [makeTool('a')], nextCursor: '' };
+      }
+      return { tools: [makeTool('b')] };
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b']);
+    expect(listTools).toHaveBeenCalledTimes(2);
+    expectListToolsCall(listTools, 2, { cursor: '' });
+  });
+
+  it('returns the pages already fetched when a later page fails, without throwing', async () => {
+    const listTools = jest.fn(async (params?: { cursor?: string }) => {
+      if (params?.cursor == null) {
+        return { tools: [makeTool('a'), makeTool('b')], nextCursor: 'c1' };
+      }
+      throw new Error('page 2 boom');
+    });
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b']);
+    expect(listTools).toHaveBeenCalledTimes(2);
+    expect(mockLogger.error).toHaveBeenCalledWith(expect.stringContaining('Failed to fetch tools'));
+  });
+
+  it('returns an empty array when the first page request rejects', async () => {
+    const listTools = jest.fn().mockRejectedValue(new Error('boom'));
+    const conn = createConnectionWithListTools(listTools);
+
+    const tools = await conn.fetchTools();
+
+    expect(tools).toEqual([]);
+    expect(listTools).toHaveBeenCalledTimes(1);
+    expect(mockLogger.error).toHaveBeenCalledWith(expect.stringContaining('Failed to fetch tools'));
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionSSRF.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionSSRF.test.ts
index 98f698c9cd4..702a0737219 100644
--- a/packages/api/src/mcp/__tests__/MCPConnectionSSRF.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPConnectionSSRF.test.ts
@@ -23,11 +23,16 @@ import type {
   Response as UndiciResponse,
 } from 'undici';
 import type { Socket } from 'net';
-import { MCPConnection } from '~/mcp/connection';
 import { createSSRFSafeUndiciConnect, resolveHostnameSSRF } from '~/auth';
+import { MCPConnection } from '~/mcp/connection';
 
 type CustomFetch = (input: UndiciRequestInfo, init?: UndiciRequestInit) => Promise<UndiciResponse>;
-type LookupCallback = (err: NodeJS.ErrnoException | null, address: string, family: number) => void;
+type LookupAddress = string | Array<{ address: string; family: number }>;
+type LookupCallback = (
+  err: NodeJS.ErrnoException | null,
+  address: LookupAddress,
+  family?: number,
+) => void;
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -48,14 +53,31 @@ jest.mock('~/auth', () => ({
       if (!callback) {
         throw new Error('lookup callback missing');
       }
+      if (
+        typeof optionsOrCallback === 'object' &&
+        optionsOrCallback != null &&
+        'all' in optionsOrCallback &&
+        optionsOrCallback.all === true
+      ) {
+        callback(null, [{ address: '127.0.0.1', family: 4 }]);
+        return;
+      }
       callback(null, '127.0.0.1', 4);
     },
   })),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
 jest.mock('~/mcp/mcpConfig', () => ({
-  mcpConfig: { CONNECTION_CHECK_TTL: 0 },
+  mcpConfig: {
+    CONNECTION_CHECK_TTL: 0,
+    TOOLS_LIST_MAX_PAGES: 50,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+  },
 }));
 
 const mockedResolveHostnameSSRF = resolveHostnameSSRF as jest.MockedFunction<
@@ -258,6 +280,45 @@ async function createStreamableServer(): Promise<Omit<TestServer, 'redirectHit'>
   };
 }
 
+async function createOversizedToolResultStreamableServer(
+  payloadSize: number,
+): Promise<Omit<TestServer, 'redirectHit'>> {
+  const sessions = new Map<string, StreamableHTTPServerTransport>();
+
+  const httpServer = http.createServer(async (req, res) => {
+    const sid = req.headers['mcp-session-id'] as string | undefined;
+    let transport = sid ? sessions.get(sid) : undefined;
+
+    if (!transport) {
+      transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+      const mcp = new McpServer({ name: 'oversized-tool-result', version: '0.0.1' });
+      mcp.tool('oversized', 'Returns an oversized text payload', {}, async () => ({
+        content: [{ type: 'text', text: 'x'.repeat(payloadSize) }],
+      }));
+      await mcp.connect(transport);
+    }
+
+    await transport.handleRequest(req, res);
+
+    if (transport.sessionId && !sessions.has(transport.sessionId)) {
+      sessions.set(transport.sessionId, transport);
+      transport.onclose = () => sessions.delete(transport!.sessionId!);
+    }
+  });
+
+  const destroySockets = trackSockets(httpServer);
+  const port = await getFreePort();
+  await new Promise<void>((resolve) => httpServer.listen(port, '127.0.0.1', resolve));
+
+  return {
+    url: `http://127.0.0.1:${port}/`,
+    close: async () => {
+      await closeMCPSessions(sessions);
+      await destroySockets();
+    },
+  };
+}
+
 describe('MCP SSRF protection – redirect blocking', () => {
   let redirectServer: TestServer;
   let conn: MCPConnection | null;
@@ -457,6 +518,11 @@ interface HeaderCaptureServer {
   close: () => Promise<void>;
 }
 
+interface RawResponseServer {
+  url: string;
+  close: () => Promise<void>;
+}
+
 /**
  * Captures every incoming request's headers, method, and body, then replies
  * with a benign 200 so tests can assert what actually crossed a redirect
@@ -490,6 +556,71 @@ async function createHeaderCaptureServer(): Promise<HeaderCaptureServer> {
   };
 }
 
+async function createTunnelProxyCaptureServer(): Promise<HeaderCaptureServer> {
+  const headers: http.IncomingHttpHeaders[] = [];
+  const requests: CapturedRequest[] = [];
+  const server = http.createServer((_req, res) => {
+    res.writeHead(502);
+    res.end();
+  });
+  server.on('connect', (req, clientSocket, head) => {
+    headers.push({ ...req.headers });
+    requests.push({
+      method: 'CONNECT',
+      headers: { ...req.headers },
+      body: req.url ?? '',
+    });
+
+    let buffer = Buffer.from(head);
+    let responded = false;
+    const respondIfRequestComplete = () => {
+      if (responded || !buffer.includes('\r\n\r\n')) {
+        return;
+      }
+      responded = true;
+      const requestLine = buffer.toString('utf8').split('\r\n')[0] ?? '';
+      requests.push({
+        method: requestLine.split(' ')[0] ?? '',
+        headers: {},
+        body: requestLine,
+      });
+      clientSocket.write(
+        'HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}',
+      );
+      clientSocket.end();
+    };
+
+    clientSocket.on('error', () => undefined);
+    clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    clientSocket.on('data', (chunk: Buffer) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      respondIfRequestComplete();
+    });
+    respondIfRequestComplete();
+  });
+
+  const destroySockets = trackSockets(server);
+  const port = await getFreePort();
+  await new Promise<void>((resolve) => server.listen(port, '127.0.0.1', resolve));
+  return {
+    url: `http://127.0.0.1:${port}/`,
+    receivedHeaders: headers,
+    receivedRequests: requests,
+    close: destroySockets,
+  };
+}
+
+async function createRawResponseServer(handler: http.RequestListener): Promise<RawResponseServer> {
+  const server = http.createServer(handler);
+  const destroySockets = trackSockets(server);
+  const port = await getFreePort();
+  await new Promise<void>((resolve) => server.listen(port, '127.0.0.1', resolve));
+  return {
+    url: `http://127.0.0.1:${port}/`,
+    close: destroySockets,
+  };
+}
+
 /**
  * Issues a single 307/308 redirect to `redirectTarget` (which lives on a
  * different port and is therefore a different origin). Used to verify
@@ -823,8 +954,20 @@ describe('MCP SSRF protection – cross-origin credential stripping on redirect'
 describe('MCP SSRF protection – customFetch input shapes', () => {
   let target: Omit<TestServer, 'redirectHit'> | undefined;
   let conn: MCPConnection | null;
+  const originalMaxResponseBytes = process.env.MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES;
+  const originalMaxLineBytes = process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES;
 
   afterEach(async () => {
+    if (originalMaxResponseBytes == null) {
+      delete process.env.MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES;
+    } else {
+      process.env.MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES = originalMaxResponseBytes;
+    }
+    if (originalMaxLineBytes == null) {
+      delete process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES;
+    } else {
+      process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES = originalMaxLineBytes;
+    }
     await safeDisconnect(conn);
     conn = null;
     if (target) {
@@ -846,12 +989,850 @@ describe('MCP SSRF protection – customFetch input shapes', () => {
       connection as unknown as {
         createFetchFunction: (
           getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+          guardStreamableHTTPResponses?: boolean,
         ) => CustomFetch;
       }
     ).createFetchFunction;
     return factory.call(connection, () => null);
   }
 
+  function getGuardedStreamableHTTPCustomFetch(connection: MCPConnection): CustomFetch {
+    const factory = (
+      connection as unknown as {
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+          guardStreamableHTTPResponses?: boolean,
+        ) => CustomFetch;
+      }
+    ).createFetchFunction;
+    return factory.call(connection, () => null, undefined, undefined, undefined, undefined, true);
+  }
+
+  function createBaseUrlFetch(connection: MCPConnection, baseUrl: string): CustomFetch {
+    const factory = (
+      connection as unknown as {
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      }
+    ).createFetchFunction;
+    return factory.call(connection, () => null, undefined, 300000, undefined, baseUrl);
+  }
+
+  function createBaseUrlDispatchers(connection: MCPConnection, baseUrl: string): string[] {
+    const privateSelf = connection as unknown as {
+      agents: Array<{ constructor: { name: string } }>;
+    };
+    createBaseUrlFetch(connection, baseUrl);
+    return privateSelf.agents.map((agent) => agent.constructor.name);
+  }
+
+  const proxyEnvKeys = [
+    'PROXY',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+  ] as const;
+  type ProxyEnvKey = (typeof proxyEnvKeys)[number];
+
+  function snapshotProxyEnv(): Partial<Record<ProxyEnvKey, string>> {
+    const snapshot: Partial<Record<ProxyEnvKey, string>> = {};
+    for (const key of proxyEnvKeys) {
+      if (process.env[key] != null) {
+        snapshot[key] = process.env[key];
+      }
+    }
+    return snapshot;
+  }
+
+  function restoreProxyEnv(snapshot: Partial<Record<ProxyEnvKey, string>>): void {
+    for (const key of proxyEnvKeys) {
+      if (snapshot[key] == null) {
+        delete process.env[key];
+      } else {
+        process.env[key] = snapshot[key];
+      }
+    }
+  }
+
+  function clearProxyEnv(): void {
+    for (const key of proxyEnvKeys) {
+      delete process.env[key];
+    }
+  }
+
+  it('should allocate proxy dispatchers for streamable-http when proxy is configured', () => {
+    conn = new MCPConnection({
+      serverName: 'customfetch-proxy-dispatchers',
+      serverConfig: {
+        type: 'streamable-http',
+        url: 'https://mcp.example.com/mcp',
+        proxy: 'http://proxy.example.com:8080',
+      },
+      useSSRFProtection: false,
+    });
+
+    const privateSelf = conn as unknown as {
+      agents: Array<{ constructor: { name: string } }>;
+      createFetchFunction: (
+        getHeaders: () => Record<string, string> | null | undefined,
+        timeout?: number,
+        sseBodyTimeout?: number,
+        configuredSecretHeaderKeys?: ReadonlySet<string>,
+        baseUrl?: string,
+      ) => CustomFetch;
+    };
+    privateSelf.createFetchFunction.call(
+      conn,
+      () => null,
+      undefined,
+      300000,
+      undefined,
+      'https://mcp.example.com/mcp',
+    );
+
+    expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual([
+      'ProxyAgent',
+      'ProxyAgent',
+    ]);
+  });
+
+  it('should use the PROXY env var for streamable-http when server proxy is not configured', () => {
+    const originalProxy = process.env.PROXY;
+    process.env.PROXY = 'http://env-proxy.example.com:8080';
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-env-proxy-dispatchers',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'https://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'https://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual([
+        'ProxyAgent',
+        'ProxyAgent',
+      ]);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+    }
+  });
+
+  it('should use standard HTTP proxy env vars for streamable-http when PROXY is absent', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalHttpsProxy = process.env.HTTPS_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpProxy = process.env.http_proxy;
+    const originalLowerHttpsProxy = process.env.https_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.HTTPS_PROXY = 'http://https-proxy.example.com:8080';
+    process.env.NO_PROXY = 'localhost,127.0.0.1';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-env-proxy-dispatchers',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'https://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'https://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual([
+        'ProxyAgent',
+        'ProxyAgent',
+      ]);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpProxy == null) {
+        delete process.env.HTTP_PROXY;
+      } else {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      }
+      if (originalHttpsProxy == null) {
+        delete process.env.HTTPS_PROXY;
+      } else {
+        process.env.HTTPS_PROXY = originalHttpsProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpProxy == null) {
+        delete process.env.http_proxy;
+      } else {
+        process.env.http_proxy = originalLowerHttpProxy;
+      }
+      if (originalLowerHttpsProxy == null) {
+        delete process.env.https_proxy;
+      } else {
+        process.env.https_proxy = originalLowerHttpsProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should honor NO_PROXY when standard HTTP proxy env vars are configured', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpsProxy = process.env.HTTPS_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpsProxy = process.env.https_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
+    process.env.HTTPS_PROXY = 'http://https-proxy.example.com:8080';
+    process.env.NO_PROXY = 'mcp.example.com';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-env-no-proxy',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'https://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'https://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual(['Agent', 'Agent']);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpsProxy == null) {
+        delete process.env.HTTPS_PROXY;
+      } else {
+        process.env.HTTPS_PROXY = originalHttpsProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpsProxy == null) {
+        delete process.env.https_proxy;
+      } else {
+        process.env.https_proxy = originalLowerHttpsProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should honor bare IPv6 NO_PROXY entries without parsing a port suffix', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpProxy = process.env.http_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.http_proxy;
+    delete process.env.no_proxy;
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = '::1';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-env-no-proxy-ipv6',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://[::1]:3000/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'http://[::1]:3000/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual(['Agent', 'Agent']);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpProxy == null) {
+        delete process.env.HTTP_PROXY;
+      } else {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpProxy == null) {
+        delete process.env.http_proxy;
+      } else {
+        process.env.http_proxy = originalLowerHttpProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should honor wildcard tokens in NO_PROXY lists', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpProxy = process.env.http_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.http_proxy;
+    delete process.env.no_proxy;
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = 'localhost,*';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-env-no-proxy-wildcard-list',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'http://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual(['Agent', 'Agent']);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpProxy == null) {
+        delete process.env.HTTP_PROXY;
+      } else {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpProxy == null) {
+        delete process.env.http_proxy;
+      } else {
+        process.env.http_proxy = originalLowerHttpProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should honor CIDR and IP range patterns in NO_PROXY lists', async () => {
+    const originalEnv = snapshotProxyEnv();
+    clearProxyEnv();
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = '10.0.0.0/8,192.168.1.10-192.168.1.20';
+
+    const expectDispatcherNamesForUrl = async (
+      url: string,
+      expectedNames: string[],
+    ): Promise<void> => {
+      await safeDisconnect(conn);
+      conn = new MCPConnection({
+        serverName: `customfetch-no-proxy-${url}`,
+        serverConfig: {
+          type: 'streamable-http',
+          url,
+        },
+        useSSRFProtection: false,
+      });
+      expect(createBaseUrlDispatchers(conn, url)).toEqual(expectedNames);
+    };
+
+    try {
+      await expectDispatcherNamesForUrl('http://10.2.3.4/mcp', ['Agent', 'Agent']);
+      await expectDispatcherNamesForUrl('http://192.168.1.15/mcp', ['Agent', 'Agent']);
+      await expectDispatcherNamesForUrl('http://192.168.1.25/mcp', ['ProxyAgent', 'ProxyAgent']);
+    } finally {
+      restoreProxyEnv(originalEnv);
+    }
+  });
+
+  it('should match NO_PROXY host entries like undici env proxy agents', async () => {
+    const originalEnv = snapshotProxyEnv();
+    clearProxyEnv();
+    process.env.HTTPS_PROXY = 'http://https-proxy.example.com:8080';
+
+    const expectDispatcherNamesForUrl = async (
+      noProxy: string,
+      url: string,
+      expectedNames: string[],
+    ): Promise<void> => {
+      await safeDisconnect(conn);
+      process.env.NO_PROXY = noProxy;
+      conn = new MCPConnection({
+        serverName: `customfetch-no-proxy-host-${noProxy}-${url}`,
+        serverConfig: {
+          type: 'streamable-http',
+          url,
+        },
+        useSSRFProtection: false,
+      });
+      expect(createBaseUrlDispatchers(conn, url)).toEqual(expectedNames);
+    };
+
+    try {
+      await expectDispatcherNamesForUrl('example.com', 'https://example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('example.com', 'https://api.example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('*.example.com', 'https://api.example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('*.example.com', 'https://example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('.example.com', 'https://example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('.example.com', 'https://api.example.com/mcp', [
+        'Agent',
+        'Agent',
+      ]);
+      await expectDispatcherNamesForUrl('example.com', 'https://badexample.com/mcp', [
+        'ProxyAgent',
+        'ProxyAgent',
+      ]);
+    } finally {
+      restoreProxyEnv(originalEnv);
+    }
+  });
+
+  it('should let empty lowercase proxy env vars disable uppercase fallbacks', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpProxy = process.env.http_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.NO_PROXY;
+    delete process.env.no_proxy;
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.http_proxy = '';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-empty-lowercase-proxy',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'http://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual(['Agent', 'Agent']);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpProxy == null) {
+        delete process.env.HTTP_PROXY;
+      } else {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpProxy == null) {
+        delete process.env.http_proxy;
+      } else {
+        process.env.http_proxy = originalLowerHttpProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should let empty lowercase no_proxy disable uppercase fallbacks', () => {
+    const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
+    const originalLowerHttpProxy = process.env.http_proxy;
+    const originalLowerNoProxy = process.env.no_proxy;
+
+    delete process.env.PROXY;
+    delete process.env.http_proxy;
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = 'mcp.example.com';
+    process.env.no_proxy = '';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-standard-empty-lowercase-no-proxy',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const privateSelf = conn as unknown as {
+        agents: Array<{ constructor: { name: string } }>;
+        createFetchFunction: (
+          getHeaders: () => Record<string, string> | null | undefined,
+          timeout?: number,
+          sseBodyTimeout?: number,
+          configuredSecretHeaderKeys?: ReadonlySet<string>,
+          baseUrl?: string,
+        ) => CustomFetch;
+      };
+      privateSelf.createFetchFunction.call(
+        conn,
+        () => null,
+        undefined,
+        300000,
+        undefined,
+        'http://mcp.example.com/mcp',
+      );
+
+      expect(privateSelf.agents.map((agent) => agent.constructor.name)).toEqual([
+        'ProxyAgent',
+        'ProxyAgent',
+      ]);
+    } finally {
+      if (originalProxy == null) {
+        delete process.env.PROXY;
+      } else {
+        process.env.PROXY = originalProxy;
+      }
+      if (originalHttpProxy == null) {
+        delete process.env.HTTP_PROXY;
+      } else {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      }
+      if (originalNoProxy == null) {
+        delete process.env.NO_PROXY;
+      } else {
+        process.env.NO_PROXY = originalNoProxy;
+      }
+      if (originalLowerHttpProxy == null) {
+        delete process.env.http_proxy;
+      } else {
+        process.env.http_proxy = originalLowerHttpProxy;
+      }
+      if (originalLowerNoProxy == null) {
+        delete process.env.no_proxy;
+      } else {
+        process.env.no_proxy = originalLowerNoProxy;
+      }
+    }
+  });
+
+  it('should recompute proxy dispatchers from the resolved request URL', async () => {
+    const originalEnv = snapshotProxyEnv();
+    const capture = await createHeaderCaptureServer();
+    clearProxyEnv();
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = '127.0.0.1';
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-recompute-proxy-dispatcher',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://mcp.example.com/mcp',
+        },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = createBaseUrlFetch(conn, 'http://mcp.example.com/mcp');
+      const response = await customFetch(capture.url);
+
+      expect(response.status).toBe(200);
+      await response.body?.cancel();
+      expect(capture.receivedRequests).toHaveLength(1);
+      expect(
+        (conn as unknown as { agents: Array<{ constructor: { name: string } }> }).agents.map(
+          (agent) => agent.constructor.name,
+        ),
+      ).toEqual(['ProxyAgent', 'ProxyAgent', 'Agent']);
+    } finally {
+      restoreProxyEnv(originalEnv);
+      await capture.close();
+    }
+  });
+
+  it('should preflight proxied IP literal targets before dispatching network requests', async () => {
+    mockedResolveHostnameSSRF.mockResolvedValueOnce(true);
+
+    conn = new MCPConnection({
+      serverName: 'customfetch-proxy-ssrf',
+      serverConfig: {
+        type: 'streamable-http',
+        url: 'https://mcp.example.com/mcp',
+        proxy: 'http://proxy.example.com:8080',
+      },
+      useSSRFProtection: true,
+    });
+
+    const customFetch = getCustomFetch(conn);
+
+    await expect(customFetch('http://203.0.113.10/mcp')).rejects.toThrow(
+      /proxied MCP request target/,
+    );
+    expect(mockedResolveHostnameSSRF).toHaveBeenCalledWith('203.0.113.10', null, '80');
+  });
+
+  it('should reject proxied hostname targets unless explicitly allowed when SSRF protection is enabled', async () => {
+    mockedResolveHostnameSSRF.mockClear();
+
+    conn = new MCPConnection({
+      serverName: 'customfetch-proxy-ssrf-hostname-denied',
+      serverConfig: {
+        type: 'streamable-http',
+        url: 'https://mcp.example.com/mcp',
+        proxy: 'http://proxy.example.com:8080',
+      },
+      useSSRFProtection: true,
+    });
+
+    const customFetch = getCustomFetch(conn);
+
+    await expect(customFetch('http://hostname-only.example/mcp')).rejects.toThrow(
+      /must be an IP literal or an explicitly allowed host/,
+    );
+    expect(mockedResolveHostnameSSRF).not.toHaveBeenCalled();
+  });
+
+  it('should skip proxied SSRF checks for explicitly allowed target hosts', async () => {
+    const proxy = await createTunnelProxyCaptureServer();
+    mockedResolveHostnameSSRF.mockClear();
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-proxy-ssrf-allowed-dns',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'https://mcp.example.com/mcp',
+          proxy: proxy.url,
+        },
+        useSSRFProtection: true,
+        allowedAddresses: ['proxy-only.internal:80'],
+      });
+
+      const customFetch = getCustomFetch(conn);
+      const response = await customFetch('http://proxy-only.internal/mcp');
+
+      expect(response.status).toBe(200);
+      await response.body?.cancel().catch(() => undefined);
+      expect(proxy.receivedRequests[0]?.method).toBe('CONNECT');
+      expect(mockedResolveHostnameSSRF).not.toHaveBeenCalled();
+    } finally {
+      await proxy.close();
+    }
+  });
+
+  it('should allow NO_PROXY hostname targets to use direct SSRF-safe dispatchers', async () => {
+    const originalEnv = snapshotProxyEnv();
+    const capture = await createHeaderCaptureServer();
+    clearProxyEnv();
+    process.env.HTTP_PROXY = 'http://http-proxy.example.com:8080';
+    process.env.NO_PROXY = 'direct.example.com';
+    mockedResolveHostnameSSRF.mockClear();
+
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-no-proxy-hostname-direct',
+        serverConfig: {
+          type: 'streamable-http',
+          url: 'http://mcp.example.com/mcp',
+        },
+        useSSRFProtection: true,
+      });
+
+      const customFetch = createBaseUrlFetch(conn, 'http://mcp.example.com/mcp');
+      const directUrl = capture.url.replace('127.0.0.1', 'direct.example.com');
+      const response = await customFetch(directUrl);
+
+      expect(response.status).toBe(200);
+      await response.body?.cancel().catch(() => undefined);
+      expect(capture.receivedRequests).toHaveLength(1);
+      expect(mockedResolveHostnameSSRF).not.toHaveBeenCalled();
+    } finally {
+      restoreProxyEnv(originalEnv);
+      await capture.close();
+    }
+  });
+
   it.each<['string' | 'URL' | 'Request']>([['string'], ['URL'], ['Request']])(
     'should accept a %s input without throwing on URL derivation',
     async (shape) => {
@@ -1015,6 +1996,169 @@ describe('MCP SSRF protection – customFetch input shapes', () => {
       }
     }
   });
+
+  it('should not apply streamable HTTP response caps unless the transport opts in', async () => {
+    process.env.MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES = '8';
+    const server = await createRawResponseServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end('{"jsonrpc":"2.0","id":1,"result":{"too":"large"}}');
+    });
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-unguarded-byte-limit',
+        serverConfig: { type: 'sse', url: server.url },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = getCustomFetch(conn);
+      const response = await customFetch(server.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'ping', id: 1 }),
+      });
+
+      await expect(response.text()).resolves.toContain('"too":"large"');
+    } finally {
+      await server.close();
+    }
+  });
+
+  it('should reject oversized JSON POST responses with the streamable HTTP byte cap', async () => {
+    process.env.MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES = '8';
+    const server = await createRawResponseServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end('{"jsonrpc":"2.0","id":1,"result":{"too":"large"}}');
+    });
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-json-byte-limit',
+        serverConfig: { type: 'streamable-http', url: server.url },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = getGuardedStreamableHTTPCustomFetch(conn);
+      const response = await customFetch(server.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'ping', id: 1 }),
+      });
+
+      await expect(response.text()).rejects.toThrow(
+        /MCP response exceeded byte limit.*limit=8 bytes/,
+      );
+    } finally {
+      await server.close();
+    }
+  });
+
+  it('should reject a POST response with an oversized SSE line before the SSE parser can grow it', async () => {
+    process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES = '16';
+    const server = await createRawResponseServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+      res.end(`data: ${'x'.repeat(64)}\n\n`);
+    });
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-sse-line-limit',
+        serverConfig: { type: 'streamable-http', url: server.url },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = getGuardedStreamableHTTPCustomFetch(conn);
+      const response = await customFetch(server.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/cancelled' }),
+      });
+      await expect(response.text()).rejects.toThrow(
+        /MCP response contained an oversized SSE line.*lineLimit=16 bytes.*observedLine=17 bytes/,
+      );
+    } finally {
+      await server.close();
+    }
+  });
+
+  it('should allow SSE lines above the old 1 MiB default when no line override is set', async () => {
+    delete process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES;
+    const payload = 'x'.repeat(2 * 1024 * 1024);
+    const server = await createRawResponseServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+      res.end(`data: ${payload}\n\n`);
+    });
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-sse-default-line-limit',
+        serverConfig: { type: 'streamable-http', url: server.url },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = getGuardedStreamableHTTPCustomFetch(conn);
+      const response = await customFetch(server.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/cancelled' }),
+      });
+
+      await expect(response.text()).resolves.toContain(payload.slice(0, 128));
+    } finally {
+      await server.close();
+    }
+  });
+
+  it('should fail an actual streamable HTTP tool call promptly with a clear oversized SSE line error', async () => {
+    process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES = '512';
+    target = await createOversizedToolResultStreamableServer(2048);
+    conn = new MCPConnection({
+      serverName: 'streamable-http-tool-call-sse-line-limit',
+      serverConfig: { type: 'streamable-http', url: target.url },
+      useSSRFProtection: false,
+    });
+
+    await conn.connect();
+    const startedAt = Date.now();
+
+    await expect(
+      conn.client.callTool({ name: 'oversized', arguments: {} }, undefined, { timeout: 3000 }),
+    ).rejects.toThrow(/MCP response contained an oversized SSE line/);
+    expect(Date.now() - startedAt).toBeLessThan(1500);
+  });
+
+  it('should stream valid SSE POST responses without waiting for EOF', async () => {
+    process.env.MCP_STREAMABLE_HTTP_MAX_LINE_BYTES = '4096';
+    let finish!: () => void;
+    const finished = new Promise<void>((resolve) => {
+      finish = resolve;
+    });
+    const server = await createRawResponseServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+      res.write('data: {"jsonrpc":"2.0","id":1,"result":{}}\n\n');
+      finished.then(() => res.end()).catch(() => res.end());
+    });
+    try {
+      conn = new MCPConnection({
+        serverName: 'customfetch-sse-streaming',
+        serverConfig: { type: 'streamable-http', url: server.url },
+        useSSRFProtection: false,
+      });
+
+      const customFetch = getGuardedStreamableHTTPCustomFetch(conn);
+      const response = await customFetch(server.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'ping', id: 1 }),
+      });
+      const reader = response.body!.getReader();
+      const { value, done } = await reader.read();
+
+      expect(done).toBe(false);
+      expect(Buffer.from(value as Uint8Array).toString('utf8')).toContain('"result":{}');
+      await reader.cancel().catch(() => undefined);
+      finish();
+    } finally {
+      finish();
+      await server.close();
+    }
+  });
 });
 
 describe('MCP SSRF protection – WebSocket DNS resolution', () => {
diff --git a/packages/api/src/mcp/__tests__/MCPManager.test.ts b/packages/api/src/mcp/__tests__/MCPManager.test.ts
index 45a51e01aca..865de69eb4e 100644
--- a/packages/api/src/mcp/__tests__/MCPManager.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPManager.test.ts
@@ -2,13 +2,16 @@ import { logger } from '@librechat/data-schemas';
 import type { IUser } from '@librechat/data-schemas';
 import type { GraphTokenResolver } from '~/utils/graph';
 import type * as t from '~/mcp/types';
+import { OboTokenResolutionError, detectOAuthRequirement, resolveOboToken } from '~/mcp/oauth';
 import { MCPServersInitializer } from '~/mcp/registry/MCPServersInitializer';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
-import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { ConnectionsRepository } from '~/mcp/ConnectionsRepository';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { isMCPDomainAllowed } from '~/auth/domain';
 import { MCPConnection } from '~/mcp/connection';
 import { MCPManager } from '~/mcp/MCPManager';
 import * as graphUtils from '~/utils/graph';
+import { processMCPEnv } from '~/utils/env';
 
 // Mock external dependencies
 jest.mock('@librechat/data-schemas', () => ({
@@ -25,17 +28,37 @@ jest.mock('~/utils/graph', () => ({
   preProcessGraphTokens: jest.fn(),
 }));
 
+jest.mock('~/mcp/oauth', () => ({
+  ...jest.requireActual('~/mcp/oauth'),
+  detectOAuthRequirement: jest.fn(),
+  resolveOboToken: jest.fn(),
+}));
+
 jest.mock('~/utils/env', () => ({
   processMCPEnv: jest.fn((params) => params.options),
 }));
 
+jest.mock('~/auth/domain', () => ({
+  isMCPDomainAllowed: jest.fn().mockResolvedValue(true),
+}));
+
+const mockShouldEnableSSRFProtection = jest.fn().mockReturnValue(false);
+const mockGetAllowedDomains = jest.fn().mockReturnValue(null);
+const mockGetAllowedAddresses = jest.fn().mockReturnValue(null);
 const mockRegistryInstance = {
   getServerConfig: jest.fn(),
   getAllServerConfigs: jest.fn(),
   getOAuthServers: jest.fn(),
-  shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
-  getAllowedDomains: jest.fn().mockReturnValue(null),
-  getAllowedAddresses: jest.fn().mockReturnValue(null),
+  shouldEnableSSRFProtection: mockShouldEnableSSRFProtection,
+  getAllowedDomains: mockGetAllowedDomains,
+  getAllowedAddresses: mockGetAllowedAddresses,
+  // Mirrors the real per-request resolver by reading the base-allowlist mocks above, so
+  // existing tests that override getAllowedDomains/shouldEnableSSRFProtection still apply.
+  resolveAllowlists: jest.fn(async () => ({
+    allowedDomains: mockGetAllowedDomains(),
+    allowedAddresses: mockGetAllowedAddresses(),
+    useSSRFProtection: mockShouldEnableSSRFProtection(),
+  })),
 };
 
 jest.mock('~/mcp/registry/MCPServersRegistry', () => ({
@@ -55,6 +78,12 @@ jest.mock('~/mcp/ConnectionsRepository');
 jest.mock('~/mcp/MCPConnectionFactory');
 
 const mockLogger = logger as jest.Mocked<typeof logger>;
+const mockResolveOboToken = resolveOboToken as jest.MockedFunction<typeof resolveOboToken>;
+const mockDetectOAuthRequirement = detectOAuthRequirement as jest.MockedFunction<
+  typeof detectOAuthRequirement
+>;
+const mockProcessMCPEnv = processMCPEnv as jest.MockedFunction<typeof processMCPEnv>;
+const mockIsMCPDomainAllowed = isMCPDomainAllowed as jest.MockedFunction<typeof isMCPDomainAllowed>;
 
 describe('MCPManager', () => {
   const userId = 'test-user-123';
@@ -68,6 +97,15 @@ describe('MCPManager', () => {
     // Set up default mock implementations
     (MCPServersInitializer.initialize as jest.Mock).mockResolvedValue(undefined);
     (mockRegistryInstance.getAllServerConfigs as jest.Mock).mockResolvedValue({});
+    (mockRegistryInstance.shouldEnableSSRFProtection as jest.Mock).mockReturnValue(false);
+    (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(null);
+    (mockRegistryInstance.getAllowedAddresses as jest.Mock).mockReturnValue(null);
+    mockProcessMCPEnv.mockImplementation((params) => params.options);
+    mockIsMCPDomainAllowed.mockResolvedValue(true);
+    mockDetectOAuthRequirement.mockResolvedValue({
+      requiresOAuth: false,
+      method: 'no-metadata-found',
+    });
   });
 
   function mockAppConnections(
@@ -471,6 +509,7 @@ describe('MCPManager', () => {
           return options;
         },
       );
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
     });
 
     it('should call preProcessGraphTokens with graphTokenResolver when provided', async () => {
@@ -534,6 +573,104 @@ describe('MCPManager', () => {
       );
     });
 
+    it('should attach request OAuth handler without reprocessing resolved config', async () => {
+      const rawServerConfig = {
+        type: 'sse',
+        url: 'https://api.example.com/{{LIBRECHAT_USER_ID}}',
+        headers: {
+          Authorization: 'Bearer {{USER_TOKEN}}',
+        },
+        requiresOAuth: true,
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+        },
+      } as t.ParsedServerConfig;
+      const processedServerConfig = {
+        ...rawServerConfig,
+        url: 'https://api.example.com/user-123',
+        headers: {
+          Authorization: 'Bearer ${SHOULD_NOT_EXPAND}',
+        },
+      };
+      const cleanupOAuthHandler = jest.fn();
+
+      mockProcessMCPEnv.mockReturnValue(processedServerConfig);
+      (MCPConnectionFactory.attachRequestOAuthHandler as jest.Mock).mockReturnValue(
+        cleanupOAuthHandler,
+      );
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(mockConnection),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(rawServerConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const oauthStart = jest.fn();
+
+      await manager.callTool({
+        user: mockUser as IUser,
+        serverName,
+        toolName: 'test_tool',
+        provider: 'openai',
+        oauthStart,
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+      });
+
+      /** One pass from user-connection runtime resolution, one from callTool — none from the handler attach */
+      expect(mockProcessMCPEnv).toHaveBeenCalledTimes(2);
+      expect(MCPConnectionFactory.attachRequestOAuthHandler).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: processedServerConfig,
+          skipEnvProcessing: true,
+        }),
+        expect.objectContaining({
+          oauthStart,
+          user: mockUser,
+        }),
+        mockConnection,
+      );
+      expect(cleanupOAuthHandler).toHaveBeenCalled();
+    });
+
+    it('should leave graph token placeholders sandboxed for user-sourced configs', async () => {
+      const serverConfig: t.ParsedServerConfig = {
+        type: 'sse',
+        url: 'https://api.example.com',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+        source: 'user',
+        dbId: 'user-server-id',
+      };
+
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(mockConnection),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+
+      await manager.callTool({
+        user: mockUser as IUser,
+        serverName,
+        toolName: 'test_tool',
+        provider: 'openai',
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+        graphTokenResolver: mockGraphTokenResolver,
+      });
+
+      expect(graphUtils.preProcessGraphTokens).not.toHaveBeenCalled();
+      expect(mockConnection.setRequestHeaders).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        }),
+      );
+    });
+
     it('should pass options unchanged when no graphTokenResolver is provided', async () => {
       const serverConfig: t.SSEOptions = {
         type: 'sse',
@@ -793,154 +930,544 @@ describe('MCPManager', () => {
     });
   });
 
-  describe('discoverServerTools', () => {
-    const mockTools = [
-      { name: 'tool1', description: 'First tool', inputSchema: { type: 'object' } },
-      { name: 'tool2', description: 'Second tool', inputSchema: { type: 'object' } },
-    ];
+  describe('callTool - OBO Integration', () => {
+    const mockUser: Partial<IUser> = {
+      id: 'user-123',
+      provider: 'openid',
+      openidId: 'oidc-sub-456',
+    };
+
+    const mockFlowManager = {
+      getState: jest.fn(),
+      setState: jest.fn(),
+      clearState: jest.fn(),
+    };
 
     const mockConnection = {
       isConnected: jest.fn().mockResolvedValue(true),
-      fetchTools: jest.fn().mockResolvedValue(mockTools),
+      setRequestHeaders: jest.fn(),
+      timeout: 30000,
+      client: {
+        request: jest.fn().mockResolvedValue({
+          content: [{ type: 'text', text: 'Tool result' }],
+          isError: false,
+        }),
+      },
     } as unknown as MCPConnection;
 
-    beforeEach(() => {
-      (MCPConnectionFactory.discoverTools as jest.Mock) = jest.fn();
-    });
-
-    it('should return tools from existing app connection when available', async () => {
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(mockConnection),
-      });
+    const mockOboTokenResolver = jest.fn();
 
-      const manager = await MCPManager.createInstance(newMCPServersConfig());
-      const result = await manager.discoverServerTools({ serverName });
+    const serverConfig: t.SSEOptions & { obo: { scopes: string } } = {
+      type: 'sse',
+      url: 'https://api.example.com',
+      headers: {
+        Authorization: 'Bearer bootstrap-token',
+      },
+      obo: {
+        scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite',
+      },
+    };
 
-      expect(result.tools).toEqual(mockTools);
-      expect(result.oauthRequired).toBe(false);
-      expect(result.oauthUrl).toBeNull();
-      expect(MCPConnectionFactory.discoverTools).not.toHaveBeenCalled();
+    beforeEach(() => {
+      mockResolveOboToken.mockReset();
     });
 
-    it('should use MCPConnectionFactory.discoverTools when no app connection available', async () => {
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(null),
-      });
+    it('should bypass shared app connections for OBO servers and use a user-scoped connection', async () => {
+      const sharedAppConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        setRequestHeaders: jest.fn(),
+        timeout: 30000,
+        client: {
+          request: jest.fn().mockResolvedValue({
+            content: [{ type: 'text', text: 'Shared tool result' }],
+            isError: false,
+          }),
+        },
+      } as unknown as MCPConnection;
+
+      const userConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        setRequestHeaders: jest.fn(),
+        timeout: 30000,
+        client: {
+          request: jest.fn().mockResolvedValue({
+            content: [{ type: 'text', text: 'User tool result' }],
+            isError: false,
+          }),
+        },
+      } as unknown as MCPConnection;
 
-      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
-        type: 'stdio',
-        command: 'test',
-        args: [],
-      });
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(sharedAppConnection),
+      };
 
-      (MCPConnectionFactory.discoverTools as jest.Mock).mockResolvedValue({
-        tools: mockTools,
-        connection: null,
-        oauthRequired: false,
-        oauthUrl: null,
+      mockResolveOboToken.mockResolvedValue({
+        access_token: 'fresh-obo-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+        expires_at: Date.now() + 3600_000,
       });
 
+      mockAppConnections(appConnections);
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
+
       const manager = await MCPManager.createInstance(newMCPServersConfig());
-      const result = await manager.discoverServerTools({ serverName });
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(userConnection);
 
-      expect(result.tools).toEqual(mockTools);
-      expect(result.oauthRequired).toBe(false);
-      expect(MCPConnectionFactory.discoverTools).toHaveBeenCalled();
-    });
+      await manager.callTool({
+        user: mockUser as IUser,
+        serverName,
+        toolName: 'test_tool',
+        provider: 'openai',
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+        oboTokenResolver: mockOboTokenResolver,
+      });
 
-    it('should forward user, customUserVars, requestBody, and connectionTimeout to discoverTools in the non-OAuth path', async () => {
-      const mockUser = { id: 'user123', email: 'test@example.com' } as unknown as IUser;
-      const customUserVars = { MY_CUSTOM_KEY: 'c527bd0abc123' };
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          serverConfig,
+          user: mockUser,
+        }),
+      );
+      expect(userConnection.setRequestHeaders as jest.Mock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Authorization: 'Bearer fresh-obo-token',
+        }),
+      );
+      expect(sharedAppConnection.setRequestHeaders as jest.Mock).not.toHaveBeenCalled();
+      expect(userConnection.client.request as jest.Mock).toHaveBeenCalled();
+      expect(sharedAppConnection.client.request as jest.Mock).not.toHaveBeenCalled();
+    });
 
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(null),
+    it('should replace Authorization with the refreshed OBO token on each tool call', async () => {
+      mockResolveOboToken.mockResolvedValue({
+        access_token: 'fresh-obo-token',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+        expires_at: Date.now() + 3600_000,
       });
 
-      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
-        type: 'streamable-http',
-        url: 'https://my-mcp.server.com?key={{MY_CUSTOM_KEY}}',
-      });
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(mockConnection),
+      };
 
-      (MCPConnectionFactory.discoverTools as jest.Mock).mockResolvedValue({
-        tools: mockTools,
-        connection: null,
-        oauthRequired: false,
-        oauthUrl: null,
-      });
+      mockAppConnections(appConnections);
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
 
       const manager = await MCPManager.createInstance(newMCPServersConfig());
-      await manager.discoverServerTools({
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(mockConnection);
+
+      await manager.callTool({
+        user: mockUser as IUser,
         serverName,
-        user: mockUser,
-        customUserVars,
-        requestBody: { conversationId: 'conv-123' } as t.ToolDiscoveryOptions['requestBody'],
-        connectionTimeout: 10000,
+        toolName: 'test_tool',
+        provider: 'openai',
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+        oboTokenResolver: mockOboTokenResolver,
       });
 
-      expect(MCPConnectionFactory.discoverTools).toHaveBeenCalledWith(
-        expect.objectContaining({ serverName }),
+      expect(mockResolveOboToken).toHaveBeenCalledWith(
+        mockUser,
+        serverConfig.obo,
+        mockOboTokenResolver,
+      );
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalled();
+      expect(mockConnection.setRequestHeaders).toHaveBeenCalledWith(
         expect.objectContaining({
-          user: mockUser,
-          customUserVars,
-          requestBody: { conversationId: 'conv-123' },
-          connectionTimeout: 10000,
+          Authorization: 'Bearer fresh-obo-token',
         }),
       );
+      expect(mockConnection.client.request).toHaveBeenCalled();
     });
 
-    it('should return null tools when server config not found', async () => {
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(null),
-      });
+    it('should fail closed with a retryable message when per-call OBO refresh has a transient failure', async () => {
+      mockResolveOboToken.mockRejectedValue(
+        new OboTokenResolutionError(
+          'exchange_failed',
+          'Temporary OBO token exchange failure.',
+          true,
+        ),
+      );
 
-      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(null);
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(mockConnection),
+      };
 
-      const manager = await MCPManager.createInstance(newMCPServersConfig());
-      const result = await manager.discoverServerTools({ serverName });
+      mockAppConnections(appConnections);
 
-      expect(result.tools).toBeNull();
-      expect(result.oauthRequired).toBe(false);
-      expect(mockLogger.warn).toHaveBeenCalledWith(
-        expect.stringContaining('Server config not found'),
-      );
-    });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
 
-    it('should return OAuth info when server requires OAuth but no user provided', async () => {
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(null),
-      });
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(mockConnection);
 
-      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
-        type: 'sse',
-        url: 'https://api.example.com',
-        requiresOAuth: true,
+      await expect(
+        manager.callTool({
+          user: mockUser as IUser,
+          serverName,
+          toolName: 'test_tool',
+          provider: 'openai',
+          flowManager: mockFlowManager as unknown as Parameters<
+            typeof manager.callTool
+          >[0]['flowManager'],
+          oboTokenResolver: mockOboTokenResolver,
+        }),
+      ).rejects.toMatchObject({
+        message: expect.stringContaining('Temporary OBO token exchange failure.'),
       });
 
-      const manager = await MCPManager.createInstance(newMCPServersConfig());
-      const result = await manager.discoverServerTools({ serverName });
-
-      expect(result.tools).toBeNull();
-      expect(result.oauthRequired).toBe(true);
-      expect(mockLogger.warn).toHaveBeenCalledWith(
-        expect.stringContaining('OAuth server requires user and flowManager'),
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalled();
+      expect(mockConnection.setRequestHeaders).not.toHaveBeenCalled();
+      expect(mockConnection.client.request).not.toHaveBeenCalled();
+      expect(mockLogger.error).toHaveBeenCalledWith(
+        expect.stringContaining('[test_tool] Tool call failed'),
+        expect.anything(),
       );
     });
 
-    it('should discover tools with OAuth when user and flowManager provided', async () => {
-      const mockUser = { id: 'user123', email: 'test@example.com' } as unknown as IUser;
-      const mockFlowManager = {
-        createFlow: jest.fn(),
-        getFlowState: jest.fn(),
-        deleteFlow: jest.fn(),
+    it('should fail closed with a re-authentication message when per-call OBO refresh has a permanent failure', async () => {
+      mockResolveOboToken.mockRejectedValue(
+        new OboTokenResolutionError(
+          'exchange_failed',
+          'The identity provider rejected the OBO token exchange.',
+        ),
+      );
+
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(mockConnection),
       };
 
-      mockAppConnections({
-        get: jest.fn().mockResolvedValue(null),
-      });
+      mockAppConnections(appConnections);
 
-      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
-        type: 'sse',
-        url: 'https://api.example.com',
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(mockConnection);
+
+      await expect(
+        manager.callTool({
+          user: mockUser as IUser,
+          serverName,
+          toolName: 'test_tool',
+          provider: 'openai',
+          flowManager: mockFlowManager as unknown as Parameters<
+            typeof manager.callTool
+          >[0]['flowManager'],
+          oboTokenResolver: mockOboTokenResolver,
+        }),
+      ).rejects.toMatchObject({
+        message: expect.stringContaining('verify the configured OBO scopes'),
+      });
+
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalled();
+      expect(mockConnection.setRequestHeaders).not.toHaveBeenCalled();
+      expect(mockConnection.client.request).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('getConnection', () => {
+    const mockUser: Partial<IUser> = {
+      id: 'user-123',
+      provider: 'openid',
+      openidId: 'oidc-sub-456',
+    };
+
+    it('should continue using shared app connections for non-OBO servers', async () => {
+      const appConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(appConnection),
+      };
+
+      const nonOboConfig: t.SSEOptions = {
+        type: 'sse',
+        url: 'https://api.example.com',
+      };
+
+      mockAppConnections(appConnections);
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(nonOboConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const getUserConnectionSpy = jest.spyOn(manager, 'getUserConnection');
+
+      const connection = await manager.getConnection({
+        serverName,
+        user: mockUser as IUser,
+      });
+
+      expect(connection).toBe(appConnection);
+      expect(appConnections.get).toHaveBeenCalledWith(serverName);
+      expect(getUserConnectionSpy).not.toHaveBeenCalled();
+    });
+
+    it('should use user-scoped connections for trusted runtime context placeholders', async () => {
+      const appConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const userConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(appConnection),
+      };
+      const runtimeHeaderConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'yaml',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      };
+
+      mockAppConnections(appConnections);
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeHeaderConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(userConnection);
+
+      const connection = await manager.getConnection({
+        serverName,
+        user: mockUser as IUser,
+      });
+
+      expect(connection).toBe(userConnection);
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          serverConfig: runtimeHeaderConfig,
+          user: mockUser,
+        }),
+      );
+    });
+  });
+
+  describe('discoverServerTools', () => {
+    const mockTools = [
+      { name: 'tool1', description: 'First tool', inputSchema: { type: 'object' } },
+      { name: 'tool2', description: 'Second tool', inputSchema: { type: 'object' } },
+    ];
+
+    const mockConnection = {
+      isConnected: jest.fn().mockResolvedValue(true),
+      fetchTools: jest.fn().mockResolvedValue(mockTools),
+      disconnect: jest.fn().mockResolvedValue(undefined),
+    } as unknown as MCPConnection;
+
+    beforeEach(() => {
+      (MCPConnectionFactory.discoverTools as jest.Mock) = jest.fn();
+    });
+
+    it('should return tools from existing app connection when available', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(mockConnection),
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result.tools).toEqual(mockTools);
+      expect(result.oauthRequired).toBe(false);
+      expect(result.oauthUrl).toBeNull();
+      expect(MCPConnectionFactory.discoverTools).not.toHaveBeenCalled();
+    });
+
+    it('should use MCPConnectionFactory.discoverTools when no app connection available', async () => {
+      const discoveryConnection = {
+        disconnect: jest.fn().mockResolvedValue(undefined),
+      } as unknown as MCPConnection;
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'stdio',
+        command: 'test',
+        args: [],
+      });
+
+      (MCPConnectionFactory.discoverTools as jest.Mock).mockResolvedValue({
+        tools: mockTools,
+        connection: discoveryConnection,
+        oauthRequired: false,
+        oauthUrl: null,
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result.tools).toEqual(mockTools);
+      expect(result.oauthRequired).toBe(false);
+      expect(MCPConnectionFactory.discoverTools).toHaveBeenCalled();
+      expect(discoveryConnection.disconnect).toHaveBeenCalledTimes(1);
+    });
+
+    it('should forward runtime context to discoverTools in the non-OAuth path', async () => {
+      const mockUser = { id: 'user123', email: 'test@example.com' } as unknown as IUser;
+      const customUserVars = { MY_CUSTOM_KEY: 'c527bd0abc123' };
+      const graphTokenResolver = jest.fn();
+
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://my-mcp.server.com?key={{MY_CUSTOM_KEY}}',
+      });
+
+      (MCPConnectionFactory.discoverTools as jest.Mock).mockResolvedValue({
+        tools: mockTools,
+        connection: null,
+        oauthRequired: false,
+        oauthUrl: null,
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.discoverServerTools({
+        serverName,
+        user: mockUser,
+        customUserVars,
+        requestBody: { conversationId: 'conv-123' } as t.ToolDiscoveryOptions['requestBody'],
+        graphTokenResolver,
+        connectionTimeout: 10000,
+      });
+
+      expect(MCPConnectionFactory.discoverTools).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          serverConfig: expect.objectContaining({
+            url: 'https://my-mcp.server.com?key={{MY_CUSTOM_KEY}}',
+          }),
+        }),
+        expect.objectContaining({
+          user: mockUser,
+          customUserVars,
+          requestBody: { conversationId: 'conv-123' },
+          graphTokenResolver,
+          connectionTimeout: 10000,
+        }),
+      );
+    });
+
+    it('should not discover BODY-scoped servers without request body context', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result).toEqual({ tools: null, oauthRequired: false, oauthUrl: null });
+      expect(MCPConnectionFactory.discoverTools).not.toHaveBeenCalled();
+      expect(mockLogger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('Request body field(s) required'),
+      );
+      expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('messageId'));
+    });
+
+    it('should return null tools when server config not found', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(null);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result.tools).toBeNull();
+      expect(result.oauthRequired).toBe(false);
+      expect(mockLogger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('Server config not found'),
+      );
+    });
+
+    it('should treat configured oauth as OAuth when requiresOAuth is unset', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'sse',
+        url: 'https://api.example.com',
+        oauth: {
+          authorization_url: 'https://auth.example.com/oauth/authorize',
+          token_url: 'https://auth.example.com/oauth/token',
+        },
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result.tools).toBeNull();
+      expect(result.oauthRequired).toBe(true);
+      expect(MCPConnectionFactory.discoverTools).not.toHaveBeenCalled();
+    });
+
+    it('should return OAuth info when server requires OAuth but no user provided', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'sse',
+        url: 'https://api.example.com',
+        requiresOAuth: true,
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result.tools).toBeNull();
+      expect(result.oauthRequired).toBe(true);
+      expect(mockLogger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('OAuth server requires user and flowManager'),
+      );
+    });
+
+    it('should discover tools with OAuth when user and flowManager provided', async () => {
+      const mockUser = { id: 'user123', email: 'test@example.com' } as unknown as IUser;
+      const mockFlowManager = {
+        createFlow: jest.fn(),
+        getFlowState: jest.fn(),
+        deleteFlow: jest.fn(),
+      };
+
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'sse',
+        url: 'https://api.example.com',
         requiresOAuth: true,
       });
 
@@ -956,6 +1483,7 @@ describe('MCPManager', () => {
         serverName,
         user: mockUser,
         flowManager: mockFlowManager as unknown as t.ToolDiscoveryOptions['flowManager'],
+        graphTokenResolver: jest.fn(),
       });
 
       expect(result.tools).toEqual(mockTools);
@@ -963,8 +1491,520 @@ describe('MCPManager', () => {
       expect(result.oauthUrl).toBe('https://auth.example.com/authorize');
       expect(MCPConnectionFactory.discoverTools).toHaveBeenCalledWith(
         expect.objectContaining({ serverName }),
-        expect.objectContaining({ user: mockUser, useOAuth: true }),
+        expect.objectContaining({
+          user: mockUser,
+          useOAuth: true,
+          graphTokenResolver: expect.any(Function),
+        }),
+      );
+    });
+  });
+
+  describe('getUserConnection - useOAuth derivation', () => {
+    const mockUser = { id: userId, email: 'test@example.com' } as unknown as IUser;
+    const mockFlowManager = {
+      createFlow: jest.fn(),
+      getFlowState: jest.fn(),
+      deleteFlow: jest.fn(),
+    };
+    const mockConnection = {
+      isConnected: jest.fn().mockResolvedValue(true),
+      isStale: jest.fn().mockReturnValue(false),
+      disconnect: jest.fn(),
+    } as unknown as MCPConnection;
+
+    it('should pass useOAuth for servers with configured oauth and no requiresOAuth value', async () => {
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'sse',
+        url: 'https://oauth-mcp.example.com',
+        oauth: {
+          authorization_url: 'https://auth.example.com/oauth/authorize',
+          token_url: 'https://auth.example.com/oauth/token',
+        },
+      });
+
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        flowManager: mockFlowManager as unknown as t.UserMCPConnectionOptions['flowManager'],
+      });
+
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({ serverName }),
+        expect.objectContaining({ useOAuth: true }),
+      );
+    });
+
+    it('should not pass useOAuth for servers with requiresOAuth: false', async () => {
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'streamable-http',
+        url: 'http://private-mcp.svc:5446/mcp',
+        requiresOAuth: false,
+        oauth: {
+          authorization_url: 'https://auth.example.com/oauth/authorize',
+          token_url: 'https://auth.example.com/oauth/token',
+        },
+      });
+
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+      });
+
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({ serverName }),
+        expect.not.objectContaining({ useOAuth: true }),
+      );
+    });
+
+    it('should detect OAuth after resolving trusted runtime URL placeholders', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/users/{{LIBRECHAT_USER_ID}}/mcp',
+        source: 'yaml',
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, user }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_USER_ID}}', user?.id ?? ''),
+        }),
+      }));
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: true,
+        method: 'protected-resource-metadata',
+      });
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        flowManager: mockFlowManager as unknown as t.UserMCPConnectionOptions['flowManager'],
+      });
+
+      expect(mockDetectOAuthRequirement).toHaveBeenCalledWith(
+        'https://api.example.com/users/test-user-123/mcp',
+        null,
+        null,
+      );
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            requiresOAuth: true,
+          }),
+        }),
+        expect.objectContaining({ useOAuth: true }),
+      );
+    });
+
+    it('should reject disallowed runtime URLs before OAuth detection probes them', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(false);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'evil.com/path' },
+          flowManager: mockFlowManager as unknown as t.UserMCPConnectionOptions['flowManager'],
+        }),
+      ).rejects.toThrow('not allowed by the configured domain policy');
+
+      expect(mockDetectOAuthRequirement).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should reject resolved runtime URLs that fail MCP domain policy', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(false);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'evil.com/path' },
+        }),
+      ).rejects.toThrow('not allowed by the configured domain policy');
+
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://evil.com/path.example.com/mcp',
+        }),
+        ['*.example.com'],
+        null,
+      );
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should validate resolved runtime URLs without passing resolved configs to the factory', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(true);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { conversationId: 'tenant-a' },
+      });
+
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://tenant-a.example.com/mcp',
+        }),
+        ['*.example.com'],
+        null,
+      );
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+          }),
+        }),
+        expect.objectContaining({
+          requestBody: { conversationId: 'tenant-a' },
+        }),
+      );
+    });
+
+    it('should keep graph placeholders unresolved for user-sourced connection configs', async () => {
+      const graphConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'user',
+        dbId: 'user-server-id',
+        requiresOAuth: false,
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(graphConfig);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        graphTokenResolver: jest.fn(),
+      });
+
+      expect(graphUtils.preProcessGraphTokens).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            headers: {
+              Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+            },
+          }),
+        }),
+        expect.any(Object),
       );
     });
+
+    it('should not cache connections when request body placeholders affect the URL', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const firstConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const secondConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock)
+        .mockResolvedValueOnce(firstConnection)
+        .mockResolvedValueOnce(secondConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const first = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+      });
+      const second = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-2' },
+      });
+
+      expect(first).toBe(firstConnection);
+      expect(second).toBe(secondConnection);
+      expect(MCPConnectionFactory.create).toHaveBeenCalledTimes(2);
+    });
+
+    it('should reuse BODY-scoped connections within a request-scoped connection store', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const requestScopedConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const requestScopedConnections: t.RequestScopedMCPConnectionStore = {
+        connections: new Map(),
+        pending: new Map(),
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(requestScopedConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const first = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+        requestScopedConnections,
+      });
+      const second = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+        requestScopedConnections,
+      });
+
+      expect(first).toBe(requestScopedConnection);
+      expect(second).toBe(requestScopedConnection);
+      expect(MCPConnectionFactory.create).toHaveBeenCalledTimes(1);
+      expect(requestScopedConnections.connections.get(`${mockUser.id}:${serverName}`)).toBe(
+        requestScopedConnection,
+      );
+    });
+
+    it('should not clear server cooldowns for ephemeral runtime connections', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const clearCooldownSpy = jest.spyOn(MCPConnection, 'clearCooldown');
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      try {
+        const manager = await MCPManager.createInstance(newMCPServersConfig());
+        await manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { messageId: 'message-1' },
+        });
+
+        expect(clearCooldownSpy).not.toHaveBeenCalled();
+      } finally {
+        clearCooldownSpy.mockRestore();
+      }
+    });
+
+    it('should still clear server cooldowns for explicit forceNew connections', async () => {
+      const staticConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const clearCooldownSpy = jest.spyOn(MCPConnection, 'clearCooldown');
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(staticConfig);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      try {
+        const manager = await MCPManager.createInstance(newMCPServersConfig());
+        await manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          forceNew: true,
+        });
+
+        expect(clearCooldownSpy).toHaveBeenCalledWith(serverName);
+      } finally {
+        clearCooldownSpy.mockRestore();
+      }
+    });
+
+    it('should reject BODY-scoped connections without request body context', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+        }),
+      ).rejects.toThrow('Request body field(s) required');
+
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should reject BODY-scoped connections when a referenced body field is missing', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'conv-123' },
+        }),
+      ).rejects.toThrow('messageId');
+
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should throw when OAuth server lacks flowManager', async () => {
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'sse',
+        url: 'https://oauth-mcp.example.com',
+        requiresOAuth: true,
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+        }),
+      ).rejects.toThrow('requires a flowManager');
+    });
   });
 });
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthAudience.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthAudience.test.ts
new file mode 100644
index 00000000000..80790da57de
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/MCPOAuthAudience.test.ts
@@ -0,0 +1,249 @@
+/**
+ * Tests that the optional `audience` field on `mcpServers.<name>.oauth` is
+ * forwarded into:
+ *   - the pre-configured authorize URL build
+ *   - the `refresh_token` grant body
+ *
+ * The authorize URL is verified by parsing the URL produced by
+ * `initiateOAuthFlow`. The refresh case is verified by intercepting the
+ * outbound /token POST body via a local HTTP server that records every
+ * request body it receives.
+ */
+
+import * as http from 'http';
+import * as net from 'net';
+import type { Socket } from 'net';
+import { TokenExchangeMethodEnum } from 'librechat-data-provider';
+import { MCPOAuthHandler } from '~/mcp/oauth';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+  getTenantId: jest.fn(),
+  SYSTEM_TENANT_ID: '__SYSTEM__',
+  encryptV2: jest.fn(async (val: string) => `enc:${val}`),
+  decryptV2: jest.fn(async (val: string) => val.replace(/^enc:/, '')),
+}));
+
+/** Bypass SSRF for local test endpoints. */
+jest.mock('~/auth', () => ({
+  ...jest.requireActual('~/auth'),
+  createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isSSRFTarget: jest.fn(() => false),
+  resolveHostnameSSRF: jest.fn(async () => false),
+  isOAuthUrlAllowed: jest.fn(() => true),
+}));
+
+function getFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.listen(0, '127.0.0.1', () => {
+      const addr = srv.address() as net.AddressInfo;
+      srv.close((err) => (err ? reject(err) : resolve(addr.port)));
+    });
+  });
+}
+
+function trackSockets(httpServer: http.Server): () => Promise<void> {
+  const sockets = new Set<Socket>();
+  httpServer.on('connection', (socket: Socket) => {
+    sockets.add(socket);
+    socket.once('close', () => sockets.delete(socket));
+  });
+  return () =>
+    new Promise<void>((resolve) => {
+      for (const socket of sockets) {
+        socket.destroy();
+      }
+      sockets.clear();
+      httpServer.close(() => resolve());
+    });
+}
+
+/**
+ * Tiny /token endpoint that records every request body and responds with a
+ * valid OAuth token payload. Sufficient to assert what LibreChat actually
+ * sends to the authorization server during a refresh exchange.
+ */
+async function startRecordingTokenServer(): Promise<{
+  url: string;
+  bodies: URLSearchParams[];
+  close: () => Promise<void>;
+}> {
+  const bodies: URLSearchParams[] = [];
+  const port = await getFreePort();
+  const server = http.createServer((req, res) => {
+    if (req.method !== 'POST') {
+      res.writeHead(405);
+      res.end();
+      return;
+    }
+    let raw = '';
+    req.on('data', (chunk) => (raw += chunk));
+    req.on('end', () => {
+      bodies.push(new URLSearchParams(raw));
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          access_token: 'new-access-token',
+          token_type: 'Bearer',
+          expires_in: 3600,
+        }),
+      );
+    });
+  });
+  const close = trackSockets(server);
+  await new Promise<void>((resolve) => server.listen(port, '127.0.0.1', resolve));
+  return { url: `http://127.0.0.1:${port}/`, bodies, close };
+}
+
+describe('MCP OAuth audience parameter', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('pre-configured authorize URL', () => {
+    it('appends audience= query parameter when configured', async () => {
+      const { authorizationUrl } = await MCPOAuthHandler.initiateOAuthFlow(
+        'test-server',
+        'https://example.test/mcp',
+        'user-1',
+        {},
+        {
+          authorization_url: 'https://auth.example.test/authorize',
+          token_url: 'https://auth.example.test/token',
+          client_id: 'test-client',
+          client_secret: 'test-secret',
+          redirect_uri: 'https://example.test/api/mcp/test-server/oauth/callback',
+          scope: 'read execute',
+          audience: 'https://example.test/mcp',
+          token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        },
+      );
+
+      const url = new URL(authorizationUrl);
+      expect(url.searchParams.get('audience')).toBe('https://example.test/mcp');
+    });
+
+    it('omits audience when not configured', async () => {
+      const { authorizationUrl } = await MCPOAuthHandler.initiateOAuthFlow(
+        'test-server',
+        'https://example.test/mcp',
+        'user-1',
+        {},
+        {
+          authorization_url: 'https://auth.example.test/authorize',
+          token_url: 'https://auth.example.test/token',
+          client_id: 'test-client',
+          client_secret: 'test-secret',
+          redirect_uri: 'https://example.test/api/mcp/test-server/oauth/callback',
+          scope: 'read',
+          token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        },
+      );
+
+      const url = new URL(authorizationUrl);
+      expect(url.searchParams.has('audience')).toBe(false);
+    });
+  });
+
+  describe('refresh_token grant body', () => {
+    let recorder: Awaited<ReturnType<typeof startRecordingTokenServer>>;
+
+    beforeEach(async () => {
+      recorder = await startRecordingTokenServer();
+    });
+
+    afterEach(async () => {
+      await recorder.close();
+    });
+
+    it('appends audience to refresh body when configured', async () => {
+      await MCPOAuthHandler.refreshOAuthTokens(
+        'refresh-token-value',
+        {
+          serverName: 'test-server',
+          serverUrl: recorder.url,
+          clientInfo: {
+            client_id: 'test-client',
+            client_secret: 'test-secret',
+            redirect_uris: ['http://localhost/callback'],
+          },
+        },
+        {},
+        {
+          token_url: `${recorder.url}token`,
+          client_id: 'test-client',
+          client_secret: 'test-secret',
+          audience: 'https://example.test/mcp',
+          token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        },
+      );
+
+      expect(recorder.bodies.length).toBeGreaterThan(0);
+      const body = recorder.bodies[recorder.bodies.length - 1];
+      expect(body.get('grant_type')).toBe('refresh_token');
+      expect(body.get('audience')).toBe('https://example.test/mcp');
+    });
+
+    it('omits audience from refresh body when forward_audience_on_refresh=false (Cognito opt-out)', async () => {
+      await MCPOAuthHandler.refreshOAuthTokens(
+        'refresh-token-value',
+        {
+          serverName: 'test-server',
+          serverUrl: recorder.url,
+          clientInfo: {
+            client_id: 'test-client',
+            client_secret: 'test-secret',
+            redirect_uris: ['http://localhost/callback'],
+          },
+        },
+        {},
+        {
+          token_url: `${recorder.url}token`,
+          client_id: 'test-client',
+          client_secret: 'test-secret',
+          audience: 'https://example.test/mcp',
+          forward_audience_on_refresh: false,
+          token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        },
+      );
+
+      expect(recorder.bodies.length).toBeGreaterThan(0);
+      const body = recorder.bodies[recorder.bodies.length - 1];
+      expect(body.get('grant_type')).toBe('refresh_token');
+      expect(body.has('audience')).toBe(false);
+    });
+
+    it('omits audience from refresh body when not configured', async () => {
+      await MCPOAuthHandler.refreshOAuthTokens(
+        'refresh-token-value',
+        {
+          serverName: 'test-server',
+          serverUrl: recorder.url,
+          clientInfo: {
+            client_id: 'test-client',
+            client_secret: 'test-secret',
+            redirect_uris: ['http://localhost/callback'],
+          },
+        },
+        {},
+        {
+          token_url: `${recorder.url}token`,
+          client_id: 'test-client',
+          client_secret: 'test-secret',
+          token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        },
+      );
+
+      expect(recorder.bodies.length).toBeGreaterThan(0);
+      const body = recorder.bodies[recorder.bodies.length - 1];
+      expect(body.get('grant_type')).toBe('refresh_token');
+      expect(body.has('audience')).toBe(false);
+    });
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthClientRegistrationReuse.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthClientRegistrationReuse.test.ts
index 75cf4147b22..68723ea099f 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthClientRegistrationReuse.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthClientRegistrationReuse.test.ts
@@ -45,7 +45,7 @@ jest.mock('@librechat/data-schemas', () => ({
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
   resolveHostnameSSRF: jest.fn(async () => false),
-  isSSRFTarget: jest.fn(async () => false),
+  isSSRFTarget: jest.fn(() => false),
   isOAuthUrlAllowed: jest.fn(() => true),
 }));
 
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
index 79470337a75..dcacd2b18ec 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
@@ -5,12 +5,12 @@
  * oauthFailed rejection, timeout behavior, and token expiry mid-session.
  */
 
-import { MCPConnection } from '~/mcp/connection';
-import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { createOAuthMCPServer } from './helpers/oauthTestServer';
 import type { OAuthTestServer } from './helpers/oauthTestServer';
 import type { StreamableHTTPOptions } from '~/mcp/types';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { createOAuthMCPServer } from './helpers/oauthTestServer';
+import { MCPConnection } from '~/mcp/connection';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -21,10 +21,13 @@ jest.mock('@librechat/data-schemas', () => ({
   },
   encryptV2: jest.fn(async (val: string) => `enc:${val}`),
   decryptV2: jest.fn(async (val: string) => val.replace(/^enc:/, '')),
+  getTenantId: jest.fn(),
 }));
 
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthFlow.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthFlow.test.ts
index cbd29d35710..545540ee579 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthFlow.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthFlow.test.ts
@@ -30,6 +30,7 @@ jest.mock('@librechat/data-schemas', () => ({
 /** Bypass SSRF validation — these tests use real local HTTP servers. */
 jest.mock('~/auth', () => ({
   ...jest.requireActual('~/auth'),
+  createSSRFSafeUndiciConnect: jest.fn(() => undefined),
   isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
index bf907422f59..fbb682c3cf5 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
@@ -31,9 +31,15 @@ jest.mock('@librechat/data-schemas', () => ({
 
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
+jest.mock('~/auth/domain', () => ({
+  isMCPDomainAllowed: jest.fn().mockResolvedValue(true),
+}));
+
 jest.mock('~/mcp/mcpConfig', () => ({
   mcpConfig: { CONNECTION_CHECK_TTL: 0, USER_CONNECTION_IDLE_TIMEOUT: 30 * 60 * 1000 },
 }));
@@ -43,6 +49,7 @@ const mockLogger = logger as jest.Mocked<typeof logger>;
 describe('MCP OAuth Race Condition Fixes', () => {
   afterEach(() => {
     jest.clearAllMocks();
+    jest.restoreAllMocks();
   });
 
   describe('Fix 1: Connection mutex coalesces concurrent attempts', () => {
@@ -75,7 +82,7 @@ describe('MCP OAuth Race Condition Fixes', () => {
         dbId: undefined,
       };
 
-      jest
+      const registrySpy = jest
         .spyOn(
           // eslint-disable-next-line @typescript-eslint/no-require-imports
           require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
@@ -86,6 +93,11 @@ describe('MCP OAuth Race Condition Fixes', () => {
           shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
           getAllowedDomains: jest.fn().mockReturnValue(null),
           getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
         });
 
       const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
@@ -95,27 +107,223 @@ describe('MCP OAuth Race Condition Fixes', () => {
         return mockConnection as never;
       });
 
-      const store = new MockKeyv();
-      const flowManager = new FlowStateManager(store as unknown as Keyv, { ttl: 30000, ci: true });
-      const user = { id: 'user-1' };
-      const opts = {
-        serverName: 'test-server',
-        user: user as never,
-        flowManager: flowManager as never,
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-1' };
+        const opts = {
+          serverName: 'test-server',
+          user: user as never,
+          flowManager: flowManager as never,
+        };
+
+        const [conn1, conn2, conn3] = await Promise.all([
+          manager.getUserConnection(opts),
+          manager.getUserConnection(opts),
+          manager.getUserConnection(opts),
+        ]);
+
+        expect(conn1).toBe(conn2);
+        expect(conn2).toBe(conn3);
+        expect(createSpy).toHaveBeenCalledTimes(1);
+        expect(manager.createCallCount).toBe(1);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
+    });
+
+    it('should re-issue the pending OAuth URL when joining an in-flight connection', async () => {
+      const { UserConnectionManager } = await import('~/mcp/UserConnectionManager');
+
+      class TestManager extends UserConnectionManager {}
+
+      const manager = new TestManager();
+
+      const mockConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        disconnect: jest.fn().mockResolvedValue(undefined),
+        isStale: jest.fn().mockReturnValue(false),
+      };
+
+      const mockAppConnections = { has: jest.fn().mockResolvedValue(false) };
+      manager.appConnections = mockAppConnections as never;
+
+      const mockConfig = {
+        type: 'streamable-http',
+        url: 'http://localhost:9999/',
+        updatedAt: undefined,
+        dbId: undefined,
+      };
+
+      const registrySpy = jest
+        .spyOn(
+          // eslint-disable-next-line @typescript-eslint/no-require-imports
+          require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
+          'getInstance',
+        )
+        .mockReturnValue({
+          getServerConfig: jest.fn().mockResolvedValue(mockConfig),
+          shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
+          getAllowedDomains: jest.fn().mockReturnValue(null),
+          getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
+        });
+
+      const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
+      const createSpy = jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
+        await new Promise((r) => setTimeout(r, 100));
+        return mockConnection as never;
+      });
+
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-oauth' };
+        const serverName = 'test-server';
+        const authorizationUrl = 'https://auth.example.com/existing';
+        await flowManager.initFlow(`${user.id}:${serverName}`, 'mcp_oauth', { authorizationUrl });
+
+        const firstConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+        });
+        const oauthStart = jest.fn().mockResolvedValue(undefined);
+        const joinedConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart,
+        });
+
+        const [conn1, conn2] = await Promise.all([firstConnection, joinedConnection]);
+
+        expect(conn1).toBe(conn2);
+        expect(oauthStart).toHaveBeenCalledWith(
+          authorizationUrl,
+          expect.objectContaining({ expiresAt: expect.any(Number) }),
+        );
+        expect(createSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
+    });
+
+    it('should preserve pending OAuth expiry when joining after the prompt was emitted', async () => {
+      const { UserConnectionManager } = await import('~/mcp/UserConnectionManager');
+
+      class TestManager extends UserConnectionManager {}
+
+      const manager = new TestManager();
+
+      const mockConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        disconnect: jest.fn().mockResolvedValue(undefined),
+        isStale: jest.fn().mockReturnValue(false),
       };
 
-      const [conn1, conn2, conn3] = await Promise.all([
-        manager.getUserConnection(opts),
-        manager.getUserConnection(opts),
-        manager.getUserConnection(opts),
-      ]);
+      const mockAppConnections = { has: jest.fn().mockResolvedValue(false) };
+      manager.appConnections = mockAppConnections as never;
 
-      expect(conn1).toBe(conn2);
-      expect(conn2).toBe(conn3);
-      expect(createSpy).toHaveBeenCalledTimes(1);
-      expect(manager.createCallCount).toBe(1);
+      const mockConfig = {
+        type: 'streamable-http',
+        url: 'http://localhost:9999/',
+        requiresOAuth: true,
+        updatedAt: undefined,
+        dbId: undefined,
+      };
 
-      createSpy.mockRestore();
+      const registrySpy = jest
+        .spyOn(
+          // eslint-disable-next-line @typescript-eslint/no-require-imports
+          require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
+          'getInstance',
+        )
+        .mockReturnValue({
+          getServerConfig: jest.fn().mockResolvedValue(mockConfig),
+          shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
+          getAllowedDomains: jest.fn().mockReturnValue(null),
+          getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
+        });
+
+      let releaseConnection: () => void = () => undefined;
+      const connectionReleased = new Promise<void>((resolve) => {
+        releaseConnection = resolve;
+      });
+
+      const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
+      const authorizationUrl = 'https://auth.example.com/current';
+      const createSpy = jest
+        .spyOn(MCPConnectionFactory, 'create')
+        .mockImplementation(async (_basicOptions, oauthOptions) => {
+          if (oauthOptions && 'oauthStart' in oauthOptions) {
+            await oauthOptions.oauthStart?.(authorizationUrl);
+          }
+          await connectionReleased;
+          return mockConnection as never;
+        });
+
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-oauth-emitted' };
+        const serverName = 'test-server';
+        await flowManager.initFlow(`${user.id}:${serverName}`, 'mcp_oauth', { authorizationUrl });
+
+        const firstOAuthStart = jest.fn().mockResolvedValue(undefined);
+        const firstConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart: firstOAuthStart,
+        });
+        for (let i = 0; i < 20 && firstOAuthStart.mock.calls.length === 0; i++) {
+          await new Promise((resolve) => setTimeout(resolve, 5));
+        }
+        expect(firstOAuthStart).toHaveBeenCalledWith(authorizationUrl, undefined);
+
+        const joinedOAuthStart = jest.fn().mockResolvedValue(undefined);
+        const joinedConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart: joinedOAuthStart,
+        });
+
+        releaseConnection();
+        const [conn1, conn2] = await Promise.all([firstConnection, joinedConnection]);
+
+        expect(conn1).toBe(conn2);
+        expect(joinedOAuthStart).toHaveBeenCalledWith(
+          authorizationUrl,
+          expect.objectContaining({ expiresAt: expect.any(Number) }),
+        );
+        expect(createSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        releaseConnection();
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
     });
 
     it('should not coalesce when forceNew is true', async () => {
@@ -142,7 +350,7 @@ describe('MCP OAuth Race Condition Fixes', () => {
         dbId: undefined,
       };
 
-      jest
+      const registrySpy = jest
         .spyOn(
           // eslint-disable-next-line @typescript-eslint/no-require-imports
           require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
@@ -153,36 +361,49 @@ describe('MCP OAuth Race Condition Fixes', () => {
           shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
           getAllowedDomains: jest.fn().mockReturnValue(null),
           getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
         });
 
       const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
-      jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
+      const createSpy = jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
         callCount++;
         await new Promise((r) => setTimeout(r, 50));
         return makeConnection() as never;
       });
 
-      const store = new MockKeyv();
-      const flowManager = new FlowStateManager(store as unknown as Keyv, { ttl: 30000, ci: true });
-      const user = { id: 'user-2' };
-
-      const [conn1, conn2] = await Promise.all([
-        manager.getUserConnection({
-          serverName: 'test-server',
-          forceNew: true,
-          user: user as never,
-          flowManager: flowManager as never,
-        }),
-        manager.getUserConnection({
-          serverName: 'test-server',
-          forceNew: true,
-          user: user as never,
-          flowManager: flowManager as never,
-        }),
-      ]);
-
-      expect(callCount).toBe(2);
-      expect(conn1).not.toBe(conn2);
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-2' };
+
+        const [conn1, conn2] = await Promise.all([
+          manager.getUserConnection({
+            serverName: 'test-server',
+            forceNew: true,
+            user: user as never,
+            flowManager: flowManager as never,
+          }),
+          manager.getUserConnection({
+            serverName: 'test-server',
+            forceNew: true,
+            user: user as never,
+            flowManager: flowManager as never,
+          }),
+        ]);
+
+        expect(callCount).toBe(2);
+        expect(conn1).not.toBe(conn2);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
     });
   });
 
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
index b5cbc869a8b..dad34d31bef 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
@@ -13,11 +13,11 @@
 
 import { Keyv } from 'keyv';
 import { logger } from '@librechat/data-schemas';
-import { FlowStateManager, PENDING_STALE_MS } from '~/flow/manager';
-import { MCPTokenStorage, ReauthenticationRequiredError } from '~/mcp/oauth';
-import { MockKeyv, InMemoryTokenStore, createOAuthMCPServer } from './helpers/oauthTestServer';
 import type { OAuthTestServer } from './helpers/oauthTestServer';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
+import { MockKeyv, InMemoryTokenStore, createOAuthMCPServer } from './helpers/oauthTestServer';
+import { MCPTokenStorage, ReauthenticationRequiredError } from '~/mcp/oauth';
+import { FlowStateManager, PENDING_STALE_MS } from '~/flow/manager';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -613,10 +613,10 @@ describe('MCP OAuth Token Expiry Scenarios', () => {
         authorizationUrl: 'https://example.com/auth',
       });
 
-      // Manually age the flow to 3 minutes
+      // Manually age the flow past the staleness window
       const state = await flowManager.getFlowState(flowId, 'mcp_oauth');
       if (state) {
-        state.createdAt = Date.now() - 3 * 60 * 1000;
+        state.createdAt = Date.now() - PENDING_STALE_MS - 60 * 1000;
         await (flowStore as unknown as { set: (k: string, v: unknown) => Promise<void> }).set(
           `mcp_oauth:${flowId}`,
           state,
@@ -627,7 +627,7 @@ describe('MCP OAuth Token Expiry Scenarios', () => {
       expect(agedState?.status).toBe('PENDING');
 
       const age = agedState?.createdAt ? Date.now() - agedState.createdAt : 0;
-      expect(age).toBeGreaterThan(2 * 60 * 1000);
+      expect(age).toBeGreaterThan(PENDING_STALE_MS);
 
       // A new flow should be created (the stale one would be deleted + recreated)
       // This verifies our staleness check threshold
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
index a1db56f95db..674350f2b07 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
@@ -348,6 +348,7 @@ describe('MCPTokenStorage', () => {
       expect(refreshTokens).toHaveBeenCalledWith(
         'rt',
         expect.objectContaining({ userId: 'u1', serverName: 'srv1' }),
+        undefined,
       );
     });
 
@@ -475,6 +476,7 @@ describe('MCPTokenStorage', () => {
         expect.objectContaining({
           clientInfo: expect.objectContaining({ client_id: 'cid' }),
         }),
+        undefined,
       );
     });
 
@@ -716,6 +718,153 @@ describe('MCPTokenStorage', () => {
     });
   });
 
+  describe('forceRefreshTokens', () => {
+    it('should refresh and store tokens even when access token is not locally expired', async () => {
+      // Access token still has time on the clock (1 hour), but the server has
+      // invalidated it (we simulate a mid-session 401 by calling forceRefreshTokens
+      // directly). The local `expires_at` must be ignored — the 401 is the signal.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+        token: 'enc:stale-access-token',
+        expiresIn: 3600,
+      });
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockResolvedValue({
+        access_token: 'new-access-token',
+        refresh_token: 'new-rt',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        obtained_at: Date.now(),
+      });
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        updateToken: store.updateToken,
+        deleteTokens: store.deleteTokens,
+        refreshTokens,
+      });
+
+      expect(result).not.toBeNull();
+      expect(result!.access_token).toBe('new-access-token');
+      expect(refreshTokens).toHaveBeenCalledWith(
+        'rt',
+        expect.objectContaining({
+          userId: 'u1',
+          serverName: 'srv1',
+          identifier: 'mcp:srv1',
+        }),
+        undefined,
+      );
+
+      // The new access token is persisted, replacing the stale one.
+      const saved = await store.findToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+      });
+      expect(saved!.token).toBe('enc:new-access-token');
+    });
+
+    it('should return null when no refresh token is stored', async () => {
+      // Access token exists locally, but no refresh token. Silent refresh is
+      // not possible — the caller must fall back to interactive OAuth.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+        token: 'enc:any',
+        expiresIn: 3600,
+      });
+
+      const refreshTokens = jest.fn();
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        refreshTokens,
+      });
+
+      expect(result).toBeNull();
+      expect(refreshTokens).not.toHaveBeenCalled();
+    });
+
+    it('should return null when refresh callback throws non-client-rejection error', async () => {
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockRejectedValue(new Error('network blew up'));
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        refreshTokens,
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it('should throw ReauthenticationRequiredError when refresh fails with invalid_client', async () => {
+      // Mirrors the contract that getTokens has on stale client registration —
+      // forceRefreshTokens cleans up the stale state and signals re-auth.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_client',
+        identifier: 'mcp:srv1:client',
+        token: 'enc:{"client_id":"cid"}',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockRejectedValue(new Error('invalid_client'));
+
+      await expect(
+        MCPTokenStorage.forceRefreshTokens({
+          userId: 'u1',
+          serverName: 'srv1',
+          findToken: store.findToken,
+          createToken: store.createToken,
+          deleteTokens: store.deleteTokens,
+          refreshTokens,
+        }),
+      ).rejects.toThrow(ReauthenticationRequiredError);
+
+      expect(
+        await store.findToken({
+          userId: 'u1',
+          type: 'mcp_oauth_refresh',
+          identifier: 'mcp:srv1:refresh',
+        }),
+      ).toBeNull();
+    });
+  });
+
   describe('storeTokens + getTokens round-trip', () => {
     it('should store and retrieve tokens with full encrypt/decrypt cycle', async () => {
       await MCPTokenStorage.storeTokens({
diff --git a/packages/api/src/mcp/__tests__/dbSourced.integration.test.ts b/packages/api/src/mcp/__tests__/dbSourced.integration.test.ts
index 5866fa1a083..981f537a570 100644
--- a/packages/api/src/mcp/__tests__/dbSourced.integration.test.ts
+++ b/packages/api/src/mcp/__tests__/dbSourced.integration.test.ts
@@ -37,11 +37,19 @@ jest.mock('@librechat/data-schemas', () => ({
 
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
 jest.mock('~/mcp/mcpConfig', () => ({
-  mcpConfig: { CONNECTION_CHECK_TTL: 0 },
+  mcpConfig: {
+    CONNECTION_CHECK_TTL: 0,
+    TOOLS_LIST_MAX_PAGES: 50,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+  },
 }));
 
 /** Track all Agents for cleanup */
diff --git a/packages/api/src/mcp/__tests__/handler.refreshScope.test.ts b/packages/api/src/mcp/__tests__/handler.refreshScope.test.ts
new file mode 100644
index 00000000000..cb80058d6bc
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/handler.refreshScope.test.ts
@@ -0,0 +1,141 @@
+/**
+ * Coverage for the `scope` parameter fallback on the OAuth refresh_token grant
+ * (support case 00046259 — Salesforce).
+ *
+ * LibreChat sends `scope` on refresh by default because some authorization servers
+ * expect it (added in the original MCP OAuth support, PR #7924). Salesforce, however,
+ * rejects any `scope` on the refresh grant with HTTP 400 "scope parameter not
+ * supported", which broke token refresh in production and forced re-authentication
+ * (amplifying the multi-replica PKCE retry storm). RFC 6749 §6 makes `scope` optional
+ * on refresh, so the handler now retries once without it — only when the server
+ * rejected the request because of that parameter.
+ *
+ * Mirrors handler.test.ts: SDK discovery is mocked and global.fetch is stubbed
+ * (the public hostname still resolves through the real SSRF gate). Request bodies are
+ * snapshotted at call time because the fallback reuses (and mutates) one URLSearchParams.
+ */
+
+import type { AuthorizationServerMetadata } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { MCPOAuthHandler } from '~/mcp/oauth';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+}));
+
+jest.mock('@modelcontextprotocol/sdk/client/auth.js', () => ({
+  startAuthorization: jest.fn(),
+  discoverAuthorizationServerMetadata: jest.fn(),
+  discoverOAuthProtectedResourceMetadata: jest.fn(),
+  registerClient: jest.fn(),
+  exchangeAuthorization: jest.fn(),
+  extractWWWAuthenticateParams: jest.fn(() => ({})),
+}));
+
+import { discoverAuthorizationServerMetadata } from '@modelcontextprotocol/sdk/client/auth.js';
+
+const mockDiscover = discoverAuthorizationServerMetadata as jest.MockedFunction<
+  typeof discoverAuthorizationServerMetadata
+>;
+
+describe('MCPOAuthHandler.refreshOAuthTokens — scope parameter fallback', () => {
+  const refreshToken = 'refresh-token-abc';
+  const originalFetch = global.fetch;
+  const mockFetch = jest.fn() as unknown as jest.MockedFunction<typeof fetch>;
+
+  /** Bodies captured at the moment each request is sent (the fallback mutates one URLSearchParams). */
+  const sentBodies: string[] = [];
+  let responseQueue: Response[] = [];
+
+  const metadata = {
+    serverName: 'salesforce',
+    serverUrl: 'https://auth.example.com',
+    clientInfo: {
+      client_id: 'client-abc',
+      scope: 'refresh_token mcp_api',
+    },
+  };
+
+  const discovered = {
+    issuer: 'https://auth.example.com',
+    authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+    token_endpoint: 'https://auth.example.com/oauth/token',
+    token_endpoint_auth_methods_supported: ['none'],
+    response_types_supported: ['code'],
+  } as AuthorizationServerMetadata;
+
+  const scopeRejection = {
+    ok: false,
+    status: 400,
+    statusText: 'Bad Request',
+    text: async () =>
+      '{"error":"invalid_request","error_description":"scope parameter not supported"}',
+  } as Response;
+
+  const success = {
+    ok: true,
+    json: async () => ({
+      access_token: 'fresh-access',
+      refresh_token: 'fresh-refresh',
+      token_type: 'Bearer',
+    }),
+  } as Response;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    sentBodies.length = 0;
+    responseQueue = [];
+    global.fetch = mockFetch;
+    mockDiscover.mockResolvedValue(discovered);
+    mockFetch.mockImplementation((async (_url: unknown, init?: { body?: unknown }) => {
+      sentBodies.push(String(init?.body ?? ''));
+      const next = responseQueue.shift();
+      if (!next) {
+        throw new Error('No queued response for fetch call');
+      }
+      return next;
+    }) as unknown as typeof fetch);
+  });
+
+  afterAll(() => {
+    global.fetch = originalFetch;
+  });
+
+  it('retries without scope when the server rejects the scope parameter, then succeeds', async () => {
+    responseQueue = [scopeRejection, success];
+
+    const result = await MCPOAuthHandler.refreshOAuthTokens(refreshToken, metadata, {}, {});
+
+    expect(sentBodies).toHaveLength(2);
+    expect(sentBodies[0]).toContain('scope=');
+    expect(sentBodies[1]).not.toContain('scope=');
+    expect(sentBodies[1]).toContain('grant_type=refresh_token');
+    expect(result.access_token).toBe('fresh-access');
+  });
+
+  it('does NOT retry and surfaces the error when the failure is unrelated to scope', async () => {
+    responseQueue = [
+      {
+        ok: false,
+        status: 400,
+        statusText: 'Bad Request',
+        text: async () => '{"error":"invalid_grant","error_description":"expired refresh token"}',
+      } as Response,
+    ];
+
+    await expect(
+      MCPOAuthHandler.refreshOAuthTokens(refreshToken, metadata, {}, {}),
+    ).rejects.toThrow(/invalid_grant|Token refresh failed/);
+    expect(sentBodies).toHaveLength(1);
+    expect(sentBodies[0]).toContain('scope=');
+  });
+
+  it('makes a single request (no scope, no retry) when no scope is configured', async () => {
+    const noScope = { ...metadata, clientInfo: { client_id: 'client-abc' } };
+    responseQueue = [success];
+
+    await MCPOAuthHandler.refreshOAuthTokens(refreshToken, noScope, {}, {});
+
+    expect(sentBodies).toHaveLength(1);
+    expect(sentBodies[0]).not.toContain('scope=');
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/handler.test.ts b/packages/api/src/mcp/__tests__/handler.test.ts
index 6e0c1961bf5..34c32bfbbbc 100644
--- a/packages/api/src/mcp/__tests__/handler.test.ts
+++ b/packages/api/src/mcp/__tests__/handler.test.ts
@@ -1,6 +1,6 @@
 import { TokenExchangeMethodEnum } from 'librechat-data-provider';
-import type { MCPOptions } from 'librechat-data-provider';
 import type { AuthorizationServerMetadata } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { MCPOptions } from 'librechat-data-provider';
 import { MCPOAuthFlowMetadata, MCPOAuthHandler, MCPOAuthTokens } from '~/mcp/oauth';
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -83,6 +83,26 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
     delete process.env.DOMAIN_SERVER;
   });
 
+  describe('Flow IDs', () => {
+    it('should tenant-scope OAuth flow IDs and parse the owning user', () => {
+      const flowId = MCPOAuthHandler.generateFlowId('user-123', 'test-server', 'tenant/a');
+
+      expect(flowId).toBe('tenant:tenant%2Fa:user-123:test-server');
+      expect(MCPOAuthHandler.parseFlowId(flowId)).toEqual({
+        tenantId: 'tenant/a',
+        userId: 'user-123',
+        serverName: 'test-server',
+      });
+    });
+
+    it('should parse legacy unscoped OAuth flow IDs', () => {
+      expect(MCPOAuthHandler.parseFlowId('user-123:test-server')).toEqual({
+        userId: 'user-123',
+        serverName: 'test-server',
+      });
+    });
+  });
+
   describe('Pre-configured OAuth Metadata Fields', () => {
     const baseConfig: MCPOptions['oauth'] = {
       authorization_url: 'https://auth.example.com/oauth/authorize',
@@ -270,6 +290,113 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
     });
   });
 
+  describe('Auto-discovered predefined clients', () => {
+    it('should reject configured client_secret without client_id', async () => {
+      await expect(
+        MCPOAuthHandler.initiateOAuthFlow(
+          mockServerName,
+          mockServerUrl,
+          mockUserId,
+          {},
+          {
+            client_secret: 'configured-client-secret',
+          },
+        ),
+      ).rejects.toThrow(/client_secret requires oauth\.client_id/);
+
+      expect(mockProbeResourceMetadataHint).not.toHaveBeenCalled();
+      expect(mockDiscoverOAuthProtectedResourceMetadata).not.toHaveBeenCalled();
+      expect(mockDiscoverAuthorizationServerMetadata).not.toHaveBeenCalled();
+      expect(mockRegisterClient).not.toHaveBeenCalled();
+      expect(mockStartAuthorization).not.toHaveBeenCalled();
+    });
+
+    it('should reject configured client_secret when OAuth endpoints are not pinned', async () => {
+      await expect(
+        MCPOAuthHandler.initiateOAuthFlow(
+          mockServerName,
+          mockServerUrl,
+          mockUserId,
+          {},
+          {
+            client_id: 'configured-client-id',
+            client_secret: 'configured-client-secret',
+          },
+        ),
+      ).rejects.toThrow(
+        /client_secret requires both oauth\.authorization_url and oauth\.token_url/,
+      );
+
+      expect(mockProbeResourceMetadataHint).not.toHaveBeenCalled();
+      expect(mockDiscoverOAuthProtectedResourceMetadata).not.toHaveBeenCalled();
+      expect(mockDiscoverAuthorizationServerMetadata).not.toHaveBeenCalled();
+      expect(mockRegisterClient).not.toHaveBeenCalled();
+      expect(mockStartAuthorization).not.toHaveBeenCalled();
+    });
+
+    it('should use configured client_id without client_secret as a public auto-discovered client', async () => {
+      mockDiscoverOAuthProtectedResourceMetadata.mockRejectedValueOnce(
+        new Error('No resource metadata'),
+      );
+      mockDiscoverAuthorizationServerMetadata.mockResolvedValueOnce({
+        issuer: 'https://example.com',
+        authorization_endpoint: 'https://example.com/authorize',
+        token_endpoint: 'https://example.com/token',
+        registration_endpoint: 'https://example.com/register',
+        response_types_supported: ['code'],
+      } as AuthorizationServerMetadata);
+
+      await MCPOAuthHandler.initiateOAuthFlow(
+        mockServerName,
+        mockServerUrl,
+        mockUserId,
+        {},
+        {
+          client_id: 'public-client-id',
+          scope: 'read write',
+        },
+      );
+
+      expect(mockRegisterClient).not.toHaveBeenCalled();
+      expect(mockStartAuthorization).toHaveBeenCalledWith(
+        mockServerUrl,
+        expect.objectContaining({
+          clientInformation: expect.objectContaining({
+            client_id: 'public-client-id',
+            scope: 'read write',
+            token_endpoint_auth_method: 'none',
+          }),
+        }),
+      );
+
+      const startOptions = mockStartAuthorization.mock.calls[0]?.[1];
+      expect(startOptions?.clientInformation).not.toHaveProperty('client_secret');
+    });
+
+    it('should reject stored configured client_secret when refresh would auto-discover token endpoint', async () => {
+      await expect(
+        MCPOAuthHandler.refreshOAuthTokens(
+          'refresh-token-12345',
+          {
+            serverName: 'test-server',
+            serverUrl: 'https://example.com/mcp',
+            clientInfo: {
+              client_id: 'configured-client-id',
+              client_secret: 'configured-client-secret',
+            },
+          },
+          {},
+          {
+            client_id: 'configured-client-id',
+            client_secret: 'configured-client-secret',
+          },
+        ),
+      ).rejects.toThrow(/cannot be used with auto-discovered token endpoints/);
+
+      expect(mockDiscoverAuthorizationServerMetadata).not.toHaveBeenCalled();
+    });
+  });
+
   describe('refreshOAuthTokens', () => {
     const mockRefreshToken = 'refresh-token-12345';
     const originalFetch = global.fetch;
@@ -348,6 +475,79 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
         });
       });
 
+      it('should reuse the stored OAuth resource indicator on refresh', async () => {
+        const metadata = {
+          serverName: 'test-server',
+          userId: 'user-123',
+          serverUrl: 'https://api.example.com/mcp',
+          resource: 'https://api.example.com/',
+          clientInfo: {
+            client_id: 'test-client-id',
+            grant_types: ['authorization_code', 'refresh_token'],
+          },
+        };
+
+        mockDiscoverAuthorizationServerMetadata.mockResolvedValueOnce({
+          issuer: 'https://auth.example.com',
+          authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+          token_endpoint: 'https://auth.example.com/oauth/token',
+          token_endpoint_auth_methods_supported: ['none'],
+          response_types_supported: ['code'],
+          jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256'],
+        } as AuthorizationServerMetadata);
+
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            access_token: 'new-access-token',
+            expires_in: 3600,
+          }),
+        } as Response);
+
+        await MCPOAuthHandler.refreshOAuthTokens(mockRefreshToken, metadata, {}, {});
+
+        const body = mockFetch.mock.calls[0][1]?.body as URLSearchParams;
+        expect(body.get('resource')).toBe('https://api.example.com/');
+      });
+
+      it('should not invent an OAuth resource indicator when the original flow had none', async () => {
+        const metadata = {
+          serverName: 'test-server',
+          userId: 'user-123',
+          serverUrl: 'https://api.example.com/mcp',
+          clientInfo: {
+            client_id: 'test-client-id',
+            grant_types: ['authorization_code', 'refresh_token'],
+          },
+        };
+
+        mockDiscoverAuthorizationServerMetadata.mockResolvedValueOnce({
+          issuer: 'https://auth.example.com',
+          authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+          token_endpoint: 'https://auth.example.com/oauth/token',
+          token_endpoint_auth_methods_supported: ['none'],
+          response_types_supported: ['code'],
+          jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256'],
+        } as AuthorizationServerMetadata);
+
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            access_token: 'new-access-token',
+            expires_in: 3600,
+          }),
+        } as Response);
+
+        await MCPOAuthHandler.refreshOAuthTokens(mockRefreshToken, metadata, {}, {});
+
+        const body = mockFetch.mock.calls[0][1]?.body as URLSearchParams;
+        expect(body.has('resource')).toBe(false);
+      });
+
       it('should use client_secret_basic when server only supports that method', async () => {
         const metadata = {
           serverName: 'test-server',
@@ -836,14 +1036,17 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
 
       await MCPOAuthHandler.revokeOAuthToken(mockServerName, mockToken, 'access', metadata);
 
-      expect(mockFetch).toHaveBeenCalledWith(new URL('https://auth.example.com/oauth/revoke'), {
-        method: 'POST',
-        body: 'token=test-token-12345&token_type_hint=access_token',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-          Authorization: `Basic ${Buffer.from('test-client-id:test-client-secret').toString('base64')}`,
-        },
-      });
+      expect(mockFetch).toHaveBeenCalledWith(
+        new URL('https://auth.example.com/oauth/revoke'),
+        expect.objectContaining({
+          method: 'POST',
+          body: 'token=test-token-12345&token_type_hint=access_token',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Authorization: `Basic ${Buffer.from('test-client-id:test-client-secret').toString('base64')}`,
+          },
+        }),
+      );
     });
 
     it('should successfully revoke a refresh token with client_secret_basic auth', async () => {
@@ -862,14 +1065,17 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
 
       await MCPOAuthHandler.revokeOAuthToken(mockServerName, mockToken, 'refresh', metadata);
 
-      expect(mockFetch).toHaveBeenCalledWith(new URL('https://auth.example.com/oauth/revoke'), {
-        method: 'POST',
-        body: 'token=test-token-12345&token_type_hint=refresh_token',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-          Authorization: `Basic ${Buffer.from('test-client-id:test-client-secret').toString('base64')}`,
-        },
-      });
+      expect(mockFetch).toHaveBeenCalledWith(
+        new URL('https://auth.example.com/oauth/revoke'),
+        expect.objectContaining({
+          method: 'POST',
+          body: 'token=test-token-12345&token_type_hint=refresh_token',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Authorization: `Basic ${Buffer.from('test-client-id:test-client-secret').toString('base64')}`,
+          },
+        }),
+      );
     });
 
     it('should successfully revoke an access token with client_secret_post auth', async () => {
@@ -888,13 +1094,16 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
 
       await MCPOAuthHandler.revokeOAuthToken(mockServerName, mockToken, 'access', metadata);
 
-      expect(mockFetch).toHaveBeenCalledWith(new URL('https://auth.example.com/oauth/revoke'), {
-        method: 'POST',
-        body: 'token=test-token-12345&token_type_hint=access_token&client_secret=test-client-secret&client_id=test-client-id',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-        },
-      });
+      expect(mockFetch).toHaveBeenCalledWith(
+        new URL('https://auth.example.com/oauth/revoke'),
+        expect.objectContaining({
+          method: 'POST',
+          body: 'token=test-token-12345&token_type_hint=access_token&client_secret=test-client-secret&client_id=test-client-id',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+        }),
+      );
     });
 
     it('should fallback to /revoke endpoint when revocationEndpoint is not provided', async () => {
diff --git a/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts b/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
index 34f968d4e27..453c3600dd1 100644
--- a/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
+++ b/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
@@ -1,11 +1,12 @@
-import * as http from 'http';
+import { z } from 'zod';
 import * as net from 'net';
+import * as http from 'http';
 import { randomUUID, createHash } from 'crypto';
-import { z } from 'zod';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import type { FlowState } from '~/flow/types';
+import type { TokenMethods } from '@librechat/data-schemas';
 import type { Socket } from 'net';
+import type { FlowState } from '~/flow/types';
 
 export class MockKeyv<T = unknown> {
   private store: Map<string, FlowState<T>>;
@@ -61,10 +62,26 @@ export interface OAuthTestServerOptions {
   rotateRefreshTokens?: boolean;
   /** When true, /token validates client_id against the registered client that initiated /authorize */
   enforceClientId?: boolean;
+  /** Scopes attached to newly issued tokens unless the authorization request asks for a scope. */
+  tokenScopes?: string[];
+  /** Scopes required by the protected MCP resource. Missing scopes produce a 403 insufficient_scope challenge. */
+  requiredScopes?: string[];
+  /** Scopes advertised by OAuth Protected Resource Metadata and authorization server metadata. */
+  scopesSupported?: string[];
+  /** When true, /authorize and /token reject requests that omit the MCP resource parameter. */
+  requireResourceParameter?: boolean;
+}
+
+export interface OAuthTokenRequestRecord {
+  grantType: string | null;
+  resource: string | null;
+  scope: string | null;
+  clientId: string | null;
 }
 
 export interface OAuthTestServer {
   url: string;
+  resourceUrl: string;
   port: number;
   close: () => Promise<void>;
   issuedTokens: Set<string>;
@@ -72,6 +89,7 @@ export interface OAuthTestServer {
   tokenIssueTimes: Map<string, number>;
   issuedRefreshTokens: Map<string, string>;
   registeredClients: Map<string, { client_id: string; client_secret: string }>;
+  tokenRequests: OAuthTokenRequestRecord[];
   getAuthCode: () => Promise<string>;
 }
 
@@ -114,20 +132,97 @@ export async function createOAuthMCPServer(
     refreshTokenTTLMs = 365 * 24 * 60 * 60 * 1000,
     rotateRefreshTokens = false,
     enforceClientId = false,
+    tokenScopes = [],
+    requiredScopes = [],
+    scopesSupported = [...new Set([...tokenScopes, ...requiredScopes])],
+    requireResourceParameter = false,
   } = options;
 
   const sessions = new Map<string, StreamableHTTPServerTransport>();
   const issuedTokens = new Set<string>();
   const tokenIssueTimes = new Map<string, number>();
+  const accessTokenScopes = new Map<string, string[]>();
   const issuedRefreshTokens = new Map<string, string>();
   const refreshTokenIssueTimes = new Map<string, number>();
+  const refreshTokenScopes = new Map<string, string[]>();
+  const tokenRequests: OAuthTokenRequestRecord[] = [];
   const authCodes = new Map<
     string,
-    { codeChallenge?: string; codeChallengeMethod?: string; clientId?: string }
+    {
+      codeChallenge?: string;
+      codeChallengeMethod?: string;
+      clientId?: string;
+      resource?: string;
+      scope?: string;
+    }
   >();
   const registeredClients = new Map<string, { client_id: string; client_secret: string }>();
 
   let port = 0;
+  const getBaseUrl = () => `http://127.0.0.1:${port}`;
+  const getResourceUrl = () => `${getBaseUrl()}/`;
+  const getResourceMetadataUrl = () => `${getBaseUrl()}/.well-known/oauth-protected-resource`;
+
+  const parseScopes = (scope: string | null | undefined): string[] => {
+    if (!scope) {
+      return tokenScopes;
+    }
+    return scope.split(/\s+/).filter(Boolean);
+  };
+
+  const writeJson = (res: http.ServerResponse, status: number, payload: unknown): void => {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+  };
+
+  const writeBearerChallenge = (
+    res: http.ServerResponse,
+    status: number,
+    error: 'invalid_token' | 'insufficient_scope',
+    description: string,
+  ): void => {
+    let authenticate = `Bearer error="${error}", error_description="${description}", resource_metadata="${getResourceMetadataUrl()}"`;
+    if (requiredScopes.length > 0) {
+      authenticate += `, scope="${requiredScopes.join(' ')}"`;
+    }
+    res.writeHead(status, {
+      'Content-Type': 'application/json',
+      'WWW-Authenticate': authenticate,
+    });
+    res.end(JSON.stringify({ error, error_description: description }));
+  };
+
+  const requireValidResourceParameter = (
+    res: http.ServerResponse,
+    params: URLSearchParams,
+  ): boolean => {
+    if (!requireResourceParameter) {
+      return true;
+    }
+    if (params.get('resource') === getResourceUrl()) {
+      return true;
+    }
+    writeJson(res, 400, {
+      error: 'invalid_target',
+      error_description: 'resource parameter is required for this MCP resource',
+    });
+    return false;
+  };
+
+  const makeTokenResponse = (
+    accessToken: string,
+    scopes: string[],
+  ): Record<string, string | number> => {
+    const tokenResponse: Record<string, string | number> = {
+      access_token: accessToken,
+      token_type: 'Bearer',
+      expires_in: Math.ceil(tokenTTLMs / 1000),
+    };
+    if (scopes.length > 0) {
+      tokenResponse.scope = scopes.join(' ');
+    }
+    return tokenResponse;
+  };
 
   const httpServer = http.createServer(async (req, res) => {
     const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
@@ -136,10 +231,11 @@ export async function createOAuthMCPServer(
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(
         JSON.stringify({
-          issuer: `http://127.0.0.1:${port}`,
-          authorization_endpoint: `http://127.0.0.1:${port}/authorize`,
-          token_endpoint: `http://127.0.0.1:${port}/token`,
-          registration_endpoint: `http://127.0.0.1:${port}/register`,
+          issuer: getBaseUrl(),
+          authorization_endpoint: `${getBaseUrl()}/authorize`,
+          token_endpoint: `${getBaseUrl()}/token`,
+          registration_endpoint: `${getBaseUrl()}/register`,
+          scopes_supported: scopesSupported,
           response_types_supported: ['code'],
           grant_types_supported: issueRefreshTokens
             ? ['authorization_code', 'refresh_token']
@@ -151,6 +247,19 @@ export async function createOAuthMCPServer(
       return;
     }
 
+    if (url.pathname === '/.well-known/oauth-protected-resource' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          resource: getResourceUrl(),
+          authorization_servers: [getBaseUrl()],
+          scopes_supported: scopesSupported,
+          bearer_methods_supported: ['header'],
+        }),
+      );
+      return;
+    }
+
     if (url.pathname === '/register' && req.method === 'POST') {
       const body = await readRequestBody(req);
       const data = JSON.parse(body) as { redirect_uris?: string[] };
@@ -169,11 +278,20 @@ export async function createOAuthMCPServer(
     }
 
     if (url.pathname === '/authorize') {
+      if (requireResourceParameter && url.searchParams.get('resource') !== getResourceUrl()) {
+        writeJson(res, 400, {
+          error: 'invalid_target',
+          error_description: 'resource parameter is required for this MCP resource',
+        });
+        return;
+      }
       const code = randomUUID();
       const codeChallenge = url.searchParams.get('code_challenge') ?? undefined;
       const codeChallengeMethod = url.searchParams.get('code_challenge_method') ?? undefined;
       const clientId = url.searchParams.get('client_id') ?? undefined;
-      authCodes.set(code, { codeChallenge, codeChallengeMethod, clientId });
+      const resource = url.searchParams.get('resource') ?? undefined;
+      const scope = url.searchParams.get('scope') ?? undefined;
+      authCodes.set(code, { codeChallenge, codeChallengeMethod, clientId, resource, scope });
       const redirectUri = url.searchParams.get('redirect_uri') ?? '';
       const state = url.searchParams.get('state') ?? '';
       res.writeHead(302, {
@@ -193,6 +311,17 @@ export async function createOAuthMCPServer(
       }
 
       const grantType = params.get('grant_type');
+      tokenRequests.push({
+        grantType,
+        resource: params.get('resource'),
+        scope: params.get('scope'),
+        clientId:
+          params.get('client_id') ?? parseBasicAuth(req.headers.authorization)?.clientId ?? null,
+      });
+
+      if (!requireValidResourceParameter(res, params)) {
+        return;
+      }
 
       if (grantType === 'authorization_code') {
         const code = params.get('code');
@@ -240,19 +369,18 @@ export async function createOAuthMCPServer(
         authCodes.delete(code);
 
         const accessToken = randomUUID();
+        const scopes = parseScopes(codeData.scope);
         issuedTokens.add(accessToken);
         tokenIssueTimes.set(accessToken, Date.now());
+        accessTokenScopes.set(accessToken, scopes);
 
-        const tokenResponse: Record<string, string | number> = {
-          access_token: accessToken,
-          token_type: 'Bearer',
-          expires_in: Math.ceil(tokenTTLMs / 1000),
-        };
+        const tokenResponse = makeTokenResponse(accessToken, scopes);
 
         if (issueRefreshTokens) {
           const refreshToken = randomUUID();
           issuedRefreshTokens.set(refreshToken, accessToken);
           refreshTokenIssueTimes.set(refreshToken, Date.now());
+          refreshTokenScopes.set(refreshToken, scopes);
           tokenResponse.refresh_token = refreshToken;
         }
 
@@ -279,21 +407,23 @@ export async function createOAuthMCPServer(
         }
 
         const newAccessToken = randomUUID();
+        const scopes = params.has('scope')
+          ? parseScopes(params.get('scope'))
+          : (refreshTokenScopes.get(refreshToken) ?? tokenScopes);
         issuedTokens.add(newAccessToken);
         tokenIssueTimes.set(newAccessToken, Date.now());
+        accessTokenScopes.set(newAccessToken, scopes);
 
-        const tokenResponse: Record<string, string | number> = {
-          access_token: newAccessToken,
-          token_type: 'Bearer',
-          expires_in: Math.ceil(tokenTTLMs / 1000),
-        };
+        const tokenResponse = makeTokenResponse(newAccessToken, scopes);
 
         if (rotateRefreshTokens) {
           issuedRefreshTokens.delete(refreshToken);
           refreshTokenIssueTimes.delete(refreshToken);
+          refreshTokenScopes.delete(refreshToken);
           const newRefreshToken = randomUUID();
           issuedRefreshTokens.set(newRefreshToken, newAccessToken);
           refreshTokenIssueTimes.set(newRefreshToken, Date.now());
+          refreshTokenScopes.set(newRefreshToken, scopes);
           tokenResponse.refresh_token = newRefreshToken;
         }
 
@@ -310,15 +440,13 @@ export async function createOAuthMCPServer(
     // All other paths require Bearer token auth
     const authHeader = req.headers.authorization;
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      writeBearerChallenge(res, 401, 'invalid_token', 'Missing Authorization header');
       return;
     }
 
     const token = authHeader.slice(7);
     if (!issuedTokens.has(token)) {
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      writeBearerChallenge(res, 401, 'invalid_token', 'Token is invalid');
       return;
     }
 
@@ -326,8 +454,15 @@ export async function createOAuthMCPServer(
     if (Date.now() - issueTime > tokenTTLMs) {
       issuedTokens.delete(token);
       tokenIssueTimes.delete(token);
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      accessTokenScopes.delete(token);
+      writeBearerChallenge(res, 401, 'invalid_token', 'Token has expired');
+      return;
+    }
+
+    const scopes = accessTokenScopes.get(token) ?? [];
+    const hasRequiredScopes = requiredScopes.every((scope) => scopes.includes(scope));
+    if (!hasRequiredScopes) {
+      writeBearerChallenge(res, 403, 'insufficient_scope', 'Insufficient scope');
       return;
     }
 
@@ -360,17 +495,22 @@ export async function createOAuthMCPServer(
 
   return {
     url: `http://127.0.0.1:${port}/`,
+    resourceUrl: `http://127.0.0.1:${port}/`,
     port,
     issuedTokens,
     tokenTTL: tokenTTLMs,
     tokenIssueTimes,
     issuedRefreshTokens,
     registeredClients,
+    tokenRequests,
     getAuthCode: async () => {
-      const authRes = await fetch(
-        `http://127.0.0.1:${port}/authorize?redirect_uri=http://localhost&state=test`,
-        { redirect: 'manual' },
-      );
+      const authUrl = new URL(`${getBaseUrl()}/authorize`);
+      authUrl.searchParams.set('redirect_uri', 'http://localhost');
+      authUrl.searchParams.set('state', 'test');
+      if (requireResourceParameter) {
+        authUrl.searchParams.set('resource', getResourceUrl());
+      }
+      const authRes = await fetch(authUrl, { redirect: 'manual' });
       const location = authRes.headers.get('location') ?? '';
       return new URL(location).searchParams.get('code') ?? '';
     },
@@ -400,7 +540,7 @@ export class InMemoryTokenStore {
     return `${filter.userId}:${filter.type}:${filter.identifier}`;
   }
 
-  findToken = async (filter: {
+  findToken = (async (filter: {
     userId?: string;
     type?: string;
     identifier?: string;
@@ -414,9 +554,9 @@ export class InMemoryTokenStore {
       }
     }
     return null;
-  };
+  }) as unknown as TokenMethods['findToken'];
 
-  createToken = async (data: {
+  createToken = (async (data: {
     userId: string;
     type: string;
     identifier: string;
@@ -436,9 +576,9 @@ export class InMemoryTokenStore {
     };
     this.tokens.set(this.key(data), token);
     return token;
-  };
+  }) as unknown as TokenMethods['createToken'];
 
-  updateToken = async (
+  updateToken = (async (
     filter: { userId?: string; type?: string; identifier?: string },
     data: {
       userId?: string;
@@ -449,7 +589,7 @@ export class InMemoryTokenStore {
       metadata?: Record<string, unknown>;
     },
   ): Promise<InMemoryToken> => {
-    const existing = await this.findToken(filter);
+    const existing = (await this.findToken(filter)) as InMemoryToken | null;
     if (!existing) {
       throw new Error(`Token not found for filter: ${JSON.stringify(filter)}`);
     }
@@ -464,7 +604,7 @@ export class InMemoryTokenStore {
     };
     this.tokens.set(existingKey, updated);
     return updated;
-  };
+  }) as unknown as TokenMethods['updateToken'];
 
   deleteToken = async (filter: {
     userId: string;
@@ -474,7 +614,7 @@ export class InMemoryTokenStore {
     this.tokens.delete(this.key(filter));
   };
 
-  deleteTokens = async (query: {
+  deleteTokens = (async (query: {
     userId?: string;
     type?: string;
     identifier?: string;
@@ -491,7 +631,7 @@ export class InMemoryTokenStore {
       }
     }
     return { acknowledged: true, deletedCount };
-  };
+  }) as unknown as TokenMethods['deleteTokens'];
 
   getAll(): InMemoryToken[] {
     return [...this.tokens.values()];
diff --git a/packages/api/src/mcp/__tests__/mcp.spec.ts b/packages/api/src/mcp/__tests__/mcp.spec.ts
index d5cc44569fe..539c04f6b94 100644
--- a/packages/api/src/mcp/__tests__/mcp.spec.ts
+++ b/packages/api/src/mcp/__tests__/mcp.spec.ts
@@ -150,6 +150,18 @@ describe('Environment Variable Extraction (MCP)', () => {
       expect(result.headers).toEqual(options.headers);
     });
 
+    it('should validate proxy URLs for remote HTTP transports', () => {
+      const options = {
+        type: 'streamable-http',
+        url: 'https://example.com/api',
+        proxy: 'http://proxy.example.com:8080',
+      };
+
+      const result = StreamableHTTPOptionsSchema.parse(options);
+
+      expect(result.proxy).toBe('http://proxy.example.com:8080');
+    });
+
     it('should accept "http" as an alias for "streamable-http"', () => {
       const options = {
         type: 'http',
@@ -324,6 +336,20 @@ describe('Environment Variable Extraction (MCP)', () => {
       });
     });
 
+    it('should process proxy in streamable-http options', () => {
+      process.env.MCP_PROXY_URL = 'http://proxy.example.com:8080';
+      const options: MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://example.com',
+        proxy: '${MCP_PROXY_URL}',
+      };
+
+      const result = processMCPEnv({ options });
+
+      expect('proxy' in result && result.proxy).toBe('http://proxy.example.com:8080');
+      delete process.env.MCP_PROXY_URL;
+    });
+
     it('should maintain streamable-http type in processed options', () => {
       const options: MCPOptions = {
         type: 'streamable-http',
@@ -1001,6 +1027,44 @@ describe('Environment Variable Extraction (MCP)', () => {
       ]);
     });
 
+    it('should resolve graph tokens in args and oauth fields before processMCPEnv', async () => {
+      const user = createTestUser({
+        id: 'user-args-oauth',
+        provider: 'openid',
+      }) as unknown as IUser;
+
+      const options: MCPOptions = {
+        type: 'stdio',
+        command: 'node',
+        args: ['server.js', '--graph-token={{LIBRECHAT_GRAPH_ACCESS_TOKEN}}'],
+        oauth: {
+          client_id: 'client-id',
+          client_secret: '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+          scope: 'profile {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      };
+
+      const graphProcessedConfig = await preProcessGraphTokens(options, {
+        user,
+        graphTokenResolver: mockGraphTokenResolver,
+      });
+
+      const finalConfig = processMCPEnv({
+        options: graphProcessedConfig,
+        user,
+      });
+
+      expect('args' in finalConfig && finalConfig.args).toEqual([
+        'server.js',
+        '--graph-token=resolved-graph-api-token',
+      ]);
+      expect(finalConfig.oauth).toEqual({
+        client_id: 'client-id',
+        client_secret: 'resolved-graph-api-token',
+        scope: 'profile resolved-graph-api-token',
+      });
+    });
+
     it('should resolve graph tokens in URL alongside other placeholders', async () => {
       const user = createTestUser({
         id: 'user-789',
diff --git a/packages/api/src/mcp/__tests__/parsers.test.ts b/packages/api/src/mcp/__tests__/parsers.test.ts
index afc3fd9de3f..3d1c71edbda 100644
--- a/packages/api/src/mcp/__tests__/parsers.test.ts
+++ b/packages/api/src/mcp/__tests__/parsers.test.ts
@@ -29,6 +29,18 @@ describe('formatToolContent', () => {
       expect(content).toBe('(No response)');
       expect(artifacts).toBeUndefined();
     });
+
+    it('should preserve the image payload in the string for unrecognized providers', () => {
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'iVBORw0KGgoAAAA...', mimeType: 'image/png' }],
+      };
+
+      const [content, artifacts] = formatToolContent(result, 'unknown' as t.Provider);
+
+      expect(artifacts).toBeUndefined();
+      expect(content).toContain('iVBORw0KGgoAAAA...');
+      expect(content).toContain('image/png');
+    });
   });
 
   describe('recognized providers', () => {
@@ -91,6 +103,16 @@ describe('formatToolContent', () => {
   });
 
   describe('image handling', () => {
+    const originalMaxImageBytes = process.env.MCP_IMAGE_DATA_MAX_BYTES;
+
+    afterEach(() => {
+      if (originalMaxImageBytes === undefined) {
+        delete process.env.MCP_IMAGE_DATA_MAX_BYTES;
+        return;
+      }
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = originalMaxImageBytes;
+    });
+
     it('should handle images with http URLs', () => {
       const result: t.MCPToolCallResponse = {
         content: [{ type: 'image', data: 'https://example.com/image.png', mimeType: 'image/png' }],
@@ -147,6 +169,83 @@ describe('formatToolContent', () => {
       expect(artifacts).toBeDefined();
       expect(artifacts?.content).toHaveLength(2);
     });
+
+    it('should reject oversized base64 image data before creating artifacts', () => {
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = '3';
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'QUJDRA==', mimeType: 'image/png' }],
+      };
+
+      expect(() => formatToolContent(result, 'openai')).toThrow(
+        'MCP image result exceeds maximum size of 3 bytes',
+      );
+    });
+
+    it('should allow base64 image data when decoded size is within the cap', () => {
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = '4';
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'QUJDRA==', mimeType: 'image/png' }],
+      };
+
+      const [content, artifacts] = formatToolContent(result, 'openai');
+
+      expect(content).toBe('');
+      expect(artifacts?.content?.[0]).toEqual({
+        type: 'image_url',
+        image_url: { url: 'data:image/png;base64,QUJDRA==' },
+      });
+    });
+
+    it('should reject oversized image data for unrecognized providers before stringifying', () => {
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = '3';
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'QUJDRA==', mimeType: 'image/png' }],
+      };
+
+      expect(() => formatToolContent(result, 'unknown' as t.Provider)).toThrow(
+        'MCP image result exceeds maximum size of 3 bytes',
+      );
+    });
+
+    it('should not apply the image data cap to remote image URLs', () => {
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = '3';
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'https://example.com/large.png', mimeType: 'image/png' }],
+      };
+
+      const [content, artifacts] = formatToolContent(result, 'openai');
+
+      expect(content).toBe('');
+      expect(artifacts?.content?.[0]).toEqual({
+        type: 'image_url',
+        image_url: { url: 'https://example.com/large.png' },
+      });
+    });
+
+    it('should enforce the image cap on base64 data that merely starts with "http"', () => {
+      process.env.MCP_IMAGE_DATA_MAX_BYTES = '3';
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'httpAAAAAAAA', mimeType: 'image/png' }],
+      };
+
+      expect(() => formatToolContent(result, 'openai')).toThrow(
+        'MCP image result exceeds maximum size of 3 bytes',
+      );
+    });
+
+    it('should treat base64 starting with "http" as inline data, not a remote URL', () => {
+      const result: t.MCPToolCallResponse = {
+        content: [{ type: 'image', data: 'httpAAAA', mimeType: 'image/png' }],
+      };
+
+      const [content, artifacts] = formatToolContent(result, 'openai');
+
+      expect(content).toBe('');
+      expect(artifacts?.content?.[0]).toEqual({
+        type: 'image_url',
+        image_url: { url: 'data:image/png;base64,httpAAAA' },
+      });
+    });
   });
 
   describe('resource handling', () => {
diff --git a/packages/api/src/mcp/__tests__/request.test.ts b/packages/api/src/mcp/__tests__/request.test.ts
new file mode 100644
index 00000000000..218c69f011a
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/request.test.ts
@@ -0,0 +1,82 @@
+import { EventEmitter } from 'events';
+
+import { getMCPRequestContext, cleanupMCPRequestContextForReq } from '~/mcp/request';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    warn: jest.fn(),
+  },
+}));
+
+function createResponse({ ended = false } = {}): EventEmitter & {
+  writableEnded: boolean;
+  finished: boolean;
+  destroyed: boolean;
+} {
+  const res = new EventEmitter() as EventEmitter & {
+    writableEnded: boolean;
+    finished: boolean;
+    destroyed: boolean;
+  };
+  res.writableEnded = ended;
+  res.finished = ended;
+  res.destroyed = false;
+  return res;
+}
+
+function nextTick(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('MCP request context', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('does not create a response-scoped context after the response has finished', () => {
+    const req = {};
+    const res = createResponse({ ended: true });
+
+    expect(getMCPRequestContext(req, res)).toBeUndefined();
+  });
+
+  it('keeps job-scoped contexts alive after response finish until explicit cleanup', async () => {
+    const req = {};
+    const res = createResponse();
+    const context = getMCPRequestContext(req, undefined, { cleanupOnResponse: false });
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    context?.connections.set('server', { disconnect });
+
+    expect(getMCPRequestContext(req, res)).toBe(context);
+
+    res.emit('finish');
+    await nextTick();
+
+    expect(disconnect).not.toHaveBeenCalled();
+
+    await cleanupMCPRequestContextForReq(req);
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(context?.connections.size).toBe(0);
+    expect(context?.pending.size).toBe(0);
+  });
+
+  it('cleans response-scoped contexts when the response finishes', async () => {
+    const req = {};
+    const res = createResponse();
+    const context = getMCPRequestContext(req, res);
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const pendingDisconnect = jest.fn().mockResolvedValue(undefined);
+
+    context?.connections.set('server', { disconnect });
+    context?.pending.set('pending-server', Promise.resolve({ disconnect: pendingDisconnect }));
+
+    res.emit('finish');
+    await nextTick();
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(pendingDisconnect).toHaveBeenCalledTimes(1);
+    expect(context?.connections.size).toBe(0);
+    expect(context?.pending.size).toBe(0);
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/utils.test.ts b/packages/api/src/mcp/__tests__/utils.test.ts
index 19f9c1eaf7c..cbed141d0f4 100644
--- a/packages/api/src/mcp/__tests__/utils.test.ts
+++ b/packages/api/src/mcp/__tests__/utils.test.ts
@@ -1,13 +1,22 @@
+import type { ParsedServerConfig } from '~/mcp/types';
 import {
   buildOAuthToolCallName,
   normalizeServerName,
   redactAllServerSecrets,
   redactServerSecrets,
+  requiresUserScopedConnection,
   isInvalidClientMessage,
   isClientRejectionMessage,
+  getMissingCustomUserVars,
+  hasCustomUserVars,
+  hasRuntimeUrlPlaceholders,
+  hasRuntimeBodyPlaceholders,
+  hasRuntimeContextPlaceholders,
+  getRuntimeBodyPlaceholderFields,
+  getMissingRuntimeBodyPlaceholderFields,
   isUserSourced,
+  requiresEphemeralUserConnection,
 } from '~/mcp/utils';
-import type { ParsedServerConfig } from '~/mcp/types';
 
 describe('normalizeServerName', () => {
   it('should not modify server names that already match the pattern', () => {
@@ -227,13 +236,93 @@ describe('redactServerSecrets', () => {
     expect(redacted.customUserVars).toEqual(config.customUserVars);
   });
 
-  it('should pass URLs through unchanged', () => {
+  it('should pass URLs through unchanged when caller has edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+    };
+    const redacted = redactServerSecrets(config, { canEdit: true });
+    expect(redacted.url).toBe('https://infra.internal/mcp');
+  });
+
+  it('should strip url and oauth flow URLs for non-user-sourced configs without edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      oauth: {
+        client_id: 'cid',
+        authorization_url: 'https://infra.internal/oauth/authorize',
+        token_url: 'https://infra.internal/oauth/token',
+        revocation_endpoint: 'https://infra.internal/oauth/revoke',
+        scope: 'read',
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.url).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.revocation_endpoint).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+    expect(redacted.oauth?.scope).toBe('read');
+  });
+
+  it('should strip url for a VIEW-shared user-sourced config when caller lacks edit', () => {
     const config: ParsedServerConfig = {
       type: 'sse',
-      url: 'https://mcp.example.com/sse?param=value',
+      url: 'https://owner-private.example.com/mcp',
+      source: 'user',
+      dbId: 'abc123',
+      oauth: {
+        client_id: 'cid',
+        authorization_url: 'https://owner-private.example.com/oauth/authorize',
+        token_url: 'https://owner-private.example.com/oauth/token',
+      },
     };
     const redacted = redactServerSecrets(config);
-    expect(redacted.url).toBe('https://mcp.example.com/sse?param=value');
+    expect(redacted.url).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+  });
+
+  it('should retain non-sensitive oauth fields when stripping oauth flow URLs', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      oauth: {
+        client_id: 'cid',
+        client_secret: 'csecret',
+        authorization_url: 'https://infra.internal/oauth/authorize',
+        token_url: 'https://infra.internal/oauth/token',
+        scope: 'read',
+        redirect_uri: 'https://app.example.com/callback',
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.oauth?.client_secret).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+    expect(redacted.oauth?.scope).toBe('read');
+    expect(redacted.oauth?.redirect_uri).toBe('https://app.example.com/callback');
+  });
+
+  it('should preserve customUserVars metadata for non-user-sourced configs without edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      customUserVars: {
+        API_KEY: { title: 'API Key', description: 'Your key', sensitive: true },
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.customUserVars).toEqual({
+      API_KEY: { title: 'API Key', description: 'Your key', sensitive: true },
+    });
   });
 
   it('should only include explicitly allowlisted fields', () => {
@@ -247,6 +336,17 @@ describe('redactServerSecrets', () => {
     expect((redacted as Record<string, unknown>).someNewSensitiveField).toBeUndefined();
     expect(redacted.title).toBe('Test');
   });
+
+  it('should preserve obo config', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://example.com/mcp',
+      title: 'OBO Server',
+      obo: { scopes: 'api://client-id/.default' },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.obo).toEqual({ scopes: 'api://client-id/.default' });
+  });
 });
 
 describe('redactAllServerSecrets', () => {
@@ -275,6 +375,55 @@ describe('redactAllServerSecrets', () => {
     expect(redacted['server-b'].oauth?.client_id).toBe('cid-b');
     expect((redacted['server-c'] as Record<string, unknown>).command).toBeUndefined();
   });
+
+  it('should pass canEdit through per-server via canEditByServer map', () => {
+    const configs: Record<string, ParsedServerConfig> = {
+      'config-server': {
+        type: 'sse',
+        url: 'https://infra.internal/mcp',
+        source: 'config',
+        oauth: {
+          client_id: 'cid',
+          authorization_url: 'https://infra.internal/oauth/authorize',
+        },
+      },
+      'user-server-owner': {
+        type: 'sse',
+        url: 'https://owner.example.com/mcp',
+        source: 'user',
+        dbId: 'owner-id',
+      },
+      'user-server-shared': {
+        type: 'sse',
+        url: 'https://shared.example.com/mcp',
+        source: 'user',
+        dbId: 'shared-id',
+      },
+    };
+    const canEditByServer = new Map<string, boolean>([
+      ['config-server', false],
+      ['user-server-owner', true],
+      ['user-server-shared', false],
+    ]);
+    const redacted = redactAllServerSecrets(configs, { canEditByServer });
+    expect(redacted['config-server'].url).toBeUndefined();
+    expect(redacted['config-server'].oauth?.authorization_url).toBeUndefined();
+    expect(redacted['user-server-owner'].url).toBe('https://owner.example.com/mcp');
+    expect(redacted['user-server-shared'].url).toBeUndefined();
+  });
+
+  it('should expose URL for non-user-sourced configs when canEditByServer is true', () => {
+    const configs: Record<string, ParsedServerConfig> = {
+      'config-server': {
+        type: 'sse',
+        url: 'https://infra.internal/mcp',
+        source: 'config',
+      },
+    };
+    const canEditByServer = new Map<string, boolean>([['config-server', true]]);
+    const redacted = redactAllServerSecrets(configs, { canEditByServer });
+    expect(redacted['config-server'].url).toBe('https://infra.internal/mcp');
+  });
 });
 
 describe('isInvalidClientMessage', () => {
@@ -340,3 +489,313 @@ describe('isUserSourced', () => {
     expect(isUserSourced({})).toBe(false);
   });
 });
+
+describe('requiresUserScopedConnection', () => {
+  it('returns true for OAuth servers', () => {
+    expect(requiresUserScopedConnection({ requiresOAuth: true })).toBe(true);
+  });
+
+  it('returns true for OBO servers', () => {
+    expect(
+      requiresUserScopedConnection({
+        obo: { scopes: 'api://client-id/.default' },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns true for servers with customUserVars', () => {
+    expect(
+      requiresUserScopedConnection({
+        customUserVars: {
+          API_KEY: { title: 'API Key', description: 'Your key' },
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns true for trusted config with runtime user placeholders', () => {
+    expect(
+      requiresUserScopedConnection({
+        source: 'yaml',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns false for user-sourced config with runtime user placeholders', () => {
+    expect(
+      requiresUserScopedConnection({
+        source: 'user',
+        dbId: 'server-123',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false for app-shareable servers', () => {
+    expect(
+      requiresUserScopedConnection({
+        requiresOAuth: false,
+        customUserVars: {},
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('hasRuntimeContextPlaceholders', () => {
+  it('detects trusted runtime placeholders across connection fields', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'config',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+          'X-Graph-Access-Token': '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('detects trusted runtime placeholders in oauth_headers', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/mcp',
+        oauth_headers: {
+          'X-User': '{{LIBRECHAT_USER_ID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores custom user variable placeholders', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'yaml',
+        headers: {
+          Authorization: 'Bearer {{MCP_API_KEY}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('ignores runtime placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('hasRuntimeUrlPlaceholders', () => {
+  it('detects trusted runtime placeholders in the server URL', () => {
+    expect(
+      hasRuntimeUrlPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores runtime URL placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeUrlPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('hasRuntimeBodyPlaceholders', () => {
+  it('detects trusted runtime BODY placeholders across connection fields', () => {
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/conversations/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+      }),
+    ).toBe(true);
+
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'config',
+        headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores BODY placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('getMissingRuntimeBodyPlaceholderFields', () => {
+  const config = {
+    source: 'yaml',
+    url: 'https://example.com/conversations/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+    headers: {
+      'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+      'X-Parent': '{{LIBRECHAT_BODY_PARENTMESSAGEID}}',
+    },
+  } as const;
+
+  it('returns the request body fields required by trusted runtime placeholders', () => {
+    expect(getRuntimeBodyPlaceholderFields(config)).toEqual([
+      'messageId',
+      'parentMessageId',
+      'conversationId',
+    ]);
+  });
+
+  it('returns missing or blank request body fields', () => {
+    expect(
+      getMissingRuntimeBodyPlaceholderFields(config, {
+        conversationId: 'conv-123',
+        messageId: ' ',
+      }),
+    ).toEqual(['messageId', 'parentMessageId']);
+  });
+
+  it('ignores BODY placeholders in user-sourced configs', () => {
+    expect(
+      getMissingRuntimeBodyPlaceholderFields({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe('requiresEphemeralUserConnection', () => {
+  it('returns true when BODY placeholders affect oauth_headers', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        url: 'https://example.com/mcp',
+        oauth_headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns true when BODY placeholders affect connection fields', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        url: 'https://example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toBe(true);
+  });
+
+  it('does not treat Graph placeholders as request-scoped by themselves', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'config',
+        env: {
+          GRAPH_TOKEN: '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('does not treat OpenID token placeholders as request-scoped by themselves', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        args: ['--id-token={{LIBRECHAT_OPENID_ID_TOKEN}}'],
+      }),
+    ).toBe(false);
+
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('returns true when BODY placeholders affect remote transport headers', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+});
+
+describe('getMissingCustomUserVars', () => {
+  const configWithVars = (keys: string[]): Pick<ParsedServerConfig, 'customUserVars'> => ({
+    customUserVars: Object.fromEntries(
+      keys.map((key) => [key, { title: key, description: `${key} description` }]),
+    ),
+  });
+
+  it('returns an empty array when the server declares no customUserVars', () => {
+    expect(getMissingCustomUserVars({}, {})).toEqual([]);
+    expect(getMissingCustomUserVars({ customUserVars: undefined }, undefined)).toEqual([]);
+  });
+
+  it('returns an empty array when customUserVars is an empty object', () => {
+    const config: Pick<ParsedServerConfig, 'customUserVars'> = { customUserVars: {} };
+    expect(hasCustomUserVars(config)).toBe(false);
+    expect(getMissingCustomUserVars(config, undefined)).toEqual([]);
+  });
+
+  it('reports every declared variable when no values are provided', () => {
+    const config = configWithVars(['THINGY_TOKEN', 'THINGY_REGION']);
+    expect(getMissingCustomUserVars(config, undefined)).toEqual(['THINGY_TOKEN', 'THINGY_REGION']);
+    expect(getMissingCustomUserVars(config, null)).toEqual(['THINGY_TOKEN', 'THINGY_REGION']);
+    expect(getMissingCustomUserVars(config, {})).toEqual(['THINGY_TOKEN', 'THINGY_REGION']);
+  });
+
+  it('reports only the variables the user has not set', () => {
+    const config = configWithVars(['THINGY_TOKEN', 'THINGY_REGION']);
+    expect(getMissingCustomUserVars(config, { THINGY_TOKEN: 'abc123' })).toEqual(['THINGY_REGION']);
+  });
+
+  it('treats empty-string and whitespace-only values as missing', () => {
+    const config = configWithVars(['THINGY_TOKEN']);
+    expect(getMissingCustomUserVars(config, { THINGY_TOKEN: '' })).toEqual(['THINGY_TOKEN']);
+    expect(getMissingCustomUserVars(config, { THINGY_TOKEN: '   ' })).toEqual(['THINGY_TOKEN']);
+    expect(getMissingCustomUserVars(config, { THINGY_TOKEN: '\t\n ' })).toEqual(['THINGY_TOKEN']);
+  });
+
+  it('returns an empty array when every declared variable has a value', () => {
+    const config = configWithVars(['THINGY_TOKEN', 'THINGY_REGION']);
+    expect(
+      getMissingCustomUserVars(config, { THINGY_TOKEN: 'abc123', THINGY_REGION: 'eu-west-1' }),
+    ).toEqual([]);
+  });
+
+  it('ignores provided values for variables the server does not declare', () => {
+    const config = configWithVars(['THINGY_TOKEN']);
+    expect(
+      getMissingCustomUserVars(config, { THINGY_TOKEN: 'abc123', UNRELATED: 'value' }),
+    ).toEqual([]);
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/zod.spec.ts b/packages/api/src/mcp/__tests__/zod.spec.ts
index 684b6de975b..03ff634097c 100644
--- a/packages/api/src/mcp/__tests__/zod.spec.ts
+++ b/packages/api/src/mcp/__tests__/zod.spec.ts
@@ -7,6 +7,7 @@ import {
   convertJsonSchemaToZod,
   resolveJsonSchemaRefs,
   normalizeJsonSchema,
+  sanitizeGeminiSchema,
 } from '../zod';
 
 describe('convertJsonSchemaToZod', () => {
@@ -2361,3 +2362,549 @@ describe('normalizeJsonSchema', () => {
     expect(result.properties.origin).toEqual({ type: 'string', description: 'Starting address' });
   });
 });
+
+describe('sanitizeGeminiSchema', () => {
+  it('collapses a multi-member anyOf to its first member', () => {
+    const schema = {
+      anyOf: [
+        { type: 'string', description: 'a string' },
+        { type: 'number', description: 'a number' },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result).toEqual({ type: 'string', description: 'a string' });
+    expect(result).not.toHaveProperty('anyOf');
+  });
+
+  it('collapses oneOf the same way as anyOf', () => {
+    const schema = {
+      oneOf: [{ type: 'integer' }, { type: 'boolean' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+
+  it('preserves sibling keys and lets the chosen member override them', () => {
+    const schema = {
+      title: 'field',
+      description: 'parent description',
+      anyOf: [
+        {
+          type: 'object',
+          description: 'member description',
+          properties: { id: { type: 'string' } },
+        },
+        { type: 'string' },
+      ],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      title: 'field',
+      description: 'member description',
+      type: 'object',
+      properties: { id: { type: 'string' } },
+    });
+  });
+
+  it('marks the field nullable when a null member is dropped from a union', () => {
+    const schema = {
+      anyOf: [{ type: 'string' }, { type: 'null' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', nullable: true });
+  });
+
+  it('handles a 3-member union that includes null (google-common would throw on this)', () => {
+    const schema = {
+      anyOf: [{ type: 'string' }, { type: 'number' }, { type: 'null' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', nullable: true });
+  });
+
+  it('collapses a nested union introduced by the chosen member', () => {
+    const schema = {
+      anyOf: [{ anyOf: [{ type: 'string' }, { type: 'number' }] }, { type: 'boolean' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string' });
+  });
+
+  it('collapses multi-entry type arrays', () => {
+    expect(sanitizeGeminiSchema({ type: ['string', 'number'] } as any)).toEqual({
+      type: 'string',
+    });
+  });
+
+  it('collapses a nullable type array to a single type plus nullable', () => {
+    expect(sanitizeGeminiSchema({ type: ['string', 'null'] } as any)).toEqual({
+      type: 'string',
+      nullable: true,
+    });
+  });
+
+  it('flattens unions nested inside object properties and array items', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        owner: { anyOf: [{ type: 'string' }, { type: 'object', properties: {} }] },
+        labels: {
+          type: 'array',
+          items: { oneOf: [{ type: 'string' }, { type: 'object' }] },
+        },
+        plain: { type: 'string', description: 'untouched' },
+      },
+      required: ['owner'],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.owner).toEqual({ type: 'string' });
+    expect(result.properties.labels.items).toEqual({ type: 'string' });
+    expect(result.properties.plain).toEqual({ type: 'string', description: 'untouched' });
+    expect(result.required).toEqual(['owner']);
+  });
+
+  it('flattens a discriminated-union MCP tool schema (GitHub issue_write pattern)', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        method: {
+          anyOf: [
+            {
+              type: 'object',
+              properties: { action: { const: 'create' }, title: { type: 'string' } },
+              required: ['action', 'title'],
+            },
+            {
+              type: 'object',
+              properties: { action: { const: 'update' }, issue_number: { type: 'number' } },
+              required: ['action', 'issue_number'],
+            },
+          ],
+        },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.method).toEqual({
+      type: 'object',
+      properties: { action: { type: 'string', enum: ['create'] }, title: { type: 'string' } },
+      required: ['action', 'title'],
+    });
+    expect(result.properties.method).not.toHaveProperty('anyOf');
+  });
+
+  it('is a no-op for schemas without unions', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: 'Name' },
+        age: { type: 'number' },
+        tags: { type: 'array', items: { type: 'string' } },
+      },
+      required: ['name'],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual(schema);
+  });
+
+  it('handles null, undefined, and primitive inputs safely', () => {
+    expect(sanitizeGeminiSchema(null as any)).toBeNull();
+    expect(sanitizeGeminiSchema(undefined as any)).toBeUndefined();
+    expect(sanitizeGeminiSchema('string' as any)).toBe('string');
+    expect(sanitizeGeminiSchema(42 as any)).toBe(42);
+  });
+
+  it('leaves no anyOf/oneOf/multi-type keys for google-common to reject', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        a: { anyOf: [{ type: 'string' }, { type: 'number' }] },
+        b: { type: ['boolean', 'null'] },
+        c: { oneOf: [{ type: 'object', properties: { x: { type: 'string' } } }, { type: 'null' }] },
+      },
+    } as any;
+
+    const json = JSON.stringify(sanitizeGeminiSchema(schema));
+    expect(json).not.toContain('"anyOf"');
+    expect(json).not.toContain('"oneOf"');
+    expect(sanitizeGeminiSchema(schema).properties.b).toEqual({
+      type: 'boolean',
+      nullable: true,
+    });
+  });
+
+  it('preserves parent properties and required outside the union when collapsing', () => {
+    const schema = {
+      type: 'object',
+      properties: { repo: { type: 'string' } },
+      required: ['repo'],
+      anyOf: [
+        { properties: { title: { type: 'string' } }, required: ['title'] },
+        { properties: { body: { type: 'string' } }, required: ['body'] },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('object');
+    expect(result.properties).toEqual({
+      repo: { type: 'string' },
+      title: { type: 'string' },
+    });
+    expect([...result.required].sort()).toEqual(['repo', 'title']);
+    expect(result).not.toHaveProperty('anyOf');
+  });
+
+  it('merges nested object properties from parent and chosen branch', () => {
+    const schema = {
+      type: 'object',
+      properties: { owner: { type: 'string' } },
+      oneOf: [
+        { type: 'object', properties: { sha: { type: 'string' } } },
+        { type: 'object', properties: { ref: { type: 'string' } } },
+      ],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema).properties).toEqual({
+      owner: { type: 'string' },
+      sha: { type: 'string' },
+    });
+  });
+
+  it('strips the dropped null from enum when a type array is nullable', () => {
+    const schema = { type: ['string', 'null'], enum: ['open', 'closed', null] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'string',
+      nullable: true,
+      enum: ['open', 'closed'],
+    });
+  });
+
+  it('strips null from enum when nullability comes from a union member', () => {
+    const schema = {
+      anyOf: [{ type: 'string', enum: ['a', 'b', null] }, { type: 'null' }],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('string');
+    expect(result.nullable).toBe(true);
+    expect(result.enum).toEqual(['a', 'b']);
+  });
+
+  it('keeps enum untouched when the field is not nullable', () => {
+    const schema = { type: ['string', 'number'], enum: ['a', 'b'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('drops a boolean enum that Gemini rejects (the reported 400), keeping the type', () => {
+    const schema = { type: 'boolean', enum: [true, false] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'boolean' });
+  });
+
+  it('drops a boolean enum produced by normalizeJsonSchema const→enum', () => {
+    // normalizeJsonSchema turns `const: true` into `enum: [true]`; Gemini rejects it.
+    const schema = normalizeJsonSchema({ type: 'boolean', const: true } as any);
+    expect(sanitizeGeminiSchema(schema as any)).toEqual({ type: 'boolean' });
+  });
+
+  it('resolves the reported failing shape: boolean enum inside array→items→object', () => {
+    // tools[0].function_declarations[N].parameters.properties[k].items.properties[0].enum[0] = true
+    const schema = {
+      type: 'object',
+      properties: {
+        rows: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              active: { type: 'boolean', enum: [true, false] },
+              name: { type: 'string' },
+            },
+          },
+        },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.rows.items.properties.active).toEqual({ type: 'boolean' });
+    expect(JSON.stringify(result)).not.toContain('"enum"');
+  });
+
+  it('filters non-string members out of a mixed string enum', () => {
+    const schema = { type: 'string', enum: ['a', 1, true, 'b', null] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('strips unsupported keywords (additionalProperties, $schema) but keeps Gemini-supported default', () => {
+    const schema = {
+      $schema: 'http://json-schema.org/draft-07/schema#',
+      type: 'object',
+      additionalProperties: { type: 'string' },
+      properties: {
+        name: { type: 'string', default: 'anon' },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result).not.toHaveProperty('$schema');
+    expect(result).not.toHaveProperty('additionalProperties');
+    expect(result.properties.name).toEqual({ type: 'string', default: 'anon' });
+  });
+
+  it('folds exclusive bounds into inclusive minimum/maximum', () => {
+    const schema = { type: 'number', exclusiveMinimum: 0, exclusiveMaximum: 100 } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'number', minimum: 0, maximum: 100 });
+  });
+
+  it('does not overwrite an existing minimum with an exclusive bound', () => {
+    const schema = { type: 'number', minimum: 5, exclusiveMinimum: 0 } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'number', minimum: 5 });
+  });
+
+  it('merges allOf intersections into a single object', () => {
+    const schema = {
+      allOf: [
+        { type: 'object', properties: { a: { type: 'string' } }, required: ['a'] },
+        { type: 'object', properties: { b: { type: 'number' } }, required: ['b'] },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('object');
+    expect(result.properties).toEqual({ a: { type: 'string' }, b: { type: 'number' } });
+    expect([...result.required].sort()).toEqual(['a', 'b']);
+    expect(result).not.toHaveProperty('allOf');
+  });
+
+  it('leaves a clean Gemini-ready schema unchanged', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        owner: { type: 'string', description: 'Repo owner' },
+        side: { type: 'string', enum: ['LEFT', 'RIGHT'] },
+        line: { type: 'number' },
+      },
+      required: ['owner'],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual(schema);
+  });
+
+  it('drops the enum when a mixed type array collapses to a non-string type', () => {
+    const schema = { type: ['integer', 'string'], enum: [1, 'auto'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+
+  it('keeps the enum when a mixed type array collapses to string', () => {
+    const schema = { type: ['string', 'integer'], enum: ['auto', 1] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['auto'] });
+  });
+
+  it('makes a typeless surviving enum a string type (Gemini enum requires Type.STRING)', () => {
+    const schema = { enum: ['a', 'b'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('drops a number enum on an integer field', () => {
+    const schema = { type: 'integer', enum: [1, 2, 3] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+
+  it('strips annotation keywords Gemini rejects (examples, readOnly, writeOnly, deprecated, $comment)', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        token: {
+          type: 'string',
+          examples: ['abc'],
+          readOnly: true,
+          writeOnly: false,
+          deprecated: true,
+          $comment: 'internal',
+        },
+      },
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'object',
+      properties: { token: { type: 'string' } },
+    });
+  });
+
+  it('strips numeric/array validators Gemini rejects (multipleOf, uniqueItems)', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        count: { type: 'integer', multipleOf: 2 },
+        tags: { type: 'array', items: { type: 'string' }, uniqueItems: true },
+      },
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'object',
+      properties: {
+        count: { type: 'integer' },
+        tags: { type: 'array', items: { type: 'string' } },
+      },
+    });
+  });
+
+  it('strips object-composition keywords Gemini rejects (patternProperties, propertyNames, dependentRequired)', () => {
+    const schema = {
+      type: 'object',
+      properties: { a: { type: 'string' } },
+      patternProperties: { '^x': { type: 'string' } },
+      propertyNames: { pattern: '^[a-z]+$' },
+      dependentRequired: { a: ['b'] },
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'object',
+      properties: { a: { type: 'string' } },
+    });
+  });
+
+  it('strips tuple/array-extension keywords Gemini rejects (prefixItems, additionalItems)', () => {
+    const schema = {
+      type: 'array',
+      items: { type: 'string' },
+      prefixItems: [{ type: 'string' }, { type: 'number' }],
+      additionalItems: false,
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'array',
+      items: { type: 'string' },
+    });
+  });
+
+  it('synthesizes `items` from `prefixItems` when a tuple array has none (Gemini requires items)', () => {
+    const schema = {
+      type: 'array',
+      prefixItems: [{ type: 'string', readOnly: true }, { type: 'number' }],
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'array',
+      items: { type: 'string' },
+    });
+  });
+
+  it('preserves an existing `items` over a `prefixItems`-derived one', () => {
+    const schema = {
+      type: 'array',
+      items: { type: 'boolean' },
+      prefixItems: [{ type: 'string' }],
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'array',
+      items: { type: 'boolean' },
+    });
+  });
+
+  it('synthesizes `items` from `prefixItems` when `items` is boolean false (Draft 2020 tuple)', () => {
+    const schema = {
+      type: 'array',
+      prefixItems: [{ type: 'number' }],
+      items: false,
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'array',
+      items: { type: 'number' },
+    });
+  });
+
+  it('falls back to an empty `items` schema for a boolean `items` with no prefixItems', () => {
+    expect(sanitizeGeminiSchema({ type: 'array', items: false } as any)).toEqual({
+      type: 'array',
+      items: {},
+    });
+    expect(sanitizeGeminiSchema({ type: 'array', items: true } as any)).toEqual({
+      type: 'array',
+      items: {},
+    });
+  });
+
+  it('falls back to an empty `items` schema for an array missing items entirely', () => {
+    expect(sanitizeGeminiSchema({ type: 'array' } as any)).toEqual({
+      type: 'array',
+      items: {},
+    });
+  });
+
+  it('drops a tuple-array `items: [...]` form and falls back rather than emit an array items', () => {
+    const schema = { type: 'array', items: [{ type: 'string' }, { type: 'number' }] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'array', items: {} });
+  });
+
+  it('preserves an object `default` verbatim without sanitizing its data keys', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        cfg: {
+          type: 'object',
+          default: { id: 'abc', readOnly: true, deprecated: false, nested: { id: 'x' } },
+          properties: { id: { type: 'string' } },
+        },
+      },
+    } as any;
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.cfg.default).toEqual({
+      id: 'abc',
+      readOnly: true,
+      deprecated: false,
+      nested: { id: 'x' },
+    });
+    expect(result.properties.cfg.properties).toEqual({ id: { type: 'string' } });
+  });
+
+  it('preserves an array `default` verbatim', () => {
+    const schema = {
+      type: 'array',
+      items: { type: 'string' },
+      default: ['id', 'readOnly'],
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'array',
+      items: { type: 'string' },
+      default: ['id', 'readOnly'],
+    });
+  });
+
+  it('strips content keywords and the bare `id` alias Gemini rejects', () => {
+    const schema = {
+      id: 'urn:example',
+      type: 'object',
+      properties: {
+        blob: { type: 'string', contentEncoding: 'base64', contentMediaType: 'image/png' },
+      },
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'object',
+      properties: { blob: { type: 'string' } },
+    });
+  });
+
+  it('strips deeply nested unsupported keywords through arrays, items, and properties', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        ranges: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: { score: { type: 'number', exclusiveMinimum: 0, multipleOf: 0.5 } },
+          },
+        },
+      },
+    } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'object',
+      properties: {
+        ranges: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: { score: { type: 'number', minimum: 0 } },
+          },
+        },
+      },
+    });
+  });
+});
diff --git a/packages/api/src/mcp/auth.ts b/packages/api/src/mcp/auth.ts
index e10c16b4b8f..b25e0ce8ee2 100644
--- a/packages/api/src/mcp/auth.ts
+++ b/packages/api/src/mcp/auth.ts
@@ -16,7 +16,7 @@ export async function getUserMCPAuthMap({
   servers?: (string | undefined)[];
   toolInstances?: (GenericTool | null)[];
   findPluginAuthsByKeys: PluginAuthMethods['findPluginAuthsByKeys'];
-}) {
+}): Promise<Record<string, Record<string, string>>> {
   let allMcpCustomUserVars: Record<string, Record<string, string>> = {};
   let mcpPluginKeysToFetch: string[] = [];
   try {
diff --git a/packages/api/src/mcp/connection.ts b/packages/api/src/mcp/connection.ts
index 9f779d7e878..87116b6a6e8 100644
--- a/packages/api/src/mcp/connection.ts
+++ b/packages/api/src/mcp/connection.ts
@@ -1,30 +1,77 @@
+import { isIP } from 'node:net';
 import { EventEmitter } from 'events';
 import { logger } from '@librechat/data-schemas';
-import { fetch as undiciFetch, Agent } from 'undici';
-import {
-  StdioClientTransport,
-  getDefaultEnvironment,
-} from '@modelcontextprotocol/sdk/client/stdio.js';
+import { fetch as undiciFetch, Agent, ProxyAgent } from 'undici';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js';
 import { ResourceListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import {
+  StdioClientTransport,
+  getDefaultEnvironment,
+} from '@modelcontextprotocol/sdk/client/stdio.js';
 import type {
   RequestInit as UndiciRequestInit,
   RequestInfo as UndiciRequestInfo,
   Response as UndiciResponse,
+  Dispatcher,
 } from 'undici';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import type { MCPOAuthTokens } from './oauth/types';
 import type * as t from './types';
-import { createSSRFSafeUndiciConnect, resolveHostnameSSRF } from '~/auth';
+import { createSSRFSafeUndiciConnect, isSSRFTarget, resolveHostnameSSRF } from '~/auth';
 import { runOutsideTracing } from '~/utils/tracing';
+import { isAddressAllowed } from '~/auth/domain';
 import { sanitizeUrlForLogging } from './utils';
 import { withTimeout } from '~/utils/promise';
 import { mcpConfig } from './mcpConfig';
 
 type FetchLike = (url: string | URL, init?: RequestInit) => Promise<Response>;
+type ManagedDispatcher = Agent | ProxyAgent;
+type ParsedIP = { version: 4 | 6; bits: 32 | 128; value: bigint };
+type MCPTool = MCPListToolsResult['tools'][number];
+
+const BIGINT_ZERO = BigInt(0);
+const BIGINT_ONE = BigInt(1);
+const BIGINT_EIGHT = BigInt(8);
+const BIGINT_SIXTEEN = BigInt(16);
+const UINT16_MASK = BigInt(0xffff);
+
+function getApproximateToolBytes(tool: MCPTool): number {
+  try {
+    return Buffer.byteLength(JSON.stringify(tool), 'utf8');
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+
+function getToolsListBudgetExceededReason(
+  toolCount: number,
+  totalBytes: number,
+  maxTools: number,
+  maxBytes: number,
+): string | null {
+  if (toolCount >= maxTools) {
+    return 'tool count';
+  }
+  if (totalBytes >= maxBytes) {
+    return 'size';
+  }
+  return null;
+}
+
+type MCPProxyConfig =
+  | {
+      type: 'explicit';
+      proxyUrl: string;
+    }
+  | {
+      type: 'env';
+      httpProxy?: string;
+      httpsProxy?: string;
+      noProxy?: string;
+    };
 
 function isStdioOptions(options: t.MCPOptions): options is t.StdioOptions {
   return 'command' in options;
@@ -74,6 +121,348 @@ const SSE_CONNECT_TIMEOUT = 120000;
 const DEFAULT_INIT_TIMEOUT = 30000;
 /** Max 307/308 redirects to follow per request (prevents redirect loops) */
 const MAX_REDIRECTS = 5;
+const DEFAULT_MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+const DEFAULT_MCP_STREAMABLE_HTTP_MAX_LINE_BYTES = 5 * 1024 * 1024;
+
+function getNonNegativeIntegerEnv(name: string, defaultValue: number): number {
+  const raw = process.env[name];
+  if (raw == null || raw.trim() === '') {
+    return defaultValue;
+  }
+
+  const trimmed = raw.trim();
+  if (!/^\d+$/.test(trimmed)) {
+    return defaultValue;
+  }
+
+  const parsed = Number(trimmed);
+  return Number.isSafeInteger(parsed) ? parsed : defaultValue;
+}
+
+function bytesToMiB(bytes: number): string {
+  return `${(bytes / 1024 / 1024).toFixed(2)} MiB`;
+}
+
+function getMemoryDebugSnapshot(): Record<string, string> {
+  const mem = process.memoryUsage();
+  return {
+    rss: bytesToMiB(mem.rss),
+    heapUsed: bytesToMiB(mem.heapUsed),
+    heapTotal: bytesToMiB(mem.heapTotal),
+    external: bytesToMiB(mem.external),
+    arrayBuffers: bytesToMiB(mem.arrayBuffers ?? 0),
+  };
+}
+
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+type JSONRPCRequestId = string | number;
+
+function getChunkBytes(chunk: unknown): Uint8Array {
+  if (typeof chunk === 'string') {
+    return textEncoder.encode(chunk);
+  }
+  if (chunk instanceof ArrayBuffer) {
+    return new Uint8Array(chunk);
+  }
+  if (ArrayBuffer.isView(chunk)) {
+    const view = new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+    return new Uint8Array(view);
+  }
+  return new Uint8Array();
+}
+
+function copyBytes(bytes: Uint8Array): Uint8Array {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy;
+}
+
+function concatBytes(chunks: Uint8Array[]): Uint8Array {
+  if (chunks.length === 0) {
+    return new Uint8Array();
+  }
+  if (chunks.length === 1) {
+    return chunks[0];
+  }
+  const totalLength = chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+  const combined = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    combined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return combined;
+}
+
+function getBodyText(body: unknown): string | null {
+  if (typeof body === 'string') {
+    return body;
+  }
+  if (body instanceof ArrayBuffer) {
+    return textDecoder.decode(new Uint8Array(body));
+  }
+  if (ArrayBuffer.isView(body)) {
+    return textDecoder.decode(new Uint8Array(body.buffer, body.byteOffset, body.byteLength));
+  }
+  return null;
+}
+
+function getJSONRPCRequestIds(body: unknown): JSONRPCRequestId[] {
+  const bodyText = getBodyText(body);
+  if (!bodyText) {
+    return [];
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return [];
+  }
+
+  const messages = Array.isArray(parsed) ? parsed : [parsed];
+  return messages.flatMap((message) => {
+    if (!message || typeof message !== 'object') {
+      return [];
+    }
+    const jsonrpcMessage = message as { id?: unknown; method?: unknown };
+    const { id } = jsonrpcMessage;
+    if (typeof jsonrpcMessage.method !== 'string') {
+      return [];
+    }
+    if (typeof id !== 'string' && typeof id !== 'number') {
+      return [];
+    }
+    return [id];
+  });
+}
+
+function buildBlockedMCPResponseMessage(
+  reason: string,
+  details: {
+    maxResponseBytes: number;
+    maxLineBytes: number;
+    totalBytes: number;
+    currentLineBytes: number;
+    chunkCount: number;
+  },
+): string {
+  const limitDetails =
+    reason === 'MCP response exceeded byte limit'
+      ? `limit=${details.maxResponseBytes} bytes, observed=${details.totalBytes} bytes`
+      : `lineLimit=${details.maxLineBytes} bytes, observedLine=${details.currentLineBytes} bytes, observedTotal=${details.totalBytes} bytes`;
+
+  return `[MCP] ${reason} (${limitDetails}, chunks=${details.chunkCount}). The MCP server returned an unsafe streamable HTTP response; narrow the tool result or retry after the server response is fixed.`;
+}
+
+function buildBlockedMCPResponseSSE(requestIds: JSONRPCRequestId[], message: string): Uint8Array {
+  const events = requestIds
+    .map((id) => {
+      const payload = {
+        jsonrpc: '2.0',
+        id,
+        error: {
+          code: -32000,
+          message,
+        },
+      };
+      return `data: ${JSON.stringify(payload)}\n\n`;
+    })
+    .join('');
+  return textEncoder.encode(events);
+}
+
+function getMCPStreamableHTTPResponseLimits(): {
+  maxResponseBytes: number;
+  maxLineBytes: number;
+} {
+  return {
+    maxResponseBytes: getNonNegativeIntegerEnv(
+      'MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES',
+      DEFAULT_MCP_STREAMABLE_HTTP_MAX_RESPONSE_BYTES,
+    ),
+    maxLineBytes: getNonNegativeIntegerEnv(
+      'MCP_STREAMABLE_HTTP_MAX_LINE_BYTES',
+      DEFAULT_MCP_STREAMABLE_HTTP_MAX_LINE_BYTES,
+    ),
+  };
+}
+
+async function guardMCPStreamableHTTPResponse(
+  response: UndiciResponse,
+  context: {
+    logPrefix: string;
+    method: string;
+    url: string;
+    requestIds?: JSONRPCRequestId[];
+  },
+): Promise<UndiciResponse> {
+  if (context.method === 'GET' || !response.body) {
+    return response;
+  }
+
+  const contentType = response.headers.get('content-type') ?? '';
+  const isEventStream = contentType.toLowerCase().includes('text/event-stream');
+  const { maxResponseBytes, maxLineBytes } = getMCPStreamableHTTPResponseLimits();
+  const canEmitFallbackSSEError = isEventStream && maxLineBytes > 0;
+  if (!isEventStream && maxResponseBytes === 0) {
+    return response;
+  }
+  if (maxResponseBytes === 0 && maxLineBytes === 0) {
+    return response;
+  }
+
+  let totalBytes = 0;
+  let currentLineBytes = 0;
+  let chunkCount = 0;
+  let pendingSSELineChunks: Uint8Array[] = [];
+  const sseEventDataLines: string[] = [];
+  const unresolvedRequestIds = new Set(context.requestIds ?? []);
+
+  const buildAndLogBlockedError = (reason: string, details: Record<string, unknown>): Error => {
+    const message = buildBlockedMCPResponseMessage(reason, {
+      maxResponseBytes,
+      maxLineBytes,
+      totalBytes,
+      currentLineBytes,
+      chunkCount,
+    });
+    logger.warn(`${context.logPrefix} MCP streamable HTTP response blocked: ${reason}`, {
+      method: context.method,
+      url: sanitizeUrlForLogging(context.url),
+      status: response.status,
+      contentType,
+      maxResponseBytes,
+      maxLineBytes,
+      totalBytes,
+      currentLineBytes,
+      chunkCount,
+      ...details,
+      memory: getMemoryDebugSnapshot(),
+    });
+    return new Error(message);
+  };
+
+  const trackSSELineForResolvedIds = (lineBytes: Uint8Array): void => {
+    if (unresolvedRequestIds.size === 0) {
+      return;
+    }
+
+    const rawLine = textDecoder.decode(lineBytes).replace(/[\r\n]+$/, '');
+    if (rawLine === '') {
+      if (sseEventDataLines.length === 0) {
+        return;
+      }
+      const data = sseEventDataLines.join('\n');
+      sseEventDataLines.length = 0;
+      try {
+        const parsed = JSON.parse(data) as { id?: unknown };
+        if (typeof parsed.id === 'string' || typeof parsed.id === 'number') {
+          unresolvedRequestIds.delete(parsed.id);
+        }
+      } catch {
+        /** Ignore malformed SSE data here; the SDK parser will report it. */
+      }
+      return;
+    }
+
+    const separatorIndex = rawLine.indexOf(':');
+    const field = separatorIndex === -1 ? rawLine : rawLine.slice(0, separatorIndex);
+    if (field !== 'data') {
+      return;
+    }
+    let value = separatorIndex === -1 ? '' : rawLine.slice(separatorIndex + 1);
+    if (value.startsWith(' ')) {
+      value = value.slice(1);
+    }
+    sseEventDataLines.push(value);
+  };
+
+  const enqueuePendingSSELine = (controller: TransformStreamDefaultController<Uint8Array>) => {
+    if (pendingSSELineChunks.length === 0) {
+      return;
+    }
+    const lineBytes = concatBytes(pendingSSELineChunks);
+    pendingSSELineChunks = [];
+    trackSSELineForResolvedIds(lineBytes);
+    controller.enqueue(lineBytes);
+  };
+
+  const blockResponse = (
+    controller: TransformStreamDefaultController<Uint8Array>,
+    reason: string,
+    details: Record<string, unknown>,
+  ) => {
+    const error = buildAndLogBlockedError(reason, details);
+    const fallbackRequestIds = [...unresolvedRequestIds];
+    if (canEmitFallbackSSEError && fallbackRequestIds.length > 0) {
+      controller.enqueue(buildBlockedMCPResponseSSE(fallbackRequestIds, error.message));
+      controller.terminate();
+      return;
+    }
+    throw error;
+  };
+
+  const guardedBody = (response.body as unknown as ReadableStream<unknown>).pipeThrough(
+    new TransformStream<unknown, Uint8Array>({
+      transform(chunk, controller) {
+        const bytes = getChunkBytes(chunk);
+        if (bytes.byteLength === 0) {
+          return;
+        }
+
+        chunkCount += 1;
+        totalBytes += bytes.byteLength;
+
+        if (maxResponseBytes > 0 && totalBytes > maxResponseBytes) {
+          blockResponse(controller, 'MCP response exceeded byte limit', {
+            chunkBytes: bytes.byteLength,
+          });
+          return;
+        }
+
+        if (isEventStream && maxLineBytes > 0) {
+          let segmentStart = 0;
+          for (let i = 0; i < bytes.byteLength; i++) {
+            const byte = bytes[i];
+            if (byte === 10 || byte === 13) {
+              if (i + 1 > segmentStart) {
+                pendingSSELineChunks.push(copyBytes(bytes.subarray(segmentStart, i + 1)));
+              }
+              enqueuePendingSSELine(controller);
+              segmentStart = i + 1;
+              currentLineBytes = 0;
+              continue;
+            }
+            currentLineBytes += 1;
+            if (currentLineBytes > maxLineBytes) {
+              blockResponse(controller, 'MCP response contained an oversized SSE line', {
+                chunkBytes: bytes.byteLength,
+              });
+              return;
+            }
+          }
+          if (segmentStart < bytes.byteLength) {
+            pendingSSELineChunks.push(copyBytes(bytes.subarray(segmentStart)));
+          }
+          return;
+        }
+
+        controller.enqueue(bytes);
+      },
+      flush(controller) {
+        enqueuePendingSSELine(controller);
+      },
+    }),
+  );
+
+  return new Response(guardedBody as unknown as BodyInit, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers as unknown as HeadersInit,
+  }) as unknown as UndiciResponse;
+}
 
 /**
  * Headers stripped before forwarding a request across an origin boundary on
@@ -164,7 +553,7 @@ function normalizeInitHeaders(init: UndiciRequestInit | undefined): Record<strin
 
 function buildFetchInit(
   init: UndiciRequestInit | undefined,
-  dispatcher: Agent,
+  dispatcher: Dispatcher,
   requestHeaders: Record<string, string> | null | undefined,
 ): UndiciRequestInit {
   const hasInitHeaders = init?.headers != null;
@@ -196,6 +585,334 @@ function getUrlPort(url: URL | string): string {
   return '';
 }
 
+function getTrimmedEnv(...keys: string[]): string | undefined {
+  for (const key of keys) {
+    const rawValue = process.env[key];
+    if (rawValue != null) {
+      return rawValue.trim() || undefined;
+    }
+  }
+  return undefined;
+}
+
+function getMCPProxyConfig(options: t.MCPOptions): MCPProxyConfig | undefined {
+  const configuredProxy =
+    'proxy' in options && typeof options.proxy === 'string' ? options.proxy.trim() : '';
+  if (configuredProxy) {
+    return { type: 'explicit', proxyUrl: configuredProxy };
+  }
+
+  const libreChatProxy = process.env.PROXY?.trim() ?? '';
+  if (libreChatProxy) {
+    return { type: 'explicit', proxyUrl: libreChatProxy };
+  }
+
+  const httpProxy = getTrimmedEnv('http_proxy', 'HTTP_PROXY');
+  const httpsProxy = getTrimmedEnv('https_proxy', 'HTTPS_PROXY');
+  if (!httpProxy && !httpsProxy) {
+    return undefined;
+  }
+
+  return {
+    type: 'env',
+    httpProxy,
+    httpsProxy,
+    noProxy: getTrimmedEnv('no_proxy', 'NO_PROXY'),
+  };
+}
+
+function parseIPv4ToBigInt(ip: string): bigint | null {
+  const octets = ip.split('.');
+  if (octets.length !== 4) {
+    return null;
+  }
+
+  let value = BIGINT_ZERO;
+  for (const octet of octets) {
+    if (!/^\d{1,3}$/.test(octet)) {
+      return null;
+    }
+    const parsed = Number.parseInt(octet, 10);
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > 255) {
+      return null;
+    }
+    value = (value << BIGINT_EIGHT) + BigInt(parsed);
+  }
+  return value;
+}
+
+function parseIPv6ToBigInt(ip: string): bigint | null {
+  let normalized = ip.toLowerCase().replace(/^\[|\]$/g, '');
+  const zoneIndex = normalized.indexOf('%');
+  if (zoneIndex !== -1) {
+    normalized = normalized.slice(0, zoneIndex);
+  }
+
+  if (normalized.includes('.')) {
+    const lastColon = normalized.lastIndexOf(':');
+    if (lastColon === -1) {
+      return null;
+    }
+    const ipv4Value = parseIPv4ToBigInt(normalized.slice(lastColon + 1));
+    if (ipv4Value == null) {
+      return null;
+    }
+    const hi = Number((ipv4Value >> BIGINT_SIXTEEN) & UINT16_MASK).toString(16);
+    const lo = Number(ipv4Value & UINT16_MASK).toString(16);
+    normalized = `${normalized.slice(0, lastColon)}:${hi}:${lo}`;
+  }
+
+  const halves = normalized.split('::');
+  if (halves.length > 2) {
+    return null;
+  }
+
+  const left = halves[0] ? halves[0].split(':') : [];
+  const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;
+  if (missing < 0 || (halves.length === 1 && left.length !== 8)) {
+    return null;
+  }
+
+  const parts = [...left, ...Array<string>(missing).fill('0'), ...right];
+  if (parts.length !== 8 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
+    return null;
+  }
+
+  return parts.reduce(
+    (value, part) => (value << BIGINT_SIXTEEN) + BigInt(Number.parseInt(part, 16)),
+    BIGINT_ZERO,
+  );
+}
+
+function parseIPLiteral(value: string): ParsedIP | null {
+  const normalized = value
+    .toLowerCase()
+    .trim()
+    .replace(/^\[|\]$/g, '');
+  const version = isIP(normalized);
+  if (version === 4) {
+    const parsed = parseIPv4ToBigInt(normalized);
+    return parsed == null ? null : { version: 4, bits: 32, value: parsed };
+  }
+  if (version === 6) {
+    const parsed = parseIPv6ToBigInt(normalized);
+    return parsed == null ? null : { version: 6, bits: 128, value: parsed };
+  }
+  return null;
+}
+
+function ipMatchesCIDR(hostname: string, cidr: string): boolean {
+  const [rangeAddress, prefixLength, extra] = cidr.split('/');
+  if (!rangeAddress || prefixLength == null || extra != null || !/^\d+$/.test(prefixLength)) {
+    return false;
+  }
+
+  const hostIP = parseIPLiteral(hostname);
+  const rangeIP = parseIPLiteral(rangeAddress);
+  if (!hostIP || !rangeIP || hostIP.version !== rangeIP.version) {
+    return false;
+  }
+
+  const prefix = Number.parseInt(prefixLength, 10);
+  if (!Number.isInteger(prefix) || prefix < 0 || prefix > rangeIP.bits) {
+    return false;
+  }
+
+  const bits = BigInt(rangeIP.bits);
+  const mask =
+    prefix === 0
+      ? BIGINT_ZERO
+      : (((BIGINT_ONE << bits) - BIGINT_ONE) << BigInt(rangeIP.bits - prefix)) &
+        ((BIGINT_ONE << bits) - BIGINT_ONE);
+  return (hostIP.value & mask) === (rangeIP.value & mask);
+}
+
+function ipMatchesRange(hostname: string, range: string): boolean {
+  const [startAddress, endAddress, extra] = range.split('-');
+  if (!startAddress || !endAddress || extra != null) {
+    return false;
+  }
+
+  const hostIP = parseIPLiteral(hostname);
+  const startIP = parseIPLiteral(startAddress);
+  const endIP = parseIPLiteral(endAddress);
+  if (
+    !hostIP ||
+    !startIP ||
+    !endIP ||
+    hostIP.version !== startIP.version ||
+    hostIP.version !== endIP.version
+  ) {
+    return false;
+  }
+
+  const min = startIP.value <= endIP.value ? startIP.value : endIP.value;
+  const max = startIP.value <= endIP.value ? endIP.value : startIP.value;
+  return hostIP.value >= min && hostIP.value <= max;
+}
+
+function matchesNoProxyIPPattern(hostname: string, entryHostname: string): boolean {
+  if (entryHostname.includes('/')) {
+    return ipMatchesCIDR(hostname, entryHostname);
+  }
+  if (entryHostname.includes('-')) {
+    return ipMatchesRange(hostname, entryHostname);
+  }
+  return false;
+}
+
+function getProxyEntryPort(entry: string): {
+  hostname: string;
+  port: number;
+} {
+  const trimmed = entry.trim();
+  const bracketed = trimmed.match(/^\[([^\]]+)\](?::(\d+))?$/);
+  if (bracketed) {
+    return {
+      hostname: bracketed[1].toLowerCase(),
+      port: bracketed[2] ? Number.parseInt(bracketed[2], 10) : 0,
+    };
+  }
+
+  const separatorCount = (trimmed.match(/:/g) ?? []).length;
+  const parsed = separatorCount === 1 ? trimmed.match(/^(.+):(\d+)$/) : null;
+  const hostname = (parsed ? parsed[1] : trimmed).replace(/^\[|\]$/g, '').toLowerCase();
+  return {
+    hostname: hostname.replace(/^\*?\./, ''),
+    port: parsed ? Number.parseInt(parsed[2], 10) : 0,
+  };
+}
+
+function shouldBypassEnvProxy(url: URL, noProxy?: string): boolean {
+  if (!noProxy) {
+    return false;
+  }
+
+  const trimmed = noProxy.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (trimmed === '*') {
+    return true;
+  }
+
+  const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  const port = Number.parseInt(getUrlPort(url), 10) || 0;
+
+  for (const entry of trimmed.split(/[,\s]/)) {
+    if (!entry) {
+      continue;
+    }
+    if (entry === '*') {
+      return true;
+    }
+
+    const proxyEntry = getProxyEntryPort(entry);
+    if (proxyEntry.port && proxyEntry.port !== port) {
+      continue;
+    }
+    if (matchesNoProxyIPPattern(hostname, proxyEntry.hostname)) {
+      return true;
+    }
+    if (hostname === proxyEntry.hostname || hostname.endsWith(`.${proxyEntry.hostname}`)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function getProxyUrlForRequest(
+  proxyConfig: MCPProxyConfig | undefined,
+  urlString: string,
+): string | undefined {
+  if (!proxyConfig || !urlString) {
+    return undefined;
+  }
+  if (proxyConfig.type === 'explicit') {
+    return proxyConfig.proxyUrl;
+  }
+
+  const url = new URL(urlString);
+  if (shouldBypassEnvProxy(url, proxyConfig.noProxy)) {
+    return undefined;
+  }
+  if (url.protocol === 'https:') {
+    return proxyConfig.httpsProxy ?? proxyConfig.httpProxy;
+  }
+  if (url.protocol === 'http:') {
+    return proxyConfig.httpProxy;
+  }
+  return undefined;
+}
+
+function createMCPDispatcher(options: {
+  bodyTimeout: number;
+  headersTimeout: number;
+  proxyUrl?: string;
+  keepAliveTimeout?: number;
+  keepAliveMaxTimeout?: number;
+  connect?: ReturnType<typeof createSSRFSafeUndiciConnect>;
+}): ManagedDispatcher {
+  const { bodyTimeout, headersTimeout, proxyUrl, keepAliveTimeout, keepAliveMaxTimeout, connect } =
+    options;
+
+  const baseOptions = {
+    bodyTimeout,
+    headersTimeout,
+    ...(keepAliveTimeout != null ? { keepAliveTimeout } : {}),
+    ...(keepAliveMaxTimeout != null ? { keepAliveMaxTimeout } : {}),
+  };
+
+  if (proxyUrl) {
+    return new ProxyAgent({
+      uri: proxyUrl,
+      ...baseOptions,
+    });
+  }
+
+  return new Agent({
+    ...baseOptions,
+    ...(connect != null ? { connect } : {}),
+  });
+}
+
+async function assertProxiedRequestTargetAllowed(
+  urlString: string,
+  proxyConfig: MCPProxyConfig | undefined,
+  useSSRFProtection: boolean,
+  allowedAddresses?: string[] | null,
+): Promise<void> {
+  const proxyUrl = getProxyUrlForRequest(proxyConfig, urlString);
+  if (!proxyUrl || !useSSRFProtection) {
+    return;
+  }
+
+  const targetUrl = new URL(urlString);
+  const port = getUrlPort(targetUrl);
+  if (isAddressAllowed(targetUrl.hostname, allowedAddresses, port)) {
+    return;
+  }
+  if (!parseIPLiteral(targetUrl.hostname)) {
+    throw new Error(
+      `SSRF protection: proxied MCP request target "${targetUrl.hostname}" must be an IP literal or an explicitly allowed host`,
+    );
+  }
+
+  const isBlockedTarget =
+    isSSRFTarget(targetUrl.hostname, allowedAddresses, port) ||
+    (await resolveHostnameSSRF(targetUrl.hostname, allowedAddresses, port));
+
+  if (!isBlockedTarget) {
+    return;
+  }
+
+  throw new Error(
+    `SSRF protection: proxied MCP request target "${targetUrl.hostname}" resolved to a private/reserved address`,
+  );
+}
+
 /**
  * Drops credential-bearing headers when a 307/308 redirect crosses an origin
  * boundary. Removes the always-forbidden set plus any caller-supplied secret
@@ -399,8 +1116,12 @@ interface MCPConnectionParams {
   oauthTokens?: MCPOAuthTokens | null;
   useSSRFProtection?: boolean;
   allowedAddresses?: string[] | null;
+  ephemeralConnection?: boolean;
 }
 
+/** Result of an MCP `tools/list` request: one page of tools plus an optional pagination cursor. */
+type MCPListToolsResult = Awaited<ReturnType<Client['listTools']>>;
+
 export class MCPConnection extends EventEmitter {
   public client: Client;
   private options: t.MCPOptions;
@@ -413,7 +1134,7 @@ export class MCPConnection extends EventEmitter {
   private isReconnecting = false;
   private isInitializing = false;
   private reconnectAttempts = 0;
-  private agents: Agent[] = [];
+  private agents: Dispatcher[] = [];
   private readonly userId?: string;
   private lastPingTime: number;
   private lastConnectionCheckAt: number = 0;
@@ -423,6 +1144,8 @@ export class MCPConnection extends EventEmitter {
   private oauthRecovery = false;
   private readonly useSSRFProtection: boolean;
   private readonly allowedAddresses?: string[] | null;
+  private readonly ephemeralConnection: boolean;
+  private readonly proxyConfig?: MCPProxyConfig;
   iconPath?: string;
   timeout?: number;
   sseReadTimeout?: number;
@@ -538,6 +1261,8 @@ export class MCPConnection extends EventEmitter {
     this.userId = params.userId;
     this.useSSRFProtection = params.useSSRFProtection === true;
     this.allowedAddresses = params.allowedAddresses ?? null;
+    this.ephemeralConnection = params.ephemeralConnection === true;
+    this.proxyConfig = getMCPProxyConfig(params.serverConfig);
     this.iconPath = params.serverConfig.iconPath;
     this.timeout = params.serverConfig.timeout;
     this.sseReadTimeout = params.serverConfig.sseReadTimeout;
@@ -579,58 +1304,83 @@ export class MCPConnection extends EventEmitter {
     sseBodyTimeout?: number,
     configuredSecretHeaderKeys?: ReadonlySet<string>,
     baseUrl?: string,
+    guardStreamableHTTPResponses = false,
   ): (input: UndiciRequestInfo, init?: UndiciRequestInit) => Promise<UndiciResponse> {
-    const basePort = baseUrl ? getUrlPort(baseUrl) : '';
-    const ssrfConnect = this.useSSRFProtection
-      ? createSSRFSafeUndiciConnect(this.allowedAddresses, basePort)
-      : undefined;
-    const connectOpts = ssrfConnect != null ? { connect: ssrfConnect } : {};
+    const proxyConfig = this.proxyConfig;
+    const useSSRFProtection = this.useSSRFProtection;
+    const allowedAddresses = this.allowedAddresses;
     /** Capture only the fields needed by the fetch closure; see factory note above. */
     const agents = this.agents;
+    const logPrefix = this.getLogPrefix();
     const effectiveTimeout = timeout || DEFAULT_TIMEOUT;
-    const postAgent = new Agent({
-      bodyTimeout: effectiveTimeout,
-      headersTimeout: effectiveTimeout,
-      ...connectOpts,
-    });
-    this.agents.push(postAgent);
+    const requestDispatchers = new Map<string, ManagedDispatcher>();
+    const ssrfConnects = new Map<string, ReturnType<typeof createSSRFSafeUndiciConnect>>();
+
+    const getSSRFConnect = (
+      targetPort: string,
+      dispatcherAllowedAddresses: string[] | null | undefined,
+      forceSafeDirectConnect: boolean,
+    ): ReturnType<typeof createSSRFSafeUndiciConnect> => {
+      const key = `${forceSafeDirectConnect ? 'redirect' : 'configured'}:${targetPort}`;
+      const existingConnect = ssrfConnects.get(key);
+      if (existingConnect) {
+        return existingConnect;
+      }
 
-    let getAgent: Agent | undefined;
-    if (sseBodyTimeout != null) {
-      getAgent = new Agent({
-        bodyTimeout: sseBodyTimeout,
-        headersTimeout: effectiveTimeout,
-        ...connectOpts,
-      });
-      this.agents.push(getAgent);
-    }
+      const connect = forceSafeDirectConnect
+        ? createSSRFSafeUndiciConnect()
+        : createSSRFSafeUndiciConnect(dispatcherAllowedAddresses, targetPort);
+      ssrfConnects.set(key, connect);
+      return connect;
+    };
 
-    let safeRedirectPostAgent: Agent | undefined;
-    let safeRedirectGetAgent: Agent | undefined;
     /**
-     * Allowlist mode keeps the original MCP URL admin-approved, but redirect
-     * targets are server-controlled. These agents add connect-time DNS checks
-     * for those cross-origin hops so DNS rebinding cannot beat the standalone
-     * resolveHostnameSSRF pre-check.
+     * Proxy selection depends on the resolved request URL, not just the
+     * configured MCP base URL. SSE message endpoints can be absolute URLs, so
+     * cache dispatchers by the target URL's proxy decision and connect policy.
      */
-    const createSafeRedirectAgent = (bodyTimeout: number): Agent => {
-      const redirectSSRFConnect = createSSRFSafeUndiciConnect();
-      const agent = new Agent({
+    const getRequestDispatcher = (
+      isGetRequest: boolean,
+      targetUrlString: string,
+      dispatcherAllowedAddresses: string[] | null | undefined,
+      forceSafeDirectConnect = false,
+    ): ManagedDispatcher => {
+      const bodyTimeout =
+        isGetRequest && sseBodyTimeout != null ? sseBodyTimeout : effectiveTimeout;
+      const proxyUrl = getProxyUrlForRequest(proxyConfig, targetUrlString);
+      const targetPort = getUrlPort(targetUrlString);
+      const needsSSRFConnect = !proxyUrl && (useSSRFProtection || forceSafeDirectConnect);
+      const key = [
+        bodyTimeout,
+        proxyUrl ?? 'direct',
+        needsSSRFConnect ? targetPort : 'open',
+        forceSafeDirectConnect ? 'redirect' : 'configured',
+      ].join(':');
+      const existingAgent = requestDispatchers.get(key);
+      if (existingAgent) {
+        return existingAgent;
+      }
+
+      const connect = needsSSRFConnect
+        ? getSSRFConnect(targetPort, dispatcherAllowedAddresses, forceSafeDirectConnect)
+        : undefined;
+      const agent = createMCPDispatcher({
         bodyTimeout,
         headersTimeout: effectiveTimeout,
-        connect: redirectSSRFConnect,
+        proxyUrl,
+        ...(connect != null ? { connect } : {}),
       });
+      requestDispatchers.set(key, agent);
       agents.push(agent);
       return agent;
     };
-    const getSafeRedirectDispatcher = (isGetRequest: boolean): Agent => {
-      if (!isGetRequest || sseBodyTimeout == null) {
-        safeRedirectPostAgent ??= createSafeRedirectAgent(effectiveTimeout);
-        return safeRedirectPostAgent;
+
+    if (baseUrl) {
+      getRequestDispatcher(false, baseUrl, allowedAddresses);
+      if (sseBodyTimeout != null) {
+        getRequestDispatcher(true, baseUrl, allowedAddresses);
       }
-      safeRedirectGetAgent ??= createSafeRedirectAgent(sseBodyTimeout);
-      return safeRedirectGetAgent;
-    };
+    }
 
     return async function customFetch(
       input: UndiciRequestInfo,
@@ -648,7 +1398,6 @@ export class MCPConnection extends EventEmitter {
       const { urlString, resolvedInit } = await resolveFetchInput(input, init);
 
       const isGet = (resolvedInit?.method ?? 'GET').toUpperCase() === 'GET';
-      const dispatcher = isGet && getAgent ? getAgent : postAgent;
       const requestHeaders = getHeaders();
       /**
        * Headers that originated from user/server configuration — runtime
@@ -661,21 +1410,42 @@ export class MCPConnection extends EventEmitter {
         ...(configuredSecretHeaderKeys ?? []),
       ]);
 
-      let currentInit = buildFetchInit(resolvedInit, dispatcher, requestHeaders);
       let currentUrlString = urlString;
+      let currentAllowedAddresses = allowedAddresses;
+      let forceRedirectSSRFConnect = false;
+      let currentInit = buildFetchInit(
+        resolvedInit,
+        getRequestDispatcher(isGet, currentUrlString, currentAllowedAddresses),
+        requestHeaders,
+      );
       const originalOrigin = new URL(currentUrlString).origin;
-
       for (let redirects = 0; ; redirects++) {
+        await assertProxiedRequestTargetAllowed(
+          currentUrlString,
+          proxyConfig,
+          useSSRFProtection,
+          currentAllowedAddresses,
+        );
         const response = await undiciFetch(currentUrlString, currentInit);
         const isMethodPreservingRedirect = response.status === 307 || response.status === 308;
+        const responseContext = {
+          logPrefix,
+          method: (currentInit?.method ?? 'GET').toUpperCase(),
+          url: currentUrlString,
+          requestIds: getJSONRPCRequestIds(currentInit?.body),
+        };
 
         if (!isMethodPreservingRedirect || redirects >= MAX_REDIRECTS) {
-          return response;
+          return guardStreamableHTTPResponses
+            ? guardMCPStreamableHTTPResponse(response, responseContext)
+            : response;
         }
 
         const location = response.headers.get('location');
         if (!location) {
-          return response;
+          return guardStreamableHTTPResponses
+            ? guardMCPStreamableHTTPResponse(response, responseContext)
+            : response;
         }
 
         const targetUrl = new URL(location, currentUrlString);
@@ -695,7 +1465,7 @@ export class MCPConnection extends EventEmitter {
          * design — letting redirect targets inherit the exemption would open
          * an SSRF amplification primitive.
          */
-        if (await resolveHostnameSSRF(targetUrl.hostname)) {
+        if (isSSRFTarget(targetUrl.hostname) || (await resolveHostnameSSRF(targetUrl.hostname))) {
           logger.warn(
             `[MCP] Blocked redirect to private/reserved address: ${sanitizeUrlForLogging(targetUrl)}`,
           );
@@ -715,6 +1485,8 @@ export class MCPConnection extends EventEmitter {
         }
 
         if (isCrossOriginRedirect) {
+          currentAllowedAddresses = null;
+          forceRedirectSSRFConnect = true;
           /**
            * Once a server-controlled cross-origin hop is seen, keep the safe
            * dispatcher for the rest of this redirect chain. Restoring the
@@ -725,7 +1497,22 @@ export class MCPConnection extends EventEmitter {
            */
           currentInit = {
             ...currentInit,
-            dispatcher: getSafeRedirectDispatcher(isGet),
+            dispatcher: getRequestDispatcher(
+              isGet,
+              targetUrl.href,
+              currentAllowedAddresses,
+              forceRedirectSSRFConnect,
+            ),
+          };
+        } else {
+          currentInit = {
+            ...currentInit,
+            dispatcher: getRequestDispatcher(
+              isGet,
+              targetUrl.href,
+              currentAllowedAddresses,
+              forceRedirectSSRFConnect,
+            ),
           };
         }
 
@@ -821,17 +1608,33 @@ export class MCPConnection extends EventEmitter {
            * The connect timeout is extended because proxies may delay initial response.
            */
           const sseTimeout = this.timeout || SSE_CONNECT_TIMEOUT;
-          const ssrfConnect = this.useSSRFProtection
-            ? createSSRFSafeUndiciConnect(this.allowedAddresses, getUrlPort(url))
-            : undefined;
-          const sseAgent = new Agent({
-            bodyTimeout: sseTimeout,
-            headersTimeout: sseTimeout,
-            keepAliveTimeout: sseTimeout,
-            keepAliveMaxTimeout: sseTimeout * 2,
-            ...(ssrfConnect != null ? { connect: ssrfConnect } : {}),
-          });
-          this.agents.push(sseAgent);
+          const sseAgents = new Map<string, ManagedDispatcher>();
+          const getSSEDispatcher = (targetUrlString: string): ManagedDispatcher => {
+            const proxyUrl = getProxyUrlForRequest(this.proxyConfig, targetUrlString);
+            const targetPort = getUrlPort(targetUrlString);
+            const key = `${proxyUrl ?? 'direct'}:${this.useSSRFProtection && !proxyUrl ? targetPort : 'open'}`;
+            const existingAgent = sseAgents.get(key);
+            if (existingAgent) {
+              return existingAgent;
+            }
+
+            const connect =
+              this.useSSRFProtection && !proxyUrl
+                ? createSSRFSafeUndiciConnect(this.allowedAddresses, targetPort)
+                : undefined;
+            const agent = createMCPDispatcher({
+              bodyTimeout: sseTimeout,
+              headersTimeout: sseTimeout,
+              keepAliveTimeout: sseTimeout,
+              keepAliveMaxTimeout: sseTimeout * 2,
+              proxyUrl,
+              ...(connect != null ? { connect } : {}),
+            });
+            sseAgents.set(key, agent);
+            this.agents.push(agent);
+            return agent;
+          };
+          getSSEDispatcher(options.url);
           const sseConfiguredSecretHeaderKeys: ReadonlySet<string> = new Set(
             Object.keys(headers).map((key) => key.toLowerCase()),
           );
@@ -842,15 +1645,28 @@ export class MCPConnection extends EventEmitter {
               signal: abortController.signal,
             },
             eventSourceInit: {
-              fetch: (url, init) => {
+              fetch: async (url, init) => {
+                const { urlString, resolvedInit } = await resolveFetchInput(
+                  url as UndiciRequestInfo,
+                  init as UndiciRequestInit,
+                );
+                await assertProxiedRequestTargetAllowed(
+                  urlString,
+                  this.proxyConfig,
+                  this.useSSRFProtection,
+                  this.allowedAddresses,
+                );
                 /** Merge headers: SSE defaults < init headers < user headers (user wins) */
-                const fetchHeaders = new Headers(
-                  Object.assign({}, SSE_REQUEST_HEADERS, init?.headers, headers),
+                const fetchHeaders = Object.assign(
+                  {},
+                  SSE_REQUEST_HEADERS,
+                  resolvedInit?.headers,
+                  headers,
                 );
-                return undiciFetch(url, {
-                  ...init,
+                return undiciFetch(urlString, {
+                  ...resolvedInit,
                   redirect: 'manual',
-                  dispatcher: sseAgent,
+                  dispatcher: getSSEDispatcher(urlString),
                   headers: fetchHeaders,
                 });
               },
@@ -904,6 +1720,7 @@ export class MCPConnection extends EventEmitter {
               this.sseReadTimeout || DEFAULT_SSE_READ_TIMEOUT,
               httpConfiguredSecretHeaderKeys,
               options.url,
+              true,
             ) as unknown as FetchLike,
           });
 
@@ -1121,7 +1938,7 @@ export class MCPConnection extends EventEmitter {
             `${this.getLogPrefix()} Server URL for OAuth: ${serverUrl ? sanitizeUrlForLogging(serverUrl) : 'undefined'}`,
           );
 
-          const oauthTimeout = this.options.initTimeout ?? 60000 * 2;
+          const oauthTimeout = mcpConfig.OAUTH_HANDLING_TIMEOUT;
           /** Promise that will resolve when OAuth is handled */
           const oauthHandledPromise = new Promise<void>((resolve, reject) => {
             let timeoutId: NodeJS.Timeout | null = null;
@@ -1242,8 +2059,13 @@ export class MCPConnection extends EventEmitter {
 
   async connect(): Promise<void> {
     try {
-      // preserve cycle tracking across reconnects so the circuit breaker can detect rapid cycling
-      await this.disconnect(false);
+      /**
+       * Persistent connections preserve cycle tracking across reconnects so the
+       * circuit breaker can detect storms. Request-scoped connections are
+       * intentionally short-lived per tool call, so their clean lifecycle should
+       * not consume the reconnect-storm cycle budget.
+       */
+      await this.disconnect(this.ephemeralConnection);
       await this.connectClient();
       if (!(await this.isConnected())) {
         throw new Error('Connection not established');
@@ -1283,7 +2105,7 @@ export class MCPConnection extends EventEmitter {
         isTransient,
       } = extractSSEErrorMessage(error);
 
-      if (errorCode === 400 || errorCode === 404 || errorCode === 405) {
+      if (errorCode === 400 || errorCode === 404 || errorCode === 405 || errorCode === 406) {
         const hasSession =
           'sessionId' in transport &&
           (transport as { sessionId?: string }).sessionId != null &&
@@ -1399,13 +2221,118 @@ export class MCPConnection extends EventEmitter {
     }
   }
 
-  async fetchTools() {
+  /**
+   * Fetches the server's tools, following MCP `tools/list` cursor pagination so a
+   * server that spans multiple pages (e.g. an aggregating gateway exposing many
+   * tools) is loaded in full instead of being truncated to the first page.
+   *
+   * Pagination is bounded by {@link mcpConfig.TOOLS_LIST_MAX_PAGES}, aggregate
+   * tool count, approximate serialized size, elapsed time, and a repeated-cursor
+   * guard. On error, the tools already fetched are returned rather than discarded,
+   * and the method never throws.
+   */
+  async fetchTools(): Promise<MCPListToolsResult['tools']> {
+    const maxPages = mcpConfig.TOOLS_LIST_MAX_PAGES;
+    const maxTools = mcpConfig.TOOLS_LIST_MAX_TOOLS;
+    const maxBytes = mcpConfig.TOOLS_LIST_MAX_BYTES;
+    const deadline = Date.now() + mcpConfig.TOOLS_LIST_TIMEOUT_MS;
+    const allTools: MCPListToolsResult['tools'] = [];
+    const seenCursors = new Set<string>();
+    let cursor: string | undefined;
+    let totalBytes = 0;
+
+    for (let page = 1; page <= maxPages; page++) {
+      const exhaustedBudget = getToolsListBudgetExceededReason(
+        allTools.length,
+        totalBytes,
+        maxTools,
+        maxBytes,
+      );
+      if (exhaustedBudget != null) {
+        this.warnToolsListBudgetExceeded(exhaustedBudget, allTools.length);
+        return allTools;
+      }
+
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) {
+        this.warnToolsListBudgetExceeded('time', allTools.length);
+        return allTools;
+      }
+
+      const result = await this.listToolsPage(cursor, remainingMs);
+      if (result == null) {
+        /** Request failed mid-pagination: return the pages already fetched instead of discarding them. */
+        return allTools;
+      }
+
+      for (const tool of result.tools) {
+        if (allTools.length >= maxTools) {
+          this.warnToolsListBudgetExceeded('tool count', allTools.length);
+          return allTools;
+        }
+
+        const toolBytes = getApproximateToolBytes(tool);
+        if (totalBytes + toolBytes > maxBytes) {
+          this.warnToolsListBudgetExceeded('size', allTools.length);
+          return allTools;
+        }
+
+        allTools.push(tool);
+        totalBytes += toolBytes;
+      }
+
+      const { nextCursor } = result;
+      if (nextCursor == null) {
+        return allTools;
+      }
+
+      const nextPageBudget = getToolsListBudgetExceededReason(
+        allTools.length,
+        totalBytes,
+        maxTools,
+        maxBytes,
+      );
+      if (nextPageBudget != null) {
+        this.warnToolsListBudgetExceeded(nextPageBudget, allTools.length);
+        return allTools;
+      }
+
+      if (seenCursors.has(nextCursor)) {
+        logger.warn(
+          `${this.getLogPrefix()} MCP server returned a repeated tools/list cursor; stopping pagination after ${page} page(s).`,
+        );
+        return allTools;
+      }
+
+      seenCursors.add(nextCursor);
+      cursor = nextCursor;
+    }
+
+    logger.warn(
+      `${this.getLogPrefix()} Reached the tools/list pagination limit of ${maxPages} page(s); some tools may be omitted. Set MCP_TOOLS_LIST_MAX_PAGES higher if this server legitimately exposes more.`,
+    );
+    return allTools;
+  }
+
+  private warnToolsListBudgetExceeded(reason: string, toolCount: number): void {
+    logger.warn(
+      `${this.getLogPrefix()} Stopping tools/list pagination because the ${reason} budget was reached after ${toolCount} tool(s).`,
+    );
+  }
+
+  /** Fetches a single `tools/list` page, returning null (and logging) on failure so pagination can stop gracefully. */
+  private async listToolsPage(
+    cursor: string | undefined,
+    timeoutMs: number,
+  ): Promise<MCPListToolsResult | null> {
     try {
-      const { tools } = await this.client.listTools();
-      return tools;
+      return await this.client.listTools(cursor != null ? { cursor } : undefined, {
+        timeout: timeoutMs,
+        maxTotalTimeout: timeoutMs,
+      });
     } catch (error) {
       this.emitError(error, 'Failed to fetch tools');
-      return [];
+      return null;
     }
   }
 
@@ -1532,6 +2459,10 @@ export class MCPConnection extends EventEmitter {
       if (message.includes('authentication required') || message.includes('unauthorized')) {
         return true;
       }
+      // Check for missing authorization values (e.g., Amazon Ads MCP returns HTTP 400 with this)
+      if (message.includes('no authorization')) {
+        return true;
+      }
     }
 
     return false;
diff --git a/packages/api/src/mcp/errors.ts b/packages/api/src/mcp/errors.ts
index 21b249db307..9ac7568313a 100644
--- a/packages/api/src/mcp/errors.ts
+++ b/packages/api/src/mcp/errors.ts
@@ -14,7 +14,7 @@ export type MCPErrorCode = (typeof MCPErrorCodes)[keyof typeof MCPErrorCodes];
  * Thrown when a user attempts to connect to an MCP server whose domain is not in the allowlist.
  */
 export class MCPDomainNotAllowedError extends Error {
-  public readonly code = MCPErrorCodes.DOMAIN_NOT_ALLOWED;
+  public readonly code: 'MCP_DOMAIN_NOT_ALLOWED' = MCPErrorCodes.DOMAIN_NOT_ALLOWED;
   public readonly statusCode = 403;
   public readonly domain: string;
 
@@ -31,7 +31,7 @@ export class MCPDomainNotAllowedError extends Error {
  * Thrown when attempting to connect/inspect an MCP server fails.
  */
 export class MCPInspectionFailedError extends Error {
-  public readonly code = MCPErrorCodes.INSPECTION_FAILED;
+  public readonly code: 'MCP_INSPECTION_FAILED' = MCPErrorCodes.INSPECTION_FAILED;
   public readonly statusCode = 400;
   public readonly serverName: string;
 
diff --git a/packages/api/src/mcp/mcpConfig.ts b/packages/api/src/mcp/mcpConfig.ts
index a81752e909e..68ae3cdfe3c 100644
--- a/packages/api/src/mcp/mcpConfig.ts
+++ b/packages/api/src/mcp/mcpConfig.ts
@@ -1,13 +1,69 @@
 import { math, isEnabled } from '~/utils';
 
+const oauthHandlingTimeout = math(process.env.MCP_OAUTH_HANDLING_TIMEOUT ?? 10 * 60 * 1000);
+/** Grace so flow state outlives the handling wait rather than expiring at the same instant —
+ * covers callback processing, the monitor poll interval, and multi-replica clock skew. */
+const OAUTH_FLOW_TTL_GRACE_MS = 60 * 1000;
+/** Flow state must outlive the handling wait, otherwise a callback arriving near the
+ * deadline cannot find its flow. Clamp the configured TTL above the handling timeout. */
+const oauthFlowTtl = Math.max(
+  math(process.env.MCP_OAUTH_FLOW_TTL ?? 15 * 60 * 1000),
+  oauthHandlingTimeout + OAUTH_FLOW_TTL_GRACE_MS,
+);
+
 /**
  * Centralized configuration for MCP-related environment variables.
  * Provides typed access to MCP settings with default values.
  */
-export const mcpConfig = {
+export const mcpConfig: {
+  OAUTH_ON_AUTH_ERROR: boolean;
+  OAUTH_DETECTION_TIMEOUT: number;
+  /** How long (ms) to wait for the user to complete an OAuth flow before timing out. Default: 10 minutes */
+  OAUTH_HANDLING_TIMEOUT: number;
+  /** TTL (ms) for OAuth flow state. Must outlive OAUTH_HANDLING_TIMEOUT so the state survives the wait. Default: 15 minutes */
+  OAUTH_FLOW_TTL: number;
+  CONNECTION_CHECK_TTL: number;
+  /** Max number of `tools/list` pages to request when an MCP server paginates its tool list.
+   * Bounds the pagination loop so a misbehaving server cannot stall tool discovery. Default: 50 */
+  TOOLS_LIST_MAX_PAGES: number;
+  /** Max total tools to retain from paginated `tools/list` responses. Default: 1000 */
+  TOOLS_LIST_MAX_TOOLS: number;
+  /** Max approximate JSON bytes to retain from paginated `tools/list` responses. Default: 5 MiB */
+  TOOLS_LIST_MAX_BYTES: number;
+  /** Max elapsed time (ms) for paginated `tools/list` discovery. Default: 30000 */
+  TOOLS_LIST_TIMEOUT_MS: number;
+  /** Idle timeout (ms) after which user connections are disconnected. Default: 15 minutes */
+  USER_CONNECTION_IDLE_TIMEOUT: number;
+  /** Max connect/disconnect cycles before the circuit breaker trips. Default: 7 */
+  CB_MAX_CYCLES: number;
+  /** Sliding window (ms) for counting cycles. Default: 45s */
+  CB_CYCLE_WINDOW_MS: number;
+  /** Cooldown (ms) after the cycle breaker trips. Default: 15s */
+  CB_CYCLE_COOLDOWN_MS: number;
+  /** Max consecutive failed connection rounds before backoff. Default: 3 */
+  CB_MAX_FAILED_ROUNDS: number;
+  /** Sliding window (ms) for counting failed rounds. Default: 120s */
+  CB_FAILED_WINDOW_MS: number;
+  /** Base backoff (ms) after failed round threshold is reached. Default: 30s */
+  CB_BASE_BACKOFF_MS: number;
+  /** Max backoff cap (ms) for exponential backoff. Default: 300s */
+  CB_MAX_BACKOFF_MS: number;
+} = {
   OAUTH_ON_AUTH_ERROR: isEnabled(process.env.MCP_OAUTH_ON_AUTH_ERROR ?? true),
   OAUTH_DETECTION_TIMEOUT: math(process.env.MCP_OAUTH_DETECTION_TIMEOUT ?? 5000),
+  /** How long (ms) to wait for the user to complete an OAuth flow before timing out. Default: 10 minutes */
+  OAUTH_HANDLING_TIMEOUT: oauthHandlingTimeout,
+  /** TTL (ms) for OAuth flow state. Clamped to never fall below OAUTH_HANDLING_TIMEOUT. Default: 15 minutes */
+  OAUTH_FLOW_TTL: oauthFlowTtl,
   CONNECTION_CHECK_TTL: math(process.env.MCP_CONNECTION_CHECK_TTL ?? 60000),
+  /** Max number of `tools/list` pages to request when an MCP server paginates its tool list. Clamped to >= 1. Default: 50 */
+  TOOLS_LIST_MAX_PAGES: Math.max(1, math(process.env.MCP_TOOLS_LIST_MAX_PAGES ?? 50)),
+  /** Max total tools to retain from paginated `tools/list` responses. Clamped to >= 1. Default: 1000 */
+  TOOLS_LIST_MAX_TOOLS: Math.max(1, math(process.env.MCP_TOOLS_LIST_MAX_TOOLS ?? 1000)),
+  /** Max approximate JSON bytes to retain from paginated `tools/list` responses. Clamped to >= 1. Default: 5 MiB */
+  TOOLS_LIST_MAX_BYTES: Math.max(1, math(process.env.MCP_TOOLS_LIST_MAX_BYTES ?? 5 * 1024 * 1024)),
+  /** Max elapsed time (ms) for paginated `tools/list` discovery. Clamped to >= 1. Default: 30000 */
+  TOOLS_LIST_TIMEOUT_MS: Math.max(1, math(process.env.MCP_TOOLS_LIST_TIMEOUT_MS ?? 30_000)),
   /** Idle timeout (ms) after which user connections are disconnected. Default: 15 minutes */
   USER_CONNECTION_IDLE_TIMEOUT: math(
     process.env.MCP_USER_CONNECTION_IDLE_TIMEOUT ?? 15 * 60 * 1000,
diff --git a/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts b/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
index 23a32787974..c4c0544b968 100644
--- a/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
+++ b/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
@@ -1,8 +1,9 @@
 import { logger, TokenMethods } from '@librechat/data-schemas';
-import { FlowStateManager, MCPConnection, MCPOAuthTokens, MCPOptions } from '../..';
-import { MCPManager } from '../MCPManager';
+import type { IToken } from '@librechat/data-schemas';
 import { OAuthReconnectionManager } from './OAuthReconnectionManager';
 import { OAuthReconnectionTracker } from './OAuthReconnectionTracker';
+import { FlowStateManager, MCPConnection, MCPOptions } from '../..';
+import { MCPManager } from '../MCPManager';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -183,7 +184,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() + 3600000), // 1 hour from now
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -234,7 +235,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // Mock failed connection
       mockMCPManager.getUserConnection.mockRejectedValue(new Error('Connection failed'));
@@ -264,7 +265,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() - 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -287,13 +288,13 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() - 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         if (identifier === 'mcp:server1:refresh') {
           return {
             userId,
             identifier,
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -330,7 +331,7 @@ describe('OAuthReconnectionManager', () => {
           return {
             userId,
             identifier,
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -366,7 +367,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // Mock connection that returns but is not connected
       const mockConnection = {
@@ -512,7 +513,7 @@ describe('OAuthReconnectionManager', () => {
           userId,
           identifier,
           expiresAt: new Date(Date.now() + 3600000),
-        } as unknown as MCPOAuthTokens;
+        } as unknown as IToken;
       });
 
       const mockNewConnection = {
@@ -576,7 +577,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       const boom = new Error('boom');
       (mockRegistryInstance.getServerConfig as jest.Mock).mockRejectedValue(boom);
@@ -650,7 +651,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() + 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -699,7 +700,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: `mcp:${serverName}`,
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // First reconnect attempt - will fail
       mockMCPManager.getUserConnection.mockRejectedValueOnce(new Error('Connection failed'));
diff --git a/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts b/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
index e0e30d7e14b..1adb9b4be0c 100644
--- a/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
+++ b/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
@@ -1,10 +1,10 @@
 import { logger } from '@librechat/data-schemas';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { MCPOAuthTokens } from './types';
+import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { OAuthReconnectionTracker } from './OAuthReconnectionTracker';
 import { FlowStateManager } from '~/flow/manager';
 import { MCPManager } from '~/mcp/MCPManager';
-import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 
 const DEFAULT_CONNECTION_TIMEOUT_MS = 10_000; // ms
 const RECONNECT_STAGGER_MS = 500; // ms between each server reconnection
@@ -62,7 +62,7 @@ export class OAuthReconnectionManager {
     return this.reconnectionsTracker.isStillReconnecting(userId, serverName);
   }
 
-  public async reconnectServers(userId: string) {
+  public async reconnectServers(userId: string): Promise<void> {
     // Check if MCPManager is available
     if (this.mcpManager == null) {
       logger.warn(
@@ -138,7 +138,7 @@ export class OAuthReconnectionManager {
     }
   }
 
-  public clearReconnection(userId: string, serverName: string) {
+  public clearReconnection(userId: string, serverName: string): void {
     this.reconnectionsTracker.removeFailed(userId, serverName);
     this.reconnectionsTracker.removeActive(userId, serverName);
   }
@@ -183,7 +183,11 @@ export class OAuthReconnectionManager {
     }
   }
 
-  public getTrackerStats() {
+  public getTrackerStats(): {
+    usersWithFailedServers: number;
+    usersWithActiveReconnections: number;
+    activeTimestamps: number;
+  } {
     return this.reconnectionsTracker.getStats();
   }
 
diff --git a/packages/api/src/mcp/oauth/detectOAuth.fallback.test.ts b/packages/api/src/mcp/oauth/detectOAuth.fallback.test.ts
index 324fca8df60..4a9e20699da 100644
--- a/packages/api/src/mcp/oauth/detectOAuth.fallback.test.ts
+++ b/packages/api/src/mcp/oauth/detectOAuth.fallback.test.ts
@@ -6,6 +6,8 @@ jest.mock('@modelcontextprotocol/sdk/client/auth.js', () => ({
 }));
 
 jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => ({ lookup: jest.fn() })),
+  isOAuthUrlAllowed: jest.fn(() => false),
   isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
diff --git a/packages/api/src/mcp/oauth/detectOAuth.test.ts b/packages/api/src/mcp/oauth/detectOAuth.test.ts
index cfcbf9a6921..c65d9416b07 100644
--- a/packages/api/src/mcp/oauth/detectOAuth.test.ts
+++ b/packages/api/src/mcp/oauth/detectOAuth.test.ts
@@ -8,6 +8,8 @@ jest.mock('@modelcontextprotocol/sdk/client/auth.js', () => ({
 }));
 
 jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => ({ lookup: jest.fn() })),
+  isOAuthUrlAllowed: jest.fn(() => false),
   isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
@@ -233,6 +235,7 @@ describe('detectOAuthRequirement', () => {
       expect(mockDiscoverOAuthProtectedResourceMetadata).toHaveBeenCalledWith(
         'https://mcp.example.com',
         expect.objectContaining({ resourceMetadataUrl: new URL(metadataUrl) }),
+        expect.any(Function),
       );
     });
 
@@ -284,6 +287,7 @@ describe('detectOAuthRequirement', () => {
       expect(mockDiscoverOAuthProtectedResourceMetadata).toHaveBeenCalledWith(
         'https://mcp.example.com/mcp',
         expect.objectContaining({ resourceMetadataUrl: new URL(metadataUrl) }),
+        expect.any(Function),
       );
     });
   });
@@ -315,6 +319,7 @@ describe('detectOAuthRequirement', () => {
       expect(mockDiscoverOAuthProtectedResourceMetadata).toHaveBeenCalledWith(
         'https://mcp.example.com',
         expect.objectContaining({ resourceMetadataUrl: undefined }),
+        expect.any(Function),
       );
       expect(result.requiresOAuth).toBe(true);
       expect(result.method).toBe('protected-resource-metadata');
@@ -343,6 +348,7 @@ describe('detectOAuthRequirement', () => {
       expect(mockDiscoverOAuthProtectedResourceMetadata).toHaveBeenCalledWith(
         'https://mcp.example.com',
         expect.objectContaining({ resourceMetadataUrl: undefined }),
+        expect.any(Function),
       );
       expect(result.requiresOAuth).toBe(true);
       expect(result.method).toBe('401-challenge-metadata');
@@ -371,6 +377,7 @@ describe('detectOAuthRequirement', () => {
       expect(mockDiscoverOAuthProtectedResourceMetadata).toHaveBeenCalledWith(
         'https://mcp.example.com',
         expect.objectContaining({ resourceMetadataUrl: undefined }),
+        expect.any(Function),
       );
     });
   });
diff --git a/packages/api/src/mcp/oauth/detectOAuth.ts b/packages/api/src/mcp/oauth/detectOAuth.ts
index 33391b181dd..52bfe828624 100644
--- a/packages/api/src/mcp/oauth/detectOAuth.ts
+++ b/packages/api/src/mcp/oauth/detectOAuth.ts
@@ -6,8 +6,11 @@
 // Manual testing ensures the OAuth detection still works against real MCP servers.
 
 import { discoverOAuthProtectedResourceMetadata } from '@modelcontextprotocol/sdk/client/auth.js';
-import { isSSRFTarget, resolveHostnameSSRF } from '~/auth';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
+import { isSSRFTarget, resolveHostnameSSRF, isOAuthUrlAllowed } from '~/auth';
 import { probeResourceMetadataHint } from './resourceHint';
+import { createHardenedOAuthFetch } from './hardenedFetch';
+import { getOAuthUrlPort } from './url';
 import { mcpConfig } from '../mcpConfig';
 
 export interface OAuthDetectionResult {
@@ -32,8 +35,13 @@ export interface OAuthDetectionResult {
  *
  * @param serverUrl - The MCP server URL to check for OAuth requirements
  */
-export async function detectOAuthRequirement(serverUrl: string): Promise<OAuthDetectionResult> {
-  const hint = await probeResourceMetadataHint(serverUrl);
+export async function detectOAuthRequirement(
+  serverUrl: string,
+  allowedDomains?: string[] | null,
+  allowedAddresses?: string[] | null,
+): Promise<OAuthDetectionResult> {
+  const fetchFn = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+  const hint = await probeResourceMetadataHint(serverUrl, fetchFn);
 
   /**
    * The `resource_metadata` URL is attacker-controlled (it's echoed from the MCP
@@ -42,10 +50,10 @@ export async function detectOAuthRequirement(serverUrl: string): Promise<OAuthDe
    * detection as an SSRF vector against the LibreChat host or its internal network.
    */
   const safeHintUrl = hint?.resourceMetadataUrl
-    ? await validateHintUrl(hint.resourceMetadataUrl)
+    ? await validateHintUrl(hint.resourceMetadataUrl, allowedDomains, allowedAddresses)
     : undefined;
 
-  const metadataResult = await checkProtectedResourceMetadata(serverUrl, safeHintUrl);
+  const metadataResult = await checkProtectedResourceMetadata(serverUrl, safeHintUrl, fetchFn);
   if (metadataResult) return metadataResult;
 
   if (hint?.bearerChallenge) {
@@ -73,7 +81,7 @@ export async function detectOAuthRequirement(serverUrl: string): Promise<OAuthDe
       };
     }
     if (hint === null) {
-      const fallbackResult = await checkAuthErrorFallback(serverUrl);
+      const fallbackResult = await checkAuthErrorFallback(serverUrl, fetchFn);
       if (fallbackResult) return fallbackResult;
     }
   }
@@ -98,11 +106,16 @@ export async function detectOAuthRequirement(serverUrl: string): Promise<OAuthDe
 async function checkProtectedResourceMetadata(
   serverUrl: string,
   resourceMetadataUrl?: URL,
+  fetchFn?: FetchLike,
 ): Promise<OAuthDetectionResult | null> {
   try {
-    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {
-      resourceMetadataUrl,
-    });
+    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+      serverUrl,
+      {
+        resourceMetadataUrl,
+      },
+      fetchFn,
+    );
 
     if (!resourceMetadata?.authorization_servers?.length) return null;
 
@@ -118,15 +131,25 @@ async function checkProtectedResourceMetadata(
 
 /**
  * SSRF-guards an attacker-controlled `resource_metadata` hint before the SDK follows it.
- * `detectOAuthRequirement` runs without admin-scoped `allowedDomains`, so the rejection
- * policy here is stricter than the handler's: any private/loopback/metadata-service
- * target is dropped, regardless of origin relative to the MCP server. On rejection the
- * caller continues with path-aware discovery (safe, since it targets the server itself).
+ * Honors the same allowedDomains/allowedAddresses policy used by the OAuth handler:
+ * trusted admin allowlist matches bypass the private-address block; otherwise hints
+ * are rejected when they target restricted hostnames or resolve to private addresses.
+ * On rejection the caller continues with path-aware discovery.
  */
-async function validateHintUrl(hintUrl: URL): Promise<URL | undefined> {
+async function validateHintUrl(
+  hintUrl: URL,
+  allowedDomains?: string[] | null,
+  allowedAddresses?: string[] | null,
+): Promise<URL | undefined> {
   try {
-    if (isSSRFTarget(hintUrl.hostname)) return undefined;
-    if (await resolveHostnameSSRF(hintUrl.hostname)) return undefined;
+    if (isOAuthUrlAllowed(hintUrl.href, allowedDomains, allowedAddresses)) return hintUrl;
+
+    const port = getOAuthUrlPort(hintUrl);
+    const allowedDomainsActive = Array.isArray(allowedDomains) && allowedDomains.length > 0;
+    const effectiveAddresses = allowedDomainsActive ? null : allowedAddresses;
+
+    if (isSSRFTarget(hintUrl.hostname, effectiveAddresses, port)) return undefined;
+    if (await resolveHostnameSSRF(hintUrl.hostname, effectiveAddresses, port)) return undefined;
     return hintUrl;
   } catch {
     // If validation itself fails (e.g. DNS lookup threw), be conservative and drop the hint.
@@ -135,9 +158,12 @@ async function validateHintUrl(hintUrl: URL): Promise<URL | undefined> {
 }
 
 // Fallback: only called when probing threw. Caller already gates on `OAUTH_ON_AUTH_ERROR`.
-async function checkAuthErrorFallback(serverUrl: string): Promise<OAuthDetectionResult | null> {
+async function checkAuthErrorFallback(
+  serverUrl: string,
+  fetchFn: FetchLike,
+): Promise<OAuthDetectionResult | null> {
   try {
-    const response = await fetch(serverUrl, {
+    const response = await fetchFn(serverUrl, {
       method: 'HEAD',
       signal: AbortSignal.timeout(mcpConfig.OAUTH_DETECTION_TIMEOUT),
     });
diff --git a/packages/api/src/mcp/oauth/events.ts b/packages/api/src/mcp/oauth/events.ts
new file mode 100644
index 00000000000..4aec0db7ea6
--- /dev/null
+++ b/packages/api/src/mcp/oauth/events.ts
@@ -0,0 +1,161 @@
+import { Constants, Time } from 'librechat-data-provider';
+import { GraphEvents, StepTypes } from '@librechat/agents';
+import type * as t from '~/types';
+import { buildOAuthToolCallName } from '~/mcp/utils';
+
+export type OAuthPromptOptions = {
+  expiresAt?: number;
+};
+
+export type OAuthToolCall = {
+  id?: string;
+  name: string;
+  type: 'tool_call' | 'tool_call_chunk';
+  args?: string;
+  output?: string;
+};
+
+export function getOAuthPromptExpiresAt(
+  options?: OAuthPromptOptions,
+  now: number = Date.now(),
+): number {
+  return typeof options?.expiresAt === 'number' && Number.isFinite(options.expiresAt)
+    ? options.expiresAt
+    : now + Time.TWO_MINUTES;
+}
+
+export function getMCPServerNamesFromTools(tools?: unknown[] | null): Set<string> {
+  const serverNames = new Set<string>();
+
+  for (const tool of tools ?? []) {
+    if (typeof tool !== 'string') {
+      continue;
+    }
+
+    const delimiterIndex = tool.indexOf(Constants.mcp_delimiter);
+    if (delimiterIndex === -1) {
+      continue;
+    }
+
+    serverNames.add(tool.slice(delimiterIndex + Constants.mcp_delimiter.length));
+  }
+
+  return serverNames;
+}
+
+export function buildMCPAuthStepId(serverName: string): string {
+  return `step_oauth_login_${serverName}`;
+}
+
+export function buildMCPAuthToolCall({
+  id,
+  args,
+  output,
+  serverName,
+  type = 'tool_call_chunk',
+}: {
+  id?: string;
+  args?: string;
+  output?: string;
+  serverName: string;
+  type?: OAuthToolCall['type'];
+}): OAuthToolCall {
+  return {
+    ...(id != null ? { id } : {}),
+    name: buildOAuthToolCallName(serverName),
+    ...(args != null ? { args } : {}),
+    ...(output != null ? { output } : {}),
+    type,
+  };
+}
+
+export function buildMCPAuthRunStepEvent({
+  runId = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+  stepId,
+  toolCall,
+  index = 0,
+}: {
+  runId?: string | null;
+  stepId: string;
+  toolCall: OAuthToolCall;
+  index?: number;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP,
+    data: {
+      runId,
+      id: stepId,
+      type: StepTypes.TOOL_CALLS,
+      index,
+      stepDetails: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [toolCall],
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepDeltaEvent({
+  authURL,
+  stepId,
+  toolCall,
+  options,
+}: {
+  authURL: string;
+  stepId: string;
+  toolCall: OAuthToolCall;
+  options?: OAuthPromptOptions;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_DELTA,
+    data: {
+      id: stepId,
+      delta: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [{ ...toolCall, args: '' }],
+        auth: authURL,
+        expires_at: getOAuthPromptExpiresAt(options),
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepEndDeltaEvent({
+  stepId,
+  toolCall,
+}: {
+  stepId: string;
+  toolCall: OAuthToolCall;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_DELTA,
+    data: {
+      id: stepId,
+      delta: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [{ ...toolCall }],
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepCompletedEvent({
+  stepId,
+  toolCall,
+  index = 0,
+}: {
+  stepId: string;
+  toolCall: OAuthToolCall;
+  index?: number;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_COMPLETED,
+    data: {
+      result: {
+        id: stepId,
+        index,
+        tool_call: toolCall,
+      },
+    },
+  };
+}
diff --git a/packages/api/src/mcp/oauth/handler.ts b/packages/api/src/mcp/oauth/handler.ts
index 519a9a20bf9..30d497b6d38 100644
--- a/packages/api/src/mcp/oauth/handler.ts
+++ b/packages/api/src/mcp/oauth/handler.ts
@@ -1,7 +1,7 @@
 import { randomBytes } from 'crypto';
 import { logger } from '@librechat/data-schemas';
-import { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
 import { OAuthMetadataSchema } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { TokenExchangeMethodEnum, type MCPOptions } from 'librechat-data-provider';
 import {
   checkResourceAllowed,
   resourceUrlFromServerUrl,
@@ -13,16 +13,17 @@ import {
   discoverAuthorizationServerMetadata,
   discoverOAuthProtectedResourceMetadata,
 } from '@modelcontextprotocol/sdk/client/auth.js';
-import { TokenExchangeMethodEnum, type MCPOptions } from 'librechat-data-provider';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
 import type { TokenMethods } from '@librechat/data-schemas';
-import type { FlowStateManager } from '~/flow/manager';
 import type {
   OAuthClientInformation,
   OAuthProtectedResourceMetadata,
+  OAuthStoredClientMetadata,
   MCPOAuthFlowMetadata,
   MCPOAuthTokens,
   OAuthMetadata,
 } from './types';
+import type { FlowStateManager } from '~/flow/manager';
 import {
   resolveTokenEndpointAuthMethod,
   getForcedTokenEndpointAuthMethod,
@@ -31,22 +32,16 @@ import {
 } from './methods';
 import { isSSRFTarget, resolveHostnameSSRF, isOAuthUrlAllowed } from '~/auth';
 import { probeResourceMetadataHint } from './resourceHint';
-import { MCPTokenStorage } from './tokens';
+import { createHardenedOAuthFetch } from './hardenedFetch';
 import { sanitizeUrlForLogging } from '~/mcp/utils';
+import { MCPTokenStorage } from './tokens';
+import { getOAuthUrlPort } from './url';
 
 /** Type for the OAuth metadata from the SDK */
 type SDKOAuthMetadata = Parameters<typeof registerClient>[1]['metadata'];
 
-function getOAuthUrlPort(url: URL): string {
-  if (url.port) return url.port;
-  if (url.protocol === 'http:') return '80';
-  if (url.protocol === 'https:') return '443';
-  return '';
-}
-
 export class MCPOAuthHandler {
   private static readonly FLOW_TYPE = 'mcp_oauth';
-  private static readonly FLOW_TTL = 10 * 60 * 1000; // 10 minutes
 
   /**
    * Creates a fetch function with custom headers injected
@@ -54,7 +49,12 @@ export class MCPOAuthHandler {
   private static createOAuthFetch(
     headers: Record<string, string>,
     clientInfo?: OAuthClientInformation,
+    allowedDomains?: string[] | null,
+    allowedAddresses?: string[] | null,
+    signal?: AbortSignal,
   ): FetchLike {
+    const hardenedFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+
     return async (url: string | URL, init?: RequestInit): Promise<Response> => {
       const newHeaders = new Headers(init?.headers ?? {});
       for (const [key, value] of Object.entries(headers)) {
@@ -118,15 +118,17 @@ export class MCPOAuthHandler {
           }
         }
 
-        return fetch(url, {
+        return hardenedFetch(url, {
           ...init,
           body: params.toString(),
           headers: newHeaders,
+          signal: init?.signal ?? signal,
         });
       }
-      return fetch(url, {
+      return hardenedFetch(url, {
         ...init,
         headers: newHeaders,
+        signal: init?.signal ?? signal,
       });
     };
   }
@@ -151,7 +153,12 @@ export class MCPOAuthHandler {
     let authServerUrl = new URL(serverUrl);
     let resourceMetadata: OAuthProtectedResourceMetadata | undefined;
 
-    const fetchFn = this.createOAuthFetch(oauthHeaders);
+    const fetchFn = this.createOAuthFetch(
+      oauthHeaders,
+      undefined,
+      allowedDomains,
+      allowedAddresses,
+    );
 
     /**
      * RFC 9728 §5.1: when the server's 401 `WWW-Authenticate` header advertises a
@@ -346,6 +353,48 @@ export class MCPOAuthHandler {
     return metadata;
   }
 
+  private static hasUnpinnedClientSecret(config?: MCPOptions['oauth']): boolean {
+    return !!(
+      config?.client_id &&
+      config.client_secret &&
+      (!config.authorization_url || !config.token_url)
+    );
+  }
+
+  public static buildStoredClientMetadata(
+    metadata?: OAuthMetadata,
+    resourceMetadata?: OAuthProtectedResourceMetadata,
+  ): OAuthStoredClientMetadata | undefined {
+    if (!metadata) {
+      return undefined;
+    }
+    const storedMetadata: OAuthStoredClientMetadata = { ...metadata };
+    if (resourceMetadata?.resource) {
+      storedMetadata.resource = new URL(resourceMetadata.resource).href;
+    }
+    return storedMetadata;
+  }
+
+  private static appendResourceParameter(body: URLSearchParams, resource?: string): void {
+    if (!resource) {
+      return;
+    }
+    body.set('resource', resource);
+  }
+
+  private static assertNoUnpinnedClientSecret(config?: MCPOptions['oauth']): void {
+    if (config?.client_secret && !config.client_id) {
+      throw new Error('[MCPOAuth] OAuth client_secret requires oauth.client_id.');
+    }
+
+    if (!this.hasUnpinnedClientSecret(config)) {
+      return;
+    }
+    throw new Error(
+      '[MCPOAuth] OAuth client_secret requires both oauth.authorization_url and oauth.token_url; refusing to use it with auto-discovered OAuth endpoints.',
+    );
+  }
+
   /**
    * Registers an OAuth client dynamically
    */
@@ -356,6 +405,8 @@ export class MCPOAuthHandler {
     resourceMetadata?: OAuthProtectedResourceMetadata,
     redirectUri?: string,
     tokenExchangeMethod?: TokenExchangeMethodEnum,
+    allowedDomains?: string[] | null,
+    allowedAddresses?: string[] | null,
   ): Promise<OAuthClientInformation> {
     logger.debug(
       `[MCPOAuth] Starting client registration for ${sanitizeUrlForLogging(serverUrl)}, server metadata:`,
@@ -417,7 +468,7 @@ export class MCPOAuthHandler {
     const clientInfo = await registerClient(serverUrl, {
       metadata: metadata as unknown as SDKOAuthMetadata,
       clientMetadata,
-      fetchFn: this.createOAuthFetch(oauthHeaders),
+      fetchFn: this.createOAuthFetch(oauthHeaders, undefined, allowedDomains, allowedAddresses),
     });
 
     const forcedAuthMethod = getForcedTokenEndpointAuthMethod(tokenExchangeMethod);
@@ -452,17 +503,20 @@ export class MCPOAuthHandler {
     allowedDomains?: string[] | null,
     findToken?: TokenMethods['findToken'],
     allowedAddresses?: string[] | null,
+    tenantId?: string,
   ): Promise<{ authorizationUrl: string; flowId: string; flowMetadata: MCPOAuthFlowMetadata }> {
     logger.debug(
       `[MCPOAuth] initiateOAuthFlow called for ${serverName} with URL: ${sanitizeUrlForLogging(serverUrl)}`,
     );
 
-    const flowId = this.generateFlowId(userId, serverName);
+    const flowId = this.generateFlowId(userId, serverName, tenantId);
     const state = this.generateState();
 
     logger.debug(`[MCPOAuth] Generated flowId: ${flowId}, state: ${state}`);
 
     try {
+      this.assertNoUnpinnedClientSecret(config);
+
       if (config?.authorization_url && config?.token_url && config?.client_id) {
         logger.debug(`[MCPOAuth] Using pre-configured OAuth settings for ${serverName}`);
 
@@ -548,6 +602,16 @@ export class MCPOAuthHandler {
         authorizationUrl.searchParams.set('state', state);
         logger.debug(`[MCPOAuth] Added state parameter to authorization URL`);
 
+        /**
+         * Auth0/Cognito-style `audience` parameter. Forwarded as-is; the provider
+         * decides whether it accepts RFC 8707 `resource`, the legacy `audience`,
+         * or both. See `OAuthOptionsSchema.audience`.
+         */
+        if (config?.audience) {
+          authorizationUrl.searchParams.set('audience', config.audience);
+          logger.debug(`[MCPOAuth] Added audience parameter (pre-configured): ${config.audience}`);
+        }
+
         const flowMetadata: MCPOAuthFlowMetadata = {
           serverName,
           userId,
@@ -556,7 +620,10 @@ export class MCPOAuthHandler {
           codeVerifier,
           clientInfo,
           metadata,
+          ...(allowedDomains !== undefined && { allowedDomains }),
+          ...(allowedAddresses !== undefined && { allowedAddresses }),
           ...(Object.keys(oauthHeaders).length > 0 && { oauthHeaders }),
+          ...(tenantId && { tenantId }),
         };
 
         logger.debug(
@@ -589,7 +656,16 @@ export class MCPOAuthHandler {
       let clientInfo: OAuthClientInformation | undefined;
       let reusedStoredClient = false;
 
-      if (findToken) {
+      if (config?.client_id) {
+        logger.debug(`[MCPOAuth] Using predefined public client_id for ${serverName}`);
+        clientInfo = {
+          client_id: config.client_id,
+          redirect_uris: [redirectUri],
+          scope: config.scope,
+          token_endpoint_auth_method: 'none',
+        };
+        logger.debug(`[MCPOAuth] Using predefined client with ID: ${clientInfo.client_id}`);
+      } else if (findToken) {
         try {
           const existing = await MCPTokenStorage.getClientInfoAndMetadata({
             userId,
@@ -630,6 +706,7 @@ export class MCPOAuthHandler {
       }
 
       if (!clientInfo) {
+        logger.debug(`[MCPOAuth] Registering OAuth client with redirect URI: ${redirectUri}`);
         clientInfo = await this.registerOAuthClient(
           authServerUrl.toString(),
           metadata,
@@ -637,6 +714,8 @@ export class MCPOAuthHandler {
           resourceMetadata,
           redirectUri,
           config?.token_exchange_method,
+          allowedDomains,
+          allowedAddresses,
         );
         logger.debug(`[MCPOAuth] Client registered with ID: ${clientInfo.client_id}`);
       }
@@ -685,6 +764,7 @@ export class MCPOAuthHandler {
             `[MCPOAuth] Added resource parameter to authorization URL: ${canonicalResource}`,
           );
         } else {
+          // resource omitted on purpose — see comment below in the `else` branch.
           /**
            * Reachable only when `discoverOAuthProtectedResourceMetadata` did not return a
            * document (404 / network error / server does not implement RFC 9728). If a PRM
@@ -697,6 +777,16 @@ export class MCPOAuthHandler {
               'This can cause issues with some Authorization Servers that expect a "resource" parameter.',
           );
         }
+
+        /**
+         * Auth0/Cognito-style `audience` parameter. Independent of `resource` (RFC 8707):
+         * some authorization servers ignore `resource` and only mint API-scoped tokens
+         * when `audience` is supplied. See `OAuthOptionsSchema.audience`.
+         */
+        if (config?.audience) {
+          authorizationUrl.searchParams.set('audience', config.audience);
+          logger.debug(`[MCPOAuth] Added audience parameter (discovered flow): ${config.audience}`);
+        }
       } catch (error) {
         logger.error(`[MCPOAuth] startAuthorization failed:`, error);
         throw error;
@@ -711,8 +801,11 @@ export class MCPOAuthHandler {
         clientInfo,
         metadata,
         resourceMetadata,
+        ...(allowedDomains !== undefined && { allowedDomains }),
+        ...(allowedAddresses !== undefined && { allowedAddresses }),
         ...(Object.keys(oauthHeaders).length > 0 && { oauthHeaders }),
         ...(reusedStoredClient && { reusedStoredClient }),
+        ...(tenantId && { tenantId }),
       };
 
       logger.debug(
@@ -739,9 +832,9 @@ export class MCPOAuthHandler {
   /**
    * Completes the OAuth flow by exchanging the authorization code for tokens.
    *
-   * `allowedDomains` is intentionally absent: all URLs used here (serverUrl,
-   * token_endpoint) originate from {@link MCPOAuthFlowMetadata} that was
-   * SSRF-validated during {@link initiateOAuthFlow}. No new URL resolution occurs.
+   * The token exchange reuses the SSRF policy captured during
+   * {@link initiateOAuthFlow} and enforces it again at connect time. This closes
+   * DNS rebinding gaps between the preflight validation and the callback request.
    */
   static async completeOAuthFlow(
     flowId: string,
@@ -770,7 +863,7 @@ export class MCPOAuthHandler {
       if (metadata.resourceMetadata) {
         /**
          * Defense-in-depth: re-assert the RFC 9728 §3.3 binding against the flow's stored
-         * server URL. Flow state has a 10-minute TTL, so a flow initiated under older
+         * server URL. Flow state has a bounded TTL, so a flow initiated under older
          * (pre-fix) code could still be in-flight at upgrade time carrying unvalidated
          * resource metadata. Re-validating here closes that window without requiring ops
          * teams to flush flow state on deploy (GHSA-gvpj-vm2f-2m23).
@@ -789,7 +882,12 @@ export class MCPOAuthHandler {
         codeVerifier: metadata.codeVerifier,
         authorizationCode,
         resource,
-        fetchFn: this.createOAuthFetch(oauthHeaders, metadata.clientInfo),
+        fetchFn: this.createOAuthFetch(
+          oauthHeaders,
+          metadata.clientInfo,
+          metadata.allowedDomains,
+          metadata.allowedAddresses,
+        ),
       });
 
       logger.debug('[MCPOAuth] Token exchange successful', {
@@ -836,8 +934,55 @@ export class MCPOAuthHandler {
    * Generates a flow ID for the OAuth flow
    * @returns Consistent ID so concurrent requests share the same flow
    */
-  public static generateFlowId(userId: string, serverName: string): string {
-    return `${userId}:${serverName}`;
+  public static generateFlowId(userId: string, serverName: string, tenantId?: string): string {
+    const flowId = `${userId}:${serverName}`;
+    if (!tenantId) {
+      return flowId;
+    }
+    return `tenant:${encodeURIComponent(tenantId)}:${flowId}`;
+  }
+
+  public static parseFlowId(
+    flowId: string,
+  ): { userId: string; serverName: string; tenantId?: string } | null {
+    const parts = flowId.split(':');
+    if (parts[0] === 'tenant') {
+      if (parts.length < 4 || !parts[1] || !parts[2]) {
+        return null;
+      }
+      let tenantId: string;
+      try {
+        tenantId = decodeURIComponent(parts[1]);
+      } catch {
+        return null;
+      }
+      const serverName = parts.slice(3).join(':');
+      if (!serverName) {
+        return null;
+      }
+      return {
+        tenantId,
+        userId: parts[2],
+        serverName,
+      };
+    }
+
+    if (parts.length < 2 || !parts[0]) {
+      return null;
+    }
+    const serverName = parts.slice(1).join(':');
+    if (!serverName) {
+      return null;
+    }
+    return {
+      userId: parts[0],
+      serverName,
+    };
+  }
+
+  /** Same shape as `generateFlowId`; kept distinct so token-fetch flows can diverge from OAuth flows */
+  public static generateTokenFlowId(userId: string, serverName: string, tenantId?: string): string {
+    return this.generateFlowId(userId, serverName, tenantId);
   }
 
   /**
@@ -1016,6 +1161,68 @@ export class MCPOAuthHandler {
     } as MCPOAuthTokens;
   }
 
+  /**
+   * Posts a `refresh_token` grant, transparently retrying without the `scope`
+   * parameter when — and only when — the authorization server rejects the request
+   * because of that parameter.
+   *
+   * RFC 6749 §6 makes `scope` optional on refresh (the server reuses the originally
+   * granted scope when it is omitted). LibreChat sends it by default because some
+   * servers expect it, but others — notably Salesforce — reject any `scope` on the
+   * refresh grant with HTTP 400 "scope parameter not supported". A failed refresh
+   * forces a full re-authentication, which on multi-replica deployments amplifies the
+   * PKCE retry storm, so we recover automatically instead of surfacing the failure.
+   */
+  private static async postRefreshRequest(
+    oauthFetch: ReturnType<typeof createHardenedOAuthFetch>,
+    tokenUrl: string | URL,
+    headers: HeadersInit,
+    body: URLSearchParams,
+    serverName: string,
+    signal?: AbortSignal,
+  ): Promise<Response> {
+    const response = await oauthFetch(tokenUrl, { method: 'POST', headers, body, signal });
+    if (response.ok || !body.has('scope')) {
+      return response;
+    }
+
+    /** Body is consumed here, so this branch must either retry or throw — never fall through. */
+    const errorText = await response.text();
+    if (!this.isScopeParameterRejection(response.status, errorText)) {
+      throw new Error(
+        `Token refresh failed: ${response.status} ${response.statusText} - ${errorText}`,
+      );
+    }
+
+    logger.warn(
+      `[MCPOAuth] ${serverName} rejected the scope parameter on token refresh (HTTP ${response.status}); retrying without scope per RFC 6749 §6`,
+    );
+    body.delete('scope');
+    return oauthFetch(tokenUrl, { method: 'POST', headers, body, signal });
+  }
+
+  /**
+   * Narrowly detects "this server does not accept a `scope` parameter on the refresh
+   * grant" so the retry-without-scope fallback can never mask unrelated refresh
+   * failures (e.g. `invalid_grant` for an expired/revoked refresh token). Matches the
+   * RFC 6749 `invalid_scope` error and Salesforce's "scope parameter not supported".
+   */
+  private static isScopeParameterRejection(status: number, body: string): boolean {
+    if (status < 400 || status >= 500) {
+      return false;
+    }
+    const lower = body.toLowerCase();
+    if (!lower.includes('scope')) {
+      return false;
+    }
+    return (
+      lower.includes('invalid_scope') ||
+      lower.includes('not supported') ||
+      lower.includes('unsupported') ||
+      lower.includes('not allowed')
+    );
+  }
+
   /**
    * Refreshes OAuth tokens using a refresh token
    */
@@ -1027,11 +1234,13 @@ export class MCPOAuthHandler {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
     oauthHeaders: Record<string, string>,
     config?: MCPOptions['oauth'],
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    signal?: AbortSignal,
   ): Promise<MCPOAuthTokens> {
     logger.debug(`[MCPOAuth] Refreshing tokens for ${metadata.serverName}`);
 
@@ -1068,9 +1277,25 @@ export class MCPOAuthHandler {
         } else if (!metadata.serverUrl) {
           throw new Error('No token URL available for refresh');
         } else {
+          if (
+            this.hasUnpinnedClientSecret(config) &&
+            metadata.clientInfo.client_id === config?.client_id &&
+            metadata.clientInfo.client_secret === config.client_secret
+          ) {
+            throw new Error(
+              '[MCPOAuth] Stored OAuth client_secret from unpinned configuration cannot be used with auto-discovered token endpoints. Configure oauth.token_url or re-authenticate without oauth.client_secret.',
+            );
+          }
+
           /** Auto-discover OAuth configuration for refresh */
           const serverUrl = new URL(metadata.serverUrl);
-          const fetchFn = this.createOAuthFetch(oauthHeaders);
+          const fetchFn = this.createOAuthFetch(
+            oauthHeaders,
+            undefined,
+            allowedDomains,
+            allowedAddresses,
+            signal,
+          );
           const oauthMetadata = await this.discoverWithOriginFallback(serverUrl, fetchFn);
 
           if (!oauthMetadata) {
@@ -1104,6 +1329,26 @@ export class MCPOAuthHandler {
         if (metadata.clientInfo.scope) {
           body.append('scope', metadata.clientInfo.scope);
         }
+        this.appendResourceParameter(body, metadata.resource);
+
+        /**
+         * Forward Auth0-style `audience` on refresh by default — Auth0 strips the
+         * API audience from refreshed access tokens unless it is re-supplied on
+         * every refresh, otherwise the next MCP call 401s once the initial token
+         * expires.
+         *
+         * Operators with strict OAuth 2.0 token endpoints (Cognito and similar)
+         * that documents refresh requests as `grant_type` + `client_id` +
+         * `refresh_token` only, and that maintain the original `aud` claim on
+         * refresh, can opt out by setting `forward_audience_on_refresh: false`.
+         * See `OAuthOptionsSchema.forward_audience_on_refresh`.
+         */
+        if (config?.audience && config?.forward_audience_on_refresh !== false) {
+          body.append('audience', config.audience);
+          logger.debug(
+            `[MCPOAuth] Added audience parameter to refresh request: ${config.audience}`,
+          );
+        }
 
         const headers: HeadersInit = {
           Accept: 'application/json',
@@ -1149,11 +1394,15 @@ export class MCPOAuthHandler {
           has_auth_header: !!headers['Authorization'],
         });
 
-        const response = await fetch(tokenUrl, {
-          method: 'POST',
+        const oauthFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+        const response = await this.postRefreshRequest(
+          oauthFetch,
+          tokenUrl,
           headers,
           body,
-        });
+          metadata.serverName,
+          signal,
+        );
 
         if (!response.ok) {
           const errorText = await response.text();
@@ -1185,6 +1434,7 @@ export class MCPOAuthHandler {
         if (config.scope) {
           body.append('scope', config.scope);
         }
+        this.appendResourceParameter(body, metadata.resource);
 
         const headers: HeadersInit = {
           Accept: 'application/json',
@@ -1232,11 +1482,15 @@ export class MCPOAuthHandler {
           body.append('client_id', config.client_id);
         }
 
-        const response = await fetch(tokenUrl, {
-          method: 'POST',
+        const oauthFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+        const response = await this.postRefreshRequest(
+          oauthFetch,
+          tokenUrl,
           headers,
           body,
-        });
+          metadata.serverName,
+          signal,
+        );
 
         if (!response.ok) {
           const errorText = await response.text();
@@ -1256,7 +1510,13 @@ export class MCPOAuthHandler {
 
       /** Auto-discover OAuth configuration for refresh */
       const serverUrl = new URL(metadata.serverUrl);
-      const fetchFn = this.createOAuthFetch(oauthHeaders);
+      const fetchFn = this.createOAuthFetch(
+        oauthHeaders,
+        undefined,
+        allowedDomains,
+        allowedAddresses,
+        signal,
+      );
       const oauthMetadata = await this.discoverWithOriginFallback(serverUrl, fetchFn);
 
       let tokenUrl: URL;
@@ -1279,6 +1539,7 @@ export class MCPOAuthHandler {
         grant_type: 'refresh_token',
         refresh_token: refreshToken,
       });
+      this.appendResourceParameter(body, metadata.resource);
 
       const headers: HeadersInit = {
         Accept: 'application/json',
@@ -1286,10 +1547,12 @@ export class MCPOAuthHandler {
         ...oauthHeaders,
       };
 
-      const response = await fetch(tokenUrl, {
+      const oauthFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+      const response = await oauthFetch(tokenUrl, {
         method: 'POST',
         headers,
         body,
+        signal,
       });
 
       if (!response.ok) {
@@ -1361,7 +1624,8 @@ export class MCPOAuthHandler {
     logger.info(
       `[MCPOAuth] Revoking tokens for ${serverName} via ${sanitizeUrlForLogging(revokeUrl.toString())}`,
     );
-    const response = await fetch(revokeUrl, {
+    const oauthFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
+    const response = await oauthFetch(revokeUrl, {
       method: 'POST',
       body: body.toString(),
       headers,
diff --git a/packages/api/src/mcp/oauth/hardenedFetch.behavior.test.ts b/packages/api/src/mcp/oauth/hardenedFetch.behavior.test.ts
new file mode 100644
index 00000000000..206616fdd00
--- /dev/null
+++ b/packages/api/src/mcp/oauth/hardenedFetch.behavior.test.ts
@@ -0,0 +1,91 @@
+import http from 'node:http';
+import type { AddressInfo, Socket } from 'node:net';
+import { createHardenedOAuthFetch, resetHardenedOAuthFetchDispatchers } from './hardenedFetch';
+
+type TestServer = {
+  port: number;
+  requestCount: () => number;
+  close: () => Promise<void>;
+};
+
+async function createLocalServer(): Promise<TestServer> {
+  let requestCount = 0;
+  const sockets = new Set<Socket>();
+  const server = http.createServer((_req, res) => {
+    requestCount += 1;
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+  });
+
+  server.on('connection', (socket) => {
+    sockets.add(socket);
+    socket.once('close', () => sockets.delete(socket));
+  });
+
+  await new Promise<void>((resolve) => server.listen(0, 'localhost', resolve));
+  const address = server.address() as AddressInfo;
+
+  return {
+    port: address.port,
+    requestCount: () => requestCount,
+    close: () =>
+      new Promise<void>((resolve) => {
+        for (const socket of sockets) {
+          socket.destroy();
+        }
+        sockets.clear();
+        server.close(() => resolve());
+      }),
+  };
+}
+
+describe('createHardenedOAuthFetch request policy', () => {
+  let server: TestServer;
+
+  beforeEach(async () => {
+    server = await createLocalServer();
+  });
+
+  afterEach(async () => {
+    resetHardenedOAuthFetchDispatchers();
+    await server.close();
+  });
+
+  it('blocks local OAuth requests unless the endpoint is explicitly trusted', async () => {
+    const oauthFetch = createHardenedOAuthFetch();
+
+    await expect(
+      oauthFetch(`http://localhost:${server.port}/token`, {
+        signal: AbortSignal.timeout(1000),
+      }),
+    ).rejects.toThrow();
+
+    expect(server.requestCount()).toBe(0);
+  });
+
+  it('allows explicitly trusted local OAuth endpoints', async () => {
+    const oauthFetch = createHardenedOAuthFetch({ allowedDomains: ['localhost'] });
+
+    const response = await oauthFetch(`http://localhost:${server.port}/token`, {
+      signal: AbortSignal.timeout(1000),
+    });
+
+    await expect(response.json()).resolves.toEqual({ ok: true });
+    expect(server.requestCount()).toBe(1);
+  });
+
+  it('does not use address exemptions when domain policy is active but unmatched', async () => {
+    const oauthFetch = createHardenedOAuthFetch({
+      allowedDomains: ['trusted.example.com'],
+      allowedAddresses: [`localhost:${server.port}`],
+    });
+
+    await expect(
+      oauthFetch(`http://localhost:${server.port}/token`, {
+        signal: AbortSignal.timeout(1000),
+      }),
+    ).rejects.toThrow();
+
+    expect(server.requestCount()).toBe(0);
+  });
+});
diff --git a/packages/api/src/mcp/oauth/hardenedFetch.test.ts b/packages/api/src/mcp/oauth/hardenedFetch.test.ts
new file mode 100644
index 00000000000..5e9f5bb082b
--- /dev/null
+++ b/packages/api/src/mcp/oauth/hardenedFetch.test.ts
@@ -0,0 +1,82 @@
+import { createSSRFSafeUndiciConnect, isOAuthUrlAllowed } from '~/auth';
+import { createHardenedOAuthFetch, resetHardenedOAuthFetchDispatchers } from './hardenedFetch';
+
+jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => ({ lookup: jest.fn() })),
+  isOAuthUrlAllowed: jest.fn(() => false),
+}));
+
+const mockCreateSSRFSafeUndiciConnect = createSSRFSafeUndiciConnect as jest.MockedFunction<
+  typeof createSSRFSafeUndiciConnect
+>;
+const mockIsOAuthUrlAllowed = isOAuthUrlAllowed as jest.MockedFunction<typeof isOAuthUrlAllowed>;
+
+describe('createHardenedOAuthFetch', () => {
+  const originalFetch = global.fetch;
+  const mockFetch = jest.fn() as unknown as jest.MockedFunction<typeof fetch>;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    global.fetch = mockFetch;
+    mockFetch.mockResolvedValue({ ok: true } as Response);
+    mockIsOAuthUrlAllowed.mockReturnValue(false);
+  });
+
+  afterEach(() => {
+    resetHardenedOAuthFetchDispatchers();
+  });
+
+  afterAll(() => {
+    global.fetch = originalFetch;
+  });
+
+  it('attaches an SSRF-safe dispatcher at connect time', async () => {
+    await createHardenedOAuthFetch()('https://auth.example.com:9443/token', {
+      method: 'POST',
+    });
+
+    expect(mockCreateSSRFSafeUndiciConnect).toHaveBeenCalledWith(undefined, '9443');
+    expect(mockFetch).toHaveBeenCalledWith(
+      'https://auth.example.com:9443/token',
+      expect.objectContaining({
+        method: 'POST',
+        dispatcher: expect.any(Object),
+      }),
+    );
+  });
+
+  it('does not apply allowedAddresses when allowedDomains is active but unmatched', async () => {
+    await createHardenedOAuthFetch({
+      allowedDomains: ['https://trusted.example.com'],
+      allowedAddresses: ['10.0.0.5:9444'],
+    })('https://untrusted.example.com:9444/token');
+
+    expect(mockCreateSSRFSafeUndiciConnect).toHaveBeenCalledWith(null, '9444');
+    expect(mockFetch.mock.calls[0][1]).toEqual(
+      expect.objectContaining({ dispatcher: expect.any(Object) }),
+    );
+  });
+
+  it('preserves admin-trusted allowedDomains bypass behavior', async () => {
+    mockIsOAuthUrlAllowed.mockReturnValueOnce(true);
+
+    await createHardenedOAuthFetch({
+      allowedDomains: ['https://auth.example.com'],
+    })('https://auth.example.com/token', { method: 'GET' });
+
+    expect(mockCreateSSRFSafeUndiciConnect).not.toHaveBeenCalled();
+    expect(mockFetch.mock.calls[0][1]).not.toHaveProperty('dispatcher');
+  });
+
+  it('normalizes allowedAddresses before caching dispatchers', async () => {
+    await createHardenedOAuthFetch({
+      allowedAddresses: ['10.0.0.5:9443', '192.168.1.5:9443'],
+    })('https://auth.example.com:9443/token');
+
+    await createHardenedOAuthFetch({
+      allowedAddresses: ['192.168.1.5:9443', '10.0.0.5:9443'],
+    })('https://auth.example.com:9443/token');
+
+    expect(mockCreateSSRFSafeUndiciConnect).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/mcp/oauth/hardenedFetch.ts b/packages/api/src/mcp/oauth/hardenedFetch.ts
new file mode 100644
index 00000000000..18988af0c7d
--- /dev/null
+++ b/packages/api/src/mcp/oauth/hardenedFetch.ts
@@ -0,0 +1,92 @@
+import { Agent } from 'undici';
+import type { Dispatcher } from 'undici';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
+import { createSSRFSafeUndiciConnect, isOAuthUrlAllowed } from '~/auth';
+import { getOAuthUrlPort } from './url';
+
+type FetchInitWithDispatcher = RequestInit & {
+  dispatcher?: Dispatcher;
+};
+
+const MAX_OAUTH_DISPATCHERS = 64;
+const oauthDispatchers = new Map<string, Agent>();
+
+function shouldBypassSSRFDispatcher(url: string | URL, allowedDomains?: string[] | null): boolean {
+  if (!Array.isArray(allowedDomains) || allowedDomains.length === 0) {
+    return false;
+  }
+
+  return isOAuthUrlAllowed(url.toString(), allowedDomains, null);
+}
+
+function getDispatcherCacheKey(port: string, allowedAddresses?: string[] | null): string {
+  const normalizedAddresses = Array.isArray(allowedAddresses)
+    ? [...new Set(allowedAddresses)].sort().join('\n')
+    : '';
+  return `${port}\0${normalizedAddresses}`;
+}
+
+function evictOldestDispatcher(): void {
+  const oldestKey = oauthDispatchers.keys().next().value as string | undefined;
+  if (!oldestKey) {
+    return;
+  }
+
+  const dispatcher = oauthDispatchers.get(oldestKey);
+  oauthDispatchers.delete(oldestKey);
+  dispatcher?.destroy();
+}
+
+function getOAuthDispatcher(
+  url: string | URL,
+  allowedDomains?: string[] | null,
+  allowedAddresses?: string[] | null,
+): Agent | undefined {
+  if (shouldBypassSSRFDispatcher(url, allowedDomains)) {
+    return undefined;
+  }
+
+  const parsedUrl = url instanceof URL ? url : new URL(url);
+  const port = getOAuthUrlPort(parsedUrl);
+  const effectiveAddresses =
+    Array.isArray(allowedDomains) && allowedDomains.length > 0 ? null : allowedAddresses;
+  const cacheKey = getDispatcherCacheKey(port, effectiveAddresses);
+  const cached = oauthDispatchers.get(cacheKey);
+  if (cached) {
+    oauthDispatchers.delete(cacheKey);
+    oauthDispatchers.set(cacheKey, cached);
+    return cached;
+  }
+
+  if (oauthDispatchers.size >= MAX_OAUTH_DISPATCHERS) {
+    evictOldestDispatcher();
+  }
+
+  const dispatcher = new Agent({
+    connect: createSSRFSafeUndiciConnect(effectiveAddresses, port),
+  });
+  oauthDispatchers.set(cacheKey, dispatcher);
+  return dispatcher;
+}
+
+export function createHardenedOAuthFetch({
+  allowedDomains,
+  allowedAddresses,
+}: {
+  allowedDomains?: string[] | null;
+  allowedAddresses?: string[] | null;
+} = {}): FetchLike {
+  return async (url: string | URL, init?: RequestInit): Promise<Response> => {
+    const dispatcher = getOAuthDispatcher(url, allowedDomains, allowedAddresses);
+    const fetchInit: FetchInitWithDispatcher =
+      dispatcher != null ? { ...init, dispatcher } : { ...init };
+    return fetch(url, fetchInit);
+  };
+}
+
+export function resetHardenedOAuthFetchDispatchers(): void {
+  for (const dispatcher of oauthDispatchers.values()) {
+    dispatcher.destroy();
+  }
+  oauthDispatchers.clear();
+}
diff --git a/packages/api/src/mcp/oauth/index.ts b/packages/api/src/mcp/oauth/index.ts
index 1c4d98213e3..7e48d8a5c01 100644
--- a/packages/api/src/mcp/oauth/index.ts
+++ b/packages/api/src/mcp/oauth/index.ts
@@ -3,3 +3,6 @@ export * from './handler';
 export * from './tokens';
 export * from './detectOAuth';
 export * from './methods';
+export * from './obo';
+export * from './pending';
+export * from './events';
diff --git a/packages/api/src/mcp/oauth/obo.spec.ts b/packages/api/src/mcp/oauth/obo.spec.ts
new file mode 100644
index 00000000000..039f13da7da
--- /dev/null
+++ b/packages/api/src/mcp/oauth/obo.spec.ts
@@ -0,0 +1,270 @@
+import type { IUser } from '@librechat/data-schemas';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
+import type { OboTokenResolver } from './obo';
+import { isOboConfigStillTrusted, resolveOboToken } from './obo';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    warn: jest.fn(),
+    error: jest.fn(),
+    info: jest.fn(),
+  },
+}));
+
+jest.mock('~/utils/oidc', () => ({
+  extractOpenIDTokenInfo: jest.fn(),
+  isOpenIDTokenValid: jest.fn(),
+}));
+
+import { extractOpenIDTokenInfo, isOpenIDTokenValid } from '~/utils/oidc';
+
+const mockExtractOpenIDTokenInfo = extractOpenIDTokenInfo as jest.Mock;
+const mockIsOpenIDTokenValid = isOpenIDTokenValid as jest.Mock;
+
+describe('resolveOboToken', () => {
+  const mockUser: Partial<IUser> = {
+    id: 'user-123',
+    provider: 'openid',
+    openidId: 'oidc-sub-456',
+    email: 'test@example.com',
+    name: 'Test User',
+    federatedTokens: {
+      access_token: 'federated-access-token',
+      id_token: 'federated-id-token',
+      expires_at: Math.floor(Date.now() / 1000) + 3600,
+    },
+  };
+
+  const oboConfig = { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' };
+
+  const mockResolver: OboTokenResolver = jest.fn().mockResolvedValue({
+    access_token: 'exchanged-mcp-token',
+    expires_in: 3600,
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should throw when user has no valid OpenID token info', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue(null);
+
+    await expect(resolveOboToken(mockUser as IUser, oboConfig, mockResolver)).rejects.toMatchObject(
+      {
+        reason: 'missing_upstream_token',
+        retryable: false,
+      },
+    );
+    expect(mockResolver).not.toHaveBeenCalled();
+  });
+
+  it('should throw when OpenID token is not valid (expired)', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'some-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(false);
+
+    await expect(resolveOboToken(mockUser as IUser, oboConfig, mockResolver)).rejects.toMatchObject(
+      {
+        reason: 'missing_upstream_token',
+        retryable: false,
+      },
+    );
+    expect(mockResolver).not.toHaveBeenCalled();
+  });
+
+  it('should throw when access token is missing from token info', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ userId: 'user-123' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    await expect(resolveOboToken(mockUser as IUser, oboConfig, mockResolver)).rejects.toMatchObject(
+      {
+        reason: 'missing_upstream_access_token',
+        retryable: false,
+      },
+    );
+    expect(mockResolver).not.toHaveBeenCalled();
+  });
+
+  it('should call the resolver with correct arguments and return MCPOAuthTokens', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const beforeCall = Date.now();
+    const result = await resolveOboToken(mockUser as IUser, oboConfig, mockResolver);
+    const afterCall = Date.now();
+
+    expect(mockResolver).toHaveBeenCalledWith(
+      mockUser,
+      'federated-access-token',
+      'api://mcp-server-id/Mcp.Tools.ReadWrite',
+      true,
+    );
+
+    expect(result).not.toBeNull();
+    expect(result!.access_token).toBe('exchanged-mcp-token');
+    expect(result!.token_type).toBe('Bearer');
+    expect(result!.obtained_at).toBeGreaterThanOrEqual(beforeCall);
+    expect(result!.obtained_at).toBeLessThanOrEqual(afterCall);
+    expect(result!.expires_at).toBe(result!.obtained_at + 3600 * 1000);
+  });
+
+  it('should default expires_in to 3600 when not provided by resolver', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const resolverNoExpiry: OboTokenResolver = jest.fn().mockResolvedValue({
+      access_token: 'exchanged-token',
+    });
+
+    const result = await resolveOboToken(mockUser as IUser, oboConfig, resolverNoExpiry);
+
+    expect(result).not.toBeNull();
+    expect(result!.expires_at).toBe(result!.obtained_at + 3600 * 1000);
+  });
+
+  it('should throw when resolver returns no access_token', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const emptyResolver: OboTokenResolver = jest.fn().mockResolvedValue({});
+    await expect(
+      resolveOboToken(mockUser as IUser, oboConfig, emptyResolver),
+    ).rejects.toMatchObject({
+      reason: 'empty_exchange_response',
+      retryable: false,
+    });
+  });
+
+  it('should throw a retryable error when resolver reports a transient failure', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const failingResolver: OboTokenResolver = jest
+      .fn()
+      .mockRejectedValue(Object.assign(new Error('temporary timeout'), { retryable: true }));
+
+    await expect(
+      resolveOboToken(mockUser as IUser, oboConfig, failingResolver),
+    ).rejects.toMatchObject({
+      reason: 'exchange_failed',
+      retryable: true,
+      userMessage: 'Temporary OBO token exchange failure.',
+    });
+  });
+
+  it('should throw a non-retryable error when resolver reports a permanent failure', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const failingResolver: OboTokenResolver = jest
+      .fn()
+      .mockRejectedValue(new Error('invalid_grant: assertion invalid'));
+
+    await expect(
+      resolveOboToken(mockUser as IUser, oboConfig, failingResolver),
+    ).rejects.toMatchObject({
+      reason: 'exchange_failed',
+      retryable: false,
+      userMessage: 'The identity provider rejected the OBO token exchange.',
+    });
+  });
+
+  it('should use the correct scopes from oboConfig', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const customConfig = { scopes: 'api://other-app/Custom.Scope' };
+    await resolveOboToken(mockUser as IUser, customConfig, mockResolver);
+
+    expect(mockResolver).toHaveBeenCalledWith(
+      mockUser,
+      'federated-access-token',
+      'api://other-app/Custom.Scope',
+      true,
+    );
+  });
+
+  it('should respect custom expires_in from resolver', async () => {
+    mockExtractOpenIDTokenInfo.mockReturnValue({ accessToken: 'federated-access-token' });
+    mockIsOpenIDTokenValid.mockReturnValue(true);
+
+    const shortLivedResolver: OboTokenResolver = jest.fn().mockResolvedValue({
+      access_token: 'short-lived-token',
+      expires_in: 300,
+    });
+
+    const result = await resolveOboToken(mockUser as IUser, oboConfig, shortLivedResolver);
+
+    expect(result).not.toBeNull();
+    expect(result!.expires_at).toBe(result!.obtained_at + 300 * 1000);
+  });
+});
+
+describe('isOboConfigStillTrusted', () => {
+  const adminPerms = {
+    [PermissionTypes.MCP_SERVERS]: {
+      [Permissions.CONFIGURE_OBO]: true,
+    },
+  };
+  const userPerms = {
+    [PermissionTypes.MCP_SERVERS]: {
+      [Permissions.CONFIGURE_OBO]: false,
+    },
+  };
+  const noOboPerms = {
+    [PermissionTypes.MCP_SERVERS]: {},
+  };
+
+  it('returns false when authorId is missing', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: undefined,
+      getUserRoleByAuthorId: jest.fn(),
+      getRolePermissions: jest.fn(),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('returns false when the author has no role (deleted user)', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: 'gone',
+      getUserRoleByAuthorId: jest.fn().mockResolvedValue(null),
+      getRolePermissions: jest.fn(),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('returns false when role lookup throws', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: 'u1',
+      getUserRoleByAuthorId: jest.fn().mockResolvedValue('ADMIN'),
+      getRolePermissions: jest.fn().mockRejectedValue(new Error('db down')),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('returns false when the role lacks CONFIGURE_OBO sub-key (older deployment)', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: 'u1',
+      getUserRoleByAuthorId: jest.fn().mockResolvedValue('ADMIN'),
+      getRolePermissions: jest.fn().mockResolvedValue(noOboPerms),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('returns false when CONFIGURE_OBO is explicitly false', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: 'u1',
+      getUserRoleByAuthorId: jest.fn().mockResolvedValue('USER'),
+      getRolePermissions: jest.fn().mockResolvedValue(userPerms),
+    });
+    expect(result).toBe(false);
+  });
+
+  it('returns true when the author still has CONFIGURE_OBO', async () => {
+    const result = await isOboConfigStillTrusted({
+      authorId: 'u1',
+      getUserRoleByAuthorId: jest.fn().mockResolvedValue('ADMIN'),
+      getRolePermissions: jest.fn().mockResolvedValue(adminPerms),
+    });
+    expect(result).toBe(true);
+  });
+});
diff --git a/packages/api/src/mcp/oauth/obo.ts b/packages/api/src/mcp/oauth/obo.ts
new file mode 100644
index 00000000000..91b994a6829
--- /dev/null
+++ b/packages/api/src/mcp/oauth/obo.ts
@@ -0,0 +1,245 @@
+import { logger } from '@librechat/data-schemas';
+import { Permissions, PermissionTypes } from 'librechat-data-provider';
+import type { IUser } from '@librechat/data-schemas';
+import { extractOpenIDTokenInfo, isOpenIDTokenValid } from '~/utils/oidc';
+import type { MCPOAuthTokens } from './types';
+
+export interface OboConfig {
+  scopes: string;
+}
+
+/**
+ * Function type for performing OBO token exchange.
+ * Injected from the main API layer since it requires OpenID configuration and caching.
+ */
+export type OboTokenResolver = (
+  user: IUser,
+  accessToken: string,
+  scopes: string,
+  fromCache?: boolean,
+) => Promise<{ access_token: string; expires_in?: number }>;
+
+export type OboTokenResolutionReason =
+  | 'missing_upstream_token'
+  | 'missing_upstream_access_token'
+  | 'empty_exchange_response'
+  | 'exchange_failed';
+
+const RETRYABLE_OBO_STATUS_CODES = new Set([429, 500, 502, 503, 504]);
+const RETRYABLE_OBO_ERROR_CODES = new Set(['ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN', 'ENOTFOUND']);
+
+function getErrorStatus(error: unknown): number | undefined {
+  if (!error || typeof error !== 'object') {
+    return undefined;
+  }
+
+  const candidate = error as {
+    status?: number;
+    statusCode?: number;
+    response?: { status?: number };
+  };
+
+  return candidate.status ?? candidate.statusCode ?? candidate.response?.status;
+}
+
+function getErrorCode(error: unknown): string | undefined {
+  if (!error || typeof error !== 'object' || !('code' in error)) {
+    return undefined;
+  }
+
+  const code = (error as { code?: unknown }).code;
+  return typeof code === 'string' ? code.toUpperCase() : undefined;
+}
+
+function getErrorRetryableFlag(error: unknown): boolean | undefined {
+  if (!error || typeof error !== 'object' || !('retryable' in error)) {
+    return undefined;
+  }
+
+  const retryable = (error as { retryable?: unknown }).retryable;
+  return typeof retryable === 'boolean' ? retryable : undefined;
+}
+
+export class OboTokenResolutionError extends Error {
+  public readonly reason: OboTokenResolutionReason;
+  public readonly retryable: boolean;
+  public readonly userMessage: string;
+  public override readonly cause?: unknown;
+
+  constructor(
+    reason: OboTokenResolutionReason,
+    userMessage: string,
+    retryable = false,
+    cause?: unknown,
+  ) {
+    super(userMessage);
+    this.name = 'OboTokenResolutionError';
+    this.reason = reason;
+    this.retryable = retryable;
+    this.userMessage = userMessage;
+    this.cause = cause;
+  }
+}
+
+function isRetryableOboExchangeError(error: unknown): boolean {
+  const taggedRetryable = getErrorRetryableFlag(error);
+  if (taggedRetryable != null) {
+    return taggedRetryable;
+  }
+
+  const status = getErrorStatus(error);
+  if (status != null && RETRYABLE_OBO_STATUS_CODES.has(status)) {
+    return true;
+  }
+
+  const code = getErrorCode(error);
+  if (code != null && RETRYABLE_OBO_ERROR_CODES.has(code)) {
+    return true;
+  }
+
+  if (!error || typeof error !== 'object' || !('message' in error)) {
+    return false;
+  }
+
+  const message = String((error as { message?: unknown }).message ?? '').toLowerCase();
+  return (
+    message.includes('timed out') ||
+    message.includes('timeout') ||
+    message.includes('econnreset') ||
+    message.includes('socket hang up') ||
+    message.includes('temporarily unavailable') ||
+    message.includes('too many requests') ||
+    message.includes('service unavailable')
+  );
+}
+
+/**
+ * Performs an OBO token exchange for the given user and MCP server OBO config.
+ * Returns MCPOAuthTokens suitable for injection into the MCP connection.
+ */
+export async function resolveOboToken(
+  user: IUser,
+  oboConfig: OboConfig,
+  oboTokenResolver: OboTokenResolver,
+): Promise<MCPOAuthTokens> {
+  const tokenInfo = extractOpenIDTokenInfo(user);
+  if (!tokenInfo || !isOpenIDTokenValid(tokenInfo)) {
+    logger.warn(
+      `[OBO] No valid OpenID token available for OBO exchange (provider: ${user.provider}, hasOpenidId: ${!!user.openidId}, hasFederatedTokens: ${!!user.federatedTokens})`,
+    );
+    throw new OboTokenResolutionError(
+      'missing_upstream_token',
+      'No valid OpenID access token is available for OBO exchange.',
+    );
+  }
+
+  if (!tokenInfo.accessToken) {
+    logger.warn('[OBO] OpenID token info present but access_token is missing');
+    throw new OboTokenResolutionError(
+      'missing_upstream_access_token',
+      'The upstream OpenID access token is missing for OBO exchange.',
+    );
+  }
+
+  try {
+    const response = await oboTokenResolver(user, tokenInfo.accessToken, oboConfig.scopes, true);
+
+    if (!response?.access_token) {
+      logger.warn('[OBO] Token exchange did not return an access token');
+      throw new OboTokenResolutionError(
+        'empty_exchange_response',
+        'The identity provider returned no access token for the OBO exchange.',
+      );
+    }
+
+    const now = Date.now();
+    const expiresIn = response.expires_in ?? 3600;
+
+    return {
+      access_token: response.access_token,
+      token_type: 'Bearer',
+      obtained_at: now,
+      expires_at: now + expiresIn * 1000,
+    };
+  } catch (error) {
+    if (error instanceof OboTokenResolutionError) {
+      throw error;
+    }
+
+    logger.error('[OBO] Failed to exchange token:', error);
+    const retryable = isRetryableOboExchangeError(error);
+    throw new OboTokenResolutionError(
+      'exchange_failed',
+      retryable
+        ? 'Temporary OBO token exchange failure.'
+        : 'The identity provider rejected the OBO token exchange.',
+      retryable,
+      error,
+    );
+  }
+}
+
+/**
+ * Re-evaluates whether the original author of a DB-stored OBO config still has
+ * permission to configure OBO. The connection layer calls this before performing
+ * an OBO token exchange so that retained configs fail closed if the author's role
+ * is downgraded after the server was created.
+ *
+ * Returns true when the author's role grants `MCP_SERVERS.CONFIGURE_OBO`. Any of
+ * the following degraded states return false (fail closed):
+ *   - missing author id
+ *   - user lookup miss / no role
+ *   - role lookup miss
+ *   - role missing the CONFIGURE_OBO bit
+ */
+export type GetUserRoleByAuthorId = (authorId: string) => Promise<string | null | undefined>;
+export type GetRolePermissions = (
+  roleName: string,
+) => Promise<Record<string, Record<string, boolean | undefined>> | null | undefined>;
+
+export async function isOboConfigStillTrusted({
+  authorId,
+  getUserRoleByAuthorId,
+  getRolePermissions,
+}: {
+  authorId: string | undefined;
+  getUserRoleByAuthorId: GetUserRoleByAuthorId;
+  getRolePermissions: GetRolePermissions;
+}): Promise<boolean> {
+  if (!authorId) {
+    return false;
+  }
+  let roleName: string | null | undefined;
+  try {
+    roleName = await getUserRoleByAuthorId(authorId);
+  } catch (err) {
+    logger.warn('[OBO] Failed to resolve author role for OBO trust check', err);
+    return false;
+  }
+  if (!roleName) {
+    return false;
+  }
+  let permissions: Record<string, Record<string, boolean | undefined>> | null | undefined;
+  try {
+    permissions = await getRolePermissions(roleName);
+  } catch (err) {
+    logger.warn('[OBO] Failed to load role permissions for OBO trust check', err);
+    return false;
+  }
+  return permissions?.[PermissionTypes.MCP_SERVERS]?.[Permissions.CONFIGURE_OBO] === true;
+}
+
+/**
+ * Async predicate injected into MCP runtime to gate OBO exchanges per server.
+ * Returns true when OBO is allowed for the given config, false to fail closed.
+ *
+ * The runtime passes `source`, `author`, and `dbId` so the implementation can
+ * use the same `isUserSourced` semantics as the rest of the MCP layer (a
+ * missing `source` field on a legacy cached config still falls back to
+ * `dbId`-presence heuristics).
+ */
+export type OboTrustChecker = (config: {
+  source?: string;
+  author?: string;
+  dbId?: string;
+}) => Promise<boolean>;
diff --git a/packages/api/src/mcp/oauth/pending.ts b/packages/api/src/mcp/oauth/pending.ts
new file mode 100644
index 00000000000..76935ca7efb
--- /dev/null
+++ b/packages/api/src/mcp/oauth/pending.ts
@@ -0,0 +1,70 @@
+import { logger, getTenantId } from '@librechat/data-schemas';
+
+import type { MCPOAuthFlowMetadata, MCPOAuthTokens } from './types';
+import type { FlowStateManager } from '~/flow/manager';
+import type { FlowState } from '~/flow/types';
+import type * as t from '~/mcp/types';
+
+import { PENDING_STALE_MS } from '~/flow/manager';
+import { MCPOAuthHandler } from './handler';
+
+const MCP_OAUTH_FLOW_TYPE = 'mcp_oauth';
+
+type PendingOAuthFlowState = Pick<
+  FlowState<MCPOAuthTokens | null>,
+  'createdAt' | 'metadata' | 'status'
+>;
+
+type PendingOAuthFlowManager = Pick<FlowStateManager<MCPOAuthTokens | null>, 'getFlowState'>;
+
+export type PendingOAuthStart = {
+  authURL: string;
+  options?: t.OAuthStartOptions;
+};
+
+export type ReplayablePendingMCPOAuthStartOptions = {
+  flowManager?: PendingOAuthFlowManager | null;
+  userId: string;
+  serverName: string;
+};
+
+export function getReplayablePendingMCPOAuthStartFromFlow(
+  flow: PendingOAuthFlowState | null | undefined,
+  now: number = Date.now(),
+): PendingOAuthStart | undefined {
+  if (flow?.status !== 'PENDING') {
+    return undefined;
+  }
+
+  const expiresAt = flow.createdAt + PENDING_STALE_MS;
+  if (expiresAt <= now) {
+    return undefined;
+  }
+
+  const metadata = flow.metadata as Partial<MCPOAuthFlowMetadata>;
+  const authorizationUrl = metadata.authorizationUrl;
+  if (!authorizationUrl) {
+    return undefined;
+  }
+
+  return { authURL: authorizationUrl, options: { expiresAt } };
+}
+
+export async function getReplayablePendingMCPOAuthStart({
+  flowManager,
+  userId,
+  serverName,
+}: ReplayablePendingMCPOAuthStartOptions): Promise<PendingOAuthStart | undefined> {
+  if (!flowManager || typeof flowManager.getFlowState !== 'function') {
+    return undefined;
+  }
+
+  try {
+    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+    const flowState = await flowManager.getFlowState(flowId, MCP_OAUTH_FLOW_TYPE);
+    return getReplayablePendingMCPOAuthStartFromFlow(flowState);
+  } catch (error) {
+    logger.warn(`[MCP OAuth] Failed to inspect pending flow for ${serverName}:`, error);
+    return undefined;
+  }
+}
diff --git a/packages/api/src/mcp/oauth/tokens.test.ts b/packages/api/src/mcp/oauth/tokens.test.ts
new file mode 100644
index 00000000000..f22c7f69c83
--- /dev/null
+++ b/packages/api/src/mcp/oauth/tokens.test.ts
@@ -0,0 +1,90 @@
+import jwt from 'jsonwebtoken';
+import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { TokenMethods } from '@librechat/data-schemas';
+import { MCPTokenStorage } from './tokens';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+  encryptV2: jest.fn(async (value: string) => `encrypted:${value}`),
+  decryptV2: jest.fn(async (value: string) => value.replace(/^encrypted:/, '')),
+}));
+
+// Avoid pulling in librechat-data-provider via ~/mcp/utils; storeTokens does not use it.
+jest.mock('~/mcp/utils', () => ({
+  isInvalidClientMessage: jest.fn(() => false),
+}));
+
+const DEFAULT_TTL_SECONDS = 365 * 24 * 60 * 60;
+
+/** Signs a JWT carrying the given `exp` (epoch seconds). Signature is irrelevant — storeTokens only decodes. */
+function makeJwt(expEpochSeconds: number): string {
+  return jwt.sign({ exp: expEpochSeconds, sub: 'test-user' }, 'test-secret');
+}
+
+/** Runs storeTokens with only createToken wired up and returns the stored access-token record. */
+async function storeAndCapture(tokens: OAuthTokens) {
+  const createToken = jest.fn().mockResolvedValue({});
+  await MCPTokenStorage.storeTokens({
+    userId: 'user-1',
+    serverName: 'salesforce',
+    tokens,
+    createToken: createToken as unknown as TokenMethods['createToken'],
+  });
+  const accessTokenCall = createToken.mock.calls.find((call) => call[0]?.type === 'mcp_oauth');
+  expect(accessTokenCall).toBeDefined();
+  return accessTokenCall![0] as { expiresIn: number };
+}
+
+describe('MCPTokenStorage.storeTokens expiry handling', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('uses the JWT `exp` claim when the provider omits expires_in/expires_at', async () => {
+    const expSeconds = Math.floor(Date.now() / 1000) + 1800; // 30 minutes
+    const stored = await storeAndCapture({
+      access_token: makeJwt(expSeconds),
+      token_type: 'Bearer',
+    });
+
+    // ~1800s, not the 365-day default.
+    expect(stored.expiresIn).toBeGreaterThanOrEqual(1798);
+    expect(stored.expiresIn).toBeLessThanOrEqual(1800);
+    expect(stored.expiresIn).toBeLessThan(DEFAULT_TTL_SECONDS);
+  });
+
+  it('falls back to the default TTL for opaque (non-JWT) tokens with no expiry', async () => {
+    const stored = await storeAndCapture({
+      access_token: '00Dxx0000001gPF!AQ4AQP_opaque_salesforce_session_token',
+      token_type: 'Bearer',
+    });
+
+    expect(stored.expiresIn).toBe(DEFAULT_TTL_SECONDS);
+  });
+
+  it('still prefers an explicit expires_in over the JWT exp', async () => {
+    const expSeconds = Math.floor(Date.now() / 1000) + 1800;
+    const stored = await storeAndCapture({
+      access_token: makeJwt(expSeconds),
+      token_type: 'Bearer',
+      expires_in: 900,
+    });
+
+    expect(stored.expiresIn).toBe(900);
+  });
+
+  it('ignores a JWT exp that is already in the past and uses the default TTL', async () => {
+    const expSeconds = Math.floor(Date.now() / 1000) - 100; // already expired
+    const stored = await storeAndCapture({
+      access_token: makeJwt(expSeconds),
+      token_type: 'Bearer',
+    });
+
+    expect(stored.expiresIn).toBe(DEFAULT_TTL_SECONDS);
+  });
+});
diff --git a/packages/api/src/mcp/oauth/tokens.ts b/packages/api/src/mcp/oauth/tokens.ts
index 5476cc302b5..65c686e7ef3 100644
--- a/packages/api/src/mcp/oauth/tokens.ts
+++ b/packages/api/src/mcp/oauth/tokens.ts
@@ -1,7 +1,8 @@
+import jwt from 'jsonwebtoken';
 import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
 import type { OAuthTokens, OAuthClientInformation } from '@modelcontextprotocol/sdk/shared/auth.js';
 import type { TokenMethods, IToken } from '@librechat/data-schemas';
-import type { MCPOAuthTokens, ExtendedOAuthTokens, OAuthMetadata } from './types';
+import type { MCPOAuthTokens, ExtendedOAuthTokens, OAuthStoredClientMetadata } from './types';
 import { isInvalidClientMessage } from '~/mcp/utils';
 import { isSystemUserId } from '~/mcp/enum';
 
@@ -24,7 +25,7 @@ interface StoreTokensParams {
   updateToken?: TokenMethods['updateToken'];
   findToken?: TokenMethods['findToken'];
   clientInfo?: OAuthClientInformation;
-  metadata?: OAuthMetadata;
+  metadata?: Partial<OAuthStoredClientMetadata>;
   /** Optional: Pass existing token state to avoid duplicate DB calls */
   existingTokens?: {
     accessToken?: IToken | null;
@@ -46,12 +47,42 @@ interface GetTokensParams {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
+    signal?: AbortSignal,
   ) => Promise<MCPOAuthTokens>;
   createToken?: TokenMethods['createToken'];
   updateToken?: TokenMethods['updateToken'];
   /** Enables cleanup of stale client registration and refresh token on invalid_client errors during refresh. */
   deleteTokens?: TokenMethods['deleteTokens'];
+  signal?: AbortSignal;
+}
+
+/**
+ * Reads the `exp` claim (RFC 7519 §4.1.4 / RFC 9068) from a JWT-format access
+ * token, returned as epoch milliseconds. Returns null for opaque (non-JWT)
+ * tokens or when no usable `exp` is present. The signature is intentionally
+ * not verified — the protected resource server validates the token; here we
+ * only read its self-declared expiry to avoid a lossy default.
+ */
+function getJwtAccessTokenExpiry(accessToken?: string): number | null {
+  if (!accessToken) {
+    return null;
+  }
+  try {
+    const decoded = jwt.decode(accessToken);
+    if (
+      decoded != null &&
+      typeof decoded !== 'string' &&
+      typeof decoded.exp === 'number' &&
+      Number.isFinite(decoded.exp)
+    ) {
+      return decoded.exp * 1000;
+    }
+  } catch {
+    /* Not a JWT or malformed — fall through to other expiry sources. */
+  }
+  return null;
 }
 
 export class MCPTokenStorage {
@@ -105,9 +136,23 @@ export class MCPTokenStorage {
         expiresInSeconds = tokens.expires_in;
         accessTokenExpiry = new Date(Date.now() + tokens.expires_in * 1000);
       } else {
-        logger.debug(`${logPrefix} No expiry provided, using default`);
-        expiresInSeconds = defaultTTL;
-        accessTokenExpiry = new Date(Date.now() + defaultTTL * 1000);
+        /**
+         * RFC 6749 §5.1 makes `expires_in` only RECOMMENDED, so some providers
+         * (e.g. Salesforce) omit it. When the access token is a JWT (RFC 9068),
+         * its `exp` claim is the authoritative lifetime — prefer it over the
+         * 365-day default so the token is refreshed on time rather than being
+         * treated as valid for a year and never refreshed.
+         */
+        const jwtExpiryMs = getJwtAccessTokenExpiry(tokens.access_token);
+        if (jwtExpiryMs != null && jwtExpiryMs > Date.now()) {
+          logger.debug(`${logPrefix} Using JWT exp claim: ${new Date(jwtExpiryMs).toISOString()}`);
+          accessTokenExpiry = new Date(jwtExpiryMs);
+          expiresInSeconds = Math.floor((jwtExpiryMs - Date.now()) / 1000);
+        } else {
+          logger.debug(`${logPrefix} No expiry provided, using default`);
+          expiresInSeconds = defaultTTL;
+          accessTokenExpiry = new Date(Date.now() + defaultTTL * 1000);
+        }
       }
 
       logger.debug(`${logPrefix} Calculated expiry date: ${accessTokenExpiry.toISOString()}`);
@@ -211,7 +256,7 @@ export class MCPTokenStorage {
           identifier: `${identifier}:client`,
           token: encryptedClientInfo,
           expiresIn: 365 * 24 * 60 * 60,
-          metadata,
+          metadata: metadata ? { ...metadata } : undefined,
         };
 
         // Check if client info already exists and update if it does
@@ -250,6 +295,183 @@ export class MCPTokenStorage {
     }
   }
 
+  /**
+   * Forces a refresh of OAuth tokens using the stored refresh token, regardless
+   * of whether the access token appears locally expired. Use this when the
+   * server has signaled token invalidity (e.g. a 401 mid-session) — the 401 is
+   * the authoritative signal, not the local `expires_at`.
+   *
+   * Returns the new tokens, or `null` when refresh is not possible (no refresh
+   * token stored, no refresh callback, etc.). Throws `ReauthenticationRequiredError`
+   * when the refresh server response indicates the client registration is stale.
+   */
+  static async forceRefreshTokens({
+    userId,
+    serverName,
+    findToken,
+    createToken,
+    updateToken,
+    deleteTokens,
+    refreshTokens,
+    existingAccessToken,
+    existingRefreshToken,
+    signal,
+  }: GetTokensParams & {
+    existingAccessToken?: IToken | null;
+    existingRefreshToken?: IToken | null;
+  }): Promise<MCPOAuthTokens | null> {
+    const logPrefix = this.getLogPrefix(userId, serverName);
+    const identifier = `mcp:${serverName}`;
+
+    const refreshTokenData =
+      existingRefreshToken !== undefined
+        ? existingRefreshToken
+        : await findToken({
+            userId,
+            type: 'mcp_oauth_refresh',
+            identifier: `${identifier}:refresh`,
+          });
+
+    if (!refreshTokenData) {
+      logger.debug(`${logPrefix} No refresh token in storage`);
+      return null;
+    }
+
+    if (!refreshTokens) {
+      logger.warn(`${logPrefix} Refresh token available but no \`refreshTokens\` provided`);
+      return null;
+    }
+
+    if (!createToken) {
+      logger.warn(`${logPrefix} Refresh token available but no \`createToken\` function provided`);
+      return null;
+    }
+
+    try {
+      logger.info(`${logPrefix} Attempting to refresh token`);
+      const decryptedRefreshToken = await decryptV2(refreshTokenData.token);
+
+      let clientInfo;
+      let clientInfoData;
+      let storedClientMetadata: Partial<OAuthStoredClientMetadata> | undefined;
+      let storedTokenEndpoint: string | undefined;
+      let storedAuthMethods: string[] | undefined;
+      let resource: string | undefined;
+      try {
+        clientInfoData = await findToken({
+          userId,
+          type: 'mcp_oauth_client',
+          identifier: `${identifier}:client`,
+        });
+        if (clientInfoData) {
+          const decryptedClientInfo = await decryptV2(clientInfoData.token);
+          clientInfo = JSON.parse(decryptedClientInfo);
+          logger.debug(`${logPrefix} Retrieved client info:`, {
+            client_id: clientInfo.client_id,
+            has_client_secret: !!clientInfo.client_secret,
+          });
+
+          if (clientInfoData.metadata) {
+            const raw =
+              clientInfoData.metadata instanceof Map
+                ? Object.fromEntries(clientInfoData.metadata)
+                : (clientInfoData.metadata as Record<string, unknown>);
+            storedClientMetadata = raw as Partial<OAuthStoredClientMetadata>;
+            if (typeof raw.token_endpoint === 'string') {
+              storedTokenEndpoint = raw.token_endpoint;
+            }
+            if (Array.isArray(raw.token_endpoint_auth_methods_supported)) {
+              storedAuthMethods = raw.token_endpoint_auth_methods_supported as string[];
+            }
+            if (typeof raw.resource === 'string') {
+              resource = raw.resource;
+            }
+          }
+        }
+      } catch {
+        logger.debug(`${logPrefix} No client info found`);
+      }
+
+      const metadata = {
+        userId,
+        serverName,
+        identifier,
+        clientInfo,
+        storedTokenEndpoint,
+        storedAuthMethods,
+        resource,
+      };
+
+      const newTokens = await refreshTokens(decryptedRefreshToken, metadata, signal);
+
+      if (signal?.aborted) {
+        throw new Error('Token refresh aborted');
+      }
+
+      logger.debug(`${logPrefix} Refresh completed`, {
+        has_new_access_token: !!newTokens.access_token,
+        has_new_refresh_token: !!newTokens.refresh_token,
+        refresh_token_will_be_rotated: !!newTokens.refresh_token,
+        expires_at: newTokens.expires_at,
+      });
+
+      // Store the refreshed tokens (handles both create and update)
+      // Pass existing token state to avoid duplicate DB calls
+      await this.storeTokens({
+        userId,
+        serverName,
+        tokens: newTokens,
+        createToken,
+        updateToken,
+        findToken,
+        clientInfo,
+        existingTokens: {
+          accessToken: existingAccessToken,
+          refreshToken: refreshTokenData,
+          clientInfoToken: clientInfoData,
+        },
+        metadata: storedClientMetadata,
+      });
+
+      logger.info(`${logPrefix} Successfully refreshed and stored OAuth tokens`);
+      return newTokens;
+    } catch (refreshError) {
+      logger.error(`${logPrefix} Failed to refresh tokens`, refreshError);
+      // Check if it's an unauthorized_client error (refresh not supported)
+      const errorMessage =
+        refreshError instanceof Error ? refreshError.message : String(refreshError);
+      if (errorMessage.toLowerCase().includes('unauthorized_client')) {
+        logger.info(
+          `${logPrefix} Server does not support refresh tokens for this client. New authentication required.`,
+        );
+      } else if (isInvalidClientMessage(errorMessage)) {
+        if (deleteTokens) {
+          logger.info(
+            `${logPrefix} Client registration rejected during token refresh, attempting to clear stale registration and refresh token`,
+          );
+          const results = await Promise.allSettled([
+            MCPTokenStorage.deleteClientRegistration({ userId, serverName, deleteTokens }),
+            deleteTokens({
+              userId,
+              type: 'mcp_oauth_refresh',
+              identifier: `${identifier}:refresh`,
+            }),
+          ]);
+          for (const r of results) {
+            if (r.status === 'rejected') {
+              logger.warn(`${logPrefix} Failed to clear stale token data`, r.reason);
+            }
+          }
+          throw new ReauthenticationRequiredError(serverName, 'invalid_client');
+        }
+        logger.warn(
+          `${logPrefix} Client registration rejected during token refresh but deleteTokens not available — stale registration cannot be cleared`,
+        );
+      }
+      return null;
+    }
+  }
+
   /**
    * Retrieves OAuth tokens for an MCP server
    */
@@ -281,7 +503,8 @@ export class MCPTokenStorage {
       if (isMissing || isExpired) {
         logger.info(`${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}`);
 
-        /** Refresh data if we have a refresh token and refresh function */
+        /** Probe for a refresh token first so we can throw `ReauthenticationRequiredError`
+         *  when none exists, matching the prior contract. */
         const refreshTokenData = await findToken({
           userId,
           type: 'mcp_oauth_refresh',
@@ -296,131 +519,17 @@ export class MCPTokenStorage {
           throw new ReauthenticationRequiredError(serverName, reason);
         }
 
-        if (!refreshTokens) {
-          logger.warn(
-            `${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}, refresh token available but no \`refreshTokens\` provided`,
-          );
-          return null;
-        }
-
-        if (!createToken) {
-          logger.warn(
-            `${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}, refresh token available but no \`createToken\` function provided`,
-          );
-          return null;
-        }
-
-        try {
-          logger.info(`${logPrefix} Attempting to refresh token`);
-          const decryptedRefreshToken = await decryptV2(refreshTokenData.token);
-
-          let clientInfo;
-          let clientInfoData;
-          let storedTokenEndpoint: string | undefined;
-          let storedAuthMethods: string[] | undefined;
-          try {
-            clientInfoData = await findToken({
-              userId,
-              type: 'mcp_oauth_client',
-              identifier: `${identifier}:client`,
-            });
-            if (clientInfoData) {
-              const decryptedClientInfo = await decryptV2(clientInfoData.token);
-              clientInfo = JSON.parse(decryptedClientInfo);
-              logger.debug(`${logPrefix} Retrieved client info:`, {
-                client_id: clientInfo.client_id,
-                has_client_secret: !!clientInfo.client_secret,
-              });
-
-              if (clientInfoData.metadata) {
-                const raw =
-                  clientInfoData.metadata instanceof Map
-                    ? Object.fromEntries(clientInfoData.metadata)
-                    : (clientInfoData.metadata as Record<string, unknown>);
-                if (typeof raw.token_endpoint === 'string') {
-                  storedTokenEndpoint = raw.token_endpoint;
-                }
-                if (Array.isArray(raw.token_endpoint_auth_methods_supported)) {
-                  storedAuthMethods = raw.token_endpoint_auth_methods_supported as string[];
-                }
-              }
-            }
-          } catch {
-            logger.debug(`${logPrefix} No client info found`);
-          }
-
-          const metadata = {
-            userId,
-            serverName,
-            identifier,
-            clientInfo,
-            storedTokenEndpoint,
-            storedAuthMethods,
-          };
-
-          const newTokens = await refreshTokens(decryptedRefreshToken, metadata);
-
-          logger.debug(`${logPrefix} Refresh completed`, {
-            has_new_access_token: !!newTokens.access_token,
-            has_new_refresh_token: !!newTokens.refresh_token,
-            refresh_token_will_be_rotated: !!newTokens.refresh_token,
-            expires_at: newTokens.expires_at,
-          });
-
-          // Store the refreshed tokens (handles both create and update)
-          // Pass existing token state to avoid duplicate DB calls
-          await this.storeTokens({
-            userId,
-            serverName,
-            tokens: newTokens,
-            createToken,
-            updateToken,
-            findToken,
-            clientInfo,
-            existingTokens: {
-              accessToken: accessTokenData, // We know this is expired/missing
-              refreshToken: refreshTokenData, // We already have this
-              clientInfoToken: clientInfoData, // We already looked this up
-            },
-          });
-
-          logger.info(`${logPrefix} Successfully refreshed and stored OAuth tokens`);
-          return newTokens;
-        } catch (refreshError) {
-          logger.error(`${logPrefix} Failed to refresh tokens`, refreshError);
-          // Check if it's an unauthorized_client error (refresh not supported)
-          const errorMessage =
-            refreshError instanceof Error ? refreshError.message : String(refreshError);
-          if (errorMessage.toLowerCase().includes('unauthorized_client')) {
-            logger.info(
-              `${logPrefix} Server does not support refresh tokens for this client. New authentication required.`,
-            );
-          } else if (isInvalidClientMessage(errorMessage)) {
-            if (deleteTokens) {
-              logger.info(
-                `${logPrefix} Client registration rejected during token refresh, attempting to clear stale registration and refresh token`,
-              );
-              const results = await Promise.allSettled([
-                MCPTokenStorage.deleteClientRegistration({ userId, serverName, deleteTokens }),
-                deleteTokens({
-                  userId,
-                  type: 'mcp_oauth_refresh',
-                  identifier: `${identifier}:refresh`,
-                }),
-              ]);
-              for (const r of results) {
-                if (r.status === 'rejected') {
-                  logger.warn(`${logPrefix} Failed to clear stale token data`, r.reason);
-                }
-              }
-              throw new ReauthenticationRequiredError(serverName, 'invalid_client');
-            }
-            logger.warn(
-              `${logPrefix} Client registration rejected during token refresh but deleteTokens not available — stale registration cannot be cleared`,
-            );
-          }
-          return null;
-        }
+        return await this.forceRefreshTokens({
+          userId,
+          serverName,
+          findToken,
+          createToken,
+          updateToken,
+          deleteTokens,
+          refreshTokens,
+          existingAccessToken: accessTokenData,
+          existingRefreshToken: refreshTokenData,
+        });
       }
 
       // If we reach here, access token should exist and be valid
diff --git a/packages/api/src/mcp/oauth/types.ts b/packages/api/src/mcp/oauth/types.ts
index 20db2bc2a79..fea8b6a1c5b 100644
--- a/packages/api/src/mcp/oauth/types.ts
+++ b/packages/api/src/mcp/oauth/types.ts
@@ -26,6 +26,11 @@ export interface OAuthMetadata {
   revocation_endpoint_auth_methods_supported?: string[];
 }
 
+export interface OAuthStoredClientMetadata extends OAuthMetadata {
+  /** Canonical OAuth resource indicator used when the authorization code was exchanged. */
+  resource?: string;
+}
+
 export interface OAuthProtectedResourceMetadata {
   /** Resource identifier */
   resource: string;
@@ -91,6 +96,10 @@ export interface MCPOAuthFlowMetadata extends FlowMetadata {
   authorizationUrl?: string;
   /** Custom headers for OAuth token exchange, persisted at flow initiation for the callback. */
   oauthHeaders?: Record<string, string>;
+  /** Domain allowlist captured at flow initiation for callback-time SSRF enforcement. */
+  allowedDomains?: string[] | null;
+  /** Address exemptions captured at flow initiation for callback-time SSRF enforcement. */
+  allowedAddresses?: string[] | null;
   /** True when the flow reused a stored client registration from a prior successful OAuth flow */
   reusedStoredClient?: boolean;
   /** Tenant context captured at flow initiation for callback replay (SameSite cookies unavailable on cross-origin redirects) */
diff --git a/packages/api/src/mcp/oauth/url.ts b/packages/api/src/mcp/oauth/url.ts
new file mode 100644
index 00000000000..6556507ed51
--- /dev/null
+++ b/packages/api/src/mcp/oauth/url.ts
@@ -0,0 +1,6 @@
+export function getOAuthUrlPort(url: URL): string {
+  if (url.port) return url.port;
+  if (url.protocol === 'http:') return '80';
+  if (url.protocol === 'https:') return '443';
+  return '';
+}
diff --git a/packages/api/src/mcp/parsers.ts b/packages/api/src/mcp/parsers.ts
index c9b824e782a..2a653314959 100644
--- a/packages/api/src/mcp/parsers.ts
+++ b/packages/api/src/mcp/parsers.ts
@@ -3,10 +3,57 @@ import { Tools } from 'librechat-data-provider';
 import type { UIResource } from 'librechat-data-provider';
 import type * as t from './types';
 
+export const DEFAULT_MCP_IMAGE_DATA_MAX_BYTES: number = 10 * 1024 * 1024;
+
 function generateResourceId(text: string): string {
   return crypto.createHash('sha256').update(text).digest('hex').substring(0, 10);
 }
 
+function getMCPImageDataMaxBytes(): number {
+  const raw = process.env.MCP_IMAGE_DATA_MAX_BYTES;
+  if (!raw) {
+    return DEFAULT_MCP_IMAGE_DATA_MAX_BYTES;
+  }
+
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MCP_IMAGE_DATA_MAX_BYTES;
+}
+
+function getBase64Padding(data: string): number {
+  if (data.endsWith('==')) {
+    return 2;
+  }
+  if (data.endsWith('=')) {
+    return 1;
+  }
+  return 0;
+}
+
+function estimateBase64ImageBytes(data: string): number {
+  const padding = getBase64Padding(data);
+  return Math.max(0, Math.floor((data.length * 3) / 4) - padding);
+}
+
+function isRemoteImageUrl(data: string): boolean {
+  return data.startsWith('http://') || data.startsWith('https://');
+}
+
+function assertImageDataWithinLimit(item: t.ImageContent): void {
+  if (isRemoteImageUrl(item.data)) {
+    return;
+  }
+
+  const maxBytes = getMCPImageDataMaxBytes();
+  const estimatedBytes = estimateBase64ImageBytes(item.data);
+  if (estimatedBytes <= maxBytes) {
+    return;
+  }
+
+  throw new Error(
+    `MCP image result exceeds maximum size of ${maxBytes} bytes: ${estimatedBytes} bytes`,
+  );
+}
+
 const RECOGNIZED_PROVIDERS = new Set([
   'google',
   'anthropic',
@@ -38,7 +85,7 @@ const imageFormatters: Record<string, undefined | t.ImageFormatter> = {
   default: (item) => ({
     type: 'image_url',
     image_url: {
-      url: item.data.startsWith('http') ? item.data : `data:${item.mimeType};base64,${item.data}`,
+      url: isRemoteImageUrl(item.data) ? item.data : `data:${item.mimeType};base64,${item.data}`,
     },
   }),
 };
@@ -71,6 +118,9 @@ function parseAsString(result: t.MCPToolCallResponse): string {
         }
         return resourceText.join('\n');
       }
+      if (isImageContent(item)) {
+        assertImageDataWithinLimit(item);
+      }
       return JSON.stringify(item, null, 2);
     })
     .filter(Boolean)
@@ -120,6 +170,7 @@ export function formatToolContent(
       if (!isImageContent(item)) {
         return;
       }
+      assertImageDataWithinLimit(item);
       const formatter = imageFormatters.default as t.ImageFormatter;
       const formattedImage = formatter(item);
 
diff --git a/packages/api/src/mcp/registry/MCPServerInspector.ts b/packages/api/src/mcp/registry/MCPServerInspector.ts
index e4877e352b3..4e0b9438e45 100644
--- a/packages/api/src/mcp/registry/MCPServerInspector.ts
+++ b/packages/api/src/mcp/registry/MCPServerInspector.ts
@@ -1,10 +1,16 @@
+import { logger } from '@librechat/data-schemas';
 import { Constants } from 'librechat-data-provider';
 import type { JsonSchemaType } from '@librechat/data-schemas';
 import type { MCPConnection } from '~/mcp/connection';
 import type * as t from '~/mcp/types';
+import {
+  hasCustomUserVars,
+  hasRuntimeContextPlaceholders,
+  hasRuntimeUrlPlaceholders,
+  isUserSourced,
+} from '~/mcp/utils';
 import { isMCPDomainAllowed, extractMCPServerDomain } from '~/auth/domain';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { hasCustomUserVars, isUserSourced } from '~/mcp/utils';
 import { MCPDomainNotAllowedError } from '~/mcp/errors';
 import { detectOAuthRequirement } from '~/mcp/oauth';
 import { isEnabled } from '~/utils';
@@ -63,12 +69,15 @@ export class MCPServerInspector {
   }
 
   private async inspectServer(): Promise<void> {
+    this.warnOnUnrestrictedRuntimeUrl();
     await this.detectOAuth();
 
     if (
       this.config.startup !== false &&
       !this.config.requiresOAuth &&
-      !hasCustomUserVars(this.config)
+      !hasCustomUserVars(this.config) &&
+      !hasRuntimeContextPlaceholders(this.config) &&
+      !this.config.obo
     ) {
       let tempConnection = false;
       if (!this.connection) {
@@ -93,8 +102,25 @@ export class MCPServerInspector {
     }
   }
 
+  /**
+   * Runtime placeholders in the URL make the resolved connection target partially
+   * user/request-controlled. The resolved URL is validated against the domain
+   * allowlist at request time, but without one only private-range SSRF protection
+   * limits where it can point.
+   */
+  private warnOnUnrestrictedRuntimeUrl(): void {
+    if (!hasRuntimeUrlPlaceholders(this.config)) return;
+    if (Array.isArray(this.allowedDomains) && this.allowedDomains.length > 0) return;
+
+    logger.warn(
+      `[MCP][${this.serverName}] Server URL contains runtime placeholders but no domain allowlist is configured; ` +
+        'the resolved URL is partially user/request-controlled. Set mcpSettings.allowedDomains to restrict targets.',
+    );
+  }
+
   private async detectOAuth(): Promise<void> {
     if (this.config.requiresOAuth != null) return;
+    if (hasRuntimeUrlPlaceholders(this.config)) return;
     if (this.config.url == null || this.config.startup === false) {
       this.config.requiresOAuth = false;
       return;
@@ -106,7 +132,11 @@ export class MCPServerInspector {
       return;
     }
 
-    const result = await detectOAuthRequirement(this.config.url);
+    const result = await detectOAuthRequirement(
+      this.config.url,
+      this.allowedDomains,
+      this.allowedAddresses,
+    );
     this.config.requiresOAuth = result.requiresOAuth;
     this.config.oauthMetadata = result.metadata;
   }
@@ -120,8 +150,8 @@ export class MCPServerInspector {
   private async fetchServerCapabilities(): Promise<void> {
     const capabilities = this.connection!.client.getServerCapabilities();
     this.config.capabilities = JSON.stringify(capabilities);
-    const tools = await this.connection!.client.listTools();
-    this.config.tools = tools.tools.map((tool) => tool.name).join(', ');
+    const tools = await this.connection!.fetchTools();
+    this.config.tools = tools.map((tool) => tool.name).join(', ');
   }
 
   private async fetchToolFunctions(): Promise<void> {
@@ -141,7 +171,7 @@ export class MCPServerInspector {
     serverName: string,
     connection: MCPConnection,
   ): Promise<t.LCAvailableTools> {
-    const { tools }: t.MCPToolListResponse = await connection.client.listTools();
+    const tools = await connection.fetchTools();
 
     const toolFunctions: t.LCAvailableTools = {};
     tools.forEach((tool) => {
diff --git a/packages/api/src/mcp/registry/MCPServersInitializer.ts b/packages/api/src/mcp/registry/MCPServersInitializer.ts
index a8b8e3ca8a4..7c19f6338f1 100644
--- a/packages/api/src/mcp/registry/MCPServersInitializer.ts
+++ b/packages/api/src/mcp/registry/MCPServersInitializer.ts
@@ -1,3 +1,4 @@
+import { createHash } from 'crypto';
 import { logger } from '@librechat/data-schemas';
 import type * as t from '~/mcp/types';
 import { registryStatusCache as statusCache } from './cache/RegistryStatusCache';
@@ -6,8 +7,30 @@ import { sanitizeUrlForLogging } from '~/mcp/utils';
 import { withTimeout } from '~/utils';
 import { isLeader } from '~/cluster';
 
-const MCP_INIT_TIMEOUT_MS =
-  process.env.MCP_INIT_TIMEOUT_MS != null ? parseInt(process.env.MCP_INIT_TIMEOUT_MS) : 30_000;
+const DEFAULT_MCP_INIT_TIMEOUT_MS = 30_000;
+const DEFAULT_FOLLOWER_RETRY_MS = 3000;
+
+const parseDurationMs = (
+  value: string | undefined,
+  fallback: number,
+  allowZero = false,
+): number => {
+  if (value == null) {
+    return fallback;
+  }
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    return fallback;
+  }
+  if (allowZero) {
+    return parsed >= 0 ? parsed : fallback;
+  }
+  return parsed > 0 ? parsed : fallback;
+};
+
+type InitializeRegistryOptions = {
+  skipStatusLeaderCheck?: boolean;
+};
 
 /**
  * Handles initialization of MCP servers at application startup with distributed coordination.
@@ -37,37 +60,72 @@ export class MCPServersInitializer {
   }
 
   public static async initialize(rawConfigs: t.MCPServers): Promise<void> {
+    const configHash = MCPServersInitializer.configHash(rawConfigs);
     // On first call in this process, always reset and re-initialize
     // This ensures we don't use stale Redis data from previous runs
-    const isFirstCallThisProcess = !MCPServersInitializer.hasInitializedThisProcess;
-    // Set flag immediately so recursive calls (from followers) use Redis cache for coordination
+    let isFirstAttemptThisProcess = !MCPServersInitializer.hasInitializedThisProcess;
+    // Set flag immediately so follower retries use Redis cache for coordination
     MCPServersInitializer.hasInitializedThisProcess = true;
+    const followerWaitStartedAt = performance.now();
+
+    while (true) {
+      if (!isFirstAttemptThisProcess && (await statusCache.isInitializedFor(configHash))) {
+        return;
+      }
+
+      if (await isLeader()) {
+        await MCPServersInitializer.initializeRegistry(rawConfigs, configHash);
+        return;
+      }
 
-    if (!isFirstCallThisProcess && (await statusCache.isInitialized())) return;
-
-    if (await isLeader()) {
-      // Leader performs initialization - always reset on first call
-      await statusCache.reset();
-      await MCPServersRegistry.getInstance().reset();
-      const serverNames = Object.keys(rawConfigs);
-      await Promise.allSettled(
-        serverNames.map((serverName) =>
-          withTimeout(
-            MCPServersInitializer.initializeServer(serverName, rawConfigs[serverName]),
-            MCP_INIT_TIMEOUT_MS,
-            `${MCPServersInitializer.prefix(serverName)} Server initialization timed out`,
-            logger.error,
-          ),
+      const followerWaitMs = performance.now() - followerWaitStartedAt;
+      const followerMaxWaitMs = MCPServersInitializer.followerMaxWaitMs();
+      if (followerWaitMs >= followerMaxWaitMs) {
+        logger.warn(
+          '[MCP] Timed out waiting for leader to initialize registry for current config fingerprint; initializing on this instance',
+        );
+        await MCPServersInitializer.initializeRegistry(rawConfigs, configHash, {
+          skipStatusLeaderCheck: true,
+        });
+        return;
+      }
+
+      logger.debug(
+        '[MCP] Waiting for leader to initialize registry for current config fingerprint',
+      );
+      isFirstAttemptThisProcess = false;
+      await new Promise((resolve) =>
+        setTimeout(
+          resolve,
+          Math.min(MCPServersInitializer.followerRetryMs(), followerMaxWaitMs - followerWaitMs),
         ),
       );
-      await statusCache.setInitialized(true);
-    } else {
-      // Followers try again after a delay if not initialized
-      await new Promise((resolve) => setTimeout(resolve, 3000));
-      await this.initialize(rawConfigs);
     }
   }
 
+  private static async initializeRegistry(
+    rawConfigs: t.MCPServers,
+    configHash: string,
+    options?: InitializeRegistryOptions,
+  ): Promise<void> {
+    await statusCache.reset();
+    await MCPServersRegistry.getInstance().reset();
+    const serverNames = Object.keys(rawConfigs);
+    await Promise.allSettled(
+      serverNames.map((serverName) =>
+        withTimeout(
+          MCPServersInitializer.initializeServer(serverName, rawConfigs[serverName]),
+          MCPServersInitializer.initTimeoutMs(),
+          `${MCPServersInitializer.prefix(serverName)} Server initialization timed out`,
+          logger.error,
+        ),
+      ),
+    );
+    await statusCache.setInitialized(true, configHash, {
+      skipLeaderCheck: options?.skipStatusLeaderCheck,
+    });
+  }
+
   /** Initializes a single server with all its metadata and adds it to appropriate collections */
   public static async initializeServer(serverName: string, rawConfig: t.MCPOptions): Promise<void> {
     try {
@@ -101,13 +159,71 @@ export class MCPServersInitializer {
     logger.info(`${prefix} OAuth Required: ${config.requiresOAuth}`);
     logger.info(`${prefix} Capabilities: ${config.capabilities}`);
     logger.info(`${prefix} Tools: ${config.tools}`);
-    logger.info(`${prefix} Server Instructions: ${config.serverInstructions}`);
+    logger.info(
+      `${prefix} Server Instructions: ${MCPServersInitializer.formatInstructionsForLogging(
+        config.serverInstructions,
+      )}`,
+    );
     logger.info(`${prefix} Initialized in: ${config.initDuration ?? 'N/A'}ms`);
     logger.info(`${prefix} -------------------------------------------------┘`);
   }
 
+  private static formatInstructionsForLogging(instructions?: string | boolean): string {
+    if (!instructions) {
+      return 'N/A';
+    }
+
+    if (typeof instructions !== 'string') {
+      return 'configured';
+    }
+
+    return `configured (${instructions.length} chars)`;
+  }
+
   // Returns formatted log prefix for server messages
   private static prefix(serverName: string): string {
     return `[MCP][${serverName}]`;
   }
+
+  private static configHash(rawConfigs: t.MCPServers): string {
+    const registry = MCPServersRegistry.getInstance();
+    const fingerprint = {
+      rawConfigs,
+      allowedDomains: registry.getAllowedDomains() ?? null,
+      allowedAddresses: registry.getAllowedAddresses() ?? null,
+    };
+    return createHash('sha256')
+      .update(JSON.stringify(MCPServersInitializer.sortForHash(fingerprint)))
+      .digest('hex');
+  }
+
+  private static followerRetryMs(): number {
+    return parseDurationMs(process.env.MCP_INIT_FOLLOWER_RETRY_MS, DEFAULT_FOLLOWER_RETRY_MS);
+  }
+
+  private static followerMaxWaitMs(): number {
+    return parseDurationMs(
+      process.env.MCP_INIT_FOLLOWER_MAX_WAIT_MS,
+      MCPServersInitializer.initTimeoutMs() + MCPServersInitializer.followerRetryMs(),
+      true,
+    );
+  }
+
+  private static initTimeoutMs(): number {
+    return parseDurationMs(process.env.MCP_INIT_TIMEOUT_MS, DEFAULT_MCP_INIT_TIMEOUT_MS);
+  }
+
+  private static sortForHash(value: unknown): unknown {
+    if (Array.isArray(value)) {
+      return value.map((item) => MCPServersInitializer.sortForHash(item));
+    }
+    if (value !== null && typeof value === 'object') {
+      return Object.fromEntries(
+        Object.entries(value as Record<string, unknown>)
+          .sort(([left], [right]) => left.localeCompare(right))
+          .map(([key, item]) => [key, MCPServersInitializer.sortForHash(item)]),
+      );
+    }
+    return value;
+  }
 }
diff --git a/packages/api/src/mcp/registry/MCPServersRegistry.ts b/packages/api/src/mcp/registry/MCPServersRegistry.ts
index 1063071ac61..fa0bdb4e13c 100644
--- a/packages/api/src/mcp/registry/MCPServersRegistry.ts
+++ b/packages/api/src/mcp/registry/MCPServersRegistry.ts
@@ -17,6 +17,62 @@ import { withTimeout } from '~/utils';
 /** How long a failure stub is considered fresh before re-attempting inspection (5 minutes). */
 const CONFIG_STUB_RETRY_MS = 5 * 60 * 1000;
 
+/**
+ * Fields an admin override can legitimately set. Used to detect whether a
+ * resolved entry differs from its YAML base so unmodified YAML servers can
+ * skip lazy-init (avoids per-request inspect storms and prevents these
+ * servers from being cached in the config tier).
+ */
+const ADMIN_CONFIGURABLE_FIELDS = [
+  'type',
+  'command',
+  'args',
+  'env',
+  'stderr',
+  'url',
+  'headers',
+  'proxy',
+  'requiresOAuth',
+  'apiKey',
+  'oauth',
+  'oauth_headers',
+  'title',
+  'description',
+  'iconPath',
+  'startup',
+  'chatMenu',
+  'serverInstructions',
+  'customUserVars',
+  'timeout',
+  'sseReadTimeout',
+  'initTimeout',
+] as const;
+
+function deepEqual(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (a == null || b == null) return a === b;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== 'object') return false;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!deepEqual(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  if (Array.isArray(b)) return false;
+  const aObj = a as Record<string, unknown>;
+  const bObj = b as Record<string, unknown>;
+  const aKeys = Object.keys(aObj);
+  const bKeys = Object.keys(bObj);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const key of aKeys) {
+    if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
+    if (!deepEqual(aObj[key], bObj[key])) return false;
+  }
+  return true;
+}
+
 const CONFIG_SERVER_INIT_TIMEOUT_MS = (() => {
   const raw = process.env.MCP_INIT_TIMEOUT_MS;
   if (raw == null) {
@@ -26,6 +82,28 @@ const CONFIG_SERVER_INIT_TIMEOUT_MS = (() => {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 30_000;
 })();
 
+/** Request context for resolving the effective MCP allowlists. */
+export interface MCPAllowlistContext {
+  userId?: string;
+  role?: string;
+}
+
+/**
+ * Resolves the effective `mcpSettings` allowlists for a request. Injected from the app
+ * layer (where the merged, tenant-scoped config lives) so the registry keeps no app-config
+ * dependency. Reads the ALS tenant context internally; pass the acting user to also pick up
+ * user/role-scoped overrides.
+ */
+export type MCPAllowlistResolver = (
+  ctx?: MCPAllowlistContext,
+) => Promise<{ allowedDomains?: string[] | null; allowedAddresses?: string[] | null }>;
+
+/** Effective allowlists resolved for a request. */
+interface ResolvedMCPAllowlists {
+  allowedDomains?: string[] | null;
+  allowedAddresses?: string[] | null;
+}
+
 /**
  * Central registry for managing MCP server configurations.
  * Authoritative source of truth for all MCP servers provided by LibreChat.
@@ -35,16 +113,19 @@ const CONFIG_SERVER_INIT_TIMEOUT_MS = (() => {
  * - Config Cache (configCacheRepo): Admin-defined configs from Config overrides, lazily initialized
  * - DB Repository (dbConfigsRepo): User-provided configs created at runtime (MongoDB + ACL)
  *
- * Query priority: YAML cache → Config cache → DB.
+ * Query priority: Config cache → YAML cache → DB.
  */
 export class MCPServersRegistry {
   private static instance: MCPServersRegistry;
 
-  private readonly dbConfigsRepo: IServerConfigsRepositoryInterface;
+  private readonly dbConfigsRepo: ServerConfigsDB;
   private readonly cacheConfigsRepo: IServerConfigsRepositoryInterface;
   private readonly configCacheRepo: IServerConfigsRepositoryInterface;
+  /** YAML-derived base allowlists; used at boot and as the fallback when no resolver is set. */
   private readonly allowedDomains?: string[] | null;
   private readonly allowedAddresses?: string[] | null;
+  /** Resolves the per-request (tenant-scoped) merged allowlists; falls back to the base above. */
+  private readonly allowlistResolver?: MCPAllowlistResolver;
   private readonly readThroughCache: Keyv<t.ParsedServerConfig>;
   private readonly readThroughCacheAll: Keyv<Record<string, t.ParsedServerConfig>>;
   private readonly pendingGetAllPromises = new Map<
@@ -66,12 +147,14 @@ export class MCPServersRegistry {
     mongoose: typeof import('mongoose'),
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    allowlistResolver?: MCPAllowlistResolver,
   ) {
     this.dbConfigsRepo = new ServerConfigsDB(mongoose);
     this.cacheConfigsRepo = ServerConfigsCacheFactory.create(APP_CACHE_NAMESPACE, false);
     this.configCacheRepo = ServerConfigsCacheFactory.create(CONFIG_CACHE_NAMESPACE, false);
     this.allowedDomains = allowedDomains;
     this.allowedAddresses = allowedAddresses;
+    this.allowlistResolver = allowlistResolver;
 
     const ttl = cacheConfig.MCP_REGISTRY_CACHE_TTL;
 
@@ -91,6 +174,7 @@ export class MCPServersRegistry {
     mongoose: typeof import('mongoose'),
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    allowlistResolver?: MCPAllowlistResolver,
   ): MCPServersRegistry {
     if (!mongoose) {
       throw new Error(
@@ -107,6 +191,7 @@ export class MCPServersRegistry {
       mongoose,
       allowedDomains,
       allowedAddresses,
+      allowlistResolver,
     );
     return MCPServersRegistry.instance;
   }
@@ -119,10 +204,12 @@ export class MCPServersRegistry {
     return MCPServersRegistry.instance;
   }
 
+  /** YAML base allowlist (boot/fallback). For request-time decisions use {@link resolveAllowlists}. */
   public getAllowedDomains(): string[] | null | undefined {
     return this.allowedDomains;
   }
 
+  /** YAML base allowlist (boot/fallback). For request-time decisions use {@link resolveAllowlists}. */
   public getAllowedAddresses(): string[] | null | undefined {
     return this.allowedAddresses;
   }
@@ -133,58 +220,127 @@ export class MCPServersRegistry {
   }
 
   /**
-   * Returns the config for a single server. When `configServers` is provided, config-source
-   * servers are resolved from it directly (no global state, no cross-tenant race).
+   * Resolves the effective domain/address allowlists for the current request.
+   *
+   * MCP allowlists live in `mcpSettings`, which is tenant/principal-scoped admin config, so
+   * they must be read per-request from the merged config — not from a process-global value
+   * that would leak across tenants. The injected resolver reads the ALS tenant context; pass
+   * the acting user so user/role-scoped overrides resolve too (config-source inspection has no
+   * user and resolves at tenant scope). Falls back to the YAML base allowlists when no resolver
+   * is injected or the resolver fails, so a transient lookup error fails to the operator's
+   * baseline rather than disabling the allowlist.
+   */
+  public async resolveAllowlists(ctx?: MCPAllowlistContext): Promise<{
+    allowedDomains?: string[] | null;
+    allowedAddresses?: string[] | null;
+    useSSRFProtection: boolean;
+  }> {
+    let allowedDomains = this.allowedDomains;
+    let allowedAddresses = this.allowedAddresses;
+    if (this.allowlistResolver) {
+      try {
+        const resolved = await this.allowlistResolver(ctx);
+        allowedDomains = resolved.allowedDomains;
+        allowedAddresses = resolved.allowedAddresses;
+      } catch (error) {
+        logger.warn(
+          '[MCPServersRegistry] Allowlist resolver failed; falling back to YAML base allowlists',
+          error,
+        );
+      }
+    }
+    return {
+      allowedDomains,
+      allowedAddresses,
+      useSSRFProtection: !Array.isArray(allowedDomains) || allowedDomains.length === 0,
+    };
+  }
+
+  /**
+   * Returns the config for a single server, mirroring the precedence used by
+   * getAllServerConfigs so list views and single-server lookups agree on
+   * the same name:
+   *   1. user-tier base entry wins absolutely over a config-tier candidate
+   *   2. healthy YAML/DB base wins over a failed (inspectionFailed) candidate
+   *   3. healthy candidate overlays its fields onto the base, preserving the
+   *      base entry's source tag so downstream recovery routes correctly
+   *   4. with no base, the candidate is returned as-is (config-only server)
+   *
+   * readThroughCache memoizes only the global YAML/DB lookup; the per-call
+   * configServers candidate is tenant-scoped and is never cached, so a
+   * failed stub from one tenant can never satisfy a no-userId lookup from
+   * another.
    */
   public async getServerConfig(
     serverName: string,
     userId?: string,
     configServers?: Record<string, t.ParsedServerConfig>,
   ): Promise<t.ParsedServerConfig | undefined> {
-    if (configServers?.[serverName]) {
-      return configServers[serverName];
-    }
+    const candidate = configServers?.[serverName];
 
     const cacheKey = this.getReadThroughCacheKey(serverName, userId);
-
+    let base: t.ParsedServerConfig | undefined;
     if (await this.readThroughCache.has(cacheKey)) {
-      return await this.readThroughCache.get(cacheKey);
-    }
-
-    const configFromYaml = await this.cacheConfigsRepo.get(serverName);
-    if (configFromYaml) {
-      await this.readThroughCache.set(cacheKey, configFromYaml);
-      return configFromYaml;
+      base = await this.readThroughCache.get(cacheKey);
+    } else {
+      const configFromYaml = await this.cacheConfigsRepo.get(serverName);
+      if (configFromYaml) {
+        base = configFromYaml;
+      } else {
+        base = await this.dbConfigsRepo.get(serverName, userId);
+      }
+      await this.readThroughCache.set(cacheKey, base);
     }
 
-    const configFromDB = await this.dbConfigsRepo.get(serverName, userId);
-    await this.readThroughCache.set(cacheKey, configFromDB);
-    return configFromDB;
+    if (!candidate) return base;
+    if (base?.source === 'user') return base;
+    if (candidate.inspectionFailed) return base ?? candidate;
+    return base ? { ...candidate, source: base.source } : candidate;
   }
 
   /**
-   * Returns all server configs visible to the given user.
-   * YAML and Config tiers are mutually exclusive by design (`ensureConfigServers` filters
-   * YAML names), so the spread order only matters for User DB (highest priority) overriding both.
+   * Returns the full server config map after merging YAML cache, Config-tier overrides,
+   * and User-DB entries.
+   *
+   * Precedence (lowest to highest): YAML cache > Config-tier overrides (success only) > User DB.
+   * Two guards keep the merge safe:
+   *   1. Config-tier entries carrying `inspectionFailed: true` never overlay an existing
+   *      base entry; the healthy base is preserved for the duration of the retry window.
+   *   2. User-DB entries (`source: 'user'`) are never replaced by Config-tier overlays.
+   * On a successful overlay the base entry's `source` field is preserved so downstream
+   * recovery logic routes to the correct storage location.
    */
   public async getAllServerConfigs(
     userId?: string,
     configServers?: Record<string, t.ParsedServerConfig>,
+    role?: string,
   ): Promise<Record<string, t.ParsedServerConfig>> {
     if (configServers == null || !Object.keys(configServers).length) {
-      return this.getBaseServerConfigs(userId);
+      return this.getBaseServerConfigs(userId, role);
+    }
+    const base = await this.getBaseServerConfigs(userId, role);
+    const result: Record<string, t.ParsedServerConfig> = { ...base };
+    for (const [name, override] of Object.entries(configServers)) {
+      if (result[name]?.source === 'user') {
+        logger.debug(`[MCP][config][${name}] Admin override shadowed by user-tier entry`);
+        continue;
+      }
+      if (override.inspectionFailed && result[name]) continue;
+      const baseSource = result[name]?.source;
+      result[name] = baseSource ? { ...override, source: baseSource } : override;
     }
-    const base = await this.getBaseServerConfigs(userId);
-    return { ...configServers, ...base };
+    return result;
   }
 
   /**
    * Returns YAML + user-DB server configs, cached via `readThroughCacheAll`.
+   * YAML wins on name collisions so a user-created server cannot hide global config.
    * Always called by `getAllServerConfigs` so the DB query is amortized across
    * requests within the TTL window regardless of whether `configServers` is present.
    */
   private async getBaseServerConfigs(
     userId?: string,
+    role?: string,
   ): Promise<Record<string, t.ParsedServerConfig>> {
     const cacheKey = userId ?? '__no_user__';
 
@@ -197,7 +353,7 @@ export class MCPServersRegistry {
       return pending;
     }
 
-    const fetchPromise = this.fetchBaseServerConfigs(cacheKey, userId);
+    const fetchPromise = this.fetchBaseServerConfigs(cacheKey, userId, role);
     this.pendingGetAllPromises.set(cacheKey, fetchPromise);
 
     try {
@@ -210,11 +366,16 @@ export class MCPServersRegistry {
   private async fetchBaseServerConfigs(
     cacheKey: string,
     userId?: string,
+    role?: string,
   ): Promise<Record<string, t.ParsedServerConfig>> {
-    const result = {
-      ...(await this.cacheConfigsRepo.getAll()),
-      ...(await this.dbConfigsRepo.getAll(userId)),
-    };
+    const [dbConfigs, yamlConfigs] = await Promise.all([
+      this.dbConfigsRepo.getAll(userId, role),
+      this.cacheConfigsRepo.getAll(),
+    ]);
+
+    this.warnOnOperatorManagedNameCollisions(yamlConfigs, dbConfigs, 'YAML');
+
+    const result = { ...dbConfigs, ...yamlConfigs };
 
     await this.readThroughCacheAll.set(cacheKey, result);
     return result;
@@ -227,15 +388,14 @@ export class MCPServersRegistry {
   public async addServerStub(
     serverName: string,
     config: t.MCPOptions,
-    storageLocation: 'CACHE' | 'DB',
+    storageLocation: 'CACHE',
     userId?: string,
   ): Promise<t.AddServerResult> {
     const configRepo = this.getConfigRepository(storageLocation);
-    const source: t.MCPServerSource = storageLocation === 'CACHE' ? 'yaml' : 'user';
-    const stubConfig: t.ParsedServerConfig = { ...config, inspectionFailed: true, source };
+    const stubConfig: t.ParsedServerConfig = { ...config, inspectionFailed: true, source: 'yaml' };
     const result = await configRepo.add(serverName, stubConfig, userId);
-    await this.readThroughCache.delete(this.getReadThroughCacheKey(serverName, userId));
-    await this.readThroughCache.delete(this.getReadThroughCacheKey(serverName));
+    await this.invalidateServerReadCaches(result.serverName, userId);
+    this.resetYamlServerNamesMemo();
     return result;
   }
 
@@ -244,16 +404,20 @@ export class MCPServersRegistry {
     config: t.MCPOptions,
     storageLocation: 'CACHE' | 'DB',
     userId?: string,
+    reservedServerNames?: Iterable<string>,
   ): Promise<t.AddServerResult> {
     const configRepo = this.getConfigRepository(storageLocation);
+    const source = (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource;
+    const configForInspection = { ...config, source } as t.ParsedServerConfig;
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
-        config,
+        configForInspection,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Failed to inspect server "${serverName}":`, error);
@@ -264,9 +428,22 @@ export class MCPServersRegistry {
     }
     const tagged = {
       ...parsedConfig,
-      source: (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource,
+      source,
     };
-    return await configRepo.add(serverName, tagged, userId);
+    const result =
+      storageLocation === 'DB'
+        ? await this.dbConfigsRepo.add(
+            serverName,
+            tagged,
+            userId,
+            await this.getOperatorManagedServerNames(reservedServerNames),
+          )
+        : await configRepo.add(serverName, tagged, userId);
+    await this.invalidateServerReadCaches(result.serverName, userId);
+    if (storageLocation === 'CACHE') {
+      this.resetYamlServerNamesMemo();
+    }
+    return result;
   }
 
   /**
@@ -290,14 +467,15 @@ export class MCPServersRegistry {
     }
 
     const { inspectionFailed: _, ...configForInspection } = existing;
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
         configForInspection,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Reinspection failed for server "${serverName}":`, error);
@@ -309,10 +487,7 @@ export class MCPServersRegistry {
 
     const updatedConfig = { ...parsedConfig, updatedAt: Date.now() };
     await configRepo.update(serverName, updatedConfig, userId);
-    await this.readThroughCache.delete(this.getReadThroughCacheKey(serverName, userId));
-    await this.readThroughCache.delete(this.getReadThroughCacheKey(serverName));
-    // Full clear required: getAllServerConfigs is keyed by userId with no reverse index to enumerate cached keys
-    await this.readThroughCacheAll.clear();
+    await this.invalidateServerReadCaches(serverName, userId);
     return { serverName, config: updatedConfig };
   }
 
@@ -323,6 +498,7 @@ export class MCPServersRegistry {
     userId?: string,
   ): Promise<t.ParsedServerConfig> {
     const configRepo = this.getConfigRepository(storageLocation);
+    const source = (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource;
 
     // Merge existing admin API key if not provided in update (needed for inspection)
     let configForInspection = { ...config };
@@ -339,14 +515,15 @@ export class MCPServersRegistry {
       }
     }
 
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
-        configForInspection,
+        { ...configForInspection, source } as t.ParsedServerConfig,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Failed to inspect server "${serverName}":`, error);
@@ -356,6 +533,7 @@ export class MCPServersRegistry {
       throw new MCPInspectionFailedError(serverName, error as Error);
     }
     await configRepo.update(serverName, parsedConfig, userId);
+    await this.invalidateServerReadCaches(serverName, userId);
     return parsedConfig;
   }
 
@@ -374,20 +552,23 @@ export class MCPServersRegistry {
       return {};
     }
 
-    const yamlNames = await this.getYamlServerNames();
-    const configServerEntries = Object.entries(resolvedMcpConfig).filter(
-      ([name]) => !yamlNames.has(name),
-    );
+    const result: Record<string, t.ParsedServerConfig> = {};
 
-    if (configServerEntries.length === 0) {
-      return {};
-    }
+    // Config-source servers are admin-defined with no acting user; resolve the effective
+    // allowlists once at tenant scope and fold them into each config-cache key so a tenant
+    // whose allowlist rejects a URL cannot poison the shared key for a tenant that allows it.
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists();
+    const allowlists: ResolvedMCPAllowlists = { allowedDomains, allowedAddresses };
 
-    const result: Record<string, t.ParsedServerConfig> = {};
+    /** Single snapshot of the YAML cache for the whole pass: in the Redis aggregate-key backend, every per-name get() reads and deserializes the full map, so N concurrent per-server lookups would issue N full-map reads. The snapshot also keeps the unchanged-YAML comparison consistent against one view of YAML across all entries. */
+    const yamlSnapshot = await this.cacheConfigsRepo.getAll();
 
     const settled = await Promise.allSettled(
-      configServerEntries.map(async ([serverName, rawConfig]) => {
-        const parsed = await this.ensureSingleConfigServer(serverName, rawConfig);
+      Object.entries(resolvedMcpConfig).map(async ([serverName, rawConfig]) => {
+        if (this.isUnmodifiedYamlServer(yamlSnapshot, serverName, rawConfig)) {
+          return;
+        }
+        const parsed = await this.ensureSingleConfigServer(serverName, rawConfig, allowlists);
         if (parsed) {
           result[serverName] = parsed;
         }
@@ -402,6 +583,31 @@ export class MCPServersRegistry {
     return result;
   }
 
+  /**
+   * Returns true when `rawConfig` matches the YAML cache entry for this server
+   * on every admin-configurable field, so an unmodified YAML-defined server
+   * can skip lazy-init and avoid being re-inspected or shadowed in the
+   * config tier.
+   */
+  private isUnmodifiedYamlServer(
+    yamlSnapshot: Record<string, t.ParsedServerConfig>,
+    serverName: string,
+    rawConfig: t.MCPOptions,
+  ): boolean {
+    const yamlEntry = yamlSnapshot[serverName];
+    if (!yamlEntry || yamlEntry.source !== 'yaml') {
+      return false;
+    }
+    const yamlRecord = yamlEntry as unknown as Record<string, unknown>;
+    const rawRecord = rawConfig as unknown as Record<string, unknown>;
+    /** rawConfig is the pre-inspection MCPOptions; absent fields mean the admin didn't override and shouldn't count as a diff against inspector-derived values on the cached YAML entry. */
+    return ADMIN_CONFIGURABLE_FIELDS.every((field) => {
+      const rawVal = rawRecord[field];
+      if (rawVal === undefined) return true;
+      return deepEqual(yamlRecord[field], rawVal);
+    });
+  }
+
   /**
    * Ensures a single config-source server is initialized.
    * Cache key is scoped by config hash to prevent cross-tenant poisoning.
@@ -411,8 +617,9 @@ export class MCPServersRegistry {
   private async ensureSingleConfigServer(
     serverName: string,
     rawConfig: t.MCPOptions,
+    allowlists: ResolvedMCPAllowlists,
   ): Promise<t.ParsedServerConfig | undefined> {
-    const cacheKey = this.configCacheKey(serverName, rawConfig);
+    const cacheKey = this.configCacheKey(serverName, rawConfig, allowlists);
 
     const cached = await this.configCacheRepo.get(cacheKey);
     if (cached) {
@@ -429,7 +636,7 @@ export class MCPServersRegistry {
       return pending;
     }
 
-    const initPromise = this.lazyInitConfigServer(cacheKey, serverName, rawConfig);
+    const initPromise = this.lazyInitConfigServer(cacheKey, serverName, rawConfig, allowlists);
     this.pendingConfigInits.set(cacheKey, initPromise);
 
     try {
@@ -447,18 +654,24 @@ export class MCPServersRegistry {
     cacheKey: string,
     serverName: string,
     rawConfig: t.MCPOptions,
+    allowlists: ResolvedMCPAllowlists,
   ): Promise<t.ParsedServerConfig | undefined> {
     const prefix = `[MCP][config][${serverName}]`;
     logger.info(`${prefix} Lazy-initializing config-source server`);
 
     try {
+      const configForInspection = {
+        ...rawConfig,
+        source: 'config' as const,
+      } as t.ParsedServerConfig;
+      const { allowedDomains, allowedAddresses } = allowlists;
       const inspected = await withTimeout(
         MCPServerInspector.inspect(
           serverName,
-          rawConfig,
+          configForInspection,
           undefined,
-          this.allowedDomains,
-          this.allowedAddresses,
+          allowedDomains,
+          allowedAddresses,
         ),
         CONFIG_SERVER_INIT_TIMEOUT_MS,
         `${prefix} Server initialization timed out`,
@@ -512,12 +725,7 @@ export class MCPServersRegistry {
   public async invalidateConfigCache(): Promise<string[]> {
     const allCached = await this.configCacheRepo.getAll();
     const evictedNames = [
-      ...new Set(
-        Object.keys(allCached).map((key) => {
-          const lastColon = key.lastIndexOf(':');
-          return lastColon > 0 ? key.slice(0, lastColon) : key;
-        }),
-      ),
+      ...new Set(Object.keys(allCached).map((key) => this.parseServerNameFromConfigCacheKey(key))),
     ];
 
     await Promise.all([
@@ -550,8 +758,7 @@ export class MCPServersRegistry {
     await this.configCacheRepo.reset();
     await this.readThroughCache.clear();
     await this.readThroughCacheAll.clear();
-    this.yamlServerNames = null;
-    this.yamlServerNamesPromise = null;
+    this.resetYamlServerNamesMemo();
   }
 
   public async removeServer(
@@ -561,6 +768,10 @@ export class MCPServersRegistry {
   ): Promise<void> {
     const configRepo = this.getConfigRepository(storageLocation);
     await configRepo.remove(serverName, userId);
+    await this.invalidateServerReadCaches(serverName, userId);
+    if (storageLocation === 'CACHE') {
+      this.resetYamlServerNamesMemo();
+    }
   }
 
   private getConfigRepository(storageLocation: 'CACHE' | 'DB'): IServerConfigsRepositoryInterface {
@@ -580,6 +791,55 @@ export class MCPServersRegistry {
     return userId ? `${serverName}::${userId}` : serverName;
   }
 
+  private async invalidateServerReadCaches(serverName: string, userId?: string): Promise<void> {
+    const deletes = [
+      this.readThroughCache.delete(this.getReadThroughCacheKey(serverName)),
+      this.readThroughCacheAll.clear(),
+    ];
+
+    if (userId) {
+      deletes.push(this.readThroughCache.delete(this.getReadThroughCacheKey(serverName, userId)));
+    }
+
+    await Promise.all(deletes);
+  }
+
+  private async getOperatorManagedServerNames(
+    reservedServerNames: Iterable<string> = [],
+  ): Promise<string[]> {
+    const yamlNames = await this.getYamlServerNames();
+
+    return [...new Set([...yamlNames, ...reservedServerNames])];
+  }
+
+  private parseServerNameFromConfigCacheKey(cacheKey: string): string {
+    const lastColon = cacheKey.lastIndexOf(':');
+    return lastColon > 0 ? cacheKey.slice(0, lastColon) : cacheKey;
+  }
+
+  private warnOnOperatorManagedNameCollisions(
+    operatorConfigs: Record<string, t.ParsedServerConfig>,
+    candidateConfigs: Record<string, t.ParsedServerConfig>,
+    operatorSource: 'Config' | 'YAML',
+  ): void {
+    const shadowedNames = Object.keys(operatorConfigs).filter(
+      (serverName) => candidateConfigs[serverName]?.source === 'user',
+    );
+    if (!shadowedNames.length) {
+      return;
+    }
+
+    logger.warn(
+      `[MCPServersRegistry] ${operatorSource} MCP server(s) shadow DB-backed server(s) with colliding name(s): ` +
+        `${shadowedNames.join(', ')}. DB records remain stored but are hidden while operator-managed servers use these names.`,
+    );
+  }
+
+  private resetYamlServerNamesMemo(): void {
+    this.yamlServerNames = null;
+    this.yamlServerNamesPromise = null;
+  }
+
   /**
    * Returns memoized YAML server names. Populated lazily on first call after boot/reset.
    * YAML servers don't change after boot, so this avoids repeated `getAll()` calls.
@@ -607,12 +867,24 @@ export class MCPServersRegistry {
   }
 
   /**
-   * Produces a config-cache key scoped by server name AND a hash of the raw config.
-   * Prevents cross-tenant cache poisoning when two tenants define the same server name
-   * with different configurations.
+   * Produces a config-cache key scoped by server name AND a hash of the raw config plus the
+   * effective allowlists. Hashing the raw config prevents cross-tenant poisoning when two
+   * tenants define the same server name with different configurations; hashing the allowlists
+   * prevents poisoning when the same config resolves differently because tenants have different
+   * `mcpSettings.allowedDomains` / `allowedAddresses` (so one tenant's inspection result — e.g.
+   * an `inspectionFailed` stub from a rejected domain — never satisfies another tenant's lookup).
    */
-  private configCacheKey(serverName: string, rawConfig: t.MCPOptions): string {
-    const sorted = JSON.stringify(rawConfig, (_key, value: unknown) => {
+  private configCacheKey(
+    serverName: string,
+    rawConfig: t.MCPOptions,
+    allowlists?: ResolvedMCPAllowlists,
+  ): string {
+    const payload = {
+      rawConfig,
+      allowedDomains: allowlists?.allowedDomains ?? null,
+      allowedAddresses: allowlists?.allowedAddresses ?? null,
+    };
+    const sorted = JSON.stringify(payload, (_key, value: unknown) => {
       if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
         return Object.fromEntries(
           Object.entries(value as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b)),
diff --git a/packages/api/src/mcp/registry/ServerConfigsRepositoryInterface.ts b/packages/api/src/mcp/registry/ServerConfigsRepositoryInterface.ts
index 4bf0fdd615c..71eac64908e 100644
--- a/packages/api/src/mcp/registry/ServerConfigsRepositoryInterface.ts
+++ b/packages/api/src/mcp/registry/ServerConfigsRepositoryInterface.ts
@@ -1,7 +1,7 @@
 import { ParsedServerConfig, AddServerResult } from '~/mcp/types';
 
 /**
- * Interface for future DB implementation
+ * Contract for MCP server configuration storage, whether cache-backed or DB-backed.
  */
 export interface IServerConfigsRepositoryInterface {
   add(serverName: string, config: ParsedServerConfig, userId?: string): Promise<AddServerResult>;
@@ -19,7 +19,7 @@ export interface IServerConfigsRepositoryInterface {
   get(serverName: string, userId?: string): Promise<ParsedServerConfig | undefined>;
 
   //ACL Entry get all accessible mcp config definitions + any mcp configured with agents
-  getAll(userId?: string): Promise<Record<string, ParsedServerConfig>>;
+  getAll(userId?: string, role?: string): Promise<Record<string, ParsedServerConfig>>;
 
   reset(): Promise<void>;
 }
diff --git a/packages/api/src/mcp/registry/__tests__/MCPReinitRecovery.integration.test.ts b/packages/api/src/mcp/registry/__tests__/MCPReinitRecovery.integration.test.ts
index 9545486fde8..cd215024322 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPReinitRecovery.integration.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPReinitRecovery.integration.test.ts
@@ -16,8 +16,8 @@
  */
 
 import * as net from 'net';
-import * as http from 'http';
 import { Keyv } from 'keyv';
+import * as http from 'http';
 import { Agent } from 'undici';
 import { Types } from 'mongoose';
 import { randomUUID } from 'crypto';
@@ -46,6 +46,8 @@ jest.mock('@librechat/data-schemas', () => ({
 
 jest.mock('~/auth', () => ({
   createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
@@ -54,7 +56,13 @@ jest.mock('~/cluster', () => ({
 }));
 
 jest.mock('~/mcp/mcpConfig', () => ({
-  mcpConfig: { CONNECTION_CHECK_TTL: 0 },
+  mcpConfig: {
+    CONNECTION_CHECK_TTL: 0,
+    TOOLS_LIST_MAX_PAGES: 50,
+    TOOLS_LIST_MAX_TOOLS: 1000,
+    TOOLS_LIST_MAX_BYTES: 5 * 1024 * 1024,
+    TOOLS_LIST_TIMEOUT_MS: 30000,
+  },
 }));
 
 jest.mock('~/mcp/registry/db/ServerConfigsDB', () => ({
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
index 2012f82e314..f6af7b52b85 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
@@ -148,6 +148,97 @@ describe('MCPServerInspector', () => {
       expect(result.toolFunctions).toBeUndefined();
     });
 
+    it('should skip capabilities fetch when trusted config needs runtime user context', async () => {
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: false,
+        method: 'no-metadata-found',
+      });
+
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig);
+
+      expect(result).toEqual({
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+        requiresOAuth: false,
+        oauthMetadata: undefined,
+        initDuration: expect.any(Number),
+      });
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should skip OAuth detection when trusted URL needs runtime user context', async () => {
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig);
+
+      expect(result).toEqual({
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+        initDuration: expect.any(Number),
+      });
+      expect(mockDetectOAuthRequirement).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should skip capabilities fetch when obo is configured', async () => {
+      // OBO servers mint per-user delegated tokens at tool-call time; an
+      // unauthenticated probe at inspection has no valid bearer to attach,
+      // so the upstream rejects the MCP `initialize` handshake and the
+      // create/update fails with MCP_INSPECTION_FAILED. Treat `obo` as
+      // user-scoped auth alongside requiresOAuth and customUserVars.
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: false,
+        method: 'no-metadata-found',
+      });
+
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig, mockConnection);
+
+      expect(result.obo).toEqual({ scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' });
+      expect(result.requiresOAuth).toBe(false);
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+      expect(mockConnection.disconnect).not.toHaveBeenCalled();
+    });
+
+    it('should NOT create a temp connection when obo is configured and no connection is provided', async () => {
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: false,
+        method: 'no-metadata-found',
+      });
+
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig);
+
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+      expect(result.requiresOAuth).toBe(false);
+      expect(result.capabilities).toBeUndefined();
+      expect(result.toolFunctions).toBeUndefined();
+    });
+
     it('should keep custom serverInstructions string and not fetch from server', async () => {
       const rawConfig: t.MCPOptions = {
         type: 'stdio',
@@ -285,7 +376,7 @@ describe('MCPServerInspector', () => {
       });
 
       // Mock server with no tools
-      mockConnection.client.listTools = jest.fn().mockResolvedValue({ tools: [] });
+      mockConnection.fetchTools = jest.fn().mockResolvedValue([]);
 
       const result = await MCPServerInspector.inspect('test_server', rawConfig, mockConnection);
 
@@ -371,29 +462,27 @@ describe('MCPServerInspector', () => {
 
   describe('getToolFunctions()', () => {
     it('should convert MCP tools to LibreChat tool functions format', async () => {
-      mockConnection.client.listTools = jest.fn().mockResolvedValue({
-        tools: [
-          {
-            name: 'file_read',
-            description: 'Read a file',
-            inputSchema: {
-              type: 'object',
-              properties: { path: { type: 'string' } },
-            },
+      mockConnection.fetchTools = jest.fn().mockResolvedValue([
+        {
+          name: 'file_read',
+          description: 'Read a file',
+          inputSchema: {
+            type: 'object',
+            properties: { path: { type: 'string' } },
           },
-          {
-            name: 'file_write',
-            description: 'Write a file',
-            inputSchema: {
-              type: 'object',
-              properties: {
-                path: { type: 'string' },
-                content: { type: 'string' },
-              },
+        },
+        {
+          name: 'file_write',
+          description: 'Write a file',
+          inputSchema: {
+            type: 'object',
+            properties: {
+              path: { type: 'string' },
+              content: { type: 'string' },
             },
           },
-        ],
-      });
+        },
+      ]);
 
       const result = await MCPServerInspector.getToolFunctions('my_server', mockConnection);
 
@@ -427,7 +516,7 @@ describe('MCPServerInspector', () => {
     });
 
     it('should handle empty tools list', async () => {
-      mockConnection.client.listTools = jest.fn().mockResolvedValue({ tools: [] });
+      mockConnection.fetchTools = jest.fn().mockResolvedValue([]);
 
       const result = await MCPServerInspector.getToolFunctions('my_server', mockConnection);
 
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
index 12d2c9091fc..11b7d0cbb96 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
@@ -1,6 +1,8 @@
-import type * as t from '~/mcp/types';
-import type { MCPConnection } from '~/mcp/connection';
 import type { MCPServersRegistry as MCPServersRegistryType } from '../MCPServersRegistry';
+import type { RedisClientsModule } from '~/cache/__tests__/redisClients.helper';
+import type { MCPConnection } from '~/mcp/connection';
+import type * as t from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 // Mock isLeader to always return true to avoid lock contention during parallel operations
 jest.mock('~/cluster', () => ({
@@ -28,6 +30,7 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
   let MCPServerInspector: typeof import('../MCPServerInspector').MCPServerInspector;
   let MCPConnectionFactory: typeof import('~/mcp/MCPConnectionFactory').MCPConnectionFactory;
   let keyvRedisClient: Awaited<typeof import('~/cache/redisClients')>['keyvRedisClient'];
+  let redisClientsModule: RedisClientsModule;
   let LeaderElection: typeof import('~/cluster/LeaderElection').LeaderElection;
   let leaderInstance: InstanceType<typeof import('~/cluster/LeaderElection').LeaderElection>;
 
@@ -146,6 +149,7 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
     MCPServerInspector = inspectorModule.MCPServerInspector;
     MCPConnectionFactory = connectionFactoryModule.MCPConnectionFactory;
     keyvRedisClient = redisClients.keyvRedisClient;
+    redisClientsModule = redisClients;
     LeaderElection = leaderElectionModule.LeaderElection;
 
     // Reset singleton and create new instance with mongoose
@@ -232,8 +236,9 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients; pass the captured module since
+    // `jest.resetModules()` in beforeEach dropped it from the registry
+    await closeRedisClients(redisClientsModule);
   });
 
   describe('initialize()', () => {
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
index dd372744e06..8964c15c194 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
@@ -1,11 +1,12 @@
 import { logger } from '@librechat/data-schemas';
-import * as t from '~/mcp/types';
 import { registryStatusCache } from '~/mcp/registry/cache/RegistryStatusCache';
 import { MCPServersInitializer } from '~/mcp/registry/MCPServersInitializer';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { MCPConnection } from '~/mcp/connection';
+import { isLeader } from '~/cluster';
+import * as t from '~/mcp/types';
 
 const FIXED_TIME = 1699564800000;
 const originalDateNow = Date.now;
@@ -47,6 +48,33 @@ const mockInspect = MCPServerInspector.inspect as jest.MockedFunction<
   typeof MCPServerInspector.inspect
 >;
 
+const withFollowerWaitEnv = async (
+  retryMs: string,
+  maxWaitMs: string,
+  callback: () => Promise<void>,
+): Promise<void> => {
+  const originalRetryMs = process.env.MCP_INIT_FOLLOWER_RETRY_MS;
+  const originalMaxWaitMs = process.env.MCP_INIT_FOLLOWER_MAX_WAIT_MS;
+  process.env.MCP_INIT_FOLLOWER_RETRY_MS = retryMs;
+  process.env.MCP_INIT_FOLLOWER_MAX_WAIT_MS = maxWaitMs;
+
+  try {
+    await callback();
+  } finally {
+    if (originalRetryMs == null) {
+      delete process.env.MCP_INIT_FOLLOWER_RETRY_MS;
+    } else {
+      process.env.MCP_INIT_FOLLOWER_RETRY_MS = originalRetryMs;
+    }
+
+    if (originalMaxWaitMs == null) {
+      delete process.env.MCP_INIT_FOLLOWER_MAX_WAIT_MS;
+    } else {
+      process.env.MCP_INIT_FOLLOWER_MAX_WAIT_MS = originalMaxWaitMs;
+    }
+  }
+};
+
 describe('MCPServersInitializer', () => {
   let mockConnection: jest.Mocked<MCPConnection>;
   let registry: MCPServersRegistry;
@@ -184,6 +212,7 @@ describe('MCPServersInitializer', () => {
     await registry.reset();
     MCPServersInitializer.resetProcessFlag();
     jest.clearAllMocks();
+    (isLeader as jest.MockedFunction<typeof isLeader>).mockResolvedValue(true);
   });
 
   afterEach(() => {
@@ -221,6 +250,115 @@ describe('MCPServersInitializer', () => {
       expect(mockInspect).not.toHaveBeenCalled();
     });
 
+    it('should re-initialize when the shared initialized status belongs to a different config', async () => {
+      await MCPServersInitializer.initialize(testConfigs);
+      expect(await registryStatusCache.isInitialized()).toBe(true);
+      const firstConfigHash = await registryStatusCache.getInitializedConfigHash();
+
+      const updatedConfigs: t.MCPServers = {
+        ...testConfigs,
+        new_server: {
+          type: 'stdio',
+          command: 'node',
+          args: ['new-server.js'],
+        },
+      };
+
+      jest.clearAllMocks();
+
+      await MCPServersInitializer.initialize(updatedConfigs);
+
+      expect(mockInspect).toHaveBeenCalledTimes(6);
+      expect(await registry.getServerConfig('new_server')).toBeDefined();
+      expect(await registryStatusCache.getInitializedConfigHash()).not.toBe(firstConfigHash);
+    });
+
+    it('should not let a follower accept stale initialized status from another config', async () => {
+      await MCPServersInitializer.initialize(testConfigs);
+
+      const updatedConfigs: t.MCPServers = {
+        ...testConfigs,
+        new_server: {
+          type: 'stdio',
+          command: 'node',
+          args: ['new-server.js'],
+        },
+      };
+      const mockIsLeader = isLeader as jest.MockedFunction<typeof isLeader>;
+      mockIsLeader.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
+
+      jest.clearAllMocks();
+
+      await withFollowerWaitEnv('1', '50', async () => {
+        await MCPServersInitializer.initialize(updatedConfigs);
+      });
+
+      expect(mockInspect).toHaveBeenCalledTimes(6);
+      expect(mockIsLeader.mock.calls.length).toBeGreaterThanOrEqual(2);
+      expect(await registry.getServerConfig('new_server')).toBeDefined();
+    });
+
+    it('should initialize locally when a stale follower wait is exhausted', async () => {
+      await MCPServersInitializer.initialize(testConfigs);
+
+      const updatedConfigs: t.MCPServers = {
+        ...testConfigs,
+        new_server: {
+          type: 'stdio',
+          command: 'node',
+          args: ['new-server.js'],
+        },
+      };
+      const mockIsLeader = isLeader as jest.MockedFunction<typeof isLeader>;
+      mockIsLeader.mockResolvedValue(false);
+
+      jest.clearAllMocks();
+
+      await withFollowerWaitEnv('1', '1', async () => {
+        await MCPServersInitializer.initialize(updatedConfigs);
+      });
+
+      expect(mockInspect).toHaveBeenCalledTimes(6);
+      expect(mockIsLeader).toHaveBeenCalled();
+      expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('Timed out waiting'));
+      expect(await registry.getServerConfig('new_server')).toBeDefined();
+    });
+
+    it('should ignore invalid follower max wait env values', async () => {
+      await MCPServersInitializer.initialize(testConfigs);
+
+      const updatedConfigs: t.MCPServers = {
+        ...testConfigs,
+        new_server: {
+          type: 'stdio',
+          command: 'node',
+          args: ['new-server.js'],
+        },
+      };
+      const mockIsLeader = isLeader as jest.MockedFunction<typeof isLeader>;
+      mockIsLeader.mockResolvedValue(false);
+      const originalInitTimeoutMs = process.env.MCP_INIT_TIMEOUT_MS;
+      process.env.MCP_INIT_TIMEOUT_MS = '1';
+
+      jest.clearAllMocks();
+
+      try {
+        await withFollowerWaitEnv('1', 'not-a-number', async () => {
+          await MCPServersInitializer.initialize(updatedConfigs);
+        });
+      } finally {
+        if (originalInitTimeoutMs == null) {
+          delete process.env.MCP_INIT_TIMEOUT_MS;
+        } else {
+          process.env.MCP_INIT_TIMEOUT_MS = originalInitTimeoutMs;
+        }
+      }
+
+      expect(mockInspect).toHaveBeenCalledTimes(6);
+      expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('Timed out waiting'));
+      expect(await registry.getServerConfig('new_server')).toBeDefined();
+    });
+
     it('should process all server configs through inspector', async () => {
       await MCPServersInitializer.initialize(testConfigs);
 
@@ -229,35 +367,35 @@ describe('MCPServersInitializer', () => {
       expect(mockInspect).toHaveBeenCalledTimes(5);
       expect(mockInspect).toHaveBeenCalledWith(
         'disabled_server',
-        testConfigs.disabled_server,
+        { ...testConfigs.disabled_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'oauth_server',
-        testConfigs.oauth_server,
+        { ...testConfigs.oauth_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'file_tools_server',
-        testConfigs.file_tools_server,
+        { ...testConfigs.file_tools_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'search_tools_server',
-        testConfigs.search_tools_server,
+        { ...testConfigs.search_tools_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'remote_no_oauth_server',
-        testConfigs.remote_no_oauth_server,
+        { ...testConfigs.remote_no_oauth_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
@@ -320,6 +458,17 @@ describe('MCPServersInitializer', () => {
       );
     });
 
+    it('should not log raw server instructions', async () => {
+      await MCPServersInitializer.initialize(testConfigs);
+
+      expect(mockLogger.info).not.toHaveBeenCalledWith(
+        expect.stringContaining('Instructions for file_tools_server'),
+      );
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('[MCP][file_tools_server] Server Instructions: configured'),
+      );
+    });
+
     it('should use Promise.allSettled for parallel server initialization', async () => {
       const allSettledSpy = jest.spyOn(Promise, 'allSettled');
 
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
index 7752ff57d22..7b77a064b89 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
@@ -1,6 +1,7 @@
 import { expect } from '@playwright/test';
-import type * as t from '~/mcp/types';
 import type { MCPServersRegistry as MCPServersRegistryType } from '../MCPServersRegistry';
+import type * as t from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 // Mock ServerConfigsDB to avoid needing MongoDB for cache integration tests
 jest.mock('../db/ServerConfigsDB', () => ({
@@ -137,8 +138,8 @@ describe('MCPServersRegistry Redis Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   // Tests for the old privateServersCache API have been removed
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
index a20c09705ff..cf0b18a7392 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
@@ -1,3 +1,4 @@
+import { logger } from '@librechat/data-schemas';
 import type * as t from '~/mcp/types';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
@@ -10,7 +11,10 @@ jest.mock('~/mcp/registry/db/ServerConfigsDB', () => ({
   ServerConfigsDB: jest.fn().mockImplementation(() => ({
     get: jest.fn().mockResolvedValue(undefined),
     getAll: jest.fn().mockResolvedValue({}),
-    add: jest.fn().mockResolvedValue(undefined),
+    add: jest.fn().mockImplementation(async (serverName: string, config: t.ParsedServerConfig) => ({
+      serverName,
+      config,
+    })),
     update: jest.fn().mockResolvedValue(undefined),
     remove: jest.fn().mockResolvedValue(undefined),
     reset: jest.fn().mockResolvedValue(undefined),
@@ -99,6 +103,229 @@ describe('MCPServersRegistry', () => {
       expect(configs).toHaveProperty('app_server');
       expect(configs).toHaveProperty('user_server');
     });
+
+    it('should keep YAML servers authoritative when a DB server has the same name', async () => {
+      const warnSpy = jest.spyOn(logger, 'warn').mockImplementation();
+      const yamlConfig = { ...testParsedConfig, source: 'yaml' as const, title: 'YAML Slack' };
+      const dbConfig = { ...testParsedConfig, source: 'user' as const, title: 'User Slack' };
+      await registry['cacheConfigsRepo'].add('slack', yamlConfig);
+      jest.spyOn(registry['dbConfigsRepo'], 'getAll').mockResolvedValue({
+        slack: dbConfig,
+        user_server: dbConfig,
+      });
+
+      try {
+        const configs = await registry.getAllServerConfigs('user-1');
+
+        expect(configs.slack).toMatchObject({ source: 'yaml', title: 'YAML Slack' });
+        expect(configs.user_server).toMatchObject({ source: 'user', title: 'User Slack' });
+      } finally {
+        warnSpy.mockRestore();
+      }
+    });
+
+    it('should warn when operator-managed servers shadow DB servers', async () => {
+      const warnSpy = jest.spyOn(logger, 'warn').mockImplementation();
+      const yamlConfig = { ...testParsedConfig, source: 'yaml' as const, title: 'YAML Slack' };
+      const dbConfig = { ...testParsedConfig, source: 'user' as const, title: 'User Slack' };
+      await registry['cacheConfigsRepo'].add('slack', yamlConfig);
+      jest.spyOn(registry['dbConfigsRepo'], 'getAll').mockResolvedValue({ slack: dbConfig });
+
+      try {
+        await registry.getAllServerConfigs('user-1');
+
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('slack'));
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('shadow DB-backed server'));
+      } finally {
+        warnSpy.mockRestore();
+      }
+    });
+
+    it('should preserve the user-tier entry over a config-tier override on the same name without emitting a misleading shadow warning', async () => {
+      const warnSpy = jest.spyOn(logger, 'warn').mockImplementation();
+      const configServer = {
+        ...testParsedConfig,
+        source: 'config' as const,
+        title: 'Config Slack',
+      };
+      const dbConfig = { ...testParsedConfig, source: 'user' as const, title: 'User Slack' };
+      jest.spyOn(registry['dbConfigsRepo'], 'getAll').mockResolvedValue({ slack: dbConfig });
+
+      try {
+        const result = await registry.getAllServerConfigs('user-1', { slack: configServer });
+
+        expect(result.slack.source).toBe('user');
+        expect(result.slack.title).toBe('User Slack');
+        expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('Config MCP server'));
+      } finally {
+        warnSpy.mockRestore();
+      }
+    });
+  });
+
+  describe('addServer', () => {
+    it('should pass user source to inspector before storing DB servers', async () => {
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+
+      await registry.addServer(
+        'user_runtime_server',
+        {
+          type: 'streamable-http',
+          url: 'https://api.example.com/mcp',
+          headers: {
+            'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+          },
+        },
+        'DB',
+        'user-1',
+      );
+
+      expect(inspectSpy).toHaveBeenCalledWith(
+        'user_runtime_server',
+        expect.objectContaining({
+          source: 'user',
+          headers: {
+            'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+          },
+        }),
+        undefined,
+        undefined,
+        undefined,
+      );
+    });
+
+    it('should reserve YAML and current config server names when creating DB servers', async () => {
+      await registry.addServer('slack', { ...testParsedConfig, title: 'Slack' }, 'CACHE');
+      await registry['configCacheRepo'].upsert('other_tenant:hash', {
+        ...testParsedConfig,
+        source: 'config',
+        title: 'Other Tenant Server',
+      });
+      const dbAddSpy = jest.spyOn(registry['dbConfigsRepo'], 'add').mockResolvedValue({
+        serverName: 'slack-2',
+        config: { ...testParsedConfig, source: 'user', title: 'Slack' },
+      });
+
+      await registry.addServer(
+        'temp_server_name',
+        { ...testParsedConfig, title: 'Slack' },
+        'DB',
+        'user-1',
+        ['config_slack'],
+      );
+
+      const reservedServerNames = Array.from(dbAddSpy.mock.calls[0]?.[3] ?? []);
+      expect(reservedServerNames).toEqual(expect.arrayContaining(['slack', 'config_slack']));
+      expect(reservedServerNames).not.toContain('other_tenant');
+    });
+  });
+
+  describe('resolveAllowlists (per-request, tenant-scoped)', () => {
+    const createWith = (
+      allowedDomains?: string[] | null,
+      allowedAddresses?: string[] | null,
+      resolver?: (ctx?: { userId?: string; role?: string }) => Promise<{
+        allowedDomains?: string[] | null;
+        allowedAddresses?: string[] | null;
+      }>,
+    ): MCPServersRegistry => {
+      (MCPServersRegistry as unknown as { instance: undefined }).instance = undefined;
+      MCPServersRegistry.createInstance(mockMongoose, allowedDomains, allowedAddresses, resolver);
+      return MCPServersRegistry.getInstance();
+    };
+
+    it('returns the YAML base allowlists when no resolver is injected', async () => {
+      const reg = createWith(['yaml.com'], ['10.0.0.0/8']);
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: ['yaml.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+        useSSRFProtection: false,
+      });
+    });
+
+    it('enables SSRF protection when the effective allowlist is empty', async () => {
+      const reg = createWith(undefined, undefined);
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: undefined,
+        allowedAddresses: undefined,
+        useSSRFProtection: true,
+      });
+    });
+
+    it('returns the resolver-provided merged allowlists and forwards the context', async () => {
+      const resolver = jest.fn().mockResolvedValue({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['172.16.0.0/12'],
+      });
+      const reg = createWith(['yaml.com'], null, resolver);
+
+      const result = await reg.resolveAllowlists({ userId: 'u1', role: 'ADMIN' });
+
+      expect(resolver).toHaveBeenCalledWith({ userId: 'u1', role: 'ADMIN' });
+      expect(result).toEqual({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['172.16.0.0/12'],
+        useSSRFProtection: false,
+      });
+    });
+
+    it('falls back to the YAML base allowlists when the resolver throws', async () => {
+      const resolver = jest.fn().mockRejectedValue(new Error('DB down'));
+      const reg = createWith(['yaml.com'], null, resolver);
+
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: ['yaml.com'],
+        allowedAddresses: null,
+        useSSRFProtection: false,
+      });
+    });
+
+    it('inspects against the resolved (admin-panel) allowlist, not the YAML base', async () => {
+      const resolver = jest.fn().mockResolvedValue({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+      });
+      const reg = createWith(['yaml-only.com'], null, resolver);
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      await reg.reset();
+
+      await reg.addServer(
+        'admin_panel_server',
+        { type: 'streamable-http', url: 'https://admin-added.com/mcp' },
+        'DB',
+        'user-1',
+      );
+
+      expect(resolver).toHaveBeenCalledWith({ userId: 'user-1' });
+      expect(inspectSpy).toHaveBeenCalledWith(
+        'admin_panel_server',
+        expect.objectContaining({ url: 'https://admin-added.com/mcp' }),
+        undefined,
+        ['admin-added.com'],
+        ['10.0.0.0/8'],
+      );
+    });
+
+    it('scopes the config-source cache key by the resolved allowlist (no cross-tenant poison)', async () => {
+      const resolver = jest
+        .fn()
+        .mockResolvedValueOnce({ allowedDomains: ['a.com'], allowedAddresses: null })
+        .mockResolvedValueOnce({ allowedDomains: ['b.com'], allowedAddresses: null });
+      const reg = createWith(null, null, resolver);
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      await reg.reset();
+      inspectSpy.mockClear();
+
+      const cfg = {
+        srv: { type: 'streamable-http' as const, url: 'https://srv.example.com/mcp' },
+      };
+      await reg.ensureConfigServers(cfg); // resolver call 1 → allowlist A
+      await reg.ensureConfigServers(cfg); // resolver call 2 → allowlist B (distinct key)
+
+      // Different resolved allowlists ⇒ different cache keys ⇒ the second pass re-inspects
+      // instead of reusing the first allowlist's cached entry.
+      expect(inspectSpy).toHaveBeenCalledTimes(2);
+    });
   });
 
   describe('reset', () => {
@@ -314,4 +541,315 @@ describe('MCPServersRegistry', () => {
       });
     });
   });
+
+  describe('admin-panel overrides for YAML-defined servers', () => {
+    const yamlLangfuseConfig = Object.freeze({
+      type: 'streamable-http',
+      url: 'https://langfuse.com/api/public/mcp',
+      requiresOAuth: false,
+      source: 'yaml',
+      updatedAt: FIXED_TIME,
+    }) as t.ParsedServerConfig;
+
+    it('flows config-tier override on a YAML-defined server through to getAllServerConfigs', async () => {
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlLangfuseConfig);
+
+      const overrideRawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        iconPath: 'https://example.com/icon.svg',
+      };
+
+      const configServers = await registry.ensureConfigServers({
+        'langfuse-docs': overrideRawConfig,
+      });
+
+      expect(configServers['langfuse-docs']).toBeDefined();
+      expect(configServers['langfuse-docs'].iconPath).toBe('https://example.com/icon.svg');
+
+      const result = await registry.getAllServerConfigs('user-1', configServers);
+
+      expect(result['langfuse-docs']).toBeDefined();
+      expect(result['langfuse-docs'].iconPath).toBe('https://example.com/icon.svg');
+      expect(result['langfuse-docs'].source).toBe('yaml');
+    });
+
+    it('preserves user-DB tier (source: "user") over config-tier overrides', async () => {
+      const userDbEntry: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://user-defined.example.com/mcp',
+        requiresOAuth: false,
+        source: 'user',
+        dbId: 'user-db-id-123',
+        updatedAt: FIXED_TIME,
+      };
+
+      jest
+        .spyOn(registry['dbConfigsRepo'], 'getAll')
+        .mockResolvedValue({ 'shared-server': userDbEntry });
+
+      const configTierOverride: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://admin-override.example.com/mcp',
+        requiresOAuth: false,
+        source: 'config',
+        iconPath: 'https://example.com/admin-icon.svg',
+        updatedAt: FIXED_TIME,
+      };
+
+      const result = await registry.getAllServerConfigs('user-1', {
+        'shared-server': configTierOverride,
+      });
+
+      expect(result['shared-server']).toBeDefined();
+      expect(result['shared-server'].source).toBe('user');
+      expect(result['shared-server'].url).toBe('https://user-defined.example.com/mcp');
+      expect(result['shared-server'].dbId).toBe('user-db-id-123');
+    });
+
+    it('still runs lazy-init for pure config-tier servers not present in YAML', async () => {
+      const configOnlyRawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://config-only.example.com/mcp',
+        requiresOAuth: false,
+        iconPath: 'https://example.com/config-only-icon.svg',
+      };
+
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      inspectSpy.mockClear();
+
+      const result = await registry.ensureConfigServers({
+        'config-only-server': configOnlyRawConfig,
+      });
+
+      expect(inspectSpy).toHaveBeenCalledTimes(1);
+      expect(inspectSpy).toHaveBeenCalledWith(
+        'config-only-server',
+        {
+          ...configOnlyRawConfig,
+          source: 'config',
+        },
+        undefined,
+        undefined,
+        undefined,
+      );
+      expect(result['config-only-server']).toBeDefined();
+      expect(result['config-only-server'].iconPath).toBe(
+        'https://example.com/config-only-icon.svg',
+      );
+      expect(result['config-only-server'].source).toBe('config');
+    });
+
+    it('preserves YAML base entry when config-tier override reports inspectionFailed', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        headers: { Authorization: 'Bearer yaml-token' },
+        source: 'yaml',
+        tools: 'yaml_tool_a, yaml_tool_b',
+        capabilities: '{"tools":{"listChanged":true}}',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const failedOverride: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'config',
+        inspectionFailed: true,
+        updatedAt: FIXED_TIME,
+      };
+
+      const result = await registry.getAllServerConfigs('user-1', {
+        'langfuse-docs': failedOverride,
+      });
+
+      expect(result['langfuse-docs']).toBeDefined();
+      expect(result['langfuse-docs'].source).toBe('yaml');
+      expect(result['langfuse-docs'].inspectionFailed).toBeUndefined();
+      expect(result['langfuse-docs'].tools).toBe('yaml_tool_a, yaml_tool_b');
+      expect(result['langfuse-docs'].capabilities).toBe('{"tools":{"listChanged":true}}');
+      expect((result['langfuse-docs'] as t.StreamableHTTPOptions).headers).toEqual({
+        Authorization: 'Bearer yaml-token',
+      });
+    });
+
+    it('healthy YAML entry survives end-to-end when inspect throws for YAML server', async () => {
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlLangfuseConfig);
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      inspectSpy.mockClear();
+      inspectSpy.mockRejectedValueOnce(new Error('network timeout'));
+
+      const configServers = await registry.ensureConfigServers({
+        'langfuse-docs': {
+          type: 'streamable-http',
+          url: 'https://langfuse.com/api/public/mcp',
+          iconPath: 'https://example.com/icon.svg',
+        } as t.MCPOptions,
+      });
+      const result = await registry.getAllServerConfigs('user-1', configServers);
+
+      expect(result['langfuse-docs'].source).toBe('yaml');
+      expect(result['langfuse-docs'].inspectionFailed).toBeUndefined();
+      expect(result['langfuse-docs'].url).toBe('https://langfuse.com/api/public/mcp');
+    });
+
+    it('preserves YAML source tag when config-tier override succeeds', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'yaml',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const successfulOverride: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'config',
+        iconPath: 'https://example.com/icon.svg',
+        updatedAt: FIXED_TIME,
+      };
+
+      const result = await registry.getAllServerConfigs('user-1', {
+        'langfuse-docs': successfulOverride,
+      });
+
+      expect(result['langfuse-docs']).toBeDefined();
+      expect(result['langfuse-docs'].source).toBe('yaml');
+      expect(result['langfuse-docs'].iconPath).toBe('https://example.com/icon.svg');
+    });
+
+    it('skips lazy-init for YAML server with no admin override', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'yaml',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const yamlRawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+      };
+
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      inspectSpy.mockClear();
+
+      const result = await registry.ensureConfigServers({
+        'langfuse-docs': yamlRawConfig,
+      });
+
+      expect(inspectSpy).not.toHaveBeenCalled();
+      expect(result['langfuse-docs']).toBeUndefined();
+    });
+
+    it('runs lazy-init for YAML server with admin override', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'yaml',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const overrideRawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        iconPath: 'https://x.com/icon.svg',
+      };
+
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      inspectSpy.mockClear();
+
+      await registry.ensureConfigServers({
+        'langfuse-docs': overrideRawConfig,
+      });
+
+      expect(inspectSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it('getServerConfig falls through to YAML on failure stub', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'yaml',
+        tools: 'yaml_tool_a',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const failureStub: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        source: 'config',
+        inspectionFailed: true,
+        updatedAt: FIXED_TIME,
+      };
+
+      const result = await registry.getServerConfig('langfuse-docs', 'user-1', {
+        'langfuse-docs': failureStub,
+      });
+
+      expect(result).toBeDefined();
+      expect(result?.source).toBe('yaml');
+      expect(result?.inspectionFailed).toBeUndefined();
+      expect(result?.tools).toBe('yaml_tool_a');
+    });
+
+    it('passes a fully merged config to lazy-init when override only adds new fields', async () => {
+      const yamlSeed: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        headers: { Authorization: 'Bearer yaml-token' },
+        source: 'yaml',
+        updatedAt: FIXED_TIME,
+      };
+      await registry['cacheConfigsRepo'].add('langfuse-docs', yamlSeed);
+
+      const mergedRawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://langfuse.com/api/public/mcp',
+        requiresOAuth: false,
+        headers: { Authorization: 'Bearer yaml-token' },
+        iconPath: 'https://example.com/icon.svg',
+      };
+
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      inspectSpy.mockClear();
+
+      const result = await registry.ensureConfigServers({
+        'langfuse-docs': mergedRawConfig,
+      });
+
+      expect(inspectSpy).toHaveBeenCalledTimes(1);
+      const firstCallArgs = inspectSpy.mock.calls[0];
+      expect(firstCallArgs[0]).toBe('langfuse-docs');
+      const passedConfig = firstCallArgs[1] as t.StreamableHTTPOptions & {
+        iconPath?: string;
+        requiresOAuth?: boolean;
+      };
+      expect(passedConfig.type).toBe('streamable-http');
+      expect(passedConfig.url).toBe('https://langfuse.com/api/public/mcp');
+      expect(passedConfig.requiresOAuth).toBe(false);
+      expect(passedConfig.headers).toEqual({ Authorization: 'Bearer yaml-token' });
+      expect(passedConfig.iconPath).toBe('https://example.com/icon.svg');
+
+      expect(result['langfuse-docs']).toBeDefined();
+      expect(result['langfuse-docs'].iconPath).toBe('https://example.com/icon.svg');
+    });
+  });
 });
diff --git a/packages/api/src/mcp/registry/__tests__/ServerConfigsDB.test.ts b/packages/api/src/mcp/registry/__tests__/ServerConfigsDB.test.ts
index 38ed51cd997..af0141ee8e5 100644
--- a/packages/api/src/mcp/registry/__tests__/ServerConfigsDB.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/ServerConfigsDB.test.ts
@@ -124,6 +124,13 @@ describe('ServerConfigsDB', () => {
       expect(result.config.dbId).toBeDefined();
     });
 
+    it('should reserve operator-managed server names when creating a DB server', async () => {
+      const config = createSSEConfig('My Test Server', 'A test server');
+      const result = await serverConfigsDB.add('temp-name', config, userId, ['my-test-server']);
+
+      expect(result.serverName).toBe('my-test-server-2');
+    });
+
     it('should grant owner ACL to the user', async () => {
       const config = createSSEConfig('ACL Test Server');
       const result = await serverConfigsDB.add('temp-name', config, userId);
@@ -963,6 +970,17 @@ describe('ServerConfigsDB', () => {
     });
 
     describe('user access', () => {
+      it('should reuse resolved principals for direct and agent access lookups', async () => {
+        const findByIdSpy = jest.spyOn(mongoose.models.User, 'findById');
+
+        try {
+          await serverConfigsDB.getAll(userId, 'USER');
+          expect(findByIdSpy).toHaveBeenCalledTimes(1);
+        } finally {
+          findByIdSpy.mockRestore();
+        }
+      });
+
       it('should return servers directly accessible by user', async () => {
         const config1 = createSSEConfig('User Server 1');
         const config2 = createSSEConfig('User Server 2');
@@ -1296,6 +1314,34 @@ describe('ServerConfigsDB', () => {
       expect(typeof created.config.updatedAt).toBe('number');
       expect(created.config.updatedAt).toBeLessThanOrEqual(Date.now());
     });
+
+    it('should strip admin-only OAuth audience fields from existing DB-backed user configs', async () => {
+      const config = createSSEConfig('Legacy Audience Test', undefined, {
+        client_id: 'public-client-id',
+      });
+      const created = await serverConfigsDB.add('temp', config, userId);
+
+      await mongoose.models.MCPServer.updateOne(
+        { serverName: created.serverName },
+        {
+          $set: {
+            'config.oauth.audience': 'https://api.example.com',
+            'config.oauth.forward_audience_on_refresh': false,
+            'config.oauth.authorization_url':
+              'https://auth.example.com/authorize?audience=https%3A%2F%2Fapi.example.com&client=ok',
+            'config.oauth.token_url':
+              'https://auth.example.com/token?resource=https%3A%2F%2Fapi.example.com&foo=bar',
+          },
+        },
+      );
+
+      const result = await serverConfigsDB.get(created.serverName, userId);
+      expect(result?.oauth?.client_id).toBe('public-client-id');
+      expect(result?.oauth?.authorization_url).toBe('https://auth.example.com/authorize?client=ok');
+      expect(result?.oauth?.token_url).toBe('https://auth.example.com/token?foo=bar');
+      expect(result?.oauth?.audience).toBeUndefined();
+      expect(result?.oauth?.forward_audience_on_refresh).toBeUndefined();
+    });
   });
 
   describe('edge cases', () => {
diff --git a/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts b/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
index 3d1433f1947..933ff7cec2a 100644
--- a/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
@@ -22,24 +22,21 @@ const mockMongoose = {} as typeof import('mongoose');
 const sseConfig: t.MCPOptions = {
   type: 'sse',
   url: 'https://mcp.example.com/sse',
-} as unknown as t.MCPOptions;
+};
 
 const altSseConfig: t.MCPOptions = {
   type: 'sse',
   url: 'https://mcp.other-tenant.com/sse',
-} as unknown as t.MCPOptions;
+};
 
 const yamlConfig: t.MCPOptions = {
   type: 'stdio',
   command: 'node',
   args: ['tools.js'],
-} as unknown as t.MCPOptions;
+};
 
 function makeParsedConfig(overrides: Partial<t.ParsedServerConfig> = {}): t.ParsedServerConfig {
   return {
-    type: 'sse',
-    url: 'https://mcp.example.com/sse',
-    requiresOAuth: false,
     tools: 'tool_a, tool_b',
     capabilities: '{}',
     initDuration: 42,
@@ -91,8 +88,9 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
     ).toEqual({});
   });
 
-  it('should exclude YAML servers from config-source detection', async () => {
+  it('should skip unchanged YAML-named servers but still process config-only servers', async () => {
     await registry.addServer('yaml_server', yamlConfig, 'CACHE');
+    inspectSpy.mockClear();
 
     const result = await registry.ensureConfigServers({
       yaml_server: yamlConfig,
@@ -101,9 +99,17 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
 
     expect(result).toHaveProperty('config_server');
     expect(result).not.toHaveProperty('yaml_server');
+    expect(inspectSpy).toHaveBeenCalledTimes(1);
+    expect(inspectSpy).toHaveBeenCalledWith(
+      'config_server',
+      { ...sseConfig, source: 'config' },
+      undefined,
+      undefined,
+      undefined,
+    );
   });
 
-  it('should return empty when all servers are YAML', async () => {
+  it('should skip lazy-init for YAML-named servers with no admin override', async () => {
     await registry.addServer('yaml_a', yamlConfig, 'CACHE');
     await registry.addServer('yaml_b', yamlConfig, 'CACHE');
     inspectSpy.mockClear();
@@ -113,10 +119,74 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
       yaml_b: yamlConfig,
     });
 
-    expect(result).toEqual({});
+    expect(result).not.toHaveProperty('yaml_a');
+    expect(result).not.toHaveProperty('yaml_b');
+    expect(inspectSpy).not.toHaveBeenCalled();
+  });
+
+  it('should lazy-init YAML-named server when admin override changes a field', async () => {
+    await registry.addServer('yaml_a', yamlConfig, 'CACHE');
+    inspectSpy.mockClear();
+
+    const overrideConfig: t.MCPOptions = { ...yamlConfig, iconPath: 'https://x.com/icon.svg' };
+    const result = await registry.ensureConfigServers({
+      yaml_a: overrideConfig,
+    });
+
+    expect(result).toHaveProperty('yaml_a');
+    expect(inspectSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should lazy-init YAML server when admin overrides only the proxy field', async () => {
+    await registry.addServer('yaml_remote', sseConfig, 'CACHE');
+    inspectSpy.mockClear();
+
+    const overrideConfig: t.MCPOptions = {
+      ...sseConfig,
+      proxy: 'http://proxy.example.com:8080',
+    } as t.MCPOptions;
+    const result = await registry.ensureConfigServers({
+      yaml_remote: overrideConfig,
+    });
+
+    expect(result).toHaveProperty('yaml_remote');
+    expect(inspectSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should not re-init YAML server when only the difference is an inspector-derived field absent from rawConfig', async () => {
+    const yamlWithInferred: t.MCPOptions = {
+      ...sseConfig,
+      requiresOAuth: false,
+    } as t.MCPOptions;
+    await registry.addServer('yaml_remote', yamlWithInferred, 'CACHE');
+    inspectSpy.mockClear();
+
+    const result = await registry.ensureConfigServers({
+      yaml_remote: sseConfig,
+    });
+
+    expect(result).not.toHaveProperty('yaml_remote');
     expect(inspectSpy).not.toHaveBeenCalled();
   });
 
+  it('should issue a single batched YAML cache read regardless of how many servers are checked', async () => {
+    await registry.addServer('yaml_a', yamlConfig, 'CACHE');
+    await registry.addServer('yaml_b', yamlConfig, 'CACHE');
+    await registry.addServer('yaml_c', yamlConfig, 'CACHE');
+    const cacheGetSpy = jest.spyOn(registry['cacheConfigsRepo'], 'get');
+    const cacheGetAllSpy = jest.spyOn(registry['cacheConfigsRepo'], 'getAll');
+
+    await registry.ensureConfigServers({
+      yaml_a: yamlConfig,
+      yaml_b: yamlConfig,
+      yaml_c: yamlConfig,
+      config_only: sseConfig,
+    });
+
+    expect(cacheGetSpy).not.toHaveBeenCalled();
+    expect(cacheGetAllSpy).toHaveBeenCalledTimes(1);
+  });
+
   it('should lazy-initialize a config-source server and tag source as config', async () => {
     const result = await registry.ensureConfigServers({ my_server: sseConfig });
 
@@ -125,7 +195,7 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
     expect(inspectSpy).toHaveBeenCalledTimes(1);
     expect(inspectSpy).toHaveBeenCalledWith(
       'my_server',
-      sseConfig,
+      { ...sseConfig, source: 'config' },
       undefined,
       undefined,
       undefined,
@@ -221,7 +291,7 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
   });
 
   describe('merge order', () => {
-    it('should merge YAML → config → user with correct precedence in getAllServerConfigs', async () => {
+    it('should keep operator-managed servers authoritative in getAllServerConfigs', async () => {
       await registry.addServer('yaml_srv', yamlConfig, 'CACHE');
 
       const configServers = await registry.ensureConfigServers({ config_srv: sseConfig });
@@ -305,6 +375,89 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
       expect(config?.source).toBe('config');
     });
 
+    it('should surface inspectionFailed stub for config-only server when no YAML/DB fallback exists', async () => {
+      inspectSpy.mockRejectedValueOnce(new Error('connection refused'));
+      const configServers = await registry.ensureConfigServers({ bad_config_only: sseConfig });
+      expect(configServers.bad_config_only.inspectionFailed).toBe(true);
+
+      const config = await registry.getServerConfig('bad_config_only', undefined, configServers);
+      expect(config).toBeDefined();
+      expect(config?.inspectionFailed).toBe(true);
+      expect(config?.source).toBe('config');
+    });
+
+    it('should prefer healthy YAML entry over inspectionFailed config-tier stub on the same name', async () => {
+      await registry.addServer('shared_name', yamlConfig, 'CACHE');
+
+      inspectSpy.mockRejectedValueOnce(new Error('connection refused'));
+      const configServers = await registry.ensureConfigServers({ shared_name: sseConfig });
+      expect(configServers.shared_name.inspectionFailed).toBe(true);
+
+      const config = await registry.getServerConfig('shared_name', undefined, configServers);
+      expect(config).toBeDefined();
+      expect(config?.inspectionFailed).toBeUndefined();
+      expect(config?.source).toBe('yaml');
+    });
+
+    it('should prefer the user-tier DB entry over a config-tier candidate on the same name', async () => {
+      const dbConfig = makeParsedConfig({
+        source: 'user',
+        title: 'User Slack',
+      } as Partial<t.ParsedServerConfig>);
+      jest.spyOn(registry['dbConfigsRepo'], 'get').mockResolvedValue(dbConfig);
+
+      const configCandidate = makeParsedConfig({
+        source: 'config',
+        title: 'Config Slack',
+      } as Partial<t.ParsedServerConfig>);
+
+      const result = await registry.getServerConfig('slack', 'user-1', {
+        slack: configCandidate,
+      });
+      expect(result?.source).toBe('user');
+      expect((result as unknown as { title: string }).title).toBe('User Slack');
+    });
+
+    it('should overlay healthy admin override fields onto a YAML base while preserving yaml source', async () => {
+      const yamlEntry = makeParsedConfig({
+        ...sseConfig,
+        source: 'yaml',
+        title: 'YAML Title',
+      } as unknown as Partial<t.ParsedServerConfig>);
+      await registry['cacheConfigsRepo'].add('shared', yamlEntry);
+
+      const adminOverride = makeParsedConfig({
+        ...sseConfig,
+        source: 'config',
+        title: 'Admin Title',
+      } as unknown as Partial<t.ParsedServerConfig>);
+
+      const result = await registry.getServerConfig('shared', undefined, {
+        shared: adminOverride,
+      });
+      expect(result?.source).toBe('yaml');
+      expect((result as unknown as { title: string }).title).toBe('Admin Title');
+    });
+
+    it('should not leak a tenant-scoped failure stub into subsequent no-configServers calls', async () => {
+      inspectSpy.mockRejectedValueOnce(new Error('connection refused'));
+      const tenantA = await registry.ensureConfigServers({ tenant_a_only: sseConfig });
+      expect(tenantA.tenant_a_only.inspectionFailed).toBe(true);
+
+      const firstLookup = await registry.getServerConfig('tenant_a_only', undefined, tenantA);
+      expect(firstLookup?.inspectionFailed).toBe(true);
+      expect(firstLookup?.source).toBe('config');
+
+      const leakedLookup = await registry.getServerConfig('tenant_a_only');
+      expect(leakedLookup).toBeUndefined();
+
+      const tenantB = await registry.ensureConfigServers({ tenant_a_only: altSseConfig });
+      const tenantBLookup = await registry.getServerConfig('tenant_a_only', undefined, tenantB);
+      expect((tenantBLookup as unknown as { url: string }).url).toBe(
+        'https://mcp.other-tenant.com/sse',
+      );
+    });
+
     it('should not cross-contaminate between tenant configServers maps', async () => {
       const tenantA = await registry.ensureConfigServers({ srv: sseConfig });
       const tenantB = await registry.ensureConfigServers({ srv: altSseConfig });
diff --git a/packages/api/src/mcp/registry/__tests__/mcpConnectionsMock.helper.ts b/packages/api/src/mcp/registry/__tests__/mcpConnectionsMock.helper.ts
index 74bc83425d2..5e028c4c81e 100644
--- a/packages/api/src/mcp/registry/__tests__/mcpConnectionsMock.helper.ts
+++ b/packages/api/src/mcp/registry/__tests__/mcpConnectionsMock.helper.ts
@@ -7,6 +7,18 @@ import type { MCPConnection } from '~/mcp/connection';
  * @returns Mocked MCPConnection instance
  */
 export function createMockConnection(serverName: string): jest.Mocked<MCPConnection> {
+  const tools = [
+    {
+      name: 'listFiles',
+      description: `Description for ${serverName}'s listFiles tool`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          input: { type: 'string' },
+        },
+      },
+    },
+  ];
   const mockClient = {
     getInstructions: jest.fn().mockReturnValue(`instructions for ${serverName}`),
     getServerCapabilities: jest.fn().mockReturnValue({
@@ -14,24 +26,12 @@ export function createMockConnection(serverName: string): jest.Mocked<MCPConnect
       resources: { listChanged: true },
       prompts: { get: `getPrompts for ${serverName}` },
     }),
-    listTools: jest.fn().mockResolvedValue({
-      tools: [
-        {
-          name: 'listFiles',
-          description: `Description for ${serverName}'s listFiles tool`,
-          inputSchema: {
-            type: 'object',
-            properties: {
-              input: { type: 'string' },
-            },
-          },
-        },
-      ],
-    }),
+    listTools: jest.fn().mockResolvedValue({ tools }),
   };
 
   return {
     client: mockClient,
+    fetchTools: jest.fn().mockResolvedValue(tools),
     disconnect: jest.fn().mockResolvedValue(undefined),
   } as unknown as jest.Mocked<MCPConnection>;
 }
diff --git a/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts b/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
index 5fbd18ffdfb..87d54fc3621 100644
--- a/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
+++ b/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
@@ -1,8 +1,14 @@
-import { standardCache } from '~/cache';
+import Keyv from 'keyv';
 import { BaseRegistryCache } from './BaseRegistryCache';
+import { standardCache } from '~/cache';
 
 // Status keys
 const INITIALIZED = 'INITIALIZED';
+const INITIALIZED_CONFIG_HASH = 'INITIALIZED_CONFIG_HASH';
+
+type StatusSetOptions = {
+  skipLeaderCheck?: boolean;
+};
 
 /**
  * Cache for tracking MCP Servers Registry global metadata and status across distributed instances.
@@ -14,25 +20,50 @@ const INITIALIZED = 'INITIALIZED';
  * This cache is only meant to be used internally by registry management components.
  */
 class RegistryStatusCache extends BaseRegistryCache {
-  protected readonly cache = standardCache(`${this.PREFIX}::Status`);
+  protected readonly cache: Keyv = standardCache(`${this.PREFIX}::Status`);
 
   public async isInitialized(): Promise<boolean> {
     return (await this.get(INITIALIZED)) === true;
   }
 
-  public async setInitialized(value: boolean): Promise<void> {
-    await this.set(INITIALIZED, value);
+  public async isInitializedFor(configHash: string): Promise<boolean> {
+    if (!(await this.isInitialized())) {
+      return false;
+    }
+    return (await this.getInitializedConfigHash()) === configHash;
+  }
+
+  public async getInitializedConfigHash(): Promise<string | undefined> {
+    return this.get<string>(INITIALIZED_CONFIG_HASH);
+  }
+
+  public async setInitialized(
+    value: boolean,
+    configHash?: string,
+    options?: StatusSetOptions,
+  ): Promise<void> {
+    if (configHash != null) {
+      await this.set(INITIALIZED_CONFIG_HASH, configHash, undefined, options);
+    }
+    await this.set(INITIALIZED, value, undefined, options);
   }
 
   private async get<T = unknown>(key: string): Promise<T | undefined> {
     return this.cache.get(key);
   }
 
-  private async set(key: string, value: string | number | boolean, ttl?: number): Promise<void> {
-    await this.leaderCheck('set MCP Servers Registry status');
+  private async set(
+    key: string,
+    value: string | number | boolean,
+    ttl?: number,
+    options?: StatusSetOptions,
+  ): Promise<void> {
+    if (!options?.skipLeaderCheck) {
+      await this.leaderCheck('set MCP Servers Registry status');
+    }
     const success = await this.cache.set(key, value, ttl);
     this.successCheck(`set status key "${key}"`, success);
   }
 }
 
-export const registryStatusCache = new RegistryStatusCache();
+export const registryStatusCache: RegistryStatusCache = new RegistryStatusCache();
diff --git a/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
index 3cfd7f35786..2530e9a0f0e 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import { expect } from '@playwright/test';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 describe('RegistryStatusCache Integration Tests', () => {
   let registryStatusCache: typeof import('../RegistryStatusCache').registryStatusCache;
@@ -56,8 +57,8 @@ describe('RegistryStatusCache Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   describe('Initialization status tracking', () => {
diff --git a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
index 4e563ab4aa0..c853becb18c 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
@@ -1,9 +1,12 @@
 import { expect } from '@playwright/test';
+import type { RedisClientsModule } from '~/cache/__tests__/redisClients.helper';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 import { ParsedServerConfig } from '~/mcp/types';
 
 describe('ServerConfigsCacheRedis Integration Tests', () => {
   let ServerConfigsCacheRedis: typeof import('../ServerConfigsCacheRedis').ServerConfigsCacheRedis;
   let keyvRedisClient: Awaited<typeof import('~/cache/redisClients')>['keyvRedisClient'];
+  let redisClientsModule: RedisClientsModule;
 
   let cache: InstanceType<typeof import('../ServerConfigsCacheRedis').ServerConfigsCacheRedis>;
 
@@ -43,6 +46,7 @@ describe('ServerConfigsCacheRedis Integration Tests', () => {
 
     ServerConfigsCacheRedis = cacheModule.ServerConfigsCacheRedis;
     keyvRedisClient = redisClients.keyvRedisClient;
+    redisClientsModule = redisClients;
 
     // Ensure Redis is connected
     if (!keyvRedisClient) throw new Error('Redis client is not initialized');
@@ -75,8 +79,9 @@ describe('ServerConfigsCacheRedis Integration Tests', () => {
   });
 
   afterAll(async () => {
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients; pass the captured module since
+    // `jest.resetModules()` in beforeEach dropped it from the registry
+    await closeRedisClients(redisClientsModule);
   });
 
   describe('add and get operations', () => {
diff --git a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
index 4ec30187a28..2cc7f159eda 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
@@ -1,5 +1,6 @@
 import { expect } from '@playwright/test';
 import type { ParsedServerConfig } from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
   let ServerConfigsCacheRedisAggregateKey: typeof import('../ServerConfigsCacheRedisAggregateKey').ServerConfigsCacheRedisAggregateKey;
@@ -56,7 +57,7 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
   });
 
   afterAll(async () => {
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    await closeRedisClients();
   });
 
   describe('add and get operations', () => {
@@ -253,8 +254,7 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
       await cache.getAll();
 
       // Spy on the underlying Keyv cache to count Redis calls
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const cacheGetSpy = jest.spyOn((cache as any).cache, 'get');
+      const cacheGetSpy = jest.spyOn(cache['cache'], 'get');
 
       await cache.getAll();
       await cache.getAll();
@@ -324,11 +324,9 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
       await cache.getAll(); // prime snapshot
 
       // Force-expire the snapshot without sleeping
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      (cache as any).localSnapshotExpiry = Date.now() - 1;
+      cache['localSnapshotExpiry'] = Date.now() - 1;
 
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const cacheGetSpy = jest.spyOn((cache as any).cache, 'get');
+      const cacheGetSpy = jest.spyOn(cache['cache'], 'get');
       const result = await cache.getAll();
       expect(cacheGetSpy.mock.calls).toHaveLength(1);
       expect(Object.keys(result).length).toBe(1);
diff --git a/packages/api/src/mcp/registry/db/ServerConfigsDB.ts b/packages/api/src/mcp/registry/db/ServerConfigsDB.ts
index b1649c66ca5..8994d6b529d 100644
--- a/packages/api/src/mcp/registry/db/ServerConfigsDB.ts
+++ b/packages/api/src/mcp/registry/db/ServerConfigsDB.ts
@@ -1,12 +1,13 @@
 import { Types } from 'mongoose';
+import { logger, encryptV2, decryptV2, createMethods } from '@librechat/data-schemas';
 import {
   ResourceType,
   AccessRoleIds,
   PrincipalType,
   PermissionBits,
 } from 'librechat-data-provider';
-import { logger, encryptV2, decryptV2, createMethods } from '@librechat/data-schemas';
 import type { AllMethods, MCPServerDocument } from '@librechat/data-schemas';
+
 import type { IServerConfigsRepositoryInterface } from '~/mcp/registry/ServerConfigsRepositoryInterface';
 import type { ParsedServerConfig, AddServerResult } from '~/mcp/types';
 import { AccessControlService } from '~/acl/accessControlService';
@@ -26,6 +27,8 @@ const DANGEROUS_CREDENTIAL_PATTERNS = [
   /\{\{LIBRECHAT_BODY_[^}]+\}\}/g,
 ];
 
+const BLOCKED_USER_OAUTH_ENDPOINT_PARAMS = ['audience', 'resource'] as const;
+
 /**
  * Sanitizes headers by removing dangerous credential placeholders.
  * This prevents credential exfiltration when MCP servers are shared between users.
@@ -51,6 +54,44 @@ function sanitizeCredentialPlaceholders(
   return sanitized;
 }
 
+function stripBlockedOAuthEndpointParams(url?: string): string | undefined {
+  if (!url) {
+    return url;
+  }
+
+  try {
+    const parsed = new URL(url);
+    BLOCKED_USER_OAUTH_ENDPOINT_PARAMS.forEach((param) => parsed.searchParams.delete(param));
+    return parsed.href;
+  } catch {
+    return url;
+  }
+}
+
+function sanitizeUserManagedOAuthConfig(config: ParsedServerConfig): ParsedServerConfig {
+  if (!config.oauth) {
+    return config;
+  }
+
+  const {
+    audience: _audience,
+    forward_audience_on_refresh: _forwardAudienceOnRefresh,
+    ...oauth
+  } = config.oauth;
+  return {
+    ...config,
+    oauth: {
+      ...oauth,
+      ...(config.oauth.authorization_url && {
+        authorization_url: stripBlockedOAuthEndpointParams(config.oauth.authorization_url),
+      }),
+      ...(config.oauth.token_url && {
+        token_url: stripBlockedOAuthEndpointParams(config.oauth.token_url),
+      }),
+    },
+  };
+}
+
 /**
  * DB backed config storage
  * Handles CRUD Methods of dynamic mcp servers
@@ -59,13 +100,11 @@ function sanitizeCredentialPlaceholders(
 export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
   private _dbMethods: AllMethods;
   private _aclService: AccessControlService;
-  private _mongoose: typeof import('mongoose');
 
   constructor(mongoose: typeof import('mongoose')) {
     if (!mongoose) {
       throw new Error('ServerConfigsDB requires mongoose instance');
     }
-    this._mongoose = mongoose;
     this._dbMethods = createMethods(mongoose);
     this._aclService = new AccessControlService(mongoose);
   }
@@ -98,18 +137,15 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
       return false;
     }
 
-    const Agent = this._mongoose.model('Agent');
-    const exists = await Agent.exists({
-      _id: { $in: accessibleAgentIds },
-      mcpServerNames: serverName,
+    return await this._dbMethods.hasAgentWithMCPServerName({
+      agentIds: accessibleAgentIds,
+      serverName,
     });
-
-    return exists !== null;
   }
 
   /**
    * Creates a new MCP server and grants owner permissions to the user.
-   * @param serverName - Temporary server name (not persisted) will be replaced by the nano id generated by the db method
+   * @param serverName - Placeholder name kept for repository compatibility; final serverName comes from config.title
    * @param config - Server configuration to store
    * @param userId - ID of the user creating the server (required)
    * @returns The created server result with serverName and config (including dbId)
@@ -119,9 +155,10 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
     serverName: string,
     config: ParsedServerConfig,
     userId?: string,
+    reservedServerNames?: Iterable<string>,
   ): Promise<AddServerResult> {
     logger.debug(
-      `[ServerConfigsDB.add] Starting Creating server with temp servername: ${serverName} for the user with the ID ${userId}`,
+      `[ServerConfigsDB.add] Creating DB-backed server from config title. Placeholder: ${serverName}; userId: ${userId}`,
     );
     if (!userId) {
       throw new Error(
@@ -129,12 +166,12 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
       );
     }
 
-    const sanitizedConfig = {
+    const sanitizedConfig = sanitizeUserManagedOAuthConfig({
       ...config,
       headers: sanitizeCredentialPlaceholders(
         (config as ParsedServerConfig & { headers?: Record<string, string> }).headers,
       ),
-    } as ParsedServerConfig;
+    } as ParsedServerConfig);
 
     /** Transformed user-provided API key config (adds customUserVars and headers) */
     const transformedConfig = this.transformUserApiKeyConfig(sanitizedConfig);
@@ -143,6 +180,7 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
     const createdServer = await this._dbMethods.createMCPServer({
       config: encryptedConfig,
       author: userId,
+      reservedServerNames,
     });
     await this._aclService.grantPermission({
       principalType: PrincipalType.USER,
@@ -177,12 +215,12 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
 
     const existingServer = await this._dbMethods.findMCPServerByServerName(serverName);
 
-    let configToSave: ParsedServerConfig = {
+    let configToSave: ParsedServerConfig = sanitizeUserManagedOAuthConfig({
       ...config,
       headers: sanitizeCredentialPlaceholders(
         (config as ParsedServerConfig & { headers?: Record<string, string> }).headers,
       ),
-    } as ParsedServerConfig;
+    } as ParsedServerConfig);
 
     /** Transformed user-provided API key config (adds customUserVars and headers) */
     configToSave = this.transformUserApiKeyConfig(configToSave);
@@ -327,62 +365,52 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
    * @param userId optional user id. if not provided only publicly shared mcp configs will be returned
    * @returns record of parsed configs
    */
-  public async getAll(userId?: string): Promise<Record<string, ParsedServerConfig>> {
+  public async getAll(userId?: string, role?: string): Promise<Record<string, ParsedServerConfig>> {
     let directlyAccessibleMCPIds: Types.ObjectId[] = [];
+    let accessibleAgentIds: Types.ObjectId[] = [];
+
     if (!userId) {
       logger.debug(`[ServerConfigsDB.getAll] fetching all publicly shared mcp servers`);
-      directlyAccessibleMCPIds = await this._aclService.findPubliclyAccessibleResources({
-        resourceType: ResourceType.MCPSERVER,
-        requiredPermissions: PermissionBits.VIEW,
-      });
+      [directlyAccessibleMCPIds, accessibleAgentIds] = await Promise.all([
+        this._aclService.findPubliclyAccessibleResources({
+          resourceType: ResourceType.MCPSERVER,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+        this._aclService.findPubliclyAccessibleResources({
+          resourceType: ResourceType.AGENT,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+      ]);
     } else {
       logger.debug(
         `[ServerConfigsDB.getAll] fetching mcp servers directly shared with the user with ID: ${userId}`,
       );
-      directlyAccessibleMCPIds = await this._aclService.findAccessibleResources({
-        userId,
-        requiredPermissions: PermissionBits.VIEW,
-        resourceType: ResourceType.MCPSERVER,
-      });
-    }
-
-    let agentMCPServerNames: string[] = [];
-    let accessibleAgentIds: Types.ObjectId[] = [];
-
-    if (!userId) {
-      accessibleAgentIds = await this._aclService.findPubliclyAccessibleResources({
-        resourceType: ResourceType.AGENT,
-        requiredPermissions: PermissionBits.VIEW,
-      });
-    } else {
-      accessibleAgentIds = await this._aclService.findAccessibleResources({
-        userId,
-        requiredPermissions: PermissionBits.VIEW,
-        resourceType: ResourceType.AGENT,
-      });
-    }
-
-    if (accessibleAgentIds.length > 0) {
-      const Agent = this._mongoose.model('Agent');
-      const agentsWithMCP = await Agent.find(
-        {
-          _id: { $in: accessibleAgentIds },
-          mcpServerNames: { $exists: true, $not: { $size: 0 } },
-        },
-        { mcpServerNames: 1 },
-      ).lean();
-
-      agentMCPServerNames = [
-        ...new Set(
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          agentsWithMCP.flatMap((a: any) => a.mcpServerNames || []),
-        ),
-      ];
+      const principalsList = await this._aclService.getUserPrincipals({ userId, role });
+      [directlyAccessibleMCPIds, accessibleAgentIds] = await Promise.all([
+        this._aclService.findAccessibleResourcesForPrincipals({
+          principalsList,
+          requiredPermissions: PermissionBits.VIEW,
+          resourceType: ResourceType.MCPSERVER,
+        }),
+        this._aclService.findAccessibleResourcesForPrincipals({
+          principalsList,
+          requiredPermissions: PermissionBits.VIEW,
+          resourceType: ResourceType.AGENT,
+        }),
+      ]);
     }
 
-    const directResults = await this._dbMethods.getListMCPServersByIds({
+    const agentMCPServerNamesPromise: Promise<string[]> =
+      accessibleAgentIds.length > 0
+        ? this._dbMethods.getMCPServerNamesByAgentIds(accessibleAgentIds)
+        : Promise.resolve([]);
+    const directResultsPromise = this._dbMethods.getListMCPServersByIds({
       ids: directlyAccessibleMCPIds,
     });
+    const [agentMCPServerNames, directResults] = await Promise.all([
+      agentMCPServerNamesPromise,
+      directResultsPromise,
+    ]);
 
     const parsedConfigs: Record<string, ParsedServerConfig> = {};
     const directData = directResults.data || [];
@@ -427,13 +455,18 @@ export class ServerConfigsDB implements IServerConfigsRepositoryInterface {
   private async mapDBServerToParsedConfig(
     serverDBDoc: MCPServerDocument,
   ): Promise<ParsedServerConfig> {
+    const authorId =
+      serverDBDoc.author != null
+        ? (serverDBDoc.author as unknown as Types.ObjectId | string).toString()
+        : undefined;
     const config: ParsedServerConfig = {
       ...serverDBDoc.config,
       dbId: (serverDBDoc._id as Types.ObjectId).toString(),
       source: 'user',
       updatedAt: serverDBDoc.updatedAt?.getTime(),
+      ...(authorId ? { author: authorId } : {}),
     };
-    return await this.decryptConfig(config);
+    return sanitizeUserManagedOAuthConfig(await this.decryptConfig(config));
   }
 
   /**
diff --git a/packages/api/src/mcp/request.ts b/packages/api/src/mcp/request.ts
new file mode 100644
index 00000000000..834283a01be
--- /dev/null
+++ b/packages/api/src/mcp/request.ts
@@ -0,0 +1,163 @@
+import { logger } from '@librechat/data-schemas';
+
+import type { RequestScopedMCPConnectionStore } from './types';
+
+export interface MCPRequestContext extends RequestScopedMCPConnectionStore {
+  cleanupStarted: boolean;
+  cleanupOnResponse: boolean;
+  responseCleanupAttached: boolean;
+}
+
+export interface MCPRequestContextOptions {
+  cleanupOnResponse?: boolean;
+}
+
+interface MCPResponseLike {
+  writableEnded?: boolean;
+  finished?: boolean;
+  destroyed?: boolean;
+  once?: (event: 'finish' | 'close', listener: () => void) => unknown;
+}
+
+interface Disconnectable {
+  disconnect: () => Promise<unknown> | unknown;
+}
+
+const contexts = new WeakMap<object, MCPRequestContext>();
+
+export function createMCPRequestContext(): MCPRequestContext {
+  return {
+    connections: new Map<string, unknown>(),
+    pending: new Map<string, Promise<unknown>>(),
+    cleanupStarted: false,
+    cleanupOnResponse: true,
+    responseCleanupAttached: false,
+  };
+}
+
+function isDisconnectable(value: unknown): value is Disconnectable {
+  return (
+    value != null &&
+    typeof value === 'object' &&
+    'disconnect' in value &&
+    typeof value.disconnect === 'function'
+  );
+}
+
+export async function cleanupMCPRequestContext(context?: MCPRequestContext): Promise<void> {
+  if (!context || context.cleanupStarted) {
+    return;
+  }
+  context.cleanupStarted = true;
+
+  const connections = new Set<Disconnectable>();
+  for (const connection of context.connections.values()) {
+    if (isDisconnectable(connection)) {
+      connections.add(connection);
+    }
+  }
+
+  const pending = Array.from(context.pending.values());
+  if (pending.length > 0) {
+    const settled = await Promise.allSettled(pending);
+    for (const result of settled) {
+      if (result.status === 'fulfilled' && isDisconnectable(result.value)) {
+        connections.add(result.value);
+      }
+    }
+  }
+
+  await Promise.allSettled(
+    Array.from(connections).map(async (connection) => {
+      try {
+        await connection.disconnect();
+      } catch (error) {
+        logger.warn('[MCP Request Context] Failed to disconnect request-scoped connection', error);
+      }
+    }),
+  );
+
+  context.connections.clear();
+  context.pending.clear();
+}
+
+function isResponseFinished(res?: MCPResponseLike): boolean {
+  return Boolean(res?.writableEnded || res?.finished || res?.destroyed);
+}
+
+function runCleanup(context: MCPRequestContext): void {
+  cleanupMCPRequestContext(context).catch((error) => {
+    logger.warn('[MCP Request Context] Cleanup failed', error);
+  });
+}
+
+function attachResponseCleanup(context: MCPRequestContext, res?: MCPResponseLike): void {
+  if (!res || context.responseCleanupAttached || context.cleanupOnResponse === false) {
+    return;
+  }
+
+  const cleanup = () => runCleanup(context);
+  if (isResponseFinished(res)) {
+    cleanup();
+    return;
+  }
+
+  if (typeof res.once !== 'function') {
+    return;
+  }
+
+  context.responseCleanupAttached = true;
+  res.once('finish', cleanup);
+  res.once('close', cleanup);
+
+  if (isResponseFinished(res)) {
+    cleanup();
+  }
+}
+
+export function getMCPRequestContext(
+  req?: object,
+  res?: MCPResponseLike,
+  options: MCPRequestContextOptions = {},
+): MCPRequestContext | undefined {
+  if (!req) {
+    return undefined;
+  }
+
+  const cleanupOnResponse = options.cleanupOnResponse !== false;
+  let context = contexts.get(req);
+  if (!context) {
+    if (cleanupOnResponse && isResponseFinished(res)) {
+      return undefined;
+    }
+
+    context = createMCPRequestContext();
+    context.cleanupOnResponse = cleanupOnResponse;
+    contexts.set(req, context);
+  } else if (!cleanupOnResponse) {
+    context.cleanupOnResponse = false;
+  }
+
+  if (cleanupOnResponse) {
+    attachResponseCleanup(context, res);
+  }
+
+  return context.cleanupStarted ? undefined : context;
+}
+
+export async function cleanupMCPRequestContextForReq(req?: object): Promise<void> {
+  if (!req) {
+    return;
+  }
+
+  const context = contexts.get(req);
+  if (!context) {
+    return;
+  }
+
+  try {
+    await cleanupMCPRequestContext(context);
+  } finally {
+    contexts.delete(req);
+  }
+}
diff --git a/packages/api/src/mcp/tools.spec.ts b/packages/api/src/mcp/tools.spec.ts
index 2a5d201df8c..f1a630487a4 100644
--- a/packages/api/src/mcp/tools.spec.ts
+++ b/packages/api/src/mcp/tools.spec.ts
@@ -1,12 +1,25 @@
 import { Constants } from 'librechat-data-provider';
-import { createMCPToolCacheService } from './tools';
-import type { LCAvailableTools } from './types';
+import type { LCAvailableTools, ParsedServerConfig } from './types';
 import type { MCPToolInput, MCPToolCacheDeps } from './tools';
+import { createMCPToolCacheService } from './tools';
+
+const requestScopedConfig: ParsedServerConfig = {
+  type: 'streamable-http',
+  url: 'https://mcp.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+  source: 'yaml',
+};
+
+const cacheableConfig: ParsedServerConfig = {
+  type: 'streamable-http',
+  url: 'https://mcp.example.com/mcp',
+  source: 'yaml',
+};
 
 function createMockDeps(overrides: Partial<MCPToolCacheDeps> = {}): MCPToolCacheDeps {
   return {
     getCachedTools: jest.fn().mockResolvedValue(null),
     setCachedTools: jest.fn().mockResolvedValue(true),
+    getServerConfig: jest.fn().mockResolvedValue(undefined),
     ...overrides,
   };
 }
@@ -57,6 +70,59 @@ describe('createMCPToolCacheService', () => {
       });
     });
 
+    it('builds tool names without caching when the resolved config is request-scoped', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [
+        {
+          name: 'search',
+          description: 'Search request-scoped docs',
+          inputSchema: { type: 'object', properties: {} },
+        },
+      ];
+
+      const result = await updateMCPServerTools({
+        userId: 'u1',
+        serverName: 'body-scoped',
+        tools,
+      });
+
+      const expectedKey = `search${Constants.mcp_delimiter}body-scoped`;
+      expect(result[expectedKey]).toBeDefined();
+      expect(deps.getServerConfig).toHaveBeenCalledWith('body-scoped', 'u1');
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('uses a provided serverConfig without calling the resolver', async () => {
+      const deps = createMockDeps();
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [{ name: 'search' }];
+
+      await updateMCPServerTools({
+        userId: 'u1',
+        serverName: 'body-scoped',
+        tools,
+        serverConfig: requestScopedConfig,
+      });
+
+      expect(deps.getServerConfig).not.toHaveBeenCalled();
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('fails open and caches when config resolution throws', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockRejectedValue(new Error('registry not initialized')),
+      });
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [{ name: 'search' }];
+
+      await updateMCPServerTools({ userId: 'u1', serverName: 'srv', tools });
+
+      expect(deps.setCachedTools).toHaveBeenCalled();
+    });
+
     it('propagates setCachedTools errors', async () => {
       const deps = createMockDeps({
         setCachedTools: jest.fn().mockRejectedValue(new Error('Redis down')),
@@ -155,6 +221,17 @@ describe('createMCPToolCacheService', () => {
   });
 
   describe('cacheMCPServerTools', () => {
+    const serverTools: LCAvailableTools = {
+      tool: {
+        type: 'function',
+        ['function']: {
+          name: 'tool',
+          description: '',
+          parameters: { type: 'object', properties: {} },
+        },
+      },
+    };
+
     it('no-ops when serverTools is empty', async () => {
       const deps = createMockDeps();
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
@@ -167,16 +244,6 @@ describe('createMCPToolCacheService', () => {
     it('caches server tools with userId and serverName', async () => {
       const deps = createMockDeps();
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
-      const serverTools: LCAvailableTools = {
-        tool: {
-          type: 'function',
-          ['function']: {
-            name: 'tool',
-            description: '',
-            parameters: { type: 'object', properties: {} },
-          },
-        },
-      };
 
       await cacheMCPServerTools({ userId: 'u1', serverName: 'brave', serverTools });
 
@@ -186,6 +253,17 @@ describe('createMCPToolCacheService', () => {
       });
     });
 
+    it('skips caching for request-scoped servers', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { cacheMCPServerTools } = createMCPToolCacheService(deps);
+
+      await cacheMCPServerTools({ userId: 'u1', serverName: 'body-scoped', serverTools });
+
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
     it('propagates setCachedTools errors', async () => {
       const deps = createMockDeps({
         setCachedTools: jest.fn().mockRejectedValue(new Error('write failed')),
@@ -193,21 +271,80 @@ describe('createMCPToolCacheService', () => {
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
 
       await expect(
-        cacheMCPServerTools({
-          userId: 'u1',
-          serverName: 'srv',
-          serverTools: {
-            t: {
-              type: 'function',
-              ['function']: {
-                name: 't',
-                description: '',
-                parameters: { type: 'object', properties: {} },
-              },
-            },
-          },
-        }),
+        cacheMCPServerTools({ userId: 'u1', serverName: 'srv', serverTools }),
       ).rejects.toThrow('write failed');
     });
   });
+
+  describe('getMCPServerTools', () => {
+    const cachedTools: LCAvailableTools = {
+      tool: {
+        type: 'function',
+        ['function']: {
+          name: 'tool',
+          description: '',
+          parameters: { type: 'object', properties: {} },
+        },
+      },
+    };
+
+    it('returns cached tools for cacheable servers', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+        getServerConfig: jest.fn().mockResolvedValue(cacheableConfig),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toEqual(cachedTools);
+      expect(deps.getCachedTools).toHaveBeenCalledWith({ userId: 'u1', serverName: 'brave' });
+    });
+
+    it('returns null for request-scoped servers without reading the cache', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'body-scoped');
+
+      expect(result).toBeNull();
+      expect(deps.getCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('uses a provided serverConfig without calling the resolver', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'body-scoped', requestScopedConfig);
+
+      expect(result).toBeNull();
+      expect(deps.getServerConfig).not.toHaveBeenCalled();
+      expect(deps.getCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('returns null when the cache is empty', async () => {
+      const deps = createMockDeps();
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toBeNull();
+    });
+
+    it('returns null instead of throwing when the cache read fails', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockRejectedValue(new Error('cache unavailable')),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toBeNull();
+    });
+  });
 });
diff --git a/packages/api/src/mcp/tools.ts b/packages/api/src/mcp/tools.ts
index d539cc5bd0c..1326bb99f31 100644
--- a/packages/api/src/mcp/tools.ts
+++ b/packages/api/src/mcp/tools.ts
@@ -1,7 +1,8 @@
 import { logger } from '@librechat/data-schemas';
 import { Constants } from 'librechat-data-provider';
 import type { JsonSchemaType } from '@librechat/agents';
-import type { LCAvailableTools, LCFunctionTool } from './types';
+import type { LCAvailableTools, LCFunctionTool, ParsedServerConfig } from './types';
+import { requiresEphemeralUserConnection } from './utils';
 
 export interface MCPToolInput {
   name: string;
@@ -18,17 +19,66 @@ export interface MCPToolCacheDeps {
     tools: LCAvailableTools,
     options?: { userId?: string; serverName?: string },
   ) => Promise<boolean>;
+  getServerConfig: (serverName: string, userId?: string) => Promise<ParsedServerConfig | undefined>;
 }
 
-export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
-  const { getCachedTools, setCachedTools } = deps;
+export interface MCPToolCacheService {
+  updateMCPServerTools: (params: {
+    userId: string;
+    serverName: string;
+    tools: MCPToolInput[] | null;
+    serverConfig?: ParsedServerConfig;
+  }) => Promise<LCAvailableTools>;
+  mergeAppTools: (appTools: LCAvailableTools) => Promise<void>;
+  cacheMCPServerTools: (params: {
+    userId: string;
+    serverName: string;
+    serverTools: LCAvailableTools;
+    serverConfig?: ParsedServerConfig;
+  }) => Promise<void>;
+  getMCPServerTools: (
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ) => Promise<LCAvailableTools | null>;
+}
+
+export function createMCPToolCacheService(deps: MCPToolCacheDeps): MCPToolCacheService {
+  const { getCachedTools, setCachedTools, getServerConfig } = deps;
+
+  /**
+   * Request-scoped servers resolve runtime user/request placeholders per
+   * connection, so their definitions must never enter the persistent tool
+   * cache. Fails open: an unresolvable config is treated as cacheable,
+   * preserving pre-gating behavior for servers the registry cannot see.
+   * The resolver sees only base registry configs — callers holding merged
+   * Config-overlay configs must pass them. All writers do, so an entry that
+   * predates gating or an overlay change survives at most one cache TTL.
+   */
+  async function isRequestScoped(
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ): Promise<boolean> {
+    try {
+      const config = serverConfig ?? (await getServerConfig(serverName, userId));
+      return config ? requiresEphemeralUserConnection(config) : false;
+    } catch (error) {
+      logger.debug(
+        `[MCP Cache] Could not resolve config for ${serverName} (user: ${userId}), treating as cacheable:`,
+        error,
+      );
+      return false;
+    }
+  }
 
   async function updateMCPServerTools(params: {
     userId: string;
     serverName: string;
     tools: MCPToolInput[] | null;
+    serverConfig?: ParsedServerConfig;
   }): Promise<LCAvailableTools> {
-    const { userId, serverName, tools } = params;
+    const { userId, serverName, tools, serverConfig } = params;
     try {
       const serverTools: LCAvailableTools = {};
       const mcpDelimiter = Constants.mcp_delimiter;
@@ -51,6 +101,13 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
         serverTools[name] = entry;
       }
 
+      if (await isRequestScoped(userId, serverName, serverConfig)) {
+        logger.debug(
+          `[MCP Cache] Built ${tools.length} tools for request-scoped server ${serverName} (user: ${userId}) without caching`,
+        );
+        return serverTools;
+      }
+
       await setCachedTools(serverTools, { userId, serverName });
       logger.debug(
         `[MCP Cache] Updated ${tools.length} tools for server ${serverName} (user: ${userId})`,
@@ -85,13 +142,20 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
     userId: string;
     serverName: string;
     serverTools: LCAvailableTools;
+    serverConfig?: ParsedServerConfig;
   }): Promise<void> {
-    const { userId, serverName, serverTools } = params;
+    const { userId, serverName, serverTools, serverConfig } = params;
     try {
       const count = Object.keys(serverTools).length;
       if (!count) {
         return;
       }
+      if (await isRequestScoped(userId, serverName, serverConfig)) {
+        logger.debug(
+          `[MCP Cache] Skipped caching ${count} tools for request-scoped server ${serverName} (user: ${userId})`,
+        );
+        return;
+      }
       await setCachedTools(serverTools, { userId, serverName });
       logger.debug(`Cached ${count} MCP server tools for ${serverName} (user: ${userId})`);
     } catch (error) {
@@ -100,5 +164,21 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
     }
   }
 
-  return { updateMCPServerTools, mergeAppTools, cacheMCPServerTools };
+  async function getMCPServerTools(
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ): Promise<LCAvailableTools | null> {
+    if (await isRequestScoped(userId, serverName, serverConfig)) {
+      return null;
+    }
+    try {
+      return (await getCachedTools({ userId, serverName })) ?? null;
+    } catch (error) {
+      logger.error(`[getMCPServerTools] Error fetching cached tools for ${serverName}:`, error);
+      return null;
+    }
+  }
+
+  return { updateMCPServerTools, mergeAppTools, cacheMCPServerTools, getMCPServerTools };
 }
diff --git a/packages/api/src/mcp/types/index.ts b/packages/api/src/mcp/types/index.ts
index 2421e860e83..b645a9484ca 100644
--- a/packages/api/src/mcp/types/index.ts
+++ b/packages/api/src/mcp/types/index.ts
@@ -19,6 +19,8 @@ import type {
 import type { SearchResultData, UIResource, TPlugin } from 'librechat-data-provider';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { LCTool } from '@librechat/agents';
+import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
+import type { GraphTokenResolver } from '~/utils/graph';
 import type { FlowStateManager } from '~/flow/manager';
 import type { RequestBody } from '~/types/http';
 import type * as o from '~/mcp/oauth/types';
@@ -174,6 +176,12 @@ export type ParsedServerConfig = MCPOptions & {
   consumeOnly?: boolean;
   /** True when inspection failed at startup; the server is known but not fully initialized */
   inspectionFailed?: boolean;
+  /**
+   * User-id of the creating user (DB-sourced configs only). Used at runtime to gate
+   * OBO token exchanges by re-checking the author's CONFIGURE_OBO permission, so a
+   * stored config remains safe if the author's role is downgraded.
+   */
+  author?: string;
 };
 
 export type AddServerResult = {
@@ -190,6 +198,10 @@ export interface BasicConnectionOptions {
   allowedAddresses?: string[] | null;
   /** When true, only resolve customUserVars in processMCPEnv (for DB-stored servers) */
   dbSourced?: boolean;
+  /** When true, serverConfig has already gone through processMCPEnv for this request */
+  skipEnvProcessing?: boolean;
+  /** When true, the connection is intentionally short-lived for a single request/tool call */
+  ephemeralConnection?: boolean;
 }
 
 /** User context for placeholder resolution in MCP connections (non-OAuth and OAuth alike) */
@@ -197,17 +209,48 @@ export interface UserConnectionContext {
   user?: IUser | IUserGroup;
   customUserVars?: Record<string, string>;
   requestBody?: RequestBody;
+  requestScopedConnections?: RequestScopedMCPConnectionStore;
+  graphTokenResolver?: GraphTokenResolver;
   connectionTimeout?: number;
 }
 
+export interface RequestScopedMCPConnectionStore {
+  connections: Map<string, unknown>;
+  pending: Map<string, Promise<unknown>>;
+}
+
+export interface OAuthStartOptions {
+  expiresAt?: number;
+}
+
+export type OAuthStartHandler = (authURL: string, options?: OAuthStartOptions) => Promise<void>;
+
 export interface OAuthConnectionOptions extends UserConnectionContext {
   useOAuth: true;
   flowManager: FlowStateManager<o.MCPOAuthTokens | null>;
   tokenMethods?: TokenMethods;
   signal?: AbortSignal;
-  oauthStart?: (authURL: string) => Promise<void>;
+  oauthStart?: OAuthStartHandler;
+  oauthEnd?: () => Promise<void>;
+  returnOnOAuth?: boolean;
+  oboTokenResolver?: OboTokenResolver;
+  oboTrustChecker?: OboTrustChecker;
+}
+
+/** Options accepted by UserConnectionManager.getUserConnection. OAuth fields are optional. */
+export interface UserMCPConnectionOptions extends UserConnectionContext {
+  serverName: string;
+  forceNew?: boolean;
+  ephemeralConnection?: boolean;
+  serverConfig?: ParsedServerConfig;
+  flowManager?: FlowStateManager<o.MCPOAuthTokens | null>;
+  tokenMethods?: TokenMethods;
+  signal?: AbortSignal;
+  oauthStart?: OAuthStartHandler;
   oauthEnd?: () => Promise<void>;
   returnOnOAuth?: boolean;
+  oboTokenResolver?: OboTokenResolver;
+  oboTrustChecker?: OboTrustChecker;
 }
 
 export interface ToolDiscoveryOptions {
@@ -216,12 +259,15 @@ export interface ToolDiscoveryOptions {
   flowManager?: FlowStateManager<o.MCPOAuthTokens | null>;
   tokenMethods?: TokenMethods;
   signal?: AbortSignal;
-  oauthStart?: (authURL: string) => Promise<void>;
+  oauthStart?: OAuthStartHandler;
   customUserVars?: Record<string, string>;
   requestBody?: RequestBody;
+  graphTokenResolver?: GraphTokenResolver;
   connectionTimeout?: number;
   /** Pre-resolved config-source servers for tenant-scoped lookup */
   configServers?: Record<string, ParsedServerConfig>;
+  oboTokenResolver?: OboTokenResolver;
+  oboTrustChecker?: OboTrustChecker;
 }
 
 export interface ToolDiscoveryResult {
diff --git a/packages/api/src/mcp/utils.ts b/packages/api/src/mcp/utils.ts
index 9befc3c5499..ab79f691d3d 100644
--- a/packages/api/src/mcp/utils.ts
+++ b/packages/api/src/mcp/utils.ts
@@ -1,13 +1,239 @@
 import { Constants } from 'librechat-data-provider';
 import type { ParsedServerConfig } from '~/mcp/types';
+import type { RequestBody } from '~/types';
 
-export const mcpToolPattern = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);
+export const mcpToolPattern: RegExp = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);
+
+const RUNTIME_CONTEXT_PLACEHOLDER_PATTERN = /\{\{LIBRECHAT_(?:USER|OPENID|GRAPH|BODY)_[^}]+\}\}/;
+const RUNTIME_BODY_PLACEHOLDER_PATTERN = /\{\{LIBRECHAT_BODY_[^}]+\}\}/;
+const RUNTIME_BODY_PLACEHOLDER_CAPTURE_PATTERN = /\{\{LIBRECHAT_BODY_([^}]+)\}\}/g;
+
+const BODY_PLACEHOLDER_FIELDS: Record<string, keyof RequestBody> = {
+  CONVERSATIONID: 'conversationId',
+  PARENTMESSAGEID: 'parentMessageId',
+  MESSAGEID: 'messageId',
+};
+
+type PlaceholderValue =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | readonly PlaceholderValue[]
+  | { readonly [key: string]: PlaceholderValue };
+
+type UserScopedConnectionConfig = Pick<ParsedServerConfig, 'requiresOAuth' | 'source' | 'dbId'> & {
+  args?: string[];
+  /** Loosened from the parsed shapes so raw (pre-inspection) configs qualify;
+   *  scoping predicates only check key presence */
+  obo?: { scopes?: string } | null;
+  customUserVars?: Record<
+    string,
+    { description?: string; title?: string; sensitive?: boolean } | undefined
+  >;
+  env?: Record<string, string | undefined>;
+  headers?: Record<string, string | undefined>;
+  oauth?: PlaceholderValue;
+  oauth_headers?: Record<string, string | undefined>;
+  url?: string;
+};
+
+function placeholderBearingFields(config: UserScopedConnectionConfig): PlaceholderValue[] {
+  return [config.args, config.env, config.headers, config.oauth, config.oauth_headers, config.url];
+}
+
+/** Whether a server should use MCP OAuth handling. */
+export function isOAuthServer(
+  config: Pick<ParsedServerConfig, 'requiresOAuth' | 'oauth'>,
+): boolean {
+  if (config.requiresOAuth === false) {
+    return false;
+  }
+  return config.requiresOAuth === true || config.oauth != null;
+}
+
+/**
+ * Whether a server needs the OAuth-style connection wiring (flow manager,
+ * token methods, OBO/OAuth resolvers). Distinct from `isOAuthServer`: OBO
+ * servers reuse the same wiring even though they don't run an OAuth handshake,
+ * because the runtime needs `oboTokenResolver`/`oboTrustChecker` plumbed through.
+ *
+ * Without this, an OBO server with `requiresOAuth: false` would land in the
+ * non-OAuth branch of MCPManager.discoverServerTools / UserConnectionManager,
+ * which omits the OBO resolver — `usesObo` then evaluates to false in the
+ * factory and the connection sends a bare request that the upstream rejects.
+ */
+export function requiresOAuthMachinery(
+  config: Pick<ParsedServerConfig, 'requiresOAuth' | 'oauth' | 'obo'>,
+): boolean {
+  return isOAuthServer(config) || config.obo != null;
+}
 
 /** Checks that `customUserVars` is present AND non-empty (guards against truthy `{}`) */
-export function hasCustomUserVars(config: Pick<ParsedServerConfig, 'customUserVars'>): boolean {
+export function hasCustomUserVars(
+  config: Pick<UserScopedConnectionConfig, 'customUserVars'>,
+): boolean {
   return !!config.customUserVars && Object.keys(config.customUserVars).length > 0;
 }
 
+function hasRuntimeContextPlaceholder(value: PlaceholderValue): boolean {
+  return hasPlaceholder(value, RUNTIME_CONTEXT_PLACEHOLDER_PATTERN);
+}
+
+function hasPlaceholder(value: PlaceholderValue, pattern: RegExp): boolean {
+  if (typeof value === 'string') {
+    return pattern.test(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => hasPlaceholder(item, pattern));
+  }
+
+  if (value == null || typeof value !== 'object') {
+    return false;
+  }
+
+  return Object.values(value).some((item) => hasPlaceholder(item, pattern));
+}
+
+function addRuntimeBodyPlaceholderFields(value: PlaceholderValue, fields: Set<string>): void {
+  if (typeof value === 'string') {
+    for (const match of value.matchAll(RUNTIME_BODY_PLACEHOLDER_CAPTURE_PATTERN)) {
+      const placeholderKey = match[1];
+      if (placeholderKey) {
+        fields.add(BODY_PLACEHOLDER_FIELDS[placeholderKey] ?? placeholderKey);
+      }
+    }
+    return;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      addRuntimeBodyPlaceholderFields(item, fields);
+    }
+    return;
+  }
+
+  if (value == null || typeof value !== 'object') {
+    return;
+  }
+
+  for (const item of Object.values(value)) {
+    addRuntimeBodyPlaceholderFields(item, fields);
+  }
+}
+
+/**
+ * Trusted YAML/config servers may use per-user/request placeholders that can
+ * only be resolved once a real request context exists. User-sourced DB servers
+ * deliberately stay sandboxed and only resolve customUserVars.
+ */
+export function hasRuntimeContextPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some(hasRuntimeContextPlaceholder);
+}
+
+export function hasRuntimeUrlPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return hasRuntimeContextPlaceholder(config.url);
+}
+
+export function hasRuntimeBodyPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some((value) =>
+    hasPlaceholder(value, RUNTIME_BODY_PLACEHOLDER_PATTERN),
+  );
+}
+
+export function getRuntimeBodyPlaceholderFields(config: UserScopedConnectionConfig): string[] {
+  if (isUserSourced(config)) {
+    return [];
+  }
+
+  const fields = new Set<string>();
+  for (const value of placeholderBearingFields(config)) {
+    addRuntimeBodyPlaceholderFields(value, fields);
+  }
+  return Array.from(fields);
+}
+
+export function getMissingRuntimeBodyPlaceholderFields(
+  config: UserScopedConnectionConfig,
+  requestBody?: RequestBody,
+): string[] {
+  return getRuntimeBodyPlaceholderFields(config).filter((field) => {
+    const value = requestBody?.[field as keyof RequestBody];
+    return value == null || (typeof value === 'string' && value.trim() === '');
+  });
+}
+
+/**
+ * `BODY` placeholders vary by chat request, so the normal userId:serverName
+ * cache would reuse a connection built with stale request context.
+ *
+ * Ephemeral connections are created and torn down per tool call — configs using
+ * these placeholders pay a full connect + initialize on every invocation.
+ *
+ * User/OpenID/Graph placeholders still require user-scoped connections, but they
+ * are not request-scoped by themselves. HTTP transports refresh resolved headers
+ * before each tool call, so token/user headers can remain on the cached user
+ * connection without forcing a reconnect for every invocation.
+ */
+export function requiresEphemeralUserConnection(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some((value) =>
+    hasPlaceholder(value, RUNTIME_BODY_PLACEHOLDER_PATTERN),
+  );
+}
+
+/**
+ * Returns true when a server requires a per-user connection instead of an
+ * app-shared connection.
+ */
+export function requiresUserScopedConnection(config: UserScopedConnectionConfig): boolean {
+  return (
+    config.requiresOAuth === true ||
+    config.obo != null ||
+    hasCustomUserVars(config) ||
+    hasRuntimeContextPlaceholders(config)
+  );
+}
+
+/**
+ * Returns the names of `customUserVars` declared on the server config for which
+ * the user has not supplied a non-blank value (unset, empty, or whitespace-only
+ * values count as missing, since they still fail auth). An empty array means
+ * every declared variable is satisfied (or the server declares none).
+ *
+ * Used to gate tool exposure: a server that requires user-provided credentials
+ * should not surface its tools to the model until those values are set,
+ * otherwise every tool call fails authentication. See issue #10969.
+ */
+export function getMissingCustomUserVars(
+  config: Pick<ParsedServerConfig, 'customUserVars'>,
+  providedVars?: Record<string, string> | null,
+): string[] {
+  if (!hasCustomUserVars(config)) {
+    return [];
+  }
+  return Object.keys(config.customUserVars ?? {}).filter((key) => {
+    const value = providedVars?.[key];
+    return value == null || (typeof value === 'string' && value.trim() === '');
+  });
+}
+
 /**
  * Determines whether a server config is user-sourced (sandboxed placeholder resolution).
  * When `source` is set, it is authoritative. When absent (pre-upgrade cached configs),
@@ -21,11 +247,19 @@ export function isUserSourced(config: Pick<ParsedServerConfig, 'source' | 'dbId'
  * Allowlist-based sanitization for API responses. Only explicitly listed fields are included;
  * new fields added to ParsedServerConfig are excluded by default until allowlisted here.
  *
- * URLs are returned as-is: DB-stored configs reject ${VAR} patterns at validation time
- * (MCPServerUserInputSchema), and YAML configs are admin-managed. Env variable resolution
- * is handled at the schema/input boundary, not the output boundary.
+ * `url` and the oauth flow URLs (`authorization_url`, `token_url`, `revocation_endpoint`) can
+ * encode internal infrastructure, so they are stripped unless `canEdit` is set: the same
+ * disclosure threshold the PATCH route enforces. Callers derive `canEdit` per server (operator
+ * YAML/config-tier servers from the MANAGE_MCP_SERVERS capability, user-sourced servers from
+ * per-resource ACL EDIT), so a user-sourced config shared view-only does not disclose its URL
+ * to the viewer.
+ * DB-stored configs reject ${VAR} patterns at validation time (MCPServerUserInputSchema);
+ * env variable resolution is handled at the schema/input boundary.
  */
-export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedServerConfig> {
+export function redactServerSecrets(
+  config: ParsedServerConfig,
+  options?: { canEdit?: boolean },
+): Partial<ParsedServerConfig> {
   const safe: Partial<ParsedServerConfig> = {
     type: config.type,
     url: config.url,
@@ -61,6 +295,23 @@ export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedS
     safe.oauth = safeOAuth;
   }
 
+  if (config.obo) {
+    safe.obo = config.obo;
+  }
+
+  if (!options?.canEdit) {
+    delete safe.url;
+    if (safe.oauth) {
+      const {
+        authorization_url: _au,
+        token_url: _tu,
+        revocation_endpoint: _re,
+        ...restOAuth
+      } = safe.oauth;
+      safe.oauth = restOAuth;
+    }
+  }
+
   return Object.fromEntries(
     Object.entries(safe).filter(([, v]) => v !== undefined),
   ) as Partial<ParsedServerConfig>;
@@ -69,10 +320,12 @@ export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedS
 /** Applies allowlist-based sanitization to a map of server configs. */
 export function redactAllServerSecrets(
   configs: Record<string, ParsedServerConfig>,
+  options?: { canEditByServer?: ReadonlyMap<string, boolean> },
 ): Record<string, Partial<ParsedServerConfig>> {
   const result: Record<string, Partial<ParsedServerConfig>> = {};
   for (const [key, config] of Object.entries(configs)) {
-    result[key] = redactServerSecrets(config);
+    const canEdit = options?.canEditByServer?.get(key) ?? false;
+    result[key] = redactServerSecrets(config, { canEdit });
   }
   return result;
 }
diff --git a/packages/api/src/mcp/zod.ts b/packages/api/src/mcp/zod.ts
index 53cb6e71a8a..767c1919a5d 100644
--- a/packages/api/src/mcp/zod.ts
+++ b/packages/api/src/mcp/zod.ts
@@ -182,7 +182,7 @@ function convertToZodUnion(
 export function resolveJsonSchemaRefs<T extends Record<string, unknown>>(
   schema: T,
   definitions?: Record<string, unknown>,
-  visited = new Set<string>(),
+  visited: Set<string> = new Set<string>(),
 ): T {
   // Handle null, undefined, or non-object values first
   if (!schema || typeof schema !== 'object') {
@@ -322,6 +322,345 @@ export function normalizeJsonSchema<T extends Record<string, unknown>>(schema: T
   return result as T;
 }
 
+function isNullSchema(member: unknown): boolean {
+  return (
+    member != null &&
+    typeof member === 'object' &&
+    (member as Record<string, unknown>).type === 'null'
+  );
+}
+
+function mergeProperties(a: unknown, b: unknown): Record<string, unknown> | undefined {
+  const objA =
+    a && typeof a === 'object' && !Array.isArray(a) ? (a as Record<string, unknown>) : undefined;
+  const objB =
+    b && typeof b === 'object' && !Array.isArray(b) ? (b as Record<string, unknown>) : undefined;
+  if (!objA && !objB) {
+    return undefined;
+  }
+  return { ...(objA ?? {}), ...(objB ?? {}) };
+}
+
+function mergeRequired(a: unknown, b: unknown): string[] | undefined {
+  const arrA = Array.isArray(a) ? (a as string[]) : [];
+  const arrB = Array.isArray(b) ? (b as string[]) : [];
+  if (arrA.length === 0 && arrB.length === 0) {
+    return undefined;
+  }
+  return Array.from(new Set([...arrA, ...arrB]));
+}
+
+/**
+ * JSON Schema keywords absent from Gemini's function-calling Schema subset
+ * (https://ai.google.dev/api/caching#Schema); they trigger `Unknown name "<key>"`
+ * 400s and are stripped. Every entry below was verified to be rejected through
+ * `FunctionDeclaration.parameters` against the live Gemini API (`gemini-2.5-flash`,
+ * `gemini-3.5-flash`) and/or Vertex AI — e.g. `additionalProperties` is rejected
+ * only by the Gemini API but accepted by Vertex, so the union is stripped for both.
+ * `@langchain/google-genai` only removes `additionalProperties`/`$schema`, so the
+ * rest must be stripped here.
+ *
+ * Not listed (handled elsewhere in `sanitizeGeminiSchema`): `default` is preserved
+ * (part of Gemini's Schema, accepted live by both endpoints); `prefixItems` is
+ * dropped but synthesized into `items` so the array keeps a required element schema.
+ */
+const GEMINI_UNSUPPORTED_KEYS = new Set([
+  'additionalProperties',
+  '$schema',
+  '$id',
+  'id',
+  '$comment',
+  'examples',
+  'readOnly',
+  'writeOnly',
+  'deprecated',
+  'multipleOf',
+  'uniqueItems',
+  'additionalItems',
+  'propertyNames',
+  'patternProperties',
+  'dependencies',
+  'dependentRequired',
+  'dependentSchemas',
+  'contentEncoding',
+  'contentMediaType',
+  'contentSchema',
+]);
+
+/**
+ * Merges the members of an `allOf` (schema intersection) into the parent: combines
+ * `properties`/`required` and fills any scalar keyword the parent doesn't already set.
+ */
+function mergeAllOf(schema: Record<string, unknown>): Record<string, unknown> {
+  const members = (schema.allOf as unknown[]).filter(
+    (member): member is Record<string, unknown> => member != null && typeof member === 'object',
+  );
+  const result = { ...schema };
+  delete result.allOf;
+  let properties = mergeProperties(result.properties, undefined);
+  let required = mergeRequired(result.required, undefined);
+  for (const member of members) {
+    properties = mergeProperties(properties, member.properties);
+    required = mergeRequired(required, member.required);
+    for (const [key, value] of Object.entries(member)) {
+      if (key !== 'properties' && key !== 'required' && !(key in result)) {
+        result[key] = value;
+      }
+    }
+  }
+  if (properties) {
+    result.properties = properties;
+  }
+  if (required) {
+    result.required = required;
+  }
+  return result;
+}
+
+/**
+ * Collapses a single `anyOf`/`oneOf` level into its parent by keeping the first
+ * non-null member, marking the field nullable when a `null` member was present.
+ * Parent and branch `properties`/`required` are merged so fields declared outside
+ * the union (e.g. always-required args) survive the collapse. Loops to fully strip
+ * union keys that the chosen member re-introduces.
+ */
+function collapseSchemaUnion(schema: Record<string, unknown>): Record<string, unknown> {
+  let current = schema;
+  let guard = 0;
+
+  while (guard < 200) {
+    guard += 1;
+    if (Array.isArray(current.allOf)) {
+      current = mergeAllOf(current);
+      continue;
+    }
+    let unionKey: 'anyOf' | 'oneOf' | null = null;
+    if (Array.isArray(current.anyOf)) {
+      unionKey = 'anyOf';
+    } else if (Array.isArray(current.oneOf)) {
+      unionKey = 'oneOf';
+    }
+    if (!unionKey) {
+      break;
+    }
+
+    const members = (current[unionKey] as unknown[]).filter(
+      (member): member is Record<string, unknown> => member != null && typeof member === 'object',
+    );
+    const nonNull = members.filter((member) => !isNullSchema(member));
+    const hadNull = nonNull.length !== members.length;
+    const chosen = nonNull[0] ?? {};
+
+    const rest = { ...current };
+    delete rest[unionKey];
+
+    const mergedProperties = mergeProperties(rest.properties, chosen.properties);
+    const mergedRequired = mergeRequired(rest.required, chosen.required);
+
+    current = { ...rest, ...chosen };
+    if (mergedProperties) {
+      current.properties = mergedProperties;
+    }
+    if (mergedRequired) {
+      current.required = mergedRequired;
+    }
+    if (hadNull) {
+      current.nullable = true;
+    }
+  }
+
+  return current;
+}
+
+/** True when the value is a usable JSON Schema object (not a boolean or array). */
+function isObjectSchema(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+
+/**
+ * Collapses a multi-entry `type` array (e.g. `['string', 'null']`) into a single
+ * type, reporting whether a `null` entry made the field nullable.
+ */
+function collapseTypeArray(types: unknown[]): { type?: string; nullable: boolean } {
+  const nonNull = types.filter((type) => type !== 'null');
+  const first = nonNull[0];
+  return {
+    type: typeof first === 'string' ? first : undefined,
+    nullable: nonNull.length !== types.length,
+  };
+}
+
+/**
+ * Sanitizes a JSON schema to Gemini/Vertex AI's function-calling Schema subset
+ * (https://ai.google.dev/api/caching#Schema), recursively. Gemini accepts only a
+ * restricted slice of JSON Schema, and `@langchain/google-common`'s
+ * `zod_to_gemini_parameters` additionally throws on any union — so MCP tools that
+ * ship richer schemas crash on the Google endpoint while working on OpenAI/Claude.
+ *
+ * Transforms (all lossy and Gemini-specific — gate on the Google/Vertex provider,
+ * run after `normalizeJsonSchema`):
+ * - Collapses `anyOf`/`oneOf` to the first non-null member (merging parent + branch
+ *   `properties`/`required`), and merges `allOf` intersections.
+ * - Collapses multi-entry `type` arrays to a single type, tracking `nullable`.
+ * - Keeps only string `enum` values — Gemini's `enum` is `Type.STRING`-only — and
+ *   drops the keyword entirely for non-string types (e.g. a boolean `const`
+ *   normalized to `enum: [true]`).
+ * - Folds `exclusiveMinimum`/`exclusiveMaximum` into `minimum`/`maximum`.
+ * - Strips `const` (after enum conversion) and every keyword in `GEMINI_UNSUPPORTED_KEYS`
+ *   (`additionalProperties`, `examples`, `readOnly`, `multipleOf`, `uniqueItems`,
+ *   `patternProperties`, `prefixItems`, etc.) that the Gemini schema validator rejects.
+ *
+ * @param schema - The JSON schema to sanitize
+ * @returns The Gemini-compatible schema
+ */
+export function sanitizeGeminiSchema<T extends Record<string, unknown>>(schema: T): T {
+  if (!schema || typeof schema !== 'object') {
+    return schema;
+  }
+
+  if (Array.isArray(schema)) {
+    return schema.map((item) =>
+      item && typeof item === 'object' ? sanitizeGeminiSchema(item) : item,
+    ) as unknown as T;
+  }
+
+  const collapsed = collapseSchemaUnion(schema);
+  const typeHasNull =
+    Array.isArray(collapsed.type) && (collapsed.type as unknown[]).includes('null');
+  const nullable = collapsed.nullable === true || typeHasNull;
+
+  let effectiveType: string | undefined;
+  if (Array.isArray(collapsed.type)) {
+    effectiveType = collapseTypeArray(collapsed.type as unknown[]).type;
+  } else if (typeof collapsed.type === 'string') {
+    effectiveType = collapsed.type;
+  }
+
+  const result: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(collapsed)) {
+    if (GEMINI_UNSUPPORTED_KEYS.has(key)) {
+      continue;
+    }
+
+    if (key === 'type' && Array.isArray(value)) {
+      if (effectiveType !== undefined) {
+        result['type'] = effectiveType;
+      }
+      continue;
+    }
+
+    // Re-emitted once below so type-array and union sources don't double up.
+    if (key === 'nullable') {
+      continue;
+    }
+
+    // `default` holds a literal data value (Gemini-supported), not a subschema —
+    // copy it verbatim so object/array defaults aren't recursively sanitized
+    // (which would strip ordinary data keys like `id`/`readOnly`).
+    if (key === 'default') {
+      result['default'] = value;
+      continue;
+    }
+
+    // Gemini has no tuple validation, so drop `prefixItems`; but Gemini requires
+    // `items` to be a schema object on every array, so synthesize one from the
+    // first tuple member unless a real object `items` is already present (a
+    // boolean `items: false` does not count).
+    if (key === 'prefixItems') {
+      if (!isObjectSchema(collapsed.items) && Array.isArray(value)) {
+        const first = value.find((member) => member && typeof member === 'object');
+        if (first) {
+          result['items'] = sanitizeGeminiSchema(first as Record<string, unknown>);
+        }
+      }
+      continue;
+    }
+
+    // Gemini requires `items` to be a schema object; drop the boolean
+    // (`items: false`) and tuple-array (`items: [...]`) forms — a
+    // `prefixItems`-derived or empty fallback is emitted instead.
+    if (key === 'items') {
+      if (isObjectSchema(value)) {
+        result['items'] = sanitizeGeminiSchema(value as Record<string, unknown>);
+      }
+      continue;
+    }
+
+    // Gemini has no `const`; a string const becomes a single-value (string) enum,
+    // a non-string const is dropped (Gemini enum is string-only).
+    if (key === 'const') {
+      if (typeof value === 'string' && !('enum' in collapsed)) {
+        result['enum'] = [value];
+      }
+      continue;
+    }
+
+    // Gemini has no exclusive bounds; fold them into the inclusive ones it accepts.
+    if (key === 'exclusiveMinimum') {
+      if (typeof value === 'number' && !('minimum' in collapsed)) {
+        result['minimum'] = value;
+      }
+      continue;
+    }
+    if (key === 'exclusiveMaximum') {
+      if (typeof value === 'number' && !('maximum' in collapsed)) {
+        result['maximum'] = value;
+      }
+      continue;
+    }
+
+    // Gemini `enum` is Type.STRING-only: keep string values only when the effective
+    // (collapsed) type is string or unset; drop the keyword entirely for non-string
+    // types (e.g. boolean/number), which also covers null-stripping for string enums.
+    if (key === 'enum' && Array.isArray(value)) {
+      const enumAllowed = effectiveType === undefined || effectiveType === 'string';
+      const stringValues = enumAllowed ? value.filter((entry) => typeof entry === 'string') : [];
+      if (stringValues.length > 0) {
+        result['enum'] = stringValues;
+      }
+      continue;
+    }
+
+    if (key === 'properties' && value && typeof value === 'object' && !Array.isArray(value)) {
+      const newProps: Record<string, unknown> = {};
+      for (const [propKey, propValue] of Object.entries(value as Record<string, unknown>)) {
+        newProps[propKey] =
+          propValue && typeof propValue === 'object'
+            ? sanitizeGeminiSchema(propValue as Record<string, unknown>)
+            : propValue;
+      }
+      result[key] = newProps;
+      continue;
+    }
+
+    if (value && typeof value === 'object') {
+      result[key] = sanitizeGeminiSchema(value as Record<string, unknown>);
+      continue;
+    }
+
+    result[key] = value;
+  }
+
+  // A surviving enum implies a string field; Gemini's enum requires Type.STRING.
+  if ('enum' in result && !('type' in result)) {
+    result['type'] = 'string';
+  }
+
+  // Gemini rejects an array whose `items` is missing or not a schema object; fall
+  // back to a permissive empty schema (verified accepted by the API) so tuple/
+  // itemless arrays don't 400 after their unsupported item forms are dropped.
+  if (result['type'] === 'array' && !isObjectSchema(result['items'])) {
+    result['items'] = {};
+  }
+
+  if (nullable) {
+    result['nullable'] = true;
+  }
+
+  return result as T;
+}
+
 /**
  * Converts a JSON Schema to a Zod schema.
  *
@@ -568,7 +907,7 @@ export function convertJsonSchemaToZod(
 export function convertWithResolvedRefs(
   schema: JsonSchemaType & Record<string, unknown>,
   options?: ConvertJsonSchemaToZodOptions,
-) {
+): z.ZodType | undefined {
   const resolved = resolveJsonSchemaRefs(schema);
   return convertJsonSchemaToZod(resolved, options);
 }
diff --git a/packages/api/src/memory/config.spec.ts b/packages/api/src/memory/config.spec.ts
index 4a836cefa01..3cadc07ed6c 100644
--- a/packages/api/src/memory/config.spec.ts
+++ b/packages/api/src/memory/config.spec.ts
@@ -1,4 +1,5 @@
 import { logger } from '@librechat/data-schemas';
+import { DEFAULT_MEMORY_MAX_INPUT_TOKENS } from 'librechat-data-provider';
 
 import type { TCustomConfig } from 'librechat-data-provider';
 
@@ -14,6 +15,7 @@ describe('memory config', () => {
 
     expect(isMemoryEnabled(loaded)).toBe(true);
     expect(isMemoryAgentEnabled(loaded)).toBe(false);
+    expect(loaded?.maxInputTokens).toBe(DEFAULT_MEMORY_MAX_INPUT_TOKENS);
   });
 
   it('requires explicit memory agent enablement before enabling the automatic agent flow', () => {
diff --git a/packages/api/src/middleware/__tests__/tenant.spec.ts b/packages/api/src/middleware/__tests__/tenant.spec.ts
index d393cdfe0d9..ff9ddd1a1a0 100644
--- a/packages/api/src/middleware/__tests__/tenant.spec.ts
+++ b/packages/api/src/middleware/__tests__/tenant.spec.ts
@@ -1,5 +1,11 @@
 import { unlink } from 'fs/promises';
-import { getTenantId, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import {
+  getTenantId,
+  getUserId,
+  getRequestId,
+  SYSTEM_TENANT_ID,
+  logger,
+} from '@librechat/data-schemas';
 import type { Response, NextFunction } from 'express';
 import type { ServerRequest } from '~/types/http';
 // Import directly from source file — _resetTenantMiddlewareStrictCache is intentionally
@@ -18,11 +24,18 @@ jest.mock('fs/promises', () => ({
 const unlinkMock = unlink as jest.MockedFunction<typeof unlink>;
 
 function mockReq(user?: Record<string, unknown>): ServerRequest {
-  return { user } as unknown as ServerRequest;
+  return { headers: {}, user } as unknown as ServerRequest;
 }
 
 function mockTenantReq(user?: Record<string, unknown>, tenantId?: string): ServerRequest {
-  return { user, tenantId } as unknown as ServerRequest;
+  return { headers: {}, user, tenantId } as unknown as ServerRequest;
+}
+
+function mockReqWithHeaders(
+  user: Record<string, unknown> | undefined,
+  headers: Record<string, string>,
+): ServerRequest {
+  return { headers, user } as unknown as ServerRequest;
 }
 
 function mockRes(): Response {
@@ -43,11 +56,32 @@ function runMiddleware(req: ServerRequest, res: Response): Promise<string | unde
   });
 }
 
+function runMiddlewareContext(
+  req: ServerRequest,
+  res: Response,
+): Promise<{
+  tenantId?: string;
+  userId?: string;
+  requestId?: string;
+}> {
+  return new Promise((resolve) => {
+    const next: NextFunction = () => {
+      resolve({
+        tenantId: getTenantId(),
+        userId: getUserId(),
+        requestId: getRequestId(),
+      });
+    };
+    tenantContextMiddleware(req, res, next);
+  });
+}
+
 describe('tenantContextMiddleware', () => {
   afterEach(() => {
     _resetTenantMiddlewareStrictCache();
     delete process.env.TENANT_ISOLATION_STRICT;
     unlinkMock.mockClear();
+    jest.restoreAllMocks();
   });
 
   it('sets ALS tenant context for authenticated requests with tenantId', async () => {
@@ -58,6 +92,22 @@ describe('tenantContextMiddleware', () => {
     expect(tenantId).toBe('tenant-x');
   });
 
+  it('sets ALS user and request context for authenticated tenant requests', async () => {
+    const req = mockReqWithHeaders(
+      { id: 'user-123', tenantId: 'tenant-x', role: 'user' },
+      { 'x-request-id': 'req-abc' },
+    );
+    const res = mockRes();
+
+    const context = await runMiddlewareContext(req, res);
+
+    expect(context).toEqual({
+      tenantId: 'tenant-x',
+      userId: 'user-123',
+      requestId: 'req-abc',
+    });
+  });
+
   it('is a no-op for unauthenticated requests (no user)', async () => {
     const req = mockReq();
     const res = mockRes();
@@ -74,6 +124,22 @@ describe('tenantContextMiddleware', () => {
     expect(tenantId).toBeUndefined();
   });
 
+  it('keeps user context in non-strict single-tenant mode', async () => {
+    const req = mockReqWithHeaders(
+      { id: 'single-user', role: 'user' },
+      { 'x-request-id': 'req-1' },
+    );
+    const res = mockRes();
+
+    const context = await runMiddlewareContext(req, res);
+
+    expect(context).toEqual({
+      tenantId: undefined,
+      userId: 'single-user',
+      requestId: 'req-1',
+    });
+  });
+
   it('returns 403 when user has no tenantId in strict mode', async () => {
     process.env.TENANT_ISOLATION_STRICT = 'true';
     _resetTenantMiddlewareStrictCache();
@@ -102,6 +168,20 @@ describe('tenantContextMiddleware', () => {
     expect(tenantId).toBe('tenant-y');
   });
 
+  it('rejects a normalized system tenant sentinel for authenticated requests', async () => {
+    const req = mockReq({ tenantId: ` ${SYSTEM_TENANT_ID} `, role: 'user' });
+    const res = mockRes();
+    const next: NextFunction = jest.fn();
+
+    await tenantContextMiddleware(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'System tenant is not allowed for request-scoped routes',
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
   it('different requests get independent tenant contexts', async () => {
     const runRequest = (tid: string) => {
       const req = mockReq({ tenantId: tid, role: 'user' });
@@ -122,6 +202,7 @@ describe('restoreTenantContextFromReq', () => {
     _resetTenantMiddlewareStrictCache();
     delete process.env.TENANT_ISOLATION_STRICT;
     unlinkMock.mockClear();
+    jest.restoreAllMocks();
   });
 
   it('restores ALS tenant context from req.user.tenantId', async () => {
@@ -139,6 +220,34 @@ describe('restoreTenantContextFromReq', () => {
     expect(tenantId).toBe('tenant-user');
   });
 
+  it('restores user and request context alongside tenant context', async () => {
+    const req = mockReqWithHeaders(
+      { id: 'restore-user', tenantId: 'tenant-user', role: 'user' },
+      { 'x-correlation-id': 'corr-123' },
+    );
+    const res = mockRes();
+
+    const context = await new Promise<{
+      tenantId?: string;
+      userId?: string;
+      requestId?: string;
+    }>((resolve) => {
+      restoreTenantContextFromReq(req, res, () => {
+        resolve({
+          tenantId: getTenantId(),
+          userId: getUserId(),
+          requestId: getRequestId(),
+        });
+      });
+    });
+
+    expect(context).toEqual({
+      tenantId: 'tenant-user',
+      userId: 'restore-user',
+      requestId: 'corr-123',
+    });
+  });
+
   it('prefers server-resolved req.tenantId over req.user.tenantId', async () => {
     const req = mockTenantReq({ tenantId: 'tenant-user', role: 'user' }, 'tenant-request');
     const res = mockRes();
@@ -187,6 +296,37 @@ describe('restoreTenantContextFromReq', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it('keeps request context while cleaning up rejected strict-mode uploads', async () => {
+    process.env.TENANT_ISOLATION_STRICT = 'true';
+    _resetTenantMiddlewareStrictCache();
+    unlinkMock.mockRejectedValueOnce(new Error('unlink failed'));
+    let observedContext: { userId?: string; requestId?: string } | undefined;
+    jest.spyOn(logger, 'error').mockImplementation(() => {
+      observedContext = {
+        userId: getUserId(),
+        requestId: getRequestId(),
+      };
+      return logger;
+    });
+
+    const req = {
+      ...mockReqWithHeaders({ id: 'strict-user', role: 'user' }, { 'x-request-id': 'req-strict' }),
+      file: { path: '/tmp/no-tenant-upload' },
+    } as ServerRequest;
+    const res = mockRes();
+    const next: NextFunction = jest.fn();
+
+    await restoreTenantContextFromReq(req, res, next);
+
+    expect(logger.error).toHaveBeenCalledWith(
+      '[restoreTenantContextFromReq] Failed to delete rejected upload:',
+      expect.objectContaining({ path: '/tmp/no-tenant-upload' }),
+    );
+    expect(observedContext).toEqual({ userId: 'strict-user', requestId: 'req-strict' });
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
   it('rejects the system tenant sentinel for request-owned work', async () => {
     const req = mockReq({ tenantId: SYSTEM_TENANT_ID, role: 'user' });
     const res = mockRes();
@@ -198,6 +338,37 @@ describe('restoreTenantContextFromReq', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it('rejects a normalized system tenant sentinel for request-owned work', async () => {
+    const req = mockTenantReq({ role: 'user' }, ` ${SYSTEM_TENANT_ID} `);
+    const res = mockRes();
+    const next: NextFunction = jest.fn();
+
+    await restoreTenantContextFromReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'System tenant is not allowed for request-scoped routes',
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('rejects blank server-resolved tenant IDs in strict mode', async () => {
+    process.env.TENANT_ISOLATION_STRICT = 'true';
+    _resetTenantMiddlewareStrictCache();
+
+    const req = mockTenantReq({ role: 'user' }, '   ');
+    const res = mockRes();
+    const next: NextFunction = jest.fn();
+
+    await restoreTenantContextFromReq(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({ error: expect.stringContaining('Tenant context required') }),
+    );
+    expect(next).not.toHaveBeenCalled();
+  });
+
   it('deletes uploaded temp files before rejecting system-tenant requests', async () => {
     const req = {
       ...mockReq({ tenantId: SYSTEM_TENANT_ID, role: 'user' }),
diff --git a/packages/api/src/middleware/access.spec.ts b/packages/api/src/middleware/access.spec.ts
index 99257adf6d7..c77508b1534 100644
--- a/packages/api/src/middleware/access.spec.ts
+++ b/packages/api/src/middleware/access.spec.ts
@@ -6,7 +6,12 @@ import {
   EndpointURLs,
 } from 'librechat-data-provider';
 import type { IRole, IUser } from '@librechat/data-schemas';
-import { checkAccess, generateCheckAccess, skipAgentCheck } from './access';
+import {
+  checkAccess,
+  checkAccessWithRequestCache,
+  generateCheckAccess,
+  skipAgentCheck,
+} from './access';
 
 // Mock logger
 jest.mock('@librechat/data-schemas', () => ({
@@ -269,6 +274,100 @@ describe('access middleware', () => {
     });
   });
 
+  describe('checkAccessWithRequestCache', () => {
+    const defaultParams = {
+      user: {
+        id: 'user123',
+        role: 'user',
+        email: 'test@example.com',
+        emailVerified: true,
+        provider: 'local',
+      } as IUser,
+      permissionType: PermissionTypes.MCP_SERVERS,
+      permissions: [Permissions.USE],
+      getRoleByName: jest.fn(),
+    };
+
+    const allowedRole = {
+      name: 'user',
+      permissions: {
+        [PermissionTypes.MCP_SERVERS]: {
+          [Permissions.USE]: true,
+          [Permissions.CREATE]: true,
+        },
+      },
+    } as unknown as IRole;
+
+    it('should memoize permission checks for the same request', async () => {
+      defaultParams.getRoleByName.mockResolvedValue(allowedRole);
+
+      const params = {
+        ...defaultParams,
+        req: mockReq as Request,
+      };
+
+      await expect(checkAccessWithRequestCache(params)).resolves.toBe(true);
+      await expect(checkAccessWithRequestCache(params)).resolves.toBe(true);
+
+      expect(defaultParams.getRoleByName).toHaveBeenCalledTimes(1);
+    });
+
+    it('should share an in-flight permission check for the same request', async () => {
+      defaultParams.getRoleByName.mockResolvedValue(allowedRole);
+
+      const params = {
+        ...defaultParams,
+        req: mockReq as Request,
+      };
+
+      await expect(
+        Promise.all([checkAccessWithRequestCache(params), checkAccessWithRequestCache(params)]),
+      ).resolves.toEqual([true, true]);
+
+      expect(defaultParams.getRoleByName).toHaveBeenCalledTimes(1);
+    });
+
+    it('should isolate memoized checks between requests', async () => {
+      defaultParams.getRoleByName.mockResolvedValue(allowedRole);
+
+      await expect(
+        checkAccessWithRequestCache({
+          ...defaultParams,
+          req: mockReq as Request,
+        }),
+      ).resolves.toBe(true);
+      await expect(
+        checkAccessWithRequestCache({
+          ...defaultParams,
+          req: { ...mockReq } as Request,
+        }),
+      ).resolves.toBe(true);
+
+      expect(defaultParams.getRoleByName).toHaveBeenCalledTimes(2);
+    });
+
+    it('should use separate cache entries for different permissions', async () => {
+      defaultParams.getRoleByName.mockResolvedValue(allowedRole);
+
+      await expect(
+        checkAccessWithRequestCache({
+          ...defaultParams,
+          req: mockReq as Request,
+          permissions: [Permissions.USE],
+        }),
+      ).resolves.toBe(true);
+      await expect(
+        checkAccessWithRequestCache({
+          ...defaultParams,
+          req: mockReq as Request,
+          permissions: [Permissions.CREATE],
+        }),
+      ).resolves.toBe(true);
+
+      expect(defaultParams.getRoleByName).toHaveBeenCalledTimes(2);
+    });
+  });
+
   describe('generateCheckAccess', () => {
     it('should create middleware that allows access when user has permissions', async () => {
       const mockRole = {
diff --git a/packages/api/src/middleware/access.ts b/packages/api/src/middleware/access.ts
index 8b3d83d037d..3b90d49d40b 100644
--- a/packages/api/src/middleware/access.ts
+++ b/packages/api/src/middleware/access.ts
@@ -24,6 +24,54 @@ export function skipAgentCheck(req?: ServerRequest): boolean {
   return !isAgentsEndpoint(req.body.endpoint);
 }
 
+export interface CheckAccessParams {
+  user: IUser;
+  req?: ServerRequest;
+  permissionType: PermissionTypes;
+  permissions: Permissions[];
+  bodyProps?: Record<Permissions, string[]>;
+  checkObject?: object;
+  /** If skipCheck function is provided and returns true, skip permission checking */
+  skipCheck?: (req?: ServerRequest) => boolean;
+  getRoleByName: (roleName: string, fieldsToSelect?: string | string[]) => Promise<IRole | null>;
+}
+
+export type CheckAccessWithRequestCacheParams = Omit<
+  CheckAccessParams,
+  'bodyProps' | 'checkObject' | 'skipCheck'
+>;
+
+type RequestPermissionCache = Map<string, Promise<boolean>>;
+
+const requestPermissionCacheKey = '__librechatRequestPermissionCache';
+
+function getRequestPermissionCache(req?: ServerRequest): RequestPermissionCache | null {
+  if (!req) {
+    return null;
+  }
+
+  const reqWithCache = req as ServerRequest & {
+    [requestPermissionCacheKey]?: RequestPermissionCache;
+  };
+
+  if (!reqWithCache[requestPermissionCacheKey]) {
+    Object.defineProperty(reqWithCache, requestPermissionCacheKey, {
+      value: new Map<string, Promise<boolean>>(),
+      enumerable: false,
+    });
+  }
+
+  return reqWithCache[requestPermissionCacheKey] ?? null;
+}
+
+function getRequestPermissionCacheKey({
+  user,
+  permissionType,
+  permissions,
+}: CheckAccessWithRequestCacheParams): string {
+  return [permissionType, [...permissions].sort().join(','), user.id, user.role].join(':');
+}
+
 /**
  * Core function to check if a user has one or more required permissions
  * @param user - The user object
@@ -43,17 +91,7 @@ export const checkAccess = async ({
   bodyProps = {} as Record<Permissions, string[]>,
   checkObject = {},
   skipCheck,
-}: {
-  user: IUser;
-  req?: ServerRequest;
-  permissionType: PermissionTypes;
-  permissions: Permissions[];
-  bodyProps?: Record<Permissions, string[]>;
-  checkObject?: object;
-  /** If skipCheck function is provided and returns true, skip permission checking */
-  skipCheck?: (req?: ServerRequest) => boolean;
-  getRoleByName: (roleName: string, fieldsToSelect?: string | string[]) => Promise<IRole | null>;
-}): Promise<boolean> => {
+}: CheckAccessParams): Promise<boolean> => {
   if (skipCheck && skipCheck(req)) {
     return true;
   }
@@ -85,6 +123,35 @@ export const checkAccess = async ({
   return false;
 };
 
+/**
+ * Checks simple role permissions using a per-request promise cache.
+ * Use this only for checks whose result is fully described by user, role, permission type, and permissions.
+ */
+export const checkAccessWithRequestCache = async (
+  params: CheckAccessWithRequestCacheParams,
+): Promise<boolean> => {
+  if (!params.req || !params.user?.id || !params.user?.role) {
+    return await checkAccess(params);
+  }
+
+  const cache = getRequestPermissionCache(params.req);
+  if (!cache) {
+    return await checkAccess(params);
+  }
+
+  const cacheKey = getRequestPermissionCacheKey(params);
+  let cachedCheck = cache.get(cacheKey);
+  if (!cachedCheck) {
+    cachedCheck = checkAccess(params).catch((error) => {
+      cache.delete(cacheKey);
+      throw error;
+    });
+    cache.set(cacheKey, cachedCheck);
+  }
+
+  return await cachedCheck;
+};
+
 /**
  * Middleware to check if a user has one or more required permissions, optionally based on `req.body` properties.
  * @param permissionType - The type of permission to check.
diff --git a/packages/api/src/middleware/admin.ts b/packages/api/src/middleware/admin.ts
index d770adfd85a..07bbd392183 100644
--- a/packages/api/src/middleware/admin.ts
+++ b/packages/api/src/middleware/admin.ts
@@ -7,7 +7,11 @@ import type { ServerRequest } from '~/types/http';
  * Middleware to check if authenticated user has admin role.
  * Should be used AFTER authentication middleware (requireJwtAuth, requireLocalAuth, etc.)
  */
-export const requireAdmin = (req: ServerRequest, res: Response, next: NextFunction) => {
+export const requireAdmin = (
+  req: ServerRequest,
+  res: Response,
+  next: NextFunction,
+): Response | undefined => {
   if (!req.user) {
     logger.warn('[requireAdmin] No user found in request');
     return res.status(401).json({
diff --git a/packages/api/src/middleware/auth.spec.ts b/packages/api/src/middleware/auth.spec.ts
new file mode 100644
index 00000000000..1c39b387df3
--- /dev/null
+++ b/packages/api/src/middleware/auth.spec.ts
@@ -0,0 +1,206 @@
+import {
+  buildSafeAuthLogContext,
+  formatAuthLogMessage,
+  getAuthFailureErrorName,
+  getAuthFailureReason,
+} from './auth';
+import type { AuthLogRequest, AuthLogState } from './auth';
+
+function createRequest(overrides: Partial<AuthLogRequest> = {}): AuthLogRequest {
+  return {
+    headers: {},
+    method: 'GET',
+    path: '/api/messages',
+    originalUrl: '/api/messages',
+    ...overrides,
+  };
+}
+
+function createAuthState(overrides: Partial<AuthLogState> = {}): AuthLogState {
+  return {
+    tokenProvider: 'openid',
+    openidReuseEnabled: true,
+    openidJwtAvailable: true,
+    hasOpenIdReuseUserId: true,
+    ...overrides,
+  };
+}
+
+describe('auth middleware logging helpers', () => {
+  it('builds safe auth log context without raw query strings or user identifiers', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        id: 'request-id',
+        path: undefined,
+        originalUrl: '/api/ask?access_token=secret-token',
+      }),
+      createAuthState(),
+      {
+        attempted_strategies: ['openidJwt', 'jwt'],
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      },
+    );
+
+    expect(log).toEqual({
+      request_id: 'request-id',
+      method: 'GET',
+      path: '/api/ask',
+      token_provider: 'openid',
+      openid_reuse_enabled: true,
+      openid_jwt_available: true,
+      has_openid_reuse_user_id: true,
+      attempted_strategies: ['openidJwt', 'jwt'],
+      fallback_attempted: true,
+      fallback_succeeded: false,
+      reason: 'jwt expired',
+      error_name: 'TokenExpiredError',
+      status: 401,
+    });
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('uses request headers when request ids are not directly set', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        headers: {
+          'x-request-id': ['header-request-id'],
+        },
+      }),
+      createAuthState({
+        tokenProvider: null,
+        openidReuseEnabled: false,
+        openidJwtAvailable: false,
+        hasOpenIdReuseUserId: false,
+      }),
+    );
+
+    expect(log).toEqual({
+      request_id: 'header-request-id',
+      method: 'GET',
+      path: '/api/messages',
+      openid_reuse_enabled: false,
+      openid_jwt_available: false,
+      has_openid_reuse_user_id: false,
+    });
+  });
+
+  it('buckets unknown token providers to keep auth logs low-cardinality', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest(),
+      createAuthState({
+        tokenProvider: 'attacker-controlled-provider',
+      }),
+    );
+
+    expect(log.token_provider).toBe('other');
+  });
+
+  it('prefers route buckets over concrete dynamic request paths', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        baseUrl: '/api/messages',
+        path: '/conversation-123/message-456',
+        originalUrl: '/api/messages/conversation-123/message-456?access_token=secret-token',
+      }),
+      createAuthState(),
+    );
+
+    expect(log.path).toBe('/api/messages');
+    expect(JSON.stringify(log)).not.toContain('conversation-123');
+    expect(JSON.stringify(log)).not.toContain('message-456');
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('logs route templates when Express exposes them', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        baseUrl: '/api/share',
+        path: '/link/conversation-123',
+        route: { path: '/link/:conversationId' },
+      }),
+      createAuthState(),
+    );
+
+    expect(log.path).toBe('/api/share/link/:conversationId');
+  });
+
+  it('drops unsupported extra values and keeps safe arrays primitive', () => {
+    const log = buildSafeAuthLogContext(createRequest({ id: 'request-id' }), createAuthState(), {
+      attempted_strategies: ['openidJwt', '', { strategy: 'jwt' }, 'jwt'],
+      fallback_attempted: true,
+      path: { unsafe: true },
+      request_id: { unsafe: true },
+      status: Number.NaN,
+      unsafe_object: { token: 'secret-token' },
+      reason: '  jwt expired  ',
+    });
+
+    expect(log).toEqual({
+      request_id: 'request-id',
+      method: 'GET',
+      path: '/api/messages',
+      token_provider: 'openid',
+      openid_reuse_enabled: true,
+      openid_jwt_available: true,
+      has_openid_reuse_user_id: true,
+      attempted_strategies: ['openidJwt', 'jwt'],
+      fallback_attempted: true,
+      reason: 'jwt expired',
+    });
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('formats auth log messages with serialized safe context for stdout collectors', () => {
+    const log = buildSafeAuthLogContext(createRequest({ id: 'request-id' }), createAuthState(), {
+      fallback_attempted: true,
+      reason: 'jwt expired',
+      error_name: 'TokenExpiredError',
+      status: 401,
+    });
+
+    expect(
+      formatAuthLogMessage('[requireJwtAuth] OpenID JWT auth failed; trying fallback', log),
+    ).toBe(
+      '[requireJwtAuth] OpenID JWT auth failed; trying fallback {"fallback_attempted":true,"reason":"jwt expired","error_name":"TokenExpiredError","status":401,"request_id":"request-id","method":"GET","path":"/api/messages","token_provider":"openid","openid_reuse_enabled":true,"openid_jwt_available":true,"has_openid_reuse_user_id":true}',
+    );
+  });
+
+  it('prefers Passport info fields for auth failure reason and error name', () => {
+    const err = Object.assign(new Error('outer failure'), { name: 'OuterError' });
+    const info = { message: 'jwt expired', name: 'TokenExpiredError' };
+
+    expect(getAuthFailureReason(err, info)).toBe('jwt expired');
+    expect(getAuthFailureErrorName(err, info)).toBe('TokenExpiredError');
+  });
+
+  it('falls back to Error fields when Passport info is absent', () => {
+    const err = Object.assign(new Error('invalid signature'), { name: 'JsonWebTokenError' });
+
+    expect(getAuthFailureReason(err, undefined)).toBe('invalid signature');
+    expect(getAuthFailureErrorName(err, undefined)).toBe('JsonWebTokenError');
+  });
+
+  it('does not throw when Passport failure objects expose throwing getters', () => {
+    const err = Object.assign(new Error('invalid signature'), { name: 'JsonWebTokenError' });
+    const info = {};
+    Object.defineProperties(info, {
+      message: {
+        get() {
+          throw new TypeError('message getter failed');
+        },
+      },
+      name: {
+        get() {
+          throw new TypeError('name getter failed');
+        },
+      },
+    });
+
+    expect(getAuthFailureReason(err, info)).toBe('invalid signature');
+    expect(getAuthFailureErrorName(err, info)).toBe('JsonWebTokenError');
+  });
+});
diff --git a/packages/api/src/middleware/auth.ts b/packages/api/src/middleware/auth.ts
new file mode 100644
index 00000000000..2ae429f6a05
--- /dev/null
+++ b/packages/api/src/middleware/auth.ts
@@ -0,0 +1,228 @@
+type AuthFailureLike = {
+  message?: unknown;
+  name?: unknown;
+};
+
+type AuthLogValue = string | number | boolean | readonly string[];
+type AuthLogHeaderValue = string | string[] | undefined;
+type AuthRoutePath = string | RegExp | readonly (string | RegExp)[];
+
+export type AuthLogRequest = {
+  headers?: Record<string, AuthLogHeaderValue>;
+  method?: string;
+  path?: string;
+  originalUrl?: string;
+  url?: string;
+  baseUrl?: string;
+  route?: {
+    path?: AuthRoutePath;
+  };
+  id?: string;
+  requestId?: string;
+};
+
+export type AuthLogState = {
+  tokenProvider?: string | null;
+  openidReuseEnabled: boolean;
+  openidJwtAvailable: boolean;
+  hasOpenIdReuseUserId: boolean;
+};
+
+export type AuthLogContext = Record<string, AuthLogValue>;
+
+function normalizeAuthLogValue(value: unknown): string | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      const normalized = normalizeAuthLogValue(entry);
+      if (normalized) {
+        return normalized;
+      }
+    }
+    return undefined;
+  }
+
+  if (typeof value === 'string') {
+    const trimmed = value.trim();
+    return trimmed || undefined;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+
+  return undefined;
+}
+
+function normalizeAuthLogContextValue(value: unknown): AuthLogValue | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    const values = value
+      .map((entry) => normalizeAuthLogValue(entry))
+      .filter((entry): entry is string => entry !== undefined);
+    return values.length > 0 ? values : undefined;
+  }
+
+  if (typeof value === 'string') {
+    return normalizeAuthLogValue(value);
+  }
+
+  if (typeof value === 'number') {
+    return Number.isFinite(value) ? value : undefined;
+  }
+
+  if (typeof value === 'boolean') {
+    return value;
+  }
+
+  return undefined;
+}
+
+function getRequestId(req: AuthLogRequest): string | undefined {
+  return (
+    normalizeAuthLogValue(req.requestId) ??
+    normalizeAuthLogValue(req.id) ??
+    normalizeAuthLogValue(req.headers?.['x-request-id']) ??
+    normalizeAuthLogValue(req.headers?.['x-correlation-id'])
+  );
+}
+
+function normalizeRoutePath(path: AuthRoutePath | undefined): string | undefined {
+  if (typeof path === 'string') {
+    return normalizeAuthLogValue(path);
+  }
+
+  if (Array.isArray(path)) {
+    for (const entry of path) {
+      const normalized = normalizeRoutePath(entry);
+      if (normalized) {
+        return normalized;
+      }
+    }
+  }
+
+  return undefined;
+}
+
+function joinRoutePath(baseUrl: string | undefined, routePath: string): string {
+  const normalizedRoute = routePath === '/' ? '' : routePath;
+  if (!baseUrl) {
+    return normalizedRoute || '/';
+  }
+  if (!normalizedRoute) {
+    return baseUrl;
+  }
+  return `${baseUrl.replace(/\/$/, '')}/${normalizedRoute.replace(/^\//, '')}`;
+}
+
+function bucketConcretePath(path: string | undefined): string | undefined {
+  const queryless = path?.split('?')[0];
+  if (!queryless) {
+    return undefined;
+  }
+
+  const segments = queryless.split('/').filter(Boolean);
+  if (segments.length === 0) {
+    return '/';
+  }
+  if (segments[0] === 'api' && segments[1]) {
+    return `/${segments.slice(0, 2).join('/')}`;
+  }
+  return `/${segments[0]}`;
+}
+
+function getRequestPath(req: AuthLogRequest): string | undefined {
+  const baseUrl = normalizeAuthLogValue(req.baseUrl);
+  const routePath = normalizeRoutePath(req.route?.path);
+  if (routePath) {
+    return joinRoutePath(baseUrl, routePath);
+  }
+  if (baseUrl) {
+    return baseUrl;
+  }
+
+  const path = normalizeAuthLogValue(req.path) ?? normalizeAuthLogValue(req.originalUrl ?? req.url);
+  return bucketConcretePath(path);
+}
+
+function getAuthFailureField(source: unknown, field: keyof AuthFailureLike): unknown {
+  if (!source) {
+    return undefined;
+  }
+  if (typeof source === 'string') {
+    return field === 'message' ? source : undefined;
+  }
+  if (typeof source === 'object') {
+    try {
+      return (source as AuthFailureLike)[field];
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
+function compactAuthLogContext(log: Record<string, unknown>): AuthLogContext {
+  const compacted: Partial<AuthLogContext> = {};
+  for (const key of Object.keys(log)) {
+    const value = normalizeAuthLogContextValue(log[key]);
+    if (value !== undefined) {
+      Object.assign(compacted, { [key]: value });
+    }
+  }
+  return compacted as AuthLogContext;
+}
+
+export function getAuthFailureReason(
+  err: unknown,
+  info: unknown,
+  fallback = 'Unauthorized',
+): string {
+  return (
+    normalizeAuthLogValue(getAuthFailureField(info, 'message')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'message')) ??
+    fallback
+  );
+}
+
+export function getAuthFailureErrorName(err: unknown, info: unknown): string | undefined {
+  return (
+    normalizeAuthLogValue(getAuthFailureField(info, 'name')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'name'))
+  );
+}
+
+function getSafeTokenProvider(tokenProvider: unknown): string | undefined {
+  const normalized = normalizeAuthLogValue(tokenProvider);
+  if (!normalized) {
+    return undefined;
+  }
+  return normalized === 'openid' || normalized === 'librechat' ? normalized : 'other';
+}
+
+export function buildSafeAuthLogContext(
+  req: AuthLogRequest,
+  authState: AuthLogState,
+  extra: Record<string, unknown> = {},
+): AuthLogContext {
+  return compactAuthLogContext({
+    ...extra,
+    request_id: getRequestId(req),
+    method: normalizeAuthLogValue(req.method),
+    path: getRequestPath(req),
+    token_provider: getSafeTokenProvider(authState.tokenProvider),
+    openid_reuse_enabled: authState.openidReuseEnabled,
+    openid_jwt_available: authState.openidJwtAvailable,
+    has_openid_reuse_user_id: authState.hasOpenIdReuseUserId,
+  });
+}
+
+export function formatAuthLogMessage(message: string, context: AuthLogContext): string {
+  return `${message} ${JSON.stringify(context)}`;
+}
diff --git a/packages/api/src/middleware/balance.spec.ts b/packages/api/src/middleware/balance.spec.ts
index 8badd2e1068..b55ee822714 100644
--- a/packages/api/src/middleware/balance.spec.ts
+++ b/packages/api/src/middleware/balance.spec.ts
@@ -52,6 +52,7 @@ describe('createSetBalanceConfig', () => {
   });
 
   const createMockResponse = (): Partial<ServerResponse> => ({
+    locals: {},
     status: jest.fn().mockReturnThis(),
     json: jest.fn().mockReturnThis(),
   });
@@ -93,6 +94,8 @@ describe('createSetBalanceConfig', () => {
       expect(balanceRecord?.refillIntervalUnit).toBe('days');
       expect(balanceRecord?.refillAmount).toBe(500);
       expect(balanceRecord?.lastRefill).toBeInstanceOf(Date);
+      expect((res.locals as { balanceConfigEnabled?: boolean }).balanceConfigEnabled).toBe(true);
+      expect((res.locals as { balanceData?: IBalance }).balanceData?.tokenCredits).toBe(1000);
     });
 
     test('should skip if balance config is not enabled', async () => {
@@ -115,6 +118,7 @@ describe('createSetBalanceConfig', () => {
       await middleware(req as ServerRequest, res as ServerResponse, mockNext);
 
       expect(mockNext).toHaveBeenCalled();
+      expect((res.locals as { balanceConfigEnabled?: boolean }).balanceConfigEnabled).toBe(false);
 
       const balanceRecord = await Balance.findOne({ user: userId });
       expect(balanceRecord).toBeNull();
@@ -381,6 +385,34 @@ describe('createSetBalanceConfig', () => {
       // lastRefill should have default value from schema
       expect(balanceRecord?.lastRefill).toBeInstanceOf(Date);
     });
+
+    test('should pass user identity when resolving balance config', async () => {
+      const userId = new mongoose.Types.ObjectId();
+      const getAppConfig = jest.fn().mockResolvedValue({
+        balance: { enabled: false },
+      });
+
+      const middleware = createSetBalanceConfig({
+        getAppConfig,
+        findBalanceByUser,
+        upsertBalanceFields,
+      });
+
+      const req = createMockRequest(userId);
+      req.user = {
+        ...req.user,
+        role: 'USER',
+        tenantId: 'tenant-a',
+      } as typeof req.user;
+
+      await middleware(req as ServerRequest, createMockResponse() as ServerResponse, mockNext);
+
+      expect(getAppConfig).toHaveBeenCalledWith({
+        role: 'USER',
+        userId: userId.toString(),
+        tenantId: 'tenant-a',
+      });
+    });
   });
 
   describe('Update Scenarios', () => {
@@ -467,6 +499,7 @@ describe('createSetBalanceConfig', () => {
 
       expect(mockNext).toHaveBeenCalled();
       expect(upsertSpy).not.toHaveBeenCalled();
+      expect((res.locals as { balanceData?: IBalance }).balanceData?.tokenCredits).toBe(1000);
     });
 
     test('should set tokenCredits for user with null tokenCredits', async () => {
diff --git a/packages/api/src/middleware/balance.ts b/packages/api/src/middleware/balance.ts
index 4b746820f43..453d7c66b0e 100644
--- a/packages/api/src/middleware/balance.ts
+++ b/packages/api/src/middleware/balance.ts
@@ -14,6 +14,7 @@ import { getBalanceConfig } from '~/app/config';
 export interface BalanceMiddlewareOptions {
   getAppConfig: (options?: {
     role?: string;
+    userId?: string;
     tenantId?: string;
     refresh?: boolean;
   }) => Promise<AppConfig>;
@@ -21,6 +22,11 @@ export interface BalanceMiddlewareOptions {
   upsertBalanceFields: (userId: string, fields: IBalanceUpdate) => Promise<IBalance | null>;
 }
 
+type BalanceLocals = {
+  balanceData?: IBalance | null;
+  balanceConfigEnabled?: boolean;
+};
+
 const balanceUpdateLocks = new Map<string, Promise<void>>();
 
 async function runBalanceUpdate(userId: string, task: () => Promise<void>): Promise<void> {
@@ -116,12 +122,15 @@ export function createSetBalanceConfig({
 ) => Promise<void> {
   return async (req: ServerRequest, res: ServerResponse, next: NextFunction): Promise<void> => {
     try {
+      const balanceLocals = res.locals as BalanceLocals;
       const user = req.user as IUser & { _id: string | ObjectId };
       const appConfig = await getAppConfig({
         role: user?.role,
+        userId: user?.id,
         tenantId: user?.tenantId,
       });
       const balanceConfig = getBalanceConfig(appConfig);
+      balanceLocals.balanceConfigEnabled = balanceConfig?.enabled === true;
       if (!balanceConfig?.enabled) {
         return next();
       }
@@ -138,10 +147,11 @@ export function createSetBalanceConfig({
         const updateFields = buildUpdateFields(balanceConfig, userBalanceRecord, userId);
 
         if (Object.keys(updateFields).length === 0) {
+          balanceLocals.balanceData = userBalanceRecord;
           return;
         }
 
-        await upsertBalanceFields(userId, updateFields);
+        balanceLocals.balanceData = await upsertBalanceFields(userId, updateFields);
       });
 
       next();
diff --git a/packages/api/src/middleware/capabilities.ts b/packages/api/src/middleware/capabilities.ts
index 7be93888c71..6fc9419dbda 100644
--- a/packages/api/src/middleware/capabilities.ts
+++ b/packages/api/src/middleware/capabilities.ts
@@ -35,6 +35,10 @@ interface CapabilityStore {
   results: Map<string, boolean>;
 }
 
+const DENIAL_WARN_INTERVAL_MS = 5 * 60 * 1000;
+const MAX_DENIAL_WARN_KEYS = 1000;
+const recentDenialWarnings = new Map<string, number>();
+
 export type HasCapabilityFn = (
   user: CapabilityUser,
   capability: SystemCapability,
@@ -58,7 +62,8 @@ export type HasConfigCapabilityFn = (
  * Outside a request context (background jobs, tests), the store is undefined
  * and every check falls through to the database — correct behavior.
  */
-export const capabilityStore = new AsyncLocalStorage<CapabilityStore>();
+export const capabilityStore: AsyncLocalStorage<CapabilityStore> =
+  new AsyncLocalStorage<CapabilityStore>();
 
 export function capabilityContextMiddleware(
   _req: ServerRequest,
@@ -75,6 +80,24 @@ export function capabilityContextMiddleware(
   capabilityStore.run({ principals: new Map(), results: new Map() }, next);
 }
 
+function warnDeniedCapabilityOnce(key: string, message: string): void {
+  const now = Date.now();
+  const lastLoggedAt = recentDenialWarnings.get(key);
+  if (lastLoggedAt !== undefined && now - lastLoggedAt < DENIAL_WARN_INTERVAL_MS) {
+    return;
+  }
+
+  if (recentDenialWarnings.size >= MAX_DENIAL_WARN_KEYS) {
+    const oldestKey = recentDenialWarnings.keys().next().value;
+    if (oldestKey !== undefined) {
+      recentDenialWarnings.delete(oldestKey);
+    }
+  }
+
+  recentDenialWarnings.set(key, now);
+  logger.warn(message);
+}
+
 /**
  * Reads principals from the per-request ALS cache without side effects.
  * Returns `undefined` when called outside a request context or before
@@ -191,7 +214,10 @@ export function generateCapabilityCheck(deps: CapabilityDeps): {
           return;
         }
 
-        logger.warn(`[requireCapability] Forbidden: user ${id} missing capability '${capability}'`);
+        warnDeniedCapabilityOnce(
+          `missing-capability:${id}:${capability}`,
+          `[requireCapability] Forbidden: user ${id} missing capability '${capability}'`,
+        );
         res.status(403).json({ message: 'Forbidden' });
       } catch (err) {
         logger.error(`[requireCapability] Error checking capability: ${capability}`, err);
diff --git a/packages/api/src/middleware/index.ts b/packages/api/src/middleware/index.ts
index cac5d637b97..fbefaac54bc 100644
--- a/packages/api/src/middleware/index.ts
+++ b/packages/api/src/middleware/index.ts
@@ -5,6 +5,7 @@ export * from './notFound';
 export * from './balance';
 export * from './json';
 export * from './capabilities';
+export * from './auth';
 export {
   tenantContextMiddleware,
   restoreTenantContextFromReq,
@@ -15,3 +16,4 @@ export * from './concurrency';
 export * from './checkBalance';
 export * from './remoteAgentAuth';
 export * from './share';
+export * from './messageFilterPii';
diff --git a/packages/api/src/middleware/messageFilterPii.spec.ts b/packages/api/src/middleware/messageFilterPii.spec.ts
new file mode 100644
index 00000000000..c67227ff2d7
--- /dev/null
+++ b/packages/api/src/middleware/messageFilterPii.spec.ts
@@ -0,0 +1,281 @@
+import type { MessageFilterPiiConfig } from 'librechat-data-provider';
+import type { Request, Response, NextFunction } from 'express';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { warn: jest.fn(), error: jest.fn(), info: jest.fn(), debug: jest.fn() },
+}));
+import { createMessageFilterPii, findPiiMatchInMessages } from './messageFilterPii';
+
+type CapturedResponse = { status?: number; body?: unknown };
+
+function runMiddleware(
+  config: MessageFilterPiiConfig | undefined,
+  body: unknown,
+): { capturedRes: CapturedResponse; nextCalls: number } {
+  const captured: CapturedResponse = {};
+  let nextCalls = 0;
+  const mw = createMessageFilterPii({ getConfig: () => config });
+  const req = { body } as unknown as Request;
+  const res = {
+    status(code: number) {
+      captured.status = code;
+      return this;
+    },
+    json(payload: unknown) {
+      captured.body = payload;
+      return this;
+    },
+  } as unknown as Response;
+  const next: NextFunction = () => {
+    nextCalls++;
+  };
+  mw(req, res, next);
+  return { capturedRes: captured, nextCalls };
+}
+
+describe('messageFilterPii middleware', () => {
+  it('passes through when no config is provided', () => {
+    const { capturedRes, nextCalls } = runMiddleware(undefined, {
+      text: 'my key is sk-proj-FAKE1234567890ABCDEF',
+    });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through when req.body.text is missing', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, {});
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through when req.body.text is the empty string', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: '' });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through plain text that matches no pattern', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: 'hello world' });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('rejects with 400 when an sk- token is present (default starters)', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toEqual({
+      error: 'message_filter_pii_block',
+      message: 'Message contains a sk- prefix token. Remove it and try again.',
+    });
+  });
+
+  it('rejects with 400 when a Bearer header is present', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'Authorization: Bearer eyJabc.def-ghi' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toMatchObject({ error: 'message_filter_pii_block' });
+  });
+
+  it('rejects with 400 when an api-key header is present', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: 'api-key: foo123bar' });
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+  });
+
+  it('honors a starterPatterns subset (sk passes when only bearer is enabled)', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      { starterPatterns: ['bearer_header'] },
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('treats starterPatterns: [] as disabling all starters', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      { starterPatterns: [] },
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('rejects on a customPatterns match with the operator-supplied label', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {
+        starterPatterns: [],
+        customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+      },
+      { text: 'token ORG-DEADBEEF here' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toEqual({
+      error: 'message_filter_pii_block',
+      message: 'Message contains a Org token. Remove it and try again.',
+    });
+  });
+
+  it('layers customPatterns on top of starters', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {
+        customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+      },
+      { text: 'token ORG-DEADBEEF here' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+  });
+
+  it('rejects with 400 when a quoted excerpt contains a blocked token (clean text)', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'explain this', quotes: ['leaked sk-proj-FAKE1234567890ABCDEF here'] },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toMatchObject({ error: 'message_filter_pii_block' });
+  });
+
+  it('scans quotes even when req.body.text is empty', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: '', quotes: ['api-key: foo123bar'] },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+  });
+
+  it('rejects a secret split across a quote and the typed text (merged scan)', () => {
+    // Neither piece matches the api-key pattern alone, but the merged
+    // `> api-key:\n\nsecret` the model receives does (the pattern allows whitespace).
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: 'secret', quotes: ['api-key:'] });
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toMatchObject({ error: 'message_filter_pii_block' });
+  });
+
+  it('passes through when neither text nor quotes match', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'hello world', quotes: ['a clean excerpt', 'another clean one'] },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('ignores non-string quote entries without throwing', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'hello world', quotes: [null, 42, '', 'clean'] },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('returns the same compiled pattern array for repeat calls with the same config (memoization)', () => {
+    const config: MessageFilterPiiConfig = {
+      customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+    };
+    const a = runMiddleware(config, { text: 'plain' });
+    const b = runMiddleware(config, { text: 'plain' });
+    expect(a.nextCalls).toBe(1);
+    expect(b.nextCalls).toBe(1);
+  });
+
+  it('drops an invalid customPattern regex without throwing and keeps other patterns active', () => {
+    const config = {
+      starterPatterns: [],
+      customPatterns: [
+        { id: 'broken', label: 'Broken', regex: '(' },
+        { id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' },
+      ],
+    } as unknown as MessageFilterPiiConfig;
+    const benign = runMiddleware(config, { text: 'plain text' });
+    expect(benign.nextCalls).toBe(1);
+    expect(benign.capturedRes.status).toBeUndefined();
+    const matching = runMiddleware(config, { text: 'token ORG-DEADBEEF here' });
+    expect(matching.nextCalls).toBe(0);
+    expect(matching.capturedRes.status).toBe(400);
+  });
+});
+
+describe('findPiiMatchInMessages', () => {
+  it('returns null for missing or empty messages', () => {
+    expect(findPiiMatchInMessages(undefined, {})).toBeNull();
+    expect(findPiiMatchInMessages([], {})).toBeNull();
+  });
+
+  it('returns null when no config is provided', () => {
+    expect(
+      findPiiMatchInMessages([{ role: 'user', content: 'sk-proj-FAKE123' }], undefined),
+    ).toBeNull();
+  });
+
+  it('matches a system-role message (remote APIs accept caller-supplied system roles)', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'system', content: 'system primer with sk-proj-FAKE1234567890ABCDEF embedded' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches an assistant-role message (callers can include attacker-controlled history)', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'assistant', content: 'sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a tool-role message', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'tool', content: 'tool reply leaking sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a string-content user message', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'user', content: 'my key is sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a content-parts user message (text part)', () => {
+    const hit = findPiiMatchInMessages(
+      [
+        {
+          role: 'user',
+          content: [
+            { type: 'image_url', image_url: { url: 'data:...' } },
+            { type: 'text', text: 'Authorization: Bearer abc.def.ghi' },
+          ],
+        },
+      ],
+      {},
+    );
+    expect(hit).toEqual({ id: 'bearer_header', label: 'Bearer token' });
+  });
+
+  it('returns null when no user message matches', () => {
+    expect(findPiiMatchInMessages([{ role: 'user', content: 'hello world' }], {})).toBeNull();
+  });
+
+  it('honors customPatterns from config', () => {
+    const hit = findPiiMatchInMessages([{ role: 'user', content: 'token ORG-DEADBEEF here' }], {
+      starterPatterns: [],
+      customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+    });
+    expect(hit).toEqual({ id: 'org', label: 'Org token' });
+  });
+});
diff --git a/packages/api/src/middleware/messageFilterPii.ts b/packages/api/src/middleware/messageFilterPii.ts
new file mode 100644
index 00000000000..ff322cba8fa
--- /dev/null
+++ b/packages/api/src/middleware/messageFilterPii.ts
@@ -0,0 +1,165 @@
+import { logger } from '@librechat/data-schemas';
+import type {
+  NextFunction,
+  RequestHandler,
+  Request as ServerRequest,
+  Response as ServerResponse,
+} from 'express';
+import type { MessageFilterPiiConfig } from 'librechat-data-provider';
+import { getReferencedQuotes, mergeQuotedText } from '../utils/quotes';
+
+type CompiledPattern = { id: string; label: string; pattern: RegExp };
+
+const STARTER_PATTERNS: CompiledPattern[] = [
+  { id: 'sk_prefix', label: 'sk- prefix token', pattern: /\b(sk-)[a-zA-Z0-9_-]+/g },
+  { id: 'bearer_header', label: 'Bearer token', pattern: /\b(Bearer )[^\s"']+/gi },
+  { id: 'api_key_header', label: 'api-key header', pattern: /\b(api-key:?\s+)[^\s"']+/gi },
+];
+
+const STARTER_BY_ID = new Map(STARTER_PATTERNS.map((p) => [p.id, p]));
+
+function selectStarter(ids?: string[]): CompiledPattern[] {
+  if (ids == null) {
+    return STARTER_PATTERNS;
+  }
+  const out: CompiledPattern[] = [];
+  for (const id of ids) {
+    const entry = STARTER_BY_ID.get(id);
+    if (entry != null) {
+      out.push(entry);
+    }
+  }
+  return out;
+}
+
+const COMPILE_CACHE = new WeakMap<object, CompiledPattern[]>();
+
+function compile(config: MessageFilterPiiConfig): CompiledPattern[] {
+  const cached = COMPILE_CACHE.get(config);
+  if (cached != null) {
+    return cached;
+  }
+  const starter = selectStarter(config.starterPatterns);
+  const custom: CompiledPattern[] = [];
+  for (const p of config.customPatterns ?? []) {
+    try {
+      custom.push({ id: p.id, label: p.label, pattern: new RegExp(p.regex, 'g') });
+    } catch (err) {
+      logger.warn(
+        `[messageFilter.pii] dropping invalid customPattern ${JSON.stringify(p.id)}: ${(err as Error).message}`,
+      );
+    }
+  }
+  const result = [...starter, ...custom];
+  COMPILE_CACHE.set(config, result);
+  return result;
+}
+
+function findMatch(text: string, patterns: CompiledPattern[]): CompiledPattern | null {
+  for (const p of patterns) {
+    p.pattern.lastIndex = 0;
+    if (p.pattern.test(text)) {
+      return p;
+    }
+  }
+  return null;
+}
+
+export interface PiiMatch {
+  id: string;
+  label: string;
+}
+
+type ContentPart = { type?: string; text?: string; [key: string]: unknown };
+type ChatLikeMessage = {
+  role?: string;
+  content?: string | ContentPart[];
+};
+
+export function findPiiMatchInMessages(
+  messages: ChatLikeMessage[] | undefined,
+  config: MessageFilterPiiConfig | undefined,
+): PiiMatch | null {
+  if (config == null || !Array.isArray(messages) || messages.length === 0) {
+    return null;
+  }
+  const patterns = compile(config);
+  if (patterns.length === 0) {
+    return null;
+  }
+  for (const msg of messages) {
+    if (msg == null) {
+      continue;
+    }
+    if (typeof msg.content === 'string') {
+      const hit = findMatch(msg.content, patterns);
+      if (hit != null) {
+        return { id: hit.id, label: hit.label };
+      }
+      continue;
+    }
+    if (Array.isArray(msg.content)) {
+      for (const part of msg.content) {
+        if (part != null && typeof part.text === 'string') {
+          const hit = findMatch(part.text, patterns);
+          if (hit != null) {
+            return { id: hit.id, label: hit.label };
+          }
+        }
+      }
+    }
+  }
+  return null;
+}
+
+export interface CreateMessageFilterPiiOptions {
+  getConfig: (req: ServerRequest) => MessageFilterPiiConfig | undefined;
+}
+
+export function createMessageFilterPii(options: CreateMessageFilterPiiOptions): RequestHandler {
+  return function messageFilterPii(req: ServerRequest, res: ServerResponse, next: NextFunction) {
+    const config = options.getConfig(req);
+    if (config == null) {
+      next();
+      return;
+    }
+    /**
+     * Scan the typed text, each quoted excerpt, and — crucially — the merged
+     * blockquote+text exactly as `AgentClient` sends it to the model. Quotes are
+     * normalized via `getReferencedQuotes` first (matching `BaseClient`). Scanning
+     * the merged string catches a secret split across a quote and the typed text
+     * (each clean alone) that only matches once concatenated; scanning the raw
+     * pieces keeps anchored patterns working against un-prefixed excerpts.
+     */
+    const candidates: string[] = [];
+    const text = typeof req.body?.text === 'string' ? req.body.text : '';
+    if (text.length > 0) {
+      candidates.push(text);
+    }
+    const quotes = getReferencedQuotes(req.body?.quotes);
+    if (quotes != null) {
+      candidates.push(...quotes);
+      candidates.push(mergeQuotedText(text, quotes));
+    }
+    if (candidates.length === 0) {
+      next();
+      return;
+    }
+    const patterns = compile(config);
+    if (patterns.length === 0) {
+      next();
+      return;
+    }
+    for (const candidate of candidates) {
+      const match = findMatch(candidate, patterns);
+      if (match != null) {
+        res.status(400).json({
+          error: 'message_filter_pii_block',
+          message: `Message contains a ${match.label}. Remove it and try again.`,
+        });
+        return;
+      }
+    }
+    next();
+  };
+}
diff --git a/packages/api/src/middleware/preAuthTenant.spec.ts b/packages/api/src/middleware/preAuthTenant.spec.ts
index 669a43c84fd..8aeb8b93baf 100644
--- a/packages/api/src/middleware/preAuthTenant.spec.ts
+++ b/packages/api/src/middleware/preAuthTenant.spec.ts
@@ -1,4 +1,4 @@
-import { getTenantId, logger } from '@librechat/data-schemas';
+import { getTenantId, getRequestId, logger } from '@librechat/data-schemas';
 import { preAuthTenantMiddleware } from './preAuthTenant';
 import type { Request, Response, NextFunction } from 'express';
 
@@ -54,6 +54,17 @@ describe('preAuthTenantMiddleware', () => {
     expect(capturedTenantId).toBe('acme-corp');
   });
 
+  it('propagates request ID from pre-auth routes', () => {
+    req.headers = { 'x-request-id': 'req-preauth' };
+    let capturedRequestId: string | undefined;
+    const capturedNext: NextFunction = () => {
+      capturedRequestId = getRequestId();
+    };
+
+    preAuthTenantMiddleware(req as Request, res as Response, capturedNext);
+    expect(capturedRequestId).toBe('req-preauth');
+  });
+
   it('ignores __SYSTEM__ sentinel and logs warning', () => {
     req.headers = { 'x-tenant-id': '__SYSTEM__' };
     req.ip = '10.0.0.1';
diff --git a/packages/api/src/middleware/preAuthTenant.ts b/packages/api/src/middleware/preAuthTenant.ts
index bab91f3a18d..5d59cd8ae9e 100644
--- a/packages/api/src/middleware/preAuthTenant.ts
+++ b/packages/api/src/middleware/preAuthTenant.ts
@@ -1,5 +1,6 @@
-import { tenantStorage, logger, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import { logger, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
 import type { Request, Response, NextFunction } from 'express';
+import { buildTenantContext, runWithTenantContext } from './tenant';
 
 /**
  * Pre-authentication tenant context middleware for unauthenticated routes.
@@ -27,46 +28,49 @@ import type { Request, Response, NextFunction } from 'express';
  * 3. Layer additional resolution on top (e.g., OpenID `tenant` claim → header).
  *
  * If no header is present, downstream runs without tenant ALS context (same as
- * single-tenant mode). This preserves backward compatibility.
+ * single-tenant mode), while request logging context can still propagate.
  */
 const MAX_TENANT_ID_LENGTH = 128;
 const VALID_TENANT_ID = /^[-a-zA-Z0-9_.]+$/;
 
 export function preAuthTenantMiddleware(req: Request, res: Response, next: NextFunction): void {
   const raw = req.headers['x-tenant-id'];
+  const requestContext = buildTenantContext({ headers: req.headers });
 
   if (!raw || typeof raw !== 'string') {
-    next();
+    runWithTenantContext(requestContext, next);
     return;
   }
 
   const tenantId = raw.trim();
 
   if (!tenantId) {
-    next();
+    runWithTenantContext(requestContext, next);
     return;
   }
 
   if (tenantId === SYSTEM_TENANT_ID) {
-    logger.warn('[preAuthTenant] Rejected __SYSTEM__ sentinel in X-Tenant-Id header', {
-      ip: req.ip,
-      path: req.path,
+    runWithTenantContext(requestContext, () => {
+      logger.warn('[preAuthTenant] Rejected __SYSTEM__ sentinel in X-Tenant-Id header', {
+        ip: req.ip,
+        path: req.path,
+      });
+      next();
     });
-    next();
     return;
   }
 
   if (tenantId.length > MAX_TENANT_ID_LENGTH || !VALID_TENANT_ID.test(tenantId)) {
-    logger.warn('[preAuthTenant] Rejected malformed X-Tenant-Id header', {
-      ip: req.ip,
-      length: tenantId.length,
-      path: req.path,
+    runWithTenantContext(requestContext, () => {
+      logger.warn('[preAuthTenant] Rejected malformed X-Tenant-Id header', {
+        ip: req.ip,
+        length: tenantId.length,
+        path: req.path,
+      });
+      next();
     });
-    next();
     return;
   }
 
-  return void tenantStorage.run({ tenantId }, async () => {
-    next();
-  });
+  runWithTenantContext(buildTenantContext({ headers: req.headers }, tenantId), next);
 }
diff --git a/packages/api/src/middleware/remoteAgentAuth.spec.ts b/packages/api/src/middleware/remoteAgentAuth.spec.ts
index 983f7bf706c..3e873789154 100644
--- a/packages/api/src/middleware/remoteAgentAuth.spec.ts
+++ b/packages/api/src/middleware/remoteAgentAuth.spec.ts
@@ -3,6 +3,7 @@ import type { TAgentsEndpoint } from 'librechat-data-provider';
 import type { JwtPayload, VerifyOptions } from 'jsonwebtoken';
 import type { Request, Response } from 'express';
 import type { RequestInit } from 'undici';
+import type { RemoteAgentAuthDeps } from './remoteAgentAuth';
 
 jest.mock('@librechat/data-schemas', () => {
   const actual = jest.requireActual('@librechat/data-schemas');
@@ -22,6 +23,11 @@ jest.mock('~/utils', () => ({
   math: jest.fn(() => 60000),
 }));
 
+jest.mock('~/utils/proxy', () => ({
+  getEnvProxyDispatcher: jest.fn(),
+  getHttpsProxyAgent: jest.fn(),
+}));
+
 const mockGetSigningKey = jest.fn();
 const mockGetSigningKeys = jest.fn();
 
@@ -31,7 +37,6 @@ jest.mock('jwks-rsa', () =>
 
 jest.mock('undici', () => ({
   fetch: jest.fn(),
-  ProxyAgent: jest.fn((proxy: string) => ({ proxy })),
 }));
 
 jest.mock('jsonwebtoken', () => ({
@@ -46,15 +51,19 @@ jest.mock('../auth/openid', () => {
 
 import jwt from 'jsonwebtoken';
 import jwksRsa from 'jwks-rsa';
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
+import { SystemRoles } from 'librechat-data-provider';
+import { fetch as undiciFetch } from 'undici';
 import { logger, tenantStorage } from '@librechat/data-schemas';
 import { clearRemoteAgentAuthCache, createRemoteAgentAuth } from './remoteAgentAuth';
 import { findOpenIDUser, getOpenIdEmail } from '../auth/openid';
-import { math } from '~/utils';
+import { isEnabled, math } from '~/utils';
+import { getEnvProxyDispatcher, getHttpsProxyAgent } from '~/utils/proxy';
 
 const mockFetch = undiciFetch as jest.Mock;
-const mockProxyAgent = ProxyAgent as unknown as jest.Mock;
 const mockMath = math as jest.Mock;
+const mockIsEnabled = isEnabled as jest.Mock;
+const mockGetEnvProxyDispatcher = getEnvProxyDispatcher as jest.Mock;
+const mockGetHttpsProxyAgent = getHttpsProxyAgent as jest.Mock;
 const realFindOpenIDUser =
   jest.requireActual<typeof import('../auth/openid')>('../auth/openid').findOpenIDUser;
 const mockFindOpenIDUser = findOpenIDUser as jest.MockedFunction<typeof findOpenIDUser>;
@@ -66,6 +75,12 @@ const ENV_KEYS = [
   'OPENID_JWKS_URL',
   'OPENID_JWKS_URL_CACHE_ENABLED',
   'OPENID_JWKS_URL_CACHE_TIME',
+  'OPENID_ROLE_SYNC_ENABLED',
+  'OPENID_ROLE_SYNC_API_ENABLED',
+  'OPENID_ROLE_SYNC_SOURCE',
+  'OPENID_ROLE_SYNC_CLAIM',
+  'OPENID_ROLE_SYNC_ROLE_PRIORITY',
+  'OPENID_ROLE_SYNC_FALLBACK_ROLE',
   'PROXY',
 ] as const;
 
@@ -92,6 +107,12 @@ const originalEnv = ENV_KEYS.reduce<Record<(typeof ENV_KEYS)[number], string | u
     OPENID_JWKS_URL: undefined,
     OPENID_JWKS_URL_CACHE_ENABLED: undefined,
     OPENID_JWKS_URL_CACHE_TIME: undefined,
+    OPENID_ROLE_SYNC_ENABLED: undefined,
+    OPENID_ROLE_SYNC_API_ENABLED: undefined,
+    OPENID_ROLE_SYNC_SOURCE: undefined,
+    OPENID_ROLE_SYNC_CLAIM: undefined,
+    OPENID_ROLE_SYNC_ROLE_PRIORITY: undefined,
+    OPENID_ROLE_SYNC_FALLBACK_ROLE: undefined,
     PROXY: undefined,
   },
 );
@@ -204,11 +225,18 @@ function makeDeps(appConfig: AppConfig = makeConfig()) {
   return {
     findUser: makeFindUser(makeUser()),
     updateUser: jest.fn(),
+    getRolesByNames: jest.fn(async (roleNames: string[]) =>
+      roleNames.map((roleName) => ({ name: roleName })),
+    ),
     getAppConfig: jest.fn().mockResolvedValue(appConfig),
     apiKeyMiddleware: jest.fn((_req: unknown, _res: unknown, next: () => void) => next()),
   };
 }
 
+function asDeps(deps: ReturnType<typeof makeDeps>): RemoteAgentAuthDeps {
+  return deps as unknown as RemoteAgentAuthDeps;
+}
+
 function setupOidcMocks(payload: JwtPayload, kid: string | null = 'test-kid') {
   (jwt.decode as jest.Mock).mockReturnValue({ header: kid == null ? {} : { kid }, payload });
   mockGetSigningKey.mockResolvedValue({ getPublicKey: () => 'public-key' });
@@ -229,6 +257,9 @@ describe('createRemoteAgentAuth', () => {
     clearRemoteAgentAuthCache();
     mockFetch.mockReset();
     mockMath.mockReturnValue(60000);
+    mockIsEnabled.mockImplementation((value?: string) => value === 'true');
+    mockGetEnvProxyDispatcher.mockReturnValue(undefined);
+    mockGetHttpsProxyAgent.mockReturnValue(undefined);
     mockFindOpenIDUser.mockImplementation(realFindOpenIDUser);
     mockNext = jest.fn();
   });
@@ -247,7 +278,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ enabled: false }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Authentication required' });
@@ -257,14 +288,14 @@ describe('createRemoteAgentAuth', () => {
 
     it('falls back to apiKeyMiddleware when oidc.enabled is false', async () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
     });
 
     it('loads base config before authentication when tenant context is absent', async () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ baseOnly: true });
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
@@ -283,7 +314,7 @@ describe('createRemoteAgentAuth', () => {
       });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, { tenantId: 'tenant-oidc-only' });
@@ -296,7 +327,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
 
       await tenantStorage.run({ tenantId: 'tenant-preauth' }, async () => {
-        await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+        await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       });
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-preauth' });
@@ -313,7 +344,7 @@ describe('createRemoteAgentAuth', () => {
       const { res, status } = makeRes();
 
       await tenantStorage.run({ tenantId: 'tenant-oidc-only' }, async () => {
-        await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+        await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
       });
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-oidc-only' });
@@ -326,7 +357,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq();
       req.user = makeUser({ tenantId: 'tenant-a' });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-a' });
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
@@ -334,7 +365,7 @@ describe('createRemoteAgentAuth', () => {
 
     it('falls back to apiKeyMiddleware when remoteApi auth is absent', async () => {
       const deps = makeDeps({ endpoints: { agents: {} } } as unknown as AppConfig);
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
     });
 
@@ -345,7 +376,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(config);
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(mockNext).not.toHaveBeenCalled();
@@ -358,7 +389,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
       expect(mockNext).toHaveBeenCalled();
@@ -368,7 +399,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Bearer token required' });
@@ -379,7 +410,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ issuer: undefined }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -390,7 +421,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ audience: undefined }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -405,7 +436,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(req.user).toMatchObject({ id: 'uid123', email: 'agent@test.com' });
       expect((jwt.verify as jest.Mock).mock.calls[0][2]).toEqual(
@@ -426,10 +457,14 @@ describe('createRemoteAgentAuth', () => {
       );
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
-      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, { tenantId: 'tenant-strict' });
+      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
+        role: 'user',
+        userId: 'uid123',
+        tenantId: 'tenant-strict',
+      });
       expect(jwt.verify).toHaveBeenCalledTimes(2);
       expect((jwt.verify as jest.Mock).mock.calls[1][2]).toEqual(
         expect.objectContaining({ audience: 'tenant-audience' }),
@@ -458,10 +493,14 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
-      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, { tenantId: 'tenant-strict' });
+      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
+        role: 'user',
+        userId: 'uid123',
+        tenantId: 'tenant-strict',
+      });
       expect(jwt.verify).toHaveBeenCalledTimes(2);
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
@@ -490,10 +529,14 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
-      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, { tenantId: 'tenant-api-key-only' });
+      expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
+        role: 'user',
+        userId: 'uid123',
+        tenantId: 'tenant-api-key-only',
+      });
       expect(jwt.verify).toHaveBeenCalledTimes(1);
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
@@ -508,7 +551,7 @@ describe('createRemoteAgentAuth', () => {
       const issuer = `${BASE_ISSUER}/`;
       const deps = makeDeps(makeConfig({ issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -525,7 +568,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(jwt.verify).toHaveBeenCalledWith(
         FAKE_TOKEN,
@@ -542,7 +585,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}   ` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(jwt.verify).toHaveBeenCalledWith(
         FAKE_TOKEN,
@@ -558,7 +601,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
       const deps = makeDeps();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -585,7 +628,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
       const deps = makeDeps();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -618,7 +661,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(mockGetSigningKey).not.toHaveBeenCalled();
       expect(jwt.verify).toHaveBeenCalledTimes(2);
@@ -634,7 +677,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect((req.user as IUser).federatedTokens).toEqual({
         access_token: FAKE_TOKEN,
@@ -647,7 +690,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect((req.user as IUser).federatedTokens).toEqual({
         access_token: FAKE_TOKEN,
@@ -661,7 +704,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser.mockResolvedValue(null);
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -680,7 +723,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser.mockResolvedValue(null);
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -706,7 +749,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
@@ -721,7 +764,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -743,7 +786,7 @@ describe('createRemoteAgentAuth', () => {
         .mockResolvedValueOnce(makeUser({ provider: 'google', openidId: undefined }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -766,7 +809,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -784,7 +827,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -803,7 +846,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: 'Bearer not.a.jwt' }) as Request,
         res,
         mockNext,
@@ -828,7 +871,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -853,7 +896,7 @@ describe('createRemoteAgentAuth', () => {
       };
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -870,7 +913,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -895,7 +938,7 @@ describe('createRemoteAgentAuth', () => {
         }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -911,7 +954,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'https://issuer-env-1.example.com' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -931,7 +974,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -953,7 +996,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -971,7 +1014,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'http://localhost:8080/realms/test' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -994,7 +1037,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1018,7 +1061,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1045,7 +1088,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }, { enabled: false }));
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1056,8 +1099,9 @@ describe('createRemoteAgentAuth', () => {
       expect(mockNext).not.toHaveBeenCalled();
     });
 
-    it('uses a proxy agent for discovery when PROXY is set', async () => {
-      process.env.PROXY = 'http://proxy.example.com';
+    it('uses a proxy dispatcher for discovery when configured', async () => {
+      const proxyDispatcher = { dispatch: jest.fn() };
+      mockGetEnvProxyDispatcher.mockReturnValue(proxyDispatcher);
       const issuer = 'https://issuer-proxy.example.com';
 
       mockFetch.mockResolvedValue({
@@ -1067,16 +1111,15 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
       );
 
-      expect(mockProxyAgent).toHaveBeenCalledWith('http://proxy.example.com');
       expect(mockFetch).toHaveBeenCalledWith(
         `${issuer}/.well-known/openid-configuration`,
-        expect.objectContaining({ dispatcher: { proxy: 'http://proxy.example.com' } }),
+        expect.objectContaining({ dispatcher: proxyDispatcher }),
       );
     });
 
@@ -1086,7 +1129,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'https://issuer-env-cache.example.com' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1094,7 +1137,7 @@ describe('createRemoteAgentAuth', () => {
 
       process.env.OPENID_JWKS_URL = 'https://env-two.example.com/jwks';
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1117,13 +1160,13 @@ describe('createRemoteAgentAuth', () => {
         }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1141,7 +1184,7 @@ describe('createRemoteAgentAuth', () => {
           }),
         );
 
-        await createRemoteAgentAuth(deps)(
+        await createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           makeRes().res,
           mockNext,
@@ -1169,7 +1212,7 @@ describe('createRemoteAgentAuth', () => {
           }),
         );
 
-        await createRemoteAgentAuth(deps)(
+        await createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           makeRes().res,
           mockNext,
@@ -1217,7 +1260,7 @@ describe('createRemoteAgentAuth', () => {
           ),
         );
         const { res, status } = makeRes();
-        const request = createRemoteAgentAuth(deps)(
+        const request = createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           res,
           mockNext,
@@ -1245,7 +1288,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1265,7 +1308,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1283,7 +1326,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser
         .mockResolvedValueOnce(null)
         .mockResolvedValueOnce(makeUser({ email: getOpenIdEmail(claims), openidId: claims.sub }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1345,7 +1388,7 @@ describe('createRemoteAgentAuth', () => {
           role: 'user',
         }),
       );
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1377,7 +1420,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1394,7 +1437,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
 
       const deps = { ...makeDeps(), updateUser: mockUpdateUser };
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1404,6 +1447,186 @@ describe('createRemoteAgentAuth', () => {
     });
   });
 
+  describe('OpenID role sync', () => {
+    function enableApiRoleSync(overrides: Record<string, string> = {}) {
+      process.env.OPENID_ROLE_SYNC_ENABLED = 'true';
+      process.env.OPENID_ROLE_SYNC_API_ENABLED = 'true';
+      process.env.OPENID_ROLE_SYNC_SOURCE = 'access';
+      process.env.OPENID_ROLE_SYNC_CLAIM = 'roles';
+      process.env.OPENID_ROLE_SYNC_ROLE_PRIORITY = 'STANDARD-USER,BASIC-USER';
+      process.env.OPENID_ROLE_SYNC_FALLBACK_ROLE = 'USER';
+
+      for (const [key, value] of Object.entries(overrides)) {
+        process.env[key] = value;
+      }
+    }
+
+    it('does not run unless API role sync is explicitly enabled', async () => {
+      process.env.OPENID_ROLE_SYNC_ENABLED = 'true';
+      process.env.OPENID_ROLE_SYNC_SOURCE = 'access';
+      process.env.OPENID_ROLE_SYNC_CLAIM = 'roles';
+      process.env.OPENID_ROLE_SYNC_ROLE_PRIORITY = 'STANDARD-USER';
+      setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', roles: ['STANDARD-USER'] });
+
+      const deps = makeDeps();
+      await createRemoteAgentAuth(asDeps(deps))(
+        makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
+        makeRes().res,
+        mockNext,
+      );
+
+      expect(deps.getRolesByNames).not.toHaveBeenCalled();
+      expect(deps.updateUser).not.toHaveBeenCalled();
+      expect(mockNext).toHaveBeenCalled();
+    });
+
+    it('selects the highest configured matching role from the verified bearer payload', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({
+        sub: 'sub123',
+        email: 'agent@test.com',
+        roles: ['BASIC-USER', 'STANDARD-USER'],
+      });
+
+      const deps = makeDeps();
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'STANDARD-USER' });
+      expect(req.user).toMatchObject({ role: 'STANDARD-USER' });
+      expect(mockNext).toHaveBeenCalled();
+    });
+
+    it('applies fallback when the verified payload has no configured role match', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({
+        sub: 'sub123',
+        email: 'agent@test.com',
+        roles: ['external-role'],
+      });
+
+      const deps = makeDeps();
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'USER' });
+      expect(req.user).toMatchObject({ role: 'USER' });
+    });
+
+    it('applies fallback when the role claim is present but empty', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({
+        sub: 'sub123',
+        email: 'agent@test.com',
+        roles: '',
+      });
+
+      const deps = makeDeps();
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'USER' });
+      expect(req.user).toMatchObject({ role: 'USER' });
+    });
+
+    it('preserves an existing ADMIN role because generic role sync cannot manage admin', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({
+        sub: 'sub123',
+        email: 'agent@test.com',
+        roles: ['STANDARD-USER'],
+      });
+
+      const deps = makeDeps();
+      deps.findUser = makeFindUser(makeUser({ role: SystemRoles.ADMIN }));
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.getRolesByNames).not.toHaveBeenCalled();
+      expect(deps.updateUser).not.toHaveBeenCalled();
+      expect(req.user).toMatchObject({ role: SystemRoles.ADMIN });
+    });
+
+    it('leaves the role unchanged when the configured source is unavailable to API auth', async () => {
+      enableApiRoleSync({ OPENID_ROLE_SYNC_SOURCE: 'id' });
+      setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', roles: ['STANDARD-USER'] });
+
+      const deps = makeDeps();
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.getRolesByNames).not.toHaveBeenCalled();
+      expect(deps.updateUser).not.toHaveBeenCalled();
+      expect(req.user).toMatchObject({ role: 'user' });
+    });
+
+    it('does not apply fallback when API group overage is unresolved', async () => {
+      enableApiRoleSync({ OPENID_ROLE_SYNC_CLAIM: 'groups' });
+      setupOidcMocks({
+        sub: 'sub123',
+        email: 'agent@test.com',
+        hasgroups: true,
+      });
+
+      const deps = makeDeps();
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.updateUser).not.toHaveBeenCalled();
+      expect(req.user).toMatchObject({ role: 'user' });
+    });
+
+    it('runs role lookup and persistence in the resolved user tenant context', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', roles: ['BASIC-USER'] });
+
+      const deps = makeDeps();
+      deps.findUser = makeFindUser(makeUser({ tenantId: 'tenant-role-sync' }));
+      deps.getAppConfig.mockImplementation(async (options) =>
+        options?.tenantId === 'tenant-role-sync'
+          ? makeConfig({ scope: undefined }, { enabled: false })
+          : makeConfig({ scope: undefined }, { enabled: true }),
+      );
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
+
+      expect(deps.getRolesByNames).toHaveBeenCalledWith(
+        ['STANDARD-USER', 'BASIC-USER', 'USER'],
+        'name',
+      );
+      expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'BASIC-USER' });
+      expect(req.user).toMatchObject({ tenantId: 'tenant-role-sync', role: 'BASIC-USER' });
+    });
+
+    it('re-checks resolved user policy after role sync changes the role', async () => {
+      enableApiRoleSync();
+      setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', roles: ['STANDARD-USER'] });
+
+      const deps = makeDeps();
+      deps.findUser = makeFindUser(makeUser({ tenantId: 'tenant-role-sync', role: 'BASIC-USER' }));
+      deps.getAppConfig.mockImplementation(async (options) => {
+        if (options?.tenantId !== 'tenant-role-sync') {
+          return makeConfig({ scope: undefined }, { enabled: true });
+        }
+
+        return options.role === 'STANDARD-USER'
+          ? makeConfig({ enabled: false }, { enabled: false })
+          : makeConfig({ scope: undefined }, { enabled: false });
+      });
+      const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
+      const { res, status, json } = makeRes();
+
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
+
+      expect(status).toHaveBeenCalledWith(401);
+      expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
+      expect(deps.updateUser).not.toHaveBeenCalled();
+      expect(req.user).toBeUndefined();
+      expect(mockNext).not.toHaveBeenCalled();
+    });
+  });
+
   describe('scope validation', () => {
     it('returns 401 when required scope is missing from token', async () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', scope: 'openid profile' });
@@ -1411,7 +1634,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1427,7 +1650,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1447,7 +1670,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1464,7 +1687,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1481,7 +1704,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent admin' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1500,7 +1723,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent admin' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1521,7 +1744,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent,admin' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1536,7 +1759,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
 
       const deps = makeDeps(makeConfig({ scope: undefined }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
diff --git a/packages/api/src/middleware/remoteAgentAuth.ts b/packages/api/src/middleware/remoteAgentAuth.ts
index e51c687c188..c198292dc2b 100644
--- a/packages/api/src/middleware/remoteAgentAuth.ts
+++ b/packages/api/src/middleware/remoteAgentAuth.ts
@@ -1,21 +1,28 @@
 import jwt from 'jsonwebtoken';
 import jwksRsa from 'jwks-rsa';
-import { HttpsProxyAgent } from 'https-proxy-agent';
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
-import { getTenantId, logger } from '@librechat/data-schemas';
+import { fetch as undiciFetch } from 'undici';
+import { getTenantId, logger, tenantStorage } from '@librechat/data-schemas';
 import { SystemRoles, isRemoteOidcUrlAllowed } from 'librechat-data-provider';
+import type { AppConfig, IUser, RoleMethods, UserMethods } from '@librechat/data-schemas';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
-import type { AppConfig, IUser, UserMethods } from '@librechat/data-schemas';
 import type { Algorithm, JwtPayload, VerifyOptions } from 'jsonwebtoken';
 import type { TAgentsEndpoint } from 'librechat-data-provider';
 import type { RequestInit } from 'undici';
 import type { GetAppConfigOptions } from '../app/service';
+import {
+  getLibreChatRolesForOpenIdSync,
+  getOpenIdRolesForOpenIdSync,
+  getOpenIdRoleSyncOptions,
+  selectOpenIdRole,
+} from '../auth/openidRoleSync';
 import { findOpenIDUser, getOpenIdEmail, normalizeOpenIdIssuer } from '../auth/openid';
+import { getEnvProxyDispatcher, getHttpsProxyAgent } from '~/utils/proxy';
 import { isEnabled, math } from '~/utils';
 
 export interface RemoteAgentAuthDeps {
   apiKeyMiddleware: RequestHandler;
   findUser: UserMethods['findUser'];
+  getRolesByNames: RoleMethods['findRolesByNames'];
   updateUser: UserMethods['updateUser'];
   getAppConfig: (options?: GetAppConfigOptions) => Promise<AppConfig>;
 }
@@ -120,9 +127,10 @@ function getJwksCacheOptions(): JwksCacheOptions {
 
 function buildDiscoveryOptions(controller: AbortController): RequestInit {
   const options: RequestInit = { signal: controller.signal };
+  const dispatcher = getEnvProxyDispatcher();
 
-  if (process.env.PROXY) {
-    options.dispatcher = new ProxyAgent(process.env.PROXY);
+  if (dispatcher) {
+    options.dispatcher = dispatcher;
   }
 
   return options;
@@ -189,8 +197,9 @@ function buildJwksClient(uri: string, cacheOptions: JwksCacheOptions): jwksRsa.J
     jwksUri: uri,
   };
 
-  if (process.env.PROXY) {
-    options.requestAgent = new HttpsProxyAgent(process.env.PROXY);
+  const requestAgent = getHttpsProxyAgent(uri);
+  if (requestAgent) {
+    options.requestAgent = requestAgent;
   }
 
   return jwksRsa(options);
@@ -247,7 +256,7 @@ function getConfigOptions(req: Request): GetAppConfigOptions {
 }
 
 function getUserConfigOptions(user: IUser): GetAppConfigOptions {
-  if (user.tenantId) return { tenantId: user.tenantId };
+  if (user.tenantId) return { role: user.role, userId: user.id, tenantId: user.tenantId };
   return { baseOnly: true };
 }
 
@@ -255,6 +264,8 @@ function isResolvedUserConfigScope(initialOptions: GetAppConfigOptions, user: IU
   const userOptions = getUserConfigOptions(user);
   return (
     initialOptions.tenantId === userOptions.tenantId &&
+    initialOptions.userId === userOptions.userId &&
+    initialOptions.role === userOptions.role &&
     initialOptions.baseOnly === userOptions.baseOnly
   );
 }
@@ -442,6 +453,87 @@ async function resolveUser(
   return { status: 'resolved', user, updateData };
 }
 
+async function selectOpenIdRoleForOpenIdSync(
+  payload: JwtPayload,
+  user: IUser,
+  getRolesByNames: RemoteAgentAuthDeps['getRolesByNames'],
+): Promise<string | undefined> {
+  const options = getOpenIdRoleSyncOptions();
+  if (!options.enabled || !options.apiEnabled) {
+    return;
+  }
+
+  if (user.role === SystemRoles.ADMIN) {
+    logger.info(
+      `[remoteAgentAuth] OpenID role sync skipped for ${user.id}; existing ADMIN role is not managed by generic role sync`,
+    );
+    return;
+  }
+
+  if (options.claimSource !== 'access') {
+    logger.warn(
+      `[remoteAgentAuth] OpenID role sync skipped; source '${options.claimSource}' is not available for API auth`,
+    );
+    return;
+  }
+
+  const openIdRoleValues = await getOpenIdRolesForOpenIdSync({
+    options,
+    accessClaims: payload,
+    decodeToken: () => payload,
+  });
+  if (openIdRoleValues === undefined) {
+    logger.warn(
+      `[remoteAgentAuth] OpenID role sync skipped; claim '${options.claim}' was not found or invalid`,
+    );
+    return;
+  }
+
+  const loadLibreChatRoles = async () =>
+    getLibreChatRolesForOpenIdSync({
+      getRolesByNames,
+      rolePriority: options.rolePriority,
+      fallbackRole: options.fallbackRole,
+      logPrefix: '[remoteAgentAuth]',
+    });
+  const { rolePriority, fallbackRole } =
+    user.tenantId && getTenantId() !== user.tenantId
+      ? await tenantStorage.run({ tenantId: user.tenantId }, loadLibreChatRoles)
+      : await loadLibreChatRoles();
+  const result = selectOpenIdRole({
+    currentRole: user.role,
+    openIdRoleValues,
+    rolePriority,
+    fallbackRole,
+  });
+
+  if (!result.selectedRole || result.selectedRole === user.role) {
+    return;
+  }
+
+  logger.info(
+    `[remoteAgentAuth] OpenID role sync selected role for ${user.id}: ${user.role || 'unset'} -> ${result.selectedRole}`,
+  );
+  return result.selectedRole;
+}
+
+async function updateResolvedUser(
+  userResolution: Extract<UserResolution, { status: 'resolved' }>,
+  updateUser: RemoteAgentAuthDeps['updateUser'],
+): Promise<void> {
+  if (Object.keys(userResolution.updateData).length === 0) {
+    return;
+  }
+
+  const update = async () => updateUser(userResolution.user.id, userResolution.updateData);
+  if (userResolution.user.tenantId && getTenantId() !== userResolution.user.tenantId) {
+    await tenantStorage.run({ tenantId: userResolution.user.tenantId }, update);
+    return;
+  }
+
+  await update();
+}
+
 /**
  * Factory for Remote Agent API auth middleware.
  *
@@ -466,6 +558,7 @@ async function resolveUser(
 export function createRemoteAgentAuth({
   apiKeyMiddleware,
   findUser,
+  getRolesByNames,
   updateUser,
   getAppConfig,
 }: RemoteAgentAuthDeps): RequestHandler {
@@ -567,10 +660,32 @@ export function createRemoteAgentAuth({
         return;
       }
 
-      if (Object.keys(userResolution.updateData).length > 0) {
-        await updateUser(userResolution.user.id, userResolution.updateData);
+      const selectedRole = await selectOpenIdRoleForOpenIdSync(
+        payload,
+        userResolution.user,
+        getRolesByNames,
+      );
+      const roleChanged = Boolean(selectedRole);
+      if (selectedRole) {
+        userResolution.user.role = selectedRole;
+        userResolution.updateData.role = selectedRole;
       }
 
+      if (
+        roleChanged &&
+        !(await enforceOidcTenantPolicy(
+          token,
+          userResolution.user,
+          initialConfigOptions,
+          getAppConfig,
+        ))
+      ) {
+        res.status(401).json({ error: 'Unauthorized' });
+        return;
+      }
+
+      await updateResolvedUser(userResolution, updateUser);
+
       req.user = userResolution.user;
       return next();
     } catch (err) {
diff --git a/packages/api/src/middleware/share.spec.ts b/packages/api/src/middleware/share.spec.ts
index 3924d4bf6ce..beff01d581f 100644
--- a/packages/api/src/middleware/share.spec.ts
+++ b/packages/api/src/middleware/share.spec.ts
@@ -6,7 +6,7 @@ jest.mock('@librechat/data-schemas', () => ({
   },
 }));
 
-import { Permissions, PermissionTypes, ResourceType } from 'librechat-data-provider';
+import { Permissions, PermissionTypes, PrincipalType, ResourceType } from 'librechat-data-provider';
 import type { NextFunction, Response } from 'express';
 import type { IRole } from '@librechat/data-schemas';
 import type { ServerRequest } from '~/types/http';
@@ -19,6 +19,9 @@ type ShareTestRequest = ServerRequest & {
   };
   body: ServerRequest['body'] & {
     public?: boolean;
+    updated?: Array<{
+      type?: string;
+    }>;
   };
 };
 
@@ -168,6 +171,41 @@ describe('createSharePolicyMiddleware', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it('requires SHARE_PUBLIC when PUBLIC is granted through updated principals', async () => {
+    const { checkSharePublicAccess } = createSharePolicyMiddleware({
+      getRoleByName,
+      hasCapability,
+    });
+    getRoleByName.mockResolvedValue(
+      createRole({
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      }),
+    );
+    const req = createRequest({
+      params: { resourceType: ResourceType.SHARED_LINK },
+      body: {
+        updated: [
+          {
+            type: PrincipalType.PUBLIC,
+          },
+        ],
+      },
+    });
+    const res = createResponse();
+
+    await checkSharePublicAccess(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'Forbidden',
+      message: `You do not have permission to share ${ResourceType.SHARED_LINK} resources publicly`,
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
   it('reuses the role permission lookup for public sharing checks', async () => {
     const { checkShareAccess, checkSharePublicAccess } = createSharePolicyMiddleware({
       getRoleByName,
diff --git a/packages/api/src/middleware/share.ts b/packages/api/src/middleware/share.ts
index ec5074a6cc1..2d265308b64 100644
--- a/packages/api/src/middleware/share.ts
+++ b/packages/api/src/middleware/share.ts
@@ -1,5 +1,5 @@
 import { logger, ResourceCapabilityMap } from '@librechat/data-schemas';
-import { Permissions, PermissionTypes, ResourceType } from 'librechat-data-provider';
+import { Permissions, PermissionTypes, PrincipalType, ResourceType } from 'librechat-data-provider';
 import type { NextFunction, Response } from 'express';
 import type { IRole } from '@librechat/data-schemas';
 import type { CapabilityUser, HasCapabilityFn } from './capabilities';
@@ -18,6 +18,9 @@ type ShareRequest = ServerRequest & {
   };
   body: RequestBody & {
     public?: boolean;
+    updated?: Array<{
+      type?: string;
+    }>;
   };
   sharePermissionContext?: SharePermissionCache;
 };
@@ -45,6 +48,7 @@ const resourceToPermissionType: Record<ResourceType, PermissionTypes> = {
   [ResourceType.MCPSERVER]: PermissionTypes.MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: PermissionTypes.REMOTE_AGENTS,
   [ResourceType.SKILL]: PermissionTypes.SKILLS,
+  [ResourceType.SHARED_LINK]: PermissionTypes.SHARED_LINKS,
 };
 
 function formatError(error: unknown): string {
@@ -204,9 +208,12 @@ export function createSharePolicyMiddleware({ getRoleByName, hasCapability }: Sh
     next: NextFunction,
   ): Promise<Response | void> {
     try {
-      const { public: isPublic } = req.body;
+      const { public: isPublic, updated } = req.body;
+      const updatesPublicPrincipal =
+        Array.isArray(updated) &&
+        updated.some((principal) => principal?.type === PrincipalType.PUBLIC);
 
-      if (!isPublic) {
+      if (!isPublic && !updatesPublicPrincipal) {
         return next();
       }
 
diff --git a/packages/api/src/middleware/tenant.ts b/packages/api/src/middleware/tenant.ts
index d0907e0d653..b78ca8a7439 100644
--- a/packages/api/src/middleware/tenant.ts
+++ b/packages/api/src/middleware/tenant.ts
@@ -1,9 +1,27 @@
 import { unlink } from 'fs/promises';
 import { isMainThread } from 'worker_threads';
-import { getTenantId, tenantStorage, logger, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import { tenantStorage, logger, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import type { TenantContext } from '@librechat/data-schemas';
 import type { Response, NextFunction } from 'express';
 import type { ServerRequest } from '~/types/http';
 
+type ContextUser = {
+  tenantId?: string;
+  id?: string;
+  _id?: { toString: () => string };
+} | null;
+
+type ContextRequest = {
+  headers: ServerRequest['headers'];
+  tenantId?: string;
+  user?: ContextUser;
+  id?: string;
+  requestId?: string;
+};
+
+const REQUEST_ID_HEADERS = ['x-request-id', 'x-correlation-id'] as const;
+const SYSTEM_TENANT_REJECTION_MESSAGE = 'System tenant is not allowed for request-scoped routes';
+
 let _checkedThread = false;
 
 let _strictMode: boolean | undefined;
@@ -17,20 +35,73 @@ export function _resetTenantMiddlewareStrictCache(): void {
   _strictMode = undefined;
 }
 
+function normalizeContextValue(value?: string): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed || undefined;
+}
+
+function getHeaderValue(value: string | string[] | undefined): string | undefined {
+  return normalizeContextValue(Array.isArray(value) ? value[0] : value);
+}
+
+function getRequestId(req: ContextRequest): string | undefined {
+  const requestId = normalizeContextValue(req.requestId) ?? normalizeContextValue(req.id);
+  if (requestId) {
+    return requestId;
+  }
+  for (const header of REQUEST_ID_HEADERS) {
+    const value = getHeaderValue(req.headers[header]);
+    if (value) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function getUserId(user: ContextUser): string | undefined {
+  return normalizeContextValue(user?.id) ?? normalizeContextValue(user?._id?.toString());
+}
+
+function hasTenantContext(context: TenantContext): boolean {
+  return Boolean(context.tenantId || context.userId || context.requestId);
+}
+
+export function buildTenantContext(
+  req: ContextRequest,
+  tenantId: string | undefined = req.tenantId ?? req.user?.tenantId,
+): TenantContext {
+  return {
+    tenantId: normalizeContextValue(tenantId),
+    userId: getUserId(req.user ?? null),
+    requestId: getRequestId(req),
+  };
+}
+
+export function runWithTenantContext(context: TenantContext, next: NextFunction): void {
+  if (!hasTenantContext(context)) {
+    next();
+    return;
+  }
+  return void tenantStorage.run(context, async () => {
+    next();
+  });
+}
+
 /**
  * Express middleware that propagates the authenticated user's `tenantId` into
- * the AsyncLocalStorage context used by the Mongoose tenant-isolation plugin.
+ * the AsyncLocalStorage context used by the Mongoose tenant-isolation plugin
+ * and request-scoped logging.
  *
  * **Placement**: Chained automatically by `requireJwtAuth` after successful
  * passport authentication (req.user is populated). Must NOT be registered at
  * global `app.use()` scope — `req.user` is undefined at that stage.
  *
  * Behaviour:
- * - Authenticated request with `tenantId` → wraps downstream in `tenantStorage.run({ tenantId })`
+ * - Authenticated request with context → wraps downstream in `tenantStorage.run(context)`
  * - Authenticated request **without** `tenantId`:
  *   - Strict mode (`TENANT_ISOLATION_STRICT=true`) → responds 403
- *   - Non-strict (default) → passes through without ALS context (backward compat)
- * - Unauthenticated request → no-op (calls `next()` directly)
+ *   - Non-strict (default) → passes through with user/request context only
+ * - Unauthenticated request → propagates request context when available
  */
 export function tenantContextMiddleware(
   req: ServerRequest,
@@ -47,27 +118,33 @@ export function tenantContextMiddleware(
     }
   }
 
-  const user = req.user as { tenantId?: string } | undefined;
+  const user = req.user;
+  const context = buildTenantContext(req);
+  const { tenantId } = context;
 
-  if (!user) {
-    next();
+  if (tenantId === SYSTEM_TENANT_ID) {
+    logger.warn('[tenantContextMiddleware] Rejected system tenant for request route', {
+      path: req.path,
+    });
+    res.status(403).json({ error: SYSTEM_TENANT_REJECTION_MESSAGE });
     return;
   }
 
-  const tenantId = user.tenantId;
+  if (!user) {
+    runWithTenantContext(context, next);
+    return;
+  }
 
   if (!tenantId) {
     if (isStrict()) {
       res.status(403).json({ error: 'Tenant context required in strict isolation mode' });
       return;
     }
-    next();
+    runWithTenantContext(context, next);
     return;
   }
 
-  return void tenantStorage.run({ tenantId }, async () => {
-    next();
-  });
+  runWithTenantContext(context, next);
 }
 
 export type RequestTenantSource = {
@@ -137,6 +214,19 @@ async function rejectRequestWithUploadCleanup(
   res.status(403).json({ error: message });
 }
 
+function rejectRequestWithUploadCleanupInContext(
+  context: TenantContext,
+  req: ServerRequest,
+  res: Response,
+  message: string,
+): Promise<void> {
+  const rejectRequest = () => rejectRequestWithUploadCleanup(req, res, message);
+  if (!hasTenantContext(context)) {
+    return rejectRequest();
+  }
+  return tenantStorage.run(context, rejectRequest);
+}
+
 /**
  * Re-enters tenant ALS from the server-resolved request tenant.
  *
@@ -150,36 +240,38 @@ export function restoreTenantContextFromReq(
   next: NextFunction,
 ): void | Promise<void> {
   const tenantId = resolveRequestTenantId(req as RequestTenantSource);
+  const context = buildTenantContext(req, tenantId);
+  const resolvedTenantId = context.tenantId;
 
-  if (!tenantId) {
+  if (!resolvedTenantId) {
     if (isStrict()) {
-      return rejectRequestWithUploadCleanup(
+      return rejectRequestWithUploadCleanupInContext(
+        context,
         req,
         res,
         'Tenant context required in strict isolation mode',
       );
     }
-    next();
+    runWithTenantContext(context, next);
     return;
   }
 
-  if (tenantId === SYSTEM_TENANT_ID) {
+  if (resolvedTenantId === SYSTEM_TENANT_ID) {
     logger.warn('[restoreTenantContextFromReq] Rejected system tenant for request route', {
       path: req.path,
     });
-    return rejectRequestWithUploadCleanup(
-      req,
-      res,
-      'System tenant is not allowed for request-scoped routes',
-    );
+    return rejectRequestWithUploadCleanup(req, res, SYSTEM_TENANT_REJECTION_MESSAGE);
   }
 
-  if (getTenantId() === tenantId) {
+  const currentContext = tenantStorage.getStore();
+  if (
+    currentContext?.tenantId === context.tenantId &&
+    currentContext?.userId === context.userId &&
+    currentContext?.requestId === context.requestId
+  ) {
     next();
     return;
   }
 
-  return void tenantStorage.run({ tenantId }, async () => {
-    next();
-  });
+  return runWithTenantContext(context, next);
 }
diff --git a/packages/api/src/modelSpecs/index.ts b/packages/api/src/modelSpecs/index.ts
new file mode 100644
index 00000000000..30c895d89c0
--- /dev/null
+++ b/packages/api/src/modelSpecs/index.ts
@@ -0,0 +1,236 @@
+import {
+  parseCompactConvo,
+  replaceSpecialVars,
+  type EModelEndpoint,
+  type TConversation,
+  type TModelSpec,
+  type TModelSpecPreset,
+  type TPreset,
+  type TSpecsConfig,
+  type TUser,
+} from 'librechat-data-provider';
+
+export const PRIVATE_MODEL_SPEC_PRESET_FIELDS: readonly [
+  'promptPrefix',
+  'instructions',
+  'additional_instructions',
+  'system',
+  'context',
+  'examples',
+] = [
+  'promptPrefix',
+  'instructions',
+  'additional_instructions',
+  'system',
+  'context',
+  'examples',
+] as const satisfies readonly (keyof TModelSpecPreset)[];
+
+export type PrivateModelSpecPresetField = (typeof PRIVATE_MODEL_SPEC_PRESET_FIELDS)[number];
+export type ModelSpecParsedBody = Partial<TConversation | TPreset | TModelSpecPreset> &
+  Record<string, unknown>;
+
+export const ENFORCED_MODEL_SPEC_REQUEST_FIELDS: readonly ['chatProjectId'] = [
+  'chatProjectId',
+] as const satisfies readonly (keyof ModelSpecParsedBody)[];
+
+export type ApplyModelSpecPresetParams = {
+  modelSpec: TModelSpec;
+  parsedBody: ModelSpecParsedBody;
+  endpoint?: string | null;
+  endpointType?: string | null;
+  defaultParamsEndpoint?: string | null;
+  includePresetDefaults?: boolean;
+};
+
+export type ApplyModelSpecPresetResult = {
+  parsedBody: ModelSpecParsedBody;
+  appliedPrivateFields: Set<PrivateModelSpecPresetField>;
+};
+
+function hasModelSpecValue(field: PrivateModelSpecPresetField, value: unknown): boolean {
+  if (value == null || value === '') {
+    return false;
+  }
+
+  if (!Array.isArray(value)) {
+    return true;
+  }
+
+  if (field === 'examples') {
+    return value.some((example) => {
+      const input = example?.input?.content;
+      const output = example?.output?.content;
+      return Boolean(input || output);
+    });
+  }
+
+  return value.length > 0;
+}
+
+function pickEnforcedModelSpecRequestFields(parsedBody: ModelSpecParsedBody): ModelSpecParsedBody {
+  const requestFields: ModelSpecParsedBody = {};
+
+  for (const field of ENFORCED_MODEL_SPEC_REQUEST_FIELDS) {
+    if (parsedBody[field] !== undefined) {
+      requestFields[field] = parsedBody[field];
+    }
+  }
+
+  return requestFields;
+}
+
+function mergeModelSpecPreset(
+  modelSpec: TModelSpec,
+  parsedBody: ModelSpecParsedBody,
+  { includePresetDefaults = false }: Pick<ApplyModelSpecPresetParams, 'includePresetDefaults'> = {},
+): ApplyModelSpecPresetResult {
+  const preset = modelSpec.preset;
+  const requestFields = includePresetDefaults
+    ? pickEnforcedModelSpecRequestFields(parsedBody)
+    : parsedBody;
+  const merged = {
+    ...requestFields,
+    ...(includePresetDefaults ? preset : {}),
+    spec: modelSpec.name,
+  } as ModelSpecParsedBody;
+  const appliedPrivateFields = new Set<PrivateModelSpecPresetField>();
+
+  for (const field of PRIVATE_MODEL_SPEC_PRESET_FIELDS) {
+    if (!Object.prototype.hasOwnProperty.call(preset, field)) {
+      continue;
+    }
+
+    if (includePresetDefaults) {
+      appliedPrivateFields.add(field);
+      continue;
+    }
+
+    if (!hasModelSpecValue(field, parsedBody[field])) {
+      (merged as Record<string, unknown>)[field] = preset[field];
+      appliedPrivateFields.add(field);
+    }
+  }
+
+  return { parsedBody: merged, appliedPrivateFields };
+}
+
+export function findModelSpecByName(
+  modelSpecs: Pick<TSpecsConfig, 'list'> | undefined,
+  spec: string | null | undefined,
+): TModelSpec | undefined {
+  if (!spec) {
+    return undefined;
+  }
+
+  return modelSpecs?.list?.find((modelSpec) => modelSpec.name === spec);
+}
+
+export function isModelSpecEndpointMatch(
+  modelSpec: Pick<TModelSpec, 'preset'> | undefined,
+  endpoint: string | null | undefined,
+): boolean {
+  return Boolean(modelSpec && endpoint === modelSpec.preset?.endpoint);
+}
+
+export function applyModelSpecPreset({
+  modelSpec,
+  parsedBody,
+  endpoint,
+  endpointType,
+  defaultParamsEndpoint,
+  includePresetDefaults,
+}: ApplyModelSpecPresetParams): ApplyModelSpecPresetResult {
+  const { parsedBody: conversation, appliedPrivateFields } = mergeModelSpecPreset(
+    modelSpec,
+    parsedBody,
+    {
+      includePresetDefaults,
+    },
+  );
+  const reparsedBody = parseCompactConvo({
+    endpoint: endpoint as EModelEndpoint | undefined,
+    endpointType: endpointType as EModelEndpoint | null | undefined,
+    conversation,
+    defaultParamsEndpoint,
+  });
+
+  if (!reparsedBody) {
+    throw new Error('Model spec preset produced an empty parsed body');
+  }
+
+  const modelSpecParsedBody = reparsedBody as ModelSpecParsedBody;
+  if (modelSpec.iconURL != null && modelSpec.iconURL !== '') {
+    modelSpecParsedBody.iconURL = modelSpec.iconURL;
+  }
+
+  return { parsedBody: modelSpecParsedBody, appliedPrivateFields };
+}
+
+export function resolveModelSpecPromptPrefixVariables<T extends { promptPrefix?: string | null }>(
+  parsedBody: T,
+  user?: TUser | null,
+  now?: string | number | Date,
+): T {
+  if (typeof parsedBody.promptPrefix !== 'string') {
+    return parsedBody;
+  }
+
+  return {
+    ...parsedBody,
+    promptPrefix: replaceSpecialVars({
+      text: parsedBody.promptPrefix,
+      user,
+      now,
+    }),
+  };
+}
+
+export function sanitizeModelSpecs<T extends Partial<TSpecsConfig> | null | undefined>(
+  modelSpecs: T,
+): T {
+  if (!modelSpecs?.list || !Array.isArray(modelSpecs.list)) {
+    return modelSpecs;
+  }
+
+  return {
+    ...modelSpecs,
+    list: modelSpecs.list.map((modelSpec) => {
+      if (!modelSpec || typeof modelSpec !== 'object') {
+        return modelSpec;
+      }
+
+      const preset = modelSpec?.preset;
+      const sanitizedModelSpec = { ...modelSpec };
+      delete (sanitizedModelSpec as { skills?: unknown }).skills;
+      const subagents = sanitizedModelSpec.subagents;
+      if (subagents && typeof subagents === 'object') {
+        const sanitizedSubagents: TModelSpec['subagents'] = {};
+        if (subagents.enabled !== undefined) {
+          sanitizedSubagents.enabled = subagents.enabled;
+        }
+        if (subagents.allowSelf !== undefined) {
+          sanitizedSubagents.allowSelf = subagents.allowSelf;
+        }
+        if (Object.keys(sanitizedSubagents).length > 0) {
+          sanitizedModelSpec.subagents = sanitizedSubagents;
+        } else {
+          delete sanitizedModelSpec.subagents;
+        }
+      }
+      if (!preset || typeof preset !== 'object') {
+        return sanitizedModelSpec;
+      }
+
+      const sanitizedPreset = { ...preset };
+      for (const field of PRIVATE_MODEL_SPEC_PRESET_FIELDS) {
+        delete sanitizedPreset[field];
+      }
+
+      return {
+        ...sanitizedModelSpec,
+        preset: sanitizedPreset,
+      };
+    }),
+  } as T;
+}
diff --git a/packages/api/src/modelSpecs/modelSpecs.test.ts b/packages/api/src/modelSpecs/modelSpecs.test.ts
new file mode 100644
index 00000000000..90287a4d4b0
--- /dev/null
+++ b/packages/api/src/modelSpecs/modelSpecs.test.ts
@@ -0,0 +1,193 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TModelSpec } from 'librechat-data-provider';
+import {
+  applyModelSpecPreset,
+  findModelSpecByName,
+  isModelSpecEndpointMatch,
+  resolveModelSpecPromptPrefixVariables,
+  sanitizeModelSpecs,
+} from './index';
+
+describe('modelSpecs helpers', () => {
+  it('should strip private prompt fields from model spec presets', () => {
+    const modelSpecs = {
+      enforce: false,
+      prioritize: true,
+      list: [
+        {
+          name: 'guarded-spec',
+          label: 'Guarded Spec',
+          skills: ['private-skill'],
+          subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_private'] },
+          preset: {
+            endpoint: EModelEndpoint.openAI,
+            model: 'gpt-4o',
+            promptPrefix: 'private prompt prefix',
+            instructions: 'private assistant instructions',
+            additional_instructions: 'private additional instructions',
+            system: 'private bedrock system',
+            context: 'private context',
+            examples: [{ input: { content: 'a' }, output: { content: 'b' } }],
+            greeting: 'Hello',
+          },
+        },
+      ],
+    };
+
+    const sanitizedModelSpecs = sanitizeModelSpecs(modelSpecs);
+    expect(sanitizedModelSpecs.list[0].subagents).toEqual({
+      enabled: true,
+      allowSelf: true,
+    });
+    expect(sanitizedModelSpecs.list[0].preset).toEqual({
+      endpoint: EModelEndpoint.openAI,
+      model: 'gpt-4o',
+      greeting: 'Hello',
+    });
+    expect(sanitizedModelSpecs.list[0]).not.toHaveProperty('skills');
+  });
+
+  it('should preserve conversation starters on model specs', () => {
+    const modelSpecs = {
+      enforce: false,
+      prioritize: true,
+      list: [
+        {
+          name: 'starter-spec',
+          label: 'Starter Spec',
+          conversation_starters: ['Summarize an article', 'Plan my week'],
+          preset: {
+            endpoint: EModelEndpoint.openAI,
+            model: 'gpt-4o',
+            promptPrefix: 'private prompt prefix',
+          },
+        },
+      ],
+    };
+
+    const sanitizedModelSpecs = sanitizeModelSpecs(modelSpecs);
+    expect(sanitizedModelSpecs.list[0].conversation_starters).toEqual([
+      'Summarize an article',
+      'Plan my week',
+    ]);
+    expect(sanitizedModelSpecs.list[0].preset).not.toHaveProperty('promptPrefix');
+  });
+
+  it('should restore only private fields for non-enforced model specs', () => {
+    const modelSpec: TModelSpec = {
+      name: 'guarded-openai',
+      label: 'Guarded OpenAI',
+      iconURL: EModelEndpoint.openAI,
+      preset: {
+        endpoint: EModelEndpoint.openAI,
+        model: 'gpt-4o',
+        promptPrefix: 'private prompt prefix',
+        instructions: 'private instructions',
+        additional_instructions: 'private additional instructions',
+        temperature: 0.2,
+        maxContextTokens: 10000,
+      },
+    };
+
+    const { parsedBody, appliedPrivateFields } = applyModelSpecPreset({
+      modelSpec,
+      parsedBody: {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'guarded-openai',
+        model: 'gpt-4o',
+        temperature: 0.8,
+      },
+      endpoint: EModelEndpoint.openAI,
+    });
+
+    expect(parsedBody.promptPrefix).toBe('private prompt prefix');
+    expect(parsedBody.instructions).toBeUndefined();
+    expect(parsedBody.additional_instructions).toBeUndefined();
+    expect(parsedBody.temperature).toBe(0.8);
+    expect(parsedBody.maxContextTokens).toBeUndefined();
+    expect(parsedBody.iconURL).toBe(EModelEndpoint.openAI);
+    expect(appliedPrivateFields.has('promptPrefix')).toBe(true);
+  });
+
+  it('should restore preset defaults when model specs are enforced', () => {
+    const modelSpec: TModelSpec = {
+      name: 'enforced-openai',
+      label: 'Enforced OpenAI',
+      preset: {
+        endpoint: EModelEndpoint.openAI,
+        model: 'gpt-4o',
+        promptPrefix: 'private prompt prefix',
+        temperature: 0.2,
+      },
+    };
+
+    const { parsedBody } = applyModelSpecPreset({
+      modelSpec,
+      parsedBody: {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'enforced-openai',
+        model: 'client-model',
+        temperature: 0.8,
+        topP: 0.9,
+        chatProjectId: 'project-1',
+      },
+      endpoint: EModelEndpoint.openAI,
+      includePresetDefaults: true,
+    });
+
+    expect(parsedBody.spec).toBe('enforced-openai');
+    expect(parsedBody.model).toBe('gpt-4o');
+    expect(parsedBody.promptPrefix).toBe('private prompt prefix');
+    expect(parsedBody.temperature).toBe(0.2);
+    expect(parsedBody.topP).toBeUndefined();
+    expect(parsedBody.chatProjectId).toBe('project-1');
+  });
+
+  it('should restore private examples when parser supplies an empty default', () => {
+    const examples = [{ input: { content: 'hello' }, output: { content: 'world' } }];
+    const modelSpec: TModelSpec = {
+      name: 'guarded-google',
+      label: 'Guarded Google',
+      preset: {
+        endpoint: EModelEndpoint.google,
+        model: 'gemini-pro',
+        examples,
+      },
+    };
+
+    const { parsedBody } = applyModelSpecPreset({
+      modelSpec,
+      parsedBody: {
+        endpoint: EModelEndpoint.google,
+        spec: 'guarded-google',
+        model: 'gemini-pro',
+      },
+      endpoint: EModelEndpoint.google,
+    });
+
+    expect(parsedBody.examples).toEqual(examples);
+  });
+
+  it('should find specs and validate endpoint matches', () => {
+    const modelSpec: TModelSpec = {
+      name: 'guarded-openai',
+      label: 'Guarded OpenAI',
+      preset: {
+        endpoint: EModelEndpoint.openAI,
+        model: 'gpt-4o',
+      },
+    };
+
+    expect(findModelSpecByName({ list: [modelSpec] }, 'guarded-openai')).toBe(modelSpec);
+    expect(isModelSpecEndpointMatch(modelSpec, EModelEndpoint.openAI)).toBe(true);
+    expect(isModelSpecEndpointMatch(modelSpec, EModelEndpoint.google)).toBe(false);
+  });
+
+  it('should resolve special variables in model spec prompt prefixes', () => {
+    expect(
+      resolveModelSpecPromptPrefixVariables({ promptPrefix: 'Help {{current_user}}.' }, {
+        name: 'Ada',
+      } as never).promptPrefix,
+    ).toBe('Help Ada.');
+  });
+});
diff --git a/packages/api/src/oauth/callback.spec.ts b/packages/api/src/oauth/callback.spec.ts
new file mode 100644
index 00000000000..981b21defcf
--- /dev/null
+++ b/packages/api/src/oauth/callback.spec.ts
@@ -0,0 +1,274 @@
+import type { NextFunction, Response } from 'express';
+import {
+  createOpenIDCallbackAuthenticator,
+  logOpenIDCallbackFailure,
+  redirectToAuthFailure,
+  type OpenIDCallbackRequest,
+  type OpenIDCallbackAuthenticatorOptions,
+} from './callback';
+
+type CallbackFn = (err: unknown, user: unknown, info: unknown) => void;
+type TestRequest = OpenIDCallbackRequest;
+
+const logger = {
+  warn: jest.fn(),
+  error: jest.fn(),
+};
+
+function createRequest(overrides: Partial<TestRequest> = {}): TestRequest {
+  return {
+    headers: {},
+    method: 'GET',
+    path: '/openid/callback',
+    originalUrl: '/openid/callback',
+    query: {},
+    ...overrides,
+  } as TestRequest;
+}
+
+function createResponse(): Response {
+  return {
+    redirect: jest.fn(),
+  } as unknown as Response;
+}
+
+function createNext(): jest.MockedFunction<NextFunction> {
+  return jest.fn() as jest.MockedFunction<NextFunction>;
+}
+
+function createAuthenticator(
+  callbackHandler: (
+    callback: CallbackFn,
+    req: TestRequest,
+    res: Response,
+    next: NextFunction,
+  ) => void,
+) {
+  const passport = {
+    authenticate: jest.fn((_strategy: 'openid', _options, callback: CallbackFn) => {
+      return (req: TestRequest, res: Response, next: NextFunction) => {
+        callbackHandler(callback, req, res, next);
+      };
+    }),
+  };
+  const options: OpenIDCallbackAuthenticatorOptions = {
+    passport,
+    logger,
+    clientDomain: 'http://client.test',
+    authFailedError: 'auth_failed',
+  };
+
+  return {
+    middleware: createOpenIDCallbackAuthenticator(options),
+    passport,
+  };
+}
+
+describe('OpenID OAuth callback helpers', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('redirects failed auth attempts to the login failure URL', () => {
+    const res = createResponse();
+
+    redirectToAuthFailure(res, {
+      clientDomain: 'http://client.test',
+      authFailedError: 'auth_failed',
+    });
+
+    expect(res.redirect).toHaveBeenCalledWith(
+      'http://client.test/login?redirect=false&error=auth_failed',
+    );
+  });
+
+  it('logs OpenID callback failures with structured OAuth context', () => {
+    const req = createRequest({
+      query: {
+        code: 'secret-code',
+        state: 'secret-state',
+      },
+    });
+    const error = Object.assign(new Error('invalid response encountered'), {
+      code: 'OAUTH_INVALID_RESPONSE',
+      name: 'ClientError',
+    });
+
+    logOpenIDCallbackFailure({
+      logger,
+      req,
+      err: error,
+      info: { message: 'provider info' },
+    });
+
+    expect(logger.warn).toHaveBeenCalledWith(
+      '[OpenID OAuth] Callback authentication failed',
+      expect.objectContaining({
+        provider: 'openid',
+        code: 'OAUTH_INVALID_RESPONSE',
+        name: 'ClientError',
+        message: 'invalid response encountered',
+        has_code: true,
+        has_state: true,
+      }),
+    );
+  });
+
+  it('continues the successful callback path after logging in without a session', () => {
+    const user = { id: 'user-1' };
+    const req = createRequest();
+    const res = createResponse();
+    const next = createNext();
+    const logIn = jest.fn((loginUser, _options, done) => {
+      req.user = loginUser;
+      done();
+    });
+    req.logIn = logIn;
+    const { middleware, passport } = createAuthenticator((callback) =>
+      callback(null, user, { message: 'ok' }),
+    );
+
+    middleware(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledWith(
+      'openid',
+      { failureMessage: true, session: false },
+      expect.any(Function),
+    );
+    expect(logIn).toHaveBeenCalledWith(user, { session: false }, expect.any(Function));
+    expect(req.user).toBe(user);
+    expect(next).toHaveBeenCalledWith();
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+
+  it('sets req.user and continues when req.logIn is unavailable', () => {
+    const user = { id: 'user-1' };
+    const req = createRequest();
+    const res = createResponse();
+    const next = createNext();
+    const { middleware } = createAuthenticator((callback) => callback(null, user, undefined));
+
+    middleware(req, res, next);
+
+    expect(req.user).toBe(user);
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  it('logs OpenID protocol failures and redirects without escalating', () => {
+    const req = createRequest({
+      query: {
+        code: 'secret-code',
+        state: 'secret-state',
+      },
+    });
+    const res = createResponse();
+    const next = createNext();
+    const error = Object.assign(new Error('invalid response encountered'), {
+      code: 'OAUTH_INVALID_RESPONSE',
+      name: 'ClientError',
+    });
+    const { middleware } = createAuthenticator((callback) => callback(error, false, undefined));
+
+    middleware(req, res, next);
+
+    expect(logger.warn).toHaveBeenCalledWith(
+      '[OpenID OAuth] Callback authentication failed',
+      expect.objectContaining({
+        provider: 'openid',
+        code: 'OAUTH_INVALID_RESPONSE',
+        name: 'ClientError',
+        message: 'invalid response encountered',
+        has_code: true,
+        has_state: true,
+      }),
+    );
+    expect(res.redirect).toHaveBeenCalledWith(
+      'http://client.test/login?redirect=false&error=auth_failed',
+    );
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('logs unexpected OpenID errors with context before escalating', () => {
+    const req = createRequest({
+      query: {
+        code: 'secret-code',
+        state: 'secret-state',
+      },
+    });
+    const res = createResponse();
+    const next = createNext();
+    const error = Object.assign(new Error('database exploded'), {
+      name: 'DatabaseError',
+    });
+    const { middleware } = createAuthenticator((callback) => callback(error, false, undefined));
+
+    middleware(req, res, next);
+
+    expect(logger.error).toHaveBeenCalledWith(
+      '[OpenID OAuth] Callback authentication error',
+      expect.objectContaining({
+        provider: 'openid',
+        name: 'DatabaseError',
+        message: 'database exploded',
+        has_code: true,
+        has_state: true,
+      }),
+    );
+    expect(next).toHaveBeenCalledWith(error);
+    expect(res.redirect).not.toHaveBeenCalled();
+  });
+
+  it('logs Passport info failures and redirects without escalating', () => {
+    const req = createRequest();
+    const res = createResponse();
+    const next = createNext();
+    const { middleware } = createAuthenticator((callback) =>
+      callback(null, false, {
+        code: 'DOMAIN_DENIED',
+        message: 'Email domain not allowed',
+      }),
+    );
+
+    middleware(req, res, next);
+
+    expect(logger.warn).toHaveBeenCalledWith(
+      '[OpenID OAuth] Callback authentication failed',
+      expect.objectContaining({
+        provider: 'openid',
+        code: 'DOMAIN_DENIED',
+        message: 'Email domain not allowed',
+      }),
+    );
+    expect(res.redirect).toHaveBeenCalledWith(
+      'http://client.test/login?redirect=false&error=auth_failed',
+    );
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('logs login errors and sends them to the error handler', () => {
+    const user = { id: 'user-1' };
+    const req = createRequest();
+    const res = createResponse();
+    const next = createNext();
+    const error = Object.assign(new Error('login failed'), {
+      name: 'LoginError',
+    });
+    req.logIn = jest.fn((_loginUser, _options, done) => done(error));
+    const { middleware } = createAuthenticator((callback) =>
+      callback(null, user, { message: 'provider info' }),
+    );
+
+    middleware(req, res, next);
+
+    expect(logger.error).toHaveBeenCalledWith(
+      '[OpenID OAuth] Callback authentication error',
+      expect.objectContaining({
+        provider: 'openid',
+        name: 'LoginError',
+        message: 'login failed',
+      }),
+    );
+    expect(next).toHaveBeenCalledWith(error);
+  });
+});
diff --git a/packages/api/src/oauth/callback.ts b/packages/api/src/oauth/callback.ts
new file mode 100644
index 00000000000..4570c91e6a6
--- /dev/null
+++ b/packages/api/src/oauth/callback.ts
@@ -0,0 +1,140 @@
+import type { NextFunction, Response } from 'express';
+import {
+  buildOAuthFailureLog,
+  isOAuthProtocolFailure,
+  type OAuthFailureLog,
+  type OAuthFailureRequest,
+} from './failure';
+
+type LoginFunction = (
+  user: unknown,
+  options: { session: false },
+  done: (err?: unknown) => void,
+) => void;
+
+export type OpenIDCallbackRequest = OAuthFailureRequest & {
+  logIn?: LoginFunction;
+  user?: unknown;
+};
+
+type OpenIDCallback = (err: unknown, user: unknown, info: unknown) => void;
+
+type PassportMiddleware = (
+  req: OpenIDCallbackRequest,
+  res: Response,
+  next: NextFunction,
+) => unknown;
+
+type PassportLike = {
+  authenticate: (
+    strategy: 'openid',
+    options: {
+      failureMessage: true;
+      session: false;
+    },
+    callback: OpenIDCallback,
+  ) => PassportMiddleware;
+};
+
+type OAuthCallbackLogLevel = 'warn' | 'error';
+
+type OAuthCallbackLogger = Record<
+  OAuthCallbackLogLevel,
+  (message: string, details: OAuthFailureLog) => void
+>;
+
+export type AuthFailureRedirectOptions = {
+  clientDomain?: string;
+  authFailedError: string;
+};
+
+export type LogOpenIDCallbackFailureOptions = {
+  logger: OAuthCallbackLogger;
+  req: OAuthFailureRequest;
+  err?: unknown;
+  info?: unknown;
+  level?: OAuthCallbackLogLevel;
+};
+
+export type OpenIDCallbackAuthenticatorOptions = AuthFailureRedirectOptions & {
+  logger: OAuthCallbackLogger;
+  passport: PassportLike;
+};
+
+export function redirectToAuthFailure(
+  res: Response,
+  { clientDomain, authFailedError }: AuthFailureRedirectOptions,
+): void {
+  res.redirect(`${clientDomain}/login?redirect=false&error=${authFailedError}`);
+}
+
+export function logOpenIDCallbackFailure({
+  logger,
+  req,
+  err,
+  info,
+  level = 'warn',
+}: LogOpenIDCallbackFailureOptions): void {
+  logger[level](
+    level === 'error'
+      ? '[OpenID OAuth] Callback authentication error'
+      : '[OpenID OAuth] Callback authentication failed',
+    buildOAuthFailureLog({
+      provider: 'openid',
+      req,
+      err,
+      info,
+      defaultMessage: 'OpenID authentication failed',
+    }),
+  );
+}
+
+export function createOpenIDCallbackAuthenticator({
+  passport,
+  logger,
+  clientDomain,
+  authFailedError,
+}: OpenIDCallbackAuthenticatorOptions): (
+  req: OpenIDCallbackRequest,
+  res: Response,
+  next: NextFunction,
+) => unknown {
+  return (req: OpenIDCallbackRequest, res: Response, next: NextFunction): unknown => {
+    return passport.authenticate(
+      'openid',
+      {
+        failureMessage: true,
+        session: false,
+      },
+      (err: unknown, user: unknown, info: unknown) => {
+        if (err) {
+          if (isOAuthProtocolFailure(err, info)) {
+            logOpenIDCallbackFailure({ logger, req, err, info });
+            return redirectToAuthFailure(res, { clientDomain, authFailedError });
+          }
+
+          logOpenIDCallbackFailure({ logger, req, err, info, level: 'error' });
+          return next(err);
+        }
+
+        if (!user) {
+          logOpenIDCallbackFailure({ logger, req, err, info });
+          return redirectToAuthFailure(res, { clientDomain, authFailedError });
+        }
+
+        if (typeof req.logIn !== 'function') {
+          req.user = user;
+          return next();
+        }
+
+        return req.logIn(user, { session: false }, (loginErr?: unknown) => {
+          if (loginErr) {
+            logOpenIDCallbackFailure({ logger, req, err: loginErr, info, level: 'error' });
+            return next(loginErr);
+          }
+          return next();
+        });
+      },
+    )(req, res, next);
+  };
+}
diff --git a/packages/api/src/oauth/csrf.spec.ts b/packages/api/src/oauth/csrf.spec.ts
index b56f1fd38fb..1199dea2976 100644
--- a/packages/api/src/oauth/csrf.spec.ts
+++ b/packages/api/src/oauth/csrf.spec.ts
@@ -5,6 +5,7 @@ describe('shouldUseSecureCookie', () => {
 
   beforeEach(() => {
     process.env = { ...originalEnv };
+    delete process.env.SESSION_COOKIE_SECURE;
   });
 
   afterAll(() => {
@@ -29,6 +30,34 @@ describe('shouldUseSecureCookie', () => {
     expect(shouldUseSecureCookie()).toBe(false);
   });
 
+  it('should return true when SESSION_COOKIE_SECURE=true', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.DOMAIN_SERVER = 'http://localhost:3080';
+    process.env.SESSION_COOKIE_SECURE = 'true';
+    expect(shouldUseSecureCookie()).toBe(true);
+  });
+
+  it('should return false when SESSION_COOKIE_SECURE=false', () => {
+    process.env.NODE_ENV = 'production';
+    process.env.DOMAIN_SERVER = 'http://10.0.0.5:3080';
+    process.env.SESSION_COOKIE_SECURE = 'false';
+    expect(shouldUseSecureCookie()).toBe(false);
+  });
+
+  it('should trim and normalize SESSION_COOKIE_SECURE values', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.DOMAIN_SERVER = 'http://localhost:3080';
+    process.env.SESSION_COOKIE_SECURE = ' TRUE ';
+    expect(shouldUseSecureCookie()).toBe(true);
+  });
+
+  it('should ignore invalid SESSION_COOKIE_SECURE values', () => {
+    process.env.NODE_ENV = 'production';
+    process.env.DOMAIN_SERVER = 'https://myapp.example.com';
+    process.env.SESSION_COOKIE_SECURE = 'yes';
+    expect(shouldUseSecureCookie()).toBe(true);
+  });
+
   describe('localhost detection in production', () => {
     beforeEach(() => {
       process.env.NODE_ENV = 'production';
diff --git a/packages/api/src/oauth/csrf.ts b/packages/api/src/oauth/csrf.ts
index 6ed63968d1b..802655f2ee6 100644
--- a/packages/api/src/oauth/csrf.ts
+++ b/packages/api/src/oauth/csrf.ts
@@ -1,20 +1,27 @@
 import crypto from 'crypto';
 import type { Request, Response, NextFunction } from 'express';
+import { isEnabled } from '~/utils/common';
 
 export const OAUTH_CSRF_COOKIE = 'oauth_csrf';
-export const OAUTH_CSRF_MAX_AGE = 10 * 60 * 1000;
+export const OAUTH_CSRF_MAX_AGE: number = 10 * 60 * 1000;
 
 export const OAUTH_SESSION_COOKIE = 'oauth_session';
-export const OAUTH_SESSION_MAX_AGE = 24 * 60 * 60 * 1000;
+export const OAUTH_SESSION_MAX_AGE: number = 24 * 60 * 60 * 1000;
 export const OAUTH_SESSION_COOKIE_PATH = '/api';
 
 /**
  * Determines if secure cookies should be used.
- * Returns `true` in production unless the server is running on localhost (HTTP).
- * This allows cookies to work on `http://localhost` during local development
+ * SESSION_COOKIE_SECURE=true/false explicitly overrides the environment heuristic.
+ * Returns `true` in production unless DOMAIN_SERVER uses a localhost-style hostname.
+ * This allows cookies to work on localhost during local development
  * even when `NODE_ENV=production` (common in Docker Compose setups).
  */
 export function shouldUseSecureCookie(): boolean {
+  const secureOverride = process.env.SESSION_COOKIE_SECURE?.trim().toLowerCase();
+  if (secureOverride === 'true' || secureOverride === 'false') {
+    return isEnabled(secureOverride);
+  }
+
   const isProduction = process.env.NODE_ENV === 'production';
   const domainServer = process.env.DOMAIN_SERVER || '';
 
diff --git a/packages/api/src/oauth/failure.spec.ts b/packages/api/src/oauth/failure.spec.ts
new file mode 100644
index 00000000000..c7178030bd9
--- /dev/null
+++ b/packages/api/src/oauth/failure.spec.ts
@@ -0,0 +1,139 @@
+import { buildOAuthFailureLog, getOAuthFailureMessage, isOAuthProtocolFailure } from './failure';
+import type { OAuthFailureRequest } from './failure';
+
+function createRequest(overrides: Partial<OAuthFailureRequest> = {}): OAuthFailureRequest {
+  return {
+    headers: {},
+    method: 'GET',
+    path: '/openid/callback',
+    originalUrl: '/openid/callback',
+    query: {},
+    ...overrides,
+  };
+}
+
+describe('OAuth failure logging helpers', () => {
+  it('prefers session failure messages and removes the consumed message', () => {
+    const req = createRequest({
+      session: {
+        messages: ['first', 'latest'],
+      },
+    });
+
+    expect(getOAuthFailureMessage(req)).toBe('latest');
+    expect(req.session?.messages).toEqual(['first']);
+  });
+
+  it('falls back to provider query error details without returning Unknown OAuth error', () => {
+    const req = createRequest({
+      query: {
+        error: 'access_denied',
+        error_description: 'Denied by provider',
+      },
+    });
+
+    expect(getOAuthFailureMessage(req)).toBe('Denied by provider');
+  });
+
+  it('logs OpenID protocol failure metadata without raw code or state values', () => {
+    const req = createRequest({
+      headers: {
+        host: 'chat.example.com',
+        'x-forwarded-for': '203.0.113.10',
+        'x-forwarded-proto': 'https',
+        'user-agent': 'test-agent',
+      },
+      id: 'request-id',
+      originalUrl: '/openid/callback?code=secret-code&state=secret-state',
+      query: {
+        code: 'secret-code',
+        state: 'secret-state',
+      },
+    });
+    const error = Object.assign(new Error('invalid response encountered'), {
+      code: 'OAUTH_INVALID_RESPONSE',
+      name: 'ClientError',
+      cause: {
+        code: 'OAUTH_INVALID_RESPONSE',
+        name: 'OperationProcessingError',
+        message: 'invalid response encountered',
+      },
+    });
+
+    const log = buildOAuthFailureLog({
+      provider: 'openid',
+      req,
+      err: error,
+      defaultMessage: 'OpenID authentication failed',
+    });
+
+    expect(log).toEqual({
+      provider: 'openid',
+      code: 'OAUTH_INVALID_RESPONSE',
+      name: 'ClientError',
+      message: 'invalid response encountered',
+      cause_code: 'OAUTH_INVALID_RESPONSE',
+      cause_name: 'OperationProcessingError',
+      cause_message: 'invalid response encountered',
+      has_code: true,
+      has_state: true,
+      method: 'GET',
+      path: '/openid/callback',
+      request_id: 'request-id',
+      host: 'chat.example.com',
+      forwarded_proto: 'https',
+      forwarded_for: '203.0.113.10',
+      user_agent: 'test-agent',
+    });
+    expect(JSON.stringify(log)).not.toContain('secret-code');
+    expect(JSON.stringify(log)).not.toContain('secret-state');
+  });
+
+  it('captures provider response error fields from Passport info', () => {
+    const log = buildOAuthFailureLog({
+      provider: 'openid',
+      req: createRequest(),
+      info: {
+        error: 'access_denied',
+        error_description: 'User denied consent',
+      },
+    });
+
+    expect(log).toEqual({
+      provider: 'openid',
+      code: 'access_denied',
+      message: 'User denied consent',
+      has_code: false,
+      has_state: false,
+      method: 'GET',
+      path: '/openid/callback',
+    });
+  });
+
+  it('truncates very long messages', () => {
+    const longMessage = 'x'.repeat(320);
+
+    const log = buildOAuthFailureLog({
+      provider: 'openid',
+      req: createRequest(),
+      info: {
+        message: longMessage,
+      },
+    });
+
+    expect(log.message).toHaveLength(315);
+    expect(log.message?.endsWith('... [truncated]')).toBe(true);
+  });
+
+  it.each([
+    [{ code: 'OAUTH_INVALID_RESPONSE' }, true],
+    [{ name: 'AuthorizationResponseError' }, true],
+    [
+      { cause: { name: 'OperationProcessingError', message: 'invalid response encountered' } },
+      true,
+    ],
+    [{ name: 'DatabaseError', message: 'database exploded' }, false],
+  ])('classifies OAuth protocol failure %j as %s', (error, expected) => {
+    expect(isOAuthProtocolFailure(error)).toBe(expected);
+  });
+});
diff --git a/packages/api/src/oauth/failure.ts b/packages/api/src/oauth/failure.ts
new file mode 100644
index 00000000000..a899ac0ffad
--- /dev/null
+++ b/packages/api/src/oauth/failure.ts
@@ -0,0 +1,258 @@
+import type { Request } from 'express';
+
+const MAX_LOG_VALUE_LENGTH = 300;
+
+type LogValue = string | boolean;
+
+type FailureLike = {
+  code?: unknown;
+  error?: unknown;
+  name?: unknown;
+  message?: unknown;
+  error_description?: unknown;
+  cause?: unknown;
+};
+
+export type OAuthFailureRequest = Pick<
+  Request,
+  'headers' | 'method' | 'path' | 'originalUrl' | 'query'
+> & {
+  id?: string;
+  requestId?: string;
+  session?: {
+    messages?: unknown[];
+  };
+};
+
+export type OAuthFailureLog = {
+  provider: string;
+  code?: string;
+  name?: string;
+  message?: string;
+  cause_code?: string;
+  cause_name?: string;
+  cause_message?: string;
+  has_code: boolean;
+  has_state: boolean;
+  query_error?: string;
+  query_error_description?: string;
+  method?: string;
+  path?: string;
+  request_id?: string;
+  host?: string;
+  forwarded_host?: string;
+  forwarded_proto?: string;
+  forwarded_for?: string;
+  real_ip?: string;
+  user_agent?: string;
+};
+
+export type BuildOAuthFailureLogParams = {
+  provider: string;
+  req: OAuthFailureRequest;
+  err?: unknown;
+  info?: unknown;
+  defaultMessage?: string;
+};
+
+function normalizeLogValue(value: unknown): string | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      const normalized = normalizeLogValue(entry);
+      if (normalized) {
+        return normalized;
+      }
+    }
+    return undefined;
+  }
+
+  if (typeof value === 'string') {
+    const trimmed = value.replace(/\s+/g, ' ').trim();
+    if (!trimmed) {
+      return undefined;
+    }
+    if (trimmed.length <= MAX_LOG_VALUE_LENGTH) {
+      return trimmed;
+    }
+    return `${trimmed.slice(0, MAX_LOG_VALUE_LENGTH)}... [truncated]`;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+
+  return undefined;
+}
+
+function compactLogObject(
+  log: Partial<OAuthFailureLog> & Pick<OAuthFailureLog, 'provider' | 'has_code' | 'has_state'>,
+): OAuthFailureLog {
+  const compacted: Partial<OAuthFailureLog> = {};
+  const keys = Object.keys(log) as Array<keyof OAuthFailureLog>;
+  for (const key of keys) {
+    const value = log[key];
+    if (value !== undefined) {
+      Object.assign(compacted, { [key]: value as LogValue });
+    }
+  }
+  return compacted as OAuthFailureLog;
+}
+
+function getField(source: unknown, field: keyof FailureLike): unknown {
+  if (!source) {
+    return undefined;
+  }
+  if (typeof source === 'string') {
+    return field === 'message' ? source : undefined;
+  }
+  if (typeof source === 'object') {
+    return (source as FailureLike)[field];
+  }
+  return undefined;
+}
+
+function firstLogValue(...values: unknown[]): string | undefined {
+  for (const value of values) {
+    const normalized = normalizeLogValue(value);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return undefined;
+}
+
+function getCause(source: unknown): unknown {
+  const cause = getField(source, 'cause');
+  return cause && typeof cause === 'object' ? cause : undefined;
+}
+
+function getHeader(req: OAuthFailureRequest, headerName: string): string | undefined {
+  return normalizeLogValue(req.headers?.[headerName]);
+}
+
+function getQueryValue(req: OAuthFailureRequest, queryName: string): string | undefined {
+  return normalizeLogValue(req.query?.[queryName]);
+}
+
+function hasQueryValue(req: OAuthFailureRequest, queryName: string): boolean {
+  return getQueryValue(req, queryName) !== undefined;
+}
+
+function getRequestPath(req: OAuthFailureRequest): string | undefined {
+  return firstLogValue(req.path, req.originalUrl?.split('?')[0]);
+}
+
+function popSessionFailureMessage(req: OAuthFailureRequest): unknown {
+  const messages = req.session?.messages;
+  if (!Array.isArray(messages) || messages.length === 0) {
+    return undefined;
+  }
+  return messages.pop();
+}
+
+export function getOAuthFailureMessage(
+  req: OAuthFailureRequest,
+  defaultMessage = 'OAuth authentication failed',
+): string {
+  return (
+    firstLogValue(
+      popSessionFailureMessage(req),
+      getQueryValue(req, 'error_description'),
+      getQueryValue(req, 'error'),
+      defaultMessage,
+    ) ?? defaultMessage
+  );
+}
+
+export function buildOAuthFailureLog({
+  provider,
+  req,
+  err,
+  info,
+  defaultMessage,
+}: BuildOAuthFailureLogParams): OAuthFailureLog {
+  const errCause = getCause(err);
+  const infoCause = getCause(info);
+  return compactLogObject({
+    provider,
+    code: firstLogValue(
+      getField(err, 'code'),
+      getField(err, 'error'),
+      getField(errCause, 'code'),
+      getField(errCause, 'error'),
+      getField(info, 'code'),
+      getField(info, 'error'),
+      getField(infoCause, 'code'),
+      getField(infoCause, 'error'),
+      getQueryValue(req, 'error'),
+    ),
+    name: firstLogValue(getField(err, 'name'), getField(info, 'name')),
+    message: firstLogValue(
+      getField(err, 'message'),
+      getField(err, 'error_description'),
+      getField(info, 'message'),
+      getField(info, 'error_description'),
+      getQueryValue(req, 'error_description'),
+      getQueryValue(req, 'error'),
+      defaultMessage,
+    ),
+    cause_code: firstLogValue(getField(errCause, 'code'), getField(infoCause, 'code')),
+    cause_name: firstLogValue(getField(errCause, 'name'), getField(infoCause, 'name')),
+    cause_message: firstLogValue(getField(errCause, 'message'), getField(infoCause, 'message')),
+    has_code: hasQueryValue(req, 'code'),
+    has_state: hasQueryValue(req, 'state'),
+    query_error: getQueryValue(req, 'error'),
+    query_error_description: getQueryValue(req, 'error_description'),
+    method: normalizeLogValue(req.method),
+    path: getRequestPath(req),
+    request_id: firstLogValue(req.requestId, req.id, getHeader(req, 'x-request-id')),
+    host: getHeader(req, 'host'),
+    forwarded_host: getHeader(req, 'x-forwarded-host'),
+    forwarded_proto: getHeader(req, 'x-forwarded-proto'),
+    forwarded_for: getHeader(req, 'x-forwarded-for'),
+    real_ip: getHeader(req, 'x-real-ip'),
+    user_agent: getHeader(req, 'user-agent'),
+  });
+}
+
+export function isOAuthProtocolFailure(err?: unknown, info?: unknown): boolean {
+  const errCause = getCause(err);
+  const infoCause = getCause(info);
+  const code = firstLogValue(
+    getField(err, 'code'),
+    getField(err, 'error'),
+    getField(errCause, 'code'),
+    getField(errCause, 'error'),
+    getField(info, 'code'),
+    getField(info, 'error'),
+    getField(infoCause, 'code'),
+    getField(infoCause, 'error'),
+  );
+
+  if (code?.startsWith('OAUTH_')) {
+    return true;
+  }
+
+  const name = firstLogValue(
+    getField(err, 'name'),
+    getField(errCause, 'name'),
+    getField(info, 'name'),
+    getField(infoCause, 'name'),
+  );
+  if (name === 'AuthorizationResponseError') {
+    return true;
+  }
+
+  const message = firstLogValue(
+    getField(err, 'message'),
+    getField(errCause, 'message'),
+    getField(info, 'message'),
+    getField(infoCause, 'message'),
+  );
+
+  return name === 'OperationProcessingError' && /invalid response/i.test(message ?? '');
+}
diff --git a/packages/api/src/oauth/index.ts b/packages/api/src/oauth/index.ts
index 01be92b6e3d..4c3fea9ea4f 100644
--- a/packages/api/src/oauth/index.ts
+++ b/packages/api/src/oauth/index.ts
@@ -1,2 +1,5 @@
 export * from './csrf';
+export * from './callback';
+export * from './failure';
 export * from './tokens';
+export * from './validation';
diff --git a/packages/api/src/oauth/tokens.spec.ts b/packages/api/src/oauth/tokens.spec.ts
new file mode 100644
index 00000000000..f3e5b4a29e5
--- /dev/null
+++ b/packages/api/src/oauth/tokens.spec.ts
@@ -0,0 +1,233 @@
+import axios from 'axios';
+import { decryptV2 } from '@librechat/data-schemas';
+import { TokenExchangeMethodEnum } from 'librechat-data-provider';
+import type { AxiosRequestConfig } from 'axios';
+import { getAccessToken, refreshAccessToken } from './tokens';
+
+jest.mock('axios');
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    debug: jest.fn(),
+    error: jest.fn(),
+  },
+  encryptV2: jest.fn(async (value: string) => `encrypted:${value}`),
+  decryptV2: jest.fn(async (value: string) => {
+    if (value === 'encrypted-client-id') {
+      return 'client-id';
+    }
+    if (value === 'encrypted-client-secret') {
+      return 'client-secret';
+    }
+    if (value === 'encrypted-refresh-token') {
+      return 'refresh-token';
+    }
+    return value;
+  }),
+}));
+
+const mockedAxios = axios as jest.MockedFunction<typeof axios>;
+const mockedDecryptV2 = decryptV2 as jest.MockedFunction<typeof decryptV2>;
+
+function createTokenMethods() {
+  return {
+    findToken: jest.fn().mockResolvedValue(null),
+    updateToken: jest.fn().mockResolvedValue({}),
+    createToken: jest.fn().mockResolvedValue({}),
+  };
+}
+
+function getAxiosConfig(): AxiosRequestConfig {
+  const config = mockedAxios.mock.calls[0]?.[0] as AxiosRequestConfig | undefined;
+  if (!config) {
+    throw new Error('Expected axios to be called');
+  }
+  return config;
+}
+
+describe('action OAuth token exchange validation', () => {
+  const tokenResponse = {
+    access_token: 'access-token',
+    expires_in: 3600,
+    refresh_token: 'new-refresh-token',
+    refresh_token_expires_in: 7200,
+  };
+
+  const baseFields = {
+    userId: 'user-1',
+    identifier: 'user-1:action-1',
+    client_url: 'https://93.184.216.34/oauth/token',
+    encrypted_oauth_client_id: 'encrypted-client-id',
+    encrypted_oauth_client_secret: 'encrypted-client-secret',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockedAxios.mockResolvedValue({ data: tokenResponse });
+  });
+
+  it.each([
+    'http://93.184.216.34/oauth/token',
+    'https://localhost/oauth/token',
+    'https://10.0.0.1/oauth/token',
+    'https://169.254.169.254/latest/meta-data',
+  ])(
+    'rejects unsafe client_url before decrypting secrets or calling axios: %s',
+    async (clientUrl) => {
+      await expect(
+        getAccessToken(
+          {
+            ...baseFields,
+            client_url: clientUrl,
+            code: 'authorization-code',
+            redirect_uri: 'https://chat.example.com/api/actions/action-1/oauth/callback',
+            token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+          },
+          createTokenMethods(),
+        ),
+      ).rejects.toThrow(/Invalid action OAuth client_url/);
+
+      expect(mockedDecryptV2).not.toHaveBeenCalled();
+      expect(mockedAxios).not.toHaveBeenCalled();
+    },
+  );
+
+  it('posts authorization-code exchanges without following redirects', async () => {
+    await getAccessToken(
+      {
+        ...baseFields,
+        code: 'authorization-code',
+        redirect_uri: 'https://chat.example.com/api/actions/action-1/oauth/callback',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+      createTokenMethods(),
+    );
+
+    const config = getAxiosConfig();
+    const params = new URLSearchParams(config.data as string);
+
+    expect(config).toEqual(
+      expect.objectContaining({
+        method: 'POST',
+        url: baseFields.client_url,
+        maxRedirects: 0,
+        httpsAgent: expect.any(Object),
+      }),
+    );
+    expect(params.get('client_id')).toBe('client-id');
+    expect(params.get('client_secret')).toBe('client-secret');
+  });
+
+  it('uses Basic auth for authorization-code exchanges without putting client secrets in the body', async () => {
+    await getAccessToken(
+      {
+        ...baseFields,
+        code: 'authorization-code',
+        redirect_uri: 'https://chat.example.com/api/actions/action-1/oauth/callback',
+        token_exchange_method: TokenExchangeMethodEnum.BasicAuthHeader,
+      },
+      createTokenMethods(),
+    );
+
+    const config = getAxiosConfig();
+    const headers = config.headers as Record<string, string>;
+    const params = new URLSearchParams(config.data as string);
+
+    expect(config.maxRedirects).toBe(0);
+    expect(headers.Authorization).toBe(
+      `Basic ${Buffer.from('client-id:client-secret').toString('base64')}`,
+    );
+    expect(params.has('client_id')).toBe(false);
+    expect(params.has('client_secret')).toBe(false);
+  });
+
+  it('posts refresh-token exchanges without following redirects', async () => {
+    await refreshAccessToken(
+      {
+        ...baseFields,
+        refresh_token: 'refresh-token',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+      createTokenMethods(),
+    );
+
+    const config = getAxiosConfig();
+    const params = new URLSearchParams(config.data as string);
+
+    expect(config).toEqual(
+      expect.objectContaining({
+        method: 'POST',
+        url: baseFields.client_url,
+        maxRedirects: 0,
+        httpsAgent: expect.any(Object),
+      }),
+    );
+    expect(params.get('grant_type')).toBe('refresh_token');
+    expect(params.get('client_id')).toBe('client-id');
+    expect(params.get('client_secret')).toBe('client-secret');
+  });
+
+  it('uses Basic auth for refresh-token exchanges without putting client secrets in the body', async () => {
+    await refreshAccessToken(
+      {
+        ...baseFields,
+        refresh_token: 'refresh-token',
+        token_exchange_method: TokenExchangeMethodEnum.BasicAuthHeader,
+      },
+      createTokenMethods(),
+    );
+
+    const config = getAxiosConfig();
+    const headers = config.headers as Record<string, string>;
+    const params = new URLSearchParams(config.data as string);
+
+    expect(config.maxRedirects).toBe(0);
+    expect(headers.Authorization).toBe(
+      `Basic ${Buffer.from('client-id:client-secret').toString('base64')}`,
+    );
+    expect(params.has('client_id')).toBe(false);
+    expect(params.has('client_secret')).toBe(false);
+  });
+
+  it('reuses the same HTTPS agent across token exchanges', async () => {
+    await getAccessToken(
+      {
+        ...baseFields,
+        code: 'authorization-code',
+        redirect_uri: 'https://chat.example.com/api/actions/action-1/oauth/callback',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+      createTokenMethods(),
+    );
+    await refreshAccessToken(
+      {
+        ...baseFields,
+        refresh_token: 'refresh-token',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+      createTokenMethods(),
+    );
+
+    const [accessConfig, refreshConfig] = mockedAxios.mock.calls.map(
+      ([config]) => config as AxiosRequestConfig,
+    );
+
+    expect(accessConfig.httpsAgent).toBe(refreshConfig.httpsAgent);
+  });
+
+  it('allows explicitly exempted private token endpoints', async () => {
+    await getAccessToken(
+      {
+        ...baseFields,
+        client_url: 'https://10.0.0.1/oauth/token',
+        code: 'authorization-code',
+        redirect_uri: 'https://chat.example.com/api/actions/action-1/oauth/callback',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+        allowedAddresses: ['10.0.0.1:443'],
+      },
+      createTokenMethods(),
+    );
+
+    expect(getAxiosConfig().url).toBe('https://10.0.0.1/oauth/token');
+  });
+});
diff --git a/packages/api/src/oauth/tokens.ts b/packages/api/src/oauth/tokens.ts
index e51e91b842a..dfdac87bb2f 100644
--- a/packages/api/src/oauth/tokens.ts
+++ b/packages/api/src/oauth/tokens.ts
@@ -1,10 +1,31 @@
 import axios from 'axios';
-import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
 import { TokenExchangeMethodEnum } from 'librechat-data-provider';
-import type { TokenMethods } from '@librechat/data-schemas';
+import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
+import type { IToken, TokenMethods } from '@librechat/data-schemas';
 import type { AxiosError } from 'axios';
+import { validateActionOAuthEndpoint } from './validation';
+import { createSSRFSafeAgents } from '~/auth';
 import { logAxiosError } from '~/utils';
 
+const actionOAuthAgents = createSSRFSafeAgents();
+const actionOAuthAgentsByAddress = new Map<string, ReturnType<typeof createSSRFSafeAgents>>();
+
+function getActionOAuthAgents(allowedAddresses?: string[] | null) {
+  if (!Array.isArray(allowedAddresses) || allowedAddresses.length === 0) {
+    return actionOAuthAgents;
+  }
+
+  const cacheKey = allowedAddresses.join('\n');
+  const cachedAgents = actionOAuthAgentsByAddress.get(cacheKey);
+  if (cachedAgents) {
+    return cachedAgents;
+  }
+
+  const agents = createSSRFSafeAgents(allowedAddresses);
+  actionOAuthAgentsByAddress.set(cacheKey, agents);
+  return agents;
+}
+
 export function createHandleOAuthToken({
   findToken,
   updateToken,
@@ -38,7 +59,7 @@ export function createHandleOAuthToken({
     expiresIn?: number | string | null;
     metadata?: Record<string, unknown>;
     type?: string;
-  }) {
+  }): Promise<IToken | null> {
     const encrypedToken = await encryptV2(token);
     let expiresInNumber = 3600;
     if (typeof expiresIn === 'number') {
@@ -143,6 +164,7 @@ export async function refreshAccessToken(
     token_exchange_method,
     encrypted_oauth_client_id,
     encrypted_oauth_client_secret,
+    allowedAddresses,
   }: {
     userId: string;
     client_url: string;
@@ -151,6 +173,7 @@ export async function refreshAccessToken(
     token_exchange_method: TokenExchangeMethodEnum;
     encrypted_oauth_client_id: string;
     encrypted_oauth_client_secret: string;
+    allowedAddresses?: string[] | null;
   },
   {
     findToken,
@@ -167,6 +190,8 @@ export async function refreshAccessToken(
   refresh_token?: string;
   refresh_token_expires_in?: number;
 }> {
+  await validateActionOAuthEndpoint(client_url, 'client_url', allowedAddresses);
+
   try {
     const oauth_client_id = await decryptV2(encrypted_oauth_client_id);
     const oauth_client_secret = await decryptV2(encrypted_oauth_client_secret);
@@ -193,6 +218,8 @@ export async function refreshAccessToken(
       method: 'POST',
       url: client_url,
       headers,
+      maxRedirects: 0,
+      httpsAgent: getActionOAuthAgents(allowedAddresses).httpsAgent,
       data: params.toString(),
     });
     await processAccessTokens(
@@ -242,6 +269,7 @@ export async function getAccessToken(
     token_exchange_method,
     encrypted_oauth_client_id,
     encrypted_oauth_client_secret,
+    allowedAddresses,
   }: {
     code: string;
     userId: string;
@@ -251,6 +279,7 @@ export async function getAccessToken(
     token_exchange_method: TokenExchangeMethodEnum;
     encrypted_oauth_client_id: string;
     encrypted_oauth_client_secret: string;
+    allowedAddresses?: string[] | null;
   },
   {
     findToken,
@@ -267,6 +296,8 @@ export async function getAccessToken(
   refresh_token?: string;
   refresh_token_expires_in?: number;
 }> {
+  await validateActionOAuthEndpoint(client_url, 'client_url', allowedAddresses);
+
   const oauth_client_id = await decryptV2(encrypted_oauth_client_id);
   const oauth_client_secret = await decryptV2(encrypted_oauth_client_secret);
 
@@ -294,6 +325,8 @@ export async function getAccessToken(
       method: 'POST',
       url: client_url,
       headers,
+      maxRedirects: 0,
+      httpsAgent: getActionOAuthAgents(allowedAddresses).httpsAgent,
       data: params.toString(),
     });
 
diff --git a/packages/api/src/oauth/validation.spec.ts b/packages/api/src/oauth/validation.spec.ts
new file mode 100644
index 00000000000..fc28801efd6
--- /dev/null
+++ b/packages/api/src/oauth/validation.spec.ts
@@ -0,0 +1,82 @@
+import { AuthTypeEnum } from 'librechat-data-provider';
+
+import { validateActionOAuthEndpoint, validateActionOAuthMetadata } from './validation';
+
+describe('validateActionOAuthEndpoint', () => {
+  it('allows HTTPS endpoints on public addresses', async () => {
+    await expect(
+      validateActionOAuthEndpoint('https://93.184.216.34/oauth/token', 'client_url'),
+    ).resolves.toBeUndefined();
+  });
+
+  it.each([
+    ['HTTP endpoint', 'http://93.184.216.34/oauth/token'],
+    ['FTP endpoint', 'ftp://93.184.216.34/oauth/token'],
+    ['localhost', 'https://localhost/oauth/token'],
+    ['loopback IP', 'https://127.0.0.1/oauth/token'],
+    ['private IP', 'https://10.0.0.1/oauth/token'],
+    ['link-local IP', 'https://169.254.169.123/oauth/token'],
+    ['metadata IP', 'https://169.254.169.254/latest/meta-data'],
+    ['internal hostname', 'https://metadata/oauth/token'],
+    ['IPv6 loopback', 'https://[::1]/oauth/token'],
+  ])('rejects %s', async (_label, url) => {
+    await expect(validateActionOAuthEndpoint(url, 'client_url')).rejects.toThrow(
+      /Invalid action OAuth client_url/,
+    );
+  });
+
+  it('rejects unparseable endpoint URLs', async () => {
+    await expect(validateActionOAuthEndpoint('not a url', 'authorization_url')).rejects.toThrow(
+      /Invalid action OAuth authorization_url/,
+    );
+  });
+
+  it('allows restricted HTTPS endpoints when explicitly exempted by allowedAddresses', async () => {
+    await expect(
+      validateActionOAuthEndpoint('https://10.0.0.1/oauth/token', 'client_url', ['10.0.0.1:443']),
+    ).resolves.toBeUndefined();
+  });
+
+  it('keeps allowedAddresses scoped to the endpoint port', async () => {
+    await expect(
+      validateActionOAuthEndpoint('https://10.0.0.1:8443/oauth/token', 'client_url', [
+        '10.0.0.1:443',
+      ]),
+    ).rejects.toThrow(/Invalid action OAuth client_url/);
+  });
+});
+
+describe('validateActionOAuthMetadata', () => {
+  it('validates both OAuth authorization and token endpoints', async () => {
+    await expect(
+      validateActionOAuthMetadata({
+        type: AuthTypeEnum.OAuth,
+        authorization_url: 'https://93.184.216.34/oauth/authorize',
+        client_url: 'https://10.0.0.1/oauth/token',
+      }),
+    ).rejects.toThrow(/Invalid action OAuth client_url/);
+  });
+
+  it('passes allowedAddresses to both OAuth endpoints', async () => {
+    await expect(
+      validateActionOAuthMetadata(
+        {
+          type: AuthTypeEnum.OAuth,
+          authorization_url: 'https://10.0.0.1/oauth/authorize',
+          client_url: 'https://10.0.0.1/oauth/token',
+        },
+        ['10.0.0.1:443'],
+      ),
+    ).resolves.toBeUndefined();
+  });
+
+  it('ignores non-OAuth auth metadata', async () => {
+    await expect(
+      validateActionOAuthMetadata({
+        type: AuthTypeEnum.ServiceHttp,
+        authorization_url: 'http://localhost/oauth/authorize',
+        client_url: 'http://localhost/oauth/token',
+      }),
+    ).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/api/src/oauth/validation.ts b/packages/api/src/oauth/validation.ts
new file mode 100644
index 00000000000..d5512488004
--- /dev/null
+++ b/packages/api/src/oauth/validation.ts
@@ -0,0 +1,71 @@
+import { AuthTypeEnum } from 'librechat-data-provider';
+
+import { validateEndpointURL } from '~/auth';
+
+type ActionOAuthEndpointField = 'authorization_url' | 'client_url';
+
+interface ActionOAuthAuthMetadata {
+  type?: AuthTypeEnum | string | null;
+  authorization_url?: string | null;
+  client_url?: string | null;
+}
+
+function invalidActionOAuth(fieldName: ActionOAuthEndpointField, message: string): never {
+  throw new Error(`Invalid action OAuth ${fieldName}: ${message}`);
+}
+
+function parseEndpointError(error: unknown): string {
+  if (!(error instanceof Error)) {
+    return 'endpoint URL is not permitted.';
+  }
+
+  try {
+    const parsed = JSON.parse(error.message) as { message?: unknown };
+    if (typeof parsed.message === 'string') {
+      return parsed.message;
+    }
+  } catch {
+    return error.message;
+  }
+
+  return error.message;
+}
+
+export async function validateActionOAuthEndpoint(
+  url: string | null | undefined,
+  fieldName: ActionOAuthEndpointField,
+  allowedAddresses?: string[] | null,
+): Promise<void> {
+  if (!url || typeof url !== 'string') {
+    invalidActionOAuth(fieldName, 'endpoint URL is required.');
+  }
+
+  let parsedUrl: URL;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    invalidActionOAuth(fieldName, 'unable to parse endpoint URL.');
+  }
+
+  if (parsedUrl.protocol !== 'https:') {
+    invalidActionOAuth(fieldName, 'only HTTPS endpoint URLs are permitted.');
+  }
+
+  try {
+    await validateEndpointURL(url, `action OAuth ${fieldName}`, allowedAddresses);
+  } catch (error) {
+    invalidActionOAuth(fieldName, parseEndpointError(error));
+  }
+}
+
+export async function validateActionOAuthMetadata(
+  auth?: ActionOAuthAuthMetadata | null,
+  allowedAddresses?: string[] | null,
+): Promise<void> {
+  if (!auth || auth.type !== AuthTypeEnum.OAuth) {
+    return;
+  }
+
+  await validateActionOAuthEndpoint(auth.authorization_url, 'authorization_url', allowedAddresses);
+  await validateActionOAuthEndpoint(auth.client_url, 'client_url', allowedAddresses);
+}
diff --git a/packages/api/src/projects/handlers.ts b/packages/api/src/projects/handlers.ts
new file mode 100644
index 00000000000..6c05457d07a
--- /dev/null
+++ b/packages/api/src/projects/handlers.ts
@@ -0,0 +1,230 @@
+import { isValidObjectIdString, logger } from '@librechat/data-schemas';
+
+import type {
+  ChatProjectMethods,
+  ChatProjectSortBy,
+  ChatProjectSortDirection,
+  CreateChatProjectInput,
+  UpdateChatProjectInput,
+} from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+
+const PROJECT_NOT_FOUND = 'Project not found';
+const CONVERSATION_NOT_FOUND = 'Conversation not found';
+
+const PROJECT_SORT_FIELDS = new Set<ChatProjectSortBy>(['name', 'createdAt', 'lastConversationAt']);
+
+interface ProjectUser {
+  id: string;
+  _id?: {
+    toString(): string;
+  };
+}
+
+interface ProjectRequest extends Request {
+  user?: ProjectUser;
+}
+
+type ProjectHandlerDependencies = Pick<
+  ChatProjectMethods,
+  | 'listChatProjects'
+  | 'createChatProject'
+  | 'getChatProject'
+  | 'updateChatProject'
+  | 'deleteChatProject'
+  | 'assignConversationToProject'
+>;
+
+const getUserId = (req: ProjectRequest): string => req.user?.id ?? req.user?._id?.toString() ?? '';
+
+const queryString = (value: Request['query'][string]): string | undefined => {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return queryString(value[0]);
+  }
+  return undefined;
+};
+
+const normalizeString = (value: string | null | undefined): string =>
+  typeof value === 'string' ? value.trim() : '';
+
+const normalizeLimit = (value: Request['query'][string]): number => {
+  const limit = parseInt(queryString(value) ?? '', 10);
+  if (!Number.isFinite(limit)) {
+    return 25;
+  }
+  return Math.min(Math.max(limit, 1), 100);
+};
+
+const normalizeSortBy = (value: Request['query'][string]): ChatProjectSortBy | undefined => {
+  const sortBy = queryString(value);
+  return PROJECT_SORT_FIELDS.has(sortBy as ChatProjectSortBy)
+    ? (sortBy as ChatProjectSortBy)
+    : undefined;
+};
+
+const normalizeSortDirection = (
+  value: Request['query'][string],
+): ChatProjectSortDirection | undefined => {
+  const sortDirection = queryString(value);
+  return sortDirection === 'asc' || sortDirection === 'desc' ? sortDirection : undefined;
+};
+
+const createProjectInput = (req: ProjectRequest): CreateChatProjectInput | null => {
+  const name = normalizeString(req.body?.name);
+  if (!name) {
+    return null;
+  }
+
+  return {
+    name,
+    description: typeof req.body?.description === 'string' ? req.body.description : '',
+  };
+};
+
+export function createProjectHandlers(deps: ProjectHandlerDependencies): {
+  listProjects: (req: ProjectRequest, res: Response) => Promise<Response>;
+  createProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  assignConversationToProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  getProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  updateProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  deleteProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+} {
+  async function listProjects(req: ProjectRequest, res: Response): Promise<Response> {
+    try {
+      const result = await deps.listChatProjects(getUserId(req), {
+        cursor: queryString(req.query.cursor),
+        limit: normalizeLimit(req.query.limit),
+        sortBy: normalizeSortBy(req.query.sortBy),
+        sortDirection: normalizeSortDirection(req.query.sortDirection),
+        search: queryString(req.query.search),
+      });
+      return res.status(200).json(result);
+    } catch (error) {
+      logger.error('[projects] Error listing projects', error);
+      return res.status(500).json({ error: 'Error listing projects' });
+    }
+  }
+
+  async function createProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const input = createProjectInput(req);
+    if (!input) {
+      return res.status(400).json({ error: 'name is required' });
+    }
+
+    try {
+      const project = await deps.createChatProject(getUserId(req), input);
+      return res.status(201).json(project);
+    } catch (error) {
+      logger.error('[projects] Error creating project', error);
+      return res.status(500).json({ error: 'Error creating project' });
+    }
+  }
+
+  async function assignConversationToProject(
+    req: ProjectRequest,
+    res: Response,
+  ): Promise<Response> {
+    const { conversationId } = req.params;
+    const projectId = req.body?.projectId ?? null;
+
+    if (projectId !== null && typeof projectId !== 'string') {
+      return res.status(400).json({ error: 'projectId must be a string or null' });
+    }
+
+    try {
+      const result = await deps.assignConversationToProject(
+        getUserId(req),
+        conversationId,
+        projectId,
+      );
+      if (!result) {
+        return res.status(404).json({ error: CONVERSATION_NOT_FOUND });
+      }
+      return res.status(200).json(result);
+    } catch (error) {
+      if (error instanceof Error && error.message === PROJECT_NOT_FOUND) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      logger.error('[projects] Error assigning conversation to project', error);
+      return res.status(500).json({ error: 'Error assigning conversation to project' });
+    }
+  }
+
+  async function getProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    try {
+      const project = await deps.getChatProject(getUserId(req), projectId);
+      if (!project) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(project);
+    } catch (error) {
+      logger.error('[projects] Error getting project', error);
+      return res.status(500).json({ error: 'Error getting project' });
+    }
+  }
+
+  async function updateProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    const input: UpdateChatProjectInput = {};
+    if (req.body?.name !== undefined) {
+      const name = normalizeString(req.body.name);
+      if (!name) {
+        return res.status(400).json({ error: 'name is required' });
+      }
+      input.name = name;
+    }
+    if (req.body?.description !== undefined) {
+      input.description = typeof req.body.description === 'string' ? req.body.description : '';
+    }
+
+    try {
+      const project = await deps.updateChatProject(getUserId(req), projectId, input);
+      if (!project) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(project);
+    } catch (error) {
+      logger.error('[projects] Error updating project', error);
+      return res.status(500).json({ error: 'Error updating project' });
+    }
+  }
+
+  async function deleteProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    try {
+      const result = await deps.deleteChatProject(getUserId(req), projectId);
+      if (!result.deletedCount) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(result);
+    } catch (error) {
+      logger.error('[projects] Error deleting project', error);
+      return res.status(500).json({ error: 'Error deleting project' });
+    }
+  }
+
+  return {
+    listProjects,
+    createProject,
+    assignConversationToProject,
+    getProject,
+    updateProject,
+    deleteProject,
+  };
+}
diff --git a/packages/api/src/projects/index.ts b/packages/api/src/projects/index.ts
new file mode 100644
index 00000000000..6c6f862d018
--- /dev/null
+++ b/packages/api/src/projects/index.ts
@@ -0,0 +1 @@
+export * from './handlers';
diff --git a/packages/api/src/prompts/schemas.ts b/packages/api/src/prompts/schemas.ts
index 43cb9d7e94f..c9df44bfe7a 100644
--- a/packages/api/src/prompts/schemas.ts
+++ b/packages/api/src/prompts/schemas.ts
@@ -6,7 +6,19 @@ import { Constants } from 'librechat-data-provider';
  * Only allows fields that users should be able to modify.
  * Sensitive fields like author, authorName, _id, productionId, etc. are excluded.
  */
-export const updatePromptGroupSchema = z
+export const updatePromptGroupSchema: z.ZodObject<
+  {
+    /** The name of the prompt group */
+    name: z.ZodOptional<z.ZodString>;
+    /** Short description/oneliner for the prompt group */
+    oneliner: z.ZodOptional<z.ZodString>;
+    /** Category for organizing prompt groups */
+    category: z.ZodOptional<z.ZodString>;
+    /** Command shortcut for the prompt group */
+    command: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+  },
+  'strict'
+> = z
   .object({
     /** The name of the prompt group */
     name: z.string().min(1).max(255).optional(),
@@ -44,6 +56,19 @@ export function validatePromptGroupUpdate(data: unknown): TUpdatePromptGroupSche
  * @param data - The raw request body to validate
  * @returns A SafeParseResult with either the validated data or validation errors
  */
-export function safeValidatePromptGroupUpdate(data: unknown) {
+export function safeValidatePromptGroupUpdate(data: unknown): z.SafeParseReturnType<
+  {
+    name?: string | undefined;
+    category?: string | undefined;
+    command?: string | null | undefined;
+    oneliner?: string | undefined;
+  },
+  {
+    name?: string | undefined;
+    category?: string | undefined;
+    command?: string | null | undefined;
+    oneliner?: string | undefined;
+  }
+> {
   return updatePromptGroupSchema.safeParse(data);
 }
diff --git a/packages/api/src/rum/proxy.spec.ts b/packages/api/src/rum/proxy.spec.ts
new file mode 100644
index 00000000000..22aeeb9374e
--- /dev/null
+++ b/packages/api/src/rum/proxy.spec.ts
@@ -0,0 +1,182 @@
+jest.mock('~/app/metrics', () => ({
+  recordRumProxyRequest: jest.fn(),
+}));
+
+import { recordRumProxyRequest } from '~/app/metrics';
+import {
+  getRumProxyBodyLimit,
+  getRumProxyClientUrl,
+  getRumProxyTimeoutMs,
+  getRumProxyTargetBaseUrl,
+  isRumProxyEnabled,
+  proxyRumRequest,
+  resolveRumProxyTarget,
+} from './proxy';
+
+const makeResponse = () => {
+  const res = {
+    set: jest.fn(),
+    send: jest.fn(),
+    status: jest.fn(),
+    json: jest.fn(),
+  };
+  res.status.mockReturnValue(res);
+  return res;
+};
+
+describe('RUM proxy configuration', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+    jest.mocked(recordRumProxyRequest).mockClear();
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  it('uses the fixed LibreChat RUM proxy URL and default body limit', () => {
+    delete process.env.RUM_PROXY_BODY_LIMIT;
+    delete process.env.RUM_PROXY_TIMEOUT_MS;
+
+    expect(getRumProxyClientUrl()).toBe('/api/rum');
+    expect(getRumProxyBodyLimit()).toBe('3mb');
+    expect(getRumProxyTimeoutMs()).toBe(10000);
+  });
+
+  it('uses a positive custom collector timeout', () => {
+    process.env.RUM_PROXY_TIMEOUT_MS = '2500';
+    expect(getRumProxyTimeoutMs()).toBe(2500);
+
+    process.env.RUM_PROXY_TIMEOUT_MS = '-1';
+    expect(getRumProxyTimeoutMs()).toBe(10000);
+  });
+
+  it('resolves OTLP paths against the configured collector base URL', () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+
+    expect(isRumProxyEnabled()).toBe(true);
+    expect(resolveRumProxyTarget('/v1/traces')).toBe('http://otel-collector:4318/v1/traces');
+    expect(resolveRumProxyTarget('/v1/logs')).toBe('http://otel-collector:4318/v1/logs');
+    expect(resolveRumProxyTarget('/v1/metrics')).toBeUndefined();
+  });
+
+  it('does not enable proxy mode when RUM is disabled', () => {
+    process.env.RUM_ENABLED = 'false';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+
+    expect(isRumProxyEnabled()).toBe(false);
+
+    delete process.env.RUM_ENABLED;
+    expect(isRumProxyEnabled()).toBe(false);
+  });
+
+  it('rejects unsafe collector target URLs', () => {
+    process.env.RUM_PROXY_TARGET_URL = 'https://user:pass@collector.example.com';
+    expect(getRumProxyTargetBaseUrl()).toBeUndefined();
+
+    process.env.RUM_PROXY_TARGET_URL = 'file:///tmp/collector';
+    expect(getRumProxyTargetBaseUrl()).toBeUndefined();
+  });
+
+  it('forwards OTLP requests without forwarding app authorization', async () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const fetchMock = jest.spyOn(global, 'fetch').mockResolvedValue(
+      new Response('ok', {
+        status: 202,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const res = makeResponse();
+
+    await proxyRumRequest(
+      {
+        path: '/v1/traces',
+        body: { resourceSpans: [] },
+        headers: {
+          accept: 'application/json',
+          authorization: 'Bearer app-token',
+          'content-type': 'application/json',
+        },
+      } as never,
+      res as never,
+    );
+
+    expect(fetchMock).toHaveBeenCalledWith('http://otel-collector:4318/v1/traces', {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({ resourceSpans: [] }),
+      signal: expect.any(AbortSignal),
+    });
+    expect(res.set).toHaveBeenCalledWith('content-type', 'application/json');
+    expect(res.status).toHaveBeenCalledWith(202);
+    expect(res.send).toHaveBeenCalledWith(Buffer.from('ok'));
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'success');
+
+    fetchMock.mockRestore();
+  });
+
+  it('returns 400 for missing payloads and 404 for unsupported OTLP paths', async () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const missingBodyRes = makeResponse();
+    const unsupportedPathRes = makeResponse();
+
+    await proxyRumRequest({ path: '/v1/traces', headers: {} } as never, missingBodyRes as never);
+    await proxyRumRequest(
+      { path: '/v1/metrics', body: Buffer.from('payload'), headers: {} } as never,
+      unsupportedPathRes as never,
+    );
+
+    expect(missingBodyRes.status).toHaveBeenCalledWith(400);
+    expect(unsupportedPathRes.status).toHaveBeenCalledWith(404);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'bad_request');
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('unknown', 'not_configured');
+  });
+
+  it('returns 502 when the collector request fails', async () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const fetchMock = jest.spyOn(global, 'fetch').mockRejectedValue(new Error('collector down'));
+    const res = makeResponse();
+
+    await proxyRumRequest(
+      { path: '/v1/traces', body: Buffer.from('payload'), headers: {} } as never,
+      res as never,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(502);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'collector_error');
+    fetchMock.mockRestore();
+  });
+
+  it('records collector error status classes', async () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const fetchMock = jest
+      .spyOn(global, 'fetch')
+      .mockResolvedValue(new Response('nope', { status: 503 }));
+    const res = makeResponse();
+
+    await proxyRumRequest(
+      { path: '/v1/logs', body: Buffer.from('payload'), headers: {} } as never,
+      res as never,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(503);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('logs', 'collector_5xx');
+    fetchMock.mockRestore();
+  });
+});
diff --git a/packages/api/src/rum/proxy.ts b/packages/api/src/rum/proxy.ts
new file mode 100644
index 00000000000..856457be5f2
--- /dev/null
+++ b/packages/api/src/rum/proxy.ts
@@ -0,0 +1,187 @@
+import { logger } from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+import type { RumProxyEndpoint, RumProxyResult } from '~/app/metrics';
+import { recordRumProxyRequest } from '~/app/metrics';
+import { isEnabled } from '~/utils';
+
+const DEFAULT_PROXY_PATH = '/api/rum';
+const DEFAULT_BODY_LIMIT = '3mb';
+const DEFAULT_TIMEOUT_MS = 10_000;
+const OTLP_PATHS = new Set(['/v1/traces', '/v1/logs']);
+
+function normalizeBasePath(pathname: string): string {
+  if (pathname === '/') {
+    return '';
+  }
+
+  return pathname.endsWith('/') ? pathname.slice(0, -1) : pathname;
+}
+
+export function getRumProxyClientUrl(): string {
+  return DEFAULT_PROXY_PATH;
+}
+
+export function getRumProxyBodyLimit(): string {
+  return process.env.RUM_PROXY_BODY_LIMIT?.trim() || DEFAULT_BODY_LIMIT;
+}
+
+export function getRumProxyTimeoutMs(): number {
+  const parsed = Number(process.env.RUM_PROXY_TIMEOUT_MS);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
+}
+
+export function getRumProxyTargetBaseUrl(): URL | undefined {
+  const value = process.env.RUM_PROXY_TARGET_URL?.trim();
+  if (!value) {
+    return undefined;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return undefined;
+  }
+
+  if (url.username || url.password || url.search || url.hash) {
+    return undefined;
+  }
+
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+    return undefined;
+  }
+
+  return url;
+}
+
+export function isRumProxyEnabled(): boolean {
+  return (
+    isEnabled(process.env.RUM_ENABLED) &&
+    process.env.RUM_AUTH_MODE === 'proxy' &&
+    getRumProxyTargetBaseUrl() != null
+  );
+}
+
+export function resolveRumProxyTarget(path: string): string | undefined {
+  if (!OTLP_PATHS.has(path)) {
+    return undefined;
+  }
+
+  const baseUrl = getRumProxyTargetBaseUrl();
+  if (!baseUrl) {
+    return undefined;
+  }
+
+  const targetUrl = new URL(baseUrl.href);
+  targetUrl.pathname = `${normalizeBasePath(targetUrl.pathname)}${path}`;
+  return targetUrl.href;
+}
+
+// Keep in sync with api/server/middleware/requireJwtAuth.js; auth drops are recorded there.
+function getRumProxyEndpoint(path: string): RumProxyEndpoint {
+  if (path === '/v1/traces') {
+    return 'traces';
+  }
+  if (path === '/v1/logs') {
+    return 'logs';
+  }
+  return 'unknown';
+}
+
+function getRumCollectorResult(status: number): RumProxyResult {
+  if (status >= 500) {
+    return 'collector_5xx';
+  }
+  if (status >= 400) {
+    return 'collector_4xx';
+  }
+  return 'success';
+}
+
+function getRequestBody(req: Request): Buffer | string | undefined {
+  const body = req.body as unknown;
+
+  if (Buffer.isBuffer(body) || typeof body === 'string') {
+    return body;
+  }
+
+  if (body && typeof body === 'object') {
+    return JSON.stringify(body);
+  }
+
+  return undefined;
+}
+
+function getHeader(req: Request, name: string): string | undefined {
+  const value = req.headers[name.toLowerCase()];
+  if (Array.isArray(value)) {
+    return value[0];
+  }
+
+  return typeof value === 'string' ? value : undefined;
+}
+
+function getProxyHeaders(req: Request, body: Buffer | string): Record<string, string> {
+  const contentType =
+    getHeader(req, 'content-type') || (typeof body === 'string' ? 'application/json' : undefined);
+  const accept = getHeader(req, 'accept');
+  return {
+    ...(contentType ? { 'content-type': contentType } : {}),
+    ...(accept ? { accept } : {}),
+  };
+}
+
+export async function proxyRumRequest(req: Request, res: Response): Promise<void> {
+  const endpoint = getRumProxyEndpoint(req.path);
+  const target = resolveRumProxyTarget(req.path);
+  if (!target) {
+    recordRumProxyRequest(endpoint, 'not_configured');
+    res.status(404).json({ message: 'RUM proxy is not configured' });
+    return;
+  }
+
+  const body = getRequestBody(req);
+  if (!body) {
+    recordRumProxyRequest(endpoint, 'bad_request');
+    res.status(400).json({ message: 'RUM payload is required' });
+    return;
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), getRumProxyTimeoutMs());
+  try {
+    const response = await fetch(target, {
+      method: 'POST',
+      headers: getProxyHeaders(req, body),
+      // TS 5.9 made `Buffer` generic (`Buffer<ArrayBufferLike>`), which no longer
+      // structurally matches `BodyInit`; Node's fetch accepts a Buffer body at runtime.
+      body: body as BodyInit,
+      signal: controller.signal,
+    });
+
+    const contentType = response.headers.get('content-type');
+    if (contentType) {
+      res.set('content-type', contentType);
+    }
+
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    recordRumProxyRequest(endpoint, getRumCollectorResult(response.status));
+    res.status(response.status).send(responseBody);
+  } catch (error) {
+    recordRumProxyRequest(
+      endpoint,
+      controller.signal.aborted ? 'collector_timeout' : 'collector_error',
+    );
+    logger.warn('[rumProxy] Failed to proxy RUM telemetry', {
+      error: error instanceof Error ? error.message : String(error),
+      target,
+    });
+    res.status(controller.signal.aborted ? 504 : 502).json({
+      message: controller.signal.aborted
+        ? 'RUM telemetry proxy timed out'
+        : 'Failed to proxy RUM telemetry',
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
diff --git a/packages/api/src/shared-links/access.test.ts b/packages/api/src/shared-links/access.test.ts
new file mode 100644
index 00000000000..3f8ea771468
--- /dev/null
+++ b/packages/api/src/shared-links/access.test.ts
@@ -0,0 +1,339 @@
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+
+import mongoose, { Types, Model } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels, createMethods } from '@librechat/data-schemas';
+import { ResourceType, PrincipalType, AccessRoleIds } from 'librechat-data-provider';
+import type { Request, Response, NextFunction } from 'express';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import { AccessControlService } from '~/acl/accessControlService';
+import { createSharedLinkAccessMiddleware } from './access';
+
+let mongoServer: MongoMemoryServer;
+let AclEntry: Model<IAclEntry>;
+let SharedLink: Model<ISharedLink>;
+let aclService: AccessControlService;
+let canAccessSharedLink: ReturnType<typeof createSharedLinkAccessMiddleware>;
+
+const userId = new Types.ObjectId();
+const mockGetUserPrincipals = jest.fn();
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  const methods = createMethods(mongoose);
+  await methods.seedDefaultRoles();
+  AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+
+  aclService = new AccessControlService(mongoose);
+  const originalMethods = aclService['_dbMethods'];
+  aclService['_dbMethods'] = {
+    ...originalMethods,
+    getUserPrincipals: mockGetUserPrincipals,
+  };
+
+  canAccessSharedLink = createSharedLinkAccessMiddleware({ mongoose, aclService });
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AclEntry.deleteMany({});
+  await SharedLink.deleteMany({});
+  mockGetUserPrincipals.mockReset();
+  delete process.env.ALLOW_SHARED_LINKS_PUBLIC;
+  delete process.env.SHARED_LINKS_AUTO_MIGRATE;
+});
+
+function createReq(overrides: Record<string, unknown> = {}): Request {
+  return { params: {}, user: undefined, ...overrides } as unknown as Request;
+}
+
+function createRes(): Response & { _status: number; _json: unknown } {
+  const res = {
+    _status: 0,
+    _json: null as unknown,
+    status(code: number) {
+      res._status = code;
+      return res;
+    },
+    json(body: unknown) {
+      res._json = body;
+      return res;
+    },
+  };
+  return res as unknown as Response & { _status: number; _json: unknown };
+}
+
+async function createTestLink(overrides: Partial<ISharedLink> = {}) {
+  return SharedLink.create({
+    shareId: `share-${Date.now()}-${Math.random()}`,
+    conversationId: 'convo1',
+    user: userId.toString(),
+    messages: [],
+    ...overrides,
+  });
+}
+
+async function grantPublicViewer(resourceId: Types.ObjectId) {
+  await aclService.grantPermission({
+    principalType: PrincipalType.PUBLIC,
+    principalId: null,
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+    accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    grantedBy: userId,
+  });
+}
+
+async function grantUserViewer(resourceId: Types.ObjectId, uid: Types.ObjectId) {
+  await aclService.grantPermission({
+    principalType: PrincipalType.USER,
+    principalId: uid,
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+    accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    grantedBy: userId,
+  });
+}
+
+describe('canAccessSharedLink', () => {
+  describe('input validation', () => {
+    test('returns 400 when shareId is missing', async () => {
+      const req = createReq({ params: {} });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+      expect(res._status).toBe(400);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('returns 404 when share does not exist', async () => {
+      const req = createReq({ params: { shareId: 'nonexistent' } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+      expect(res._status).toBe(404);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('returns 404 when share is expired but ACL still exists', async () => {
+      const link = await createTestLink({ expiredAt: new Date('2020-01-01T00:00:00.000Z') });
+      await grantPublicViewer(link._id);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(404);
+      expect(next).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('public links', () => {
+    test('calls next() for anonymous access when ALLOW_SHARED_LINKS_PUBLIC is true', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+
+    test('returns 401 for anonymous access when ALLOW_SHARED_LINKS_PUBLIC is not set', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(401);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('calls next() for authenticated access to public link even without ALLOW_SHARED_LINKS_PUBLIC', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: userId.toString(), _id: userId },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+  });
+
+  describe('private links', () => {
+    test('returns 401 for unauthenticated user', async () => {
+      const link = await createTestLink();
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(401);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('returns 403 for authenticated user without ACL entry', async () => {
+      const link = await createTestLink();
+      const otherUser = new Types.ObjectId();
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: otherUser },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: otherUser.toString(), _id: otherUser, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(403);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('calls next() for authenticated user with ACL entry', async () => {
+      const link = await createTestLink();
+      const viewer = new Types.ObjectId();
+      await grantUserViewer(link._id, viewer);
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: viewer },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: viewer.toString(), _id: viewer, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+  });
+
+  describe('legacy link auto-migration', () => {
+    async function createLegacyLink(isPublic: boolean) {
+      const link = await createTestLink();
+      // Inject isPublic directly into MongoDB to simulate a legacy document
+      await mongoose.connection
+        .db!.collection('sharedlinks')
+        .updateOne({ _id: link._id }, { $set: { isPublic } });
+      return link;
+    }
+
+    test('auto-migrates public legacy link and calls next()', async () => {
+      const link = await createLegacyLink(true);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+
+      const entries = await AclEntry.find({ resourceId: link._id }).lean();
+      const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+      const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+      expect(hasOwner).toBe(true);
+      expect(hasPublic).toBe(true);
+
+      const rawDoc = await mongoose.connection
+        .db!.collection('sharedlinks')
+        .findOne({ _id: link._id });
+      expect(rawDoc).not.toHaveProperty('isPublic');
+    });
+
+    test('does not re-create PUBLIC after owner removes it', async () => {
+      const link = await createLegacyLink(true);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const next1 = jest.fn();
+      const req1 = createReq({ params: { shareId: link.shareId } });
+      await canAccessSharedLink(req1, createRes(), next1 as unknown as NextFunction);
+
+      await AclEntry.deleteMany({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      });
+
+      const next2 = jest.fn();
+      const req2 = createReq({ params: { shareId: link.shareId } });
+      const res2 = createRes();
+      await canAccessSharedLink(req2, res2, next2 as unknown as NextFunction);
+
+      const publicEntries = await AclEntry.find({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      }).lean();
+      expect(publicEntries).toHaveLength(0);
+    });
+
+    test('auto-migrates legacy link with isPublic: false — no PUBLIC grant', async () => {
+      const link = await createLegacyLink(false);
+      const viewer = new Types.ObjectId();
+      await grantUserViewer(link._id, viewer);
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: viewer },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: viewer.toString(), _id: viewer, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      const publicEntries = await AclEntry.find({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      }).lean();
+      expect(publicEntries).toHaveLength(0);
+    });
+
+    test('returns 403 when auto-migration is disabled', async () => {
+      const link = await createLegacyLink(true);
+      process.env.SHARED_LINKS_AUTO_MIGRATE = 'false';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(403);
+      expect(next).not.toHaveBeenCalled();
+      expect((res._json as Record<string, string>).message).toContain('migration');
+    });
+  });
+});
diff --git a/packages/api/src/shared-links/access.ts b/packages/api/src/shared-links/access.ts
new file mode 100644
index 00000000000..3cbb971c3a0
--- /dev/null
+++ b/packages/api/src/shared-links/access.ts
@@ -0,0 +1,145 @@
+import { ResourceType, PermissionBits } from 'librechat-data-provider';
+import {
+  getTenantId,
+  runAsSystem,
+  tenantStorage,
+  activeExpirationFilter,
+} from '@librechat/data-schemas';
+import type { Request, Response, NextFunction } from 'express';
+import type { IUser } from '@librechat/data-schemas';
+import type { Types, Model } from 'mongoose';
+import { AccessControlService } from '~/acl/accessControlService';
+import { autoMigrateLegacyLink } from './service';
+import { isEnabled } from '~/utils';
+
+interface RawSharedLink {
+  _id?: Types.ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  shareId?: string;
+  tenantId?: string;
+  isPublic?: boolean;
+  expiredAt?: Date;
+}
+
+export interface SharedLinkAccessDeps {
+  mongoose: typeof import('mongoose');
+  aclService?: AccessControlService;
+}
+
+function isAutoMigrateEnabled(): boolean {
+  // Fallback for legacy rows missed by the explicit shared-link permissions migration.
+  const val = process.env.SHARED_LINKS_AUTO_MIGRATE;
+  return val === undefined || isEnabled(val);
+}
+
+export function createSharedLinkAccessMiddleware(deps: SharedLinkAccessDeps) {
+  const { mongoose: mg } = deps;
+  const aclService = deps.aclService ?? new AccessControlService(mg);
+
+  async function hasPublicViewPermission(resourceId: string): Promise<boolean> {
+    return aclService.hasPublicAccess({
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    });
+  }
+
+  return async function canAccessSharedLink(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> {
+    const { shareId } = req.params;
+    if (!shareId) {
+      res.status(400).json({ message: 'Missing shareId' });
+      return;
+    }
+
+    const SharedLink = mg.models.SharedLink as Model<RawSharedLink>;
+    const findShare = async () =>
+      (await SharedLink.findOne({
+        shareId,
+        ...activeExpirationFilter<RawSharedLink>(),
+      }).lean()) as RawSharedLink | null;
+    const rawShare = getTenantId() ? await findShare() : await runAsSystem(findShare);
+
+    if (!rawShare) {
+      res.status(404).json({ message: 'Shared link not found' });
+      return;
+    }
+
+    const resourceId = rawShare._id?.toString();
+    if (!resourceId) {
+      res.status(404).json({ message: 'Shared link not found' });
+      return;
+    }
+
+    const user = req.user as IUser | undefined;
+
+    const runWithTenant = async (fn: () => Promise<void>): Promise<void> => {
+      if (rawShare.tenantId) {
+        return tenantStorage.run({ tenantId: rawShare.tenantId }, fn);
+      }
+      return runAsSystem(fn);
+    };
+
+    await runWithTenant(async () => {
+      const isLegacy = 'isPublic' in rawShare;
+
+      if (isLegacy) {
+        if (!isAutoMigrateEnabled()) {
+          res.status(403).json({ message: 'Legacy shared link requires migration' });
+          return;
+        }
+        await autoMigrateLegacyLink(rawShare);
+      }
+
+      const publicGranted = await hasPublicViewPermission(resourceId);
+
+      if (publicGranted) {
+        if (isEnabled(process.env.ALLOW_SHARED_LINKS_PUBLIC)) {
+          (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+          next();
+          return;
+        }
+
+        if (!user) {
+          res.status(401).json({ message: 'Authentication required' });
+          return;
+        }
+
+        (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+        next();
+        return;
+      }
+
+      if (!user) {
+        res.status(401).json({ message: 'Authentication required' });
+        return;
+      }
+
+      const userId = user.id ?? user._id?.toString();
+      if (!userId) {
+        res.status(401).json({ message: 'Authentication required' });
+        return;
+      }
+
+      const hasAccess = await aclService.checkPermission({
+        userId,
+        role: user.role,
+        resourceType: ResourceType.SHARED_LINK,
+        resourceId,
+        requiredPermission: PermissionBits.VIEW,
+      });
+
+      if (!hasAccess) {
+        res.status(403).json({ message: 'You do not have permission to view this shared link' });
+        return;
+      }
+
+      (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+      next();
+    });
+  };
+}
diff --git a/packages/api/src/shared-links/config.test.ts b/packages/api/src/shared-links/config.test.ts
new file mode 100644
index 00000000000..5df601d5411
--- /dev/null
+++ b/packages/api/src/shared-links/config.test.ts
@@ -0,0 +1,85 @@
+import type { AppConfig } from '@librechat/data-schemas';
+import { buildSharedLinkStartupPayload, isFileSnapshotEnabled } from './config';
+
+const withSharedLinks = (sharedLinks: unknown): AppConfig =>
+  ({ interfaceConfig: { sharedLinks } }) as unknown as AppConfig;
+
+describe('isFileSnapshotEnabled', () => {
+  const original = process.env.SHARED_LINKS_SNAPSHOT_FILES;
+
+  afterEach(() => {
+    if (original === undefined) {
+      delete process.env.SHARED_LINKS_SNAPSHOT_FILES;
+    } else {
+      process.env.SHARED_LINKS_SNAPSHOT_FILES = original;
+    }
+  });
+
+  it('defaults to enabled with no config or env', () => {
+    delete process.env.SHARED_LINKS_SNAPSHOT_FILES;
+    expect(isFileSnapshotEnabled()).toBe(true);
+    expect(isFileSnapshotEnabled({} as AppConfig)).toBe(true);
+  });
+
+  it('honors yaml snapshotFiles: false', () => {
+    delete process.env.SHARED_LINKS_SNAPSHOT_FILES;
+    expect(isFileSnapshotEnabled(withSharedLinks({ snapshotFiles: false }))).toBe(false);
+  });
+
+  it('defaults enabled when sharedLinks is a boolean', () => {
+    delete process.env.SHARED_LINKS_SNAPSHOT_FILES;
+    expect(isFileSnapshotEnabled(withSharedLinks(true))).toBe(true);
+  });
+
+  it('env override wins over yaml (env false beats yaml true)', () => {
+    process.env.SHARED_LINKS_SNAPSHOT_FILES = 'false';
+    expect(isFileSnapshotEnabled(withSharedLinks({ snapshotFiles: true }))).toBe(false);
+  });
+
+  it('env override wins over yaml (env true beats yaml false)', () => {
+    process.env.SHARED_LINKS_SNAPSHOT_FILES = 'true';
+    expect(isFileSnapshotEnabled(withSharedLinks({ snapshotFiles: false }))).toBe(true);
+  });
+});
+
+describe('buildSharedLinkStartupPayload', () => {
+  it('builds the share-view startup allowlist', () => {
+    const payload = buildSharedLinkStartupPayload(
+      {
+        interfaceConfig: {
+          privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+          termsOfService: { externalUrl: 'https://example.com/tos' },
+          modelSelect: true,
+        },
+      } as AppConfig,
+      {
+        ANALYTICS_GTM_ID: 'GTM-XYZ',
+        APP_TITLE: 'Test Chat',
+        CUSTOM_FOOTER: 'Shared footer',
+        SANDPACK_BUNDLER_URL: 'https://bundler.example.com',
+        SANDPACK_STATIC_BUNDLER_URL: 'https://static-bundler.example.com',
+      },
+    );
+
+    expect(payload).toEqual({
+      appTitle: 'Test Chat',
+      analyticsGtmId: 'GTM-XYZ',
+      bundlerURL: 'https://bundler.example.com',
+      staticBundlerURL: 'https://static-bundler.example.com',
+      customFooter: 'Shared footer',
+      interface: {
+        privacyPolicy: { externalUrl: 'https://example.com/privacy' },
+        termsOfService: { externalUrl: 'https://example.com/tos' },
+      },
+    });
+  });
+
+  it('defaults the app title and omits unrelated interface config', () => {
+    const payload = buildSharedLinkStartupPayload(
+      { interfaceConfig: { modelSelect: true } } as AppConfig,
+      {},
+    );
+
+    expect(payload).toEqual({ appTitle: 'LibreChat' });
+  });
+});
diff --git a/packages/api/src/shared-links/config.ts b/packages/api/src/shared-links/config.ts
new file mode 100644
index 00000000000..1d19c7d22cc
--- /dev/null
+++ b/packages/api/src/shared-links/config.ts
@@ -0,0 +1,68 @@
+import type { TSharedLinkStartupConfig } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { isEnabled } from '~/utils';
+
+type SharedLinkStartupEnv = NodeJS.ProcessEnv;
+
+/**
+ * Whether shared links should snapshot the files referenced by the shared chat
+ * snapshot. The `SHARED_LINKS_SNAPSHOT_FILES` env var overrides the yaml
+ * `interface.sharedLinks.snapshotFiles` value; both default to enabled.
+ */
+export function isFileSnapshotEnabled(appConfig?: AppConfig): boolean {
+  const envValue = process.env.SHARED_LINKS_SNAPSHOT_FILES;
+  if (envValue !== undefined) {
+    return isEnabled(envValue);
+  }
+
+  const sharedLinks = appConfig?.interfaceConfig?.sharedLinks;
+  if (sharedLinks && typeof sharedLinks === 'object') {
+    return sharedLinks.snapshotFiles !== false;
+  }
+
+  return true;
+}
+
+/**
+ * Viewer-independent global kill switch for serving shared-link files. Reading
+ * and serving must NOT depend on the viewer's resolved config (per-role/user
+ * overrides) — only on the link's own stored choice plus this global env switch.
+ * Active only when `SHARED_LINKS_SNAPSHOT_FILES` is explicitly set to a disabled
+ * value; the creator's yaml choice is already captured per-link at share time.
+ */
+export function isFileSnapshotKillSwitchActive(): boolean {
+  const envValue = process.env.SHARED_LINKS_SNAPSHOT_FILES;
+  return envValue !== undefined && !isEnabled(envValue);
+}
+
+export function buildSharedLinkStartupPayload(
+  appConfig?: AppConfig | null,
+  env: SharedLinkStartupEnv = process.env,
+): TSharedLinkStartupConfig {
+  const payload: TSharedLinkStartupConfig = {
+    appTitle: env.APP_TITLE || 'LibreChat',
+  };
+
+  if (typeof env.ANALYTICS_GTM_ID === 'string') {
+    payload.analyticsGtmId = env.ANALYTICS_GTM_ID;
+  }
+  if (typeof env.SANDPACK_BUNDLER_URL === 'string') {
+    payload.bundlerURL = env.SANDPACK_BUNDLER_URL;
+  }
+  if (typeof env.SANDPACK_STATIC_BUNDLER_URL === 'string') {
+    payload.staticBundlerURL = env.SANDPACK_STATIC_BUNDLER_URL;
+  }
+  if (typeof env.CUSTOM_FOOTER === 'string') {
+    payload.customFooter = env.CUSTOM_FOOTER;
+  }
+
+  const { privacyPolicy, termsOfService } = appConfig?.interfaceConfig ?? {};
+  if (privacyPolicy || termsOfService) {
+    payload.interface = {
+      ...(privacyPolicy ? { privacyPolicy } : {}),
+      ...(termsOfService ? { termsOfService } : {}),
+    };
+  }
+
+  return payload;
+}
diff --git a/packages/api/src/shared-links/service.test.ts b/packages/api/src/shared-links/service.test.ts
new file mode 100644
index 00000000000..314569a5316
--- /dev/null
+++ b/packages/api/src/shared-links/service.test.ts
@@ -0,0 +1,369 @@
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+
+import mongoose, { Types, Model } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels, createMethods } from '@librechat/data-schemas';
+import { PrincipalType, AccessRoleIds } from 'librechat-data-provider';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import {
+  autoMigrateLegacyLink,
+  grantCreationPermissions,
+  ensureLinkPermissions,
+  updateSharedLinkPermissionsExpiration,
+  deleteSharedLinkWithCleanup,
+  deleteConvoSharedLinksWithCleanup,
+  deleteAllSharedLinksWithCleanup,
+} from './service';
+
+let mongoServer: MongoMemoryServer;
+let AclEntry: Model<IAclEntry>;
+let SharedLink: Model<ISharedLink>;
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  const methods = createMethods(mongoose);
+  await methods.seedDefaultRoles();
+  AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AclEntry.deleteMany({});
+  await SharedLink.deleteMany({});
+});
+
+const userId = new Types.ObjectId().toString();
+
+async function createTestLink(overrides: Partial<ISharedLink> = {}) {
+  return SharedLink.create({
+    shareId: `share-${Date.now()}-${Math.random()}`,
+    conversationId: 'convo1',
+    user: userId,
+    messages: [],
+    ...overrides,
+  });
+}
+
+describe('autoMigrateLegacyLink', () => {
+  async function createLegacyLink(isPublic: boolean) {
+    const link = await createTestLink();
+    await mongoose.connection
+      .db!.collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  async function createOwnerlessLegacyLink(isPublic: boolean) {
+    const link = await SharedLink.create({
+      shareId: `share-${Date.now()}-${Math.random()}`,
+      conversationId: 'convo1',
+      messages: [],
+    });
+    await mongoose.connection
+      .db!.collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  test('grants OWNER and PUBLIC VIEWER for public legacy link', async () => {
+    const link = await createLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(true);
+    expect(hasPublic).toBe(true);
+  });
+
+  test('grants OWNER only for private legacy link (isPublic: false)', async () => {
+    const link = await createLegacyLink(false);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: false,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(true);
+    expect(hasPublic).toBe(false);
+  });
+
+  test('grants PUBLIC VIEWER for ownerless public legacy link', async () => {
+    const link = await createOwnerlessLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(false);
+    expect(hasPublic).toBe(true);
+  });
+
+  test('removes isPublic field from document', async () => {
+    const link = await createLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const rawDoc = await mongoose.connection
+      .db!.collection('sharedlinks')
+      .findOne({ _id: link._id });
+    expect(rawDoc).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic when grant fails, allowing retry on next access', async () => {
+    const link = await createLegacyLink(true);
+    const AccessRole = mongoose.models.AccessRole;
+    await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+    try {
+      await autoMigrateLegacyLink({
+        _id: link._id,
+        conversationId: link.conversationId,
+        user: userId,
+        shareId: link.shareId,
+        isPublic: true,
+      });
+
+      const rawDoc = await mongoose.connection
+        .db!.collection('sharedlinks')
+        .findOne({ _id: link._id });
+      expect(rawDoc).toHaveProperty('isPublic');
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+
+  test('is idempotent — does not duplicate ACL entries on repeated calls', async () => {
+    const link = await createLegacyLink(true);
+    const args = {
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    };
+    await autoMigrateLegacyLink(args);
+    await autoMigrateLegacyLink(args);
+
+    const ownerEntries = await AclEntry.find({
+      resourceId: link._id,
+      principalType: PrincipalType.USER,
+    }).lean();
+    expect(ownerEntries).toHaveLength(1);
+  });
+});
+
+describe('grantCreationPermissions', () => {
+  test('creates OWNER and PUBLIC VIEWER AclEntries', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+
+    const owner = entries.find((e) => e.principalType === PrincipalType.USER);
+    expect(owner).toBeDefined();
+    expect(owner!.principalId!.toString()).toBe(userId);
+
+    const pub = entries.find((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(pub).toBeDefined();
+  });
+
+  test('creates only OWNER when grantPublic is false', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, false);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+    expect(entries[0].principalType).toBe(PrincipalType.USER);
+  });
+
+  test('propagates shared link expiration to created AclEntries', async () => {
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    const link = await createTestLink({ expiredAt });
+
+    await grantCreationPermissions(link._id, userId, true, expiredAt);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+    for (const entry of entries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+  });
+
+  test('deletes SharedLink when OWNER grant fails', async () => {
+    const link = await createTestLink();
+
+    try {
+      const AccessRole = mongoose.models.AccessRole;
+      await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+      await expect(grantCreationPermissions(link._id, userId, true)).rejects.toThrow();
+
+      const linkAfter = await SharedLink.findById(link._id);
+      expect(linkAfter).toBeNull();
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+});
+
+describe('ensureLinkPermissions', () => {
+  test('creates OWNER AclEntry for legacy link with no entries', async () => {
+    const link = await createTestLink();
+
+    const beforeCount = await AclEntry.countDocuments({ resourceId: link._id });
+    expect(beforeCount).toBe(0);
+
+    await ensureLinkPermissions(link._id, userId);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+    expect(entries[0].principalType).toBe(PrincipalType.USER);
+  });
+
+  test('is idempotent — does not duplicate on repeated calls', async () => {
+    const link = await createTestLink();
+
+    await ensureLinkPermissions(link._id, userId);
+    await ensureLinkPermissions(link._id, userId);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+  });
+
+  test('does not delete the SharedLink on failure', async () => {
+    const link = await createTestLink();
+    const AccessRole = mongoose.models.AccessRole;
+    await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+    try {
+      await ensureLinkPermissions(link._id, userId);
+
+      const linkAfter = await SharedLink.findById(link._id);
+      expect(linkAfter).not.toBeNull();
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+});
+
+describe('updateSharedLinkPermissionsExpiration', () => {
+  test('sets and clears expiration on shared-link AclEntries', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    await updateSharedLinkPermissionsExpiration(link._id, expiredAt);
+
+    const expiringEntries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(expiringEntries).toHaveLength(2);
+    for (const entry of expiringEntries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+
+    await updateSharedLinkPermissionsExpiration(link._id, null);
+
+    const retainedEntries = await AclEntry.find({ resourceId: link._id }).lean();
+    for (const entry of retainedEntries) {
+      expect(entry).not.toHaveProperty('expiredAt');
+    }
+  });
+});
+
+describe('deleteSharedLinkWithCleanup', () => {
+  test('deletes link and triggers ACL cleanup', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const result = await deleteSharedLinkWithCleanup(userId, link.shareId!);
+
+    expect(result).toMatchObject({ success: true, shareId: link.shareId! });
+    expect(result!._id).toBe(link._id.toString());
+
+    const linkAfter = await SharedLink.findById(link._id);
+    expect(linkAfter).toBeNull();
+
+    // ACL cleanup is async (fire-and-forget), wait briefly
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+
+  test('returns null when link not found', async () => {
+    const result = await deleteSharedLinkWithCleanup(userId, 'nonexistent');
+    expect(result).toBeNull();
+  });
+});
+
+describe('deleteConvoSharedLinksWithCleanup', () => {
+  test('deletes all links for conversation and cleans up ACLs', async () => {
+    const link1 = await createTestLink({ conversationId: 'convo-a' });
+    const link2 = await createTestLink({ conversationId: 'convo-a' });
+    await grantCreationPermissions(link1._id, userId, true);
+    await grantCreationPermissions(link2._id, userId, false);
+
+    const result = await deleteConvoSharedLinksWithCleanup(userId, 'convo-a');
+
+    expect(result.deletedCount).toBe(2);
+
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({
+      resourceId: { $in: [link1._id, link2._id] },
+    }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+});
+
+describe('deleteAllSharedLinksWithCleanup', () => {
+  test('deletes all user links and cleans up ACLs', async () => {
+    const link1 = await createTestLink({ conversationId: 'c1' });
+    const link2 = await createTestLink({ conversationId: 'c2' });
+    await grantCreationPermissions(link1._id, userId, true);
+    await grantCreationPermissions(link2._id, userId, true);
+
+    const result = await deleteAllSharedLinksWithCleanup(userId);
+
+    expect(result.deletedCount).toBe(2);
+
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({
+      resourceId: { $in: [link1._id, link2._id] },
+    }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+});
diff --git a/packages/api/src/shared-links/service.ts b/packages/api/src/shared-links/service.ts
new file mode 100644
index 00000000000..7fb786b1ea1
--- /dev/null
+++ b/packages/api/src/shared-links/service.ts
@@ -0,0 +1,324 @@
+import mongoose from 'mongoose';
+import { logger } from '@librechat/data-schemas';
+import {
+  PrincipalType,
+  ResourceType,
+  AccessRoleIds,
+  PermissionBits,
+} from 'librechat-data-provider';
+import type { Model, Types, DeleteResult, UpdateQuery } from 'mongoose';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import { AccessControlService } from '~/acl/accessControlService';
+
+let _aclService: AccessControlService | null = null;
+function getAclService(): AccessControlService {
+  if (!_aclService) {
+    _aclService = new AccessControlService(mongoose);
+  }
+  return _aclService;
+}
+
+interface RawSharedLink {
+  _id?: Types.ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  shareId?: string;
+  tenantId?: string;
+  isPublic?: boolean;
+  expiredAt?: Date;
+}
+
+export async function autoMigrateLegacyLink(share: RawSharedLink): Promise<void> {
+  const shareId = share._id;
+  if (!shareId) {
+    return;
+  }
+
+  const resourceId = shareId.toString();
+  let ownerGranted = false;
+  let publicGranted = false;
+  let existingOwner = false;
+  if (share.user) {
+    existingOwner = await getAclService().checkPermission({
+      userId: share.user,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+      requiredPermission: PermissionBits.DELETE,
+    });
+
+    if (!existingOwner) {
+      try {
+        await getAclService().grantPermission({
+          principalType: PrincipalType.USER,
+          principalId: share.user,
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+          accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+          grantedBy: share.user,
+          expiredAt: share.expiredAt,
+        });
+        existingOwner = true;
+        ownerGranted = true;
+      } catch (err) {
+        logger.error('[autoMigrateLegacyLink] Failed to grant OWNER', {
+          shareId: share.shareId,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+  }
+  const needsPublicGrant = share.isPublic !== false;
+  if (needsPublicGrant) {
+    const hasPublic = await getAclService().hasPublicAccess({
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    });
+
+    if (!hasPublic) {
+      try {
+        await getAclService().grantPermission({
+          principalType: PrincipalType.PUBLIC,
+          principalId: null,
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+          accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+          grantedBy: share.user,
+          expiredAt: share.expiredAt,
+        });
+        publicGranted = true;
+      } catch (err) {
+        logger.error('[autoMigrateLegacyLink] Failed to grant PUBLIC VIEWER', {
+          shareId: share.shareId,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    } else {
+      publicGranted = true;
+    }
+  }
+
+  const ownerOk = existingOwner || !share.user;
+  const publicOk = publicGranted || !needsPublicGrant;
+
+  if (!ownerOk || !publicOk) {
+    logger.warn('[autoMigrateLegacyLink] Grants incomplete, keeping isPublic for retry', {
+      shareId: share.shareId,
+      ownerOk,
+      publicOk,
+    });
+    return;
+  }
+
+  await mongoose.connection
+    .db!.collection('sharedlinks')
+    .updateOne({ _id: shareId }, { $unset: { isPublic: 1 } });
+
+  logger.info('[autoMigrateLegacyLink] Migrated legacy shared link', {
+    shareId: share.shareId,
+    resourceId,
+    ownerGranted,
+    publicGranted,
+  });
+}
+
+export async function grantCreationPermissions(
+  sharedLinkId: string | Types.ObjectId,
+  userId: string,
+  grantPublic: boolean = true,
+  expiredAt?: Date | null,
+): Promise<void> {
+  const resourceId = sharedLinkId.toString();
+
+  try {
+    await getAclService().grantPermission({
+      principalType: PrincipalType.USER,
+      principalId: userId,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+      accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      grantedBy: userId,
+      expiredAt: expiredAt ?? undefined,
+    });
+  } catch (err) {
+    logger.error('[grantCreationPermissions] OWNER grant failed, deleting SharedLink', {
+      resourceId,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    await mongoose.models.SharedLink.deleteOne({ _id: sharedLinkId });
+    throw err;
+  }
+
+  if (grantPublic) {
+    try {
+      await getAclService().grantPermission({
+        principalType: PrincipalType.PUBLIC,
+        principalId: null,
+        resourceType: ResourceType.SHARED_LINK,
+        resourceId,
+        accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+        grantedBy: userId,
+        expiredAt: expiredAt ?? undefined,
+      });
+    } catch (err) {
+      logger.error('[grantCreationPermissions] PUBLIC VIEWER grant failed, cleaning up', {
+        resourceId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      await Promise.all([
+        mongoose.models.SharedLink.deleteOne({ _id: sharedLinkId }),
+        getAclService().removeAllPermissions({
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+        }),
+      ]);
+      throw err;
+    }
+  }
+}
+
+export async function ensureLinkPermissions(
+  sharedLinkId: string | Types.ObjectId,
+  userId: string,
+): Promise<void> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const rawDoc = await SharedLink.findById(sharedLinkId).lean();
+
+  if (!rawDoc) {
+    return;
+  }
+
+  if ('isPublic' in rawDoc) {
+    await autoMigrateLegacyLink(rawDoc as Parameters<typeof autoMigrateLegacyLink>[0]);
+    return;
+  }
+
+  try {
+    await getAclService().grantPermission({
+      principalType: PrincipalType.USER,
+      principalId: userId,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId: sharedLinkId.toString(),
+      accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      grantedBy: userId,
+      expiredAt: rawDoc.expiredAt,
+    });
+  } catch (err) {
+    logger.error('[ensureLinkPermissions] Failed to ensure OWNER AclEntry', {
+      resourceId: sharedLinkId.toString(),
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
+export async function cleanupSharedLinkPermissions(
+  resourceId: string | Types.ObjectId,
+): Promise<DeleteResult> {
+  return getAclService().removeAllPermissions({
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+  });
+}
+
+export async function cleanupBulkSharedLinkPermissions(
+  resourceIds: (string | Types.ObjectId)[],
+): Promise<DeleteResult> {
+  const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  return AclEntry.deleteMany({
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId: { $in: resourceIds },
+  });
+}
+
+export async function updateSharedLinkPermissionsExpiration(
+  resourceId: string | Types.ObjectId,
+  expiredAt: Date | null,
+): Promise<void> {
+  const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  const update: UpdateQuery<IAclEntry> =
+    expiredAt instanceof Date ? { $set: { expiredAt } } : { $unset: { expiredAt: 1 } };
+
+  await AclEntry.updateMany(
+    {
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    },
+    update,
+  );
+}
+
+export async function deleteSharedLinkWithCleanup(
+  user: string,
+  shareId: string,
+): Promise<{ _id?: string; success: boolean; shareId: string; message: string } | null> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const result = await SharedLink.findOneAndDelete({ shareId, user }).lean();
+
+  if (!result) {
+    return null;
+  }
+
+  const resourceId = result._id;
+  if (resourceId) {
+    cleanupSharedLinkPermissions(resourceId).catch((err) => {
+      logger.error('[deleteSharedLinkWithCleanup] ACL cleanup failed', {
+        shareId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    _id: resourceId?.toString(),
+    success: true,
+    shareId,
+    message: 'Share deleted successfully',
+  };
+}
+
+export async function deleteConvoSharedLinksWithCleanup(
+  user: string,
+  conversationId: string,
+): Promise<{ message: string; deletedCount: number }> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const links = await SharedLink.find({ user, conversationId }).select('_id').lean();
+  const ids = links.map((l) => l._id);
+  const result = await SharedLink.deleteMany({ user, conversationId });
+
+  if (ids.length > 0) {
+    cleanupBulkSharedLinkPermissions(ids).catch((err) => {
+      logger.error('[deleteConvoSharedLinksWithCleanup] ACL cleanup failed', {
+        conversationId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    message: 'Shared links deleted successfully',
+    deletedCount: result.deletedCount,
+  };
+}
+
+export async function deleteAllSharedLinksWithCleanup(
+  user: string,
+): Promise<{ message: string; deletedCount: number }> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const links = await SharedLink.find({ user }).select('_id').lean();
+  const ids = links.map((l) => l._id);
+  const result = await SharedLink.deleteMany({ user });
+
+  if (ids.length > 0) {
+    cleanupBulkSharedLinkPermissions(ids).catch((err) => {
+      logger.error('[deleteAllSharedLinksWithCleanup] ACL cleanup failed', {
+        user,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    message: 'All shared links deleted successfully',
+    deletedCount: result.deletedCount,
+  };
+}
diff --git a/packages/api/src/skills/__tests__/deployment.test.ts b/packages/api/src/skills/__tests__/deployment.test.ts
new file mode 100644
index 00000000000..ea180d240ba
--- /dev/null
+++ b/packages/api/src/skills/__tests__/deployment.test.ts
@@ -0,0 +1,615 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { Types } from 'mongoose';
+import { logger } from '@librechat/data-schemas';
+import type { CodeEnvRef } from 'librechat-data-provider';
+import type { DeploymentSkillBaseMethods } from '../deployment';
+import {
+  DEPLOYMENT_SKILLS_DIR_ENV,
+  createDeploymentSkillMethods,
+  getDeploymentSkillIds,
+  initializeDeploymentSkills,
+  loadDeploymentSkillsFromDirectory,
+  mergeDeploymentSkillIds,
+  resolveDeploymentSkillDirectory,
+} from '../deployment';
+
+const DESCRIPTION = 'Use this skill when the deployment needs a shared testing fixture.';
+
+let tempRoots: string[] = [];
+
+async function makeTempRoot(): Promise<string> {
+  const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'deployment-skills-'));
+  tempRoots.push(root);
+  return root;
+}
+
+async function writeDeploymentSkill(
+  root: string,
+  options: {
+    skillsDir?: string;
+    folder?: string;
+    name?: string;
+    alwaysApply?: boolean;
+    frontmatter?: string;
+  } = {},
+): Promise<string> {
+  const skillsDir = options.skillsDir ?? 'skill';
+  const folder = options.folder ?? options.name ?? 'analysis-kit';
+  const name = options.name ?? folder;
+  const skillDir = path.join(root, skillsDir, folder);
+  await fs.promises.mkdir(path.join(skillDir, 'references'), { recursive: true });
+  await fs.promises.mkdir(path.join(skillDir, 'assets'), { recursive: true });
+  await fs.promises.writeFile(
+    path.join(skillDir, 'SKILL.md'),
+    options.frontmatter ??
+      [
+        '---',
+        `name: ${name}`,
+        `description: ${DESCRIPTION}`,
+        'allowed-tools:',
+        '  - execute_code',
+        'disable-model-invocation: true',
+        'user-invocable: false',
+        `always-apply: ${options.alwaysApply === true ? 'true' : 'false'}`,
+        '---',
+        '',
+        '# Analysis Kit',
+        '',
+        'Read references/guide.txt before answering.',
+      ].join('\n'),
+  );
+  await fs.promises.writeFile(path.join(skillDir, 'references', 'guide.txt'), 'reference notes');
+  await fs.promises.writeFile(path.join(skillDir, 'assets', 'pixel.bin'), Buffer.from([0, 1, 2]));
+  return skillDir;
+}
+
+function encodeTestCursor(row: { _id: Types.ObjectId; updatedAt: Date }): string {
+  return Buffer.from(
+    JSON.stringify({
+      updatedAt: row.updatedAt.toISOString(),
+      _id: row._id.toString(),
+    }),
+  ).toString('base64');
+}
+
+afterEach(async () => {
+  const emptyRoot = await makeTempRoot();
+  await initializeDeploymentSkills({ projectRoot: emptyRoot, env: {} });
+  await Promise.all(
+    tempRoots.map((root) => fs.promises.rm(root, { recursive: true, force: true })),
+  );
+  tempRoots = [];
+});
+
+describe('resolveDeploymentSkillDirectory', () => {
+  it('defaults to project root ./skill', () => {
+    const root = path.join(os.tmpdir(), 'librechat-root');
+    expect(resolveDeploymentSkillDirectory({ projectRoot: root, env: {} })).toEqual({
+      directory: path.join(root, 'skill'),
+      explicitlyConfigured: false,
+    });
+  });
+
+  it('honors a relative DEPLOYMENT_SKILLS_DIR override', () => {
+    const root = path.join(os.tmpdir(), 'librechat-root');
+    const env = { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' };
+    expect(resolveDeploymentSkillDirectory({ projectRoot: root, env })).toEqual({
+      directory: path.join(root, 'config', 'skills'),
+      explicitlyConfigured: true,
+    });
+  });
+});
+
+describe('loadDeploymentSkillsFromDirectory', () => {
+  it('treats a missing default directory as an empty deployment catalog', async () => {
+    const root = await makeTempRoot();
+    const registry = await loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), {
+      projectRoot: root,
+    });
+    expect(registry.list()).toEqual([]);
+  });
+
+  it('fails startup validation when an explicitly configured directory is missing', async () => {
+    const root = await makeTempRoot();
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'missing-skills'), {
+        projectRoot: root,
+        explicitlyConfigured: true,
+      }),
+    ).rejects.toThrow(/Deployment skills directory not found/);
+  });
+
+  it('loads bundled skills and their files without touching the DB', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, { name: 'analysis-kit', alwaysApply: true });
+
+    const registry = await loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), {
+      projectRoot: root,
+    });
+    const [skill] = registry.list();
+
+    expect(skill).toMatchObject({
+      name: 'analysis-kit',
+      description: DESCRIPTION,
+      source: 'deployment',
+      deployment: true,
+      isPublic: true,
+      alwaysApply: true,
+      allowedTools: ['execute_code'],
+      disableModelInvocation: true,
+      userInvocable: false,
+      authorName: 'Deployment',
+      sourceMetadata: { deployment: true, directory: 'skill/analysis-kit' },
+    });
+    expect(skill.fileCount).toBe(2);
+    expect(skill.files.map((file) => [file.relativePath, file.category])).toEqual([
+      ['assets/pixel.bin', 'asset'],
+      ['references/guide.txt', 'reference'],
+    ]);
+    expect(skill.files.find((file) => file.relativePath === 'references/guide.txt')).toMatchObject({
+      source: 'deployment',
+      content: 'reference notes',
+      isBinary: false,
+      mimeType: 'text/plain',
+    });
+    expect(skill.files.find((file) => file.relativePath === 'assets/pixel.bin')).toMatchObject({
+      isBinary: true,
+    });
+  });
+
+  it('validates SKILL.md frontmatter at startup', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      name: 'bad-frontmatter',
+      frontmatter: [
+        '---',
+        'name: bad-frontmatter',
+        `description: ${DESCRIPTION}`,
+        'unknown-key: nope',
+        '---',
+        '',
+        'Body',
+      ].join('\n'),
+    });
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/frontmatter\.unknown-key/);
+  });
+
+  it('validates bundled file paths at startup', async () => {
+    const root = await makeTempRoot();
+    const skillDir = await writeDeploymentSkill(root, { name: 'bad-path' });
+    await fs.promises.writeFile(path.join(skillDir, 'references', 'bad path.txt'), 'bad');
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/relativePath: Relative path contains invalid characters/);
+  });
+
+  it('rejects duplicate deployment skill names', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, { folder: 'one', name: 'duplicate-name' });
+    await writeDeploymentSkill(root, { folder: 'two', name: 'duplicate-name' });
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/Duplicate deployment skill name "duplicate-name"/);
+  });
+});
+
+describe('createDeploymentSkillMethods', () => {
+  it('merges deployment skills into read paths while stripping them from DB calls', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: true,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const deploymentId = getDeploymentSkillIds()[0];
+    const dbId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const dbSkill = {
+      _id: dbId,
+      name: 'db-skill',
+      description: 'A persisted skill.',
+      body: 'persisted body',
+      author: dbAuthor,
+      version: 3,
+      fileCount: 0,
+      updatedAt: new Date(0),
+    };
+    const base: DeploymentSkillBaseMethods = {
+      getSkillById: jest.fn(async (id) => (id.toString() === dbId.toString() ? dbSkill : null)),
+      getSkillByName: jest.fn(async (name) => (name === dbSkill.name ? dbSkill : null)),
+      listSkillsByAccess: jest.fn(async () => ({
+        skills: [dbSkill],
+        has_more: false,
+        after: null,
+      })),
+      listAlwaysApplySkills: jest.fn(async () => ({
+        skills: [{ _id: dbId, name: 'db-always', body: 'db always', author: dbAuthor }],
+        has_more: false,
+        after: null,
+      })),
+      listSkillFiles: jest.fn(async () => []),
+      getSkillFileByPath: jest.fn(async () => null),
+      updateSkillFileContent: jest.fn(async () => undefined),
+      updateSkillFileCodeEnvIds: jest.fn(async (updates) => ({
+        matchedCount: updates.length,
+        modifiedCount: updates.length,
+      })),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId]);
+
+    expect(mergedIds.map((id) => id.toString())).toEqual([
+      dbId.toString(),
+      deploymentId.toString(),
+    ]);
+
+    const deploymentSkill = await methods.getSkillById(deploymentId);
+    expect(deploymentSkill).toMatchObject({ name: 'analysis-kit', source: 'deployment' });
+    expect(base.getSkillById).not.toHaveBeenCalled();
+
+    const listed = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(listed?.skills.map((skill) => skill.name).sort()).toEqual(['analysis-kit', 'db-skill']);
+    expect(base.listSkillsByAccess).toHaveBeenCalledWith({
+      accessibleIds: [dbId],
+      limit: 10,
+    });
+
+    const alwaysApply = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(alwaysApply?.skills.map((skill) => skill.name).sort()).toEqual([
+      'analysis-kit',
+      'db-always',
+    ]);
+    expect(base.listAlwaysApplySkills).toHaveBeenCalledWith({
+      accessibleIds: [dbId],
+      limit: 10,
+    });
+
+    const files = await methods.listSkillFiles?.(deploymentId);
+    expect(files?.map((file) => file.relativePath).sort()).toEqual([
+      'assets/pixel.bin',
+      'references/guide.txt',
+    ]);
+    const guideFile = files?.find((file) => file.relativePath === 'references/guide.txt');
+    expect(guideFile?._id).toBeInstanceOf(Types.ObjectId);
+    expect(guideFile?.skillId.toString()).toBe(deploymentId.toString());
+    expect(guideFile).toMatchObject({
+      file_id: expect.any(String),
+      filename: 'guide.txt',
+      source: 'deployment',
+      mimeType: 'text/plain',
+      bytes: 'reference notes'.length,
+      category: 'reference',
+      isExecutable: false,
+      author: expect.any(Types.ObjectId),
+    });
+    expect(guideFile?.createdAt.getTime()).toEqual(expect.any(Number));
+    expect(guideFile?.updatedAt.getTime()).toEqual(expect.any(Number));
+    expect(guideFile).not.toHaveProperty('content');
+    expect(base.listSkillFiles).not.toHaveBeenCalled();
+
+    await methods.updateSkillFileContent?.(deploymentId, 'references/guide.txt', {
+      content: 'updated content',
+      isBinary: false,
+    });
+    const updatedFile = await methods.getSkillFileByPath?.(deploymentId, 'references/guide.txt');
+    expect(updatedFile?.content).toBe('updated content');
+    expect(base.updateSkillFileContent).not.toHaveBeenCalled();
+
+    const codeEnvRef: CodeEnvRef = {
+      kind: 'skill',
+      id: deploymentId.toString(),
+      version: 1,
+      storage_session_id: 'storage-session',
+      file_id: 'file-id',
+    };
+    const updateResult = await methods.updateSkillFileCodeEnvIds?.([
+      { skillId: deploymentId, relativePath: 'references/guide.txt', codeEnvRef },
+      { skillId: dbId, relativePath: 'references/db.txt', codeEnvRef },
+    ]);
+
+    expect(updateResult).toEqual({ matchedCount: 1, modifiedCount: 1 });
+    expect(base.updateSkillFileCodeEnvIds).toHaveBeenCalledWith([
+      { skillId: dbId, relativePath: 'references/db.txt', codeEnvRef },
+    ]);
+    expect(
+      (await methods.getSkillFileByPath?.(deploymentId, 'references/guide.txt'))?.codeEnvRef,
+    ).toEqual(codeEnvRef);
+  });
+
+  it('lets deployment skills shadow persisted skills with the same name', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: true,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const deploymentId = getDeploymentSkillIds()[0];
+    const dbId = new Types.ObjectId();
+    const otherId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const shadowedSkill = {
+      _id: dbId,
+      name: 'analysis-kit',
+      description: 'A persisted duplicate skill.',
+      body: 'persisted duplicate body',
+      author: dbAuthor,
+      version: 9,
+      fileCount: 0,
+      updatedAt: new Date(Date.now() + 60_000),
+    };
+    const otherSkill = {
+      _id: otherId,
+      name: 'db-skill',
+      description: 'A persisted non-duplicate skill.',
+      body: 'persisted body',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date(0),
+    };
+    const base: DeploymentSkillBaseMethods = {
+      getSkillByName: jest.fn(async (name) => (name === shadowedSkill.name ? shadowedSkill : null)),
+      listSkillsByAccess: jest.fn(async () => ({
+        skills: [shadowedSkill, otherSkill],
+        has_more: false,
+        after: null,
+      })),
+      listAlwaysApplySkills: jest.fn(async () => ({
+        skills: [
+          {
+            _id: dbId,
+            name: shadowedSkill.name,
+            body: shadowedSkill.body,
+            author: dbAuthor,
+            updatedAt: shadowedSkill.updatedAt,
+          },
+          {
+            _id: otherId,
+            name: 'db-always',
+            body: 'db always',
+            author: dbAuthor,
+            updatedAt: otherSkill.updatedAt,
+          },
+        ],
+        has_more: false,
+        after: null,
+      })),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId, otherId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const byName = await methods.getSkillByName?.(shadowedSkill.name, mergedIds, {
+      preferUserInvocable: true,
+    });
+    expect(byName).toMatchObject({
+      _id: deploymentId,
+      name: shadowedSkill.name,
+      source: 'deployment',
+    });
+    expect(base.getSkillByName).not.toHaveBeenCalled();
+
+    const listed = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(listed?.skills.map((skill) => [skill.name, skill._id.toString()]).sort()).toEqual([
+      ['analysis-kit', deploymentId.toString()],
+      ['db-skill', otherId.toString()],
+    ]);
+
+    await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenNthCalledWith(
+      1,
+      expect.stringContaining('persisted list skill row(s) shadowed'),
+    );
+
+    const alwaysApply = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(alwaysApply?.skills.map((skill) => [skill.name, skill._id.toString()]).sort()).toEqual([
+      ['analysis-kit', deploymentId.toString()],
+      ['db-always', otherId.toString()],
+    ]);
+
+    await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(2);
+    expect(warnSpy).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining('persisted always-apply skill row(s) shadowed'),
+    );
+    warnSpy.mockRestore();
+  });
+
+  it('preserves pagination when an always-apply DB page only contains shadowed skills', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: false,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const dbId = new Types.ObjectId();
+    const nextId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const shadowedUpdatedAt = new Date('2026-01-02T00:00:00.000Z');
+    const shadowedSkill = {
+      _id: dbId,
+      name: 'analysis-kit',
+      body: 'persisted duplicate body',
+      author: dbAuthor,
+    };
+    const nextSkill = {
+      _id: nextId,
+      name: 'db-next',
+      body: 'next persisted body',
+      author: dbAuthor,
+    };
+    const shadowedCursor = encodeTestCursor({ _id: dbId, updatedAt: shadowedUpdatedAt });
+    const base: DeploymentSkillBaseMethods = {
+      listAlwaysApplySkills: jest.fn(async (params) => {
+        if (params.cursor) {
+          return {
+            skills: [nextSkill],
+            has_more: false,
+            after: null,
+          };
+        }
+        return {
+          skills: [shadowedSkill],
+          has_more: true,
+          after: shadowedCursor,
+        };
+      }),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId, nextId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const first = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 1,
+    });
+    expect(first?.skills).toEqual([]);
+    expect(first?.has_more).toBe(true);
+    expect(first?.after).toBe(shadowedCursor);
+
+    const second = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 1,
+      cursor: first?.after,
+    });
+    expect(second?.skills.map((skill) => skill.name)).toEqual(['db-next']);
+    expect(second?.has_more).toBe(false);
+    expect(base.listAlwaysApplySkills).toHaveBeenNthCalledWith(2, {
+      accessibleIds: [dbId, nextId],
+      limit: 1,
+      cursor: first?.after,
+    });
+    warnSpy.mockRestore();
+  });
+
+  it('waits to return older deployment rows until the DB page boundary advances', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: false,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const hiddenId = new Types.ObjectId();
+    const visibleId = new Types.ObjectId();
+    const nextId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const hiddenSkill = {
+      _id: hiddenId,
+      name: 'analysis-kit',
+      description: 'A persisted duplicate skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-03T00:00:00.000Z'),
+    };
+    const visibleSkill = {
+      _id: visibleId,
+      name: 'db-visible',
+      description: 'A visible persisted skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-02T00:00:00.000Z'),
+    };
+    const nextSkill = {
+      _id: nextId,
+      name: 'db-next',
+      description: 'The next persisted skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-01T00:00:00.000Z'),
+    };
+    const visibleCursor = encodeTestCursor({
+      _id: visibleId,
+      updatedAt: visibleSkill.updatedAt,
+    });
+    const base: DeploymentSkillBaseMethods = {
+      listSkillsByAccess: jest.fn(async (params) => {
+        if (params.cursor) {
+          return {
+            skills: [nextSkill],
+            has_more: false,
+            after: null,
+          };
+        }
+        return {
+          skills: [hiddenSkill, visibleSkill],
+          has_more: true,
+          after: visibleCursor,
+        };
+      }),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([hiddenId, visibleId, nextId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const first = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 2,
+    });
+    expect(first?.skills.map((skill) => skill.name)).toEqual(['db-visible']);
+    expect(first?.has_more).toBe(true);
+    expect(first?.after).toBe(visibleCursor);
+
+    const second = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 2,
+      cursor: first?.after,
+    });
+    expect(second?.skills.map((skill) => skill.name)).toEqual(['db-next', 'analysis-kit']);
+    expect(second?.has_more).toBe(false);
+    warnSpy.mockRestore();
+  });
+});
diff --git a/packages/api/src/skills/__tests__/import.test.ts b/packages/api/src/skills/__tests__/import.test.ts
index 626edbdb808..55416967d21 100644
--- a/packages/api/src/skills/__tests__/import.test.ts
+++ b/packages/api/src/skills/__tests__/import.test.ts
@@ -67,6 +67,20 @@ function mockZipRequest(buffer: Buffer): ImportRequest {
   } as unknown as ImportRequest;
 }
 
+function mockMarkdownRequest(content: string, originalname = 'bad-frontmatter.md'): ImportRequest {
+  return {
+    user: {
+      id: 'user-1',
+      _id: new Types.ObjectId(),
+      username: 'tester',
+    },
+    file: {
+      originalname,
+      buffer: Buffer.from(content),
+    },
+  } as unknown as ImportRequest;
+}
+
 function importSummary(body: unknown): ImportSummary {
   return (body as { _importSummary: ImportSummary })._importSummary;
 }
@@ -90,6 +104,12 @@ async function zipWithAdditionalFiles(fileCount: number, fileBytes: number): Pro
   return zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
 }
 
+async function zipWithSkillMarkdown(skillMarkdown: string): Promise<Buffer> {
+  const zip = new JSZip();
+  zip.file('SKILL.md', skillMarkdown);
+  return zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
+}
+
 describe('parseFrontmatter', () => {
   it('extracts name + description from a minimal frontmatter block', () => {
     const raw = `---\nname: demo\ndescription: A demo skill.\n---\n\n# Body`;
@@ -101,6 +121,16 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('coerces non-string scalar name and description to strings', () => {
+    const raw = `---\nname: 123\ndescription: 2024\n---\n\n# Body`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: '123',
+      description: '2024',
+      alwaysApply: undefined,
+      invalidBooleans: [],
+    });
+  });
+
   it('extracts always-apply: true', () => {
     const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: true\n---\n\n# Legal body`;
     expect(parseFrontmatter(raw)).toEqual({
@@ -121,6 +151,37 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('extracts alwaysApply: true', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalwaysApply: true\n---\n\n# Legal body`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'legal',
+      description: 'Legal rules.',
+      alwaysApply: true,
+      invalidBooleans: [],
+    });
+  });
+
+  it('lets always-apply win when both spellings are present', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: false\nalwaysApply: true\n---\n\n# Legal body`;
+    expect(parseFrontmatter(raw).alwaysApply).toBe(false);
+  });
+
+  it('ignores invalid alwaysApply alias when canonical always-apply is valid', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: true\nalwaysApply: yes\n---\n\n# Legal body`;
+    const result = parseFrontmatter(raw);
+
+    expect(result.alwaysApply).toBe(true);
+    expect(result.invalidBooleans).toEqual([]);
+  });
+
+  it('ignores invalid alwaysApply alias before a valid canonical always-apply', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalwaysApply: yes\nalways-apply: false\n---\n\n# Legal body`;
+    const result = parseFrontmatter(raw);
+
+    expect(result.alwaysApply).toBe(false);
+    expect(result.invalidBooleans).toEqual([]);
+  });
+
   it('flags non-boolean always-apply values as invalid (no silent drop)', () => {
     const raw = `---\nname: n\ndescription: d\nalways-apply: yes\n---\n\nbody`;
     const result = parseFrontmatter(raw);
@@ -128,6 +189,27 @@ describe('parseFrontmatter', () => {
     expect(result.invalidBooleans).toEqual(['always-apply']);
   });
 
+  it('flags non-boolean alwaysApply values as invalid (no silent drop)', () => {
+    const raw = `---\nname: n\ndescription: d\nalwaysApply: yes\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['alwaysApply']);
+  });
+
+  it('flags legacy YAML boolean aliases as invalid', () => {
+    const raw = `---\nname: n\ndescription: d\nalways-apply: on\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['always-apply']);
+  });
+
+  it.each(['null', '~'])('flags always-apply: %s as invalid', (value) => {
+    const raw = `---\nname: n\ndescription: d\nalways-apply: ${value}\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['always-apply']);
+  });
+
   it('does not flag always-apply when the key is absent', () => {
     const raw = `---\nname: n\ndescription: d\n---\n\nbody`;
     expect(parseFrontmatter(raw).invalidBooleans).toEqual([]);
@@ -164,6 +246,26 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('extracts frontmatter after a BOM and leading blank lines', () => {
+    const raw = `\uFEFF\n\n---\nname: prologue\ndescription: Has leading whitespace.\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'prologue',
+      description: 'Has leading whitespace.',
+      alwaysApply: undefined,
+      invalidBooleans: [],
+    });
+  });
+
+  it('does not treat frontmatter scalar lines that start with --- text as closing fences', () => {
+    const raw = `---\nname: marker\ndescription: 'first\n---not a closing fence\nlast'\nalways-apply: false\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'marker',
+      description: 'first ---not a closing fence last',
+      alwaysApply: false,
+      invalidBooleans: [],
+    });
+  });
+
   it('returns empty fields when frontmatter is unterminated', () => {
     const raw = `---\nname: incomplete\n`;
     expect(parseFrontmatter(raw)).toEqual({
@@ -173,6 +275,18 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('returns empty fields when frontmatter YAML is malformed', () => {
+    const raw = `---\nname: [\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual(
+      expect.objectContaining({
+        name: '',
+        description: '',
+        invalidBooleans: [],
+        parseError: expect.any(String),
+      }),
+    );
+  });
+
   it('ignores always-apply appearing outside the frontmatter block', () => {
     const raw = `---\nname: n\ndescription: d\n---\n\nalways-apply: true (but this is in the body)`;
     const result = parseFrontmatter(raw);
@@ -256,4 +370,49 @@ describe('createImportHandler', () => {
     expect(summary.filesFailed).toBe(3);
     expect(summary.errors).toHaveLength(3);
   });
+
+  it('rejects malformed YAML frontmatter in markdown imports', async () => {
+    const deps = mockImportDeps();
+    const handler = createImportHandler(deps);
+    const res = mockResponse();
+
+    await handler(mockMarkdownRequest('---\nname: [\n---\n\nbody'), res);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.body).toEqual(
+      expect.objectContaining({
+        error: 'Validation failed',
+        issues: expect.arrayContaining([
+          expect.objectContaining({
+            field: 'frontmatter',
+            code: 'INVALID_YAML',
+          }),
+        ]),
+      }),
+    );
+    expect(deps.createSkill).not.toHaveBeenCalled();
+  });
+
+  it('rejects malformed YAML frontmatter in archive imports', async () => {
+    const deps = mockImportDeps();
+    const handler = createImportHandler(deps);
+    const res = mockResponse();
+    const buffer = await zipWithSkillMarkdown('---\nname: [\n---\n\nbody');
+
+    await handler(mockZipRequest(buffer), res);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.body).toEqual(
+      expect.objectContaining({
+        error: 'Validation failed',
+        issues: expect.arrayContaining([
+          expect.objectContaining({
+            field: 'frontmatter',
+            code: 'INVALID_YAML',
+          }),
+        ]),
+      }),
+    );
+    expect(deps.createSkill).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/api/src/skills/deployment.ts b/packages/api/src/skills/deployment.ts
new file mode 100644
index 00000000000..3824fe055ff
--- /dev/null
+++ b/packages/api/src/skills/deployment.ts
@@ -0,0 +1,1073 @@
+import fs from 'fs';
+import path from 'path';
+import yaml from 'js-yaml';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import {
+  logger,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  inferSkillFileCategory,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+} from '@librechat/data-schemas';
+import type { ValidationIssue } from '@librechat/data-schemas';
+import type { CodeEnvRef } from 'librechat-data-provider';
+import { parseFrontmatter, guessMimeType } from './import';
+
+export const DEPLOYMENT_SKILLS_DIR_ENV = 'DEPLOYMENT_SKILLS_DIR';
+export const DEFAULT_DEPLOYMENT_SKILLS_DIR = 'skill';
+export const DEPLOYMENT_SKILL_SOURCE = 'deployment';
+export const DEPLOYMENT_SKILL_FILE_SOURCE = 'deployment';
+
+const SKILL_MD = 'SKILL.md';
+const DEPLOYMENT_AUTHOR_ID = new Types.ObjectId('de9100000000000000000000');
+const MAX_CACHED_TEXT_BYTES = 512 * 1024;
+
+type SkillId = Types.ObjectId | string;
+
+export type DeploymentSkillFile = {
+  _id: Types.ObjectId;
+  skillId: Types.ObjectId;
+  relativePath: string;
+  file_id: string;
+  filename: string;
+  filepath: string;
+  source: typeof DEPLOYMENT_SKILL_FILE_SOURCE;
+  mimeType: string;
+  bytes: number;
+  category: 'script' | 'reference' | 'asset' | 'other';
+  isExecutable: boolean;
+  author: Types.ObjectId;
+  content?: string;
+  isBinary?: boolean;
+  codeEnvRef?: CodeEnvRef;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+export type DeploymentSkill = {
+  _id: Types.ObjectId;
+  name: string;
+  displayTitle?: string;
+  description: string;
+  body: string;
+  frontmatter: Record<string, unknown>;
+  category: string;
+  disableModelInvocation?: boolean;
+  userInvocable?: boolean;
+  allowedTools?: string[];
+  author: Types.ObjectId;
+  authorName: string;
+  version: number;
+  source: typeof DEPLOYMENT_SKILL_SOURCE;
+  sourceMetadata: { deployment: true; directory: string };
+  fileCount: number;
+  alwaysApply: boolean;
+  isPublic: true;
+  deployment: true;
+  files: DeploymentSkillFile[];
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+type SkillLookupOptions = {
+  preferUserInvocable?: boolean;
+  preferModelInvocable?: boolean;
+};
+
+type SkillSummaryRow = {
+  _id: Types.ObjectId;
+  name: string;
+  displayTitle?: string;
+  description: string;
+  category?: string;
+  disableModelInvocation?: boolean;
+  userInvocable?: boolean;
+  allowedTools?: string[];
+  author: Types.ObjectId;
+  authorName?: string;
+  version?: number;
+  source?: string;
+  sourceMetadata?: Record<string, unknown>;
+  fileCount?: number;
+  alwaysApply?: boolean;
+  isPublic?: boolean;
+  tenantId?: string;
+  deployment?: boolean;
+  createdAt?: Date;
+  updatedAt?: Date;
+};
+
+type SkillDetailRow = SkillSummaryRow & {
+  body: string;
+  frontmatter?: Record<string, unknown>;
+  version: number;
+  fileCount: number;
+};
+
+type AlwaysApplySkillRow = {
+  _id: Types.ObjectId;
+  name: string;
+  body: string;
+  author: Types.ObjectId | string;
+  allowedTools?: string[];
+  deployment?: boolean;
+  updatedAt?: Date;
+};
+
+type ListSkillsByAccessParams = {
+  accessibleIds: Types.ObjectId[];
+  category?: string;
+  search?: string;
+  limit: number;
+  cursor?: string | null;
+};
+
+type ListSkillsByAccessResult = {
+  skills: SkillSummaryRow[];
+  has_more?: boolean;
+  after?: string | null;
+};
+
+type ListAlwaysApplyParams = {
+  accessibleIds: Types.ObjectId[];
+  limit: number;
+  cursor?: string | null;
+};
+
+type ListAlwaysApplyResult = {
+  skills: AlwaysApplySkillRow[];
+  has_more?: boolean;
+  after?: string | null;
+};
+
+type SkillFileRow = Omit<DeploymentSkillFile, 'codeEnvRef' | 'content' | 'isBinary'> & {
+  storageKey?: string;
+  storageRegion?: string;
+  tenantId?: string;
+};
+
+type SkillFileContentRow = SkillFileRow & {
+  codeEnvRef?: CodeEnvRef;
+  content?: string;
+  isBinary?: boolean;
+};
+
+export type DeploymentSkillBaseMethods = {
+  getSkillById?: (id: SkillId) => Promise<SkillDetailRow | null>;
+  getSkillByName?: (
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    options?: SkillLookupOptions,
+  ) => Promise<SkillDetailRow | null>;
+  listSkillsByAccess?: (params: ListSkillsByAccessParams) => Promise<ListSkillsByAccessResult>;
+  listAlwaysApplySkills?: (params: ListAlwaysApplyParams) => Promise<ListAlwaysApplyResult>;
+  listSkillFiles?: (skillId: SkillId) => Promise<SkillFileRow[]>;
+  getSkillFileByPath?: (
+    skillId: SkillId,
+    relativePath: string,
+  ) => Promise<SkillFileContentRow | null>;
+  updateSkillFileContent?: (
+    skillId: SkillId,
+    relativePath: string,
+    update: { content?: string; isBinary?: boolean },
+  ) => Promise<void>;
+  updateSkillFileCodeEnvIds?: (
+    updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+  ) => Promise<{ matchedCount: number; modifiedCount: number } | void>;
+};
+
+type Cursor = { updatedAt: Date; _id: Types.ObjectId };
+type CollisionFilterResult<T> = {
+  rows: T[];
+};
+
+type LoadDeploymentSkillsOptions = {
+  projectRoot?: string;
+  env?: NodeJS.ProcessEnv;
+};
+
+type DirectoryResolution = {
+  directory: string;
+  explicitlyConfigured: boolean;
+};
+
+type LoadedSkillDirectory = {
+  directory: string;
+  relativeDirectory: string;
+};
+
+export class DeploymentSkillRegistry {
+  private readonly skillsById = new Map<string, DeploymentSkill>();
+  private readonly skillsByName = new Map<string, DeploymentSkill>();
+  private readonly filesByPath = new Map<string, DeploymentSkillFile>();
+
+  constructor(
+    private readonly directory: string | null,
+    skills: DeploymentSkill[],
+  ) {
+    for (const skill of skills) {
+      this.skillsById.set(skill._id.toString(), skill);
+      this.skillsByName.set(skill.name, skill);
+      for (const file of skill.files) {
+        this.filesByPath.set(file.filepath, file);
+      }
+    }
+  }
+
+  getDirectory(): string | null {
+    return this.directory;
+  }
+
+  list(): DeploymentSkill[] {
+    return Array.from(this.skillsById.values());
+  }
+
+  ids(): Types.ObjectId[] {
+    return this.list().map((skill) => skill._id);
+  }
+
+  hasId(id: SkillId | undefined): boolean {
+    return id != null && this.skillsById.has(id.toString());
+  }
+
+  getById(id: SkillId): DeploymentSkill | null {
+    return this.skillsById.get(id.toString()) ?? null;
+  }
+
+  getByName(
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    _options?: SkillLookupOptions,
+  ): DeploymentSkill | null {
+    const skill = this.skillsByName.get(name);
+    if (!skill) {
+      return null;
+    }
+    if (!hasAccessibleId(accessibleIds, skill._id)) {
+      return null;
+    }
+    return skill;
+  }
+
+  namesByAccess(accessibleIds: Types.ObjectId[]): Set<string> {
+    const accessibleSet = new Set(accessibleIds.map((id) => id.toString()));
+    const names = new Set<string>();
+    for (const skill of this.list()) {
+      if (accessibleSet.has(skill._id.toString())) {
+        names.add(skill.name);
+      }
+    }
+    return names;
+  }
+
+  listByAccess(params: ListSkillsByAccessParams): DeploymentSkill[] {
+    const accessibleSet = new Set(params.accessibleIds.map((id) => id.toString()));
+    const cursor = decodeCursor(params.cursor);
+    const search = params.search?.toLowerCase();
+    return this.list()
+      .filter((skill) => accessibleSet.has(skill._id.toString()))
+      .filter((skill) => !params.category || skill.category === params.category)
+      .filter((skill) => {
+        if (!search) {
+          return true;
+        }
+        return (
+          skill.name.toLowerCase().includes(search) ||
+          skill.description.toLowerCase().includes(search) ||
+          (skill.displayTitle?.toLowerCase().includes(search) ?? false)
+        );
+      })
+      .filter((skill) => isAfterCursor(skill, cursor))
+      .sort(compareBySkillCursor);
+  }
+
+  listAlwaysApply(params: ListAlwaysApplyParams): DeploymentSkill[] {
+    const accessibleSet = new Set(params.accessibleIds.map((id) => id.toString()));
+    const cursor = decodeCursor(params.cursor);
+    return this.list()
+      .filter((skill) => skill.alwaysApply === true)
+      .filter((skill) => accessibleSet.has(skill._id.toString()))
+      .filter((skill) => isAfterCursor(skill, cursor))
+      .sort(compareBySkillCursor);
+  }
+
+  listFiles(skillId: SkillId): DeploymentSkillFile[] | null {
+    const skill = this.getById(skillId);
+    return skill ? [...skill.files] : null;
+  }
+
+  getFileByPath(skillId: SkillId, relativePath: string): DeploymentSkillFile | null {
+    const skill = this.getById(skillId);
+    if (!skill) {
+      return null;
+    }
+    return skill.files.find((file) => file.relativePath === relativePath) ?? null;
+  }
+
+  hasFilePath(filepath: string): boolean {
+    return this.filesByPath.has(filepath);
+  }
+
+  updateFileCodeEnvRefs(
+    updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+  ): Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> {
+    const dbUpdates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> = [];
+    for (const update of updates) {
+      const file = this.getFileByPath(update.skillId, update.relativePath);
+      if (!file) {
+        dbUpdates.push(update);
+        continue;
+      }
+      file.codeEnvRef = update.codeEnvRef;
+    }
+    return dbUpdates;
+  }
+}
+
+let registry = new DeploymentSkillRegistry(null, []);
+const warnedDeploymentNameCollisions = new Set<string>();
+
+export function getDeploymentSkillRegistry(): DeploymentSkillRegistry {
+  return registry;
+}
+
+export function getDeploymentSkillIds(): Types.ObjectId[] {
+  return registry.ids();
+}
+
+export function mergeDeploymentSkillIds(ids: Array<SkillId>): Types.ObjectId[] {
+  const seen = new Set<string>();
+  const merged: Types.ObjectId[] = [];
+  for (const id of [...ids, ...registry.ids()]) {
+    const oid = typeof id === 'string' ? new Types.ObjectId(id) : id;
+    const key = oid.toString();
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    merged.push(oid);
+  }
+  return merged;
+}
+
+export function isDeploymentSkillId(id: SkillId | undefined): boolean {
+  return registry.hasId(id);
+}
+
+export function isDeploymentSkillFileSource(source: unknown): boolean {
+  return source === DEPLOYMENT_SKILL_FILE_SOURCE;
+}
+
+export function getDeploymentSkillById(id: SkillId): DeploymentSkill | null {
+  return registry.getById(id);
+}
+
+export function isDeploymentSkillFilePath(filepath: string): boolean {
+  return registry.hasFilePath(filepath);
+}
+
+export async function getDeploymentSkillDownloadStream(
+  filepath: string,
+): Promise<NodeJS.ReadableStream> {
+  if (!registry.hasFilePath(filepath)) {
+    throw new Error('Deployment skill file is not registered');
+  }
+  return fs.createReadStream(filepath);
+}
+
+export function updateDeploymentSkillFileCodeEnvRefs(
+  updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+): Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> {
+  return registry.updateFileCodeEnvRefs(updates);
+}
+
+export function resolveDeploymentSkillDirectory(
+  options: LoadDeploymentSkillsOptions = {},
+): DirectoryResolution {
+  const env = options.env ?? process.env;
+  const projectRoot = options.projectRoot ?? process.cwd();
+  const configured = env[DEPLOYMENT_SKILLS_DIR_ENV]?.trim();
+  const rawDirectory =
+    configured && configured.length > 0 ? configured : DEFAULT_DEPLOYMENT_SKILLS_DIR;
+  return {
+    directory: path.isAbsolute(rawDirectory)
+      ? rawDirectory
+      : path.resolve(projectRoot, rawDirectory),
+    explicitlyConfigured: configured != null && configured.length > 0,
+  };
+}
+
+export async function initializeDeploymentSkills(
+  options: LoadDeploymentSkillsOptions = {},
+): Promise<DeploymentSkillRegistry> {
+  const resolved = resolveDeploymentSkillDirectory(options);
+  registry = await loadDeploymentSkillsFromDirectory(resolved.directory, {
+    projectRoot: options.projectRoot ?? process.cwd(),
+    explicitlyConfigured: resolved.explicitlyConfigured,
+  });
+  const count = registry.list().length;
+  if (count > 0) {
+    logger.info(
+      `[deploymentSkills] Loaded ${count} deployment skill(s) from ${registry.getDirectory()}`,
+    );
+  } else {
+    logger.debug(`[deploymentSkills] No deployment skills loaded from ${resolved.directory}`);
+  }
+  return registry;
+}
+
+export async function loadDeploymentSkillsFromDirectory(
+  directory: string,
+  options: { projectRoot?: string; explicitlyConfigured?: boolean } = {},
+): Promise<DeploymentSkillRegistry> {
+  let rootStat: fs.Stats;
+  try {
+    rootStat = await fs.promises.stat(directory);
+  } catch (error) {
+    if (
+      (error as NodeJS.ErrnoException).code === 'ENOENT' &&
+      options.explicitlyConfigured !== true
+    ) {
+      return new DeploymentSkillRegistry(directory, []);
+    }
+    throw new Error(`Deployment skills directory not found: ${directory}`);
+  }
+  if (!rootStat.isDirectory()) {
+    throw new Error(`Deployment skills path must be a directory: ${directory}`);
+  }
+
+  const skillDirectories = await findSkillDirectories(directory, options.projectRoot ?? directory);
+  const skills = await Promise.all(
+    skillDirectories.map((skillDirectory) => loadDeploymentSkill(skillDirectory, directory)),
+  );
+  validateUniqueNames(skills);
+  return new DeploymentSkillRegistry(directory, skills.sort(compareBySkillCursor));
+}
+
+export function createDeploymentSkillMethods<T extends DeploymentSkillBaseMethods>(
+  base: T,
+): T & Required<Pick<DeploymentSkillBaseMethods, 'getSkillById'>> {
+  const methods = {
+    ...base,
+    getSkillById: async (id: SkillId): Promise<SkillDetailRow | null> => {
+      const deployment = registry.getById(id);
+      if (deployment) {
+        return toSkillDetailRow(deployment);
+      }
+      return base.getSkillById ? base.getSkillById(id) : null;
+    },
+    getSkillByName: async (
+      name: string,
+      accessibleIds: Types.ObjectId[],
+      options?: SkillLookupOptions,
+    ): Promise<SkillDetailRow | null> => {
+      const deployment = registry.getByName(name, accessibleIds, options);
+      if (deployment) {
+        return toSkillDetailRow(deployment);
+      }
+      const dbSkill = base.getSkillByName
+        ? await base.getSkillByName(name, stripDeploymentIds(accessibleIds), options)
+        : null;
+      return dbSkill;
+    },
+    listSkillsByAccess: async (
+      params: ListSkillsByAccessParams,
+    ): Promise<ListSkillsByAccessResult> => {
+      const dbResult = base.listSkillsByAccess
+        ? await base.listSkillsByAccess({
+            ...params,
+            accessibleIds: stripDeploymentIds(params.accessibleIds),
+          })
+        : { skills: [], has_more: false, after: null };
+      const deploymentNames = registry.namesByAccess(params.accessibleIds);
+      const filteredDb = filterDeploymentNameCollisions(dbResult.skills, deploymentNames, 'list');
+      const dbPageBoundary = getDbPageBoundary(dbResult);
+      const deploymentRows = limitRowsToDbPageBoundary(
+        registry.listByAccess(params).map(toSkillSummaryRow),
+        dbPageBoundary,
+      );
+      return mergeSkillPage({
+        dbResult: {
+          ...dbResult,
+          skills: filteredDb.rows,
+        },
+        dbPageBoundary,
+        deploymentRows,
+        limit: params.limit,
+      });
+    },
+    listAlwaysApplySkills: async (
+      params: ListAlwaysApplyParams,
+    ): Promise<ListAlwaysApplyResult> => {
+      const dbResult = base.listAlwaysApplySkills
+        ? await base.listAlwaysApplySkills({
+            ...params,
+            accessibleIds: stripDeploymentIds(params.accessibleIds),
+          })
+        : { skills: [], has_more: false, after: null };
+      const deploymentNames = registry.namesByAccess(params.accessibleIds);
+      const filteredDb = filterDeploymentNameCollisions(
+        dbResult.skills,
+        deploymentNames,
+        'always-apply',
+      );
+      const dbPageBoundary = getDbPageBoundary(dbResult);
+      return mergeAlwaysApplyPage({
+        dbResult: {
+          ...dbResult,
+          skills: filteredDb.rows,
+        },
+        dbPageBoundary,
+        deploymentRows: limitRowsToDbPageBoundary(
+          registry.listAlwaysApply(params).map(toAlwaysApplyRow),
+          dbPageBoundary,
+        ),
+        limit: params.limit,
+      });
+    },
+    listSkillFiles: async (skillId: SkillId): Promise<SkillFileRow[]> => {
+      const deploymentFiles = registry.listFiles(skillId);
+      if (deploymentFiles) {
+        return deploymentFiles.map(toSkillFileRow);
+      }
+      return base.listSkillFiles ? base.listSkillFiles(skillId) : [];
+    },
+    getSkillFileByPath: async (
+      skillId: SkillId,
+      relativePath: string,
+    ): Promise<SkillFileContentRow | null> => {
+      const deploymentFile = registry.getFileByPath(skillId, relativePath);
+      if (deploymentFile) {
+        return toSkillFileContentRow(deploymentFile);
+      }
+      return base.getSkillFileByPath ? base.getSkillFileByPath(skillId, relativePath) : null;
+    },
+    updateSkillFileContent: async (
+      skillId: SkillId,
+      relativePath: string,
+      update: { content?: string; isBinary?: boolean },
+    ): Promise<void> => {
+      const deploymentFile = registry.getFileByPath(skillId, relativePath);
+      if (deploymentFile) {
+        if (update.content !== undefined) {
+          deploymentFile.content = update.content;
+        }
+        if (update.isBinary !== undefined) {
+          deploymentFile.isBinary = update.isBinary;
+        }
+        return;
+      }
+      if (base.updateSkillFileContent) {
+        await base.updateSkillFileContent(skillId, relativePath, update);
+      }
+    },
+    updateSkillFileCodeEnvIds: async (
+      updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+    ): Promise<{ matchedCount: number; modifiedCount: number } | void> => {
+      const dbUpdates = registry.updateFileCodeEnvRefs(updates);
+      if (dbUpdates.length === 0) {
+        return { matchedCount: updates.length, modifiedCount: updates.length };
+      }
+      return base.updateSkillFileCodeEnvIds
+        ? base.updateSkillFileCodeEnvIds(dbUpdates)
+        : { matchedCount: 0, modifiedCount: 0 };
+    },
+  };
+  return methods as T & Required<Pick<DeploymentSkillBaseMethods, 'getSkillById'>>;
+}
+
+async function findSkillDirectories(
+  directory: string,
+  projectRoot: string,
+): Promise<LoadedSkillDirectory[]> {
+  const directories: LoadedSkillDirectory[] = [];
+  if (await fileExists(path.join(directory, SKILL_MD))) {
+    directories.push({
+      directory,
+      relativeDirectory: relativeToRoot(projectRoot, directory),
+    });
+  }
+
+  const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+  const childDirectories = entries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(directory, entry.name));
+  const childSkillChecks = await Promise.all(
+    childDirectories.map(async (child) =>
+      (await fileExists(path.join(child, SKILL_MD)))
+        ? {
+            directory: child,
+            relativeDirectory: relativeToRoot(projectRoot, child),
+          }
+        : null,
+    ),
+  );
+  for (const child of childSkillChecks) {
+    if (child) {
+      directories.push(child);
+    }
+  }
+  return directories;
+}
+
+async function loadDeploymentSkill(
+  skillDirectory: LoadedSkillDirectory,
+  rootDirectory: string,
+): Promise<DeploymentSkill> {
+  const skillMdPath = path.join(skillDirectory.directory, SKILL_MD);
+  const [content, stat] = await Promise.all([
+    fs.promises.readFile(skillMdPath, 'utf8'),
+    fs.promises.stat(skillMdPath),
+  ]);
+  const parsed = parseFrontmatter(content);
+  const structured = parseStructuredFrontmatter(content);
+  if ('error' in structured) {
+    throw new Error(`${skillDirectory.relativeDirectory}/${SKILL_MD}: ${structured.error}`);
+  }
+  const frontmatter = structured.frontmatter ?? {};
+  const description =
+    typeof frontmatter.description === 'string' ? frontmatter.description : parsed.description;
+  const name = typeof frontmatter.name === 'string' ? frontmatter.name : parsed.name;
+  const issues: ValidationIssue[] = [
+    ...validateSkillName(name),
+    ...validateSkillDescription(description),
+    ...validateSkillBody(content),
+    ...validateSkillFrontmatter(frontmatter),
+  ];
+  if (parsed.invalidBooleans.length > 0) {
+    issues.push(
+      ...parsed.invalidBooleans.map((key) => ({
+        field: `frontmatter.${key}`,
+        code: 'INVALID_TYPE',
+        message: `"${key}" must be a boolean (true or false)`,
+      })),
+    );
+  }
+  const { errors, warnings } = partitionIssues(issues);
+  if (errors.length > 0) {
+    throw new Error(
+      `${skillDirectory.relativeDirectory}/${SKILL_MD}: ${errors
+        .map((issue) => `${issue.field}: ${issue.message}`)
+        .join('; ')}`,
+    );
+  }
+  if (warnings.length > 0) {
+    logger.warn(
+      `[deploymentSkills] ${skillDirectory.relativeDirectory}/${SKILL_MD}: ${warnings
+        .map((issue) => `${issue.field}: ${issue.message}`)
+        .join('; ')}`,
+    );
+  }
+
+  const derived = deriveStructuredFrontmatterFields(frontmatter);
+  const skillId = stableObjectId(`deployment-skill:${name}`);
+  const files = await loadDeploymentSkillFiles({
+    skillId,
+    skillName: name,
+    skillDirectory: skillDirectory.directory,
+    rootDirectory,
+  });
+  return {
+    _id: skillId,
+    name,
+    description,
+    body: content,
+    frontmatter,
+    category: '',
+    author: DEPLOYMENT_AUTHOR_ID,
+    authorName: 'Deployment',
+    version: 1,
+    source: DEPLOYMENT_SKILL_SOURCE,
+    sourceMetadata: {
+      deployment: true,
+      directory: skillDirectory.relativeDirectory,
+    },
+    fileCount: files.length,
+    alwaysApply: parsed.alwaysApply ?? false,
+    isPublic: true,
+    deployment: true,
+    files,
+    createdAt: stat.birthtime,
+    updatedAt: stat.mtime,
+    ...derived,
+  };
+}
+
+async function loadDeploymentSkillFiles({
+  skillId,
+  skillName,
+  skillDirectory,
+  rootDirectory,
+}: {
+  skillId: Types.ObjectId;
+  skillName: string;
+  skillDirectory: string;
+  rootDirectory: string;
+}): Promise<DeploymentSkillFile[]> {
+  const files = await collectSkillFiles(skillDirectory, skillDirectory);
+  const rows = await Promise.all(
+    files.map(async (filePath) => {
+      const relativePath = normalizePath(path.relative(skillDirectory, filePath));
+      const issues = validateRelativePath(relativePath);
+      if (issues.length > 0) {
+        throw new Error(
+          `${relativeToRoot(rootDirectory, filePath)}: ${issues
+            .map((issue) => `${issue.field}: ${issue.message}`)
+            .join('; ')}`,
+        );
+      }
+      const stat = await fs.promises.stat(filePath);
+      const mimeType = guessMimeType(relativePath);
+      const cache = await readCachedFileContent(filePath, stat.size);
+      return {
+        _id: stableObjectId(`deployment-skill-file:${skillName}:${relativePath}`),
+        skillId,
+        relativePath,
+        file_id: stableObjectId(`deployment-skill-file-id:${skillName}:${relativePath}`).toString(),
+        filename: path.basename(relativePath),
+        filepath: filePath,
+        source: DEPLOYMENT_SKILL_FILE_SOURCE,
+        mimeType,
+        bytes: stat.size,
+        category: inferSkillFileCategory(relativePath),
+        isExecutable: false,
+        author: DEPLOYMENT_AUTHOR_ID,
+        createdAt: stat.birthtime,
+        updatedAt: stat.mtime,
+        ...cache,
+      } satisfies DeploymentSkillFile;
+    }),
+  );
+  return rows.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+
+async function collectSkillFiles(root: string, directory: string): Promise<string[]> {
+  const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+  const results = await Promise.all(
+    entries.map(async (entry) => {
+      const filePath = path.join(directory, entry.name);
+      const relativePath = normalizePath(path.relative(root, filePath));
+      if (relativePath === SKILL_MD) {
+        return [];
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error(`${relativePath}: symlinks are not allowed in deployment skills`);
+      }
+      if (entry.isDirectory()) {
+        return collectSkillFiles(root, filePath);
+      }
+      if (!entry.isFile()) {
+        return [];
+      }
+      return [filePath];
+    }),
+  );
+  return results.flat();
+}
+
+async function readCachedFileContent(
+  filePath: string,
+  bytes: number,
+): Promise<Pick<DeploymentSkillFile, 'content' | 'isBinary'>> {
+  const file = await fs.promises.open(filePath, 'r');
+  try {
+    const probe = Buffer.alloc(Math.min(bytes, 8192));
+    if (probe.length > 0) {
+      await file.read(probe, 0, probe.length, 0);
+    }
+    if (probe.includes(0)) {
+      return { isBinary: true };
+    }
+  } finally {
+    await file.close();
+  }
+  if (bytes > MAX_CACHED_TEXT_BYTES) {
+    return { isBinary: false };
+  }
+  return {
+    isBinary: false,
+    content: await fs.promises.readFile(filePath, 'utf8'),
+  };
+}
+
+function parseStructuredFrontmatter(
+  content: string,
+): { frontmatter?: Record<string, unknown>; error?: undefined } | { error: string } {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith('---')) {
+    return { frontmatter: {} };
+  }
+  const after = trimmed.slice(3);
+  const closingIdx = after.indexOf('\n---');
+  if (closingIdx === -1) {
+    return { error: `Invalid ${SKILL_MD} frontmatter: missing closing "---".` };
+  }
+  try {
+    const parsed = yaml.load(after.slice(0, closingIdx));
+    if (parsed == null) {
+      return { frontmatter: {} };
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return { error: `${SKILL_MD} frontmatter must be a YAML mapping.` };
+    }
+    return { frontmatter: parsed as Record<string, unknown> };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { error: `Invalid ${SKILL_MD} frontmatter: ${message}` };
+  }
+}
+
+function validateUniqueNames(skills: DeploymentSkill[]): void {
+  const seen = new Set<string>();
+  for (const skill of skills) {
+    if (seen.has(skill.name)) {
+      throw new Error(`Duplicate deployment skill name "${skill.name}"`);
+    }
+    seen.add(skill.name);
+  }
+}
+
+function mergeSkillPage({
+  dbResult,
+  dbPageBoundary,
+  deploymentRows,
+  limit,
+}: {
+  dbResult: ListSkillsByAccessResult;
+  dbPageBoundary?: Cursor | null;
+  deploymentRows: SkillSummaryRow[];
+  limit: number;
+}): ListSkillsByAccessResult {
+  const boundedLimit = Math.min(Math.max(1, limit || 20), 100);
+  const merged = [...deploymentRows, ...dbResult.skills].sort(compareBySkillCursor);
+  const sliced = merged.slice(0, boundedLimit);
+  const hasMore = merged.length > boundedLimit || dbResult.has_more === true;
+  const cursorRow = getMergedPageCursor(sliced, boundedLimit, dbPageBoundary);
+  return {
+    skills: sliced,
+    has_more: hasMore,
+    after: hasMore && cursorRow ? encodeCursor(cursorRow) : null,
+  };
+}
+
+function mergeAlwaysApplyPage({
+  dbResult,
+  dbPageBoundary,
+  deploymentRows,
+  limit,
+}: {
+  dbResult: ListAlwaysApplyResult;
+  dbPageBoundary?: Cursor | null;
+  deploymentRows: AlwaysApplySkillRow[];
+  limit: number;
+}): ListAlwaysApplyResult {
+  const boundedLimit = Math.min(Math.max(1, limit || 20), 100);
+  const merged = [...deploymentRows, ...dbResult.skills].sort(compareBySkillCursor);
+  const sliced = merged.slice(0, boundedLimit);
+  const hasMore = merged.length > boundedLimit || dbResult.has_more === true;
+  const cursorRow = getMergedPageCursor(sliced, boundedLimit, dbPageBoundary);
+  return {
+    skills: sliced,
+    has_more: hasMore,
+    after: hasMore && cursorRow ? encodeCursor(cursorRow) : null,
+  };
+}
+
+function getMergedPageCursor<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(
+  sliced: T[],
+  boundedLimit: number,
+  dbPageBoundary?: Cursor | null,
+): Pick<SkillSummaryRow, '_id' | 'updatedAt'> | null {
+  const lastReturned = sliced.length > 0 ? sliced[sliced.length - 1] : null;
+  if (sliced.length < boundedLimit && dbPageBoundary) {
+    return dbPageBoundary;
+  }
+  return lastReturned;
+}
+
+function getDbPageBoundary<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(dbResult: {
+  skills: T[];
+  has_more?: boolean;
+  after?: string | null;
+}): Cursor | null {
+  if (dbResult.has_more !== true) {
+    return null;
+  }
+  const last = dbResult.skills.length > 0 ? dbResult.skills[dbResult.skills.length - 1] : null;
+  if (last?.updatedAt) {
+    return { _id: last._id, updatedAt: last.updatedAt };
+  }
+  return decodeCursor(dbResult.after);
+}
+
+function limitRowsToDbPageBoundary<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(
+  rows: T[],
+  dbPageBoundary: Cursor | null,
+): T[] {
+  if (!dbPageBoundary) {
+    return rows;
+  }
+  return rows.filter((row) => compareBySkillCursor(row, dbPageBoundary) <= 0);
+}
+
+function toSkillSummaryRow(skill: DeploymentSkill): SkillSummaryRow {
+  const { body: _body, frontmatter: _frontmatter, files: _files, ...row } = skill;
+  return row;
+}
+
+function toSkillDetailRow(skill: DeploymentSkill): SkillDetailRow {
+  const { files: _files, ...row } = skill;
+  return row;
+}
+
+function toAlwaysApplyRow(skill: DeploymentSkill): AlwaysApplySkillRow {
+  return {
+    _id: skill._id,
+    name: skill.name,
+    body: skill.body,
+    author: skill.author,
+    deployment: true,
+    updatedAt: skill.updatedAt,
+    ...(skill.allowedTools !== undefined ? { allowedTools: skill.allowedTools } : {}),
+  };
+}
+
+function toSkillFileRow(file: DeploymentSkillFile): SkillFileRow {
+  const { codeEnvRef: _codeEnvRef, content: _content, isBinary: _isBinary, ...row } = file;
+  return row;
+}
+
+function toSkillFileContentRow(file: DeploymentSkillFile): SkillFileContentRow {
+  return {
+    ...toSkillFileRow(file),
+    codeEnvRef: file.codeEnvRef,
+    content: file.content,
+    isBinary: file.isBinary,
+  };
+}
+
+function stripDeploymentIds(ids: Types.ObjectId[]): Types.ObjectId[] {
+  return ids.filter((id) => !registry.hasId(id));
+}
+
+function hasAccessibleId(ids: Types.ObjectId[], skillId: Types.ObjectId): boolean {
+  const key = skillId.toString();
+  return ids.some((id) => id.toString() === key);
+}
+
+function filterDeploymentNameCollisions<
+  T extends { name: string } & Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+>(rows: T[], deploymentNames: Set<string>, context: string): CollisionFilterResult<T> {
+  if (rows.length === 0 || deploymentNames.size === 0) {
+    return { rows };
+  }
+  const hiddenNames = new Set<string>();
+  const filtered = rows.filter((row) => {
+    if (!deploymentNames.has(row.name)) {
+      return true;
+    }
+    hiddenNames.add(row.name);
+    return false;
+  });
+  if (hiddenNames.size > 0) {
+    const unwarnedNames = Array.from(hiddenNames).filter((name) => {
+      const key = `${context}:${name}`;
+      if (warnedDeploymentNameCollisions.has(key)) {
+        return false;
+      }
+      warnedDeploymentNameCollisions.add(key);
+      return true;
+    });
+    if (unwarnedNames.length > 0) {
+      logger.warn(
+        `[deploymentSkills] Hid persisted ${context} skill row(s) shadowed by deployment skill name(s): ${unwarnedNames.join(', ')}`,
+      );
+    }
+  }
+  return { rows: filtered };
+}
+
+function compareBySkillCursor(
+  a: Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+  b: Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+): number {
+  const aTime = (a.updatedAt ?? new Date(0)).getTime();
+  const bTime = (b.updatedAt ?? new Date(0)).getTime();
+  if (aTime !== bTime) {
+    return bTime - aTime;
+  }
+  return a._id.toString().localeCompare(b._id.toString());
+}
+
+function isAfterCursor(row: Pick<SkillSummaryRow, '_id' | 'updatedAt'>, cursor: Cursor | null) {
+  if (!cursor) {
+    return true;
+  }
+  const rowTime = (row.updatedAt ?? new Date(0)).getTime();
+  const cursorTime = cursor.updatedAt.getTime();
+  if (rowTime < cursorTime) {
+    return true;
+  }
+  if (rowTime > cursorTime) {
+    return false;
+  }
+  return row._id.toString() > cursor._id.toString();
+}
+
+function decodeCursor(cursor: string | null | undefined): Cursor | null {
+  if (!cursor || cursor === 'undefined' || cursor === 'null') {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(cursor, 'base64').toString('utf8')) as {
+      updatedAt?: string;
+      _id?: string;
+    };
+    if (!decoded.updatedAt || !decoded._id || !Types.ObjectId.isValid(decoded._id)) {
+      return null;
+    }
+    const updatedAt = new Date(decoded.updatedAt);
+    if (Number.isNaN(updatedAt.getTime())) {
+      return null;
+    }
+    return { updatedAt, _id: new Types.ObjectId(decoded._id) };
+  } catch {
+    return null;
+  }
+}
+
+function encodeCursor(row: Pick<SkillSummaryRow, '_id' | 'updatedAt'>): string {
+  return Buffer.from(
+    JSON.stringify({
+      updatedAt: (row.updatedAt ?? new Date(0)).toISOString(),
+      _id: row._id.toString(),
+    }),
+  ).toString('base64');
+}
+
+function stableObjectId(seed: string): Types.ObjectId {
+  return new Types.ObjectId(crypto.createHash('sha1').update(seed).digest('hex').slice(0, 24));
+}
+
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    const stat = await fs.promises.stat(filePath);
+    return stat.isFile();
+  } catch {
+    return false;
+  }
+}
+
+function normalizePath(value: string): string {
+  return value.split(path.sep).join('/');
+}
+
+function relativeToRoot(root: string, target: string): string {
+  const relative = normalizePath(path.relative(root, target));
+  return relative.length > 0 ? relative : '.';
+}
diff --git a/packages/api/src/skills/handlers.ts b/packages/api/src/skills/handlers.ts
index 41836b66cd2..e2b135c4b0c 100644
--- a/packages/api/src/skills/handlers.ts
+++ b/packages/api/src/skills/handlers.ts
@@ -5,19 +5,6 @@ import {
   PrincipalType,
   PermissionBits,
 } from 'librechat-data-provider';
-import type { Response } from 'express';
-import type { Types } from 'mongoose';
-import type {
-  ISkill,
-  ISkillFile,
-  ISkillSummary,
-  CreateSkillInput,
-  CreateSkillResult,
-  UpdateSkillInput,
-  ListSkillsByAccessResult,
-  UpdateSkillResult,
-  ValidationIssue,
-} from '@librechat/data-schemas';
 import type {
   TSkill,
   TSkillFile,
@@ -31,6 +18,19 @@ import type {
   TSkillConflictResponse,
   TSkillFileContentResponse,
 } from 'librechat-data-provider';
+import type {
+  ISkill,
+  ISkillFile,
+  ISkillSummary,
+  CreateSkillInput,
+  CreateSkillResult,
+  UpdateSkillInput,
+  ListSkillsByAccessResult,
+  UpdateSkillResult,
+  ValidationIssue,
+} from '@librechat/data-schemas';
+import type { Response } from 'express';
+import type { Types } from 'mongoose';
 import type { ServerRequest, StrategyFunctions } from '~/types';
 import { isBinaryBuffer } from './binary';
 
@@ -206,6 +206,7 @@ function serializeSkillFile(file: ISkillFile & { _id: Types.ObjectId }): TSkillF
     storageKey: file.storageKey,
     storageRegion: file.storageRegion,
     source: file.source as TSkillFile['source'],
+    sourceMetadata: file.sourceMetadata as TSkillFile['sourceMetadata'],
     mimeType: file.mimeType,
     bytes: file.bytes,
     category: file.category,
@@ -268,7 +269,16 @@ function parseLimit(raw: unknown): number {
  * deps from `~/models` + `PermissionService`, and wires the returned handlers
  * onto the Express router.
  */
-export function createSkillsHandlers(deps: SkillsHandlersDeps) {
+export function createSkillsHandlers(deps: SkillsHandlersDeps): {
+  list: (req: ServerRequest, res: Response) => Promise<Response>;
+  create: (req: ServerRequest, res: Response) => Promise<Response>;
+  get: (req: ServerRequest, res: Response) => Promise<Response>;
+  patch: (req: ServerRequest, res: Response) => Promise<Response>;
+  delete: (req: ServerRequest, res: Response) => Promise<Response>;
+  listFiles: (req: ServerRequest, res: Response) => Promise<Response>;
+  downloadFile: (req: ServerRequest, res: Response) => Promise<Response | undefined>;
+  deleteFile: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     createSkill,
     getSkillById,
diff --git a/packages/api/src/skills/import.ts b/packages/api/src/skills/import.ts
index 013a0219332..c93b0215938 100644
--- a/packages/api/src/skills/import.ts
+++ b/packages/api/src/skills/import.ts
@@ -1,10 +1,8 @@
-import crypto from 'crypto';
 import path from 'path';
 import JSZip from 'jszip';
+import crypto from 'crypto';
+import { logger } from '@librechat/data-schemas';
 import { ResourceType, AccessRoleIds, PrincipalType } from 'librechat-data-provider';
-import { logger, stripYamlTrailingComment } from '@librechat/data-schemas';
-import type { Request, Response } from 'express';
-import type { Types } from 'mongoose';
 import type {
   ISkill,
   ISkillFile,
@@ -12,50 +10,16 @@ import type {
   CreateSkillResult,
   UpsertSkillFileInput,
 } from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+import type { Types } from 'mongoose';
+import type { ImportLimits } from './limits';
 import { resolveRequestTenantId } from '~/middleware/tenant';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from './limits';
+import { parseSkillMarkdown } from './parse';
 
-/** Security limits for zip processing. */
-const MAX_ZIP_BYTES = 50 * 1024 * 1024; // 50 MB compressed
-const MAX_DECOMPRESSED_BYTES = 500 * 1024 * 1024; // 500 MB total decompressed
-const MAX_ENTRIES = 500;
-const MAX_SINGLE_FILE_BYTES = 10 * 1024 * 1024; // 10 MB per file
 const SKILL_MD = 'SKILL.md';
 
-export interface ImportLimits {
-  maxZipBytes: number;
-  maxDecompressedBytes: number;
-  maxEntries: number;
-  maxSingleFileBytes: number;
-}
-
-/** Strip surrounding YAML quotes (single or double) from a scalar value. */
-function unquoteYaml(value: string): string {
-  if (
-    value.length >= 2 &&
-    ((value[0] === '"' && value[value.length - 1] === '"') ||
-      (value[0] === "'" && value[value.length - 1] === "'"))
-  ) {
-    return value.slice(1, -1);
-  }
-  return value;
-}
-
-/**
- * Parse a YAML scalar as a strict boolean. Returns `undefined` when the
- * value is neither `true` nor `false`. Callers should pre-strip inline
- * comments with `stripYamlTrailingComment` when needed; this helper only
- * normalizes case / whitespace so the call site stays one-purpose.
- */
-function parseBooleanScalar(value: string): boolean | undefined {
-  const lowered = value.trim().toLowerCase();
-  if (lowered === 'true') {
-    return true;
-  }
-  if (lowered === 'false') {
-    return false;
-  }
-  return undefined;
-}
+export type { ImportLimits } from './limits';
 
 /**
  * YAML frontmatter parser — extracts the first-class fields LibreChat
@@ -64,11 +28,12 @@ function parseBooleanScalar(value: string): boolean | undefined {
  * `packages/data-schemas/src/methods/skill.ts` covers the wire contract;
  * this parser only needs to hand `createSkill` the columns it populates.
  *
- * When a known boolean field (currently just `always-apply`) is present
+ * When a known boolean field (currently `always-apply` plus the accepted
+ * `alwaysApply` alias) is present
  * with a value that isn't recognizable as `true`/`false`, the parser
  * records it on `invalidBooleans[]` so the import handler can surface
  * a 400 instead of silently dropping the flag. Without this signal,
- * authoring mistakes like `always-apply: yes` would be lossy-converted
+ * authoring mistakes like `alwaysApply: yes` would be lossy-converted
  * to "not always-applied" and the user would never learn their
  * frontmatter was malformed.
  *
@@ -80,55 +45,40 @@ export function parseFrontmatter(raw: string): {
   alwaysApply?: boolean;
   /** Keys that carried non-boolean values for fields that must be boolean. */
   invalidBooleans: string[];
+  parseError?: string;
 } {
-  const trimmed = raw.trim();
-  if (!trimmed.startsWith('---')) {
-    return { name: '', description: '', invalidBooleans: [] };
+  const parsed = parseSkillMarkdown(raw);
+  const result: {
+    name: string;
+    description: string;
+    alwaysApply?: boolean;
+    invalidBooleans: string[];
+    parseError?: string;
+  } = {
+    name: parsed.name,
+    description: parsed.description,
+    invalidBooleans: parsed.invalidBooleans,
+  };
+  if (parsed.parseError) {
+    result.parseError = parsed.parseError;
   }
-  const after = trimmed.slice(3);
-  const closingIdx = after.indexOf('\n---');
-  if (closingIdx === -1) {
-    return { name: '', description: '', invalidBooleans: [] };
+  if ('alwaysApply' in parsed) {
+    result.alwaysApply = parsed.alwaysApply;
   }
-  const block = after.slice(0, closingIdx);
-  let name = '';
-  let description = '';
-  let alwaysApply: boolean | undefined;
-  const invalidBooleans: string[] = [];
-  for (const line of block.split('\n')) {
-    const colon = line.indexOf(':');
-    if (colon === -1) {
-      continue;
-    }
-    const key = line.slice(0, colon).trim().toLowerCase();
-    const rawValue = line.slice(colon + 1).trim();
-    if (key === 'name') {
-      name = unquoteYaml(rawValue);
-    } else if (key === 'description') {
-      description = unquoteYaml(rawValue);
-    } else if (key === 'always-apply') {
-      // Operate on the raw post-colon text (no outer `unquoteYaml`): a
-      // line like `always-apply: "true" # note` must have its comment
-      // stripped BEFORE unquoting. Running `unquoteYaml` on the whole
-      // line first would miss the quoted branch (the line doesn't end
-      // in a quote once the comment is attached), and unquoting twice
-      // would be fragile if `unquoteYaml` ever gains richer YAML-escape
-      // handling.
-      const stripped = stripYamlTrailingComment(rawValue).trim();
-      if (stripped === '') {
-        // Empty value or comment-only (`always-apply: # TBD`) — treat as
-        // absent so mid-edit placeholder states don't reject the save.
-        continue;
-      }
-      const parsed = parseBooleanScalar(unquoteYaml(stripped));
-      if (parsed === undefined) {
-        invalidBooleans.push(key);
-      } else {
-        alwaysApply = parsed;
-      }
-    }
-  }
-  return { name, description, alwaysApply, invalidBooleans };
+  return result;
+}
+
+function sendFrontmatterParseError(res: Response, parseError: string) {
+  return res.status(400).json({
+    error: 'Validation failed',
+    issues: [
+      {
+        field: 'frontmatter',
+        code: 'INVALID_YAML',
+        message: `Invalid YAML frontmatter: ${parseError}`,
+      },
+    ],
+  });
 }
 
 /** Validates a relative path is safe (no traversal, no absolute paths). */
@@ -214,7 +164,7 @@ interface ServerRequest extends Request {
  * Grants SKILL_OWNER to the uploader.
  */
 export function createImportHandler(deps: ImportSkillDeps) {
-  return async function importSkillHandler(req: ServerRequest, res: Response) {
+  return async function importSkillHandler(req: ServerRequest, res: Response): Promise<Response> {
     const { file } = req;
     if (!file) {
       return res.status(400).json({ error: 'No file provided' });
@@ -250,10 +200,12 @@ export function createImportHandler(deps: ImportSkillDeps) {
 
 function getImportLimits(limits?: Partial<ImportLimits>): ImportLimits {
   return {
-    maxZipBytes: limits?.maxZipBytes ?? MAX_ZIP_BYTES,
-    maxDecompressedBytes: limits?.maxDecompressedBytes ?? MAX_DECOMPRESSED_BYTES,
-    maxEntries: limits?.maxEntries ?? MAX_ENTRIES,
-    maxSingleFileBytes: limits?.maxSingleFileBytes ?? MAX_SINGLE_FILE_BYTES,
+    maxZipBytes: limits?.maxZipBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxZipBytes,
+    maxDecompressedBytes:
+      limits?.maxDecompressedBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes,
+    maxEntries: limits?.maxEntries ?? DEFAULT_SKILL_IMPORT_LIMITS.maxEntries,
+    maxSingleFileBytes:
+      limits?.maxSingleFileBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
   };
 }
 
@@ -308,7 +260,10 @@ async function handleMarkdown(
 ) {
   const content = file.buffer.toString('utf-8');
 
-  const { name, description, alwaysApply, invalidBooleans } = parseFrontmatter(content);
+  const { name, description, alwaysApply, invalidBooleans, parseError } = parseFrontmatter(content);
+  if (parseError) {
+    return sendFrontmatterParseError(res, parseError);
+  }
   if (invalidBooleans.length > 0) {
     return res.status(400).json({
       error: 'Validation failed',
@@ -419,7 +374,11 @@ async function handleZip(
     return res.status(400).json({ error: 'SKILL.md exceeds maximum file size' });
   }
 
-  const { name, description, alwaysApply, invalidBooleans } = parseFrontmatter(skillMdContent);
+  const { name, description, alwaysApply, invalidBooleans, parseError } =
+    parseFrontmatter(skillMdContent);
+  if (parseError) {
+    return sendFrontmatterParseError(res, parseError);
+  }
   if (invalidBooleans.length > 0) {
     return res.status(400).json({
       error: 'Validation failed',
@@ -662,6 +621,6 @@ const MIME_MAP: Record<string, string> = {
   '.pdf': 'application/pdf',
 };
 
-function guessMimeType(filename: string): string {
+export function guessMimeType(filename: string): string {
   return MIME_MAP[path.extname(filename).toLowerCase()] || 'application/octet-stream';
 }
diff --git a/packages/api/src/skills/index.ts b/packages/api/src/skills/index.ts
index 5d32c38cbe0..5669d6586bd 100644
--- a/packages/api/src/skills/index.ts
+++ b/packages/api/src/skills/index.ts
@@ -1,4 +1,8 @@
 export * from './binary';
 export * from './handlers';
 export * from './import';
+export * from './limits';
+export * from './parse';
 export * from './skillStates';
+export * from './deployment';
+export * from './sync';
diff --git a/packages/api/src/skills/limits.ts b/packages/api/src/skills/limits.ts
new file mode 100644
index 00000000000..0d7624485a1
--- /dev/null
+++ b/packages/api/src/skills/limits.ts
@@ -0,0 +1,13 @@
+export type ImportLimits = {
+  maxZipBytes: number;
+  maxDecompressedBytes: number;
+  maxEntries: number;
+  maxSingleFileBytes: number;
+};
+
+export const DEFAULT_SKILL_IMPORT_LIMITS: ImportLimits = {
+  maxZipBytes: 50 * 1024 * 1024,
+  maxDecompressedBytes: 500 * 1024 * 1024,
+  maxEntries: 500,
+  maxSingleFileBytes: 10 * 1024 * 1024,
+};
diff --git a/packages/api/src/skills/parse.ts b/packages/api/src/skills/parse.ts
new file mode 100644
index 00000000000..041e87ed5e3
--- /dev/null
+++ b/packages/api/src/skills/parse.ts
@@ -0,0 +1,160 @@
+import yaml from 'js-yaml';
+
+export type ParsedSkillMarkdown = {
+  name: string;
+  description: string;
+  alwaysApply?: boolean;
+  frontmatter?: Record<string, unknown>;
+  invalidBooleans: string[];
+  parseError?: string;
+};
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function extractFrontmatterBlock(raw: string): string | null {
+  const normalized = raw.replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
+  const firstContentIndex = normalized.search(/\S/);
+  if (firstContentIndex === -1) {
+    return null;
+  }
+  const content = normalized.slice(firstContentIndex);
+  const opening = /^---[ \t]*\n/.exec(content);
+  if (!opening) {
+    return null;
+  }
+  const body = content.slice(opening[0].length);
+  const closingFence = /(?:^|\n)---[ \t]*(?:\n|$)/.exec(body);
+  if (!closingFence) {
+    return null;
+  }
+  return body.slice(0, closingFence.index);
+}
+
+function getCaseInsensitive(frontmatter: Record<string, unknown>, key: string): unknown {
+  const entry = Object.entries(frontmatter).find(([candidate]) => candidate.toLowerCase() === key);
+  return entry?.[1];
+}
+
+function hasCaseInsensitive(frontmatter: Record<string, unknown>, key: string): boolean {
+  return Object.keys(frontmatter).some((candidate) => candidate.toLowerCase() === key);
+}
+
+function getRawFrontmatterValue(block: string, key: string): string | undefined {
+  const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const pattern = new RegExp(`^\\s*${escapedKey}\\s*:\\s*(.*)$`, 'i');
+  const line = block.split('\n').find((candidate) => pattern.test(candidate));
+  const match = line?.match(pattern);
+  return match?.[1];
+}
+
+function stripInlineComment(value: string): string {
+  let quote: '"' | "'" | null = null;
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if ((char === '"' || char === "'") && (!quote || quote === char)) {
+      quote = quote ? null : char;
+      continue;
+    }
+    if (char === '#' && !quote) {
+      return value.slice(0, i).trim();
+    }
+  }
+  return value.trim();
+}
+
+function normalizeFrontmatterKeys(frontmatter: Record<string, unknown>): Record<string, unknown> {
+  return Object.entries(frontmatter).reduce<Record<string, unknown>>((acc, [key, value]) => {
+    const normalizedKey = key.toLowerCase();
+    acc[normalizedKey === 'alwaysapply' ? 'alwaysApply' : normalizedKey] = value;
+    return acc;
+  }, {});
+}
+
+function parseBoolean(value: unknown, rawValue?: string): boolean | undefined {
+  const raw = rawValue === undefined ? undefined : stripInlineComment(rawValue).toLowerCase();
+  if (typeof value === 'boolean') {
+    return raw === 'true' || raw === 'false' ? value : undefined;
+  }
+  if (typeof value !== 'string') {
+    return undefined;
+  }
+  const lowered = value.trim().toLowerCase();
+  if (lowered === 'true') {
+    return true;
+  }
+  if (lowered === 'false') {
+    return false;
+  }
+  return undefined;
+}
+
+function hasBooleanPlaceholder(rawValue?: string): boolean {
+  return rawValue !== undefined && stripInlineComment(rawValue).length === 0;
+}
+
+function toScalarString(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  return '';
+}
+
+export function parseSkillMarkdown(raw: string): ParsedSkillMarkdown {
+  const block = extractFrontmatterBlock(raw);
+  if (!block) {
+    return { name: '', description: '', invalidBooleans: [] };
+  }
+  let parsed: unknown;
+  try {
+    parsed = yaml.load(block);
+  } catch (error) {
+    return {
+      name: '',
+      description: '',
+      invalidBooleans: [],
+      parseError: error instanceof Error ? error.message : 'Invalid YAML frontmatter',
+    };
+  }
+  const frontmatter = isPlainObject(parsed) ? normalizeFrontmatterKeys(parsed) : {};
+  const nameValue = getCaseInsensitive(frontmatter, 'name');
+  const descriptionValue = getCaseInsensitive(frontmatter, 'description');
+  const whenToUseValue = getCaseInsensitive(frontmatter, 'when-to-use');
+  const hasCanonicalAlwaysApply = hasCaseInsensitive(frontmatter, 'always-apply');
+  const hasAliasAlwaysApply = hasCaseInsensitive(frontmatter, 'alwaysapply');
+  const canonicalAlwaysApplyValue = getCaseInsensitive(frontmatter, 'always-apply');
+  const aliasAlwaysApplyValue = getCaseInsensitive(frontmatter, 'alwaysapply');
+  const rawCanonicalAlwaysApplyValue = getRawFrontmatterValue(block, 'always-apply');
+  const rawAliasAlwaysApplyValue = getRawFrontmatterValue(block, 'alwaysApply');
+  const name = toScalarString(nameValue);
+  let description = '';
+  if (descriptionValue !== undefined) {
+    description = toScalarString(descriptionValue);
+  } else if (whenToUseValue !== undefined) {
+    description = toScalarString(whenToUseValue);
+  }
+  let alwaysApply: boolean | undefined;
+  const invalidBooleans: string[] = [];
+  if (hasCanonicalAlwaysApply) {
+    alwaysApply = parseBoolean(canonicalAlwaysApplyValue, rawCanonicalAlwaysApplyValue);
+    if (alwaysApply === undefined && !hasBooleanPlaceholder(rawCanonicalAlwaysApplyValue)) {
+      invalidBooleans.push('always-apply');
+    }
+  } else if (hasAliasAlwaysApply) {
+    alwaysApply = parseBoolean(aliasAlwaysApplyValue, rawAliasAlwaysApplyValue);
+    if (alwaysApply === undefined && !hasBooleanPlaceholder(rawAliasAlwaysApplyValue)) {
+      invalidBooleans.push('alwaysApply');
+    }
+  }
+  return {
+    name,
+    description,
+    alwaysApply,
+    frontmatter,
+    invalidBooleans,
+  };
+}
diff --git a/packages/api/src/skills/skillStates.ts b/packages/api/src/skills/skillStates.ts
index 902debaced4..f04ecd66982 100644
--- a/packages/api/src/skills/skillStates.ts
+++ b/packages/api/src/skills/skillStates.ts
@@ -9,7 +9,7 @@ export const MAX_KEY_LENGTH = 64;
  * Generous upper bound on raw payload size to reject abusive inputs before
  * we spend cycles validating or querying the DB for orphan cleanup.
  */
-export const MAX_RAW_PAYLOAD = MAX_SKILL_STATES * 2;
+export const MAX_RAW_PAYLOAD: number = MAX_SKILL_STATES * 2;
 
 /** Map of skillId → explicit active state override. */
 export type SkillStatesRecord = Record<string, boolean>;
diff --git a/packages/api/src/skills/sync/github.spec.ts b/packages/api/src/skills/sync/github.spec.ts
new file mode 100644
index 00000000000..d0c8e946a6d
--- /dev/null
+++ b/packages/api/src/skills/sync/github.spec.ts
@@ -0,0 +1,2271 @@
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import { getTenantId } from '@librechat/data-schemas';
+import type {
+  ISkill,
+  ISkillFile,
+  CreateSkillInput,
+  CreateSkillResult,
+  ISkillSyncStatus,
+  SkillSyncStatusInput,
+  UpdateSkillInput,
+  UpdateSkillResult,
+} from '@librechat/data-schemas';
+import type { GitHubSkillSyncDeps } from './github';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from '../limits';
+import { createGitHubSkillSyncRunner } from './github';
+
+function response(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
+  const normalizedHeaders = new Map(
+    Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]),
+  );
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: {
+      get: (key: string) => normalizedHeaders.get(key.toLowerCase()) ?? null,
+    },
+    json: async () => body,
+  } as unknown as Response;
+}
+
+function blob(content: string) {
+  return {
+    sha: 'blob-sha',
+    encoding: 'base64',
+    size: Buffer.byteLength(content),
+    content: Buffer.from(content).toString('base64'),
+  };
+}
+
+function githubFetch(
+  skillMarkdown = '---\nname: research\ndescription: Research things\nalways-apply: true\n---\nBody',
+): typeof fetch {
+  return jest.fn(async (input: RequestInfo | URL) => {
+    const url = input.toString();
+    if (url.includes('/commits/')) {
+      return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+    }
+    if (url.includes('/git/trees/tree-sha')) {
+      return response({
+        sha: 'tree-sha',
+        truncated: false,
+        tree: [
+          {
+            path: 'skills',
+            mode: '040000',
+            type: 'tree',
+            sha: 'skills-tree-sha',
+            url: 'https://api.github.test/tree/skills',
+          },
+        ],
+      });
+    }
+    if (url.includes('/git/trees/skills-tree-sha')) {
+      return response({
+        sha: 'skills-tree-sha',
+        truncated: false,
+        tree: [
+          {
+            path: 'research/SKILL.md',
+            mode: '100644',
+            type: 'blob',
+            sha: 'skill-md-sha',
+            size: Buffer.byteLength(skillMarkdown),
+            url: 'https://api.github.test/blob/skill',
+          },
+          {
+            path: 'research/scripts/run.sh',
+            mode: '100644',
+            type: 'blob',
+            sha: 'file-sha',
+            size: 7,
+            url: 'https://api.github.test/blob/file',
+          },
+        ],
+      });
+    }
+    if (url.includes('/git/blobs/skill-md-sha')) {
+      return response(blob(skillMarkdown));
+    }
+    if (url.includes('/git/blobs/file-sha')) {
+      return response(blob('echo ok'));
+    }
+    return response({ message: 'not found' }, 404);
+  }) as unknown as typeof fetch;
+}
+
+function makeSkill(input: CreateSkillInput): ISkill & { _id: Types.ObjectId } {
+  return {
+    _id: new Types.ObjectId(),
+    name: input.name,
+    description: input.description,
+    body: input.body ?? '',
+    frontmatter: input.frontmatter ?? {},
+    author: input.author,
+    authorName: input.authorName,
+    version: 1,
+    source: input.source ?? 'inline',
+    sourceMetadata: input.sourceMetadata,
+    fileCount: 0,
+    alwaysApply: input.alwaysApply ?? false,
+    tenantId: input.tenantId,
+  };
+}
+
+function makeSkillFile(
+  skill: ISkill & { _id: Types.ObjectId },
+  overrides: Partial<ISkillFile> = {},
+): ISkillFile & { _id: Types.ObjectId } {
+  return {
+    _id: new Types.ObjectId(),
+    skillId: skill._id,
+    relativePath: 'scripts/run.sh',
+    file_id: 'old-file-id',
+    filename: 'run.sh',
+    filepath: '/uploads/old-file-id__run.sh',
+    source: 'local',
+    sourceMetadata: {
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      upstreamId: 'librechat-skills:skills/research',
+      commitSha: 'old-commit-sha',
+      blobSha: 'old-file-sha',
+      path: 'skills/research/scripts/run.sh',
+    },
+    mimeType: 'application/x-sh',
+    bytes: 7,
+    category: 'script',
+    isExecutable: false,
+    author: skill.author,
+    ...overrides,
+  };
+}
+
+function makeSourceAuthorId(sourceId = 'librechat-skills', tenantId?: string): Types.ObjectId {
+  const seed = tenantId ? `github:${sourceId}:${tenantId}` : `github:${sourceId}`;
+  return new Types.ObjectId(crypto.createHash('sha256').update(seed).digest('hex').slice(0, 24));
+}
+
+function createDeps(
+  overrides: Partial<GitHubSkillSyncDeps> = {},
+): GitHubSkillSyncDeps & { statuses: ISkillSyncStatus[] } {
+  const statuses: ISkillSyncStatus[] = [];
+  const deps: GitHubSkillSyncDeps & { statuses: ISkillSyncStatus[] } = {
+    statuses,
+    getConfig: () => ({
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'librechat-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            credentialKey: 'github-skills-prod',
+          },
+        ],
+      },
+    }),
+    getCredentialToken: jest.fn(async () => 'github_pat_secret'),
+    getCredentialSummary: jest.fn(async () => ({
+      provider: 'github' as const,
+      credentialKey: 'github-skills-prod',
+      credentialPresent: true,
+      tokenFingerprint: 'abc123',
+    })),
+    listCredentials: jest.fn(async () => []),
+    listStatuses: jest.fn(async () => statuses),
+    upsertStatus: jest.fn(async (input: SkillSyncStatusInput) => {
+      const status: ISkillSyncStatus = {
+        provider: input.provider,
+        sourceId: input.sourceId,
+        tenantId: input.tenantId,
+        status: input.status,
+        credentialKey: input.credentialKey,
+        owner: input.owner,
+        repo: input.repo,
+        ref: input.ref,
+        paths: input.paths,
+        startedAt: input.startedAt,
+        finishedAt: input.finishedAt,
+        lastSuccessAt: input.status === 'succeeded' ? input.finishedAt : undefined,
+        lastFailureAt: input.status === 'failed' ? input.finishedAt : undefined,
+        errorCode: input.errorCode,
+        errorMessage: input.errorMessage,
+        syncedSkillCount: input.syncedSkillCount ?? 0,
+        syncedFileCount: input.syncedFileCount ?? 0,
+        deletedSkillCount: input.deletedSkillCount ?? 0,
+        deletedFileCount: input.deletedFileCount ?? 0,
+      };
+      statuses.push(status);
+      return status;
+    }),
+    tryAcquireLock: jest.fn(async () => true),
+    refreshLock: jest.fn(async () => true),
+    releaseLock: jest.fn(async () => undefined),
+    createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+      return { skill: makeSkill(input), warnings: [] };
+    }),
+    updateSkill: jest.fn(),
+    getSkillById: jest.fn(),
+    findSkillBySourceIdentity: jest.fn(async () => null),
+    listSkillsBySource: jest.fn(async () => []),
+    listSkillFiles: jest.fn(async () => []),
+    getSkillFileByPath: jest.fn(async () => null),
+    upsertSkillFile: jest.fn(async () => {
+      return {
+        _id: new Types.ObjectId(),
+        skillId: new Types.ObjectId(),
+        relativePath: 'scripts/run.sh',
+        file_id: 'file-id',
+        filename: 'run.sh',
+        filepath: '/uploads/file-id__run.sh',
+        source: 'local',
+        mimeType: 'application/x-sh',
+        bytes: 7,
+        category: 'script',
+        isExecutable: false,
+        author: new Types.ObjectId(),
+      } as ISkillFile & { _id: Types.ObjectId };
+    }),
+    deleteSkillFile: jest.fn(async () => ({ deleted: true })),
+    deleteSkill: jest.fn(async () => ({ deleted: true })),
+    saveBuffer: jest.fn(async () => ({ filepath: '/uploads/file-id__run.sh', source: 'local' })),
+    deleteFile: jest.fn(async () => undefined),
+    grantPermission: jest.fn(async () => undefined),
+    fetchFn: githubFetch(),
+    ...overrides,
+  };
+  return deps;
+}
+
+describe('createGitHubSkillSyncRunner', () => {
+  it('creates a GitHub skill and syncs bundled files from a configured path', async () => {
+    const deps = createDeps();
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fetchedUrls = (deps.fetchFn as unknown as jest.Mock).mock.calls.map(
+      ([input]: [RequestInfo | URL]) => input.toString(),
+    );
+
+    expect(result.status).toBe('completed');
+    expect(fetchedUrls.some((url) => url.includes('/git/trees/tree-sha?recursive=1'))).toBe(false);
+    expect(fetchedUrls.some((url) => url.includes('/git/trees/skills-tree-sha?recursive=1'))).toBe(
+      true,
+    );
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        description: 'Research things',
+        body: expect.stringContaining('Body'),
+        alwaysApply: true,
+        source: 'github',
+        sourceMetadata: expect.objectContaining({
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          upstreamId: 'librechat-skills:skills/research',
+          skillBlobSha: 'skill-md-sha',
+        }),
+      }),
+    );
+    expect(deps.upsertSkillFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        relativePath: 'scripts/run.sh',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/research',
+          blobSha: 'file-sha',
+          commitSha: 'commit-sha',
+        }),
+      }),
+    );
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalType: 'public',
+        accessRoleId: 'skill_viewer',
+      }),
+    );
+  });
+
+  it('drops an invalid alwaysApply alias when canonical always-apply is valid', async () => {
+    const deps = createDeps({
+      fetchFn: githubFetch(
+        '---\nname: research\ndescription: Research things\nalways-apply: true\nalwaysApply: yes\n---\nBody',
+      ),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        alwaysApply: true,
+        frontmatter: { 'always-apply': true },
+      }),
+    );
+  });
+
+  it('fails duplicate discovered skill names before publishing partial mirrors', async () => {
+    const duplicateFetch = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-a-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/skill-a',
+            },
+            {
+              path: 'analysis/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-b-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/skill-b',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-a-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: First\n---\nBody'));
+      }
+      if (url.includes('/git/blobs/skill-b-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Second\n---\nBody'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn: duplicateFetch });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'DUPLICATE_SKILL_NAME',
+        errorMessage: 'GitHub source "librechat-skills" contains multiple skills named "duplicate"',
+      }),
+    );
+  });
+
+  it('fails duplicate root and nested skill names before publishing partial mirrors', async () => {
+    const duplicateFetch = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'root-skill-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/root-skill',
+            },
+            {
+              path: 'child/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-skill-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/child-skill',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/root-skill-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Root\n---\nBody'));
+      }
+      if (url.includes('/git/blobs/child-skill-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Child\n---\nBody'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn: duplicateFetch,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: [''],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'DUPLICATE_SKILL_NAME',
+        errorMessage: 'GitHub source "librechat-skills" contains multiple skills named "duplicate"',
+      }),
+    );
+  });
+
+  it('discovers nested skill roots within the configured discovery depth', async () => {
+    const skillMarkdown = '---\nname: tdd\ndescription: Test-driven development\n---\nBody';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'engineering/tdd/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            {
+              path: 'engineering/tdd/tests.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'tests-md-sha',
+              size: 5,
+              url: 'https://api.github.test/blob/tests',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-md-sha')) {
+        return response(blob(skillMarkdown));
+      }
+      if (url.includes('/git/blobs/tests-md-sha')) {
+        return response(blob('tests'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'mattpocock-skills',
+              owner: 'mattpocock',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              skillDiscoveryDepth: 2,
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'tdd',
+        sourceMetadata: expect.objectContaining({
+          sourceId: 'mattpocock-skills',
+          upstreamId: 'mattpocock-skills:skills/engineering/tdd',
+        }),
+      }),
+    );
+    expect(deps.upsertSkillFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        relativePath: 'tests.md',
+        sourceMetadata: expect.objectContaining({
+          path: 'skills/engineering/tdd/tests.md',
+        }),
+      }),
+    );
+  });
+
+  it('uses an env-backed source token without loading a stored credential', async () => {
+    const previousToken = process.env.GITHUB_SKILLS_TOKEN;
+    process.env.GITHUB_SKILLS_TOKEN = 'github_pat_from_env';
+    const getCredentialToken = jest.fn(async () => 'github_pat_from_db');
+    const deps = createDeps({
+      getCredentialToken,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const status = await runner.getStatus();
+      const result = await runner.runOnce();
+
+      expect(status.sources[0]?.credentialPresent).toBe(true);
+      expect(result.status).toBe('completed');
+      expect(getCredentialToken).not.toHaveBeenCalled();
+      expect(deps.createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sourceMetadata: expect.objectContaining({ sourceId: 'librechat-skills' }),
+        }),
+      );
+    } finally {
+      if (previousToken == null) {
+        delete process.env.GITHUB_SKILLS_TOKEN;
+      } else {
+        process.env.GITHUB_SKILLS_TOKEN = previousToken;
+      }
+    }
+  });
+
+  it('does not list or resolve server credentials and skips runs when they are disabled', async () => {
+    const previousToken = process.env.GITHUB_SKILLS_TOKEN;
+    process.env.GITHUB_SKILLS_TOKEN = 'github_pat_from_env';
+    const getCredentialToken = jest.fn(async () => 'github_pat_from_db');
+    const listCredentials = jest.fn(async () => [
+      {
+        provider: 'github' as const,
+        credentialKey: 'github-skills-prod',
+        credentialPresent: true,
+        tokenFingerprint: 'abc123',
+      },
+    ]);
+    const deps = createDeps({
+      allowServerCredentials: false,
+      getCredentialToken,
+      listCredentials,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+            {
+              id: 'stored-credential-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const status = await runner.getStatus();
+      const result = await runner.runOnce();
+
+      expect(status.credentials).toEqual([]);
+      expect(status.sources).toEqual([
+        expect.objectContaining({ sourceId: 'librechat-skills', credentialPresent: false }),
+        expect.objectContaining({
+          sourceId: 'stored-credential-skills',
+          credentialPresent: false,
+        }),
+      ]);
+      expect(result.status).toBe('skipped');
+      expect(result.message).toBe(
+        'GitHub skill sync credentials are not available for this runner',
+      );
+      expect(result.sources).toEqual([
+        expect.objectContaining({ sourceId: 'librechat-skills', credentialPresent: false }),
+        expect.objectContaining({
+          sourceId: 'stored-credential-skills',
+          credentialPresent: false,
+        }),
+      ]);
+      expect(listCredentials).not.toHaveBeenCalled();
+      expect(getCredentialToken).not.toHaveBeenCalled();
+      expect(deps.fetchFn).not.toHaveBeenCalled();
+      expect(deps.tryAcquireLock).not.toHaveBeenCalled();
+      expect(deps.upsertStatus).not.toHaveBeenCalled();
+    } finally {
+      if (previousToken == null) {
+        delete process.env.GITHUB_SKILLS_TOKEN;
+      } else {
+        process.env.GITHUB_SKILLS_TOKEN = previousToken;
+      }
+    }
+  });
+
+  it('preserves slash-delimited refs when fetching the GitHub commit', async () => {
+    const baseFetch = githubFetch();
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        expect(url).toContain('/commits/heads/release/2026-05');
+        expect(url).not.toContain('heads%2Frelease%2F2026-05');
+      }
+      return baseFetch(input);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'heads/release/2026-05',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const result = await createGitHubSkillSyncRunner(deps).runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(fetchFn).toHaveBeenCalled();
+  });
+
+  it('runs a tenant-scoped source inside its tenant context and stamps the skill tenantId', async () => {
+    let observedTenantId: string | undefined = 'unset';
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-a',
+            },
+          ],
+        },
+      }),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        observedTenantId = getTenantId();
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(observedTenantId).toBe('tenant-a');
+    expect(deps.findSkillBySourceIdentity).toHaveBeenCalledWith({
+      source: 'github',
+      upstreamId: 'librechat-skills:skills/research',
+      tenantId: 'tenant-a',
+    });
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'research', tenantId: 'tenant-a' }),
+    );
+    expect(deps.upsertStatus).toHaveBeenCalledWith(
+      expect.objectContaining({ sourceId: 'librechat-skills', tenantId: 'tenant-a' }),
+    );
+    const [lockParams] = (deps.tryAcquireLock as jest.Mock).mock.calls[0];
+    expect(lockParams).not.toHaveProperty('tenantId');
+  });
+
+  it('matches stored source status by tenant and source id', async () => {
+    const deps = createDeps({
+      listStatuses: jest.fn(async () => [
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          tenantId: 'tenant-a',
+          status: 'succeeded',
+          syncedSkillCount: 1,
+          syncedFileCount: 2,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          tenantId: 'tenant-b',
+          status: 'failed',
+          errorCode: 'OTHER_TENANT',
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+      ]),
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-b',
+            },
+          ],
+        },
+      }),
+    });
+
+    const status = await createGitHubSkillSyncRunner(deps).getStatus();
+
+    expect(status.sources[0]).toEqual(
+      expect.objectContaining({
+        sourceId: 'librechat-skills',
+        tenantId: 'tenant-b',
+        status: 'failed',
+        errorCode: 'OTHER_TENANT',
+      }),
+    );
+  });
+
+  it('runs in the ambient context when a source has no configured tenantId', async () => {
+    let observedTenantId: string | undefined = 'unset';
+    const deps = createDeps({
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        observedTenantId = getTenantId();
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(observedTenantId).toBeUndefined();
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'research', tenantId: undefined }),
+    );
+  });
+
+  it('scopes mirror cleanup to the current source and deletes only its absent upstream skills', async () => {
+    const keptId = new Types.ObjectId();
+    const staleId = new Types.ObjectId();
+    const existingSkill = (upstreamId: string, _id: Types.ObjectId) => {
+      const skill = makeSkill({
+        name: 'research',
+        description: 'Research things',
+        author: new Types.ObjectId(),
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const listSkillsBySource = jest.fn(async () => [
+      existingSkill('librechat-skills:skills/research', keptId),
+      existingSkill('librechat-skills:skills/removed', staleId),
+    ]);
+    const deps = createDeps({ listSkillsBySource });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(listSkillsBySource).toHaveBeenCalledWith({
+      source: 'github',
+      sourceId: 'librechat-skills',
+    });
+    expect(deps.deleteSkill).toHaveBeenCalledTimes(1);
+    expect(deps.deleteSkill).toHaveBeenCalledWith(staleId.toString());
+  });
+
+  it('deletes stale name-conflicting mirrors after file sync and before same-commit renames', async () => {
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const existingSkill = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = existingSkill('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = existingSkill('librechat-skills:skills/research', existingId, 'research');
+    const existingById = new Map([[existingId.toString(), syncedSkill]]);
+    const deletedIds = new Set<string>();
+    const listSkillsBySource = jest.fn(async () =>
+      [staleSkill, syncedSkill].filter((skill) => !deletedIds.has(skill._id.toString())),
+    );
+    const deleteSkill = jest.fn(async (id: string) => {
+      deletedIds.add(id);
+      return { deleted: true };
+    });
+    const updateSkill = jest.fn(
+      async ({
+        id,
+        update,
+      }: {
+        id: string;
+        expectedVersion: number;
+        update: UpdateSkillInput;
+      }): Promise<UpdateSkillResult> => {
+        if (!deletedIds.has(staleId.toString()) && update.name === 'renamed') {
+          throw new Error('duplicate key');
+        }
+        const skill = existingById.get(id);
+        if (!skill) {
+          return { status: 'not_found' as const };
+        }
+        const updated = { ...skill, ...update, version: skill.version + 1 };
+        existingById.set(id, updated);
+        return { status: 'updated' as const, skill: updated, warnings: [] };
+      },
+    );
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: renamed\ndescription: Renamed skill\n---\nBody'),
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) => existingById.get(id.toString()) ?? null),
+      listSkillsBySource,
+      deleteSkill,
+      updateSkill,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deleteSkill).toHaveBeenCalledWith(staleId.toString());
+    expect(updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existingId.toString(),
+        update: expect.objectContaining({ name: 'renamed' }),
+      }),
+    );
+    expect((deps.upsertSkillFile as jest.Mock).mock.invocationCallOrder[0]).toBeLessThan(
+      deleteSkill.mock.invocationCallOrder[0],
+    );
+    expect(deleteSkill.mock.invocationCallOrder[0]).toBeLessThan(
+      updateSkill.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('does not delete stale name-conflicting mirrors before another skill file sync fails', async () => {
+    const renamedMarkdown = '---\nname: renamed\ndescription: Renamed skill\n---\nBody';
+    const brokenMarkdown = '---\nname: broken\ndescription: Broken skill\n---\nBody';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'research-skill-sha',
+              size: Buffer.byteLength(renamedMarkdown),
+              url: 'https://api.github.test/blob/research-skill',
+            },
+            {
+              path: 'research/scripts/run.sh',
+              mode: '100644',
+              type: 'blob',
+              sha: 'research-file-sha',
+              size: 7,
+              url: 'https://api.github.test/blob/research-file',
+            },
+            {
+              path: 'broken/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'broken-skill-sha',
+              size: Buffer.byteLength(brokenMarkdown),
+              url: 'https://api.github.test/blob/broken-skill',
+            },
+            {
+              path: 'broken/scripts/run.sh',
+              mode: '100644',
+              type: 'blob',
+              sha: 'broken-file-sha',
+              size: 7,
+              url: 'https://api.github.test/blob/broken-file',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/research-skill-sha')) {
+        return response(blob(renamedMarkdown));
+      }
+      if (url.includes('/git/blobs/broken-skill-sha')) {
+        return response(blob(brokenMarkdown));
+      }
+      if (url.includes('/git/blobs/research-file-sha')) {
+        return response(blob('echo ok'));
+      }
+      if (url.includes('/git/blobs/broken-file-sha')) {
+        return response(blob('echo ok'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = makeExisting('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = makeExisting('librechat-skills:skills/research', existingId, 'research');
+    const createdIds: string[] = [];
+    const deleteSkill = jest.fn(async (id: string) => ({ deleted: createdIds.includes(id) }));
+    const deps = createDeps({
+      fetchFn,
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existingId.toString() ? syncedSkill : null,
+      ),
+      listSkillsBySource: jest.fn(async () => [staleSkill, syncedSkill]),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        const skill = makeSkill(input);
+        createdIds.push(skill._id.toString());
+        return { skill, warnings: [] };
+      }),
+      saveBuffer: jest.fn(async () => {
+        throw new Error('storage unavailable');
+      }),
+      deleteSkill,
+      updateSkill: jest.fn(),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deleteSkill).not.toHaveBeenCalledWith(staleId.toString());
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorMessage: 'storage unavailable',
+      }),
+    );
+  });
+
+  it('restores a stale name-conflicting mirror when the rename update fails after deletion', async () => {
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = makeExisting('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = makeExisting('librechat-skills:skills/research', existingId, 'research');
+    const deletedIds = new Set<string>();
+    let restoredSkill: (ISkill & { _id: Types.ObjectId }) | undefined;
+    const createSkill = jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+      restoredSkill = makeSkill(input);
+      return { skill: restoredSkill, warnings: [] };
+    });
+    const deleteSkill = jest.fn(async (id: string) => {
+      deletedIds.add(id);
+      return { deleted: true };
+    });
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: renamed\ndescription: Renamed skill\n---\nBody'),
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existingId.toString() ? syncedSkill : null,
+      ),
+      listSkillsBySource: jest.fn(async () =>
+        [staleSkill, syncedSkill].filter((skill) => !deletedIds.has(skill._id.toString())),
+      ),
+      createSkill,
+      deleteSkill,
+      updateSkill: jest.fn(async () => ({ status: 'conflict' as const, current: syncedSkill })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deleteSkill).toHaveBeenCalledWith(staleId.toString());
+    expect(createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'renamed',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/removed',
+        }),
+      }),
+    );
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: restoredSkill?._id }),
+    );
+  });
+
+  it("does not mirror-delete another tenant's skills from an ambient source run", async () => {
+    const ambientStaleId = new Types.ObjectId();
+    const otherTenantId = new Types.ObjectId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      tenantId?: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name: 'research',
+        description: 'Research things',
+        author: new Types.ObjectId(),
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      skill.tenantId = tenantId;
+      return skill;
+    };
+    // The configured source is ambient (no tenantId), but listSkillsBySource
+    // (non-strict) returns a skill owned by tenant-b. It must not be deleted.
+    const listSkillsBySource = jest.fn(async () => [
+      makeExisting('librechat-skills:skills/removed', ambientStaleId, undefined),
+      makeExisting('librechat-skills:skills/removed', otherTenantId, 'tenant-b'),
+    ]);
+    const deps = createDeps({ listSkillsBySource });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.deleteSkill).toHaveBeenCalledTimes(1);
+    expect(deps.deleteSkill).toHaveBeenCalledWith(ambientStaleId.toString());
+    expect(deps.deleteSkill).not.toHaveBeenCalledWith(otherTenantId.toString());
+  });
+
+  it('derives distinct synthetic authors for the same source mirrored into different tenants', async () => {
+    const authorForTenant = async (tenantId: string): Promise<string> => {
+      let author = '';
+      const deps = createDeps({
+        getConfig: () => ({
+          github: {
+            enabled: true,
+            intervalMinutes: 60,
+            runOnStartup: false,
+            sources: [
+              {
+                id: 'librechat-skills',
+                owner: 'LibreChat',
+                repo: 'skills',
+                ref: 'main',
+                paths: ['skills'],
+                credentialKey: 'github-skills-prod',
+                tenantId,
+              },
+            ],
+          },
+        }),
+        createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+          author = input.author.toString();
+          return { skill: makeSkill(input), warnings: [] };
+        }),
+      });
+      await createGitHubSkillSyncRunner(deps).runOnce();
+      return author;
+    };
+
+    const [authorA, authorB] = [
+      await authorForTenant('tenant-a'),
+      await authorForTenant('tenant-b'),
+    ];
+    expect(authorA).not.toBe('');
+    expect(authorA).not.toBe(authorB);
+  });
+
+  it('uses distinct synthetic authors so same-named skills can sync from different sources', async () => {
+    const seenNamesByAuthor = new Set<string>();
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'source-a',
+              owner: 'LibreChat',
+              repo: 'skills-a',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+            {
+              id: 'source-b',
+              owner: 'LibreChat',
+              repo: 'skills-b',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        const key = `${input.name}:${input.author.toString()}`;
+        if (seenNamesByAuthor.has(key)) {
+          throw new Error('duplicate key');
+        }
+        seenNamesByAuthor.add(key);
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const createCalls = (deps.createSkill as jest.Mock).mock.calls.map(
+      ([input]: [CreateSkillInput]) => input,
+    );
+
+    expect(result.status).toBe('completed');
+    expect(createCalls).toHaveLength(2);
+    expect(createCalls.map((input) => input.name)).toEqual(['research', 'research']);
+    expect(new Set(createCalls.map((input) => input.author.toString())).size).toBe(2);
+  });
+
+  it('marks a source failed and skips mirror deletion when the credential is missing', async () => {
+    const deps = createDeps({
+      getCredentialToken: jest.fn(async () => null),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'MISSING_CREDENTIAL',
+      }),
+    );
+  });
+
+  it('marks GitHub secondary rate limits as rate limited instead of auth failures', async () => {
+    const deps = createDeps({
+      fetchFn: jest.fn(async () =>
+        response(
+          { message: 'You have exceeded a secondary rate limit. Please wait before retrying.' },
+          403,
+          { 'x-ratelimit-remaining': '42' },
+        ),
+      ) as unknown as typeof fetch,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_RATE_LIMITED',
+      }),
+    );
+  });
+
+  it('keeps non-rate-limit GitHub 403 responses classified as auth failures', async () => {
+    const deps = createDeps({
+      fetchFn: jest.fn(async () =>
+        response({ message: 'Resource not accessible by personal access token' }, 403, {
+          'x-ratelimit-remaining': '42',
+        }),
+      ) as unknown as typeof fetch,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_AUTH_FAILED',
+      }),
+    );
+  });
+
+  it('marks a source failed and skips mirror deletion when SKILL.md frontmatter is malformed', async () => {
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: [\n---\nBody'),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_PARSE_FAILED',
+        errorMessage: expect.stringContaining('skills/research/SKILL.md'),
+      }),
+    );
+  });
+
+  it('uses a ref-independent upstream identity when updating an existing GitHub skill', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      frontmatter: { 'allowed-tools': ['old-tool'] },
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'release',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => ({ ...existing, version: existing.version + 1 })),
+      fetchFn: githubFetch('---\nname: research\ndescription: Research things\n---\nBody'),
+      updateSkill: jest.fn(async ({ update }) => ({
+        status: 'updated' as const,
+        skill: {
+          ...existing,
+          ...update,
+          version: existing.version + 1,
+        },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.findSkillBySourceIdentity).toHaveBeenCalledWith({
+      source: 'github',
+      upstreamId: 'librechat-skills:skills/research',
+      tenantId: undefined,
+    });
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        update: expect.objectContaining({
+          sourceMetadata: expect.objectContaining({
+            ref: 'release',
+            upstreamId: 'librechat-skills:skills/research',
+          }),
+          frontmatter: {},
+        }),
+      }),
+    );
+  });
+
+  it('ignores source identity matches from a different tenant bucket', async () => {
+    const otherTenantSkill = makeSkill({
+      name: 'research',
+      description: 'Tenant skill',
+      author: makeSourceAuthorId('librechat-skills', 'tenant-b'),
+      authorName: 'GitHub Sync',
+      frontmatter: {},
+      source: 'github',
+      tenantId: 'tenant-b',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => otherTenantSkill),
+      listSkillsBySource: jest.fn(async () => [otherTenantSkill]),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        tenantId: undefined,
+      }),
+    );
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalledWith(otherTenantSkill._id.toString());
+  });
+
+  it('does not match still-discovered mirrors as moved skills when new skills sync first', async () => {
+    const newSkillMarkdown = '---\nname: research\ndescription: New research skill\n---\nNew';
+    const renamedSkillMarkdown = '---\nname: renamed\ndescription: Renamed skill\n---\nRenamed';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'new/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'new-skill-sha',
+              size: Buffer.byteLength(newSkillMarkdown),
+              url: 'https://api.github.test/blob/new-skill',
+            },
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'renamed-skill-sha',
+              size: Buffer.byteLength(renamedSkillMarkdown),
+              url: 'https://api.github.test/blob/renamed-skill',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/new-skill-sha')) {
+        return response(blob(newSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/renamed-skill-sha')) {
+        return response(blob(renamedSkillMarkdown));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old research skill',
+      body: 'Old body',
+      author: makeSourceAuthorId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      fetchFn,
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? existing : null,
+      ),
+      listSkillsBySource: jest.fn(async () => [existing]),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existing._id.toString() ? existing : null,
+      ),
+      updateSkill: jest.fn(async ({ update }) => ({
+        status: 'updated' as const,
+        skill: { ...existing, ...update, version: existing.version + 1 },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/new',
+        }),
+      }),
+    );
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        update: expect.objectContaining({
+          name: 'renamed',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/research',
+          }),
+        }),
+      }),
+    );
+  });
+
+  it('reuses a same-named source mirror when a skill moves configured paths', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: makeSourceAuthorId(),
+      authorName: 'GitHub Sync',
+      frontmatter: {},
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/old-research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/old-research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const unchangedFile = makeSkillFile(existing, {
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/old-research',
+        commitSha: 'old-commit-sha',
+        blobSha: 'file-sha',
+        path: 'skills/old-research/scripts/run.sh',
+      },
+    });
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => null),
+      listSkillsBySource: jest.fn(async () => [existing]),
+      getSkillById: jest.fn(async () => existing),
+      getSkillFileByPath: jest.fn(async () => unchangedFile),
+      listSkillFiles: jest.fn(async () => [unchangedFile]),
+      updateSkill: jest.fn(async ({ update }) => {
+        Object.assign(existing, update, { version: existing.version + 1 });
+        return { status: 'updated' as const, skill: existing, warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        update: expect.objectContaining({
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/research',
+            skillPath: 'skills/research',
+          }),
+        }),
+      }),
+    );
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+  });
+
+  it('refreshes an existing skill version after file sync before updating metadata', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const afterFileSync = { ...existing, version: existing.version + 2 };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => afterFileSync),
+      updateSkill: jest.fn(async ({ expectedVersion, update }) => ({
+        status: 'updated' as const,
+        skill: {
+          ...afterFileSync,
+          ...update,
+          version: expectedVersion + 1,
+        },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.upsertSkillFile).toHaveBeenCalled();
+    expect(deps.getSkillById).toHaveBeenCalledWith(existing._id);
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        expectedVersion: afterFileSync.version,
+      }),
+    );
+  });
+
+  it('treats frontmatter-only edits during sync as conflicts', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      frontmatter: { 'allowed-tools': ['old-tool'] },
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const edited = {
+      ...existing,
+      version: existing.version + 1,
+      frontmatter: { 'allowed-tools': ['user-tool'] },
+    };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => edited),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_CONFLICT',
+      }),
+    );
+  });
+
+  it('skips existing skill updates when the upstream package is unchanged', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Research things',
+      body: skillMarkdown,
+      frontmatter: {},
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+        commitSha: 'old-commit-sha',
+        skillBlobSha: 'skill-md-sha',
+        syncedAt: '2026-05-30T00:00:00.000Z',
+        syncStatus: 'synced',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const unchangedFile = makeSkillFile(existing, {
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        commitSha: 'old-commit-sha',
+        blobSha: 'file-sha',
+        path: 'skills/research/scripts/run.sh',
+      },
+    });
+    const deps = createDeps({
+      fetchFn: githubFetch(skillMarkdown),
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => existing),
+      getSkillFileByPath: jest.fn(async () => unchangedFile),
+      listSkillFiles: jest.fn(async () => [unchangedFile]),
+      updateSkill: jest.fn(),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.grantPermission).toHaveBeenCalled();
+  });
+
+  it('does not mutate existing skill files when permission grant fails', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => existing),
+      grantPermission: jest.fn(async () => {
+        throw new Error('permission unavailable');
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: existing._id }),
+    );
+    expect(deps.listSkillFiles).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+  });
+
+  it('restores existing skill files when the skill update fails after file sync', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const oldFile = makeSkillFile(existing);
+    const files = new Map<string, ISkillFile & { _id: Types.ObjectId }>([
+      [oldFile.relativePath, oldFile],
+    ]);
+    const upsertSkillFile = jest.fn(
+      async (
+        row: Parameters<GitHubSkillSyncDeps['upsertSkillFile']>[0],
+      ): Promise<ISkillFile & { _id: Types.ObjectId }> => {
+        const current = files.get(row.relativePath);
+        const next = {
+          _id: current?._id ?? new Types.ObjectId(),
+          skillId: row.skillId as Types.ObjectId,
+          relativePath: row.relativePath,
+          file_id: row.file_id,
+          filename: row.filename,
+          filepath: row.filepath,
+          storageKey: row.storageKey,
+          storageRegion: row.storageRegion,
+          source: row.source,
+          sourceMetadata: row.sourceMetadata,
+          mimeType: row.mimeType,
+          bytes: row.bytes,
+          category: 'script' as const,
+          isExecutable: row.isExecutable ?? false,
+          author: row.author,
+          tenantId: row.tenantId,
+        };
+        files.set(row.relativePath, next);
+        return next;
+      },
+    );
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => ({ ...existing, version: existing.version + 1 })),
+      getSkillFileByPath: jest.fn(
+        async (_skillId, relativePath) => files.get(relativePath) ?? null,
+      ),
+      listSkillFiles: jest.fn(async () => Array.from(files.values())),
+      upsertSkillFile,
+      deleteSkillFile: jest.fn(async (_skillId, relativePath) => ({
+        deleted: files.delete(relativePath),
+      })),
+      saveBuffer: jest.fn(async () => ({
+        filepath: '/uploads/new-file-id__run.sh',
+        source: 'local',
+      })),
+      deleteFile: jest.fn(async () => undefined),
+      updateSkill: jest.fn(async () => ({ status: 'conflict' as const, current: existing })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_CONFLICT',
+      }),
+    );
+    expect(files.get('scripts/run.sh')).toEqual(
+      expect.objectContaining({ filepath: oldFile.filepath }),
+    );
+    expect(deps.deleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({ filepath: '/uploads/new-file-id__run.sh' }),
+    );
+    expect(deps.deleteFile).not.toHaveBeenCalledWith(
+      expect.objectContaining({ filepath: oldFile.filepath }),
+    );
+  });
+
+  it('preserves credential presence when a manual run is skipped by an active lock', async () => {
+    const deps = createDeps({
+      tryAcquireLock: jest.fn(async () => false),
+      listCredentials: jest.fn(async () => [
+        {
+          provider: 'github' as const,
+          credentialKey: 'github-skills-prod',
+          credentialPresent: true,
+          tokenFingerprint: 'abc123',
+        },
+      ]),
+      listStatuses: jest.fn(async () => [
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          status: 'running',
+          credentialKey: 'github-skills-prod',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+      ]),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('skipped');
+    expect(result.sources).toEqual([
+      expect.objectContaining({
+        sourceId: 'librechat-skills',
+        status: 'running',
+        credentialPresent: true,
+      }),
+    ]);
+  });
+
+  it('uses a fresh lock owner for each sync run', async () => {
+    const deps = createDeps({ lockOwner: 'worker-a' });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    await runner.runOnce();
+    await runner.runOnce();
+
+    const lockOwners = (deps.tryAcquireLock as jest.Mock).mock.calls.map(
+      ([params]: [Parameters<GitHubSkillSyncDeps['tryAcquireLock']>[0]]) => params.lockOwner,
+    );
+    const releasedOwners = (deps.releaseLock as jest.Mock).mock.calls.map(
+      ([params]: [Parameters<GitHubSkillSyncDeps['releaseLock']>[0]]) => params.lockOwner,
+    );
+
+    expect(lockOwners).toHaveLength(2);
+    expect(lockOwners[0]).not.toBe(lockOwners[1]);
+    expect(lockOwners.every((owner) => owner.startsWith('worker-a:'))).toBe(true);
+    expect(releasedOwners).toEqual(lockOwners);
+  });
+
+  it('excludes child skill packages from parent synced files', async () => {
+    const parentSkillMarkdown = '---\nname: parent\ndescription: Parent skill\n---\nParent';
+    const childSkillMarkdown = '---\nname: child\ndescription: Child skill\n---\nChild';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'parent-skill-sha',
+              size: Buffer.byteLength(parentSkillMarkdown),
+              url: 'https://api.github.test/blob/parent-skill',
+            },
+            {
+              path: 'parent.txt',
+              mode: '100644',
+              type: 'blob',
+              sha: 'parent-file-sha',
+              size: 6,
+              url: 'https://api.github.test/blob/parent-file',
+            },
+            {
+              path: 'child/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-skill-sha',
+              size: Buffer.byteLength(childSkillMarkdown),
+              url: 'https://api.github.test/blob/child-skill',
+            },
+            {
+              path: 'child/child.txt',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-file-sha',
+              size: 5,
+              url: 'https://api.github.test/blob/child-file',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/parent-skill-sha')) {
+        return response(blob(parentSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/parent-file-sha')) {
+        return response(blob('parent'));
+      }
+      if (url.includes('/git/blobs/child-skill-sha')) {
+        return response(blob(childSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/child-file-sha')) {
+        return response(blob('child'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fileCalls = (deps.upsertSkillFile as jest.Mock).mock.calls.map(
+      ([row]: [Parameters<GitHubSkillSyncDeps['upsertSkillFile']>[0]]) => row,
+    );
+
+    expect(result.status).toBe('completed');
+    expect(fileCalls).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          relativePath: 'parent.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+        expect.objectContaining({
+          relativePath: 'child.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/child',
+          }),
+        }),
+      ]),
+    );
+    expect(fileCalls).not.toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          relativePath: 'child/SKILL.md',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+        expect.objectContaining({
+          relativePath: 'child/child.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+      ]),
+    );
+  });
+
+  it('rejects oversized GitHub blobs before downloading file content', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const oversizedBytes = DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes + 1;
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            {
+              path: 'research/data.bin',
+              mode: '100644',
+              type: 'blob',
+              sha: 'oversized-file-sha',
+              size: oversizedBytes,
+              url: 'https://api.github.test/blob/oversized',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-md-sha')) {
+        return response(blob(skillMarkdown));
+      }
+      if (url.includes('/git/blobs/oversized-file-sha')) {
+        throw new Error('oversized blob should not be downloaded');
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fetchedUrls = (fetchFn as unknown as jest.Mock).mock.calls.map(
+      ([input]: [RequestInfo | URL]) => input.toString(),
+    );
+
+    expect(result.status).toBe('failed');
+    expect(fetchedUrls.some((url) => url.includes('/git/blobs/oversized-file-sha'))).toBe(false);
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_BLOB_TOO_LARGE',
+      }),
+    );
+  });
+
+  it('rejects packages that exceed the skill import entry limit before blob downloads', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const extraFiles = Array.from(
+      { length: DEFAULT_SKILL_IMPORT_LIMITS.maxEntries },
+      (_, index) => ({
+        path: `research/files/${index}.txt`,
+        mode: '100644',
+        type: 'blob',
+        sha: `file-${index}-sha`,
+        size: 1,
+        url: `https://api.github.test/blob/file-${index}`,
+      }),
+    );
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            ...extraFiles,
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/')) {
+        throw new Error('blob should not be downloaded');
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_TOO_MANY_FILES',
+      }),
+    );
+  });
+
+  it('rolls back a newly created skill when file sync fails before publishing', async () => {
+    const deps = createDeps({
+      saveBuffer: jest.fn(async () => {
+        throw new Error('storage unavailable');
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).toHaveBeenCalled();
+    expect(deps.grantPermission).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).toHaveBeenCalledWith(expect.any(String));
+  });
+
+  it('stops syncing after losing the Mongo lock lease', async () => {
+    jest.useFakeTimers();
+    let releaseToken: (token: string) => void = () => undefined;
+    const tokenPromise = new Promise<string>((resolve) => {
+      releaseToken = resolve;
+    });
+    const deps = createDeps({
+      getCredentialToken: jest.fn(() => tokenPromise),
+      refreshLock: jest.fn(async () => false),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const runPromise = runner.runOnce();
+      await jest.advanceTimersByTimeAsync(10 * 60 * 1000);
+      releaseToken('github_pat_secret');
+      const result = await runPromise;
+
+      expect(result.status).toBe('failed');
+      expect(result.message).toBe('GitHub skill sync lock was lost');
+      expect(deps.fetchFn).not.toHaveBeenCalled();
+      expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          status: 'failed',
+          errorCode: 'SYNC_LOCK_LOST',
+        }),
+      );
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});
diff --git a/packages/api/src/skills/sync/github.ts b/packages/api/src/skills/sync/github.ts
new file mode 100644
index 00000000000..5af41921f32
--- /dev/null
+++ b/packages/api/src/skills/sync/github.ts
@@ -0,0 +1,1872 @@
+import path from 'path';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import { logger, tenantStorage } from '@librechat/data-schemas';
+import {
+  ResourceType,
+  PrincipalType,
+  AccessRoleIds,
+  SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH,
+} from 'librechat-data-provider';
+import type {
+  ISkill,
+  ISkillFile,
+  CreateSkillInput,
+  UpdateSkillInput,
+  CreateSkillResult,
+  UpdateSkillResult,
+  UpsertSkillFileInput,
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncCredentialSummary,
+  SkillSyncStatusInput,
+} from '@librechat/data-schemas';
+import type { SkillSyncConfig, SkillSyncGitHubSourceConfig } from 'librechat-data-provider';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from '../limits';
+import { parseSkillMarkdown } from '../parse';
+
+const GITHUB_API_BASE = 'https://api.github.com';
+const SYSTEM_AUTHOR_ID = new Types.ObjectId('000000000000000000000000');
+const SYSTEM_AUTHOR_NAME = 'GitHub Sync';
+const PROVIDER: SkillSyncProvider = 'github';
+const LOCK_LEASE_MS = 30 * 60 * 1000;
+
+export const GITHUB_FINE_GRAINED_TOKEN_RECOMMENDATION =
+  'Use a GitHub fine-grained personal access token scoped to the selected repository with read-only Contents and Metadata permissions.';
+
+type FetchFn = typeof fetch;
+
+type GitHubTreeEntry = {
+  path: string;
+  mode: string;
+  type: 'blob' | 'tree' | 'commit';
+  sha: string;
+  size?: number;
+  url: string;
+};
+
+type GitHubTreeResponse = {
+  sha: string;
+  tree: GitHubTreeEntry[];
+  truncated: boolean;
+};
+
+type GitHubBlobResponse = {
+  sha: string;
+  content: string;
+  encoding: string;
+  size: number;
+};
+
+type GitHubCommitResponse = {
+  sha: string;
+  commit: {
+    tree: {
+      sha: string;
+    };
+  };
+};
+
+type SyncCounters = {
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+};
+
+type AssertNotCancelled = () => void;
+
+type DiscoveredSkill = {
+  rootPath: string;
+  skillMd: GitHubTreeEntry;
+  files: GitHubTreeEntry[];
+};
+
+type UpsertRemoteSkillResult = {
+  skill: ISkill & { _id: Types.ObjectId };
+  created: boolean;
+};
+
+type PreparedRemoteSkill = {
+  existing: (ISkill & { _id: Types.ObjectId }) | null;
+  update: UpdateSkillInput;
+  createInput: CreateSkillInput;
+};
+
+type PreparedExistingRemoteSkill = PreparedRemoteSkill & {
+  existing: ISkill & { _id: Types.ObjectId };
+};
+
+type PreparedDiscoveredSkill = {
+  discovered: DiscoveredSkill;
+  prepared: PreparedRemoteSkill;
+};
+
+type SaveBufferResult = {
+  filepath: string;
+  source: string;
+  storageKey?: string;
+  storageRegion?: string;
+};
+
+type StoredSkillFileRef = {
+  filepath: string;
+  source: string;
+  storageKey?: string;
+  storageRegion?: string;
+  author?: Types.ObjectId | string;
+  tenantId?: string;
+};
+
+type DeletedSyncedSkillJournal = {
+  skill: ISkill & { _id: Types.ObjectId };
+  files: Array<ISkillFile & { _id: Types.ObjectId }>;
+};
+
+type SyncSkillFilesJournal = {
+  staleFiles: StoredSkillFileRef[];
+  savedFiles: StoredSkillFileRef[];
+};
+
+type SyncSkillFilesResult = Pick<SyncCounters, 'syncedFileCount' | 'deletedFileCount'> &
+  SyncSkillFilesJournal;
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type GitHubSkillSyncDeps = {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  getCredentialToken: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<string | null>;
+  getCredentialSummary: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<SkillSyncCredentialSummary | null>;
+  listCredentials: (provider: SkillSyncProvider) => Promise<SkillSyncCredentialSummary[]>;
+  listStatuses: (provider: SkillSyncProvider) => Promise<ISkillSyncStatus[]>;
+  upsertStatus: (input: SkillSyncStatusInput) => Promise<ISkillSyncStatus>;
+  tryAcquireLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    leaseMs: number;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  refreshLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    leaseMs: number;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  releaseLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    tenantId?: string;
+  }) => Promise<void>;
+  createSkill: (data: CreateSkillInput) => Promise<CreateSkillResult>;
+  updateSkill: (params: {
+    id: string;
+    expectedVersion: number;
+    update: UpdateSkillInput;
+  }) => Promise<UpdateSkillResult>;
+  getSkillById: (id: string | Types.ObjectId) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  findSkillBySourceIdentity: (params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsBySource: (params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }) => Promise<Array<ISkill & { _id: Types.ObjectId }>>;
+  listSkillFiles: (
+    skillId: string | Types.ObjectId,
+  ) => Promise<Array<ISkillFile & { _id: Types.ObjectId }>>;
+  getSkillFileByPath: (
+    skillId: string | Types.ObjectId,
+    relativePath: string,
+  ) => Promise<(ISkillFile & { _id: Types.ObjectId }) | null>;
+  upsertSkillFile: (row: UpsertSkillFileInput) => Promise<ISkillFile & { _id: Types.ObjectId }>;
+  deleteSkillFile: (
+    skillId: string | Types.ObjectId,
+    relativePath: string,
+  ) => Promise<{ deleted: boolean }>;
+  deleteSkill: (id: string) => Promise<{ deleted: boolean }>;
+  saveBuffer: (params: {
+    userId: string;
+    buffer: Buffer;
+    fileName: string;
+    basePath?: string;
+    isImage?: boolean;
+    tenantId?: string;
+  }) => Promise<SaveBufferResult>;
+  deleteFile?: (file: {
+    filepath: string;
+    source: string;
+    storageKey?: string;
+    storageRegion?: string;
+    user?: Types.ObjectId | string;
+    tenantId?: string;
+  }) => Promise<void>;
+  grantPermission: (params: {
+    principalType: string;
+    principalId: string | Types.ObjectId | null;
+    resourceType: string;
+    resourceId: string | Types.ObjectId;
+    accessRoleId: string;
+    grantedBy: string | Types.ObjectId;
+  }) => Promise<unknown>;
+  fetchFn?: FetchFn;
+  lockOwner?: string;
+  allowServerCredentials?: boolean;
+};
+
+export type GitHubSkillSyncRunResult = {
+  status: 'started' | 'skipped' | 'completed' | 'failed';
+  message?: string;
+  sources: Array<ISkillSyncStatus & { credentialPresent?: boolean }>;
+};
+
+export type GitHubSkillSyncStatus = {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: Array<ISkillSyncStatus & { credentialPresent: boolean }>;
+  credentials: SkillSyncCredentialSummary[];
+  fineGrainedTokenRecommendation: string;
+};
+
+export type GitHubSkillSyncRunner = {
+  getStatus: () => Promise<GitHubSkillSyncStatus>;
+  runOnce: () => Promise<GitHubSkillSyncRunResult>;
+};
+
+class SkillSyncError extends Error {
+  code: string;
+
+  constructor(code: string, message: string) {
+    super(message);
+    this.name = 'SkillSyncError';
+    this.code = code;
+  }
+}
+
+function normalizeRepoPath(value: string): string {
+  const trimmed = value.trim().replace(/^\/+|\/+$/g, '');
+  return trimmed === '.' ? '' : trimmed;
+}
+
+function isSafeRelativePath(value: string): boolean {
+  if (!value || value.startsWith('/') || value.startsWith('\\')) {
+    return false;
+  }
+  if (!/^[a-zA-Z0-9._\-/]+$/.test(value)) {
+    return false;
+  }
+  return value.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+
+function makeUpstreamId(source: SkillSyncGitHubSourceConfig, rootPath: string): string {
+  // Identity is keyed on the stable, admin-controlled source id and the skill's
+  // root path only — never owner/repo/ref. Repointing a source to a renamed or
+  // replacement repository (or rotating its ref) keeps the same upstream id, so
+  // existing mirrors are updated in place instead of being treated as new and
+  // colliding on the (name, author, tenantId) uniqueness constraint.
+  return `${source.id}:${rootPath}`;
+}
+
+function makeSourceAuthorId(source: SkillSyncGitHubSourceConfig): Types.ObjectId {
+  // Fold the tenant into the synthetic author so the same source mirrored into
+  // different tenants gets distinct author ids (clearer audits, no cross-tenant
+  // author collisions). The tenant suffix is omitted when absent so single-tenant
+  // author ids stay stable.
+  const seed = source.tenantId
+    ? `${PROVIDER}:${source.id}:${source.tenantId}`
+    : `${PROVIDER}:${source.id}`;
+  const digest = crypto.createHash('sha256').update(seed).digest('hex').slice(0, 24);
+  return new Types.ObjectId(digest);
+}
+
+function toSkillName(value: string): string {
+  const normalized = value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .replace(/-{2,}/g, '-');
+  return normalized || 'github-skill';
+}
+
+function getFilename(relativePath: string): string {
+  return path.posix.basename(relativePath);
+}
+
+function guessMimeType(filename: string): string {
+  const ext = path.extname(filename).toLowerCase();
+  const mimeMap: Record<string, string> = {
+    '.md': 'text/markdown',
+    '.txt': 'text/plain',
+    '.js': 'application/javascript',
+    '.ts': 'text/typescript',
+    '.jsx': 'text/jsx',
+    '.tsx': 'text/tsx',
+    '.json': 'application/json',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.py': 'text/x-python',
+    '.sh': 'application/x-sh',
+    '.css': 'text/css',
+    '.html': 'text/html',
+    '.xml': 'application/xml',
+    '.csv': 'text/csv',
+    '.toml': 'text/toml',
+    '.ini': 'text/ini',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.pdf': 'application/pdf',
+  };
+  return mimeMap[ext] ?? 'application/octet-stream';
+}
+
+function toCleanFrontmatter(
+  frontmatter: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  if (!frontmatter) {
+    return {};
+  }
+  const clean = { ...frontmatter };
+  delete clean.name;
+  delete clean.description;
+  // Drop a placeholder/non-boolean always-apply (e.g. `always-apply:` or
+  // `always-apply: # TODO`, which js-yaml yields as null). Apply the same
+  // cleanup to the accepted `alwaysApply` alias so a malformed alias does not
+  // survive after the canonical key has already supplied the effective flag.
+  // The boolean is already captured in the dedicated alwaysApply field, and
+  // persisting a null here would leave ambiguous/invalid frontmatter on the
+  // synced skill.
+  if ('always-apply' in clean && typeof clean['always-apply'] !== 'boolean') {
+    delete clean['always-apply'];
+  }
+  if ('alwaysApply' in clean && typeof clean.alwaysApply !== 'boolean') {
+    delete clean.alwaysApply;
+  }
+  return clean;
+}
+
+function getLimitMegabytes(bytes: number): number {
+  return Math.round(bytes / 1024 / 1024);
+}
+
+function assertGitHubBlobSize(entry: GitHubTreeEntry, relativePath: string): number {
+  if (typeof entry.size !== 'number' || !Number.isFinite(entry.size) || entry.size < 0) {
+    throw new SkillSyncError(
+      'GITHUB_BLOB_SIZE_UNKNOWN',
+      `GitHub file "${relativePath}" did not include a valid blob size`,
+    );
+  }
+  if (entry.size > DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes) {
+    throw new SkillSyncError(
+      'GITHUB_BLOB_TOO_LARGE',
+      `GitHub file "${relativePath}" exceeds the ${getLimitMegabytes(
+        DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
+      )}MB per-file skill import limit`,
+    );
+  }
+  return entry.size;
+}
+
+function assertGitHubBufferSize(buffer: Buffer, relativePath: string): void {
+  if (buffer.length <= DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_BLOB_TOO_LARGE',
+    `GitHub file "${relativePath}" exceeds the ${getLimitMegabytes(
+      DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
+    )}MB per-file skill import limit`,
+  );
+}
+
+function assertCumulativeGitHubFileSize(totalBytes: number): void {
+  if (totalBytes <= DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_PACKAGE_TOO_LARGE',
+    `GitHub skill files exceed the ${getLimitMegabytes(
+      DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes,
+    )}MB cumulative skill import limit`,
+  );
+}
+
+function assertGitHubEntryCount(discovered: DiscoveredSkill): void {
+  const entryCount = discovered.files.length + 1;
+  if (entryCount <= DEFAULT_SKILL_IMPORT_LIMITS.maxEntries) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_TOO_MANY_FILES',
+    `GitHub skill "${discovered.rootPath}" exceeds the ${DEFAULT_SKILL_IMPORT_LIMITS.maxEntries} file skill import limit`,
+  );
+}
+
+function getSkillMdPath(discovered: DiscoveredSkill): string {
+  return discovered.rootPath ? `${discovered.rootPath}/SKILL.md` : 'SKILL.md';
+}
+
+function getDiscoveredRelativePath(discovered: DiscoveredSkill, entry: GitHubTreeEntry): string {
+  const prefix = discovered.rootPath ? `${discovered.rootPath}/` : '';
+  const normalized = normalizeRepoPath(entry.path);
+  return prefix ? normalized.slice(prefix.length) : normalized;
+}
+
+function assertGitHubSkillPackageManifest(discovered: DiscoveredSkill): void {
+  assertGitHubEntryCount(discovered);
+  assertGitHubBlobSize(discovered.skillMd, getSkillMdPath(discovered));
+  let totalFileBytes = 0;
+  for (const entry of discovered.files) {
+    const relativePath = getDiscoveredRelativePath(discovered, entry);
+    if (!isSafeRelativePath(relativePath) || relativePath.toUpperCase() === 'SKILL.MD') {
+      continue;
+    }
+    totalFileBytes += assertGitHubBlobSize(entry, relativePath);
+    assertCumulativeGitHubFileSize(totalFileBytes);
+  }
+}
+
+function getSourceMetadataString(
+  row: { sourceMetadata?: Record<string, unknown> },
+  key: string,
+): string | undefined {
+  const metadata = row.sourceMetadata;
+  const value = metadata && typeof metadata === 'object' ? metadata[key] : undefined;
+  return typeof value === 'string' ? value : undefined;
+}
+
+function serializeDate(date: Date): string {
+  return date.toISOString();
+}
+
+function sanitizeError(error: unknown): { code: string; message: string } {
+  if (error instanceof SkillSyncError) {
+    return { code: error.code, message: error.message };
+  }
+  if (error instanceof Error) {
+    return {
+      code: 'SYNC_FAILED',
+      message: error.message.replace(/Bearer\s+\S+/gi, 'Bearer [redacted]'),
+    };
+  }
+  return { code: 'SYNC_FAILED', message: 'Unknown skill sync failure' };
+}
+
+function buildGitHubHeaders(token: string): HeadersInit {
+  return {
+    Accept: 'application/vnd.github+json',
+    Authorization: `Bearer ${token}`,
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': 'LibreChat-Skill-Sync',
+  };
+}
+
+function buildGitHubUrl(pathname: string): string {
+  return `${GITHUB_API_BASE}${pathname}`;
+}
+
+function encodeGitHubPath(value: string): string {
+  return value.split('/').map(encodeURIComponent).join('/');
+}
+
+async function readGitHubErrorMessage(response: Response): Promise<string | undefined> {
+  try {
+    const body = (await response.json()) as { message?: unknown };
+    return typeof body.message === 'string' ? body.message : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function isGitHubRateLimitResponse(params: {
+  status: number;
+  remaining: string | null;
+  retryAfter: string | null;
+  message?: string;
+}): boolean {
+  if (params.status === 429 || params.remaining === '0' || params.retryAfter) {
+    return true;
+  }
+  const message = params.message?.toLowerCase() ?? '';
+  return message.includes('rate limit') || message.includes('abuse detection');
+}
+
+async function githubJson<T>(params: {
+  fetchFn: FetchFn;
+  token: string;
+  pathname: string;
+}): Promise<T> {
+  const response = await params.fetchFn(buildGitHubUrl(params.pathname), {
+    headers: buildGitHubHeaders(params.token),
+  });
+  if (response.ok) {
+    return (await response.json()) as T;
+  }
+  const remaining = response.headers.get('x-ratelimit-remaining');
+  const retryAfter = response.headers.get('retry-after');
+  const message = await readGitHubErrorMessage(response);
+  if (response.status === 401 || response.status === 403 || response.status === 429) {
+    const code = isGitHubRateLimitResponse({
+      status: response.status,
+      remaining,
+      retryAfter,
+      message,
+    })
+      ? 'GITHUB_RATE_LIMITED'
+      : 'GITHUB_AUTH_FAILED';
+    throw new SkillSyncError(code, `GitHub request failed with HTTP ${response.status}`);
+  }
+  if (response.status === 404) {
+    throw new SkillSyncError('GITHUB_NOT_FOUND', 'GitHub repository, ref, or path was not found');
+  }
+  throw new SkillSyncError(
+    'GITHUB_REQUEST_FAILED',
+    `GitHub request failed with HTTP ${response.status}`,
+  );
+}
+
+async function fetchCommit(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+}): Promise<GitHubCommitResponse> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const ref = encodeGitHubPath(params.source.ref);
+  return githubJson<GitHubCommitResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/commits/${ref}`,
+  });
+}
+
+async function fetchTree(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  treeSha: string;
+  recursive?: boolean;
+}): Promise<GitHubTreeResponse> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const treeSha = encodeURIComponent(params.treeSha);
+  const recursive = params.recursive ?? true;
+  return githubJson<GitHubTreeResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/git/trees/${treeSha}${recursive ? '?recursive=1' : ''}`,
+  });
+}
+
+async function fetchTreeAtPath(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  rootTreeSha: string;
+  repoPath: string;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<GitHubTreeEntry[]> {
+  const normalizedPath = normalizeRepoPath(params.repoPath);
+  let treeSha = params.rootTreeSha;
+  if (normalizedPath) {
+    for (const segment of normalizedPath.split('/')) {
+      params.assertNotCancelled();
+      const tree = await fetchTree({
+        fetchFn: params.fetchFn,
+        token: params.token,
+        source: params.source,
+        treeSha,
+        recursive: false,
+      });
+      params.assertNotCancelled();
+      if (tree.truncated) {
+        throw new SkillSyncError('GITHUB_TREE_TRUNCATED', 'GitHub tree response was truncated');
+      }
+      const next = tree.tree.find((entry) => entry.type === 'tree' && entry.path === segment);
+      if (!next) {
+        throw new SkillSyncError(
+          'GITHUB_PATH_NOT_FOUND',
+          `Configured GitHub skill path "${normalizedPath}" was not found`,
+        );
+      }
+      treeSha = next.sha;
+    }
+  }
+
+  params.assertNotCancelled();
+  const tree = await fetchTree({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    source: params.source,
+    treeSha,
+    recursive: true,
+  });
+  params.assertNotCancelled();
+  if (tree.truncated) {
+    throw new SkillSyncError('GITHUB_TREE_TRUNCATED', 'GitHub tree response was truncated');
+  }
+  if (!normalizedPath) {
+    return tree.tree;
+  }
+  return tree.tree.map((entry) => ({
+    ...entry,
+    path: `${normalizedPath}/${normalizeRepoPath(entry.path)}`,
+  }));
+}
+
+async function fetchConfiguredTreeEntries(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  rootTreeSha: string;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<GitHubTreeEntry[]> {
+  const entriesByPath = new Map<string, GitHubTreeEntry>();
+  for (const repoPath of params.source.paths) {
+    const entries = await fetchTreeAtPath({ ...params, repoPath });
+    for (const entry of entries) {
+      const normalizedPath = normalizeRepoPath(entry.path);
+      entriesByPath.set(normalizedPath, { ...entry, path: normalizedPath });
+    }
+  }
+  return [...entriesByPath.values()];
+}
+
+async function fetchBlob(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  sha: string;
+}): Promise<Buffer> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const sha = encodeURIComponent(params.sha);
+  const blob = await githubJson<GitHubBlobResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/git/blobs/${sha}`,
+  });
+  if (blob.encoding !== 'base64') {
+    throw new SkillSyncError(
+      'GITHUB_UNSUPPORTED_BLOB',
+      `Unsupported GitHub blob encoding "${blob.encoding}"`,
+    );
+  }
+  return Buffer.from(blob.content.replace(/\s/g, ''), 'base64');
+}
+
+function isSkillRootWithinDiscoveryDepth(
+  rootPath: string,
+  basePath: string,
+  maxDepth: number,
+): boolean {
+  if (rootPath === basePath) {
+    return true;
+  }
+  if (basePath && !rootPath.startsWith(`${basePath}/`)) {
+    return false;
+  }
+  const relative = basePath ? rootPath.slice(basePath.length).replace(/^\/+/, '') : rootPath;
+  if (!relative) {
+    return true;
+  }
+  return relative.split('/').length <= maxDepth;
+}
+
+function discoverSkills(
+  tree: GitHubTreeEntry[],
+  source: SkillSyncGitHubSourceConfig,
+): DiscoveredSkill[] {
+  const basePaths = source.paths.map(normalizeRepoPath);
+  const skillDiscoveryDepth = source.skillDiscoveryDepth ?? SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH;
+  const skillMdByRoot = new Map<string, GitHubTreeEntry>();
+  for (const entry of tree) {
+    if (entry.type !== 'blob') {
+      continue;
+    }
+    const normalized = normalizeRepoPath(entry.path);
+    const basename = path.posix.basename(normalized);
+    if (basename.toUpperCase() !== 'SKILL.MD') {
+      continue;
+    }
+    const parent = normalizeRepoPath(path.posix.dirname(normalized));
+    for (const basePath of basePaths) {
+      if (isSkillRootWithinDiscoveryDepth(parent, basePath, skillDiscoveryDepth)) {
+        skillMdByRoot.set(parent, entry);
+      }
+    }
+  }
+
+  const skillRoots = [...skillMdByRoot.keys()];
+  return [...skillMdByRoot.entries()].map(([rootPath, skillMd]) => {
+    const prefix = rootPath ? `${rootPath}/` : '';
+    const childSkillRoots = skillRoots.filter((candidate) => {
+      if (!candidate || candidate === rootPath) {
+        return false;
+      }
+      return rootPath ? candidate.startsWith(`${rootPath}/`) : true;
+    });
+    const files = tree.filter((entry) => {
+      if (entry.type !== 'blob') {
+        return false;
+      }
+      const normalized = normalizeRepoPath(entry.path);
+      if (!normalized.startsWith(prefix) || normalized === skillMd.path) {
+        return false;
+      }
+      if (childSkillRoots.some((childRoot) => normalized.startsWith(`${childRoot}/`))) {
+        return false;
+      }
+      const relativePath = prefix ? normalized.slice(prefix.length) : normalized;
+      return isSafeRelativePath(relativePath) && relativePath.toUpperCase() !== 'SKILL.MD';
+    });
+    return { rootPath, skillMd, files };
+  });
+}
+
+function assertConfiguredPathsExist(
+  tree: GitHubTreeEntry[],
+  source: SkillSyncGitHubSourceConfig,
+): void {
+  for (const configuredPath of source.paths.map(normalizeRepoPath)) {
+    if (configuredPath === '') {
+      continue;
+    }
+    const exists = tree.some((entry) => {
+      const entryPath = normalizeRepoPath(entry.path);
+      return entryPath === configuredPath || entryPath.startsWith(`${configuredPath}/`);
+    });
+    if (!exists) {
+      throw new SkillSyncError(
+        'GITHUB_PATH_NOT_FOUND',
+        `Configured GitHub skill path "${configuredPath}" was not found`,
+      );
+    }
+  }
+}
+
+function makeStatusInput(params: {
+  source: SkillSyncGitHubSourceConfig;
+  status: SkillSyncStatusInput['status'];
+  startedAt?: Date;
+  finishedAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  counts?: Partial<SyncCounters>;
+}): SkillSyncStatusInput {
+  return {
+    provider: PROVIDER,
+    sourceId: params.source.id,
+    tenantId: params.source.tenantId,
+    status: params.status,
+    credentialKey: params.source.credentialKey,
+    owner: params.source.owner,
+    repo: params.source.repo,
+    ref: params.source.ref,
+    paths: params.source.paths,
+    startedAt: params.startedAt,
+    finishedAt: params.finishedAt,
+    errorCode: params.errorCode,
+    errorMessage: params.errorMessage,
+    syncedSkillCount: params.counts?.syncedSkillCount ?? 0,
+    syncedFileCount: params.counts?.syncedFileCount ?? 0,
+    deletedSkillCount: params.counts?.deletedSkillCount ?? 0,
+    deletedFileCount: params.counts?.deletedFileCount ?? 0,
+  };
+}
+
+function makeStatusKey(sourceId: string, tenantId?: string): string {
+  return `${tenantId ?? ''}:${sourceId}`;
+}
+
+async function ensurePublicViewer(
+  deps: GitHubSkillSyncDeps,
+  skillId: Types.ObjectId,
+): Promise<void> {
+  await deps.grantPermission({
+    principalType: PrincipalType.PUBLIC,
+    principalId: null,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    accessRoleId: AccessRoleIds.SKILL_VIEWER,
+    grantedBy: SYSTEM_AUTHOR_ID,
+  });
+}
+
+async function prepareRemoteSkill(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  discovered: DiscoveredSkill;
+  skillMdContent: string;
+  commitSha: string;
+  syncedAt: Date;
+}): Promise<PreparedRemoteSkill> {
+  const { deps, source, discovered, skillMdContent, commitSha, syncedAt } = params;
+  const parsed = parseSkillMarkdown(skillMdContent);
+  if (parsed.parseError) {
+    throw new SkillSyncError(
+      'SKILL_PARSE_FAILED',
+      `${discovered.rootPath}/SKILL.md contains invalid YAML frontmatter: ${parsed.parseError}`,
+    );
+  }
+  if (parsed.invalidBooleans.length > 0) {
+    throw new SkillSyncError(
+      'SKILL_PARSE_FAILED',
+      `${discovered.rootPath}/SKILL.md contains invalid boolean frontmatter`,
+    );
+  }
+  const upstreamId = makeUpstreamId(source, discovered.rootPath);
+  const fallbackName = toSkillName(path.posix.basename(discovered.rootPath) || source.id);
+  const sourceMetadata = {
+    provider: PROVIDER,
+    sourceId: source.id,
+    upstreamId,
+    owner: source.owner,
+    repo: source.repo,
+    ref: source.ref,
+    skillPath: discovered.rootPath,
+    commitSha,
+    skillBlobSha: discovered.skillMd.sha,
+    syncedAt: serializeDate(syncedAt),
+    syncStatus: 'synced',
+  };
+  const update: UpdateSkillInput = {
+    name: parsed.name || fallbackName,
+    description: parsed.description || parsed.name || fallbackName,
+    body: skillMdContent,
+    frontmatter: toCleanFrontmatter(parsed.frontmatter),
+    alwaysApply: parsed.alwaysApply,
+    source: PROVIDER,
+    sourceMetadata,
+  };
+  const sourceTenantId = source.tenantId ?? undefined;
+  const foundExisting = await deps.findSkillBySourceIdentity({
+    source: PROVIDER,
+    upstreamId,
+    tenantId: sourceTenantId,
+  });
+  const existing =
+    foundExisting && (foundExisting.tenantId ?? undefined) === sourceTenantId
+      ? foundExisting
+      : null;
+  const createInput: CreateSkillInput = {
+    ...(update as Omit<UpdateSkillInput, 'source'>),
+    name: update.name ?? fallbackName,
+    description: update.description ?? fallbackName,
+    author: makeSourceAuthorId(source),
+    authorName: SYSTEM_AUTHOR_NAME,
+    source: PROVIDER,
+    tenantId: source.tenantId,
+  };
+  return { existing, update, createInput };
+}
+
+async function commitRemoteSkill(
+  deps: GitHubSkillSyncDeps,
+  prepared: PreparedRemoteSkill,
+): Promise<UpsertRemoteSkillResult> {
+  if (prepared.existing) {
+    const result = await deps.updateSkill({
+      id: prepared.existing._id.toString(),
+      expectedVersion: prepared.existing.version,
+      update: prepared.update,
+    });
+    if (result.status === 'updated') {
+      return { skill: result.skill, created: false };
+    }
+    if (result.status === 'conflict') {
+      throw new SkillSyncError(
+        'SKILL_CONFLICT',
+        `Skill "${prepared.existing.name}" changed during sync`,
+      );
+    }
+    throw new SkillSyncError(
+      'SKILL_NOT_FOUND',
+      `Previously synced skill "${prepared.existing.name}" was removed`,
+    );
+  }
+  const created = await deps.createSkill(prepared.createInput);
+  return { skill: created.skill, created: true };
+}
+
+/**
+ * File sync bumps the parent skill's `version` (via file upserts/deletes) but
+ * never changes its authored content, so we must re-read to get past our own
+ * version bumps. A plain re-read would also silently accept and overwrite a
+ * concurrent external edit; compare the refreshed content against the pre-sync
+ * snapshot and treat a changed body/name/description/always-apply as a conflict.
+ */
+function hasExternalSkillEdit(before: ISkill, after: ISkill): boolean {
+  return (
+    before.body !== after.body ||
+    before.name !== after.name ||
+    before.description !== after.description ||
+    (before.alwaysApply ?? false) !== (after.alwaysApply ?? false) ||
+    JSON.stringify(before.frontmatter ?? {}) !== JSON.stringify(after.frontmatter ?? {})
+  );
+}
+
+async function commitExistingRemoteSkillAfterFileSync(
+  deps: GitHubSkillSyncDeps,
+  prepared: PreparedExistingRemoteSkill,
+  options: { forceCommit?: boolean } = {},
+): Promise<UpsertRemoteSkillResult> {
+  const refreshed = await deps.getSkillById(prepared.existing._id);
+  if (!refreshed) {
+    throw new SkillSyncError(
+      'SKILL_NOT_FOUND',
+      `Previously synced skill "${prepared.existing.name}" was removed`,
+    );
+  }
+  if (hasExternalSkillEdit(prepared.existing, refreshed)) {
+    throw new SkillSyncError(
+      'SKILL_CONFLICT',
+      `Skill "${prepared.existing.name}" was modified during sync`,
+    );
+  }
+  if (!options.forceCommit && !hasRemoteSkillDefinitionChanged(prepared.update, refreshed)) {
+    return { skill: refreshed, created: false };
+  }
+  return commitRemoteSkill(deps, { ...prepared, existing: refreshed });
+}
+
+async function cleanupFile(deps: GitHubSkillSyncDeps, file: StoredSkillFileRef): Promise<void> {
+  if (!deps.deleteFile) {
+    return;
+  }
+  await deps.deleteFile({
+    filepath: file.filepath,
+    source: file.source,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    user: file.author,
+    tenantId: file.tenantId,
+  });
+}
+
+function toStoredFileRef(params: {
+  saved: SaveBufferResult;
+  author: Types.ObjectId;
+  tenantId?: string;
+}): StoredSkillFileRef {
+  return {
+    filepath: params.saved.filepath,
+    source: params.saved.source,
+    storageKey: params.saved.storageKey,
+    storageRegion: params.saved.storageRegion,
+    author: params.author,
+    tenantId: params.tenantId,
+  };
+}
+
+function toSkillFileInput(file: ISkillFile & { _id: Types.ObjectId }): UpsertSkillFileInput {
+  return {
+    skillId: file.skillId,
+    relativePath: file.relativePath,
+    file_id: file.file_id,
+    filename: file.filename,
+    filepath: file.filepath,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    source: file.source,
+    sourceMetadata: file.sourceMetadata,
+    mimeType: file.mimeType,
+    bytes: file.bytes,
+    isExecutable: file.isExecutable,
+    author: file.author,
+    tenantId: file.tenantId,
+  };
+}
+
+function toCreateSkillInput(skill: ISkill & { _id: Types.ObjectId }): CreateSkillInput {
+  return {
+    name: skill.name,
+    displayTitle: skill.displayTitle,
+    description: skill.description,
+    body: skill.body,
+    frontmatter: skill.frontmatter,
+    category: skill.category,
+    author: skill.author,
+    authorName: skill.authorName,
+    source: PROVIDER,
+    sourceMetadata: skill.sourceMetadata,
+    alwaysApply: skill.alwaysApply,
+    tenantId: skill.tenantId,
+  };
+}
+
+function toStoredFileRefFromSkillFile(
+  file: ISkillFile & { _id: Types.ObjectId },
+): StoredSkillFileRef {
+  return {
+    filepath: file.filepath,
+    source: file.source,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    author: file.author,
+    tenantId: file.tenantId,
+  };
+}
+
+function getStoredFileKey(file: StoredSkillFileRef): string {
+  return [file.source, file.filepath, file.storageKey ?? '', file.storageRegion ?? ''].join(':');
+}
+
+async function cleanupStoredFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  files: StoredSkillFileRef[];
+  logMessage: string;
+}): Promise<void> {
+  const seen = new Set<string>();
+  for (const file of params.files) {
+    const key = getStoredFileKey(file);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    await cleanupFile(params.deps, file).catch((cleanupError) =>
+      logger.error(params.logMessage, cleanupError),
+    );
+  }
+}
+
+async function restoreExistingSkillFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  skill: ISkill & { _id: Types.ObjectId };
+  previousFiles: Array<ISkillFile & { _id: Types.ObjectId }>;
+  savedFiles: StoredSkillFileRef[];
+}): Promise<void> {
+  const { deps, skill, previousFiles, savedFiles } = params;
+  const previousByPath = new Map(previousFiles.map((file) => [file.relativePath, file]));
+  const currentFiles = await deps.listSkillFiles(skill._id);
+
+  for (const file of currentFiles) {
+    if (previousByPath.has(file.relativePath)) {
+      continue;
+    }
+    await deps.deleteSkillFile(skill._id, file.relativePath);
+  }
+  for (const file of previousFiles) {
+    await deps.upsertSkillFile(toSkillFileInput(file));
+  }
+  await cleanupStoredFiles({
+    deps,
+    files: savedFiles,
+    logMessage: '[GitHubSkillSync] Failed to clean up rolled-back synced file:',
+  });
+}
+
+async function deleteSyncedSkillForRestore(
+  deps: GitHubSkillSyncDeps,
+  skill: ISkill & { _id: Types.ObjectId },
+): Promise<{ deletedFileCount: number; deletedSkill: DeletedSyncedSkillJournal }> {
+  const files = await deps.listSkillFiles(skill._id);
+  await deps.deleteSkill(skill._id.toString());
+  return {
+    deletedFileCount: files.length,
+    deletedSkill: { skill, files },
+  };
+}
+
+async function restoreDeletedSyncedSkill(
+  deps: GitHubSkillSyncDeps,
+  deleted: DeletedSyncedSkillJournal,
+): Promise<void> {
+  const restored = await deps.createSkill(toCreateSkillInput(deleted.skill));
+  for (const file of deleted.files) {
+    await deps.upsertSkillFile({
+      ...toSkillFileInput(file),
+      skillId: restored.skill._id,
+    });
+  }
+  await ensurePublicViewer(deps, restored.skill._id);
+}
+
+async function cleanupDeletedSyncedSkillFiles(
+  deps: GitHubSkillSyncDeps,
+  deleted: DeletedSyncedSkillJournal,
+): Promise<void> {
+  await cleanupStoredFiles({
+    deps,
+    files: deleted.files.map(toStoredFileRefFromSkillFile),
+    logMessage: '[GitHubSkillSync] Failed to clean up deleted stale mirrored skill file:',
+  });
+}
+
+function comparableSourceMetadata(metadata: Record<string, unknown> | undefined): string {
+  const { commitSha: _commitSha, syncedAt: _syncedAt, ...rest } = metadata ?? {};
+  return JSON.stringify(rest);
+}
+
+function hasRemoteSkillDefinitionChanged(update: UpdateSkillInput, existing: ISkill): boolean {
+  return (
+    update.body !== existing.body ||
+    update.name !== existing.name ||
+    update.description !== existing.description ||
+    (update.alwaysApply ?? false) !== (existing.alwaysApply ?? false) ||
+    JSON.stringify(update.frontmatter ?? {}) !== JSON.stringify(existing.frontmatter ?? {}) ||
+    comparableSourceMetadata(update.sourceMetadata) !==
+      comparableSourceMetadata(existing.sourceMetadata)
+  );
+}
+
+function findMovedSourceSkill(params: {
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedRemoteSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  excludedUpstreamIds: Set<string>;
+}): (ISkill & { _id: Types.ObjectId }) | null {
+  const sourceTenantId = params.source.tenantId ?? undefined;
+  const sourceAuthor = params.prepared.createInput.author.toString();
+  const name = params.prepared.createInput.name;
+
+  return (
+    params.existingSyncedSkills.find((skill) => {
+      if ((skill.tenantId ?? undefined) !== sourceTenantId) {
+        return false;
+      }
+      if (skill.name !== name || skill.author.toString() !== sourceAuthor) {
+        return false;
+      }
+      const upstreamId = getSourceMetadataString(skill, 'upstreamId');
+      if (!upstreamId) {
+        return false;
+      }
+      return !params.excludedUpstreamIds.has(upstreamId);
+    }) ?? null
+  );
+}
+
+function hasNameConflictingStaleSkill(params: {
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedDiscoveredSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+}): boolean {
+  return Boolean(
+    findMovedSourceSkill({
+      source: params.source,
+      prepared: params.prepared.prepared,
+      existingSyncedSkills: params.existingSyncedSkills,
+      excludedUpstreamIds: params.discoveredUpstreamIds,
+    }),
+  );
+}
+
+function orderPreparedSkillsForSafeStaleDeletes(params: {
+  source: SkillSyncGitHubSourceConfig;
+  preparedSkills: PreparedDiscoveredSkill[];
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+}): PreparedDiscoveredSkill[] {
+  const regular: PreparedDiscoveredSkill[] = [];
+  const nameConflicting: PreparedDiscoveredSkill[] = [];
+  for (const prepared of params.preparedSkills) {
+    if (
+      prepared.prepared.existing &&
+      hasNameConflictingStaleSkill({
+        source: params.source,
+        prepared,
+        existingSyncedSkills: params.existingSyncedSkills,
+        discoveredUpstreamIds: params.discoveredUpstreamIds,
+      })
+    ) {
+      nameConflicting.push(prepared);
+      continue;
+    }
+    regular.push(prepared);
+  }
+  return [...regular, ...nameConflicting];
+}
+
+function getMirrorNameKey(params: {
+  tenantId?: string;
+  author: string;
+  name: string | undefined;
+}): string {
+  return `${params.tenantId ?? ''}:${params.author}:${params.name ?? ''}`;
+}
+
+function assertNoDuplicatePreparedSkillNames(
+  source: SkillSyncGitHubSourceConfig,
+  preparedSkills: PreparedDiscoveredSkill[],
+): void {
+  const sourceTenantId = source.tenantId ?? undefined;
+  const seen = new Map<string, string>();
+  for (const { discovered, prepared } of preparedSkills) {
+    const key = getMirrorNameKey({
+      tenantId: sourceTenantId,
+      author: prepared.createInput.author.toString(),
+      name: prepared.createInput.name,
+    });
+    if (seen.has(key)) {
+      throw new SkillSyncError(
+        'DUPLICATE_SKILL_NAME',
+        `GitHub source "${source.id}" contains multiple skills named "${prepared.createInput.name}"`,
+      );
+    }
+    seen.set(key, discovered.rootPath);
+  }
+}
+
+async function deleteNameConflictingStaleSkill(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedRemoteSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<{
+  remainingSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  deletedSkill?: DeletedSyncedSkillJournal;
+}> {
+  const staleSkill = findMovedSourceSkill({
+    source: params.source,
+    prepared: params.prepared,
+    existingSyncedSkills: params.existingSyncedSkills,
+    excludedUpstreamIds: params.discoveredUpstreamIds,
+  });
+  if (!staleSkill) {
+    return {
+      remainingSkills: params.existingSyncedSkills,
+      deletedSkillCount: 0,
+      deletedFileCount: 0,
+    };
+  }
+
+  params.assertNotCancelled();
+  const { deletedFileCount, deletedSkill } = await deleteSyncedSkillForRestore(
+    params.deps,
+    staleSkill,
+  );
+  const staleSkillId = staleSkill._id.toString();
+
+  return {
+    remainingSkills: params.existingSyncedSkills.filter(
+      (skill) => skill._id.toString() !== staleSkillId,
+    ),
+    deletedSkillCount: 1,
+    deletedFileCount,
+    deletedSkill,
+  };
+}
+
+async function syncSkillFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  skill: ISkill & { _id: Types.ObjectId };
+  discovered: DiscoveredSkill;
+  commitSha: string;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+  journal?: SyncSkillFilesJournal;
+}): Promise<SyncSkillFilesResult> {
+  const { deps, token, source, skill, discovered, commitSha, fetchFn, assertNotCancelled } = params;
+  const journal = params.journal ?? { staleFiles: [], savedFiles: [] };
+  const remotePaths = new Set<string>();
+  let syncedFileCount = 0;
+  let deletedFileCount = 0;
+  let totalFileBytes = 0;
+
+  for (const entry of discovered.files) {
+    assertNotCancelled();
+    const relativePath = getDiscoveredRelativePath(discovered, entry);
+    if (!isSafeRelativePath(relativePath) || relativePath.toUpperCase() === 'SKILL.MD') {
+      continue;
+    }
+    totalFileBytes += assertGitHubBlobSize(entry, relativePath);
+    assertCumulativeGitHubFileSize(totalFileBytes);
+    remotePaths.add(relativePath);
+    const existing = await deps.getSkillFileByPath(skill._id, relativePath);
+    if (existing && getSourceMetadataString(existing, 'blobSha') === entry.sha) {
+      continue;
+    }
+    const buffer = await fetchBlob({ fetchFn, token, source, sha: entry.sha });
+    assertNotCancelled();
+    assertGitHubBufferSize(buffer, relativePath);
+    const fileId = crypto.randomUUID();
+    const filename = getFilename(relativePath);
+    const mimeType = guessMimeType(filename);
+    const saved = await deps.saveBuffer({
+      userId: skill.author.toString(),
+      buffer,
+      fileName: `${fileId}__${filename}`,
+      basePath: 'uploads',
+      isImage: mimeType.startsWith('image/'),
+      tenantId: skill.tenantId,
+    });
+    const savedFile = toStoredFileRef({ saved, author: skill.author, tenantId: skill.tenantId });
+    try {
+      await deps.upsertSkillFile({
+        skillId: skill._id,
+        relativePath,
+        file_id: fileId,
+        filename,
+        filepath: saved.filepath,
+        storageKey: saved.storageKey,
+        storageRegion: saved.storageRegion,
+        source: saved.source,
+        sourceMetadata: {
+          provider: PROVIDER,
+          sourceId: source.id,
+          upstreamId: makeUpstreamId(source, discovered.rootPath),
+          commitSha,
+          blobSha: entry.sha,
+          path: entry.path,
+        },
+        mimeType,
+        bytes: buffer.length,
+        isExecutable: false,
+        author: skill.author,
+        tenantId: skill.tenantId,
+      });
+    } catch (error) {
+      await cleanupFile(deps, savedFile).catch((cleanupError) =>
+        logger.error('[GitHubSkillSync] Failed to clean up orphaned synced file:', cleanupError),
+      );
+      throw error;
+    }
+    syncedFileCount++;
+    journal.savedFiles.push(savedFile);
+    if (existing && existing.filepath !== saved.filepath) {
+      journal.staleFiles.push(existing);
+    }
+  }
+
+  const existingFiles = await deps.listSkillFiles(skill._id);
+  for (const file of existingFiles) {
+    assertNotCancelled();
+    if (remotePaths.has(file.relativePath)) {
+      continue;
+    }
+    const result = await deps.deleteSkillFile(skill._id, file.relativePath);
+    if (result.deleted) {
+      deletedFileCount++;
+      journal.staleFiles.push(file);
+    }
+  }
+  return { syncedFileCount, deletedFileCount, ...journal };
+}
+
+async function deleteSyncedSkill(
+  deps: GitHubSkillSyncDeps,
+  skill: ISkill & { _id: Types.ObjectId },
+): Promise<number> {
+  const files = await deps.listSkillFiles(skill._id);
+  let deletedFiles = 0;
+  for (const file of files) {
+    await cleanupFile(deps, file).catch((cleanupError) =>
+      logger.error('[GitHubSkillSync] Failed to clean up mirrored skill file:', cleanupError),
+    );
+    deletedFiles++;
+  }
+  await deps.deleteSkill(skill._id.toString());
+  return deletedFiles;
+}
+
+function getTokenEnvVarName(tokenReference: string | undefined): string | null {
+  const match = tokenReference?.trim().match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/);
+  return match?.[1] ?? null;
+}
+
+async function resolveGitHubToken(
+  deps: GitHubSkillSyncDeps,
+  source: SkillSyncGitHubSourceConfig,
+): Promise<string | null> {
+  if (deps.allowServerCredentials === false) {
+    return null;
+  }
+  const tokenEnvVar = getTokenEnvVarName(source.token);
+  if (tokenEnvVar) {
+    return process.env[tokenEnvVar]?.trim() || null;
+  }
+  if (!source.credentialKey) {
+    return null;
+  }
+  return deps.getCredentialToken(PROVIDER, source.credentialKey);
+}
+
+function getMissingCredentialMessage(
+  source: SkillSyncGitHubSourceConfig,
+  allowServerCredentials: boolean,
+): string {
+  if (!allowServerCredentials) {
+    return 'Server GitHub credentials are not available for this skill sync config';
+  }
+  const tokenEnvVar = getTokenEnvVarName(source.token);
+  if (tokenEnvVar) {
+    return `Missing GitHub token environment variable "${tokenEnvVar}"`;
+  }
+  return `Missing GitHub credential "${source.credentialKey ?? source.id}"`;
+}
+
+async function syncSource(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<ISkillSyncStatus> {
+  const { deps, source, fetchFn, assertNotCancelled } = params;
+  const startedAt = new Date();
+  await deps.upsertStatus(makeStatusInput({ source, status: 'running', startedAt }));
+  try {
+    assertNotCancelled();
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    const token = await resolveGitHubToken(deps, source);
+    assertNotCancelled();
+    if (!token) {
+      throw new SkillSyncError(
+        'MISSING_CREDENTIAL',
+        getMissingCredentialMessage(source, allowServerCredentials),
+      );
+    }
+    const commit = await fetchCommit({ fetchFn, token, source });
+    assertNotCancelled();
+    const treeEntries = await fetchConfiguredTreeEntries({
+      fetchFn,
+      token,
+      source,
+      rootTreeSha: commit.commit.tree.sha,
+      assertNotCancelled,
+    });
+    assertConfiguredPathsExist(treeEntries, source);
+    const discoveredSkills = discoverSkills(treeEntries, source);
+    const seenUpstreamIds = new Set<string>();
+    let existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }> | null = null;
+    const getExistingSyncedSkills = async () => {
+      if (!existingSyncedSkills) {
+        existingSyncedSkills = await deps.listSkillsBySource({
+          source: PROVIDER,
+          sourceId: source.id,
+        });
+      }
+      return existingSyncedSkills;
+    };
+    const counts: SyncCounters = {
+      syncedSkillCount: 0,
+      syncedFileCount: 0,
+      deletedSkillCount: 0,
+      deletedFileCount: 0,
+    };
+    const syncedAt = new Date();
+    const preparedSkills: PreparedDiscoveredSkill[] = [];
+
+    for (const discovered of discoveredSkills) {
+      assertNotCancelled();
+      assertGitHubSkillPackageManifest(discovered);
+      const skillMdPath = getSkillMdPath(discovered);
+      const skillMdBuffer = await fetchBlob({
+        fetchFn,
+        token,
+        source,
+        sha: discovered.skillMd.sha,
+      });
+      assertNotCancelled();
+      assertGitHubBufferSize(skillMdBuffer, skillMdPath);
+      const prepared = await prepareRemoteSkill({
+        deps,
+        source,
+        discovered,
+        skillMdContent: skillMdBuffer.toString('utf-8'),
+        commitSha: commit.sha,
+        syncedAt,
+      });
+      preparedSkills.push({ discovered, prepared });
+    }
+
+    const discoveredUpstreamIds = new Set(
+      preparedSkills.map(({ discovered }) => makeUpstreamId(source, discovered.rootPath)),
+    );
+    assertNoDuplicatePreparedSkillNames(source, preparedSkills);
+    const orderedPreparedSkills = orderPreparedSkillsForSafeStaleDeletes({
+      source,
+      preparedSkills,
+      existingSyncedSkills: await getExistingSyncedSkills(),
+      discoveredUpstreamIds,
+    });
+
+    for (const { discovered, prepared } of orderedPreparedSkills) {
+      assertNotCancelled();
+      const movedExisting = prepared.existing
+        ? null
+        : findMovedSourceSkill({
+            source,
+            prepared,
+            existingSyncedSkills: await getExistingSyncedSkills(),
+            excludedUpstreamIds: discoveredUpstreamIds,
+          });
+      const effectivePrepared: PreparedRemoteSkill = movedExisting
+        ? { ...prepared, existing: movedExisting }
+        : prepared;
+      seenUpstreamIds.add(makeUpstreamId(source, discovered.rootPath));
+      if (effectivePrepared.existing) {
+        // Check for an external edit before mutating files, so a concurrently
+        // edited skill fails fast without leaving its bundled files partially
+        // rewritten to the upstream version. The post-file-sync check below
+        // still guards edits that land during the file sync itself.
+        const beforeFileSync = await deps.getSkillById(effectivePrepared.existing._id);
+        if (!beforeFileSync) {
+          throw new SkillSyncError(
+            'SKILL_NOT_FOUND',
+            `Previously synced skill "${effectivePrepared.existing.name}" was removed`,
+          );
+        }
+        if (hasExternalSkillEdit(effectivePrepared.existing, beforeFileSync)) {
+          throw new SkillSyncError(
+            'SKILL_CONFLICT',
+            `Skill "${effectivePrepared.existing.name}" was modified during sync`,
+          );
+        }
+        await ensurePublicViewer(deps, effectivePrepared.existing._id);
+        const previousFiles = await deps.listSkillFiles(effectivePrepared.existing._id);
+        const journal: SyncSkillFilesJournal = { staleFiles: [], savedFiles: [] };
+        let fileCounts: SyncSkillFilesResult;
+        let staleConflictCleanup:
+          | Awaited<ReturnType<typeof deleteNameConflictingStaleSkill>>
+          | undefined;
+        try {
+          fileCounts = await syncSkillFiles({
+            deps,
+            token,
+            source,
+            skill: effectivePrepared.existing,
+            discovered,
+            commitSha: commit.sha,
+            fetchFn,
+            assertNotCancelled,
+            journal,
+          });
+          if (prepared.existing) {
+            staleConflictCleanup = await deleteNameConflictingStaleSkill({
+              deps,
+              source,
+              prepared: effectivePrepared,
+              existingSyncedSkills: await getExistingSyncedSkills(),
+              discoveredUpstreamIds,
+              assertNotCancelled,
+            });
+            existingSyncedSkills = staleConflictCleanup.remainingSkills;
+            counts.deletedSkillCount += staleConflictCleanup.deletedSkillCount;
+            counts.deletedFileCount += staleConflictCleanup.deletedFileCount;
+          }
+          await commitExistingRemoteSkillAfterFileSync(
+            deps,
+            {
+              ...effectivePrepared,
+              existing: effectivePrepared.existing,
+            },
+            { forceCommit: fileCounts.syncedFileCount > 0 || fileCounts.deletedFileCount > 0 },
+          );
+        } catch (error) {
+          await restoreExistingSkillFiles({
+            deps,
+            skill: effectivePrepared.existing,
+            previousFiles,
+            savedFiles: journal.savedFiles,
+          }).catch((cleanupError) =>
+            logger.error(
+              '[GitHubSkillSync] Failed to restore existing skill files after sync failure:',
+              cleanupError,
+            ),
+          );
+          if (staleConflictCleanup?.deletedSkill) {
+            await restoreDeletedSyncedSkill(deps, staleConflictCleanup.deletedSkill).catch(
+              (cleanupError) =>
+                logger.error(
+                  '[GitHubSkillSync] Failed to restore stale mirrored skill after sync failure:',
+                  cleanupError,
+                ),
+            );
+          }
+          throw error;
+        }
+        await cleanupStoredFiles({
+          deps,
+          files: fileCounts.staleFiles,
+          logMessage: '[GitHubSkillSync] Failed to clean up replaced synced file:',
+        });
+        if (staleConflictCleanup?.deletedSkill) {
+          await cleanupDeletedSyncedSkillFiles(deps, staleConflictCleanup.deletedSkill);
+        }
+        counts.syncedSkillCount++;
+        counts.syncedFileCount += fileCounts.syncedFileCount;
+        counts.deletedFileCount += fileCounts.deletedFileCount;
+        continue;
+      }
+
+      const upserted = await commitRemoteSkill(deps, effectivePrepared);
+      const { skill } = upserted;
+      try {
+        const fileCounts = await syncSkillFiles({
+          deps,
+          token,
+          source,
+          skill,
+          discovered,
+          commitSha: commit.sha,
+          fetchFn,
+          assertNotCancelled,
+        });
+        await ensurePublicViewer(deps, skill._id);
+        counts.syncedSkillCount++;
+        counts.syncedFileCount += fileCounts.syncedFileCount;
+        counts.deletedFileCount += fileCounts.deletedFileCount;
+      } catch (error) {
+        await deleteSyncedSkill(deps, skill).catch((cleanupError) =>
+          logger.error(
+            '[GitHubSkillSync] Failed to roll back partially synced skill:',
+            cleanupError,
+          ),
+        );
+        throw error;
+      }
+    }
+
+    const currentSyncedSkills = await deps.listSkillsBySource({
+      source: PROVIDER,
+      sourceId: source.id,
+    });
+    // Only mirror-delete skills owned by this source's tenant. With no
+    // configured tenantId under non-strict isolation, listSkillsBySource can
+    // return github skills across tenants, so without this guard an ambient sync
+    // could delete another tenant's mirrored skills. Absent tenantId is its own
+    // (ambient) bucket.
+    const sourceTenantId = source.tenantId ?? undefined;
+    for (const skill of currentSyncedSkills) {
+      assertNotCancelled();
+      if ((skill.tenantId ?? undefined) !== sourceTenantId) {
+        continue;
+      }
+      const upstreamId =
+        skill.sourceMetadata && typeof skill.sourceMetadata.upstreamId === 'string'
+          ? skill.sourceMetadata.upstreamId
+          : '';
+      if (seenUpstreamIds.has(upstreamId)) {
+        continue;
+      }
+      counts.deletedFileCount += await deleteSyncedSkill(deps, skill);
+      counts.deletedSkillCount++;
+    }
+
+    return deps.upsertStatus(
+      makeStatusInput({
+        source,
+        status: 'succeeded',
+        startedAt,
+        finishedAt: new Date(),
+        counts,
+      }),
+    );
+  } catch (error) {
+    const sanitized = sanitizeError(error);
+    logger.error(`[GitHubSkillSync] Source "${source.id}" failed: ${sanitized.message}`);
+    return deps.upsertStatus(
+      makeStatusInput({
+        source,
+        status: 'failed',
+        startedAt,
+        finishedAt: new Date(),
+        errorCode: sanitized.code,
+        errorMessage: sanitized.message,
+      }),
+    );
+  }
+}
+
+/**
+ * Runs a source sync inside its tenant's async context when `tenantId` is set,
+ * so the tenant-isolation mongoose hooks scope every skill/file/ACL read and
+ * write to that tenant (required under strict isolation). Storage writes also
+ * receive the tenant explicitly via `skill.tenantId`. Without a configured
+ * tenant the sync runs in the ambient context, preserving single-tenant behavior.
+ *
+ * The callback is `async` per the tenant-context contract so the ALS store
+ * propagates across every awaited Mongoose operation in `syncSource`.
+ */
+function syncSourceInTenantContext(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<ISkillSyncStatus> {
+  if (!params.source.tenantId) {
+    return syncSource(params);
+  }
+  return tenantStorage.run({ tenantId: params.source.tenantId }, async () => syncSource(params));
+}
+
+function getGithubConfig(config: SkillSyncConfig | undefined): {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: SkillSyncGitHubSourceConfig[];
+} {
+  return {
+    enabled: config?.github?.enabled ?? false,
+    intervalMinutes: config?.github?.intervalMinutes ?? 60,
+    runOnStartup: config?.github?.runOnStartup ?? false,
+    sources:
+      config?.github?.sources.map((source) => ({
+        ...source,
+        skillDiscoveryDepth: source.skillDiscoveryDepth ?? SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH,
+      })) ?? [],
+  };
+}
+
+export function createGitHubSkillSyncRunner(deps: GitHubSkillSyncDeps): GitHubSkillSyncRunner {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const lockOwnerPrefix = deps.lockOwner ?? `${process.pid}`;
+
+  async function getStatus(): Promise<GitHubSkillSyncStatus> {
+    const github = getGithubConfig(await deps.getConfig());
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    const [storedStatuses, credentials] = await Promise.all([
+      deps.listStatuses(PROVIDER),
+      allowServerCredentials ? deps.listCredentials(PROVIDER) : Promise.resolve([]),
+    ]);
+    const statusBySourceId = new Map(
+      storedStatuses.map((status) => [makeStatusKey(status.sourceId, status.tenantId), status]),
+    );
+    const credentialByKey = new Map(
+      credentials.map((credential) => [credential.credentialKey, credential]),
+    );
+    const sources = github.sources.map((source) => {
+      const stored = statusBySourceId.get(makeStatusKey(source.id, source.tenantId));
+      const credential =
+        allowServerCredentials && source.credentialKey
+          ? credentialByKey.get(source.credentialKey)
+          : null;
+      const tokenEnvVar = getTokenEnvVarName(source.token);
+      const envTokenPresent =
+        allowServerCredentials && tokenEnvVar ? Boolean(process.env[tokenEnvVar]?.trim()) : false;
+      return {
+        provider: PROVIDER,
+        sourceId: source.id,
+        tenantId: source.tenantId,
+        status: stored?.status ?? 'idle',
+        credentialKey: source.credentialKey,
+        credentialPresent: envTokenPresent || Boolean(credential),
+        owner: source.owner,
+        repo: source.repo,
+        ref: source.ref,
+        paths: source.paths,
+        startedAt: stored?.startedAt,
+        finishedAt: stored?.finishedAt,
+        lastSuccessAt: stored?.lastSuccessAt,
+        lastFailureAt: stored?.lastFailureAt,
+        errorCode: stored?.errorCode,
+        errorMessage: stored?.errorMessage,
+        syncedSkillCount: stored?.syncedSkillCount ?? 0,
+        syncedFileCount: stored?.syncedFileCount ?? 0,
+        deletedSkillCount: stored?.deletedSkillCount ?? 0,
+        deletedFileCount: stored?.deletedFileCount ?? 0,
+        createdAt: stored?.createdAt,
+        updatedAt: stored?.updatedAt,
+      } satisfies ISkillSyncStatus & { credentialPresent: boolean };
+    });
+    return {
+      enabled: github.enabled,
+      intervalMinutes: github.intervalMinutes,
+      runOnStartup: github.runOnStartup,
+      sources,
+      credentials,
+      fineGrainedTokenRecommendation: GITHUB_FINE_GRAINED_TOKEN_RECOMMENDATION,
+    };
+  }
+
+  async function runOnce(): Promise<GitHubSkillSyncRunResult> {
+    const github = getGithubConfig(await deps.getConfig());
+    if (!github.enabled || github.sources.length === 0) {
+      return { status: 'skipped', message: 'GitHub skill sync is disabled', sources: [] };
+    }
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    if (!allowServerCredentials) {
+      const status = await getStatus();
+      if (!status.sources.some((source) => source.credentialPresent)) {
+        return {
+          status: 'skipped',
+          message: 'GitHub skill sync credentials are not available for this runner',
+          sources: status.sources,
+        };
+      }
+    }
+    const lockOwner = `${lockOwnerPrefix}:${crypto.randomUUID().replace(/-/g, '').slice(0, 12)}`;
+    const acquired = await deps.tryAcquireLock({
+      provider: PROVIDER,
+      lockOwner,
+      leaseMs: LOCK_LEASE_MS,
+    });
+    if (!acquired) {
+      const status = await getStatus();
+      return {
+        status: 'skipped',
+        message: 'GitHub skill sync is already running',
+        sources: status.sources,
+      };
+    }
+    let lockLost = false;
+    const assertNotCancelled = () => {
+      if (lockLost) {
+        throw new SkillSyncError('SYNC_LOCK_LOST', 'GitHub skill sync lock was lost');
+      }
+    };
+    const refreshTimer = setInterval(
+      () => {
+        deps
+          .refreshLock({
+            provider: PROVIDER,
+            lockOwner,
+            leaseMs: LOCK_LEASE_MS,
+          })
+          .then((refreshed) => {
+            if (!refreshed) {
+              lockLost = true;
+              logger.warn('[GitHubSkillSync] Failed to refresh active sync lock');
+            }
+          })
+          .catch((error) => {
+            lockLost = true;
+            logger.error('[GitHubSkillSync] Failed to refresh active sync lock:', error);
+          });
+      },
+      Math.max(60_000, Math.floor(LOCK_LEASE_MS / 3)),
+    );
+    refreshTimer.unref?.();
+    try {
+      const sources: ISkillSyncStatus[] = [];
+      for (const source of github.sources) {
+        if (lockLost) {
+          break;
+        }
+        sources.push(
+          await syncSourceInTenantContext({ deps, source, fetchFn, assertNotCancelled }),
+        );
+      }
+      const failed = sources.some((source) => source.status === 'failed');
+      return {
+        status: failed || lockLost ? 'failed' : 'completed',
+        message: lockLost ? 'GitHub skill sync lock was lost' : undefined,
+        sources,
+      };
+    } finally {
+      clearInterval(refreshTimer);
+      await deps.releaseLock({ provider: PROVIDER, lockOwner });
+    }
+  }
+
+  return { getStatus, runOnce };
+}
diff --git a/packages/api/src/skills/sync/index.ts b/packages/api/src/skills/sync/index.ts
new file mode 100644
index 00000000000..8cfe4a506b3
--- /dev/null
+++ b/packages/api/src/skills/sync/index.ts
@@ -0,0 +1,3 @@
+export * from './github';
+export * from './orchestrator';
+export * from './scheduler';
diff --git a/packages/api/src/skills/sync/orchestrator.spec.ts b/packages/api/src/skills/sync/orchestrator.spec.ts
new file mode 100644
index 00000000000..c86359e966f
--- /dev/null
+++ b/packages/api/src/skills/sync/orchestrator.spec.ts
@@ -0,0 +1,416 @@
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { SkillSyncTriggerRunnerFactoryInput } from './orchestrator';
+import type { GitHubSkillSyncRunner } from './github';
+import { createSkillSyncTriggerOrchestrator } from './orchestrator';
+
+type RunnerStatus = Awaited<ReturnType<GitHubSkillSyncRunner['getStatus']>>;
+type RunnerRunResult = Awaited<ReturnType<GitHubSkillSyncRunner['runOnce']>>;
+
+const source = {
+  id: 'tenant-skills',
+  owner: 'LibreChat',
+  repo: 'skills',
+  ref: 'main',
+  paths: ['skills'],
+  token: '${GITHUB_SKILLS_TOKEN}',
+  tenantId: 'other-tenant',
+};
+
+function skillSync(
+  overrides: Partial<NonNullable<SkillSyncConfig>['github']> = {},
+): SkillSyncConfig {
+  return {
+    github: {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: true,
+      sources: [source],
+      ...overrides,
+    },
+  };
+}
+
+function statusFromConfig(
+  config: SkillSyncConfig | undefined,
+  { allowServerCredentials = true }: { allowServerCredentials?: boolean } = {},
+): RunnerStatus {
+  const github = config?.github;
+  return {
+    enabled: github?.enabled ?? false,
+    intervalMinutes: github?.intervalMinutes ?? 60,
+    runOnStartup: github?.runOnStartup ?? false,
+    sources:
+      github?.sources.map((configuredSource) => ({
+        provider: 'github',
+        sourceId: configuredSource.id,
+        tenantId: configuredSource.tenantId,
+        status: 'idle',
+        credentialKey: configuredSource.credentialKey,
+        credentialPresent:
+          allowServerCredentials &&
+          Boolean(configuredSource.credentialKey || configuredSource.token),
+        owner: configuredSource.owner,
+        repo: configuredSource.repo,
+        ref: configuredSource.ref,
+        paths: configuredSource.paths,
+        syncedSkillCount: 0,
+        syncedFileCount: 0,
+        deletedSkillCount: 0,
+        deletedFileCount: 0,
+        errorCode: undefined,
+        errorMessage: undefined,
+        startedAt: undefined,
+        finishedAt: undefined,
+        lastSuccessAt: undefined,
+        lastFailureAt: undefined,
+        createdAt: undefined,
+        updatedAt: undefined,
+      })) ?? [],
+    credentials: [],
+    fineGrainedTokenRecommendation: 'Use a GitHub fine-grained personal access token.',
+  };
+}
+
+function withRunnableCredentials(status: RunnerStatus): RunnerStatus {
+  return {
+    ...status,
+    sources: status.sources.map((configuredSource) => ({
+      ...configuredSource,
+      credentialPresent: true,
+    })),
+  };
+}
+
+function completedRun(): RunnerRunResult {
+  return { status: 'completed', sources: [] };
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+async function flushPromises() {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function createHarness(
+  options: {
+    status?: RunnerStatus;
+    runOnce?: () => Promise<RunnerRunResult>;
+  } = {},
+) {
+  const runners: Array<{
+    input: SkillSyncTriggerRunnerFactoryInput;
+    runner: GitHubSkillSyncRunner;
+  }> = [];
+  const logger = {
+    warn: jest.fn(),
+    error: jest.fn(),
+  };
+  const createRunner = jest.fn((input: SkillSyncTriggerRunnerFactoryInput) => {
+    const runner: GitHubSkillSyncRunner = {
+      getStatus: jest.fn(
+        async () =>
+          options.status ??
+          statusFromConfig(await input.getConfig(), {
+            allowServerCredentials: input.allowServerCredentials !== false,
+          }),
+      ),
+      runOnce: jest.fn(options.runOnce ?? (async () => completedRun())),
+    };
+    runners.push({ input, runner });
+    return runner;
+  });
+  const orchestrator = createSkillSyncTriggerOrchestrator({
+    createRunner,
+    logger,
+  });
+  return { createRunner, logger, orchestrator, runners };
+}
+
+describe('createSkillSyncTriggerOrchestrator', () => {
+  it('starts request sync from resolved admin skillSync config and derives tenant from the request', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness({
+      status: withRunnableCredentials(statusFromConfig(config)),
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    const requestConfig = await runners[0].input.getConfig();
+    expect(started).toBe(true);
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+    expect(requestConfig?.github?.runOnStartup).toBe(false);
+    expect(requestConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('does not auto-start request sync when only server credentials are configured', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+    expect(runners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('starts request sync with server credentials when the caller opts in', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+
+    expect(started).toBe(true);
+    expect(runners[0].input.allowServerCredentials).toBe(true);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not start request sync for base YAML skillSync config', async () => {
+    const config = skillSync();
+    const { createRunner, orchestrator } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(createRunner).not.toHaveBeenCalled();
+  });
+
+  it('creates an admin request runner from resolved config without disabling startup runs', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const runner = orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runner).toBe(runners[0].runner);
+    expect(runners[0].input.allowServerCredentials).toBe(true);
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('preserves configured tenant scope for platform admin override runners', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: {},
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'other-tenant' }),
+    );
+  });
+
+  it('preserves configured tenant scope for admin base skillSync runs', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'other-tenant' }),
+    );
+  });
+
+  it('filters admin base skillSync status sources without rewriting unscoped sources', async () => {
+    const config = skillSync({
+      sources: [
+        {
+          ...source,
+          id: 'tenant-a-source',
+          tenantId: 'tenant-a',
+        },
+        {
+          ...source,
+          id: 'tenant-b-source',
+          tenantId: 'tenant-b',
+        },
+        {
+          id: 'shared-source',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          token: '${GITHUB_SKILLS_TOKEN}',
+        },
+      ],
+    });
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: false,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.sources).toEqual([
+      expect.objectContaining({ id: 'tenant-a-source', tenantId: 'tenant-a' }),
+      expect.objectContaining({ id: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('filters inherited base sources when admin override changes non-source fields', async () => {
+    const baseSources = [
+      {
+        ...source,
+        id: 'tenant-a-source',
+        tenantId: 'tenant-a',
+      },
+      {
+        ...source,
+        id: 'tenant-b-source',
+        tenantId: 'tenant-b',
+      },
+      {
+        id: 'shared-source',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        paths: ['skills'],
+        token: '${GITHUB_SKILLS_TOKEN}',
+      },
+    ];
+    const base = skillSync({ intervalMinutes: 60, sources: baseSources });
+    const resolved = skillSync({ intervalMinutes: 30, sources: baseSources });
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: resolved, config: { skillSync: base } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: false,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.intervalMinutes).toBe(30);
+    expect(runnerConfig?.github?.sources).toEqual([
+      expect.objectContaining({ id: 'tenant-a-source', tenantId: 'tenant-a' }),
+      expect.objectContaining({ id: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('does not allow admin override runners to use server credentials by default', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+  });
+
+  it('does not start request sync when the configured source is already running', async () => {
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: {
+        ...statusFromConfig(config),
+        sources: [
+          {
+            ...statusFromConfig(config).sources[0],
+            status: 'running',
+            startedAt: new Date(),
+          },
+        ],
+      },
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(runners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('retries request sync when a running source status is stale', async () => {
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: {
+        ...statusFromConfig(config),
+        sources: [
+          {
+            ...statusFromConfig(config).sources[0],
+            status: 'running',
+            credentialPresent: true,
+            startedAt: new Date(Date.now() - 40 * 60 * 1000),
+          },
+        ],
+      },
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(true);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('suppresses duplicate request sync while an equivalent run is in flight', async () => {
+    const pendingRun = deferred<RunnerRunResult>();
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: withRunnableCredentials(statusFromConfig(config)),
+      runOnce: () => pendingRun.promise,
+    });
+
+    const first = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+    const second = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    pendingRun.resolve(completedRun());
+    await flushPromises();
+
+    expect(first).toBe(true);
+    expect(second).toBe(false);
+    expect(runners).toHaveLength(1);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/skills/sync/orchestrator.ts b/packages/api/src/skills/sync/orchestrator.ts
new file mode 100644
index 00000000000..5181799f05a
--- /dev/null
+++ b/packages/api/src/skills/sync/orchestrator.ts
@@ -0,0 +1,302 @@
+import { skillSyncConfigSchema } from 'librechat-data-provider';
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+
+const REQUEST_SYNC_MIN_INTERVAL_MS = 5 * 60 * 1000;
+const REQUEST_SYNC_STALE_RUNNING_MS = 35 * 60 * 1000;
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type SkillSyncAppConfigLike = {
+  skillSync?: unknown;
+  config?: {
+    skillSync?: unknown;
+  };
+};
+
+export type SkillSyncRequestUser = {
+  tenantId?: string | null;
+};
+
+export type SkillSyncRequestLike = {
+  config?: SkillSyncAppConfigLike;
+  user?: SkillSyncRequestUser;
+  skillSyncAllowServerCredentials?: boolean;
+};
+
+type ResolvedSkillSyncConfig = NonNullable<SkillSyncConfig>;
+type ResolvedGitHubSkillSyncConfig = NonNullable<ResolvedSkillSyncConfig['github']>;
+type SkillSyncConfigWithGitHub = ResolvedSkillSyncConfig & {
+  github: ResolvedGitHubSkillSyncConfig;
+};
+
+type SkillSyncRunnerStatus = Awaited<ReturnType<GitHubSkillSyncRunner['getStatus']>>;
+
+type SkillSyncTriggerLogger = {
+  warn: (message: string, metadata?: object) => void;
+  error: (message: string, error?: unknown) => void;
+};
+
+export type SkillSyncTriggerRunnerFactoryInput = {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  loadAppConfig: () => MaybePromise<SkillSyncAppConfigLike | undefined>;
+  allowServerCredentials?: boolean;
+};
+
+export type SkillSyncTriggerOrchestratorDeps = {
+  createRunner: (input: SkillSyncTriggerRunnerFactoryInput) => GitHubSkillSyncRunner;
+  logger: SkillSyncTriggerLogger;
+  minIntervalMs?: number;
+  staleRunningMs?: number;
+  inFlight?: Set<string>;
+};
+
+export type SkillSyncTriggerOrchestrator = {
+  getRunnerForAdminRequest: (request: SkillSyncRequestLike) => GitHubSkillSyncRunner;
+  maybeRunForRequest: (request: SkillSyncRequestLike) => Promise<boolean>;
+};
+
+function parseSkillSyncConfig(
+  raw: unknown,
+  logger: SkillSyncTriggerLogger,
+): SkillSyncConfig | undefined {
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    logger.warn('[GitHubSkillSync] Ignoring invalid skill sync config', {
+      issues: parsed.error.flatten(),
+    });
+    return undefined;
+  }
+  return parsed.data;
+}
+
+function hasGitHubConfig(config: SkillSyncConfig | undefined): config is SkillSyncConfigWithGitHub {
+  return Boolean(config?.github);
+}
+
+function isSameSkillSyncConfig(
+  left: SkillSyncConfig | undefined,
+  right: SkillSyncConfig | undefined,
+) {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function getRequestTenantId(user: SkillSyncRequestUser | undefined): string | undefined {
+  return typeof user?.tenantId === 'string' && user.tenantId ? user.tenantId : undefined;
+}
+
+function withRequestTenant(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+  { disableRunOnStartup = false }: { disableRunOnStartup?: boolean } = {},
+): SkillSyncConfig {
+  const tenantId = getRequestTenantId(user);
+  return {
+    ...config,
+    github: {
+      ...config.github,
+      ...(disableRunOnStartup ? { runOnStartup: false } : {}),
+      sources: config.github.sources.map((source) => ({
+        ...source,
+        // Tenant-scoped requests derive their tenant from the request; platform
+        // requests have no tenant and preserve an explicitly configured source.
+        tenantId: tenantId ?? source.tenantId,
+      })),
+    },
+  };
+}
+
+function isSameGitHubSource(
+  left: ResolvedGitHubSkillSyncConfig['sources'][number] | undefined,
+  right: ResolvedGitHubSkillSyncConfig['sources'][number] | undefined,
+): boolean {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function withAdminReadableTenantScope(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+  base: SkillSyncConfigWithGitHub | undefined,
+): SkillSyncConfig {
+  const tenantId = getRequestTenantId(user);
+  const baseSourceById = new Map(base?.github.sources.map((source) => [source.id, source]) ?? []);
+  const sources = tenantId
+    ? config.github.sources.flatMap((source) => {
+        const baseSource = baseSourceById.get(source.id);
+        if (isSameGitHubSource(source, baseSource)) {
+          if (source.tenantId && source.tenantId !== tenantId) {
+            return [];
+          }
+          return [{ ...source, tenantId: source.tenantId ? tenantId : undefined }];
+        }
+        if (source.tenantId && source.tenantId !== tenantId) {
+          return [];
+        }
+        return [{ ...source, tenantId }];
+      })
+    : [];
+  return {
+    ...config,
+    github: {
+      ...config.github,
+      sources,
+    },
+  };
+}
+
+function getRequestSkillSyncConfig(
+  appConfig: SkillSyncAppConfigLike | undefined,
+  user: SkillSyncRequestUser | undefined,
+  logger: SkillSyncTriggerLogger,
+): SkillSyncConfig | undefined {
+  const resolved = parseSkillSyncConfig(appConfig?.skillSync, logger);
+  if (
+    !hasGitHubConfig(resolved) ||
+    !resolved.github.enabled ||
+    resolved.github.sources.length === 0
+  ) {
+    return undefined;
+  }
+
+  const base = parseSkillSyncConfig(appConfig?.config?.skillSync, logger);
+  if (isSameSkillSyncConfig(resolved, base)) {
+    return undefined;
+  }
+
+  return withRequestTenant(resolved, user, { disableRunOnStartup: true });
+}
+
+function getAdminRequestSkillSyncConfig(
+  appConfig: SkillSyncAppConfigLike | undefined,
+  user: SkillSyncRequestUser | undefined,
+  logger: SkillSyncTriggerLogger,
+  { allowServerCredentials = false }: { allowServerCredentials?: boolean } = {},
+): SkillSyncConfig | undefined {
+  const resolved = parseSkillSyncConfig(appConfig?.skillSync, logger);
+  if (!hasGitHubConfig(resolved)) {
+    return resolved;
+  }
+
+  const base = parseSkillSyncConfig(appConfig?.config?.skillSync, logger);
+  const baseWithGitHub = hasGitHubConfig(base) ? base : undefined;
+  if (!allowServerCredentials) {
+    return withAdminReadableTenantScope(resolved, user, baseWithGitHub);
+  }
+  if (isSameSkillSyncConfig(resolved, base)) {
+    return resolved;
+  }
+
+  return withRequestTenant(resolved, user);
+}
+
+function toTimestamp(value: unknown): number {
+  if (!value) {
+    return 0;
+  }
+  if (value instanceof Date) {
+    return value.getTime();
+  }
+  const parsed = Date.parse(String(value));
+  return Number.isNaN(parsed) ? 0 : parsed;
+}
+
+function getLastAttemptAt(source: SkillSyncRunnerStatus['sources'][number]): number {
+  return Math.max(
+    toTimestamp(source.finishedAt),
+    toTimestamp(source.startedAt),
+    toTimestamp(source.updatedAt),
+    toTimestamp(source.lastSuccessAt),
+    toTimestamp(source.lastFailureAt),
+  );
+}
+
+function shouldRunRequestSync(
+  status: SkillSyncRunnerStatus,
+  { minIntervalMs, staleRunningMs }: { minIntervalMs: number; staleRunningMs: number },
+): boolean {
+  if (!status.enabled || status.sources.length === 0) {
+    return false;
+  }
+  const intervalMs = Math.max(minIntervalMs, (status.intervalMinutes ?? 60) * 60 * 1000);
+  const now = Date.now();
+  return status.sources.some((source) => {
+    if (!source.credentialPresent) {
+      return false;
+    }
+    if (source.status === 'running') {
+      const startedAt = toTimestamp(source.startedAt);
+      return Boolean(startedAt && now - startedAt >= staleRunningMs);
+    }
+    const lastAttemptAt = getLastAttemptAt(source);
+    return !lastAttemptAt || now - lastAttemptAt >= intervalMs;
+  });
+}
+
+function getRequestSyncKey(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+) {
+  const tenantId = user?.tenantId ?? '';
+  const sources = config.github.sources
+    .map((source) => source.id)
+    .sort()
+    .join(',');
+  return `${tenantId}:${sources}`;
+}
+
+export function createSkillSyncTriggerOrchestrator(
+  deps: SkillSyncTriggerOrchestratorDeps,
+): SkillSyncTriggerOrchestrator {
+  const inFlight = deps.inFlight ?? new Set<string>();
+  const minIntervalMs = deps.minIntervalMs ?? REQUEST_SYNC_MIN_INTERVAL_MS;
+  const staleRunningMs = deps.staleRunningMs ?? REQUEST_SYNC_STALE_RUNNING_MS;
+
+  function getRunnerForAdminRequest(request: SkillSyncRequestLike): GitHubSkillSyncRunner {
+    const allowServerCredentials = Boolean(request.skillSyncAllowServerCredentials);
+    const config = getAdminRequestSkillSyncConfig(request.config, request.user, deps.logger, {
+      allowServerCredentials,
+    });
+    return deps.createRunner({
+      getConfig: async () => config,
+      loadAppConfig: async () => request.config,
+      allowServerCredentials,
+    });
+  }
+
+  async function maybeRunForRequest(request: SkillSyncRequestLike): Promise<boolean> {
+    const config = getRequestSkillSyncConfig(request.config, request.user, deps.logger);
+    if (!hasGitHubConfig(config)) {
+      return false;
+    }
+
+    const syncKey = getRequestSyncKey(config, request.user);
+    if (inFlight.has(syncKey)) {
+      return false;
+    }
+
+    const requestRunner = deps.createRunner({
+      getConfig: async () => config,
+      loadAppConfig: async () => request.config,
+      allowServerCredentials: Boolean(request.skillSyncAllowServerCredentials),
+    });
+    const status = await requestRunner.getStatus();
+    if (!shouldRunRequestSync(status, { minIntervalMs, staleRunningMs })) {
+      return false;
+    }
+
+    inFlight.add(syncKey);
+    void requestRunner
+      .runOnce()
+      .catch((error) => deps.logger.error('[GitHubSkillSync] Request-scoped sync failed:', error))
+      .finally(() => inFlight.delete(syncKey));
+    return true;
+  }
+
+  return {
+    getRunnerForAdminRequest,
+    maybeRunForRequest,
+  };
+}
diff --git a/packages/api/src/skills/sync/scheduler.spec.ts b/packages/api/src/skills/sync/scheduler.spec.ts
new file mode 100644
index 00000000000..da9eb0fff48
--- /dev/null
+++ b/packages/api/src/skills/sync/scheduler.spec.ts
@@ -0,0 +1,86 @@
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+import { SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES, startGitHubSkillSyncScheduler } from './scheduler';
+import { __resetShutdownStateForTests } from '~/app/shutdown';
+
+const source = {
+  id: 'librechat-skills',
+  owner: 'LibreChat',
+  repo: 'skills',
+  ref: 'main',
+  paths: ['skills'],
+  credentialKey: 'github-skills-prod',
+};
+
+function config(intervalMinutes: number, enabled = true): SkillSyncConfig {
+  return {
+    github: {
+      enabled,
+      intervalMinutes,
+      runOnStartup: false,
+      sources: [source],
+    },
+  };
+}
+
+function runner(): GitHubSkillSyncRunner {
+  return {
+    getStatus: jest.fn(),
+    runOnce: jest.fn(async () => ({ status: 'completed', sources: [] })),
+  } as unknown as GitHubSkillSyncRunner;
+}
+
+async function flushPromises() {
+  await Promise.resolve();
+  await Promise.resolve();
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+describe('startGitHubSkillSyncScheduler', () => {
+  beforeEach(() => {
+    jest.useFakeTimers();
+    __resetShutdownStateForTests();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+    __resetShutdownStateForTests();
+  });
+
+  it('clamps oversized intervals before scheduling a timer', async () => {
+    const setTimeoutSpy = jest.spyOn(global, 'setTimeout');
+    const scheduler = startGitHubSkillSyncScheduler({
+      getConfig: () => config(Number.MAX_SAFE_INTEGER),
+      runner: runner(),
+    });
+
+    await flushPromises();
+
+    expect(setTimeoutSpy).toHaveBeenLastCalledWith(
+      expect.any(Function),
+      SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES * 60 * 1000,
+    );
+    scheduler.stop();
+  });
+
+  it('uses fresh config when scheduling the next run', async () => {
+    let intervalMinutes = 5;
+    const skillRunner = runner();
+    const setTimeoutSpy = jest.spyOn(global, 'setTimeout');
+    const scheduler = startGitHubSkillSyncScheduler({
+      getConfig: () => config(intervalMinutes),
+      runner: skillRunner,
+    });
+    await flushPromises();
+
+    intervalMinutes = 10;
+    await jest.advanceTimersByTimeAsync(5 * 60 * 1000);
+    await flushPromises();
+
+    expect(skillRunner.runOnce).toHaveBeenCalledTimes(1);
+    expect(setTimeoutSpy).toHaveBeenLastCalledWith(expect.any(Function), 10 * 60 * 1000);
+    scheduler.stop();
+  });
+});
diff --git a/packages/api/src/skills/sync/scheduler.ts b/packages/api/src/skills/sync/scheduler.ts
new file mode 100644
index 00000000000..7aad2d7bab0
--- /dev/null
+++ b/packages/api/src/skills/sync/scheduler.ts
@@ -0,0 +1,103 @@
+import { logger } from '@librechat/data-schemas';
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+import { registerShutdownTask } from '~/app/shutdown';
+
+const NODE_TIMER_MAX_MS = 2147483647;
+const SKILL_SYNC_MIN_INTERVAL_MINUTES = 5;
+export const SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES: number = Math.floor(NODE_TIMER_MAX_MS / 60_000);
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type GitHubSkillSyncScheduler = {
+  stop: () => void;
+};
+
+function normalizeIntervalMinutes(value: unknown): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) {
+    return 60;
+  }
+  return Math.min(
+    SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES,
+    Math.max(SKILL_SYNC_MIN_INTERVAL_MINUTES, Math.floor(value)),
+  );
+}
+
+function getSources(config: SkillSyncConfig | undefined) {
+  const sources = config?.github?.sources;
+  return Array.isArray(sources) ? sources : [];
+}
+
+export function startGitHubSkillSyncScheduler(params: {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  runner: GitHubSkillSyncRunner;
+}): GitHubSkillSyncScheduler {
+  let stopped = false;
+  let timer: NodeJS.Timeout | undefined;
+
+  const getConfig = async (): Promise<SkillSyncConfig | undefined> => {
+    try {
+      return await params.getConfig();
+    } catch (error) {
+      logger.error('[GitHubSkillSync] Failed to load scheduler config:', error);
+      return undefined;
+    }
+  };
+
+  const scheduleNext = (config: SkillSyncConfig | undefined) => {
+    if (stopped) {
+      return;
+    }
+    const delayMs = normalizeIntervalMinutes(config?.github?.intervalMinutes) * 60 * 1000;
+    timer = setTimeout(tick, delayMs);
+    timer.unref?.();
+  };
+
+  const runIfEnabled = async () => {
+    const config = await getConfig();
+    const github = config?.github;
+    if (!github?.enabled || getSources(config).length === 0) {
+      return config;
+    }
+    try {
+      await params.runner.runOnce();
+    } catch (error) {
+      logger.error('[GitHubSkillSync] Scheduled run failed:', error);
+    }
+    return getConfig();
+  };
+
+  async function tick() {
+    if (stopped) {
+      return;
+    }
+    const config = await runIfEnabled();
+    scheduleNext(config);
+  }
+
+  const scheduler = {
+    stop: () => {
+      stopped = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = undefined;
+      }
+    },
+  };
+
+  void (async () => {
+    const config = await getConfig();
+    if (config?.github?.enabled && config.github.runOnStartup && getSources(config).length > 0) {
+      void params.runner.runOnce().catch((error) => {
+        logger.error('[GitHubSkillSync] Scheduled startup run failed:', error);
+      });
+    }
+    scheduleNext(config);
+  })();
+
+  registerShutdownTask('github skill sync scheduler', () => {
+    scheduler.stop();
+  });
+
+  return scheduler;
+}
diff --git a/packages/api/src/storage/s3/s3Config.ts b/packages/api/src/storage/s3/s3Config.ts
index 9f7a0ce5eb5..5dc374d07d4 100644
--- a/packages/api/src/storage/s3/s3Config.ts
+++ b/packages/api/src/storage/s3/s3Config.ts
@@ -1,6 +1,6 @@
 import { logger } from '@librechat/data-schemas';
-import { isEnabled } from '~/utils/common';
 import { DEFAULT_BASE_PATH } from '~/storage/constants';
+import { isEnabled } from '~/utils/common';
 
 const MAX_EXPIRY_SECONDS = 7 * 24 * 60 * 60; // 7 days
 const DEFAULT_EXPIRY_SECONDS = 2 * 60; // 2 minutes
@@ -39,7 +39,22 @@ const parseRefreshExpiry = (): number | null => {
 };
 
 // Internal module config — not part of the public @librechat/api surface
-export const s3Config = {
+export const s3Config: {
+  /** AWS region for S3 */
+  AWS_REGION: string;
+  /** S3 bucket name */
+  AWS_BUCKET_NAME: string;
+  /** Custom endpoint URL (for MinIO, R2, etc.) */
+  AWS_ENDPOINT_URL: string | undefined;
+  /** Use path-style URLs instead of virtual-hosted-style */
+  AWS_FORCE_PATH_STYLE: boolean;
+  /** Presigned URL expiry in seconds */
+  S3_URL_EXPIRY_SECONDS: number;
+  /** Custom refresh expiry in milliseconds (null = use default buffer logic) */
+  S3_REFRESH_EXPIRY_MS: number | null;
+  /** Default base path for file storage */
+  DEFAULT_BASE_PATH: string;
+} = {
   /** AWS region for S3 */
   AWS_REGION: process.env.AWS_REGION ?? '',
   /** S3 bucket name */
diff --git a/packages/api/src/stream/GenerationJobManager.ts b/packages/api/src/stream/GenerationJobManager.ts
index de6232e85b0..42b396bd300 100644
--- a/packages/api/src/stream/GenerationJobManager.ts
+++ b/packages/api/src/stream/GenerationJobManager.ts
@@ -1,7 +1,18 @@
 import { logger, getTenantId, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import {
+  Constants,
+  UsageEvents,
+  parseTextParts,
+  reconcileContextUsage,
+  promptTokensFromUsage,
+} from 'librechat-data-provider';
+import type {
+  TMessageContentParts,
+  TContextUsageEvent,
+  TTokenUsageEvent,
+  Agents,
+} from 'librechat-data-provider';
 import type { StandardGraph } from '@librechat/agents';
-import { parseTextParts } from 'librechat-data-provider';
-import type { Agents, TMessageContentParts } from 'librechat-data-provider';
 import type {
   SerializableJobData,
   IEventTransport,
@@ -9,9 +20,93 @@ import type {
   AbortResult,
   IJobStore,
 } from './interfaces/IJobStore';
+import type { GenerationJobStore } from '~/app/metrics';
 import type * as t from '~/types';
+import {
+  recordGenerationStreamResumePendingEvents,
+  recordGenerationStreamSubscription,
+  setGenerationJobsInFlight,
+  recordGenerationJob,
+} from '~/app/metrics';
 import { InMemoryEventTransport } from './implementations/InMemoryEventTransport';
 import { InMemoryJobStore } from './implementations/InMemoryJobStore';
+import { filterPersistableAbortContent } from './abortContent';
+
+/** Error surfaced to any client still attached when a stale/hung job is reaped. */
+const REAPED_JOB_ERROR = 'Generation timed out';
+const OAUTH_TOOL_CALL_PREFIX = `oauth${Constants.mcp_delimiter}`;
+
+function getToolCallName(toolCall: unknown): unknown {
+  return toolCall != null && typeof toolCall === 'object' && 'name' in toolCall
+    ? toolCall.name
+    : undefined;
+}
+
+function hasOAuthToolCall(toolCalls: unknown): boolean {
+  return (
+    Array.isArray(toolCalls) &&
+    toolCalls.some((toolCall) => {
+      const name = getToolCallName(toolCall);
+      return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+    })
+  );
+}
+
+function getReplayStepId(event: t.ServerSentEvent): unknown {
+  if (!('event' in event) || !event.data || typeof event.data !== 'object') {
+    return undefined;
+  }
+
+  if (event.event === 'on_run_step' || event.event === 'on_run_step_delta') {
+    return 'id' in event.data ? event.data.id : undefined;
+  }
+
+  if (event.event === 'on_run_step_completed') {
+    const result = 'result' in event.data ? event.data.result : undefined;
+    return result != null && typeof result === 'object' && 'id' in result ? result.id : undefined;
+  }
+
+  return undefined;
+}
+
+function isOAuthReplayEvent(event: t.ServerSentEvent): boolean {
+  if (!('event' in event) || !event.data || typeof event.data !== 'object') {
+    return false;
+  }
+
+  if (event.event === 'on_run_step') {
+    const stepDetails = 'stepDetails' in event.data ? event.data.stepDetails : undefined;
+    return (
+      stepDetails != null &&
+      typeof stepDetails === 'object' &&
+      'tool_calls' in stepDetails &&
+      hasOAuthToolCall(stepDetails.tool_calls)
+    );
+  }
+
+  if (event.event === 'on_run_step_delta') {
+    const delta = 'delta' in event.data ? event.data.delta : undefined;
+    if (delta == null || typeof delta !== 'object') {
+      return false;
+    }
+    if (!('tool_calls' in delta) || !hasOAuthToolCall(delta.tool_calls)) {
+      return false;
+    }
+
+    return true;
+  }
+
+  if (event.event === 'on_run_step_completed') {
+    const result = 'result' in event.data ? event.data.result : undefined;
+    if (result == null || typeof result !== 'object' || !('tool_call' in result)) {
+      return false;
+    }
+    const name = getToolCallName(result.tool_call);
+    return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+  }
+
+  return false;
+}
 
 /**
  * Configuration options for GenerationJobManager
@@ -87,6 +182,15 @@ class GenerationJobManagerClass {
   /** Runtime state - always in-memory, not serializable */
   private runtimeState = new Map<string, RuntimeJobState>();
 
+  /** Jobs actively generating in this process. */
+  private runningJobs = new Set<string>();
+
+  /** Serializes replay-event read/modify/write updates per stream. */
+  private replayEventWriteQueues = new Map<string, Promise<void>>();
+
+  /** Serializes token-usage read/modify/write updates per stream. */
+  private tokenUsageWriteQueues = new Map<string, Promise<void>>();
+
   private cleanupInterval: NodeJS.Timeout | null = null;
 
   /** Whether we're using Redis stores */
@@ -144,6 +248,7 @@ class GenerationJobManagerClass {
     isRedis?: boolean;
     cleanupOnComplete?: boolean;
   }): void {
+    const previousStore = this.storeLabel;
     if (this.cleanupInterval) {
       logger.warn(
         '[GenerationJobManager] Reconfiguring after initialization - destroying existing services',
@@ -151,10 +256,14 @@ class GenerationJobManagerClass {
       this.destroy();
     }
 
+    this.runningJobs.clear();
+    setGenerationJobsInFlight(previousStore, 0);
+
     this.jobStore = services.jobStore;
     this.eventTransport = services.eventTransport;
     this._isRedis = services.isRedis ?? false;
     this._cleanupOnComplete = services.cleanupOnComplete ?? true;
+    this.syncRunningJobMetrics();
 
     logger.info(
       `[GenerationJobManager] Configured with ${this._isRedis ? 'Redis' : 'in-memory'} stores`,
@@ -168,6 +277,14 @@ class GenerationJobManagerClass {
     return this._isRedis;
   }
 
+  private get storeLabel(): GenerationJobStore {
+    return this._isRedis ? 'redis' : 'memory';
+  }
+
+  private syncRunningJobMetrics(store: GenerationJobStore = this.storeLabel): void {
+    setGenerationJobsInFlight(store, this.runningJobs.size);
+  }
+
   /**
    * Get the job store instance (for advanced use cases).
    */
@@ -226,6 +343,9 @@ class GenerationJobManagerClass {
       hasSubscriber: false,
     };
     this.runtimeState.set(streamId, runtime);
+    this.runningJobs.add(streamId);
+    this.syncRunningJobMetrics();
+    recordGenerationJob(this.storeLabel, 'created');
 
     // Resolve immediately - early event buffer handles late subscribers
     resolveReady!();
@@ -362,6 +482,10 @@ class GenerationJobManagerClass {
         userMessage: jobData.userMessage,
         responseMessageId: jobData.responseMessageId,
         sender: jobData.sender,
+        endpoint: jobData.endpoint,
+        iconURL: jobData.iconURL,
+        model: jobData.model,
+        promptTokens: jobData.promptTokens,
       },
       readyPromise: runtime.readyPromise,
       resolveReady: runtime.resolveReady,
@@ -538,6 +662,8 @@ class GenerationJobManagerClass {
     // Clear content state and run step buffer (Redis only)
     this.jobStore.clearContentState(streamId);
     this.runStepBuffers?.delete(streamId);
+    this.replayEventWriteQueues.delete(streamId);
+    this.tokenUsageWriteQueues.delete(streamId);
 
     // For error jobs, DON'T delete immediately - keep around so late-connecting
     // clients can receive the error. This handles the race condition where error
@@ -554,6 +680,9 @@ class GenerationJobManagerClass {
         completedAt: Date.now(),
         error,
       });
+      this.runningJobs.delete(streamId);
+      this.syncRunningJobMetrics();
+      recordGenerationJob(this.storeLabel, 'error');
       // Keep runtime state so subscribe() can access errorEvent
       logger.debug(
         `[GenerationJobManager] Job completed with error (keeping for late subscribers): ${streamId}`,
@@ -575,6 +704,9 @@ class GenerationJobManagerClass {
       });
     }
 
+    this.runningJobs.delete(streamId);
+    this.syncRunningJobMetrics();
+    recordGenerationJob(this.storeLabel, 'completed');
     logger.debug(`[GenerationJobManager] Job completed: ${streamId}`);
   }
 
@@ -592,6 +724,7 @@ class GenerationJobManagerClass {
 
     if (!jobData) {
       logger.warn(`[GenerationJobManager] Cannot abort - job not found: ${streamId}`);
+      recordGenerationJob(this.storeLabel, 'abort_failed');
       return {
         text: '',
         content: [],
@@ -616,16 +749,20 @@ class GenerationJobManagerClass {
     /** Content before clearing state */
     const result = await this.jobStore.getContentParts(streamId);
     const content = result?.content ?? [];
+    const abortContent = filterPersistableAbortContent(content);
+    const shouldPersistAbortContent = abortContent.length > 0;
 
     /** Collected usage for all models */
     const collectedUsage = this.jobStore.getCollectedUsage(streamId);
 
     /** Text from content parts for fallback token counting */
-    const text = parseTextParts(content as TMessageContentParts[]);
+    const text = shouldPersistAbortContent
+      ? parseTextParts(abortContent as TMessageContentParts[])
+      : '';
 
     /** Detect "early abort" - aborted before any generation happened (e.g., during tool loading)
     In this case, no messages were saved to DB, so frontend shouldn't navigate to conversation */
-    const isEarlyAbort = content.length === 0 && !jobData.responseMessageId;
+    const isEarlyAbort = !shouldPersistAbortContent && jobData.createdEventEmitted !== true;
 
     /** Final event for abort */
     const userMessageId = jobData.userMessage?.messageId;
@@ -641,6 +778,7 @@ class GenerationJobManagerClass {
             parentMessageId: jobData.userMessage.parentMessageId,
             conversationId: jobData.conversationId,
             text: jobData.userMessage.text ?? '',
+            quotes: jobData.userMessage.quotes,
             isCreatedByUser: true,
           }
         : null,
@@ -650,8 +788,11 @@ class GenerationJobManagerClass {
             messageId: jobData.responseMessageId ?? `${userMessageId ?? 'aborted'}_`,
             parentMessageId: userMessageId,
             conversationId: jobData.conversationId,
-            content,
+            content: abortContent,
             sender: jobData.sender ?? 'AI',
+            endpoint: jobData.endpoint,
+            iconURL: jobData.iconURL,
+            model: jobData.model,
             unfinished: true,
             error: false,
             isCreatedByUser: false,
@@ -668,6 +809,8 @@ class GenerationJobManagerClass {
     await this.eventTransport.emitDone(streamId, abortFinalEvent);
     this.jobStore.clearContentState(streamId);
     this.runStepBuffers?.delete(streamId);
+    this.replayEventWriteQueues.delete(streamId);
+    this.tokenUsageWriteQueues.delete(streamId);
 
     // Immediate cleanup if configured (default: true)
     if (this._cleanupOnComplete) {
@@ -682,12 +825,15 @@ class GenerationJobManagerClass {
       });
     }
 
+    this.runningJobs.delete(streamId);
+    this.syncRunningJobMetrics();
+    recordGenerationJob(this.storeLabel, 'aborted');
     logger.debug(`[GenerationJobManager] Job aborted: ${streamId}`);
 
     return {
       success: true,
       jobData,
-      content,
+      content: abortContent,
       finalEvent: abortFinalEvent,
       text,
       collectedUsage,
@@ -723,9 +869,11 @@ class GenerationJobManagerClass {
     onError?: t.ErrorHandler,
     options?: t.SubscribeOptions,
   ): Promise<{ unsubscribe: t.UnsubscribeFn } | null> {
+    const subscriptionType = options?.skipBufferReplay ? 'resume' : 'initial';
     // Use lazy initialization to support cross-replica subscriptions
     const runtime = await this.getOrCreateRuntimeState(streamId);
     if (!runtime) {
+      recordGenerationStreamSubscription(this.storeLabel, subscriptionType, 'not_found');
       return null;
     }
 
@@ -761,8 +909,14 @@ class GenerationJobManagerClass {
       onError,
     });
 
-    if (subscription.ready) {
-      await subscription.ready;
+    try {
+      if (subscription.ready) {
+        await subscription.ready;
+      }
+      recordGenerationStreamSubscription(this.storeLabel, subscriptionType, 'success');
+    } catch (err) {
+      recordGenerationStreamSubscription(this.storeLabel, subscriptionType, 'error');
+      throw err;
     }
 
     const isFirst = this.eventTransport.isFirstSubscriber(streamId);
@@ -864,6 +1018,11 @@ class GenerationJobManagerClass {
       : 0;
 
     const resumeState = await this.getResumeState(streamId);
+    recordGenerationStreamSubscription(
+      this.storeLabel,
+      'resume_state',
+      resumeState ? 'found' : 'missing',
+    );
 
     let pendingEvents: t.ServerSentEvent[] = [];
     if (!this._isRedis) {
@@ -872,6 +1031,7 @@ class GenerationJobManagerClass {
         pendingEvents = runtime.earlyEventBuffer.slice(bufferLengthAtSnapshot);
         runtime.earlyEventBuffer = [];
         if (pendingEvents.length > 0) {
+          recordGenerationStreamResumePendingEvents(this.storeLabel, pendingEvents.length);
           logger.debug(
             `[GenerationJobManager] Captured ${pendingEvents.length} gap events for ${streamId}`,
           );
@@ -902,7 +1062,16 @@ class GenerationJobManagerClass {
       return;
     }
 
+    // Refresh job activity so the store's stale-job failsafe reaps on inactivity
+    // (a hung generation), not on age (a long but live stream). Parity with
+    // RedisJobStore refreshing the running TTL on each appendChunk.
+    this.jobStore.recordActivity?.(streamId);
+
     await this.trackUserMessage(streamId, event);
+    await this.trackTitleEvent(streamId, event);
+    await this.trackReplayEvent(streamId, event);
+    await this.trackContextUsage(streamId, event);
+    await this.trackTokenUsage(streamId, event);
 
     // For Redis mode, persist chunk for later reconstruction (fire-and-forget for resumability)
     if (this._isRedis) {
@@ -985,6 +1154,182 @@ class GenerationJobManagerClass {
     }
   }
 
+  /**
+   * Persist the last title event so resume sync can replay it. Content
+   * aggregation only reconstructs message parts, so UI-only events need their
+   * own metadata slot.
+   */
+  private async trackTitleEvent(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!('event' in event) || event.event !== 'title') {
+      return;
+    }
+
+    await this.jobStore.updateJob(streamId, {
+      titleEvent: JSON.stringify(event),
+    });
+  }
+
+  /**
+   * Persist the latest context usage snapshot (one per model call) so a
+   * resuming client can restore the context gauge without waiting for the
+   * next model call.
+   */
+  private async trackContextUsage(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!('event' in event) || event.event !== UsageEvents.ON_CONTEXT_USAGE) {
+      return;
+    }
+
+    /** Share the token-usage queue so snapshot + usage writes are serialized per
+     *  stream: `persistTokenUsage` reconciles the stored snapshot (read-modify-
+     *  write), and a snapshot landing between its read and write — or a stale
+     *  reconciled write landing after a newer snapshot — would clobber the newer
+     *  run's gauge when visible calls interleave. FIFO ordering keeps each call's
+     *  pre-invoke snapshot ahead of its own usage and behind the next snapshot. */
+    await this.queueJobWrite(this.tokenUsageWriteQueues, streamId, () =>
+      this.jobStore.updateJob(streamId, {
+        contextUsage: JSON.stringify((event as { data?: unknown }).data ?? null),
+      }),
+    );
+  }
+
+  /**
+   * Chains a read/modify/write job update onto the stream's queue so
+   * concurrent writers can't clobber each other's merged state.
+   */
+  private async queueJobWrite(
+    queues: Map<string, Promise<void>>,
+    streamId: string,
+    write: () => Promise<void>,
+  ): Promise<void> {
+    const previousWrite = queues.get(streamId) ?? Promise.resolve();
+    const nextWrite = previousWrite
+      .catch(() => {
+        // Keep the queue moving even if a prior metadata write failed.
+      })
+      .then(write);
+
+    queues.set(streamId, nextWrite);
+
+    try {
+      await nextWrite;
+    } finally {
+      if (queues.get(streamId) === nextWrite) {
+        queues.delete(streamId);
+      }
+    }
+  }
+
+  /**
+   * Persist replay-only stream events that are needed to reconstruct active
+   * UI state on resume but are not represented by aggregated message content.
+   */
+  private async trackReplayEvent(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!isOAuthReplayEvent(event)) {
+      return;
+    }
+
+    await this.queueJobWrite(this.replayEventWriteQueues, streamId, () =>
+      this.persistReplayEvent(streamId, event),
+    );
+  }
+
+  /**
+   * Persist per-model-call token usage so resuming clients can rebuild
+   * usage totals on any replica (the live collectedUsage array only exists
+   * on the generating instance).
+   */
+  private async trackTokenUsage(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!('event' in event) || event.event !== UsageEvents.ON_TOKEN_USAGE) {
+      return;
+    }
+
+    await this.queueJobWrite(this.tokenUsageWriteQueues, streamId, () =>
+      this.persistTokenUsage(streamId, event as { data?: unknown }),
+    );
+  }
+
+  private async persistTokenUsage(streamId: string, event: { data?: unknown }): Promise<void> {
+    const jobData = await this.jobStore.getJob(streamId);
+    if (!jobData || event.data == null) {
+      return;
+    }
+
+    let tokenUsage: unknown[] = [];
+    if (jobData.tokenUsage) {
+      try {
+        tokenUsage = JSON.parse(jobData.tokenUsage) as unknown[];
+      } catch {
+        tokenUsage = [];
+      }
+    }
+    tokenUsage.push(event.data);
+
+    const update: Partial<SerializableJobData> = { tokenUsage: JSON.stringify(tokenUsage) };
+
+    /** Reconcile the resume snapshot to this call's ACTUAL prompt tokens. A primary
+     *  usage is the post-invoke truth for the call the latest stored snapshot
+     *  precedes (no snapshot is captured between a call's pre-invoke dispatch and
+     *  its usage), so a resuming client restores the real context instead of the
+     *  calibration-inflated estimate — and a mid-call resume (no usage yet) simply
+     *  keeps the raw snapshot rather than mis-applying an earlier call's tokens. */
+    const usage = event.data as TTokenUsageEvent;
+    if (usage.usage_type == null && jobData.contextUsage) {
+      try {
+        const snapshot = JSON.parse(jobData.contextUsage) as TContextUsageEvent | null;
+        if (
+          snapshot != null &&
+          (snapshot.runId == null || usage.runId == null || snapshot.runId === usage.runId)
+        ) {
+          update.contextUsage = JSON.stringify(
+            reconcileContextUsage(snapshot, promptTokensFromUsage(usage)),
+          );
+        }
+      } catch {
+        /* leave the stored snapshot as-is on parse failure */
+      }
+    }
+
+    await this.jobStore.updateJob(streamId, update);
+  }
+
+  private async persistReplayEvent(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    const jobData = await this.jobStore.getJob(streamId);
+    if (!jobData) {
+      return;
+    }
+
+    let replayEvents: t.ServerSentEvent[] = [];
+    if (jobData.replayEvents) {
+      try {
+        replayEvents = JSON.parse(jobData.replayEvents) as t.ServerSentEvent[];
+      } catch {
+        replayEvents = [];
+      }
+    }
+
+    const stepId = getReplayStepId(event);
+    const eventName = 'event' in event ? event.event : undefined;
+    const existingIndex =
+      stepId == null
+        ? -1
+        : replayEvents.findIndex((candidate) => {
+            if (!('event' in candidate) || candidate.event !== eventName) {
+              return false;
+            }
+            return getReplayStepId(candidate) === stepId;
+          });
+
+    if (existingIndex >= 0) {
+      replayEvents[existingIndex] = event;
+    } else {
+      replayEvents.push(event);
+    }
+
+    await this.jobStore.updateJob(streamId, {
+      replayEvents: JSON.stringify(replayEvents),
+    });
+  }
+
   /**
    * Persist user message metadata from the created event.
    * Awaited in emitChunk so the HSET commits before the PUBLISH,
@@ -998,11 +1343,13 @@ class GenerationJobManagerClass {
 
     const { message } = event;
     const updates: Partial<SerializableJobData> = {
+      createdEventEmitted: true,
       userMessage: {
         messageId: message.messageId,
         parentMessageId: message.parentMessageId,
         conversationId: message.conversationId,
         text: message.text,
+        quotes: message.quotes,
       },
     };
 
@@ -1094,11 +1441,49 @@ class GenerationJobManagerClass {
     const result = await this.jobStore.getContentParts(streamId);
     const aggregatedContent = result?.content ?? [];
     const runSteps = await this.jobStore.getRunSteps(streamId);
+    let titleEvent: t.ResumeState['titleEvent'];
+    if (jobData.titleEvent) {
+      try {
+        titleEvent = JSON.parse(jobData.titleEvent) as t.ResumeState['titleEvent'];
+      } catch {
+        // Ignore malformed persisted title events.
+      }
+    }
+    let replayEvents: t.ResumeState['replayEvents'];
+    if (jobData.replayEvents) {
+      try {
+        replayEvents = JSON.parse(jobData.replayEvents) as t.ResumeState['replayEvents'];
+      } catch {
+        // Ignore malformed persisted replay events.
+      }
+    }
+
+    let contextUsage: t.ResumeState['contextUsage'];
+    if (jobData.contextUsage) {
+      try {
+        contextUsage = JSON.parse(jobData.contextUsage) as t.ResumeState['contextUsage'];
+      } catch {
+        // Ignore malformed persisted context usage.
+      }
+    }
+
+    /** Persisted per model call by trackTokenUsage — unlike the live
+     *  collectedUsage reference, this survives cross-replica resumes. */
+    let collectedUsage: t.ResumeState['collectedUsage'];
+    if (jobData.tokenUsage) {
+      try {
+        const parsed = JSON.parse(jobData.tokenUsage) as t.ResumeState['collectedUsage'];
+        collectedUsage = parsed && parsed.length > 0 ? parsed : undefined;
+      } catch {
+        // Ignore malformed persisted token usage.
+      }
+    }
 
     logger.debug(`[GenerationJobManager] getResumeState:`, {
       streamId,
       runStepsLength: runSteps.length,
       aggregatedContentLength: aggregatedContent.length,
+      collectedUsageLength: collectedUsage?.length ?? 0,
     });
 
     return {
@@ -1108,6 +1493,12 @@ class GenerationJobManagerClass {
       responseMessageId: jobData.responseMessageId,
       conversationId: jobData.conversationId,
       sender: jobData.sender,
+      iconURL: jobData.iconURL,
+      model: jobData.model,
+      titleEvent,
+      replayEvents,
+      collectedUsage,
+      contextUsage,
     };
   }
 
@@ -1179,11 +1570,33 @@ class GenerationJobManagerClass {
    */
   private async cleanup(): Promise<void> {
     const count = await this.jobStore.cleanup();
+    let runningJobsChanged = false;
 
     // Cleanup runtime state for deleted jobs
     for (const streamId of this.runtimeState.keys()) {
       if (!(await this.jobStore.hasJob(streamId))) {
+        /**
+         * Abort any still-pending generation whose job has been reaped (e.g. a
+         * stale "running" job removed by the store's failsafe timeout). This
+         * unwinds the hung in-flight work so its client/graph references can be
+         * garbage collected, rather than leaking via the pending promise.
+         */
+        const runtime = this.runtimeState.get(streamId);
+        if (runtime && !runtime.abortController.signal.aborted) {
+          runtime.abortController.abort();
+        }
+        // If a client is still attached when the job is reaped, send a terminal
+        // error first so the SSE connection closes instead of hanging open with no
+        // final/done event (the route only ends the response from onDone/onError).
+        if (this.eventTransport.getSubscriberCount(streamId) > 0) {
+          try {
+            await this.eventTransport.emitError(streamId, REAPED_JOB_ERROR);
+          } catch (err) {
+            logger.error(`[GenerationJobManager] Failed to notify reaped stream ${streamId}:`, err);
+          }
+        }
         this.runtimeState.delete(streamId);
+        runningJobsChanged = this.runningJobs.delete(streamId) || runningJobsChanged;
         this.runStepBuffers?.delete(streamId);
         this.jobStore.clearContentState(streamId);
         this.eventTransport.cleanup(streamId);
@@ -1207,6 +1620,10 @@ class GenerationJobManagerClass {
       }
     }
 
+    if (runningJobsChanged) {
+      this.syncRunningJobMetrics();
+    }
+
     if (count > 0) {
       logger.debug(`[GenerationJobManager] Cleaned up ${count} expired jobs`);
     }
@@ -1295,11 +1712,15 @@ class GenerationJobManagerClass {
     await this.jobStore.destroy();
     this.eventTransport.destroy();
     this.runtimeState.clear();
+    this.runningJobs.clear();
+    this.syncRunningJobMetrics();
     this.runStepBuffers?.clear();
+    this.replayEventWriteQueues.clear();
+    this.tokenUsageWriteQueues.clear();
 
     logger.debug('[GenerationJobManager] Destroyed');
   }
 }
 
-export const GenerationJobManager = new GenerationJobManagerClass();
+export const GenerationJobManager: GenerationJobManagerClass = new GenerationJobManagerClass();
 export { GenerationJobManagerClass };
diff --git a/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts b/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts
new file mode 100644
index 00000000000..c9721efc000
--- /dev/null
+++ b/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts
@@ -0,0 +1,218 @@
+import type { ServerSentEvent } from '~/types';
+import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
+import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
+import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
+
+jest.spyOn(console, 'log').mockImplementation();
+
+function createInMemoryManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new InMemoryJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+class SnapshotReplayJobStore extends InMemoryJobStore {
+  async getJob(streamId: string) {
+    const job = await super.getJob(streamId);
+    return job ? { ...job } : null;
+  }
+
+  async updateJob(streamId: string, updates: Parameters<InMemoryJobStore['updateJob']>[1]) {
+    if (updates.replayEvents) {
+      await new Promise((resolve) => setTimeout(resolve, 5));
+    }
+    await super.updateJob(streamId, updates);
+  }
+}
+
+function createSnapshotReplayManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new SnapshotReplayJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+describe('GenerationJobManager resume replay events', () => {
+  let manager: GenerationJobManagerClass | undefined;
+
+  afterEach(async () => {
+    await manager?.destroy();
+    manager = undefined;
+  });
+
+  test('includes OAuth run step and delta replay events in resume state', async () => {
+    manager = createInMemoryManager();
+    const streamId = `oauth-delta-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const runStepEvent = {
+      event: 'on_run_step',
+      data: {
+        id: 'step-oauth',
+        runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    } satisfies ServerSentEvent;
+    const authEvent = {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    } satisfies ServerSentEvent;
+
+    await manager.emitChunk(streamId, runStepEvent);
+    await manager.emitChunk(streamId, authEvent);
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step',
+      data: {
+        id: 'step-regular',
+        runId: 'response-1',
+        index: 1,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-regular', name: 'regular-tool', args: '{}' }],
+        },
+      },
+    });
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-no-auth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'regular-tool', args: '{}' }],
+        },
+      },
+    });
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toEqual([runStepEvent, authEvent]);
+  });
+
+  test('replaces OAuth replay event for the same step id', async () => {
+    manager = createInMemoryManager();
+    const streamId = `oauth-delta-replace-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/first',
+          expires_at: 1780791946,
+        },
+      },
+    });
+
+    const replacementEvent = {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/latest',
+          expires_at: 1780792000,
+        },
+      },
+    } satisfies ServerSentEvent;
+
+    await manager.emitChunk(streamId, replacementEvent);
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toEqual([replacementEvent]);
+  });
+
+  test('does not replay non-MCP action auth deltas', async () => {
+    manager = createInMemoryManager();
+    const streamId = `action-auth-delta-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-action-auth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'google_calendar_action_api_example_com', args: '' }],
+          auth: 'https://auth.example.com/action',
+          expires_at: 1780791946,
+        },
+      },
+    });
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toBeUndefined();
+  });
+
+  test('serializes replay event updates for concurrent MCP OAuth prompts', async () => {
+    manager = createSnapshotReplayManager();
+    const streamId = `oauth-delta-concurrent-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const createRunStepEvent = (serverName: string, index: number) =>
+      ({
+        event: 'on_run_step',
+        data: {
+          id: `step-oauth-${serverName}`,
+          runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          index,
+          stepDetails: {
+            type: 'tool_calls',
+            tool_calls: [{ id: `call-${serverName}`, name: `oauth_mcp_${serverName}`, args: '' }],
+          },
+        },
+      }) satisfies ServerSentEvent;
+
+    const createAuthEvent = (serverName: string) =>
+      ({
+        event: 'on_run_step_delta',
+        data: {
+          id: `step-oauth-${serverName}`,
+          delta: {
+            type: 'tool_calls',
+            tool_calls: [{ name: `oauth_mcp_${serverName}`, args: '' }],
+            auth: `https://auth.example.com/${serverName}`,
+            expires_at: 1780791946,
+          },
+        },
+      }) satisfies ServerSentEvent;
+
+    const events = [
+      createRunStepEvent('Google-Workspace', 0),
+      createAuthEvent('Google-Workspace'),
+      createRunStepEvent('clickhouse-docs', 1),
+      createAuthEvent('clickhouse-docs'),
+    ];
+
+    await Promise.all(events.map((event) => manager!.emitChunk(streamId, event)));
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toHaveLength(events.length);
+    expect(resumeState?.replayEvents).toEqual(expect.arrayContaining(events));
+  });
+});
diff --git a/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts b/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
index 0c119ab8d2a..3e34d155d5d 100644
--- a/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
+++ b/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
@@ -1,6 +1,11 @@
 /* eslint jest/no-standalone-expect: ["error", { "additionalTestBlockFunctions": ["testRedis"] }] */
 import type { Redis, Cluster } from 'ioredis';
 import type { ServerSentEvent, StreamEvent, CreatedEvent } from '~/types';
+import {
+  ioredisClient as staticRedisClient,
+  keyvRedisClient as staticKeyvClient,
+  keyvRedisClientReady,
+} from '~/cache/redisClients';
 import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
 import { RedisEventTransport } from '~/stream/implementations/RedisEventTransport';
 import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
@@ -8,11 +13,6 @@ import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
 import { RedisJobStore } from '~/stream/implementations/RedisJobStore';
 import { createStreamServices } from '~/stream/createStreamServices';
 import { GenerationJobManager } from '~/stream/GenerationJobManager';
-import {
-  ioredisClient as staticRedisClient,
-  keyvRedisClient as staticKeyvClient,
-  keyvRedisClientReady,
-} from '~/cache/redisClients';
 
 /** Suppress winston Console transport output (survives jest.resetModules) */
 jest.spyOn(console, 'log').mockImplementation();
@@ -404,11 +404,21 @@ describe('GenerationJobManager Integration Tests', () => {
         await GenerationJobManager.updateMetadata(streamId, {
           sender: 'ConsistencyAgent',
           responseMessageId: 'resp-123',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
         });
 
         const updated = await GenerationJobManager.getJob(streamId);
         expect(updated?.metadata?.sender).toBe('ConsistencyAgent');
         expect(updated?.metadata?.responseMessageId).toBe('resp-123');
+        expect(updated?.metadata?.iconURL).toBe('https://example.com/spec-icon.png');
+        expect(updated?.metadata?.model).toBe('gpt-4.1');
+
+        const resumeState = await GenerationJobManager.getResumeState(streamId);
+        expect(resumeState?.sender).toBe('ConsistencyAgent');
+        expect(resumeState?.responseMessageId).toBe('resp-123');
+        expect(resumeState?.iconURL).toBe('https://example.com/spec-icon.png');
+        expect(resumeState?.model).toBe('gpt-4.1');
 
         await GenerationJobManager.completeJob(streamId);
 
@@ -1356,6 +1366,28 @@ describe('GenerationJobManager Integration Tests', () => {
       await manager.destroy();
     });
 
+    test('should include emitted title event in resume state', async () => {
+      const manager = createInMemoryManager();
+      const streamId = `title-resume-${Date.now()}`;
+      await manager.createJob(streamId, 'user-1', streamId);
+
+      const titleEvent = {
+        event: 'title',
+        data: {
+          conversationId: streamId,
+          title: 'Resumed Title',
+        },
+      } satisfies ServerSentEvent;
+
+      await manager.emitChunk(streamId, titleEvent);
+
+      const resumeState = await manager.getResumeState(streamId);
+
+      expect(resumeState?.titleEvent).toEqual(titleEvent);
+
+      await manager.destroy();
+    });
+
     test('should replay buffer by default when no options are passed', async () => {
       const manager = createInMemoryManager();
       const streamId = `replay-buf-${Date.now()}`;
diff --git a/packages/api/src/stream/__tests__/RedisEventTransport.spec.ts b/packages/api/src/stream/__tests__/RedisEventTransport.spec.ts
new file mode 100644
index 00000000000..fa238b6628a
--- /dev/null
+++ b/packages/api/src/stream/__tests__/RedisEventTransport.spec.ts
@@ -0,0 +1,56 @@
+import type { Redis } from 'ioredis';
+import { logger } from '@librechat/data-schemas';
+import { RedisEventTransport } from '~/stream/implementations/RedisEventTransport';
+import { createMockPublisher } from './helpers/publisher';
+
+logger.silent = true;
+
+function createMockSubscriber() {
+  return {
+    on: jest.fn(),
+    subscribe: jest.fn().mockResolvedValue(undefined),
+    unsubscribe: jest.fn().mockResolvedValue(undefined),
+  };
+}
+
+function getMessageHandler(mockSubscriber: ReturnType<typeof createMockSubscriber>) {
+  return mockSubscriber.on.mock.calls.find((call) => call[0] === 'message')?.[1] as (
+    channel: string,
+    message: string,
+  ) => void;
+}
+
+describe('RedisEventTransport', () => {
+  it('resets stale abort-listener reorder state before the next real subscriber', async () => {
+    const mockPublisher = createMockPublisher();
+    const mockSubscriber = createMockSubscriber();
+    const transport = new RedisEventTransport(
+      mockPublisher as unknown as Redis,
+      mockSubscriber as unknown as Redis,
+    );
+
+    const streamId = 'reorder-abort-listener-reuse-test';
+    transport.onAbort(streamId, () => {});
+
+    const messageHandler = getMessageHandler(mockSubscriber);
+    const channel = `stream:{${streamId}}:events`;
+
+    for (let i = 0; i < 5; i++) {
+      await transport.emitChunk(streamId, { index: i });
+      messageHandler(channel, JSON.stringify({ type: 'chunk', seq: i, data: { index: i } }));
+    }
+
+    await mockPublisher.del(`stream:{${streamId}}:seq`);
+
+    const secondRunChunks: unknown[] = [];
+    transport.subscribe(streamId, {
+      onChunk: (event) => secondRunChunks.push(event),
+    });
+
+    messageHandler(channel, JSON.stringify({ type: 'chunk', seq: 0, data: { index: 0 } }));
+
+    expect(secondRunChunks.map((chunk) => (chunk as { index: number }).index)).toEqual([0]);
+
+    transport.destroy();
+  });
+});
diff --git a/packages/api/src/stream/__tests__/collectedUsage.spec.ts b/packages/api/src/stream/__tests__/collectedUsage.spec.ts
index 635eba3aa43..30f70c2090a 100644
--- a/packages/api/src/stream/__tests__/collectedUsage.spec.ts
+++ b/packages/api/src/stream/__tests__/collectedUsage.spec.ts
@@ -282,6 +282,188 @@ describe('AbortJob - Text and CollectedUsage', () => {
     await GenerationJobManager.destroy();
   });
 
+  it('should treat OAuth-only content as an early abort', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([]);
+    expect(abortResult.text).toBe('');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: true,
+        responseMessage: null,
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
+  it('should keep post-created OAuth-only aborts tied to the created turn', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `created-oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+    await GenerationJobManager.updateMetadata(streamId, {
+      responseMessageId: 'response-message-1',
+      endpoint: 'agents',
+      iconURL: 'https://example.com/spec-icon.png',
+      model: 'gpt-4.1',
+      userMessage: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+      },
+    });
+    await GenerationJobManager.emitChunk(streamId, {
+      created: true,
+      streamId,
+      message: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+        sender: 'User',
+        isCreatedByUser: true,
+      },
+    });
+
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([]);
+    expect(abortResult.text).toBe('');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: false,
+        conversation: { conversationId: streamId },
+        requestMessage: expect.objectContaining({
+          messageId: 'user-message-1',
+        }),
+        responseMessage: expect.objectContaining({
+          messageId: 'response-message-1',
+          content: [],
+          endpoint: 'agents',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
+        }),
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
+  it('should strip OAuth prompts but persist real abort content', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `mixed-oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+    await GenerationJobManager.updateMetadata(streamId, {
+      responseMessageId: 'response-message-1',
+      userMessage: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+      },
+    });
+
+    const textPart = { type: 'text', text: 'Partial response...' };
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+      textPart,
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([textPart]);
+    expect(abortResult.text).toBe('Partial response...');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: false,
+        responseMessage: expect.objectContaining({
+          content: [textPart],
+        }),
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
   it('should return both text and collectedUsage on abort', async () => {
     const { GenerationJobManager } = await import('../GenerationJobManager');
     const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
diff --git a/packages/api/src/stream/__tests__/reconnect-reorder-desync.stream_integration.spec.ts b/packages/api/src/stream/__tests__/reconnect-reorder-desync.stream_integration.spec.ts
index 6f7ad2f6eb0..2f363d049b8 100644
--- a/packages/api/src/stream/__tests__/reconnect-reorder-desync.stream_integration.spec.ts
+++ b/packages/api/src/stream/__tests__/reconnect-reorder-desync.stream_integration.spec.ts
@@ -234,6 +234,60 @@ describe('Reconnect Reorder Buffer Desync (Regression)', () => {
       sub.unsubscribe();
       transport.destroy();
     });
+
+    test('should not carry nextSeq into a new generation after last unsubscribe', async () => {
+      const mockPublisher = createMockPublisher();
+      const mockSubscriber = {
+        on: jest.fn(),
+        subscribe: jest.fn().mockResolvedValue(undefined),
+        unsubscribe: jest.fn().mockResolvedValue(undefined),
+      };
+
+      const transport = new RedisEventTransport(
+        mockPublisher as unknown as Redis,
+        mockSubscriber as unknown as Redis,
+      );
+
+      const streamId = 'reorder-generation-reuse-test';
+      const firstRunChunks: unknown[] = [];
+
+      const firstSub = transport.subscribe(streamId, {
+        onChunk: (event) => firstRunChunks.push(event),
+      });
+
+      await transport.syncReorderBuffer(streamId);
+
+      const messageHandler = mockSubscriber.on.mock.calls.find(
+        (call) => call[0] === 'message',
+      )?.[1] as (channel: string, message: string) => void;
+      const channel = `stream:{${streamId}}:events`;
+
+      for (let i = 0; i < 5; i++) {
+        await transport.emitChunk(streamId, { index: i });
+        messageHandler(channel, JSON.stringify({ type: 'chunk', seq: i, data: { index: i } }));
+      }
+
+      expect(firstRunChunks.map((c) => (c as { index: number }).index)).toEqual([0, 1, 2, 3, 4]);
+
+      firstSub.unsubscribe();
+
+      // Simulate another replica cleaning up the shared Redis sequence key
+      // before this replica's local preserved stream state is garbage-collected.
+      await mockPublisher.del(`stream:{${streamId}}:seq`);
+
+      const secondRunChunks: unknown[] = [];
+      transport.subscribe(streamId, {
+        onChunk: (event) => secondRunChunks.push(event),
+      });
+
+      await transport.syncReorderBuffer(streamId);
+
+      messageHandler(channel, JSON.stringify({ type: 'chunk', seq: 0, data: { index: 0 } }));
+
+      expect(secondRunChunks.map((c) => (c as { index: number }).index)).toEqual([0]);
+
+      transport.destroy();
+    });
   });
 
   describe('syncReorderBuffer race: message arrives during async GET window (Unit)', () => {
diff --git a/packages/api/src/stream/__tests__/staleJobReaping.spec.ts b/packages/api/src/stream/__tests__/staleJobReaping.spec.ts
new file mode 100644
index 00000000000..003162af437
--- /dev/null
+++ b/packages/api/src/stream/__tests__/staleJobReaping.spec.ts
@@ -0,0 +1,220 @@
+/**
+ * Tests for the stale running-job failsafe that prevents abandoned/hung
+ * generations from leaking their content state in memory until the process OOMs.
+ *
+ * - InMemoryJobStore reaps jobs stuck in "running" past `staleJobTimeout`
+ *   (mirrors RedisJobStore's running-job TTL).
+ * - GenerationJobManager aborts the in-flight generation when its job is reaped
+ *   or replaced, so client/graph references can be garbage collected.
+ *
+ * @see https://github.com/danny-avila/LibreChat/issues/13391
+ */
+
+/** Suppress winston Console transport output (survives jest.resetModules) */
+jest.spyOn(console, 'log').mockImplementation();
+
+describe('InMemoryJobStore - stale running-job failsafe', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('reaps a running job older than staleJobTimeout', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ ttlAfterComplete: 0, staleJobTimeout: 1000 });
+    await store.initialize();
+
+    await store.createJob('s1', 'u1', 's1');
+    await store.updateJob('s1', { createdAt: Date.now() - 5000 });
+
+    const removed = await store.cleanup();
+
+    expect(removed).toBe(1);
+    expect(await store.hasJob('s1')).toBe(false);
+
+    await store.destroy();
+  });
+
+  it('does not reap a running job with recent activity even if created long ago', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ staleJobTimeout: 1000 });
+    await store.initialize();
+
+    await store.createJob('s1', 'u1', 's1');
+    await store.updateJob('s1', { createdAt: Date.now() - 5000 });
+    // Actively streaming: a long but live generation must not be reaped.
+    store.recordActivity('s1');
+
+    const removed = await store.cleanup();
+
+    expect(removed).toBe(0);
+    expect(await store.hasJob('s1')).toBe(true);
+
+    await store.destroy();
+  });
+
+  it('does not reap a replacement job that reuses a stale stream id', async () => {
+    jest.useFakeTimers();
+    try {
+      const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+      const store = new InMemoryJobStore({ ttlAfterComplete: 0, staleJobTimeout: 1000 });
+      await store.initialize();
+
+      await store.createJob('s1', 'u1', 's1');
+      store.recordActivity('s1'); // old generation's activity
+      await jest.advanceTimersByTimeAsync(5000); // ...goes stale
+
+      // Replacement reuses the same streamId (old job never terminated).
+      await store.createJob('s1', 'u1', 's1');
+      const removed = await store.cleanup();
+
+      expect(removed).toBe(0); // fresh replacement must not be reaped immediately
+      expect(await store.hasJob('s1')).toBe(true);
+
+      await store.destroy();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('does not reap a running job within the staleJobTimeout', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ staleJobTimeout: 60000 });
+    await store.initialize();
+
+    await store.createJob('s1', 'u1', 's1');
+
+    const removed = await store.cleanup();
+
+    expect(removed).toBe(0);
+    expect(await store.hasJob('s1')).toBe(true);
+
+    await store.destroy();
+  });
+
+  it('treats staleJobTimeout=0 as disabling the running-job failsafe', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ staleJobTimeout: 0 });
+    await store.initialize();
+
+    await store.createJob('s1', 'u1', 's1');
+    await store.updateJob('s1', { createdAt: Date.now() - 3_600_000 });
+
+    const removed = await store.cleanup();
+
+    expect(removed).toBe(0);
+    expect(await store.hasJob('s1')).toBe(true);
+
+    await store.destroy();
+  });
+
+  it('removes per-user tracking when reaping a stale running job', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ staleJobTimeout: 1000 });
+    await store.initialize();
+
+    await store.createJob('s1', 'u1', 's1');
+    expect(await store.getActiveJobIdsByUser('u1')).toEqual(['s1']);
+
+    await store.updateJob('s1', { createdAt: Date.now() - 5000 });
+    await store.cleanup();
+
+    expect(await store.getActiveJobIdsByUser('u1')).toEqual([]);
+    expect(await store.getJobCount()).toBe(0);
+
+    await store.destroy();
+  });
+
+  it('reaps terminal jobs while leaving fresh running jobs intact', async () => {
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const store = new InMemoryJobStore({ ttlAfterComplete: 0, staleJobTimeout: 60000 });
+    await store.initialize();
+
+    await store.createJob('done', 'u1', 'done');
+    await store.updateJob('done', { status: 'complete', completedAt: Date.now() });
+    await store.createJob('live', 'u1', 'live');
+
+    const removed = await store.cleanup();
+
+    expect(removed).toBe(1);
+    expect(await store.hasJob('done')).toBe(false);
+    expect(await store.hasJob('live')).toBe(true);
+
+    await store.destroy();
+  });
+});
+
+describe('GenerationJobManager - generation abort on reaping', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('aborts and cleans up a hung running job once the store reaps it', async () => {
+    const { GenerationJobManagerClass } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    jest.useFakeTimers();
+    try {
+      const manager = new GenerationJobManagerClass();
+      manager.configure({
+        jobStore: new InMemoryJobStore({ ttlAfterComplete: 0, staleJobTimeout: 1000 }),
+        eventTransport: new InMemoryEventTransport(),
+        isRedis: false,
+      });
+      manager.initialize();
+
+      const job = await manager.createJob('conv-2', 'user-1', 'conv-2');
+      expect(await manager.hasJob('conv-2')).toBe(true);
+      expect(job.abortController.signal.aborted).toBe(false);
+
+      // Advance past the stale timeout + the 60s cleanup interval.
+      await jest.advanceTimersByTimeAsync(61000);
+
+      expect(job.abortController.signal.aborted).toBe(true);
+      expect(await manager.hasJob('conv-2')).toBe(false);
+      expect(manager.getRuntimeStats().runtimeStateSize).toBe(0);
+      expect(manager.getRuntimeStats().eventTransportStreams).toBe(0);
+
+      await manager.destroy();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  it('sends a terminal error to a still-connected client when its job is reaped', async () => {
+    const { GenerationJobManagerClass } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    jest.useFakeTimers();
+    try {
+      const manager = new GenerationJobManagerClass();
+      manager.configure({
+        jobStore: new InMemoryJobStore({ ttlAfterComplete: 0, staleJobTimeout: 1000 }),
+        eventTransport: new InMemoryEventTransport(),
+        isRedis: false,
+      });
+      manager.initialize();
+
+      await manager.createJob('conv-3', 'user-1', 'conv-3');
+      const errors: string[] = [];
+      const subscription = await manager.subscribe(
+        'conv-3',
+        () => undefined,
+        () => undefined,
+        (error) => errors.push(error),
+      );
+
+      // Hung generation: no chunks emitted; advance past the stale timeout + cleanup tick.
+      await jest.advanceTimersByTimeAsync(61000);
+
+      expect(errors).toContain('Generation timed out');
+      expect(await manager.hasJob('conv-3')).toBe(false);
+
+      subscription?.unsubscribe();
+      await manager.destroy();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});
diff --git a/packages/api/src/stream/__tests__/usageResume.spec.ts b/packages/api/src/stream/__tests__/usageResume.spec.ts
new file mode 100644
index 00000000000..59564730f9c
--- /dev/null
+++ b/packages/api/src/stream/__tests__/usageResume.spec.ts
@@ -0,0 +1,96 @@
+import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
+import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
+import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
+
+jest.spyOn(console, 'log').mockImplementation();
+
+function createInMemoryManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new InMemoryJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+describe('GenerationJobManager usage resume state', () => {
+  let manager: GenerationJobManagerClass | undefined;
+
+  afterEach(async () => {
+    await manager?.destroy();
+    manager = undefined;
+  });
+
+  test('accumulates persisted token usage events in resume state', async () => {
+    manager = createInMemoryManager();
+    const streamId = `usage-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const firstUsage = {
+      input_tokens: 1200,
+      output_tokens: 300,
+      input_token_details: { cache_creation: 100, cache_read: 800 },
+      model: 'claude-3-5-sonnet',
+      provider: 'anthropic',
+    };
+    const secondUsage = {
+      input_tokens: 1600,
+      output_tokens: 120,
+      model: 'claude-3-5-sonnet',
+      provider: 'anthropic',
+      usage_type: 'summarization',
+    };
+
+    await manager.emitChunk(streamId, { event: 'on_token_usage', data: firstUsage });
+    await manager.emitChunk(streamId, { event: 'on_token_usage', data: secondUsage });
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.collectedUsage).toEqual([firstUsage, secondUsage]);
+  });
+
+  test('omits collected usage when none was recorded', async () => {
+    manager = createInMemoryManager();
+    const streamId = `usage-resume-empty-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.collectedUsage).toBeUndefined();
+    expect(resumeState?.contextUsage).toBeUndefined();
+  });
+
+  test('persists the latest context usage snapshot for resume', async () => {
+    manager = createInMemoryManager();
+    const streamId = `context-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const makeSnapshot = (messageTokens: number) => ({
+      runId: 'run-1',
+      agentId: 'agent-1',
+      breakdown: {
+        maxContextTokens: 200000,
+        instructionTokens: 1500,
+        systemMessageTokens: 1000,
+        dynamicInstructionTokens: 0,
+        toolSchemaTokens: 500,
+        summaryTokens: 0,
+        toolCount: 3,
+        messageCount: 4,
+        messageTokens,
+        availableForMessages: 188500,
+      },
+      contextBudget: 190000,
+      effectiveInstructionTokens: 1500,
+      prePruneContextTokens: messageTokens,
+      remainingContextTokens: 190000 - 1500 - messageTokens,
+      calibrationRatio: 1.05,
+    });
+
+    await manager.emitChunk(streamId, { event: 'on_context_usage', data: makeSnapshot(4000) });
+    await manager.emitChunk(streamId, { event: 'on_context_usage', data: makeSnapshot(9000) });
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.contextUsage).toEqual(makeSnapshot(9000));
+  });
+});
diff --git a/packages/api/src/stream/abortContent.ts b/packages/api/src/stream/abortContent.ts
new file mode 100644
index 00000000000..a9177a9ff81
--- /dev/null
+++ b/packages/api/src/stream/abortContent.ts
@@ -0,0 +1,80 @@
+import { Constants, ContentTypes } from 'librechat-data-provider';
+import type { Agents, TMessageContentParts } from 'librechat-data-provider';
+
+const OAUTH_TOOL_CALL_PREFIX = `oauth${Constants.mcp_delimiter}`;
+
+type PersistableAbortContentPart = Agents.MessageContentComplex | TMessageContentParts;
+type AbortContentPart = PersistableAbortContentPart | null | undefined;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object';
+}
+
+function getTextValue(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (isRecord(value) && typeof value.value === 'string') {
+    return value.value;
+  }
+  return '';
+}
+
+function getToolCall(part: Record<string, unknown>): Record<string, unknown> | null {
+  if (isRecord(part.tool_call)) {
+    return part.tool_call;
+  }
+
+  const keyedToolCall = part[ContentTypes.TOOL_CALL];
+  return isRecord(keyedToolCall) ? keyedToolCall : null;
+}
+
+function isOAuthPromptContentPart(part: AbortContentPart): boolean {
+  if (!isRecord(part) || part.type !== ContentTypes.TOOL_CALL) {
+    return false;
+  }
+
+  const partRecord = part as Record<string, unknown>;
+  const toolCall = getToolCall(partRecord);
+  if (!toolCall) {
+    return false;
+  }
+
+  const auth = typeof toolCall.auth === 'string' ? toolCall.auth : partRecord.auth;
+  if (typeof auth === 'string' && auth.trim().length > 0) {
+    return true;
+  }
+
+  const name = toolCall.name;
+  return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+}
+
+function isPersistableAbortContentPart(
+  part: AbortContentPart,
+): part is PersistableAbortContentPart {
+  if (!isRecord(part)) {
+    return false;
+  }
+
+  if (isOAuthPromptContentPart(part)) {
+    return false;
+  }
+
+  if (part.type === ContentTypes.TEXT) {
+    return getTextValue(part.text).trim().length > 0;
+  }
+
+  if (part.type === ContentTypes.THINK) {
+    return getTextValue(part.think).trim().length > 0;
+  }
+
+  return Object.keys(part).length > 0;
+}
+
+export function hasPersistableAbortContent(content: unknown): boolean {
+  return filterPersistableAbortContent(content).length > 0;
+}
+
+export function filterPersistableAbortContent(content: unknown): PersistableAbortContentPart[] {
+  return Array.isArray(content) ? content.filter(isPersistableAbortContentPart) : [];
+}
diff --git a/packages/api/src/stream/createStreamServices.ts b/packages/api/src/stream/createStreamServices.ts
index ebf3055f8da..11fd5352750 100644
--- a/packages/api/src/stream/createStreamServices.ts
+++ b/packages/api/src/stream/createStreamServices.ts
@@ -34,6 +34,7 @@ export interface StreamServicesConfig {
   inMemoryOptions?: {
     ttlAfterComplete?: number;
     maxJobs?: number;
+    staleJobTimeout?: number;
   };
 }
 
@@ -119,6 +120,8 @@ function createInMemoryServices(options?: StreamServicesConfig['inMemoryOptions'
   const jobStore = new InMemoryJobStore({
     ttlAfterComplete: options?.ttlAfterComplete ?? 300000, // 5 minutes
     maxJobs: options?.maxJobs ?? 1000,
+    // Failsafe for crashed/hung generations (mirrors RedisJobStore's running-job TTL).
+    staleJobTimeout: options?.staleJobTimeout ?? 1_200_000, // 20 minutes
   });
 
   const eventTransport = new InMemoryEventTransport();
diff --git a/packages/api/src/stream/implementations/InMemoryJobStore.ts b/packages/api/src/stream/implementations/InMemoryJobStore.ts
index 7280c3ce800..f318f3baf5d 100644
--- a/packages/api/src/stream/implementations/InMemoryJobStore.ts
+++ b/packages/api/src/stream/implementations/InMemoryJobStore.ts
@@ -35,19 +35,38 @@ export class InMemoryJobStore implements IJobStore {
   /** Maps userId -> Set of streamIds (conversationIds) for active jobs */
   private userJobMap = new Map<string, Set<string>>();
 
+  /**
+   * Maps streamId -> last generation-activity timestamp. Refreshed via
+   * recordActivity() on each emitted chunk so the stale-job failsafe reaps on
+   * inactivity (a hung generation) rather than age (a long but live stream).
+   */
+  private lastActivity = new Map<string, number>();
+
   /** Time to keep completed jobs before cleanup (0 = immediate) */
   private ttlAfterComplete = 0;
 
   /** Maximum number of concurrent jobs */
   private maxJobs = 1000;
 
-  constructor(options?: { ttlAfterComplete?: number; maxJobs?: number }) {
+  /**
+   * Failsafe timeout (ms) for jobs stuck in "running" status. Mirrors
+   * RedisJobStore's running-job TTL: a crashed or hung generation that never
+   * reaches a terminal state would otherwise retain its content state forever,
+   * leaking the full message context until the process runs out of memory.
+   * 0 disables the failsafe. Default: 20 minutes.
+   */
+  private staleJobTimeout = 1_200_000;
+
+  constructor(options?: { ttlAfterComplete?: number; maxJobs?: number; staleJobTimeout?: number }) {
     if (options?.ttlAfterComplete) {
       this.ttlAfterComplete = options.ttlAfterComplete;
     }
     if (options?.maxJobs) {
       this.maxJobs = options.maxJobs;
     }
+    if (options?.staleJobTimeout !== undefined) {
+      this.staleJobTimeout = options.staleJobTimeout;
+    }
   }
 
   async initialize(): Promise<void> {
@@ -87,6 +106,10 @@ export class InMemoryJobStore implements IJobStore {
     };
 
     this.jobs.set(streamId, job);
+    // Clear any prior activity timestamp so a replacement reusing this streamId
+    // (the controller handles job replacement) falls back to the fresh createdAt
+    // and isn't reaped on the previous generation's stale last-activity time.
+    this.lastActivity.delete(streamId);
 
     // Track job by userId (tenant-qualified when available) for efficient user-scoped queries
     const userKey = tenantId ? `${tenantId}:${userId}` : userId;
@@ -117,9 +140,21 @@ export class InMemoryJobStore implements IJobStore {
   async deleteJob(streamId: string): Promise<void> {
     this.jobs.delete(streamId);
     this.contentState.delete(streamId);
+    this.lastActivity.delete(streamId);
     logger.debug(`[InMemoryJobStore] Deleted job: ${streamId}`);
   }
 
+  /**
+   * Refresh a job's last-activity timestamp (called on each emitted chunk) so the
+   * stale-job failsafe in cleanup() reaps on inactivity rather than total age,
+   * mirroring RedisJobStore refreshing the running TTL on each appendChunk.
+   */
+  recordActivity(streamId: string): void {
+    if (this.jobs.has(streamId)) {
+      this.lastActivity.set(streamId, Date.now());
+    }
+  }
+
   async hasJob(streamId: string): Promise<boolean> {
     return this.jobs.has(streamId);
   }
@@ -137,6 +172,7 @@ export class InMemoryJobStore implements IJobStore {
   async cleanup(): Promise<number> {
     const now = Date.now();
     const toDelete: string[] = [];
+    let staleRunning = 0;
 
     for (const [streamId, job] of this.jobs) {
       const isFinished = ['complete', 'error', 'aborted'].includes(job.status);
@@ -145,6 +181,18 @@ export class InMemoryJobStore implements IJobStore {
         if (this.ttlAfterComplete === 0 || now - job.completedAt > this.ttlAfterComplete) {
           toDelete.push(streamId);
         }
+      } else if (this.staleJobTimeout > 0 && job.status === 'running') {
+        // Failsafe: reap jobs stuck in "running" with no generation activity for
+        // longer than the stale timeout. These are crashed/hung generations that
+        // never reached a terminal state; without this they accumulate their
+        // content state in memory until the process OOMs. Reaping keys off last
+        // activity (not creation time) so a long but live stream is never reaped,
+        // mirroring RedisJobStore refreshing the running TTL on each chunk.
+        const lastActive = this.lastActivity.get(streamId) ?? job.createdAt;
+        if (now - lastActive > this.staleJobTimeout) {
+          toDelete.push(streamId);
+          staleRunning++;
+        }
       }
     }
 
@@ -163,6 +211,12 @@ export class InMemoryJobStore implements IJobStore {
       await this.deleteJob(id);
     }
 
+    if (staleRunning > 0) {
+      logger.warn(
+        `[InMemoryJobStore] Reaped ${staleRunning} stale running job(s) exceeding ${this.staleJobTimeout}ms (likely crashed/hung generations)`,
+      );
+    }
+
     if (toDelete.length > 0) {
       logger.debug(`[InMemoryJobStore] Cleaned up ${toDelete.length} expired jobs`);
     }
diff --git a/packages/api/src/stream/implementations/RedisEventTransport.ts b/packages/api/src/stream/implementations/RedisEventTransport.ts
index 73c82aa0119..43a573f1e8d 100644
--- a/packages/api/src/stream/implementations/RedisEventTransport.ts
+++ b/packages/api/src/stream/implementations/RedisEventTransport.ts
@@ -439,6 +439,12 @@ export class RedisEventTransport implements IEventTransport {
     }
 
     const streamState = this.streams.get(streamId)!;
+    // Internal listeners (for example cross-replica abort) can leave ordering
+    // state behind with no real SSE subscribers. A new subscriber is a fresh
+    // attachment and must not inherit that prior generation's expected seq.
+    if (streamState.count === 0) {
+      this.resetReorderBuffer(streamId);
+    }
     streamState.count++;
     streamState.handlers.set(subscriberId, handlers);
 
@@ -470,12 +476,13 @@ export class RedisEventTransport implements IEventTransport {
 
         // If last subscriber left, unsubscribe from Redis and notify
         if (state.count === 0) {
-          // Clear any pending flush timeout and buffered messages
-          if (state.reorderBuffer.flushTimeout) {
-            clearTimeout(state.reorderBuffer.flushTimeout);
-            state.reorderBuffer.flushTimeout = null;
-          }
-          state.reorderBuffer.pending.clear();
+          /**
+           * Preserve callbacks for reconnect, but drop ordering state from the
+           * previous attachment. Reconnects always call syncReorderBuffer(), so
+           * keeping nextSeq here only risks poisoning a later generation when
+           * the shared Redis sequence key has already been reset elsewhere.
+           */
+          this.resetReorderBuffer(streamId);
 
           this.subscriber.unsubscribe(channel).catch((err) => {
             logger.error(`[RedisEventTransport] Failed to unsubscribe from ${channel}:`, err);
diff --git a/packages/api/src/stream/implementations/RedisJobStore.ts b/packages/api/src/stream/implementations/RedisJobStore.ts
index f2c4dd46618..a00eeba6b41 100644
--- a/packages/api/src/stream/implementations/RedisJobStore.ts
+++ b/packages/api/src/stream/implementations/RedisJobStore.ts
@@ -913,6 +913,7 @@ export class RedisJobStore implements IJobStore {
       error: data.error || undefined,
       userMessage: data.userMessage ? JSON.parse(data.userMessage) : undefined,
       responseMessageId: data.responseMessageId || undefined,
+      createdEventEmitted: data.createdEventEmitted === '1',
       sender: data.sender || undefined,
       syncSent: data.syncSent === '1',
       finalEvent: data.finalEvent || undefined,
@@ -920,6 +921,10 @@ export class RedisJobStore implements IJobStore {
       iconURL: data.iconURL || undefined,
       model: data.model || undefined,
       promptTokens: data.promptTokens ? parseInt(data.promptTokens, 10) : undefined,
+      titleEvent: data.titleEvent || undefined,
+      replayEvents: data.replayEvents || undefined,
+      contextUsage: data.contextUsage || undefined,
+      tokenUsage: data.tokenUsage || undefined,
     };
   }
 }
diff --git a/packages/api/src/stream/index.ts b/packages/api/src/stream/index.ts
index 74c13a2bf01..708a94c3d49 100644
--- a/packages/api/src/stream/index.ts
+++ b/packages/api/src/stream/index.ts
@@ -15,6 +15,7 @@ export type {
 
 export { createStreamServices } from './createStreamServices';
 export type { StreamServicesConfig, StreamServices } from './createStreamServices';
+export { filterPersistableAbortContent, hasPersistableAbortContent } from './abortContent';
 
 // Implementations (for advanced use cases)
 export { InMemoryJobStore } from './implementations/InMemoryJobStore';
diff --git a/packages/api/src/stream/interfaces/IJobStore.ts b/packages/api/src/stream/interfaces/IJobStore.ts
index afd6ac68a07..f2e905e4fa7 100644
--- a/packages/api/src/stream/interfaces/IJobStore.ts
+++ b/packages/api/src/stream/interfaces/IJobStore.ts
@@ -1,5 +1,5 @@
-import type { Agents } from 'librechat-data-provider';
 import type { StandardGraph } from '@librechat/agents';
+import type { Agents } from 'librechat-data-provider';
 
 /**
  * Job status enum
@@ -25,11 +25,17 @@ export interface SerializableJobData {
     parentMessageId?: string;
     conversationId?: string;
     text?: string;
+    /** Quoted excerpts referenced on this turn, carried so resumable/aborted
+     *  reconstructions of the user message keep their `MessageQuotes`. */
+    quotes?: string[];
   };
 
   /** Response message ID for reconnection */
   responseMessageId?: string;
 
+  /** Whether the user-message created event has been emitted */
+  createdEventEmitted?: boolean;
+
   /** Sender name for UI display */
   sender?: string;
 
@@ -39,6 +45,18 @@ export interface SerializableJobData {
   /** Serialized final event for replay */
   finalEvent?: string;
 
+  /** Serialized title event for replay during active-stream resume */
+  titleEvent?: string;
+
+  /** Serialized replay-only stream events for active-stream resume */
+  replayEvents?: string;
+
+  /** Serialized latest context usage snapshot for active-stream resume */
+  contextUsage?: string;
+
+  /** Serialized token usage events for active-stream resume (cross-replica safe) */
+  tokenUsage?: string;
+
   /** Endpoint metadata for abort handling - avoids storing functions */
   endpoint?: string;
   iconURL?: string;
@@ -67,7 +85,7 @@ export interface SerializableJobData {
  */
 export interface UsageMetadata {
   /** Logical usage bucket for accounting/reporting. Defaults to model response usage. */
-  usage_type?: 'message' | 'summarization';
+  usage_type?: 'message' | 'summarization' | 'subagent' | 'sequential';
   /** Total input tokens (prompt tokens) */
   input_tokens?: number;
   /** Total output tokens (completion tokens) */
@@ -78,6 +96,9 @@ export interface UsageMetadata {
   model?: string;
   /** Provider identifier that generated this usage */
   provider?: string;
+  /** Agent that produced this usage (graph agent id / subagent agent id). Lets
+   *  multi-endpoint graphs price each call with its own endpoint token config. */
+  agentId?: string;
   /**
    * OpenAI-style cache token details.
    * Present for OpenAI models (GPT-4, o1, etc.)
@@ -139,6 +160,20 @@ export interface ResumeState {
   responseMessageId?: string;
   conversationId?: string;
   sender?: string;
+  iconURL?: string;
+  model?: string;
+  titleEvent?: {
+    event: 'title';
+    data?: {
+      conversationId?: string;
+      title?: string;
+    };
+  };
+  replayEvents?: Array<{
+    event: string;
+    data?: unknown;
+    [key: string]: unknown;
+  }>;
 }
 
 /**
@@ -181,6 +216,18 @@ export interface IJobStore {
   /** Cleanup expired jobs */
   cleanup(): Promise<number>;
 
+  /**
+   * Record generation activity for a job (e.g. a chunk was emitted), refreshing
+   * its "last active" timestamp so the stale-running-job failsafe does not reap a
+   * stream that is still producing output.
+   *
+   * In-memory: updates an internal last-activity timestamp used by cleanup().
+   * Redis: no-op — the running-job TTL is already refreshed on each appendChunk.
+   *
+   * @param streamId - The stream identifier
+   */
+  recordActivity?(streamId: string): void;
+
   /** Get total job count */
   getJobCount(): Promise<number>;
 
diff --git a/packages/api/src/telemetry.ts b/packages/api/src/telemetry.ts
new file mode 100644
index 00000000000..c75db96f117
--- /dev/null
+++ b/packages/api/src/telemetry.ts
@@ -0,0 +1,6 @@
+/**
+ * Build entry shim for the `@librechat/api/telemetry` subpath export.
+ * Re-exports the telemetry barrel under a unique basename so the bundler emits
+ * stable `dist/telemetry.*` output (see tsdown.config.mjs for details).
+ */
+export * from './telemetry/index';
diff --git a/packages/api/src/telemetry/config.spec.ts b/packages/api/src/telemetry/config.spec.ts
new file mode 100644
index 00000000000..2e87f9cb800
--- /dev/null
+++ b/packages/api/src/telemetry/config.spec.ts
@@ -0,0 +1,55 @@
+import { getTelemetryConfig } from './config';
+
+describe('getTelemetryConfig', () => {
+  it('defaults tracing off', () => {
+    const config = getTelemetryConfig({});
+
+    expect(config.enabled).toBe(false);
+    expect(config.sdkDisabled).toBe(false);
+    expect(config.serviceName).toBe('librechat');
+    expect(config.healthPath).toBe('/health');
+    expect(config.ioredisTracingEnabled).toBe(false);
+  });
+
+  it('enables tracing only when OTEL_TRACING_ENABLED is true', () => {
+    expect(getTelemetryConfig({ OTEL_TRACING_ENABLED: 'true' }).enabled).toBe(true);
+    expect(getTelemetryConfig({ OTEL_TRACING_ENABLED: 'TRUE' }).enabled).toBe(true);
+    expect(getTelemetryConfig({ OTEL_TRACING_ENABLED: 'false' }).enabled).toBe(false);
+  });
+
+  it('lets OTEL_SDK_DISABLED override tracing enablement', () => {
+    const config = getTelemetryConfig({
+      OTEL_SDK_DISABLED: 'true',
+      OTEL_TRACING_ENABLED: 'true',
+    });
+
+    expect(config.enabled).toBe(false);
+    expect(config.sdkDisabled).toBe(true);
+  });
+
+  it('uses standard service env vars when provided', () => {
+    const config = getTelemetryConfig({
+      OTEL_SERVICE_NAME: ' librechat-api ',
+      OTEL_SERVICE_VERSION: ' 1.2.3 ',
+    });
+
+    expect(config.serviceName).toBe('librechat-api');
+    expect(config.serviceVersion).toBe('1.2.3');
+  });
+
+  it('falls back to npm package version when service version is absent', () => {
+    const config = getTelemetryConfig({
+      npm_package_version: '0.8.5',
+    });
+
+    expect(config.serviceVersion).toBe('0.8.5');
+  });
+
+  it('enables ioredis instrumentation only when explicitly configured', () => {
+    const config = getTelemetryConfig({
+      OTEL_IOREDIS_TRACING_ENABLED: 'true',
+    });
+
+    expect(config.ioredisTracingEnabled).toBe(true);
+  });
+});
diff --git a/packages/api/src/telemetry/config.ts b/packages/api/src/telemetry/config.ts
new file mode 100644
index 00000000000..4848bf3be30
--- /dev/null
+++ b/packages/api/src/telemetry/config.ts
@@ -0,0 +1,46 @@
+const DEFAULT_SERVICE_NAME = 'librechat';
+export const DEFAULT_HEALTH_PATH = '/health';
+
+export type TelemetryStatus = 'disabled' | 'failed' | 'started' | 'starting' | 'stopped';
+
+export interface TelemetryConfig {
+  enabled: boolean;
+  healthPath: string;
+  ioredisTracingEnabled: boolean;
+  sdkDisabled: boolean;
+  serviceName: string;
+  serviceVersion?: string;
+}
+
+function isTruthy(value?: string | boolean | null): boolean {
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  if (typeof value === 'string') {
+    return value.trim().toLowerCase() === 'true';
+  }
+  return false;
+}
+
+function normalizeEnvValue(value?: string): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+export function getTelemetryConfig(env: NodeJS.ProcessEnv = process.env): TelemetryConfig {
+  const sdkDisabled = isTruthy(env.OTEL_SDK_DISABLED);
+  const enabled = isTruthy(env.OTEL_TRACING_ENABLED) && !sdkDisabled;
+  const serviceName = normalizeEnvValue(env.OTEL_SERVICE_NAME) ?? DEFAULT_SERVICE_NAME;
+  const serviceVersion =
+    normalizeEnvValue(env.OTEL_SERVICE_VERSION) ?? normalizeEnvValue(env.npm_package_version);
+  const ioredisTracingEnabled = isTruthy(env.OTEL_IOREDIS_TRACING_ENABLED);
+
+  return {
+    enabled,
+    serviceName,
+    ioredisTracingEnabled,
+    sdkDisabled,
+    serviceVersion,
+    healthPath: DEFAULT_HEALTH_PATH,
+  };
+}
diff --git a/packages/api/src/telemetry/index.ts b/packages/api/src/telemetry/index.ts
new file mode 100644
index 00000000000..104d8c9b5e5
--- /dev/null
+++ b/packages/api/src/telemetry/index.ts
@@ -0,0 +1,7 @@
+export { getTelemetryConfig } from './config';
+export { initializeTelemetry, shutdownTelemetry } from './sdk';
+export { telemetryErrorMiddleware, telemetryMiddleware } from './middleware';
+export { createSseStreamTelemetry } from './stream';
+export type { SseStreamTelemetry } from './stream';
+export type { TelemetryConfig, TelemetryStatus } from './config';
+export type { TelemetryController } from './sdk';
diff --git a/packages/api/src/telemetry/middleware.spec.ts b/packages/api/src/telemetry/middleware.spec.ts
new file mode 100644
index 00000000000..271d8c0a114
--- /dev/null
+++ b/packages/api/src/telemetry/middleware.spec.ts
@@ -0,0 +1,395 @@
+import { EventEmitter } from 'node:events';
+import { SpanStatusCode, trace } from '@opentelemetry/api';
+import type { NextFunction, Response } from 'express';
+import type { Span } from '@opentelemetry/api';
+import type { ServerRequest } from '~/types';
+import { getTelemetryRequestSpan } from './sdk';
+import { telemetryErrorMiddleware, telemetryMiddleware } from './middleware';
+
+jest.mock('./sdk', () => ({
+  getTelemetryRequestSpan: jest.fn(),
+}));
+
+const mockGetTelemetryRequestSpan = getTelemetryRequestSpan as jest.MockedFunction<
+  typeof getTelemetryRequestSpan
+>;
+
+interface MockResponse extends EventEmitter {
+  statusCode: number;
+  writableEnded: boolean;
+}
+
+function createSpan(): jest.Mocked<Span> {
+  const span = {} as jest.Mocked<Span>;
+  span.addEvent = jest.fn<jest.Mocked<Span>, Parameters<Span['addEvent']>>(() => span);
+  span.addLink = jest.fn<jest.Mocked<Span>, Parameters<Span['addLink']>>(() => span);
+  span.addLinks = jest.fn<jest.Mocked<Span>, Parameters<Span['addLinks']>>(() => span);
+  span.end = jest.fn<void, Parameters<Span['end']>>();
+  span.isRecording = jest.fn<boolean, Parameters<Span['isRecording']>>(() => true);
+  span.recordException = jest.fn<void, Parameters<Span['recordException']>>();
+  span.setAttribute = jest.fn<jest.Mocked<Span>, Parameters<Span['setAttribute']>>(() => span);
+  span.setAttributes = jest.fn<jest.Mocked<Span>, Parameters<Span['setAttributes']>>(() => span);
+  span.setStatus = jest.fn<jest.Mocked<Span>, Parameters<Span['setStatus']>>(() => span);
+  span.spanContext = jest.fn<ReturnType<Span['spanContext']>, Parameters<Span['spanContext']>>(
+    () => ({
+      spanId: '0000000000000000',
+      traceFlags: 0,
+      traceId: '00000000000000000000000000000000',
+    }),
+  );
+  span.updateName = jest.fn<jest.Mocked<Span>, Parameters<Span['updateName']>>(() => span);
+  return span;
+}
+
+function createResponse(statusCode = 200): MockResponse {
+  const res = new EventEmitter() as MockResponse;
+  res.statusCode = statusCode;
+  res.writableEnded = false;
+  return res;
+}
+
+function createRequest(overrides: Partial<ServerRequest> = {}): ServerRequest {
+  return {
+    baseUrl: '/api/messages',
+    body: {
+      prompt: 'do not capture this prompt',
+      text: 'do not capture this body',
+    },
+    headers: {
+      authorization: 'Bearer do-not-capture-this-auth-header',
+      cookie: 'session=do-not-capture-this-cookie',
+      'x-api-key': 'do-not-capture-this-api-key',
+    },
+    method: 'POST',
+    path: '/api/messages/conversation-1',
+    route: { path: '/:conversationId' },
+    user: {
+      email: 'do-not-capture@example.com',
+      id: 'user-1',
+      tenantId: 'tenant-1',
+    } as ServerRequest['user'],
+    ...overrides,
+  } as ServerRequest;
+}
+
+afterEach(() => {
+  mockGetTelemetryRequestSpan.mockReset();
+});
+
+describe('telemetryMiddleware', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('passes through without an active span', () => {
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(undefined);
+
+    telemetryMiddleware(createRequest(), createResponse() as Response, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses the stored request span for deferred completion attributes', () => {
+    const activeSpan = createSpan();
+    const requestSpan = createSpan();
+    const req = createRequest();
+    const res = createResponse(202);
+    const next: NextFunction = jest.fn();
+    mockGetTelemetryRequestSpan.mockReturnValue(requestSpan);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(activeSpan);
+
+    telemetryMiddleware(req, res as Response, next);
+    res.emit('finish');
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(trace.getActiveSpan).not.toHaveBeenCalled();
+    expect(activeSpan.setAttributes).not.toHaveBeenCalled();
+    expect(requestSpan.setAttributes).toHaveBeenCalledWith({
+      'http.request.method': 'POST',
+    });
+    expect(requestSpan.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.response.status_code': 202,
+        'http.route': '/api/messages/:conversationId',
+      }),
+    );
+  });
+
+  it('records safe route and identity attributes without body content', () => {
+    const span = createSpan();
+    const req = createRequest();
+    const res = createResponse(201);
+    const next: NextFunction = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, next);
+    res.emit('finish');
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(span.setAttributes).toHaveBeenCalledWith({
+      'http.request.method': 'POST',
+    });
+    expect(span.setAttributes).toHaveBeenCalledWith({
+      'enduser.id': 'user-1',
+      'librechat.tenant.id': 'tenant-1',
+    });
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.response.status_code': 201,
+        'http.route': '/api/messages/:conversationId',
+      }),
+    );
+
+    const capturedAttributes = JSON.stringify(span.setAttributes.mock.calls);
+    expect(capturedAttributes).not.toContain('do not capture this prompt');
+    expect(capturedAttributes).not.toContain('do not capture this body');
+    expect(capturedAttributes).not.toContain('do-not-capture@example.com');
+    expect(capturedAttributes).not.toContain('conversation-1');
+    expect(capturedAttributes).not.toContain('do-not-capture-this-auth-header');
+    expect(capturedAttributes).not.toContain('do-not-capture-this-cookie');
+    expect(capturedAttributes).not.toContain('do-not-capture-this-api-key');
+  });
+
+  it('records identity attributes populated by downstream middleware', () => {
+    const span = createSpan();
+    const req = createRequest({
+      headers: {},
+      user: undefined,
+    });
+    const res = createResponse(200);
+    const next: NextFunction = jest.fn(() => {
+      req.user = {
+        id: 'late-user',
+        tenantId: 'late-tenant',
+      } as ServerRequest['user'];
+    });
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(span.setAttributes).toHaveBeenCalledTimes(1);
+
+    res.emit('finish');
+
+    expect(span.setAttributes).toHaveBeenCalledWith({
+      'enduser.id': 'late-user',
+      'librechat.tenant.id': 'late-tenant',
+    });
+  });
+
+  it('does not derive tenant identity from request headers', () => {
+    const span = createSpan();
+    const req = createRequest({
+      headers: {
+        'x-tenant-id': 'spoofed-tenant',
+      },
+      user: undefined,
+    });
+    const res = createResponse(200);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, jest.fn());
+    res.emit('finish');
+
+    expect(span.setAttributes).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        'librechat.tenant.id': 'spoofed-tenant',
+      }),
+    );
+    expect(JSON.stringify(span.setAttributes.mock.calls)).not.toContain('spoofed-tenant');
+  });
+
+  it('ignores health checks', () => {
+    const span = createSpan();
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(
+      createRequest({
+        baseUrl: '',
+        path: '/health',
+        route: undefined,
+      }),
+      createResponse() as Response,
+      next,
+    );
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(span.setAttributes).not.toHaveBeenCalled();
+  });
+
+  it('uses a low-cardinality fallback for unmatched API routes', () => {
+    const span = createSpan();
+    const req = createRequest({
+      baseUrl: '',
+      path: '/api/nonexistent/123',
+      route: undefined,
+    });
+    const res = createResponse(404);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, jest.fn());
+    res.emit('finish');
+
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.route': '/api/*',
+        'http.response.status_code': 404,
+      }),
+    );
+  });
+
+  it('uses a low-cardinality fallback for unmatched SPA routes', () => {
+    const span = createSpan();
+    const req = createRequest({
+      baseUrl: '',
+      path: '/chat/conversation-id',
+      route: undefined,
+    });
+    const res = createResponse(200);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, jest.fn());
+    res.emit('finish');
+
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.route': 'spa_fallback',
+        'http.response.status_code': 200,
+      }),
+    );
+  });
+
+  it('marks server responses as errored', () => {
+    const span = createSpan();
+    const req = createRequest();
+    const res = createResponse(500);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(req, res as Response, jest.fn());
+    res.emit('finish');
+
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+  });
+
+  it('records completion attributes only once when finish and close both fire', () => {
+    const span = createSpan();
+    const res = createResponse(200);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(createRequest(), res as Response, jest.fn());
+    res.emit('finish');
+    res.emit('close');
+
+    expect(span.setAttributes).toHaveBeenCalledTimes(3);
+  });
+
+  it('marks client disconnects before finish as aborted errors', () => {
+    const span = createSpan();
+    const res = createResponse(200);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryMiddleware(createRequest(), res as Response, jest.fn());
+    res.emit('close');
+
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.response.status_code': 499,
+        'librechat.request.aborted': true,
+      }),
+    );
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+  });
+});
+
+describe('telemetryErrorMiddleware', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('records exceptions and forwards the error', () => {
+    const span = createSpan();
+    const error = new TypeError('boom');
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryErrorMiddleware(error, createRequest(), createResponse() as Response, next);
+
+    expect(span.recordException).toHaveBeenCalledWith(error);
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(span.setAttributes).toHaveBeenCalledWith({
+      'enduser.id': 'user-1',
+      'librechat.tenant.id': 'tenant-1',
+    });
+    expect(span.setAttributes).toHaveBeenCalledWith({
+      'error.type': 'TypeError',
+      'http.route': '/api/messages/:conversationId',
+    });
+    expect(next).toHaveBeenCalledWith(error);
+  });
+
+  it('records exceptions on the stored request span when available', () => {
+    const activeSpan = createSpan();
+    const requestSpan = createSpan();
+    const error = new TypeError('boom');
+    const next = jest.fn();
+    mockGetTelemetryRequestSpan.mockReturnValue(requestSpan);
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(activeSpan);
+
+    telemetryErrorMiddleware(error, createRequest(), createResponse() as Response, next);
+
+    expect(trace.getActiveSpan).not.toHaveBeenCalled();
+    expect(activeSpan.recordException).not.toHaveBeenCalled();
+    expect(requestSpan.recordException).toHaveBeenCalledWith(error);
+    expect(requestSpan.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(next).toHaveBeenCalledWith(error);
+  });
+
+  it('handles non-Error values without throwing', () => {
+    const span = createSpan();
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryErrorMiddleware('boom', createRequest(), createResponse() as Response, next);
+
+    expect(span.recordException).toHaveBeenCalledWith('boom');
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'error.type': 'string',
+        'http.route': '/api/messages/:conversationId',
+      }),
+    );
+    expect(next).toHaveBeenCalledWith('boom');
+  });
+
+  it('handles null error values without throwing', () => {
+    const span = createSpan();
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(span);
+
+    telemetryErrorMiddleware(null, createRequest(), createResponse() as Response, next);
+
+    expect(span.recordException).not.toHaveBeenCalled();
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'error.type': 'null',
+        'http.route': '/api/messages/:conversationId',
+      }),
+    );
+    expect(next).toHaveBeenCalledWith(null);
+  });
+
+  it('forwards the error without an active span', () => {
+    const error = new Error('boom');
+    const next = jest.fn();
+    jest.spyOn(trace, 'getActiveSpan').mockReturnValue(undefined);
+
+    telemetryErrorMiddleware(error, createRequest(), createResponse() as Response, next);
+
+    expect(next).toHaveBeenCalledWith(error);
+  });
+});
diff --git a/packages/api/src/telemetry/middleware.ts b/packages/api/src/telemetry/middleware.ts
new file mode 100644
index 00000000000..d9c110c1b9e
--- /dev/null
+++ b/packages/api/src/telemetry/middleware.ts
@@ -0,0 +1,171 @@
+import { SpanStatusCode, trace } from '@opentelemetry/api';
+import type { Span, Attributes } from '@opentelemetry/api';
+import type { NextFunction, Response } from 'express';
+import type { ServerRequest } from '~/types';
+import { getTelemetryRequestSpan } from './sdk';
+import { DEFAULT_HEALTH_PATH } from './config';
+
+const CLIENT_CLOSED_REQUEST_STATUS_CODE = 499;
+
+type ExpressErrorValue =
+  | Error
+  | string
+  | number
+  | boolean
+  | bigint
+  | symbol
+  | object
+  | null
+  | undefined;
+
+function getUserId(req: ServerRequest): string | undefined {
+  return req.user?.id;
+}
+
+function getTenantId(req: ServerRequest): string | undefined {
+  return req.user?.tenantId;
+}
+
+function isHealthPath(req: ServerRequest): boolean {
+  return req.path === DEFAULT_HEALTH_PATH;
+}
+
+function isApiPath(req: ServerRequest): boolean {
+  return req.path === '/api' || req.path.startsWith('/api/');
+}
+
+function getRoutePath(req: ServerRequest): string {
+  const routePath = req.route?.path;
+  if (typeof routePath === 'string') {
+    return `${req.baseUrl}${routePath}`;
+  }
+
+  if (isHealthPath(req)) {
+    return '/health';
+  }
+
+  if (isApiPath(req)) {
+    return '/api/*';
+  }
+
+  return 'spa_fallback';
+}
+
+function setIdentityAttributes(span: Span, req: ServerRequest): void {
+  const userId = getUserId(req);
+  const tenantId = getTenantId(req);
+
+  if (!userId && !tenantId) {
+    return;
+  }
+
+  const attributes: Attributes = {};
+
+  if (userId) {
+    attributes['enduser.id'] = userId;
+  }
+
+  if (tenantId) {
+    attributes['librechat.tenant.id'] = tenantId;
+  }
+
+  span.setAttributes(attributes);
+}
+
+function setCompletionAttributes(
+  span: Span,
+  req: ServerRequest,
+  res: Response,
+  aborted = false,
+): void {
+  const statusCode = aborted ? CLIENT_CLOSED_REQUEST_STATUS_CODE : res.statusCode;
+  const routePath = getRoutePath(req);
+  const attributes: Attributes = {
+    'http.route': routePath,
+    'http.response.status_code': statusCode,
+  };
+
+  if (aborted) {
+    attributes['librechat.request.aborted'] = true;
+  }
+
+  setIdentityAttributes(span, req);
+  span.setAttributes(attributes);
+
+  if (aborted || statusCode >= 500) {
+    span.setStatus({ code: SpanStatusCode.ERROR });
+  }
+}
+
+export function telemetryMiddleware(req: ServerRequest, res: Response, next: NextFunction): void {
+  if (isHealthPath(req)) {
+    next();
+    return;
+  }
+
+  const span = getTelemetryRequestSpan(req) ?? trace.getActiveSpan();
+  if (!span) {
+    next();
+    return;
+  }
+
+  span.setAttributes({
+    'http.request.method': req.method,
+  });
+
+  let completed = false;
+  const complete = () => {
+    if (completed) {
+      return;
+    }
+    completed = true;
+    setCompletionAttributes(span, req, res);
+  };
+
+  const close = () => {
+    if (completed) {
+      return;
+    }
+    completed = true;
+    setCompletionAttributes(span, req, res, !res.writableEnded);
+  };
+
+  res.once('finish', complete);
+  res.once('close', close);
+  next();
+}
+
+export function telemetryErrorMiddleware(
+  err: ExpressErrorValue,
+  req: ServerRequest,
+  _res: Response,
+  next: NextFunction,
+): void {
+  const span = getTelemetryRequestSpan(req) ?? trace.getActiveSpan();
+  if (span) {
+    const routePath = getRoutePath(req);
+    if (err) {
+      span.recordException(err instanceof Error ? err : String(err));
+    }
+    span.setStatus({ code: SpanStatusCode.ERROR });
+    setIdentityAttributes(span, req);
+    span.setAttributes({
+      'error.type': getErrorType(err),
+      'http.route': routePath,
+    });
+  }
+
+  next(err);
+}
+
+function getErrorType(err: ExpressErrorValue): string {
+  if (err instanceof Error) {
+    return err.name || err.constructor.name;
+  }
+
+  if (err === null) {
+    return 'null';
+  }
+
+  return typeof err;
+}
diff --git a/packages/api/src/telemetry/sdk.spec.ts b/packages/api/src/telemetry/sdk.spec.ts
new file mode 100644
index 00000000000..c361a6cd5cc
--- /dev/null
+++ b/packages/api/src/telemetry/sdk.spec.ts
@@ -0,0 +1,534 @@
+import { Socket } from 'node:net';
+import { IncomingMessage } from 'node:http';
+import { Agent as HttpsAgent } from 'node:https';
+import type { RequestOptions } from 'node:http';
+import type { Span } from '@opentelemetry/api';
+
+interface HttpInstrumentationOptions {
+  requestHook?: (span: Span, request: object) => void;
+  startIncomingSpanHook?: (request: IncomingMessage) => Record<string, string>;
+  startOutgoingSpanHook?: (request: RequestOptions) => Record<string, string>;
+}
+
+interface UndiciInstrumentationOptions {
+  startSpanHook?: (request: { origin?: string; path?: string }) => Record<string, string>;
+}
+
+const mockStart = jest.fn();
+const mockShutdown = jest.fn();
+const mockNodeSDK = jest.fn(() => ({
+  start: mockStart,
+  shutdown: mockShutdown,
+}));
+const mockExpressInstrumentation = jest.fn(() => ({ name: 'express' }));
+const mockHttpInstrumentation = jest.fn((options?: HttpInstrumentationOptions) => ({
+  name: 'http',
+  options,
+}));
+const mockIORedisInstrumentation = jest.fn(() => ({ name: 'ioredis' }));
+const mockMongoDBInstrumentation = jest.fn(() => ({ name: 'mongodb' }));
+const mockMongooseInstrumentation = jest.fn(() => ({ name: 'mongoose' }));
+const mockUndiciInstrumentation = jest.fn((options?: UndiciInstrumentationOptions) => ({
+  name: 'undici',
+  options,
+}));
+const mockResourceFromAttributes = jest.fn((attributes: object) => ({ attributes }));
+
+jest.mock(
+  '@opentelemetry/sdk-node',
+  () => ({
+    NodeSDK: mockNodeSDK,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-express',
+  () => ({
+    ExpressInstrumentation: mockExpressInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-http',
+  () => ({
+    HttpInstrumentation: mockHttpInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-ioredis',
+  () => ({
+    IORedisInstrumentation: mockIORedisInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-mongodb',
+  () => ({
+    MongoDBInstrumentation: mockMongoDBInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-mongoose',
+  () => ({
+    MongooseInstrumentation: mockMongooseInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/instrumentation-undici',
+  () => ({
+    UndiciInstrumentation: mockUndiciInstrumentation,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/resources',
+  () => ({
+    resourceFromAttributes: mockResourceFromAttributes,
+  }),
+  { virtual: true },
+);
+
+jest.mock(
+  '@opentelemetry/semantic-conventions',
+  () => ({
+    ATTR_SERVICE_NAME: 'service.name',
+    ATTR_SERVICE_VERSION: 'service.version',
+  }),
+  { virtual: true },
+);
+
+jest.mock('../app/shutdown', () => ({
+  registerShutdownTask: jest.fn(),
+}));
+
+describe('telemetry SDK lifecycle', () => {
+  let emitWarningSpy: jest.SpyInstance;
+  let getTelemetryRequestSpan: (typeof import('./sdk'))['getTelemetryRequestSpan'];
+  let initializeTelemetry: (typeof import('./sdk'))['initializeTelemetry'];
+  let resetTelemetryForTests: (typeof import('./sdk'))['resetTelemetryForTests'];
+  let shutdownTelemetry: (typeof import('./sdk'))['shutdownTelemetry'];
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    ({ getTelemetryRequestSpan, initializeTelemetry, resetTelemetryForTests, shutdownTelemetry } =
+      await import('./sdk'));
+    await resetTelemetryForTests();
+    Reflect.deleteProperty(globalThis, 'Bun');
+    emitWarningSpy = jest.spyOn(process, 'emitWarning').mockImplementation(() => true);
+  });
+
+  afterEach(async () => {
+    await resetTelemetryForTests();
+    emitWarningSpy.mockRestore();
+    Reflect.deleteProperty(globalThis, 'Bun');
+  });
+
+  it('does not initialize when tracing is disabled by default', () => {
+    const controller = initializeTelemetry({});
+
+    expect(controller.enabled).toBe(false);
+    expect(controller.status).toBe('disabled');
+    expect(mockNodeSDK).not.toHaveBeenCalled();
+  });
+
+  it('does not initialize when OTEL_SDK_DISABLED is true', () => {
+    const controller = initializeTelemetry({
+      OTEL_SDK_DISABLED: 'true',
+      OTEL_TRACING_ENABLED: 'true',
+    });
+
+    expect(controller.enabled).toBe(false);
+    expect(controller.status).toBe('disabled');
+    expect(mockNodeSDK).not.toHaveBeenCalled();
+  });
+
+  it('does not initialize under Bun runtime', () => {
+    Object.defineProperty(globalThis, 'Bun', {
+      configurable: true,
+      value: {},
+    });
+
+    const controller = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(controller.enabled).toBe(false);
+    expect(controller.status).toBe('disabled');
+    expect(mockNodeSDK).not.toHaveBeenCalled();
+  });
+
+  it('starts the Node SDK once when enabled', () => {
+    const first = initializeTelemetry({
+      OTEL_SERVICE_NAME: 'librechat-test',
+      OTEL_TRACING_ENABLED: 'true',
+    });
+    const second = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(first.enabled).toBe(true);
+    expect(first.status).toBe('started');
+    expect(second.enabled).toBe(true);
+    expect(mockNodeSDK).toHaveBeenCalledTimes(1);
+    expect(mockStart).toHaveBeenCalledTimes(1);
+    expect(mockResourceFromAttributes).toHaveBeenCalledWith({
+      'service.name': 'librechat-test',
+    });
+    expect(mockHttpInstrumentation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        headersToSpanAttributes: {
+          client: { requestHeaders: [], responseHeaders: [] },
+          server: { requestHeaders: [], responseHeaders: [] },
+        },
+      }),
+    );
+    expect(mockExpressInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockMongoDBInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockMongooseInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockIORedisInstrumentation).not.toHaveBeenCalled();
+    expect(mockUndiciInstrumentation).toHaveBeenCalledTimes(1);
+  });
+
+  it('enables ioredis instrumentation when explicitly configured', () => {
+    initializeTelemetry({
+      OTEL_IOREDIS_TRACING_ENABLED: 'true',
+      OTEL_TRACING_ENABLED: 'true',
+    });
+
+    expect(mockMongooseInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockHttpInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockExpressInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockMongoDBInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockIORedisInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockUndiciInstrumentation).toHaveBeenCalledTimes(1);
+  });
+
+  it('tracks HTTP server request spans for completion updates', () => {
+    const span = {} as Span;
+    const request = new IncomingMessage(new Socket());
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const requestHook = instrumentationOptions?.requestHook;
+
+    if (!requestHook) {
+      throw new Error('HTTP instrumentation requestHook was not configured');
+    }
+
+    requestHook(span, request);
+
+    expect(getTelemetryRequestSpan(request)).toBe(span);
+  });
+
+  it('redacts incoming URL attributes before HTTP spans are exported', () => {
+    const request = new IncomingMessage(new Socket());
+    request.url = '/oauth/callback?code=secret-code&state=secret-state';
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startIncomingSpanHook = instrumentationOptions?.startIncomingSpanHook;
+
+    if (!startIncomingSpanHook) {
+      throw new Error('HTTP instrumentation startIncomingSpanHook was not configured');
+    }
+
+    const attributes = startIncomingSpanHook(request);
+
+    expect(attributes).toEqual({
+      'http.target': 'spa_fallback?[REDACTED]',
+      'http.url': 'spa_fallback?[REDACTED]',
+      'url.full': 'spa_fallback?[REDACTED]',
+      'url.path': 'spa_fallback',
+      'url.query': '[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('secret-code');
+    expect(JSON.stringify(attributes)).not.toContain('secret-state');
+  });
+
+  it('redacts outgoing HTTP URL query attributes before client spans are exported', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      protocol: 'http:',
+      hostname: '127.0.0.1',
+      port: 33169,
+      path: '/custom-action?api_key=LC_ACTION_QUERY_SECRET_67890&user_text=sensitive+prompt+words',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?api_key=[REDACTED]&user_text=[REDACTED]',
+      'http.url': 'http://127.0.0.1:33169/custom-action?api_key=[REDACTED]&user_text=[REDACTED]',
+      'url.full': 'http://127.0.0.1:33169/custom-action?api_key=[REDACTED]&user_text=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': 'api_key=[REDACTED]&user_text=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+    expect(JSON.stringify(attributes)).not.toContain('sensitive+prompt+words');
+  });
+
+  it('redacts delimiter-less outgoing query segments and preserves separate HTTP ports', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      protocol: 'https:',
+      host: 'api.example.com',
+      port: 8443,
+      path: '/custom-action?LC_ACTION_QUERY_SECRET_67890&user_text=sensitive+prompt+words',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?[REDACTED]&user_text=[REDACTED]',
+      'http.url': 'https://api.example.com:8443/custom-action?[REDACTED]&user_text=[REDACTED]',
+      'url.full': 'https://api.example.com:8443/custom-action?[REDACTED]&user_text=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': '[REDACTED]&user_text=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+    expect(JSON.stringify(attributes)).not.toContain('sensitive+prompt+words');
+  });
+
+  it('keeps outgoing HTTP URLs absolute when request options omit an origin', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      protocol: 'http:',
+      path: '/custom-action?api_key=LC_ACTION_QUERY_SECRET_67890',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?api_key=[REDACTED]',
+      'http.url': 'http://localhost/custom-action?api_key=[REDACTED]',
+      'url.full': 'http://localhost/custom-action?api_key=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': 'api_key=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+  });
+
+  it('uses the agent protocol for outgoing URL attributes when request protocol is absent', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      agent: new HttpsAgent(),
+      hostname: 'api.example.com',
+      path: '/custom-action?api_key=LC_ACTION_QUERY_SECRET_67890',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?api_key=[REDACTED]',
+      'http.url': 'https://api.example.com/custom-action?api_key=[REDACTED]',
+      'url.full': 'https://api.example.com/custom-action?api_key=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': 'api_key=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+  });
+
+  it('does not infer HTTPS from port 443 without protocol context', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      hostname: 'api.example.com',
+      port: 443,
+      path: '/custom-action?api_key=LC_ACTION_QUERY_SECRET_67890',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?api_key=[REDACTED]',
+      'http.url': 'http://api.example.com:443/custom-action?api_key=[REDACTED]',
+      'url.full': 'http://api.example.com:443/custom-action?api_key=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': 'api_key=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+  });
+
+  it('brackets IPv6 hostnames in outgoing HTTP URL attributes', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockHttpInstrumentation.mock.calls[0]?.[0];
+    const startOutgoingSpanHook = instrumentationOptions?.startOutgoingSpanHook;
+
+    if (!startOutgoingSpanHook) {
+      throw new Error('HTTP instrumentation startOutgoingSpanHook was not configured');
+    }
+
+    const attributes = startOutgoingSpanHook({
+      protocol: 'http:',
+      hostname: '::1',
+      port: 8080,
+      path: '/custom-action?api_key=LC_ACTION_QUERY_SECRET_67890',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/custom-action?api_key=[REDACTED]',
+      'http.url': 'http://[::1]:8080/custom-action?api_key=[REDACTED]',
+      'url.full': 'http://[::1]:8080/custom-action?api_key=[REDACTED]',
+      'url.path': '/custom-action',
+      'url.query': 'api_key=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('LC_ACTION_QUERY_SECRET_67890');
+  });
+
+  it('redacts outgoing Undici URL query attributes before fetch spans are exported', () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    const instrumentationOptions = mockUndiciInstrumentation.mock.calls[0]?.[0];
+    const startSpanHook = instrumentationOptions?.startSpanHook;
+
+    if (!startSpanHook) {
+      throw new Error('Undici instrumentation startSpanHook was not configured');
+    }
+
+    const attributes = startSpanHook({
+      origin: 'https://api.openweathermap.org',
+      path: '/data/3.0/onecall?appid=OPENWEATHER_SECRET_123&lat=40.71&lon=-74.01',
+    });
+
+    expect(attributes).toEqual({
+      'http.target': '/data/3.0/onecall?appid=[REDACTED]&lat=[REDACTED]&lon=[REDACTED]',
+      'http.url':
+        'https://api.openweathermap.org/data/3.0/onecall?appid=[REDACTED]&lat=[REDACTED]&lon=[REDACTED]',
+      'url.full':
+        'https://api.openweathermap.org/data/3.0/onecall?appid=[REDACTED]&lat=[REDACTED]&lon=[REDACTED]',
+      'url.path': '/data/3.0/onecall',
+      'url.query': 'appid=[REDACTED]&lat=[REDACTED]&lon=[REDACTED]',
+    });
+    expect(JSON.stringify(attributes)).not.toContain('OPENWEATHER_SECRET_123');
+    expect(JSON.stringify(attributes)).not.toContain('40.71');
+    expect(JSON.stringify(attributes)).not.toContain('-74.01');
+  });
+
+  it('reflects lifecycle status from the controller getter', async () => {
+    const controller = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(controller.status).toBe('started');
+    await controller.shutdown();
+    expect(controller.status).toBe('stopped');
+    expect(controller.enabled).toBe(false);
+  });
+
+  it('handles async SDK start failures without throwing', async () => {
+    mockStart.mockRejectedValueOnce(new Error('async start failed'));
+
+    const controller = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(controller.enabled).toBe(true);
+    expect(controller.status).toBe('starting');
+    await controller.shutdown();
+    expect(controller.enabled).toBe(false);
+    expect(controller.status).toBe('failed');
+    expect(emitWarningSpy).toHaveBeenCalledWith(
+      'OpenTelemetry initialization failed: async start failed',
+      { code: 'LIBRECHAT_OTEL' },
+    );
+  });
+
+  it('returns failed status without throwing when SDK start fails', () => {
+    mockStart.mockImplementationOnce(() => {
+      throw new Error('start failed');
+    });
+
+    const controller = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(controller.enabled).toBe(false);
+    expect(controller.status).toBe('failed');
+    expect(emitWarningSpy).toHaveBeenCalledWith(
+      'OpenTelemetry initialization failed: start failed',
+      { code: 'LIBRECHAT_OTEL' },
+    );
+  });
+
+  it('shuts down the active SDK idempotently', async () => {
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+    await shutdownTelemetry();
+    await shutdownTelemetry();
+
+    expect(mockShutdown).toHaveBeenCalledTimes(1);
+  });
+
+  it('coalesces concurrent shutdown calls', async () => {
+    let resolveShutdown: () => void = () => undefined;
+    mockShutdown.mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        resolveShutdown = resolve;
+      }),
+    );
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    const firstShutdown = shutdownTelemetry();
+    const secondShutdown = shutdownTelemetry();
+    expect(mockShutdown).toHaveBeenCalledTimes(1);
+
+    resolveShutdown();
+    await Promise.all([firstShutdown, secondShutdown]);
+  });
+
+  it('keeps the active SDK available when shutdown fails', async () => {
+    mockShutdown.mockRejectedValueOnce(new Error('shutdown failed'));
+    const controller = initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    await expect(shutdownTelemetry()).rejects.toThrow('shutdown failed');
+    expect(controller.status).toBe('started');
+
+    await shutdownTelemetry();
+    expect(mockShutdown).toHaveBeenCalledTimes(2);
+    expect(controller.status).toBe('stopped');
+  });
+
+  it('registers a shutdown task with the coordinator when initialized', async () => {
+    const { registerShutdownTask } = await import('../app/shutdown');
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    expect(registerShutdownTask).toHaveBeenCalledWith('telemetry', expect.any(Function));
+  });
+
+  it('the registered shutdown task warns when telemetry shutdown rejects', async () => {
+    const { registerShutdownTask } = await import('../app/shutdown');
+    mockShutdown.mockRejectedValueOnce(new Error('flush failed'));
+    initializeTelemetry({ OTEL_TRACING_ENABLED: 'true' });
+
+    const shutdownTaskCalls = (registerShutdownTask as jest.Mock).mock.calls;
+    const taskFn = shutdownTaskCalls[shutdownTaskCalls.length - 1]?.[1] as
+      | (() => Promise<void>)
+      | undefined;
+    expect(taskFn).toBeDefined();
+    await taskFn?.();
+
+    expect(emitWarningSpy).toHaveBeenCalledWith('OpenTelemetry shutdown failed: flush failed', {
+      code: 'LIBRECHAT_OTEL',
+    });
+  });
+});
diff --git a/packages/api/src/telemetry/sdk.ts b/packages/api/src/telemetry/sdk.ts
new file mode 100644
index 00000000000..c3fb90b852d
--- /dev/null
+++ b/packages/api/src/telemetry/sdk.ts
@@ -0,0 +1,512 @@
+import { IncomingMessage } from 'node:http';
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { HttpInstrumentation } from '@opentelemetry/instrumentation-http';
+import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
+import { IORedisInstrumentation } from '@opentelemetry/instrumentation-ioredis';
+import { ExpressInstrumentation } from '@opentelemetry/instrumentation-express';
+import { MongoDBInstrumentation } from '@opentelemetry/instrumentation-mongodb';
+import { MongooseInstrumentation } from '@opentelemetry/instrumentation-mongoose';
+import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic-conventions';
+import type { NodeSDKConfiguration } from '@opentelemetry/sdk-node';
+import type { Span, Attributes } from '@opentelemetry/api';
+import type { RequestOptions } from 'node:http';
+import type { TelemetryConfig, TelemetryStatus } from './config';
+import { registerShutdownTask } from '../app/shutdown';
+import { getTelemetryConfig } from './config';
+
+export interface TelemetryController {
+  readonly enabled: boolean;
+  readonly status: TelemetryStatus;
+  shutdown: () => Promise<void>;
+}
+
+const WARNING_CODE = 'LIBRECHAT_OTEL';
+const REDACTED_QUERY_VALUE = '[REDACTED]';
+const SIGNAL_SHUTDOWN_TIMEOUT_MS = 5_000;
+
+interface RequestUrlParts {
+  href?: string;
+  search?: string;
+  pathname?: string;
+}
+
+interface AgentProtocol {
+  protocol?: string;
+}
+
+interface UndiciRequestInfo {
+  path?: string;
+  origin?: string;
+}
+
+let activeSdk: NodeSDK | undefined;
+let pendingSdk: NodeSDK | undefined;
+let startPromise: Promise<void> | undefined;
+let shutdownPromise: Promise<void> | undefined;
+let status: TelemetryStatus = 'stopped';
+let shutdownTaskRegistered = false;
+let requestSpans = new WeakMap<IncomingMessage, Span>();
+
+function isBunRuntime(): boolean {
+  return Reflect.get(globalThis, 'Bun') != null;
+}
+
+function shouldIgnoreIncomingRequest(request: IncomingMessage, healthPath: string): boolean {
+  return request.url === healthPath || request.url?.startsWith(`${healthPath}?`) === true;
+}
+
+function getIncomingUrlInfo(request: IncomingMessage): { hasQuery: boolean; pathname: string } {
+  const rawUrl = request.url ?? '/';
+
+  try {
+    const parsedUrl = new URL(rawUrl, 'http://localhost');
+    return {
+      hasQuery: parsedUrl.search.length > 1,
+      pathname: parsedUrl.pathname || '/',
+    };
+  } catch {
+    const queryIndex = rawUrl.indexOf('?');
+    return {
+      hasQuery: queryIndex >= 0 && queryIndex < rawUrl.length - 1,
+      pathname: queryIndex >= 0 ? rawUrl.slice(0, queryIndex) || '/' : rawUrl || '/',
+    };
+  }
+}
+
+function getLowCardinalityUrlPath(pathname: string, healthPath: string): string {
+  if (pathname === healthPath) {
+    return healthPath;
+  }
+
+  if (pathname === '/api' || pathname.startsWith('/api/')) {
+    return '/api/*';
+  }
+
+  return 'spa_fallback';
+}
+
+function getSanitizedIncomingUrlAttributes(
+  request: IncomingMessage,
+  healthPath: string,
+): Attributes {
+  const { hasQuery, pathname } = getIncomingUrlInfo(request);
+  const safePath = getLowCardinalityUrlPath(pathname, healthPath);
+  const safeTarget = hasQuery ? `${safePath}?${REDACTED_QUERY_VALUE}` : safePath;
+  const attributes: Attributes = {
+    'http.target': safeTarget,
+    'http.url': safeTarget,
+    'url.full': safeTarget,
+    'url.path': safePath,
+  };
+
+  if (hasQuery) {
+    attributes['url.query'] = REDACTED_QUERY_VALUE;
+  }
+
+  return attributes;
+}
+
+function getStringValue(value: string | number | null | undefined): string | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  const stringValue = String(value).trim();
+  return stringValue || undefined;
+}
+
+function getRedactedQuery(search: string): string | undefined {
+  const query = search.startsWith('?') ? search.slice(1) : search;
+  if (!query) {
+    return undefined;
+  }
+
+  return query
+    .split('&')
+    .map((part) => {
+      const separatorIndex = part.indexOf('=');
+      if (separatorIndex < 0) {
+        return REDACTED_QUERY_VALUE;
+      }
+
+      const key = part.slice(0, separatorIndex);
+      if (!key) {
+        return REDACTED_QUERY_VALUE;
+      }
+
+      return `${key}=${REDACTED_QUERY_VALUE}`;
+    })
+    .join('&');
+}
+
+function getSanitizedUrlAttributesFromParts(
+  origin: string | undefined,
+  pathname: string,
+  search: string,
+): Attributes {
+  const path = pathname || '/';
+  const redactedQuery = getRedactedQuery(search);
+  const target = redactedQuery ? `${path}?${redactedQuery}` : path;
+  const fullUrl = origin ? `${origin}${target}` : target;
+  const attributes: Attributes = {
+    'http.target': target,
+    'http.url': fullUrl,
+    'url.full': fullUrl,
+    'url.path': path,
+  };
+
+  if (redactedQuery) {
+    attributes['url.query'] = redactedQuery;
+  }
+
+  return attributes;
+}
+
+function getFallbackUrlParts(rawUrl: string): { pathname: string; search: string } {
+  const queryIndex = rawUrl.indexOf('?');
+  if (queryIndex < 0) {
+    return { pathname: rawUrl || '/', search: '' };
+  }
+
+  return {
+    pathname: rawUrl.slice(0, queryIndex) || '/',
+    search: rawUrl.slice(queryIndex),
+  };
+}
+
+function getSanitizedOutgoingUrlAttributes(rawUrl: string, origin?: string): Attributes {
+  const hasOrigin = /^[a-z][a-z\d+\-.]*:\/\//i.test(rawUrl);
+
+  try {
+    const parsedUrl = new URL(rawUrl, origin ?? 'http://localhost');
+    const safeOrigin = hasOrigin || origin ? parsedUrl.origin : undefined;
+    return getSanitizedUrlAttributesFromParts(safeOrigin, parsedUrl.pathname, parsedUrl.search);
+  } catch {
+    const { pathname, search } = getFallbackUrlParts(rawUrl);
+    return getSanitizedUrlAttributesFromParts(origin, pathname, search);
+  }
+}
+
+function normalizeProtocol(protocol: string): string {
+  return protocol.endsWith(':') ? protocol : `${protocol}:`;
+}
+
+function getRequestAgentProtocol(request: RequestOptions): string | undefined {
+  const { agent } = request;
+  if (!agent || typeof agent === 'boolean') {
+    return undefined;
+  }
+
+  return getStringValue((agent as AgentProtocol).protocol);
+}
+
+function getOutgoingHttpProtocol(request: RequestOptions): string {
+  const protocol = getStringValue(request.protocol) ?? getRequestAgentProtocol(request);
+  if (!protocol) {
+    return 'http:';
+  }
+
+  return normalizeProtocol(protocol);
+}
+
+function getUrlAuthorityHost(host: string): string {
+  try {
+    const parsedHost = new URL(`http://${host}`);
+    return parsedHost.host;
+  } catch {
+    if (host.includes(':') && !host.startsWith('[')) {
+      return `[${host}]`;
+    }
+  }
+
+  return host;
+}
+
+function getHostWithPort(host: string, port: string | undefined): string {
+  const authorityHost = getUrlAuthorityHost(host);
+  if (!port) {
+    return authorityHost;
+  }
+
+  try {
+    const parsedHost = new URL(`http://${authorityHost}`);
+    if (parsedHost.port) {
+      return authorityHost;
+    }
+  } catch {
+    return authorityHost;
+  }
+
+  return `${authorityHost}:${port}`;
+}
+
+function getOutgoingHttpOrigin(request: RequestOptions): string | undefined {
+  const protocol = getOutgoingHttpProtocol(request);
+  const host = getStringValue(request.host);
+  const port = getStringValue(request.port);
+  if (host) {
+    return `${protocol}//${getHostWithPort(host, port)}`;
+  }
+
+  const hostname = getStringValue(request.hostname);
+  const resolvedHostname = hostname ?? 'localhost';
+  return `${protocol}//${getHostWithPort(resolvedHostname, port)}`;
+}
+
+function getOutgoingHttpUrl(request: RequestOptions & RequestUrlParts): string {
+  if (request.path) {
+    return request.path;
+  }
+
+  if (request.href) {
+    return request.href;
+  }
+
+  const pathname = request.pathname || '/';
+  if (!request.search) {
+    return pathname;
+  }
+
+  const search = request.search.startsWith('?') ? request.search : `?${request.search}`;
+  return `${pathname}${search}`;
+}
+
+function getSanitizedOutgoingHttpUrlAttributes(request: RequestOptions): Attributes {
+  const requestWithUrlParts = request as RequestOptions & RequestUrlParts;
+  return getSanitizedOutgoingUrlAttributes(
+    getOutgoingHttpUrl(requestWithUrlParts),
+    getOutgoingHttpOrigin(request),
+  );
+}
+
+function getSanitizedUndiciUrlAttributes(request: UndiciRequestInfo): Attributes {
+  return getSanitizedOutgoingUrlAttributes(request.path ?? '/', request.origin);
+}
+
+function getResourceAttributes(config: TelemetryConfig): Attributes {
+  const attributes: Attributes = {
+    [ATTR_SERVICE_NAME]: config.serviceName,
+  };
+
+  if (config.serviceVersion) {
+    attributes[ATTR_SERVICE_VERSION] = config.serviceVersion;
+  }
+
+  return attributes;
+}
+
+function createSdk(config: TelemetryConfig): NodeSDK {
+  const instrumentations: NodeSDKConfiguration['instrumentations'] = [
+    new HttpInstrumentation({
+      headersToSpanAttributes: {
+        client: { requestHeaders: [], responseHeaders: [] },
+        server: { requestHeaders: [], responseHeaders: [] },
+      },
+      requestHook: (span: Span, request: object) => {
+        if (request instanceof IncomingMessage) {
+          requestSpans.set(request, span);
+        }
+      },
+      startIncomingSpanHook: (request: IncomingMessage) =>
+        getSanitizedIncomingUrlAttributes(request, config.healthPath),
+      startOutgoingSpanHook: (request: RequestOptions) =>
+        getSanitizedOutgoingHttpUrlAttributes(request),
+      ignoreIncomingRequestHook: (request: IncomingMessage) =>
+        shouldIgnoreIncomingRequest(request, config.healthPath),
+    }),
+    new ExpressInstrumentation(),
+    new MongoDBInstrumentation(),
+    new MongooseInstrumentation(),
+    new UndiciInstrumentation({
+      startSpanHook: (request: UndiciRequestInfo) => getSanitizedUndiciUrlAttributes(request),
+    }),
+  ];
+
+  if (config.ioredisTracingEnabled) {
+    instrumentations.push(new IORedisInstrumentation());
+  }
+
+  const sdkConfig: Partial<NodeSDKConfiguration> = {
+    resource: resourceFromAttributes(getResourceAttributes(config)),
+    instrumentations,
+  };
+
+  return new NodeSDK(sdkConfig);
+}
+
+export function getTelemetryRequestSpan(request: IncomingMessage): Span | undefined {
+  return requestSpans.get(request);
+}
+
+/**
+ * NodeSDK.start has been synchronous in some supported OpenTelemetry versions
+ * and promise-returning in others, so the lifecycle wrapper accepts either form.
+ */
+function startSdk(sdk: NodeSDK): void | Promise<void> {
+  return (sdk as NodeSDK & { start: () => void | Promise<void> }).start();
+}
+
+function emitWarning(message: string): void {
+  process.emitWarning(message, { code: WARNING_CODE });
+}
+
+function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function isControllerEnabled(): boolean {
+  return status === 'starting' || status === 'started';
+}
+
+function makeController(): TelemetryController {
+  return {
+    get enabled() {
+      return isControllerEnabled();
+    },
+    get status() {
+      return status;
+    },
+    shutdown: shutdownTelemetry,
+  };
+}
+
+function ensureShutdownTaskRegistered(): void {
+  if (shutdownTaskRegistered) {
+    return;
+  }
+  shutdownTaskRegistered = true;
+  // Register with the centralized graceful-shutdown coordinator
+  // (see ../app/shutdown.ts) rather than attaching SIGTERM/SIGINT
+  // listeners directly — signal listener return values are ignored
+  // by Node, so a separate signal handler can let the coordinator
+  // exit before the async OpenTelemetry flush completes, dropping
+  // final spans during pod shutdowns.
+  registerShutdownTask('telemetry', () =>
+    withTimeout(shutdownTelemetry(), SIGNAL_SHUTDOWN_TIMEOUT_MS).catch((error) => {
+      emitWarning(`OpenTelemetry shutdown failed: ${getErrorMessage(error)}`);
+    }),
+  );
+}
+
+function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
+  let timeout: NodeJS.Timeout | undefined;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeout = setTimeout(() => {
+      reject(new Error(`timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timeout.unref?.();
+  });
+
+  return Promise.race([promise, timeoutPromise]).finally(() => {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+  });
+}
+
+export function initializeTelemetry(env: NodeJS.ProcessEnv = process.env): TelemetryController {
+  if (activeSdk || pendingSdk) {
+    return makeController();
+  }
+
+  const config = getTelemetryConfig(env);
+  if (!config.enabled || isBunRuntime()) {
+    status = 'disabled';
+    return makeController();
+  }
+
+  try {
+    const sdk = createSdk(config);
+    const result = startSdk(sdk);
+    if (result) {
+      pendingSdk = sdk;
+      status = 'starting';
+      const pendingStart = result
+        .then(() => {
+          if (pendingSdk === sdk) {
+            pendingSdk = undefined;
+            activeSdk = sdk;
+            status = 'started';
+            ensureShutdownTaskRegistered();
+          }
+        })
+        .catch((error) => {
+          if (pendingSdk === sdk) {
+            pendingSdk = undefined;
+            status = 'failed';
+            emitWarning(`OpenTelemetry initialization failed: ${getErrorMessage(error)}`);
+          }
+        });
+      startPromise = pendingStart;
+      void pendingStart.finally(() => {
+        if (startPromise === pendingStart) {
+          startPromise = undefined;
+        }
+      });
+      return makeController();
+    }
+
+    activeSdk = sdk;
+    status = 'started';
+    ensureShutdownTaskRegistered();
+    return makeController();
+  } catch (error) {
+    status = 'failed';
+    emitWarning(`OpenTelemetry initialization failed: ${getErrorMessage(error)}`);
+    return makeController();
+  }
+}
+
+async function performShutdownTelemetry(): Promise<void> {
+  if (startPromise) {
+    await startPromise;
+  }
+
+  if (!activeSdk) {
+    status = status === 'started' ? 'stopped' : status;
+    return;
+  }
+
+  const sdk = activeSdk;
+  try {
+    await sdk.shutdown();
+    activeSdk = undefined;
+    status = 'stopped';
+  } catch (error) {
+    status = 'started';
+    throw error;
+  }
+}
+
+export function shutdownTelemetry(): Promise<void> {
+  if (!shutdownPromise) {
+    shutdownPromise = performShutdownTelemetry().finally(() => {
+      shutdownPromise = undefined;
+    });
+  }
+
+  return shutdownPromise;
+}
+
+export async function resetTelemetryForTests(): Promise<void> {
+  try {
+    if (startPromise) {
+      await startPromise.catch(() => undefined);
+    }
+
+    if (shutdownPromise) {
+      await shutdownPromise.catch(() => undefined);
+    } else if (activeSdk) {
+      await Promise.resolve(activeSdk.shutdown()).catch(() => undefined);
+    }
+  } finally {
+    activeSdk = undefined;
+    pendingSdk = undefined;
+    startPromise = undefined;
+    shutdownPromise = undefined;
+    status = 'stopped';
+    requestSpans = new WeakMap<IncomingMessage, Span>();
+    shutdownTaskRegistered = false;
+  }
+}
diff --git a/packages/api/src/telemetry/stream.spec.ts b/packages/api/src/telemetry/stream.spec.ts
new file mode 100644
index 00000000000..331384256cb
--- /dev/null
+++ b/packages/api/src/telemetry/stream.spec.ts
@@ -0,0 +1,212 @@
+import { EventEmitter } from 'node:events';
+import { context, SpanKind, SpanStatusCode, trace } from '@opentelemetry/api';
+import type { Response } from 'express';
+import type { Span, Tracer } from '@opentelemetry/api';
+import type { ServerRequest } from '~/types';
+import { createSseStreamTelemetry } from './stream';
+
+interface MockResponse extends EventEmitter {
+  writableEnded: boolean;
+}
+
+function createSpan(): jest.Mocked<Span> {
+  const span = {} as jest.Mocked<Span>;
+  span.addEvent = jest.fn<jest.Mocked<Span>, Parameters<Span['addEvent']>>(() => span);
+  span.addLink = jest.fn<jest.Mocked<Span>, Parameters<Span['addLink']>>(() => span);
+  span.addLinks = jest.fn<jest.Mocked<Span>, Parameters<Span['addLinks']>>(() => span);
+  span.end = jest.fn<void, Parameters<Span['end']>>();
+  span.isRecording = jest.fn<boolean, Parameters<Span['isRecording']>>(() => true);
+  span.recordException = jest.fn<void, Parameters<Span['recordException']>>();
+  span.setAttribute = jest.fn<jest.Mocked<Span>, Parameters<Span['setAttribute']>>(() => span);
+  span.setAttributes = jest.fn<jest.Mocked<Span>, Parameters<Span['setAttributes']>>(() => span);
+  span.setStatus = jest.fn<jest.Mocked<Span>, Parameters<Span['setStatus']>>(() => span);
+  span.spanContext = jest.fn<ReturnType<Span['spanContext']>, Parameters<Span['spanContext']>>(
+    () => ({
+      spanId: '0000000000000000',
+      traceFlags: 0,
+      traceId: '00000000000000000000000000000000',
+    }),
+  );
+  span.updateName = jest.fn<jest.Mocked<Span>, Parameters<Span['updateName']>>(() => span);
+  return span;
+}
+
+function createRequest(): ServerRequest {
+  return {
+    method: 'GET',
+  } as ServerRequest;
+}
+
+function createResponse(): MockResponse {
+  const res = new EventEmitter() as MockResponse;
+  res.writableEnded = false;
+  return res;
+}
+
+function mockTracer(span: jest.Mocked<Span>): jest.Mock {
+  const startSpan = jest.fn(() => span);
+  jest.spyOn(trace, 'getTracer').mockReturnValue({ startSpan } as unknown as Tracer);
+  return startSpan;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe('createSseStreamTelemetry', () => {
+  it('records normal stream completion attributes', () => {
+    const span = createSpan();
+    const startSpan = mockTracer(span);
+    const res = createResponse();
+    const telemetry = createSseStreamTelemetry({
+      isResume: false,
+      req: createRequest(),
+      res: res as Response,
+      streamId: 'stream-1',
+    });
+    const payload = 'event: message\ndata: {"final":true}\n\n';
+
+    telemetry.recordHeadersFlushed();
+    telemetry.recordFinalEventEmitted();
+    telemetry.recordWrite(payload, { final: true });
+    res.writableEnded = true;
+    res.emit('finish');
+
+    expect(startSpan).toHaveBeenCalledWith(
+      'librechat.sse.stream',
+      {
+        kind: SpanKind.INTERNAL,
+        attributes: expect.objectContaining({
+          'http.request.method': 'GET',
+          'http.route': '/api/agents/chat/stream/:streamId',
+          'librechat.stream.id': 'stream-1',
+          'librechat.stream.resume': false,
+          'librechat.stream.route': '/api/agents/chat/stream/:streamId',
+        }),
+      },
+      context.active(),
+    );
+    expect(span.addEvent).toHaveBeenCalledWith('headers_flushed');
+    expect(span.addEvent).toHaveBeenCalledWith('first_chunk');
+    expect(span.addEvent).toHaveBeenCalledWith('final_event_emitted');
+    expect(span.addEvent).toHaveBeenCalledWith('final_event_written');
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'http.response.body.size': Buffer.byteLength(payload),
+        'librechat.stream.bytes.sent': Buffer.byteLength(payload),
+        'librechat.stream.chunks.count': 1,
+        'librechat.stream.completed': true,
+        'librechat.stream.end_reason': 'done',
+        'librechat.stream.error_event_emitted': false,
+        'librechat.stream.final_event_emitted': true,
+        'librechat.stream.final_event_written': true,
+        'librechat.stream.time_to_first_chunk_ms': expect.any(Number),
+      }),
+    );
+    expect(span.setStatus).not.toHaveBeenCalled();
+    expect(span.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('records client aborts on close before writableEnded', () => {
+    const span = createSpan();
+    mockTracer(span);
+    const res = createResponse();
+    const telemetry = createSseStreamTelemetry({
+      isResume: true,
+      req: createRequest(),
+      res: res as Response,
+      streamId: 'stream-2',
+    });
+
+    telemetry.recordWrite('event: message\ndata: {}\n\n');
+    res.emit('close');
+
+    expect(span.addEvent).toHaveBeenCalledWith('client_aborted');
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'librechat.stream.completed': false,
+        'librechat.stream.end_reason': 'client_aborted',
+      }),
+    );
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(span.setAttribute).toHaveBeenCalledWith('error.type', 'client_aborted');
+    expect(span.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('preserves subscribe_failed as the terminal reason when an error event is sent', () => {
+    const span = createSpan();
+    mockTracer(span);
+    const res = createResponse();
+    const telemetry = createSseStreamTelemetry({
+      isResume: false,
+      req: createRequest(),
+      res: res as Response,
+      streamId: 'stream-3',
+    });
+
+    telemetry.recordSubscribeFailed();
+    telemetry.recordErrorEventEmitted();
+    telemetry.recordWrite('event: error\ndata: {"error":"Failed to subscribe to stream"}\n\n');
+    res.writableEnded = true;
+    res.emit('finish');
+
+    expect(span.addEvent).toHaveBeenCalledWith('subscribe_failed');
+    expect(span.addEvent).toHaveBeenCalledWith('error_event_emitted');
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'librechat.stream.completed': false,
+        'librechat.stream.end_reason': 'subscribe_failed',
+        'librechat.stream.error_event_emitted': true,
+      }),
+    );
+    expect(span.setStatus).toHaveBeenCalledWith({ code: SpanStatusCode.ERROR });
+    expect(span.setAttribute).toHaveBeenCalledWith('error.type', 'subscribe_failed');
+    expect(span.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('ends only once when finish and close both fire', () => {
+    const span = createSpan();
+    mockTracer(span);
+    const res = createResponse();
+    const telemetry = createSseStreamTelemetry({
+      isResume: false,
+      req: createRequest(),
+      res: res as Response,
+      streamId: 'stream-4',
+    });
+
+    telemetry.recordFinalEventEmitted();
+    telemetry.recordWrite('event: message\ndata: {"final":true}\n\n', { final: true });
+    res.writableEnded = true;
+    res.emit('finish');
+    res.emit('close');
+
+    expect(span.end).toHaveBeenCalledTimes(1);
+    expect(span.setAttributes).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not count writes after the stream span has ended', () => {
+    const span = createSpan();
+    mockTracer(span);
+    const res = createResponse();
+    const telemetry = createSseStreamTelemetry({
+      isResume: false,
+      req: createRequest(),
+      res: res as Response,
+      streamId: 'stream-5',
+    });
+    const firstPayload = 'event: message\ndata: {"index":1}\n\n';
+
+    telemetry.recordWrite(firstPayload);
+    res.emit('close');
+    telemetry.recordWrite('event: message\ndata: {"index":2}\n\n');
+
+    expect(span.setAttributes).toHaveBeenCalledWith(
+      expect.objectContaining({
+        'librechat.stream.bytes.sent': Buffer.byteLength(firstPayload),
+        'librechat.stream.chunks.count': 1,
+      }),
+    );
+    expect(span.end).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/telemetry/stream.ts b/packages/api/src/telemetry/stream.ts
new file mode 100644
index 00000000000..0ef07d57f10
--- /dev/null
+++ b/packages/api/src/telemetry/stream.ts
@@ -0,0 +1,147 @@
+import { performance } from 'node:perf_hooks';
+import { context, SpanKind, SpanStatusCode, trace } from '@opentelemetry/api';
+import type { Attributes, Span } from '@opentelemetry/api';
+import type { Response } from 'express';
+import type { ServerRequest } from '~/types';
+
+const STREAM_SPAN_NAME = 'librechat.sse.stream';
+const STREAM_ROUTE = '/api/agents/chat/stream/:streamId';
+
+type StreamEndReason = 'done' | 'client_aborted' | 'server_error' | 'subscribe_failed';
+
+export interface SseStreamTelemetry {
+  recordHeadersFlushed: () => void;
+  recordWrite: (payload: string, options?: { final?: boolean }) => void;
+  recordFinalEventEmitted: () => void;
+  recordErrorEventEmitted: () => void;
+  recordSubscribeFailed: () => void;
+}
+
+interface SseStreamTelemetryOptions {
+  isResume: boolean;
+  req: ServerRequest;
+  res: Response;
+  streamId: string;
+}
+
+class SseStreamSpanTelemetry implements SseStreamTelemetry {
+  private readonly span: Span;
+  private readonly startTimeMs = performance.now();
+  private bytesSent = 0;
+  private chunksCount = 0;
+  private ended = false;
+  private errorEventEmitted = false;
+  private finalEventEmitted = false;
+  private finalEventWritten = false;
+  private firstChunkMs: number | undefined;
+  private plannedEndReason: StreamEndReason | undefined;
+
+  constructor({ isResume, req, res, streamId }: SseStreamTelemetryOptions) {
+    this.span = trace.getTracer('librechat.telemetry').startSpan(
+      STREAM_SPAN_NAME,
+      {
+        kind: SpanKind.INTERNAL,
+        attributes: {
+          'http.request.method': req.method,
+          'http.route': STREAM_ROUTE,
+          'librechat.stream.id': streamId,
+          'librechat.stream.resume': isResume,
+          'librechat.stream.route': STREAM_ROUTE,
+        },
+      },
+      context.active(),
+    );
+
+    res.once('finish', () => {
+      this.end(this.plannedEndReason ?? (this.errorEventEmitted ? 'server_error' : 'done'));
+    });
+
+    res.once('close', () => {
+      if (res.writableEnded) {
+        this.end(this.plannedEndReason ?? (this.errorEventEmitted ? 'server_error' : 'done'));
+        return;
+      }
+
+      this.span.addEvent('client_aborted');
+      this.end('client_aborted');
+    });
+  }
+
+  recordHeadersFlushed(): void {
+    this.span.addEvent('headers_flushed');
+    this.span.setAttribute('librechat.stream.headers_flushed', true);
+  }
+
+  recordWrite(payload: string, options?: { final?: boolean }): void {
+    if (this.ended) {
+      return;
+    }
+
+    this.chunksCount += 1;
+    this.bytesSent += Buffer.byteLength(payload);
+
+    if (this.firstChunkMs === undefined) {
+      this.firstChunkMs = performance.now() - this.startTimeMs;
+      this.span.addEvent('first_chunk');
+      this.span.setAttribute('librechat.stream.time_to_first_chunk_ms', this.firstChunkMs);
+    }
+
+    if (options?.final) {
+      this.finalEventWritten = true;
+      this.span.addEvent('final_event_written');
+    }
+  }
+
+  recordFinalEventEmitted(): void {
+    this.finalEventEmitted = true;
+    this.plannedEndReason = 'done';
+    this.span.addEvent('final_event_emitted');
+  }
+
+  recordErrorEventEmitted(): void {
+    this.errorEventEmitted = true;
+    this.plannedEndReason ??= 'server_error';
+    this.span.addEvent('error_event_emitted');
+  }
+
+  recordSubscribeFailed(): void {
+    this.plannedEndReason = 'subscribe_failed';
+    this.span.addEvent('subscribe_failed');
+  }
+
+  private end(reason: StreamEndReason): void {
+    if (this.ended) {
+      return;
+    }
+
+    this.ended = true;
+    const attributes: Attributes = {
+      'http.response.body.size': this.bytesSent,
+      'librechat.stream.bytes.sent': this.bytesSent,
+      'librechat.stream.chunks.count': this.chunksCount,
+      'librechat.stream.completed': reason === 'done',
+      'librechat.stream.duration_ms': performance.now() - this.startTimeMs,
+      'librechat.stream.end_reason': reason,
+      'librechat.stream.error_event_emitted': this.errorEventEmitted,
+      'librechat.stream.final_event_emitted': this.finalEventEmitted,
+      'librechat.stream.final_event_written': this.finalEventWritten,
+    };
+
+    if (this.firstChunkMs !== undefined) {
+      attributes['librechat.stream.time_to_first_chunk_ms'] = this.firstChunkMs;
+    }
+
+    this.span.setAttributes(attributes);
+
+    if (reason !== 'done') {
+      this.span.setStatus({ code: SpanStatusCode.ERROR });
+      this.span.setAttribute('error.type', reason);
+    }
+
+    this.span.end();
+  }
+}
+
+export function createSseStreamTelemetry(options: SseStreamTelemetryOptions): SseStreamTelemetry {
+  return new SseStreamSpanTelemetry(options);
+}
diff --git a/packages/api/src/tools/definitions.spec.ts b/packages/api/src/tools/definitions.spec.ts
index 4dc1acdf838..316bfcf44de 100644
--- a/packages/api/src/tools/definitions.spec.ts
+++ b/packages/api/src/tools/definitions.spec.ts
@@ -1,11 +1,12 @@
-import { loadToolDefinitions } from './definitions';
-import { toolkitExpansion, toolkitParent } from './toolkits/mapping';
-import { getToolDefinition } from './registry/definitions';
+import { Providers } from '@librechat/agents';
 import type {
   LoadToolDefinitionsParams,
   LoadToolDefinitionsDeps,
   ActionToolDefinition,
 } from './definitions';
+import { toolkitExpansion, toolkitParent } from './toolkits/mapping';
+import { getToolDefinition } from './registry/definitions';
+import { loadToolDefinitions } from './definitions';
 
 describe('definitions.ts', () => {
   const mockGetOrFetchMCPServerTools = jest.fn().mockResolvedValue(null);
@@ -428,6 +429,69 @@ describe('definitions.ts', () => {
         expect(getItemDef?.description).toBe('Get a specific item');
       });
 
+      it('union-flattens MCP tool schemas for Google, but preserves unions otherwise', async () => {
+        const mockServerTools = {
+          issue_write_mcp_github: {
+            function: {
+              name: 'issue_write_mcp_github',
+              description: 'Write an issue',
+              parameters: {
+                type: 'object',
+                properties: {
+                  repo: { type: 'string' },
+                  payload: {
+                    anyOf: [
+                      {
+                        type: 'object',
+                        properties: { action: { const: 'create' }, title: { type: 'string' } },
+                      },
+                      {
+                        type: 'object',
+                        properties: { action: { const: 'update' }, number: { type: 'number' } },
+                      },
+                    ],
+                  },
+                },
+                required: ['repo'],
+              },
+            },
+          },
+        };
+        mockGetOrFetchMCPServerTools.mockResolvedValue(mockServerTools);
+
+        const deps: LoadToolDefinitionsDeps = {
+          getOrFetchMCPServerTools: mockGetOrFetchMCPServerTools,
+          isBuiltInTool: mockIsBuiltInTool,
+        };
+
+        const googleResult = await loadToolDefinitions(
+          {
+            userId: 'user-123',
+            agentId: 'agent-123',
+            tools: ['issue_write_mcp_github'],
+            provider: Providers.GOOGLE,
+          },
+          deps,
+        );
+        const googleDef = googleResult.toolDefinitions.find(
+          (d) => d.name === 'issue_write_mcp_github',
+        );
+        expect(JSON.stringify(googleDef?.parameters)).not.toContain('anyOf');
+        expect(
+          (googleDef?.parameters as { properties: Record<string, { properties: object }> })
+            .properties.payload.properties,
+        ).toEqual({ action: { type: 'string', enum: ['create'] }, title: { type: 'string' } });
+
+        const defaultResult = await loadToolDefinitions(
+          { userId: 'user-123', agentId: 'agent-123', tools: ['issue_write_mcp_github'] },
+          deps,
+        );
+        const defaultDef = defaultResult.toolDefinitions.find(
+          (d) => d.name === 'issue_write_mcp_github',
+        );
+        expect(JSON.stringify(defaultDef?.parameters)).toContain('anyOf');
+      });
+
       it('should load MCP tools with hyphenated server names (server-one)', async () => {
         const mockServerTools = {
           'list_items_mcp_server-one': {
@@ -553,6 +617,78 @@ describe('definitions.ts', () => {
         expect(toolDef.name).toBe('list_items_mcp_my-server');
         expect((toolDef as { serverName?: string }).serverName).toBe('my-server');
       });
+
+      it('should convert empty MCP tool descriptions to undefined', async () => {
+        const mockServerTools = {
+          no_desc_tool_mcp_asana: {
+            function: {
+              name: 'no_desc_tool_mcp_asana',
+              description: '',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+          has_desc_tool_mcp_asana: {
+            function: {
+              name: 'has_desc_tool_mcp_asana',
+              description: 'List tasks',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        };
+
+        mockGetOrFetchMCPServerTools.mockResolvedValue(mockServerTools);
+
+        const params: LoadToolDefinitionsParams = {
+          userId: 'user-123',
+          agentId: 'agent-123',
+          tools: ['sys__all__sys_mcp_asana'],
+        };
+
+        const deps: LoadToolDefinitionsDeps = {
+          getOrFetchMCPServerTools: mockGetOrFetchMCPServerTools,
+          isBuiltInTool: mockIsBuiltInTool,
+        };
+
+        const result = await loadToolDefinitions(params, deps);
+
+        const noDef = result.toolDefinitions.find((d) => d.name === 'no_desc_tool_mcp_asana');
+        expect(noDef).toBeDefined();
+        expect(noDef?.description).toBeUndefined();
+
+        const hasDef = result.toolDefinitions.find((d) => d.name === 'has_desc_tool_mcp_asana');
+        expect(hasDef).toBeDefined();
+        expect(hasDef?.description).toBe('List tasks');
+      });
+
+      it('should convert empty description to undefined for directly named MCP tool', async () => {
+        const toolName = 'no_desc_tool_mcp_asana';
+        mockGetOrFetchMCPServerTools.mockResolvedValue({
+          [toolName]: {
+            function: {
+              name: toolName,
+              description: '',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        });
+
+        const params: LoadToolDefinitionsParams = {
+          userId: 'user-123',
+          agentId: 'agent-123',
+          tools: [toolName],
+        };
+
+        const deps: LoadToolDefinitionsDeps = {
+          getOrFetchMCPServerTools: mockGetOrFetchMCPServerTools,
+          isBuiltInTool: mockIsBuiltInTool,
+        };
+
+        const result = await loadToolDefinitions(params, deps);
+
+        const def = result.toolDefinitions.find((d) => d.name === toolName);
+        expect(def).toBeDefined();
+        expect(def?.description).toBeUndefined();
+      });
     });
 
     describe('toolkit expansion', () => {
diff --git a/packages/api/src/tools/definitions.ts b/packages/api/src/tools/definitions.ts
index 7f82bc06ece..4babe3ed81f 100644
--- a/packages/api/src/tools/definitions.ts
+++ b/packages/api/src/tools/definitions.ts
@@ -5,11 +5,12 @@
  * @module packages/api/src/tools/definitions
  */
 
+import { Providers } from '@librechat/agents';
 import { Constants, isActionTool } from 'librechat-data-provider';
-import type { AgentToolOptions } from 'librechat-data-provider';
 import type { LCToolRegistry, JsonSchemaType, LCTool, GenericTool } from '@librechat/agents';
+import type { AgentToolOptions } from 'librechat-data-provider';
 import type { ToolDefinition } from './classification';
-import { resolveJsonSchemaRefs, normalizeJsonSchema } from '~/mcp/zod';
+import { resolveJsonSchemaRefs, normalizeJsonSchema, sanitizeGeminiSchema } from '~/mcp/zod';
 import { buildToolClassification } from './classification';
 import { getToolDefinition } from './registry/definitions';
 import { toolkitExpansion } from './toolkits/mapping';
@@ -39,6 +40,8 @@ export interface LoadToolDefinitionsParams {
   programmaticToolsEnabled?: boolean;
   /** Whether code execution is enabled and requested by this agent */
   codeExecutionEnabled?: boolean;
+  /** Agent provider — Gemini/Vertex tool schemas get union-flattened for compatibility */
+  provider?: Providers;
 }
 
 export interface ActionToolDefinition {
@@ -83,9 +86,21 @@ export async function loadToolDefinitions(
     deferredToolsEnabled = false,
     programmaticToolsEnabled = false,
     codeExecutionEnabled = false,
+    provider,
   } = params;
   const { getOrFetchMCPServerTools, isBuiltInTool, getActionToolDefinitions } = deps;
 
+  const isGoogle = provider === Providers.GOOGLE || provider === Providers.VERTEXAI;
+
+  /** Normalizes MCP tool params, additionally union-flattening for the Gemini/Vertex path. */
+  const buildMcpParameters = (mcpParams?: JsonSchemaType): JsonSchemaType | undefined => {
+    if (!mcpParams) {
+      return undefined;
+    }
+    const normalized = normalizeJsonSchema(resolveJsonSchemaRefs(mcpParams));
+    return isGoogle ? sanitizeGeminiSchema(normalized) : normalized;
+  };
+
   const emptyResult: LoadToolDefinitionsResult = {
     toolDefinitions: [],
     toolRegistry: new Map(),
@@ -158,10 +173,8 @@ export async function loadToolDefinitions(
         if (toolDef?.function) {
           mcpToolDefs.push({
             name: actualToolName,
-            description: toolDef.function.description,
-            parameters: toolDef.function.parameters
-              ? normalizeJsonSchema(resolveJsonSchemaRefs(toolDef.function.parameters))
-              : undefined,
+            description: toolDef.function.description || undefined,
+            parameters: buildMcpParameters(toolDef.function.parameters),
             serverName,
           });
         }
@@ -173,10 +186,8 @@ export async function loadToolDefinitions(
     if (toolDef?.function) {
       mcpToolDefs.push({
         name: toolName,
-        description: toolDef.function.description,
-        parameters: toolDef.function.parameters
-          ? normalizeJsonSchema(resolveJsonSchemaRefs(toolDef.function.parameters))
-          : undefined,
+        description: toolDef.function.description || undefined,
+        parameters: buildMcpParameters(toolDef.function.parameters),
         serverName,
       });
     }
diff --git a/packages/api/src/tools/toolkits/gemini.ts b/packages/api/src/tools/toolkits/gemini.ts
index 5eb0cec9fd8..d147ed6f564 100644
--- a/packages/api/src/tools/toolkits/gemini.ts
+++ b/packages/api/src/tools/toolkits/gemini.ts
@@ -75,7 +75,15 @@ const geminiImageGenJsonSchema: ExtendedJsonSchema = {
   required: ['prompt'],
 };
 
-export const geminiToolkit = {
+export const geminiToolkit: {
+  readonly gemini_image_gen: {
+    readonly name: 'gemini_image_gen';
+    readonly description: string;
+    readonly description_for_model: 'Use this tool to generate images from text descriptions using Vertex AI Gemini.\n1. Prompts should be detailed and specific for best results.\n2. One image per function call. Create only 1 image per request.\n3. IMPORTANT: When user asks to "edit", "modify", "change", or "swap" elements in an existing image:\n   - ALWAYS include the original image ID in the image_ids array\n   - Describe the desired changes clearly in the prompt\n   - The tool will generate a new image based on the original image context + your prompt\n4. IMPORTANT: For editing requests, use DIRECT editing instructions:\n   - User says "remove the gun" → prompt should be "remove the gun from this image"\n   - User says "make it blue" → prompt should be "make this image blue"\n   - User says "add sunglasses" → prompt should be "add sunglasses to this image"\n   - DO NOT reconstruct or modify the original prompt - use the user\'s editing instruction directly\n   - ALWAYS include the image being edited in image_ids array\n5. OPTIONAL: Use image_ids to provide context images that will influence the generation:\n   - Include any relevant image IDs from the conversation in the image_ids array\n   - These images will be used as visual context/inspiration for the new generation\n   - For "editing" requests, always include the image being "edited"\n6. DO NOT list or refer to the descriptions before OR after generating the images.\n7. Always mention the image type (photo, oil painting, watercolor painting, illustration, cartoon, drawing, vector, render, etc.) at the beginning of the prompt.\n8. Use aspectRatio to control the shape of the image:\n   - 16:9 or 3:2 for landscape/wide images\n   - 9:16 or 2:3 for portrait/tall images\n   - 21:9 for ultra-wide/cinematic images\n   - 1:1 for square images (default)\n9. Use imageSize to control the resolution: 1K (standard), 2K (high), 4K (maximum quality).\n\nThe prompt should be a detailed paragraph describing every part of the image in concrete, objective detail.';
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+} = {
   gemini_image_gen: {
     name: 'gemini_image_gen' as const,
     description: getGeminiImageGenDescription(),
diff --git a/packages/api/src/tools/toolkits/mapping.ts b/packages/api/src/tools/toolkits/mapping.ts
index e6cb14d9bcf..fc657b98e26 100644
--- a/packages/api/src/tools/toolkits/mapping.ts
+++ b/packages/api/src/tools/toolkits/mapping.ts
@@ -3,7 +3,9 @@
  * When a toolkit key appears in an agent's tool list,
  * these extra tools should also be included.
  */
-export const toolkitExpansion = {
+export const toolkitExpansion: {
+  readonly image_gen_oai: readonly ['image_edit_oai'];
+} = {
   image_gen_oai: ['image_edit_oai'],
 } as const satisfies Readonly<Record<string, readonly string[]>>;
 
diff --git a/packages/api/src/tools/toolkits/oai.ts b/packages/api/src/tools/toolkits/oai.ts
index 9786b0571de..65c00891243 100644
--- a/packages/api/src/tools/toolkits/oai.ts
+++ b/packages/api/src/tools/toolkits/oai.ts
@@ -131,7 +131,20 @@ Guidelines:
   required: ['image_ids', 'prompt'],
 };
 
-export const oaiToolkit = {
+export const oaiToolkit: {
+  readonly image_gen_oai: {
+    readonly name: 'image_gen_oai';
+    readonly description: string;
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+  readonly image_edit_oai: {
+    readonly name: 'image_edit_oai';
+    readonly description: string;
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+} = {
   image_gen_oai: {
     name: 'image_gen_oai' as const,
     description: getImageGenDescription(),
diff --git a/packages/api/src/types/anthropic.ts b/packages/api/src/types/anthropic.ts
index 7f62a149747..9c418e61dbc 100644
--- a/packages/api/src/types/anthropic.ts
+++ b/packages/api/src/types/anthropic.ts
@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { Dispatcher } from 'undici';
 import { AuthKeys, anthropicSchema, TVertexAISchema } from 'librechat-data-provider';
-import type { AnthropicClientOptions } from '@librechat/agents';
 import type { ThinkingDisplayWireValue } from 'librechat-data-provider';
-import type { LLMConfigResult } from './openai';
+import type { AnthropicClientOptions } from '@librechat/agents';
 import type { GoogleServiceKey } from '../utils/key';
+import type { LLMConfigResult } from './openai';
 
 export type AnthropicParameters = z.infer<typeof anthropicSchema>;
 
@@ -80,12 +80,21 @@ export interface AnthropicConfigOptions {
   proxy?: string | null;
   /** URL for a reverse proxy, if used */
   reverseProxyUrl?: string | null;
+  /** Whether the reverse proxy URL came from a user-stored credential */
+  baseURLIsUserProvided?: boolean;
+  /** Admin-approved internal host:port exemptions for user-provided base URLs */
+  allowedAddresses?: string[] | null;
   /** Default parameters to apply only if fields are undefined */
   defaultParams?: Record<string, unknown>;
   /** Additional parameters to add to the configuration */
   addParams?: Record<string, unknown>;
   /** Parameters to drop/exclude from the configuration */
   dropParams?: string[];
+  /**
+   * Admin-configured custom request headers (with unresolved placeholders).
+   * Merged beneath provider-managed headers and resolved at request time.
+   */
+  headers?: Record<string, string>;
   /** Vertex AI specific options for Google Cloud configuration */
   vertexOptions?: VertexAIClientOptions;
   /** Full Vertex AI configuration including model mappings from YAML config */
@@ -98,7 +107,7 @@ export interface AnthropicConfigOptions {
 export type AnthropicLLMConfigResult = LLMConfigResult<
   AnthropicClientOptions & {
     clientOptions?: {
-      fetchOptions?: { dispatcher: Dispatcher };
+      fetchOptions?: { dispatcher?: Dispatcher; redirect?: RequestRedirect };
     };
     stream?: boolean;
   }
diff --git a/packages/api/src/types/bedrock.ts b/packages/api/src/types/bedrock.ts
index 8f34b2864d1..c60658e33d7 100644
--- a/packages/api/src/types/bedrock.ts
+++ b/packages/api/src/types/bedrock.ts
@@ -8,6 +8,13 @@ import type { BedrockConverseInput } from 'librechat-data-provider';
  */
 export type BedrockCredentials = Partial<AwsCredentialIdentity>;
 
+/**
+ * User-provided Bedrock credentials can be either AWS credentials or an API key.
+ */
+export type BedrockUserCredentials = BedrockCredentials & {
+  bearerToken?: string;
+};
+
 /**
  * AWS Bedrock Guardrail configuration
  * @see https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_GuardrailConfiguration.html
@@ -19,6 +26,8 @@ export interface GuardrailConfiguration {
   guardrailVersion: string;
   /** The trace behavior for the guardrail */
   trace?: 'enabled' | 'disabled' | 'enabled_full';
+  /** The processing mode for guardrail; 'sync' is the default guardrail behavior if unset */
+  streamProcessingMode?: 'sync' | 'async';
 }
 
 /**
@@ -39,6 +48,8 @@ export interface BedrockConfigOptions {
   client?: BedrockRuntimeClient;
   /** AWS credentials */
   credentials?: BedrockCredentials;
+  /** AWS shared config profile for the SDK credential provider chain */
+  profile?: string;
   /** Custom endpoint host for reverse proxy */
   endpointHost?: string;
   /** Guardrail configuration for content filtering */
@@ -55,6 +66,7 @@ export interface BedrockLLMConfigResult {
     region?: string;
     client?: BedrockRuntimeClient;
     credentials?: BedrockCredentials;
+    profile?: string;
     endpointHost?: string;
     guardrailConfig?: GuardrailConfiguration;
     applicationInferenceProfile?: string;
diff --git a/packages/api/src/types/events.ts b/packages/api/src/types/events.ts
index d068888b172..360929d0347 100644
--- a/packages/api/src/types/events.ts
+++ b/packages/api/src/types/events.ts
@@ -14,6 +14,9 @@ export type CreatedEvent = {
     text?: string;
     sender: string;
     isCreatedByUser: boolean;
+    /** Quoted excerpts referenced on this turn, carried through resumable job
+     *  metadata so reconstructed user messages keep their `MessageQuotes`. */
+    quotes?: string[];
   };
   streamId: string;
 };
diff --git a/packages/api/src/types/google.ts b/packages/api/src/types/google.ts
index c6a53f961aa..bf26f23a47f 100644
--- a/packages/api/src/types/google.ts
+++ b/packages/api/src/types/google.ts
@@ -27,4 +27,8 @@ export interface GoogleConfigOptions {
   streamRate?: number;
   /** Model to use for title generation */
   titleModel?: string;
+  /** Force Vertex AI auth semantics even when a Google API key is configured */
+  forceVertex?: boolean;
+  /** GCP project id for Vertex AI ADC/service-account authentication */
+  projectId?: string;
 }
diff --git a/packages/api/src/types/http.ts b/packages/api/src/types/http.ts
index 219b2729f7f..b3a34df3838 100644
--- a/packages/api/src/types/http.ts
+++ b/packages/api/src/types/http.ts
@@ -16,6 +16,8 @@ export type RequestBody = {
   model?: string;
   key?: string;
   endpointOption?: Partial<TEndpointOption>;
+  /** Browser IANA timezone used to resolve local-time prompt variables (e.g. `{{current_datetime}}`). */
+  timezone?: string;
 };
 
 export type ServerRequest = Request<unknown, unknown, RequestBody> & {
diff --git a/packages/api/src/types/openai.ts b/packages/api/src/types/openai.ts
index 646c814c2d8..e0c7923ed74 100644
--- a/packages/api/src/types/openai.ts
+++ b/packages/api/src/types/openai.ts
@@ -16,6 +16,8 @@ export interface OpenAIConfigOptions {
   modelOptions?: OpenAIModelOptions;
   directEndpoint?: boolean;
   reverseProxyUrl?: string | null;
+  baseURLIsUserProvided?: boolean;
+  allowedAddresses?: string[] | null;
   defaultQuery?: Record<string, string | undefined>;
   headers?: Record<string, string>;
   proxy?: string | null;
@@ -30,7 +32,10 @@ export type OpenAIConfiguration = OpenAIClientOptions['configuration'];
 
 export type OAIClientOptions = Omit<OpenAIClientOptions, 'verbosity'> & {
   include_reasoning?: boolean;
+  /** Replays `reasoning_content` on tool-bearing turns (DeepSeek thinking-mode, #13366). */
+  includeReasoningContent?: boolean;
   promptCache?: boolean;
+  promptCacheTtl?: '5m' | '1h';
   _lc_stream_delay?: number;
   verbosity?: string | null;
 };
diff --git a/packages/api/src/utils/__tests__/quotes.test.ts b/packages/api/src/utils/__tests__/quotes.test.ts
new file mode 100644
index 00000000000..54d8e9dcdbf
--- /dev/null
+++ b/packages/api/src/utils/__tests__/quotes.test.ts
@@ -0,0 +1,63 @@
+import { QUOTE_MAX_COUNT, QUOTE_MAX_LENGTH, mergeQuotedText, getReferencedQuotes } from '../quotes';
+
+describe('getReferencedQuotes', () => {
+  it('returns null for non-array input', () => {
+    expect(getReferencedQuotes(undefined)).toBeNull();
+    expect(getReferencedQuotes(null)).toBeNull();
+    expect(getReferencedQuotes('quote')).toBeNull();
+    expect(getReferencedQuotes({ 0: 'quote' })).toBeNull();
+  });
+
+  it('returns null when nothing usable remains', () => {
+    expect(getReferencedQuotes([])).toBeNull();
+    expect(getReferencedQuotes(['', '   ', 42, null])).toBeNull();
+  });
+
+  it('trims, drops empties/non-strings, and keeps order', () => {
+    expect(getReferencedQuotes(['  hello  ', '', 7, 'world'])).toEqual(['hello', 'world']);
+  });
+
+  it('caps each excerpt to QUOTE_MAX_LENGTH', () => {
+    const long = 'a'.repeat(QUOTE_MAX_LENGTH + 50);
+    const result = getReferencedQuotes([long]);
+    expect(result).not.toBeNull();
+    expect(result?.[0]).toHaveLength(QUOTE_MAX_LENGTH);
+  });
+
+  it('caps the number of excerpts to QUOTE_MAX_COUNT', () => {
+    const many = Array.from({ length: QUOTE_MAX_COUNT + 5 }, (_, i) => `q${i}`);
+    expect(getReferencedQuotes(many)).toHaveLength(QUOTE_MAX_COUNT);
+  });
+});
+
+describe('mergeQuotedText', () => {
+  it('returns the original text when there are no quotes', () => {
+    expect(mergeQuotedText('hello', [])).toBe('hello');
+  });
+
+  it('prepends a single quote as a Markdown blockquote', () => {
+    expect(mergeQuotedText('What does this mean?', ['the selected text'])).toBe(
+      '> the selected text\n\nWhat does this mean?',
+    );
+  });
+
+  it('prefixes every line of a multi-line excerpt', () => {
+    expect(mergeQuotedText('explain', ['line one\nline two'])).toBe(
+      '> line one\n> line two\n\nexplain',
+    );
+  });
+
+  it('renders empty lines within an excerpt as bare blockquote markers', () => {
+    expect(mergeQuotedText('explain', ['a\n\nb'])).toBe('> a\n>\n> b\n\nexplain');
+  });
+
+  it('separates multiple excerpts with a blank line', () => {
+    expect(mergeQuotedText('compare these', ['first', 'second'])).toBe(
+      '> first\n\n> second\n\ncompare these',
+    );
+  });
+
+  it('returns just the blockquote when the user text is empty', () => {
+    expect(mergeQuotedText('', ['only quote'])).toBe('> only quote');
+  });
+});
diff --git a/packages/api/src/utils/axios.ts b/packages/api/src/utils/axios.ts
index bab5242d8e2..918e841d9e5 100644
--- a/packages/api/src/utils/axios.ts
+++ b/packages/api/src/utils/axios.ts
@@ -1,5 +1,5 @@
-import { Buffer } from 'buffer';
 import axios from 'axios';
+import { Buffer } from 'buffer';
 import { logger } from '@librechat/data-schemas';
 import type { AxiosInstance, AxiosProxyConfig, AxiosError } from 'axios';
 
@@ -45,7 +45,7 @@ export const logAxiosError = ({
 }: {
   message: string;
   error: AxiosError | Error | unknown;
-}) => {
+}): string => {
   let logMessage = message;
   try {
     const stack =
diff --git a/packages/api/src/utils/code.ts b/packages/api/src/utils/code.ts
index 9ac814a52b7..4293ef7f052 100644
--- a/packages/api/src/utils/code.ts
+++ b/packages/api/src/utils/code.ts
@@ -7,5 +7,5 @@ import https from 'https';
  * on Node 19+ (keepAlive: true by default), tainted sockets re-enter the global pool
  * and kill unrelated requests (e.g., node-fetch in CodeExecutor) after the idle timeout.
  */
-export const codeServerHttpAgent = new http.Agent({ keepAlive: false });
-export const codeServerHttpsAgent = new https.Agent({ keepAlive: false });
+export const codeServerHttpAgent: http.Agent = new http.Agent({ keepAlive: false });
+export const codeServerHttpsAgent: https.Agent = new https.Agent({ keepAlive: false });
diff --git a/packages/api/src/utils/env.spec.ts b/packages/api/src/utils/env.spec.ts
index e28e2da43d8..7873083d37f 100644
--- a/packages/api/src/utils/env.spec.ts
+++ b/packages/api/src/utils/env.spec.ts
@@ -990,6 +990,7 @@ describe('processMCPEnv', () => {
     process.env.OAUTH_CLIENT_ID = 'oauth-client-id-value';
     process.env.OAUTH_CLIENT_SECRET = 'oauth-client-secret-value';
     process.env.MCP_SERVER_URL = 'https://mcp.example.com';
+    process.env.MCP_PROXY_URL = 'http://proxy.example.com:8080';
   });
 
   afterEach(() => {
@@ -998,6 +999,7 @@ describe('processMCPEnv', () => {
     delete process.env.OAUTH_CLIENT_ID;
     delete process.env.OAUTH_CLIENT_SECRET;
     delete process.env.MCP_SERVER_URL;
+    delete process.env.MCP_PROXY_URL;
   });
 
   it('should return null/undefined as-is', () => {
@@ -1045,6 +1047,47 @@ describe('processMCPEnv', () => {
     });
   });
 
+  it('should process outbound proxy for remote MCP options', () => {
+    const options: MCPOptions = {
+      type: 'sse',
+      url: '${MCP_SERVER_URL}/sse',
+      proxy: '${MCP_PROXY_URL}',
+    };
+
+    const result = processMCPEnv({ options });
+
+    expect(result).toEqual({
+      type: 'sse',
+      url: 'https://mcp.example.com/sse',
+      proxy: 'http://proxy.example.com:8080',
+    });
+  });
+
+  it('should not process user-controlled placeholders in outbound proxy', () => {
+    const user = createTestUser({ id: 'user-proxy-target' });
+    const body = { conversationId: 'conv-1', parentMessageId: 'parent-1', messageId: 'msg-1' };
+    const options: MCPOptions = {
+      type: 'sse',
+      url: '${MCP_SERVER_URL}/sse',
+      proxy:
+        'http://proxy.example.com/{{CUSTOM_PROXY_PATH}}/{{LIBRECHAT_USER_ID}}/{{LIBRECHAT_BODY_MESSAGEID}}',
+    };
+
+    const result = processMCPEnv({
+      options,
+      user,
+      body,
+      customUserVars: { CUSTOM_PROXY_PATH: 'tenant-proxy' },
+    });
+
+    expect(result).toEqual({
+      type: 'sse',
+      url: 'https://mcp.example.com/sse',
+      proxy:
+        'http://proxy.example.com/{{CUSTOM_PROXY_PATH}}/{{LIBRECHAT_USER_ID}}/{{LIBRECHAT_BODY_MESSAGEID}}',
+    });
+  });
+
   it('should process OAuth configuration with environment variables', () => {
     const options: MCPOptions = {
       type: 'streamable-http',
@@ -1083,6 +1126,42 @@ describe('processMCPEnv', () => {
     });
   });
 
+  it('should process user placeholders in oauth_headers', () => {
+    const user = createTestUser({ id: 'user-123', email: 'test@example.com' });
+    const options: MCPOptions = {
+      type: 'streamable-http',
+      url: 'https://mcp.example.com/api',
+      oauth_headers: {
+        'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+        'X-Static': 'static-value',
+      },
+    };
+
+    const result = processMCPEnv({ options, user });
+
+    expect('oauth_headers' in result! && result.oauth_headers).toEqual({
+      'X-User-Id': 'user-123',
+      'X-Static': 'static-value',
+    });
+  });
+
+  it('should NOT resolve user placeholders in oauth_headers when dbSourced', () => {
+    const user = createTestUser({ id: 'user-123' });
+    const options: MCPOptions = {
+      type: 'streamable-http',
+      url: 'https://mcp.example.com/api',
+      oauth_headers: {
+        'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+      },
+    };
+
+    const result = processMCPEnv({ options, user, dbSourced: true });
+
+    expect('oauth_headers' in result! && result.oauth_headers).toEqual({
+      'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+    });
+  });
+
   it('should process user field placeholders in all fields', () => {
     const user = createTestUser({
       id: 'user-123',
diff --git a/packages/api/src/utils/env.ts b/packages/api/src/utils/env.ts
index ef37b41b006..61922e6424b 100644
--- a/packages/api/src/utils/env.ts
+++ b/packages/api/src/utils/env.ts
@@ -272,6 +272,13 @@ function processSingleValue({
   return value;
 }
 
+function processAdminValue(originalValue: string, dbSourced: boolean): string {
+  if (typeof originalValue !== 'string') {
+    return String(originalValue);
+  }
+  return dbSourced ? originalValue : extractEnvVariable(originalValue);
+}
+
 /**
  * Recursively processes an object to replace environment variables in string values
  * @param params - Processing parameters
@@ -378,6 +385,22 @@ export function processMCPEnv(params: {
     }
   }
 
+  // Process OAuth headers if they exist; sent on OAuth discovery/token requests
+  if ('oauth_headers' in newObj && newObj.oauth_headers) {
+    const processedOAuthHeaders: Record<string, string> = {};
+    for (const [key, originalValue] of Object.entries(newObj.oauth_headers)) {
+      processedOAuthHeaders[key] = processSingleValue({
+        user,
+        body,
+        dbSourced,
+        originalValue,
+        customUserVars,
+        isHeader: true,
+      });
+    }
+    newObj.oauth_headers = processedOAuthHeaders;
+  }
+
   // Process URL if it exists (for WebSocket, SSE, StreamableHTTP types)
   if ('url' in newObj && newObj.url) {
     newObj.url = processSingleValue({
@@ -389,6 +412,11 @@ export function processMCPEnv(params: {
     });
   }
 
+  // Process outbound proxy if it exists (for SSE and StreamableHTTP types)
+  if ('proxy' in newObj && newObj.proxy) {
+    newObj.proxy = processAdminValue(newObj.proxy, dbSourced);
+  }
+
   // Process OAuth configuration if it exists (for all transport types)
   if ('oauth' in newObj && newObj.oauth) {
     const processedOAuth: Record<string, boolean | string | string[] | undefined> = {};
@@ -497,7 +525,7 @@ export function resolveHeaders(options?: {
   user?: Partial<IUser> | { id: string };
   body?: RequestBody;
   customUserVars?: Record<string, string>;
-}) {
+}): Record<string, string> {
   const { headers, user, body, customUserVars } = options ?? {};
   const inputHeaders = headers ?? {};
 
diff --git a/packages/api/src/utils/generators.ts b/packages/api/src/utils/generators.ts
index 902721df34b..2e0416cb89a 100644
--- a/packages/api/src/utils/generators.ts
+++ b/packages/api/src/utils/generators.ts
@@ -2,22 +2,36 @@ import fetch from 'node-fetch';
 import { logger } from '@librechat/data-schemas';
 import { GraphEvents, sleep } from '@librechat/agents';
 import type { Response as ServerResponse } from 'express';
+import type { Agent as HttpsAgent } from 'node:https';
+import type { Agent as HttpAgent } from 'node:http';
+import type { URL as NodeURL } from 'node:url';
 import type { ServerSentEvent } from '~/types';
 import { sendEvent } from './events';
 
+type SSRFSafeAgents = {
+  httpAgent: HttpAgent;
+  httpsAgent: HttpsAgent;
+};
+
 /**
  * Makes a function to make HTTP request and logs the process.
  * @param params
  * @param params.directEndpoint - Whether to use a direct endpoint.
  * @param params.reverseProxyUrl - The reverse proxy URL to use for the request.
+ * @param params.ssrfAgents - Optional SSRF-safe agents for user-provided URLs.
+ * @param params.redirect - Optional redirect policy for user-provided URLs.
  * @returns A promise that resolves to the response of the fetch request.
  */
 export function createFetch({
   directEndpoint = false,
   reverseProxyUrl = '',
+  ssrfAgents,
+  redirect,
 }: {
   directEndpoint?: boolean;
   reverseProxyUrl?: string;
+  ssrfAgents?: SSRFSafeAgents;
+  redirect?: fetch.RequestRedirect;
 }) {
   /**
    * Makes an HTTP request and logs the process.
@@ -34,10 +48,18 @@ export function createFetch({
       url = reverseProxyUrl;
     }
     logger.debug(`Making request to ${url}`);
+    const requestInit = { ...init };
+    if (ssrfAgents) {
+      requestInit.agent = (parsedURL: NodeURL) =>
+        parsedURL.protocol === 'http:' ? ssrfAgents.httpAgent : ssrfAgents.httpsAgent;
+    }
+    if (redirect) {
+      requestInit.redirect = redirect;
+    }
     if (typeof Bun !== 'undefined') {
-      return await fetch(url, init);
+      return await fetch(url, requestInit);
     }
-    return await fetch(url, init);
+    return await fetch(url, requestInit);
   };
 }
 
@@ -46,19 +68,23 @@ export function createFetch({
  * @param res - The response object to send events to
  * @returns Object containing handler functions
  */
-export function createStreamEventHandlers(res: ServerResponse) {
+export function createStreamEventHandlers(res: ServerResponse): {
+  on_run_step: (event: ServerSentEvent) => void;
+  on_message_delta: (event: ServerSentEvent) => void;
+  on_reasoning_delta: (event: ServerSentEvent) => void;
+} {
   return {
-    [GraphEvents.ON_RUN_STEP]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_RUN_STEP]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
     },
-    [GraphEvents.ON_MESSAGE_DELTA]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_MESSAGE_DELTA]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
     },
-    [GraphEvents.ON_REASONING_DELTA]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_REASONING_DELTA]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
@@ -67,7 +93,7 @@ export function createStreamEventHandlers(res: ServerResponse) {
 }
 
 export function createHandleLLMNewToken(streamRate: number) {
-  return async function () {
+  return async function (): Promise<void> {
     if (streamRate) {
       await sleep(streamRate);
     }
diff --git a/packages/api/src/utils/graph.ts b/packages/api/src/utils/graph.ts
index beee50fa812..e5e248435c1 100644
--- a/packages/api/src/utils/graph.ts
+++ b/packages/api/src/utils/graph.ts
@@ -12,10 +12,16 @@ import {
  * Pre-computed regex for matching the Graph token placeholder.
  * Escapes curly braces in the placeholder string for safe regex use.
  */
-const GRAPH_TOKEN_REGEX = new RegExp(
-  GRAPH_TOKEN_PLACEHOLDER.replace(/[{}]/g, '\\$&'),
-  'g',
-);
+const GRAPH_TOKEN_REGEX = new RegExp(GRAPH_TOKEN_PLACEHOLDER.replace(/[{}]/g, '\\$&'), 'g');
+
+type GraphTokenResolvable =
+  | string
+  | string[]
+  | boolean
+  | number
+  | null
+  | undefined
+  | Record<string, string | string[] | boolean | number | null | undefined>;
 
 /**
  * Response from a Graph API token exchange.
@@ -71,26 +77,48 @@ export function recordContainsGraphTokenPlaceholder(
   return Object.values(record).some(containsGraphTokenPlaceholder);
 }
 
+function valueContainsGraphTokenPlaceholder(value: GraphTokenResolvable): boolean {
+  if (typeof value === 'string') {
+    return containsGraphTokenPlaceholder(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsGraphTokenPlaceholder);
+  }
+  if (value == null || typeof value !== 'object') {
+    return false;
+  }
+  return Object.values(value).some(valueContainsGraphTokenPlaceholder);
+}
+
 /**
- * Checks if MCP options contain the Graph token placeholder in headers, env, or url.
+ * Checks if MCP options contain the Graph token placeholder in connection fields.
  * @param options - The MCP options object
  * @returns True if any field contains the placeholder
  */
 export function mcpOptionsContainGraphTokenPlaceholder(options: {
+  args?: string[];
   headers?: Record<string, string>;
   env?: Record<string, string>;
+  oauth?: Record<string, string | string[] | boolean | number | null | undefined>;
+  oauth_headers?: Record<string, string>;
   url?: string;
 }): boolean {
   if (options.url && containsGraphTokenPlaceholder(options.url)) {
     return true;
   }
+  if (options.args?.some(containsGraphTokenPlaceholder)) {
+    return true;
+  }
   if (recordContainsGraphTokenPlaceholder(options.headers)) {
     return true;
   }
   if (recordContainsGraphTokenPlaceholder(options.env)) {
     return true;
   }
-  return false;
+  if (recordContainsGraphTokenPlaceholder(options.oauth_headers)) {
+    return true;
+  }
+  return valueContainsGraphTokenPlaceholder(options.oauth);
 }
 
 /**
@@ -144,7 +172,9 @@ export async function resolveGraphTokenPlaceholder(
       return value.replace(GRAPH_TOKEN_REGEX, graphTokenResponse.access_token);
     }
 
-    logger.warn('[resolveGraphTokenPlaceholder] Graph token exchange did not return an access token');
+    logger.warn(
+      '[resolveGraphTokenPlaceholder] Graph token exchange did not return an access token',
+    );
     return value;
   } catch (error) {
     logger.error('[resolveGraphTokenPlaceholder] Failed to exchange token for Graph API:', error);
@@ -178,6 +208,42 @@ export async function resolveGraphTokensInRecord(
   return resolved;
 }
 
+async function resolveGraphTokensInArray(
+  values: string[] | undefined,
+  options: GraphTokenOptions,
+): Promise<string[] | undefined> {
+  if (!values || !values.some(containsGraphTokenPlaceholder)) {
+    return values;
+  }
+
+  const resolved: string[] = [];
+  for (const value of values) {
+    resolved.push(await resolveGraphTokenPlaceholder(value, options));
+  }
+  return resolved;
+}
+
+async function resolveGraphTokensInOAuth(
+  oauth: Record<string, string | string[] | boolean | number | null | undefined> | undefined,
+  options: GraphTokenOptions,
+): Promise<Record<string, string | string[] | boolean | number | null | undefined> | undefined> {
+  if (!oauth || !valueContainsGraphTokenPlaceholder(oauth)) {
+    return oauth;
+  }
+
+  const resolved: Record<string, string | string[] | boolean | number | null | undefined> = {};
+  for (const [key, value] of Object.entries(oauth)) {
+    if (typeof value === 'string') {
+      resolved[key] = await resolveGraphTokenPlaceholder(value, options);
+    } else if (Array.isArray(value)) {
+      resolved[key] = await resolveGraphTokensInArray(value, options);
+    } else {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+
 /**
  * Pre-processes MCP options to resolve Graph token placeholders.
  * This must be called before processMCPEnv since Graph token resolution is async.
@@ -186,14 +252,16 @@ export async function resolveGraphTokensInRecord(
  * @param graphOptions - Options for Graph token resolution
  * @returns The options with Graph token placeholders resolved
  */
-export async function preProcessGraphTokens<T extends {
-  headers?: Record<string, string>;
-  env?: Record<string, string>;
-  url?: string;
-}>(
-  options: T,
-  graphOptions: GraphTokenOptions,
-): Promise<T> {
+export async function preProcessGraphTokens<
+  T extends {
+    args?: string[];
+    headers?: Record<string, string>;
+    env?: Record<string, string>;
+    oauth?: Record<string, string | string[] | boolean | number | null | undefined>;
+    oauth_headers?: Record<string, string>;
+    url?: string;
+  },
+>(options: T, graphOptions: GraphTokenOptions): Promise<T> {
   if (!mcpOptionsContainGraphTokenPlaceholder(options)) {
     return options;
   }
@@ -204,6 +272,10 @@ export async function preProcessGraphTokens<T extends {
     result.url = await resolveGraphTokenPlaceholder(result.url, graphOptions);
   }
 
+  if (result.args) {
+    result.args = await resolveGraphTokensInArray(result.args, graphOptions);
+  }
+
   if (result.headers) {
     result.headers = await resolveGraphTokensInRecord(result.headers, graphOptions);
   }
@@ -212,5 +284,13 @@ export async function preProcessGraphTokens<T extends {
     result.env = await resolveGraphTokensInRecord(result.env, graphOptions);
   }
 
+  if (result.oauth_headers) {
+    result.oauth_headers = await resolveGraphTokensInRecord(result.oauth_headers, graphOptions);
+  }
+
+  if (result.oauth) {
+    result.oauth = await resolveGraphTokensInOAuth(result.oauth, graphOptions);
+  }
+
   return result;
 }
diff --git a/packages/api/src/utils/headers.spec.ts b/packages/api/src/utils/headers.spec.ts
new file mode 100644
index 00000000000..ca5cdd8c10c
--- /dev/null
+++ b/packages/api/src/utils/headers.spec.ts
@@ -0,0 +1,155 @@
+import type { RunLLMConfig } from '~/types';
+import { mergeHeaders, resolveConfigHeaders } from './headers';
+
+describe('mergeHeaders', () => {
+  it('returns undefined when neither side has headers', () => {
+    expect(mergeHeaders(undefined, undefined)).toBeUndefined();
+  });
+
+  it('returns a copy of the side that is present', () => {
+    expect(mergeHeaders({ a: '1' }, undefined)).toEqual({ a: '1' });
+    expect(mergeHeaders(undefined, { b: '2' })).toEqual({ b: '2' });
+  });
+
+  it('lets override win on key collisions', () => {
+    expect(mergeHeaders({ a: 'base', b: 'base' }, { b: 'override' })).toEqual({
+      a: 'base',
+      b: 'override',
+    });
+  });
+
+  it('comma-unions anthropic-beta values from both sides (deduped)', () => {
+    const merged = mergeHeaders(
+      { 'anthropic-beta': 'custom-beta, shared' },
+      { 'anthropic-beta': 'shared,managed-beta' },
+    );
+    expect(merged?.['anthropic-beta']).toBe('custom-beta,shared,managed-beta');
+  });
+
+  it('does not mutate the input objects', () => {
+    const base = { a: '1' };
+    const override = { b: '2' };
+    mergeHeaders(base, override);
+    expect(base).toEqual({ a: '1' });
+    expect(override).toEqual({ b: '2' });
+  });
+
+  it('replaces a case-variant base key with the override (no duplicate header names)', () => {
+    const merged = mergeHeaders({ authorization: 'custom' }, { Authorization: 'Bearer managed' });
+    expect(merged).toEqual({ Authorization: 'Bearer managed' });
+  });
+
+  it('unions anthropic-beta case-insensitively, keeping the override casing', () => {
+    const merged = mergeHeaders(
+      { 'anthropic-beta': 'custom-beta' },
+      { 'Anthropic-Beta': 'managed-beta' },
+    );
+    expect(merged).toEqual({ 'Anthropic-Beta': 'custom-beta,managed-beta' });
+  });
+});
+
+describe('resolveConfigHeaders', () => {
+  const user = { id: 'user-123', email: 'person@example.com' };
+  const body = { conversationId: 'convo-abc' };
+
+  it('is a no-op when llmConfig is null/undefined', () => {
+    expect(() => resolveConfigHeaders({ llmConfig: null, user, body })).not.toThrow();
+    expect(() => resolveConfigHeaders({ llmConfig: undefined, user, body })).not.toThrow();
+  });
+
+  it('resolves OpenAI-style configuration.defaultHeaders', () => {
+    const llmConfig = {
+      configuration: {
+        defaultHeaders: {
+          'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+          'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+        },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({
+      'X-Conversation-Id': 'convo-abc',
+      'X-User-Id': 'user-123',
+    });
+  });
+
+  it('resolves Anthropic-style clientOptions.defaultHeaders while preserving non-placeholder values', () => {
+    const llmConfig = {
+      clientOptions: {
+        defaultHeaders: {
+          'anthropic-beta': 'fine-grained-tool-streaming-2025-05-14',
+          'cf-aig-metadata': '{"conversation_id":"{{LIBRECHAT_BODY_CONVERSATIONID}}"}',
+        },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    const clientOptions = (
+      llmConfig as unknown as { clientOptions: { defaultHeaders: Record<string, string> } }
+    ).clientOptions;
+    expect(clientOptions.defaultHeaders).toEqual({
+      'anthropic-beta': 'fine-grained-tool-streaming-2025-05-14',
+      'cf-aig-metadata': '{"conversation_id":"convo-abc"}',
+    });
+  });
+
+  it('leaves Google customHeaders untouched (resolved at init, not request time)', () => {
+    const llmConfig = {
+      customHeaders: {
+        'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+        Authorization: 'Bearer ${SOME_KEY}',
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    // Native Google headers are resolved in initializeGoogle; resolveConfigHeaders
+    // must not re-process them (keeps the key-derived auth out of env expansion).
+    expect(
+      (llmConfig as unknown as { customHeaders: Record<string, string> }).customHeaders,
+    ).toEqual({
+      'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+      Authorization: 'Bearer ${SOME_KEY}',
+    });
+  });
+
+  it('resolves each header map only once across repeated calls (idempotent under reuse)', () => {
+    process.env.HEADERS_SPEC_IDEMPOTENT = 'env-value';
+    const reusedUser = { id: 'u', name: '${HEADERS_SPEC_IDEMPOTENT}' };
+    const llmConfig = {
+      configuration: { defaultHeaders: { 'X-Name': '{{LIBRECHAT_USER_NAME}}' } },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user: reusedUser, body });
+    // Second pass must NOT re-expand the now-substituted ${...} from the user name
+    resolveConfigHeaders({ llmConfig, user: reusedUser, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({
+      'X-Name': '${HEADERS_SPEC_IDEMPOTENT}',
+    });
+    delete process.env.HEADERS_SPEC_IDEMPOTENT;
+  });
+
+  it('resolves env-var placeholders in header values', () => {
+    process.env.HEADERS_SPEC_GATEWAY_KEY = 'secret-key';
+    const llmConfig = {
+      configuration: {
+        defaultHeaders: { 'X-Gateway-Key': '${HEADERS_SPEC_GATEWAY_KEY}' },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({ 'X-Gateway-Key': 'secret-key' });
+    delete process.env.HEADERS_SPEC_GATEWAY_KEY;
+  });
+
+  it('leaves configs without header maps untouched', () => {
+    const llmConfig = { model: 'gpt-4o', configuration: {} } as unknown as RunLLMConfig;
+    expect(() => resolveConfigHeaders({ llmConfig, user, body })).not.toThrow();
+    expect(llmConfig.configuration).toEqual({});
+  });
+});
diff --git a/packages/api/src/utils/headers.ts b/packages/api/src/utils/headers.ts
new file mode 100644
index 00000000000..37ddd571ce6
--- /dev/null
+++ b/packages/api/src/utils/headers.ts
@@ -0,0 +1,128 @@
+import type { AnthropicClientOptions } from '@librechat/agents';
+import type { IUser } from '@librechat/data-schemas';
+import type { RequestBody, RunLLMConfig } from '~/types';
+import { resolveHeaders } from './env';
+
+/** Comma-unions two header values (deduped, trimmed), e.g. `anthropic-beta`. */
+function unionCsv(a: string, b: string): string {
+  const values = [a, b]
+    .flatMap((value) => value.split(','))
+    .map((value) => value.trim())
+    .filter(Boolean);
+  return Array.from(new Set(values)).join(',');
+}
+
+/**
+ * Merges two header maps, with `override` winning on key collisions. Matching is
+ * case-insensitive (HTTP header names are), so an `override` key replaces any
+ * case variant from `base` rather than leaving both names in the output (which
+ * clients may collapse, breaking auth or protocol headers); the `override`
+ * casing is kept. The `anthropic-beta` header is special-cased: values from both
+ * sides are comma-unioned (deduped) so a custom beta coexists with
+ * provider-managed betas instead of clobbering them.
+ *
+ * Used both to layer endpoint headers over global (`endpoints.all`) headers and
+ * to attach admin-configured custom headers beneath provider-managed headers
+ * (auth/version/beta), so the provider integration's own headers always win.
+ *
+ * @returns the merged map, or `undefined` when neither side has any headers.
+ */
+export function mergeHeaders(
+  base?: Record<string, string>,
+  override?: Record<string, string>,
+): Record<string, string> | undefined {
+  if (!base && !override) {
+    return undefined;
+  }
+
+  const merged: Record<string, string> = { ...(base ?? {}) };
+  if (!override) {
+    return merged;
+  }
+
+  const baseKeyByLower = new Map<string, string>(
+    Object.keys(merged).map((key) => [key.toLowerCase(), key]),
+  );
+
+  for (const [key, value] of Object.entries(override)) {
+    const lower = key.toLowerCase();
+    const existingKey = baseKeyByLower.get(lower);
+    const nextValue =
+      lower === 'anthropic-beta' && existingKey != null
+        ? unionCsv(merged[existingKey], value)
+        : value;
+
+    if (existingKey != null && existingKey !== key) {
+      delete merged[existingKey];
+    }
+    merged[key] = nextValue;
+    baseKeyByLower.set(lower, key);
+  }
+
+  return merged;
+}
+
+type DefaultHeadersContainer = { defaultHeaders?: Record<string, string> };
+
+/**
+ * Header maps already resolved by `resolveConfigHeaders`. `resolveConfigHeaders`
+ * mutates config objects in place, and the same initialized agent (hence the same
+ * nested header objects) can flow through `buildAgentInput` more than once (root +
+ * subagent, multiple parents). Resolving twice would run env expansion over values
+ * already substituted with user/body data, violating the env-before-user invariant
+ * documented in `resolveHeaders`. Tracking resolved maps makes resolution
+ * idempotent across reuse. Keyed by object identity (per-request fresh objects), so
+ * nothing carries across requests.
+ */
+const resolvedHeaderMaps = new WeakSet<object>();
+
+/**
+ * Resolves placeholder templates in the outbound request headers of a built LLM
+ * config, mutating it in place. Handles the OpenAI-compatible
+ * `configuration.defaultHeaders` (OpenAI / Azure / custom) and the native
+ * Anthropic `clientOptions.defaultHeaders` (including Vertex) carriers. Native
+ * Google `customHeaders` are intentionally NOT handled here — they are resolved
+ * once at init in `initializeGoogle`, so the provider-managed `Authorization`
+ * header (built from a possibly user-provided key) never passes through env
+ * expansion.
+ *
+ * Resolution runs at request time so request-body placeholders (e.g.
+ * `{{LIBRECHAT_BODY_CONVERSATIONID}}`) resolve against the live request. It is a
+ * no-op for header values without placeholders, and idempotent under config reuse.
+ */
+export function resolveConfigHeaders({
+  llmConfig,
+  user,
+  body,
+  customUserVars,
+}: {
+  llmConfig?: RunLLMConfig | null;
+  user?: Partial<IUser> | { id: string };
+  body?: RequestBody;
+  customUserVars?: Record<string, string>;
+}): void {
+  if (llmConfig == null) {
+    return;
+  }
+
+  const resolveOnce = (headers: Record<string, string>): Record<string, string> => {
+    if (resolvedHeaderMaps.has(headers)) {
+      return headers;
+    }
+    const resolved = resolveHeaders({ headers, user, body, customUserVars });
+    resolvedHeaderMaps.add(resolved);
+    return resolved;
+  };
+
+  const configuration = llmConfig.configuration as DefaultHeadersContainer | undefined;
+  if (configuration?.defaultHeaders != null) {
+    configuration.defaultHeaders = resolveOnce(configuration.defaultHeaders);
+  }
+
+  const clientOptions = (llmConfig as AnthropicClientOptions).clientOptions as
+    | DefaultHeadersContainer
+    | undefined;
+  if (clientOptions?.defaultHeaders != null) {
+    clientOptions.defaultHeaders = resolveOnce(clientOptions.defaultHeaders);
+  }
+}
diff --git a/packages/api/src/utils/http.ts b/packages/api/src/utils/http.ts
index e9f1d622815..9a0b39080b2 100644
--- a/packages/api/src/utils/http.ts
+++ b/packages/api/src/utils/http.ts
@@ -5,7 +5,10 @@
 export function normalizeHttpError(
   err: Error | { status?: number; message?: string } | unknown,
   fallbackStatus = 400,
-) {
+): {
+  status: number;
+  message: string;
+} {
   let status = fallbackStatus;
   if (err && typeof err === 'object' && 'status' in err && typeof err.status === 'number') {
     status = err.status;
diff --git a/packages/api/src/utils/index.ts b/packages/api/src/utils/index.ts
index 2b4ac882451..a0bc2510b33 100644
--- a/packages/api/src/utils/index.ts
+++ b/packages/api/src/utils/index.ts
@@ -10,6 +10,7 @@ export * from './files';
 export * from './import';
 export * from './generators';
 export * from './graph';
+export * from './headers';
 export * from './path';
 export * from './key';
 export * from './latex';
@@ -18,6 +19,7 @@ export * from './math';
 export * from './oidc';
 export * from './openid';
 export * from './promise';
+export * from './proxy';
 export * from './ports';
 export * from './sanitizeTitle';
 export * from './text';
@@ -27,4 +29,5 @@ export * from './tokens';
 export * from './tokenMap';
 export * from './url';
 export * from './message';
+export * from './quotes';
 export * from './tracing';
diff --git a/packages/api/src/utils/memory.ts b/packages/api/src/utils/memory.ts
index 214548d14be..4ab8318624e 100644
--- a/packages/api/src/utils/memory.ts
+++ b/packages/api/src/utils/memory.ts
@@ -1,6 +1,6 @@
 import { logger } from '@librechat/data-schemas';
-import { GenerationJobManager } from '~/stream';
 import { OAuthReconnectionManager } from '~/mcp/oauth/OAuthReconnectionManager';
+import { GenerationJobManager } from '~/stream';
 import { MCPManager } from '~/mcp/MCPManager';
 
 type ConnectionStats = ReturnType<InstanceType<typeof MCPManager>['getConnectionStats']>;
@@ -147,4 +147,10 @@ function stop(): void {
   logger.info('[MemDiag] Stopped memory diagnostics');
 }
 
-export const memoryDiagnostics = { start, stop, forceGC, getSnapshots, collectSnapshot };
+export const memoryDiagnostics: {
+  start: typeof start;
+  stop: typeof stop;
+  forceGC: typeof forceGC;
+  getSnapshots: typeof getSnapshots;
+  collectSnapshot: typeof collectSnapshot;
+} = { start, stop, forceGC, getSnapshots, collectSnapshot };
diff --git a/packages/api/src/utils/message.spec.ts b/packages/api/src/utils/message.spec.ts
index b1dcc6ea020..3cc6c4b2f6f 100644
--- a/packages/api/src/utils/message.spec.ts
+++ b/packages/api/src/utils/message.spec.ts
@@ -4,6 +4,8 @@ import {
   sanitizeFileForTransmit,
   buildMessageFiles,
   getThreadData,
+  isPreliminaryMessageId,
+  isUnpersistedPreliminaryParent,
 } from './message';
 
 /** Cast to string for type compatibility with ThreadMessage */
@@ -130,6 +132,55 @@ describe('sanitizeMessageForTransmit', () => {
   });
 });
 
+describe('isUnpersistedPreliminaryParent', () => {
+  it('returns false without querying for non-preliminary parent ids', async () => {
+    const getMessages = jest.fn();
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'persisted-response',
+        getMessages,
+      }),
+    ).resolves.toBe(false);
+
+    expect(isPreliminaryMessageId('persisted-response')).toBe(false);
+    expect(getMessages).not.toHaveBeenCalled();
+  });
+
+  it('returns true when the underscore-suffixed parent is not persisted', async () => {
+    const getMessages = jest.fn().mockResolvedValue([]);
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'pending-response_',
+        getMessages,
+      }),
+    ).resolves.toBe(true);
+
+    expect(getMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'pending-response_', conversationId: 'conversation-123' },
+      '_id',
+    );
+  });
+
+  it('returns false when the underscore-suffixed parent is already persisted', async () => {
+    const getMessages = jest.fn().mockResolvedValue([{ _id: 'persisted-parent' }]);
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'persisted-response_',
+        getMessages,
+      }),
+    ).resolves.toBe(false);
+  });
+});
+
 describe('buildMessageFiles', () => {
   const baseAttachment = {
     file_id: 'file-1',
diff --git a/packages/api/src/utils/message.ts b/packages/api/src/utils/message.ts
index 732884c0f05..55d068577a7 100644
--- a/packages/api/src/utils/message.ts
+++ b/packages/api/src/utils/message.ts
@@ -4,6 +4,11 @@ import type { TFile, TMessage } from 'librechat-data-provider';
 /** Minimal shape for request file entries (from `req.body.files`) */
 type RequestFile = { file_id?: string };
 
+type GetMessagesByParentId = (
+  filter: { user: string; messageId: string; conversationId?: string },
+  select: '_id',
+) => Promise<unknown[]>;
+
 /** Fields to strip from files before client transmission */
 const FILE_STRIP_FIELDS = ['text', '_id', '__v'] as const;
 
@@ -92,6 +97,37 @@ export function sanitizeMessageForTransmit<T extends Partial<TMessage>>(
   return sanitized;
 }
 
+export function isPreliminaryMessageId(messageId: unknown): messageId is string {
+  return typeof messageId === 'string' && messageId.endsWith('_');
+}
+
+export async function isUnpersistedPreliminaryParent({
+  userId,
+  conversationId,
+  parentMessageId,
+  getMessages,
+}: {
+  userId: string;
+  conversationId?: string | null;
+  parentMessageId?: string | null;
+  getMessages: GetMessagesByParentId;
+}): Promise<boolean> {
+  if (!isPreliminaryMessageId(parentMessageId)) {
+    return false;
+  }
+
+  const filter: { user: string; messageId: string; conversationId?: string } = {
+    user: userId,
+    messageId: parentMessageId,
+  };
+  if (conversationId && conversationId !== Constants.NEW_CONVO) {
+    filter.conversationId = conversationId;
+  }
+
+  const messages = await getMessages(filter, '_id');
+  return messages.length === 0;
+}
+
 /** Minimal message shape for thread traversal.
  *
  * Both `files` and `attachments` carry `file_id` references, but they
diff --git a/packages/api/src/utils/proxy.spec.ts b/packages/api/src/utils/proxy.spec.ts
new file mode 100644
index 00000000000..774dd627e09
--- /dev/null
+++ b/packages/api/src/utils/proxy.spec.ts
@@ -0,0 +1,199 @@
+import { HttpsProxyAgent } from 'https-proxy-agent';
+import { EnvHttpProxyAgent, ProxyAgent } from 'undici';
+import {
+  applyAxiosProxyConfig,
+  getEnvProxyDispatcher,
+  getHttpsProxyAgent,
+  getProxyDispatcher,
+  getProxyEnvConfig,
+  getProxyUrlForUrl,
+  shouldBypassProxy,
+} from './proxy';
+
+jest.mock('https-proxy-agent', () => ({
+  HttpsProxyAgent: jest.fn(),
+}));
+
+jest.mock('undici', () => ({
+  EnvHttpProxyAgent: jest.fn(),
+  ProxyAgent: jest.fn(),
+}));
+
+const MockEnvHttpProxyAgent = EnvHttpProxyAgent as jest.MockedClass<typeof EnvHttpProxyAgent>;
+const MockProxyAgent = ProxyAgent as jest.MockedClass<typeof ProxyAgent>;
+const MockHttpsProxyAgent = HttpsProxyAgent as jest.MockedClass<typeof HttpsProxyAgent>;
+
+describe('proxy helpers', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    delete process.env.PROXY;
+    delete process.env.proxy;
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.NO_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('returns undefined when no proxy env is configured', () => {
+    expect(getProxyEnvConfig()).toBeUndefined();
+    expect(getEnvProxyDispatcher()).toBeUndefined();
+    expect(MockEnvHttpProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('uses PROXY for both protocols and passes no_proxy through to undici', () => {
+    process.env.PROXY = 'http://corporate-proxy:8080';
+    process.env.no_proxy = 'localhost,.internal.example';
+
+    expect(getProxyEnvConfig()).toEqual({
+      httpProxy: 'http://corporate-proxy:8080',
+      httpsProxy: 'http://corporate-proxy:8080',
+      noProxy: 'localhost,.internal.example',
+    });
+
+    expect(getEnvProxyDispatcher()).toBeInstanceOf(EnvHttpProxyAgent);
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledWith({
+      httpProxy: 'http://corporate-proxy:8080',
+      httpsProxy: 'http://corporate-proxy:8080',
+      noProxy: 'localhost,.internal.example',
+    });
+  });
+
+  it('uses lowercase standard proxy env before uppercase values', () => {
+    process.env.HTTP_PROXY = 'http://upper-http:8080';
+    process.env.HTTPS_PROXY = 'http://upper-https:8080';
+    process.env.NO_PROXY = 'upper.example';
+    process.env.http_proxy = 'http://lower-http:8080';
+    process.env.https_proxy = 'http://lower-https:8080';
+    process.env.no_proxy = 'lower.example';
+
+    expect(getProxyEnvConfig()).toEqual({
+      httpProxy: 'http://lower-http:8080',
+      httpsProxy: 'http://lower-https:8080',
+      noProxy: 'lower.example',
+    });
+  });
+
+  it('reuses the env dispatcher until proxy env changes', () => {
+    process.env.PROXY = 'http://corporate-proxy-reuse:8080';
+    process.env.NO_PROXY = 'localhost';
+
+    const first = getEnvProxyDispatcher();
+    const second = getEnvProxyDispatcher();
+
+    expect(second).toBe(first);
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledTimes(1);
+
+    process.env.NO_PROXY = 'localhost,.internal.example';
+    getEnvProxyDispatcher();
+
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledTimes(2);
+  });
+
+  it('creates explicit proxy dispatchers when a non-env proxy is provided', () => {
+    const first = getProxyDispatcher('http://explicit-proxy:8080');
+    const second = getProxyDispatcher('http://explicit-proxy:8080');
+
+    expect(second).toBe(first);
+    expect(MockProxyAgent).toHaveBeenCalledTimes(1);
+    expect(MockProxyAgent).toHaveBeenCalledWith('http://explicit-proxy:8080');
+  });
+
+  it('uses the env dispatcher when the explicit proxy matches PROXY', () => {
+    process.env.PROXY = 'http://matching-proxy:8080';
+
+    getProxyDispatcher('http://matching-proxy:8080');
+
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledWith({
+      httpProxy: 'http://matching-proxy:8080',
+      httpsProxy: 'http://matching-proxy:8080',
+      noProxy: undefined,
+    });
+    expect(MockProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('matches NO_PROXY wildcard, domains, host ports, and whitespace separators', () => {
+    const noProxy = 'localhost, .internal.example api.example.com:8443 *.service.local *wild.local';
+
+    expect(shouldBypassProxy('https://localhost/login', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://sso.internal.example/login', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.example.com:8443/models', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.example.com/models', noProxy)).toBe(false);
+    expect(shouldBypassProxy('https://foo.service.local/search', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.wild.local/search', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://example.com', '*')).toBe(true);
+  });
+
+  it('resolves target-aware proxy URLs and respects NO_PROXY for axios-style agents', () => {
+    process.env.HTTP_PROXY = 'http://http-proxy:8080';
+    process.env.HTTPS_PROXY = 'http://https-proxy:8080';
+    process.env.NO_PROXY = 'internal.example';
+
+    expect(getProxyUrlForUrl('http://api.external.example/models')).toBe('http://http-proxy:8080');
+    expect(getProxyUrlForUrl('https://api.external.example/models')).toBe(
+      'http://https-proxy:8080',
+    );
+    expect(getProxyUrlForUrl('https://sso.internal.example/login')).toBeUndefined();
+  });
+
+  it('falls back to HTTP_PROXY for HTTPS axios-style agents', () => {
+    process.env.HTTP_PROXY = 'http://single-proxy:8080';
+
+    expect(getProxyUrlForUrl('https://api.external.example/models')).toBe(
+      'http://single-proxy:8080',
+    );
+
+    const config = applyAxiosProxyConfig({}, 'https://api.external.example/models');
+
+    expect(config).toEqual({
+      httpsAgent: expect.any(Object),
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).toHaveBeenCalledWith('http://single-proxy:8080');
+  });
+
+  it('applies cached HttpsProxyAgent and disables axios native proxy handling', () => {
+    process.env.HTTPS_PROXY = 'http://https-proxy:8080';
+
+    const config = applyAxiosProxyConfig({}, 'https://api.external.example/models');
+    const agent = getHttpsProxyAgent('https://api.external.example/models');
+
+    expect(config).toEqual({
+      httpsAgent: agent,
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).toHaveBeenCalledTimes(1);
+    expect(MockHttpsProxyAgent).toHaveBeenCalledWith('http://https-proxy:8080');
+  });
+
+  it('disables axios native proxy handling for NO_PROXY targets', () => {
+    process.env.proxy = 'http://axios-default-proxy:8080';
+    process.env.NO_PROXY = 'internal.example';
+
+    expect(applyAxiosProxyConfig({}, 'https://sso.internal.example/login')).toEqual({
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('applies axios native proxy config to plain HTTP targets', () => {
+    process.env.HTTP_PROXY = 'http://http-proxy:8080';
+
+    expect(applyAxiosProxyConfig({}, 'http://api.external.example/models')).toEqual({
+      proxy: {
+        host: 'http-proxy',
+        port: 8080,
+        protocol: 'http',
+      },
+    });
+    expect(MockHttpsProxyAgent).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/api/src/utils/proxy.ts b/packages/api/src/utils/proxy.ts
new file mode 100644
index 00000000000..bb227ee942e
--- /dev/null
+++ b/packages/api/src/utils/proxy.ts
@@ -0,0 +1,237 @@
+import { HttpsProxyAgent } from 'https-proxy-agent';
+import { EnvHttpProxyAgent, ProxyAgent } from 'undici';
+import type { AxiosRequestConfig, AxiosProxyConfig } from 'axios';
+import type { Dispatcher } from 'undici';
+
+export type ProxyEnvConfig = {
+  httpProxy?: string;
+  httpsProxy?: string;
+  noProxy?: string;
+};
+
+type HttpsProxyAgentInstance = InstanceType<typeof HttpsProxyAgent>;
+type ProxyResolution = {
+  proxyUrl?: string;
+  bypassed: boolean;
+};
+
+let envProxyDispatcher: EnvHttpProxyAgent | undefined;
+let envProxyDispatcherKey: string | undefined;
+const explicitDispatchers = new Map<string, ProxyAgent>();
+const httpsProxyAgents = new Map<string, HttpsProxyAgentInstance>();
+
+function getTrimmedEnv(...keys: string[]): string | undefined {
+  for (const key of keys) {
+    const value = process.env[key]?.trim();
+    if (value) return value;
+  }
+  return undefined;
+}
+
+export function getProxyEnvConfig(): ProxyEnvConfig | undefined {
+  const proxy = getTrimmedEnv('PROXY', 'proxy');
+  const noProxy = getTrimmedEnv('no_proxy', 'NO_PROXY');
+
+  if (proxy) {
+    return { httpProxy: proxy, httpsProxy: proxy, noProxy };
+  }
+
+  const httpProxy = getTrimmedEnv('http_proxy', 'HTTP_PROXY');
+  const httpsProxy = getTrimmedEnv('https_proxy', 'HTTPS_PROXY');
+  if (!httpProxy && !httpsProxy) return undefined;
+
+  return { httpProxy, httpsProxy, noProxy };
+}
+
+function getProxyConfigKey(config: ProxyEnvConfig): string {
+  return [config.httpProxy ?? '', config.httpsProxy ?? '', config.noProxy ?? ''].join('|');
+}
+
+export function getEnvProxyDispatcher(): Dispatcher | undefined {
+  const proxyConfig = getProxyEnvConfig();
+  if (!proxyConfig) return undefined;
+
+  const key = getProxyConfigKey(proxyConfig);
+  if (!envProxyDispatcher || envProxyDispatcherKey !== key) {
+    envProxyDispatcher = new EnvHttpProxyAgent(proxyConfig);
+    envProxyDispatcherKey = key;
+  }
+
+  return envProxyDispatcher;
+}
+
+function getExplicitProxyDispatcher(proxyUrl: string): Dispatcher {
+  const cached = explicitDispatchers.get(proxyUrl);
+  if (cached) return cached;
+
+  const dispatcher = new ProxyAgent(proxyUrl);
+  explicitDispatchers.set(proxyUrl, dispatcher);
+  return dispatcher;
+}
+
+export function getProxyDispatcher(proxyUrl?: string | null): Dispatcher | undefined {
+  const trimmedProxy = proxyUrl?.trim();
+  if (!trimmedProxy) return getEnvProxyDispatcher();
+
+  const proxyConfig = getProxyEnvConfig();
+  if (proxyConfig?.httpProxy === trimmedProxy && proxyConfig?.httpsProxy === trimmedProxy) {
+    return getEnvProxyDispatcher();
+  }
+
+  return getExplicitProxyDispatcher(trimmedProxy);
+}
+
+function parseUrl(value: string | URL | undefined): URL | undefined {
+  if (!value) return undefined;
+  if (value instanceof URL) return value;
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}
+
+function normalizeHostname(value: string): string {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .replace(/\.$/, '');
+}
+
+function getDefaultPort(protocol: string): number {
+  if (protocol === 'http:' || protocol === 'ws:') return 80;
+  if (protocol === 'https:' || protocol === 'wss:') return 443;
+  return 0;
+}
+
+function getNoProxyEntry(entry: string): { host: string; port: number } {
+  const trimmed = entry.trim();
+  const bracketed = trimmed.match(/^\[([^\]]+)\](?::(\d+))?$/);
+  if (bracketed) {
+    return {
+      host: normalizeHostname(bracketed[1]),
+      port: bracketed[2] ? Number.parseInt(bracketed[2], 10) : 0,
+    };
+  }
+
+  const parsed = (trimmed.match(/:/g) ?? []).length === 1 ? trimmed.match(/^(.+):(\d+)$/) : null;
+  const host = normalizeHostname(parsed ? parsed[1] : trimmed);
+  return {
+    host: host === '*' ? host : host.replace(/^\*\.?/, '.'),
+    port: parsed ? Number.parseInt(parsed[2], 10) : 0,
+  };
+}
+
+function hostMatchesNoProxy(hostname: string, entryHost: string): boolean {
+  if (!entryHost) return false;
+  if (entryHost === '*') return true;
+
+  const normalizedEntry = entryHost.startsWith('.') ? entryHost.slice(1) : entryHost;
+  return hostname === normalizedEntry || hostname.endsWith(`.${normalizedEntry}`);
+}
+
+export function shouldBypassProxy(targetUrl: string | URL, noProxy?: string): boolean {
+  if (!noProxy?.trim()) return false;
+
+  const url = parseUrl(targetUrl);
+  if (!url) return false;
+
+  const hostname = normalizeHostname(url.hostname);
+  const port = Number.parseInt(url.port, 10) || getDefaultPort(url.protocol);
+
+  return noProxy
+    .split(/[\s,]+/)
+    .filter(Boolean)
+    .some((entry) => {
+      const parsed = getNoProxyEntry(entry);
+      return parsed.port > 0 && parsed.port !== port
+        ? false
+        : hostMatchesNoProxy(hostname, parsed.host);
+    });
+}
+
+function getProxyResolution(targetUrl?: string | URL): ProxyResolution {
+  const proxyConfig = getProxyEnvConfig();
+  if (!proxyConfig) return { bypassed: false };
+
+  const url = parseUrl(targetUrl);
+  if (url && shouldBypassProxy(url, proxyConfig.noProxy)) {
+    return { bypassed: true };
+  }
+
+  if (!url) return { proxyUrl: proxyConfig.httpsProxy ?? proxyConfig.httpProxy, bypassed: false };
+  if (url.protocol === 'http:' || url.protocol === 'ws:') {
+    return { proxyUrl: proxyConfig.httpProxy, bypassed: false };
+  }
+  if (url.protocol === 'https:' || url.protocol === 'wss:') {
+    return { proxyUrl: proxyConfig.httpsProxy ?? proxyConfig.httpProxy, bypassed: false };
+  }
+  return { bypassed: false };
+}
+
+export function getProxyUrlForUrl(targetUrl?: string | URL): string | undefined {
+  return getProxyResolution(targetUrl).proxyUrl;
+}
+
+export function getHttpsProxyAgent(targetUrl?: string | URL): HttpsProxyAgentInstance | undefined {
+  const url = parseUrl(targetUrl);
+  if (url && url.protocol !== 'https:' && url.protocol !== 'wss:') return undefined;
+
+  const proxyUrl = getProxyUrlForUrl(targetUrl);
+  if (!proxyUrl) return undefined;
+
+  const cached = httpsProxyAgents.get(proxyUrl);
+  if (cached) return cached;
+
+  const agent = new HttpsProxyAgent(proxyUrl);
+  httpsProxyAgents.set(proxyUrl, agent);
+  return agent;
+}
+
+function getAxiosProxyConfig(proxyUrl: string): AxiosProxyConfig {
+  const url = new URL(proxyUrl);
+  const proxyConfig: Partial<AxiosProxyConfig> = {
+    host: url.hostname.replace(/^\[|\]$/g, ''),
+    protocol: url.protocol.replace(':', ''),
+  };
+
+  if (url.port) {
+    proxyConfig.port = Number.parseInt(url.port, 10);
+  }
+
+  if (url.username || url.password) {
+    proxyConfig.auth = {
+      username: decodeURIComponent(url.username),
+      password: decodeURIComponent(url.password),
+    };
+  }
+
+  return proxyConfig as AxiosProxyConfig;
+}
+
+export function applyAxiosProxyConfig(
+  config: AxiosRequestConfig,
+  targetUrl?: string | URL,
+): AxiosRequestConfig {
+  const resolution = getProxyResolution(targetUrl);
+  if (resolution.bypassed) {
+    config.proxy = false;
+    return config;
+  }
+
+  const url = parseUrl(targetUrl);
+  if (url && (url.protocol === 'http:' || url.protocol === 'ws:') && resolution.proxyUrl) {
+    config.proxy = getAxiosProxyConfig(resolution.proxyUrl);
+    return config;
+  }
+
+  const agent = getHttpsProxyAgent(targetUrl);
+  if (!agent) return config;
+
+  config.httpsAgent = agent;
+  config.proxy = false;
+  return config;
+}
+
+export const getOpenIdProxyDispatcher: () => Dispatcher | undefined = getEnvProxyDispatcher;
diff --git a/packages/api/src/utils/quotes.ts b/packages/api/src/utils/quotes.ts
new file mode 100644
index 00000000000..877ff5aafe9
--- /dev/null
+++ b/packages/api/src/utils/quotes.ts
@@ -0,0 +1,69 @@
+/** Max characters kept per quoted excerpt (defense-in-depth over the client cap). */
+export const QUOTE_MAX_LENGTH = 1500;
+
+/** Max number of quoted excerpts merged into a single user turn. */
+export const QUOTE_MAX_COUNT = 10;
+
+/**
+ * Normalizes the `quotes` field off a request body into a clean string array.
+ * Trims, drops empties/non-strings, caps each excerpt length and the overall
+ * count. Returns `null` when there is nothing usable so callers can skip the
+ * merge entirely.
+ */
+export function getReferencedQuotes(raw: unknown): string[] | null {
+  if (!Array.isArray(raw)) {
+    return null;
+  }
+
+  const quotes: string[] = [];
+  for (const item of raw) {
+    if (typeof item !== 'string') {
+      continue;
+    }
+    const trimmed = item.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    quotes.push(trimmed.slice(0, QUOTE_MAX_LENGTH));
+    if (quotes.length >= QUOTE_MAX_COUNT) {
+      break;
+    }
+  }
+
+  return quotes.length > 0 ? quotes : null;
+}
+
+/** Formats one excerpt as a Markdown blockquote, prefixing every line. */
+function toBlockquote(quote: string): string {
+  return quote
+    .split('\n')
+    .map((line) => (line.length > 0 ? `> ${line}` : '>'))
+    .join('\n');
+}
+
+/**
+ * Renders quoted excerpts as Markdown blockquote blocks, one block per excerpt
+ * separated by a blank line. Provider-agnostic (no bespoke tags). Returns an
+ * empty string when there are no quotes.
+ */
+export function formatQuotesAsMarkdown(quotes: string[]): string {
+  return quotes.map(toBlockquote).join('\n\n');
+}
+
+/**
+ * Merges quoted excerpts into a body of text as Markdown blockquotes, prepended
+ * before the text so the excerpts read as part of the user turn. Returns the
+ * original text unchanged when there are no quotes.
+ */
+export function mergeQuotedText(text: string, quotes: string[]): string {
+  if (quotes.length === 0) {
+    return text;
+  }
+
+  const block = formatQuotesAsMarkdown(quotes);
+  if (block.length === 0) {
+    return text;
+  }
+  const body = text ?? '';
+  return body.length > 0 ? `${block}\n\n${body}` : block;
+}
diff --git a/packages/api/src/utils/text.spec.ts b/packages/api/src/utils/text.spec.ts
index 30185f9da7c..cbafb25af77 100644
--- a/packages/api/src/utils/text.spec.ts
+++ b/packages/api/src/utils/text.spec.ts
@@ -222,6 +222,24 @@ describe('processTextWithTokenLimit', () => {
       expect(syncResult.wasTruncated).toBe(asyncResult.wasTruncated);
       expect(syncResult.text.length).toBe(asyncResult.text.length);
     });
+
+    it('should preserve the end of text when requested', async () => {
+      const { tokenCountFn } = createMockTokenCounter();
+      const text = `${'a'.repeat(200)}LATEST_MEMORY_REQUEST`;
+      const tokenLimit = 10;
+
+      const result = await processTextWithTokenLimit({
+        text,
+        tokenLimit,
+        tokenCountFn,
+        preserve: 'end',
+      });
+
+      expect(result.wasTruncated).toBe(true);
+      expect(result.tokenCount).toBeLessThanOrEqual(tokenLimit);
+      expect(result.text).toContain('LATEST_MEMORY_REQUEST');
+      expect(result.text).not.toContain('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+    });
   });
 
   describe('when text is under the token limit', () => {
diff --git a/packages/api/src/utils/text.ts b/packages/api/src/utils/text.ts
index 3099c2bbc4a..5273670e10c 100644
--- a/packages/api/src/utils/text.ts
+++ b/packages/api/src/utils/text.ts
@@ -39,10 +39,12 @@ export async function processTextWithTokenLimit({
   text,
   tokenLimit,
   tokenCountFn,
+  preserve = 'start',
 }: {
   text: string;
   tokenLimit: number;
   tokenCountFn: TokenCountFn;
+  preserve?: 'start' | 'end';
 }): Promise<{ text: string; tokenCount: number; wasTruncated: boolean }> {
   const originalTokenCount = await tokenCountFn(text);
 
@@ -61,7 +63,14 @@ export async function processTextWithTokenLimit({
   const ratio = tokenLimit / originalTokenCount;
   let charPosition = Math.floor(text.length * ratio * TRUNCATION_SAFETY_BUFFER);
 
-  let truncatedText = text.substring(0, charPosition);
+  const sliceText = (position: number) => {
+    if (position <= 0) {
+      return '';
+    }
+    return preserve === 'end' ? text.slice(-position) : text.substring(0, position);
+  };
+
+  let truncatedText = sliceText(charPosition);
   let tokenCount = await tokenCountFn(truncatedText);
 
   const maxIterations = 5;
@@ -70,7 +79,7 @@ export async function processTextWithTokenLimit({
   while (tokenCount > tokenLimit && iterations < maxIterations && charPosition > 0) {
     const overageRatio = tokenLimit / tokenCount;
     charPosition = Math.floor(charPosition * overageRatio * TRUNCATION_SAFETY_BUFFER);
-    truncatedText = text.substring(0, charPosition);
+    truncatedText = sliceText(charPosition);
     tokenCount = await tokenCountFn(truncatedText);
     iterations++;
   }
diff --git a/packages/api/src/utils/tokenizer.ts b/packages/api/src/utils/tokenizer.ts
index 4c638c948e1..d66908712a7 100644
--- a/packages/api/src/utils/tokenizer.ts
+++ b/packages/api/src/utils/tokenizer.ts
@@ -45,7 +45,7 @@ class Tokenizer {
   }
 }
 
-const TokenizerSingleton = new Tokenizer();
+const TokenizerSingleton: Tokenizer = new Tokenizer();
 
 /**
  * Counts the number of tokens in a given text using ai-tokenizer with o200k_base encoding.
diff --git a/packages/api/src/utils/tokens.spec.ts b/packages/api/src/utils/tokens.spec.ts
new file mode 100644
index 00000000000..0931c248156
--- /dev/null
+++ b/packages/api/src/utils/tokens.spec.ts
@@ -0,0 +1,33 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { EndpointTokenConfig } from '~/types';
+import { getModelMaxTokens, getModelMaxOutputTokens } from './tokens';
+
+describe('getModelMaxTokens partial-override fallback', () => {
+  const partialOverride: EndpointTokenConfig = {
+    'custom-model': { prompt: 1, completion: 2, context: 32000, output: 4096 },
+  };
+
+  it('uses the override for a listed model', () => {
+    expect(getModelMaxTokens('custom-model', EModelEndpoint.openAI, partialOverride)).toBe(32000);
+  });
+
+  it('falls back to the built-in map for a model absent from a partial override', () => {
+    const fallback = getModelMaxTokens('gpt-4o', EModelEndpoint.openAI, partialOverride);
+    const builtin = getModelMaxTokens('gpt-4o', EModelEndpoint.openAI);
+    expect(fallback).toBe(builtin);
+    expect(fallback).toBeGreaterThan(100000);
+  });
+});
+
+describe('getModelMaxOutputTokens partial-override fallback', () => {
+  const partialOverride: EndpointTokenConfig = {
+    'custom-model': { prompt: 1, completion: 2, context: 32000, output: 4096 },
+  };
+
+  it('falls back to the built-in map for a model absent from a partial override', () => {
+    const fallback = getModelMaxOutputTokens('gpt-4o', EModelEndpoint.openAI, partialOverride);
+    const builtin = getModelMaxOutputTokens('gpt-4o', EModelEndpoint.openAI);
+    expect(fallback).toBe(builtin);
+    expect(fallback).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/api/src/utils/tokens.ts b/packages/api/src/utils/tokens.ts
index 75a579eb40b..b9e248bbcae 100644
--- a/packages/api/src/utils/tokens.ts
+++ b/packages/api/src/utils/tokens.ts
@@ -55,10 +55,13 @@ const openAIModels = {
   'gpt-5.1': 400000,
   'gpt-5.2': 400000,
   'gpt-5.3': 400000,
-  'gpt-5.4': 272000, // standard context; 1M experimental available via API opt-in (2x rate)
-  'gpt-5.4-pro': 272000, // same window as gpt-5.4
+  'gpt-5.4': 1050000, // >272K input prices at the long-context tier (2x input, 1.5x output)
+  'gpt-5.4-pro': 1050000,
+  'gpt-5.4-mini': 400000,
+  'gpt-5.4-nano': 400000,
   'gpt-5.5': 1050000,
   'gpt-5.5-pro': 1050000,
+  'chat-latest': 400000,
   'gpt-5-mini': 400000,
   'gpt-5-nano': 400000,
   'gpt-5-pro': 400000,
@@ -95,10 +98,19 @@ const cohereModels = {
 
 const googleModels = {
   /* Max I/O is combined so we subtract the amount from max response tokens for actual total */
-  gemma: 8196,
+  gemma: 32768,
   'gemma-2': 32768,
   'gemma-3': 32768,
   'gemma-3-27b': 131072,
+  'gemma4:31b': 256000,
+  'gemma4-31b': 256000,
+  'gemma-4-31b': 256000,
+  'gemma4:26b': 256000,
+  'gemma4-26b': 256000,
+  'gemma-4-26b-a4b': 256000,
+  'gemma-4-26b': 256000,
+  gemma4: 128000,
+  'gemma-4': 128000,
   gemini: 30720, // -2048 from max
   'gemini-pro-vision': 12288,
   'gemini-1.5': 1000000,
@@ -117,6 +129,7 @@ const googleModels = {
   'gemini-3-pro-image': 1000000,
   'gemini-3.1': 1000000,
   'gemini-3.1-flash-lite': 1000000,
+  'gemini-3.5-flash': 1048576,
 };
 
 const anthropicModels = {
@@ -145,6 +158,9 @@ const anthropicModels = {
   'claude-sonnet-4-6': 1000000,
   'claude-opus-4-6': 1000000,
   'claude-opus-4-7': 1000000,
+  'claude-opus-4-8': 1000000,
+  'claude-fable-5': 1000000,
+  'claude-mythos-5': 1000000,
 };
 
 const deepseekModels = {
@@ -350,7 +366,7 @@ const aggregateModels = {
   ...openAIModels,
 };
 
-export const maxTokensMap = {
+export const maxTokensMap: Record<string, Record<string, number>> = {
   [EModelEndpoint.azureOpenAI]: openAIModels,
   [EModelEndpoint.openAI]: aggregateModels,
   [EModelEndpoint.agents]: aggregateModels,
@@ -370,8 +386,11 @@ export const modelMaxOutputs = {
   'gpt-5.3': 128000,
   'gpt-5.4': 128000,
   'gpt-5.4-pro': 128000,
+  'gpt-5.4-mini': 128000,
+  'gpt-5.4-nano': 128000,
   'gpt-5.5': 128000,
   'gpt-5.5-pro': 128000,
+  'chat-latest': 128000,
   'gpt-5-mini': 128000,
   'gpt-5-nano': 128000,
   'gpt-5-pro': 128000,
@@ -393,6 +412,9 @@ const anthropicMaxOutputs = {
   'claude-opus-4-5': 64000,
   'claude-opus-4-6': 128000,
   'claude-opus-4-7': 128000,
+  'claude-opus-4-8': 128000,
+  'claude-fable-5': 128000,
+  'claude-mythos-5': 128000,
   'claude-3.5-sonnet': 8192,
   'claude-3-5-sonnet': 8192,
   'claude-3.7-sonnet': 128000,
@@ -409,7 +431,7 @@ const deepseekMaxOutputs = {
   'deepseek.r1': 64000,
 };
 
-export const maxOutputTokensMap = {
+export const maxOutputTokensMap: Record<string, Record<string, number>> = {
   [EModelEndpoint.anthropic]: anthropicMaxOutputs,
   [EModelEndpoint.azureOpenAI]: modelMaxOutputs,
   [EModelEndpoint.openAI]: { ...modelMaxOutputs, ...deepseekMaxOutputs },
@@ -494,11 +516,19 @@ export function getModelTokenValue(
  */
 export function getModelMaxTokens(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
   endpointTokenConfig?: EndpointTokenConfig,
 ): number | undefined {
-  const tokensMap = endpointTokenConfig ?? maxTokensMap[endpoint as keyof typeof maxTokensMap];
-  return getModelTokenValue(modelName, tokensMap);
+  /** A partial override only covers the models it lists; fall back to the
+   *  built-in map for unlisted models instead of dropping to the default
+   *  budget (matches buildTokenConfigMap and getMultiplier). */
+  if (endpointTokenConfig != null) {
+    const overrideValue = getModelTokenValue(modelName, endpointTokenConfig);
+    if (overrideValue != null) {
+      return overrideValue;
+    }
+  }
+  return getModelTokenValue(modelName, maxTokensMap[endpoint as keyof typeof maxTokensMap]);
 }
 
 /**
@@ -511,12 +541,21 @@ export function getModelMaxTokens(
  */
 export function getModelMaxOutputTokens(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
   endpointTokenConfig?: EndpointTokenConfig,
 ): number | undefined {
-  const tokensMap =
-    endpointTokenConfig ?? maxOutputTokensMap[endpoint as keyof typeof maxOutputTokensMap];
-  return getModelTokenValue(modelName, tokensMap, 'output');
+  /** Partial override fallback — see getModelMaxTokens */
+  if (endpointTokenConfig != null) {
+    const overrideValue = getModelTokenValue(modelName, endpointTokenConfig, 'output');
+    if (overrideValue != null) {
+      return overrideValue;
+    }
+  }
+  return getModelTokenValue(
+    modelName,
+    maxOutputTokensMap[endpoint as keyof typeof maxOutputTokensMap],
+    'output',
+  );
 }
 
 /**
@@ -534,7 +573,7 @@ export function getModelMaxOutputTokens(
  */
 export function matchModelName(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
 ): string | undefined {
   if (typeof modelName !== 'string') {
     return undefined;
@@ -553,7 +592,29 @@ export function matchModelName(
   return matchedPattern || modelName;
 }
 
-export const modelSchema = z.object({
+export const modelSchema: z.ZodObject<
+  {
+    id: z.ZodString;
+    pricing: z.ZodObject<
+      {
+        prompt: z.ZodString;
+        completion: z.ZodString;
+      },
+      'strip',
+      z.ZodTypeAny,
+      {
+        prompt: string;
+        completion: string;
+      },
+      {
+        prompt: string;
+        completion: string;
+      }
+    >;
+    context_length: z.ZodNumber;
+  },
+  'strip'
+> = z.object({
   id: z.string(),
   pricing: z.object({
     prompt: z.string(),
@@ -562,7 +623,54 @@ export const modelSchema = z.object({
   context_length: z.number(),
 });
 
-export const inputSchema = z.object({
+export const inputSchema: z.ZodObject<
+  {
+    data: z.ZodArray<
+      z.ZodObject<
+        {
+          id: z.ZodString;
+          pricing: z.ZodObject<
+            {
+              prompt: z.ZodString;
+              completion: z.ZodString;
+            },
+            'strip',
+            z.ZodTypeAny,
+            {
+              prompt: string;
+              completion: string;
+            },
+            {
+              prompt: string;
+              completion: string;
+            }
+          >;
+          context_length: z.ZodNumber;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          id: string;
+          pricing: {
+            prompt: string;
+            completion: string;
+          };
+          context_length: number;
+        },
+        {
+          id: string;
+          pricing: {
+            prompt: string;
+            completion: string;
+          };
+          context_length: number;
+        }
+      >,
+      'many'
+    >;
+  },
+  'strip'
+> = z.object({
   data: z.array(modelSchema),
 });
 
diff --git a/packages/api/src/utils/yaml.ts b/packages/api/src/utils/yaml.ts
index 50ea0bd4de2..ed237b81dd8 100644
--- a/packages/api/src/utils/yaml.ts
+++ b/packages/api/src/utils/yaml.ts
@@ -1,7 +1,7 @@
 import fs from 'fs';
 import yaml from 'js-yaml';
 
-export function loadYaml(filepath: string) {
+export function loadYaml(filepath: string): unknown {
   try {
     const fileContents = fs.readFileSync(filepath, 'utf8');
     return yaml.load(fileContents);
diff --git a/packages/api/src/web/web.spec.ts b/packages/api/src/web/web.spec.ts
index a33a6e1eb11..4ba9e70e480 100644
--- a/packages/api/src/web/web.spec.ts
+++ b/packages/api/src/web/web.spec.ts
@@ -689,8 +689,7 @@ describe('web.ts', () => {
       const originalEnv = process.env;
       process.env = {
         ...originalEnv,
-        SERPER_API_KEY: 'test-key',
-        // Missing other keys to force authentication failure
+        JINA_API_KEY: 'test-key',
       };
 
       // Initialize webSearchConfig with environment variable references
@@ -710,10 +709,9 @@ describe('web.ts', () => {
       mockLoadAuthValues.mockImplementation(({ authFields }) => {
         const result: Record<string, string> = {};
         authFields.forEach((field: string) => {
-          if (field === 'SERPER_API_KEY') {
+          if (field === 'JINA_API_KEY') {
             result[field] = 'test-key';
           }
-          // Other fields are intentionally missing
         });
         return Promise.resolve(result);
       });
@@ -1106,6 +1104,47 @@ describe('web.ts', () => {
       expect(cohereCalls.length).toBe(0);
     });
 
+    it('should fallback to no reranker when rerankerType is omitted and no reranker is authenticated', async () => {
+      const webSearchConfig: TCustomConfig['webSearch'] = {
+        searxngInstanceUrl: '${SEARXNG_INSTANCE_URL}',
+        searxngApiKey: '${SEARXNG_API_KEY}',
+        firecrawlApiKey: '${FIRECRAWL_API_KEY}',
+        firecrawlApiUrl: '${FIRECRAWL_API_URL}',
+        jinaApiKey: '${JINA_API_KEY}',
+        jinaApiUrl: '${JINA_API_URL}',
+        cohereApiKey: '${COHERE_API_KEY}',
+        safeSearch: SafeSearchTypes.MODERATE,
+        searchProvider: 'searxng' as SearchProviders,
+        scraperProvider: 'firecrawl' as ScraperProviders,
+      };
+
+      mockLoadAuthValues.mockImplementation(({ authFields }) => {
+        const result: Record<string, string> = {};
+        authFields.forEach((field: string) => {
+          if (field === 'SEARXNG_INSTANCE_URL') {
+            result[field] = 'https://search.example';
+          } else if (field === 'SEARXNG_API_KEY') {
+            result[field] = 'searxng-api-key';
+          } else if (field === 'FIRECRAWL_API_KEY') {
+            result[field] = 'firecrawl-api-key';
+          } else if (field === 'FIRECRAWL_API_URL') {
+            result[field] = 'https://api.firecrawl.dev';
+          }
+        });
+        return Promise.resolve(result);
+      });
+
+      const result = await loadWebSearchAuth({
+        userId,
+        webSearchConfig,
+        loadAuthValues: mockLoadAuthValues,
+      });
+
+      expect(result.authenticated).toBe(true);
+      expect(result.authResult.rerankerType).toBe('none');
+      expect(result.authTypes).toContainEqual(['rerankers', AuthType.SYSTEM_DEFINED]);
+    });
+
     it('should handle invalid specified service gracefully', async () => {
       // Initialize a webSearchConfig with an invalid searchProvider
       const webSearchConfig: TCustomConfig['webSearch'] = {
diff --git a/packages/api/src/web/web.ts b/packages/api/src/web/web.ts
index 06d65d4d985..d43649947dc 100644
--- a/packages/api/src/web/web.ts
+++ b/packages/api/src/web/web.ts
@@ -7,11 +7,7 @@ import {
   extractVariableName,
 } from 'librechat-data-provider';
 import { webSearchAuth } from '@librechat/data-schemas';
-import type {
-  RerankerTypes,
-  TCustomConfig,
-  TWebSearchConfig,
-} from 'librechat-data-provider';
+import type { RerankerTypes, TCustomConfig, TWebSearchConfig } from 'librechat-data-provider';
 import type { TWebSearchKeys, TWebSearchCategories } from '@librechat/data-schemas';
 import { isSSRFTarget, resolveHostnameSSRF } from '../auth';
 
@@ -209,8 +205,7 @@ export async function loadWebSearchAuth({
           const isUserProvidedOptInUrlKey =
             originalKey != null && USER_PROVIDED_OPT_IN_URL_KEYS.has(originalKey);
           const isUserProvidedUrlEnabled =
-            isUserProvidedUrlKey ||
-            (isUserProvidedOptInUrlKey && isUserProvidedEnabled(field));
+            isUserProvidedUrlKey || (isUserProvidedOptInUrlKey && isUserProvidedEnabled(field));
           let contributed = false;
 
           if (isUserProvidedOptInUrlKey && isFieldUserProvided && !isUserProvidedUrlEnabled) {
@@ -253,6 +248,10 @@ export async function loadWebSearchAuth({
         continue;
       }
     }
+    if (category === SearchCategories.RERANKERS && !webSearchConfig?.rerankerType) {
+      authResult.rerankerType = 'none' as RerankerTypes;
+      return [true, false];
+    }
     return [false, isUserProvided];
   }
 
diff --git a/packages/api/tsdown.config.mjs b/packages/api/tsdown.config.mjs
new file mode 100644
index 00000000000..3a4202e9ec7
--- /dev/null
+++ b/packages/api/tsdown.config.mjs
@@ -0,0 +1,21 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+export default defineConfig({
+  // The telemetry entry is a thin shim (`src/telemetry.ts`) rather than the
+  // `src/telemetry/index.ts` barrel: oxc emits declarations flat into outDir keyed
+  // by source basename, so two `index.ts` entries would collide (index.d.cts +
+  // index2.d.cts). Distinct basenames yield stable `index.*` / `telemetry.*` output.
+  entry: ['src/index.ts', 'src/telemetry.ts'],
+  format: ['cjs'],
+  platform: 'node',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Externalize every third-party dependency (consumers provide the peers) and bundle
+  // only first-party code: relative imports and the `~/*` tsconfig alias (-> src).
+  // `neverBundle` is the 0.22 replacement for the deprecated `external` option.
+  deps: {
+    neverBundle: (id) => !id.startsWith('.') && !id.startsWith('~') && !path.isAbsolute(id),
+  },
+});
diff --git a/packages/client/package.json b/packages/client/package.json
index 3540d1fdb9c..d26093df8f4 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,20 +1,27 @@
 {
   "name": "@librechat/client",
-  "version": "0.4.59",
+  "version": "0.4.63",
   "description": "React components for LibreChat",
   "repository": {
     "type": "git",
     "url": "https://github.com/danny-avila/LibreChat"
   },
-  "main": "dist/index.js",
-  "module": "dist/index.es.js",
-  "types": "dist/types/index.d.ts",
+  "main": "dist/index.cjs",
+  "module": "dist/index.mjs",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.js",
-      "types": "./dist/types/index.d.ts"
-    }
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./style.css": "./dist/style.css",
+    "./package.json": "./package.json"
   },
   "files": [
     "dist"
@@ -22,15 +29,15 @@
   "scripts": {
     "clean": "rimraf dist",
     "b:clean": "bun run rimraf dist",
-    "build": "npm run clean && rollup -c --bundleConfigAsCjs",
-    "build:dev": "npm run clean && NODE_ENV=development rollup -c --bundleConfigAsCjs",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w --bundleConfigAsCjs",
-    "dev": "rollup -c -w --bundleConfigAsCjs"
+    "build": "npm run clean && tsdown",
+    "build:dev": "npm run clean && NODE_ENV=development tsdown",
+    "b:build": "bun run b:clean && bun run tsdown",
+    "build:watch": "tsdown --watch",
+    "dev": "tsdown --watch"
   },
   "peerDependencies": {
-    "@ariakit/react": "^0.4.16",
-    "@ariakit/react-core": "^0.4.17",
+    "@ariakit/react": "^0.4.29",
+    "@ariakit/react-core": "^0.4.26",
     "@dicebear/collection": "^9.4.1",
     "@dicebear/core": "^9.4.1",
     "@headlessui/react": "^2.1.2",
@@ -59,7 +66,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "dompurify": "^3.4.0",
-    "framer-motion": "^12.23.6",
+    "framer-motion": "^12.40.0",
     "i18next": "^24.2.2 || ^25.3.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "input-otp": "^1.4.2",
@@ -90,6 +97,7 @@
     "@tanstack/react-virtual": "^3.13.13",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^14.0.0",
+    "@tsdown/css": "^0.22.2",
     "@types/jest": "^29.5.14",
     "@types/react": "^18.2.11",
     "@types/react-dom": "^18.2.4",
@@ -112,6 +120,7 @@
     "rollup-plugin-postcss": "^4.0.2",
     "rollup-plugin-typescript2": "^0.37.0",
     "tailwindcss-radix": "^2.8.0",
-    "typescript": "^5.0.0"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   }
 }
diff --git a/packages/client/rollup.config.js b/packages/client/rollup.config.js
deleted file mode 100644
index 149545f6269..00000000000
--- a/packages/client/rollup.config.js
+++ /dev/null
@@ -1,82 +0,0 @@
-// ESM bundler config for React components
-import { fileURLToPath } from 'url';
-import alias from '@rollup/plugin-alias';
-import postcss from 'rollup-plugin-postcss';
-import replace from '@rollup/plugin-replace';
-import commonjs from '@rollup/plugin-commonjs';
-import resolve from '@rollup/plugin-node-resolve';
-import typescript from 'rollup-plugin-typescript2';
-import { dirname, resolve as pathResolve } from 'path';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-import pkg from './package.json';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const plugins = [
-  peerDepsExternal(),
-  alias({
-    entries: [{ find: '~', replacement: pathResolve(__dirname, 'src') }],
-  }),
-  resolve({
-    extensions: ['.js', '.jsx', '.ts', '.tsx'],
-    browser: true,
-    preferBuiltins: false,
-  }),
-  replace({
-    'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV || 'production'),
-    'process.env.VITE_ENABLE_LOGGER': JSON.stringify(process.env.VITE_ENABLE_LOGGER || 'false'),
-    'process.env.VITE_LOGGER_FILTER': JSON.stringify(process.env.VITE_LOGGER_FILTER || ''),
-    preventAssignment: true,
-  }),
-  commonjs(),
-  postcss({
-    extract: false,
-    inject: true,
-    minimize: process.env.NODE_ENV === 'production',
-    modules: false,
-    config: {
-      path: './postcss.config.js',
-    },
-  }),
-  typescript({
-    tsconfig: './tsconfig.json',
-    useTsconfigDeclarationDir: true,
-    clean: true,
-    check: false,
-  }),
-];
-
-const isDev = process.env.NODE_ENV !== 'production';
-
-export default {
-  input: 'src/index.ts',
-  output: [
-    {
-      file: pkg.main,
-      format: 'cjs',
-      sourcemap: isDev ? 'inline' : true,
-      exports: 'named',
-    },
-    {
-      file: pkg.module,
-      format: 'esm',
-      sourcemap: isDev ? 'inline' : true,
-      exports: 'named',
-    },
-  ],
-  external: [
-    ...Object.keys(pkg.peerDependencies || {}),
-    'react/jsx-runtime',
-    'react/jsx-dev-runtime',
-  ],
-  preserveSymlinks: true,
-  plugins,
-  onwarn(warning, warn) {
-    // Ignore "use client" directive warnings
-    if (warning.code === 'MODULE_LEVEL_DIRECTIVE') {
-      return;
-    }
-    warn(warning);
-  },
-};
diff --git a/packages/client/src/Providers/ToastContext.tsx b/packages/client/src/Providers/ToastContext.tsx
index afe24995d23..6a34228588d 100644
--- a/packages/client/src/Providers/ToastContext.tsx
+++ b/packages/client/src/Providers/ToastContext.tsx
@@ -1,4 +1,5 @@
-import { createContext, useContext, ReactNode } from 'react';
+import { createContext, useContext, ReactNode, Context } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { TShowToast } from '~/common';
 import useToast from '~/hooks/useToast';
 
@@ -6,15 +7,15 @@ type ToastContextType = {
   showToast: ({ message, severity, showIcon, duration }: TShowToast) => void;
 };
 
-export const ToastContext = createContext<ToastContextType>({
+export const ToastContext: Context<ToastContextType> = createContext<ToastContextType>({
   showToast: () => ({}),
 });
 
-export function useToastContext() {
+export function useToastContext(): ToastContextType {
   return useContext(ToastContext);
 }
 
-export default function ToastProvider({ children }: { children: ReactNode }) {
+export default function ToastProvider({ children }: { children: ReactNode }): JSX.Element {
   const { showToast } = useToast();
 
   return <ToastContext.Provider value={{ showToast }}>{children}</ToastContext.Provider>;
diff --git a/packages/client/src/components/Accordion.tsx b/packages/client/src/components/Accordion.tsx
index 813cf4fa029..b013d0378f0 100644
--- a/packages/client/src/components/Accordion.tsx
+++ b/packages/client/src/components/Accordion.tsx
@@ -1,11 +1,17 @@
 import * as React from 'react';
-import * as AccordionPrimitive from '@radix-ui/react-accordion';
 import { ChevronDownIcon } from '@radix-ui/react-icons';
+import * as AccordionPrimitive from '@radix-ui/react-accordion';
 import { cn } from '~/utils';
 
-const Accordion = AccordionPrimitive.Root;
+const Accordion: React.ForwardRefExoticComponent<
+  (AccordionPrimitive.AccordionSingleProps | AccordionPrimitive.AccordionMultipleProps) &
+    React.RefAttributes<HTMLDivElement>
+> = AccordionPrimitive.Root;
 
-const AccordionItem = React.forwardRef<
+const AccordionItem: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionItemProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Item>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
 >(({ className = '', ...props }, ref) => (
@@ -13,7 +19,10 @@ const AccordionItem = React.forwardRef<
 ));
 AccordionItem.displayName = 'AccordionItem';
 
-const AccordionTrigger = React.forwardRef<
+const AccordionTrigger: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
 >(({ className = '', children, ...props }, ref) => (
@@ -33,7 +42,10 @@ const AccordionTrigger = React.forwardRef<
 ));
 AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName;
 
-const AccordionContent = React.forwardRef<
+const AccordionContent: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
 >(({ className = '', children, ...props }, ref) => (
diff --git a/packages/client/src/components/AlertDialog.tsx b/packages/client/src/components/AlertDialog.tsx
index 4e78fda2111..3de8f592423 100644
--- a/packages/client/src/components/AlertDialog.tsx
+++ b/packages/client/src/components/AlertDialog.tsx
@@ -1,10 +1,13 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import * as AlertDialogPrimitive from '@radix-ui/react-alert-dialog';
 import { cn } from '~/utils';
 
-const AlertDialog = AlertDialogPrimitive.Root;
+const AlertDialog: React.FC<AlertDialogPrimitive.AlertDialogProps> = AlertDialogPrimitive.Root;
 
-const AlertDialogTrigger = AlertDialogPrimitive.Trigger;
+const AlertDialogTrigger: React.ForwardRefExoticComponent<
+  AlertDialogPrimitive.AlertDialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = AlertDialogPrimitive.Trigger;
 
 type AlertPortalProps = AlertDialogPrimitive.AlertDialogPortalProps & { className?: string };
 
@@ -32,7 +35,10 @@ const AlertDialogOverlay = React.forwardRef<
 ));
 AlertDialogOverlay.displayName = AlertDialogPrimitive.Overlay.displayName;
 
-const AlertDialogContent = React.forwardRef<
+const AlertDialogContent: React.ForwardRefExoticComponent<
+  Omit<AlertDialogPrimitive.AlertDialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Content>
 >(({ className = '', ...props }, ref) => (
@@ -51,12 +57,18 @@ const AlertDialogContent = React.forwardRef<
 ));
 AlertDialogContent.displayName = AlertDialogPrimitive.Content.displayName;
 
-const AlertDialogHeader = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const AlertDialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div className={cn('flex flex-col space-y-2 text-center sm:text-left', className)} {...props} />
 );
 AlertDialogHeader.displayName = 'AlertDialogHeader';
 
-const AlertDialogFooter = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const AlertDialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2', className)}
     {...props}
@@ -64,7 +76,13 @@ const AlertDialogFooter = ({ className = '', ...props }: React.HTMLAttributes<HT
 );
 AlertDialogFooter.displayName = 'AlertDialogFooter';
 
-const AlertDialogTitle = React.forwardRef<
+const AlertDialogTitle: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogTitleProps & React.RefAttributes<HTMLHeadingElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Title>
 >(({ className = '', ...props }, ref) => (
@@ -76,7 +94,13 @@ const AlertDialogTitle = React.forwardRef<
 ));
 AlertDialogTitle.displayName = AlertDialogPrimitive.Title.displayName;
 
-const AlertDialogDescription = React.forwardRef<
+const AlertDialogDescription: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Description>
 >(({ className = '', ...props }, ref) => (
@@ -88,7 +112,13 @@ const AlertDialogDescription = React.forwardRef<
 ));
 AlertDialogDescription.displayName = AlertDialogPrimitive.Description.displayName;
 
-const AlertDialogAction = React.forwardRef<
+const AlertDialogAction: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogActionProps & React.RefAttributes<HTMLButtonElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Action>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Action>
 >(({ className = '', ...props }, ref) => (
@@ -103,7 +133,13 @@ const AlertDialogAction = React.forwardRef<
 ));
 AlertDialogAction.displayName = AlertDialogPrimitive.Action.displayName;
 
-const AlertDialogCancel = React.forwardRef<
+const AlertDialogCancel: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogCancelProps & React.RefAttributes<HTMLButtonElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Cancel>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Cancel>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/AnimatedSearchInput.tsx b/packages/client/src/components/AnimatedSearchInput.tsx
index 9e3411d1d71..1a07d728540 100644
--- a/packages/client/src/components/AnimatedSearchInput.tsx
+++ b/packages/client/src/components/AnimatedSearchInput.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { Search } from 'lucide-react';
-import { TranslationKeys, useLocalize } from '~/hooks';
+import { JSX } from 'react/jsx-runtime';
+import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
 const AnimatedSearchInput = ({
@@ -13,7 +14,7 @@ const AnimatedSearchInput = ({
   onChange: (e: React.ChangeEvent<HTMLInputElement>) => void;
   isSearching?: boolean;
   placeholder: string;
-}) => {
+}): JSX.Element => {
   const isSearching = searching === true;
   const hasValue = value != null && value.length > 0;
   const localize = useLocalize();
diff --git a/packages/client/src/components/AnimatedTabs.tsx b/packages/client/src/components/AnimatedTabs.tsx
index 131d871aaf6..3d5eab05dea 100644
--- a/packages/client/src/components/AnimatedTabs.tsx
+++ b/packages/client/src/components/AnimatedTabs.tsx
@@ -1,8 +1,9 @@
-import * as Ariakit from '@ariakit/react';
 import { forwardRef, useEffect, useRef } from 'react';
+import * as Ariakit from '@ariakit/react';
 import type { ElementRef } from 'react';
 import { cn } from '~/utils';
 import './AnimatedTabs.css';
+import { JSX } from 'react/jsx-runtime';
 
 export interface TabItem {
   id?: string;
@@ -89,7 +90,7 @@ export function AnimatedTabs({
   containerClassName = '',
   tabListProps = {},
   defaultSelectedId,
-}: AnimatedTabsProps) {
+}: AnimatedTabsProps): JSX.Element {
   const tabIds = tabs.map((tab, index) => tab.id || `tab-${index}`);
   const firstTabId = defaultSelectedId || tabIds[0];
   const tabListRef = useRef<HTMLDivElement | null>(null);
diff --git a/packages/client/src/components/Badge.tsx b/packages/client/src/components/Badge.tsx
index 0a92d16c698..8a645fc1a3f 100644
--- a/packages/client/src/components/Badge.tsx
+++ b/packages/client/src/components/Badge.tsx
@@ -1,8 +1,9 @@
-import type React from 'react';
 import { X, Plus } from 'lucide-react';
 import { motion } from 'framer-motion';
+import { JSX } from 'react/jsx-runtime';
 import type { ButtonHTMLAttributes } from 'react';
 import type { LucideIcon } from 'lucide-react';
+import type React from 'react';
 import { cn } from '~/utils';
 
 interface BadgeProps
@@ -35,7 +36,7 @@ export default function Badge({
   onToggle,
   className,
   ...props
-}: BadgeProps) {
+}: BadgeProps): JSX.Element {
   const isMoveable = isEditing && isAvailable;
   const isDisabled = id === '1' && isInChat;
 
diff --git a/packages/client/src/components/Breadcrumb.tsx b/packages/client/src/components/Breadcrumb.tsx
index f1026a83052..09e0e5e9afc 100644
--- a/packages/client/src/components/Breadcrumb.tsx
+++ b/packages/client/src/components/Breadcrumb.tsx
@@ -1,9 +1,14 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Slot } from '@radix-ui/react-slot';
 import { ChevronRight, MoreHorizontal } from 'lucide-react';
 import { cn } from '~/utils';
 
-const Breadcrumb = React.forwardRef<
+const Breadcrumb: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLElement>, HTMLElement>, 'ref'> & {
+    separator?: React.ReactNode;
+  } & React.RefAttributes<HTMLElement>
+> = React.forwardRef<
   HTMLElement,
   React.ComponentPropsWithoutRef<'nav'> & {
     separator?: React.ReactNode;
@@ -11,7 +16,10 @@ const Breadcrumb = React.forwardRef<
 >(({ ...props }, ref) => <nav ref={ref} aria-label="breadcrumb" {...props} />);
 Breadcrumb.displayName = 'Breadcrumb';
 
-const BreadcrumbList = React.forwardRef<HTMLOListElement, React.ComponentPropsWithoutRef<'ol'>>(
+const BreadcrumbList: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.OlHTMLAttributes<HTMLOListElement>, HTMLOListElement>, 'ref'> &
+    React.RefAttributes<HTMLOListElement>
+> = React.forwardRef<HTMLOListElement, React.ComponentPropsWithoutRef<'ol'>>(
   ({ className, ...props }, ref) => (
     <ol
       ref={ref}
@@ -25,14 +33,24 @@ const BreadcrumbList = React.forwardRef<HTMLOListElement, React.ComponentPropsWi
 );
 BreadcrumbList.displayName = 'BreadcrumbList';
 
-const BreadcrumbItem = React.forwardRef<HTMLLIElement, React.ComponentPropsWithoutRef<'li'>>(
+const BreadcrumbItem: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.LiHTMLAttributes<HTMLLIElement>, HTMLLIElement>, 'ref'> &
+    React.RefAttributes<HTMLLIElement>
+> = React.forwardRef<HTMLLIElement, React.ComponentPropsWithoutRef<'li'>>(
   ({ className, ...props }, ref) => (
     <li ref={ref} className={cn('inline-flex items-center gap-1.5', className)} {...props} />
   ),
 );
 BreadcrumbItem.displayName = 'BreadcrumbItem';
 
-const BreadcrumbLink = React.forwardRef<
+const BreadcrumbLink: React.ForwardRefExoticComponent<
+  Omit<
+    React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>,
+    'ref'
+  > & {
+    asChild?: boolean;
+  } & React.RefAttributes<HTMLAnchorElement>
+> = React.forwardRef<
   HTMLAnchorElement,
   React.ComponentPropsWithoutRef<'a'> & {
     asChild?: boolean;
@@ -50,7 +68,10 @@ const BreadcrumbLink = React.forwardRef<
 });
 BreadcrumbLink.displayName = 'BreadcrumbLink';
 
-const BreadcrumbPage = React.forwardRef<HTMLSpanElement, React.ComponentPropsWithoutRef<'span'>>(
+const BreadcrumbPage: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLSpanElement>, HTMLSpanElement>, 'ref'> &
+    React.RefAttributes<HTMLSpanElement>
+> = React.forwardRef<HTMLSpanElement, React.ComponentPropsWithoutRef<'span'>>(
   ({ className, ...props }, ref) => (
     <span
       ref={ref}
@@ -64,7 +85,10 @@ const BreadcrumbPage = React.forwardRef<HTMLSpanElement, React.ComponentPropsWit
 );
 BreadcrumbPage.displayName = 'BreadcrumbPage';
 
-const BreadcrumbSeparator = ({ children, className, ...props }: React.ComponentProps<'li'>) => (
+const BreadcrumbSeparator: {
+  ({ children, className, ...props }: React.ComponentProps<'li'>): JSX.Element;
+  displayName: string;
+} = ({ children, className, ...props }: React.ComponentProps<'li'>): JSX.Element => (
   <li
     role="presentation"
     aria-hidden="true"
@@ -76,7 +100,10 @@ const BreadcrumbSeparator = ({ children, className, ...props }: React.ComponentP
 );
 BreadcrumbSeparator.displayName = 'BreadcrumbSeparator';
 
-const BreadcrumbEllipsis = ({ className, ...props }: React.ComponentProps<'span'>) => (
+const BreadcrumbEllipsis: {
+  ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element => (
   <span
     role="presentation"
     aria-hidden="true"
diff --git a/packages/client/src/components/Button.tsx b/packages/client/src/components/Button.tsx
index b7d9701e5bc..53150bde5ac 100644
--- a/packages/client/src/components/Button.tsx
+++ b/packages/client/src/components/Button.tsx
@@ -1,9 +1,26 @@
 import * as React from 'react';
 import { Slot } from '@radix-ui/react-slot';
+import { ClassProp } from 'class-variance-authority/types';
 import { cva, type VariantProps } from 'class-variance-authority';
 import { cn } from '~/utils';
 
-const buttonVariants = cva(
+const buttonVariants: (
+  props?:
+    | ({
+        variant?:
+          | 'default'
+          | 'link'
+          | 'submit'
+          | 'outline'
+          | 'destructive'
+          | 'secondary'
+          | 'ghost'
+          | null
+          | undefined;
+        size?: 'default' | 'icon' | 'sm' | 'lg' | null | undefined;
+      } & ClassProp)
+    | undefined,
+) => string = cva(
   'inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-lg text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
   {
     variants: {
@@ -39,7 +56,9 @@ export interface ButtonProps
   asChild?: boolean;
 }
 
-const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+const Button: React.ForwardRefExoticComponent<
+  ButtonProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<HTMLButtonElement, ButtonProps>(
   ({ className, variant, size, asChild = false, type = 'button', ...props }, ref) => {
     const Comp = asChild ? Slot : 'button';
     return (
diff --git a/packages/client/src/components/Checkbox.tsx b/packages/client/src/components/Checkbox.tsx
index 38d94dd74df..b4b45c221c0 100644
--- a/packages/client/src/components/Checkbox.tsx
+++ b/packages/client/src/components/Checkbox.tsx
@@ -20,7 +20,9 @@ export type CheckboxProps =
       'aria-label'?: never;
     });
 
-const Checkbox = React.forwardRef<React.ElementRef<typeof CheckboxPrimitive.Root>, CheckboxProps>(
+const Checkbox: React.ForwardRefExoticComponent<
+  CheckboxProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<React.ElementRef<typeof CheckboxPrimitive.Root>, CheckboxProps>(
   ({ className = '', ...props }, ref) => (
     <CheckboxPrimitive.Root
       ref={ref}
diff --git a/packages/client/src/components/CheckboxButton.tsx b/packages/client/src/components/CheckboxButton.tsx
index 1858b7b68d8..e91e7e0efef 100644
--- a/packages/client/src/components/CheckboxButton.tsx
+++ b/packages/client/src/components/CheckboxButton.tsx
@@ -3,7 +3,20 @@ import { useEffect } from 'react';
 import { Checkbox, useStoreState, useCheckboxStore } from '@ariakit/react';
 import { cn } from '~/utils';
 
-const CheckboxButton = React.forwardRef<
+const CheckboxButton: React.ForwardRefExoticComponent<
+  {
+    icon?: React.ReactNode;
+    label: string;
+    className?: string;
+    checked?: boolean;
+    defaultChecked?: boolean;
+    isCheckedClassName?: string;
+    setValue?: (values: {
+      e?: React.ChangeEvent<HTMLInputElement>;
+      value: boolean | string;
+    }) => void;
+  } & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<
   HTMLInputElement,
   {
     icon?: React.ReactNode;
diff --git a/packages/client/src/components/Collapsible.tsx b/packages/client/src/components/Collapsible.tsx
index 9605c4e41ab..a91c0b36dbc 100644
--- a/packages/client/src/components/Collapsible.tsx
+++ b/packages/client/src/components/Collapsible.tsx
@@ -1,9 +1,16 @@
+import { ForwardRefExoticComponent, RefAttributes } from 'react';
 import * as CollapsiblePrimitive from '@radix-ui/react-collapsible';
 
-const Collapsible = CollapsiblePrimitive.Root;
+const Collapsible: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleProps & RefAttributes<HTMLDivElement>
+> = CollapsiblePrimitive.Root;
 
-const CollapsibleTrigger = CollapsiblePrimitive.CollapsibleTrigger;
+const CollapsibleTrigger: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleTriggerProps & RefAttributes<HTMLButtonElement>
+> = CollapsiblePrimitive.CollapsibleTrigger;
 
-const CollapsibleContent = CollapsiblePrimitive.CollapsibleContent;
+const CollapsibleContent: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleContentProps & RefAttributes<HTMLDivElement>
+> = CollapsiblePrimitive.CollapsibleContent;
 
 export { Collapsible, CollapsibleTrigger, CollapsibleContent };
diff --git a/packages/client/src/components/Combobox.tsx b/packages/client/src/components/Combobox.tsx
index 147d3c19391..793a8af7de1 100644
--- a/packages/client/src/components/Combobox.tsx
+++ b/packages/client/src/components/Combobox.tsx
@@ -1,4 +1,5 @@
 import { startTransition } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Search as SearchIcon } from 'lucide-react';
 import * as RadixSelect from '@radix-ui/react-select';
 import { CheckIcon, ChevronDownIcon } from '@radix-ui/react-icons';
@@ -34,7 +35,7 @@ export default function ComboboxComponent({
   setValue: (value: string) => void;
   isCollapsed: boolean;
   SelectIcon?: React.ReactNode;
-}) {
+}): JSX.Element {
   const options: OptionWithIcon[] = (items ?? []).map((option: string | OptionWithIcon) => {
     if (typeof option === 'string') {
       return { label: option, value: option };
diff --git a/packages/client/src/components/ControlCombobox.tsx b/packages/client/src/components/ControlCombobox.tsx
index 8c6ca3d8bf3..d7e9aaa65b3 100644
--- a/packages/client/src/components/ControlCombobox.tsx
+++ b/packages/client/src/components/ControlCombobox.tsx
@@ -1,10 +1,11 @@
+import { useMemo, useState, useRef, memo, useEffect, MemoExoticComponent } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { matchSorter } from 'match-sorter';
 import { Search, ChevronDown } from 'lucide-react';
-import { useMemo, useState, useRef, memo, useEffect } from 'react';
 import { SelectRenderer } from '@ariakit/react-core/select/select-renderer';
 import type { OptionWithIcon } from '~/common';
 import './AnimatePopover.css';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 interface ControlComboboxProps {
@@ -24,6 +25,7 @@ interface ControlComboboxProps {
   disabled?: boolean;
   iconSide?: 'left' | 'right';
   selectId?: string;
+  placement?: Ariakit.SelectStoreProps['placement'];
 }
 
 const ROW_HEIGHT = 36;
@@ -45,7 +47,8 @@ function ControlCombobox({
   iconClassName,
   iconSide = 'left',
   selectId,
-}: ControlComboboxProps) {
+  placement,
+}: ControlComboboxProps): JSX.Element {
   const [searchValue, setSearchValue] = useState('');
   const buttonRef = useRef<HTMLButtonElement>(null);
   const [buttonWidth, setButtonWidth] = useState<number | null>(null);
@@ -69,6 +72,7 @@ function ControlCombobox({
     defaultItems: items.map(getItem),
     value: selectedValue,
     setValue,
+    placement,
   });
 
   const matches = useMemo(() => {
@@ -201,4 +205,5 @@ function ControlCombobox({
   );
 }
 
-export default memo(ControlCombobox);
+const ControlComboboxMemo: MemoExoticComponent<typeof ControlCombobox> = memo(ControlCombobox);
+export default ControlComboboxMemo;
diff --git a/packages/client/src/components/DataTable.tsx b/packages/client/src/components/DataTable.tsx
index 6a26e31d765..9b3712aa817 100644
--- a/packages/client/src/components/DataTable.tsx
+++ b/packages/client/src/components/DataTable.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback, useEffect, useRef, useState, memo, useMemo } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { useVirtualizer } from '@tanstack/react-virtual';
 import {
   Row,
@@ -222,7 +223,7 @@ export default function DataTable<TData, TValue>({
   filterValue,
   isLoading,
   enableSearch = true,
-}: DataTableProps<TData, TValue>) {
+}: DataTableProps<TData, TValue>): JSX.Element {
   const localize = useLocalize();
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const tableContainerRef = useRef<HTMLDivElement>(null);
@@ -434,7 +435,10 @@ export default function DataTable<TData, TValue>({
           className,
         )}
       >
-        <Table className="w-full min-w-[300px] table-fixed border-separate border-spacing-0">
+        <Table
+          unwrapped
+          className="w-full min-w-[300px] table-fixed border-separate border-spacing-0"
+        >
           <TableHeader className="sticky top-0 z-50 bg-surface-secondary">
             {table.getHeaderGroups().map((headerGroup) => (
               <TableRow key={headerGroup.id} className="border-b border-border-light">
diff --git a/packages/client/src/components/DataTable/DataTable.hooks.ts b/packages/client/src/components/DataTable/DataTable.hooks.ts
index d2941fb4387..ed062f0b4cb 100644
--- a/packages/client/src/components/DataTable/DataTable.hooks.ts
+++ b/packages/client/src/components/DataTable/DataTable.hooks.ts
@@ -1,7 +1,7 @@
-import { useState, useEffect, useMemo } from 'react';
+import { useState, useEffect, useMemo, SetStateAction, Dispatch, CSSProperties } from 'react';
 import type { TableColumn } from './DataTable.types';
 
-export function useDebounced<T>(value: T, delay: number) {
+export function useDebounced<T>(value: T, delay: number): T {
   const [debounced, setDebounced] = useState(value);
 
   useEffect(() => {
@@ -12,7 +12,9 @@ export function useDebounced<T>(value: T, delay: number) {
   return debounced;
 }
 
-export const useOptimizedRowSelection = (initialSelection: Record<string, boolean> = {}) => {
+export const useOptimizedRowSelection = (
+  initialSelection: Record<string, boolean> = {},
+): readonly [Record<string, boolean>, Dispatch<SetStateAction<Record<string, boolean>>>] => {
   const [selection, setSelection] = useState(initialSelection);
   return [selection, setSelection] as const;
 };
@@ -21,7 +23,7 @@ export const useColumnStyles = <TData, TValue>(
   columns: TableColumn<TData, TValue>[],
   isSmallScreen: boolean,
   containerRef: React.RefObject<HTMLDivElement>,
-) => {
+): Record<string, CSSProperties> => {
   const [containerWidth, setContainerWidth] = useState(0);
 
   useEffect(() => {
@@ -83,13 +85,20 @@ export const useColumnStyles = <TData, TValue>(
   }, [columns, containerWidth, isSmallScreen]);
 };
 
-export const useDynamicColumnWidths = useColumnStyles;
+export const useDynamicColumnWidths: <TData, TValue>(
+  columns: TableColumn<TData, TValue>[],
+  isSmallScreen: boolean,
+  containerRef: React.RefObject<HTMLDivElement>,
+) => Record<string, CSSProperties> = useColumnStyles;
 
 export const useKeyboardNavigation = (
   tableRef: React.RefObject<HTMLDivElement>,
   rowCount: number,
   onRowSelect?: (index: number) => void,
-) => {
+): {
+  focusedRowIndex: number;
+  setFocusedRowIndex: Dispatch<SetStateAction<number>>;
+} => {
   const [focusedRowIndex, setFocusedRowIndex] = useState<number>(-1);
 
   useEffect(() => {
diff --git a/packages/client/src/components/DataTable/DataTable.tsx b/packages/client/src/components/DataTable/DataTable.tsx
index 4320b86db3e..2c11155e0ae 100644
--- a/packages/client/src/components/DataTable/DataTable.tsx
+++ b/packages/client/src/components/DataTable/DataTable.tsx
@@ -1,4 +1,5 @@
 import React, { useRef, useState, useEffect, useMemo, useCallback } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { useVirtualizer } from '@tanstack/react-virtual';
 import { ArrowUp, ArrowDown, ArrowDownUp } from 'lucide-react';
 import {
@@ -37,7 +38,7 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
   sorting,
   onSortingChange,
   customActionsRenderer,
-}: DataTableProps<TData, TValue>) {
+}: DataTableProps<TData, TValue>): JSX.Element {
   const localize = useLocalize();
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
 
@@ -140,6 +141,10 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
       }
     });
     return newVisibility;
+    /* isSmallScreen is intentionally a dependency: it forces a fresh result
+       reference when the viewport crosses the mobile breakpoint so the effect
+       below re-applies column visibility, even though the body doesn't read it. */
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isSmallScreen, columns]);
 
   useEffect(() => {
@@ -510,15 +515,24 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
 
                   const metaWidth = (header.column.columnDef.meta as { width?: number } | undefined)
                     ?.width;
-                  const widthStyle = isSelectHeader
-                    ? { width: '32px', maxWidth: '32px', minWidth: '32px' }
-                    : metaWidth && metaWidth >= 1 && metaWidth <= 100
-                      ? {
-                          width: `${metaWidth}%`,
-                          maxWidth: `${metaWidth}%`,
-                          minWidth: `${metaWidth}%`,
-                        }
-                      : {};
+                  let widthStyle: React.CSSProperties = {};
+                  if (isSelectHeader) {
+                    widthStyle = { width: '32px', maxWidth: '32px', minWidth: '32px' };
+                  } else if (metaWidth != null && metaWidth >= 1 && metaWidth <= 100) {
+                    widthStyle = {
+                      width: `${metaWidth}%`,
+                      maxWidth: `${metaWidth}%`,
+                      minWidth: `${metaWidth}%`,
+                    };
+                  }
+
+                  const sortDirection = header.column.getIsSorted();
+                  let ariaSort: 'ascending' | 'descending' | undefined;
+                  if (sortDirection === 'asc') {
+                    ariaSort = 'ascending';
+                  } else if (sortDirection === 'desc') {
+                    ariaSort = 'descending';
+                  }
                   return (
                     <TableHead
                       key={header.id}
@@ -537,13 +551,7 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
                       role={canSort ? 'button' : undefined}
                       tabIndex={canSort ? 0 : undefined}
                       aria-label={sortAriaLabel}
-                      aria-sort={
-                        header.column.getIsSorted() === 'asc'
-                          ? 'ascending'
-                          : header.column.getIsSorted() === 'desc'
-                            ? 'descending'
-                            : undefined
-                      }
+                      aria-sort={ariaSort}
                     >
                       {isSelectHeader ? (
                         flexRender(header.column.columnDef.header, header.getContext())
diff --git a/packages/client/src/components/DataTable/DataTableComponents.tsx b/packages/client/src/components/DataTable/DataTableComponents.tsx
index d058ad409b0..830c05d4cc3 100644
--- a/packages/client/src/components/DataTable/DataTableComponents.tsx
+++ b/packages/client/src/components/DataTable/DataTableComponents.tsx
@@ -1,13 +1,24 @@
 import React, { memo, forwardRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { flexRender } from '@tanstack/react-table';
-import type { TableColumn } from './DataTable.types';
 import type { Row } from '@tanstack/react-table';
+import type { TableColumn } from './DataTable.types';
 import { TableCell, TableRow, TableRowHeader } from '../Table';
 import { Checkbox } from '../Checkbox';
 import { Skeleton } from '../Skeleton';
 import { cn } from '~/utils';
 
-export const SelectionCheckbox = memo(
+export const SelectionCheckbox: React.MemoExoticComponent<
+  ({
+    checked,
+    onChange,
+    ariaLabel,
+  }: {
+    checked: boolean;
+    onChange: (value: boolean) => void;
+    ariaLabel: string;
+  }) => JSX.Element
+> = memo(
   ({
     checked,
     onChange,
@@ -16,7 +27,7 @@ export const SelectionCheckbox = memo(
     checked: boolean;
     onChange: (value: boolean) => void;
     ariaLabel: string;
-  }) => (
+  }): JSX.Element => (
     <div
       role="button"
       tabIndex={0}
@@ -70,16 +81,16 @@ const TableRowComponent = <TData extends Record<string, unknown>>(
         const isDesktopOnly = meta?.desktopOnly;
         const isRowHeader = meta?.isRowHeader;
         const percent = meta?.width;
-        const widthStyle =
-          cell.column.id === 'select'
-            ? { width: '32px', maxWidth: '32px', minWidth: '32px' }
-            : percent
-              ? {
-                  width: `${percent}%`,
-                  maxWidth: `${percent}%`,
-                  minWidth: `${percent}%`, // Don't shrink on mobile
-                }
-              : undefined;
+        let widthStyle: React.CSSProperties | undefined;
+        if (cell.column.id === 'select') {
+          widthStyle = { width: '32px', maxWidth: '32px', minWidth: '32px' };
+        } else if (percent) {
+          widthStyle = {
+            width: `${percent}%`,
+            maxWidth: `${percent}%`,
+            minWidth: `${percent}%`, // Don't shrink on mobile
+          };
+        }
 
         const CellComponent = isRowHeader ? TableRowHeader : TableCell;
 
@@ -124,20 +135,29 @@ interface GenericRowProps {
   selected: boolean;
 }
 
-export const MemoizedTableRow = memo(
-  ForwardTableRowComponent as (props: GenericRowProps) => JSX.Element,
-  (prev: GenericRowProps, next: GenericRowProps) =>
-    prev.row.original === next.row.original && prev.selected === next.selected,
-);
+export const MemoizedTableRow: React.MemoExoticComponent<(props: GenericRowProps) => JSX.Element> =
+  memo(
+    ForwardTableRowComponent as (props: GenericRowProps) => JSX.Element,
+    (prev: GenericRowProps, next: GenericRowProps) =>
+      prev.row.original === next.row.original && prev.selected === next.selected,
+  );
 
-export const SkeletonRows = memo(
+export const SkeletonRows: React.MemoExoticComponent<
+  <TData extends Record<string, unknown>, TValue>({
+    count,
+    columns,
+  }: {
+    count?: number;
+    columns: TableColumn<TData, TValue>[];
+  }) => JSX.Element
+> = memo(
   <TData extends Record<string, unknown>, TValue>({
     count = 10,
     columns,
   }: {
     count?: number;
     columns: TableColumn<TData, TValue>[];
-  }) => (
+  }): JSX.Element => (
     <>
       {Array.from({ length: count }, (_, index) => (
         <TableRow key={`skeleton-${index}`} className="h-[56px] border-b border-border-light">
diff --git a/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx b/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
index aa6dd2294f5..6d47cdafc5e 100644
--- a/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
+++ b/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
@@ -1,8 +1,9 @@
 import { Component, ErrorInfo, ReactNode, createRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { RefreshCw } from 'lucide-react';
+import { useLocalize } from '~/hooks';
 import { Button } from '../Button';
 import { logger } from '~/utils';
-import { useLocalize } from '~/hooks';
 
 /**
  * Error boundary specifically for DataTable component.
@@ -114,7 +115,7 @@ class DataTableErrorBoundaryInner extends Component<
   }
 }
 
-export function DataTableErrorBoundary(props: DataTableErrorBoundaryProps) {
+export function DataTableErrorBoundary(props: DataTableErrorBoundaryProps): JSX.Element {
   const localize = useLocalize();
   return <DataTableErrorBoundaryInner {...props} localize={localize} />;
 }
diff --git a/packages/client/src/components/DataTable/DataTableSearch.tsx b/packages/client/src/components/DataTable/DataTableSearch.tsx
index 30ced61cbe2..f269d0a1542 100644
--- a/packages/client/src/components/DataTable/DataTableSearch.tsx
+++ b/packages/client/src/components/DataTable/DataTableSearch.tsx
@@ -1,12 +1,21 @@
-import { memo } from 'react';
 import { startTransition } from 'react';
+import { memo, MemoExoticComponent } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { DataTableSearchProps } from './DataTable.types';
 import { useLocalize } from '~/hooks';
 import { Input } from '../Input';
 import { cn } from '~/utils';
 
-export const DataTableSearch = memo(
-  ({ value, onChange, placeholder, className, disabled = false }: DataTableSearchProps) => {
+export const DataTableSearch: MemoExoticComponent<
+  ({ value, onChange, placeholder, className, disabled }: DataTableSearchProps) => JSX.Element
+> = memo(
+  ({
+    value,
+    onChange,
+    placeholder,
+    className,
+    disabled = false,
+  }: DataTableSearchProps): JSX.Element => {
     const localize = useLocalize();
 
     return (
diff --git a/packages/client/src/components/DelayedRender.tsx b/packages/client/src/components/DelayedRender.tsx
index 0899d1dd32b..e15a71f8dfa 100644
--- a/packages/client/src/components/DelayedRender.tsx
+++ b/packages/client/src/components/DelayedRender.tsx
@@ -6,7 +6,7 @@ interface DelayedRenderProps {
   children: React.ReactNode;
 }
 
-const DelayedRender = ({ delay, children }: DelayedRenderProps) =>
+const DelayedRender = ({ delay, children }: DelayedRenderProps): React.ReactNode =>
   useDelayedRender(delay)(() => children);
 
 export default DelayedRender;
diff --git a/packages/client/src/components/Dialog.tsx b/packages/client/src/components/Dialog.tsx
index 572faf91005..c5b97cc2e6a 100644
--- a/packages/client/src/components/Dialog.tsx
+++ b/packages/client/src/components/Dialog.tsx
@@ -1,13 +1,16 @@
 import * as React from 'react';
+import { X } from 'lucide-react';
+import { JSX } from 'react/jsx-runtime';
 import * as DialogPrimitive from '@radix-ui/react-dialog';
+import { Button, ButtonProps } from './Button';
 import { useMediaQuery } from '~/hooks';
-import { Button } from './Button';
-import { X } from 'lucide-react';
 import { cn } from '~/utils';
 
-const Dialog = DialogPrimitive.Root;
+const Dialog: React.FC<DialogPrimitive.DialogProps> = DialogPrimitive.Root;
 
-const DialogTrigger = DialogPrimitive.Trigger;
+const DialogTrigger: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Trigger;
 
 type DialogPortalProps = DialogPrimitive.DialogPortalProps & { className?: string };
 
@@ -40,10 +43,12 @@ type DialogContentProps = React.ComponentPropsWithoutRef<typeof DialogPrimitive.
   disableScroll?: boolean;
 };
 
-const DialogContent = React.forwardRef<
-  React.ElementRef<typeof DialogPrimitive.Content>,
-  DialogContentProps
->(
+const DialogContent: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    showCloseButton?: boolean;
+    disableScroll?: boolean;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<typeof DialogPrimitive.Content>, DialogContentProps>(
   (
     { className, children = true, showCloseButton = true, disableScroll = false, ...props },
     ref,
@@ -79,7 +84,10 @@ const DialogContent = React.forwardRef<
 );
 DialogContent.displayName = DialogPrimitive.Content.displayName;
 
-const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn(
       'flex flex-col space-y-2 border-b border-black/10 p-6 pb-4 text-left dark:border-white/10',
@@ -90,7 +98,10 @@ const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogHeader.displayName = 'DialogHeader';
 
-const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-row justify-between space-x-2 px-6 py-4', className ?? '')}
     {...props}
@@ -98,7 +109,10 @@ const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogFooter.displayName = 'DialogFooter';
 
-const DialogTitle = React.forwardRef<
+const DialogTitle: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogTitleProps & React.RefAttributes<HTMLHeadingElement>, 'ref'> &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
 >(({ className, ...props }, ref) => (
@@ -110,7 +124,10 @@ const DialogTitle = React.forwardRef<
 ));
 DialogTitle.displayName = DialogPrimitive.Title.displayName;
 
-const DialogDescription = React.forwardRef<
+const DialogDescription: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>, 'ref'> &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
 >(({ className, ...props }, ref) => (
@@ -122,7 +139,10 @@ const DialogDescription = React.forwardRef<
 ));
 DialogDescription.displayName = DialogPrimitive.Description.displayName;
 
-const DialogClose = React.forwardRef<
+const DialogClose: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogCloseProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Close>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Close>
 >(({ className, ...props }, ref) => (
@@ -139,7 +159,10 @@ const DialogClose = React.forwardRef<
 ));
 DialogClose.displayName = DialogPrimitive.Title.displayName;
 
-const DialogButton = React.forwardRef<
+const DialogButton: React.ForwardRefExoticComponent<
+  Omit<ButtonProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof Button>,
   React.ComponentPropsWithoutRef<typeof Button>
 >(({ className, ...props }, ref) => (
diff --git a/packages/client/src/components/DialogTemplate.tsx b/packages/client/src/components/DialogTemplate.tsx
index d3ee806641c..6a286cbdff2 100644
--- a/packages/client/src/components/DialogTemplate.tsx
+++ b/packages/client/src/components/DialogTemplate.tsx
@@ -1,4 +1,4 @@
-import { forwardRef, ReactNode, Ref } from 'react';
+import { forwardRef, ForwardRefExoticComponent, ReactNode, Ref, RefAttributes } from 'react';
 import {
   DialogClose,
   DialogContent,
@@ -29,7 +29,9 @@ type DialogTemplateProps = {
   showCancelButton?: boolean;
 };
 
-const DialogTemplate = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
+const DialogTemplate: ForwardRefExoticComponent<
+  DialogTemplateProps & RefAttributes<HTMLDivElement>
+> = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
   const {
     title,
     description,
diff --git a/packages/client/src/components/Dropdown.tsx b/packages/client/src/components/Dropdown.tsx
index 74b9b4cb80a..e0df3ac2c5d 100644
--- a/packages/client/src/components/Dropdown.tsx
+++ b/packages/client/src/components/Dropdown.tsx
@@ -1,5 +1,8 @@
-import React from 'react';
+import React, { useMemo, useState } from 'react';
+import { Search } from 'lucide-react';
+import { matchSorter } from 'match-sorter';
 import * as Select from '@ariakit/react/select';
+import * as Combobox from '@ariakit/react/combobox';
 import type { Option } from '~/common';
 import { cn } from '~/utils/';
 import './Dropdown.css';
@@ -18,6 +21,10 @@ interface DropdownProps {
   ariaLabel?: string;
   'aria-labelledby'?: string;
   portal?: boolean;
+  disabled?: boolean;
+  searchable?: boolean;
+  searchPlaceholder?: string;
+  searchEmptyText?: string;
 }
 
 const isDivider = (item: string | Option | { divider: true }): item is { divider: true } =>
@@ -26,6 +33,9 @@ const isDivider = (item: string | Option | { divider: true }): item is { divider
 const isOption = (item: string | Option | { divider: true }): item is Option =>
   typeof item === 'object' && 'value' in item && 'label' in item;
 
+const normalizeOption = (item: string | Option): Option =>
+  typeof item === 'string' ? { value: item, label: item } : item;
+
 const Dropdown: React.FC<DropdownProps> = ({
   value: selectedValue,
   label = '',
@@ -40,12 +50,25 @@ const Dropdown: React.FC<DropdownProps> = ({
   ariaLabel,
   'aria-labelledby': ariaLabelledBy,
   portal = true,
+  disabled = false,
+  searchable = false,
+  searchPlaceholder,
+  searchEmptyText,
 }) => {
+  const [searchValue, setSearchValue] = useState('');
+
   const handleChange = (value: string) => {
     onChange(value);
   };
 
+  const comboboxStore = Combobox.useComboboxStore({
+    resetValueOnHide: true,
+    value: searchValue,
+    setValue: setSearchValue,
+  });
+
   const selectProps = Select.useSelectStore({
+    combobox: searchable ? comboboxStore : undefined,
     value: selectedValue,
     setValue: handleChange,
   });
@@ -56,8 +79,8 @@ const Dropdown: React.FC<DropdownProps> = ({
     }
     return options
       .filter((o) => !isDivider(o))
-      .map((o) => (typeof o === 'string' ? { value: o, label: o } : o))
-      .find((o) => isOption(o) && o.value === val) as Option | undefined;
+      .map((o) => normalizeOption(o as string | Option))
+      .find((o) => o.value === val);
   };
 
   const getOptionLabel = (currentValue: string | undefined) => {
@@ -68,12 +91,54 @@ const Dropdown: React.FC<DropdownProps> = ({
     return option ? option.label : currentValue;
   };
 
+  const matches = useMemo(() => {
+    if (!searchable) {
+      return [];
+    }
+    const optionItems = options
+      .filter((o) => !isDivider(o))
+      .map((o) => normalizeOption(o as string | Option));
+    return matchSorter(optionItems, searchValue, {
+      keys: ['label', 'value'],
+      baseSort: (a, b) => (a.index < b.index ? -1 : 1),
+    });
+  }, [searchable, options, searchValue]);
+
+  const renderOptionContent = (option: Option) => (
+    <div className="flex w-full items-center gap-2">
+      {option.icon != null && <span>{option.icon as React.ReactNode}</span>}
+      <span className="block truncate">{option.label}</span>
+      {selectedValue === option.value && (
+        <span className="ml-auto pl-2">
+          <svg
+            width="24"
+            height="24"
+            viewBox="0 0 24 24"
+            fill="none"
+            xmlns="http://www.w3.org/2000/svg"
+            className="icon-md block group-hover:hidden"
+            aria-hidden="true"
+          >
+            <path
+              fillRule="evenodd"
+              clipRule="evenodd"
+              d="M2 12C2 6.47715 6.47715 2 12 2C17.5228 2 22 6.47715 22 12C22 17.5228 17.5228 22 12 22C6.47715 22 2 17.5228 2 12ZM16.0755 7.93219C16.5272 8.25003 16.6356 8.87383 16.3178 9.32549L11.5678 16.0755C11.3931 16.3237 11.1152 16.4792 10.8123 16.4981C10.5093 16.517 10.2142 16.3973 10.0101 16.1727L7.51006 13.4227C7.13855 13.014 7.16867 12.3816 7.57733 12.0101C7.98598 11.6386 8.61843 11.6687 8.98994 12.0773L10.6504 13.9039L14.6822 8.17451C15 7.72284 15.6238 7.61436 16.0755 7.93219Z"
+              fill="currentColor"
+            />
+          </svg>
+        </span>
+      )}
+    </div>
+  );
+
   return (
     <div className={cn('relative', className)}>
       <Select.Select
         store={selectProps}
+        disabled={disabled}
         className={cn(
           'focus:ring-offset-ring-offset relative inline-flex items-center justify-between rounded-xl border border-input bg-background px-3 py-2 text-sm text-text-primary transition-all duration-200 ease-in-out hover:bg-accent hover:text-accent-foreground focus:ring-ring-primary',
+          'disabled:cursor-not-allowed disabled:opacity-50 disabled:hover:bg-background disabled:hover:text-text-primary',
           iconOnly ? 'size-10' : 'w-fit gap-2',
           className,
         )}
@@ -109,49 +174,74 @@ const Dropdown: React.FC<DropdownProps> = ({
           '[pointer-events:auto]', // Override body's pointer-events:none when in modal
         )}
       >
-        {options.map((item, index) => {
-          if (isDivider(item)) {
-            return <div key={`divider-${index}`} className="my-1 border-t border-border-heavy" />;
-          }
-
-          const option = typeof item === 'string' ? { value: item, label: item } : item;
-          if (!isOption(option)) {
-            return null;
-          }
-
-          return (
-            <Select.SelectItem
-              key={`option-${index}`}
-              value={String(option.value)}
-              className="select-item"
-              data-theme={option.value}
+        {searchable ? (
+          <>
+            <div className="sticky -top-2 z-10 -mx-2 -mt-2 mb-1 bg-surface-primary px-2 pb-1.5 pt-2 dark:bg-surface-secondary">
+              <div className="relative">
+                <Search
+                  className="pointer-events-none absolute left-2 top-1/2 h-4 w-4 -translate-y-1/2 text-text-tertiary"
+                  aria-hidden="true"
+                />
+                <Combobox.Combobox
+                  store={comboboxStore}
+                  autoSelect
+                  placeholder={searchPlaceholder}
+                  aria-label={searchPlaceholder}
+                  className="w-full rounded-lg bg-transparent py-1.5 pl-8 pr-2 text-sm text-text-primary placeholder:text-text-secondary focus:outline-none focus:ring-2 focus:ring-border-xheavy"
+                />
+              </div>
+            </div>
+            <Combobox.ComboboxList
+              store={comboboxStore}
+              aria-label={ariaLabel}
+              aria-labelledby={ariaLabelledBy}
+              className="flex flex-col"
             >
-              <div className="flex w-full items-center gap-2">
-                {option.icon != null && <span>{option.icon as React.ReactNode}</span>}
-                <span className="block truncate">{option.label}</span>
-                {selectedValue === option.value && (
-                  <span className="ml-auto pl-2">
-                    <svg
-                      width="24"
-                      height="24"
-                      viewBox="0 0 24 24"
-                      fill="none"
-                      xmlns="http://www.w3.org/2000/svg"
-                      className="icon-md block group-hover:hidden"
-                    >
-                      <path
-                        fillRule="evenodd"
-                        clipRule="evenodd"
-                        d="M2 12C2 6.47715 6.47715 2 12 2C17.5228 2 22 6.47715 22 12C22 17.5228 17.5228 22 12 22C6.47715 22 2 17.5228 2 12ZM16.0755 7.93219C16.5272 8.25003 16.6356 8.87383 16.3178 9.32549L11.5678 16.0755C11.3931 16.3237 11.1152 16.4792 10.8123 16.4981C10.5093 16.517 10.2142 16.3973 10.0101 16.1727L7.51006 13.4227C7.13855 13.014 7.16867 12.3816 7.57733 12.0101C7.98598 11.6386 8.61843 11.6687 8.98994 12.0773L10.6504 13.9039L14.6822 8.17451C15 7.72284 15.6238 7.61436 16.0755 7.93219Z"
-                        fill="currentColor"
-                      />
-                    </svg>
-                  </span>
-                )}
+              {matches.map((option) => (
+                <Combobox.ComboboxItem
+                  key={`option-${String(option.value)}`}
+                  value={String(option.value)}
+                  className="select-item"
+                  render={
+                    <Select.SelectItem value={String(option.value)} data-theme={option.value} />
+                  }
+                >
+                  {renderOptionContent(option)}
+                </Combobox.ComboboxItem>
+              ))}
+            </Combobox.ComboboxList>
+            {matches.length === 0 && (
+              <div className="px-2 py-6 text-center text-sm text-text-secondary" aria-hidden="true">
+                {searchEmptyText}
               </div>
-            </Select.SelectItem>
-          );
-        })}
+            )}
+            <div role="status" aria-live="polite" className="sr-only">
+              {matches.length === 0 ? searchEmptyText : ''}
+            </div>
+          </>
+        ) : (
+          options.map((item, index) => {
+            if (isDivider(item)) {
+              return <div key={`divider-${index}`} className="my-1 border-t border-border-heavy" />;
+            }
+
+            const option = normalizeOption(item);
+            if (!isOption(option)) {
+              return null;
+            }
+
+            return (
+              <Select.SelectItem
+                key={`option-${index}`}
+                value={String(option.value)}
+                className="select-item"
+                data-theme={option.value}
+              >
+                {renderOptionContent(option)}
+              </Select.SelectItem>
+            );
+          })
+        )}
       </Select.SelectPopover>
     </div>
   );
diff --git a/packages/client/src/components/DropdownMenu.tsx b/packages/client/src/components/DropdownMenu.tsx
index 013301bc6ac..a73fe6e7c1c 100644
--- a/packages/client/src/components/DropdownMenu.tsx
+++ b/packages/client/src/components/DropdownMenu.tsx
@@ -1,21 +1,24 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import * as DropdownMenuPrimitive from '@radix-ui/react-dropdown-menu';
 import { CheckIcon, ChevronRightIcon, CircleIcon } from 'lucide-react';
 import { cn } from '~/utils';
 
-function DropdownMenu({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
+function DropdownMenu({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Root>): JSX.Element {
   return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />;
 }
 
 function DropdownMenuPortal({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>): JSX.Element {
   return <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />;
 }
 
 function DropdownMenuTrigger({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>): JSX.Element {
   return <DropdownMenuPrimitive.Trigger data-slot="dropdown-menu-trigger" {...props} />;
 }
 
@@ -23,7 +26,7 @@ function DropdownMenuContent({
   className,
   sideOffset = 4,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>): JSX.Element {
   return (
     <DropdownMenuPrimitive.Portal>
       <DropdownMenuPrimitive.Content
@@ -39,7 +42,9 @@ function DropdownMenuContent({
   );
 }
 
-function DropdownMenuGroup({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
+function DropdownMenuGroup({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Group>): JSX.Element {
   return <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />;
 }
 
@@ -51,7 +56,7 @@ function DropdownMenuItem({
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Item> & {
   inset?: boolean;
   variant?: 'default' | 'destructive';
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.Item
       data-slot="dropdown-menu-item"
@@ -71,7 +76,7 @@ function DropdownMenuCheckboxItem({
   children,
   checked,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>): JSX.Element {
   return (
     <DropdownMenuPrimitive.CheckboxItem
       data-slot="dropdown-menu-checkbox-item"
@@ -94,7 +99,7 @@ function DropdownMenuCheckboxItem({
 
 function DropdownMenuRadioGroup({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>): JSX.Element {
   return <DropdownMenuPrimitive.RadioGroup data-slot="dropdown-menu-radio-group" {...props} />;
 }
 
@@ -102,7 +107,7 @@ function DropdownMenuRadioItem({
   className,
   children,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>): JSX.Element {
   return (
     <DropdownMenuPrimitive.RadioItem
       data-slot="dropdown-menu-radio-item"
@@ -128,7 +133,7 @@ function DropdownMenuLabel({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Label> & {
   inset?: boolean;
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.Label
       data-slot="dropdown-menu-label"
@@ -142,7 +147,7 @@ function DropdownMenuLabel({
 function DropdownMenuSeparator({
   className,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>): JSX.Element {
   return (
     <DropdownMenuPrimitive.Separator
       data-slot="dropdown-menu-separator"
@@ -152,7 +157,7 @@ function DropdownMenuSeparator({
   );
 }
 
-function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'span'>) {
+function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'span'>): JSX.Element {
   return (
     <span
       data-slot="dropdown-menu-shortcut"
@@ -162,7 +167,9 @@ function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'spa
   );
 }
 
-function DropdownMenuSub({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
+function DropdownMenuSub({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>): JSX.Element {
   return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />;
 }
 
@@ -173,7 +180,7 @@ function DropdownMenuSubTrigger({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.SubTrigger> & {
   inset?: boolean;
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.SubTrigger
       data-slot="dropdown-menu-sub-trigger"
@@ -193,7 +200,7 @@ function DropdownMenuSubTrigger({
 function DropdownMenuSubContent({
   className,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>): JSX.Element {
   return (
     <DropdownMenuPrimitive.SubContent
       data-slot="dropdown-menu-sub-content"
diff --git a/packages/client/src/components/FileUpload.tsx b/packages/client/src/components/FileUpload.tsx
index 3481a36e8ed..c0cec6b032c 100644
--- a/packages/client/src/components/FileUpload.tsx
+++ b/packages/client/src/components/FileUpload.tsx
@@ -7,22 +7,22 @@ type FileUploadProps = {
   handleFileChange: (event: React.ChangeEvent<HTMLInputElement>) => void;
 };
 
-const FileUpload = forwardRef<HTMLInputElement, FileUploadProps>(
-  ({ children, handleFileChange }, ref) => {
-    return (
-      <>
-        {children}
-        <input
-          ref={ref}
-          multiple
-          type="file"
-          style={{ display: 'none' }}
-          onChange={handleFileChange}
-        />
-      </>
-    );
-  },
-);
+const FileUpload: React.ForwardRefExoticComponent<
+  FileUploadProps & React.RefAttributes<HTMLInputElement>
+> = forwardRef<HTMLInputElement, FileUploadProps>(({ children, handleFileChange }, ref) => {
+  return (
+    <>
+      {children}
+      <input
+        ref={ref}
+        multiple
+        type="file"
+        style={{ display: 'none' }}
+        onChange={handleFileChange}
+      />
+    </>
+  );
+});
 
 FileUpload.displayName = 'FileUpload';
 
diff --git a/packages/client/src/components/FilterInput.tsx b/packages/client/src/components/FilterInput.tsx
index 04f5fe33a17..273894e68d8 100644
--- a/packages/client/src/components/FilterInput.tsx
+++ b/packages/client/src/components/FilterInput.tsx
@@ -23,7 +23,9 @@ export interface FilterInputProps
  *   onChange={(e) => setSearchQuery(e.target.value)}
  * />
  */
-const FilterInput = React.forwardRef<HTMLInputElement, FilterInputProps>(
+const FilterInput: React.ForwardRefExoticComponent<
+  FilterInputProps & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, FilterInputProps>(
   ({ className, label, inputId, containerClassName, ...props }, ref) => {
     return (
       <div className={cn('relative', containerClassName)}>
diff --git a/packages/client/src/components/FormInput.tsx b/packages/client/src/components/FormInput.tsx
index 2d6c55e348d..c1dc0f3982e 100644
--- a/packages/client/src/components/FormInput.tsx
+++ b/packages/client/src/components/FormInput.tsx
@@ -1,4 +1,5 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { ControllerRenderProps, FieldValues, FieldPath } from 'react-hook-form';
 import { Label } from './Label';
 import { Input } from './Input';
@@ -25,7 +26,7 @@ export default function FormInput<
   containerClass?: string;
   type?: 'string' | 'number';
   labelAdjacent?: React.ReactNode;
-}) {
+}): JSX.Element {
   const handleChange = (e: React.ChangeEvent<HTMLInputElement>) => {
     const value = e.target.value;
 
diff --git a/packages/client/src/components/HoverCard.tsx b/packages/client/src/components/HoverCard.tsx
index 5b64adbfa1e..ba389711cd4 100644
--- a/packages/client/src/components/HoverCard.tsx
+++ b/packages/client/src/components/HoverCard.tsx
@@ -2,13 +2,20 @@ import * as React from 'react';
 import * as HoverCardPrimitive from '@radix-ui/react-hover-card';
 import { cn } from '~/utils';
 
-const HoverCard = HoverCardPrimitive.Root;
+const HoverCard: React.FC<HoverCardPrimitive.HoverCardProps> = HoverCardPrimitive.Root;
 
-const HoverCardTrigger = HoverCardPrimitive.Trigger;
+const HoverCardTrigger: React.ForwardRefExoticComponent<
+  HoverCardPrimitive.HoverCardTriggerProps & React.RefAttributes<HTMLAnchorElement>
+> = HoverCardPrimitive.Trigger;
 
-const HoverCardPortal = HoverCardPrimitive.Portal;
+const HoverCardPortal: React.FC<HoverCardPrimitive.HoverCardPortalProps> =
+  HoverCardPrimitive.Portal;
 
-const HoverCardContent = React.forwardRef<
+const HoverCardContent: React.ForwardRefExoticComponent<
+  Omit<HoverCardPrimitive.HoverCardContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    disabled?: boolean;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof HoverCardPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof HoverCardPrimitive.Content> & { disabled?: boolean }
 >(({ className = '', align = 'center', sideOffset = 6, disabled = false, ...props }, ref) => {
diff --git a/packages/client/src/components/InfoHoverCard.tsx b/packages/client/src/components/InfoHoverCard.tsx
index 5b56beb5f2e..a87f52d323f 100644
--- a/packages/client/src/components/InfoHoverCard.tsx
+++ b/packages/client/src/components/InfoHoverCard.tsx
@@ -1,4 +1,5 @@
 import { useState } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { CircleHelpIcon } from 'lucide-react';
 import { HoverCard, HoverCardTrigger, HoverCardPortal, HoverCardContent } from './HoverCard';
 import { ESide } from '~/common';
@@ -8,7 +9,7 @@ type InfoHoverCardProps = {
   text: string;
 };
 
-const InfoHoverCard = ({ side, text }: InfoHoverCardProps) => {
+const InfoHoverCard = ({ side, text }: InfoHoverCardProps): JSX.Element => {
   const [isOpen, setIsOpen] = useState(false);
 
   return (
diff --git a/packages/client/src/components/Input.tsx b/packages/client/src/components/Input.tsx
index 7b4fa5c9466..6f502e08aaa 100644
--- a/packages/client/src/components/Input.tsx
+++ b/packages/client/src/components/Input.tsx
@@ -3,18 +3,19 @@ import { cn } from '~/utils';
 
 export type InputProps = React.InputHTMLAttributes<HTMLInputElement>;
 
-const Input = React.forwardRef<HTMLInputElement, InputProps>(({ className, ...props }, ref) => {
-  return (
-    <input
-      className={cn(
-        'flex h-10 w-full rounded-lg border border-border-light bg-transparent px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
-        className ?? '',
-      )}
-      ref={ref}
-      {...props}
-    />
-  );
-});
+const Input: React.ForwardRefExoticComponent<InputProps & React.RefAttributes<HTMLInputElement>> =
+  React.forwardRef<HTMLInputElement, InputProps>(({ className, ...props }, ref) => {
+    return (
+      <input
+        className={cn(
+          'flex h-10 w-full rounded-lg border border-border-light bg-transparent px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
+          className ?? '',
+        )}
+        ref={ref}
+        {...props}
+      />
+    );
+  });
 
 Input.displayName = 'Input';
 
diff --git a/packages/client/src/components/InputNumber.tsx b/packages/client/src/components/InputNumber.tsx
index 7f32a298ece..0102eb4d427 100644
--- a/packages/client/src/components/InputNumber.tsx
+++ b/packages/client/src/components/InputNumber.tsx
@@ -5,26 +5,28 @@ import * as React from 'react';
 import RCInputNumber from 'rc-input-number';
 import * as InputNumberPrimitive from 'rc-input-number';
 import { cn } from '~/utils';
+import { ValueType } from '@rc-component/mini-decimal';
 
 // TODO help needed
 // React.ElementRef<typeof LabelPrimitive.Root>,
 // React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root>
 
-const InputNumber = React.forwardRef<
-  React.ElementRef<typeof RCInputNumber>,
-  InputNumberPrimitive.InputNumberProps
->(({ className, ...props }, ref) => {
-  return (
-    <RCInputNumber
-      className={cn(
-        'flex max-h-5 w-full rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50',
-        className ?? '',
-      )}
-      ref={ref}
-      {...props}
-    />
-  );
-});
+const InputNumber: React.ForwardRefExoticComponent<
+  InputNumberPrimitive.InputNumberProps<ValueType> & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<React.ElementRef<typeof RCInputNumber>, InputNumberPrimitive.InputNumberProps>(
+  ({ className, ...props }, ref) => {
+    return (
+      <RCInputNumber
+        className={cn(
+          'flex max-h-5 w-full rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50',
+          className ?? '',
+        )}
+        ref={ref}
+        {...props}
+      />
+    );
+  },
+);
 InputNumber.displayName = 'Input';
 
 // console.log(_InputNumber);
diff --git a/packages/client/src/components/InputOTP.tsx b/packages/client/src/components/InputOTP.tsx
index 32b8ba08f49..59e6454ac32 100644
--- a/packages/client/src/components/InputOTP.tsx
+++ b/packages/client/src/components/InputOTP.tsx
@@ -1,9 +1,69 @@
 import * as React from 'react';
-import { OTPInput, OTPInputContext } from 'input-otp';
 import { Minus } from 'lucide-react';
+import { OTPInput, OTPInputContext, RenderProps } from 'input-otp';
 import { cn } from '~/utils';
 
-const InputOTP = React.forwardRef<
+const InputOTP: React.ForwardRefExoticComponent<
+  (
+    | Omit<
+        Omit<
+          React.InputHTMLAttributes<HTMLInputElement>,
+          | 'value'
+          | 'onChange'
+          | 'maxLength'
+          | 'containerClassName'
+          | 'textAlign'
+          | 'onComplete'
+          | 'pushPasswordManagerStrategy'
+          | 'pasteTransformer'
+          | 'noScriptCSSFallback'
+        > & {
+          value?: string;
+          onChange?: (newValue: string) => unknown;
+          maxLength: number;
+          textAlign?: 'left' | 'center' | 'right';
+          onComplete?: (...args: unknown[]) => unknown;
+          pushPasswordManagerStrategy?: 'increase-width' | 'none';
+          pasteTransformer?: (pasted: string) => string;
+          containerClassName?: string;
+          noScriptCSSFallback?: string | null;
+        } & {
+          render: (props: RenderProps) => React.ReactNode;
+          children?: never;
+        } & React.RefAttributes<HTMLInputElement>,
+        'ref'
+      >
+    | Omit<
+        Omit<
+          React.InputHTMLAttributes<HTMLInputElement>,
+          | 'value'
+          | 'onChange'
+          | 'maxLength'
+          | 'containerClassName'
+          | 'textAlign'
+          | 'onComplete'
+          | 'pushPasswordManagerStrategy'
+          | 'pasteTransformer'
+          | 'noScriptCSSFallback'
+        > & {
+          value?: string;
+          onChange?: (newValue: string) => unknown;
+          maxLength: number;
+          textAlign?: 'left' | 'center' | 'right';
+          onComplete?: (...args: unknown[]) => unknown;
+          pushPasswordManagerStrategy?: 'increase-width' | 'none';
+          pasteTransformer?: (pasted: string) => string;
+          containerClassName?: string;
+          noScriptCSSFallback?: string | null;
+        } & {
+          render?: never;
+          children: React.ReactNode;
+        } & React.RefAttributes<HTMLInputElement>,
+        'ref'
+      >
+  ) &
+    React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<
   React.ElementRef<typeof OTPInput>,
   React.ComponentPropsWithoutRef<typeof OTPInput>
 >(({ className, containerClassName, ...props }, ref) => (
@@ -19,15 +79,21 @@ const InputOTP = React.forwardRef<
 ));
 InputOTP.displayName = 'InputOTP';
 
-const InputOTPGroup = React.forwardRef<
-  React.ElementRef<'div'>,
-  React.ComponentPropsWithoutRef<'div'>
->(({ className, ...props }, ref) => (
-  <div ref={ref} className={cn('flex items-center', className)} {...props} />
-));
+const InputOTPGroup: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<'div'>, React.ComponentPropsWithoutRef<'div'>>(
+  ({ className, ...props }, ref) => (
+    <div ref={ref} className={cn('flex items-center', className)} {...props} />
+  ),
+);
 InputOTPGroup.displayName = 'InputOTPGroup';
 
-const InputOTPSlot = React.forwardRef<
+const InputOTPSlot: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> & {
+    index: number;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<'div'>,
   React.ComponentPropsWithoutRef<'div'> & { index: number }
 >(({ index, className, ...props }, ref) => {
@@ -60,14 +126,16 @@ const InputOTPSlot = React.forwardRef<
 });
 InputOTPSlot.displayName = 'InputOTPSlot';
 
-const InputOTPSeparator = React.forwardRef<
-  React.ElementRef<'div'>,
-  React.ComponentPropsWithoutRef<'div'>
->(({ ...props }, ref) => (
-  <div ref={ref} role="separator" {...props}>
-    <Minus />
-  </div>
-));
+const InputOTPSeparator: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<'div'>, React.ComponentPropsWithoutRef<'div'>>(
+  ({ ...props }, ref) => (
+    <div ref={ref} role="separator" {...props}>
+      <Minus />
+    </div>
+  ),
+);
 InputOTPSeparator.displayName = 'InputOTPSeparator';
 
 export { InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator };
diff --git a/packages/client/src/components/InputWithDropDown.tsx b/packages/client/src/components/InputWithDropDown.tsx
index da7829a11a4..0af4de87214 100644
--- a/packages/client/src/components/InputWithDropDown.tsx
+++ b/packages/client/src/components/InputWithDropDown.tsx
@@ -7,7 +7,12 @@ export type InputWithDropdownProps = React.InputHTMLAttributes<HTMLInputElement>
   onSelect?: (value: string) => void;
 };
 
-const InputWithDropdown = React.forwardRef<HTMLInputElement, InputWithDropdownProps>(
+const InputWithDropdown: React.ForwardRefExoticComponent<
+  React.InputHTMLAttributes<HTMLInputElement> & {
+    options: string[];
+    onSelect?: (value: string) => void;
+  } & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, InputWithDropdownProps>(
   ({ className, options, onSelect, ...props }, ref) => {
     const [isOpen, setIsOpen] = React.useState(false);
     const [inputValue, setInputValue] = React.useState((props.value as string) || '');
diff --git a/packages/client/src/components/Label.tsx b/packages/client/src/components/Label.tsx
index d250e47e3fb..ef15f3051ce 100644
--- a/packages/client/src/components/Label.tsx
+++ b/packages/client/src/components/Label.tsx
@@ -2,7 +2,11 @@ import * as React from 'react';
 import * as LabelPrimitive from '@radix-ui/react-label';
 import { cn } from '~/utils';
 
-const Label = React.forwardRef<
+const Label: React.ForwardRefExoticComponent<
+  Omit<LabelPrimitive.LabelProps & React.RefAttributes<HTMLLabelElement>, 'ref'> & {
+    className?: string;
+  } & React.RefAttributes<HTMLLabelElement>
+> = React.forwardRef<
   React.ElementRef<typeof LabelPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root> & {
     className?: string;
diff --git a/packages/client/src/components/MultiSearch.tsx b/packages/client/src/components/MultiSearch.tsx
index 56d1843e713..d0b9e8b26b7 100644
--- a/packages/client/src/components/MultiSearch.tsx
+++ b/packages/client/src/components/MultiSearch.tsx
@@ -1,5 +1,6 @@
-import { Search, X } from 'lucide-react';
 import React, { useState, useMemo, useCallback, useRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
+import { Search, X } from 'lucide-react';
 import { cn } from '~/utils';
 
 /** This is a generic that can be added to Menu and Select components */
@@ -13,7 +14,7 @@ export default function MultiSearch({
   onChange: (filter: string) => void;
   placeholder?: string;
   className?: string;
-}) {
+}): JSX.Element {
   const inputRef = useRef<HTMLInputElement>(null);
 
   const onChangeHandler: React.ChangeEventHandler<HTMLInputElement> = useCallback(
diff --git a/packages/client/src/components/MultiSelect.tsx b/packages/client/src/components/MultiSelect.tsx
index bb48841468a..5275cb572da 100644
--- a/packages/client/src/components/MultiSelect.tsx
+++ b/packages/client/src/components/MultiSelect.tsx
@@ -9,6 +9,7 @@ import {
   SelectProvider,
 } from '@ariakit/react';
 import './AnimatePopover.css';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 type MultiSelectItem<T extends string> = T | { label: string; value: T };
@@ -84,7 +85,7 @@ export default function MultiSelect<T extends string>({
   selectedValues = [],
   setSelectedValues,
   renderItemContent,
-}: MultiSelectProps<T>) {
+}: MultiSelectProps<T>): JSX.Element {
   const selectRef = useRef<HTMLButtonElement>(null);
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
 
diff --git a/packages/client/src/components/OGDialogTemplate.tsx b/packages/client/src/components/OGDialogTemplate.tsx
index 2414915a4b5..5fd9a581fe9 100644
--- a/packages/client/src/components/OGDialogTemplate.tsx
+++ b/packages/client/src/components/OGDialogTemplate.tsx
@@ -1,4 +1,11 @@
-import { forwardRef, isValidElement, ReactNode, Ref } from 'react';
+import {
+  forwardRef,
+  ForwardRefExoticComponent,
+  isValidElement,
+  ReactNode,
+  Ref,
+  RefAttributes,
+} from 'react';
 import {
   OGDialogTitle,
   OGDialogClose,
@@ -62,7 +69,9 @@ type DialogTemplateProps = {
   onClose?: () => void;
 };
 
-const OGDialogTemplate = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
+const OGDialogTemplate: ForwardRefExoticComponent<
+  DialogTemplateProps & RefAttributes<HTMLDivElement>
+> = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
   const localize = useLocalize();
   const {
     title,
diff --git a/packages/client/src/components/OriginalDialog.tsx b/packages/client/src/components/OriginalDialog.tsx
index e870cbc8c0c..70a19e3433a 100644
--- a/packages/client/src/components/OriginalDialog.tsx
+++ b/packages/client/src/components/OriginalDialog.tsx
@@ -1,6 +1,7 @@
 import * as React from 'react';
-import * as DialogPrimitive from '@radix-ui/react-dialog';
 import { X } from 'lucide-react';
+import { JSX } from 'react/jsx-runtime';
+import * as DialogPrimitive from '@radix-ui/react-dialog';
 import { cn } from '~/utils';
 
 const DialogDepthContext = React.createContext(0);
@@ -10,47 +11,55 @@ interface OGDialogProps extends DialogPrimitive.DialogProps {
   triggerRefs?: React.RefObject<HTMLButtonElement | HTMLInputElement | HTMLDivElement | null>[];
 }
 
-const Dialog = React.forwardRef<HTMLDivElement, OGDialogProps>(
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  ({ children, triggerRef, triggerRefs, onOpenChange, ...props }, ref) => {
-    const parentDepth = React.useContext(DialogDepthContext);
-    const currentDepth = parentDepth + 1;
-
-    const handleOpenChange = (open: boolean) => {
-      if (!open && triggerRef?.current) {
-        setTimeout(() => {
-          triggerRef.current?.focus();
-        }, 0);
-      }
-      if (triggerRefs?.length) {
-        triggerRefs.forEach((ref) => {
-          if (ref?.current) {
-            setTimeout(() => {
-              ref.current?.focus();
-            }, 0);
-          }
-        });
-      }
-      onOpenChange?.(open);
-    };
-
-    return (
-      <DialogDepthContext.Provider value={currentDepth}>
-        <DialogPrimitive.Root {...props} onOpenChange={handleOpenChange}>
-          {children}
-        </DialogPrimitive.Root>
-      </DialogDepthContext.Provider>
-    );
-  },
-);
+const Dialog: React.ForwardRefExoticComponent<OGDialogProps & React.RefAttributes<HTMLDivElement>> =
+  React.forwardRef<HTMLDivElement, OGDialogProps>(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    ({ children, triggerRef, triggerRefs, onOpenChange, ...props }, ref) => {
+      const parentDepth = React.useContext(DialogDepthContext);
+      const currentDepth = parentDepth + 1;
+
+      const handleOpenChange = (open: boolean) => {
+        if (!open && triggerRef?.current) {
+          setTimeout(() => {
+            triggerRef.current?.focus();
+          }, 0);
+        }
+        if (triggerRefs?.length) {
+          triggerRefs.forEach((ref) => {
+            if (ref?.current) {
+              setTimeout(() => {
+                ref.current?.focus();
+              }, 0);
+            }
+          });
+        }
+        onOpenChange?.(open);
+      };
+
+      return (
+        <DialogDepthContext.Provider value={currentDepth}>
+          <DialogPrimitive.Root {...props} onOpenChange={handleOpenChange}>
+            {children}
+          </DialogPrimitive.Root>
+        </DialogDepthContext.Provider>
+      );
+    },
+  );
 
-const DialogTrigger = DialogPrimitive.Trigger;
+const DialogTrigger: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Trigger;
 
-const DialogPortal = DialogPrimitive.Portal;
+const DialogPortal: React.FC<DialogPrimitive.DialogPortalProps> = DialogPrimitive.Portal;
 
-const DialogClose = DialogPrimitive.Close;
+const DialogClose: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogCloseProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Close;
 
-export const DialogOverlay = React.forwardRef<
+export const DialogOverlay: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogOverlayProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Overlay>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay>
 >(({ className, style, ...props }, ref) => {
@@ -77,10 +86,13 @@ type DialogContentProps = React.ComponentPropsWithoutRef<typeof DialogPrimitive.
   overlayClassName?: string;
 };
 
-const DialogContent = React.forwardRef<
-  React.ElementRef<typeof DialogPrimitive.Content>,
-  DialogContentProps
->(
+const DialogContent: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    showCloseButton?: boolean;
+    disableScroll?: boolean;
+    overlayClassName?: string;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<typeof DialogPrimitive.Content>, DialogContentProps>(
   (
     {
       className,
@@ -161,12 +173,18 @@ const DialogContent = React.forwardRef<
 );
 DialogContent.displayName = DialogPrimitive.Content.displayName;
 
-const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div className={cn('flex flex-col space-y-1.5 text-center sm:text-left', className)} {...props} />
 );
 DialogHeader.displayName = 'DialogHeader';
 
-const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2', className)}
     {...props}
@@ -174,7 +192,10 @@ const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogFooter.displayName = 'DialogFooter';
 
-const DialogTitle = React.forwardRef<
+const DialogTitle: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogTitleProps & React.RefAttributes<HTMLHeadingElement>, 'ref'> &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
 >(({ className, ...props }, ref) => (
@@ -186,7 +207,10 @@ const DialogTitle = React.forwardRef<
 ));
 DialogTitle.displayName = DialogPrimitive.Title.displayName;
 
-const DialogDescription = React.forwardRef<
+const DialogDescription: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>, 'ref'> &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
 >(({ className, ...props }, ref) => (
diff --git a/packages/client/src/components/Pagination.tsx b/packages/client/src/components/Pagination.tsx
index 815befacccd..259cc5bbec1 100644
--- a/packages/client/src/components/Pagination.tsx
+++ b/packages/client/src/components/Pagination.tsx
@@ -1,9 +1,13 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { ChevronLeft, ChevronRight, MoreHorizontal } from 'lucide-react';
 import { ButtonProps, buttonVariants } from './Button';
 import { cn } from '~/utils';
 
-const Pagination = ({ className, ...props }: React.ComponentProps<'nav'>) => (
+const Pagination: {
+  ({ className, ...props }: React.ComponentProps<'nav'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'nav'>): JSX.Element => (
   <nav
     role="navigation"
     aria-label="pagination"
@@ -13,16 +17,22 @@ const Pagination = ({ className, ...props }: React.ComponentProps<'nav'>) => (
 );
 Pagination.displayName = 'Pagination';
 
-const PaginationContent = React.forwardRef<HTMLUListElement, React.ComponentProps<'ul'>>(
+const PaginationContent: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLUListElement>, HTMLUListElement>, 'ref'> &
+    React.RefAttributes<HTMLUListElement>
+> = React.forwardRef<HTMLUListElement, React.ComponentProps<'ul'>>(
   ({ className, ...props }, ref) => (
     <ul ref={ref} className={cn('flex flex-row items-center gap-1', className)} {...props} />
   ),
 );
 PaginationContent.displayName = 'PaginationContent';
 
-const PaginationItem = React.forwardRef<HTMLLIElement, React.ComponentProps<'li'>>(
-  ({ className, ...props }, ref) => <li ref={ref} className={cn('', className)} {...props} />,
-);
+const PaginationItem: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.LiHTMLAttributes<HTMLLIElement>, HTMLLIElement>, 'ref'> &
+    React.RefAttributes<HTMLLIElement>
+> = React.forwardRef<HTMLLIElement, React.ComponentProps<'li'>>(({ className, ...props }, ref) => (
+  <li ref={ref} className={cn('', className)} {...props} />
+));
 PaginationItem.displayName = 'PaginationItem';
 
 type PaginationLinkProps = {
@@ -30,13 +40,16 @@ type PaginationLinkProps = {
 } & Pick<ButtonProps, 'size'> &
   React.ComponentProps<'a'>;
 
-const PaginationLink = ({
+const PaginationLink: {
+  ({ className, isActive, size, children, ...props }: PaginationLinkProps): JSX.Element;
+  displayName: string;
+} = ({
   className,
   isActive = false,
   size = 'icon',
   children,
   ...props
-}: PaginationLinkProps) => (
+}: PaginationLinkProps): JSX.Element => (
   <a
     aria-current={isActive ? 'page' : undefined}
     className={cn(
@@ -53,10 +66,10 @@ const PaginationLink = ({
 );
 PaginationLink.displayName = 'PaginationLink';
 
-const PaginationPrevious = ({
-  className,
-  ...props
-}: React.ComponentProps<typeof PaginationLink>) => (
+const PaginationPrevious: {
+  ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element => (
   <PaginationLink
     aria-label="Go to previous page"
     size="default"
@@ -69,7 +82,10 @@ const PaginationPrevious = ({
 );
 PaginationPrevious.displayName = 'PaginationPrevious';
 
-const PaginationNext = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>) => (
+const PaginationNext: {
+  ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element => (
   <PaginationLink
     aria-label="Go to next page"
     size="default"
@@ -82,7 +98,10 @@ const PaginationNext = ({ className, ...props }: React.ComponentProps<typeof Pag
 );
 PaginationNext.displayName = 'PaginationNext';
 
-const PaginationEllipsis = ({ className, ...props }: React.ComponentProps<'span'>) => (
+const PaginationEllipsis: {
+  ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element => (
   <span
     aria-hidden
     className={cn('flex h-9 w-9 items-center justify-center', className)}
diff --git a/packages/client/src/components/PixelCard.tsx b/packages/client/src/components/PixelCard.tsx
index c1f3d8971aa..904e2fc05b5 100644
--- a/packages/client/src/components/PixelCard.tsx
+++ b/packages/client/src/components/PixelCard.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useCallback } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 class Pixel {
@@ -169,7 +170,7 @@ export default function PixelCard({
   randomness = 0.3,
   width,
   height,
-}: PixelCardProps) {
+}: PixelCardProps): JSX.Element {
   const containerRef = useRef<HTMLDivElement>(null);
   const canvasRef = useRef<HTMLCanvasElement>(null);
   const pixelsRef = useRef<Pixel[]>([]);
diff --git a/packages/client/src/components/Progress.tsx b/packages/client/src/components/Progress.tsx
index e8e0b0f6b2d..64c45d45e13 100644
--- a/packages/client/src/components/Progress.tsx
+++ b/packages/client/src/components/Progress.tsx
@@ -2,7 +2,10 @@ import * as React from 'react';
 import * as ProgressPrimitive from '@radix-ui/react-progress';
 import { cn } from '~/utils';
 
-const Progress = React.forwardRef<
+const Progress: React.ForwardRefExoticComponent<
+  Omit<ProgressPrimitive.ProgressProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof ProgressPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof ProgressPrimitive.Root>
 >(({ className, value, ...props }, ref) => (
diff --git a/packages/client/src/components/QuestionMark.tsx b/packages/client/src/components/QuestionMark.tsx
index f018226f19d..b01bb0d7914 100644
--- a/packages/client/src/components/QuestionMark.tsx
+++ b/packages/client/src/components/QuestionMark.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export const QuestionMark = ({ className = '' }) => {
+export const QuestionMark = ({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element => {
   return (
     <span>
       <div
diff --git a/packages/client/src/components/Radio.tsx b/packages/client/src/components/Radio.tsx
index 6f1a4736170..0115c6b9d5a 100644
--- a/packages/client/src/components/Radio.tsx
+++ b/packages/client/src/components/Radio.tsx
@@ -18,7 +18,7 @@ interface RadioProps {
   'aria-labelledby'?: string;
 }
 
-const Radio = memo(function Radio({
+const Radio: React.NamedExoticComponent<RadioProps> = memo(function Radio({
   options,
   value,
   onChange,
diff --git a/packages/client/src/components/Resizable.tsx b/packages/client/src/components/Resizable.tsx
index 817f860313d..cc6eea00bb0 100644
--- a/packages/client/src/components/Resizable.tsx
+++ b/packages/client/src/components/Resizable.tsx
@@ -1,13 +1,17 @@
+import { JSX } from 'react/jsx-runtime';
 import { GripVertical } from 'lucide-react';
 import { Group, Panel, Separator } from 'react-resizable-panels';
 import type { ComponentProps } from 'react';
 import { cn } from '~/utils';
 
-const ResizablePanelGroup = ({ className = '', ...props }: ComponentProps<typeof Group>) => (
+const ResizablePanelGroup = ({
+  className = '',
+  ...props
+}: ComponentProps<typeof Group>): JSX.Element => (
   <Group className={cn('h-full w-full', className)} {...props} />
 );
 
-const ResizablePanel = Panel;
+const ResizablePanel: typeof Panel = Panel;
 
 const ResizableHandle = ({
   withHandle,
@@ -15,7 +19,7 @@ const ResizableHandle = ({
   ...props
 }: ComponentProps<typeof Separator> & {
   withHandle?: boolean;
-}) => (
+}): JSX.Element => (
   <Separator
     className={cn(
       'relative flex w-px items-center justify-center bg-border after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-offset-1',
@@ -37,7 +41,7 @@ const ResizableHandleAlt = ({
   ...props
 }: ComponentProps<typeof Separator> & {
   withHandle?: boolean;
-}) => (
+}): JSX.Element => (
   <Separator
     className={cn(
       'group relative flex w-px items-center justify-center bg-border after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-offset-1',
diff --git a/packages/client/src/components/SecretInput.tsx b/packages/client/src/components/SecretInput.tsx
index f28f7b3ebd1..ba0dda7aaf0 100644
--- a/packages/client/src/components/SecretInput.tsx
+++ b/packages/client/src/components/SecretInput.tsx
@@ -5,17 +5,43 @@ import { cn } from '~/utils';
 
 export interface SecretInputProps
   extends Omit<React.InputHTMLAttributes<HTMLInputElement>, 'type'> {
-  /** Show copy button */
+  /** Show the built-in copy button */
   showCopy?: boolean;
+  /** Custom copy control rendered inside the input, in place of the built-in one */
+  copyButton?: React.ReactNode;
   /** Callback when value is copied */
   onCopy?: () => void;
   /** Duration in ms to show checkmark after copy (default: 2000) */
   copyFeedbackDuration?: number;
+  label?: React.ReactNode;
+  labelClassName?: string;
+  containerClassName?: string;
+  controlsClassName?: string;
+  buttonClassName?: string;
+  controlsOnHover?: boolean;
 }
 
-const SecretInput = React.forwardRef<HTMLInputElement, SecretInputProps>(
+const SecretInput: React.ForwardRefExoticComponent<
+  SecretInputProps & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, SecretInputProps>(
   (
-    { className, showCopy = false, onCopy, copyFeedbackDuration = 2000, disabled, value, ...props },
+    {
+      id,
+      label,
+      className,
+      showCopy = false,
+      copyButton,
+      labelClassName,
+      containerClassName,
+      controlsClassName,
+      buttonClassName,
+      controlsOnHover = false,
+      onCopy,
+      copyFeedbackDuration = 2000,
+      disabled,
+      value,
+      ...props
+    },
     ref,
   ) => {
     const [isVisible, setIsVisible] = useState(false);
@@ -49,13 +75,14 @@ const SecretInput = React.forwardRef<HTMLInputElement, SecretInputProps>(
     }, [value, isCopied, disabled, onCopy, copyFeedbackDuration]);
 
     return (
-      <div className="relative flex items-center">
+      <div className={cn('group/secret-input relative', containerClassName)}>
         <input
+          id={id}
           type={isVisible ? 'text' : 'password'}
           className={cn(
-            'flex h-10 w-full rounded-lg border border-input bg-transparent px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
-            showCopy ? 'pr-20' : 'pr-10',
+            'flex h-10 w-full rounded-lg border border-border-light bg-transparent py-2 pl-3 text-sm transition-colors placeholder:text-muted-foreground hover:border-border-medium focus-visible:border-border-heavy focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
             className ?? '',
+            copyButton != null || showCopy ? 'pr-20' : 'pr-11',
           )}
           ref={ref}
           disabled={disabled}
@@ -64,17 +91,31 @@ const SecretInput = React.forwardRef<HTMLInputElement, SecretInputProps>(
           spellCheck={false}
           {...props}
         />
-        <div className="absolute right-1 flex items-center gap-0.5">
-          {showCopy && (
+        {label != null && (
+          <label htmlFor={id} className={cn(labelClassName ?? '')}>
+            {label}
+          </label>
+        )}
+        <div
+          className={cn(
+            'pointer-events-none absolute inset-y-0 right-1.5 flex items-center gap-0.5 [&_button]:pointer-events-auto',
+            controlsOnHover &&
+              'opacity-0 transition-opacity duration-150 group-focus-within/secret-input:opacity-100 group-hover/secret-input:opacity-100',
+            controlsClassName,
+          )}
+        >
+          {copyButton}
+          {showCopy && copyButton == null && (
             <button
               type="button"
               onClick={handleCopy}
               disabled={disabled || !value}
               className={cn(
-                'flex size-8 items-center justify-center rounded-md text-text-secondary transition-colors',
+                'inline-flex size-7 shrink-0 items-center justify-center rounded-md text-text-secondary transition-colors duration-150 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary [&>svg]:block',
                 disabled || !value
                   ? 'cursor-not-allowed opacity-50'
                   : 'hover:bg-surface-hover hover:text-text-primary',
+                buttonClassName,
               )}
               aria-label={isCopied ? 'Copied' : 'Copy to clipboard'}
             >
@@ -86,12 +127,13 @@ const SecretInput = React.forwardRef<HTMLInputElement, SecretInputProps>(
             onClick={toggleVisibility}
             disabled={disabled}
             className={cn(
-              'flex size-8 items-center justify-center rounded-md text-text-secondary transition-colors',
+              'inline-flex size-7 shrink-0 items-center justify-center rounded-md text-text-secondary transition-colors duration-150 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary [&>svg]:block',
               disabled
                 ? 'cursor-not-allowed opacity-50'
                 : 'hover:bg-surface-hover hover:text-text-primary',
+              buttonClassName,
             )}
-            aria-label={isVisible ? 'Hide password' : 'Show password'}
+            aria-label={isVisible ? 'Hide secret' : 'Show secret'}
           >
             {isVisible ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
           </button>
diff --git a/packages/client/src/components/Select.tsx b/packages/client/src/components/Select.tsx
index 51671c0782c..1cdc604e44f 100644
--- a/packages/client/src/components/Select.tsx
+++ b/packages/client/src/components/Select.tsx
@@ -4,15 +4,22 @@ import { CaretSortIcon, CheckIcon, ChevronDownIcon, ChevronUpIcon } from '@radix
 import { cn } from '~/utils';
 
 // @ts-ignore - Radix UI type conflicts with React types
-const Select = SelectPrimitive.Root;
+const Select: React.FC<SelectPrimitive.SelectProps> = SelectPrimitive.Root;
 
 // @ts-ignore - Radix UI type conflicts with React types
-const SelectGroup = SelectPrimitive.Group;
+const SelectGroup: React.ForwardRefExoticComponent<
+  SelectPrimitive.SelectGroupProps & React.RefAttributes<HTMLDivElement>
+> = SelectPrimitive.Group;
 
-const SelectValue = SelectPrimitive.Value;
+const SelectValue: React.ForwardRefExoticComponent<
+  SelectPrimitive.SelectValueProps & React.RefAttributes<HTMLSpanElement>
+> = SelectPrimitive.Value;
 
 // @ts-ignore - Radix UI type conflicts with React types
-const SelectTrigger = React.forwardRef<
+const SelectTrigger: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Trigger>
 >(({ className = '', children, ...props }, ref) => (
@@ -33,7 +40,10 @@ const SelectTrigger = React.forwardRef<
 ));
 SelectTrigger.displayName = SelectPrimitive.Trigger.displayName;
 
-const SelectScrollUpButton = React.forwardRef<
+const SelectScrollUpButton: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectScrollUpButtonProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.ScrollUpButton>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollUpButton>
 >(({ className = '', ...props }, ref) => (
@@ -50,7 +60,10 @@ const SelectScrollUpButton = React.forwardRef<
 ));
 SelectScrollUpButton.displayName = SelectPrimitive.ScrollUpButton.displayName;
 
-const SelectScrollDownButton = React.forwardRef<
+const SelectScrollDownButton: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectScrollDownButtonProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.ScrollDownButton>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollDownButton>
 >(({ className = '', ...props }, ref) => (
@@ -67,7 +80,10 @@ const SelectScrollDownButton = React.forwardRef<
 ));
 SelectScrollDownButton.displayName = SelectPrimitive.ScrollDownButton.displayName;
 
-const SelectContent = React.forwardRef<
+const SelectContent: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Content>
 >(({ className = '', children, position = 'popper', ...props }, ref) => (
@@ -101,7 +117,10 @@ const SelectContent = React.forwardRef<
 ));
 SelectContent.displayName = SelectPrimitive.Content.displayName;
 
-const SelectLabel = React.forwardRef<
+const SelectLabel: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectLabelProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Label>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Label>
 >(({ className = '', ...props }, ref) => (
@@ -113,7 +132,10 @@ const SelectLabel = React.forwardRef<
 ));
 SelectLabel.displayName = SelectPrimitive.Label.displayName;
 
-const SelectItem = React.forwardRef<
+const SelectItem: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectItemProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Item>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Item>
 >(({ className = '', children, ...props }, ref) => (
@@ -136,7 +158,10 @@ const SelectItem = React.forwardRef<
 ));
 SelectItem.displayName = SelectPrimitive.Item.displayName;
 
-const SelectSeparator = React.forwardRef<
+const SelectSeparator: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectSeparatorProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Separator>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Separator>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/SelectDropDown.tsx b/packages/client/src/components/SelectDropDown.tsx
index e9a6027bc17..c73d8856f13 100644
--- a/packages/client/src/components/SelectDropDown.tsx
+++ b/packages/client/src/components/SelectDropDown.tsx
@@ -1,4 +1,5 @@
 import React, { useRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import {
   Label,
   Listbox,
@@ -73,7 +74,7 @@ function SelectDropDown({
   searchClassName,
   searchPlaceholder,
   showOptionIcon = false,
-}: SelectDropDownProps) {
+}: SelectDropDownProps): JSX.Element {
   const transitionProps = { className: 'top-full mt-3' };
   if (showAbove) {
     transitionProps.className = 'bottom-full mb-3';
diff --git a/packages/client/src/components/Separator.tsx b/packages/client/src/components/Separator.tsx
index 7ba6d380960..e6281145745 100644
--- a/packages/client/src/components/Separator.tsx
+++ b/packages/client/src/components/Separator.tsx
@@ -3,7 +3,11 @@ import * as SeparatorPrimitive from '@radix-ui/react-separator';
 
 import { cn } from '~/utils';
 
-const Separator = React.forwardRef<
+const Separator: React.ForwardRefExoticComponent<
+  Omit<SeparatorPrimitive.SeparatorProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    className?: string;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SeparatorPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root> & {
     className?: string;
diff --git a/packages/client/src/components/Skeleton.tsx b/packages/client/src/components/Skeleton.tsx
index a903db77a02..90da649ae59 100644
--- a/packages/client/src/components/Skeleton.tsx
+++ b/packages/client/src/components/Skeleton.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-function Skeleton({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+function Skeleton({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element {
   return (
     <div
       className={cn(
diff --git a/packages/client/src/components/Slider.tsx b/packages/client/src/components/Slider.tsx
index 3845b8901fa..4cf13a5f26d 100644
--- a/packages/client/src/components/Slider.tsx
+++ b/packages/client/src/components/Slider.tsx
@@ -12,46 +12,47 @@ type SliderProps = React.ComponentPropsWithoutRef<typeof SliderPrimitive.Root> &
     | { 'aria-label': string; 'aria-labelledby': string }
   );
 
-const Slider = React.forwardRef<React.ElementRef<typeof SliderPrimitive.Root>, SliderProps>(
-  (
-    {
-      className,
-      onDoubleClick,
-      'aria-labelledby': ariaLabelledBy,
-      'aria-label': ariaLabel,
-      'aria-describedby': ariaDescribedBy,
-      ...props
-    },
-    ref,
-  ) => (
-    <SliderPrimitive.Root
-      ref={ref}
-      {...props}
-      {...{
-        className: cn(
-          'relative flex w-full cursor-pointer touch-none select-none items-center',
-          className,
-        ),
+const Slider: React.ForwardRefExoticComponent<SliderProps & React.RefAttributes<HTMLSpanElement>> =
+  React.forwardRef<React.ElementRef<typeof SliderPrimitive.Root>, SliderProps>(
+    (
+      {
+        className,
         onDoubleClick,
-      }}
-    >
-      <SliderPrimitive.Track
-        {...{ className: 'relative h-2 w-full grow overflow-hidden rounded-full bg-secondary' }}
-      >
-        <SliderPrimitive.Range {...{ className: 'absolute h-full bg-primary' }} />
-      </SliderPrimitive.Track>
-      <SliderPrimitive.Thumb
+        'aria-labelledby': ariaLabelledBy,
+        'aria-label': ariaLabel,
+        'aria-describedby': ariaDescribedBy,
+        ...props
+      },
+      ref,
+    ) => (
+      <SliderPrimitive.Root
+        ref={ref}
+        {...props}
         {...{
-          className:
-            'block h-5 w-5 rounded-full border-2 border-primary bg-background ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
-          'aria-labelledby': ariaLabelledBy,
-          'aria-label': ariaLabel,
-          'aria-describedby': ariaDescribedBy,
+          className: cn(
+            'relative flex w-full cursor-pointer touch-none select-none items-center',
+            className,
+          ),
+          onDoubleClick,
         }}
-      />
-    </SliderPrimitive.Root>
-  ),
-);
+      >
+        <SliderPrimitive.Track
+          {...{ className: 'relative h-2 w-full grow overflow-hidden rounded-full bg-secondary' }}
+        >
+          <SliderPrimitive.Range {...{ className: 'absolute h-full bg-primary' }} />
+        </SliderPrimitive.Track>
+        <SliderPrimitive.Thumb
+          {...{
+            className:
+              'block h-5 w-5 rounded-full border-2 border-primary bg-background ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
+            'aria-labelledby': ariaLabelledBy,
+            'aria-label': ariaLabel,
+            'aria-describedby': ariaDescribedBy,
+          }}
+        />
+      </SliderPrimitive.Root>
+    ),
+  );
 Slider.displayName = SliderPrimitive.Root.displayName;
 
 export { Slider };
diff --git a/packages/client/src/components/Switch.tsx b/packages/client/src/components/Switch.tsx
index 42c8c561e70..66d1e1508ce 100644
--- a/packages/client/src/components/Switch.tsx
+++ b/packages/client/src/components/Switch.tsx
@@ -17,7 +17,9 @@ type SwitchProps =
       'aria-label'?: never;
     });
 
-const Switch = React.forwardRef<React.ElementRef<typeof SwitchPrimitives.Root>, SwitchProps>(
+const Switch: React.ForwardRefExoticComponent<
+  SwitchProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<React.ElementRef<typeof SwitchPrimitives.Root>, SwitchProps>(
   ({ className, ...props }, ref) => (
     <SwitchPrimitives.Root
       className={cn(
diff --git a/packages/client/src/components/Table.tsx b/packages/client/src/components/Table.tsx
index a14ac3a8ac8..662ac5bae9e 100644
--- a/packages/client/src/components/Table.tsx
+++ b/packages/client/src/components/Table.tsx
@@ -5,50 +5,56 @@ interface TableProps extends React.HTMLAttributes<HTMLTableElement> {
   unwrapped?: boolean;
 }
 
-const Table = React.forwardRef<HTMLTableElement, TableProps>(
-  ({ className, unwrapped = false, ...props }, ref) => {
-    const tableElement = (
-      <table ref={ref} className={cn('w-full caption-bottom text-sm', className)} {...props} />
-    );
+const Table: React.ForwardRefExoticComponent<TableProps & React.RefAttributes<HTMLTableElement>> =
+  React.forwardRef<HTMLTableElement, TableProps>(
+    ({ className, unwrapped = false, ...props }, ref) => {
+      const tableElement = (
+        <table ref={ref} className={cn('w-full caption-bottom text-sm', className)} {...props} />
+      );
 
-    if (unwrapped) {
-      return tableElement;
-    }
+      if (unwrapped) {
+        return tableElement;
+      }
 
-    return <div className="relative w-full overflow-auto">{tableElement}</div>;
-  },
-);
+      return <div className="relative w-full overflow-auto">{tableElement}</div>;
+    },
+  );
 Table.displayName = 'Table';
 
-const TableHeader = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <thead ref={ref} className={cn('[&_tr]:border-b', className)} {...props} />
-));
+const TableHeader: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <thead ref={ref} className={cn('[&_tr]:border-b', className)} {...props} />
+  ),
+);
 TableHeader.displayName = 'TableHeader';
 
-const TableBody = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <tbody ref={ref} className={cn('[&_tr:last-child]:border-0', className)} {...props} />
-));
+const TableBody: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tbody ref={ref} className={cn('[&_tr:last-child]:border-0', className)} {...props} />
+  ),
+);
 TableBody.displayName = 'TableBody';
 
-const TableFooter = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <tfoot
-    ref={ref}
-    className={cn('border-t bg-muted/50 font-medium [&>tr]:last:border-b-0', className)}
-    {...props}
-  />
-));
+const TableFooter: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tfoot
+      ref={ref}
+      className={cn('border-t bg-muted/50 font-medium [&>tr]:last:border-b-0', className)}
+      {...props}
+    />
+  ),
+);
 TableFooter.displayName = 'TableFooter';
 
-const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
+const TableRow: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableRowElement> & React.RefAttributes<HTMLTableRowElement>
+> = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
   ({ className, ...props }, ref) => (
     <tr
       ref={ref}
@@ -62,55 +68,59 @@ const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTML
 );
 TableRow.displayName = 'TableRow';
 
-const TableHead = React.forwardRef<
-  HTMLTableCellElement,
-  React.ThHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <th
-    ref={ref}
-    className={cn(
-      'h-12 px-4 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0',
-      className,
-    )}
-    {...props}
-  />
-));
+const TableHead: React.ForwardRefExoticComponent<
+  React.ThHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      className={cn(
+        'h-12 px-4 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0',
+        className,
+      )}
+      {...props}
+    />
+  ),
+);
 TableHead.displayName = 'TableHead';
 
-const TableCell = React.forwardRef<
-  HTMLTableCellElement,
-  React.TdHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <td
-    ref={ref}
-    className={cn('p-4 align-middle [&:has([role=checkbox])]:pr-0', className)}
-    {...props}
-  />
-));
+const TableCell: React.ForwardRefExoticComponent<
+  React.TdHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.TdHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <td
+      ref={ref}
+      className={cn('p-4 align-middle [&:has([role=checkbox])]:pr-0', className)}
+      {...props}
+    />
+  ),
+);
 TableCell.displayName = 'TableCell';
 
-const TableRowHeader = React.forwardRef<
-  HTMLTableCellElement,
-  React.ThHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <th
-    ref={ref}
-    scope="row"
-    className={cn(
-      'p-4 text-left align-middle font-medium [&:has([role=checkbox])]:pr-0',
-      className,
-    )}
-    {...props}
-  />
-));
+const TableRowHeader: React.ForwardRefExoticComponent<
+  React.ThHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      scope="row"
+      className={cn(
+        'p-4 text-left align-middle font-medium [&:has([role=checkbox])]:pr-0',
+        className,
+      )}
+      {...props}
+    />
+  ),
+);
 TableRowHeader.displayName = 'TableRowHeader';
 
-const TableCaption = React.forwardRef<
-  HTMLTableCaptionElement,
-  React.HTMLAttributes<HTMLTableCaptionElement>
->(({ className, ...props }, ref) => (
-  <caption ref={ref} className={cn('mt-4 text-sm text-muted-foreground', className)} {...props} />
-));
+const TableCaption: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableCaptionElement> & React.RefAttributes<HTMLTableCaptionElement>
+> = React.forwardRef<HTMLTableCaptionElement, React.HTMLAttributes<HTMLTableCaptionElement>>(
+  ({ className, ...props }, ref) => (
+    <caption ref={ref} className={cn('mt-4 text-sm text-muted-foreground', className)} {...props} />
+  ),
+);
 TableCaption.displayName = 'TableCaption';
 
 export {
diff --git a/packages/client/src/components/Tabs.tsx b/packages/client/src/components/Tabs.tsx
index b4bc2a901c4..81658ab0726 100644
--- a/packages/client/src/components/Tabs.tsx
+++ b/packages/client/src/components/Tabs.tsx
@@ -2,9 +2,14 @@ import * as React from 'react';
 import * as TabsPrimitive from '@radix-ui/react-tabs';
 import { cn } from '~/utils';
 
-const Tabs = TabsPrimitive.Root;
+const Tabs: React.ForwardRefExoticComponent<
+  TabsPrimitive.TabsProps & React.RefAttributes<HTMLDivElement>
+> = TabsPrimitive.Root;
 
-const TabsList = React.forwardRef<
+const TabsList: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsListProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.List>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.List>
 >(({ className = '', ...props }, ref) => (
@@ -19,7 +24,10 @@ const TabsList = React.forwardRef<
 ));
 TabsList.displayName = TabsPrimitive.List.displayName;
 
-const TabsTrigger = React.forwardRef<
+const TabsTrigger: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.Trigger>
 >(({ className = '', ...props }, ref) => (
@@ -34,7 +42,10 @@ const TabsTrigger = React.forwardRef<
 ));
 TabsTrigger.displayName = TabsPrimitive.Trigger.displayName;
 
-const TabsContent = React.forwardRef<
+const TabsContent: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.Content>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/Tag.tsx b/packages/client/src/components/Tag.tsx
index 1ae58b5cc19..012eb25a3ae 100644
--- a/packages/client/src/components/Tag.tsx
+++ b/packages/client/src/components/Tag.tsx
@@ -47,4 +47,14 @@ const TagPrimitiveRoot = React.forwardRef<HTMLDivElement, TagProps>(
 
 TagPrimitiveRoot.displayName = 'Tag';
 
-export const Tag = React.memo(TagPrimitiveRoot);
+export const Tag: React.MemoExoticComponent<
+  React.ForwardRefExoticComponent<
+    Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> & {
+      label: string;
+      labelClassName?: string;
+      CancelButton?: React.ReactNode;
+      LabelNode?: React.ReactNode;
+      onRemove?: (e: React.MouseEvent<HTMLButtonElement>) => void;
+    } & React.RefAttributes<HTMLDivElement>
+  >
+> = React.memo(TagPrimitiveRoot);
diff --git a/packages/client/src/components/Textarea.tsx b/packages/client/src/components/Textarea.tsx
index f9167e91c15..0ad61c8786e 100644
--- a/packages/client/src/components/Textarea.tsx
+++ b/packages/client/src/components/Textarea.tsx
@@ -5,20 +5,20 @@ import { cn } from '~/utils';
 
 export interface TextareaProps extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {}
 
-const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
-  ({ className = '', ...props }, ref) => {
-    return (
-      <textarea
-        className={cn(
-          'flex h-20 w-full resize-none rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none focus:ring-2 focus:ring-gray-400 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50 dark:focus:ring-gray-400 dark:focus:ring-offset-gray-900',
-          className,
-        )}
-        ref={ref}
-        {...props}
-      />
-    );
-  },
-);
+const Textarea: React.ForwardRefExoticComponent<
+  TextareaProps & React.RefAttributes<HTMLTextAreaElement>
+> = React.forwardRef<HTMLTextAreaElement, TextareaProps>(({ className = '', ...props }, ref) => {
+  return (
+    <textarea
+      className={cn(
+        'flex h-20 w-full resize-none rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none focus:ring-2 focus:ring-gray-400 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50 dark:focus:ring-gray-400 dark:focus:ring-offset-gray-900',
+        className,
+      )}
+      ref={ref}
+      {...props}
+    />
+  );
+});
 Textarea.displayName = 'Textarea';
 
 export { Textarea };
diff --git a/packages/client/src/components/TextareaAutosize.tsx b/packages/client/src/components/TextareaAutosize.tsx
index d85ccbbf61e..3d5c3622ffe 100644
--- a/packages/client/src/components/TextareaAutosize.tsx
+++ b/packages/client/src/components/TextareaAutosize.tsx
@@ -1,5 +1,11 @@
+import {
+  forwardRef,
+  RefAttributes,
+  ForwardRefExoticComponent,
+  useLayoutEffect,
+  useState,
+} from 'react';
 import { useAtomValue } from 'jotai';
-import { forwardRef, useLayoutEffect, useState } from 'react';
 import ReactTextareaAutosize from 'react-textarea-autosize';
 import type { TextareaAutosizeProps } from 'react-textarea-autosize';
 import { chatDirectionAtom } from '~/store';
@@ -16,11 +22,11 @@ export type TextareaAutosizePropsWithAria =
       'aria-label'?: never;
     });
 
-export const TextareaAutosize = forwardRef<HTMLTextAreaElement, TextareaAutosizePropsWithAria>(
-  (props, ref) => {
-    const [, setIsRerendered] = useState(false);
-    const chatDirection = useAtomValue(chatDirectionAtom).toLowerCase();
-    useLayoutEffect(() => setIsRerendered(true), []);
-    return <ReactTextareaAutosize dir={chatDirection} {...props} ref={ref} />;
-  },
-);
+export const TextareaAutosize: ForwardRefExoticComponent<
+  TextareaAutosizePropsWithAria & RefAttributes<HTMLTextAreaElement>
+> = forwardRef<HTMLTextAreaElement, TextareaAutosizePropsWithAria>((props, ref) => {
+  const [, setIsRerendered] = useState(false);
+  const chatDirection = useAtomValue(chatDirectionAtom).toLowerCase();
+  useLayoutEffect(() => setIsRerendered(true), []);
+  return <ReactTextareaAutosize dir={chatDirection} {...props} ref={ref} />;
+});
diff --git a/packages/client/src/components/ThemeSelector.tsx b/packages/client/src/components/ThemeSelector.tsx
index 5956e87b397..ebe110b58cd 100644
--- a/packages/client/src/components/ThemeSelector.tsx
+++ b/packages/client/src/components/ThemeSelector.tsx
@@ -1,4 +1,5 @@
 import { useContext, useCallback, useEffect, useState } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Sun, Moon, Monitor } from 'lucide-react';
 import { ThemeContext, isDark } from '../theme';
 import { useLocalize } from '../hooks';
@@ -54,7 +55,7 @@ const Theme = ({ theme, onChange }: { theme: string; onChange: (value: string) =
   );
 };
 
-const ThemeSelector = ({ returnThemeOnly }: { returnThemeOnly?: boolean }) => {
+const ThemeSelector = ({ returnThemeOnly }: { returnThemeOnly?: boolean }): JSX.Element => {
   const { theme, setTheme } = useContext(ThemeContext);
   const [announcement, setAnnouncement] = useState('');
   const localize = useLocalize();
diff --git a/packages/client/src/components/Toast.tsx b/packages/client/src/components/Toast.tsx
index f78b6d5aaa3..7c47ef5d2fe 100644
--- a/packages/client/src/components/Toast.tsx
+++ b/packages/client/src/components/Toast.tsx
@@ -1,8 +1,9 @@
+import { JSX } from 'react/jsx-runtime';
 import * as RadixToast from '@radix-ui/react-toast';
 import { NotificationSeverity } from '~/common';
 import { useToast } from '~/hooks';
 
-export function Toast() {
+export function Toast(): JSX.Element {
   const { toast, onOpenChange } = useToast();
   const severityClassName = {
     /* Going up by 100 units in terms of darkness (eg bg-green-500 to bg-green-600) for
diff --git a/packages/client/src/components/Tooltip.tsx b/packages/client/src/components/Tooltip.tsx
index ddcdeef6c9a..21457c9435d 100644
--- a/packages/client/src/components/Tooltip.tsx
+++ b/packages/client/src/components/Tooltip.tsx
@@ -1,6 +1,13 @@
+import {
+  memo,
+  forwardRef,
+  useCallback,
+  useMemo,
+  RefAttributes,
+  ForwardRefExoticComponent,
+} from 'react';
 import DOMPurify from 'dompurify';
 import * as Ariakit from '@ariakit/react';
-import { memo, forwardRef, useCallback, useMemo } from 'react';
 import { AnimatePresence, motion } from 'framer-motion';
 import { cn } from '~/utils';
 import './Tooltip.css';
@@ -104,7 +111,9 @@ const TooltipPopup = memo(function TooltipPopup({
   );
 });
 
-export const TooltipAnchor = forwardRef<HTMLDivElement, TooltipAnchorProps>(function TooltipAnchor(
+export const TooltipAnchor: ForwardRefExoticComponent<
+  Omit<TooltipAnchorProps, 'ref'> & RefAttributes<HTMLDivElement>
+> = forwardRef<HTMLDivElement, TooltipAnchorProps>(function TooltipAnchor(
   { description, side = 'top', className, role, enableHTML = false, ...props },
   ref,
 ) {
diff --git a/packages/client/src/hooks/ThemeContext.old.tsx b/packages/client/src/hooks/ThemeContext.old.tsx
index 74516fcab0a..d026868b765 100644
--- a/packages/client/src/hooks/ThemeContext.old.tsx
+++ b/packages/client/src/hooks/ThemeContext.old.tsx
@@ -1,7 +1,8 @@
 //ThemeContext.js
 // source: https://plainenglish.io/blog/light-and-dark-mode-in-react-web-application-with-tailwind-css-89674496b942
-import { useSetAtom } from 'jotai';
 import React, { createContext, useState, useEffect } from 'react';
+import { useSetAtom } from 'jotai';
+import { JSX } from 'react/jsx-runtime';
 import { getInitialTheme, applyFontSize } from '~/utils';
 import { fontSizeAtom } from '~/store';
 
@@ -24,7 +25,8 @@ export const isDark = (theme: string): boolean => {
   return theme === 'dark';
 };
 
-export const ThemeContext = createContext<ProviderValue>(defaultContextValue);
+export const ThemeContext: React.Context<ProviderValue> =
+  createContext<ProviderValue>(defaultContextValue);
 
 export const ThemeProvider = ({
   initialTheme,
@@ -32,7 +34,7 @@ export const ThemeProvider = ({
 }: {
   initialTheme?: string;
   children: React.ReactNode;
-}) => {
+}): JSX.Element => {
   const [theme, setTheme] = useState(getInitialTheme);
   const setFontSize = useSetAtom(fontSizeAtom);
 
diff --git a/packages/client/src/hooks/useAvatar.ts b/packages/client/src/hooks/useAvatar.ts
index 8b183bb276d..c57b058efa3 100644
--- a/packages/client/src/hooks/useAvatar.ts
+++ b/packages/client/src/hooks/useAvatar.ts
@@ -5,7 +5,7 @@ import type { TUser } from 'librechat-data-provider';
 
 const avatarCache: Record<string, string> = {};
 
-const useAvatar = (user: TUser | undefined) => {
+const useAvatar = (user: TUser | undefined): string => {
   return useMemo(() => {
     const { username, name } = user ?? {};
     const seed = name || username;
diff --git a/packages/client/src/hooks/useCombobox.ts b/packages/client/src/hooks/useCombobox.ts
index 3282f2b7e86..90eeb8b9ac7 100644
--- a/packages/client/src/hooks/useCombobox.ts
+++ b/packages/client/src/hooks/useCombobox.ts
@@ -1,4 +1,4 @@
-import { useMemo, useState } from 'react';
+import { SetStateAction, Dispatch, useMemo, useState } from 'react';
 import { matchSorter } from 'match-sorter';
 import type { OptionWithIcon, MentionOption } from '~/common';
 
@@ -8,7 +8,13 @@ export default function useCombobox({
 }: {
   value: string;
   options: Array<OptionWithIcon | MentionOption>;
-}) {
+}): {
+  open: boolean;
+  setOpen: Dispatch<SetStateAction<boolean>>;
+  searchValue: string;
+  setSearchValue: Dispatch<SetStateAction<string>>;
+  matches: (OptionWithIcon | MentionOption)[];
+} {
   const [open, setOpen] = useState(false);
   const [searchValue, setSearchValue] = useState('');
 
diff --git a/packages/client/src/hooks/useDelayedRender.tsx b/packages/client/src/hooks/useDelayedRender.tsx
index 6524f47aed8..ddb14af2756 100644
--- a/packages/client/src/hooks/useDelayedRender.tsx
+++ b/packages/client/src/hooks/useDelayedRender.tsx
@@ -26,7 +26,7 @@ const useDelayedRender = (delay: number) => {
     };
   }, [delay, delayed]);
 
-  return (fn: () => ReactNode) => {
+  return (fn: () => ReactNode): ReactNode => {
     if (delayed && timerPromiseRef.current) {
       throw timerPromiseRef.current;
     }
diff --git a/packages/client/src/hooks/useLocalize.ts b/packages/client/src/hooks/useLocalize.ts
index cab3dd6547b..0035f53e83b 100644
--- a/packages/client/src/hooks/useLocalize.ts
+++ b/packages/client/src/hooks/useLocalize.ts
@@ -1,12 +1,11 @@
 import { useCallback } from 'react';
 import { TOptions } from 'i18next';
 import { useTranslation } from 'react-i18next';
-import { resources } from '~/locales/i18n';
 
-export type TranslationKeys = keyof typeof resources.en.translation;
+export type TranslationKeys = string;
 
 /** Language lifecycle is managed by the host app — do not add i18n.changeLanguage() calls here. */
-export default function useLocalize() {
+export default function useLocalize(): (phraseKey: TranslationKeys, options?: TOptions) => string {
   const { t } = useTranslation();
 
   return useCallback(
diff --git a/packages/client/src/hooks/useMediaQuery.tsx b/packages/client/src/hooks/useMediaQuery.tsx
index 74c6362b9a7..067474c9649 100644
--- a/packages/client/src/hooks/useMediaQuery.tsx
+++ b/packages/client/src/hooks/useMediaQuery.tsx
@@ -1,6 +1,6 @@
 import { useEffect, useState } from 'react';
 
-export default function useMediaQuery(query: string) {
+export default function useMediaQuery(query: string): boolean {
   const [matches, setMatches] = useState(false);
 
   useEffect(() => {
diff --git a/packages/client/src/hooks/useToast.ts b/packages/client/src/hooks/useToast.ts
index 9937c640dd3..fe9adf316e9 100644
--- a/packages/client/src/hooks/useToast.ts
+++ b/packages/client/src/hooks/useToast.ts
@@ -1,10 +1,14 @@
-import { useAtom } from 'jotai';
 import { useRef, useEffect } from 'react';
+import { useAtom } from 'jotai';
 import type { TShowToast } from '~/common';
-import { NotificationSeverity } from '~/common';
 import { toastState, type ToastState } from '~/store';
+import { NotificationSeverity } from '~/common';
 
-export default function useToast(showDelay = 100) {
+export default function useToast(showDelay = 100): {
+  toast: ToastState;
+  onOpenChange: (open: boolean) => void;
+  showToast: ({ message, severity, showIcon, duration, status }: TShowToast) => void;
+} {
   const [toast, setToast] = useAtom(toastState);
   const showTimerRef = useRef<number | null>(null);
   const hideTimerRef = useRef<number | null>(null);
@@ -26,7 +30,7 @@ export default function useToast(showDelay = 100) {
     showIcon = true,
     duration = 3000, // default duration for the toast to be visible
     status,
-  }: TShowToast) => {
+  }: TShowToast): void => {
     // Clear existing timeouts
     if (showTimerRef.current !== null) {
       clearTimeout(showTimerRef.current);
@@ -52,7 +56,7 @@ export default function useToast(showDelay = 100) {
 
   return {
     toast,
-    onOpenChange: (open: boolean) => setToast({ ...toast, open }),
+    onOpenChange: (open: boolean): void => setToast({ ...toast, open }),
     showToast,
   };
 }
diff --git a/packages/client/src/locales/i18n.ts b/packages/client/src/locales/i18n.ts
index f463723a4f2..42ec38b2eae 100644
--- a/packages/client/src/locales/i18n.ts
+++ b/packages/client/src/locales/i18n.ts
@@ -1,7 +1,10 @@
 import i18n from 'i18next';
 import { initReactI18next } from 'react-i18next';
 import LanguageDetector from 'i18next-browser-languagedetector';
-
+import translationZh_Hans from './zh-Hans/translation.json';
+import translationZh_Hant from './zh-Hant/translation.json';
+import translationPt_BR from './pt-BR/translation.json';
+import translationPt_PT from './pt-PT/translation.json';
 import translationEn from './en/translation.json';
 import translationAr from './ar/translation.json';
 import translationCa from './ca/translation.json';
@@ -14,8 +17,6 @@ import translationFa from './fa/translation.json';
 import translationFr from './fr/translation.json';
 import translationIt from './it/translation.json';
 import translationPl from './pl/translation.json';
-import translationPt_BR from './pt-BR/translation.json';
-import translationPt_PT from './pt-PT/translation.json';
 import translationRu from './ru/translation.json';
 import translationJa from './ja/translation.json';
 import translationKa from './ka/translation.json';
@@ -29,12 +30,185 @@ import translationId from './id/translation.json';
 import translationHe from './he/translation.json';
 import translationHu from './hu/translation.json';
 import translationFi from './fi/translation.json';
-import translationZh_Hans from './zh-Hans/translation.json';
-import translationZh_Hant from './zh-Hant/translation.json';
 
 export const defaultNS = 'translation';
 
-export const resources = {
+export const resources: {
+  readonly en: {
+    readonly translation: {
+      com_ui_cancel: string;
+      com_ui_no_options: string;
+      com_ui_delete_selected_items: string;
+      com_ui_filter_by: string;
+      com_ui_cancel_dialog: string;
+      com_ui_no_results_found: string;
+      com_ui_select_all: string;
+      com_ui_no_selection: string;
+      com_ui_confirm_bulk_delete: string;
+      com_ui_delete_success: string;
+      com_ui_retry: string;
+      com_ui_selected_count: string;
+      com_ui_data_table: string;
+      com_ui_no_data: string;
+      com_ui_delete_selected: string;
+      com_ui_search: string;
+      com_ui_search_table: string;
+      com_ui_search_table_description: string;
+      com_ui_data_table_scroll_area: string;
+      com_ui_select_row: string;
+      com_ui_loading_more_data: string;
+      com_ui_no_search_results: string;
+      com_ui_table_error: string;
+      com_ui_table_error_description: string;
+      com_ui_error_details: string;
+      com_ui_enabled: string;
+      com_ui_disabled: string;
+      com_ui_toggle_theme: string;
+      com_ui_dark_theme_enabled: string;
+      com_ui_light_theme_enabled: string;
+    };
+  };
+  readonly ar: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ca: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly cs: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'zh-Hans': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'zh-Hant': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly da: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly de: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly es: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly et: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fa: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fr: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly it: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly pl: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'pt-BR': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'pt-PT': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ru: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ja: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ka: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly sv: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ko: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly th: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly tr: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly vi: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly nl: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly id: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly he: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly hu: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fi: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+} = {
   en: { translation: translationEn },
   ar: { translation: translationAr },
   ca: { translation: translationCa },
diff --git a/packages/client/src/store.ts b/packages/client/src/store.ts
index 36a3f05844c..9b1d49e22aa 100644
--- a/packages/client/src/store.ts
+++ b/packages/client/src/store.ts
@@ -1,8 +1,12 @@
-import { atom } from 'jotai';
+import { atom, PrimitiveAtom } from 'jotai';
 import { NotificationSeverity } from '~/common';
 
-export const chatDirectionAtom = atom<string>('ltr');
-export const fontSizeAtom = atom<string>('text-base');
+export const chatDirectionAtom: PrimitiveAtom<string> & {
+  init: string;
+} = atom<string>('ltr');
+export const fontSizeAtom: PrimitiveAtom<string> & {
+  init: string;
+} = atom<string>('text-base');
 
 export type ToastState = {
   open: boolean;
@@ -11,7 +15,9 @@ export type ToastState = {
   showIcon: boolean;
 };
 
-export const toastState = atom<ToastState>({
+export const toastState: PrimitiveAtom<ToastState> & {
+  init: ToastState;
+} = atom<ToastState>({
   open: false,
   message: '',
   severity: NotificationSeverity.SUCCESS,
diff --git a/packages/client/src/svgs/AnthropicIcon.tsx b/packages/client/src/svgs/AnthropicIcon.tsx
index d634bd01183..fee9b793334 100644
--- a/packages/client/src/svgs/AnthropicIcon.tsx
+++ b/packages/client/src/svgs/AnthropicIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function AnthropicIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function AnthropicIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 16"
diff --git a/packages/client/src/svgs/AnthropicMinimalIcon.tsx b/packages/client/src/svgs/AnthropicMinimalIcon.tsx
index dea61ef6cae..d50d77d4ad1 100644
--- a/packages/client/src/svgs/AnthropicMinimalIcon.tsx
+++ b/packages/client/src/svgs/AnthropicMinimalIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function AnthropicMinimalIcon() {
+export default function AnthropicMinimalIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/AppleIcon.tsx b/packages/client/src/svgs/AppleIcon.tsx
index 9994ca5f88b..bffdf3f52ad 100644
--- a/packages/client/src/svgs/AppleIcon.tsx
+++ b/packages/client/src/svgs/AppleIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function AppleIcon() {
+export default function AppleIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ArchiveIcon.tsx b/packages/client/src/svgs/ArchiveIcon.tsx
index cf85d69cc55..a6e76de6905 100644
--- a/packages/client/src/svgs/ArchiveIcon.tsx
+++ b/packages/client/src/svgs/ArchiveIcon.tsx
@@ -1,4 +1,10 @@
-export default function ArchiveIcon({ className = 'icon-md' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ArchiveIcon({
+  className = 'icon-md',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/AssistantIcon.tsx b/packages/client/src/svgs/AssistantIcon.tsx
index 05233817f18..c8514f3f2aa 100644
--- a/packages/client/src/svgs/AssistantIcon.tsx
+++ b/packages/client/src/svgs/AssistantIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 export default function AssistantIcon({
@@ -6,7 +7,7 @@ export default function AssistantIcon({
 }: {
   className?: string;
   size?: string | number;
-}) {
+}): JSX.Element {
   const unit = 24;
   const height = size;
   const width = size;
diff --git a/packages/client/src/svgs/AttachmentIcon.tsx b/packages/client/src/svgs/AttachmentIcon.tsx
index 51aa489d7ed..2a6035bacbf 100644
--- a/packages/client/src/svgs/AttachmentIcon.tsx
+++ b/packages/client/src/svgs/AttachmentIcon.tsx
@@ -1,4 +1,10 @@
-export default function AttachmentIcon({ className = '' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function AttachmentIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/AudioPaths.tsx b/packages/client/src/svgs/AudioPaths.tsx
index 874f54328d3..51d2569efce 100644
--- a/packages/client/src/svgs/AudioPaths.tsx
+++ b/packages/client/src/svgs/AudioPaths.tsx
@@ -1,4 +1,6 @@
-export default function AudioPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function AudioPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/AzureMinimalIcon.tsx b/packages/client/src/svgs/AzureMinimalIcon.tsx
index e51d7aca321..a3ba7af85cf 100644
--- a/packages/client/src/svgs/AzureMinimalIcon.tsx
+++ b/packages/client/src/svgs/AzureMinimalIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function AzureMinimalIcon({
@@ -6,7 +7,7 @@ export default function AzureMinimalIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   const height = size;
   const width = size;
 
diff --git a/packages/client/src/svgs/BedrockIcon.tsx b/packages/client/src/svgs/BedrockIcon.tsx
index ec69f3c4e09..bb6efd63d94 100644
--- a/packages/client/src/svgs/BedrockIcon.tsx
+++ b/packages/client/src/svgs/BedrockIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 export default function BedrockIcon({
@@ -6,7 +7,7 @@ export default function BedrockIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/BirthdayIcon.tsx b/packages/client/src/svgs/BirthdayIcon.tsx
index b0567778bd7..0566894178f 100644
--- a/packages/client/src/svgs/BirthdayIcon.tsx
+++ b/packages/client/src/svgs/BirthdayIcon.tsx
@@ -1,7 +1,12 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function BirthdayIcon({ className = '' }) {
+export default function BirthdayIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       version="1.1"
diff --git a/packages/client/src/svgs/Blocks.tsx b/packages/client/src/svgs/Blocks.tsx
index 6c3aab213b9..000ef3305d2 100644
--- a/packages/client/src/svgs/Blocks.tsx
+++ b/packages/client/src/svgs/Blocks.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function Blocks({ className = '' }: { className?: string }) {
+export default function Blocks({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/CautionIcon.tsx b/packages/client/src/svgs/CautionIcon.tsx
index b8adae79a3c..97372c33da7 100644
--- a/packages/client/src/svgs/CautionIcon.tsx
+++ b/packages/client/src/svgs/CautionIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function CautionIcon() {
+export default function CautionIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/ChatGPTMinimalIcon.tsx b/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
index 80d7c862bcd..3c28e715ac7 100644
--- a/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
+++ b/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ChatGPTMinimalIcon() {
+export default function ChatGPTMinimalIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ChatIcon.tsx b/packages/client/src/svgs/ChatIcon.tsx
index de14015d480..1f275e96023 100644
--- a/packages/client/src/svgs/ChatIcon.tsx
+++ b/packages/client/src/svgs/ChatIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ChatIcon() {
+export default function ChatIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/CheckMark.tsx b/packages/client/src/svgs/CheckMark.tsx
index 75921475b77..144f326c821 100644
--- a/packages/client/src/svgs/CheckMark.tsx
+++ b/packages/client/src/svgs/CheckMark.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function CheckMark({ className = '' }: { className?: string }) {
+export default function CheckMark({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/CircleHelpIcon.tsx b/packages/client/src/svgs/CircleHelpIcon.tsx
index 1f0265b50d7..296c4ea3790 100644
--- a/packages/client/src/svgs/CircleHelpIcon.tsx
+++ b/packages/client/src/svgs/CircleHelpIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function CircleHelpIcon({ className = 'icon-md-heavy', size = '1em' }) {
+export default function CircleHelpIcon({
+  className = 'icon-md-heavy',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/Clipboard.tsx b/packages/client/src/svgs/Clipboard.tsx
index a7c1fda81ab..d68b13244c0 100644
--- a/packages/client/src/svgs/Clipboard.tsx
+++ b/packages/client/src/svgs/Clipboard.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function Clipboard({ className = 'icon-md-heavy', size = '1em' }) {
+export default function Clipboard({
+  className = 'icon-md-heavy',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/CodePaths.tsx b/packages/client/src/svgs/CodePaths.tsx
index adddb42ec32..aec617275c4 100644
--- a/packages/client/src/svgs/CodePaths.tsx
+++ b/packages/client/src/svgs/CodePaths.tsx
@@ -1,4 +1,6 @@
-export default function CodePaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function CodePaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/CodeyIcon.tsx b/packages/client/src/svgs/CodeyIcon.tsx
index 1a40cfe647f..286170d456b 100644
--- a/packages/client/src/svgs/CodeyIcon.tsx
+++ b/packages/client/src/svgs/CodeyIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function CodeyIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function CodeyIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       // width="100%"
diff --git a/packages/client/src/svgs/ContinueIcon.tsx b/packages/client/src/svgs/ContinueIcon.tsx
index b4dcd5c7e19..69181cc579c 100644
--- a/packages/client/src/svgs/ContinueIcon.tsx
+++ b/packages/client/src/svgs/ContinueIcon.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function ContinueIcon({ className = '' }: { className?: string }) {
+export default function ContinueIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/ConvoIcon.tsx b/packages/client/src/svgs/ConvoIcon.tsx
index edd9fd4148f..cf3dd314ac2 100644
--- a/packages/client/src/svgs/ConvoIcon.tsx
+++ b/packages/client/src/svgs/ConvoIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ConvoIcon() {
+export default function ConvoIcon(): JSX.Element {
   return (
     <svg
       data-testid="convo-icon"
diff --git a/packages/client/src/svgs/CrossIcon.tsx b/packages/client/src/svgs/CrossIcon.tsx
index 635f2c7cc00..b52b65d03b2 100644
--- a/packages/client/src/svgs/CrossIcon.tsx
+++ b/packages/client/src/svgs/CrossIcon.tsx
@@ -1,7 +1,12 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function CrossIcon({ className = '' }) {
+export default function CrossIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/CustomMinimalIcon.tsx b/packages/client/src/svgs/CustomMinimalIcon.tsx
index dabe8f62005..85d3fb3f1dd 100644
--- a/packages/client/src/svgs/CustomMinimalIcon.tsx
+++ b/packages/client/src/svgs/CustomMinimalIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function CustomMinimalIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function CustomMinimalIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/DarkModeIcon.tsx b/packages/client/src/svgs/DarkModeIcon.tsx
index 3b91f0842a9..3575aecd2e4 100644
--- a/packages/client/src/svgs/DarkModeIcon.tsx
+++ b/packages/client/src/svgs/DarkModeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DarkModeIcon() {
+export default function DarkModeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/DataIcon.tsx b/packages/client/src/svgs/DataIcon.tsx
index 92a445b96e1..935473b6ffa 100644
--- a/packages/client/src/svgs/DataIcon.tsx
+++ b/packages/client/src/svgs/DataIcon.tsx
@@ -1,4 +1,6 @@
-export default function DataIcon({ className = 'icon-sm' }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function DataIcon({ className = 'icon-sm' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/DiscordIcon.tsx b/packages/client/src/svgs/DiscordIcon.tsx
index af4ae0f12f3..09cab0d68d4 100644
--- a/packages/client/src/svgs/DiscordIcon.tsx
+++ b/packages/client/src/svgs/DiscordIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DiscordIcon() {
+export default function DiscordIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/DislikeIcon.tsx b/packages/client/src/svgs/DislikeIcon.tsx
index 40a23ad0ea7..589b4cec12b 100644
--- a/packages/client/src/svgs/DislikeIcon.tsx
+++ b/packages/client/src/svgs/DislikeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DislikeIcon() {
+export default function DislikeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/DotsIcon.tsx b/packages/client/src/svgs/DotsIcon.tsx
index b0f9f00da0e..854e1448bbe 100644
--- a/packages/client/src/svgs/DotsIcon.tsx
+++ b/packages/client/src/svgs/DotsIcon.tsx
@@ -1,10 +1,11 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
 export default function DotsIcon({
   className = 'h-4 w-4 flex-shrink-0 text-gray-500',
 }: {
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/EditIcon.tsx b/packages/client/src/svgs/EditIcon.tsx
index ae28655633e..2f75243e8f5 100644
--- a/packages/client/src/svgs/EditIcon.tsx
+++ b/packages/client/src/svgs/EditIcon.tsx
@@ -6,30 +6,31 @@ type IconProps = {
   size?: string;
 };
 
-const EditIcon = React.forwardRef<SVGSVGElement, IconProps>((props: IconProps, ref) => {
-  const { className = 'icon-md', size = '1.2em' } = props;
-  return (
-    <svg
-      ref={ref}
-      fill="none"
-      strokeWidth="2"
-      xmlns="http://www.w3.org/2000/svg"
-      viewBox="0 0 24 24"
-      strokeLinecap="round"
-      strokeLinejoin="round"
-      height={size}
-      width={size}
-      className={cn(className)}
-      aria-hidden="true"
-    >
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M13.2929 4.29291C15.0641 2.52167 17.9359 2.52167 19.7071 4.2929C21.4783 6.06414 21.4783 8.93588 19.7071 10.7071L18.7073 11.7069L11.1603 19.2539C10.7182 19.696 10.1489 19.989 9.53219 20.0918L4.1644 20.9864C3.84584 21.0395 3.52125 20.9355 3.29289 20.7071C3.06453 20.4788 2.96051 20.1542 3.0136 19.8356L3.90824 14.4678C4.01103 13.8511 4.30396 13.2818 4.7461 12.8397L13.2929 4.29291ZM13 7.41422L6.16031 14.2539C6.01293 14.4013 5.91529 14.591 5.88102 14.7966L5.21655 18.7835L9.20339 18.119C9.40898 18.0847 9.59872 17.9871 9.7461 17.8397L16.5858 11L13 7.41422ZM18 9.5858L14.4142 6.00001L14.7071 5.70712C15.6973 4.71693 17.3027 4.71693 18.2929 5.70712C19.2831 6.69731 19.2831 8.30272 18.2929 9.29291L18 9.5858Z"
-        fill="currentColor"
-      ></path>
-    </svg>
-  );
-});
+const EditIcon: React.ForwardRefExoticComponent<IconProps & React.RefAttributes<SVGSVGElement>> =
+  React.forwardRef<SVGSVGElement, IconProps>((props: IconProps, ref) => {
+    const { className = 'icon-md', size = '1.2em' } = props;
+    return (
+      <svg
+        ref={ref}
+        fill="none"
+        strokeWidth="2"
+        xmlns="http://www.w3.org/2000/svg"
+        viewBox="0 0 24 24"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        height={size}
+        width={size}
+        className={cn(className)}
+        aria-hidden="true"
+      >
+        <path
+          fillRule="evenodd"
+          clipRule="evenodd"
+          d="M13.2929 4.29291C15.0641 2.52167 17.9359 2.52167 19.7071 4.2929C21.4783 6.06414 21.4783 8.93588 19.7071 10.7071L18.7073 11.7069L11.1603 19.2539C10.7182 19.696 10.1489 19.989 9.53219 20.0918L4.1644 20.9864C3.84584 21.0395 3.52125 20.9355 3.29289 20.7071C3.06453 20.4788 2.96051 20.1542 3.0136 19.8356L3.90824 14.4678C4.01103 13.8511 4.30396 13.2818 4.7461 12.8397L13.2929 4.29291ZM13 7.41422L6.16031 14.2539C6.01293 14.4013 5.91529 14.591 5.88102 14.7966L5.21655 18.7835L9.20339 18.119C9.40898 18.0847 9.59872 17.9871 9.7461 17.8397L16.5858 11L13 7.41422ZM18 9.5858L14.4142 6.00001L14.7071 5.70712C15.6973 4.71693 17.3027 4.71693 18.2929 5.70712C19.2831 6.69731 19.2831 8.30272 18.2929 9.29291L18 9.5858Z"
+          fill="currentColor"
+        ></path>
+      </svg>
+    );
+  });
 
 export default EditIcon;
diff --git a/packages/client/src/svgs/ExperimentIcon.tsx b/packages/client/src/svgs/ExperimentIcon.tsx
index 476e925ff44..212d90b6a09 100644
--- a/packages/client/src/svgs/ExperimentIcon.tsx
+++ b/packages/client/src/svgs/ExperimentIcon.tsx
@@ -1,4 +1,6 @@
-export default function ExperimentIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ExperimentIcon(): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/FacebookIcon.tsx b/packages/client/src/svgs/FacebookIcon.tsx
index 54680776a69..b77c6378787 100644
--- a/packages/client/src/svgs/FacebookIcon.tsx
+++ b/packages/client/src/svgs/FacebookIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function FacebookIcon() {
+export default function FacebookIcon(): JSX.Element {
   return (
     <svg viewBox="0 0 40 40" width="25" height="25" aria-hidden="true">
       <linearGradient
diff --git a/packages/client/src/svgs/FileIcon.tsx b/packages/client/src/svgs/FileIcon.tsx
index b02976bbf45..3baf630374a 100644
--- a/packages/client/src/svgs/FileIcon.tsx
+++ b/packages/client/src/svgs/FileIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import type { TFile } from 'librechat-data-provider';
 
 export default function FileIcon({
@@ -10,7 +11,7 @@ export default function FileIcon({
     paths: React.FC;
     title: string;
   };
-}) {
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/FilePaths.tsx b/packages/client/src/svgs/FilePaths.tsx
index 29341ebeb92..94de953a58a 100644
--- a/packages/client/src/svgs/FilePaths.tsx
+++ b/packages/client/src/svgs/FilePaths.tsx
@@ -1,4 +1,6 @@
-export default function FilePaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function FilePaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/GPTIcon.tsx b/packages/client/src/svgs/GPTIcon.tsx
index 477882be6e9..7c343eddd93 100644
--- a/packages/client/src/svgs/GPTIcon.tsx
+++ b/packages/client/src/svgs/GPTIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function GPTIcon({
@@ -6,7 +7,7 @@ export default function GPTIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   const unit = '41';
   const height = size;
   const width = size;
diff --git a/packages/client/src/svgs/GeminiIcon.tsx b/packages/client/src/svgs/GeminiIcon.tsx
index 4835e6e58f3..0e50a0a81d8 100644
--- a/packages/client/src/svgs/GeminiIcon.tsx
+++ b/packages/client/src/svgs/GeminiIcon.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function GeminiIcon({
   size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/GithubIcon.tsx b/packages/client/src/svgs/GithubIcon.tsx
index 089692a7702..e637d3ad3cf 100644
--- a/packages/client/src/svgs/GithubIcon.tsx
+++ b/packages/client/src/svgs/GithubIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function GithubIcon() {
+export default function GithubIcon(): JSX.Element {
   return (
     <svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" fill="none" aria-hidden="true">
       <path
diff --git a/packages/client/src/svgs/GoogleIcon.tsx b/packages/client/src/svgs/GoogleIcon.tsx
index 0dcafc29422..306435700fd 100644
--- a/packages/client/src/svgs/GoogleIcon.tsx
+++ b/packages/client/src/svgs/GoogleIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function GoogleIcon() {
+export default function GoogleIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/GoogleIconChat.tsx b/packages/client/src/svgs/GoogleIconChat.tsx
index 5e4da789e7e..0ec7a741a4d 100644
--- a/packages/client/src/svgs/GoogleIconChat.tsx
+++ b/packages/client/src/svgs/GoogleIconChat.tsx
@@ -1,15 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function Google({
-  size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
-  const unit = '41';
-  const height = size;
-  const width = size;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/GoogleMinimalIcon.tsx b/packages/client/src/svgs/GoogleMinimalIcon.tsx
index 9c7e3aad3e1..26aba74fe37 100644
--- a/packages/client/src/svgs/GoogleMinimalIcon.tsx
+++ b/packages/client/src/svgs/GoogleMinimalIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function GoogleMinimalIcon({ className = '' }: { className?: string }) {
+export default function GoogleMinimalIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LightModeIcon.tsx b/packages/client/src/svgs/LightModeIcon.tsx
index ab58472a006..f3c6031a007 100644
--- a/packages/client/src/svgs/LightModeIcon.tsx
+++ b/packages/client/src/svgs/LightModeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LightModeIcon() {
+export default function LightModeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/LightningIcon.tsx b/packages/client/src/svgs/LightningIcon.tsx
index a9b7b633bf7..ee7880c9cbe 100644
--- a/packages/client/src/svgs/LightningIcon.tsx
+++ b/packages/client/src/svgs/LightningIcon.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function LightningIcon({ className = '' }) {
+export default function LightningIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LikeIcon.tsx b/packages/client/src/svgs/LikeIcon.tsx
index 8e3b7ba5bfc..a430fc5e584 100644
--- a/packages/client/src/svgs/LikeIcon.tsx
+++ b/packages/client/src/svgs/LikeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LikeIcon() {
+export default function LikeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/LinkIcon.tsx b/packages/client/src/svgs/LinkIcon.tsx
index 79935df032f..30f1039a7a2 100644
--- a/packages/client/src/svgs/LinkIcon.tsx
+++ b/packages/client/src/svgs/LinkIcon.tsx
@@ -1,4 +1,6 @@
-export default function LinkIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function LinkIcon(): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/ListeningIcon.tsx b/packages/client/src/svgs/ListeningIcon.tsx
index 1bdc7fb8941..074a2c6e298 100644
--- a/packages/client/src/svgs/ListeningIcon.tsx
+++ b/packages/client/src/svgs/ListeningIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 type ListeningIconProps = {
   className?: string;
 };
 
-export default function ListeningIcon({ className }: ListeningIconProps) {
+export default function ListeningIcon({ className }: ListeningIconProps): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LockIcon.tsx b/packages/client/src/svgs/LockIcon.tsx
index efcf5052883..3ac81a38168 100644
--- a/packages/client/src/svgs/LockIcon.tsx
+++ b/packages/client/src/svgs/LockIcon.tsx
@@ -1,4 +1,6 @@
-export default function LockIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function LockIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LogOutIcon.tsx b/packages/client/src/svgs/LogOutIcon.tsx
index 754ea10a774..de5a5eb299f 100644
--- a/packages/client/src/svgs/LogOutIcon.tsx
+++ b/packages/client/src/svgs/LogOutIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LogOutIcon() {
+export default function LogOutIcon(): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/MCPIcon.tsx b/packages/client/src/svgs/MCPIcon.tsx
index f5db9df9409..558b75508c1 100644
--- a/packages/client/src/svgs/MCPIcon.tsx
+++ b/packages/client/src/svgs/MCPIcon.tsx
@@ -1,4 +1,6 @@
-export default function MCPIcon({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function MCPIcon({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="195"
diff --git a/packages/client/src/svgs/MessagesSquared.tsx b/packages/client/src/svgs/MessagesSquared.tsx
index 58582d0e4fa..939d355481f 100644
--- a/packages/client/src/svgs/MessagesSquared.tsx
+++ b/packages/client/src/svgs/MessagesSquared.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function MessagesSquared({ className }: { className?: string }) {
+export default function MessagesSquared({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/MinimalPlugin.tsx b/packages/client/src/svgs/MinimalPlugin.tsx
index d38a3180e0f..ef9b712f82b 100644
--- a/packages/client/src/svgs/MinimalPlugin.tsx
+++ b/packages/client/src/svgs/MinimalPlugin.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function MinimalPlugin({
   size,
   className = 'icon-md',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/MobileSidebar.tsx b/packages/client/src/svgs/MobileSidebar.tsx
index 999de0b91c4..a9e4e0703d7 100644
--- a/packages/client/src/svgs/MobileSidebar.tsx
+++ b/packages/client/src/svgs/MobileSidebar.tsx
@@ -1,4 +1,6 @@
-export default function MobileSidebar({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function MobileSidebar({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/MoonshotIcon.tsx b/packages/client/src/svgs/MoonshotIcon.tsx
index 599de9f058e..821174e5ac8 100644
--- a/packages/client/src/svgs/MoonshotIcon.tsx
+++ b/packages/client/src/svgs/MoonshotIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function MoonshotIcon({ className = '' }: { className?: string }) {
+export default function MoonshotIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/NewChatIcon.tsx b/packages/client/src/svgs/NewChatIcon.tsx
index 20ae52863dd..ac0a2537b4e 100644
--- a/packages/client/src/svgs/NewChatIcon.tsx
+++ b/packages/client/src/svgs/NewChatIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function NewChatIcon({ className = '' }: { className?: string }) {
+export default function NewChatIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="16"
diff --git a/packages/client/src/svgs/OpenAIMinimalIcon.tsx b/packages/client/src/svgs/OpenAIMinimalIcon.tsx
index 36dd2bc5173..ecb8f8e1672 100644
--- a/packages/client/src/svgs/OpenAIMinimalIcon.tsx
+++ b/packages/client/src/svgs/OpenAIMinimalIcon.tsx
@@ -1,4 +1,10 @@
-export default function OpenAIMinimalIcon({ className = 'h-4 w-4' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function OpenAIMinimalIcon({
+  className = 'h-4 w-4',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/OpenIDIcon.tsx b/packages/client/src/svgs/OpenIDIcon.tsx
index 88702c19d0a..aaae6b58529 100644
--- a/packages/client/src/svgs/OpenIDIcon.tsx
+++ b/packages/client/src/svgs/OpenIDIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function OpenIDIcon() {
+export default function OpenIDIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/PaLMIcon.tsx b/packages/client/src/svgs/PaLMIcon.tsx
index 90358c4ba7d..5d58b101c08 100644
--- a/packages/client/src/svgs/PaLMIcon.tsx
+++ b/packages/client/src/svgs/PaLMIcon.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function PaLMIcon({
   size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       // width="100%"
diff --git a/packages/client/src/svgs/PaLMinimalIcon.tsx b/packages/client/src/svgs/PaLMinimalIcon.tsx
index 5cfb9091679..e236ef7d68f 100644
--- a/packages/client/src/svgs/PaLMinimalIcon.tsx
+++ b/packages/client/src/svgs/PaLMinimalIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function PaLMinimalIcon({ className = '' }: { className?: string }) {
+export default function PaLMinimalIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/PersonalizationIcon.tsx b/packages/client/src/svgs/PersonalizationIcon.tsx
index a40dcbc86ad..54f8914bc34 100644
--- a/packages/client/src/svgs/PersonalizationIcon.tsx
+++ b/packages/client/src/svgs/PersonalizationIcon.tsx
@@ -1,4 +1,10 @@
-export default function PersonalizationIcon({ className = '' }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function PersonalizationIcon({
+  className = '',
+}: {
+  className?: string;
+}): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/PinIcon.tsx b/packages/client/src/svgs/PinIcon.tsx
index 322268e5082..458ea8814cb 100644
--- a/packages/client/src/svgs/PinIcon.tsx
+++ b/packages/client/src/svgs/PinIcon.tsx
@@ -1,4 +1,6 @@
-export default function PinIcon({ unpin = false }: { unpin?: boolean }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function PinIcon({ unpin = false }: { unpin?: boolean }): JSX.Element {
   if (unpin) {
     return (
       <svg
diff --git a/packages/client/src/svgs/Plugin.tsx b/packages/client/src/svgs/Plugin.tsx
index 37fdea05c85..ab0f55a00ee 100644
--- a/packages/client/src/svgs/Plugin.tsx
+++ b/packages/client/src/svgs/Plugin.tsx
@@ -1,6 +1,8 @@
+import { JSX } from 'react/jsx-runtime';
+import type { SVGProps } from 'react';
 import { cn } from '~/utils/';
 
-export default function Plugin({ className = '', ...props }) {
+export default function Plugin({ className = '', ...props }: SVGProps<SVGSVGElement>): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/RegenerateIcon.tsx b/packages/client/src/svgs/RegenerateIcon.tsx
index d7ca1cbbe48..078ec217988 100644
--- a/packages/client/src/svgs/RegenerateIcon.tsx
+++ b/packages/client/src/svgs/RegenerateIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function RegenerateIcon({ className = '', size = '1em' }) {
+export default function RegenerateIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/RenameIcon.tsx b/packages/client/src/svgs/RenameIcon.tsx
index 4dc5f7cfed3..4fd2d051184 100644
--- a/packages/client/src/svgs/RenameIcon.tsx
+++ b/packages/client/src/svgs/RenameIcon.tsx
@@ -1,4 +1,6 @@
-export default function RenameIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function RenameIcon(): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/SamlIcon.tsx b/packages/client/src/svgs/SamlIcon.tsx
index eac9c9d7d57..7cee28801c4 100644
--- a/packages/client/src/svgs/SamlIcon.tsx
+++ b/packages/client/src/svgs/SamlIcon.tsx
@@ -8,8 +8,9 @@
  *  - AUTHOR: HashiCorp
  */
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SamlIcon() {
+export default function SamlIcon(): JSX.Element {
   return (
     <svg
       width="800px"
diff --git a/packages/client/src/svgs/SaveIcon.tsx b/packages/client/src/svgs/SaveIcon.tsx
index 737889cc904..ca32cb7d361 100644
--- a/packages/client/src/svgs/SaveIcon.tsx
+++ b/packages/client/src/svgs/SaveIcon.tsx
@@ -1,9 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
+
 type SaveIconProps = {
   size?: string | number;
   className?: string;
 };
 
-export default function SaveIcon({ size = '1em', className }: SaveIconProps) {
+export default function SaveIcon({ size = '1em', className }: SaveIconProps): JSX.Element {
   return (
     <svg
       viewBox="64 64 896 896"
diff --git a/packages/client/src/svgs/SendIcon.tsx b/packages/client/src/svgs/SendIcon.tsx
index 703c645f0bf..f68ee176e98 100644
--- a/packages/client/src/svgs/SendIcon.tsx
+++ b/packages/client/src/svgs/SendIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function SendIcon({ size = 24, className = '' }) {
+export default function SendIcon({
+  size = 24,
+  className = '',
+}: {
+  size?: number | undefined;
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/SendMessageIcon.tsx b/packages/client/src/svgs/SendMessageIcon.tsx
index a48c868bdbe..3aef3c976df 100644
--- a/packages/client/src/svgs/SendMessageIcon.tsx
+++ b/packages/client/src/svgs/SendMessageIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SendMessageIcon() {
+export default function SendMessageIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/SharePointIcon.tsx b/packages/client/src/svgs/SharePointIcon.tsx
index 5764a27a1c9..caa77ee6379 100644
--- a/packages/client/src/svgs/SharePointIcon.tsx
+++ b/packages/client/src/svgs/SharePointIcon.tsx
@@ -1,5 +1,10 @@
 import React from 'react';
-export default function SharePointIcon({ className = '' }) {
+import { JSX } from 'react/jsx-runtime';
+export default function SharePointIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       fill="currentColor"
diff --git a/packages/client/src/svgs/SheetPaths.tsx b/packages/client/src/svgs/SheetPaths.tsx
index a98e14cae3c..1902a56bc75 100644
--- a/packages/client/src/svgs/SheetPaths.tsx
+++ b/packages/client/src/svgs/SheetPaths.tsx
@@ -1,4 +1,6 @@
-export default function SheetPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function SheetPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/Sidebar.tsx b/packages/client/src/svgs/Sidebar.tsx
index 910343cfb23..17b155d22c7 100644
--- a/packages/client/src/svgs/Sidebar.tsx
+++ b/packages/client/src/svgs/Sidebar.tsx
@@ -1,4 +1,6 @@
-export default function Sidebar({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function Sidebar({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/Sparkles.tsx b/packages/client/src/svgs/Sparkles.tsx
index 8b1604dd845..dd8582b79ea 100644
--- a/packages/client/src/svgs/Sparkles.tsx
+++ b/packages/client/src/svgs/Sparkles.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function Sparkles({ className = '', size = 24 }) {
+export default function Sparkles({
+  className = '',
+  size = 24,
+}: {
+  className?: string | undefined;
+  size?: number | undefined;
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/SpeechIcon.tsx b/packages/client/src/svgs/SpeechIcon.tsx
index f3e74f3e662..abc8f37173d 100644
--- a/packages/client/src/svgs/SpeechIcon.tsx
+++ b/packages/client/src/svgs/SpeechIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 type SpeechIconProps = {
   className?: string;
 };
 
-export default function SpeechIcon({ className }: SpeechIconProps) {
+export default function SpeechIcon({ className }: SpeechIconProps): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/Spinner.tsx b/packages/client/src/svgs/Spinner.tsx
index 84fbf8f3279..b61af9d1190 100644
--- a/packages/client/src/svgs/Spinner.tsx
+++ b/packages/client/src/svgs/Spinner.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 interface SpinnerProps {
@@ -14,7 +15,7 @@ export default function Spinner({
   color = 'currentColor',
   bgOpacity = 0.1,
   speed = 0.75,
-}: SpinnerProps) {
+}: SpinnerProps): JSX.Element {
   const cssVars = {
     '--spinner-speed': `${speed}s`,
   } as React.CSSProperties;
diff --git a/packages/client/src/svgs/SquirclePlusIcon.tsx b/packages/client/src/svgs/SquirclePlusIcon.tsx
index c7548f2c7d0..ce2837bba1b 100644
--- a/packages/client/src/svgs/SquirclePlusIcon.tsx
+++ b/packages/client/src/svgs/SquirclePlusIcon.tsx
@@ -1,4 +1,6 @@
-export default function SquirclePlusIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function SquirclePlusIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/StopGeneratingIcon.tsx b/packages/client/src/svgs/StopGeneratingIcon.tsx
index 35d19ca02ec..fd3155146f7 100644
--- a/packages/client/src/svgs/StopGeneratingIcon.tsx
+++ b/packages/client/src/svgs/StopGeneratingIcon.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function StopGeneratingIcon({ className = '' }: { className?: string }) {
+export default function StopGeneratingIcon({
+  className = '',
+}: {
+  className?: string;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/SunIcon.tsx b/packages/client/src/svgs/SunIcon.tsx
index b0842d346a2..eeb69d364d9 100644
--- a/packages/client/src/svgs/SunIcon.tsx
+++ b/packages/client/src/svgs/SunIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SunIcon() {
+export default function SunIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/SwitchIcon.tsx b/packages/client/src/svgs/SwitchIcon.tsx
index e97cf24f3b5..582bb8e8449 100644
--- a/packages/client/src/svgs/SwitchIcon.tsx
+++ b/packages/client/src/svgs/SwitchIcon.tsx
@@ -1,9 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
+
 type SwitchIconProps = {
   size?: string | number;
   className?: string;
 };
 
-export default function SwitchIcon({ size = '1em', className }: SwitchIconProps) {
+export default function SwitchIcon({ size = '1em', className }: SwitchIconProps): JSX.Element {
   return (
     <svg
       viewBox="64 64 896 896"
diff --git a/packages/client/src/svgs/TextPaths.tsx b/packages/client/src/svgs/TextPaths.tsx
index 89d7353b6da..04d4521b296 100644
--- a/packages/client/src/svgs/TextPaths.tsx
+++ b/packages/client/src/svgs/TextPaths.tsx
@@ -1,4 +1,6 @@
-export default function TextPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function TextPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/ThumbDownIcon.tsx b/packages/client/src/svgs/ThumbDownIcon.tsx
index 581222ee0dd..92027b2328a 100644
--- a/packages/client/src/svgs/ThumbDownIcon.tsx
+++ b/packages/client/src/svgs/ThumbDownIcon.tsx
@@ -1,4 +1,14 @@
-export default function ThumbDownIcon({ className = '', size = '1em', bold = false }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ThumbDownIcon({
+  className = '',
+  size = '1em',
+  bold = false,
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+  bold?: boolean | undefined;
+}): JSX.Element {
   return bold ? (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ThumbUpIcon.tsx b/packages/client/src/svgs/ThumbUpIcon.tsx
index 33f1495dcb9..7a86e98602c 100644
--- a/packages/client/src/svgs/ThumbUpIcon.tsx
+++ b/packages/client/src/svgs/ThumbUpIcon.tsx
@@ -1,4 +1,14 @@
-export default function ThumbUpIcon({ className = '', size = '1em', bold = false }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ThumbUpIcon({
+  className = '',
+  size = '1em',
+  bold = false,
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+  bold?: boolean | undefined;
+}): JSX.Element {
   return bold ? (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/TrashIcon.tsx b/packages/client/src/svgs/TrashIcon.tsx
index fcab75beedd..85c94ee6674 100644
--- a/packages/client/src/svgs/TrashIcon.tsx
+++ b/packages/client/src/svgs/TrashIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 type TrashIconProps = {
   className?: string;
 };
 
-export default function TrashIcon({ className = '' }: TrashIconProps) {
+export default function TrashIcon({ className = '' }: TrashIconProps): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/UserIcon.tsx b/packages/client/src/svgs/UserIcon.tsx
index 1003f082226..928dc982829 100644
--- a/packages/client/src/svgs/UserIcon.tsx
+++ b/packages/client/src/svgs/UserIcon.tsx
@@ -1,4 +1,6 @@
-export default function UserIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function UserIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/VectorIcon.tsx b/packages/client/src/svgs/VectorIcon.tsx
index 57aaa363ee4..3889680f649 100644
--- a/packages/client/src/svgs/VectorIcon.tsx
+++ b/packages/client/src/svgs/VectorIcon.tsx
@@ -1,4 +1,6 @@
-export default function VectorIcon({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function VectorIcon({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="20"
diff --git a/packages/client/src/svgs/VideoPaths.tsx b/packages/client/src/svgs/VideoPaths.tsx
index 6876824e42d..9a28e1dd4ea 100644
--- a/packages/client/src/svgs/VideoPaths.tsx
+++ b/packages/client/src/svgs/VideoPaths.tsx
@@ -1,4 +1,6 @@
-export default function VideoPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function VideoPaths(): JSX.Element {
   return (
     <>
       {/* Video container - rounded rectangle (not filled) */}
diff --git a/packages/client/src/svgs/VolumeIcon.tsx b/packages/client/src/svgs/VolumeIcon.tsx
index f08784e8846..42e043a499b 100644
--- a/packages/client/src/svgs/VolumeIcon.tsx
+++ b/packages/client/src/svgs/VolumeIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function VolumeIcon({ className = '', size = '1em' }) {
+export default function VolumeIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 24"
diff --git a/packages/client/src/svgs/VolumeMuteIcon.tsx b/packages/client/src/svgs/VolumeMuteIcon.tsx
index 29a9954503f..6f6aa8f0b5f 100644
--- a/packages/client/src/svgs/VolumeMuteIcon.tsx
+++ b/packages/client/src/svgs/VolumeMuteIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function VolumeMuteIcon({ className = '', size = '1em' }) {
+export default function VolumeMuteIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 24"
diff --git a/packages/client/src/svgs/XAIcon.tsx b/packages/client/src/svgs/XAIcon.tsx
index 2ee679dcd3f..ea4a1fc8b56 100644
--- a/packages/client/src/svgs/XAIcon.tsx
+++ b/packages/client/src/svgs/XAIcon.tsx
@@ -1,6 +1,11 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function XAIcon({ className = '' }) {
+export default function XAIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/theme/atoms/themeAtoms.ts b/packages/client/src/theme/atoms/themeAtoms.ts
index 0babc4036b7..5923b181839 100644
--- a/packages/client/src/theme/atoms/themeAtoms.ts
+++ b/packages/client/src/theme/atoms/themeAtoms.ts
@@ -1,36 +1,49 @@
 // This file is kept for backward compatibility but is no longer used internally.
 // Theme state is now managed via React useState + localStorage in ThemeProvider.
 
-import { atomWithStorage } from 'jotai/utils';
+import { WritableAtom } from 'jotai';
+import { atomWithStorage, RESET } from 'jotai/utils';
 import { IThemeRGB } from '../types';
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeModeAtom = atomWithStorage<string>('color-theme', 'system', undefined, {
+export const themeModeAtom: WritableAtom<
+  string,
+  [string | typeof RESET | ((prev: string) => string | typeof RESET)],
+  void
+> = atomWithStorage<string>('color-theme', 'system', undefined, {
   getOnInit: true,
 });
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeColorsAtom = atomWithStorage<IThemeRGB | undefined>(
-  'theme-colors',
-  undefined,
-  undefined,
-  {
-    getOnInit: true,
-  },
-);
+export const themeColorsAtom: WritableAtom<
+  IThemeRGB | undefined,
+  [
+    | IThemeRGB
+    | typeof RESET
+    | ((prev: IThemeRGB | undefined) => IThemeRGB | typeof RESET | undefined)
+    | undefined,
+  ],
+  void
+> = atomWithStorage<IThemeRGB | undefined>('theme-colors', undefined, undefined, {
+  getOnInit: true,
+});
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeNameAtom = atomWithStorage<string | undefined>(
-  'theme-name',
-  undefined,
-  undefined,
-  {
-    getOnInit: true,
-  },
-);
+export const themeNameAtom: WritableAtom<
+  string | undefined,
+  [
+    | string
+    | typeof RESET
+    | ((prev: string | undefined) => string | typeof RESET | undefined)
+    | undefined,
+  ],
+  void
+> = atomWithStorage<string | undefined>('theme-name', undefined, undefined, {
+  getOnInit: true,
+});
diff --git a/packages/client/src/theme/context/ThemeProvider.tsx b/packages/client/src/theme/context/ThemeProvider.tsx
index 30773d222a4..8872fd62108 100644
--- a/packages/client/src/theme/context/ThemeProvider.tsx
+++ b/packages/client/src/theme/context/ThemeProvider.tsx
@@ -1,6 +1,15 @@
-import React, { createContext, useContext, useEffect, useMemo, useCallback, useState, useRef } from 'react';
-import { IThemeRGB } from '../types';
+import React, {
+  createContext,
+  useContext,
+  useEffect,
+  useMemo,
+  useCallback,
+  useState,
+  useRef,
+} from 'react';
+import { JSX } from 'react/jsx-runtime';
 import applyTheme from '../utils/applyTheme';
+import { IThemeRGB } from '../types';
 
 const THEME_KEY = 'color-theme';
 const THEME_COLORS_KEY = 'theme-colors';
@@ -17,7 +26,7 @@ type ThemeContextType = {
 };
 
 // Export ThemeContext so it can be imported from hooks
-export const ThemeContext = createContext<ThemeContextType>({
+export const ThemeContext: React.Context<ThemeContextType> = createContext<ThemeContextType>({
   theme: 'system',
   setTheme: () => undefined,
   setThemeRGB: () => undefined,
@@ -115,7 +124,7 @@ export function ThemeProvider({
   themeRGB: propThemeRGB,
   themeName: propThemeName,
   initialTheme,
-}: ThemeProviderProps) {
+}: ThemeProviderProps): JSX.Element {
   const [theme, setThemeState] = useState<string>(getInitialTheme);
   const [themeRGB, setThemeRGBState] = useState<IThemeRGB | undefined>(getInitialThemeColors);
   const [themeName, setThemeNameState] = useState<string | undefined>(getInitialThemeName);
@@ -246,7 +255,7 @@ export function ThemeProvider({
 /**
  * Hook to access the current theme context
  */
-export function useTheme() {
+export function useTheme(): ThemeContextType {
   const context = useContext(ThemeContext);
   if (!context) {
     throw new Error('useTheme must be used within a ThemeProvider');
diff --git a/packages/client/src/theme/utils/applyTheme.ts b/packages/client/src/theme/utils/applyTheme.ts
index f98db54dd8c..b3fc4514b8c 100644
--- a/packages/client/src/theme/utils/applyTheme.ts
+++ b/packages/client/src/theme/utils/applyTheme.ts
@@ -93,7 +93,7 @@ function mapTheme(rgb: IThemeRGB): Partial<IThemeVariables> {
  * Applies theme to the document root
  * Sets CSS variables as rgb() values for compatibility with existing CSS
  */
-export default function applyTheme(themeRGB?: IThemeRGB) {
+export default function applyTheme(themeRGB?: IThemeRGB): void {
   if (!themeRGB) return;
 
   const themeObject = mapTheme(themeRGB);
diff --git a/packages/client/src/utils/logger.ts b/packages/client/src/utils/logger.ts
index 73e4fac5a5f..4830ba7fe46 100644
--- a/packages/client/src/utils/logger.ts
+++ b/packages/client/src/utils/logger.ts
@@ -24,7 +24,14 @@ const createLogFunction = (
   };
 };
 
-const logger = {
+const logger: {
+  log: LogFunction;
+  dir: LogFunction;
+  warn: LogFunction;
+  info: LogFunction;
+  error: LogFunction;
+  debug: LogFunction;
+} = {
   log: createLogFunction(console.log, 'log'),
   dir: createLogFunction(console.dir, 'dir'),
   warn: createLogFunction(console.warn, 'warn'),
diff --git a/packages/client/src/utils/theme.ts b/packages/client/src/utils/theme.ts
index a5bc645a07a..e84e05f45ce 100644
--- a/packages/client/src/utils/theme.ts
+++ b/packages/client/src/utils/theme.ts
@@ -1,4 +1,4 @@
-export const applyFontSize = (val: string) => {
+export const applyFontSize = (val: string): void => {
   const root = document.documentElement;
   const size = val.split('-')[1]; // This will be 'xs', 'sm', 'base', 'lg', or 'xl'
 
@@ -21,7 +21,7 @@ export const applyFontSize = (val: string) => {
   }
 };
 
-export const getInitialTheme = () => {
+export const getInitialTheme = (): string => {
   if (typeof window !== 'undefined' && window.localStorage) {
     const storedPrefs = window.localStorage.getItem('color-theme');
     if (typeof storedPrefs === 'string') {
diff --git a/packages/client/tsconfig.json b/packages/client/tsconfig.json
index e15bc2ab53d..65b1eb1f72b 100644
--- a/packages/client/tsconfig.json
+++ b/packages/client/tsconfig.json
@@ -8,6 +8,7 @@
     "declaration": true,
     "declarationMap": true,
     "declarationDir": "./dist/types",
+    "isolatedDeclarations": true,
     "sourceMap": true,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
diff --git a/packages/client/tsdown.config.mjs b/packages/client/tsdown.config.mjs
new file mode 100644
index 00000000000..a027189ce6a
--- /dev/null
+++ b/packages/client/tsdown.config.mjs
@@ -0,0 +1,33 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+// Mirror the prior Rollup `@rollup/plugin-replace` substitutions: only these three are
+// baked at lib-build time. `import.meta.env.MODE` and `REACT_APP_*` are intentionally left
+// intact so the consuming Vite app resolves them at app-build time.
+const define = {
+  'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV || 'production'),
+  'process.env.VITE_ENABLE_LOGGER': JSON.stringify(process.env.VITE_ENABLE_LOGGER || 'false'),
+  'process.env.VITE_LOGGER_FILTER': JSON.stringify(process.env.VITE_LOGGER_FILTER || ''),
+};
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  format: ['esm', 'cjs'],
+  platform: 'browser',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Force .mjs/.cjs (and .d.mts/.d.cts) regardless of package `type`, so the package can stay
+  // CommonJS (jest.config.js / babel.config.js are CJS) while still shipping dual ESM/CJS.
+  fixedExtension: true,
+  define,
+  // Extract all component CSS into a single `dist/style.css` (no import left in the JS, so the
+  // CJS output stays valid CommonJS). Consumers import `@librechat/client/style.css` once.
+  css: { inject: false },
+  // Externalize every third-party import (consumers provide the peers + react/jsx-runtime);
+  // bundle only relative, `~`-aliased, and absolute sources.
+  deps: {
+    neverBundle: (id) => !id.startsWith('.') && !id.startsWith('~') && !path.isAbsolute(id),
+    onlyBundle: false,
+  },
+});
diff --git a/packages/data-provider/package.json b/packages/data-provider/package.json
index e507d31e281..a3307a11faf 100644
--- a/packages/data-provider/package.json
+++ b/packages/data-provider/package.json
@@ -1,19 +1,19 @@
 {
   "name": "librechat-data-provider",
-  "version": "0.8.502",
+  "version": "0.8.509",
   "description": "data services for librechat apps",
   "main": "dist/index.js",
-  "module": "dist/index.es.js",
+  "module": "dist/index.mjs",
   "types": "./dist/types/index.d.ts",
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
+      "import": "./dist/index.mjs",
       "require": "./dist/index.js",
       "types": "./dist/types/index.d.ts"
     },
     "./react-query": {
-      "import": "./dist/react-query/index.es.js",
+      "import": "./dist/react-query/index.mjs",
       "require": "./dist/react-query/index.js",
       "types": "./dist/types/react-query/index.d.ts"
     }
@@ -23,14 +23,14 @@
   ],
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w",
+    "build": "npm run clean && tsdown && tsc -p tsconfig.build.json",
+    "build:watch": "tsdown --watch",
     "rollup:api": "npx rollup -c server-rollup.config.js --bundleConfigAsCjs",
     "test": "jest --coverage --watch",
     "test:ci": "jest --coverage --ci --logHeapUsage",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs"
+    "b:build": "bun run b:clean && bun run tsdown && bun run tsc -p tsconfig.build.json"
   },
   "repository": {
     "type": "git",
@@ -45,7 +45,7 @@
   "dependencies": {
     "axios": "^1.16.0",
     "dayjs": "^1.11.13",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "zod": "^3.22.4"
   },
   "devDependencies": {
@@ -57,20 +57,18 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^15.1.0",
     "@rollup/plugin-replace": "^5.0.5",
-    "@rollup/plugin-terser": "^1.0.0",
     "@types/jest": "^29.5.2",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.3.0",
+    "@types/node": "^24.12.4",
     "@types/react": "^18.2.18",
     "@types/winston": "^2.4.4",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "openapi-types": "^12.1.3",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
-    "rollup-plugin-peer-deps-external": "^2.2.4",
-    "rollup-plugin-typescript2": "^0.37.0",
-    "typescript": "^5.0.4"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^4.28.0"
diff --git a/packages/data-provider/react-query/package-lock.json b/packages/data-provider/react-query/package-lock.json
index 6653102f4fa..822eedea480 100644
--- a/packages/data-provider/react-query/package-lock.json
+++ b/packages/data-provider/react-query/package-lock.json
@@ -140,16 +140,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -241,9 +241,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
diff --git a/packages/data-provider/react-query/package.json b/packages/data-provider/react-query/package.json
index b426c6386aa..83ca09ddc23 100644
--- a/packages/data-provider/react-query/package.json
+++ b/packages/data-provider/react-query/package.json
@@ -6,5 +6,8 @@
   "types": "../dist/types/react-query/index.d.ts",
   "dependencies": {
     "axios": "^1.16.0"
+  },
+  "overrides": {
+    "form-data": "^4.0.6"
   }
 }
diff --git a/packages/data-provider/rollup.config.js b/packages/data-provider/rollup.config.js
deleted file mode 100644
index 95cb5206d8d..00000000000
--- a/packages/data-provider/rollup.config.js
+++ /dev/null
@@ -1,74 +0,0 @@
-import typescript from 'rollup-plugin-typescript2';
-import resolve from '@rollup/plugin-node-resolve';
-import pkg from './package.json';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-import commonjs from '@rollup/plugin-commonjs';
-import replace from '@rollup/plugin-replace';
-import terser from '@rollup/plugin-terser';
-
-const plugins = [
-  peerDepsExternal(),
-  resolve(),
-  replace({
-    __IS_DEV__: process.env.NODE_ENV === 'development',
-  }),
-  commonjs(),
-  typescript({
-    tsconfig: './tsconfig.json',
-    useTsconfigDeclarationDir: true,
-  }),
-  terser(),
-];
-
-export default [
-  {
-    input: 'src/index.ts',
-    output: [
-      {
-        file: pkg.main,
-        format: 'cjs',
-        sourcemap: true,
-        exports: 'named',
-      },
-      {
-        file: pkg.module,
-        format: 'esm',
-        sourcemap: true,
-        exports: 'named',
-      },
-    ],
-    ...{
-      external: [
-        ...Object.keys(pkg.dependencies || {}),
-        ...Object.keys(pkg.devDependencies || {}),
-        ...Object.keys(pkg.peerDependencies || {}),
-        'react',
-        'react-dom',
-      ],
-      preserveSymlinks: true,
-      plugins,
-    },
-  },
-  // Separate bundle for react-query related part
-  {
-    input: 'src/react-query/index.ts',
-    output: [
-      {
-        file: 'dist/react-query/index.es.js',
-        format: 'esm',
-        exports: 'named',
-        sourcemap: true,
-      },
-    ],
-    external: [
-      ...Object.keys(pkg.dependencies || {}),
-      ...Object.keys(pkg.devDependencies || {}),
-      ...Object.keys(pkg.peerDependencies || {}),
-      'react',
-      'react-dom',
-      // 'librechat-data-provider', // Marking main part as external
-    ],
-    preserveSymlinks: true,
-    plugins,
-  },
-];
diff --git a/packages/data-provider/specs/bedrock.spec.ts b/packages/data-provider/specs/bedrock.spec.ts
index bbb57310c63..1d0a804fc3e 100644
--- a/packages/data-provider/specs/bedrock.spec.ts
+++ b/packages/data-provider/specs/bedrock.spec.ts
@@ -1,7 +1,8 @@
-import { ThinkingDisplay } from '../src/schemas';
+import { ThinkingDisplay, isMythosClassModel, MYTHOS_CLASS_FAMILIES } from '../src/schemas';
 import {
   BEDROCK_OUTPUT_128K_BETA,
   supportsAdaptiveThinking,
+  omitsSamplingParameters,
   omitsThinkingByDefault,
   resolveThinkingDisplay,
   bedrockOutputParser,
@@ -13,6 +14,23 @@ import {
 
 const BEDROCK_CLAUDE_4_BETAS = [BEDROCK_OUTPUT_128K_BETA, BEDROCK_FINE_GRAINED_TOOL_STREAMING_BETA];
 
+describe('isMythosClassModel (single source of truth for Fable/Mythos)', () => {
+  test('matches every declared family across naming variants', () => {
+    MYTHOS_CLASS_FAMILIES.forEach((family) => {
+      expect(isMythosClassModel(`claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`anthropic.claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`us.anthropic.claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`claude-${family}-5-20260609`)).toBe(true);
+    });
+  });
+
+  test('does not match opus/sonnet/haiku or unrelated models', () => {
+    ['claude-opus-4-8', 'claude-sonnet-4-6', 'claude-haiku-4-5', 'gpt-4o', ''].forEach((model) => {
+      expect(isMythosClassModel(model)).toBe(false);
+    });
+  });
+});
+
 describe('supportsAdaptiveThinking', () => {
   test('should return true for claude-opus-4-6', () => {
     expect(supportsAdaptiveThinking('claude-opus-4-6')).toBe(true);
@@ -42,6 +60,13 @@ describe('supportsAdaptiveThinking', () => {
     expect(supportsAdaptiveThinking('claude-sonnet-6')).toBe(true);
   });
 
+  test('should return true for Mythos-class models (Fable / Mythos)', () => {
+    expect(supportsAdaptiveThinking('claude-fable-5')).toBe(true);
+    expect(supportsAdaptiveThinking('claude-mythos-5')).toBe(true);
+    expect(supportsAdaptiveThinking('anthropic.claude-fable-5')).toBe(true);
+    expect(supportsAdaptiveThinking('us.anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('should return false for claude-opus-4-5', () => {
     expect(supportsAdaptiveThinking('claude-opus-4-5')).toBe(false);
   });
@@ -160,6 +185,12 @@ describe('supportsContext1m', () => {
     expect(supportsContext1m('claude-opus-5')).toBe(true);
   });
 
+  test('should return true for Mythos-class models (Fable / Mythos)', () => {
+    expect(supportsContext1m('claude-fable-5')).toBe(true);
+    expect(supportsContext1m('claude-mythos-5')).toBe(true);
+    expect(supportsContext1m('anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('should return false for claude-opus-4-5', () => {
     expect(supportsContext1m('claude-opus-4-5')).toBe(false);
   });
@@ -222,7 +253,7 @@ describe('omitsThinkingByDefault', () => {
     expect(omitsThinkingByDefault('us.anthropic.claude-opus-4-7')).toBe(true);
   });
 
-  test('returns true for claude-opus-4-8 (future Opus 4.x)', () => {
+  test('returns true for claude-opus-4-8', () => {
     expect(omitsThinkingByDefault('claude-opus-4-8')).toBe(true);
   });
 
@@ -234,10 +265,21 @@ describe('omitsThinkingByDefault', () => {
     expect(omitsThinkingByDefault('claude-opus-9')).toBe(true);
   });
 
+  test('returns true for Mythos-class models (Fable / Mythos)', () => {
+    expect(omitsThinkingByDefault('claude-fable-5')).toBe(true);
+    expect(omitsThinkingByDefault('claude-mythos-5')).toBe(true);
+    expect(omitsThinkingByDefault('anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('returns false for claude-opus-4-6 (adaptive but pre-4.7)', () => {
     expect(omitsThinkingByDefault('claude-opus-4-6')).toBe(false);
   });
 
+  test('returns false for base Opus 4 snapshot IDs', () => {
+    expect(omitsThinkingByDefault('claude-opus-4-20250514')).toBe(false);
+    expect(omitsThinkingByDefault('anthropic.claude-opus-4-20250514-v1:0')).toBe(false);
+  });
+
   test('returns false for claude-opus-4-5', () => {
     expect(omitsThinkingByDefault('claude-opus-4-5')).toBe(false);
   });
@@ -264,6 +306,49 @@ describe('omitsThinkingByDefault', () => {
   });
 });
 
+describe('omitsSamplingParameters', () => {
+  test('returns true for Opus 4.7+ models', () => {
+    const models = [
+      'claude-opus-4-7',
+      'claude-opus-4-8',
+      'anthropic.claude-opus-4-8',
+      'us.anthropic.claude-opus-4-8',
+      'claude-opus-5',
+    ];
+
+    models.forEach((model) => {
+      expect(omitsSamplingParameters(model)).toBe(true);
+    });
+  });
+
+  test('returns true for Mythos-class models (Fable / Mythos)', () => {
+    const models = [
+      'claude-fable-5',
+      'claude-mythos-5',
+      'anthropic.claude-fable-5',
+      'us.anthropic.claude-fable-5',
+    ];
+
+    models.forEach((model) => {
+      expect(omitsSamplingParameters(model)).toBe(true);
+    });
+  });
+
+  test('returns false for older Opus and non-Opus models', () => {
+    const models = [
+      'claude-opus-4-20250514',
+      'anthropic.claude-opus-4-20250514-v1:0',
+      'claude-opus-4-1-20250805',
+      'claude-opus-4-6',
+      'claude-sonnet-4-7',
+    ];
+
+    models.forEach((model) => {
+      expect(omitsSamplingParameters(model)).toBe(false);
+    });
+  });
+});
+
 describe('resolveThinkingDisplay', () => {
   test('returns "summarized" for Opus 4.7 when explicit is auto/null/undefined', () => {
     expect(resolveThinkingDisplay('claude-opus-4-7', ThinkingDisplay.auto)).toBe('summarized');
@@ -541,6 +626,75 @@ describe('bedrockInputParser', () => {
       expect(additionalFields.effort).toBeUndefined();
     });
 
+    test('should strip sampling parameters for Opus 4.8 Bedrock models', () => {
+      const input = {
+        model: 'anthropic.claude-opus-4-8',
+        temperature: 0.7,
+        topP: 0.9,
+        topK: 40,
+        top_p: 0.8,
+        additionalModelRequestFields: {
+          custom_flag: true,
+          temperature: 0.5,
+          topP: 0.95,
+          top_k: 20,
+        },
+      };
+      const result = bedrockInputParser.parse(input) as Record<string, unknown>;
+      const additionalFields = result.additionalModelRequestFields as Record<string, unknown>;
+      expect(result.temperature).toBeUndefined();
+      expect(result.topP).toBeUndefined();
+      expect(additionalFields.temperature).toBeUndefined();
+      expect(additionalFields.topP).toBeUndefined();
+      expect(additionalFields.top_p).toBeUndefined();
+      expect(additionalFields.top_k).toBeUndefined();
+      expect(additionalFields.custom_flag).toBe(true);
+      expect(additionalFields.thinking).toEqual({ type: 'adaptive', display: 'summarized' });
+      expect(additionalFields.anthropic_beta).toEqual(BEDROCK_CLAUDE_4_BETAS);
+    });
+
+    test('should preserve sampling parameters for Opus 4.6 Bedrock models', () => {
+      const input = {
+        model: 'anthropic.claude-opus-4-6-v1',
+        temperature: 0.7,
+        topP: 0.9,
+        topK: 40,
+      };
+      const result = bedrockInputParser.parse(input) as Record<string, unknown>;
+      const additionalFields = result.additionalModelRequestFields as Record<string, unknown>;
+      expect(result.temperature).toBe(0.7);
+      expect(result.topP).toBe(0.9);
+      expect(additionalFields.top_k).toBe(40);
+    });
+
+    test('should set adaptive thinking and strip sampling params for Fable 5 Bedrock models', () => {
+      const input = {
+        model: 'anthropic.claude-fable-5',
+        effort: 'high',
+        temperature: 0.7,
+        topP: 0.9,
+        topK: 40,
+        top_p: 0.8,
+        additionalModelRequestFields: {
+          custom_flag: true,
+          temperature: 0.5,
+          top_k: 20,
+        },
+      };
+      const result = bedrockInputParser.parse(input) as Record<string, unknown>;
+      const additionalFields = result.additionalModelRequestFields as Record<string, unknown>;
+      expect(result.temperature).toBeUndefined();
+      expect(result.topP).toBeUndefined();
+      expect(additionalFields.temperature).toBeUndefined();
+      expect(additionalFields.top_p).toBeUndefined();
+      expect(additionalFields.top_k).toBeUndefined();
+      expect(additionalFields.custom_flag).toBe(true);
+      expect(additionalFields.thinking).toEqual({ type: 'adaptive', display: 'summarized' });
+      expect(additionalFields.output_config).toEqual({ effort: 'high' });
+      /** Mythos-class models do not receive the legacy output-128k / fine-grained-tool-streaming betas. */
+      expect(additionalFields.anthropic_beta).toBeUndefined();
+    });
+
     test('should set thinking.display to "summarized" so Opus 4.7 returns reasoning blocks', () => {
       const input = {
         model: 'anthropic.claude-opus-4-7',
@@ -1117,4 +1271,34 @@ describe('bedrockInputParser', () => {
       expect(amrf.reasoning_config).toBeUndefined();
     });
   });
+
+  describe('promptCacheTtl tied to promptCache', () => {
+    test('preserves promptCacheTtl when caching is enabled (claude default)', () => {
+      const result = bedrockInputParser.parse({
+        model: 'anthropic.claude-opus-4-6-v1',
+        promptCacheTtl: '1h',
+      }) as Record<string, unknown>;
+      expect(result.promptCache).toBe(true);
+      expect(result.promptCacheTtl).toBe('1h');
+    });
+
+    test('clears promptCacheTtl when promptCache is explicitly disabled', () => {
+      const result = bedrockInputParser.parse({
+        model: 'anthropic.claude-opus-4-6-v1',
+        promptCache: false,
+        promptCacheTtl: '1h',
+      }) as Record<string, unknown>;
+      expect(result.promptCacheTtl).toBeUndefined();
+    });
+
+    test('clears promptCache and promptCacheTtl for non-caching models', () => {
+      const result = bedrockInputParser.parse({
+        model: 'meta.llama3-1-70b-instruct-v1:0',
+        promptCache: true,
+        promptCacheTtl: '1h',
+      }) as Record<string, unknown>;
+      expect(result.promptCache).toBeUndefined();
+      expect(result.promptCacheTtl).toBeUndefined();
+    });
+  });
 });
diff --git a/packages/data-provider/specs/config-schemas.spec.ts b/packages/data-provider/specs/config-schemas.spec.ts
index b27f804726e..236295483b9 100644
--- a/packages/data-provider/specs/config-schemas.spec.ts
+++ b/packages/data-provider/specs/config-schemas.spec.ts
@@ -3,14 +3,22 @@ import {
   agentsEndpointSchema,
   azureEndpointSchema,
   endpointSchema,
+  RetentionMode,
   configSchema,
   interfaceSchema,
   fileStorageSchema,
   fileStrategiesSchema,
+  SKILL_SYNC_MAX_INTERVAL_MINUTES,
   summarizationTriggerSchema,
   summarizationConfigSchema,
+  MAX_SUBAGENTS,
 } from '../src/config';
-import { tModelSpecPresetSchema, EModelEndpoint } from '../src/schemas';
+import {
+  tModelSpecPresetSchema,
+  EModelEndpoint,
+  ReasoningParameterFormat,
+  ReasoningResponseKey,
+} from '../src/schemas';
 import { specsConfigSchema } from '../src/models';
 import { FileSources } from '../src/types/files';
 
@@ -305,6 +313,58 @@ describe('endpointSchema addParams validation', () => {
     expect(result.success).toBe(true);
   });
 
+  it('accepts custom reasoning format config', () => {
+    const result = endpointSchema.safeParse({
+      ...validEndpoint,
+      customParams: {
+        reasoningFormat: ReasoningParameterFormat.reasoningObject,
+      },
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.customParams?.reasoningFormat).toBe(
+        ReasoningParameterFormat.reasoningObject,
+      );
+    }
+  });
+
+  it('rejects invalid custom reasoning format config', () => {
+    const result = endpointSchema.safeParse({
+      ...validEndpoint,
+      customParams: {
+        reasoningFormat: 'provider_magic',
+      },
+    });
+
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts custom reasoning response key config', () => {
+    const result = endpointSchema.safeParse({
+      ...validEndpoint,
+      customParams: {
+        reasoningKey: ReasoningResponseKey.reasoning,
+      },
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.customParams?.reasoningKey).toBe(ReasoningResponseKey.reasoning);
+    }
+  });
+
+  it('rejects invalid custom reasoning response key config', () => {
+    const result = endpointSchema.safeParse({
+      ...validEndpoint,
+      customParams: {
+        reasoningKey: 'reasoning_text',
+      },
+    });
+
+    expect(result.success).toBe(false);
+  });
+
   it('rejects non-boolean web_search objects in addParams', () => {
     const result = endpointSchema.safeParse({
       ...validEndpoint,
@@ -622,6 +682,294 @@ describe('configSchema fileStrategy', () => {
   });
 });
 
+describe('configSchema skillSync', () => {
+  it('accepts a GitHub skill sync source with explicit paths and credential key', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills', '.'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.paths).toEqual(['skills', '']);
+    expect(result.data?.skillSync?.github?.sources[0]?.skillDiscoveryDepth).toBeUndefined();
+  });
+
+  it('accepts a GitHub skill sync source with an env-backed token and discovery depth', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'mattpocock-skills',
+              owner: 'mattpocock',
+              repo: 'skills',
+              paths: ['skills'],
+              skillDiscoveryDepth: 3,
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.token).toBe('${GITHUB_SKILLS_TOKEN}');
+    expect(result.data?.skillSync?.github?.sources[0]?.skillDiscoveryDepth).toBe(3);
+  });
+
+  it('accepts an optional tenantId on a GitHub skill sync source', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-a',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.tenantId).toBe('tenant-a');
+  });
+
+  it('rejects the reserved system tenant id on a GitHub skill sync source', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: '__SYSTEM__',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects enabled GitHub skill sync without sources', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync intervals below five minutes', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 4,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync intervals above the Node timer limit', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: SKILL_SYNC_MAX_INTERVAL_MINUTES + 1,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects unsafe GitHub skill sync paths and credential keys', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['../skills'],
+              credentialKey: '../token',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync sources without credentials or with literal tokens', () => {
+    const missingCredential = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+            },
+          ],
+        },
+      },
+    });
+    const literalToken = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              token: 'github_pat_secret',
+            },
+          ],
+        },
+      },
+    });
+    const duplicateCredentialSources = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+    });
+    expect(missingCredential.success).toBe(false);
+    expect(literalToken.success).toBe(false);
+    expect(duplicateCredentialSources.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync discovery depths outside the allowed range', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              skillDiscoveryDepth: 11,
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects malformed GitHub skill sync refs during config validation', () => {
+    const invalidRefs = [
+      'feature branch',
+      'release:2026',
+      'bad?ref',
+      'bad*ref',
+      '[bad]',
+      '@{upstream}',
+      'main.lock',
+    ];
+
+    for (const ref of invalidRefs) {
+      const result = configSchema.safeParse({
+        version: '1.3.11',
+        skillSync: {
+          github: {
+            enabled: true,
+            sources: [
+              {
+                id: 'librechat-skills',
+                owner: 'LibreChat',
+                repo: 'skills',
+                ref,
+                paths: ['skills'],
+                credentialKey: 'github-skills-prod',
+              },
+            ],
+          },
+        },
+      });
+      expect(result.success).toBe(false);
+    }
+  });
+});
+
 describe('interfaceSchema', () => {
   it('silently strips removed legacy fields', () => {
     const result = interfaceSchema.parse({
@@ -633,6 +981,30 @@ describe('interfaceSchema', () => {
     expect(result).not.toHaveProperty('sidePanel');
     expect(result.modelSelect).toBe(false);
   });
+
+  it('accepts retainAgentFiles with all-data retention', () => {
+    const result = interfaceSchema.parse({
+      retentionMode: RetentionMode.ALL,
+      retainAgentFiles: true,
+    });
+
+    expect(result.retentionMode).toBe(RetentionMode.ALL);
+    expect(result.retainAgentFiles).toBe(true);
+  });
+
+  it('accepts defaultPinnedTools as a string array', () => {
+    const result = interfaceSchema.parse({
+      defaultPinnedTools: ['artifacts', 'execute_code', 'mcp'],
+    });
+
+    expect(result.defaultPinnedTools).toEqual(['artifacts', 'execute_code', 'mcp']);
+  });
+
+  it('leaves defaultPinnedTools undefined when not provided', () => {
+    const result = interfaceSchema.parse({ modelSelect: true });
+
+    expect(result.defaultPinnedTools).toBeUndefined();
+  });
 });
 
 describe('summarizationTriggerSchema', () => {
@@ -767,15 +1139,42 @@ describe('specsConfigSchema', () => {
         {
           name: 'spec-1',
           label: 'Spec 1',
+          hideBadgeRow: true,
+          softDefault: true,
           preset: { endpoint: EModelEndpoint.openAI },
+          subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_researcher'] },
         },
       ],
     });
     expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.list[0].hideBadgeRow).toBe(true);
+      expect(result.data.list[0].softDefault).toBe(true);
+      expect(result.data.list[0].subagents).toEqual({
+        enabled: true,
+        allowSelf: true,
+        agent_ids: ['agent_researcher'],
+      });
+    }
   });
 
   it('still rejects null list', () => {
     const result = specsConfigSchema.safeParse({ list: null });
     expect(result.success).toBe(false);
   });
+
+  it('rejects model spec subagent ids above the shared cap', () => {
+    const oversized = Array.from({ length: MAX_SUBAGENTS + 1 }, (_, i) => `agent_${i}`);
+    const result = specsConfigSchema.safeParse({
+      list: [
+        {
+          name: 'spec-1',
+          label: 'Spec 1',
+          preset: { endpoint: EModelEndpoint.openAI },
+          subagents: { enabled: true, agent_ids: oversized },
+        },
+      ],
+    });
+    expect(result.success).toBe(false);
+  });
 });
diff --git a/packages/data-provider/specs/mcp.spec.ts b/packages/data-provider/specs/mcp.spec.ts
index 573769c4fad..a52e2f59e95 100644
--- a/packages/data-provider/specs/mcp.spec.ts
+++ b/packages/data-provider/specs/mcp.spec.ts
@@ -1,6 +1,53 @@
-import { SSEOptionsSchema, MCPServerUserInputSchema } from '../src/mcp';
+import {
+  MCPOptionsSchema,
+  SSEOptionsSchema,
+  StreamableHTTPOptionsSchema,
+  MCPServerUserInputSchema,
+  MCP_USER_INPUT_FIELDS,
+} from '../src/mcp';
 
-describe('MCPServerUserInputSchema', () => {
+describe('MCPOptionsSchema', () => {
+  describe('OBO transport support', () => {
+    it('should accept obo on SSE transport', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(true);
+    });
+
+    it('should accept obo on streamable-http transport', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(true);
+    });
+
+    it('should reject obo on WebSocket transport', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'websocket',
+        url: 'wss://mcp-server.com/ws',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject obo on stdio transport', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'stdio',
+        command: 'node',
+        args: ['server.js'],
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(false);
+    });
+  });
+});
+
+describe('MCP schemas', () => {
   describe('env variable exfiltration prevention', () => {
     it('should confirm admin schema resolves env vars (attack vector baseline)', () => {
       process.env.FAKE_SECRET = 'leaked-secret-value';
@@ -26,6 +73,115 @@ describe('MCPServerUserInputSchema', () => {
     });
   });
 
+  describe('OAuth URL env variable resolution (admin schema)', () => {
+    const OAUTH_AUTH_URL = 'https://auth.example.com/authorize';
+    const OAUTH_TOKEN_URL = 'https://auth.example.com/token';
+    const OAUTH_REDIRECT_URI = 'https://app.example.com/callback';
+    const OAUTH_REVOCATION_URL = 'https://auth.example.com/revoke';
+
+    beforeEach(() => {
+      process.env.OAUTH_AUTH_URL = OAUTH_AUTH_URL;
+      process.env.OAUTH_TOKEN_URL = OAUTH_TOKEN_URL;
+      process.env.OAUTH_REDIRECT_URI = OAUTH_REDIRECT_URI;
+      process.env.OAUTH_REVOCATION_URL = OAUTH_REVOCATION_URL;
+    });
+
+    afterEach(() => {
+      delete process.env.OAUTH_AUTH_URL;
+      delete process.env.OAUTH_TOKEN_URL;
+      delete process.env.OAUTH_REDIRECT_URI;
+      delete process.env.OAUTH_REVOCATION_URL;
+    });
+
+    it('should resolve env vars in authorization_url and token_url', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: '${OAUTH_AUTH_URL}',
+          token_url: '${OAUTH_TOKEN_URL}',
+          client_id: 'my-client',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.authorization_url).toBe(OAUTH_AUTH_URL);
+        expect(result.data.oauth.token_url).toBe(OAUTH_TOKEN_URL);
+      }
+    });
+
+    it('should resolve env vars in redirect_uri', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        oauth: {
+          redirect_uri: '${OAUTH_REDIRECT_URI}',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.redirect_uri).toBe(OAUTH_REDIRECT_URI);
+      }
+    });
+
+    it('should resolve env vars in revocation_endpoint', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          revocation_endpoint: '${OAUTH_REVOCATION_URL}',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.revocation_endpoint).toBe(OAUTH_REVOCATION_URL);
+      }
+    });
+
+    it('should accept plain OAuth URLs without env vars', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.direct.com/authorize',
+          token_url: 'https://auth.direct.com/token',
+          redirect_uri: 'https://app.direct.com/callback',
+          revocation_endpoint: 'https://auth.direct.com/revoke',
+          client_id: 'my-client',
+        },
+      });
+      expect(result.success).toBe(true);
+    });
+
+    it('should reject invalid URLs after env var resolution', () => {
+      process.env.OAUTH_BAD_URL = 'not-a-url';
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: '${OAUTH_BAD_URL}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.OAUTH_BAD_URL;
+    });
+
+    it('should pass through undefined when OAuth URL fields are omitted', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: { scope: 'openid' },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.authorization_url).toBeUndefined();
+        expect(result.data.oauth.token_url).toBeUndefined();
+        expect(result.data.oauth.redirect_uri).toBeUndefined();
+        expect(result.data.oauth.revocation_endpoint).toBeUndefined();
+      }
+    });
+  });
+
   describe('env variable rejection', () => {
     it('should reject SSE URLs containing env variable patterns', () => {
       const result = MCPServerUserInputSchema.safeParse({
@@ -50,6 +206,111 @@ describe('MCPServerUserInputSchema', () => {
       });
       expect(result.success).toBe(false);
     });
+
+    it('should reject OAuth authorization_url containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://attacker.example/authorize?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth token_url containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          token_url: 'https://attacker.example/token?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth redirect_uri containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          redirect_uri: 'https://attacker.example/callback?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth revocation_endpoint containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          revocation_endpoint: 'https://attacker.example/revoke?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+  });
+
+  describe('proxy field restrictions', () => {
+    it('should accept admin-configured proxies for SSE', () => {
+      const result = SSEOptionsSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        proxy: 'http://proxy.example.com:8080',
+      });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.proxy).toBe('http://proxy.example.com:8080');
+      }
+    });
+
+    it('should accept admin-configured proxies for streamable-http', () => {
+      const result = StreamableHTTPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        proxy: 'http://proxy.example.com:8080',
+      });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.proxy).toBe('http://proxy.example.com:8080');
+      }
+    });
+
+    it('should reject unsupported proxy protocols', () => {
+      const result = StreamableHTTPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        proxy: 'ftp://proxy.example.com',
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject SSE proxy configuration from user input', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        proxy: 'http://proxy.example.com:8080',
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject streamable-http proxy configuration from user input', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        proxy: 'http://proxy.example.com:8080',
+      });
+      expect(result.success).toBe(false);
+    });
   });
 
   describe('protocol allowlisting', () => {
@@ -144,4 +405,335 @@ describe('MCPServerUserInputSchema', () => {
       expect(result.success).toBe(true);
     });
   });
+
+  describe('OBO configuration', () => {
+    it('should accept obo field with valid scopes', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.obo).toEqual({
+          scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite',
+        });
+      }
+    });
+
+    it('should accept obo on streamable-http transport', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        obo: { scopes: 'api://other-app/Custom.Scope' },
+      });
+      expect(result.success).toBe(true);
+    });
+
+    it('should reject obo on WebSocket transport', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'websocket',
+        url: 'wss://mcp-server.com/ws',
+        obo: { scopes: 'api://mcp-server-id/Mcp.Tools.ReadWrite' },
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject obo with empty scopes', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        obo: { scopes: '' },
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject obo without scopes property', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        obo: {},
+      });
+      expect(result.success).toBe(false);
+    });
+
+    it('should accept config without obo (optional)', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+      });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.obo).toBeUndefined();
+      }
+    });
+  });
+
+  describe('user-managed OAuth audience restrictions', () => {
+    it('should reject audience from user-managed OAuth configuration', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          audience: 'https://api.example.com',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject refresh audience forwarding from user-managed OAuth configuration', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          forward_audience_on_refresh: false,
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject audience query parameters in user-managed OAuth authorization URLs', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize?audience=https://api.example.com',
+          token_url: 'https://auth.example.com/token',
+          client_id: 'public-client-id',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject resource query parameters in user-managed OAuth token URLs', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          token_url: 'https://auth.example.com/token?resource=https://api.example.com',
+          client_id: 'public-client-id',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should continue accepting non-audience OAuth fields from user-managed configuration', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          token_url: 'https://auth.example.com/token',
+          client_id: 'public-client-id',
+          scope: 'read execute',
+        },
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.authorization_url).toBe('https://auth.example.com/authorize');
+        expect(result.data.oauth.token_url).toBe('https://auth.example.com/token');
+        expect(result.data.oauth.client_id).toBe('public-client-id');
+        expect(result.data.oauth.scope).toBe('read execute');
+      }
+    });
+  });
+
+  describe('OAuth confidential client endpoint pinning', () => {
+    it('should reject client_secret without client_id', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          token_url: 'https://auth.example.com/token',
+          client_secret: 'client-secret',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject client_secret with client_id when authorization_url is missing', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          token_url: 'https://auth.example.com/token',
+          client_id: 'client-id',
+          client_secret: 'client-secret',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should reject client_secret with client_id when token_url is missing', () => {
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          client_id: 'client-id',
+          client_secret: 'client-secret',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should accept client_id without client_secret for auto-discovery', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          client_id: 'public-client-id',
+        },
+      });
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should accept client_secret when both OAuth endpoints are pinned', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          token_url: 'https://auth.example.com/token',
+          client_id: 'client-id',
+          client_secret: 'client-secret',
+        },
+      });
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should accept audience parameter (Auth0/Cognito-style)', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          audience: 'https://api.example.com',
+        },
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.audience).toBe('https://api.example.com');
+      }
+    });
+
+    it('should accept audience alongside scope and other OAuth fields', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+          token_url: 'https://auth.example.com/token',
+          scope: 'read execute',
+          audience: 'https://api.example.com',
+        },
+      });
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should treat audience as optional (omitting it is fine)', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          scope: 'read',
+        },
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.audience).toBeUndefined();
+      }
+    });
+
+    it('should reject empty-string audience', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          audience: '',
+        },
+      });
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should accept forward_audience_on_refresh = false (Cognito opt-out)', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          audience: 'https://api.example.com',
+          forward_audience_on_refresh: false,
+        },
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.forward_audience_on_refresh).toBe(false);
+      }
+    });
+
+    it('should treat forward_audience_on_refresh as optional', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          audience: 'https://api.example.com',
+        },
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.forward_audience_on_refresh).toBeUndefined();
+      }
+    });
+  });
+});
+
+describe('MCP_USER_INPUT_FIELDS', () => {
+  it('includes the expected user-input fields and excludes server-managed ones', () => {
+    // Sanity check on the schema-derived field set. This is the comparison
+    // surface for the OBO lockdown check in updateMCPServerController; if it
+    // drifts unexpectedly, the lockdown could miss a new field. Add new
+    // entries here when you add new user-input fields to the schema.
+    expect(MCP_USER_INPUT_FIELDS.has('type')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('url')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('title')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('description')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('iconPath')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('oauth')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('apiKey')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('obo')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('proxy')).toBe(true);
+    expect(MCP_USER_INPUT_FIELDS.has('headers')).toBe(true);
+
+    // Server-managed fields should NOT be in this set — they're stripped by
+    // omitServerManagedFields() before MCPServerUserInputSchema is built.
+    expect(MCP_USER_INPUT_FIELDS.has('startup')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('timeout')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('chatMenu')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('requiresOAuth')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('customUserVars')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('oauth_headers')).toBe(false);
+
+    // Stdio is intentionally excluded from MCPServerUserInputSchema (security
+    // posture), so its transport-only fields should not be in the set either.
+    expect(MCP_USER_INPUT_FIELDS.has('command')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('args')).toBe(false);
+    expect(MCP_USER_INPUT_FIELDS.has('env')).toBe(false);
+  });
 });
diff --git a/packages/data-provider/specs/parsers.timezone.spec.ts b/packages/data-provider/specs/parsers.timezone.spec.ts
new file mode 100644
index 00000000000..cd8583b95a8
--- /dev/null
+++ b/packages/data-provider/specs/parsers.timezone.spec.ts
@@ -0,0 +1,66 @@
+import { replaceSpecialVars } from '../src/parsers';
+
+/**
+ * Exercises real `dayjs` timezone conversion (no module mock) so the assertions
+ * hold regardless of the machine's local timezone — the anchor instant and the
+ * requested zone are both fixed.
+ */
+describe('replaceSpecialVars timezone handling', () => {
+  const anchor = '2024-01-15T18:30:00.000Z';
+
+  test('resolves {{current_datetime}} in the supplied timezone', () => {
+    const result = replaceSpecialVars({
+      text: '{{current_datetime}}',
+      now: anchor,
+      timezone: 'America/New_York',
+    });
+    expect(result).toBe('2024-01-15 13:30:00 -05:00 (Monday)');
+  });
+
+  test('resolves {{current_date}} across a day boundary into the local zone', () => {
+    const result = replaceSpecialVars({
+      text: '{{current_date}}',
+      now: '2024-01-15T02:30:00.000Z',
+      timezone: 'America/New_York',
+    });
+    expect(result).toBe('2024-01-14 (Sunday)');
+  });
+
+  test('shifts the local day forward for zones ahead of UTC', () => {
+    const result = replaceSpecialVars({
+      text: '{{current_date}} | {{current_datetime}}',
+      now: anchor,
+      timezone: 'Asia/Tokyo',
+    });
+    expect(result).toBe('2024-01-16 (Tuesday) | 2024-01-16 03:30:00 +09:00 (Tuesday)');
+  });
+
+  test('keeps {{iso_datetime}} in UTC regardless of timezone', () => {
+    const result = replaceSpecialVars({
+      text: '{{iso_datetime}}',
+      now: anchor,
+      timezone: 'Asia/Tokyo',
+    });
+    expect(result).toBe('2024-01-15T18:30:00.000Z');
+  });
+
+  test('falls back to the un-zoned anchor when the timezone is invalid', () => {
+    const withInvalid = replaceSpecialVars({
+      text: '{{current_datetime}}',
+      now: anchor,
+      timezone: 'Not/AZone',
+    });
+    const withNone = replaceSpecialVars({ text: '{{current_datetime}}', now: anchor });
+    expect(withInvalid).toBe(withNone);
+  });
+
+  test('ignores an empty timezone string', () => {
+    const withEmpty = replaceSpecialVars({
+      text: '{{current_datetime}}',
+      now: anchor,
+      timezone: '',
+    });
+    const withNone = replaceSpecialVars({ text: '{{current_datetime}}', now: anchor });
+    expect(withEmpty).toBe(withNone);
+  });
+});
diff --git a/packages/data-provider/specs/request-interceptor-subdir.spec.ts b/packages/data-provider/specs/request-interceptor-subdir.spec.ts
new file mode 100644
index 00000000000..82d83a677a2
--- /dev/null
+++ b/packages/data-provider/specs/request-interceptor-subdir.spec.ts
@@ -0,0 +1,158 @@
+/**
+ * @jest-environment @happy-dom/jest-environment
+ */
+import axios from 'axios';
+import { setTokenHeader } from '../src/headers-helpers';
+
+const mockAdapter = jest.fn();
+let originalAdapter: typeof axios.defaults.adapter;
+let savedLocation: Location;
+let baseElement: HTMLBaseElement;
+let originalProcessBrowser: boolean | undefined;
+
+beforeAll(async () => {
+  originalAdapter = axios.defaults.adapter;
+  axios.defaults.adapter = mockAdapter;
+
+  baseElement = document.createElement('base');
+  baseElement.setAttribute('href', '/chat/');
+  document.head.appendChild(baseElement);
+
+  const proc = process as typeof process & { browser?: boolean };
+  originalProcessBrowser = proc.browser;
+  proc.browser = true;
+
+  await import('../src/request');
+});
+
+beforeEach(() => {
+  mockAdapter.mockReset();
+  savedLocation = window.location;
+});
+
+afterAll(() => {
+  axios.defaults.adapter = originalAdapter;
+  document.head.removeChild(baseElement);
+
+  const proc = process as typeof process & { browser?: boolean };
+  if (originalProcessBrowser === undefined) {
+    delete proc.browser;
+  } else {
+    proc.browser = originalProcessBrowser;
+  }
+});
+
+afterEach(() => {
+  delete axios.defaults.headers.common['Authorization'];
+  window.localStorage.clear();
+  delete (window as Window & { __librechatAuthRecovery?: unknown }).__librechatAuthRecovery;
+  Object.defineProperty(window, 'location', {
+    value: savedLocation,
+    writable: true,
+    configurable: true,
+  });
+});
+
+function setWindowLocation(overrides: Partial<Location>) {
+  Object.defineProperty(window, 'location', {
+    value: { ...window.location, ...overrides },
+    writable: true,
+    configurable: true,
+  });
+}
+
+describe('axios 401 interceptor — subdirectory shared link guard', () => {
+  it('recognizes base-prefixed shared link data requests', async () => {
+    expect.assertions(2);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/chat/share/abc123',
+      pathname: '/chat/share/abc123',
+      search: '',
+      hash: '',
+      origin: 'http://localhost',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/chat/api/share/abc123', method: 'get', headers: {} },
+    });
+
+    mockAdapter.mockResolvedValueOnce({
+      data: { token: 'new-token' },
+      status: 200,
+      headers: {},
+      config: {},
+    });
+
+    mockAdapter.mockResolvedValueOnce({
+      data: { sharedLink: {} },
+      status: 200,
+      headers: {},
+      config: {},
+    });
+
+    try {
+      await axios.get('/chat/api/share/abc123');
+    } catch {
+      // may reject depending on exact flow
+    }
+
+    expect(mockAdapter.mock.calls.length).toBe(3);
+
+    const refreshCall = mockAdapter.mock.calls[1];
+    expect(refreshCall[0].url).toBe('/chat/api/auth/refresh');
+  });
+
+  it('does not refresh or redirect for unrelated base-prefixed 401s on public shared links', async () => {
+    expect.assertions(2);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/chat/share/abc123',
+      pathname: '/chat/share/abc123',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/chat/api/mcp/servers', method: 'get', headers: {} },
+    });
+
+    try {
+      await axios.get('/chat/api/mcp/servers');
+    } catch {
+      // expected rejection
+    }
+
+    expect(mockAdapter).toHaveBeenCalledTimes(1);
+    expect(window.location.href).toBe('http://localhost/chat/share/abc123');
+  });
+
+  it('does not strip paths that only share the base prefix', async () => {
+    expect.assertions(1);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/chatroom/share/abc123',
+      pathname: '/chatroom/share/abc123',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/chatroom/api/share/abc123', method: 'get', headers: {} },
+    });
+
+    try {
+      await axios.get('/chatroom/api/share/abc123');
+    } catch {
+      // expected rejection
+    }
+
+    expect(mockAdapter).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/data-provider/specs/request-interceptor.spec.ts b/packages/data-provider/specs/request-interceptor.spec.ts
index b5e43736cce..fec6a45cecb 100644
--- a/packages/data-provider/specs/request-interceptor.spec.ts
+++ b/packages/data-provider/specs/request-interceptor.spec.ts
@@ -2,6 +2,7 @@
  * @jest-environment @happy-dom/jest-environment
  */
 import axios from 'axios';
+import type { InternalAxiosRequestConfig } from 'axios';
 import { setTokenHeader } from '../src/headers-helpers';
 
 /**
@@ -20,6 +21,55 @@ const mockAdapter = jest.fn();
 let originalAdapter: typeof axios.defaults.adapter;
 let savedLocation: Location;
 
+type RetryableAdapterConfig = InternalAxiosRequestConfig & { _retry?: boolean };
+
+function createAdapterResponse(config: InternalAxiosRequestConfig, data: unknown = {}) {
+  return Promise.resolve({
+    data,
+    status: 200,
+    headers: {},
+    config,
+  });
+}
+
+function create401Error(config: InternalAxiosRequestConfig) {
+  return Promise.reject({
+    response: { status: 401 },
+    config,
+  });
+}
+
+function getCallsForUrl(urlPart: string) {
+  return mockAdapter.mock.calls.filter(([config]) => config.url?.includes(urlPart) === true);
+}
+
+function createDeferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+async function waitForAdapterCall(urlPart: string) {
+  for (let i = 0; i < 10; i++) {
+    if (getCallsForUrl(urlPart).length > 0) {
+      return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  throw new Error(`Adapter was not called for ${urlPart}`);
+}
+
+function createJwt(expiresAtMs: number) {
+  const payload = Buffer.from(JSON.stringify({ exp: Math.floor(expiresAtMs / 1000) })).toString(
+    'base64url',
+  );
+  return `header.${payload}.signature`;
+}
+
 beforeAll(async () => {
   originalAdapter = axios.defaults.adapter;
   axios.defaults.adapter = mockAdapter;
@@ -38,6 +88,8 @@ afterAll(() => {
 
 afterEach(() => {
   delete axios.defaults.headers.common['Authorization'];
+  window.localStorage.clear();
+  delete (window as Window & { __librechatAuthRecovery?: unknown }).__librechatAuthRecovery;
   Object.defineProperty(window, 'location', {
     value: savedLocation,
     writable: true,
@@ -53,6 +105,27 @@ function setWindowLocation(overrides: Partial<Location>) {
   });
 }
 
+function setTrackedWindowLocation(overrides: Partial<Location>) {
+  let href = overrides.href ?? window.location.href;
+  const hrefWrites: string[] = [];
+  Object.defineProperty(window, 'location', {
+    value: {
+      ...window.location,
+      ...overrides,
+      get href() {
+        return href;
+      },
+      set href(value: string) {
+        hrefWrites.push(value);
+        href = value;
+      },
+    },
+    writable: true,
+    configurable: true,
+  });
+  return hrefWrites;
+}
+
 describe('axios 401 interceptor — Authorization header guard', () => {
   it('skips refresh and rejects when Authorization header is cleared', async () => {
     expect.assertions(1);
@@ -85,7 +158,7 @@ describe('axios 401 interceptor — Authorization header guard', () => {
 
     mockAdapter.mockRejectedValueOnce({
       response: { status: 401 },
-      config: { url: '/api/share/abc123', headers: {} },
+      config: { url: '/api/share/abc123', method: 'get', headers: {} },
     });
 
     mockAdapter.mockResolvedValueOnce({
@@ -114,6 +187,82 @@ describe('axios 401 interceptor — Authorization header guard', () => {
     expect(refreshCall[0].url).toContain('api/auth/refresh');
   });
 
+  it('does not refresh or redirect for unrelated 401s on public shared link pages', async () => {
+    expect.assertions(2);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/share/abc123',
+      pathname: '/share/abc123',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/api/mcp/servers', headers: {} },
+    });
+
+    try {
+      await axios.get('/api/mcp/servers');
+    } catch {
+      // expected rejection
+    }
+
+    expect(mockAdapter).toHaveBeenCalledTimes(1);
+    expect(window.location.href).toBe('http://localhost/share/abc123');
+  });
+
+  it('does not treat nested share routes as public shared link pages', async () => {
+    expect.assertions(1);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/foo/share/abc123',
+      pathname: '/foo/share/abc123',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/api/share/abc123', method: 'get', headers: {} },
+    });
+
+    try {
+      await axios.get('/api/share/abc123');
+    } catch {
+      // expected rejection
+    }
+
+    expect(mockAdapter).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not treat nested API share paths as shared message requests', async () => {
+    expect.assertions(1);
+    setTokenHeader(undefined);
+
+    setWindowLocation({
+      href: 'http://localhost/share/abc123',
+      pathname: '/share/abc123',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockRejectedValueOnce({
+      response: { status: 401 },
+      config: { url: '/foo/api/share/abc123', method: 'get', headers: {} },
+    });
+
+    try {
+      await axios.get('/foo/api/share/abc123');
+    } catch {
+      // expected rejection
+    }
+
+    expect(mockAdapter).toHaveBeenCalledTimes(1);
+  });
+
   it('does not bypass guard when share/ appears only in query params', async () => {
     expect.assertions(1);
     setTokenHeader(undefined);
@@ -152,7 +301,7 @@ describe('axios 401 interceptor — Authorization header guard', () => {
 
     mockAdapter.mockRejectedValueOnce({
       response: { status: 401 },
-      config: { url: '/api/share/abc123', headers: {} },
+      config: { url: '/api/share/abc123', method: 'get', headers: {} },
     });
 
     mockAdapter.mockResolvedValueOnce({
@@ -184,7 +333,7 @@ describe('axios 401 interceptor — Authorization header guard', () => {
 
     mockAdapter.mockRejectedValueOnce({
       response: { status: 401 },
-      config: { url: '/api/share/abc123', headers: {} },
+      config: { url: '/api/share/abc123', method: 'get', headers: {} },
     });
 
     mockAdapter.mockResolvedValueOnce({
@@ -301,4 +450,160 @@ describe('axios 401 interceptor — Authorization header guard', () => {
     const refreshCall = mockAdapter.mock.calls[1];
     expect(refreshCall[0].url).toContain('api/auth/refresh');
   });
+
+  it('coalesces concurrent 401 responses into one refresh and retries with the new token', async () => {
+    expect.assertions(3);
+    setTokenHeader('expired-token');
+
+    mockAdapter.mockImplementation((config: RetryableAdapterConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: 'new-token' });
+      }
+      if (config._retry === true) {
+        return createAdapterResponse(config, { ok: true });
+      }
+      return create401Error(config);
+    });
+
+    const responses = await Promise.all([
+      axios.get('/api/messages'),
+      axios.get('/api/convos'),
+      axios.get('/api/files'),
+    ]);
+
+    expect(responses.map((response) => response.data)).toEqual([
+      { ok: true },
+      { ok: true },
+      { ok: true },
+    ]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(
+      mockAdapter.mock.calls
+        .filter(([config]) => (config as RetryableAdapterConfig)._retry === true)
+        .every(([config]) => config.headers?.Authorization === 'Bearer new-token'),
+    ).toBe(true);
+  });
+
+  it('holds new requests behind an in-flight auth recovery', async () => {
+    expect.assertions(4);
+    setTokenHeader('expired-token');
+    const refresh = createDeferred<string>();
+
+    mockAdapter.mockImplementation((config: RetryableAdapterConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return refresh.promise.then((token) => createAdapterResponse(config, { token }));
+      }
+      if (config.url === '/api/messages' && config._retry !== true) {
+        return create401Error(config);
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const firstRequest = axios.get('/api/messages');
+    await waitForAdapterCall('/api/auth/refresh');
+
+    const secondRequest = axios.get('/api/projects');
+    await Promise.resolve();
+
+    expect(getCallsForUrl('/api/projects')).toHaveLength(0);
+
+    refresh.resolve('new-token');
+    const responses = await Promise.all([firstRequest, secondRequest]);
+    expect(responses.map((response) => response.data)).toEqual([{ ok: true }, { ok: true }]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(getCallsForUrl('/api/projects')[0][0].headers?.Authorization).toBe('Bearer new-token');
+  });
+
+  it('redirects once when a burst of 401s cannot refresh a token', async () => {
+    expect.assertions(3);
+    setTokenHeader('expired-token');
+    const hrefWrites = setTrackedWindowLocation({
+      href: 'http://localhost/c/race',
+      pathname: '/c/race',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: '' });
+      }
+      return create401Error(config);
+    });
+
+    await Promise.allSettled([
+      axios.get('/api/messages'),
+      axios.get('/api/convos'),
+      axios.get('/api/files'),
+    ]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(hrefWrites).toHaveLength(1);
+    expect(hrefWrites[0]).toBe('/login?redirect_to=%2Fc%2Frace');
+  });
+
+  it('keeps redirect deduping when the storage timestamp is corrupted', async () => {
+    expect.assertions(2);
+    setTokenHeader('expired-token');
+    const hrefWrites = setTrackedWindowLocation({
+      href: 'http://localhost/c/race',
+      pathname: '/c/race',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: '' });
+      }
+      return create401Error(config);
+    });
+
+    await axios.get('/api/messages').catch(() => undefined);
+    window.localStorage.setItem('librechat.auth.redirect.startedAt', 'not-a-number');
+    await axios.get('/api/convos').catch(() => undefined);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(hrefWrites).toEqual(['/login?redirect_to=%2Fc%2Frace']);
+  });
+
+  it('refreshes a near-expiry bearer token before sending a request', async () => {
+    expect.assertions(4);
+    setTokenHeader(createJwt(Date.now() + 60_000));
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: 'fresh-token' });
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const response = await axios.get('/api/messages');
+
+    expect(response.data).toEqual({ ok: true });
+
+    expect(mockAdapter.mock.calls[0][0].url).toContain('/api/auth/refresh');
+    expect(mockAdapter.mock.calls[1][0].url).toBe('/api/messages');
+    expect(mockAdapter.mock.calls[1][0].headers?.Authorization).toBe('Bearer fresh-token');
+  });
+
+  it('does not wait on the in-flight recovery when the refresh request itself fails', async () => {
+    expect.assertions(3);
+    setTokenHeader(createJwt(Date.now() + 60_000));
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return create401Error(config);
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const response = await axios.get('/api/messages');
+
+    expect(response.data).toEqual({ ok: true });
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(getCallsForUrl('/api/messages')).toHaveLength(1);
+  });
 });
diff --git a/packages/data-provider/src/accessPermissions.ts b/packages/data-provider/src/accessPermissions.ts
index 8047f14b79c..88f6ef954ba 100644
--- a/packages/data-provider/src/accessPermissions.ts
+++ b/packages/data-provider/src/accessPermissions.ts
@@ -48,6 +48,7 @@ export enum ResourceType {
   MCPSERVER = 'mcpServer',
   REMOTE_AGENT = 'remoteAgent',
   SKILL = 'skill',
+  SHARED_LINK = 'sharedLink',
 }
 
 /**
@@ -83,6 +84,8 @@ export enum AccessRoleIds {
   SKILL_VIEWER = 'skill_viewer',
   SKILL_EDITOR = 'skill_editor',
   SKILL_OWNER = 'skill_owner',
+  SHARED_LINK_VIEWER = 'sharedLink_viewer',
+  SHARED_LINK_OWNER = 'sharedLink_owner',
 }
 
 // ===== ZOD SCHEMAS =====
@@ -145,7 +148,7 @@ export const resourcePermissionsResponseSchema = z.object({
 export const updateResourcePermissionsRequestSchema = z.object({
   updated: principalSchema.array(),
   removed: principalSchema.array(),
-  public: z.boolean(),
+  public: z.boolean().optional(),
   publicAccessRoleId: z.string().optional(),
 });
 
@@ -157,7 +160,7 @@ export const updateResourcePermissionsResponseSchema = z.object({
   message: z.string(),
   results: z.object({
     principals: principalSchema.array(),
-    public: z.boolean(),
+    public: z.boolean().optional(),
     publicAccessRoleId: z.string().optional(),
   }),
 });
@@ -322,6 +325,7 @@ export function accessRoleToPermBits(accessRoleId: string): number {
     case AccessRoleIds.MCPSERVER_VIEWER:
     case AccessRoleIds.REMOTE_AGENT_VIEWER:
     case AccessRoleIds.SKILL_VIEWER:
+    case AccessRoleIds.SHARED_LINK_VIEWER:
       return PermissionBits.VIEW;
     case AccessRoleIds.AGENT_EDITOR:
     case AccessRoleIds.PROMPTGROUP_EDITOR:
@@ -334,6 +338,7 @@ export function accessRoleToPermBits(accessRoleId: string): number {
     case AccessRoleIds.MCPSERVER_OWNER:
     case AccessRoleIds.REMOTE_AGENT_OWNER:
     case AccessRoleIds.SKILL_OWNER:
+    case AccessRoleIds.SHARED_LINK_OWNER:
       return (
         PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE
       );
diff --git a/packages/data-provider/src/api-endpoints.ts b/packages/data-provider/src/api-endpoints.ts
index 0a50f678d4e..326e60f6443 100644
--- a/packages/data-provider/src/api-endpoints.ts
+++ b/packages/data-provider/src/api-endpoints.ts
@@ -1,6 +1,7 @@
+import type { StartupConfigContext } from './config';
 import type { AssistantsEndpoint } from './schemas';
-import * as q from './types/queries';
 import { ResourceType } from './accessPermissions';
+import * as q from './types/queries';
 
 let BASE_URL = '';
 if (
@@ -70,20 +71,27 @@ export const messagesBranch = () => `${messagesRoot}/branch`;
 
 const shareRoot = `${BASE_URL}/api/share`;
 export const shareMessages = (shareId: string) => `${shareRoot}/${shareId}`;
+export const sharedStartupConfig = (shareId: string) => `${shareMessages(shareId)}/config`;
 export const getSharedLink = (conversationId: string) => `${shareRoot}/link/${conversationId}`;
 export const getSharedLinks = (
   pageSize: number,
-  isPublic: boolean,
   sortBy: 'title' | 'createdAt',
   sortDirection: 'asc' | 'desc',
   search?: string,
   cursor?: string,
 ) =>
-  `${shareRoot}?pageSize=${pageSize}&isPublic=${isPublic}&sortBy=${sortBy}&sortDirection=${sortDirection}${
+  `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${
     search ? `&search=${search}` : ''
   }${cursor ? `&cursor=${cursor}` : ''}`;
 export const createSharedLink = (conversationId: string) => `${shareRoot}/${conversationId}`;
 export const updateSharedLink = (shareId: string) => `${shareRoot}/${shareId}`;
+/** Share-scoped file routes: serve snapshotted files via shared-link permission. */
+export const sharedFile = (shareId: string, fileId: string) =>
+  `${shareRoot}/${shareId}/files/${encodeURIComponent(fileId)}`;
+export const sharedFileDownload = (shareId: string, fileId: string) =>
+  `${sharedFile(shareId, fileId)}/download`;
+export const sharedFilePreview = (shareId: string, fileId: string) =>
+  `${sharedFile(shareId, fileId)}/preview`;
 
 const keysEndpoint = `${BASE_URL}/api/keys`;
 
@@ -115,6 +123,7 @@ export const genTitle = (conversationId: string) =>
 export const updateConversation = () => `${conversationsRoot}/update`;
 
 export const archiveConversation = () => `${conversationsRoot}/archive`;
+export const pinConversation = () => `${conversationsRoot}/pin`;
 
 export const deleteConversation = () => `${conversationsRoot}`;
 
@@ -126,6 +135,17 @@ export const forkConversation = () => `${conversationsRoot}/fork`;
 
 export const duplicateConversation = () => `${conversationsRoot}/duplicate`;
 
+export const projectsRoot = `${BASE_URL}/api/projects`;
+
+export const projects = (params: q.ProjectListParams = {}) => {
+  return `${projectsRoot}${buildQuery(params)}`;
+};
+
+export const projectById = (id: string) => `${projectsRoot}/${encodeURIComponent(id)}`;
+
+export const projectConversation = (conversationId: string) =>
+  `${projectsRoot}/conversations/${encodeURIComponent(conversationId)}`;
+
 export const search = (q: string, cursor?: string | null) =>
   `${BASE_URL}/api/search?q=${q}${cursor ? `&cursor=${cursor}` : ''}`;
 
@@ -137,6 +157,10 @@ export const deletePreset = () => `${BASE_URL}/api/presets/delete`;
 
 export const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 
+export const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
+
+export const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
+
 export const models = () => `${BASE_URL}/api/models`;
 
 export const tokenizer = () => `${BASE_URL}/api/tokenizer`;
@@ -212,7 +236,8 @@ export const mcpOAuthBind = (serverName: string) => `${BASE_URL}/api/mcp/${serve
 export const actionOAuthBind = (actionId: string) =>
   `${BASE_URL}/api/actions/${actionId}/oauth/bind`;
 
-export const config = () => `${BASE_URL}/api/config`;
+export const config = (context?: StartupConfigContext) =>
+  `${BASE_URL}/api/config${buildQuery({ context })}`;
 
 export const prompts = () => `${BASE_URL}/api/prompts`;
 
@@ -392,6 +417,12 @@ export const skillFiles = (id: string) => `${getSkill(id)}/files`;
 export const skillFile = (id: string, relativePath: string) =>
   `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
 
+export const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
+export const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
+export const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
+export const adminSkillsSyncCredential = (credentialKey: string) =>
+  `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
+
 /**
  * Skill filesystem tree (phase 2). URL shape mirrors the original UI PR so
  * the tree hooks keep their call surface. `path` is pre-encoded by the
diff --git a/packages/data-provider/src/bedrock.ts b/packages/data-provider/src/bedrock.ts
index 96a4998079e..7e97d594a47 100644
--- a/packages/data-provider/src/bedrock.ts
+++ b/packages/data-provider/src/bedrock.ts
@@ -68,14 +68,14 @@ type AnthropicInput = BedrockConverseInput & {
 
 /** Extracts opus major/minor version from both naming formats */
 function parseOpusVersion(model: string): { major: number; minor: number } | null {
-  const nameFirst = model.match(/claude-opus[-.]?(\d+)(?:[-.](\d+))?/);
+  const nameFirst = model.match(/claude-opus[-.]?(\d+)(?:[-.](\d{1,2})(?!\d))?/);
   if (nameFirst) {
     return {
       major: parseInt(nameFirst[1], 10),
       minor: nameFirst[2] != null ? parseInt(nameFirst[2], 10) : 0,
     };
   }
-  const numFirst = model.match(/claude-(\d+)(?:[-.](\d+))?-opus/);
+  const numFirst = model.match(/claude-(\d+)(?:[-.](\d{1,2})(?!\d))?-opus/);
   if (numFirst) {
     return {
       major: parseInt(numFirst[1], 10),
@@ -105,7 +105,13 @@ function parseSonnetVersion(model: string): { major: number; minor: number } | n
   return null;
 }
 
-/** Checks if a model supports adaptive thinking (Opus 4.6+, Sonnet 4.6+) */
+/**
+ * Mythos-class detection (Claude Fable / Mythos) lives in `schemas.ts` as
+ * `isMythosClassModel` — the single source of truth for the family names.
+ * The helpers below OR it in alongside the `opus`/`sonnet` version parsers.
+ */
+
+/** Checks if a model supports adaptive thinking (Opus 4.6+, Sonnet 4.6+, Fable/Mythos) */
 export function supportsAdaptiveThinking(model: string): boolean {
   const opus = parseOpusVersion(model);
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 6))) {
@@ -115,6 +121,9 @@ export function supportsAdaptiveThinking(model: string): boolean {
   if (sonnet != null && (sonnet.major > 4 || (sonnet.major === 4 && sonnet.minor >= 6))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
@@ -133,10 +142,24 @@ export function omitsThinkingByDefault(model: string): boolean {
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 7))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
-/** Checks if a model has a 1M context window (Sonnet 4.6+, Opus 4.6+, Opus 5+) */
+export function omitsSamplingParameters(model: string): boolean {
+  const opus = parseOpusVersion(model);
+  if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 7))) {
+    return true;
+  }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
+  return false;
+}
+
+/** Checks if a model has a 1M context window (Sonnet 4.6+, Opus 4.6+, Opus 5+, Fable/Mythos) */
 export function supportsContext1m(model: string): boolean {
   const sonnet = parseSonnetVersion(model);
   if (sonnet != null && (sonnet.major > 4 || (sonnet.major === 4 && sonnet.minor >= 6))) {
@@ -146,6 +169,9 @@ export function supportsContext1m(model: string): boolean {
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 6))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
@@ -159,6 +185,8 @@ export function supportsContext1m(model: string): boolean {
 function getBedrockAnthropicBetaHeaders(model: string): string[] {
   const betaHeaders: string[] = [];
 
+  /** Mythos-class (Fable/Mythos) is intentionally not matched: these betas are built-in/no-op for the
+   * 4.7+ generation (Fable has native 128K output), so omitting them on Bedrock is lossless. */
   const isClaude4PlusModel =
     /anthropic\.claude-(?:[4-9](?:\.\d+)?(?:-\d+)?-(?:sonnet|opus|haiku)|(?:sonnet|opus|haiku)-[4-9])/.test(
       model,
@@ -177,11 +205,12 @@ function getBedrockAnthropicBetaHeaders(model: string): string[] {
 }
 
 function mergeBedrockAnthropicBetaHeaders(existing: unknown, generated: string[]): string[] {
-  const existingValues: unknown[] = Array.isArray(existing)
-    ? existing
-    : typeof existing === 'string'
-      ? [existing]
-      : [];
+  let existingValues: unknown[] = [];
+  if (Array.isArray(existing)) {
+    existingValues = existing;
+  } else if (typeof existing === 'string') {
+    existingValues = [existing];
+  }
 
   const betaHeaders = new Set<string>();
 
@@ -203,6 +232,7 @@ function mergeBedrockAnthropicBetaHeaders(existing: unknown, generated: string[]
 export const bedrockInputSchema = s.tConversationSchema
   .pick({
     /* LibreChat params; optionType: 'conversation' */
+    chatProjectId: true,
     modelLabel: true,
     promptPrefix: true,
     resendFiles: true,
@@ -226,6 +256,7 @@ export const bedrockInputSchema = s.tConversationSchema
     thinkingDisplay: true,
     reasoning_effort: true,
     promptCache: true,
+    promptCacheTtl: true,
     /* Catch-all fields */
     topK: true,
     additionalModelRequestFields: true,
@@ -259,6 +290,7 @@ export type BedrockConverseInput = z.infer<typeof bedrockInputSchema>;
 export const bedrockInputParser = s.tConversationSchema
   .pick({
     /* LibreChat params; optionType: 'conversation' */
+    chatProjectId: true,
     modelLabel: true,
     promptPrefix: true,
     resendFiles: true,
@@ -281,6 +313,7 @@ export const bedrockInputParser = s.tConversationSchema
     thinkingDisplay: true,
     reasoning_effort: true,
     promptCache: true,
+    promptCacheTtl: true,
     /* Catch-all fields */
     topK: true,
     additionalModelRequestFields: true,
@@ -288,6 +321,7 @@ export const bedrockInputParser = s.tConversationSchema
   .catchall(z.any())
   .transform((data) => {
     const knownKeys = [
+      'chatProjectId',
       'modelLabel',
       'promptPrefix',
       'resendFiles',
@@ -304,10 +338,13 @@ export const bedrockInputParser = s.tConversationSchema
       'topP',
       'stop',
       'promptCache',
+      'promptCacheTtl',
     ];
 
     const additionalFields: Record<string, unknown> = {};
     const typedData = data as Record<string, unknown>;
+    const shouldOmitSamplingParameters =
+      typeof typedData.model === 'string' && omitsSamplingParameters(typedData.model);
 
     Object.entries(typedData).forEach(([key, value]) => {
       if (!knownKeys.includes(key)) {
@@ -320,13 +357,14 @@ export const bedrockInputParser = s.tConversationSchema
       }
     });
 
-    /** Default thinking and thinkingBudget for 'anthropic.claude-3-7-sonnet' models, if not defined */
+    /** Configure thinking for Bedrock Anthropic models: 3.7 Sonnet, Claude 4+ (opus/sonnet/haiku), and Mythos-class (Fable/Mythos). */
     if (
       typeof typedData.model === 'string' &&
       (typedData.model.includes('anthropic.claude-3-7-sonnet') ||
         /anthropic\.claude-(?:[4-9](?:\.\d+)?(?:-\d+)?-(?:sonnet|opus|haiku)|(?:sonnet|opus|haiku)-[4-9])/.test(
           typedData.model,
-        ))
+        ) ||
+        s.isMythosClassModel(typedData.model))
     ) {
       const isAdaptive = supportsAdaptiveThinking(typedData.model as string);
 
@@ -436,6 +474,24 @@ export const bedrockInputParser = s.tConversationSchema
         delete amrf.reasoning_config;
         delete amrf.reasoning_effort;
       }
+
+      if (shouldOmitSamplingParameters) {
+        delete amrf.temperature;
+        delete amrf.topP;
+        delete amrf.top_p;
+        delete amrf.topK;
+        delete amrf.top_k;
+      }
+    }
+
+    if (shouldOmitSamplingParameters) {
+      delete typedData.temperature;
+      delete typedData.topP;
+      delete additionalFields.temperature;
+      delete additionalFields.topP;
+      delete additionalFields.top_p;
+      delete additionalFields.topK;
+      delete additionalFields.top_k;
     }
 
     /** Default promptCache for claude and nova models, if not defined */
@@ -450,6 +506,15 @@ export const bedrockInputParser = s.tConversationSchema
       typedData.promptCache = undefined;
     }
 
+    /**
+     * A cache TTL is meaningless without caching — tie it to promptCache. When
+     * caching is off or unsupported for the model (cleared above), drop the TTL
+     * so an unsupported `1h` is never sent on a non-caching Bedrock request.
+     */
+    if (typedData.promptCache !== true) {
+      typedData.promptCacheTtl = undefined;
+    }
+
     if (Object.keys(additionalFields).length > 0) {
       typedData.additionalModelRequestFields = {
         ...((typedData.additionalModelRequestFields as Record<string, unknown> | undefined) || {}),
diff --git a/packages/data-provider/src/config.spec.ts b/packages/data-provider/src/config.spec.ts
index f5c107c58f9..ae7e7ca5261 100644
--- a/packages/data-provider/src/config.spec.ts
+++ b/packages/data-provider/src/config.spec.ts
@@ -29,6 +29,34 @@ describe('excludedKeys', () => {
   });
 });
 
+describe('bedrockEndpointSchema', () => {
+  it('preserves guardrailConfig from configSchema parsing', () => {
+    const guardrailConfig = {
+      guardrailIdentifier: '${BEDROCK_GUARDRAIL_ID}',
+      guardrailVersion: '${BEDROCK_GUARDRAIL_VERSION}',
+      trace: 'enabled_full',
+      streamProcessingMode: 'sync',
+    };
+
+    const result = configSchema.safeParse({
+      version: '1.0',
+      endpoints: {
+        bedrock: {
+          streamRate: 25,
+          availableRegions: ['us-west-2'],
+          guardrailConfig,
+        },
+      },
+    });
+
+    expect(result.success).toBe(true);
+    if (!result.success) {
+      return;
+    }
+    expect(result.data.endpoints?.bedrock?.guardrailConfig).toEqual(guardrailConfig);
+  });
+});
+
 describe('resolveEndpointType', () => {
   describe('non-agents endpoints', () => {
     it('returns the config type for a custom endpoint', () => {
diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
index ebc86122d19..c0034d8a33d 100644
--- a/packages/data-provider/src/config.ts
+++ b/packages/data-provider/src/config.ts
@@ -1,17 +1,26 @@
 import { z } from 'zod';
 import type { ZodError } from 'zod';
 import type { TEndpointsConfig, TModelsConfig, TConfig } from './types';
-import { EModelEndpoint, eModelEndpointSchema, isAgentsEndpoint } from './schemas';
+import {
+  EModelEndpoint,
+  eModelEndpointSchema,
+  isAgentsEndpoint,
+  eReasoningParameterFormatSchema,
+  eReasoningResponseKeySchema,
+} from './schemas';
 import { ComponentTypes, SettingTypes, OptionTypes } from './generate';
 import { specsConfigSchema, TSpecsConfig } from './models';
+import { REFILL_INTERVAL_UNITS } from './balance';
 import { fileConfigSchema } from './file-config';
 import { apiBaseUrl } from './api-endpoints';
 import { FileSources } from './types/files';
 import { MCPServersSchema } from './mcp';
-import { REFILL_INTERVAL_UNITS } from './balance';
+export { MAX_SUBAGENTS } from './limits';
 
 export const defaultSocialLogins = ['google', 'facebook', 'openid', 'github', 'discord', 'saml'];
 
+export const BASE_ONLY_CONFIG_SECTIONS = [] as const;
+
 export const defaultRetrievalModels = [
   'gpt-4o',
   'o1-preview-2024-09-12',
@@ -45,6 +54,7 @@ export const excludedKeys = new Set([
   'createdAt',
   'updatedAt',
   'expiredAt',
+  'isTemporary',
   'messages',
   'isArchived',
   'tags',
@@ -56,6 +66,7 @@ export const excludedKeys = new Set([
   'files',
   'spec',
   'disableParams',
+  'chatProjectId',
 ]);
 
 export enum SettingsViews {
@@ -235,6 +246,192 @@ export const cloudfrontConfigSchema = z
 
 export type CloudFrontConfig = z.infer<typeof cloudfrontConfigSchema>;
 
+const skillSyncIdentifierSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, {
+    message:
+      'must start with a letter or digit and contain only letters, digits, underscores, or hyphens',
+  });
+
+export const SKILL_SYNC_MIN_INTERVAL_MINUTES = 5;
+export const SKILL_SYNC_MAX_INTERVAL_MINUTES = Math.floor(2147483647 / 60_000);
+export const SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH = 2;
+export const SKILL_SYNC_MAX_DISCOVERY_DEPTH = 10;
+
+const skillSyncGitHubOwnerSchema = z
+  .string()
+  .min(1)
+  .max(39)
+  .regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$/, {
+    message: 'must be a valid GitHub owner name',
+  });
+
+const skillSyncGitHubRepoSchema = z
+  .string()
+  .min(1)
+  .max(100)
+  .regex(/^[a-zA-Z0-9._-]+$/, {
+    message: 'must be a valid GitHub repository name',
+  });
+
+const invalidGitRefChars = new Set(['~', '^', ':', '?', '*', '[']);
+
+function hasInvalidGitRefCharacter(value: string): boolean {
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code <= 32 || code === 127 || invalidGitRefChars.has(char)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+const skillSyncGitHubRefSchema = z
+  .string()
+  .min(1)
+  .max(255)
+  .refine((value) => !value.startsWith('/') && !value.endsWith('/'), {
+    message: 'must not start or end with a slash',
+  })
+  .refine((value) => !value.includes('..') && !value.includes('//') && !value.includes('\\'), {
+    message: 'must not contain traversal segments, empty path segments, or backslashes',
+  })
+  .refine((value) => !value.includes('@{') && value !== '@', {
+    message: 'must not contain invalid Git ref syntax',
+  })
+  .refine((value) => !value.endsWith('.'), {
+    message: 'must not end with a dot',
+  })
+  .refine((value) => !hasInvalidGitRefCharacter(value), {
+    message: 'must not contain invalid Git ref characters',
+  })
+  .refine(
+    (value) =>
+      value
+        .split('/')
+        .every((segment) => segment && !segment.startsWith('.') && !segment.endsWith('.lock')),
+    {
+      message: 'must contain valid Git ref path segments',
+    },
+  );
+
+const skillSyncPathSchema = z
+  .string()
+  .max(500)
+  .refine((value) => value.trim().length > 0, { message: 'must not be empty' })
+  .transform((value) => {
+    const trimmed = value.trim().replace(/^\/+|\/+$/g, '');
+    return trimmed === '.' ? '' : trimmed;
+  })
+  .refine((value) => !value.includes('\\') && !value.includes('..'), {
+    message: 'must not contain traversal segments or backslashes',
+  })
+  .refine((value) => value === '' || /^[a-zA-Z0-9._\-/]+$/.test(value), {
+    message: 'must contain only letters, digits, dots, underscores, hyphens, and slashes',
+  })
+  .refine(
+    (value) =>
+      value === '' || value.split('/').every((segment) => segment.length > 0 && segment !== '.'),
+    {
+      message: 'must not contain empty or dot path segments',
+    },
+  );
+
+const skillSyncTokenReferenceSchema = z
+  .string()
+  .trim()
+  .regex(/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/, {
+    message: 'must be an environment variable reference like ${GITHUB_SKILLS_TOKEN}',
+  });
+
+/**
+ * Tenant that owns the skills mirrored from a source. When set, the sync runner
+ * executes that source's database writes inside the tenant's async context so
+ * synced skills are created, listed, and shared within the tenant under strict
+ * tenant isolation. Mirrors the request tenant-id contract: no reserved system id.
+ */
+const skillSyncTenantIdSchema = z
+  .string()
+  .max(128)
+  .refine((value) => /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(value), {
+    message: 'must be a valid tenant id',
+  })
+  .refine((value) => value !== '__SYSTEM__', {
+    message: 'must not be the reserved system tenant id',
+  });
+
+export const skillSyncGitHubSourceSchema = z
+  .object({
+    id: skillSyncIdentifierSchema,
+    owner: skillSyncGitHubOwnerSchema,
+    repo: skillSyncGitHubRepoSchema,
+    ref: skillSyncGitHubRefSchema.default('main'),
+    paths: z.array(skillSyncPathSchema).min(1),
+    skillDiscoveryDepth: z.number().int().min(0).max(SKILL_SYNC_MAX_DISCOVERY_DEPTH).optional(),
+    credentialKey: skillSyncIdentifierSchema.optional(),
+    token: skillSyncTokenReferenceSchema.optional(),
+    tenantId: skillSyncTenantIdSchema.optional(),
+  })
+  .superRefine((source, ctx) => {
+    if (!source.credentialKey && !source.token) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['credentialKey'],
+        message: 'Either credentialKey or token is required',
+      });
+    }
+    if (source.credentialKey && source.token) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['token'],
+        message: 'Use either credentialKey or token, not both',
+      });
+    }
+  });
+
+export const skillSyncConfigSchema = z
+  .object({
+    github: z
+      .object({
+        enabled: z.boolean().default(false),
+        intervalMinutes: z
+          .number()
+          .int()
+          .min(SKILL_SYNC_MIN_INTERVAL_MINUTES)
+          .max(SKILL_SYNC_MAX_INTERVAL_MINUTES)
+          .default(60),
+        runOnStartup: z.boolean().default(false),
+        sources: z.array(skillSyncGitHubSourceSchema).default([]),
+      })
+      .superRefine((github, ctx) => {
+        if (github.enabled && github.sources.length === 0) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['sources'],
+            message: 'At least one GitHub source is required when skill sync is enabled',
+          });
+        }
+        const seen = new Set<string>();
+        for (const source of github.sources) {
+          if (seen.has(source.id)) {
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              path: ['sources'],
+              message: `Duplicate GitHub skill sync source id "${source.id}"`,
+            });
+          }
+          seen.add(source.id);
+        }
+      })
+      .optional(),
+  })
+  .optional();
+
+export type SkillSyncConfig = z.infer<typeof skillSyncConfigSchema>;
+export type SkillSyncGitHubSourceConfig = z.infer<typeof skillSyncGitHubSourceSchema>;
+
 // Helper type to extract the shape of the Zod object schema
 type SchemaShape<T> = T extends z.ZodObject<infer U> ? U : never;
 
@@ -388,6 +585,15 @@ export const defaultAssistantsVersion = {
 export const baseEndpointSchema = z.object({
   streamRate: z.number().optional(),
   baseURL: z.string().optional(),
+  /**
+   * Custom request headers forwarded to the provider on every request. Values
+   * support the same placeholder resolution as custom endpoints — env vars
+   * (`${VAR}`), user fields (`{{LIBRECHAT_USER_*}}`), and request-body fields
+   * (`{{LIBRECHAT_BODY_CONVERSATIONID}}`). Primarily for routing built-in
+   * providers through an AI gateway / reverse proxy that consumes metadata
+   * headers (provider-native request shaping is preserved).
+   */
+  headers: z.record(z.string()).optional(),
   titlePrompt: z.string().optional(),
   titleModel: z.string().optional(),
   titleConvo: z.boolean().optional(),
@@ -396,16 +602,31 @@ export const baseEndpointSchema = z.object({
     .optional(),
   titleEndpoint: z.string().optional(),
   titlePromptTemplate: z.string().optional(),
+  /**
+   * When conversation titles are generated. `immediate` (default) generates the
+   * title as soon as the request is made, in parallel with the response, from the
+   * user's first message. `final` defers generation until the full response
+   * completes (legacy behavior).
+   */
+  titleTiming: z.union([z.literal('immediate'), z.literal('final')]).optional(),
   /** Maximum characters allowed in a single tool result before truncation. */
   maxToolResultChars: z.number().positive().optional(),
 });
 
 export type TBaseEndpoint = z.infer<typeof baseEndpointSchema>;
 
+export const bedrockGuardrailConfigSchema = z.object({
+  guardrailIdentifier: z.string(),
+  guardrailVersion: z.string(),
+  trace: z.enum(['enabled', 'disabled', 'enabled_full']).optional(),
+  streamProcessingMode: z.enum(['sync', 'async']).optional(),
+});
+
 export const bedrockEndpointSchema = baseEndpointSchema.merge(
   z.object({
     availableRegions: z.array(z.string()).optional(),
     models: z.array(z.string()).optional(),
+    guardrailConfig: bedrockGuardrailConfigSchema.optional(),
     inferenceProfiles: z.record(z.string(), z.string()).optional(),
   }),
 );
@@ -549,6 +770,11 @@ export const agentsEndpointSchema = baseEndpointSchema
         .array(z.nativeEnum(AgentCapabilities))
         .optional()
         .default(defaultAgentCapabilities),
+      skills: z
+        .object({
+          maxCatalogSkills: z.number().int().min(1).max(100).optional(),
+        })
+        .optional(),
       remoteApi: remoteApiSchema.optional(),
     }),
   )
@@ -615,18 +841,44 @@ export const endpointSchema = baseEndpointSchema.merge(
     }),
     iconURL: z.string().optional(),
     modelDisplayLabel: z.string().optional(),
+    /**
+     * Forces the endpoint to use a provider's native client / request format
+     * instead of the default OpenAI-compatible client. Currently supports
+     * `anthropic`, for endpoints that speak the Anthropic `/v1/messages` API
+     * (Anthropic itself or Anthropic-compatible gateways). Omit for
+     * OpenAI-compatible endpoints.
+     */
+    provider: z.literal(EModelEndpoint.anthropic).optional(),
     headers: z.record(z.string()).optional(),
     addParams: addParamsSchema.optional(),
     dropParams: z.array(z.string()).optional(),
     customParams: z
       .object({
         defaultParamsEndpoint: z.string().default('custom'),
+        reasoningFormat: eReasoningParameterFormatSchema.optional(),
+        reasoningKey: eReasoningResponseKeySchema.optional(),
+        /** Replays `reasoning_content` within a run's tool-call turns (e.g. Xiaomi MiMo, Kimi). */
+        includeReasoningContent: z.boolean().optional(),
+        /** Also reconstructs `reasoning_content` from persisted history across turns (implies `includeReasoningContent`). */
+        includeReasoningHistory: z.boolean().optional(),
         paramDefinitions: z.array(paramDefinitionSchema).optional(),
       })
       .strict()
       .optional(),
     directEndpoint: z.boolean().optional(),
     titleMessageRole: z.enum(['system', 'user', 'assistant']).optional(),
+    /** Static per-model token config: context window and per-million-token rates */
+    tokenConfig: z
+      .record(
+        z.object({
+          prompt: z.number(),
+          completion: z.number(),
+          context: z.number(),
+          cacheRead: z.number().optional(),
+          cacheWrite: z.number().optional(),
+        }),
+      )
+      .optional(),
   }),
 );
 
@@ -645,6 +897,7 @@ export const azureEndpointSchema = z
         titleMethod: true,
         titleModel: true,
         titlePrompt: true,
+        titleTiming: true,
         titlePromptTemplate: true,
       })
       .partial(),
@@ -884,6 +1137,7 @@ const mcpServersSchema = z
     create: z.boolean().optional(),
     share: z.boolean().optional(),
     public: z.boolean().optional(),
+    configureObo: z.boolean().optional(),
     trustCheckbox: z
       .object({
         label: localizedStringSchema.optional(),
@@ -895,6 +1149,11 @@ const mcpServersSchema = z
 
 export type TMcpServersConfig = z.infer<typeof mcpServersSchema>;
 
+export enum RetentionMode {
+  ALL = 'all',
+  TEMPORARY = 'temporary',
+}
+
 export const interfaceSchema = z
   .object({
     privacyPolicy: z
@@ -937,8 +1196,18 @@ export const interfaceSchema = z
     temporaryChat: z.boolean().optional(),
     temporaryChatRetention: z.number().min(1).max(8760).optional(),
     autoSubmitFromUrl: z.boolean().optional(),
+    retentionMode: z.nativeEnum(RetentionMode).default(RetentionMode.TEMPORARY),
+    retainAgentFiles: z.boolean().optional(),
     runCode: z.boolean().optional(),
     webSearch: z.boolean().optional(),
+    contextUsage: z.boolean().optional(),
+    contextCost: z.boolean().optional(),
+    currency: z
+      .object({
+        code: z.string(),
+        rate: z.number().positive(),
+      })
+      .optional(),
     peoplePicker: z
       .object({
         users: z.boolean().optional(),
@@ -953,6 +1222,9 @@ export const interfaceSchema = z
       .optional(),
     fileSearch: z.boolean().optional(),
     fileCitations: z.boolean().optional(),
+    /** Tool keys (and `'mcp'` or an MCP server name) pinned to the prompt bar by default */
+    defaultPinnedTools: z.array(z.string()).optional(),
+    buildInfo: z.boolean().optional(),
     remoteAgents: z
       .object({
         use: z.boolean().optional(),
@@ -973,6 +1245,17 @@ export const interfaceSchema = z
         }),
       ])
       .optional(),
+    sharedLinks: z
+      .union([
+        z.boolean(),
+        z.object({
+          create: z.boolean().optional(),
+          share: z.boolean().optional(),
+          public: z.boolean().optional(),
+          snapshotFiles: z.boolean().optional(),
+        }),
+      ])
+      .optional(),
   })
   .default({
     modelSelect: true,
@@ -997,6 +1280,8 @@ export const interfaceSchema = z
     autoSubmitFromUrl: true,
     runCode: true,
     webSearch: true,
+    contextUsage: true,
+    contextCost: false,
     peoplePicker: {
       users: true,
       groups: true,
@@ -1013,6 +1298,7 @@ export const interfaceSchema = z
     },
     fileSearch: true,
     fileCitations: true,
+    buildInfo: true,
     remoteAgents: {
       use: false,
       create: false,
@@ -1026,6 +1312,12 @@ export const interfaceSchema = z
       public: false,
       defaultActiveOnShare: false,
     },
+    sharedLinks: {
+      create: true,
+      share: true,
+      public: true,
+      snapshotFiles: true,
+    },
   });
 
 export type TInterfaceConfig = z.infer<typeof interfaceSchema>;
@@ -1049,6 +1341,23 @@ export const turnstileSchema = z.object({
 
 export type TTurnstileConfig = z.infer<typeof turnstileSchema>;
 
+export type TRumConfig = {
+  provider: 'hyperdx';
+  enabled: boolean;
+  url: string;
+  serviceName: string;
+  authMode: 'publicToken' | 'proxy';
+  publicToken?: string;
+  tracePropagationTargets?: string[];
+  consoleCapture?: boolean;
+  disableReplay?: boolean;
+  advancedNetworkCapture?: boolean;
+  sampleRate?: number;
+  environment?: string;
+};
+
+export type StartupConfigContext = 'share';
+
 export type TStartupConfig = {
   appTitle: string;
   socialLogins?: string[];
@@ -1088,7 +1397,14 @@ export type TStartupConfig = {
   modelDescriptions?: Record<string, Record<string, string>>;
   sharedLinksEnabled: boolean;
   publicSharedLinksEnabled: boolean;
+  /** Whether shared links snapshot conversation files (gates the per-link "share files" checkbox). */
+  sharedLinksSnapshotFilesEnabled?: boolean;
+  /** Effective default timing for when conversation titles become fetchable.
+   * `immediate` = fetch in parallel with the active stream (default);
+   * `final` = fetch only after the stream completes (legacy). */
+  titleGenerationTiming?: 'immediate' | 'final';
   analyticsGtmId?: string;
+  rum?: TRumConfig;
   bundlerURL?: string;
   staticBundlerURL?: string;
   sharePointFilePickerEnabled?: boolean;
@@ -1127,8 +1443,27 @@ export type TStartupConfig = {
   >;
   mcpPlaceholder?: string;
   conversationImportMaxFileSize?: number;
+  buildInfo?: {
+    commit?: string | null;
+    commitShort?: string | null;
+    branch?: string | null;
+    buildDate?: string | null;
+  };
 };
 
+export type TSharedLinkStartupInterface = Pick<
+  Partial<TInterfaceConfig>,
+  'privacyPolicy' | 'termsOfService'
+>;
+
+export type TSharedLinkStartupConfig = Pick<TStartupConfig, 'appTitle'> &
+  Pick<
+    Partial<TStartupConfig>,
+    'analyticsGtmId' | 'bundlerURL' | 'customFooter' | 'staticBundlerURL'
+  > & {
+    interface?: TSharedLinkStartupInterface;
+  };
+
 export enum OCRStrategy {
   MISTRAL_OCR = 'mistral_ocr',
   CUSTOM_OCR = 'custom_ocr',
@@ -1269,11 +1604,14 @@ export const transactionsSchema = z.object({
   enabled: z.boolean().optional().default(true),
 });
 
+export const DEFAULT_MEMORY_MAX_INPUT_TOKENS = 12000;
+
 export const memorySchema = z.object({
   disabled: z.boolean().optional(),
   validKeys: z.array(z.string()).optional(),
   tokenLimit: z.number().optional(),
   charLimit: z.number().optional().default(10000),
+  maxInputTokens: z.number().int().positive().optional().default(DEFAULT_MEMORY_MAX_INPUT_TOKENS),
   personalize: z.boolean().default(true),
   messageWindowSize: z.number().optional().default(5),
   agent: z
@@ -1335,6 +1673,38 @@ export type SummarizationConfig = z.infer<typeof summarizationConfigSchema>;
 
 const customEndpointsSchema = z.array(endpointSchema.partial()).optional();
 
+const messageFilterPiiCustomPatternSchema = z.object({
+  id: z.string().min(1),
+  label: z.string().min(1),
+  regex: z
+    .string()
+    .min(1)
+    .refine(
+      (value) => {
+        try {
+          new RegExp(value, 'g');
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      { message: 'Invalid regex' },
+    ),
+});
+
+export const messageFilterPiiSchema = z.object({
+  starterPatterns: z.array(z.string()).optional(),
+  customPatterns: z.array(messageFilterPiiCustomPatternSchema).optional(),
+});
+
+export type MessageFilterPiiConfig = z.infer<typeof messageFilterPiiSchema>;
+
+export const messageFilterSchema = z.object({
+  pii: messageFilterPiiSchema.optional(),
+});
+
+export type MessageFilterConfig = z.infer<typeof messageFilterSchema>;
+
 export const configSchema = z.object({
   version: z.string(),
   cache: z.boolean().default(true),
@@ -1342,6 +1712,7 @@ export const configSchema = z.object({
   webSearch: webSearchSchema.optional(),
   memory: memorySchema.optional(),
   summarization: summarizationConfigSchema.optional(),
+  skillSync: skillSyncConfigSchema,
   secureImageLinks: z.boolean().optional(),
   imageOutputType: z.nativeEnum(EImageOutputType).default(EImageOutputType.PNG),
   includedTools: z.array(z.string()).optional(),
@@ -1382,6 +1753,7 @@ export const configSchema = z.object({
   rateLimits: rateLimitSchema.optional(),
   fileConfig: fileConfigSchema.optional(),
   modelSpecs: specsConfigSchema.optional(),
+  messageFilter: messageFilterSchema.optional(),
   endpoints: z
     .object({
       allowedAddresses: allowedAddressesSchema,
@@ -1490,43 +1862,32 @@ export const alternateName = {
 };
 
 const sharedOpenAIModels = [
+  'gpt-5.5',
+  'gpt-5.5-pro',
+  'chat-latest',
   'gpt-5.4',
-  // TODO: gpt-5.4-thinking may have separate reasoning token pricing — verify before release
-  'gpt-5.4-thinking',
   'gpt-5.4-pro',
+  'gpt-5.4-mini',
+  'gpt-5.4-nano',
+  'gpt-5.3-codex',
+  'gpt-5.2',
   'gpt-5.1',
-  'gpt-5.1-chat-latest',
   'gpt-5.1-codex',
+  'gpt-5.1-codex-max',
   'gpt-5.1-codex-mini',
   'gpt-5',
   'gpt-5-mini',
   'gpt-5-nano',
-  'gpt-5-chat-latest',
   'gpt-4.1',
   'gpt-4.1-mini',
   'gpt-4.1-nano',
   'gpt-4o-mini',
   'gpt-4o',
-  'gpt-4.5-preview',
-  'gpt-4.5-preview-2025-02-27',
-  'gpt-3.5-turbo',
-  'gpt-3.5-turbo-0125',
-  'gpt-4-turbo',
-  'gpt-4-turbo-2024-04-09',
-  'gpt-4-0125-preview',
-  'gpt-4-turbo-preview',
-  'gpt-4-1106-preview',
-  'gpt-3.5-turbo-1106',
-  'gpt-3.5-turbo-16k-0613',
-  'gpt-3.5-turbo-16k',
-  'gpt-4',
-  'gpt-4-0314',
-  'gpt-4-32k-0314',
-  'gpt-4-0613',
-  'gpt-3.5-turbo-0613',
 ];
 
 const sharedAnthropicModels = [
+  'claude-fable-5',
+  'claude-opus-4-8',
   'claude-opus-4-7',
   'claude-sonnet-4-6',
   'claude-opus-4-6',
@@ -1550,6 +1911,8 @@ const sharedAnthropicModels = [
 ];
 
 export const bedrockModels = [
+  'anthropic.claude-fable-5',
+  'anthropic.claude-opus-4-8',
   'anthropic.claude-opus-4-7',
   'anthropic.claude-sonnet-4-6',
   'anthropic.claude-opus-4-6-v1',
@@ -1588,6 +1951,8 @@ export const defaultModels = {
   [EModelEndpoint.assistants]: [...sharedOpenAIModels, 'chatgpt-4o-latest'],
   [EModelEndpoint.agents]: sharedOpenAIModels, // TODO: Add agent models (agentsModels)
   [EModelEndpoint.google]: [
+    // Gemini 3.5 Models
+    'gemini-3.5-flash',
     // Gemini 3.1 Models
     'gemini-3.1-pro-preview',
     'gemini-3.1-pro-preview-customtools',
@@ -2097,6 +2462,10 @@ export enum SettingsTabValues {
    * Tab for Personalization Settings
    */
   PERSONALIZATION = 'personalization',
+  /**
+   * Tab for About / Build Info
+   */
+  ABOUT = 'about',
 }
 
 export enum STTProviders {
@@ -2131,10 +2500,18 @@ export enum TTSProviders {
 
 /** Enum for app-wide constants */
 export enum Constants {
-  /** Key for the app's version. */
-  VERSION = 'v0.8.6-rc1',
+  /**
+   * Key for the app's version. The placeholder `__LIBRECHAT_VERSION__` is
+   * swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
+   * using the value of the root `package.json`'s `version` field. Consumers
+   * always import this via the built dist bundle (see `main` field in
+   * `packages/data-provider/package.json`), so production and UI code get the
+   * substituted value. Only tests that import the TypeScript source directly
+   * would observe the raw placeholder.
+   */
+  VERSION = '__LIBRECHAT_VERSION__',
   /** Key for the Custom Config's version (librechat.yaml). */
-  CONFIG_VERSION = '1.3.11',
+  CONFIG_VERSION = '1.3.13',
   /** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
   NO_PARENT = '00000000-0000-0000-0000-000000000000',
   /** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -2188,9 +2565,6 @@ export enum Constants {
   SUBAGENT = 'subagent',
 }
 
-/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
-export const MAX_SUBAGENTS = 10;
-
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 export const MAX_SUBAGENT_DEPTH = 5;
 
diff --git a/packages/data-provider/src/createPayload.ts b/packages/data-provider/src/createPayload.ts
index 783ad7f9dd8..da20e7d1acf 100644
--- a/packages/data-provider/src/createPayload.ts
+++ b/packages/data-provider/src/createPayload.ts
@@ -2,6 +2,15 @@ import type * as t from './types';
 import { EndpointURLs } from './config';
 import * as s from './schemas';
 
+/** Resolves the browser's IANA timezone so the server can localize prompt variables. */
+function getUserTimezone(): string | undefined {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export default function createPayload(submission: t.TSubmission) {
   const {
     isEdited,
@@ -42,6 +51,7 @@ export default function createPayload(submission: t.TSubmission) {
     isContinued: !!(isEdited && isContinued),
     ephemeralAgent: s.isAssistantsEndpoint(endpoint) ? undefined : ephemeralAgent,
     manualSkills: s.isAssistantsEndpoint(endpoint) ? undefined : manualSkills,
+    timezone: getUserTimezone(),
   };
 
   return { server, payload };
diff --git a/packages/data-provider/src/data-service.ts b/packages/data-provider/src/data-service.ts
index 15cf7ed17d8..80e55551706 100644
--- a/packages/data-provider/src/data-service.ts
+++ b/packages/data-provider/src/data-service.ts
@@ -1,18 +1,20 @@
 import type { AxiosResponse } from 'axios';
+import type { TContextProjectionRequest, TContextUsageEvent } from './types/runs';
+import type { TFileConfig } from './file-config';
 import type * as t from './types';
+import * as permissions from './accessPermissions';
 import * as endpoints from './api-endpoints';
+import * as mcp from './types/mcpServers';
 import * as a from './types/assistants';
-import * as ag from './types/agents';
 import * as m from './types/mutations';
+import * as ag from './types/agents';
 import * as q from './types/queries';
-import * as f from './types/files';
 import * as sk from './types/skills';
-import * as mcp from './types/mcpServers';
+import * as f from './types/files';
 import * as config from './config';
 import request from './request';
 import * as s from './schemas';
 import * as r from './roles';
-import * as permissions from './accessPermissions';
 
 export function revokeUserKey(name: string): Promise<unknown> {
   return request.delete(endpoints.revokeUserKey(name));
@@ -62,14 +64,16 @@ export function getSharedMessages(shareId: string): Promise<t.TSharedMessagesRes
   return request.get(endpoints.shareMessages(shareId));
 }
 
+export function getSharedStartupConfig(shareId: string): Promise<config.TSharedLinkStartupConfig> {
+  return request.get(endpoints.sharedStartupConfig(shareId));
+}
+
 export const listSharedLinks = async (
   params: q.SharedLinksListParams,
 ): Promise<q.SharedLinksResponse> => {
-  const { pageSize, isPublic, sortBy, sortDirection, search, cursor } = params;
+  const { pageSize, sortBy, sortDirection, search, cursor } = params;
 
-  return request.get(
-    endpoints.getSharedLinks(pageSize, isPublic, sortBy, sortDirection, search, cursor),
-  );
+  return request.get(endpoints.getSharedLinks(pageSize, sortBy, sortDirection, search, cursor));
 };
 
 export function getSharedLink(conversationId: string): Promise<t.TSharedLinkGetResponse> {
@@ -79,12 +83,20 @@ export function getSharedLink(conversationId: string): Promise<t.TSharedLinkGetR
 export function createSharedLink(
   conversationId: string,
   targetMessageId?: string,
+  snapshotFiles?: boolean,
 ): Promise<t.TSharedLinkResponse> {
-  return request.post(endpoints.createSharedLink(conversationId), { targetMessageId });
+  return request.post(endpoints.createSharedLink(conversationId), {
+    targetMessageId,
+    snapshotFiles,
+  });
 }
 
-export function updateSharedLink(shareId: string): Promise<t.TSharedLinkResponse> {
-  return request.patch(endpoints.updateSharedLink(shareId));
+export function updateSharedLink(
+  shareId: string,
+  targetMessageId?: string,
+  snapshotFiles?: boolean,
+): Promise<t.TSharedLinkResponse> {
+  return request.patch(endpoints.updateSharedLink(shareId), { targetMessageId, snapshotFiles });
 }
 
 export function deleteSharedLink(shareId: string): Promise<m.TDeleteSharedLinkResponse> {
@@ -225,18 +237,34 @@ export function cancelMCPOAuth(serverName: string): Promise<m.CancelMCPOAuthResp
 
 /* Config */
 
-export const getStartupConfig = (): Promise<
+export type StartupConfigOptions = {
+  context?: config.StartupConfigContext;
+};
+
+export const getStartupConfig = (
+  options?: StartupConfigOptions,
+): Promise<
   config.TStartupConfig & {
     mcpCustomUserVars?: Record<string, { title: string; description: string }>;
   }
 > => {
-  return request.get(endpoints.config());
+  return request.get(endpoints.config(options?.context));
 };
 
 export const getAIEndpoints = (): Promise<t.TEndpointsConfig> => {
   return request.get(endpoints.aiEndpoints());
 };
 
+export const getTokenConfig = (): Promise<t.TTokenConfigMap> => {
+  return request.get(endpoints.tokenConfig());
+};
+
+export const getContextProjection = (
+  payload: TContextProjectionRequest,
+): Promise<TContextUsageEvent | null> => {
+  return request.post(endpoints.contextProjection(), payload);
+};
+
 export const getModels = async (): Promise<t.TModelsConfig> => {
   return request.get(endpoints.models());
 };
@@ -418,11 +446,16 @@ export const getFilePreview = (fileId: string): Promise<f.TFilePreview> => {
   return request.get(endpoints.filePreview(fileId));
 };
 
+/** Preview status for a snapshotted file served through a shared link. */
+export const getSharedFilePreview = (shareId: string, fileId: string): Promise<f.TFilePreview> => {
+  return request.get(endpoints.sharedFilePreview(shareId, fileId));
+};
+
 export const getAgentFiles = (agentId: string): Promise<f.TFile[]> => {
   return request.get(endpoints.agentFiles(agentId));
 };
 
-export const getFileConfig = (): Promise<f.FileConfig> => {
+export const getFileConfig = (): Promise<TFileConfig> => {
   return request.get(`${endpoints.files()}/config`);
 };
 
@@ -704,6 +737,19 @@ export const getFileDownloadURL = async (
   return request.get(`${endpoints.files()}/download-url/${userId}/${file_id}`);
 };
 
+/** Blob download for a snapshotted file served through a shared link. */
+export const getSharedFileDownload = async (
+  shareId: string,
+  file_id: string,
+): Promise<AxiosResponse> => {
+  return request.getResponse(endpoints.sharedFileDownload(shareId, file_id), {
+    responseType: 'blob',
+    headers: {
+      Accept: 'application/octet-stream',
+    },
+  });
+};
+
 export const getCodeOutputDownload = async (url: string): Promise<AxiosResponse> => {
   return request.getResponse(url, {
     responseType: 'blob',
@@ -787,6 +833,40 @@ export function archiveConversation(
   return request.post(endpoints.archiveConversation(), { arg: payload });
 }
 
+export function listProjects(params?: q.ProjectListParams): Promise<q.ProjectListResponse> {
+  return request.get(endpoints.projects(params ?? {}));
+}
+
+export function createProject(payload: t.TCreateChatProjectRequest): Promise<t.TChatProject> {
+  return request.post(endpoints.projects(), payload);
+}
+
+export function getProjectById(projectId: string): Promise<t.TChatProject> {
+  return request.get(endpoints.projectById(projectId));
+}
+
+export function updateProject(payload: t.TUpdateChatProjectRequest): Promise<t.TChatProject> {
+  const { projectId, ...data } = payload;
+  return request.patch(endpoints.projectById(projectId), data);
+}
+
+export function deleteProject(projectId: string): Promise<t.TDeleteChatProjectResponse> {
+  return request.delete(endpoints.projectById(projectId));
+}
+
+export function assignConversationToProject(
+  payload: t.TAssignConversationToProjectRequest,
+): Promise<t.TAssignConversationToProjectResponse> {
+  const { conversationId, projectId } = payload;
+  return request.put(endpoints.projectConversation(conversationId), { projectId });
+}
+
+export function pinConversation(
+  payload: t.TPinConversationRequest,
+): Promise<t.TPinConversationResponse> {
+  return request.post(endpoints.pinConversation(), { arg: payload });
+}
+
 export function genTitle(payload: m.TGenTitleRequest): Promise<m.TGenTitleResponse> {
   return request.get(endpoints.genTitle(payload.conversationId));
 }
@@ -1044,6 +1124,29 @@ export const updateSkillNodeContent = (variables: {
   });
 };
 
+export function getGitHubSkillSyncStatus(): Promise<sk.TGitHubSkillSyncStatusResponse> {
+  return request.get(endpoints.adminSkillsSyncStatus());
+}
+
+export function runGitHubSkillSync(): Promise<sk.TGitHubSkillSyncManualRunResponse> {
+  return request.post(endpoints.adminSkillsSyncRun());
+}
+
+export function setGitHubSkillSyncCredential(variables: {
+  credentialKey: string;
+  token: string;
+}): Promise<sk.TGitHubSkillSyncCredentialSummary> {
+  return request.put(endpoints.adminSkillsSyncCredential(variables.credentialKey), {
+    token: variables.token,
+  } satisfies sk.TGitHubSkillSyncCredentialUpdateRequest);
+}
+
+export function deleteGitHubSkillSyncCredential(
+  credentialKey: string,
+): Promise<{ credentialKey: string; deleted: boolean }> {
+  return request.delete(endpoints.adminSkillsSyncCredential(credentialKey));
+}
+
 /* Roles */
 export function listRoles(): Promise<q.ListRolesResponse> {
   return request.get(`${endpoints.adminRoles()}?limit=200`);
diff --git a/packages/data-provider/src/file-config.spec.ts b/packages/data-provider/src/file-config.spec.ts
index f5973538762..b564f5a9137 100644
--- a/packages/data-provider/src/file-config.spec.ts
+++ b/packages/data-provider/src/file-config.spec.ts
@@ -23,6 +23,10 @@ describe('inferMimeType', () => {
     expect(inferMimeType('test.md', 'text/x-markdown')).toBe('text/markdown');
   });
 
+  it('should normalize application/x-zip-compressed to application/zip', () => {
+    expect(inferMimeType('archive.zip', 'application/x-zip-compressed')).toBe('application/zip');
+  });
+
   it('should return a type that matches textMimeTypes after normalization', () => {
     const normalized = inferMimeType('test.py', 'text/x-python-script');
     expect(textMimeTypes.test(normalized)).toBe(true);
@@ -36,6 +40,7 @@ describe('inferMimeType', () => {
   it('should infer from extension when browser type is empty', () => {
     expect(inferMimeType('test.py', '')).toBe('text/x-python');
     expect(inferMimeType('code.js', '')).toBe('text/javascript');
+    expect(inferMimeType('archive.zip', '')).toBe('application/zip');
     expect(inferMimeType('photo.heic', '')).toBe('image/heic');
     expect(inferMimeType('Main.java', '')).toBe('text/x-java');
   });
@@ -82,6 +87,7 @@ describe('applicationMimeTypes', () => {
     'application/msword',
     'application/xml',
     'application/zip',
+    'application/x-zip-compressed',
     'application/epub+zip',
     'application/x-tar',
     'application/x-sh',
diff --git a/packages/data-provider/src/file-config.ts b/packages/data-provider/src/file-config.ts
index 457c4950ccd..06f6b4806d3 100644
--- a/packages/data-provider/src/file-config.ts
+++ b/packages/data-provider/src/file-config.ts
@@ -61,6 +61,7 @@ export const fullMimeTypesList = [
   'application/vnd.coffeescript',
   'application/xml',
   'application/zip',
+  'application/x-zip-compressed',
   'application/x-parquet',
   'application/vnd.oasis.opendocument.text',
   'application/vnd.oasis.opendocument.spreadsheet',
@@ -121,6 +122,7 @@ export const codeInterpreterMimeTypesList = [
   'application/typescript',
   'application/xml',
   'application/zip',
+  'application/x-zip-compressed',
   'application/x-parquet',
   ...excelFileTypes,
 ];
@@ -185,7 +187,7 @@ export const textMimeTypes =
   /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
 
 export const applicationMimeTypes =
-  /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+  /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 
 export const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 
@@ -367,6 +369,7 @@ export const imageTypeMapping: { [key: string]: string } = {
 
 /** Normalizes non-standard MIME types that browsers may report to their canonical forms */
 export const mimeTypeAliases: Readonly<Record<string, string>> = {
+  'application/x-zip-compressed': 'application/zip',
   'text/x-python-script': 'text/x-python',
   'text/x-markdown': 'text/markdown',
 };
diff --git a/packages/data-provider/src/generate.ts b/packages/data-provider/src/generate.ts
index 21f63a34d92..c184983505c 100644
--- a/packages/data-provider/src/generate.ts
+++ b/packages/data-provider/src/generate.ts
@@ -614,7 +614,9 @@ export const generateGoogleSchema = (customGoogle: GoogleSettings) => {
         promptPrefix: obj.promptPrefix ?? null,
         examples: obj.examples ?? [{ input: { content: '' }, output: { content: '' } }],
         temperature: obj.temperature ?? defaults.temperature.default,
-        maxOutputTokens: obj.maxOutputTokens ?? defaults.maxOutputTokens.default,
+        maxOutputTokens:
+          obj.maxOutputTokens ??
+          defaults.maxOutputTokens.reset(obj.model ?? defaults.model.default),
         topP: obj.topP ?? defaults.topP.default,
         topK: obj.topK ?? defaults.topK.default,
         maxContextTokens: obj.maxContextTokens ?? undefined,
diff --git a/packages/data-provider/src/index.ts b/packages/data-provider/src/index.ts
index bb166d975ae..7ecaf4ba8a2 100644
--- a/packages/data-provider/src/index.ts
+++ b/packages/data-provider/src/index.ts
@@ -36,7 +36,13 @@ export * from './accessPermissions';
 export * from './keys';
 /* api call helpers */
 export * from './headers-helpers';
-export { loginPage, registerPage, apiBaseUrl, buildLoginRedirectUrl } from './api-endpoints';
+export {
+  loginPage,
+  registerPage,
+  apiBaseUrl,
+  sharedFileDownload,
+  buildLoginRedirectUrl,
+} from './api-endpoints';
 export { default as request } from './request';
 export { dataService };
 import * as dataService from './data-service';
diff --git a/packages/data-provider/src/keys.ts b/packages/data-provider/src/keys.ts
index 36f42866175..dde54005a66 100644
--- a/packages/data-provider/src/keys.ts
+++ b/packages/data-provider/src/keys.ts
@@ -1,6 +1,7 @@
 export enum QueryKeys {
   messages = 'messages',
   sharedMessages = 'sharedMessages',
+  sharedStartupConfig = 'sharedStartupConfig',
   sharedLinks = 'sharedLinks',
   allConversations = 'allConversations',
   archivedConversations = 'archivedConversations',
@@ -12,6 +13,8 @@ export enum QueryKeys {
   models = 'models',
   balance = 'balance',
   endpoints = 'endpoints',
+  tokenConfig = 'tokenConfig',
+  contextProjection = 'contextProjection',
   presets = 'presets',
   searchResults = 'searchResults',
   tokenCount = 'tokenCount',
@@ -42,6 +45,9 @@ export enum QueryKeys {
   promptGroups = 'promptGroups',
   allPromptGroups = 'allPromptGroups',
   promptGroup = 'promptGroup',
+  projects = 'projects',
+  project = 'project',
+  projectConversations = 'projectConversations',
   categories = 'categories',
   randomPrompts = 'randomPrompts',
   agentCategories = 'agentCategories',
@@ -112,10 +118,15 @@ export enum MutationKeys {
   enableTwoFactor = 'enableTwoFactor',
   verifyTwoFactor = 'verifyTwoFactor',
   updateMemoryPreferences = 'updateMemoryPreferences',
+  createProject = 'createProject',
+  updateProject = 'updateProject',
+  deleteProject = 'deleteProject',
+  assignConversationToProject = 'assignConversationToProject',
   /* Skill mutations from the original UI PR — tree/node operations are
    * phase 2 and currently stubbed in the data-service layer. */
   createSkillNode = 'createSkillNode',
   updateSkillNode = 'updateSkillNode',
   deleteSkillNode = 'deleteSkillNode',
   updateSkillNodeContent = 'updateSkillNodeContent',
+  convoPin = 'convoPin',
 }
diff --git a/packages/data-provider/src/limits.ts b/packages/data-provider/src/limits.ts
new file mode 100644
index 00000000000..7dbabf6d2ce
--- /dev/null
+++ b/packages/data-provider/src/limits.ts
@@ -0,0 +1,2 @@
+/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
+export const MAX_SUBAGENTS = 10;
diff --git a/packages/data-provider/src/mcp.ts b/packages/data-provider/src/mcp.ts
index b22a599b9b6..bf9953d51c6 100644
--- a/packages/data-provider/src/mcp.ts
+++ b/packages/data-provider/src/mcp.ts
@@ -2,6 +2,158 @@ import { z } from 'zod';
 import { TokenExchangeMethodEnum } from './types/agents';
 import { extractEnvVariable } from './utils';
 
+const validateOAuthClientCredentials = (
+  oauth: {
+    client_id?: string;
+    client_secret?: string;
+    authorization_url?: string;
+    token_url?: string;
+  },
+  ctx: z.RefinementCtx,
+): void => {
+  if (oauth.client_secret && !oauth.client_id) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['client_secret'],
+      message: 'OAuth client_secret requires client_id',
+    });
+  }
+
+  if (oauth.client_id && oauth.client_secret && (!oauth.authorization_url || !oauth.token_url)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['client_secret'],
+      message: 'OAuth client_secret with client_id requires both authorization_url and token_url',
+    });
+  }
+};
+
+const OAuthOptionsBaseSchema = z.object({
+  /** OAuth authorization endpoint (optional - can be auto-discovered) */
+  authorization_url: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
+  /** OAuth token endpoint (optional - can be auto-discovered) */
+  token_url: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
+  /** OAuth client ID (optional - can use dynamic registration) */
+  client_id: z.string().optional(),
+  /** OAuth client secret (requires explicit authorization and token endpoints) */
+  client_secret: z.string().optional(),
+  /** OAuth scopes to request */
+  scope: z.string().optional(),
+  /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
+  redirect_uri: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
+  /** Token exchange method */
+  token_exchange_method: z.nativeEnum(TokenExchangeMethodEnum).optional(),
+  /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
+  grant_types_supported: z.array(z.string()).optional(),
+  /** Supported token endpoint authentication methods (defaults to ['client_secret_basic', 'client_secret_post']) */
+  token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+  /** Supported response types (defaults to ['code']) */
+  response_types_supported: z.array(z.string()).optional(),
+  /** Supported code challenge methods (defaults to ['S256', 'plain']) */
+  code_challenge_methods_supported: z.array(z.string()).optional(),
+  /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
+  skip_code_challenge_check: z.boolean().optional(),
+  /**
+   * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+   * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+   * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+   * automatically from Protected Resource Metadata) is the standards-conformant
+   * route; `audience` covers the providers that ignore it.
+   *
+   * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+   * and DCR-discovered paths). Whether it is also forwarded on the
+   * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+   *
+   * The `authorization_code` exchange intentionally never receives `audience` —
+   * Auth0 binds audience from the original `/authorize` request and embeds it
+   * in the issued access token; sending it again is redundant.
+   *
+   * No canonicalization is applied — the audience identifier is provider-defined
+   * and may differ from the MCP server URL. This field is only accepted from
+   * trusted/admin MCP configuration and is rejected from user-managed servers.
+   */
+  audience: z.string().min(1).optional(),
+  /**
+   * Whether to also forward `audience` on the `refresh_token` grant body.
+   *
+   * Default: `true`. Required for Auth0, which strips the API audience from
+   * refreshed access tokens unless `audience` is re-supplied on every refresh
+   * — without it the next MCP call 401s once the initial access token expires.
+   *
+   * Set to `false` for providers that document refresh requests as
+   * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+   * strict OAuth 2.0 token endpoints). Those providers maintain the original
+   * `aud` claim across refreshes when the initial token was resource-bound,
+   * so the extra parameter is redundant and may be rejected as
+   * `invalid_request`.
+   *
+   * Ignored when `audience` itself is not configured.
+   */
+  forward_audience_on_refresh: z.boolean().optional(),
+  /** OAuth revocation endpoint (optional - can be auto-discovered) */
+  revocation_endpoint: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
+  /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
+  revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+});
+
+const OAuthOptionsSchema = OAuthOptionsBaseSchema.superRefine(validateOAuthClientCredentials);
+
+const BLOCKED_USER_OAUTH_ENDPOINT_PARAMS = ['audience', 'resource'] as const;
+const envVarPattern = /\$\{[^}]+\}/;
+
+const userOAuthEndpointUrlSchema = z
+  .string()
+  .refine((val) => !envVarPattern.test(val), {
+    message: 'Environment variable references are not allowed in URLs',
+  })
+  .pipe(z.string().url())
+  .refine(
+    (value) => {
+      try {
+        const { searchParams } = new URL(value);
+        return BLOCKED_USER_OAUTH_ENDPOINT_PARAMS.every((param) => !searchParams.has(param));
+      } catch {
+        return true;
+      }
+    },
+    { message: 'OAuth endpoint URLs cannot include audience or resource query parameters' },
+  );
+
+const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
+  audience: true,
+  forward_audience_on_refresh: true,
+})
+  .extend({
+    authorization_url: userOAuthEndpointUrlSchema.optional(),
+    token_url: userOAuthEndpointUrlSchema.optional(),
+    redirect_uri: userOAuthEndpointUrlSchema.optional(),
+    revocation_endpoint: userOAuthEndpointUrlSchema.optional(),
+    audience: z.never().optional(),
+    forward_audience_on_refresh: z.never().optional(),
+  })
+  .superRefine(validateOAuthClientCredentials);
+
+const OboOptionsSchema = z.object({
+  /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+  scopes: z.string().min(1),
+});
+
 const BaseOptionsSchema = z.object({
   /** Display name for the MCP server - only letters, numbers, and spaces allowed */
   title: z
@@ -39,40 +191,9 @@ const BaseOptionsSchema = z.object({
   /**
    * OAuth configuration for SSE and Streamable HTTP transports
    * - Optional: OAuth can be auto-discovered on 401 responses
-   * - Pre-configured values will skip discovery steps
+   * - Pre-configured confidential clients must pin both OAuth endpoints
    */
-  oauth: z
-    .object({
-      /** OAuth authorization endpoint (optional - can be auto-discovered) */
-      authorization_url: z.string().url().optional(),
-      /** OAuth token endpoint (optional - can be auto-discovered) */
-      token_url: z.string().url().optional(),
-      /** OAuth client ID (optional - can use dynamic registration) */
-      client_id: z.string().optional(),
-      /** OAuth client secret (optional - can use dynamic registration) */
-      client_secret: z.string().optional(),
-      /** OAuth scopes to request */
-      scope: z.string().optional(),
-      /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-      redirect_uri: z.string().url().optional(),
-      /** Token exchange method */
-      token_exchange_method: z.nativeEnum(TokenExchangeMethodEnum).optional(),
-      /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
-      grant_types_supported: z.array(z.string()).optional(),
-      /** Supported token endpoint authentication methods (defaults to ['client_secret_basic', 'client_secret_post']) */
-      token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-      /** Supported response types (defaults to ['code']) */
-      response_types_supported: z.array(z.string()).optional(),
-      /** Supported code challenge methods (defaults to ['S256', 'plain']) */
-      code_challenge_methods_supported: z.array(z.string()).optional(),
-      /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
-      skip_code_challenge_check: z.boolean().optional(),
-      /** OAuth revocation endpoint (optional - can be auto-discovered) */
-      revocation_endpoint: z.string().url().optional(),
-      /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
-      revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-    })
-    .optional(),
+  oauth: OAuthOptionsSchema.optional(),
   /** Custom headers to send with OAuth requests (registration, discovery, token exchange, etc.) */
   oauth_headers: z.record(z.string(), z.string()).optional(),
   /**
@@ -98,13 +219,39 @@ const BaseOptionsSchema = z.object({
       z.object({
         title: z.string(),
         description: z.string(),
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.boolean().optional(),
       }),
     )
     .optional(),
 });
 
+const ProxyUrlSchema = z
+  .string()
+  .transform((val: string) => extractEnvVariable(val))
+  .pipe(z.string().url())
+  .refine(
+    (val: string) => {
+      const protocol = new URL(val).protocol;
+      return (
+        protocol === 'http:' ||
+        protocol === 'https:' ||
+        protocol === 'socks:' ||
+        protocol === 'socks5:'
+      );
+    },
+    {
+      message: 'Proxy URL must use http://, https://, socks://, or socks5://',
+    },
+  );
+
 export const StdioOptionsSchema = BaseOptionsSchema.extend({
   type: z.literal('stdio').default('stdio'),
+  obo: z.undefined().optional(),
   /**
    * The executable to run to start the server.
    */
@@ -145,6 +292,7 @@ export const StdioOptionsSchema = BaseOptionsSchema.extend({
 
 export const WebSocketOptionsSchema = BaseOptionsSchema.extend({
   type: z.literal('websocket').default('websocket'),
+  obo: z.undefined().optional(),
   url: z
     .string()
     .transform((val: string) => extractEnvVariable(val))
@@ -163,6 +311,16 @@ export const WebSocketOptionsSchema = BaseOptionsSchema.extend({
 export const SSEOptionsSchema = BaseOptionsSchema.extend({
   type: z.literal('sse').default('sse'),
   headers: z.record(z.string(), z.string()).optional(),
+  /**
+   * On-Behalf-Of (OBO) token exchange configuration.
+   * When configured, LibreChat exchanges the logged-in user's federated access token
+   * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+   * The exchanged token is injected as a Bearer Authorization header automatically.
+   * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+   */
+  obo: OboOptionsSchema.optional(),
+  /** Optional outbound proxy URL for this remote MCP transport */
+  proxy: ProxyUrlSchema.optional(),
   url: z
     .string()
     .transform((val: string) => extractEnvVariable(val))
@@ -181,6 +339,16 @@ export const SSEOptionsSchema = BaseOptionsSchema.extend({
 export const StreamableHTTPOptionsSchema = BaseOptionsSchema.extend({
   type: z.union([z.literal('streamable-http'), z.literal('http')]),
   headers: z.record(z.string(), z.string()).optional(),
+  /**
+   * On-Behalf-Of (OBO) token exchange configuration.
+   * When configured, LibreChat exchanges the logged-in user's federated access token
+   * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+   * The exchanged token is injected as a Bearer Authorization header automatically.
+   * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+   */
+  obo: OboOptionsSchema.optional(),
+  /** Optional outbound proxy URL for this remote MCP transport */
+  proxy: ProxyUrlSchema.optional(),
   url: z
     .string()
     .transform((val: string) => extractEnvVariable(val))
@@ -223,7 +391,11 @@ const omitServerManagedFields = <T extends z.ZodObject<z.ZodRawShape>>(schema: T
     oauth_headers: true,
   });
 
-const envVarPattern = /\$\{[^}]+\}/;
+const userManagedServerFields = <T extends z.ZodObject<z.ZodRawShape>>(schema: T) =>
+  omitServerManagedFields(schema).extend({
+    oauth: UserOAuthOptionsSchema.optional(),
+  });
+
 const isWsProtocol = (val: string): boolean => /^wss?:/i.test(val);
 const isHttpProtocol = (val: string): boolean => /^https?:/i.test(val);
 
@@ -243,7 +415,8 @@ const userUrlSchema = (protocolCheck: (val: string) => boolean, message: string)
 /**
  * MCP Server configuration that comes from UI/API input only.
  * Omits server-managed fields like startup, timeout, customUserVars, etc.
- * Allows: title, description, url, iconPath, oauth (user credentials)
+ * Allows: title, description, url, iconPath, oauth (user credentials).
+ * Admin-only OAuth audience fields are rejected for user-managed servers.
  *
  * SECURITY: Stdio transport is intentionally excluded from user input.
  * Stdio allows arbitrary command execution and should only be configured
@@ -257,15 +430,42 @@ const userUrlSchema = (protocolCheck: (val: string) => boolean, message: string)
  * file://, ftp://, javascript:, and other non-network schemes.
  */
 export const MCPServerUserInputSchema = z.union([
-  omitServerManagedFields(WebSocketOptionsSchema).extend({
+  userManagedServerFields(WebSocketOptionsSchema).extend({
     url: userUrlSchema(isWsProtocol, 'WebSocket URL must use ws:// or wss://'),
   }),
-  omitServerManagedFields(SSEOptionsSchema).extend({
+  userManagedServerFields(SSEOptionsSchema).extend({
+    proxy: z.never().optional(),
     url: userUrlSchema(isHttpProtocol, 'SSE URL must use http:// or https://'),
   }),
-  omitServerManagedFields(StreamableHTTPOptionsSchema).extend({
+  userManagedServerFields(StreamableHTTPOptionsSchema).extend({
+    proxy: z.never().optional(),
     url: userUrlSchema(isHttpProtocol, 'Streamable HTTP URL must use http:// or https://'),
   }),
 ]);
 
 export type MCPServerUserInput = z.infer<typeof MCPServerUserInputSchema>;
+
+/**
+ * Set of every field name that may appear in a user-submitted MCP server config,
+ * derived from `MCPServerUserInputSchema`'s union members. Used as the comparison
+ * surface for the OBO lockdown check in `updateMCPServerController` so that
+ * server-managed fields on the existing config (`dbId`, `source`, `author`,
+ * `requiresOAuth`, `oauthMetadata`, etc.) don't show up as differences and
+ * cause spurious 403s on legitimate saves.
+ *
+ * Schema-derived rather than hand-maintained: when a new field is added to
+ * `BaseOptionsSchema` or any transport variant, it flows into this set
+ * automatically. The OBO lockdown then locks the new field by default
+ * (since it won't be in the hand-curated `OBO_USER_EDITABLE_FIELDS`
+ * allowlist), preventing a silent privilege regression.
+ */
+export const MCP_USER_INPUT_FIELDS: ReadonlySet<string> = (() => {
+  const fields = new Set<string>();
+  for (const variant of MCPServerUserInputSchema.options) {
+    const shape = (variant as unknown as { shape: Record<string, unknown> }).shape;
+    for (const key of Object.keys(shape)) {
+      fields.add(key);
+    }
+  }
+  return fields;
+})();
diff --git a/packages/data-provider/src/models.ts b/packages/data-provider/src/models.ts
index 6be55effded..b34d51feb3f 100644
--- a/packages/data-provider/src/models.ts
+++ b/packages/data-provider/src/models.ts
@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { AgentSubagentsConfig } from './types/assistants';
 import type { TModelSpecPreset } from './schemas';
 import {
   EModelEndpoint,
@@ -7,6 +8,7 @@ import {
   AuthType,
   authTypeSchema,
 } from './schemas';
+import { MAX_SUBAGENTS } from './limits';
 
 export type TModelSpec = {
   name: string;
@@ -14,6 +16,7 @@ export type TModelSpec = {
   preset: TModelSpecPreset;
   order?: number;
   default?: boolean;
+  softDefault?: boolean;
   description?: string;
   /**
    * Optional group name for organizing specs in the UI selector.
@@ -30,33 +33,53 @@ export type TModelSpec = {
   groupIcon?: string | EModelEndpoint;
   showIconInMenu?: boolean;
   showIconInHeader?: boolean;
+  /** Show this spec's label and description on the chat landing in place of the greeting. */
+  showOnLanding?: boolean;
+  /** Conversation starter prompts shown on the chat landing while this spec is active. */
+  conversation_starters?: string[];
   iconURL?: string | EModelEndpoint; // Allow using project-included icons
   authType?: AuthType;
+  /** Hide the chat input tool badge row while this model spec is active. */
+  hideBadgeRow?: boolean;
   webSearch?: boolean;
   fileSearch?: boolean;
   executeCode?: boolean;
   artifacts?: string | boolean;
   mcpServers?: string[];
+  skills?: boolean | string[];
+  subagents?: AgentSubagentsConfig;
 };
 
+export const modelSpecSubagentsSchema = z.object({
+  enabled: z.boolean().optional(),
+  allowSelf: z.boolean().optional(),
+  agent_ids: z.array(z.string()).max(MAX_SUBAGENTS).optional(),
+});
+
 export const tModelSpecSchema = z.object({
   name: z.string(),
   label: z.string(),
   preset: tModelSpecPresetSchema,
   order: z.number().optional(),
   default: z.boolean().optional(),
+  softDefault: z.boolean().optional(),
   description: z.string().optional(),
   group: z.string().optional(),
   groupIcon: z.union([z.string(), eModelEndpointSchema]).optional(),
   showIconInMenu: z.boolean().optional(),
   showIconInHeader: z.boolean().optional(),
+  showOnLanding: z.boolean().optional(),
+  conversation_starters: z.array(z.string()).optional(),
   iconURL: z.union([z.string(), eModelEndpointSchema]).optional(),
   authType: authTypeSchema.optional(),
+  hideBadgeRow: z.boolean().optional(),
   webSearch: z.boolean().optional(),
   fileSearch: z.boolean().optional(),
   executeCode: z.boolean().optional(),
   artifacts: z.union([z.string(), z.boolean()]).optional(),
   mcpServers: z.array(z.string()).optional(),
+  skills: z.union([z.boolean(), z.array(z.string())]).optional(),
+  subagents: modelSpecSubagentsSchema.optional(),
 });
 
 export const specsConfigSchema = z.object({
diff --git a/packages/data-provider/src/parameterSettings.spec.ts b/packages/data-provider/src/parameterSettings.spec.ts
new file mode 100644
index 00000000000..a8e269525a0
--- /dev/null
+++ b/packages/data-provider/src/parameterSettings.spec.ts
@@ -0,0 +1,57 @@
+import { EModelEndpoint } from './types';
+import { applyModelAwareDefaults, paramSettings } from './parameterSettings';
+import type { SettingDefinition } from './generate';
+
+const googleParams = paramSettings[EModelEndpoint.google] as SettingDefinition[];
+const maxOut = (params: SettingDefinition[]) => params.find((p) => p.key === 'maxOutputTokens');
+
+describe('applyModelAwareDefaults', () => {
+  it('resolves the Google maxOutputTokens default for current Gemini models', () => {
+    const result = applyModelAwareDefaults(googleParams, EModelEndpoint.google, 'gemini-2.5-pro');
+    expect(maxOut(result)?.default).toBe(65535);
+  });
+
+  it('resolves the legacy default for older Gemini models', () => {
+    const result = applyModelAwareDefaults(googleParams, EModelEndpoint.google, 'gemini-1.5-flash');
+    expect(maxOut(result)?.default).toBe(8192);
+  });
+
+  it('resolves the image default for Gemini image models', () => {
+    const result = applyModelAwareDefaults(
+      googleParams,
+      EModelEndpoint.google,
+      'gemini-2.5-flash-image',
+    );
+    expect(maxOut(result)?.default).toBe(32768);
+  });
+
+  it('returns settings unchanged for non-Google endpoints', () => {
+    const result = applyModelAwareDefaults(
+      googleParams,
+      EModelEndpoint.anthropic,
+      'gemini-2.5-pro',
+    );
+    expect(result).toBe(googleParams);
+  });
+
+  it('returns settings unchanged when no model is provided', () => {
+    expect(applyModelAwareDefaults(googleParams, EModelEndpoint.google, '')).toBe(googleParams);
+  });
+
+  it('does not mutate the original settings', () => {
+    const before = maxOut(googleParams)?.default;
+    applyModelAwareDefaults(googleParams, EModelEndpoint.google, 'gemini-2.5-pro');
+    expect(maxOut(googleParams)?.default).toBe(before);
+  });
+
+  it('lets a configured override applied afterward take precedence', () => {
+    const modelAware = applyModelAwareDefaults(
+      googleParams,
+      EModelEndpoint.google,
+      'gemini-2.5-pro',
+    );
+    const override = { ...maxOut(modelAware), default: 2048 } as SettingDefinition;
+    const final = modelAware.map((p) => (p.key === 'maxOutputTokens' ? override : p));
+    expect(maxOut(final)?.default).toBe(2048);
+  });
+});
diff --git a/packages/data-provider/src/parameterSettings.ts b/packages/data-provider/src/parameterSettings.ts
index e9b4f36f11b..44389cb3230 100644
--- a/packages/data-provider/src/parameterSettings.ts
+++ b/packages/data-provider/src/parameterSettings.ts
@@ -406,6 +406,22 @@ const anthropic: Record<string, SettingDefinition> = {
     showDefault: false,
     columnSpan: 2,
   },
+  promptCacheTtl: {
+    key: 'promptCacheTtl',
+    label: 'com_endpoint_prompt_cache_ttl',
+    labelCode: true,
+    description: 'com_endpoint_anthropic_prompt_cache_ttl',
+    descriptionCode: true,
+    type: 'enum',
+    default: anthropicSettings.promptCacheTtl.default,
+    options: ['5m', '1h'],
+    component: 'combobox',
+    optionType: 'conversation',
+    showDefault: false,
+    selectPlaceholder: 'com_endpoint_prompt_cache_ttl_default',
+    selectPlaceholderCode: true,
+    columnSpan: 2,
+  },
   thinking: {
     key: 'thinking',
     label: 'com_endpoint_thinking',
@@ -552,6 +568,22 @@ const bedrock: Record<string, SettingDefinition> = {
     showDefault: false,
     columnSpan: 2,
   },
+  promptCacheTtl: {
+    key: 'promptCacheTtl',
+    label: 'com_endpoint_prompt_cache_ttl',
+    labelCode: true,
+    description: 'com_endpoint_anthropic_prompt_cache_ttl',
+    descriptionCode: true,
+    type: 'enum',
+    default: undefined,
+    options: ['5m', '1h'],
+    component: 'combobox',
+    optionType: 'conversation',
+    showDefault: false,
+    selectPlaceholder: 'com_endpoint_prompt_cache_ttl_default',
+    selectPlaceholderCode: true,
+    columnSpan: 2,
+  },
   reasoning_effort: {
     key: 'reasoning_effort',
     label: 'com_endpoint_reasoning_effort',
@@ -733,6 +765,19 @@ const google: Record<string, SettingDefinition> = {
     showDefault: false,
     columnSpan: 2,
   },
+  url_context: {
+    key: 'url_context',
+    label: 'com_endpoint_use_url_context',
+    labelCode: true,
+    description: 'com_endpoint_google_use_url_context',
+    descriptionCode: true,
+    type: 'boolean',
+    default: false,
+    component: 'switch',
+    optionType: 'model',
+    showDefault: false,
+    columnSpan: 2,
+  },
 };
 
 const googleConfig: SettingsConfiguration = [
@@ -748,6 +793,7 @@ const googleConfig: SettingsConfiguration = [
   google.thinkingBudget,
   google.thinkingLevel,
   google.web_search,
+  google.url_context,
   librechat.fileTokenLimit,
 ];
 
@@ -768,6 +814,7 @@ const googleCol2: SettingsConfiguration = [
   google.thinkingBudget,
   google.thinkingLevel,
   google.web_search,
+  google.url_context,
   librechat.fileTokenLimit,
 ];
 
@@ -792,7 +839,11 @@ const openAI: SettingsConfiguration = [
   librechat.fileTokenLimit,
 ];
 
-const openRouter: SettingsConfiguration = [...openAI, anthropic.promptCache];
+const openRouter: SettingsConfiguration = [
+  ...openAI,
+  anthropic.promptCache,
+  anthropic.promptCacheTtl,
+];
 
 const openAICol1: SettingsConfiguration = [
   baseDefinitions.model as SettingDefinition,
@@ -829,6 +880,7 @@ const anthropicConfig: SettingsConfiguration = [
   anthropic.topK,
   librechat.resendFiles,
   anthropic.promptCache,
+  anthropic.promptCacheTtl,
   anthropic.thinking,
   anthropic.thinkingBudget,
   anthropic.effort,
@@ -851,6 +903,7 @@ const anthropicCol2: SettingsConfiguration = [
   anthropic.topK,
   librechat.resendFiles,
   anthropic.promptCache,
+  anthropic.promptCacheTtl,
   anthropic.thinking,
   anthropic.thinkingBudget,
   anthropic.effort,
@@ -871,6 +924,7 @@ const bedrockAnthropic: SettingsConfiguration = [
   librechat.resendFiles,
   bedrock.region,
   bedrock.promptCache,
+  bedrock.promptCacheTtl,
   anthropic.thinking,
   anthropic.thinkingBudget,
   anthropic.effort,
@@ -911,6 +965,7 @@ const bedrockGeneral: SettingsConfiguration = [
   librechat.resendFiles,
   bedrock.region,
   bedrock.promptCache,
+  bedrock.promptCacheTtl,
   librechat.fileTokenLimit,
 ];
 
@@ -930,6 +985,7 @@ const bedrockAnthropicCol2: SettingsConfiguration = [
   librechat.resendFiles,
   bedrock.region,
   bedrock.promptCache,
+  bedrock.promptCacheTtl,
   anthropic.thinking,
   anthropic.thinkingBudget,
   anthropic.effort,
@@ -982,6 +1038,7 @@ const bedrockGeneralCol2: SettingsConfiguration = [
   librechat.resendFiles,
   bedrock.region,
   bedrock.promptCache,
+  bedrock.promptCacheTtl,
   librechat.fileTokenLimit,
 ];
 
@@ -1092,7 +1149,7 @@ export const presetSettings: Record<
   [EModelEndpoint.custom]: openAIColumns,
   [Providers.OPENROUTER]: {
     col1: openAICol1,
-    col2: [...openAICol2, anthropic.promptCache],
+    col2: [...openAICol2, anthropic.promptCache, anthropic.promptCacheTtl],
   },
   [EModelEndpoint.anthropic]: {
     col1: anthropicCol1,
@@ -1141,3 +1198,23 @@ export const agentParamSettings: Record<string, SettingsConfiguration | undefine
   }
   return acc;
 }, {});
+
+/**
+ * Resolves model-aware defaults for a settings configuration before rendering.
+ * Google's `maxOutputTokens` default depends on the selected Gemini model so that
+ * current models (2.5 and 3+) surface their 64K output limit instead of the legacy 8K value.
+ */
+export function applyModelAwareDefaults(
+  settings: SettingsConfiguration,
+  endpoint: string,
+  model?: string,
+): SettingsConfiguration {
+  if (endpoint !== EModelEndpoint.google || !model) {
+    return settings;
+  }
+  return settings.map((setting) =>
+    setting.key === 'maxOutputTokens'
+      ? { ...setting, default: googleSettings.maxOutputTokens.reset(model) }
+      : setting,
+  );
+}
diff --git a/packages/data-provider/src/parsers.ts b/packages/data-provider/src/parsers.ts
index 684b233e483..c30297f5814 100644
--- a/packages/data-provider/src/parsers.ts
+++ b/packages/data-provider/src/parsers.ts
@@ -1,9 +1,10 @@
 import dayjs from 'dayjs';
+import utc from 'dayjs/plugin/utc.js';
+import timezonePlugin from 'dayjs/plugin/timezone.js';
 import type { ZodIssue } from 'zod';
 import type * as a from './types/assistants';
 import type * as s from './schemas';
 import type * as t from './types';
-import { ContentTypes } from './types/runs';
 import {
   openAISchema,
   openRouterSchema,
@@ -18,8 +19,12 @@ import {
   compactAssistantSchema,
 } from './schemas';
 import { bedrockInputSchema } from './bedrock';
+import { ContentTypes } from './types/runs';
 import { alternateName } from './config';
 
+dayjs.extend(utc);
+dayjs.extend(timezonePlugin);
+
 type EndpointSchema =
   | typeof openAISchema
   | typeof openRouterSchema
@@ -424,21 +429,40 @@ export function findLastSeparatorIndex(text: string, separators = SEPARATORS): n
   return lastIndex;
 }
 
+/**
+ * Anchors a dayjs instant to the user's IANA timezone when one is supplied,
+ * so local-time special vars reflect the user's wall clock rather than the
+ * server's. Falls back to the original instant for missing or invalid zones.
+ */
+function applyTimezone(value: dayjs.Dayjs, timezone?: string): dayjs.Dayjs {
+  if (!timezone) {
+    return value;
+  }
+  try {
+    const zoned = value.tz(timezone);
+    return zoned.isValid() ? zoned : value;
+  } catch {
+    return value;
+  }
+}
+
 export function replaceSpecialVars({
   text,
   user,
   now: inputNow,
+  timezone,
 }: {
   text: string;
   user?: t.TUser | null;
   now?: string | number | Date;
+  timezone?: string;
 }) {
   let result = text;
   if (!result) {
     return result;
   }
 
-  const now = inputNow != null ? dayjs(inputNow) : dayjs();
+  const now = applyTimezone(inputNow != null ? dayjs(inputNow) : dayjs(), timezone);
   const weekdayName = now.format('dddd');
 
   const currentDate = now.format('YYYY-MM-DD');
diff --git a/packages/data-provider/src/permissions.ts b/packages/data-provider/src/permissions.ts
index 3f4590af3ac..08f2c7953db 100644
--- a/packages/data-provider/src/permissions.ts
+++ b/packages/data-provider/src/permissions.ts
@@ -64,6 +64,10 @@ export enum PermissionTypes {
    * Type for Skill Permissions
    */
   SKILLS = 'SKILLS',
+  /**
+   * Type for Shared Link Permissions
+   */
+  SHARED_LINKS = 'SHARED_LINKS',
 }
 
 /**
@@ -87,6 +91,7 @@ export const PERMISSION_TYPE_INTERFACE_FIELDS: Record<PermissionTypes, string> =
   [PermissionTypes.MCP_SERVERS]: 'mcpServers',
   [PermissionTypes.REMOTE_AGENTS]: 'remoteAgents',
   [PermissionTypes.SKILLS]: 'skills',
+  [PermissionTypes.SHARED_LINKS]: 'sharedLinks',
 };
 
 /** Set of interface config field names that correspond to role permissions. */
@@ -98,13 +103,14 @@ export const INTERFACE_PERMISSION_FIELDS = new Set(Object.values(PERMISSION_TYPE
  * DB overrides — other sub-keys (like `placeholder`, `trustCheckbox`) are UI-only and pass through.
  *
  * Mapping to Permissions enum:
- *   'use'    → Permissions.USE       (agents, prompts, mcpServers, remoteAgents, marketplace)
- *   'create' → Permissions.CREATE    (agents, prompts, mcpServers, remoteAgents)
- *   'share'  → Permissions.SHARE     (agents, prompts, mcpServers, remoteAgents)
- *   'public' → Permissions.SHARE_PUBLIC (agents, prompts, mcpServers, remoteAgents)
- *   'users'  → Permissions.VIEW_USERS   (peoplePicker only)
- *   'groups' → Permissions.VIEW_GROUPS  (peoplePicker only)
- *   'roles'  → Permissions.VIEW_ROLES   (peoplePicker only)
+ *   'use'           → Permissions.USE       (agents, prompts, mcpServers, remoteAgents, marketplace)
+ *   'create'        → Permissions.CREATE    (agents, prompts, mcpServers, remoteAgents)
+ *   'share'         → Permissions.SHARE     (agents, prompts, mcpServers, remoteAgents)
+ *   'public'        → Permissions.SHARE_PUBLIC (agents, prompts, mcpServers, remoteAgents)
+ *   'users'         → Permissions.VIEW_USERS   (peoplePicker only)
+ *   'groups'        → Permissions.VIEW_GROUPS  (peoplePicker only)
+ *   'roles'         → Permissions.VIEW_ROLES   (peoplePicker only)
+ *   'configureObo'  → Permissions.CONFIGURE_OBO (mcpServers only)
  */
 export const PERMISSION_SUB_KEYS = new Set([
   'use',
@@ -114,6 +120,7 @@ export const PERMISSION_SUB_KEYS = new Set([
   'users',
   'groups',
   'roles',
+  'configureObo',
 ]);
 
 /**
@@ -133,6 +140,12 @@ export enum Permissions {
   VIEW_ROLES = 'VIEW_ROLES',
   /** Can share resources publicly (with everyone) */
   SHARE_PUBLIC = 'SHARE_PUBLIC',
+  /**
+   * Can configure MCP server On-Behalf-Of (OBO) token exchange. Gates the
+   * `obo` field on MCP server configs because OBO silently mints and forwards
+   * per-user delegated tokens to whatever URL the server points at.
+   */
+  CONFIGURE_OBO = 'CONFIGURE_OBO',
 }
 
 export const promptPermissionsSchema = z.object({
@@ -212,6 +225,7 @@ export const mcpServersPermissionsSchema = z.object({
   [Permissions.CREATE]: z.boolean().default(true),
   [Permissions.SHARE]: z.boolean().default(false),
   [Permissions.SHARE_PUBLIC]: z.boolean().default(false),
+  [Permissions.CONFIGURE_OBO]: z.boolean().default(false),
 });
 export type TMcpServersPermissions = z.infer<typeof mcpServersPermissionsSchema>;
 
@@ -231,6 +245,13 @@ export const skillPermissionsSchema = z.object({
 });
 export type TSkillPermissions = z.infer<typeof skillPermissionsSchema>;
 
+export const sharedLinksPermissionsSchema = z.object({
+  [Permissions.CREATE]: z.boolean().default(true),
+  [Permissions.SHARE]: z.boolean().default(true),
+  [Permissions.SHARE_PUBLIC]: z.boolean().default(false),
+});
+export type TSharedLinksPermissions = z.infer<typeof sharedLinksPermissionsSchema>;
+
 // Define a single permissions schema that holds all permission types.
 export const permissionsSchema = z.object({
   [PermissionTypes.PROMPTS]: promptPermissionsSchema,
@@ -248,4 +269,5 @@ export const permissionsSchema = z.object({
   [PermissionTypes.MCP_SERVERS]: mcpServersPermissionsSchema,
   [PermissionTypes.REMOTE_AGENTS]: remoteAgentsPermissionsSchema,
   [PermissionTypes.SKILLS]: skillPermissionsSchema,
+  [PermissionTypes.SHARED_LINKS]: sharedLinksPermissionsSchema,
 });
diff --git a/packages/data-provider/src/react-query/react-query-service.ts b/packages/data-provider/src/react-query/react-query-service.ts
index 571dce58308..509a3d8ce9a 100644
--- a/packages/data-provider/src/react-query/react-query-service.ts
+++ b/packages/data-provider/src/react-query/react-query-service.ts
@@ -4,17 +4,17 @@ import type {
   UseMutationResult,
   QueryObserverResult,
 } from '@tanstack/react-query';
+import { MCPServerConnectionStatusResponse } from '../types/queries';
 import { Constants, initialModelsConfig } from '../config';
 import { defaultOrderQuery } from '../types/assistants';
-import { MCPServerConnectionStatusResponse } from '../types/queries';
+import * as permissions from '../accessPermissions';
+import { ResourceType } from '../accessPermissions';
 import * as dataService from '../data-service';
 import * as m from '../types/mutations';
 import * as q from '../types/queries';
 import { QueryKeys } from '../keys';
 import * as s from '../schemas';
 import * as t from '../types';
-import * as permissions from '../accessPermissions';
-import { ResourceType } from '../accessPermissions';
 
 export { hasPermissions } from '../accessPermissions';
 
@@ -51,10 +51,7 @@ export const useGetSharedLinkQuery = (
       refetchOnReconnect: false,
       refetchOnMount: false,
       onSuccess: (data) => {
-        queryClient.setQueryData([QueryKeys.sharedLinks, conversationId], {
-          conversationId: data.conversationId,
-          shareId: data.shareId,
-        });
+        queryClient.setQueryData([QueryKeys.sharedLinks, conversationId], data);
       },
       ...config,
     },
@@ -125,6 +122,8 @@ export const useUpdateUserKeysMutation = (): UseMutationResult<
     onSuccess: (data, variables) => {
       queryClient.invalidateQueries([QueryKeys.name, variables.name]);
       queryClient.invalidateQueries([QueryKeys.models]);
+      /** token-config is derived from the same per-user model fetch */
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
     },
   });
 };
@@ -134,6 +133,7 @@ export const useClearConversationsMutation = (): UseMutationResult<unknown> => {
   return useMutation(() => dataService.clearAllConversations(), {
     onSuccess: () => {
       queryClient.invalidateQueries([QueryKeys.allConversations]);
+      queryClient.invalidateQueries([QueryKeys.conversationTags]);
     },
   });
 };
@@ -144,6 +144,7 @@ export const useRevokeUserKeyMutation = (name: string): UseMutationResult<unknow
     onSuccess: () => {
       queryClient.invalidateQueries([QueryKeys.name, name]);
       queryClient.invalidateQueries([QueryKeys.models]);
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
       if (s.isAssistantsEndpoint(name)) {
         queryClient.invalidateQueries([QueryKeys.assistants, name, defaultOrderQuery]);
         queryClient.invalidateQueries([QueryKeys.assistantDocs]);
@@ -162,6 +163,7 @@ export const useRevokeAllUserKeysMutation = (): UseMutationResult<unknown> => {
   return useMutation(() => dataService.revokeAllUserKeys(), {
     onSuccess: () => {
       queryClient.invalidateQueries([QueryKeys.name]);
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
       queryClient.invalidateQueries([
         QueryKeys.assistants,
         s.EModelEndpoint.assistants,
diff --git a/packages/data-provider/src/request.ts b/packages/data-provider/src/request.ts
index 5021b150e37..ca2a98eedf7 100644
--- a/packages/data-provider/src/request.ts
+++ b/packages/data-provider/src/request.ts
@@ -1,8 +1,8 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import axios, { AxiosError, AxiosRequestConfig } from 'axios';
+import axios, { AxiosRequestConfig } from 'axios';
+import type * as t from './types';
 import { setTokenHeader } from './headers-helpers';
 import * as endpoints from './api-endpoints';
-import type * as t from './types';
 
 async function _get<T>(url: string, options?: AxiosRequestConfig): Promise<T> {
   const response = await axios.get(url, { ...options });
@@ -61,93 +61,294 @@ async function _patch(url: string, data?: any) {
   return response.data;
 }
 
-let isRefreshing = false;
-let failedQueue: { resolve: (value?: any) => void; reject: (reason?: any) => void }[] = [];
+const AUTH_RECOVERY_EVENT = 'authRecovery';
+const AUTH_REDIRECT_EVENT = 'authRedirectStarted';
+const AUTH_REDIRECT_STORAGE_KEY = 'librechat.auth.redirect.startedAt';
+const AUTH_REDIRECT_DEDUPE_MS = 15_000;
+const TOKEN_REFRESH_BUFFER_MS = 2 * 60 * 1000;
+
+type RetryableAxiosRequestConfig = AxiosRequestConfig & { _retry?: boolean };
+
+type AuthRecoveryState = {
+  lastRedirectStartedAt: number;
+  refreshPromise: Promise<string | null> | null;
+};
+
+type AuthRecoveryWindow = Window & {
+  __librechatAuthRecovery?: AuthRecoveryState;
+};
 
 const refreshToken = (retry?: boolean): Promise<t.TRefreshTokenResponse | undefined> =>
   _post(endpoints.refreshToken(retry));
 
+const SHARE_PAGE_PATH_REGEX = /^\/share\/[^/]+\/?$/;
+const SHARED_MESSAGES_PATH_REGEX = /^\/api\/share\/[^/]+$/;
+
+const normalizePathname = (pathname: string) =>
+  pathname.startsWith('/') ? pathname : `/${pathname}`;
+
+const stripBasePath = (pathname: string) => {
+  const normalizedPathname = normalizePathname(pathname);
+  const baseUrl = endpoints.apiBaseUrl();
+  if (!baseUrl) {
+    return normalizedPathname;
+  }
+
+  const normalizedBaseUrl = normalizePathname(baseUrl);
+  if (
+    normalizedPathname === normalizedBaseUrl ||
+    normalizedPathname.startsWith(`${normalizedBaseUrl}/`)
+  ) {
+    return normalizedPathname.slice(normalizedBaseUrl.length) || '/';
+  }
+  return normalizedPathname;
+};
+
+const isSharePage = () => SHARE_PAGE_PATH_REGEX.test(stripBasePath(window.location.pathname));
+
+const getRequestPathname = (url?: string) => {
+  if (typeof url !== 'string') {
+    return '';
+  }
+  try {
+    return new URL(url, window.location.origin).pathname;
+  } catch {
+    return url.split(/[?#]/)[0] ?? '';
+  }
+};
+
+const isSharedMessagesRequest = (url?: string, method?: string) =>
+  method?.toLowerCase() === 'get' &&
+  SHARED_MESSAGES_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
+
 const dispatchTokenUpdatedEvent = (token: string) => {
   setTokenHeader(token);
+  clearAuthRedirectStartedAt();
   window.dispatchEvent(new CustomEvent('tokenUpdated', { detail: token }));
 };
 
-const processQueue = (error: AxiosError | null, token: string | null = null) => {
-  failedQueue.forEach((prom) => {
-    if (error) {
-      prom.reject(error);
-    } else {
-      prom.resolve(token);
-    }
-  });
-  failedQueue = [];
+const getAuthRecoveryState = (): AuthRecoveryState => {
+  const browserWindow = window as AuthRecoveryWindow;
+  browserWindow.__librechatAuthRecovery ??= {
+    lastRedirectStartedAt: 0,
+    refreshPromise: null,
+  };
+  return browserWindow.__librechatAuthRecovery;
+};
+
+const getAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  try {
+    const startedAt = window.localStorage.getItem(AUTH_REDIRECT_STORAGE_KEY);
+    const storedStartedAt = startedAt != null ? Number(startedAt) : 0;
+    const finiteStartedAt = Number.isFinite(storedStartedAt) ? storedStartedAt : 0;
+    return Math.max(finiteStartedAt, state.lastRedirectStartedAt);
+  } catch {
+    return state.lastRedirectStartedAt;
+  }
+};
+
+const setAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  state.lastRedirectStartedAt = Date.now();
+  try {
+    window.localStorage.setItem(AUTH_REDIRECT_STORAGE_KEY, String(state.lastRedirectStartedAt));
+  } catch {
+    // localStorage can be blocked in embedded/private contexts.
+  }
+};
+
+const clearAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  state.lastRedirectStartedAt = 0;
+  try {
+    window.localStorage.removeItem(AUTH_REDIRECT_STORAGE_KEY);
+  } catch {
+    // Ignore unavailable storage.
+  }
+};
+
+const isAuthRedirectInProgress = () => {
+  const startedAt = getAuthRedirectStartedAt();
+  return (
+    Number.isFinite(startedAt) && startedAt > 0 && Date.now() - startedAt < AUTH_REDIRECT_DEDUPE_MS
+  );
+};
+
+const dispatchAuthRecoveryEvent = (state: 'started' | 'finished') => {
+  window.dispatchEvent(new CustomEvent(AUTH_RECOVERY_EVENT, { detail: { state } }));
+};
+
+const setRequestAuthorizationHeader = (config: AxiosRequestConfig, token: string) => {
+  const headers = (config.headers ?? {}) as Record<string, string>;
+  headers['Authorization'] = `Bearer ${token}`;
+  config.headers = headers;
+};
+
+const isAuthRecoveryEndpoint = (url?: string) =>
+  url?.includes('/api/auth/2fa') === true ||
+  url?.includes('/api/auth/logout') === true ||
+  url?.includes('/api/auth/refresh') === true;
+
+const startAuthRecovery = (retryRefresh?: boolean) => {
+  const state = getAuthRecoveryState();
+  if (state.refreshPromise) {
+    return state.refreshPromise;
+  }
+
+  dispatchAuthRecoveryEvent('started');
+  state.refreshPromise = refreshToken(retryRefresh)
+    .then((response) => {
+      const token = response?.token ?? '';
+      if (!token) {
+        return null;
+      }
+      dispatchTokenUpdatedEvent(token);
+      return token;
+    })
+    .finally(() => {
+      state.refreshPromise = null;
+      dispatchAuthRecoveryEvent('finished');
+    });
+
+  return state.refreshPromise;
+};
+
+const redirectToLoginOnce = () => {
+  if (isAuthRedirectInProgress()) {
+    return;
+  }
+
+  const href = endpoints.apiBaseUrl() + endpoints.buildLoginRedirectUrl();
+  setAuthRedirectStartedAt();
+  window.dispatchEvent(new CustomEvent(AUTH_REDIRECT_EVENT, { detail: { href } }));
+  window.location.href = href;
+};
+
+const getBearerToken = () => {
+  const authorization = axios.defaults.headers.common['Authorization'];
+  if (typeof authorization !== 'string' || !authorization.startsWith('Bearer ')) {
+    return null;
+  }
+  return authorization.slice('Bearer '.length);
+};
+
+const getJwtExpiryMs = (token: string) => {
+  const payload = token.split('.')[1];
+  if (!payload) {
+    return null;
+  }
+
+  try {
+    const normalizedPayload = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const paddedPayload = normalizedPayload.padEnd(
+      normalizedPayload.length + ((4 - (normalizedPayload.length % 4)) % 4),
+      '=',
+    );
+    const decodedPayload = JSON.parse(window.atob(paddedPayload)) as { exp?: number };
+    return typeof decodedPayload.exp === 'number' ? decodedPayload.exp * 1000 : null;
+  } catch {
+    return null;
+  }
+};
+
+const shouldRefreshBeforeRequest = (url?: string) => {
+  if (isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress()) {
+    return false;
+  }
+
+  const token = getBearerToken();
+  if (!token) {
+    return false;
+  }
+
+  const expiresAt = getJwtExpiryMs(token);
+  if (expiresAt == null) {
+    return false;
+  }
+
+  const timeUntilExpiry = expiresAt - Date.now();
+  return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
 
 if (typeof window !== 'undefined') {
+  axios.interceptors.request.use(async (config) => {
+    const state = getAuthRecoveryState();
+    if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
+      const token = await state.refreshPromise.catch(() => null);
+      if (token) {
+        setRequestAuthorizationHeader(config, token);
+      }
+      return config;
+    }
+
+    if (!shouldRefreshBeforeRequest(config.url)) {
+      return config;
+    }
+
+    const token = await startAuthRecovery(false).catch(() => null);
+    if (token) {
+      setRequestAuthorizationHeader(config, token);
+    }
+    return config;
+  });
+
   axios.interceptors.response.use(
     (response) => response,
     async (error) => {
-      const originalRequest = error.config;
+      const originalRequest = error.config as RetryableAxiosRequestConfig | undefined;
       if (!error.response) {
         return Promise.reject(error);
       }
+      if (!originalRequest) {
+        return Promise.reject(error);
+      }
 
-      if (originalRequest.url?.includes('/api/auth/2fa') === true) {
+      const isRefreshRequest = originalRequest.url?.includes('/api/auth/refresh') === true;
+      if (isAuthRecoveryEndpoint(originalRequest.url) && !isRefreshRequest) {
         return Promise.reject(error);
       }
-      if (originalRequest.url?.includes('/api/auth/logout') === true) {
+
+      if (isRefreshRequest && getAuthRecoveryState().refreshPromise) {
         return Promise.reject(error);
       }
 
       /** Skip refresh when the Authorization header has been cleared (e.g. during logout),
-       *  but allow shared link requests to proceed so auth recovery/redirect can happen */
+       *  but allow the shared link data request to proceed so private shares can still
+       *  recover auth/redirect without unrelated share-page queries forcing login. */
       if (
         !axios.defaults.headers.common['Authorization'] &&
-        !window.location.pathname.startsWith('/share/')
+        !(isSharePage() && isSharedMessagesRequest(originalRequest.url, originalRequest.method))
       ) {
         return Promise.reject(error);
       }
 
-      if (error.response.status === 401 && !originalRequest._retry) {
-        console.warn('401 error, refreshing token');
-        originalRequest._retry = true;
+      if (isAuthRedirectInProgress()) {
+        return Promise.reject(error);
+      }
 
-        if (isRefreshing) {
-          try {
-            const token = await new Promise((resolve, reject) => {
-              failedQueue.push({ resolve, reject });
-            });
-            originalRequest.headers['Authorization'] = 'Bearer ' + token;
-            return await axios(originalRequest);
-          } catch (err) {
-            return Promise.reject(err);
-          }
+      if (error.response.status === 401 && !originalRequest._retry) {
+        const hasActiveRecovery = getAuthRecoveryState().refreshPromise != null;
+        if (!hasActiveRecovery) {
+          console.warn('401 error, refreshing token');
         }
-
-        isRefreshing = true;
+        originalRequest._retry = true;
 
         try {
-          const response = await refreshToken(
+          const token = await startAuthRecovery(
             // Handle edge case where we get a blank screen if the initial 401 error is from a refresh token request
-            originalRequest.url?.includes('api/auth/refresh') === true ? true : false,
+            isRefreshRequest,
           );
 
-          const token = response?.token ?? '';
-
           if (token) {
-            originalRequest.headers['Authorization'] = 'Bearer ' + token;
-            dispatchTokenUpdatedEvent(token);
-            processQueue(null, token);
+            setRequestAuthorizationHeader(originalRequest, token);
             return await axios(originalRequest);
-          } else {
-            processQueue(error, null);
-            window.location.href = endpoints.apiBaseUrl() + endpoints.buildLoginRedirectUrl();
           }
+
+          redirectToLoginOnce();
+          return Promise.reject(error);
         } catch (err) {
-          processQueue(err as AxiosError, null);
           return Promise.reject(err);
-        } finally {
-          isRefreshing = false;
         }
       }
 
diff --git a/packages/data-provider/src/roles.spec.ts b/packages/data-provider/src/roles.spec.ts
index db94c393f42..3cc1740e47f 100644
--- a/packages/data-provider/src/roles.spec.ts
+++ b/packages/data-provider/src/roles.spec.ts
@@ -89,7 +89,8 @@ describe('roleDefaults', () => {
           permType === PermissionTypes.MEMORIES ||
           permType === PermissionTypes.PROMPTS ||
           permType === PermissionTypes.AGENTS ||
-          permType === PermissionTypes.SKILLS;
+          permType === PermissionTypes.SKILLS ||
+          permType === PermissionTypes.SHARED_LINKS;
 
         expect({
           permType,
@@ -156,4 +157,20 @@ describe('roleDefaults', () => {
       });
     });
   });
+
+  describe('MCP_SERVERS.CONFIGURE_OBO defaults', () => {
+    it('grants ADMIN CONFIGURE_OBO by default', () => {
+      const adminMcp = roleDefaults[SystemRoles.ADMIN].permissions[
+        PermissionTypes.MCP_SERVERS
+      ] as Record<string, boolean>;
+      expect(adminMcp[Permissions.CONFIGURE_OBO]).toBe(true);
+    });
+
+    it('does not grant CONFIGURE_OBO to USER by default — gates the OBO config layer', () => {
+      const userMcp = roleDefaults[SystemRoles.USER].permissions[
+        PermissionTypes.MCP_SERVERS
+      ] as Record<string, boolean>;
+      expect(userMcp[Permissions.CONFIGURE_OBO]).toBe(false);
+    });
+  });
 });
diff --git a/packages/data-provider/src/roles.ts b/packages/data-provider/src/roles.ts
index 600c0174026..42ce28ce1fc 100644
--- a/packages/data-provider/src/roles.ts
+++ b/packages/data-provider/src/roles.ts
@@ -13,6 +13,7 @@ import {
   fileSearchPermissionsSchema,
   multiConvoPermissionsSchema,
   mcpServersPermissionsSchema,
+  sharedLinksPermissionsSchema,
   peoplePickerPermissionsSchema,
   remoteAgentsPermissionsSchema,
   temporaryChatPermissionsSchema,
@@ -97,6 +98,7 @@ const defaultRolesSchema = z.object({
         [Permissions.CREATE]: z.boolean().default(true),
         [Permissions.SHARE]: z.boolean().default(true),
         [Permissions.SHARE_PUBLIC]: z.boolean().default(true),
+        [Permissions.CONFIGURE_OBO]: z.boolean().default(true),
       }),
       [PermissionTypes.REMOTE_AGENTS]: remoteAgentsPermissionsSchema.extend({
         [Permissions.USE]: z.boolean().default(true),
@@ -110,6 +112,11 @@ const defaultRolesSchema = z.object({
         [Permissions.SHARE]: z.boolean().default(true),
         [Permissions.SHARE_PUBLIC]: z.boolean().default(true),
       }),
+      [PermissionTypes.SHARED_LINKS]: sharedLinksPermissionsSchema.extend({
+        [Permissions.CREATE]: z.boolean().default(true),
+        [Permissions.SHARE]: z.boolean().default(true),
+        [Permissions.SHARE_PUBLIC]: z.boolean().default(true),
+      }),
     }),
   }),
   [SystemRoles.USER]: roleSchema.extend({
@@ -185,6 +192,7 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.CREATE]: true,
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
+        [Permissions.CONFIGURE_OBO]: true,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: true,
@@ -198,6 +206,11 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     },
   },
   [SystemRoles.USER]: {
@@ -236,6 +249,7 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.CREATE]: false,
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
+        [Permissions.CONFIGURE_OBO]: false,
       },
       [PermissionTypes.REMOTE_AGENTS]: {
         [Permissions.USE]: false,
@@ -249,6 +263,11 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     },
   },
 });
diff --git a/packages/data-provider/src/schemas.spec.ts b/packages/data-provider/src/schemas.spec.ts
index 34cd72a346c..2e1f00532fd 100644
--- a/packages/data-provider/src/schemas.spec.ts
+++ b/packages/data-provider/src/schemas.spec.ts
@@ -1,4 +1,10 @@
-import { AnthropicEffort, anthropicSettings, eAnthropicEffortSchema } from './schemas';
+import {
+  AnthropicEffort,
+  googleSettings,
+  anthropicSettings,
+  compactGoogleSchema,
+  eAnthropicEffortSchema,
+} from './schemas';
 
 describe('anthropicSettings', () => {
   describe('maxOutputTokens.reset()', () => {
@@ -354,6 +360,120 @@ describe('anthropicSettings', () => {
   });
 });
 
+describe('googleSettings', () => {
+  describe('maxOutputTokens.reset()', () => {
+    const { reset } = googleSettings.maxOutputTokens;
+
+    describe('current Gemini text models (64K, Vertex-safe)', () => {
+      it.each([
+        'gemini-2.5-pro',
+        'gemini-2.5-flash',
+        'gemini-2.5-flash-lite',
+        'gemini-2.5-pro-preview-05-06',
+        'gemini-3',
+        'gemini-3-pro',
+        'gemini-3.1',
+        'gemini-3.1-flash-lite',
+        'gemini-3.5-flash',
+        'models/gemini-3.5-flash',
+        'gemini-4-pro',
+        'gemini-10-flash',
+      ])('returns 65535 for %s', (model) => {
+        expect(reset(model)).toBe(65535);
+      });
+    });
+
+    describe('Gemini image models (32K)', () => {
+      it.each(['gemini-2.5-flash-image', 'gemini-3-pro-image'])('returns 32768 for %s', (model) => {
+        expect(reset(model)).toBe(32768);
+      });
+    });
+
+    describe('legacy/deprecated Gemini and Gemma models (8K)', () => {
+      it.each([
+        'gemini',
+        'gemini-pro',
+        'gemini-pro-vision',
+        'gemini-1.0-pro',
+        'gemini-1.5-pro',
+        'gemini-1.5-flash',
+        'gemini-1.5-flash-latest',
+        'gemini-1.5-flash-8b',
+        'gemini-2.0-flash',
+        'gemini-2.0-flash-lite',
+        'gemini-2.0-flash-preview-image-generation',
+        'gemini-exp-1206',
+        'gemma-3-27b',
+      ])('returns 8192 for %s', (model) => {
+        expect(reset(model)).toBe(8192);
+      });
+    });
+  });
+
+  describe('maxOutputTokens.set()', () => {
+    const { set } = googleSettings.maxOutputTokens;
+
+    it('caps current Gemini models at 65535', () => {
+      expect(set(100000, 'gemini-2.5-pro')).toBe(65535);
+      expect(set(100000, 'gemini-3.5-flash')).toBe(65535);
+    });
+
+    it('allows values within the current 64K limit', () => {
+      expect(set(32000, 'gemini-2.5-flash')).toBe(32000);
+      expect(set(65535, 'gemini-3.5-flash')).toBe(65535);
+    });
+
+    it('caps Gemini image models at 32768', () => {
+      expect(set(65535, 'gemini-2.5-flash-image')).toBe(32768);
+      expect(set(32768, 'gemini-2.5-flash-image')).toBe(32768);
+    });
+
+    it('caps legacy Gemini models at 8192', () => {
+      expect(set(65535, 'gemini-2.0-flash')).toBe(8192);
+      expect(set(20000, 'gemini-1.5-flash')).toBe(8192);
+    });
+
+    it('allows values within the legacy 8K limit', () => {
+      expect(set(4096, 'gemini-1.5-flash')).toBe(4096);
+      expect(set(8192, 'gemini-2.0-flash')).toBe(8192);
+    });
+  });
+
+  describe('compactGoogleSchema (model-aware maxOutputTokens)', () => {
+    it('strips the model default for current Gemini models', () => {
+      const result = compactGoogleSchema.parse({
+        model: 'gemini-2.5-pro',
+        maxOutputTokens: 65535,
+      });
+      expect(result.maxOutputTokens).toBeUndefined();
+    });
+
+    it('preserves a deliberate below-default value for current Gemini models', () => {
+      const result = compactGoogleSchema.parse({
+        model: 'gemini-2.5-pro',
+        maxOutputTokens: 8192,
+      });
+      expect(result.maxOutputTokens).toBe(8192);
+    });
+
+    it('strips the legacy default for legacy Gemini models', () => {
+      const result = compactGoogleSchema.parse({
+        model: 'gemini-1.5-flash',
+        maxOutputTokens: 8192,
+      });
+      expect(result.maxOutputTokens).toBeUndefined();
+    });
+
+    it('preserves chat project membership metadata', () => {
+      const result = compactGoogleSchema.parse({
+        model: 'gemini-2.5-pro',
+        chatProjectId: 'project-1',
+      });
+      expect(result.chatProjectId).toBe('project-1');
+    });
+  });
+});
+
 describe('AnthropicEffort', () => {
   it('exposes xhigh between high and max in the enum', () => {
     expect(AnthropicEffort.xhigh).toBe('xhigh');
diff --git a/packages/data-provider/src/schemas.ts b/packages/data-provider/src/schemas.ts
index bf9c119eece..6c855156e42 100644
--- a/packages/data-provider/src/schemas.ts
+++ b/packages/data-provider/src/schemas.ts
@@ -1,9 +1,9 @@
 import { z } from 'zod';
-import { Tools } from './types/assistants';
 import type { TMessageContentParts, FunctionTool, FunctionToolCall } from './types/assistants';
-import { TFeedback, feedbackSchema } from './feedback';
 import type { SearchResultData } from './types/web';
 import type { TFile } from './types/files';
+import { TFeedback, feedbackSchema } from './feedback';
+import { Tools } from './types/assistants';
 
 export const isUUID = z.string().uuid();
 
@@ -79,6 +79,33 @@ export const isOpenAILikeProvider = (provider?: string | null): boolean => {
   return openAILikeProviders.has(provider ?? '');
 };
 
+/**
+ * Providers whose `usage_metadata.input_tokens` ALREADY INCLUDES cached tokens
+ * (`input_token_details.cache_*` is a subset, not an additional charge):
+ * Google/Vertex (`promptTokenCount`), OpenAI/Azure (`prompt_tokens`), and the
+ * OpenAI-compatible family. `@librechat/agents`' `getAnthropicUsageMetadata`
+ * folds `cache_creation` + `cache_read` into `input_tokens`, so Anthropic is a
+ * subset provider too; without this the cache portion is billed twice. Bedrock
+ * stays additive — its Converse path passes AWS `inputTokens` through unmodified.
+ * Single source of truth shared by the backend billing path
+ * (`packages/api/src/agents/usage.ts`) and the client usage normalization.
+ */
+export const cacheSubsetProviders = new Set<string>([
+  Providers.OPENAI,
+  Providers.AZURE,
+  Providers.GOOGLE,
+  Providers.VERTEXAI,
+  Providers.XAI,
+  Providers.DEEPSEEK,
+  Providers.OPENROUTER,
+  Providers.MOONSHOT,
+  Providers.ANTHROPIC,
+]);
+
+export const inputTokensIncludesCache = (provider?: string | null): boolean => {
+  return cacheSubsetProviders.has(provider ?? '');
+};
+
 export const isDocumentSupportedProvider = (provider?: string | null): boolean => {
   return documentSupportedProviders.has(provider ?? '');
 };
@@ -177,6 +204,17 @@ export enum ReasoningEffort {
   xhigh = 'xhigh',
 }
 
+export enum ReasoningParameterFormat {
+  disabled = 'disabled',
+  reasoningEffort = 'reasoning_effort',
+  reasoningObject = 'reasoning_object',
+}
+
+export enum ReasoningResponseKey {
+  reasoning = 'reasoning',
+  reasoningContent = 'reasoning_content',
+}
+
 export enum AnthropicEffort {
   unset = '',
   low = 'low',
@@ -250,6 +288,8 @@ export const imageDetailValue = {
 
 export const eImageDetailSchema = z.nativeEnum(ImageDetail);
 export const eReasoningEffortSchema = z.nativeEnum(ReasoningEffort);
+export const eReasoningParameterFormatSchema = z.nativeEnum(ReasoningParameterFormat);
+export const eReasoningResponseKeySchema = z.nativeEnum(ReasoningResponseKey);
 export const eAnthropicEffortSchema = z.nativeEnum(AnthropicEffort);
 export const eThinkingDisplaySchema = z.nativeEnum(ThinkingDisplay);
 export const eReasoningSummarySchema = z.nativeEnum(ReasoningSummary);
@@ -366,15 +406,45 @@ export const openAISettings = {
   },
 };
 
+/**
+ * `65535` (not 65536) is the value valid on both Google AI Studio and Vertex AI:
+ * Vertex caps current Gemini text models at 65,535 output tokens, so defaulting to
+ * 65,536 would make otherwise-default Vertex requests fail validation.
+ */
+const GOOGLE_MAX_OUTPUT = 65535 as const;
+const GOOGLE_IMAGE_MAX_OUTPUT = 32768 as const;
+const GOOGLE_LEGACY_MAX_OUTPUT = 8192 as const;
+
+/**
+ * Resolves the documented max output-token limit for a Google/Gemini model.
+ * Current Gemini text models (2.5 and 3+) support 64K output tokens; their image
+ * variants (e.g. `gemini-2.5-flash-image`) cap at 32K; legacy/deprecated models
+ * (2.0 and earlier, including legacy image models) and Gemma retain the 8K limit.
+ */
+const getGoogleMaxOutputTokens = (modelName: string): number => {
+  if (/gemini-(?:2\.5|[3-9]|\d{2,})/i.test(modelName)) {
+    if (/image/i.test(modelName)) {
+      return GOOGLE_IMAGE_MAX_OUTPUT;
+    }
+    return GOOGLE_MAX_OUTPUT;
+  }
+  return GOOGLE_LEGACY_MAX_OUTPUT;
+};
+
 export const googleSettings = {
   model: {
     default: 'gemini-1.5-flash-latest' as const,
   },
   maxOutputTokens: {
     min: 1 as const,
-    max: 64000 as const,
+    max: GOOGLE_MAX_OUTPUT,
     step: 1 as const,
-    default: 8192 as const,
+    default: GOOGLE_LEGACY_MAX_OUTPUT,
+    reset: (modelName: string): number => getGoogleMaxOutputTokens(modelName),
+    set: (value: number, modelName: string): number => {
+      const max = getGoogleMaxOutputTokens(modelName);
+      return value > max ? max : value;
+    },
   },
   temperature: {
     min: 0 as const,
@@ -416,6 +486,27 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64000 as const;
 const CLAUDE_32K_MAX_OUTPUT = 32000 as const;
 const DEFAULT_MAX_OUTPUT = 8192 as const;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096 as const;
+
+/**
+ * Claude "Mythos-class" model families — new top-level classes (peers of
+ * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
+ * adaptive thinking always on, raw thinking omitted by default (summarized
+ * opt-in), sampling parameters rejected, and a 1M context window. The tier
+ * word is the class name itself, so the `opus`/`sonnet` version parsers don't
+ * cover them.
+ *
+ * Single source of truth: add a future sibling class name here and every
+ * Mythos-class gate (adaptive thinking, sampling omission, prompt caching, 1M
+ * context, 128K output) picks it up.
+ */
+export const MYTHOS_CLASS_FAMILIES = ['fable', 'mythos'] as const;
+const MYTHOS_CLASS_PATTERN = new RegExp(`claude-(?:${MYTHOS_CLASS_FAMILIES.join('|')})[-.]?\\d`);
+
+/** Whether the model is a Claude Mythos-class model (e.g. `claude-fable-5`). */
+export function isMythosClassModel(model: string): boolean {
+  return MYTHOS_CLASS_PATTERN.test(model);
+}
+
 export const anthropicSettings = {
   model: {
     default: 'claude-3-5-sonnet-latest' as const,
@@ -429,6 +520,9 @@ export const anthropicSettings = {
   promptCache: {
     default: true as const,
   },
+  promptCacheTtl: {
+    default: undefined,
+  },
   thinking: {
     default: true as const,
   },
@@ -444,6 +538,10 @@ export const anthropicSettings = {
     step: 1 as const,
     default: DEFAULT_MAX_OUTPUT,
     reset: (modelName: string) => {
+      if (isMythosClassModel(modelName)) {
+        return ANTHROPIC_MAX_OUTPUT;
+      }
+
       if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) {
         return ANTHROPIC_MAX_OUTPUT;
       }
@@ -463,6 +561,13 @@ export const anthropicSettings = {
       return DEFAULT_MAX_OUTPUT;
     },
     set: (value: number, modelName: string) => {
+      if (isMythosClassModel(modelName)) {
+        if (value > ANTHROPIC_MAX_OUTPUT) {
+          return ANTHROPIC_MAX_OUTPUT;
+        }
+        return value;
+      }
+
       if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) {
         if (value > ANTHROPIC_MAX_OUTPUT) {
           return ANTHROPIC_MAX_OUTPUT;
@@ -599,6 +704,8 @@ export const tPluginAuthConfigSchema = z.object({
   label: z.string(),
   description: z.string(),
   optional: z.boolean().optional(),
+  /** Whether the field holds a secret and should be masked in the UI (defaults to masked when omitted). */
+  sensitive: z.boolean().optional(),
 });
 
 export type TPluginAuthConfig = z.infer<typeof tPluginAuthConfigSchema>;
@@ -648,6 +755,8 @@ export const tMessageSchema = z.object({
   /** @deprecated */
   generation: z.string().nullable().optional(),
   isCreatedByUser: z.boolean(),
+  isTemporary: z.boolean().optional(),
+  expiredAt: z.string().nullable().optional(),
   error: z.boolean().optional(),
   clientTimestamp: z.string().optional(),
   createdAt: z
@@ -669,6 +778,8 @@ export const tMessageSchema = z.object({
   feedback: feedbackSchema.optional(),
   /** metadata */
   metadata: z.record(z.unknown()).optional(),
+  /** Output tokens for assistant messages, calibrated prompt-side estimate for user messages */
+  tokenCount: z.number().optional(),
   contextMeta: z
     .object({
       calibrationRatio: z
@@ -702,6 +813,14 @@ export const tMessageSchema = z.object({
    * what actually ran, not the current catalog).
    */
   alwaysAppliedSkills: z.array(z.string()).optional(),
+  /**
+   * Verbatim excerpts the user quoted (via the "Add to chat" selection
+   * popup) to reference on this turn. UI metadata that `MessageQuotes`
+   * renders above the user bubble so the references persist on reload. The
+   * excerpts are merged into the user message text sent to the model at
+   * request time and counted in the user message token count.
+   */
+  quotes: z.array(z.string()).optional(),
 });
 
 export type MemoryArtifact = {
@@ -780,6 +899,7 @@ export const tConversationSchema = z.object({
   endpoint: eModelEndpointSchema.nullable(),
   endpointType: eModelEndpointSchema.nullable().optional(),
   isArchived: z.boolean().optional(),
+  pinned: z.boolean().optional(),
   title: z.string().nullable().or(z.literal('New Chat')).default('New Chat'),
   user: z.string().optional(),
   messages: z.array(z.string()).optional(),
@@ -800,6 +920,7 @@ export const tConversationSchema = z.object({
   max_tokens: coerceNumber.optional(),
   /* Anthropic */
   promptCache: z.boolean().optional(),
+  promptCacheTtl: z.enum(['5m', '1h']).optional(),
   system: z.string().optional(),
   thinking: z.boolean().optional(),
   thinkingBudget: coerceNumber.optional(),
@@ -812,6 +933,7 @@ export const tConversationSchema = z.object({
   examples: z.array(tExampleSchema).optional(),
   /* DB */
   tags: z.array(z.string()).optional(),
+  chatProjectId: z.string().nullable().optional(),
   createdAt: z.string(),
   updatedAt: z.string(),
   /* Files */
@@ -832,6 +954,8 @@ export const tConversationSchema = z.object({
   thinkingDisplay: eThinkingDisplaySchema.optional().nullable(),
   /* OpenAI Responses API / Anthropic API / Google API */
   web_search: z.boolean().optional(),
+  /* Google API: URL Context tool (+ native YouTube video understanding) */
+  url_context: z.boolean().optional(),
   /* disable streaming */
   disableStreaming: z.boolean().optional(),
   /* assistant */
@@ -855,6 +979,7 @@ export const tConversationSchema = z.object({
   iconURL: z.string().nullable().optional(),
   /* temporary chat */
   expiredAt: z.string().nullable().optional(),
+  isTemporary: z.boolean().optional(),
   /* file token limits */
   fileTokenLimit: coerceNumber.optional(),
   /** @deprecated */
@@ -866,6 +991,7 @@ export const tConversationSchema = z.object({
 export const tPresetSchema = tConversationSchema
   .omit({
     conversationId: true,
+    chatProjectId: true,
     createdAt: true,
     updatedAt: true,
     title: true,
@@ -940,6 +1066,8 @@ export const tQueryParamsSchema = tConversationSchema
     useResponsesApi: true,
     /** @endpoints openAI, anthropic, google */
     web_search: true,
+    /** @endpoints google */
+    url_context: true,
     /** @endpoints openAI, custom, azureOpenAI */
     disableStreaming: true,
     /** @endpoints google, anthropic, bedrock */
@@ -950,6 +1078,7 @@ export const tQueryParamsSchema = tConversationSchema
     maxOutputTokens: true,
     /** @endpoints anthropic */
     promptCache: true,
+    promptCacheTtl: true,
     thinking: true,
     thinkingBudget: true,
     thinkingLevel: true,
@@ -1024,8 +1153,8 @@ export type TConversation = z.infer<typeof tConversationSchema> & {
 export const tSharedLinkSchema = z.object({
   conversationId: z.string(),
   shareId: z.string(),
+  targetMessageId: z.string().optional(),
   messages: z.array(z.string()),
-  isPublic: z.boolean(),
   title: z.string(),
   createdAt: z.string(),
   updatedAt: z.string(),
@@ -1046,6 +1175,7 @@ export const tConversationTagSchema = z.object({
 export type TConversationTag = z.infer<typeof tConversationTagSchema>;
 
 export const googleBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   promptPrefix: true,
@@ -1059,6 +1189,7 @@ export const googleBaseSchema = tConversationSchema.pick({
   thinkingBudget: true,
   thinkingLevel: true,
   web_search: true,
+  url_context: true,
   fileTokenLimit: true,
   iconURL: true,
   greeting: true,
@@ -1093,6 +1224,7 @@ export const googleGenConfigSchema = z
       })
       .optional(),
     web_search: z.boolean().optional(),
+    url_context: z.boolean().optional(),
   })
   .strip()
   .optional();
@@ -1117,6 +1249,7 @@ export function removeNullishValues<T extends Record<string, unknown>>(
 }
 
 const assistantBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   assistant_id: true,
   instructions: true,
@@ -1152,6 +1285,7 @@ export const assistantSchema = assistantBaseSchema
   }));
 
 const compactAssistantBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   assistant_id: true,
   instructions: true,
@@ -1167,6 +1301,7 @@ export const compactAssistantSchema = compactAssistantBaseSchema
   .catch(() => ({}));
 
 export const agentsBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   temperature: true,
@@ -1220,6 +1355,7 @@ export const agentsSchema = agentsBaseSchema
   }));
 
 export const openAIBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   chatGptLabel: true,
@@ -1251,7 +1387,7 @@ export const openAISchema = openAIBaseSchema
   .catch(() => ({}));
 
 export const openRouterSchema = openAIBaseSchema
-  .merge(tConversationSchema.pick({ promptCache: true }))
+  .merge(tConversationSchema.pick({ promptCache: true, promptCacheTtl: true }))
   .transform((obj: Partial<TConversation>) => removeNullishValues(obj, true))
   .catch(() => ({}));
 
@@ -1261,7 +1397,7 @@ export const compactGoogleSchema = googleBaseSchema
     if (newObj.temperature === google.temperature.default) {
       delete newObj.temperature;
     }
-    if (newObj.maxOutputTokens === google.maxOutputTokens.default) {
+    if (newObj.maxOutputTokens === google.maxOutputTokens.reset(newObj.model ?? '')) {
       delete newObj.maxOutputTokens;
     }
     if (newObj.topP === google.topP.default) {
@@ -1276,6 +1412,7 @@ export const compactGoogleSchema = googleBaseSchema
   .catch(() => ({}));
 
 export const anthropicBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   promptPrefix: true,
@@ -1285,6 +1422,7 @@ export const anthropicBaseSchema = tConversationSchema.pick({
   topK: true,
   resendFiles: true,
   promptCache: true,
+  promptCacheTtl: true,
   thinking: true,
   thinkingBudget: true,
   effort: true,
@@ -1317,6 +1455,7 @@ export const tBannerSchema = z.object({
 export type TBanner = z.infer<typeof tBannerSchema>;
 
 export const compactAgentsBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   spec: true,
   // model: true,
   iconURL: true,
diff --git a/packages/data-provider/src/types.ts b/packages/data-provider/src/types.ts
index b1c037c94fa..f3d40b139b2 100644
--- a/packages/data-provider/src/types.ts
+++ b/packages/data-provider/src/types.ts
@@ -7,6 +7,8 @@ import type {
   TAttachment,
   TMessage,
   TBanner,
+  ReasoningResponseKey,
+  ReasoningParameterFormat,
 } from './schemas';
 import type { RefillIntervalUnit } from './balance';
 import type { SettingDefinition } from './generate';
@@ -51,6 +53,7 @@ export type TEndpointOption = Pick<
   | 'additionalModelRequestFields'
   // Anthropic-specific
   | 'promptCache'
+  | 'promptCacheTtl'
   | 'thinking'
   | 'thinkingBudget'
   | 'thinkingLevel'
@@ -69,6 +72,7 @@ export type TEndpointOption = Pick<
   | 'file_ids'
   // System field
   | 'system'
+  | 'chatProjectId'
   // Google examples
   | 'examples'
   // Context
@@ -124,6 +128,8 @@ export type TPayload = Partial<TMessage> &
      * before the LLM turn runs.
      */
     manualSkills?: string[];
+    /** Browser IANA timezone (e.g. `America/New_York`) used to resolve local-time prompt variables server-side. */
+    timezone?: string;
   };
 
 export type TEditedContent =
@@ -144,6 +150,8 @@ export type TSubmission = {
   isContinued?: boolean;
   isTemporary: boolean;
   messages: TMessage[];
+  /** Client-only full message context used to restore branch siblings after scoped regenerate. */
+  regenerateMessages?: TMessage[];
   isRegenerate?: boolean;
   initialResponse?: TMessage;
   conversation: Partial<TConversation>;
@@ -213,6 +221,7 @@ export type TUser = {
   avatar: string;
   role: string;
   provider: string;
+  tenantId?: string;
   plugins?: string[];
   twoFactorEnabled?: boolean;
   backupCodes?: TBackupCode[];
@@ -284,6 +293,43 @@ export type TUpdateConversationRequest = {
 
 export type TUpdateConversationResponse = TConversation;
 
+export type TChatProject = {
+  _id: string;
+  name: string;
+  description?: string;
+  user?: string;
+  conversationCount: number;
+  lastConversationAt?: string | null;
+  lastConversationId?: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type TCreateChatProjectRequest = {
+  name: string;
+  description?: string;
+};
+
+export type TUpdateChatProjectRequest = Partial<TCreateChatProjectRequest> & {
+  projectId: string;
+};
+
+export type TDeleteChatProjectResponse = {
+  deletedCount: number;
+  modifiedCount: number;
+};
+
+export type TAssignConversationToProjectRequest = {
+  conversationId: string;
+  projectId: string | null;
+};
+
+export type TAssignConversationToProjectResponse = {
+  conversation: TConversation;
+  previousProjectId: string | null;
+  projectId: string | null;
+};
+
 export type TDeleteConversationRequest = {
   conversationId?: string;
   thread_id?: string;
@@ -307,19 +353,32 @@ export type TArchiveConversationRequest = {
 
 export type TArchiveConversationResponse = TConversation;
 
+export type TPinConversationRequest = {
+  conversationId: string;
+  pinned: boolean;
+};
+
+export type TPinConversationResponse = TConversation;
+
 export type TSharedMessagesResponse = Omit<TSharedLink, 'messages'> & {
   messages: TMessage[];
 };
 
 export type TCreateShareLinkRequest = Pick<TConversation, 'conversationId'>;
 
-export type TUpdateShareLinkRequest = Pick<TSharedLink, 'shareId'>;
+export type TUpdateShareLinkRequest = Pick<TSharedLink, 'shareId' | 'targetMessageId'>;
 
 export type TSharedLinkResponse = Pick<TSharedLink, 'shareId'> &
-  Pick<TConversation, 'conversationId'>;
+  Pick<TSharedLink, 'targetMessageId'> &
+  Pick<TConversation, 'conversationId'> & {
+    _id?: string;
+  };
 
-export type TSharedLinkGetResponse = TSharedLinkResponse & {
+export type TSharedLinkGetResponse = Omit<TSharedLinkResponse, 'shareId'> & {
+  shareId: string | null;
   success: boolean;
+  /** Per-link "share files" choice; absent on legacy links (treated as enabled). */
+  snapshotFiles?: boolean;
 };
 
 // type for getting conversation tags
@@ -386,11 +445,19 @@ export type TConfig = {
   modelDisplayLabel?: string;
   userProvide?: boolean | null;
   userProvideURL?: boolean | null;
+  userProvideAccessKeyId?: boolean;
+  userProvideSecretAccessKey?: boolean;
+  userProvideSessionToken?: boolean;
+  userProvideBearerToken?: boolean;
   disableBuilder?: boolean;
   retrievalModels?: string[];
   capabilities?: string[];
   customParams?: {
     defaultParamsEndpoint?: string;
+    reasoningFormat?: ReasoningParameterFormat;
+    reasoningKey?: ReasoningResponseKey;
+    includeReasoningContent?: boolean;
+    includeReasoningHistory?: boolean;
     paramDefinitions?: Partial<SettingDefinition>[];
   };
 };
@@ -401,6 +468,18 @@ export type TEndpointsConfig =
 
 export type TModelsConfig = Record<string, string[]>;
 
+/** Server-resolved context window and pricing for one model. Rates are USD per 1M tokens. */
+export type TModelTokenomics = {
+  context?: number;
+  prompt?: number;
+  completion?: number;
+  cacheWrite?: number;
+  cacheRead?: number;
+};
+
+/** endpoint → model → resolved tokenomics, from GET /api/endpoints/token-config */
+export type TTokenConfigMap = Record<string, Record<string, TModelTokenomics>>;
+
 export type TUpdateTokenCountResponse = {
   count: number;
 };
diff --git a/packages/data-provider/src/types/agents.ts b/packages/data-provider/src/types/agents.ts
index db70de8c9d8..0dc96fb6ccf 100644
--- a/packages/data-provider/src/types/agents.ts
+++ b/packages/data-provider/src/types/agents.ts
@@ -1,7 +1,8 @@
 /* eslint-disable @typescript-eslint/no-namespace */
-import { StepTypes, ContentTypes, ToolCallTypes } from './runs';
 import type { FunctionToolCall, SummaryContentPart } from './assistants';
+import type { TTokenUsageEvent, TContextUsageEvent } from './runs';
 import type { TAttachment, TPlugin } from 'src/schemas';
+import { StepTypes, ContentTypes, ToolCallTypes } from './runs';
 
 export namespace Agents {
   export type MessageType = 'human' | 'ai' | 'generic' | 'system' | 'function' | 'tool' | 'remove';
@@ -217,6 +218,24 @@ export namespace Agents {
     responseMessageId?: string;
     conversationId?: string;
     sender?: string;
+    iconURL?: string;
+    model?: string;
+    titleEvent?: {
+      event: 'title';
+      data?: {
+        conversationId?: string;
+        title?: string;
+      };
+    };
+    replayEvents?: Array<{
+      event: string;
+      data?: unknown;
+      [key: string]: unknown;
+    }>;
+    /** Cumulative provider-reported usage for the run; backfills usage totals on resume */
+    collectedUsage?: TTokenUsageEvent[];
+    /** Latest context window snapshot; restores the usage gauge on resume */
+    contextUsage?: TContextUsageEvent;
   }
   /**
    * Represents a run step delta i.e. any changed fields on a run step during
diff --git a/packages/data-provider/src/types/mutations.ts b/packages/data-provider/src/types/mutations.ts
index 4f40794527a..d4fed908ff9 100644
--- a/packages/data-provider/src/types/mutations.ts
+++ b/packages/data-provider/src/types/mutations.ts
@@ -1,18 +1,3 @@
-import * as types from '../types';
-import * as r from '../roles';
-import * as p from '../permissions';
-import {
-  Tools,
-  Assistant,
-  AssistantCreateParams,
-  AssistantUpdateParams,
-  FunctionTool,
-  AssistantDocument,
-  Agent,
-  AgentCreateParams,
-  AgentUpdateParams,
-} from './assistants';
-import { Action, ActionMetadata } from './agents';
 import type { InfiniteData, QueryKey } from '@tanstack/react-query';
 import type {
   TSkill,
@@ -26,6 +11,21 @@ import type {
   TDeleteSkillFileResponse,
   TSkillListResponse,
 } from './skills';
+import {
+  Tools,
+  Assistant,
+  AssistantCreateParams,
+  AssistantUpdateParams,
+  FunctionTool,
+  AssistantDocument,
+  Agent,
+  AgentCreateParams,
+  AgentUpdateParams,
+} from './assistants';
+import { Action, ActionMetadata } from './agents';
+import * as p from '../permissions';
+import * as types from '../types';
+import * as r from '../roles';
 
 export type MutationOptions<
   Response,
@@ -195,6 +195,11 @@ export type ArchiveConversationOptions = MutationOptions<
   types.TArchiveConversationRequest
 >;
 
+export type PinConversationOptions = MutationOptions<
+  types.TPinConversationResponse,
+  types.TPinConversationRequest
+>;
+
 export type DuplicateConvoOptions = MutationOptions<
   types.TDuplicateConvoResponse,
   types.TDuplicateConvoRequest
@@ -446,6 +451,7 @@ export type ToolParams<T extends ToolId> = ToolParamsMap[T] & {
   partIndex?: number;
   blockIndex?: number;
   conversationId: string;
+  isTemporary?: boolean;
 };
 export type ToolCallResponse = { result: unknown; attachments?: types.TAttachment[] };
 export type ToolCallMutationOptions<T extends ToolId> = MutationOptions<
diff --git a/packages/data-provider/src/types/queries.ts b/packages/data-provider/src/types/queries.ts
index 323090f2508..abe773fce2d 100644
--- a/packages/data-provider/src/types/queries.ts
+++ b/packages/data-provider/src/types/queries.ts
@@ -19,11 +19,12 @@ export type ConversationListParams = {
   sortDirection?: 'asc' | 'desc';
   tags?: string[];
   search?: string;
+  projectId?: string;
 };
 
 export type MinimalConversation = Pick<
   s.TConversation,
-  'conversationId' | 'endpoint' | 'title' | 'createdAt' | 'updatedAt' | 'user'
+  'conversationId' | 'endpoint' | 'title' | 'createdAt' | 'updatedAt' | 'user' | 'chatProjectId'
 >;
 
 export type ConversationListResponse = {
@@ -37,6 +38,21 @@ export type ConversationUpdater = (
   conversation: s.TConversation,
 ) => ConversationData;
 
+export type ProjectListParams = {
+  cursor?: string;
+  limit?: number;
+  sortBy?: 'name' | 'createdAt' | 'lastConversationAt';
+  sortDirection?: 'asc' | 'desc';
+  search?: string;
+};
+
+export type ProjectListResponse = {
+  projects: t.TChatProject[];
+  nextCursor: string | null;
+};
+
+export type ProjectData = InfiniteData<ProjectListResponse>;
+
 /* Messages */
 export type MessagesListParams = {
   cursor?: string | null;
@@ -60,7 +76,6 @@ export type SharedMessagesResponse = Omit<s.TSharedLink, 'messages'> & {
 
 export interface SharedLinksListParams {
   pageSize: number;
-  isPublic: boolean;
   sortBy: 'title' | 'createdAt';
   sortDirection: 'asc' | 'desc';
   search?: string;
@@ -70,7 +85,6 @@ export interface SharedLinksListParams {
 export type SharedLinkItem = {
   shareId: string;
   title: string;
-  isPublic: boolean;
   createdAt: Date;
   conversationId: string;
 };
@@ -187,6 +201,8 @@ export interface MCPServerStatus {
 export interface MCPConnectionStatusResponse {
   success: boolean;
   connectionStatus: Record<string, MCPServerStatus>;
+  /** Server-configured OAuth completion window in ms (`MCP_OAUTH_HANDLING_TIMEOUT`) */
+  oauthTimeout?: number;
 }
 
 export interface MCPServerConnectionStatusResponse {
diff --git a/packages/data-provider/src/types/runs.spec.ts b/packages/data-provider/src/types/runs.spec.ts
new file mode 100644
index 00000000000..f4058d1c7be
--- /dev/null
+++ b/packages/data-provider/src/types/runs.spec.ts
@@ -0,0 +1,121 @@
+import type { TContextUsageEvent, TTokenUsageEvent } from './runs';
+import { promptTokensFromUsage, reconcileContextUsage } from './runs';
+
+describe('promptTokensFromUsage', () => {
+  it('adds cache reads/writes for additive providers (Bedrock)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 53702,
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'bedrock',
+    };
+    expect(promptTokensFromUsage(event)).toBe(55773);
+  });
+
+  it('treats input_tokens as the full prompt for Anthropic (cache-inclusive)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 55773,
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'anthropic',
+    };
+    expect(promptTokensFromUsage(event)).toBe(55773);
+  });
+
+  it('treats input_tokens as the full prompt for subset providers (OpenAI)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 1000,
+      input_token_details: { cache_read: 200, cache_creation: 100 },
+      provider: 'openAI',
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+
+  it('handles missing fields', () => {
+    expect(promptTokensFromUsage({ provider: 'anthropic' })).toBe(0);
+  });
+
+  it('uses the magnitude heuristic when the provider is absent (cache ≤ input ⇒ included)', () => {
+    /** OpenAI-compatible/custom payload with no provider: cache already folded
+     *  into input_tokens, so it must NOT be re-added. */
+    const event: TTokenUsageEvent = {
+      input_tokens: 1000,
+      input_token_details: { cache_read: 400, cache_creation: 0 },
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+
+  it('adds cache when provider is absent and cache exceeds input (additive shape)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 100,
+      input_token_details: { cache_read: 900, cache_creation: 0 },
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+});
+
+describe('reconcileContextUsage', () => {
+  /** The exact over-reporting case from a real web-search + summarization turn:
+   *  calibrationRatio pinned at 5 inflated messageTokens to 187471 → used 213375,
+   *  while the provider's real prompt for that call was 55773. */
+  const inflatedSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 250000,
+      instructionTokens: 4205,
+      systemMessageTokens: 384,
+      dynamicInstructionTokens: 1525,
+      toolSchemaTokens: 2296,
+      summaryTokens: 1938,
+      toolCount: 1,
+      messageCount: 2,
+      messageTokens: 187471,
+      availableForMessages: 233295,
+    },
+    contextBudget: 237500,
+    remainingContextTokens: 24125,
+    calibrationRatio: 5,
+  };
+
+  it('reconciles the inflated estimate to the real prompt tokens', () => {
+    const result = reconcileContextUsage(inflatedSnapshot, 55773);
+    /** used = budget − remaining = real prompt, down from the inflated 213375 */
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(55773);
+    /** only messageTokens is corrected; instructions/summary stay raw */
+    expect(result.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    expect(result.breakdown.instructionTokens).toBe(4205);
+    expect(result.breakdown.summaryTokens).toBe(1938);
+    /** rows still sum to the real total */
+    expect(
+      result.breakdown.messageTokens +
+        result.breakdown.instructionTokens +
+        result.breakdown.summaryTokens,
+    ).toBe(55773);
+  });
+
+  it('clamps messageTokens to zero when the prompt is smaller than the overhead', () => {
+    const result = reconcileContextUsage(inflatedSnapshot, 3000);
+    expect(result.breakdown.messageTokens).toBe(0);
+    expect(result.remainingContextTokens).toBe(237500 - 3000);
+  });
+
+  it('is a no-op for an unusable prompt count', () => {
+    expect(reconcileContextUsage(inflatedSnapshot, 0)).toBe(inflatedSnapshot);
+    expect(reconcileContextUsage(inflatedSnapshot, -5)).toBe(inflatedSnapshot);
+    expect(reconcileContextUsage(inflatedSnapshot, NaN)).toBe(inflatedSnapshot);
+  });
+
+  it('end-to-end: promptTokensFromUsage feeds reconcileContextUsage (followup turn)', () => {
+    const followupSnapshot: TContextUsageEvent = {
+      ...inflatedSnapshot,
+      breakdown: { ...inflatedSnapshot.breakdown, messageTokens: 30480 },
+      remainingContextTokens: 202815,
+    };
+    const usage: TTokenUsageEvent = {
+      input_tokens: 9875, // cache-inclusive (Anthropic): 7804 fresh + 2071 read
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'anthropic',
+    };
+    const result = reconcileContextUsage(followupSnapshot, promptTokensFromUsage(usage));
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(9875);
+    expect(result.breakdown.messageTokens).toBe(9875 - 4205 - 1938);
+  });
+});
diff --git a/packages/data-provider/src/types/runs.ts b/packages/data-provider/src/types/runs.ts
index 706c380c6f6..8e1033c07fe 100644
--- a/packages/data-provider/src/types/runs.ts
+++ b/packages/data-provider/src/types/runs.ts
@@ -1,3 +1,5 @@
+import { inputTokensIncludesCache } from '../schemas';
+
 export enum ContentTypes {
   TEXT = 'text',
   THINK = 'think',
@@ -40,6 +42,166 @@ export enum StepEvents {
   ON_SUBAGENT_UPDATE = 'on_subagent_update',
 }
 
+/** Token-tracking event names streamed to the client (separate from StepEvents dispatch). */
+export enum UsageEvents {
+  ON_CONTEXT_USAGE = 'on_context_usage',
+  ON_TOKEN_USAGE = 'on_token_usage',
+}
+
+/** Mirrors TokenBudgetBreakdown from @librechat/agents (data-provider cannot import it). */
+export type TTokenBudgetBreakdown = {
+  maxContextTokens: number;
+  instructionTokens: number;
+  systemMessageTokens: number;
+  dynamicInstructionTokens: number;
+  toolSchemaTokens: number;
+  summaryTokens: number;
+  toolCount: number;
+  messageCount: number;
+  messageTokens: number;
+  availableForMessages: number;
+  /** Per-tool schema token counts (post-multiplier), keyed by tool name */
+  toolTokenCounts?: Record<string, number>;
+  /** Names of counted tools that are deferred (`defer_loading`) and discovered */
+  deferredToolNames?: string[];
+};
+
+/** Per-model-call context snapshot, dispatched after pruning and before the LLM call. */
+export type TContextUsageEvent = {
+  runId?: string;
+  agentId?: string;
+  breakdown: TTokenBudgetBreakdown;
+  /** Usable budget this call: maxContextTokens minus output reserve */
+  contextBudget?: number;
+  /** Calibrated instruction overhead actually applied this call */
+  effectiveInstructionTokens?: number;
+  /** Calibrated message tokens before pruning (excluding instructions) */
+  prePruneContextTokens?: number;
+  /** Tokens still free after instructions + pruned messages */
+  remainingContextTokens?: number;
+  calibrationRatio?: number;
+  /** Output tokens of the response's final model call (the call this pre-invoke
+   *  snapshot precedes). Populated only on the persisted `metadata.contextUsage`
+   *  blob so a reloaded multi-call turn adds the same post-snapshot delta the
+   *  live finalizer did — not the full response `tokenCount`, which the snapshot
+   *  already includes for earlier steps. */
+  completedOutputTokens?: number;
+};
+
+/**
+ * Request payload for a server-side context-usage projection: "what context
+ * would the next call send for this branch under this config", computed by the
+ * agents SDK without invoking the model. Powers the gauge in states the live
+ * snapshot can't cover (page load of a snapshot-less branch, window/model
+ * switch). `messageId` is the viewed branch's tail; the server walks its parent
+ * chain.
+ */
+export type TContextProjectionRequest = {
+  conversationId: string;
+  messageId: string;
+  endpoint: string;
+  model?: string;
+  agentId?: string;
+  spec?: string;
+  maxContextTokens?: number;
+  /** Provider-calibrated ratio from a prior snapshot, applied as a static seed. */
+  calibrationRatio?: number;
+  /** Client-only cache-bust: a branch content revision so a message edit
+   *  (which keeps the same tail id) refetches. The server ignores it. */
+  revision?: number;
+};
+
+/**
+ * Per-response usage rollup persisted on `responseMessage.metadata.usage`, in
+ * display units (input excludes cache; output includes repaired completion).
+ * Normalized per-event on the backend before summing so a reloaded conversation
+ * reproduces the live branch/total usage exactly, even for mixed-provider turns
+ * (summarization/subagent calls on a different provider than the primary).
+ */
+export type TResponseUsage = {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  /** Authoritative USD cost; present only when `interface.contextCost` was on at save */
+  cost?: number;
+};
+
+/** Provider-reported usage for a single completed model call. */
+export type TTokenUsageEvent = {
+  input_tokens?: number;
+  output_tokens?: number;
+  total_tokens?: number;
+  input_token_details?: {
+    cache_creation?: number;
+    cache_read?: number;
+  };
+  model?: string;
+  provider?: string;
+  /** Non-primary buckets fold into session cost/totals but not the live
+   *  context gauge: hidden sequential-agent calls (`sequential`), summary
+   *  passes (`summarization`), and isolated subagent runs (`subagent`) */
+  usage_type?: 'summarization' | 'subagent' | 'sequential';
+  runId?: string;
+  /** Per-run emission sequence; keeps identical payloads from distinct model calls unique */
+  seq?: number;
+  /** Authoritative USD cost of this call from the backend (premium tiers, cache
+   *  rates); present only when `interface.contextCost` is enabled. Clients sum
+   *  this rather than re-deriving cost from base rates. */
+  cost?: number;
+};
+
+/**
+ * Full prompt token count for one completed model call — the EXACT context the
+ * model saw, provider-aware: additive providers (Bedrock) report `input_tokens`
+ * excluding cache, so cache reads/writes are added back; subset providers
+ * (Anthropic, OpenAI, …) already fold cache into `input_tokens`. When the
+ * provider is absent (custom/OpenAI-compatible payloads), fall back to the same
+ * magnitude heuristic `normalizeUsageUnits` uses — cache ≤ input means it's
+ * already included — so cached events aren't re-inflated. The ground truth the
+ * gauge reconciles its calibrated estimate to.
+ */
+export const promptTokensFromUsage = (event: TTokenUsageEvent): number => {
+  const input = event.input_tokens ?? 0;
+  const details = event.input_token_details ?? {};
+  const cacheRead = details.cache_read ?? 0;
+  const cacheCreation = details.cache_creation ?? 0;
+  const includesCache =
+    event.provider != null
+      ? inputTokensIncludesCache(event.provider)
+      : cacheRead + cacheCreation <= input;
+  return includesCache ? input : input + cacheRead + cacheCreation;
+};
+
+/**
+ * Reconciles a pre-invoke context snapshot's CALIBRATED estimate to a call's
+ * ACTUAL prompt tokens. The SDK's calibration multiplier scales only
+ * `messageTokens` (instructions/summary are raw tiktoken counts), and it can
+ * over-shoot badly when a provider injects server-side content the SDK never
+ * counted (e.g. Anthropic web search) — pinning the gauge several× too high and
+ * persisting it. Trust the provider's own prompt count: keep the raw
+ * instruction/summary rows, set `messageTokens` to the remainder, and recompute
+ * the free space. No-op when `promptTokens` is unusable.
+ */
+export const reconcileContextUsage = (
+  snapshot: TContextUsageEvent,
+  promptTokens: number,
+): TContextUsageEvent => {
+  if (!Number.isFinite(promptTokens) || promptTokens <= 0) {
+    return snapshot;
+  }
+  const { breakdown } = snapshot;
+  const budget = snapshot.contextBudget ?? breakdown.maxContextTokens;
+  const nonMessageTokens = (breakdown.instructionTokens ?? 0) + (breakdown.summaryTokens ?? 0);
+  const messageTokens = Math.max(0, promptTokens - nonMessageTokens);
+  return {
+    ...snapshot,
+    breakdown: { ...breakdown, messageTokens },
+    remainingContextTokens:
+      budget != null ? Math.max(0, budget - promptTokens) : snapshot.remainingContextTokens,
+  };
+};
+
 /** Lifecycle phase carried on subagent-progress envelopes (mirrors SDK SubagentUpdatePhase). */
 export type SubagentUpdatePhase =
   | 'start'
diff --git a/packages/data-provider/src/types/skills.ts b/packages/data-provider/src/types/skills.ts
index 3552629a80f..487edc29dc3 100644
--- a/packages/data-provider/src/types/skills.ts
+++ b/packages/data-provider/src/types/skills.ts
@@ -25,9 +25,11 @@ export const SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 /**
  * Source of a skill — where its canonical definition came from.
  * `inline` means the skill was authored directly in LibreChat.
- * `github` / `notion` are reserved for future sync integrations.
+ * `deployment` means the skill was loaded from the server's configured
+ * deployment skill directory and is not persisted as a Skill document.
+ * `github` is populated by admin-configured GitHub skill sync; `notion` is reserved.
  */
-export type SkillSource = 'inline' | 'github' | 'notion';
+export type SkillSource = 'inline' | 'deployment' | 'github' | 'notion';
 
 /**
  * Category inferred from a skill file's top-level directory prefix.
@@ -58,11 +60,25 @@ export type SkillFrontmatter = {
  * Provenance metadata for skills that originated from an external source
  * (e.g. a GitHub commit SHA or a Notion page id).
  *
- * Reserved for phase 2+ external sync — no code path currently populates this
- * in phase 1, but the column exists so a future sync worker can use it
- * without a schema migration.
+ * Populated by external sync workers with upstream identifiers such as source
+ * ids, paths, and commit/blob SHAs.
  */
-export type SkillSourceMetadata = Record<string, string | number | boolean>;
+export type SkillSourceMetadata =
+  | Record<string, string | number | boolean>
+  | {
+      provider: 'github';
+      sourceId: string;
+      upstreamId: string;
+      owner: string;
+      repo: string;
+      ref: string;
+      skillPath: string;
+      commitSha?: string;
+      skillBlobSha?: string;
+      syncedAt?: string;
+      syncStatus?: 'synced' | 'failed';
+      error?: string;
+    };
 
 /**
  * A non-blocking coaching hint surfaced alongside a successful create/update
@@ -92,8 +108,8 @@ export type TSkillWarning = {
  * - `frontmatter` is the structured YAML bag minus `name`/`description`
  *   (those live as top-level columns). Validated strictly against a known
  *   key set server-side.
- * - `source`/`sourceMetadata` are reserved for phase 2+ external sync and
- *   always `'inline'` / absent in phase 1.
+ * - `source`/`sourceMetadata` identify whether the row is user-authored,
+ *   deployment-provided, or mirrored from an external source such as GitHub.
  */
 export type TSkill = {
   _id: string;
@@ -181,6 +197,7 @@ export type TSkillFile = {
   isExecutable: boolean;
   author: string;
   tenantId?: string;
+  sourceMetadata?: Record<string, string | number | boolean>;
   /** Lazily cached text content (≤ 512 KB). Excluded from list responses. */
   content?: string;
   /** Set on first read. `true` prevents repeated storage reads for non-text files. */
@@ -189,6 +206,59 @@ export type TSkillFile = {
   updatedAt: string;
 };
 
+export type TGitHubSkillSyncCredentialSummary = {
+  provider: 'github';
+  credentialKey: string;
+  credentialPresent: boolean;
+  tokenFingerprint?: string;
+  updatedAt?: string;
+  createdAt?: string;
+};
+
+export type TGitHubSkillSyncSourceStatus = {
+  provider: 'github';
+  sourceId: string;
+  tenantId?: string;
+  status: 'idle' | 'running' | 'succeeded' | 'failed' | 'skipped';
+  credentialKey?: string;
+  credentialPresent: boolean;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: string;
+  finishedAt?: string;
+  lastSuccessAt?: string;
+  lastFailureAt?: string;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  updatedAt?: string;
+  createdAt?: string;
+};
+
+export type TGitHubSkillSyncStatusResponse = {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: TGitHubSkillSyncSourceStatus[];
+  credentials: TGitHubSkillSyncCredentialSummary[];
+  fineGrainedTokenRecommendation: string;
+};
+
+export type TGitHubSkillSyncCredentialUpdateRequest = {
+  token: string;
+};
+
+export type TGitHubSkillSyncManualRunResponse = {
+  status: 'started' | 'skipped' | 'completed' | 'failed';
+  message?: string;
+  sources?: TGitHubSkillSyncSourceStatus[];
+};
+
 /** Request body for POST `/api/skills`. */
 export type TCreateSkill = {
   name: string;
@@ -197,7 +267,7 @@ export type TCreateSkill = {
   body: string;
   frontmatter?: Partial<SkillFrontmatter>;
   category?: string;
-  /** When `true`, the skill auto-primes into every turn (mirrors `always-apply` frontmatter). */
+  /** When `true`, the skill auto-primes into every turn (mirrors always-apply frontmatter). */
   alwaysApply?: boolean;
 };
 
diff --git a/packages/data-provider/tsconfig.build.json b/packages/data-provider/tsconfig.build.json
new file mode 100644
index 00000000000..689e9bced3e
--- /dev/null
+++ b/packages/data-provider/tsconfig.build.json
@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": false,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "declarationDir": "./dist/types",
+    "outDir": "./dist/types"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.spec.ts", "**/*.test.ts"]
+}
diff --git a/packages/data-provider/tsdown.config.mjs b/packages/data-provider/tsdown.config.mjs
new file mode 100644
index 00000000000..a870e0aa439
--- /dev/null
+++ b/packages/data-provider/tsdown.config.mjs
@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import replace from '@rollup/plugin-replace';
+import { defineConfig } from 'tsdown';
+
+const require = createRequire(import.meta.url);
+const rootPkg = require('../../package.json');
+
+export default defineConfig({
+  entry: ['src/index.ts', 'src/react-query/index.ts'],
+  format: ['cjs', 'esm'],
+  platform: 'neutral',
+  // Declarations are emitted separately by `tsc -p tsconfig.build.json` (see the
+  // `build` script). This package's zod schemas aren't `isolatedDeclarations`-clean,
+  // so oxc/bundled-dts isn't viable; plain tsc keeps the rich types and is the only
+  // slow step (~2s), while rolldown bundles the JS in ~0.2s.
+  dts: false,
+  outDir: 'dist',
+  sourcemap: true,
+  deps: {
+    // Match the prior Rollup build: bundle nothing third-party. Externalize every
+    // bare import (deps, peers, and node built-ins like `crypto`); bundle only the
+    // package's own relative/aliased modules.
+    neverBundle: (id) => !id.startsWith('.') && !path.isAbsolute(id) && !id.startsWith('src/'),
+    onlyBundle: false,
+  },
+  plugins: [
+    replace({
+      preventAssignment: true,
+      values: {
+        __IS_DEV__: process.env.NODE_ENV === 'development',
+        __LIBRECHAT_VERSION__: rootPkg.version,
+      },
+    }),
+  ],
+});
diff --git a/packages/data-schemas/package.json b/packages/data-schemas/package.json
index 9419a694542..254ac5558ff 100644
--- a/packages/data-schemas/package.json
+++ b/packages/data-schemas/package.json
@@ -1,22 +1,32 @@
 {
   "name": "@librechat/data-schemas",
-  "version": "0.0.51",
+  "version": "0.0.56",
   "description": "Mongoose schemas and models for LibreChat",
   "type": "module",
   "main": "dist/index.cjs",
-  "module": "dist/index.es.js",
-  "types": "./dist/types/index.d.ts",
+  "module": "dist/index.mjs",
+  "types": "./dist/index.d.cts",
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.cjs",
-      "types": "./dist/types/index.d.ts"
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./capabilities": {
-      "import": "./dist/admin/capabilities.es.js",
-      "require": "./dist/admin/capabilities.cjs",
-      "types": "./dist/types/admin/capabilities.d.ts"
+      "import": {
+        "types": "./dist/capabilities.d.mts",
+        "default": "./dist/admin/capabilities.mjs"
+      },
+      "require": {
+        "types": "./dist/capabilities.d.cts",
+        "default": "./dist/admin/capabilities.cjs"
+      }
     }
   },
   "files": [
@@ -24,13 +34,13 @@
   ],
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w",
+    "build": "npm run clean && tsdown",
+    "build:watch": "tsdown --watch",
     "test": "jest --coverage --watch",
     "test:ci": "jest --coverage --ci",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs"
+    "b:build": "bun run b:clean && bun run tsdown"
   },
   "repository": {
     "type": "git",
@@ -52,16 +62,17 @@
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.2",
-    "@types/node": "^20.3.0",
+    "@types/node": "^24.12.4",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "mongodb-memory-server": "^11.0.1",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
     "rollup-plugin-peer-deps-external": "^2.2.4",
     "rollup-plugin-typescript2": "^0.37.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   },
   "peerDependencies": {
     "jsonwebtoken": "^9.0.2",
diff --git a/packages/data-schemas/rollup.config.js b/packages/data-schemas/rollup.config.js
deleted file mode 100644
index 703630e1214..00000000000
--- a/packages/data-schemas/rollup.config.js
+++ /dev/null
@@ -1,46 +0,0 @@
-import json from '@rollup/plugin-json';
-import typescript from '@rollup/plugin-typescript';
-import commonjs from '@rollup/plugin-commonjs';
-import nodeResolve from '@rollup/plugin-node-resolve';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-
-export default {
-  input: 'src/index.ts',
-  output: [
-    {
-      dir: 'dist',
-      format: 'es',
-      sourcemap: true,
-      preserveModules: true,
-      preserveModulesRoot: 'src',
-      entryFileNames: '[name].es.js',
-    },
-    {
-      dir: 'dist',
-      format: 'cjs',
-      sourcemap: true,
-      preserveModules: true,
-      preserveModulesRoot: 'src',
-      entryFileNames: '[name].cjs',
-    },
-  ],
-  plugins: [
-    // Allow importing JSON files
-    json(),
-    // Automatically externalize peer dependencies
-    peerDepsExternal(),
-    // Resolve modules from node_modules
-    nodeResolve(),
-    // Convert CommonJS modules to ES6
-    commonjs(),
-    // Compile TypeScript files and generate type declarations
-    typescript({
-      tsconfig: './tsconfig.build.json',
-      declaration: true,
-      declarationDir: 'dist/types',
-      rootDir: 'src',
-    }),
-  ],
-  // Do not bundle these external dependencies
-  external: ['mongoose'],
-};
diff --git a/packages/data-schemas/src/admin/capabilities.ts b/packages/data-schemas/src/admin/capabilities.ts
index 0284fb55864..33a6c2ecf91 100644
--- a/packages/data-schemas/src/admin/capabilities.ts
+++ b/packages/data-schemas/src/admin/capabilities.ts
@@ -37,9 +37,17 @@ export const SystemCapabilities = {
   MANAGE_PROMPTS: 'manage:prompts',
   READ_SKILLS: 'read:skills',
   MANAGE_SKILLS: 'manage:skills',
+  READ_SHARED_LINKS: 'read:sharedlinks',
+  MANAGE_SHARED_LINKS: 'manage:sharedlinks',
   /** Reserved — not yet enforced by any middleware. */
   READ_ASSISTANTS: 'read:assistants',
   MANAGE_ASSISTANTS: 'manage:assistants',
+  /**
+   * Required to list, view, and CSV-export the SystemGrant audit log. Append-only
+   * by design, so there is no MANAGE counterpart — modifying historical entries
+   * would defeat the forensic guarantee.
+   */
+  READ_AUDIT_LOG: 'read:audit_log',
 } as const;
 
 /**
@@ -55,6 +63,7 @@ export const CapabilityImplications: Partial<Record<BaseSystemCapability, BaseSy
     [SystemCapabilities.MANAGE_AGENTS]: [SystemCapabilities.READ_AGENTS],
     [SystemCapabilities.MANAGE_PROMPTS]: [SystemCapabilities.READ_PROMPTS],
     [SystemCapabilities.MANAGE_SKILLS]: [SystemCapabilities.READ_SKILLS],
+    [SystemCapabilities.MANAGE_SHARED_LINKS]: [SystemCapabilities.READ_SHARED_LINKS],
     [SystemCapabilities.MANAGE_ASSISTANTS]: [SystemCapabilities.READ_ASSISTANTS],
   };
 
@@ -143,6 +152,7 @@ export const ResourceCapabilityMap: Record<ResourceType, SystemCapability> = {
   [ResourceType.MCPSERVER]: SystemCapabilities.MANAGE_MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: SystemCapabilities.MANAGE_AGENTS,
   [ResourceType.SKILL]: SystemCapabilities.MANAGE_SKILLS,
+  [ResourceType.SHARED_LINK]: SystemCapabilities.MANAGE_SHARED_LINKS,
 };
 
 /**
@@ -213,11 +223,17 @@ export const CAPABILITY_CATEGORIES: CapabilityCategory[] = [
       SystemCapabilities.MANAGE_ASSISTANTS,
       SystemCapabilities.READ_ASSISTANTS,
       SystemCapabilities.MANAGE_MCP_SERVERS,
+      SystemCapabilities.MANAGE_SHARED_LINKS,
+      SystemCapabilities.READ_SHARED_LINKS,
     ],
   },
   {
     key: 'system',
     labelKey: 'com_cap_cat_system',
-    capabilities: [SystemCapabilities.ACCESS_ADMIN, SystemCapabilities.READ_USAGE],
+    capabilities: [
+      SystemCapabilities.ACCESS_ADMIN,
+      SystemCapabilities.READ_USAGE,
+      SystemCapabilities.READ_AUDIT_LOG,
+    ],
   },
 ];
diff --git a/packages/data-schemas/src/app/assistants.ts b/packages/data-schemas/src/app/assistants.ts
index c41a8d603ed..ddc56cf495f 100644
--- a/packages/data-schemas/src/app/assistants.ts
+++ b/packages/data-schemas/src/app/assistants.ts
@@ -52,6 +52,10 @@ export function assistantsConfigSetup(
 
   return {
     ...prevConfig,
+    version:
+      assistantsConfig?.version != null
+        ? parsedConfig.version
+        : (prevConfig.version ?? parsedConfig.version),
     retrievalModels: parsedConfig.retrievalModels,
     disableBuilder: parsedConfig.disableBuilder,
     pollIntervalMs: parsedConfig.pollIntervalMs,
diff --git a/packages/data-schemas/src/app/endpoints.ts b/packages/data-schemas/src/app/endpoints.ts
index 1c8ed5b5d0e..70a5376528e 100644
--- a/packages/data-schemas/src/app/endpoints.ts
+++ b/packages/data-schemas/src/app/endpoints.ts
@@ -1,10 +1,15 @@
 import { EModelEndpoint } from 'librechat-data-provider';
-import type { TCustomConfig, TAgentsEndpoint, TAnthropicEndpoint } from 'librechat-data-provider';
+import type {
+  TEndpoint,
+  TCustomConfig,
+  TAgentsEndpoint,
+  TAnthropicEndpoint,
+} from 'librechat-data-provider';
 import type { AppConfig } from '~/types';
 import { azureAssistantsDefaults, assistantsConfigSetup } from './assistants';
 import { agentsConfigSetup } from './agents';
-import { azureConfigSetup } from './azure';
 import { vertexConfigSetup } from './vertex';
+import { azureConfigSetup } from './azure';
 
 /**
  * Loads custom config endpoints
@@ -14,7 +19,21 @@ import { vertexConfigSetup } from './vertex';
 export const loadEndpoints = (
   config: Partial<TCustomConfig>,
   agentsDefaults?: Partial<TAgentsEndpoint>,
-) => {
+): {
+  allowedAddresses?: string[];
+  openAI?: Partial<import('librechat-data-provider').TEndpoint>;
+  google?: Partial<import('librechat-data-provider').TEndpoint>;
+  bedrock?: Partial<import('librechat-data-provider').TEndpoint>;
+  anthropic?: Partial<TAnthropicEndpoint> & {
+    vertexConfig?: import('librechat-data-provider').TVertexAIConfig;
+  };
+  azureOpenAI?: import('librechat-data-provider').TAzureConfig;
+  assistants?: Partial<import('librechat-data-provider').TAssistantEndpoint>;
+  azureAssistants?: Partial<import('librechat-data-provider').TAssistantEndpoint>;
+  all?: Partial<import('librechat-data-provider').TEndpoint>;
+  agents?: Partial<TAgentsEndpoint>;
+  custom?: import('librechat-data-provider').TCustomEndpoints;
+} => {
   const loadedEndpoints: AppConfig['endpoints'] = {};
   const endpoints = config?.endpoints;
 
@@ -74,7 +93,12 @@ export const loadEndpoints = (
   });
 
   if (endpoints?.all) {
-    loadedEndpoints.all = endpoints.all;
+    /**
+     * `DeepPartial<TCustomConfig>` widens record values to `string | undefined`
+     * (e.g. `headers`), so cast to the concrete endpoint type — mirrors the
+     * `anthropicConfig as TAnthropicEndpoint` cast above.
+     */
+    loadedEndpoints.all = endpoints.all as Partial<TEndpoint>;
   }
 
   if (endpoints?.allowedAddresses) {
diff --git a/packages/data-schemas/src/app/interface.spec.ts b/packages/data-schemas/src/app/interface.spec.ts
index 9e289d289b1..1a4f72c3029 100644
--- a/packages/data-schemas/src/app/interface.spec.ts
+++ b/packages/data-schemas/src/app/interface.spec.ts
@@ -1,4 +1,4 @@
-import { getConfigDefaults } from 'librechat-data-provider';
+import { getConfigDefaults, RetentionMode } from 'librechat-data-provider';
 import type { TCustomConfig } from 'librechat-data-provider';
 import { loadDefaultInterface } from './interface';
 
@@ -27,6 +27,108 @@ describe('loadDefaultInterface', () => {
     expect(interfaceConfig?.autoSubmitFromUrl).toBe(false);
   });
 
+  it('preserves a disabled build info flag', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        buildInfo: false,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(false);
+  });
+
+  it('uses the schema default for build info when not configured', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(true);
+  });
+
+  it('preserves enabled build info config', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        buildInfo: true,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(true);
+  });
+
+  it('disables context cost by default', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(false);
+  });
+
+  it('preserves a disabled context cost flag', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        contextCost: false,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(false);
+  });
+
+  it('preserves enabled context cost config', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        contextCost: true,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(true);
+  });
+
+  it('passes through a configured display currency', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        currency: { code: 'EUR', rate: 0.92 },
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.currency).toEqual({ code: 'EUR', rate: 0.92 });
+  });
+
+  it('omits currency when it is not configured', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.currency).toBeUndefined();
+  });
+
   it('preserves enabled URL auto-submit config', async () => {
     const config: Partial<TCustomConfig> = {
       interface: {
@@ -65,4 +167,45 @@ describe('loadDefaultInterface', () => {
 
     expect(interfaceConfig).not.toHaveProperty('temporaryChatRetention');
   });
+
+  it('preserves the configured agent file retention exemption', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        retentionMode: RetentionMode.ALL,
+        retainAgentFiles: true,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.retentionMode).toBe(RetentionMode.ALL);
+    expect(interfaceConfig?.retainAgentFiles).toBe(true);
+  });
+
+  it('passes through configured default pinned tools', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        defaultPinnedTools: ['artifacts', 'execute_code', 'mcp'],
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.defaultPinnedTools).toEqual(['artifacts', 'execute_code', 'mcp']);
+  });
+
+  it('omits default pinned tools when not explicitly configured', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig).not.toHaveProperty('defaultPinnedTools');
+  });
 });
diff --git a/packages/data-schemas/src/app/interface.ts b/packages/data-schemas/src/app/interface.ts
index 4e719e8ac52..143e62bc5f0 100644
--- a/packages/data-schemas/src/app/interface.ts
+++ b/packages/data-schemas/src/app/interface.ts
@@ -39,6 +39,10 @@ export async function loadDefaultInterface({
     mcpServers: interfaceConfig?.mcpServers ?? defaults.mcpServers,
     customWelcome: interfaceConfig?.customWelcome ?? defaults.customWelcome,
     autoSubmitFromUrl: interfaceConfig?.autoSubmitFromUrl ?? defaults.autoSubmitFromUrl,
+    buildInfo: interfaceConfig?.buildInfo ?? defaults.buildInfo,
+    contextUsage: interfaceConfig?.contextUsage ?? defaults.contextUsage,
+    contextCost: interfaceConfig?.contextCost ?? defaults.contextCost,
+    currency: interfaceConfig?.currency ?? defaults.currency,
 
     // Permissions and related settings - only include if explicitly configured
     bookmarks: interfaceConfig?.bookmarks,
@@ -48,14 +52,18 @@ export async function loadDefaultInterface({
     agents: interfaceConfig?.agents,
     temporaryChat: interfaceConfig?.temporaryChat,
     temporaryChatRetention: interfaceConfig?.temporaryChatRetention,
+    retentionMode: interfaceConfig?.retentionMode,
+    retainAgentFiles: interfaceConfig?.retainAgentFiles,
     runCode: interfaceConfig?.runCode,
     webSearch: interfaceConfig?.webSearch,
     fileSearch: interfaceConfig?.fileSearch,
     fileCitations: interfaceConfig?.fileCitations,
+    defaultPinnedTools: interfaceConfig?.defaultPinnedTools,
     peoplePicker: interfaceConfig?.peoplePicker,
     marketplace: interfaceConfig?.marketplace,
     remoteAgents: interfaceConfig?.remoteAgents,
     skills: interfaceConfig?.skills,
+    sharedLinks: interfaceConfig?.sharedLinks,
   });
 
   return loadedInterface;
diff --git a/packages/data-schemas/src/app/memory.ts b/packages/data-schemas/src/app/memory.ts
index a3b89176db4..ee298db9399 100644
--- a/packages/data-schemas/src/app/memory.ts
+++ b/packages/data-schemas/src/app/memory.ts
@@ -1,4 +1,4 @@
-import { memorySchema } from 'librechat-data-provider';
+import { DEFAULT_MEMORY_MAX_INPUT_TOKENS, memorySchema } from 'librechat-data-provider';
 
 import type { TCustomConfig, TMemoryConfig } from 'librechat-data-provider';
 
@@ -23,8 +23,11 @@ export function loadMemoryConfig(config: TCustomConfig['memory']): TMemoryConfig
   }
 
   const charLimit = memorySchema.shape.charLimit.safeParse(config.charLimit).data ?? 10000;
+  const maxInputTokens =
+    memorySchema.shape.maxInputTokens.safeParse(config.maxInputTokens).data ??
+    DEFAULT_MEMORY_MAX_INPUT_TOKENS;
 
-  return { ...config, charLimit };
+  return { ...config, charLimit, maxInputTokens };
 }
 
 export function isMemoryEnabled(config: TMemoryConfig | undefined): boolean {
diff --git a/packages/data-schemas/src/app/resolution.spec.ts b/packages/data-schemas/src/app/resolution.spec.ts
index b751e0bbcf0..d3020c07074 100644
--- a/packages/data-schemas/src/app/resolution.spec.ts
+++ b/packages/data-schemas/src/app/resolution.spec.ts
@@ -1,8 +1,12 @@
 import { INTERFACE_PERMISSION_FIELDS, PermissionTypes } from 'librechat-data-provider';
-import { mergeConfigOverrides } from './resolution';
 import type { AppConfig, IConfig } from '~/types';
+import { mergeConfigOverrides } from './resolution';
 
-function fakeConfig(overrides: Record<string, unknown>, priority: number): IConfig {
+function fakeConfig(
+  overrides: Record<string, unknown>,
+  priority: number,
+  tombstones?: string[],
+): IConfig {
   return {
     _id: 'fake',
     principalType: 'role',
@@ -10,6 +14,7 @@ function fakeConfig(overrides: Record<string, unknown>, priority: number): IConf
     principalModel: 'Role',
     priority,
     overrides,
+    tombstones,
     isActive: true,
     configVersion: 1,
   } as unknown as IConfig;
@@ -342,6 +347,66 @@ describe('mergeConfigOverrides', () => {
     expect(iface.parameters).toBe(true);
   });
 
+  it('merges skillSync config sections from DB overrides', () => {
+    const base = {
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'base-source',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+      interfaceConfig: { modelSelect: true },
+    } as unknown as AppConfig;
+
+    const configs = [
+      fakeConfig(
+        {
+          skillSync: {
+            github: {
+              enabled: false,
+              sources: [
+                {
+                  id: 'override-source',
+                  owner: 'other',
+                  repo: 'skills',
+                  paths: ['skills'],
+                  token: '${OTHER_TOKEN}',
+                },
+              ],
+            },
+          },
+          interface: { modelSelect: false },
+        },
+        10,
+      ),
+    ];
+
+    const result = mergeConfigOverrides(base, configs);
+
+    expect(result.skillSync?.github?.enabled).toBe(false);
+    expect(result.skillSync?.github?.sources).toEqual([
+      {
+        id: 'override-source',
+        owner: 'other',
+        repo: 'skills',
+        paths: ['skills'],
+        token: '${OTHER_TOKEN}',
+      },
+    ]);
+    expect(result.interfaceConfig?.modelSelect).toBe(false);
+  });
+
   it('preserves UI sub-keys in composite permission fields like mcpServers', () => {
     const base = {
       interfaceConfig: {},
@@ -426,6 +491,67 @@ describe('mergeConfigOverrides', () => {
     });
     expect(result.mcpServers).toBeUndefined();
   });
+
+  it('applies tombstones after remapping YAML paths to AppConfig paths', () => {
+    const base = {
+      mcpConfig: {
+        github: { type: 'streamable-http', url: 'https://github.example.com' },
+        slack: { type: 'streamable-http', url: 'https://slack.example.com' },
+      },
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({}, 10, ['mcpServers.github']),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toBeUndefined();
+    expect(mcpConfig.slack).toEqual({
+      type: 'streamable-http',
+      url: 'https://slack.example.com',
+    });
+
+    const baseMcpConfig = (base as unknown as Record<string, unknown>).mcpConfig as Record<
+      string,
+      unknown
+    >;
+    expect(baseMcpConfig.github).toEqual({
+      type: 'streamable-http',
+      url: 'https://github.example.com',
+    });
+  });
+
+  it('lets a higher-priority override recreate a lower-priority tombstoned path', () => {
+    const base = {
+      mcpConfig: {
+        github: { type: 'streamable-http', url: 'https://github.example.com' },
+      },
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({}, 10, ['mcpServers.github']),
+      fakeConfig({ mcpServers: { github: { url: 'https://scoped.example.com' } } }, 100),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toEqual({
+      url: 'https://scoped.example.com',
+    });
+  });
+
+  it('lets a higher-priority tombstone suppress a lower-priority override', () => {
+    const base = {
+      mcpConfig: {},
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({ mcpServers: { github: { url: 'https://role.example.com' } } }, 10),
+      fakeConfig({}, 100, ['mcpServers.github']),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toBeUndefined();
+  });
 });
 
 describe('INTERFACE_PERMISSION_FIELDS', () => {
diff --git a/packages/data-schemas/src/app/resolution.ts b/packages/data-schemas/src/app/resolution.ts
index cc1e11cb821..4f17acac2ce 100644
--- a/packages/data-schemas/src/app/resolution.ts
+++ b/packages/data-schemas/src/app/resolution.ts
@@ -1,4 +1,8 @@
-import { INTERFACE_PERMISSION_FIELDS, PERMISSION_SUB_KEYS } from 'librechat-data-provider';
+import {
+  BASE_ONLY_CONFIG_SECTIONS,
+  INTERFACE_PERMISSION_FIELDS,
+  PERMISSION_SUB_KEYS,
+} from 'librechat-data-provider';
 import type { TCustomConfig } from 'librechat-data-provider';
 import type { AppConfig, IConfig } from '~/types';
 
@@ -6,6 +10,7 @@ type AnyObject = { [key: string]: unknown };
 
 const MAX_MERGE_DEPTH = 10;
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const BASE_ONLY_OVERRIDE_SECTIONS = new Set<string>(BASE_ONLY_CONFIG_SECTIONS);
 
 /**
  * Paths within the config tree where arrays of objects should be merged by
@@ -36,6 +41,50 @@ const OVERRIDE_KEY_MAP: Partial<Record<keyof TCustomConfig, keyof AppConfig>> =
   turnstile: 'turnstileConfig',
 };
 
+function isSafePath(path: string): boolean {
+  const segments = path.split('.');
+  if (
+    path.length === 0 ||
+    path.startsWith('.') ||
+    path.endsWith('.') ||
+    path.includes('..') ||
+    segments.some((segment) => segment.length === 0 || UNSAFE_KEYS.has(segment))
+  ) {
+    return false;
+  }
+  return true;
+}
+
+function remapOverridePath(path: string): string {
+  const [first, ...rest] = path.split('.');
+  const mappedFirst = OVERRIDE_KEY_MAP[first as keyof typeof OVERRIDE_KEY_MAP] ?? first;
+  return [mappedFirst, ...rest].join('.');
+}
+
+function deletePath<T extends AnyObject>(target: T, path: string): T {
+  if (!isSafePath(path)) {
+    return target;
+  }
+
+  const segments = path.split('.');
+  const result = { ...target } as AnyObject;
+  let cursor: AnyObject = result;
+
+  for (let index = 0; index < segments.length - 1; index++) {
+    const segment = segments[index];
+    const value = cursor[segment];
+    if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+      return result as T;
+    }
+    const cloned = { ...(value as AnyObject) };
+    cursor[segment] = cloned;
+    cursor = cloned;
+  }
+
+  delete cursor[segments[segments.length - 1]];
+  return result as T;
+}
+
 function mergeArrayByKey(
   target: AnyObject[],
   source: AnyObject[],
@@ -144,9 +193,20 @@ export function mergeConfigOverrides(baseConfig: AppConfig, configs: IConfig[]):
 
   let merged = { ...baseConfig };
   for (const config of sorted) {
+    if (Array.isArray(config.tombstones)) {
+      for (const path of config.tombstones) {
+        if (typeof path === 'string') {
+          merged = deletePath(merged, remapOverridePath(path));
+        }
+      }
+    }
+
     if (config.overrides && typeof config.overrides === 'object') {
       const remapped: AnyObject = {};
       for (const [key, value] of Object.entries(config.overrides)) {
+        if (BASE_ONLY_OVERRIDE_SECTIONS.has(key)) {
+          continue;
+        }
         const mappedKey = OVERRIDE_KEY_MAP[key as keyof typeof OVERRIDE_KEY_MAP] ?? key;
         if (
           key === 'interface' &&
diff --git a/packages/data-schemas/src/app/service.spec.ts b/packages/data-schemas/src/app/service.spec.ts
index 80298b3e182..2a2a8ffd1d8 100644
--- a/packages/data-schemas/src/app/service.spec.ts
+++ b/packages/data-schemas/src/app/service.spec.ts
@@ -1,5 +1,6 @@
 import type { DeepPartial, TCustomConfig } from 'librechat-data-provider';
-import { loadSummarizationConfig } from './service';
+import { EModelEndpoint, defaultAssistantsVersion } from 'librechat-data-provider';
+import { AppService, loadSummarizationConfig } from './service';
 import logger from '~/config/winston';
 
 jest.mock('~/config/winston', () => ({
@@ -78,3 +79,70 @@ describe('loadSummarizationConfig', () => {
     expect(String(warnSpy.mock.calls[0][0])).toContain('Invalid summarization config');
   });
 });
+
+describe('AppService assistants config', () => {
+  it('preserves configured Assistants API versions', async () => {
+    const config = {
+      endpoints: {
+        [EModelEndpoint.assistants]: {
+          version: 'v3',
+        },
+        [EModelEndpoint.azureOpenAI]: {
+          assistants: true,
+          groups: [
+            {
+              group: 'azure-assistants-test',
+              apiKey: 'test-key',
+              instanceName: 'azure-assistants-test',
+              assistants: true,
+              version: '2024-02-15-preview',
+              models: {
+                'gpt-4': {
+                  deploymentName: 'gpt-4',
+                },
+              },
+            },
+          ],
+        },
+        [EModelEndpoint.azureAssistants]: {
+          version: 4,
+        },
+      },
+    } as DeepPartial<TCustomConfig>;
+
+    const result = await AppService({ config });
+
+    expect(result.endpoints?.[EModelEndpoint.assistants]?.version).toBe('v3');
+    expect(result.endpoints?.[EModelEndpoint.azureAssistants]?.version).toBe(4);
+  });
+
+  it('keeps Azure Assistants default version when only Azure OpenAI enables assistants', async () => {
+    const config = {
+      endpoints: {
+        [EModelEndpoint.azureOpenAI]: {
+          assistants: true,
+          groups: [
+            {
+              group: 'azure-assistants-test',
+              apiKey: 'test-key',
+              instanceName: 'azure-assistants-test',
+              assistants: true,
+              version: '2024-02-15-preview',
+              models: {
+                'gpt-4': {
+                  deploymentName: 'gpt-4',
+                },
+              },
+            },
+          ],
+        },
+      },
+    } as DeepPartial<TCustomConfig>;
+
+    const result = await AppService({ config });
+
+    expect(result.endpoints?.[EModelEndpoint.azureAssistants]?.version).toBe(
+      defaultAssistantsVersion.azureAssistants,
+    );
+  });
+});
diff --git a/packages/data-schemas/src/app/service.ts b/packages/data-schemas/src/app/service.ts
index 19fec9f5a17..fe3ae1b0073 100644
--- a/packages/data-schemas/src/app/service.ts
+++ b/packages/data-schemas/src/app/service.ts
@@ -1,6 +1,7 @@
 import {
   EModelEndpoint,
   getConfigDefaults,
+  skillSyncConfigSchema,
   summarizationConfigSchema,
 } from 'librechat-data-provider';
 import type { TCustomConfig, FileSources, DeepPartial } from 'librechat-data-provider';
@@ -51,6 +52,21 @@ export function loadSummarizationConfig(
   };
 }
 
+export function loadSkillSyncConfig(config: DeepPartial<TCustomConfig>): AppConfig['skillSync'] {
+  const raw = config.skillSync;
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    logger.warn('[AppService] Invalid skill sync config', parsed.error.flatten());
+    return undefined;
+  }
+
+  return parsed.data;
+}
+
 export type Paths = {
   root: string;
   uploads: string;
@@ -83,6 +99,7 @@ export const AppService = async (params?: {
   const webSearch = loadWebSearchConfig(config.webSearch);
   const memory = loadMemoryConfig(config.memory);
   const summarization = loadSummarizationConfig(config);
+  const skillSync = loadSkillSyncConfig(config);
   const filteredTools = config.filteredTools;
   const includedTools = config.includedTools;
   const fileStrategy = (config.fileStrategy ?? configDefaults.fileStrategy) as
@@ -110,6 +127,7 @@ export const AppService = async (params?: {
   const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
   const turnstileConfig = loadTurnstileConfig(config, configDefaults);
   const speech = config.speech;
+  const messageFilter = config.messageFilter;
 
   const defaultConfig = {
     ocr,
@@ -117,15 +135,17 @@ export const AppService = async (params?: {
     config,
     memory,
     speech,
-    balance,
     actions,
+    balance,
+    skillSync,
     webSearch,
     mcpSettings,
-    transactions,
     fileStrategy,
     registration,
+    transactions,
     filteredTools,
     includedTools,
+    messageFilter,
     summarization,
     availableTools,
     imageOutputType,
diff --git a/packages/data-schemas/src/app/vertex.ts b/packages/data-schemas/src/app/vertex.ts
index 92c71c370be..c773729bedd 100644
--- a/packages/data-schemas/src/app/vertex.ts
+++ b/packages/data-schemas/src/app/vertex.ts
@@ -1,4 +1,3 @@
-import logger from '~/config/winston';
 import {
   EModelEndpoint,
   extractEnvVariable,
@@ -12,12 +11,13 @@ import type {
   TAnthropicEndpoint,
   TVertexModelConfig,
 } from 'librechat-data-provider';
+import logger from '~/config/winston';
 
 /**
  * Default Vertex AI models available through Google Cloud
  * These are the standard Anthropic model names as served by Vertex AI
  */
-export const defaultVertexModels = [
+export const defaultVertexModels: string[] = [
   'claude-sonnet-4-6',
   'claude-3-7-sonnet-20250219',
   'claude-3-5-sonnet-v2@20241022',
diff --git a/packages/data-schemas/src/common/enum.ts b/packages/data-schemas/src/common/enum.ts
index 6fdce9c2bc9..191191ecdf5 100644
--- a/packages/data-schemas/src/common/enum.ts
+++ b/packages/data-schemas/src/common/enum.ts
@@ -1,15 +1,28 @@
 import { PermissionBits } from 'librechat-data-provider';
 
 /**
- * Common role combinations
+ * Common role combinations. Values mirror unions of `PermissionBits` flags;
+ * literals are required by `--isolatedDeclarations` (cross-file enum refs
+ * aren't computable). The guard below fails fast on any drift.
  */
 export enum RoleBits {
-  /** 0001 = 1 */
-  VIEWER = PermissionBits.VIEW,
-  /** 0011 = 3 */
-  EDITOR = PermissionBits.VIEW | PermissionBits.EDIT,
-  /** 0111 = 7 */
-  MANAGER = PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE,
-  /** 1111 = 15 */
-  OWNER = PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE,
+  /** VIEW */
+  VIEWER = 1,
+  /** VIEW | EDIT */
+  EDITOR = 3,
+  /** VIEW | EDIT | DELETE */
+  MANAGER = 7,
+  /** VIEW | EDIT | DELETE | SHARE */
+  OWNER = 15,
+}
+
+if (
+  (RoleBits.VIEWER as number) !== PermissionBits.VIEW ||
+  (RoleBits.EDITOR as number) !== (PermissionBits.VIEW | PermissionBits.EDIT) ||
+  (RoleBits.MANAGER as number) !==
+    (PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE) ||
+  (RoleBits.OWNER as number) !==
+    (PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE)
+) {
+  throw new Error('RoleBits is out of sync with PermissionBits');
 }
diff --git a/packages/data-schemas/src/config/meiliLogger.ts b/packages/data-schemas/src/config/meiliLogger.ts
index 572e8770716..46cff165fa4 100644
--- a/packages/data-schemas/src/config/meiliLogger.ts
+++ b/packages/data-schemas/src/config/meiliLogger.ts
@@ -2,14 +2,14 @@ import winston from 'winston';
 import 'winston-daily-rotate-file';
 import { getLogDirectory } from './utils';
 
-const logDir = getLogDirectory();
-
-const { NODE_ENV, DEBUG_LOGGING = 'false' } = process.env;
+const { NODE_ENV, DEBUG_LOGGING = 'false', LOG_TO_FILE } = process.env;
 
 const useDebugLogging =
   (typeof DEBUG_LOGGING === 'string' && DEBUG_LOGGING.toLowerCase() === 'true') ||
   DEBUG_LOGGING === 'true';
 
+const useFileLogging = typeof LOG_TO_FILE !== 'string' || LOG_TO_FILE.toLowerCase() !== 'false';
+
 const levels: winston.config.AbstractConfigSetLevels = {
   error: 0,
   warn: 1,
@@ -41,17 +41,23 @@ const fileFormat = winston.format.combine(
 );
 
 const logLevel = useDebugLogging ? 'debug' : 'error';
-const transports: winston.transport[] = [
-  new winston.transports.DailyRotateFile({
-    level: logLevel,
-    filename: `${logDir}/meiliSync-%DATE%.log`,
-    datePattern: 'YYYY-MM-DD',
-    zippedArchive: true,
-    maxSize: '20m',
-    maxFiles: '14d',
-    format: fileFormat,
-  }),
-];
+const transports: winston.transport[] = [];
+
+if (useFileLogging) {
+  const logDir = getLogDirectory();
+
+  transports.push(
+    new winston.transports.DailyRotateFile({
+      level: logLevel,
+      filename: `${logDir}/meiliSync-%DATE%.log`,
+      datePattern: 'YYYY-MM-DD',
+      zippedArchive: true,
+      maxSize: '20m',
+      maxFiles: '14d',
+      format: fileFormat,
+    }),
+  );
+}
 
 const consoleFormat = winston.format.combine(
   winston.format.colorize({ all: true }),
@@ -66,7 +72,7 @@ transports.push(
   }),
 );
 
-const logger = winston.createLogger({
+const logger: winston.Logger = winston.createLogger({
   level: level(),
   levels,
   transports,
diff --git a/packages/data-schemas/src/config/parsers.spec.ts b/packages/data-schemas/src/config/parsers.spec.ts
new file mode 100644
index 00000000000..b008c0aeb95
--- /dev/null
+++ b/packages/data-schemas/src/config/parsers.spec.ts
@@ -0,0 +1,322 @@
+import winston from 'winston';
+import { debugTraverse, redactFormat, redactMessage } from './parsers';
+
+const SPLAT_SYMBOL = Symbol.for('splat');
+const MESSAGE_SYMBOL = Symbol.for('message');
+
+type FormatterInfo = Record<string | symbol, unknown> & {
+  level: string;
+  message: string;
+  timestamp: string;
+};
+
+type RedactInfo = Record<string | symbol, unknown> & {
+  level: string;
+  message: unknown;
+};
+
+function runRedactFormat(info: RedactInfo): RedactInfo {
+  return (redactFormat().transform(info) || info) as RedactInfo;
+}
+
+function runRedactSplatFormat(info: RedactInfo): RedactInfo {
+  const format = winston.format.combine(redactFormat(), winston.format.splat());
+  return (format.transform(info) || info) as RedactInfo;
+}
+
+function runFormatter(info: FormatterInfo): string {
+  const transformed = debugTraverse.transform(info);
+  if (transformed && typeof transformed === 'object') {
+    const message = (transformed as Record<string | symbol, unknown>)[MESSAGE_SYMBOL];
+    return typeof message === 'string' ? message : String(transformed);
+  }
+  return String(transformed);
+}
+
+function buildInfo(level: string, meta: Record<string, unknown>): FormatterInfo {
+  return {
+    level,
+    message: 'test',
+    timestamp: 'ts',
+    ...meta,
+    [SPLAT_SYMBOL]: [meta],
+  };
+}
+
+describe('redactMessage', () => {
+  it('redacts sensitive token patterns anywhere in a message', () => {
+    expect(redactMessage('token: sk-abc123def')).toBe('token: sk-[REDACTED]');
+    expect(redactMessage('auth Bearer secretvalue')).toBe('auth Bearer [REDACTED]');
+    expect(redactMessage('api-key: secretvalue')).toBe('api-key: [REDACTED]');
+    expect(redactMessage('https://example.test/?key=secretvalue&next=true')).toBe(
+      'https://example.test/?key=[REDACTED]&next=true',
+    );
+    expect(redactMessage('https://example.test/?api_key=secretvalue&next=true')).toBe(
+      'https://example.test/?api_key=[REDACTED]&next=true',
+    );
+  });
+
+  it('does not redact ordinary words containing sensitive prefixes', () => {
+    expect(redactMessage('task-runner failed')).toBe('task-runner failed');
+    expect(redactMessage('mask-value computed')).toBe('mask-value computed');
+    expect(redactMessage('monkey=10 bananas')).toBe('monkey=10 bananas');
+  });
+});
+
+describe('redactFormat', () => {
+  it.each(['error', 'warn', 'info', 'debug'])('redacts info.message for %s level', (level) => {
+    const info = runRedactFormat({ level, message: 'Bearer secretvalue' });
+    expect(info.message).toBe('Bearer [REDACTED]');
+  });
+
+  it('redacts the winston message symbol', () => {
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [MESSAGE_SYMBOL]: 'token: sk-abc123def',
+    });
+
+    expect(info[MESSAGE_SYMBOL]).toBe('token: sk-[REDACTED]');
+  });
+
+  it('redacts splat arguments before winston interpolates them', () => {
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'token %s',
+      [SPLAT_SYMBOL]: ['sk-abc123def'],
+    });
+
+    expect(info.message).toBe('token sk-[REDACTED]');
+  });
+
+  it('redacts string values in splat metadata', () => {
+    const metadata = {
+      auth: 'Bearer secretvalue',
+      nested: { url: 'https://example.test/?key=secretvalue&next=true' },
+    };
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [metadata],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<{ auth: string; nested: { url: string } }>;
+
+    expect(splat[0].auth).toBe('Bearer [REDACTED]');
+    expect(splat[0].nested.url).toBe('https://example.test/?key=[REDACTED]&next=true');
+    expect(metadata.auth).toBe('Bearer secretvalue');
+    expect(metadata.nested.url).toBe('https://example.test/?key=secretvalue&next=true');
+  });
+
+  it('redacts values under sensitive splat metadata keys', () => {
+    const metadata = {
+      apiKey: 'secretvalue',
+      authorization: 'secretvalue',
+      nested: { token: 'secretvalue' },
+      safe: 'secretvalue',
+      'x-api-key': 'secretvalue',
+    };
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [metadata],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<typeof metadata>;
+
+    expect(splat[0].apiKey).toBe('[REDACTED]');
+    expect(splat[0].authorization).toBe('[REDACTED]');
+    expect(splat[0].nested.token).toBe('[REDACTED]');
+    expect(splat[0]['x-api-key']).toBe('[REDACTED]');
+    expect(splat[0].safe).toBe('secretvalue');
+    expect(metadata.apiKey).toBe('secretvalue');
+    expect(metadata.nested.token).toBe('secretvalue');
+  });
+
+  it('redacts object messages before serialization', () => {
+    const message = {
+      apiKey: 'secretvalue',
+      nested: { url: 'https://example.test/?api_key=secretvalue&next=true' },
+    };
+    const info = runRedactFormat({
+      level: 'debug',
+      message,
+    });
+
+    expect(info.message).toEqual({
+      apiKey: '[REDACTED]',
+      nested: { url: 'https://example.test/?api_key=[REDACTED]&next=true' },
+    });
+    expect(message.apiKey).toBe('secretvalue');
+    expect(message.nested.url).toBe('https://example.test/?api_key=secretvalue&next=true');
+  });
+
+  it('redacts serializable non-plain splat values before interpolation', () => {
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'values %s %s',
+      [SPLAT_SYMBOL]: [
+        new URL('https://example.test/?api_key=secretvalue&next=true'),
+        Buffer.from('sk-abc123def'),
+      ],
+    });
+
+    expect(info.message).toBe(
+      'values https://example.test/?api_key=[REDACTED]&next=true sk-[REDACTED]',
+    );
+  });
+
+  it('summarizes large buffer splats instead of scanning the whole payload', () => {
+    const buffer = Buffer.concat([Buffer.alloc(9000, 'a'), Buffer.from('sk-abc123def')]);
+
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'payload %s',
+      [SPLAT_SYMBOL]: [buffer],
+    });
+
+    expect(info.message).toBe(`payload [REDACTED Buffer ${buffer.length} bytes]`);
+    expect(info.message).not.toContain('sk-abc123def');
+  });
+
+  it('bounds large object and array redaction work', () => {
+    const metadata: Record<string, unknown> = {};
+    Array.from({ length: 60 }).forEach((_, index) => {
+      metadata[`field${index}`] = index === 59 ? 'sk-abc123def' : `safe-${index}`;
+    });
+
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [[metadata, ...Array.from({ length: 60 }, (_, index) => `safe-${index}`)]],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<Array<Record<string, unknown> | string>>;
+    const redactedObject = splat[0][0] as Record<string, unknown>;
+
+    expect(Object.keys(redactedObject)).toHaveLength(51);
+    expect(redactedObject.field49).toBe('safe-49');
+    expect(redactedObject.field59).toBeUndefined();
+    expect(redactedObject.__redaction_truncated__).toBe('Additional object properties omitted');
+    expect(splat[0]).toHaveLength(51);
+    expect(splat[0][50]).toBe('Additional array values omitted');
+    expect(JSON.stringify(splat)).not.toContain('sk-abc123def');
+  });
+
+  it('redacts over-deep object subtrees instead of traversing indefinitely', () => {
+    const root: Record<string, unknown> = {};
+    let current = root;
+    Array.from({ length: 12 }).forEach((_, index) => {
+      current.child = { label: `level-${index}` };
+      current = current.child as Record<string, unknown>;
+    });
+    current.apiKey = 'secretvalue';
+
+    const info = runRedactFormat({
+      level: 'info',
+      message: root,
+    });
+
+    const serialized = JSON.stringify(info.message);
+    expect(serialized).toContain('[REDACTED]');
+    expect(serialized).not.toContain('secretvalue');
+  });
+
+  it('redacts error splat arguments without mutating the original error', () => {
+    const error = new Error('Bearer secretvalue');
+    error.stack = 'Error: Bearer secretvalue\n    at request';
+
+    const info = runRedactFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+    const splat = info[SPLAT_SYMBOL] as Error[];
+
+    expect(splat[0]).toBeInstanceOf(Error);
+    expect(splat[0]).not.toBe(error);
+    expect(splat[0].message).toBe('Bearer [REDACTED]');
+    expect(splat[0].stack).toContain('Bearer [REDACTED]');
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'message')).toBe(false);
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'stack')).toBe(false);
+    expect(error.message).toBe('Bearer secretvalue');
+    expect(error.stack).toContain('Bearer secretvalue');
+  });
+
+  it('preserves contextual messages when redacting error splat arguments', () => {
+    const error = new Error('Bearer secretvalue');
+
+    const info = runRedactSplatFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+
+    expect(info.message).toBe('request failed');
+  });
+
+  it('preserves and redacts non-enumerable error causes when cloning errors', () => {
+    const cause = new Error('Bearer cause-secret');
+    const error = new Error('outer');
+    Object.defineProperty(error, 'cause', {
+      value: cause,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+
+    const info = runRedactFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<Error & { cause?: Error }>;
+
+    expect(splat[0].cause).toBeInstanceOf(Error);
+    expect(splat[0].cause).not.toBe(cause);
+    expect(splat[0].cause?.message).toBe('Bearer [REDACTED]');
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'cause')).toBe(false);
+    expect(cause.message).toBe('Bearer cause-secret');
+  });
+});
+
+describe('debugTraverse request context', () => {
+  it('appends request context metadata for non-debug lines', () => {
+    const out = runFormatter(
+      buildInfo('info', {
+        tenantId: 'tenant-1',
+        userId: 'user-1',
+        requestId: 'req-1',
+      }),
+    );
+
+    expect(out).toContain('"tenantId":"tenant-1"');
+    expect(out).toContain('"userId":"user-1"');
+    expect(out).toContain('"requestId":"req-1"');
+  });
+
+  it('does not append the system tenant sentinel as tenantId', () => {
+    const out = runFormatter(
+      buildInfo('info', {
+        tenantId: '__SYSTEM__',
+        userId: 'user-1',
+        requestId: 'req-1',
+      }),
+    );
+
+    expect(out).not.toContain('__SYSTEM__');
+    expect(out).not.toContain('"tenantId"');
+    expect(out).toContain('"userId":"user-1"');
+    expect(out).toContain('"requestId":"req-1"');
+  });
+
+  it('omits the system tenant sentinel from debug object metadata', () => {
+    const out = runFormatter(
+      buildInfo('debug', {
+        tenantId: '__SYSTEM__',
+        userId: 'user-1',
+      }),
+    );
+
+    expect(out).not.toContain('__SYSTEM__');
+    expect(out).not.toMatch(/tenantId:/);
+    expect(out).toContain('userId');
+  });
+});
diff --git a/packages/data-schemas/src/config/parsers.ts b/packages/data-schemas/src/config/parsers.ts
index 35635b949d4..a7be1659d89 100644
--- a/packages/data-schemas/src/config/parsers.ts
+++ b/packages/data-schemas/src/config/parsers.ts
@@ -1,34 +1,37 @@
 import { klona } from 'klona';
 import winston from 'winston';
-import traverse from '../utils/object-traverse';
 import type { TraverseContext } from '../utils/object-traverse';
+import { SYSTEM_TENANT_ID } from './tenantContext';
+import traverse from '../utils/object-traverse';
 
 const SPLAT_SYMBOL = Symbol.for('splat');
 const MESSAGE_SYMBOL = Symbol.for('message');
 const CONSOLE_JSON_STRING_LENGTH: number =
   parseInt(process.env.CONSOLE_JSON_STRING_LENGTH || '', 10) || 255;
 const DEBUG_MESSAGE_LENGTH: number = parseInt(process.env.DEBUG_MESSAGE_LENGTH || '', 10) || 150;
+const LOG_CONTEXT_KEYS = ['tenantId', 'userId', 'requestId'] as const;
+const REDACTED_VALUE = '[REDACTED]';
+const REDACTION_TRUNCATED_KEY = '__redaction_truncated__';
+const MAX_REDACTION_DEPTH = 8;
+const MAX_REDACTION_ENTRIES = 50;
+const DEFAULT_REDACTION_STRING_LENGTH = 8192;
+const MAX_REDACTION_STRING_LENGTH = Math.max(
+  CONSOLE_JSON_STRING_LENGTH,
+  DEFAULT_REDACTION_STRING_LENGTH,
+);
+const MAX_REDACTION_BUFFER_BYTES = MAX_REDACTION_STRING_LENGTH;
 
 const sensitiveKeys: RegExp[] = [
-  /^(sk-)[^\s]+/, // OpenAI API key pattern
-  /(Bearer )[^\s]+/, // Header: Bearer token pattern
-  /(api-key:? )[^\s]+/, // Header: API key pattern
-  /(key=)[^\s]+/, // URL query param: sensitive key pattern (Google)
+  /\b(sk-)[a-zA-Z0-9_-]+/g, // OpenAI API key pattern
+  /\b(Bearer )[^\s"']+/g, // Header: Bearer token pattern
+  /\b(api-key:? )[^\s"']+/gi, // Header: API key pattern
+  /\b(api_key=)[^\s"'&]+/gi, // URL query param: API key pattern
+  /\b(key=)[^\s"'&]+/g, // URL query param: sensitive key pattern
 ];
 
-/**
- * Determines if a given value string is sensitive and returns matching regex patterns.
- *
- * @param valueStr - The value string to check.
- * @returns An array of regex patterns that match the value string.
- */
-function getMatchingSensitivePatterns(valueStr: string): RegExp[] {
-  if (valueStr) {
-    // Filter and return all regex patterns that match the value string
-    return sensitiveKeys.filter((regex) => regex.test(valueStr));
-  }
-  return [];
-}
+const sensitiveMetadataKey =
+  /^(authorization|proxy-authorization|x-api-key|api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|password)$/i;
+const errorStringProperties = new Set(['name', 'message', 'stack']);
 
 /**
  * Redacts sensitive information from a console message and trims it to a specified length if provided.
@@ -41,39 +44,311 @@ function redactMessage(str: string, trimLength?: number): string {
     return '';
   }
 
-  const patterns = getMatchingSensitivePatterns(str);
-  patterns.forEach((pattern) => {
-    str = str.replace(pattern, '$1[REDACTED]');
+  const redacted = sensitiveKeys.reduce(
+    (currentMessage, pattern) => currentMessage.replace(pattern, '$1[REDACTED]'),
+    str,
+  );
+
+  if (trimLength !== undefined && redacted.length > trimLength) {
+    return `${redacted.substring(0, trimLength)}...`;
+  }
+
+  return redacted;
+}
+
+function redactLogString(str: string): string {
+  if (str.length <= MAX_REDACTION_STRING_LENGTH) {
+    return redactMessage(str);
+  }
+
+  const redacted = redactMessage(str.substring(0, MAX_REDACTION_STRING_LENGTH));
+  return `${redacted}... [truncated ${str.length - MAX_REDACTION_STRING_LENGTH} chars]`;
+}
+
+function isPlainRecord(value: object): value is Record<string, unknown> {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function isSensitiveMetadataKey(key: string): boolean {
+  return sensitiveMetadataKey.test(key);
+}
+
+function redactRecordValue(
+  key: string,
+  value: unknown,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): unknown {
+  return isSensitiveMetadataKey(key) ? REDACTED_VALUE : redactLogValue(value, seen, depth);
+}
+
+function defineRedactedErrorProperty(
+  error: Error & Record<string, unknown>,
+  key: 'name' | 'message' | 'stack',
+  value: string | undefined,
+): void {
+  if (value === undefined) {
+    return;
+  }
+
+  Object.defineProperty(error, key, {
+    value: redactLogString(value),
+    writable: true,
+    enumerable: false,
+    configurable: true,
   });
+}
+
+function defineRedactedDescriptor(
+  target: Error & Record<string, unknown>,
+  key: string | symbol,
+  descriptor: PropertyDescriptor,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): void {
+  if (!('value' in descriptor)) {
+    Object.defineProperty(target, key, descriptor);
+    return;
+  }
+
+  Object.defineProperty(target, key, {
+    ...descriptor,
+    value:
+      typeof key === 'string'
+        ? redactRecordValue(key, descriptor.value, seen, depth)
+        : redactLogValue(descriptor.value, seen, depth),
+  });
+}
+
+function redactErrorValue(error: Error, seen: WeakMap<object, unknown>, depth: number): Error {
+  const redacted = Object.create(Object.getPrototypeOf(error)) as Error & Record<string, unknown>;
+  seen.set(error, redacted);
+
+  defineRedactedErrorProperty(redacted, 'name', error.name);
+  defineRedactedErrorProperty(redacted, 'message', error.message);
+  defineRedactedErrorProperty(redacted, 'stack', error.stack);
+
+  Reflect.ownKeys(error).forEach((key) => {
+    if (typeof key === 'string' && errorStringProperties.has(key)) {
+      return;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    if (descriptor === undefined) {
+      return;
+    }
+    defineRedactedDescriptor(redacted, key, descriptor, seen, depth + 1);
+  });
+  return redacted;
+}
+
+function isBufferValue(value: object): value is Buffer {
+  return typeof Buffer !== 'undefined' && Buffer.isBuffer(value);
+}
+
+function getJsonValue(value: object): unknown {
+  const toJSON = (value as { toJSON?: unknown }).toJSON;
+  if (typeof toJSON !== 'function') {
+    return undefined;
+  }
+
+  try {
+    const jsonValue = toJSON.call(value);
+    return jsonValue === value ? undefined : jsonValue;
+  } catch {
+    return undefined;
+  }
+}
+
+function getCustomStringValue(value: object): string | undefined {
+  const toString = (value as { toString?: unknown }).toString;
+  if (typeof toString !== 'function' || toString === Object.prototype.toString) {
+    return undefined;
+  }
+
+  try {
+    const stringValue = toString.call(value);
+    return typeof stringValue === 'string' ? stringValue : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function redactMapValue(
+  value: Map<unknown, unknown>,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Map<unknown, unknown> {
+  const redacted = new Map<unknown, unknown>();
+  seen.set(value, redacted);
+  let count = 0;
+  for (const [mapKey, mapValue] of value) {
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted.set(REDACTION_TRUNCATED_KEY, 'Additional map entries omitted');
+      break;
+    }
+    redacted.set(
+      mapKey,
+      typeof mapKey === 'string'
+        ? redactRecordValue(mapKey, mapValue, seen, depth + 1)
+        : redactLogValue(mapValue, seen, depth + 1),
+    );
+    count += 1;
+  }
+  return redacted;
+}
+
+function redactSetValue(
+  value: Set<unknown>,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Set<unknown> {
+  const redacted = new Set<unknown>();
+  seen.set(value, redacted);
+  let count = 0;
+  for (const setValue of value) {
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted.add('Additional set values omitted');
+      break;
+    }
+    redacted.add(redactLogValue(setValue, seen, depth + 1));
+    count += 1;
+  }
+  return redacted;
+}
+
+function redactObjectEntries(
+  value: object,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Record<string, unknown> | undefined {
+  const record = value as Record<string, unknown>;
+  let redacted: Record<string, unknown> | undefined;
+  let count = 0;
+
+  for (const key in record) {
+    if (!Object.prototype.hasOwnProperty.call(record, key)) {
+      continue;
+    }
+    if (redacted === undefined) {
+      redacted = {};
+      seen.set(value, redacted);
+    }
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted[REDACTION_TRUNCATED_KEY] = 'Additional object properties omitted';
+      break;
+    }
+    redacted[key] = redactRecordValue(key, record[key], seen, depth + 1);
+    count += 1;
+  }
+
+  return redacted;
+}
+
+function redactNonPlainValue(
+  value: object,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): unknown {
+  if (isBufferValue(value)) {
+    return value.length > MAX_REDACTION_BUFFER_BYTES
+      ? `[REDACTED Buffer ${value.length} bytes]`
+      : redactLogString(value.toString('utf8'));
+  }
+
+  if (value instanceof URL || value instanceof URLSearchParams) {
+    return redactLogString(value.toString());
+  }
 
-  if (trimLength !== undefined && str.length > trimLength) {
-    return `${str.substring(0, trimLength)}...`;
+  if (value instanceof Map) {
+    return redactMapValue(value, seen, depth);
   }
 
-  return str;
+  if (value instanceof Set) {
+    return redactSetValue(value, seen, depth);
+  }
+
+  const jsonValue = getJsonValue(value);
+  if (jsonValue !== undefined) {
+    return redactLogValue(jsonValue, seen, depth + 1);
+  }
+
+  const redactedEntries = redactObjectEntries(value, seen, depth);
+  if (redactedEntries !== undefined) {
+    return redactedEntries;
+  }
+
+  const stringValue = getCustomStringValue(value);
+  return stringValue !== undefined ? redactLogString(stringValue) : value;
+}
+
+function redactLogValue(value: unknown, seen = new WeakMap<object, unknown>(), depth = 0): unknown {
+  if (typeof value === 'string') {
+    return redactLogString(value);
+  }
+
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+
+  const cached = seen.get(value);
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  if (depth >= MAX_REDACTION_DEPTH) {
+    return REDACTED_VALUE;
+  }
+
+  if (Array.isArray(value)) {
+    const redacted: unknown[] = [];
+    seen.set(value, redacted);
+    const length = Math.min(value.length, MAX_REDACTION_ENTRIES);
+    for (let index = 0; index < length; index++) {
+      redacted.push(redactLogValue(value[index], seen, depth + 1));
+    }
+    if (value.length > MAX_REDACTION_ENTRIES) {
+      redacted.push('Additional array values omitted');
+    }
+    return redacted;
+  }
+
+  if (value instanceof Error) {
+    return redactErrorValue(value, seen, depth);
+  }
+
+  if (!isPlainRecord(value)) {
+    return redactNonPlainValue(value, seen, depth);
+  }
+
+  return redactObjectEntries(value, seen, depth) ?? {};
 }
 
 /**
- * Redacts sensitive information from log messages if the log level is 'error'.
+ * Redacts sensitive information from log messages at every level.
  * Note: Intentionally mutates the object.
  * @param info - The log information object.
  * @returns The modified log information object.
  */
-const redactFormat = winston.format((info: winston.Logform.TransformableInfo) => {
-  if (info.level === 'error') {
-    // Type guard to ensure message is a string
-    if (typeof info.message === 'string') {
-      info.message = redactMessage(info.message);
+const redactFormat: winston.Logform.FormatWrap = winston.format(
+  (info: winston.Logform.TransformableInfo) => {
+    const infoRecord = info as Record<string | symbol, unknown>;
+
+    if (info.message !== undefined) {
+      info.message = redactLogValue(info.message);
     }
 
-    // Handle MESSAGE_SYMBOL with type safety
-    const symbolValue = (info as Record<string | symbol, unknown>)[MESSAGE_SYMBOL];
-    if (typeof symbolValue === 'string') {
-      (info as Record<string | symbol, unknown>)[MESSAGE_SYMBOL] = redactMessage(symbolValue);
+    const symbolValue = infoRecord[MESSAGE_SYMBOL];
+    if (symbolValue !== undefined) {
+      infoRecord[MESSAGE_SYMBOL] = redactLogValue(symbolValue);
     }
-  }
-  return info;
-});
+
+    if (infoRecord[SPLAT_SYMBOL] !== undefined) {
+      infoRecord[SPLAT_SYMBOL] = redactLogValue(infoRecord[SPLAT_SYMBOL]);
+    }
+    return info;
+  },
+);
 
 /**
  * Truncates long strings, especially base64 image data, within log messages.
@@ -104,17 +379,36 @@ const condenseArray = (item: unknown): string | unknown => {
   return item;
 };
 
+function formatRequestContext(metadata: Record<string, unknown>): string {
+  const context: Partial<Record<(typeof LOG_CONTEXT_KEYS)[number], string>> = {};
+  LOG_CONTEXT_KEYS.forEach((key) => {
+    const value = metadata[key];
+    if (key === 'tenantId' && value === SYSTEM_TENANT_ID) {
+      return;
+    }
+    if (typeof value === 'string' && value) {
+      context[key] = value;
+    }
+  });
+  return Object.keys(context).length > 0 ? JSON.stringify(context) : '';
+}
+
+function appendRequestContext(line: string, metadata: Record<string, unknown>): string {
+  const context = formatRequestContext(metadata);
+  return context ? `${line} ${context}` : line;
+}
+
 /**
  * Formats log messages for debugging purposes.
  * - Truncates long strings within log messages.
  * - Condenses arrays by truncating long strings and objects as strings within array items.
- * - Redacts sensitive information from log messages if the log level is 'error'.
+ * - Message redaction is applied by redactFormat before this formatter.
  * - Converts log information object to a formatted string.
  *
  * @param options - The options for formatting log messages.
  * @returns The formatted log message.
  */
-const debugTraverse = winston.format.printf(
+const debugTraverse: winston.Logform.Format = winston.format.printf(
   ({ level, message, timestamp, ...metadata }: Record<string, unknown>) => {
     if (!message) {
       return `${timestamp} ${level}`;
@@ -131,7 +425,7 @@ const debugTraverse = winston.format.printf(
 
     try {
       if (level !== 'debug') {
-        return msgParts[0];
+        return appendRequestContext(msgParts[0], metadata);
       }
 
       if (!metadata) {
@@ -144,22 +438,25 @@ const debugTraverse = winston.format.printf(
       const debugValue = Array.isArray(splatArray) ? splatArray[0] : undefined;
 
       if (!debugValue) {
-        return msgParts[0];
+        return appendRequestContext(msgParts[0], metadata);
       }
 
       if (debugValue && Array.isArray(debugValue)) {
         msgParts.push(`\n${JSON.stringify(debugValue.map(condenseArray))}`);
-        return msgParts.join('');
+        return appendRequestContext(msgParts.join(''), metadata);
       }
 
       if (typeof debugValue !== 'object') {
         msgParts.push(` ${debugValue}`);
-        return msgParts.join('');
+        return appendRequestContext(msgParts.join(''), metadata);
       }
 
       msgParts.push('\n{');
 
       const copy = klona(metadata);
+      if (copy.tenantId === SYSTEM_TENANT_ID) {
+        delete copy.tenantId;
+      }
       try {
         const traversal = traverse(copy);
         traversal.forEach(function (this: TraverseContext, value: unknown) {
@@ -212,54 +509,58 @@ const debugTraverse = winston.format.printf(
  * Truncates long string values in JSON log objects.
  * Prevents outputting extremely long values (e.g., base64, blobs).
  */
-const jsonTruncateFormat = winston.format((info: winston.Logform.TransformableInfo) => {
-  const truncateLongStrings = (str: string, maxLength: number): string =>
-    str.length > maxLength ? str.substring(0, maxLength) + '...' : str;
-
-  const seen = new WeakSet<object>();
+const jsonTruncateFormat: winston.Logform.FormatWrap = winston.format(
+  (info: winston.Logform.TransformableInfo) => {
+    const truncateLongStrings = (str: string, maxLength: number): string =>
+      str.length > maxLength ? str.substring(0, maxLength) + '...' : str;
 
-  const truncateObject = (obj: unknown): unknown => {
-    if (typeof obj !== 'object' || obj === null) {
-      return obj;
-    }
+    const seen = new WeakSet<object>();
 
-    // Handle circular references - now with proper object type
-    if (seen.has(obj)) {
-      return '[Circular]';
-    }
-    seen.add(obj);
+    const truncateObject = (obj: unknown): unknown => {
+      if (typeof obj !== 'object' || obj === null) {
+        return obj;
+      }
 
-    if (Array.isArray(obj)) {
-      return obj.map((item) => truncateObject(item));
-    }
+      // Handle circular references - now with proper object type
+      if (seen.has(obj)) {
+        return '[Circular]';
+      }
+      seen.add(obj);
 
-    // We know this is an object at this point
-    const objectRecord = obj as Record<string, unknown>;
-    const newObj: Record<string, unknown> = {};
-    Object.entries(objectRecord).forEach(([key, value]) => {
-      if (typeof value === 'string') {
-        newObj[key] = truncateLongStrings(value, CONSOLE_JSON_STRING_LENGTH);
-      } else {
-        newObj[key] = truncateObject(value);
+      if (Array.isArray(obj)) {
+        return obj.map((item) => truncateObject(item));
       }
-    });
-    return newObj;
-  };
 
-  return truncateObject(info) as winston.Logform.TransformableInfo;
-});
+      // We know this is an object at this point
+      const objectRecord = obj as Record<string, unknown>;
+      const newObj: Record<string, unknown> = {};
+      Object.entries(objectRecord).forEach(([key, value]) => {
+        if (typeof value === 'string') {
+          newObj[key] = truncateLongStrings(value, CONSOLE_JSON_STRING_LENGTH);
+        } else {
+          newObj[key] = truncateObject(value);
+        }
+      });
+      return newObj;
+    };
+
+    return truncateObject(info) as winston.Logform.TransformableInfo;
+  },
+);
 
 /**
  * Renames Winston's `message` to `msg` for JSON output so ingest stacks
  * (e.g. Elasticsearch) can avoid reserved `message` field collisions.
  */
-const jsonMessageAsMsgFormat = winston.format((info: winston.Logform.TransformableInfo) => {
-  const record = info as Record<string, unknown>;
-  if ('message' in record) {
-    record.msg = record.message;
-    delete record.message;
-  }
-  return info;
-});
+const jsonMessageAsMsgFormat: winston.Logform.FormatWrap = winston.format(
+  (info: winston.Logform.TransformableInfo) => {
+    const record = info as Record<string, unknown>;
+    if ('message' in record) {
+      record.msg = record.message;
+      delete record.message;
+    }
+    return info;
+  },
+);
 
 export { redactFormat, redactMessage, debugTraverse, jsonTruncateFormat, jsonMessageAsMsgFormat };
diff --git a/packages/data-schemas/src/config/tenantContext.spec.ts b/packages/data-schemas/src/config/tenantContext.spec.ts
index 7e6cc0748d1..f82c41699cb 100644
--- a/packages/data-schemas/src/config/tenantContext.spec.ts
+++ b/packages/data-schemas/src/config/tenantContext.spec.ts
@@ -1,4 +1,10 @@
-import { tenantStorage, runAsSystem, scopedCacheKey } from './tenantContext';
+import {
+  tenantStorage,
+  getUserId,
+  getRequestId,
+  runAsSystem,
+  scopedCacheKey,
+} from './tenantContext';
 
 describe('scopedCacheKey', () => {
   it('returns base key when no ALS context is set', () => {
@@ -23,4 +29,24 @@ describe('scopedCacheKey', () => {
     });
     expect(scopedCacheKey('KEY')).toBe('KEY');
   });
+
+  it('reads user and request IDs from ALS context', async () => {
+    await tenantStorage.run({ userId: 'user-1', requestId: 'req-1' }, async () => {
+      expect(getUserId()).toBe('user-1');
+      expect(getRequestId()).toBe('req-1');
+    });
+  });
+
+  it('preserves user and request context inside system tenant operations', async () => {
+    await tenantStorage.run(
+      { tenantId: 'acme', userId: 'user-1', requestId: 'req-1' },
+      async () => {
+        await runAsSystem(async () => {
+          expect(getUserId()).toBe('user-1');
+          expect(getRequestId()).toBe('req-1');
+          expect(scopedCacheKey('KEY')).toBe('KEY');
+        });
+      },
+    );
+  });
 });
diff --git a/packages/data-schemas/src/config/tenantContext.ts b/packages/data-schemas/src/config/tenantContext.ts
index eb77edb27d1..00e18603d69 100644
--- a/packages/data-schemas/src/config/tenantContext.ts
+++ b/packages/data-schemas/src/config/tenantContext.ts
@@ -2,6 +2,8 @@ import { AsyncLocalStorage } from 'async_hooks';
 
 export interface TenantContext {
   tenantId?: string;
+  userId?: string;
+  requestId?: string;
 }
 
 /** Sentinel value for deliberate cross-tenant system operations */
@@ -12,19 +14,31 @@ export const SYSTEM_TENANT_ID = '__SYSTEM__';
  * Callbacks passed to `tenantStorage.run()` must be `async` for the context to propagate
  * through Mongoose query execution. Sync callbacks returning a Mongoose thenable will lose context.
  */
-export const tenantStorage = new AsyncLocalStorage<TenantContext>();
+export const tenantStorage: AsyncLocalStorage<TenantContext> =
+  new AsyncLocalStorage<TenantContext>();
 
 /** Returns the current tenant ID from async context, or undefined if none is set */
 export function getTenantId(): string | undefined {
   return tenantStorage.getStore()?.tenantId;
 }
 
+/** Returns the current user ID from async context, or undefined if none is set */
+export function getUserId(): string | undefined {
+  return tenantStorage.getStore()?.userId;
+}
+
+/** Returns the current request ID from async context, or undefined if none is set */
+export function getRequestId(): string | undefined {
+  return tenantStorage.getStore()?.requestId;
+}
+
 /**
  * Runs a function in an explicit cross-tenant system context (bypasses tenant filtering).
  * The callback MUST be async — sync callbacks returning Mongoose thenables will lose context.
  */
 export function runAsSystem<T>(fn: () => Promise<T>): Promise<T> {
-  return tenantStorage.run({ tenantId: SYSTEM_TENANT_ID }, fn);
+  const { requestId, userId } = tenantStorage.getStore() ?? {};
+  return tenantStorage.run({ tenantId: SYSTEM_TENANT_ID, requestId, userId }, fn);
 }
 
 /**
diff --git a/packages/data-schemas/src/config/winston.ts b/packages/data-schemas/src/config/winston.ts
index b793b7ed9c0..9b14692c817 100644
--- a/packages/data-schemas/src/config/winston.ts
+++ b/packages/data-schemas/src/config/winston.ts
@@ -7,11 +7,10 @@ import {
   jsonTruncateFormat,
   jsonMessageAsMsgFormat,
 } from './parsers';
+import { getTenantId, getUserId, getRequestId, SYSTEM_TENANT_ID } from './tenantContext';
 import { getLogDirectory } from './utils';
 
-const logDir = getLogDirectory();
-
-const { NODE_ENV, DEBUG_LOGGING, CONSOLE_JSON, DEBUG_CONSOLE } = process.env;
+const { NODE_ENV, DEBUG_LOGGING, CONSOLE_JSON, DEBUG_CONSOLE, LOG_TO_FILE } = process.env;
 
 const useConsoleJson = typeof CONSOLE_JSON === 'string' && CONSOLE_JSON.toLowerCase() === 'true';
 
@@ -19,6 +18,8 @@ const useDebugConsole = typeof DEBUG_CONSOLE === 'string' && DEBUG_CONSOLE.toLow
 
 const useDebugLogging = typeof DEBUG_LOGGING === 'string' && DEBUG_LOGGING.toLowerCase() === 'true';
 
+const useFileLogging = typeof LOG_TO_FILE !== 'string' || LOG_TO_FILE.toLowerCase() !== 'false';
+
 const levels: winston.config.AbstractConfigSetLevels = {
   error: 0,
   warn: 1,
@@ -30,6 +31,49 @@ const levels: winston.config.AbstractConfigSetLevels = {
   silly: 7,
 };
 
+const LOG_CONTEXT_KEYS = ['tenantId', 'userId', 'requestId'] as const;
+
+function getLogTenantId(): string | undefined {
+  const tenantId = getTenantId();
+  return tenantId === SYSTEM_TENANT_ID ? undefined : tenantId;
+}
+
+const requestContextFormat = winston.format((info: winston.Logform.TransformableInfo) => {
+  if (info.tenantId === SYSTEM_TENANT_ID) {
+    delete info.tenantId;
+  }
+  const context = {
+    tenantId: getLogTenantId(),
+    userId: getUserId(),
+    requestId: getRequestId(),
+  };
+  LOG_CONTEXT_KEYS.forEach((key) => {
+    if (context[key] && info[key] == null) {
+      info[key] = context[key];
+    }
+  });
+  return info;
+});
+
+function formatRequestContext(info: winston.Logform.TransformableInfo): string {
+  const context: Partial<Record<(typeof LOG_CONTEXT_KEYS)[number], string>> = {};
+  LOG_CONTEXT_KEYS.forEach((key) => {
+    const value = info[key];
+    if (key === 'tenantId' && value === SYSTEM_TENANT_ID) {
+      return;
+    }
+    if (typeof value === 'string' && value) {
+      context[key] = value;
+    }
+  });
+  return Object.keys(context).length > 0 ? JSON.stringify(context) : '';
+}
+
+function appendRequestContext(line: string, info: winston.Logform.TransformableInfo): string {
+  const context = formatRequestContext(info);
+  return context ? `${line} ${context}` : line;
+}
+
 winston.addColors({
   info: 'green',
   warn: 'italic yellow',
@@ -47,41 +91,50 @@ const fileFormat = winston.format.combine(
   winston.format.timestamp({ format: () => new Date().toISOString() }),
   winston.format.errors({ stack: true }),
   winston.format.splat(),
+  requestContextFormat(),
 );
 
-const transports: winston.transport[] = [
-  new winston.transports.DailyRotateFile({
-    level: 'error',
-    filename: `${logDir}/error-%DATE%.log`,
-    datePattern: 'YYYY-MM-DD',
-    zippedArchive: true,
-    maxSize: '20m',
-    maxFiles: '14d',
-    format: winston.format.combine(fileFormat, jsonMessageAsMsgFormat(), winston.format.json()),
-  }),
-];
+const transports: winston.transport[] = [];
+
+if (useFileLogging) {
+  const logDir = getLogDirectory();
 
-if (useDebugLogging) {
   transports.push(
     new winston.transports.DailyRotateFile({
-      level: 'debug',
-      filename: `${logDir}/debug-%DATE%.log`,
+      level: 'error',
+      filename: `${logDir}/error-%DATE%.log`,
       datePattern: 'YYYY-MM-DD',
       zippedArchive: true,
       maxSize: '20m',
       maxFiles: '14d',
-      format: winston.format.combine(fileFormat, debugTraverse),
+      format: winston.format.combine(fileFormat, jsonMessageAsMsgFormat(), winston.format.json()),
     }),
   );
+
+  if (useDebugLogging) {
+    transports.push(
+      new winston.transports.DailyRotateFile({
+        level: 'debug',
+        filename: `${logDir}/debug-%DATE%.log`,
+        datePattern: 'YYYY-MM-DD',
+        zippedArchive: true,
+        maxSize: '20m',
+        maxFiles: '14d',
+        format: winston.format.combine(fileFormat, debugTraverse),
+      }),
+    );
+  }
 }
 
 const consoleFormat = winston.format.combine(
   redactFormat(),
+  requestContextFormat(),
   winston.format.colorize({ all: true }),
   winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
   winston.format.printf((info) => {
     const message = `${info.timestamp} ${info.level}: ${info.message}`;
-    return info.level.includes('error') ? redactMessage(message) : message;
+    const line = appendRequestContext(message, info);
+    return info.level.includes('error') ? redactMessage(line) : line;
   }),
 );
 
@@ -127,7 +180,7 @@ if (useDebugConsole) {
 }
 
 // Create logger
-const logger = winston.createLogger({
+const logger: winston.Logger = winston.createLogger({
   level: level(),
   levels,
   transports,
diff --git a/packages/data-schemas/src/index.ts b/packages/data-schemas/src/index.ts
index 4156559658d..ee393b2de44 100644
--- a/packages/data-schemas/src/index.ts
+++ b/packages/data-schemas/src/index.ts
@@ -14,15 +14,40 @@ export {
   cacheTokenValues,
   premiumTokenValues,
   defaultRate,
+  createTxMethods,
   permissionBitSupersets,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  inferSkillFileCategory,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+  AUDIT_SCHEMA_VERSION,
+  MAX_AUDIT_EXPORT_ROWS,
+  MAX_AUDIT_LOG_LIMIT,
+  MAX_AUDIT_VERIFY_ROWS,
 } from './methods';
 export type * from './types';
 export type * from './methods';
+export {
+  AUDIT_ACTIONS,
+  AUDIT_CATEGORIES,
+  AUDIT_OUTCOMES,
+  AUDIT_SEVERITIES,
+  AUDIT_ACTOR_TYPES,
+  AUDIT_ACTION_CATEGORY,
+} from './types/admin';
+export { GENESIS_HASH, PLATFORM_CHAIN_KEY } from './schema/auditLog';
 export { default as logger } from './config/winston';
 export { default as meiliLogger } from './config/meiliLogger';
+export { redactMessage } from './config/parsers';
 export {
   tenantStorage,
   getTenantId,
+  getUserId,
+  getRequestId,
   runAsSystem,
   scopedCacheKey,
   SYSTEM_TENANT_ID,
diff --git a/packages/data-schemas/src/methods/accessRole.spec.ts b/packages/data-schemas/src/methods/accessRole.spec.ts
index 7f62c2f8cff..ec9e97ed9bb 100644
--- a/packages/data-schemas/src/methods/accessRole.spec.ts
+++ b/packages/data-schemas/src/methods/accessRole.spec.ts
@@ -206,6 +206,8 @@ describe('AccessRole Model Tests', () => {
           AccessRoleIds.REMOTE_AGENT_EDITOR,
           AccessRoleIds.REMOTE_AGENT_OWNER,
           AccessRoleIds.REMOTE_AGENT_VIEWER,
+          AccessRoleIds.SHARED_LINK_OWNER,
+          AccessRoleIds.SHARED_LINK_VIEWER,
           AccessRoleIds.SKILL_EDITOR,
           AccessRoleIds.SKILL_OWNER,
           AccessRoleIds.SKILL_VIEWER,
diff --git a/packages/data-schemas/src/methods/accessRole.ts b/packages/data-schemas/src/methods/accessRole.ts
index 654912978de..63a49f3dba9 100644
--- a/packages/data-schemas/src/methods/accessRole.ts
+++ b/packages/data-schemas/src/methods/accessRole.ts
@@ -3,7 +3,27 @@ import type { Model, Types, DeleteResult } from 'mongoose';
 import type { IAccessRole } from '~/types';
 import { RoleBits } from '~/common';
 
-export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
+export function createAccessRoleMethods(mongoose: typeof import('mongoose')): {
+  createRole: (roleData: Partial<IAccessRole>) => Promise<IAccessRole>;
+  updateRole: (
+    accessRoleId: string | Types.ObjectId,
+    updateData: Partial<IAccessRole>,
+  ) => Promise<IAccessRole | null>;
+  deleteRole: (accessRoleId: string | Types.ObjectId) => Promise<DeleteResult>;
+  getAllRoles: () => Promise<IAccessRole[]>;
+  findRoleById: (roleId: string | Types.ObjectId) => Promise<IAccessRole | null>;
+  seedDefaultRoles: () => Promise<Record<string, IAccessRole>>;
+  findRoleByIdentifier: (accessRoleId: string | Types.ObjectId) => Promise<IAccessRole | null>;
+  getRoleForPermissions: (
+    resourceType: string,
+    permBits: PermissionBits | RoleBits,
+  ) => Promise<IAccessRole | null>;
+  findRoleByPermissions: (
+    resourceType: string,
+    permBits: PermissionBits | RoleBits,
+  ) => Promise<IAccessRole | null>;
+  findRolesByResourceType: (resourceType: string) => Promise<IAccessRole[]>;
+} {
   /**
    * Find an access role by its ID
    * @param roleId - The role ID
@@ -101,7 +121,7 @@ export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
    * Seed default roles if they don't exist
    * @returns Object containing created roles
    */
-  async function seedDefaultRoles() {
+  async function seedDefaultRoles(): Promise<Record<string, IAccessRole>> {
     const AccessRole = mongoose.models.AccessRole as Model<IAccessRole>;
     const defaultRoles = [
       {
@@ -209,6 +229,20 @@ export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
         resourceType: ResourceType.SKILL,
         permBits: RoleBits.OWNER,
       },
+      {
+        accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+        name: 'com_ui_role_viewer',
+        description: 'com_ui_role_viewer_desc',
+        resourceType: ResourceType.SHARED_LINK,
+        permBits: RoleBits.VIEWER,
+      },
+      {
+        accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+        name: 'com_ui_role_owner',
+        description: 'com_ui_role_owner_desc',
+        resourceType: ResourceType.SHARED_LINK,
+        permBits: RoleBits.OWNER,
+      },
     ];
 
     const result: Record<string, IAccessRole> = {};
diff --git a/packages/data-schemas/src/methods/aclEntry.spec.ts b/packages/data-schemas/src/methods/aclEntry.spec.ts
index 575f43f9db8..68e23078308 100644
--- a/packages/data-schemas/src/methods/aclEntry.spec.ts
+++ b/packages/data-schemas/src/methods/aclEntry.spec.ts
@@ -1,11 +1,11 @@
 import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
 import {
   ResourceType,
   PrincipalType,
   PrincipalModel,
   PermissionBits,
 } from 'librechat-data-provider';
-import { MongoMemoryServer } from 'mongodb-memory-server';
 import type * as t from '~/types';
 import { createAclEntryMethods, permissionBitSupersets } from './aclEntry';
 import aclEntrySchema from '~/schema/aclEntry';
@@ -1194,6 +1194,42 @@ describe('AclEntry Model Tests', () => {
       expect(agentIds).toHaveLength(1);
       expect(agentIds[0].toString()).toBe(agentRes.toString());
     });
+
+    test('should have a public-principal compound index available for the planner', async () => {
+      await AclEntry.syncIndexes();
+      const indexes = await AclEntry.collection.indexes();
+      const publicIndex = indexes.find(
+        (idx) =>
+          idx.key?.principalType === 1 &&
+          idx.key?.resourceType === 1 &&
+          idx.key?.permBits === 1 &&
+          idx.key?.resourceId === 1,
+      );
+      expect(publicIndex).toBeDefined();
+
+      await methods.grantPermission(
+        PrincipalType.PUBLIC,
+        null,
+        ResourceType.AGENT,
+        new mongoose.Types.ObjectId(),
+        PermissionBits.VIEW,
+        grantedById,
+      );
+
+      const explain = (await AclEntry.find({
+        principalType: PrincipalType.PUBLIC,
+        resourceType: ResourceType.AGENT,
+        permBits: { $in: [PermissionBits.VIEW] },
+      })
+        .hint(publicIndex!.name as string)
+        .explain('queryPlanner')) as unknown as {
+        queryPlanner?: { winningPlan?: Record<string, unknown> };
+      };
+
+      const planString = JSON.stringify(explain?.queryPlanner?.winningPlan ?? {});
+      expect(planString).toContain('IXSCAN');
+      expect(planString).not.toContain('COLLSCAN');
+    });
   });
 
   describe('aggregateAclEntries', () => {
@@ -1223,14 +1259,14 @@ describe('AclEntry Model Tests', () => {
         grantedById,
       );
 
-      const results = await methods.aggregateAclEntries([
+      const results = (await methods.aggregateAclEntries([
         { $group: { _id: '$resourceType', count: { $sum: 1 } } },
         { $sort: { _id: 1 } },
-      ]);
+      ])) as Array<{ _id: string; count: number }>;
 
       expect(results).toHaveLength(2);
-      const agentResult = results.find((r: { _id: string }) => r._id === ResourceType.AGENT);
-      expect(agentResult.count).toBe(2);
+      const agentResult = results.find((r) => r._id === ResourceType.AGENT);
+      expect(agentResult?.count).toBe(2);
     });
 
     test('should return empty array for non-matching pipeline', async () => {
diff --git a/packages/data-schemas/src/methods/aclEntry.tenant.spec.ts b/packages/data-schemas/src/methods/aclEntry.tenant.spec.ts
new file mode 100644
index 00000000000..a216ce9e635
--- /dev/null
+++ b/packages/data-schemas/src/methods/aclEntry.tenant.spec.ts
@@ -0,0 +1,114 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { PrincipalType, PrincipalModel, PermissionBits } from 'librechat-data-provider';
+import type { IAclEntry } from '..';
+import { createAclEntryMethods } from './aclEntry';
+import { createModels } from '../models';
+import { tenantStorage } from '../config/tenantContext';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+const TENANT_A = 'tenant-aaaaaaaaaaaaaaaaaaaa';
+const TENANT_B = 'tenant-bbbbbbbbbbbbbbbbbbbb';
+const RESOURCE_TYPE = 'agent';
+
+let mongoServer: MongoMemoryServer;
+let AclEntry: mongoose.Model<IAclEntry>;
+let methods: ReturnType<typeof createAclEntryMethods>;
+
+function runAs<T>(tenantId: string, fn: () => Promise<T>): Promise<T> {
+  return tenantStorage.run({ tenantId }, fn);
+}
+
+async function seedAcl(tenantId: string, doc: Record<string, unknown>): Promise<void> {
+  await runAs(tenantId, async () => {
+    await new AclEntry(doc).save();
+  });
+}
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  AclEntry = mongoose.models.AclEntry as mongoose.Model<IAclEntry>;
+  methods = createAclEntryMethods(mongoose);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AclEntry.deleteMany({});
+});
+
+describe('AclEntry resource lookups are scoped to the active tenant', () => {
+  it('findAccessibleResources returns only the current tenant resources', async () => {
+    const principalId = new mongoose.Types.ObjectId();
+    const resourceA = new mongoose.Types.ObjectId();
+    const resourceB = new mongoose.Types.ObjectId();
+
+    await seedAcl(TENANT_A, {
+      principalType: PrincipalType.USER,
+      principalModel: PrincipalModel.USER,
+      principalId,
+      resourceType: RESOURCE_TYPE,
+      resourceId: resourceA,
+      permBits: PermissionBits.VIEW,
+    });
+    await seedAcl(TENANT_B, {
+      principalType: PrincipalType.USER,
+      principalModel: PrincipalModel.USER,
+      principalId,
+      resourceType: RESOURCE_TYPE,
+      resourceId: resourceB,
+      permBits: PermissionBits.VIEW,
+    });
+
+    const principals = [{ principalType: PrincipalType.USER, principalId }];
+
+    const aResources = await runAs(TENANT_A, () =>
+      methods.findAccessibleResources(principals, RESOURCE_TYPE, PermissionBits.VIEW),
+    );
+    expect(aResources.map(String)).toEqual([String(resourceA)]);
+
+    const bResources = await runAs(TENANT_B, () =>
+      methods.findAccessibleResources(principals, RESOURCE_TYPE, PermissionBits.VIEW),
+    );
+    expect(bResources.map(String)).toEqual([String(resourceB)]);
+  });
+
+  it('findPublicResourceIds returns only the current tenant public resources', async () => {
+    const publicA = new mongoose.Types.ObjectId();
+    const publicB = new mongoose.Types.ObjectId();
+
+    await seedAcl(TENANT_A, {
+      principalType: PrincipalType.PUBLIC,
+      resourceType: RESOURCE_TYPE,
+      resourceId: publicA,
+      permBits: PermissionBits.VIEW,
+    });
+    await seedAcl(TENANT_B, {
+      principalType: PrincipalType.PUBLIC,
+      resourceType: RESOURCE_TYPE,
+      resourceId: publicB,
+      permBits: PermissionBits.VIEW,
+    });
+
+    const aPublic = await runAs(TENANT_A, () =>
+      methods.findPublicResourceIds(RESOURCE_TYPE, PermissionBits.VIEW),
+    );
+    expect(aPublic.map(String)).toEqual([String(publicA)]);
+
+    const bPublic = await runAs(TENANT_B, () =>
+      methods.findPublicResourceIds(RESOURCE_TYPE, PermissionBits.VIEW),
+    );
+    expect(bPublic.map(String)).toEqual([String(publicB)]);
+  });
+});
diff --git a/packages/data-schemas/src/methods/aclEntry.ts b/packages/data-schemas/src/methods/aclEntry.ts
index b1803918cf9..105d55a1d10 100644
--- a/packages/data-schemas/src/methods/aclEntry.ts
+++ b/packages/data-schemas/src/methods/aclEntry.ts
@@ -8,8 +8,8 @@ import type {
   Model,
 } from 'mongoose';
 import type { AclEntry, IAclEntry } from '~/types';
-import { MAX_PERM_BITS } from '~/common/permissions';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import { MAX_PERM_BITS } from '~/common/permissions';
 
 /**
  * Empty frozen array shared by every rejection path. Returning a single
@@ -76,7 +76,87 @@ export function permissionBitSupersets(requiredBits: number): readonly number[]
   return frozen;
 }
 
-export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
+export function createAclEntryMethods(mongoose: typeof import('mongoose')): {
+  findEntriesByPrincipal: (
+    principalType: string,
+    principalId: string | Types.ObjectId,
+    resourceType?: string,
+  ) => Promise<IAclEntry[]>;
+  findEntriesByResource: (
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<IAclEntry[]>;
+  findEntriesByPrincipalsAndResource: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<IAclEntry[]>;
+  hasPermission: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    permissionBit: number,
+  ) => Promise<boolean>;
+  getEffectivePermissions: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<number>;
+  getEffectivePermissionsForResources: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceIds: Array<string | Types.ObjectId>,
+  ) => Promise<Map<string, number>>;
+  grantPermission: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    permBits: number,
+    grantedBy?: string | Types.ObjectId,
+    session?: ClientSession,
+    roleId?: string | Types.ObjectId,
+    expiredAt?: Date,
+  ) => Promise<IAclEntry | null>;
+  revokePermission: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<DeleteResult>;
+  modifyPermissionBits: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    addBits?: number | null,
+    removeBits?: number | null,
+    session?: ClientSession,
+  ) => Promise<IAclEntry | null>;
+  findAccessibleResources: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    requiredPermBit: number,
+  ) => Promise<Types.ObjectId[]>;
+  deleteAclEntries: (
+    filter: Record<string, unknown>,
+    options?: { session?: ClientSession },
+  ) => Promise<DeleteResult>;
+  bulkWriteAclEntries: (
+    ops: AnyBulkWriteOperation<AclEntry>[],
+    options?: { session?: ClientSession },
+  ) => Promise<import('mongodb').BulkWriteResult>;
+  findPublicResourceIds: (
+    resourceType: string,
+    requiredPermissions: number,
+  ) => Promise<Types.ObjectId[]>;
+  aggregateAclEntries: (pipeline: PipelineStage[]) => Promise<unknown[]>;
+  getSoleOwnedResourceIds: (
+    userObjectId: Types.ObjectId,
+    resourceTypes: string | string[],
+  ) => Promise<Types.ObjectId[]>;
+} {
   /**
    * Find ACL entries for a specific principal (user or group)
    * @param principalType - The type of principal ('user', 'group')
@@ -264,9 +344,10 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
     resourceType: string,
     resourceId: string | Types.ObjectId,
     permBits: number,
-    grantedBy: string | Types.ObjectId,
+    grantedBy?: string | Types.ObjectId,
     session?: ClientSession,
     roleId?: string | Types.ObjectId,
+    expiredAt?: Date,
   ): Promise<IAclEntry | null> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     const query: Record<string, unknown> = {
@@ -292,9 +373,10 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
     const update = {
       $set: {
         permBits,
-        grantedBy,
         grantedAt: new Date(),
+        ...(grantedBy && { grantedBy }),
         ...(roleId && { roleId }),
+        ...(expiredAt && { expiredAt }),
       },
     };
 
@@ -445,7 +527,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
   async function bulkWriteAclEntries(
     ops: AnyBulkWriteOperation<AclEntry>[],
     options?: { session?: ClientSession },
-  ) {
+  ): Promise<import('mongodb').BulkWriteResult> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     return tenantSafeBulkWrite(AclEntry, ops as AnyBulkWriteOperation[], options || {});
   }
@@ -472,7 +554,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
    * Runs an aggregation pipeline on the AclEntry collection.
    * @param pipeline - MongoDB aggregation pipeline stages
    */
-  async function aggregateAclEntries(pipeline: PipelineStage[]) {
+  async function aggregateAclEntries(pipeline: PipelineStage[]): Promise<unknown[]> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     return AclEntry.aggregate(pipeline);
   }
diff --git a/packages/data-schemas/src/methods/action.ts b/packages/data-schemas/src/methods/action.ts
index 3dc5a2c87a6..b86509800fb 100644
--- a/packages/data-schemas/src/methods/action.ts
+++ b/packages/data-schemas/src/methods/action.ts
@@ -3,7 +3,18 @@ import type { IAction } from '~/types';
 
 const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'] as const;
 
-export function createActionMethods(mongoose: typeof import('mongoose')) {
+export function createActionMethods(mongoose: typeof import('mongoose')): {
+  getActions: (
+    searchParams: FilterQuery<IAction>,
+    includeSensitive?: boolean,
+  ) => Promise<IAction[]>;
+  updateAction: (
+    searchParams: FilterQuery<IAction>,
+    updateData: Partial<IAction>,
+  ) => Promise<IAction | null>;
+  deleteAction: (searchParams: FilterQuery<IAction>) => Promise<IAction | null>;
+  deleteActions: (searchParams: FilterQuery<IAction>) => Promise<number>;
+} {
   /**
    * Update an action with new data without overwriting existing properties,
    * or create a new action if it doesn't exist.
diff --git a/packages/data-schemas/src/methods/agent.spec.ts b/packages/data-schemas/src/methods/agent.spec.ts
index 2d5a6666bb4..82c8f6aac4d 100644
--- a/packages/data-schemas/src/methods/agent.spec.ts
+++ b/packages/data-schemas/src/methods/agent.spec.ts
@@ -8,6 +8,8 @@ import {
   PrincipalModel,
   PermissionBits,
   EToolResources,
+  Constants,
+  actionDelimiter,
 } from 'librechat-data-provider';
 import type {
   UpdateWithAggregationPipeline,
@@ -520,6 +522,130 @@ describe('Agent Methods', () => {
       expect(retrievedAgent!.description).toBe('Test description');
     });
 
+    test('should derive mcpServerNames only from MCP tools on create', async () => {
+      const { agentId, authorId } = createTestIds();
+      const actionTool = `sync${Constants.mcp_delimiter}state${actionDelimiter}api---example---com`;
+      const mcpTool = `search${Constants.mcp_delimiter}authorizedServer`;
+
+      const newAgent = await createAgent({
+        id: agentId,
+        name: 'MCP Names Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        tools: [actionTool, mcpTool],
+      });
+
+      expect(newAgent.mcpServerNames).toEqual(['authorizedServer']);
+    });
+
+    test('should derive mcpServerNames only from MCP tools on update', async () => {
+      const { agentId, authorId } = createTestIds();
+      const actionTool = `sync${Constants.mcp_delimiter}state${actionDelimiter}api---example---com`;
+      const mcpTool = `search${Constants.mcp_delimiter}authorizedServer`;
+
+      await createAgent({
+        id: agentId,
+        name: 'MCP Names Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        tools: [],
+      });
+
+      const updatedAgent = await updateAgent({ id: agentId }, { tools: [actionTool, mcpTool] });
+
+      expect(updatedAgent!.mcpServerNames).toEqual(['authorizedServer']);
+    });
+
+    test('should prune nonexistent skill ids from the allowlist on create', async () => {
+      const { agentId, authorId } = createTestIds();
+      const realSkill = await mongoose.models.Skill.create({
+        name: 'create-prune-skill',
+        description: 'Skill backing the create-time allowlist pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      const newAgent = await createAgent({
+        id: agentId,
+        name: 'Skill Prune Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        skills: [realSkill._id.toString(), danglingId],
+        skills_enabled: true,
+      });
+
+      expect(newAgent.skills).toEqual([realSkill._id.toString()]);
+    });
+
+    test('should prune nonexistent skill ids from the allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+      const realSkill = await mongoose.models.Skill.create({
+        name: 'update-prune-skill',
+        description: 'Skill backing the update-time allowlist pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Skill Prune Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent(
+        { id: agentId },
+        { skills: [danglingId, realSkill._id.toString()], skills_enabled: true },
+      );
+
+      expect(updatedAgent!.skills).toEqual([realSkill._id.toString()]);
+      expect(updatedAgent!.skills_enabled).toBe(true);
+    });
+
+    test('should fail closed when pruning empties the allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Skill Heal Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent(
+        { id: agentId },
+        { skills: [danglingId], skills_enabled: true },
+      );
+
+      expect(updatedAgent!.skills).toEqual([]);
+      expect(updatedAgent!.skills_enabled).toBe(false);
+    });
+
+    test('should keep full-catalog semantics for an explicit empty allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+
+      await createAgent({
+        id: agentId,
+        name: 'Explicit Empty Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent({ id: agentId }, { skills: [], skills_enabled: true });
+
+      expect(updatedAgent!.skills).toEqual([]);
+      expect(updatedAgent!.skills_enabled).toBe(true);
+    });
+
     test('should delete an agent', async () => {
       const agentId = `agent_${uuidv4()}`;
       const authorId = new mongoose.Types.ObjectId();
@@ -1703,6 +1829,38 @@ describe('Agent Methods', () => {
       expect(revertedAgent.description).toBe('Original description');
     });
 
+    test('should prune deleted skill ids when reverting to an older version', async () => {
+      const agentId = `agent_${uuidv4()}`;
+      const authorId = new mongoose.Types.ObjectId();
+      const Skill = mongoose.models.Skill;
+      const skill = await Skill.create({
+        name: 'revert-prune-skill',
+        description: 'Skill backing the revert pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const skillId = skill._id.toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Revert Skill Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        skills: [skillId],
+        skills_enabled: true,
+      });
+
+      await updateAgent({ id: agentId }, { skills: [], name: 'No Skills Anymore' });
+      await Skill.deleteOne({ _id: skill._id });
+
+      const revertedAgent = await revertAgentVersion({ id: agentId }, 0);
+
+      expect(revertedAgent.name).toBe('Revert Skill Agent');
+      expect(revertedAgent.skills).toEqual([]);
+      expect(revertedAgent.skills_enabled).toBe(false);
+    });
+
     test('should detect action metadata changes and force version update', async () => {
       const agentId = `agent_${uuidv4()}`;
       const authorId = new mongoose.Types.ObjectId();
@@ -3334,14 +3492,22 @@ describe('Support Contact Field', () => {
       expect(result.data[0].name).toBe('Agent A1');
     });
 
-    test('should include the skills field in the list projection', async () => {
-      // Frontend popover scoping relies on `agent.skills` being present in
-      // list results so it can narrow the `$` catalog without refetching the
-      // full agent document. Locks in that projection contract.
-      const targetSkillIds = [
-        new mongoose.Types.ObjectId().toString(),
-        new mongoose.Types.ObjectId().toString(),
-      ];
+    test('should omit skill configuration from the default list projection', async () => {
+      const skillDocs = await mongoose.models.Skill.create([
+        {
+          name: 'projection-skill-a',
+          description: 'Skill backing projection test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+        {
+          name: 'projection-skill-b',
+          description: 'Skill backing projection test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+      ]);
+      const targetSkillIds = skillDocs.map((doc) => doc._id.toString());
       const scopedAgent = await createAgent({
         id: `agent_${uuidv4().slice(0, 12)}`,
         name: 'Scoped Agent',
@@ -3350,6 +3516,7 @@ describe('Support Contact Field', () => {
         model: 'gpt-4',
         author: userA,
         skills: targetSkillIds,
+        skills_enabled: true,
       });
 
       const result = await getListAgentsByAccess({
@@ -3357,8 +3524,47 @@ describe('Support Contact Field', () => {
         otherParams: {},
       });
 
+      expect(result.data).toHaveLength(1);
+      expect(result.data[0].skills).toBeUndefined();
+      expect(result.data[0].skills_enabled).toBeUndefined();
+    });
+
+    test('should include skill configuration only when explicitly requested', async () => {
+      const skillDocs = await mongoose.models.Skill.create([
+        {
+          name: 'scoped-skill-a',
+          description: 'Skill backing inclusion test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+        {
+          name: 'scoped-skill-b',
+          description: 'Skill backing inclusion test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+      ]);
+      const targetSkillIds = skillDocs.map((doc) => doc._id.toString());
+      const scopedAgent = await createAgent({
+        id: `agent_${uuidv4().slice(0, 12)}`,
+        name: 'Scoped Agent',
+        description: 'Agent with configured skill scope',
+        provider: 'openai',
+        model: 'gpt-4',
+        author: userA,
+        skills: targetSkillIds,
+        skills_enabled: true,
+      });
+
+      const result = await getListAgentsByAccess({
+        accessibleIds: [scopedAgent._id] as mongoose.Types.ObjectId[],
+        otherParams: {},
+        includeSkillConfig: true,
+      });
+
       expect(result.data).toHaveLength(1);
       expect(result.data[0].skills).toEqual(targetSkillIds);
+      expect(result.data[0].skills_enabled).toBe(true);
     });
 
     test('should return multiple accessible agents when provided', async () => {
@@ -3487,6 +3693,85 @@ describe('Support Contact Field', () => {
       expect(result.data[0].id).toBe(agentB1.id);
       expect(result.data[0].author).toBe(userB.toString());
     });
+
+    test('should cap results at the default page size when limit is omitted', async () => {
+      const extraAgents = [];
+      for (let i = 0; i < 102; i++) {
+        const agent = await createAgent({
+          id: `agent_${uuidv4().slice(0, 12)}`,
+          name: `Bulk Agent ${i}`,
+          description: `Bulk agent ${i}`,
+          provider: 'openai',
+          model: 'gpt-4',
+          author: userA,
+        });
+        extraAgents.push(agent);
+      }
+
+      const accessibleIds = extraAgents.map((a) => a._id) as mongoose.Types.ObjectId[];
+
+      const result = await getListAgentsByAccess({
+        accessibleIds,
+        otherParams: {},
+      });
+
+      expect(result.data).toHaveLength(100);
+      expect(result.has_more).toBe(true);
+      expect(result.after).toBeTruthy();
+    });
+
+    test('should return all agents when limit is explicitly null', async () => {
+      const extraAgents = [];
+      for (let i = 0; i < 102; i++) {
+        const agent = await createAgent({
+          id: `agent_${uuidv4().slice(0, 12)}`,
+          name: `Bulk Agent ${i}`,
+          description: `Bulk agent ${i}`,
+          provider: 'openai',
+          model: 'gpt-4',
+          author: userA,
+        });
+        extraAgents.push(agent);
+      }
+
+      const accessibleIds = extraAgents.map((a) => a._id) as mongoose.Types.ObjectId[];
+
+      const result = await getListAgentsByAccess({
+        accessibleIds,
+        otherParams: {},
+        limit: null,
+      });
+
+      expect(result.data).toHaveLength(102);
+      expect(result.has_more).toBe(false);
+      expect(result.after).toBeNull();
+    });
+
+    test('should honor explicit limits above the legacy 100 cap', async () => {
+      const extraAgents = [];
+      for (let i = 0; i < 105; i++) {
+        const agent = await createAgent({
+          id: `agent_${uuidv4().slice(0, 12)}`,
+          name: `Bulk Agent ${i}`,
+          description: `Bulk agent ${i}`,
+          provider: 'openai',
+          model: 'gpt-4',
+          author: userA,
+        });
+        extraAgents.push(agent);
+      }
+
+      const accessibleIds = extraAgents.map((a) => a._id) as mongoose.Types.ObjectId[];
+
+      const result = await getListAgentsByAccess({
+        accessibleIds,
+        otherParams: {},
+        limit: 500,
+      });
+
+      expect(result.data).toHaveLength(105);
+      expect(result.has_more).toBe(false);
+    });
   });
 });
 
diff --git a/packages/data-schemas/src/methods/agent.ts b/packages/data-schemas/src/methods/agent.ts
index 833f0b9f63d..f9406112f57 100644
--- a/packages/data-schemas/src/methods/agent.ts
+++ b/packages/data-schemas/src/methods/agent.ts
@@ -1,8 +1,15 @@
 import crypto from 'node:crypto';
-import { Constants, EToolResources, ResourceType, actionDelimiter } from 'librechat-data-provider';
+import {
+  Constants,
+  EToolResources,
+  ResourceType,
+  actionDelimiter,
+  isActionTool,
+} from 'librechat-data-provider';
 import type { AgentToolResources } from 'librechat-data-provider';
 import type { FilterQuery, Model, Types } from 'mongoose';
 import type { IAgent, IAclEntry } from '~/types';
+import { filterExistingSkillIds } from './skill';
 import logger from '~/config/winston';
 
 const { mcp_delimiter } = Constants;
@@ -46,7 +53,7 @@ function extractMCPServerNames(tools: string[] | undefined | null): string[] {
   }
   const serverNames = new Set<string>();
   for (const tool of tools) {
-    if (!tool || !tool.includes(mcp_delimiter)) {
+    if (!tool || !tool.includes(mcp_delimiter) || isActionTool(tool)) {
       continue;
     }
     const parts = tool.split(mcp_delimiter);
@@ -240,7 +247,83 @@ async function generateActionMetadataHash(
   return hashHex;
 }
 
-export function createAgentMethods(mongoose: typeof import('mongoose'), deps: AgentDeps) {
+export function createAgentMethods(
+  mongoose: typeof import('mongoose'),
+  deps: AgentDeps,
+): {
+  getAgent: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent | null>;
+  getAgents: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent[]>;
+  createAgent: (agentData: Record<string, unknown>) => Promise<IAgent>;
+  hasAgentWithMCPServerName: ({
+    agentIds,
+    serverName,
+  }: {
+    agentIds: Types.ObjectId[];
+    serverName: string;
+  }) => Promise<boolean>;
+  getMCPServerNamesByAgentIds: (agentIds: Types.ObjectId[]) => Promise<string[]>;
+  updateAgent: (
+    searchParameter: FilterQuery<IAgent>,
+    updateData: Record<string, unknown>,
+    options?: {
+      updatingUserId?: string | null;
+      forceVersion?: boolean;
+      skipVersioning?: boolean;
+    },
+  ) => Promise<IAgent | null>;
+  deleteAgent: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent | null>;
+  deleteUserAgents: (userId: string) => Promise<void>;
+  revertAgentVersion: (
+    searchParameter: FilterQuery<IAgent>,
+    versionIndex: number,
+  ) => Promise<IAgent>;
+  countPromotedAgents: () => Promise<number>;
+  addAgentResourceFile: ({
+    agent_id,
+    tool_resource,
+    file_id,
+    updatingUserId,
+  }: {
+    agent_id: string;
+    tool_resource: string;
+    file_id: string;
+    updatingUserId?: string;
+  }) => Promise<IAgent>;
+  getListAgentsByAccess: ({
+    accessibleIds,
+    otherParams,
+    limit,
+    after,
+    includeSkillConfig,
+  }: {
+    accessibleIds?: Types.ObjectId[];
+    otherParams?: Record<string, unknown>;
+    limit?: number | null;
+    after?: string | null;
+    includeSkillConfig?: boolean;
+  }) => Promise<{
+    object: string;
+    data: Array<Record<string, unknown>>;
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }>;
+  removeAgentResourceFiles: ({
+    agent_id,
+    files,
+  }: {
+    agent_id: string;
+    files: Array<{ tool_resource: string; file_id: string }>;
+  }) => Promise<IAgent>;
+  generateActionMetadataHash: typeof generateActionMetadataHash;
+  removeAgentFromUserFavorites: (resourceId: string, userIds: string[]) => Promise<void>;
+  removeAgentResourceFilesFromAllAgents: ({
+    file_ids,
+  }: {
+    file_ids: string[];
+  }) => Promise<{ matchedCount: number; modifiedCount: number }>;
+} {
   const { removeAllPermissions, getActions, getSoleOwnedResourceIds } = deps;
 
   /**
@@ -248,6 +331,15 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
    */
   async function createAgent(agentData: Record<string, unknown>): Promise<IAgent> {
     const Agent = mongoose.models.Agent as Model<IAgent>;
+    if (Array.isArray(agentData.skills) && agentData.skills.length > 0) {
+      const prunedSkills = await filterExistingSkillIds(mongoose, agentData.skills as string[]);
+      agentData.skills = prunedSkills;
+      /** Fail closed when pruning empties a non-empty allowlist — empty +
+       *  enabled means the full catalog, and hygiene must never widen scope. */
+      if (prunedSkills.length === 0) {
+        agentData.skills_enabled = false;
+      }
+    }
     const { author: _author, ...versionData } = agentData;
     const timestamp = new Date();
     const initialAgentData = {
@@ -282,6 +374,50 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
     return await Agent.find(searchParameter).lean<IAgent[]>();
   }
 
+  async function hasAgentWithMCPServerName({
+    agentIds,
+    serverName,
+  }: {
+    agentIds: Types.ObjectId[];
+    serverName: string;
+  }): Promise<boolean> {
+    if (agentIds.length === 0) {
+      return false;
+    }
+
+    const Agent = mongoose.models.Agent as Model<IAgent>;
+    const agent = await Agent.exists({
+      _id: { $in: agentIds },
+      mcpServerNames: serverName,
+    });
+
+    return agent !== null;
+  }
+
+  async function getMCPServerNamesByAgentIds(agentIds: Types.ObjectId[]): Promise<string[]> {
+    if (agentIds.length === 0) {
+      return [];
+    }
+
+    const Agent = mongoose.models.Agent as Model<IAgent>;
+    const agents = await Agent.find(
+      {
+        _id: { $in: agentIds },
+        mcpServerNames: { $exists: true, $not: { $size: 0 } },
+      },
+      { mcpServerNames: 1 },
+    ).lean<Array<Pick<IAgent, 'mcpServerNames'>>>();
+
+    const serverNames = new Set<string>();
+    for (const agent of agents) {
+      for (const serverName of agent.mcpServerNames ?? []) {
+        serverNames.add(serverName);
+      }
+    }
+
+    return Array.from(serverNames);
+  }
+
   /**
    * Update an agent with new data without overwriting existing properties,
    * or create a new agent if it doesn't exist.
@@ -312,6 +448,27 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
       } = currentAgent.toObject() as unknown as Record<string, unknown>;
       const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
+      /** Self-heal: drop allowlist ids whose skill doc no longer exists.
+       *  A dangling id keeps the allowlist non-empty while scoping the
+       *  runtime catalog to an empty intersection — silently disabling
+       *  skills for the agent. When pruning empties a non-empty allowlist,
+       *  fail closed and disable skills: empty + enabled means the full
+       *  catalog, and hygiene must never widen scope. (An explicit user
+       *  `skills: []` submission skips this branch and keeps the
+       *  full-catalog semantics.) */
+      if (Array.isArray(directUpdates.skills) && directUpdates.skills.length > 0) {
+        const prunedSkills = await filterExistingSkillIds(
+          mongoose,
+          directUpdates.skills as string[],
+        );
+        directUpdates.skills = prunedSkills;
+        updateData.skills = prunedSkills;
+        if (prunedSkills.length === 0) {
+          directUpdates.skills_enabled = false;
+          updateData.skills_enabled = false;
+        }
+      }
+
       // Sync mcpServerNames when tools are updated
       if ((directUpdates as Record<string, unknown>).tools !== undefined) {
         const mcpServerNames = extractMCPServerNames(
@@ -641,18 +798,21 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
   }
 
   /**
-   * Get agents by accessible IDs with optional cursor-based pagination.
+   * Get agents by accessible IDs with cursor pagination. Defaults to a 100-page
+   * limit (max 1000); pass `limit: null` to opt out entirely.
    */
   async function getListAgentsByAccess({
     accessibleIds = [],
     otherParams = {},
-    limit = null,
+    limit = 100,
     after = null,
+    includeSkillConfig = false,
   }: {
     accessibleIds?: Types.ObjectId[];
     otherParams?: Record<string, unknown>;
     limit?: number | null;
     after?: string | null;
+    includeSkillConfig?: boolean;
   }): Promise<{
     object: string;
     data: Array<Record<string, unknown>>;
@@ -664,7 +824,7 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
     const Agent = mongoose.models.Agent as Model<IAgent>;
     const isPaginated = limit !== null && limit !== undefined;
     const normalizedLimit = isPaginated
-      ? Math.min(Math.max(1, parseInt(String(limit)) || 20), 100)
+      ? Math.min(Math.max(1, parseInt(String(limit)) || 20), 1000)
       : null;
 
     const baseQuery: Record<string, unknown> = {
@@ -700,7 +860,7 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
       }
     }
 
-    let query = Agent.find(baseQuery, {
+    const projection: Record<string, 1> = {
       id: 1,
       _id: 1,
       name: 1,
@@ -711,13 +871,14 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
       category: 1,
       support_contact: 1,
       is_promoted: 1,
-      /* Needed so the client can scope the `$` skill popover to each agent's
-         configured catalog without refetching the full agent document. The
-         master toggle is required alongside the allowlist so the popover can
-         distinguish "enabled with full catalog" from "disabled". */
-      skills: 1,
-      skills_enabled: 1,
-    }).sort({ updatedAt: -1, _id: 1 });
+    };
+
+    if (includeSkillConfig) {
+      projection.skills = 1;
+      projection.skills_enabled = 1;
+    }
+
+    let query = Agent.find(baseQuery, projection).sort({ updatedAt: -1, _id: 1 });
 
     if (isPaginated && normalizedLimit) {
       query = query.limit(normalizedLimit + 1);
@@ -780,6 +941,21 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
     delete revertToVersion.author;
     delete revertToVersion.updatedBy;
 
+    /** Version snapshots can predate skill deletions; restoring one verbatim
+     *  would resurrect dangling allowlist ids that scope the catalog to
+     *  nothing. Same self-heal (and fail-closed-on-empty rule) as
+     *  `createAgent`/`updateAgent`. */
+    if (Array.isArray(revertToVersion.skills) && revertToVersion.skills.length > 0) {
+      const prunedSkills = await filterExistingSkillIds(
+        mongoose,
+        revertToVersion.skills as string[],
+      );
+      revertToVersion.skills = prunedSkills;
+      if (prunedSkills.length === 0) {
+        revertToVersion.skills_enabled = false;
+      }
+    }
+
     const revertedAgent = await Agent.findOneAndUpdate(searchParameter, revertToVersion, {
       new: true,
     }).lean<IAgent>();
@@ -820,6 +996,8 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
     getAgent,
     getAgents,
     createAgent,
+    hasAgentWithMCPServerName,
+    getMCPServerNamesByAgentIds,
     updateAgent,
     deleteAgent,
     deleteUserAgents,
diff --git a/packages/data-schemas/src/methods/agentApiKey.ts b/packages/data-schemas/src/methods/agentApiKey.ts
index 3462f9ff843..c3de31f6bc2 100644
--- a/packages/data-schemas/src/methods/agentApiKey.ts
+++ b/packages/data-schemas/src/methods/agentApiKey.ts
@@ -11,7 +11,22 @@ import logger from '~/config/winston';
 const API_KEY_PREFIX = 'sk-';
 const API_KEY_LENGTH = 32;
 
-export function createAgentApiKeyMethods(mongoose: typeof import('mongoose')) {
+export function createAgentApiKeyMethods(mongoose: typeof import('mongoose')): {
+  createAgentApiKey: (data: AgentApiKeyCreateData) => Promise<AgentApiKeyCreateResult>;
+  validateAgentApiKey: (
+    apiKey: string,
+  ) => Promise<{ userId: Types.ObjectId; keyId: Types.ObjectId } | null>;
+  listAgentApiKeys: (userId: string | Types.ObjectId) => Promise<AgentApiKeyListItem[]>;
+  deleteAgentApiKey: (
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ) => Promise<boolean>;
+  deleteAllAgentApiKeys: (userId: string | Types.ObjectId) => Promise<number>;
+  getAgentApiKeyById: (
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ) => Promise<AgentApiKeyListItem | null>;
+} {
   async function generateApiKey(): Promise<{ key: string; keyHash: string; keyPrefix: string }> {
     const randomPart = await getRandomValues(API_KEY_LENGTH);
     const key = `${API_KEY_PREFIX}${randomPart}`;
diff --git a/packages/data-schemas/src/methods/agentCategory.tenant.spec.ts b/packages/data-schemas/src/methods/agentCategory.tenant.spec.ts
new file mode 100644
index 00000000000..cccae345b91
--- /dev/null
+++ b/packages/data-schemas/src/methods/agentCategory.tenant.spec.ts
@@ -0,0 +1,60 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { IAgentCategory } from '..';
+import { createAgentCategoryMethods } from './agentCategory';
+import { createModels } from '../models';
+import { tenantStorage } from '../config/tenantContext';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+const TENANT_A = 'tenant-aaaaaaaaaaaaaaaaaaaa';
+const TENANT_B = 'tenant-bbbbbbbbbbbbbbbbbbbb';
+
+let mongoServer: MongoMemoryServer;
+let AgentCategory: mongoose.Model<IAgentCategory>;
+let methods: ReturnType<typeof createAgentCategoryMethods>;
+
+function runAs<T>(tenantId: string, fn: () => Promise<T>): Promise<T> {
+  return tenantStorage.run({ tenantId }, fn);
+}
+
+async function seedCategory(tenantId: string, value: string): Promise<void> {
+  await runAs(tenantId, async () => {
+    await new AgentCategory({ value, label: value, isActive: true }).save();
+  });
+}
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  AgentCategory = mongoose.models.AgentCategory as mongoose.Model<IAgentCategory>;
+  methods = createAgentCategoryMethods(mongoose);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AgentCategory.deleteMany({});
+});
+
+describe('getValidCategoryValues is scoped to the active tenant', () => {
+  it('returns only the current tenant category values', async () => {
+    await seedCategory(TENANT_A, 'alpha');
+    await seedCategory(TENANT_B, 'beta');
+
+    const aValues = await runAs(TENANT_A, () => methods.getValidCategoryValues());
+    expect(aValues).toEqual(['alpha']);
+
+    const bValues = await runAs(TENANT_B, () => methods.getValidCategoryValues());
+    expect(bValues).toEqual(['beta']);
+  });
+});
diff --git a/packages/data-schemas/src/methods/agentCategory.ts b/packages/data-schemas/src/methods/agentCategory.ts
index 0a71d777db7..cb26923e238 100644
--- a/packages/data-schemas/src/methods/agentCategory.ts
+++ b/packages/data-schemas/src/methods/agentCategory.ts
@@ -2,7 +2,30 @@ import type { Model, Types } from 'mongoose';
 import type { IAgentCategory } from '~/types';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
 
-export function createAgentCategoryMethods(mongoose: typeof import('mongoose')) {
+export function createAgentCategoryMethods(mongoose: typeof import('mongoose')): {
+  getActiveCategories: () => Promise<IAgentCategory[]>;
+  getCategoriesWithCounts: () => Promise<(IAgentCategory & { agentCount: number })[]>;
+  getValidCategoryValues: () => Promise<string[]>;
+  seedCategories: (
+    categories: Array<{
+      value: string;
+      label?: string;
+      description?: string;
+      order?: number;
+      custom?: boolean;
+    }>,
+  ) => Promise<import('mongoose').mongo.BulkWriteResult>;
+  findCategoryByValue: (value: string) => Promise<IAgentCategory | null>;
+  createCategory: (categoryData: Partial<IAgentCategory>) => Promise<IAgentCategory>;
+  updateCategory: (
+    value: string,
+    updateData: Partial<IAgentCategory>,
+  ) => Promise<IAgentCategory | null>;
+  deleteCategory: (value: string) => Promise<boolean>;
+  findCategoryById: (id: string | Types.ObjectId) => Promise<IAgentCategory | null>;
+  getAllCategories: () => Promise<IAgentCategory[]>;
+  ensureDefaultCategories: () => Promise<boolean>;
+} {
   /**
    * Get all active categories sorted by order
    * @returns Array of active categories
diff --git a/packages/data-schemas/src/methods/assistant.ts b/packages/data-schemas/src/methods/assistant.ts
index 798acb688cb..cc558ebc333 100644
--- a/packages/data-schemas/src/methods/assistant.ts
+++ b/packages/data-schemas/src/methods/assistant.ts
@@ -1,7 +1,19 @@
 import type { FilterQuery, Model } from 'mongoose';
 import type { IAssistant } from '~/types';
 
-export function createAssistantMethods(mongoose: typeof import('mongoose')) {
+export function createAssistantMethods(mongoose: typeof import('mongoose')): {
+  updateAssistantDoc: (
+    searchParams: FilterQuery<IAssistant>,
+    updateData: Partial<IAssistant>,
+  ) => Promise<IAssistant | null>;
+  deleteAssistant: (searchParams: FilterQuery<IAssistant>) => Promise<IAssistant | null>;
+  deleteAssistants: (searchParams: FilterQuery<IAssistant>) => Promise<number>;
+  getAssistants: (
+    searchParams: FilterQuery<IAssistant>,
+    select?: string | Record<string, number> | null,
+  ) => Promise<IAssistant[]>;
+  getAssistant: (searchParams: FilterQuery<IAssistant>) => Promise<IAssistant | null>;
+} {
   /**
    * Update an assistant with new data without overwriting existing properties,
    * or create a new assistant if it doesn't exist.
@@ -39,7 +51,9 @@ export function createAssistantMethods(mongoose: typeof import('mongoose')) {
   /**
    * Deletes an assistant based on the provided search params.
    */
-  async function deleteAssistant(searchParams: FilterQuery<IAssistant>) {
+  async function deleteAssistant(
+    searchParams: FilterQuery<IAssistant>,
+  ): Promise<IAssistant | null> {
     const Assistant = mongoose.models.Assistant as Model<IAssistant>;
     return await Assistant.findOneAndDelete(searchParams);
   }
diff --git a/packages/data-schemas/src/methods/auditLog.spec.ts b/packages/data-schemas/src/methods/auditLog.spec.ts
new file mode 100644
index 00000000000..aefdf34e817
--- /dev/null
+++ b/packages/data-schemas/src/methods/auditLog.spec.ts
@@ -0,0 +1,518 @@
+import mongoose, { Types } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { RecordAuditEntryInput } from '~/types';
+import type * as t from '~/types';
+import auditLogSchema, { GENESIS_HASH, PLATFORM_CHAIN_KEY } from '~/schema/auditLog';
+import { auditChainKey, createAuditLogMethods } from './auditLog';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+let mongoServer: MongoMemoryServer;
+let AuditLog: mongoose.Model<t.IAuditLog>;
+let methods: ReturnType<typeof createAuditLogMethods>;
+
+const actorObjectId = new Types.ObjectId();
+const CK_A = auditChainKey('tenant-a');
+const CK_B = auditChainKey('tenant-b');
+
+function baseInput(over: Partial<RecordAuditEntryInput> = {}): RecordAuditEntryInput {
+  return {
+    action: 'grant.assigned',
+    actor: { type: 'user', id: actorObjectId, name: 'Alice Admin' },
+    target: { type: 'role', id: 'ADMIN', name: 'ADMIN' },
+    metadata: { capability: 'manage:users' },
+    tenantId: 'tenant-a',
+    ...over,
+  };
+}
+
+async function seed(count: number, over: Partial<RecordAuditEntryInput> = {}): Promise<void> {
+  for (let i = 0; i < count; i++) {
+    await methods.recordAuditEntry(baseInput({ metadata: { capability: `cap:${i}` }, ...over }));
+  }
+}
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  AuditLog = mongoose.models.AuditLog || mongoose.model<t.IAuditLog>('AuditLog', auditLogSchema);
+  methods = createAuditLogMethods(mongoose);
+  await mongoose.connect(mongoServer.getUri());
+  await AuditLog.init();
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AuditLog.collection.deleteMany({});
+});
+
+describe('auditLog methods', () => {
+  describe('recordAuditEntry', () => {
+    it('persists a tenant-scoped entry with denormalized + derived fields', async () => {
+      const doc = await methods.recordAuditEntry(baseInput());
+      expect(doc).not.toBeNull();
+
+      const persisted = await AuditLog.findOne({ chainKey: CK_A }).lean();
+      expect(persisted).toMatchObject({
+        schemaVersion: 1,
+        category: 'grant',
+        action: 'grant.assigned',
+        outcome: 'success',
+        severity: 'info',
+        actor: { type: 'user', id: actorObjectId.toString(), name: 'Alice Admin' },
+        target: { type: 'role', id: 'ADMIN', name: 'ADMIN' },
+        metadata: { capability: 'manage:users' },
+        tenantId: 'tenant-a',
+        chainKey: CK_A,
+        seq: 1,
+        prevHash: GENESIS_HASH,
+      });
+      expect(persisted?.hash).toMatch(/^[a-f0-9]{64}$/);
+      expect(persisted?.createdAt).toBeInstanceOf(Date);
+    });
+
+    it('derives a warning severity for non-success outcomes', async () => {
+      await methods.recordAuditEntry(baseInput({ outcome: 'denied' }));
+      const persisted = await AuditLog.findOne({ chainKey: CK_A }).lean();
+      expect(persisted?.outcome).toBe('denied');
+      expect(persisted?.severity).toBe('warning');
+    });
+
+    it('starts each chain at the genesis hash and links subsequent entries', async () => {
+      const first = await methods.recordAuditEntry(baseInput());
+      const second = await methods.recordAuditEntry(baseInput());
+      expect(first?.seq).toBe(1);
+      expect(first?.prevHash).toBe(GENESIS_HASH);
+      expect(second?.seq).toBe(2);
+      expect(second?.prevHash).toBe(first?.hash);
+    });
+
+    it('keeps tenant and platform chains independent', async () => {
+      await methods.recordAuditEntry(baseInput({ tenantId: 'tenant-a' }));
+      await methods.recordAuditEntry(baseInput({ tenantId: 'tenant-b' }));
+      await methods.recordAuditEntry(baseInput({ tenantId: undefined }));
+
+      const a = await AuditLog.findOne({ chainKey: CK_A }).lean();
+      const b = await AuditLog.findOne({ chainKey: CK_B }).lean();
+      const platform = await AuditLog.findOne({ chainKey: PLATFORM_CHAIN_KEY }).lean();
+
+      expect(a?.seq).toBe(1);
+      expect(b?.seq).toBe(1);
+      expect(platform?.seq).toBe(1);
+      expect(platform?.tenantId).toBeUndefined();
+    });
+
+    it('treats a blank tenantId as platform scope (no literal "" stored)', async () => {
+      await methods.recordAuditEntry(baseInput({ tenantId: '   ' }));
+      const platform = await AuditLog.findOne({ chainKey: PLATFORM_CHAIN_KEY }).lean();
+      expect(platform).not.toBeNull();
+      expect(platform?.tenantId).toBeUndefined();
+      const blank = await AuditLog.findOne({ tenantId: '' }).lean();
+      expect(blank).toBeNull();
+    });
+
+    it('omits metadata/context entirely when empty', async () => {
+      await methods.recordAuditEntry(
+        baseInput({ metadata: {}, context: { ip: '', userAgent: undefined } }),
+      );
+      const persisted = await AuditLog.findOne({ chainKey: CK_A }).lean();
+      expect(persisted?.metadata).toBeUndefined();
+      expect(persisted?.context).toBeUndefined();
+    });
+
+    it('persists request context when provided', async () => {
+      await methods.recordAuditEntry(
+        baseInput({ context: { ip: '10.0.0.1', userAgent: 'jest', requestId: 'req-1' } }),
+      );
+      const persisted = await AuditLog.findOne({ chainKey: CK_A }).lean();
+      expect(persisted?.context).toMatchObject({
+        ip: '10.0.0.1',
+        userAgent: 'jest',
+        requestId: 'req-1',
+      });
+    });
+
+    it('fail-open returns null on write failure; fail-closed throws', async () => {
+      const spy = jest
+        .spyOn(AuditLog, 'create')
+        .mockRejectedValueOnce(new Error('boom'))
+        .mockRejectedValueOnce(new Error('boom'));
+
+      await expect(methods.recordAuditEntry(baseInput())).resolves.toBeNull();
+      await expect(methods.recordAuditEntry(baseInput(), { failClosed: true })).rejects.toThrow(
+        'boom',
+      );
+
+      spy.mockRestore();
+    });
+  });
+
+  describe('append-only enforcement', () => {
+    it('rejects every query-level update and delete path', async () => {
+      await methods.recordAuditEntry(baseInput());
+      await expect(
+        AuditLog.updateOne({ chainKey: CK_A }, { action: 'grant.removed' }),
+      ).rejects.toThrow(/append-only/);
+      await expect(AuditLog.updateMany({}, { seq: 9 })).rejects.toThrow(/append-only/);
+      await expect(AuditLog.findOneAndUpdate({}, { seq: 9 })).rejects.toThrow(/append-only/);
+      await expect(AuditLog.deleteOne({ chainKey: CK_A })).rejects.toThrow(/append-only/);
+      await expect(AuditLog.deleteMany({ chainKey: CK_A })).rejects.toThrow(/append-only/);
+      await expect(AuditLog.findOneAndDelete({})).rejects.toThrow(/append-only/);
+    });
+
+    it('rejects document-level re-save and deleteOne', async () => {
+      await methods.recordAuditEntry(baseInput());
+      const doc = await AuditLog.findOne({ chainKey: CK_A });
+      expect(doc).not.toBeNull();
+      await expect(doc!.save()).rejects.toThrow(/append-only/);
+      await expect(doc!.deleteOne()).rejects.toThrow(/append-only/);
+    });
+
+    it('rejects bulkWrite (which would bypass query/document middleware)', async () => {
+      await methods.recordAuditEntry(baseInput());
+      await expect(
+        AuditLog.bulkWrite([
+          {
+            updateOne: {
+              filter: { chainKey: CK_A },
+              update: { $set: { 'actor.name': 'x' } },
+            },
+          },
+        ]),
+      ).rejects.toThrow(/append-only/);
+    });
+
+    it('rejects insertMany (which would let callers poison the chain)', async () => {
+      await expect(
+        AuditLog.insertMany([
+          {
+            schemaVersion: 1,
+            category: 'grant',
+            action: 'grant.assigned',
+            outcome: 'success',
+            severity: 'info',
+            actor: { type: 'user', name: 'Mallory' },
+            target: { type: 'role', id: 'ADMIN', name: 'ADMIN' },
+            chainKey: CK_A,
+            seq: 999,
+            prevHash: GENESIS_HASH,
+            hash: 'f'.repeat(64),
+            createdAt: new Date(),
+          },
+        ]),
+      ).rejects.toThrow(/append-only/);
+    });
+  });
+
+  describe('listAuditLogPage', () => {
+    it('returns newest-first entries with total and nextCursor', async () => {
+      await seed(3);
+      const page = await methods.listAuditLogPage('tenant-a', { limit: 2 });
+      expect(page.total).toBe(3);
+      expect(page.entries).toHaveLength(2);
+      expect(page.entries[0].integrity.seq).toBe(3);
+      expect(page.entries[1].integrity.seq).toBe(2);
+      expect(page.nextCursor).toBe(2);
+    });
+
+    it('paginates by keyset cursor without duplicating rows under concurrent appends', async () => {
+      await seed(4);
+      const page1 = await methods.listAuditLogPage('tenant-a', { limit: 2 });
+      const seenIds = new Set(page1.entries.map((e) => e.id));
+      // a new entry lands at the head between page fetches
+      await methods.recordAuditEntry(baseInput());
+      const page2 = await methods.listAuditLogPage('tenant-a', {
+        limit: 2,
+        cursor: page1.nextCursor ?? undefined,
+      });
+      for (const entry of page2.entries) {
+        expect(seenIds.has(entry.id)).toBe(false);
+      }
+      expect(page2.entries.map((e) => e.integrity.seq)).toEqual([2, 1]);
+      expect(page2.nextCursor).toBeNull();
+    });
+
+    it('supports offset pagination', async () => {
+      await seed(3);
+      const page = await methods.listAuditLogPage('tenant-a', { limit: 1, offset: 1 });
+      expect(page.entries[0].integrity.seq).toBe(2);
+    });
+
+    it('isolates tenants', async () => {
+      await methods.recordAuditEntry(baseInput({ tenantId: 'tenant-a' }));
+      await methods.recordAuditEntry(baseInput({ tenantId: 'tenant-b' }));
+      const page = await methods.listAuditLogPage('tenant-a', {});
+      expect(page.total).toBe(1);
+      expect(page.entries[0].tenantId).toBe('tenant-a');
+    });
+
+    it('filters by action, outcome, severity, and actorType', async () => {
+      await methods.recordAuditEntry(baseInput({ action: 'grant.assigned' }));
+      await methods.recordAuditEntry(baseInput({ action: 'grant.removed', outcome: 'denied' }));
+
+      expect(
+        (await methods.listAuditLogPage('tenant-a', { action: ['grant.removed'] })).total,
+      ).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { outcome: ['denied'] })).total).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { severity: ['warning'] })).total).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { actorType: 'user' })).total).toBe(2);
+      expect((await methods.listAuditLogPage('tenant-a', { actorType: 'agent' })).total).toBe(0);
+    });
+
+    it('substring-matches actorQuery, targetQuery, and capability case-insensitively', async () => {
+      await methods.recordAuditEntry(
+        baseInput({
+          actor: { type: 'user', id: actorObjectId, name: 'Alice Admin' },
+          target: { type: 'role', id: 'ADMIN', name: 'ADMIN' },
+          metadata: { capability: 'manage:users' },
+        }),
+      );
+      expect((await methods.listAuditLogPage('tenant-a', { actorQuery: 'alice' })).total).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { targetQuery: 'admin' })).total).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { capability: 'manage' })).total).toBe(1);
+      expect((await methods.listAuditLogPage('tenant-a', { actorQuery: 'zzz' })).total).toBe(0);
+    });
+
+    it('filters by date window', async () => {
+      await seed(2);
+      const future = new Date(Date.now() + 60_000);
+      const past = new Date(Date.now() - 60_000);
+      expect((await methods.listAuditLogPage('tenant-a', { from: past, to: future })).total).toBe(
+        2,
+      );
+      expect((await methods.listAuditLogPage('tenant-a', { from: future })).total).toBe(0);
+    });
+  });
+
+  describe('findAuditLogEntry', () => {
+    it('returns a single entry scoped to its tenant', async () => {
+      const doc = await methods.recordAuditEntry(baseInput());
+      const id = doc!._id.toString();
+      const found = await methods.findAuditLogEntry('tenant-a', id);
+      expect(found?.id).toBe(id);
+      expect(await methods.findAuditLogEntry('tenant-b', id)).toBeNull();
+    });
+
+    it('returns null for a non-ObjectId id', async () => {
+      expect(await methods.findAuditLogEntry('tenant-a', 'not-an-id')).toBeNull();
+    });
+  });
+
+  describe('streamAuditLogEntries', () => {
+    it('streams all matching rows newest-first', async () => {
+      await seed(3);
+      const seen: number[] = [];
+      const { count, truncated } = await methods.streamAuditLogEntries('tenant-a', {}, (e) => {
+        seen.push(e.integrity.seq);
+      });
+      expect(count).toBe(3);
+      expect(truncated).toBe(false);
+      expect(seen).toEqual([3, 2, 1]);
+    });
+
+    it('honors isCancelled and reports truncation only when the cap cuts rows off', async () => {
+      await seed(5);
+      const cancelled = await methods.streamAuditLogEntries('tenant-a', {}, () => {}, {
+        isCancelled: () => true,
+      });
+      expect(cancelled.count).toBe(0);
+
+      const capped = await methods.streamAuditLogEntries('tenant-a', {}, () => {}, { maxRows: 2 });
+      expect(capped.count).toBe(2);
+      expect(capped.truncated).toBe(true);
+
+      // exact-cap match exhausts naturally and is NOT truncated
+      const exact = await methods.streamAuditLogEntries('tenant-a', {}, () => {}, { maxRows: 5 });
+      expect(exact.count).toBe(5);
+      expect(exact.truncated).toBe(false);
+    });
+  });
+
+  describe('verifyAuditChain', () => {
+    it('verifies an intact chain', async () => {
+      await seed(4);
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(true);
+      expect(result.checked).toBe(4);
+      expect(result.range).toEqual({ firstSeq: 1, lastSeq: 4 });
+    });
+
+    it('reports ok for an empty chain', async () => {
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(true);
+      expect(result.checked).toBe(0);
+    });
+
+    it('stops verification when the caller cancels', async () => {
+      await seed(3);
+      const result = await methods.verifyAuditChain('tenant-a', { isCancelled: () => true });
+      expect(result.ok).toBe(false);
+      expect(result.checked).toBe(0);
+      expect(result.reason).toBe('verification cancelled');
+    });
+
+    it('bounds verification when rows exceed the configured cap', async () => {
+      await seed(3);
+      const result = await methods.verifyAuditChain('tenant-a', { maxRows: 2 });
+      expect(result.ok).toBe(false);
+      expect(result.checked).toBe(2);
+      expect(result.brokenAt).toBe(3);
+      expect(result.reason).toMatch(/row limit exceeded/);
+    });
+
+    it('allows an exact-cap verification to complete', async () => {
+      await seed(2);
+      const result = await methods.verifyAuditChain('tenant-a', { maxRows: 2 });
+      expect(result.ok).toBe(true);
+      expect(result.checked).toBe(2);
+    });
+
+    it('detects a tampered field (hash mismatch)', async () => {
+      await seed(3);
+      // mutate a field via the raw driver, bypassing the append-only hooks
+      await AuditLog.collection.updateOne(
+        { chainKey: CK_A, seq: 2 },
+        { $set: { 'actor.name': 'Mallory' } },
+      );
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(false);
+      expect(result.brokenAt).toBe(2);
+      expect(result.reason).toBe('hash mismatch');
+    });
+
+    it('detects a deleted entry (sequence gap)', async () => {
+      await seed(3);
+      await AuditLog.collection.deleteOne({ chainKey: CK_A, seq: 2 });
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(false);
+      expect(result.reason).toMatch(/sequence gap/);
+    });
+
+    it('detects a forged hash link', async () => {
+      await seed(3);
+      await AuditLog.collection.updateOne(
+        { chainKey: CK_A, seq: 2 },
+        { $set: { hash: 'f'.repeat(64) } },
+      );
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(false);
+      expect(result.brokenAt).toBe(2);
+    });
+
+    it('does not silently trust a deleted prefix without a checkpoint', async () => {
+      await seed(3);
+      // attacker deletes the oldest row through the raw driver
+      await AuditLog.collection.deleteOne({ chainKey: CK_A, seq: 1 });
+      const result = await methods.verifyAuditChain('tenant-a');
+      expect(result.ok).toBe(false);
+      expect(result.brokenAt).toBe(2);
+      expect(result.reason).toMatch(/non-genesis|prefix/);
+    });
+
+    it('rejects a checkpoint that does not match the remaining chain', async () => {
+      await seed(3);
+      await AuditLog.collection.deleteOne({ chainKey: CK_A, seq: 1 });
+      const result = await methods.verifyAuditChain('tenant-a', {
+        trustedCheckpoint: { throughSeq: 1, prevHash: 'f'.repeat(64) },
+      });
+      expect(result.ok).toBe(false);
+      expect(result.reason).toMatch(/checkpoint mismatch/);
+    });
+  });
+
+  describe('purgeAuditLogEntries', () => {
+    it('is a no-op unless confirmed', async () => {
+      await seed(2);
+      const result = await methods.purgeAuditLogEntries('tenant-a', {
+        before: new Date(Date.now() + 60_000),
+        confirm: false,
+      });
+      expect(result.deletedCount).toBe(0);
+      expect(await AuditLog.countDocuments({ chainKey: CK_A })).toBe(2);
+    });
+
+    it('purges a prefix and leaves the chain verifiable from a checkpoint', async () => {
+      // space writes so createdAt is strictly increasing for a deterministic cutoff
+      for (let i = 0; i < 4; i++) {
+        await methods.recordAuditEntry(baseInput());
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      const third = await AuditLog.findOne({ chainKey: CK_A, seq: 3 }).lean();
+      const cutoff = third!.createdAt;
+
+      const result = await methods.purgeAuditLogEntries('tenant-a', {
+        before: cutoff,
+        confirm: true,
+      });
+      expect(result.deletedCount).toBeGreaterThanOrEqual(1);
+      expect(result.checkpoint?.throughSeq).toBeGreaterThanOrEqual(1);
+
+      // Without the checkpoint, the now non-genesis start is flagged, not trusted.
+      const unverified = await methods.verifyAuditChain('tenant-a');
+      expect(unverified.ok).toBe(false);
+
+      // With the checkpoint the purge returned, the shorter chain verifies.
+      const verified = await methods.verifyAuditChain('tenant-a', {
+        trustedCheckpoint: result.checkpoint,
+      });
+      expect(verified.ok).toBe(true);
+      expect(verified.range?.firstSeq).toBeGreaterThan(1);
+    });
+
+    it('purges only a contiguous seq prefix under createdAt clock skew', async () => {
+      for (let i = 0; i < 4; i++) {
+        await methods.recordAuditEntry(baseInput());
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      const fourth = await AuditLog.findOne({ chainKey: CK_A, seq: 4 }).lean();
+      // simulate multi-instance clock skew: the earliest seq carries a late timestamp
+      await AuditLog.collection.updateOne(
+        { chainKey: CK_A, seq: 1 },
+        { $set: { createdAt: new Date(fourth!.createdAt.getTime() + 60_000) } },
+      );
+      // a naive `createdAt < before` delete would drop interior rows (seq 2 & 3)
+      // while keeping seq 1, creating a gap — the seq-boundary purge must refuse,
+      // since seq 1 (the lowest seq) is now within the retention window.
+      const result = await methods.purgeAuditLogEntries('tenant-a', {
+        before: fourth!.createdAt,
+        confirm: true,
+      });
+      expect(result.deletedCount).toBe(0);
+      const remaining = await AuditLog.find({ chainKey: CK_A })
+        .sort({ seq: 1 })
+        .select('seq')
+        .lean<{ seq: number }[]>();
+      expect(remaining.map((r) => r.seq)).toEqual([1, 2, 3, 4]);
+    });
+
+    it('does not mint a checkpoint when a confirmed purge removed nothing', async () => {
+      await seed(2);
+      const result = await methods.purgeAuditLogEntries('tenant-a', {
+        // cutoff before every entry → nothing matches → no authorized prefix
+        before: new Date(Date.now() - 60_000),
+        confirm: true,
+      });
+      expect(result.deletedCount).toBe(0);
+      expect(result.checkpoint).toBeUndefined();
+    });
+  });
+
+  describe('append index safety', () => {
+    it('builds the unique seq index before appending (independent of autoIndex)', async () => {
+      const spy = jest.spyOn(AuditLog, 'createIndexes');
+      // a fresh methods instance has not yet memoized the index build
+      const freshMethods = createAuditLogMethods(mongoose);
+      await freshMethods.recordAuditEntry(baseInput());
+      expect(spy).toHaveBeenCalled();
+      spy.mockRestore();
+    });
+  });
+});
diff --git a/packages/data-schemas/src/methods/auditLog.ts b/packages/data-schemas/src/methods/auditLog.ts
new file mode 100644
index 00000000000..0ab6a7dd515
--- /dev/null
+++ b/packages/data-schemas/src/methods/auditLog.ts
@@ -0,0 +1,714 @@
+import { createHash } from 'node:crypto';
+import type { FilterQuery, Model } from 'mongoose';
+import type {
+  AdminAuditLogEntry,
+  AuditChainVerification,
+  AuditContext,
+  AuditLogFilters,
+  AuditLogPage,
+  AuditMetadata,
+  IAuditLog,
+  PurgeAuditLogOptions,
+  PurgeAuditLogResult,
+  RecordAuditEntryInput,
+  RecordAuditEntryOptions,
+  VerifyAuditChainOptions,
+} from '~/types';
+import { GENESIS_HASH, PLATFORM_CHAIN_KEY } from '~/schema/auditLog';
+import { AUDIT_ACTION_CATEGORY } from '~/types/admin';
+import logger from '~/config/winston';
+
+const DEFAULT_LIMIT = 100;
+export const MAX_AUDIT_LOG_LIMIT = 500;
+/**
+ * Upper bound on rows emitted by the CSV export stream. At 100k rows per tenant
+ * per export request, a careless admin script (or a hostile auditor) can keep a
+ * cursor and a Node worker busy without saturating either; beyond that, exports
+ * should be sliced by `from`/`to`.
+ */
+export const MAX_AUDIT_EXPORT_ROWS = 100_000;
+/**
+ * Upper bound on rows verified in a single HTTP-triggered integrity check. Full
+ * offline jobs can pass a larger value explicitly when needed.
+ */
+export const MAX_AUDIT_VERIFY_ROWS = 100_000;
+/** Record-format version stamped on every new entry. */
+export const AUDIT_SCHEMA_VERSION = 1;
+const MAX_SEARCH_LENGTH = 200;
+/**
+ * Retries when concurrent appends race for the same `seq`. Generous because a
+ * lost append on the default fail-open path means a silently missing audit row;
+ * with jittered backoff this resolves contention well beyond any realistic burst
+ * of parallel admin writes.
+ */
+const MAX_APPEND_RETRIES = 12;
+/** Base unit (ms) for jittered backoff between duplicate-key retries. */
+const APPEND_BACKOFF_MS = 5;
+const OBJECT_ID_RE = /^[a-fA-F0-9]{24}$/;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export interface AuditLogMethods {
+  recordAuditEntry: (
+    input: RecordAuditEntryInput,
+    options?: RecordAuditEntryOptions,
+  ) => Promise<IAuditLog | null>;
+  listAuditLogPage: (
+    tenantId: string | undefined,
+    filters: AuditLogFilters,
+  ) => Promise<AuditLogPage>;
+  findAuditLogEntry: (
+    tenantId: string | undefined,
+    id: string,
+  ) => Promise<AdminAuditLogEntry | null>;
+  streamAuditLogEntries: (
+    tenantId: string | undefined,
+    filters: Omit<AuditLogFilters, 'offset' | 'limit' | 'cursor'>,
+    onEntry: (entry: AdminAuditLogEntry) => void | Promise<void>,
+    options?: { isCancelled?: () => boolean; maxRows?: number },
+  ) => Promise<{ count: number; truncated: boolean }>;
+  verifyAuditChain: (
+    tenantId: string | undefined,
+    options?: VerifyAuditChainOptions,
+  ) => Promise<AuditChainVerification>;
+  purgeAuditLogEntries: (
+    tenantId: string | undefined,
+    options: PurgeAuditLogOptions,
+  ) => Promise<PurgeAuditLogResult>;
+}
+
+function escapeRegex(input: string): string {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function regexFilter(value: string): { $regex: string; $options: string } {
+  return { $regex: escapeRegex(value), $options: 'i' };
+}
+
+function oneOrIn<T>(values: T[]): T | { $in: T[] } {
+  return values.length === 1 ? values[0] : { $in: values };
+}
+
+function idToString(id: string | { toString(): string }): string {
+  return typeof id === 'string' ? id : id.toString();
+}
+
+function isDuplicateKeyError(err: unknown): boolean {
+  return typeof err === 'object' && err !== null && (err as { code?: number }).code === 11000;
+}
+
+/** Distinguishes tenant chains from the platform chain so a tenant whose id is
+ * literally the platform sentinel cannot share the platform's audit chain. */
+const TENANT_CHAIN_PREFIX = 'tenant:';
+
+/** Tenant scope → chain key. Blank/whitespace tenant is the platform chain;
+ * tenant ids are namespaced so they can never collide with `PLATFORM_CHAIN_KEY`. */
+export function auditChainKey(tenantId?: string): string {
+  return typeof tenantId === 'string' && tenantId.trim().length > 0
+    ? `${TENANT_CHAIN_PREFIX}${tenantId}`
+    : PLATFORM_CHAIN_KEY;
+}
+
+function normalizeTenantId(tenantId?: string): string | undefined {
+  return typeof tenantId === 'string' && tenantId.trim().length > 0 ? tenantId : undefined;
+}
+
+/** Drop undefined values; collapse an empty map to `undefined` so the field is
+ * omitted entirely (and hashes identically on read-back). */
+function normalizeMetadata(metadata?: AuditMetadata): AuditMetadata | undefined {
+  if (!metadata) return undefined;
+  const out: AuditMetadata = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (value !== undefined) out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+function normalizeContext(context?: AuditContext): AuditContext | undefined {
+  if (!context) return undefined;
+  const out: AuditContext = {};
+  if (context.requestId) out.requestId = context.requestId;
+  if (context.ip) out.ip = context.ip;
+  if (context.userAgent) out.userAgent = context.userAgent;
+  if (context.sessionId) out.sessionId = context.sessionId;
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+/** Deterministic JSON: object keys sorted recursively so two semantically equal
+ * entries always serialize to the same string. */
+function stableStringify(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? 'null';
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+  const record = value as Record<string, unknown>;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(record[k])}`).join(',')}}`;
+}
+
+/** Fields covered by the per-entry hash. Mirrors the stored shape so write-time
+ * and verify-time recomputation agree exactly. */
+interface HashableEntry {
+  schemaVersion: number;
+  category: IAuditLog['category'];
+  action: IAuditLog['action'];
+  outcome: IAuditLog['outcome'];
+  severity: IAuditLog['severity'];
+  actor: IAuditLog['actor'];
+  target: IAuditLog['target'];
+  metadata?: AuditMetadata;
+  context?: AuditContext;
+  tenantId?: string;
+  chainKey: string;
+  seq: number;
+  prevHash: string;
+  createdAt: Date;
+}
+
+function computeEntryHash(entry: HashableEntry): string {
+  const canonical = {
+    v: entry.schemaVersion,
+    category: entry.category,
+    action: entry.action,
+    outcome: entry.outcome,
+    severity: entry.severity,
+    actor: {
+      type: entry.actor.type,
+      id: entry.actor.id ?? null,
+      name: entry.actor.name,
+    },
+    target: {
+      type: entry.target.type,
+      id: entry.target.id ?? null,
+      name: entry.target.name ?? null,
+    },
+    metadata: entry.metadata ?? null,
+    context: entry.context
+      ? {
+          requestId: entry.context.requestId ?? null,
+          ip: entry.context.ip ?? null,
+          userAgent: entry.context.userAgent ?? null,
+          sessionId: entry.context.sessionId ?? null,
+        }
+      : null,
+    tenantId: entry.tenantId ?? null,
+    chainKey: entry.chainKey,
+    seq: entry.seq,
+    prevHash: entry.prevHash,
+    createdAt: entry.createdAt.toISOString(),
+  };
+  return createHash('sha256').update(stableStringify(canonical)).digest('hex');
+}
+
+function toWire(doc: IAuditLog): AdminAuditLogEntry {
+  const entry: AdminAuditLogEntry = {
+    id: doc._id.toString(),
+    schemaVersion: doc.schemaVersion,
+    category: doc.category,
+    action: doc.action,
+    outcome: doc.outcome,
+    severity: doc.severity,
+    actor: {
+      type: doc.actor.type,
+      name: doc.actor.name,
+      ...(doc.actor.id != null ? { id: doc.actor.id } : {}),
+    },
+    target: {
+      type: doc.target.type,
+      ...(doc.target.id != null ? { id: doc.target.id } : {}),
+      ...(doc.target.name != null ? { name: doc.target.name } : {}),
+    },
+    integrity: { seq: doc.seq, hash: doc.hash, prevHash: doc.prevHash },
+    timestamp: doc.createdAt.toISOString(),
+  };
+  if (doc.metadata != null) entry.metadata = doc.metadata;
+  const context = normalizeContext(doc.context);
+  if (context) entry.context = context;
+  if (doc.tenantId != null) entry.tenantId = doc.tenantId;
+  return entry;
+}
+
+function clampLimit(limit?: number): number {
+  if (!limit || Number.isNaN(limit) || limit < 1) return DEFAULT_LIMIT;
+  return Math.min(Math.floor(limit), MAX_AUDIT_LOG_LIMIT);
+}
+
+/**
+ * Builds the Mongo `find` filter for audit-log queries. Chain scoping is always
+ * applied first and uses the compound `{ chainKey, ... }` indexes. The substring
+ * regex filters (`actor.name`, `target.name`, `metadata.capability`, `search`)
+ * are case-insensitive and cannot use a B-tree index: within the chain slice
+ * they degrade to a partition scan. The primary listing combines `chainKey` with
+ * `seq`/`createdAt` pagination, so the scan stays bounded by the date window.
+ */
+function buildFilter(chainKey: string, filters: AuditLogFilters): FilterQuery<IAuditLog> {
+  const query: FilterQuery<IAuditLog> = { chainKey };
+
+  if (filters.category && filters.category.length > 0) {
+    query.category = oneOrIn(filters.category);
+  }
+  if (filters.action && filters.action.length > 0) {
+    query.action = oneOrIn(filters.action);
+  }
+  if (filters.outcome && filters.outcome.length > 0) {
+    query.outcome = oneOrIn(filters.outcome);
+  }
+  if (filters.severity && filters.severity.length > 0) {
+    query.severity = oneOrIn(filters.severity);
+  }
+  if (filters.actorType) {
+    query['actor.type'] = filters.actorType;
+  }
+  if (filters.actorQuery) {
+    query['actor.name'] = regexFilter(filters.actorQuery);
+  }
+  if (filters.targetType) {
+    query['target.type'] = filters.targetType;
+  }
+  if (filters.targetQuery) {
+    query['target.name'] = regexFilter(filters.targetQuery);
+  }
+  if (filters.capability) {
+    query['metadata.capability'] = regexFilter(filters.capability);
+  }
+  if (filters.from || filters.to) {
+    const createdAt: { $gte?: Date; $lte?: Date } = {};
+    if (filters.from) createdAt.$gte = filters.from;
+    if (filters.to) createdAt.$lte = filters.to;
+    query.createdAt = createdAt;
+  }
+  if (filters.search && filters.search.length > 0) {
+    const safe = regexFilter(filters.search.slice(0, MAX_SEARCH_LENGTH));
+    query.$or = [
+      { 'actor.name': safe },
+      { 'target.name': safe },
+      { action: safe },
+      { 'metadata.capability': safe },
+    ];
+  }
+
+  return query;
+}
+
+export function createAuditLogMethods(mongoose: typeof import('mongoose')): AuditLogMethods {
+  function model(): Model<IAuditLog> {
+    return mongoose.models.AuditLog as Model<IAuditLog>;
+  }
+
+  /**
+   * The read-then-create append only serializes concurrent writers when the
+   * unique `{ chainKey, seq }` index exists. With `MONGO_AUTO_INDEX=false`, or
+   * during the startup window before a background build finishes, two writers
+   * could insert the same `seq` with no duplicate-key error and silently fork
+   * the chain. Build the indexes once before the first append so serialization
+   * never depends on a background build. Memoized; reset on failure so a later
+   * write retries.
+   */
+  let indexPromise: Promise<unknown> | null = null;
+  function ensureIndexes(): Promise<unknown> {
+    if (!indexPromise) {
+      indexPromise = model()
+        .createIndexes()
+        .catch((err) => {
+          indexPromise = null;
+          throw err;
+        });
+    }
+    return indexPromise;
+  }
+
+  async function recordAuditEntry(
+    input: RecordAuditEntryInput,
+    options?: RecordAuditEntryOptions,
+  ): Promise<IAuditLog | null> {
+    const AuditLog = model();
+    const tenantId = normalizeTenantId(input.tenantId);
+    const chainKey = auditChainKey(input.tenantId);
+    const category = input.category ?? AUDIT_ACTION_CATEGORY[input.action];
+    const outcome = input.outcome ?? 'success';
+    const severity =
+      input.severity ?? (outcome === 'failure' || outcome === 'denied' ? 'warning' : 'info');
+    const actor = {
+      type: input.actor.type,
+      name: input.actor.name,
+      ...(input.actor.id != null ? { id: idToString(input.actor.id) } : {}),
+    };
+    const target = {
+      type: input.target.type,
+      ...(input.target.id != null ? { id: idToString(input.target.id) } : {}),
+      ...(input.target.name != null ? { name: input.target.name } : {}),
+    };
+    const metadata = normalizeMetadata(input.metadata);
+    const context = normalizeContext(input.context);
+
+    for (let attempt = 0; attempt < MAX_APPEND_RETRIES; attempt++) {
+      try {
+        /** Guarantee the unique seq index exists before serializing on it. */
+        await ensureIndexes();
+        const last = await AuditLog.findOne({ chainKey })
+          .sort({ seq: -1 })
+          .select('seq hash')
+          .lean<{ seq: number; hash: string }>();
+        const prevSeq = last?.seq ?? 0;
+        const prevHash = last?.hash ?? GENESIS_HASH;
+        const seq = prevSeq + 1;
+        const createdAt = new Date();
+        const hash = computeEntryHash({
+          schemaVersion: AUDIT_SCHEMA_VERSION,
+          category,
+          action: input.action,
+          outcome,
+          severity,
+          actor,
+          target,
+          metadata,
+          context,
+          tenantId,
+          chainKey,
+          seq,
+          prevHash,
+          createdAt,
+        });
+        const doc = await AuditLog.create({
+          schemaVersion: AUDIT_SCHEMA_VERSION,
+          category,
+          action: input.action,
+          outcome,
+          severity,
+          actor,
+          target,
+          ...(metadata !== undefined && { metadata }),
+          ...(context !== undefined && { context }),
+          ...(tenantId !== undefined && { tenantId }),
+          chainKey,
+          seq,
+          prevHash,
+          hash,
+          createdAt,
+        });
+        return doc;
+      } catch (err) {
+        if (isDuplicateKeyError(err) && attempt < MAX_APPEND_RETRIES - 1) {
+          /** Jittered backoff de-correlates racing writers before they recompute
+           * the tail `seq`, so the next attempt is very unlikely to collide. */
+          await sleep(Math.floor(Math.random() * APPEND_BACKOFF_MS * (attempt + 1)));
+          continue;
+        }
+        /**
+         * Fail-open by default: a failed write must never block the privileged
+         * operation, so it returns null and leaves a structured forensic trail.
+         * Callers that require a durable record pass `failClosed` to surface the
+         * failure instead.
+         */
+        logger.error('[auditLog] failed to record audit entry', {
+          action: input.action,
+          category,
+          outcome,
+          chainKey,
+          tenantId,
+          actorId: actor.id ?? null,
+          actorType: actor.type,
+          targetType: target.type,
+          targetId: target.id ?? null,
+          err,
+        });
+        if (options?.failClosed) {
+          throw err instanceof Error ? err : new Error('Failed to record audit entry');
+        }
+        return null;
+      }
+    }
+    return null;
+  }
+
+  async function listAuditLogPage(
+    tenantId: string | undefined,
+    filters: AuditLogFilters,
+  ): Promise<AuditLogPage> {
+    const AuditLog = model();
+    const chainKey = auditChainKey(tenantId);
+    const limit = clampLimit(filters.limit);
+    const base = buildFilter(chainKey, filters);
+
+    const cursorSeq =
+      typeof filters.cursor === 'number' && Number.isFinite(filters.cursor)
+        ? filters.cursor
+        : undefined;
+    const paged: FilterQuery<IAuditLog> =
+      cursorSeq !== undefined ? { ...base, seq: { $lt: cursorSeq } } : base;
+    const offset =
+      cursorSeq === undefined && filters.offset && filters.offset > 0
+        ? Math.floor(filters.offset)
+        : 0;
+
+    let pageQuery = AuditLog.find(paged)
+      .sort({ seq: -1 })
+      .limit(limit + 1);
+    if (offset > 0) pageQuery = pageQuery.skip(offset);
+
+    const [rowsPlusOne, total] = await Promise.all([
+      pageQuery.lean<IAuditLog[]>(),
+      AuditLog.countDocuments(base),
+    ]);
+
+    const hasMore = rowsPlusOne.length > limit;
+    const rows = hasMore ? rowsPlusOne.slice(0, limit) : rowsPlusOne;
+    const nextCursor = hasMore && rows.length > 0 ? rows[rows.length - 1].seq : null;
+
+    return { entries: rows.map(toWire), total, nextCursor };
+  }
+
+  async function findAuditLogEntry(
+    tenantId: string | undefined,
+    id: string,
+  ): Promise<AdminAuditLogEntry | null> {
+    if (!OBJECT_ID_RE.test(id)) return null;
+    const AuditLog = model();
+    const query: FilterQuery<IAuditLog> = { _id: id, chainKey: auditChainKey(tenantId) };
+    const doc = await AuditLog.findOne(query).lean<IAuditLog>();
+    return doc ? toWire(doc) : null;
+  }
+
+  async function streamAuditLogEntries(
+    tenantId: string | undefined,
+    filters: Omit<AuditLogFilters, 'offset' | 'limit' | 'cursor'>,
+    onEntry: (entry: AdminAuditLogEntry) => void | Promise<void>,
+    options?: { isCancelled?: () => boolean; maxRows?: number },
+  ): Promise<{ count: number; truncated: boolean }> {
+    const AuditLog = model();
+    const query = buildFilter(auditChainKey(tenantId), filters);
+    const cursor = AuditLog.find(query)
+      .sort({ seq: -1 })
+      .lean<IAuditLog[]>()
+      .cursor({ batchSize: 500 });
+
+    const isCancelled = options?.isCancelled;
+    const maxRows = options?.maxRows;
+    let count = 0;
+    let truncated = false;
+    try {
+      for await (const doc of cursor) {
+        if (isCancelled?.()) {
+          await cursor.close();
+          break;
+        }
+        if (maxRows != null && count >= maxRows) {
+          /** The cap fired only because at least one more row exists beyond it,
+           * so this is a genuine truncation — an exact-cap match exhausts the
+           * cursor naturally and never reaches here. */
+          truncated = true;
+          await cursor.close();
+          break;
+        }
+        await onEntry(toWire(doc));
+        count++;
+      }
+    } finally {
+      await cursor.close().catch(() => undefined);
+    }
+    return { count, truncated };
+  }
+
+  async function verifyAuditChain(
+    tenantId: string | undefined,
+    options?: VerifyAuditChainOptions,
+  ): Promise<AuditChainVerification> {
+    const AuditLog = model();
+    const chainKey = auditChainKey(tenantId);
+    const cursor = AuditLog.find({ chainKey })
+      .sort({ seq: 1 })
+      .lean<IAuditLog[]>()
+      .cursor({ batchSize: 500 });
+
+    const trustedCheckpoint = options?.trustedCheckpoint;
+    const isCancelled = options?.isCancelled;
+    const maxRows = options?.maxRows;
+    let prevHash = GENESIS_HASH;
+    let expectedSeq: number | null = null;
+    let firstSeq: number | null = null;
+    let lastSeq = 0;
+    let checked = 0;
+
+    try {
+      for await (const doc of cursor) {
+        if (isCancelled?.()) {
+          await cursor.close();
+          return {
+            ok: false,
+            chainKey,
+            checked,
+            reason: 'verification cancelled',
+            range: firstSeq !== null ? { firstSeq, lastSeq } : undefined,
+          };
+        }
+        if (maxRows != null && checked >= maxRows) {
+          await cursor.close();
+          return {
+            ok: false,
+            chainKey,
+            checked,
+            brokenAt: doc.seq,
+            reason: `verification row limit exceeded (${maxRows})`,
+            range:
+              firstSeq !== null ? { firstSeq, lastSeq } : { firstSeq: doc.seq, lastSeq: doc.seq },
+          };
+        }
+        if (firstSeq === null) {
+          firstSeq = doc.seq;
+          expectedSeq = doc.seq;
+          /**
+           * A non-genesis start (firstSeq > 1) means a prefix is gone. Only a
+           * matching trusted checkpoint proves it was an authorized retention
+           * purge; otherwise this is an attacker deleting the oldest rows, so we
+           * must NOT silently trust the first row's prevHash.
+           */
+          if (doc.seq === 1) {
+            prevHash = GENESIS_HASH;
+          } else if (
+            trustedCheckpoint &&
+            trustedCheckpoint.throughSeq === doc.seq - 1 &&
+            trustedCheckpoint.prevHash === doc.prevHash
+          ) {
+            prevHash = doc.prevHash;
+          } else {
+            await cursor.close();
+            return {
+              ok: false,
+              chainKey,
+              checked,
+              brokenAt: doc.seq,
+              reason: trustedCheckpoint
+                ? 'checkpoint mismatch: purged prefix does not match the trusted checkpoint'
+                : `non-genesis start at seq ${doc.seq}: prefix purged or deleted (supply a trusted checkpoint to verify)`,
+              range: { firstSeq, lastSeq: doc.seq },
+            };
+          }
+        }
+        if (doc.seq !== expectedSeq) {
+          return {
+            ok: false,
+            chainKey,
+            checked,
+            brokenAt: expectedSeq ?? doc.seq,
+            reason: `sequence gap: expected ${expectedSeq}, found ${doc.seq}`,
+            range: { firstSeq, lastSeq },
+          };
+        }
+        if (doc.prevHash !== prevHash) {
+          return {
+            ok: false,
+            chainKey,
+            checked,
+            brokenAt: doc.seq,
+            reason: 'broken hash link',
+            range: { firstSeq, lastSeq },
+          };
+        }
+        if (computeEntryHash(doc) !== doc.hash) {
+          return {
+            ok: false,
+            chainKey,
+            checked,
+            brokenAt: doc.seq,
+            reason: 'hash mismatch',
+            range: { firstSeq, lastSeq },
+          };
+        }
+        prevHash = doc.hash;
+        lastSeq = doc.seq;
+        expectedSeq = doc.seq + 1;
+        checked++;
+      }
+    } finally {
+      await cursor.close().catch(() => undefined);
+    }
+
+    return {
+      ok: true,
+      chainKey,
+      checked,
+      range: firstSeq !== null ? { firstSeq, lastSeq } : undefined,
+    };
+  }
+
+  async function purgeAuditLogEntries(
+    tenantId: string | undefined,
+    options: PurgeAuditLogOptions,
+  ): Promise<PurgeAuditLogResult> {
+    if (!options.confirm) return { deletedCount: 0 };
+    if (!(options.before instanceof Date) || Number.isNaN(options.before.getTime())) {
+      throw new Error('purgeAuditLogEntries: `before` must be a valid Date');
+    }
+    const AuditLog = model();
+    const chainKey = auditChainKey(tenantId);
+
+    /**
+     * Translate the date intent into a contiguous `seq` boundary before deleting.
+     * `createdAt` is app-generated, so under multi-instance clock skew a later
+     * `seq` can carry an earlier timestamp; a raw date delete could then remove
+     * an interior row and permanently break verification. Instead, find the
+     * earliest entry that must be retained (the first by `seq` whose `createdAt`
+     * is on/after `before`) and delete only the strictly-lower `seq` prefix. This
+     * never deletes past a retained entry, so the remaining chain stays
+     * contiguous even with skew (it may retain a few old rows, which is safe).
+     */
+    const firstRetained = await AuditLog.findOne({ chainKey, createdAt: { $gte: options.before } })
+      .sort({ seq: 1 })
+      .select('seq')
+      .lean<{ seq: number }>();
+
+    const deleteFilter: FilterQuery<IAuditLog> = firstRetained
+      ? { chainKey, seq: { $lt: firstRetained.seq } }
+      : { chainKey };
+
+    /**
+     * Retention purge is the one privileged path that removes audit rows. It
+     * intentionally uses the raw driver to bypass the append-only Mongoose hooks
+     * (the model blocks every delete). Tenant isolation is applied via `chainKey`.
+     */
+    // eslint-disable-next-line no-restricted-syntax -- privileged retention purge; append-only hooks block deleteMany, tenant scoped via chainKey
+    const result = await AuditLog.collection.deleteMany(deleteFilter);
+    const deletedCount = result.deletedCount ?? 0;
+
+    logger.warn('[auditLog] retention purge executed', {
+      chainKey,
+      before: options.before.toISOString(),
+      deletedCount,
+    });
+
+    /**
+     * Only a purge that actually removed rows may mint a trust boundary. A no-op
+     * purge returning a checkpoint for the current first entry would let a caller
+     * legitimize a prefix this purge never authorized (e.g. one an attacker
+     * deleted), so `verifyAuditChain` could be tricked into accepting it.
+     */
+    if (deletedCount === 0) {
+      return { deletedCount: 0 };
+    }
+
+    const newFirst = await AuditLog.findOne({ chainKey })
+      .sort({ seq: 1 })
+      .select('seq prevHash')
+      .lean<{ seq: number; prevHash: string }>();
+
+    return {
+      deletedCount,
+      /** Boundary for `verifyAuditChain`: the new earliest entry resumes the
+       * chain at `seq`, so the purged prefix ran through `seq - 1` and its last
+       * hash is this entry's `prevHash`. Callers persist this to later prove the
+       * purge was authorized. */
+      checkpoint: newFirst
+        ? { throughSeq: newFirst.seq - 1, prevHash: newFirst.prevHash }
+        : undefined,
+    };
+  }
+
+  return {
+    recordAuditEntry,
+    listAuditLogPage,
+    findAuditLogEntry,
+    streamAuditLogEntries,
+    verifyAuditChain,
+    purgeAuditLogEntries,
+  };
+}
diff --git a/packages/data-schemas/src/methods/banner.ts b/packages/data-schemas/src/methods/banner.ts
index 6ae4877207f..17bab9ddcd1 100644
--- a/packages/data-schemas/src/methods/banner.ts
+++ b/packages/data-schemas/src/methods/banner.ts
@@ -1,8 +1,10 @@
 import type { Model } from 'mongoose';
-import logger from '~/config/winston';
 import type { IBanner, IUser } from '~/types';
+import logger from '~/config/winston';
 
-export function createBannerMethods(mongoose: typeof import('mongoose')) {
+export function createBannerMethods(mongoose: typeof import('mongoose')): {
+  getBanner: (user?: IUser | null) => Promise<IBanner | null>;
+} {
   /**
    * Retrieves the current active banner.
    */
diff --git a/packages/data-schemas/src/methods/categories.ts b/packages/data-schemas/src/methods/categories.ts
index f15c67f1d11..8f8776c3982 100644
--- a/packages/data-schemas/src/methods/categories.ts
+++ b/packages/data-schemas/src/methods/categories.ts
@@ -1,12 +1,12 @@
 import logger from '~/config/winston';
 
-const options = [
-  { label: 'com_ui_dbaas', value: 'dbaas' },
-] as const;
+const options = [{ label: 'com_ui_dbaas', value: 'dbaas' }] as const;
 
 export type CategoryOption = { label: string; value: string };
 
-export function createCategoriesMethods(_mongoose: typeof import('mongoose')) {
+export function createCategoriesMethods(_mongoose: typeof import('mongoose')): {
+  getCategories: () => Promise<CategoryOption[]>;
+} {
   /**
    * Retrieves the categories.
    */
diff --git a/packages/data-schemas/src/methods/chatProject.spec.ts b/packages/data-schemas/src/methods/chatProject.spec.ts
new file mode 100644
index 00000000000..5563f90b6ca
--- /dev/null
+++ b/packages/data-schemas/src/methods/chatProject.spec.ts
@@ -0,0 +1,293 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels } from '~/models';
+import type { IChatProject, IConversation } from '~/types';
+import { createChatProjectMethods, type ChatProjectMethods } from './chatProject';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+let mongoServer: InstanceType<typeof MongoMemoryServer>;
+let ChatProject: mongoose.Model<IChatProject>;
+let Conversation: mongoose.Model<IConversation>;
+let methods: ChatProjectMethods;
+let modelsToCleanup: string[] = [];
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  const mongoUri = mongoServer.getUri();
+
+  const models = createModels(mongoose);
+  modelsToCleanup = Object.keys(models);
+  Object.assign(mongoose.models, models);
+
+  ChatProject = mongoose.models.ChatProject as mongoose.Model<IChatProject>;
+  Conversation = mongoose.models.Conversation as mongoose.Model<IConversation>;
+  methods = createChatProjectMethods(mongoose);
+
+  await mongoose.connect(mongoUri);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+
+  for (const modelName of modelsToCleanup) {
+    if (mongoose.models[modelName]) {
+      delete mongoose.models[modelName];
+    }
+  }
+});
+
+afterEach(async () => {
+  await ChatProject.deleteMany({});
+  await Conversation.deleteMany({});
+});
+
+async function createConversation(user: string, conversationId: string, title: string) {
+  return await Conversation.create({
+    conversationId,
+    title,
+    user,
+    endpoint: 'openAI',
+  });
+}
+
+describe('ChatProject methods', () => {
+  const user = 'user-1';
+  const otherUser = 'user-2';
+
+  it('creates, reads, updates, and lists private projects', async () => {
+    const project = await methods.createChatProject(user, {
+      name: 'Customer Alpha',
+      description: 'Support work',
+    });
+
+    expect(project.name).toBe('Customer Alpha');
+    expect(project.conversationCount).toBe(0);
+
+    const readProject = await methods.getChatProject(user, project._id!.toString());
+    expect(readProject?.description).toBe('Support work');
+
+    const updatedProject = await methods.updateChatProject(user, project._id!.toString(), {
+      name: 'Customer Alpha Updated',
+    });
+    expect(updatedProject?.name).toBe('Customer Alpha Updated');
+
+    const list = await methods.listChatProjects(user, { sortBy: 'name', sortDirection: 'asc' });
+    expect(list.projects).toHaveLength(1);
+    expect(list.projects[0].name).toBe('Customer Alpha Updated');
+  });
+
+  it('paginates projects deterministically when latest activity is null', async () => {
+    const staleProject = await methods.createChatProject(user, { name: 'Stale' });
+    await methods.createChatProject(user, { name: 'Quiet A' });
+    await methods.createChatProject(user, { name: 'Quiet B' });
+    const recentProject = await methods.createChatProject(user, { name: 'Recent' });
+
+    await ChatProject.updateOne(
+      { _id: staleProject._id },
+      { $set: { lastConversationAt: new Date('2026-01-01T00:00:00.000Z') } },
+    );
+    await ChatProject.updateOne(
+      { _id: recentProject._id },
+      { $set: { lastConversationAt: new Date('2026-02-01T00:00:00.000Z') } },
+    );
+
+    const firstPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 3,
+    });
+    const secondPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 3,
+      cursor: firstPage.nextCursor,
+    });
+    const names = [...firstPage.projects, ...secondPage.projects].map((project) => project.name);
+
+    expect(firstPage.projects[0].name).toBe('Recent');
+    expect(firstPage.projects[1].name).toBe('Stale');
+    expect(firstPage.nextCursor).toBeTruthy();
+    expect(secondPage.projects.every((project) => project.lastConversationAt == null)).toBe(true);
+    expect(names).toEqual(expect.arrayContaining(['Recent', 'Stale', 'Quiet A', 'Quiet B']));
+    expect(new Set(names).size).toBe(4);
+
+    const invalidCursor = Buffer.from(
+      JSON.stringify({ primary: 'not-a-date', id: recentProject._id!.toString() }),
+    ).toString('base64');
+    const invalidCursorPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 1,
+      cursor: invalidCursor,
+    });
+
+    expect(invalidCursorPage.projects[0].name).toBe('Recent');
+  });
+
+  it('paginates chat-less projects when a page ends on the last dated project', async () => {
+    const staleProject = await methods.createChatProject(user, { name: 'Stale' });
+    await methods.createChatProject(user, { name: 'Quiet A' });
+    await methods.createChatProject(user, { name: 'Quiet B' });
+    const recentProject = await methods.createChatProject(user, { name: 'Recent' });
+
+    await ChatProject.updateOne(
+      { _id: staleProject._id },
+      { $set: { lastConversationAt: new Date('2026-01-01T00:00:00.000Z') } },
+    );
+    await ChatProject.updateOne(
+      { _id: recentProject._id },
+      { $set: { lastConversationAt: new Date('2026-02-01T00:00:00.000Z') } },
+    );
+
+    // limit equals the number of dated projects, so the cursor lands on a dated
+    // project; the null (chat-less) projects must still appear on the next page.
+    const firstPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 2,
+    });
+    const secondPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 2,
+      cursor: firstPage.nextCursor,
+    });
+
+    expect(firstPage.projects.map((project) => project.name)).toEqual(['Recent', 'Stale']);
+    expect(firstPage.nextCursor).toBeTruthy();
+    expect(secondPage.projects.map((project) => project.name).sort()).toEqual([
+      'Quiet A',
+      'Quiet B',
+    ]);
+    expect(secondPage.projects.every((project) => project.lastConversationAt == null)).toBe(true);
+  });
+
+  it('assigns many conversations to one project and updates stats', async () => {
+    const project = await methods.createChatProject(user, { name: 'Customer Alpha' });
+    await createConversation(user, 'convo-1', 'First');
+    await createConversation(user, 'convo-2', 'Second');
+
+    await methods.assignConversationToProject(user, 'convo-1', project._id!.toString());
+    await methods.assignConversationToProject(user, 'convo-2', project._id!.toString());
+
+    const conversations = await Conversation.find({
+      user,
+      chatProjectId: project._id!.toString(),
+    }).lean<IConversation[]>();
+    const refreshedProject = await methods.getChatProject(user, project._id!.toString());
+
+    expect(conversations).toHaveLength(2);
+    expect(refreshedProject?.conversationCount).toBe(2);
+    expect(refreshedProject?.lastConversationId).toBeDefined();
+  });
+
+  it('excludes retention-hidden conversations from project stats', async () => {
+    const project = await methods.createChatProject(user, { name: 'Visible Stats' });
+    const chatProjectId = project._id!.toString();
+    const visibleDate = new Date('2026-01-01T00:00:00.000Z');
+    const hiddenDate = new Date('2026-02-01T00:00:00.000Z');
+
+    await Conversation.collection.insertMany([
+      {
+        conversationId: 'visible-convo',
+        title: 'Visible',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: false,
+        expiredAt: null,
+        createdAt: visibleDate,
+        updatedAt: visibleDate,
+      },
+      {
+        conversationId: 'temporary-convo',
+        title: 'Temporary',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: true,
+        expiredAt: new Date('2027-03-01T00:00:00.000Z'),
+        createdAt: hiddenDate,
+        updatedAt: hiddenDate,
+      },
+      {
+        conversationId: 'expired-convo',
+        title: 'Expired',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: false,
+        expiredAt: new Date('2025-12-01T00:00:00.000Z'),
+        createdAt: hiddenDate,
+        updatedAt: hiddenDate,
+      },
+    ]);
+
+    const refreshedProject = await methods.refreshChatProjectStats(user, chatProjectId);
+
+    expect(refreshedProject?.conversationCount).toBe(1);
+    expect(refreshedProject?.lastConversationId).toBe('visible-convo');
+    expect(refreshedProject?.lastConversationAt?.toISOString()).toBe(visibleDate.toISOString());
+  });
+
+  it('enforces one project per chat when moving conversations', async () => {
+    const firstProject = await methods.createChatProject(user, { name: 'First' });
+    const secondProject = await methods.createChatProject(user, { name: 'Second' });
+    await createConversation(user, 'convo-1', 'First');
+
+    await methods.assignConversationToProject(user, 'convo-1', firstProject._id!.toString());
+    await methods.assignConversationToProject(user, 'convo-1', secondProject._id!.toString());
+
+    const movedConversation = await Conversation.findOne({
+      user,
+      conversationId: 'convo-1',
+    }).lean<IConversation>();
+    const refreshedFirst = await methods.getChatProject(user, firstProject._id!.toString());
+    const refreshedSecond = await methods.getChatProject(user, secondProject._id!.toString());
+
+    expect(movedConversation?.chatProjectId).toBe(secondProject._id!.toString());
+    expect(refreshedFirst?.conversationCount).toBe(0);
+    expect(refreshedSecond?.conversationCount).toBe(1);
+  });
+
+  it('deleting a project unassigns chats instead of deleting them', async () => {
+    const project = await methods.createChatProject(user, { name: 'Delete me' });
+    await createConversation(user, 'convo-1', 'First');
+    await methods.assignConversationToProject(user, 'convo-1', project._id!.toString());
+
+    const result = await methods.deleteChatProject(user, project._id!.toString());
+    const conversation = await Conversation.findOne({
+      user,
+      conversationId: 'convo-1',
+    }).lean<IConversation>();
+
+    expect(result.deletedCount).toBe(1);
+    expect(result.modifiedCount).toBe(1);
+    expect(conversation).not.toBeNull();
+    expect(conversation?.chatProjectId).toBeUndefined();
+  });
+
+  it('isolates projects and assignments by user', async () => {
+    const project = await methods.createChatProject(user, { name: 'Mine' });
+    await createConversation(otherUser, 'convo-1', 'Theirs');
+
+    const otherRead = await methods.getChatProject(otherUser, project._id!.toString());
+    const assignment = await methods.assignConversationToProject(
+      user,
+      'convo-1',
+      project._id!.toString(),
+    );
+    const deleteResult = await methods.deleteChatProject(otherUser, project._id!.toString());
+
+    expect(otherRead).toBeNull();
+    expect(assignment).toBeNull();
+    expect(deleteResult.deletedCount).toBe(0);
+  });
+});
diff --git a/packages/data-schemas/src/methods/chatProject.ts b/packages/data-schemas/src/methods/chatProject.ts
new file mode 100644
index 00000000000..038a6a979a1
--- /dev/null
+++ b/packages/data-schemas/src/methods/chatProject.ts
@@ -0,0 +1,463 @@
+import type { FilterQuery, Model, SortOrder, Types } from 'mongoose';
+import logger from '~/config/winston';
+import { isValidObjectIdString } from '~/utils/objectId';
+import { buildRetentionVisibilityFilter } from '~/utils/retention';
+import { escapeRegExp } from '~/utils/string';
+import type { IChatProject, IChatProjectDocument, IConversation } from '~/types';
+
+export type ChatProjectSortBy = 'name' | 'createdAt' | 'lastConversationAt';
+export type ChatProjectSortDirection = 'asc' | 'desc';
+
+export type CreateChatProjectInput = {
+  name: string;
+  description?: string | null;
+};
+
+export type UpdateChatProjectInput = Partial<CreateChatProjectInput>;
+
+export type ListChatProjectsOptions = {
+  cursor?: string | null;
+  limit?: number;
+  sortBy?: ChatProjectSortBy;
+  sortDirection?: ChatProjectSortDirection;
+  search?: string;
+};
+
+export type ListChatProjectsResult = {
+  projects: IChatProject[];
+  nextCursor: string | null;
+};
+
+export type DeleteChatProjectResult = {
+  deletedCount: number;
+  modifiedCount: number;
+};
+
+export type AssignConversationToProjectResult = {
+  conversation: IConversation;
+  previousProjectId: string | null;
+  projectId: string | null;
+};
+
+export interface ChatProjectMethods {
+  createChatProject(user: string, input: CreateChatProjectInput): Promise<IChatProject>;
+  getChatProject(user: string, projectId: string): Promise<IChatProject | null>;
+  listChatProjects(
+    user: string,
+    options?: ListChatProjectsOptions,
+  ): Promise<ListChatProjectsResult>;
+  updateChatProject(
+    user: string,
+    projectId: string,
+    input: UpdateChatProjectInput,
+  ): Promise<IChatProject | null>;
+  deleteChatProject(user: string, projectId: string): Promise<DeleteChatProjectResult>;
+  assignConversationToProject(
+    user: string,
+    conversationId: string,
+    projectId: string | null,
+  ): Promise<AssignConversationToProjectResult | null>;
+  refreshChatProjectStats(user: string, projectId: string): Promise<IChatProject | null>;
+}
+
+type ProjectCursor = {
+  primary: string | null;
+  id: string;
+};
+
+type ProjectLean = IChatProject & { _id: Types.ObjectId };
+
+const VALID_SORT_FIELDS = new Set<ChatProjectSortBy>(['name', 'createdAt', 'lastConversationAt']);
+
+function normalizeSortBy(sortBy?: string): ChatProjectSortBy {
+  return VALID_SORT_FIELDS.has(sortBy as ChatProjectSortBy)
+    ? (sortBy as ChatProjectSortBy)
+    : 'lastConversationAt';
+}
+
+function normalizeSortDirection(sortDirection?: string): ChatProjectSortDirection {
+  return sortDirection === 'asc' ? 'asc' : 'desc';
+}
+
+function normalizeLimit(limit?: number): number {
+  if (!Number.isFinite(limit) || !limit) {
+    return 25;
+  }
+  return Math.min(Math.max(Math.floor(limit), 1), 100);
+}
+
+function sanitizeProjectInput(input: CreateChatProjectInput): CreateChatProjectInput {
+  return {
+    name: input.name.trim().slice(0, 100),
+    description: input.description?.trim().slice(0, 1000) ?? '',
+  };
+}
+
+function parseCursor(cursor?: string | null): ProjectCursor | null {
+  if (!cursor) {
+    return null;
+  }
+
+  try {
+    const decoded = JSON.parse(Buffer.from(cursor, 'base64').toString()) as ProjectCursor;
+    if (!decoded.id || !isValidObjectIdString(decoded.id)) {
+      return null;
+    }
+    return {
+      primary: decoded.primary ?? null,
+      id: decoded.id,
+    };
+  } catch {
+    logger.warn('[listChatProjects] Invalid cursor format, starting from beginning');
+    return null;
+  }
+}
+
+function encodeCursor(project: ProjectLean, sortBy: ChatProjectSortBy): string {
+  let primary: string | null = null;
+  if (sortBy === 'name') {
+    primary = project.name;
+  } else {
+    const date = project[sortBy];
+    primary = date instanceof Date ? date.toISOString() : null;
+  }
+  return Buffer.from(JSON.stringify({ primary, id: project._id.toString() })).toString('base64');
+}
+
+function cursorPrimaryValue(
+  primary: string | null,
+  sortBy: ChatProjectSortBy,
+): string | Date | null | undefined {
+  if (primary == null) {
+    return sortBy === 'lastConversationAt' ? null : undefined;
+  }
+
+  if (sortBy === 'name') {
+    return primary;
+  }
+
+  const date = new Date(primary);
+  return Number.isNaN(date.getTime()) ? undefined : date;
+}
+
+function createCursorFilter(
+  mongoose: typeof import('mongoose'),
+  cursor: ProjectCursor | null,
+  sortBy: ChatProjectSortBy,
+  sortDirection: ChatProjectSortDirection,
+): FilterQuery<IChatProjectDocument> | null {
+  if (!cursor) {
+    return null;
+  }
+
+  const op = sortDirection === 'asc' ? '$gt' : '$lt';
+  const id = new mongoose.Types.ObjectId(cursor.id);
+  const primary = cursorPrimaryValue(cursor.primary, sortBy);
+
+  if (primary === undefined) {
+    logger.warn('[listChatProjects] Invalid cursor primary value, starting from beginning');
+    return null;
+  }
+
+  const branches: FilterQuery<IChatProjectDocument>[] = [
+    { [sortBy]: { [op]: primary } },
+    { [sortBy]: primary, _id: { [op]: id } },
+  ];
+
+  /**
+   * Projects with no conversations have `lastConversationAt: null`, which sorts
+   * after all dated projects in descending order. A `$lt: <date>` predicate does
+   * not match null, so once the cursor moves past the dated projects we must
+   * include the null bucket explicitly, otherwise empty projects never paginate.
+   */
+  if (sortBy === 'lastConversationAt' && sortDirection === 'desc' && primary instanceof Date) {
+    branches.push({ lastConversationAt: null } as FilterQuery<IChatProjectDocument>);
+  }
+
+  return { $or: branches } as FilterQuery<IChatProjectDocument>;
+}
+
+function visibleProjectConversationFilter(
+  user: string,
+  projectId: string,
+): FilterQuery<IConversation> {
+  return {
+    $and: [
+      { user, chatProjectId: projectId },
+      { $or: [{ isArchived: false }, { isArchived: { $exists: false } }] },
+      buildRetentionVisibilityFilter<IConversation>(),
+    ],
+  } as FilterQuery<IConversation>;
+}
+
+export async function refreshChatProjectStatsForUser(
+  mongoose: typeof import('mongoose'),
+  user: string,
+  projectId: string,
+): Promise<IChatProject | null> {
+  if (!isValidObjectIdString(projectId)) {
+    return null;
+  }
+
+  const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+  const Conversation = mongoose.models.Conversation as Model<IConversation>;
+  const projectFilter = { _id: new mongoose.Types.ObjectId(projectId), user };
+  const conversationFilter = visibleProjectConversationFilter(user, projectId);
+
+  const [conversationCount, latestConversation] = await Promise.all([
+    Conversation.countDocuments(conversationFilter),
+    Conversation.findOne(conversationFilter)
+      .select('conversationId updatedAt createdAt')
+      .sort({ updatedAt: -1, _id: -1 })
+      .lean<IConversation>(),
+  ]);
+
+  return await ChatProject.findOneAndUpdate(
+    projectFilter,
+    {
+      $set: {
+        conversationCount,
+        lastConversationAt: latestConversation?.updatedAt ?? latestConversation?.createdAt ?? null,
+        lastConversationId: latestConversation?.conversationId ?? null,
+      },
+    },
+    { new: true },
+  ).lean<IChatProject>();
+}
+
+export async function updateChatProjectLastConversationForUser(
+  mongoose: typeof import('mongoose'),
+  user: string,
+  projectId: string,
+  conversation: Pick<IConversation, 'conversationId' | 'createdAt' | 'updatedAt'>,
+  incrementCount = false,
+): Promise<void> {
+  if (!isValidObjectIdString(projectId) || !conversation.conversationId) {
+    return;
+  }
+
+  const lastConversationAt = conversation.updatedAt ?? conversation.createdAt ?? new Date();
+  const update: Record<string, unknown> = {
+    $set: {
+      lastConversationAt,
+      lastConversationId: conversation.conversationId,
+    },
+  };
+  if (incrementCount) {
+    update.$inc = { conversationCount: 1 };
+  }
+
+  const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+  await ChatProject.updateOne({ _id: new mongoose.Types.ObjectId(projectId), user }, update);
+}
+
+export function createChatProjectMethods(mongoose: typeof import('mongoose')): ChatProjectMethods {
+  async function createChatProject(
+    user: string,
+    input: CreateChatProjectInput,
+  ): Promise<IChatProject> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const sanitized = sanitizeProjectInput(input);
+    if (!sanitized.name) {
+      throw new Error('Project name is required');
+    }
+
+    const project = await ChatProject.create({
+      ...sanitized,
+      user,
+      conversationCount: 0,
+      lastConversationAt: null,
+      lastConversationId: null,
+    });
+    return project.toObject() as IChatProject;
+  }
+
+  async function getChatProject(user: string, projectId: string): Promise<IChatProject | null> {
+    if (!isValidObjectIdString(projectId)) {
+      return null;
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    return await ChatProject.findOne({
+      _id: new mongoose.Types.ObjectId(projectId),
+      user,
+    }).lean<IChatProject>();
+  }
+
+  async function listChatProjects(
+    user: string,
+    options: ListChatProjectsOptions = {},
+  ): Promise<ListChatProjectsResult> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const limit = normalizeLimit(options.limit);
+    const sortBy = normalizeSortBy(options.sortBy);
+    const sortDirection = normalizeSortDirection(options.sortDirection);
+    const sortOrder: SortOrder = sortDirection === 'asc' ? 1 : -1;
+    const filters: FilterQuery<IChatProjectDocument>[] = [{ user }];
+
+    if (options.search?.trim()) {
+      filters.push({ name: { $regex: escapeRegExp(options.search.trim()), $options: 'i' } });
+    }
+
+    const cursorFilter = createCursorFilter(
+      mongoose,
+      parseCursor(options.cursor),
+      sortBy,
+      sortDirection,
+    );
+    if (cursorFilter) {
+      filters.push(cursorFilter);
+    }
+
+    const query =
+      filters.length === 1 ? filters[0] : ({ $and: filters } as FilterQuery<IChatProjectDocument>);
+    const projects = await ChatProject.find(query)
+      .sort({ [sortBy]: sortOrder, _id: sortOrder })
+      .limit(limit + 1)
+      .lean<ProjectLean[]>();
+
+    let nextCursor: string | null = null;
+    if (projects.length > limit) {
+      projects.pop();
+      const lastProject = projects[projects.length - 1];
+      if (lastProject) {
+        nextCursor = encodeCursor(lastProject, sortBy);
+      }
+    }
+
+    return { projects, nextCursor };
+  }
+
+  async function updateChatProject(
+    user: string,
+    projectId: string,
+    input: UpdateChatProjectInput,
+  ): Promise<IChatProject | null> {
+    if (!isValidObjectIdString(projectId)) {
+      return null;
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const update: Partial<Pick<IChatProject, 'name' | 'description'>> = {};
+    if (typeof input.name === 'string') {
+      const name = input.name.trim().slice(0, 100);
+      if (!name) {
+        throw new Error('Project name is required');
+      }
+      update.name = name;
+    }
+    if (input.description !== undefined) {
+      update.description = input.description?.trim().slice(0, 1000) ?? '';
+    }
+
+    return await ChatProject.findOneAndUpdate(
+      { _id: new mongoose.Types.ObjectId(projectId), user },
+      { $set: update },
+      { new: true, runValidators: true },
+    ).lean<IChatProject>();
+  }
+
+  async function deleteChatProject(
+    user: string,
+    projectId: string,
+  ): Promise<DeleteChatProjectResult> {
+    if (!isValidObjectIdString(projectId)) {
+      return { deletedCount: 0, modifiedCount: 0 };
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const Conversation = mongoose.models.Conversation as Model<IConversation>;
+    const projectFilter = { _id: new mongoose.Types.ObjectId(projectId), user };
+    const project = await ChatProject.findOne(projectFilter).select('_id').lean<IChatProject>();
+    if (!project) {
+      return { deletedCount: 0, modifiedCount: 0 };
+    }
+
+    const [conversationResult, deleteResult] = await Promise.all([
+      Conversation.updateMany(
+        { user, chatProjectId: projectId },
+        { $unset: { chatProjectId: '' } },
+      ),
+      ChatProject.deleteOne(projectFilter),
+    ]);
+
+    return {
+      deletedCount: deleteResult.deletedCount ?? 0,
+      modifiedCount: conversationResult.modifiedCount ?? 0,
+    };
+  }
+
+  async function assignConversationToProject(
+    user: string,
+    conversationId: string,
+    projectId: string | null,
+  ): Promise<AssignConversationToProjectResult | null> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const Conversation = mongoose.models.Conversation as Model<IConversation>;
+    const conversation = await Conversation.findOne({ user, conversationId }).lean<IConversation>();
+    if (!conversation) {
+      return null;
+    }
+
+    const normalizedProjectId = projectId || null;
+    if (normalizedProjectId) {
+      if (!isValidObjectIdString(normalizedProjectId)) {
+        throw new Error('Project not found');
+      }
+      const project = await ChatProject.findOne({
+        _id: new mongoose.Types.ObjectId(normalizedProjectId),
+        user,
+      })
+        .select('_id')
+        .lean<IChatProject>();
+      if (!project) {
+        throw new Error('Project not found');
+      }
+    }
+
+    const previousProjectId = conversation.chatProjectId ?? null;
+    const update =
+      normalizedProjectId == null
+        ? { $unset: { chatProjectId: '' } }
+        : { $set: { chatProjectId: normalizedProjectId } };
+    const updatedConversation = await Conversation.findOneAndUpdate(
+      { user, conversationId },
+      update,
+      { new: true },
+    ).lean<IConversation>();
+
+    if (!updatedConversation) {
+      return null;
+    }
+
+    const projectIds = new Set(
+      [previousProjectId, normalizedProjectId].filter((id): id is string => Boolean(id)),
+    );
+    await Promise.all(
+      [...projectIds].map((id) => refreshChatProjectStatsForUser(mongoose, user, id)),
+    );
+
+    return {
+      conversation: updatedConversation,
+      previousProjectId,
+      projectId: normalizedProjectId,
+    };
+  }
+
+  async function refreshChatProjectStats(
+    user: string,
+    projectId: string,
+  ): Promise<IChatProject | null> {
+    return await refreshChatProjectStatsForUser(mongoose, user, projectId);
+  }
+
+  return {
+    createChatProject,
+    getChatProject,
+    listChatProjects,
+    updateChatProject,
+    deleteChatProject,
+    assignConversationToProject,
+    refreshChatProjectStats,
+  };
+}
diff --git a/packages/data-schemas/src/methods/config.spec.ts b/packages/data-schemas/src/methods/config.spec.ts
index 8ab6be35eef..5111a915e6b 100644
--- a/packages/data-schemas/src/methods/config.spec.ts
+++ b/packages/data-schemas/src/methods/config.spec.ts
@@ -1,9 +1,9 @@
 import mongoose, { Types } from 'mongoose';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import { PrincipalType, PrincipalModel } from 'librechat-data-provider';
+import type { IConfig } from '~/types';
 import { createConfigMethods } from './config';
 import configSchema from '~/schema/config';
-import type { IConfig } from '~/types';
 
 let mongoServer: MongoMemoryServer;
 let methods: ReturnType<typeof createConfigMethods>;
@@ -26,7 +26,7 @@ beforeEach(async () => {
   await mongoose.models.Config.deleteMany({});
 });
 
-describe('upsertConfig', () => {
+describe('upsertConfig tombstone preservation', () => {
   it('creates a new config document', async () => {
     const result = await methods.upsertConfig(
       PrincipalType.ROLE,
@@ -270,6 +270,137 @@ describe('patchConfigFields', () => {
     expect(result).toBeTruthy();
     expect(result!.principalId).toBe('newrole');
   });
+
+  it('clears tombstones for patched paths and their ancestors', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.patchConfigFields(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { 'mcpServers.github.url': 'https://scoped.example.com' },
+      10,
+    );
+
+    expect(result!.tombstones).not.toContain('mcpServers.github');
+  });
+
+  it('does not clear a whole-section tombstone when patching a nested path', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers',
+      10,
+    );
+
+    const result = await methods.patchConfigFields(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { 'mcpServers.github.url': 'https://scoped.example.com' },
+      10,
+    );
+
+    expect(result!.tombstones).toContain('mcpServers');
+  });
+});
+
+describe('tombstoneConfigField', () => {
+  it('adds a tombstone and removes the overridden subtree', async () => {
+    await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {
+        mcpServers: {
+          github: {
+            type: 'streamable-http',
+            url: 'https://github.example.com',
+          },
+          slack: {
+            type: 'streamable-http',
+            url: 'https://slack.example.com',
+          },
+        },
+      },
+      10,
+    );
+
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+    const overrides = result!.overrides as Record<string, unknown>;
+    const mcpServers = overrides.mcpServers as Record<string, unknown>;
+
+    expect(result!.tombstones).toContain('mcpServers.github');
+    expect(mcpServers.github).toBeUndefined();
+    expect(mcpServers.slack).toEqual({
+      type: 'streamable-http',
+      url: 'https://slack.example.com',
+    });
+  });
+
+  it('creates a config if none exists', async () => {
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    expect(result).toBeTruthy();
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
+
+  it('preserves inactive configs when adding a tombstone', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 10);
+    await methods.toggleConfigActive(PrincipalType.ROLE, 'admin', false);
+
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    expect(result!.isActive).toBe(false);
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
+});
+
+describe('upsertConfig', () => {
+  it('preserves tombstones when replacing overrides', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { interface: { modelSelect: false } },
+      10,
+    );
+
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
 });
 
 describe('unsetConfigField', () => {
@@ -297,6 +428,20 @@ describe('unsetConfigField', () => {
     const result = await methods.unsetConfigField(PrincipalType.ROLE, 'ghost', 'a.b');
     expect(result).toBeNull();
   });
+
+  it('clears tombstones for the reset path and descendants', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.unsetConfigField(PrincipalType.ROLE, 'admin', 'mcpServers.github');
+
+    expect(result!.tombstones).not.toContain('mcpServers.github');
+  });
 });
 
 describe('deleteConfig', () => {
@@ -331,3 +476,172 @@ describe('toggleConfigActive', () => {
     expect(result!.isActive).toBe(true);
   });
 });
+
+describe('expectEmpty atomic guard', () => {
+  it('deleteConfig with expectEmpty matches and deletes an empty doc', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 10);
+
+    const result = await methods.deleteConfig(PrincipalType.ROLE, 'admin', undefined, {
+      expectEmpty: true,
+    });
+    expect(result).toBeTruthy();
+
+    const remaining = await mongoose.models.Config.countDocuments({});
+    expect(remaining).toBe(0);
+  });
+
+  it('deleteConfig with expectEmpty returns null when overrides is non-empty (doc preserved)', async () => {
+    await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { interface: { modelSelect: false } },
+      10,
+    );
+
+    const result = await methods.deleteConfig(PrincipalType.ROLE, 'admin', undefined, {
+      expectEmpty: true,
+    });
+    expect(result).toBeNull();
+
+    const remaining = await mongoose.models.Config.countDocuments({});
+    expect(remaining).toBe(1);
+  });
+
+  it('deleteConfig with expectEmpty returns null when tombstones is non-empty (doc preserved)', async () => {
+    await mongoose.models.Config.create({
+      principalType: PrincipalType.ROLE,
+      principalId: 'admin',
+      principalModel: PrincipalModel.ROLE,
+      overrides: {},
+      tombstones: ['endpoints.openai.apiKey'],
+      priority: 10,
+      isActive: true,
+      configVersion: 1,
+    });
+
+    const result = await methods.deleteConfig(PrincipalType.ROLE, 'admin', undefined, {
+      expectEmpty: true,
+    });
+    expect(result).toBeNull();
+
+    const remaining = await mongoose.models.Config.countDocuments({});
+    expect(remaining).toBe(1);
+  });
+
+  it('toggleConfigActive with expectEmpty matches and toggles an empty doc', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 10);
+
+    const result = await methods.toggleConfigActive(PrincipalType.ROLE, 'admin', false, undefined, {
+      expectEmpty: true,
+    });
+    expect(result).toBeTruthy();
+    expect(result!.isActive).toBe(false);
+  });
+
+  it('toggleConfigActive with expectEmpty returns null on non-empty doc (isActive preserved)', async () => {
+    await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { interface: { modelSelect: false } },
+      10,
+    );
+
+    const result = await methods.toggleConfigActive(PrincipalType.ROLE, 'admin', false, undefined, {
+      expectEmpty: true,
+    });
+    expect(result).toBeNull();
+
+    const doc = await methods.findConfigByPrincipal(PrincipalType.ROLE, 'admin');
+    expect(doc!.isActive).toBe(true);
+  });
+
+  it('upsertConfig with expectEmpty inserts when no doc exists', async () => {
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {},
+      10,
+      undefined,
+      { expectEmpty: true },
+    );
+    expect(result).toBeTruthy();
+    expect(result!.principalId).toBe('admin');
+  });
+
+  it('upsertConfig with expectEmpty updates an empty existing doc', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 5);
+
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {},
+      99,
+      undefined,
+      { expectEmpty: true },
+    );
+    expect(result).toBeTruthy();
+    expect(result!.priority).toBe(99);
+  });
+
+  it('upsertConfig with preservePriority inserts with the requested priority', async () => {
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {},
+      10,
+      undefined,
+      { expectEmpty: true, preservePriority: true },
+    );
+
+    expect(result).toBeTruthy();
+    expect(result!.priority).toBe(10);
+  });
+
+  it('upsertConfig with preservePriority keeps an empty existing doc priority', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 5);
+
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {},
+      99,
+      undefined,
+      { expectEmpty: true, preservePriority: true },
+    );
+
+    expect(result).toBeTruthy();
+    expect(result!.priority).toBe(5);
+    expect(result!.configVersion).toBe(2);
+  });
+
+  it('upsertConfig with expectEmpty returns null when existing doc has non-empty overrides', async () => {
+    await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { interface: { modelSelect: false } },
+      10,
+    );
+
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {},
+      99,
+      undefined,
+      { expectEmpty: true },
+    );
+    expect(result).toBeNull();
+
+    const doc = await methods.findConfigByPrincipal(PrincipalType.ROLE, 'admin');
+    expect(doc!.priority).toBe(10);
+    expect(Object.keys(doc!.overrides ?? {}).length).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/data-schemas/src/methods/config.ts b/packages/data-schemas/src/methods/config.ts
index 68deed3ae01..16f94efd9ea 100644
--- a/packages/data-schemas/src/methods/config.ts
+++ b/packages/data-schemas/src/methods/config.ts
@@ -1,11 +1,80 @@
 import { Types } from 'mongoose';
 import { PrincipalType, PrincipalModel } from 'librechat-data-provider';
-import { BASE_CONFIG_PRINCIPAL_ID } from '~/admin/capabilities';
+import type { FilterQuery, Model, ClientSession } from 'mongoose';
 import type { TCustomConfig } from 'librechat-data-provider';
-import type { Model, ClientSession } from 'mongoose';
 import type { IConfig } from '~/types';
+import { BASE_CONFIG_PRINCIPAL_ID } from '~/admin/capabilities';
+import { escapeRegExp } from '~/utils/string';
+
+function getTombstonePathsToClear(fieldPath: string): string[] {
+  const parts = fieldPath.split('.');
+  if (parts.length <= 1) {
+    return [fieldPath];
+  }
+  return parts.slice(1).map((_, index) => parts.slice(0, index + 2).join('.'));
+}
 
-export function createConfigMethods(mongoose: typeof import('mongoose')) {
+function getPathAndDescendantsRegex(fieldPath: string): RegExp {
+  return new RegExp(`^${escapeRegExp(fieldPath)}(?:\\.|$)`);
+}
+
+export function createConfigMethods(mongoose: typeof import('mongoose')): {
+  listAllConfigs: (filter?: { isActive?: boolean }, session?: ClientSession) => Promise<IConfig[]>;
+  findConfigByPrincipal: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    options?: { includeInactive?: boolean },
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  getApplicableConfigs: (
+    principals?: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    session?: ClientSession,
+  ) => Promise<IConfig[]>;
+  upsertConfig: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    overrides: Partial<TCustomConfig>,
+    priority: number,
+    session?: ClientSession,
+    options?: { expectEmpty?: boolean; preservePriority?: boolean },
+  ) => Promise<IConfig | null>;
+  patchConfigFields: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fields: Record<string, unknown>,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  tombstoneConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  unsetConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    fieldPath: string,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  deleteConfig: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    session?: ClientSession,
+    options?: { expectEmpty?: boolean },
+  ) => Promise<IConfig | null>;
+  toggleConfigActive: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    isActive: boolean,
+    session?: ClientSession,
+    options?: { expectEmpty?: boolean },
+  ) => Promise<IConfig | null>;
+} {
   async function findConfigByPrincipal(
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
@@ -80,25 +149,33 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     overrides: Partial<TCustomConfig>,
     priority: number,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean; preservePriority?: boolean },
   ): Promise<IConfig | null> {
     const Config = mongoose.models.Config as Model<IConfig>;
 
-    const query = {
+    const query: FilterQuery<IConfig> = {
       principalType,
       principalId: principalId.toString(),
     };
+    if (options?.expectEmpty) {
+      query.$and = [
+        { $or: [{ overrides: { $eq: {} } }, { overrides: { $exists: false } }] },
+        { $or: [{ tombstones: { $size: 0 } }, { tombstones: { $exists: false } }] },
+      ];
+    }
 
     const update = {
       $set: {
         principalModel,
         overrides,
-        priority,
+        ...(options?.preservePriority ? {} : { priority }),
         isActive: true,
       },
+      ...(options?.preservePriority ? { $setOnInsert: { priority } } : {}),
       $inc: { configVersion: 1 },
     };
 
-    const options = {
+    const mongoOptions = {
       upsert: true,
       new: true,
       setDefaultsOnInsert: true,
@@ -106,11 +183,14 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     };
 
     try {
-      return await Config.findOneAndUpdate(query, update, options);
+      return await Config.findOneAndUpdate(query, update, mongoOptions);
     } catch (err: unknown) {
       if ((err as { code?: number }).code === 11000) {
+        if (options?.expectEmpty) {
+          return null;
+        }
         return await Config.findOneAndUpdate(
-          query,
+          { principalType, principalId: principalId.toString() },
           { $set: update.$set, $inc: update.$inc },
           { new: true, ...(session ? { session } : {}) },
         );
@@ -139,6 +219,40 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
       setPayload[`overrides.${path}`] = value;
     }
 
+    const tombstonesToClear = [...new Set(Object.keys(fields).flatMap(getTombstonePathsToClear))];
+
+    const options = {
+      upsert: true,
+      new: true,
+      setDefaultsOnInsert: true,
+      ...(session ? { session } : {}),
+    };
+
+    const update: Record<string, unknown> = {
+      $set: setPayload,
+      $inc: { configVersion: 1 },
+    };
+    if (tombstonesToClear.length > 0) {
+      update.$pull = { tombstones: { $in: tombstonesToClear } };
+    }
+
+    return await Config.findOneAndUpdate(
+      { principalType, principalId: principalId.toString() },
+      update,
+      options,
+    );
+  }
+
+  async function tombstoneConfigField(
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ): Promise<IConfig | null> {
+    const Config = mongoose.models.Config as Model<IConfig>;
+
     const options = {
       upsert: true,
       new: true,
@@ -148,7 +262,15 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
 
     return await Config.findOneAndUpdate(
       { principalType, principalId: principalId.toString() },
-      { $set: setPayload, $inc: { configVersion: 1 } },
+      {
+        $set: {
+          principalModel,
+          priority,
+        },
+        $unset: { [`overrides.${fieldPath}`]: '' },
+        $addToSet: { tombstones: fieldPath },
+        $inc: { configVersion: 1 },
+      },
       options,
     );
   }
@@ -168,7 +290,11 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
 
     return await Config.findOneAndUpdate(
       { principalType, principalId: principalId.toString() },
-      { $unset: { [`overrides.${fieldPath}`]: '' }, $inc: { configVersion: 1 } },
+      {
+        $unset: { [`overrides.${fieldPath}`]: '' },
+        $pull: { tombstones: { $regex: getPathAndDescendantsRegex(fieldPath) } },
+        $inc: { configVersion: 1 },
+      },
       options,
     );
   }
@@ -177,13 +303,20 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean },
   ): Promise<IConfig | null> {
     const Config = mongoose.models.Config as Model<IConfig>;
-
-    return await Config.findOneAndDelete({
+    const filter: FilterQuery<IConfig> = {
       principalType,
       principalId: principalId.toString(),
-    }).session(session ?? null);
+    };
+    if (options?.expectEmpty) {
+      filter.$and = [
+        { $or: [{ overrides: { $eq: {} } }, { overrides: { $exists: false } }] },
+        { $or: [{ tombstones: { $size: 0 } }, { tombstones: { $exists: false } }] },
+      ];
+    }
+    return await Config.findOneAndDelete(filter).session(session ?? null);
   }
 
   async function toggleConfigActive(
@@ -191,10 +324,21 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     principalId: string | Types.ObjectId,
     isActive: boolean,
     session?: ClientSession,
+    options?: { expectEmpty?: boolean },
   ): Promise<IConfig | null> {
     const Config = mongoose.models.Config as Model<IConfig>;
+    const filter: FilterQuery<IConfig> = {
+      principalType,
+      principalId: principalId.toString(),
+    };
+    if (options?.expectEmpty) {
+      filter.$and = [
+        { $or: [{ overrides: { $eq: {} } }, { overrides: { $exists: false } }] },
+        { $or: [{ tombstones: { $size: 0 } }, { tombstones: { $exists: false } }] },
+      ];
+    }
     return await Config.findOneAndUpdate(
-      { principalType, principalId: principalId.toString() },
+      filter,
       { $set: { isActive } },
       { new: true, ...(session ? { session } : {}) },
     );
@@ -206,6 +350,7 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     getApplicableConfigs,
     upsertConfig,
     patchConfigFields,
+    tombstoneConfigField,
     unsetConfigField,
     deleteConfig,
     toggleConfigActive,
diff --git a/packages/data-schemas/src/methods/conversation.spec.ts b/packages/data-schemas/src/methods/conversation.spec.ts
index 0b6e0857cdc..1d9621cc0fe 100644
--- a/packages/data-schemas/src/methods/conversation.spec.ts
+++ b/packages/data-schemas/src/methods/conversation.spec.ts
@@ -1,8 +1,8 @@
 import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
-import { EModelEndpoint } from 'librechat-data-provider';
-import type { IConversation } from '../types';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import { EModelEndpoint, RetentionMode } from 'librechat-data-provider';
+import type { IChatProject, IConversation } from '../types';
 import { ConversationMethods, createConversationMethods } from './conversation';
 import { tenantStorage, runAsSystem } from '~/config/tenantContext';
 import { createModels } from '../models';
@@ -16,6 +16,13 @@ jest.mock('~/config/winston', () => ({
 
 let mongoServer: InstanceType<typeof MongoMemoryServer>;
 let Conversation: mongoose.Model<IConversation>;
+let ChatProject: mongoose.Model<IChatProject>;
+let ConversationTag: mongoose.Model<{
+  user: string;
+  tag: string;
+  count: number;
+  position: number;
+}>;
 let modelsToCleanup: string[] = [];
 
 // Mock message methods (same as original test mocking ./Message)
@@ -32,6 +39,13 @@ beforeAll(async () => {
   modelsToCleanup = Object.keys(models);
   Object.assign(mongoose.models, models);
   Conversation = mongoose.models.Conversation as mongoose.Model<IConversation>;
+  ChatProject = mongoose.models.ChatProject as mongoose.Model<IChatProject>;
+  ConversationTag = mongoose.models.ConversationTag as mongoose.Model<{
+    user: string;
+    tag: string;
+    count: number;
+    position: number;
+  }>;
 
   methods = createConversationMethods(mongoose, { getMessages, deleteMessages });
 
@@ -58,6 +72,8 @@ const saveConvo = (...args: Parameters<ConversationMethods['saveConvo']>) =>
   methods.saveConvo(...args) as Promise<IConversation | null>;
 const getConvo = (...args: Parameters<ConversationMethods['getConvo']>) =>
   methods.getConvo(...args);
+const getConvoRetention = (...args: Parameters<ConversationMethods['getConvoRetention']>) =>
+  methods.getConvoRetention(...args);
 const getConvoTitle = (...args: Parameters<ConversationMethods['getConvoTitle']>) =>
   methods.getConvoTitle(...args);
 const getConvoFiles = (...args: Parameters<ConversationMethods['getConvoFiles']>) =>
@@ -78,7 +94,7 @@ describe('Conversation Operations', () => {
   let mockCtx: {
     userId: string;
     isTemporary?: boolean;
-    interfaceConfig?: { temporaryChatRetention?: number };
+    interfaceConfig?: { temporaryChatRetention?: number; retentionMode?: RetentionMode };
   };
   let mockConversationData: {
     conversationId: string;
@@ -89,6 +105,8 @@ describe('Conversation Operations', () => {
   beforeEach(async () => {
     // Clear database
     await Conversation.deleteMany({});
+    await ChatProject.deleteMany({});
+    await ConversationTag.deleteMany({});
 
     // Reset mocks
     jest.clearAllMocks();
@@ -136,7 +154,7 @@ describe('Conversation Operations', () => {
 
       // Verify that getMessages was called with correct parameters
       expect(getMessages).toHaveBeenCalledWith(
-        { conversationId: mockConversationData.conversationId },
+        { conversationId: mockConversationData.conversationId, user: mockCtx.userId },
         '_id',
       );
     });
@@ -151,6 +169,155 @@ describe('Conversation Operations', () => {
       expect(result?.conversationId).toBe(newConversationId);
     });
 
+    it('refreshes project stats when archiving a project conversation', async () => {
+      const project = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project Stats',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const firstConversationId = uuidv4();
+      const secondConversationId = uuidv4();
+      const chatProjectId = project._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId: firstConversationId,
+        title: 'First',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId,
+      });
+      await saveConvo(mockCtx, {
+        conversationId: secondConversationId,
+        title: 'Second',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId,
+      });
+
+      await saveConvo(mockCtx, {
+        conversationId: secondConversationId,
+        isArchived: true,
+      });
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+      expect(refreshedProject?.lastConversationId).toBe(firstConversationId);
+    });
+
+    it('bulkSaveConvos keeps owned project ids and strips orphan ones', async () => {
+      const project = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const ownedId = project._id!.toString();
+      const orphanId = new mongoose.Types.ObjectId().toString();
+      const ownedConvoId = uuidv4();
+      const orphanConvoId = uuidv4();
+
+      await methods.bulkSaveConvos([
+        {
+          conversationId: ownedConvoId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: ownedId,
+        },
+        {
+          conversationId: orphanConvoId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: orphanId,
+        },
+      ]);
+
+      const ownedConvo = await Conversation.findOne({
+        conversationId: ownedConvoId,
+      }).lean<IConversation>();
+      const orphanConvo = await Conversation.findOne({
+        conversationId: orphanConvoId,
+      }).lean<IConversation>();
+
+      expect(ownedConvo?.chatProjectId).toBe(ownedId);
+      expect(orphanConvo?.chatProjectId == null).toBe(true);
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+    });
+
+    it('refreshes both projects when a save moves a conversation between them', async () => {
+      const projectA = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project A',
+        conversationCount: 0,
+      });
+      const projectB = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project B',
+        conversationCount: 0,
+      });
+      const conversationId = uuidv4();
+      const projectAId = projectA._id!.toString();
+      const projectBId = projectB._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId,
+        title: 'Moving',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectAId,
+      });
+      // A stale tab re-submits with the new project id, moving the chat A -> B.
+      await saveConvo(mockCtx, {
+        conversationId,
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectBId,
+      });
+
+      const refreshedA = await ChatProject.findById(projectA._id).lean<IChatProject>();
+      const refreshedB = await ChatProject.findById(projectB._id).lean<IChatProject>();
+      expect(refreshedA?.conversationCount).toBe(0);
+      expect(refreshedA?.lastConversationId == null).toBe(true);
+      expect(refreshedB?.conversationCount).toBe(1);
+      expect(refreshedB?.lastConversationId).toBe(conversationId);
+    });
+
+    it('bulkSaveConvos refreshes the project a conversation leaves', async () => {
+      const projectA = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project A',
+        conversationCount: 0,
+      });
+      const projectB = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project B',
+        conversationCount: 0,
+      });
+      const conversationId = uuidv4();
+      const projectAId = projectA._id!.toString();
+      const projectBId = projectB._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId,
+        title: 'Bulk Moving',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectAId,
+      });
+      await methods.bulkSaveConvos([
+        {
+          conversationId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: projectBId,
+        },
+      ]);
+
+      const refreshedA = await ChatProject.findById(projectA._id).lean<IChatProject>();
+      const refreshedB = await ChatProject.findById(projectB._id).lean<IChatProject>();
+      expect(refreshedA?.conversationCount).toBe(0);
+      expect(refreshedB?.conversationCount).toBe(1);
+    });
+
     it('should not create a conversation when noUpsert is true and conversation does not exist', async () => {
       const nonExistentId = uuidv4();
       const result = await saveConvo(
@@ -263,7 +430,7 @@ describe('Conversation Operations', () => {
       const result = await saveConvo(mockCtx, mockConversationData);
 
       expect(result?.conversationId).toBe(mockConversationData.conversationId);
-      expect(result?.expiredAt).toBeNull();
+      expect(result?.expiredAt).toBeUndefined();
     });
 
     it('should use custom retention period from config', async () => {
@@ -401,6 +568,21 @@ describe('Conversation Operations', () => {
       );
     });
 
+    it('should preserve temporary retention when saving without isTemporary', async () => {
+      mockCtx.interfaceConfig = { temporaryChatRetention: 24 };
+      mockCtx.isTemporary = true;
+      const firstSave = await saveConvo(mockCtx, mockConversationData);
+      const originalExpiredAt = firstSave?.expiredAt;
+
+      mockCtx.isTemporary = undefined;
+      const updatedData = { ...mockConversationData, title: 'Updated Title' };
+      const secondSave = await saveConvo(mockCtx, updatedData);
+
+      expect(secondSave?.title).toBe('Updated Title');
+      expect(secondSave?.isTemporary).toBe(true);
+      expect(secondSave?.expiredAt).toEqual(originalExpiredAt);
+    });
+
     it('should not set expiredAt when updating non-temporary conversation', async () => {
       // First save a non-temporary conversation
       mockCtx.isTemporary = false;
@@ -416,23 +598,124 @@ describe('Conversation Operations', () => {
       expect(secondSave?.expiredAt).toBeNull();
     });
 
-    it('should filter out expired conversations in getConvosByCursor', async () => {
+    it('should set expiredAt for non-temporary conversation when retentionMode is ALL', async () => {
+      mockCtx.isTemporary = false;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+      const result = await saveConvo(mockCtx, mockConversationData);
+      expect(result?.expiredAt).toBeDefined();
+      expect(result?.isTemporary).toBe(false);
+    });
+
+    it('should mark retained conversation non-temporary when retentionMode is ALL and isTemporary is omitted', async () => {
+      mockCtx.isTemporary = undefined;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+
+      const result = await saveConvo(mockCtx, mockConversationData);
+
+      expect(result?.expiredAt).toBeDefined();
+      expect(result?.isTemporary).toBe(false);
+    });
+
+    it('should preserve existing temporary flag when retentionMode is ALL and isTemporary is omitted', async () => {
+      mockCtx.isTemporary = true;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+
+      const firstSave = await saveConvo(mockCtx, mockConversationData);
+
+      mockCtx.isTemporary = undefined;
+      const secondSave = await saveConvo(mockCtx, {
+        ...mockConversationData,
+        title: 'Updated Title',
+      });
+
+      expect(firstSave?.isTemporary).toBe(true);
+      expect(secondSave?.title).toBe('Updated Title');
+      expect(secondSave?.isTemporary).toBe(true);
+      expect(secondSave?.expiredAt).toBeDefined();
+    });
+
+    it('should not set expiredAt when retentionMode is temporary and not isTemporary', async () => {
+      mockCtx.isTemporary = false;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.TEMPORARY,
+      };
+      const result = await saveConvo(mockCtx, mockConversationData);
+      expect(result?.expiredAt).toBeNull();
+      expect(result?.isTemporary).toBe(false);
+    });
+
+    it('should filter out temporary conversations in getConvosByCursor', async () => {
       // Create some test conversations
-      const nonExpiredConvo = await Conversation.create({
+      const newNonTemporaryConvo = await Conversation.create({
         conversationId: uuidv4(),
         user: 'user123',
-        title: 'Non-expired',
+        title: 'New Non-temporary Conversation',
         endpoint: EModelEndpoint.openAI,
+        isTemporary: false,
+        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        updatedAt: new Date(),
+      });
+
+      const oldNonTemporaryConvo = await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        title: 'Old Non-Temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: undefined,
         expiredAt: null,
         updatedAt: new Date(),
       });
 
+      const legacyNullNonTemporaryConvoId = uuidv4();
+      await Conversation.collection.insertOne({
+        conversationId: legacyNullNonTemporaryConvoId,
+        user: 'user123',
+        title: 'Legacy Null Non-Temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: null,
+        expiredAt: null,
+        updatedAt: new Date(),
+        createdAt: new Date(),
+      });
+
+      const legacyTemporaryConvoId = uuidv4();
+      await Conversation.collection.insertOne({
+        conversationId: legacyTemporaryConvoId,
+        user: 'user123',
+        title: 'Legacy Temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        updatedAt: new Date(),
+        createdAt: new Date(),
+      });
+
+      const expiredRetainedConvo = await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        title: 'Expired Retained Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: false,
+        expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+        updatedAt: new Date(),
+      });
+
       await Conversation.create({
         conversationId: uuidv4(),
         user: 'user123',
-        title: 'Future expired',
+        title: 'Temporary conversation',
         endpoint: EModelEndpoint.openAI,
-        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours from now
+        isTemporary: true,
+        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
         updatedAt: new Date(),
       });
 
@@ -441,41 +724,104 @@ describe('Conversation Operations', () => {
 
       const result = await getConvosByCursor('user123');
 
-      // Should only return conversations with null or non-existent expiredAt
-      expect(result?.conversations).toHaveLength(1);
-      expect(result?.conversations[0]?.conversationId).toBe(nonExpiredConvo.conversationId);
+      // Should return both non-temporary conversations, not the temporary one
+      expect(result?.conversations).toHaveLength(3);
+      const convoIds = result?.conversations.map((c) => c.conversationId);
+      expect(convoIds).toContain(newNonTemporaryConvo.conversationId);
+      expect(convoIds).toContain(oldNonTemporaryConvo.conversationId);
+      expect(convoIds).toContain(legacyNullNonTemporaryConvoId);
+      expect(convoIds).not.toContain(legacyTemporaryConvoId);
+      expect(convoIds).not.toContain(expiredRetainedConvo.conversationId);
     });
 
-    it('should filter out expired conversations in getConvosQueried', async () => {
-      // Create test conversations
-      const nonExpiredConvo = await Conversation.create({
+    it('should filter out temporary conversations in getConvosQueried', async () => {
+      const newNonTemporaryConvo = await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        title: 'New Non-temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: false,
+        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        updatedAt: new Date(),
+      });
+
+      const oldNonTemporaryConvo = await Conversation.create({
         conversationId: uuidv4(),
         user: 'user123',
-        title: 'Non-expired',
+        title: 'Old Non-Temporary Conversation',
         endpoint: EModelEndpoint.openAI,
+        isTemporary: undefined,
         expiredAt: null,
+        updatedAt: new Date(),
+      });
+
+      const legacyNullNonTemporaryConvoId = uuidv4();
+      await Conversation.collection.insertOne({
+        conversationId: legacyNullNonTemporaryConvoId,
+        user: 'user123',
+        title: 'Legacy Null Non-Temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: null,
+        expiredAt: null,
+        updatedAt: new Date(),
+        createdAt: new Date(),
+      });
+
+      const legacyTemporaryConvoId = uuidv4();
+      await Conversation.collection.insertOne({
+        conversationId: legacyTemporaryConvoId,
+        user: 'user123',
+        title: 'Legacy Temporary Conversation',
+        endpoint: EModelEndpoint.openAI,
+        expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        updatedAt: new Date(),
+        createdAt: new Date(),
+      });
+
+      const expiredRetainedConvo = await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        title: 'Expired Retained Conversation',
+        endpoint: EModelEndpoint.openAI,
+        isTemporary: false,
+        expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+        updatedAt: new Date(),
       });
 
-      const expiredConvo = await Conversation.create({
+      const tempConvo = await Conversation.create({
         conversationId: uuidv4(),
         user: 'user123',
-        title: 'Expired',
+        title: 'Temporary conversation',
         endpoint: EModelEndpoint.openAI,
+        isTemporary: true,
         expiredAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        updatedAt: new Date(),
       });
 
       const convoIds = [
-        { conversationId: nonExpiredConvo.conversationId },
-        { conversationId: expiredConvo.conversationId },
+        { conversationId: newNonTemporaryConvo.conversationId },
+        { conversationId: oldNonTemporaryConvo.conversationId },
+        { conversationId: legacyNullNonTemporaryConvoId },
+        { conversationId: legacyTemporaryConvoId },
+        { conversationId: expiredRetainedConvo.conversationId },
+        { conversationId: tempConvo.conversationId },
       ];
 
       const result = await getConvosQueried('user123', convoIds);
 
-      // Should only return the non-expired conversation
-      expect(result?.conversations).toHaveLength(1);
-      expect(result?.conversations[0].conversationId).toBe(nonExpiredConvo.conversationId);
-      expect(result?.convoMap[nonExpiredConvo.conversationId]).toBeDefined();
-      expect(result?.convoMap[expiredConvo.conversationId]).toBeUndefined();
+      // Should only return the non-temporary conversations
+      expect(result?.conversations).toHaveLength(3);
+
+      const resultIds = result?.conversations.map((c) => c.conversationId);
+      expect(resultIds).toContain(newNonTemporaryConvo.conversationId);
+      expect(resultIds).toContain(oldNonTemporaryConvo.conversationId);
+      expect(resultIds).toContain(legacyNullNonTemporaryConvoId);
+      expect(result?.convoMap[newNonTemporaryConvo.conversationId]).toBeDefined();
+      expect(result?.convoMap[oldNonTemporaryConvo.conversationId]).toBeDefined();
+      expect(result?.convoMap[legacyNullNonTemporaryConvoId]).toBeDefined();
+      expect(result?.convoMap[legacyTemporaryConvoId]).toBeUndefined();
+      expect(result?.convoMap[expiredRetainedConvo.conversationId]).toBeUndefined();
+      expect(result?.convoMap[tempConvo.conversationId]).toBeUndefined();
     });
   });
 
@@ -524,6 +870,24 @@ describe('Conversation Operations', () => {
     });
   });
 
+  describe('getConvoRetention', () => {
+    it('should retrieve only retention fields for a user conversation', async () => {
+      await Conversation.create({
+        conversationId: mockConversationData.conversationId,
+        user: 'user123',
+        title: 'Test Conversation',
+        endpoint: EModelEndpoint.openAI,
+        expiredAt: new Date('2030-01-01T00:00:00.000Z'),
+      });
+
+      const result = await getConvoRetention('user123', mockConversationData.conversationId);
+
+      expect(result?.expiredAt).toEqual(new Date('2030-01-01T00:00:00.000Z'));
+      expect(result).not.toHaveProperty('title');
+      expect(result).not.toHaveProperty('messages');
+    });
+  });
+
   describe('getConvoTitle', () => {
     it('should return the conversation title', async () => {
       await Conversation.create({
@@ -620,6 +984,153 @@ describe('Conversation Operations', () => {
         'Conversation not found or already deleted.',
       );
     });
+
+    it('should decrement tag counts for a deleted bookmarked conversation', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 2, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(1);
+    });
+
+    it('should decrement counts for every tag on the deleted conversation', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 3, position: 1 });
+      await ConversationTag.create({ user: 'user123', tag: 'personal', count: 1, position: 2 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work', 'personal'],
+      });
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      const work = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      const personal = await ConversationTag.findOne({ user: 'user123', tag: 'personal' }).lean();
+      expect(work?.count).toBe(2);
+      expect(personal?.count).toBe(0);
+    });
+
+    it('should decrement a shared tag once per deleted conversation when clearing all', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 2, position: 1 });
+      await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+      await Conversation.create({
+        conversationId: uuidv4(),
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      await deleteConvos('user123', {});
+
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(0);
+    });
+
+    it('should not double-decrement duplicate tag entries within one conversation', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 2, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work', 'work'],
+      });
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(1);
+    });
+
+    it('should clamp tag counts at zero and never go negative', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 0, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(0);
+    });
+
+    it('should not touch tags belonging to another user', async () => {
+      await ConversationTag.create({ user: 'other', tag: 'work', count: 5, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      const tag = await ConversationTag.findOne({ user: 'other', tag: 'work' }).lean();
+      expect(tag?.count).toBe(5);
+    });
+
+    it('should not decrement tag counts when the delete removed nothing (lost race)', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 2, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      const deleteSpy = jest
+        .spyOn(Conversation, 'deleteMany')
+        .mockResolvedValueOnce({ acknowledged: true, deletedCount: 0 } as never);
+
+      await deleteConvos('user123', { conversationId: convoId });
+
+      deleteSpy.mockRestore();
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(2);
+    });
+
+    it('should still decrement tag counts when message deletion fails after the delete', async () => {
+      await ConversationTag.create({ user: 'user123', tag: 'work', count: 2, position: 1 });
+      const convoId = uuidv4();
+      await Conversation.create({
+        conversationId: convoId,
+        user: 'user123',
+        endpoint: EModelEndpoint.openAI,
+        tags: ['work'],
+      });
+
+      deleteMessages.mockRejectedValueOnce(new Error('message cleanup failed'));
+
+      await expect(deleteConvos('user123', { conversationId: convoId })).rejects.toThrow(
+        'message cleanup failed',
+      );
+
+      const tag = await ConversationTag.findOne({ user: 'user123', tag: 'work' }).lean();
+      expect(tag?.count).toBe(1);
+      const convo = await Conversation.findOne({ conversationId: convoId });
+      expect(convo).toBeNull();
+    });
   });
 
   describe('deleteNullOrEmptyConversations', () => {
@@ -971,5 +1482,34 @@ describe('Conversation Operations', () => {
       expect(doc?.title).toBe('Updated');
       expect(doc?.tenantId).toBe('real-tenant');
     });
+
+    it('bulkSaveConvos refreshes stats for cloned project conversations', async () => {
+      const project = await ChatProject.create({
+        user: 'user123',
+        name: 'Bulk Project',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const conversationId = uuidv4();
+      const createdAt = new Date('2026-01-01T00:00:00.000Z');
+
+      await methods.bulkSaveConvos([
+        {
+          conversationId,
+          user: 'user123',
+          title: 'Cloned Project Chat',
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: project._id!.toString(),
+          createdAt,
+          updatedAt: createdAt,
+        },
+      ]);
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+      expect(refreshedProject?.lastConversationId).toBe(conversationId);
+      expect(refreshedProject?.lastConversationAt?.toISOString()).toBe(createdAt.toISOString());
+    });
   });
 });
diff --git a/packages/data-schemas/src/methods/conversation.ts b/packages/data-schemas/src/methods/conversation.ts
index f02ea8dbe0c..cc2594fd269 100644
--- a/packages/data-schemas/src/methods/conversation.ts
+++ b/packages/data-schemas/src/methods/conversation.ts
@@ -1,10 +1,18 @@
+import { RetentionMode } from 'librechat-data-provider';
 import type { FilterQuery, Model, SortOrder } from 'mongoose';
+import type { DeleteResult } from 'mongoose';
+import type { AppConfig, IChatProjectDocument, IConversation } from '~/types';
+import type { MessageMethods } from './message';
+import {
+  refreshChatProjectStatsForUser,
+  updateChatProjectLastConversationForUser,
+} from './chatProject';
+import { buildRetentionVisibilityFilter, createFallbackRetentionDate } from '~/utils/retention';
 import { createTempChatExpirationDate } from '~/utils/tempChatRetention';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import { isValidObjectIdString } from '~/utils/objectId';
+import { decrementTagCounts } from './conversationTag';
 import logger from '~/config/winston';
-import type { AppConfig, IConversation } from '~/types';
-import type { MessageMethods } from './message';
-import type { DeleteResult } from 'mongoose';
 
 export interface ConversationMethods {
   getConvoFiles(conversationId: string): Promise<string[]>;
@@ -34,6 +42,7 @@ export interface ConversationMethods {
       search?: string;
       sortBy?: string;
       sortDirection?: string;
+      projectId?: string;
     },
   ): Promise<{ conversations: IConversation[]; nextCursor: string | null }>;
   getConvosQueried(
@@ -47,6 +56,10 @@ export interface ConversationMethods {
     convoMap: Record<string, unknown>;
   }>;
   getConvo(user: string, conversationId: string): Promise<IConversation | null>;
+  getConvoRetention(
+    user: string,
+    conversationId: string,
+  ): Promise<Pick<IConversation, 'expiredAt'> | null>;
   getConvoTitle(user: string, conversationId: string): Promise<string | null>;
   deleteConvos(
     user: string,
@@ -65,6 +78,10 @@ export function createConversationMethods(
     return messageMethods;
   }
 
+  function getVisibleConversationRetentionFilter(): FilterQuery<IConversation> {
+    return buildRetentionVisibilityFilter<IConversation>();
+  }
+
   /**
    * Searches for a conversation by conversationId and returns a lean document with only conversationId and user.
    */
@@ -94,6 +111,24 @@ export function createConversationMethods(
     }
   }
 
+  /**
+   * Retrieves only the retention deadline for a conversation.
+   */
+  async function getConvoRetention(
+    user: string,
+    conversationId: string,
+  ): Promise<Pick<IConversation, 'expiredAt'> | null> {
+    try {
+      const Conversation = mongoose.models.Conversation as Model<IConversation>;
+      return await Conversation.findOne({ user, conversationId }, 'expiredAt').lean<
+        Pick<IConversation, 'expiredAt'>
+      >();
+    } catch (error) {
+      logger.error('[getConvoRetention] Error getting conversation retention fields', error);
+      throw new Error('Error getting conversation retention fields');
+    }
+  }
+
   /**
    * Deletes conversations and messages with null or empty IDs.
    */
@@ -178,22 +213,67 @@ export function createConversationMethods(
         logger.debug(`[saveConvo] ${metadata.context}`);
       }
 
-      const messages = await getMessages({ conversationId }, '_id');
+      const messages = await getMessages({ conversationId, user: userId }, '_id');
       const update: Record<string, unknown> = { ...convo, messages, user: userId };
+      const unsetFields: Record<string, number> = { ...(metadata?.unsetFields ?? {}) };
+
+      if (Object.prototype.hasOwnProperty.call(update, 'chatProjectId') && update.chatProjectId) {
+        const chatProjectId = typeof update.chatProjectId === 'string' ? update.chatProjectId : '';
+        let isValidChatProject = isValidObjectIdString(chatProjectId);
+
+        if (isValidChatProject) {
+          const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+          const project = await ChatProject.exists({
+            _id: new mongoose.Types.ObjectId(chatProjectId),
+            user: userId,
+          });
+          isValidChatProject = project != null;
+        }
+
+        if (!isValidChatProject) {
+          delete update.chatProjectId;
+          unsetFields.chatProjectId = 1;
+        }
+      }
+
+      const mayChangeProjectMembership =
+        Object.prototype.hasOwnProperty.call(update, 'chatProjectId') ||
+        Object.prototype.hasOwnProperty.call(unsetFields, 'chatProjectId');
+      let previousChatProjectId: string | null = null;
+      if (mayChangeProjectMembership) {
+        const existing = await Conversation.findOne(
+          { conversationId, user: userId },
+          'chatProjectId',
+        ).lean<{ chatProjectId?: string | null } | null>();
+        previousChatProjectId = existing?.chatProjectId ?? null;
+      }
 
       if (newConversationId) {
         update.conversationId = newConversationId;
       }
 
-      if (isTemporary) {
+      if (interfaceConfig?.retentionMode === RetentionMode.ALL) {
+        if (typeof isTemporary === 'boolean') {
+          update.isTemporary = isTemporary;
+        }
         try {
           update.expiredAt = createTempChatExpirationDate(interfaceConfig);
         } catch (err) {
           logger.error('Error creating temporary chat expiration date:', err);
           logger.info(`---\`saveConvo\` context: ${metadata?.context}`);
-          update.expiredAt = null;
+          update.expiredAt = createFallbackRetentionDate();
         }
-      } else {
+      } else if (isTemporary === true) {
+        update.isTemporary = true;
+        try {
+          update.expiredAt = createTempChatExpirationDate(interfaceConfig);
+        } catch (err) {
+          logger.error('Error creating temporary chat expiration date:', err);
+          logger.info(`---\`saveConvo\` context: ${metadata?.context}`);
+          update.expiredAt = createFallbackRetentionDate();
+        }
+      } else if (isTemporary === false) {
+        update.isTemporary = false;
         update.expiredAt = null;
       }
 
@@ -207,28 +287,108 @@ export function createConversationMethods(
       }
 
       const updateOperation: Record<string, unknown> = { $set: update };
-      if (metadata?.unsetFields && Object.keys(metadata.unsetFields).length > 0) {
-        updateOperation.$unset = metadata.unsetFields;
+      if (Object.keys(unsetFields).length > 0) {
+        updateOperation.$unset = unsetFields;
       }
       if (createdAtOnInsert) {
         updateOperation.$setOnInsert = { createdAt: createdAtOnInsert };
       }
 
-      const conversation = await Conversation.findOneAndUpdate(
+      const conversationResult = (await Conversation.findOneAndUpdate(
         { conversationId, user: userId },
         updateOperation,
         {
           new: true,
           upsert: metadata?.noUpsert !== true,
+          includeResultMetadata: true,
           ...(createdAtOnInsert ? { timestamps: false } : {}),
         },
-      );
+      )) as unknown as {
+        value:
+          | (IConversation & {
+              _id: unknown;
+              $isDefault: (path: string) => boolean;
+              toObject: () => IConversation;
+            })
+          | null;
+        lastErrorObject?: {
+          updatedExisting?: boolean;
+        };
+      };
+      const conversation = conversationResult.value;
 
       if (!conversation) {
         logger.debug('[saveConvo] Conversation not found, skipping update');
         return null;
       }
 
+      if (
+        interfaceConfig?.retentionMode === RetentionMode.ALL &&
+        typeof isTemporary !== 'boolean' &&
+        (conversation.isTemporary == null ||
+          (conversation.isTemporary === false && conversation.$isDefault('isTemporary')))
+      ) {
+        await Conversation.updateOne(
+          { _id: conversation._id, isTemporary: { $ne: false } },
+          { $set: { isTemporary: false } },
+        );
+        conversation.isTemporary = false;
+      }
+
+      const newChatProjectId = conversation.chatProjectId ?? null;
+      const projectMembershipChanged = previousChatProjectId !== newChatProjectId;
+
+      /**
+       * A chat that moved between projects (e.g. a stale tab re-submitting an
+       * older project id) must fully recompute the stats of the project it left;
+       * the incremental path only ever touches the project it now belongs to.
+       */
+      if (projectMembershipChanged && previousChatProjectId) {
+        await refreshChatProjectStatsForUser(mongoose, userId, previousChatProjectId);
+      }
+
+      if (conversation.chatProjectId) {
+        const isRetentionVisibilityUpdate =
+          typeof update.isTemporary === 'boolean' ||
+          Object.prototype.hasOwnProperty.call(convo, 'expiredAt') ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'isTemporary') ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'expiredAt');
+        /**
+         * Saving a conversation that is itself archived or retention-hidden (e.g.
+         * renaming or title generation on an archived project chat) must recompute
+         * stats rather than take the incremental fast path, otherwise the project's
+         * lastConversationAt/Id would point at a chat the project workspace hides.
+         */
+        const isConversationHidden =
+          conversation.isArchived === true ||
+          conversation.isTemporary === true ||
+          (conversation.expiredAt != null &&
+            new Date(conversation.expiredAt).getTime() <= Date.now());
+        /**
+         * A move into this project (projectMembershipChanged) also needs a full
+         * refresh: the incremental path only bumps the count for brand-new inserts,
+         * so a pre-existing chat joining the project would otherwise be uncounted.
+         */
+        const shouldRefreshProjectStats =
+          projectMembershipChanged ||
+          typeof update.isArchived === 'boolean' ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'isArchived') ||
+          isRetentionVisibilityUpdate ||
+          isConversationHidden;
+
+        if (shouldRefreshProjectStats) {
+          await refreshChatProjectStatsForUser(mongoose, userId, conversation.chatProjectId);
+        } else {
+          await updateChatProjectLastConversationForUser(
+            mongoose,
+            userId,
+            conversation.chatProjectId,
+            conversation,
+            conversationResult.lastErrorObject?.updatedExisting === false,
+          );
+        }
+      }
+
       return conversation.toObject();
     } catch (error) {
       logger.error('[saveConvo] Error saving conversation', error);
@@ -245,19 +405,113 @@ export function createConversationMethods(
   async function bulkSaveConvos(conversations: Array<Record<string, unknown>>) {
     try {
       const Conversation = mongoose.models.Conversation as Model<IConversation>;
-      const bulkOps = conversations.map((convo) => ({
-        updateOne: {
-          filter: {
-            conversationId: convo.conversationId,
+      const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+
+      /**
+       * Validate project ownership before persisting (mirrors saveConvo). Bulk
+       * paths like import/duplicate/fork can carry a chatProjectId that does not
+       * belong to the user; persisting it would create an orphan assignment that
+       * is hidden from both the project and the unassigned filter.
+       */
+      const candidatePairs = new Map<string, { user: string; projectId: string }>();
+      for (const convo of conversations) {
+        if (
+          typeof convo.user === 'string' &&
+          typeof convo.chatProjectId === 'string' &&
+          isValidObjectIdString(convo.chatProjectId)
+        ) {
+          candidatePairs.set(`${convo.user}:${convo.chatProjectId}`, {
             user: convo.user,
+            projectId: convo.chatProjectId,
+          });
+        }
+      }
+
+      const ownedProjects = new Set<string>();
+      if (candidatePairs.size > 0) {
+        const owned = await ChatProject.find({
+          $or: [...candidatePairs.values()].map(({ user, projectId }) => ({
+            _id: new mongoose.Types.ObjectId(projectId),
+            user,
+          })),
+        })
+          .select('_id user')
+          .lean<Array<{ _id: { toString: () => string }; user: string }>>();
+        for (const project of owned) {
+          ownedProjects.add(`${project.user}:${project._id.toString()}`);
+        }
+      }
+
+      /**
+       * Capture each conversation's existing project so a bulk move (import that
+       * overwrites an existing (user, conversationId), duplicate/fork) also refreshes
+       * the project it leaves, not just the one it joins. One batched read keeps this
+       * O(1) in round-trips regardless of batch size.
+       */
+      const previousProjectByConversation = new Map<string, string>();
+      const conversationPairs = conversations
+        .filter((c) => typeof c.user === 'string' && typeof c.conversationId === 'string')
+        .map((c) => ({ user: c.user as string, conversationId: c.conversationId as string }));
+      if (conversationPairs.length > 0) {
+        const existing = await Conversation.find(
+          { $or: conversationPairs },
+          'user conversationId chatProjectId',
+        ).lean<Array<{ user: string; conversationId: string; chatProjectId?: string | null }>>();
+        for (const doc of existing) {
+          if (doc.chatProjectId) {
+            previousProjectByConversation.set(
+              `${doc.user}:${doc.conversationId}`,
+              doc.chatProjectId,
+            );
+          }
+        }
+      }
+
+      const affectedProjectStats = new Map<string, { user: string; projectId: string }>();
+      const bulkOps = conversations.map((convo) => {
+        const sanitized = { ...convo };
+        if (typeof sanitized.user === 'string' && typeof sanitized.chatProjectId === 'string') {
+          if (ownedProjects.has(`${sanitized.user}:${sanitized.chatProjectId}`)) {
+            affectedProjectStats.set(`${sanitized.user}:${sanitized.chatProjectId}`, {
+              user: sanitized.user,
+              projectId: sanitized.chatProjectId,
+            });
+          } else {
+            sanitized.chatProjectId = null;
+          }
+        }
+        if (typeof sanitized.user === 'string' && typeof sanitized.conversationId === 'string') {
+          const previousProjectId = previousProjectByConversation.get(
+            `${sanitized.user}:${sanitized.conversationId}`,
+          );
+          const newProjectId =
+            typeof sanitized.chatProjectId === 'string' ? sanitized.chatProjectId : null;
+          if (previousProjectId && previousProjectId !== newProjectId) {
+            affectedProjectStats.set(`${sanitized.user}:${previousProjectId}`, {
+              user: sanitized.user,
+              projectId: previousProjectId,
+            });
+          }
+        }
+        return {
+          updateOne: {
+            filter: {
+              conversationId: sanitized.conversationId,
+              user: sanitized.user,
+            },
+            update: sanitized,
+            upsert: true,
+            timestamps: false,
           },
-          update: convo,
-          upsert: true,
-          timestamps: false,
-        },
-      }));
+        };
+      });
 
       const result = await tenantSafeBulkWrite(Conversation, bulkOps);
+      await Promise.all(
+        [...affectedProjectStats.values()].map(({ user, projectId }) =>
+          refreshChatProjectStatsForUser(mongoose, user, projectId),
+        ),
+      );
       return result;
     } catch (error) {
       logger.error('[bulkSaveConvos] Error saving conversations in bulk', error);
@@ -278,6 +532,7 @@ export function createConversationMethods(
       search,
       sortBy = 'updatedAt',
       sortDirection = 'desc',
+      projectId,
     }: {
       cursor?: string | null;
       limit?: number;
@@ -286,6 +541,7 @@ export function createConversationMethods(
       search?: string;
       sortBy?: string;
       sortDirection?: string;
+      projectId?: string;
     } = {},
   ) {
     const Conversation = mongoose.models.Conversation as Model<IConversation>;
@@ -302,9 +558,15 @@ export function createConversationMethods(
       filters.push({ tags: { $in: tags } } as FilterQuery<IConversation>);
     }
 
-    filters.push({
-      $or: [{ expiredAt: null }, { expiredAt: { $exists: false } }],
-    } as FilterQuery<IConversation>);
+    if (projectId === 'unassigned') {
+      filters.push({
+        $or: [{ chatProjectId: null }, { chatProjectId: { $exists: false } }],
+      } as FilterQuery<IConversation>);
+    } else if (projectId) {
+      filters.push({ chatProjectId: projectId } as FilterQuery<IConversation>);
+    }
+
+    filters.push(getVisibleConversationRetentionFilter());
 
     if (search) {
       try {
@@ -379,7 +641,7 @@ export function createConversationMethods(
 
       const convos = await Conversation.find(query)
         .select(
-          'conversationId endpoint title createdAt updatedAt user model agent_id assistant_id spec iconURL',
+          'conversationId endpoint title createdAt updatedAt user model agent_id assistant_id spec iconURL chatProjectId pinned',
         )
         .sort(sortObj)
         .limit(limit + 1)
@@ -429,7 +691,7 @@ export function createConversationMethods(
       const results = await Conversation.find({
         user,
         conversationId: { $in: conversationIds },
-        $or: [{ expiredAt: { $exists: false } }, { expiredAt: null }],
+        ...getVisibleConversationRetentionFilter(),
       }).lean<IConversation[]>();
 
       results.sort(
@@ -486,20 +748,69 @@ export function createConversationMethods(
       const Conversation = mongoose.models.Conversation as Model<IConversation>;
       const { deleteMessages } = getMessageMethods();
       const userFilter = { ...filter, user };
-      const conversations = await Conversation.find(userFilter).select('conversationId');
+      const conversations = await Conversation.find(userFilter).select(
+        'conversationId chatProjectId tags',
+      );
       const conversationIds = conversations.map((c) => c.conversationId);
+      const projectIds = new Set(
+        conversations
+          .map((conversation) => conversation.chatProjectId)
+          .filter((projectId): projectId is string => Boolean(projectId)),
+      );
+
+      /**
+       * One entry per (conversation, tag) association: each conversation's tags are
+       * deduped so a duplicate tag entry within a single conversation only decrements
+       * the bookmark count once.
+       */
+      const tagDecrements: string[] = [];
+      for (const conversation of conversations) {
+        if (!conversation.tags?.length) {
+          continue;
+        }
+        for (const tag of new Set(conversation.tags)) {
+          tagDecrements.push(tag);
+        }
+      }
 
       if (!conversationIds.length) {
         throw new Error('Conversation not found or already deleted.');
       }
 
       const deleteConvoResult = await Conversation.deleteMany(userFilter);
+      const deleted = deleteConvoResult.deletedCount > 0;
+
+      /**
+       * Reconcile bookmark counts from the deletion before message cleanup: if
+       * `deleteMessages` later throws, the conversation is already gone and a retry
+       * finds nothing, so the count must be reconciled here or it would stay stale.
+       * The decrement is best-effort and never throws, so it cannot block message
+       * cleanup. The `deletedCount` guard skips a losing concurrent delete whose
+       * pre-delete snapshot would otherwise decrement a conversation it did not
+       * actually remove.
+       */
+      if (deleted) {
+        await decrementTagCounts(mongoose, user, tagDecrements);
+      }
 
       const deleteMessagesResult = await deleteMessages({
         conversationId: { $in: conversationIds },
         user,
       });
 
+      /**
+       * Refresh project stats after message cleanup so a stats-refresh error cannot
+       * prevent `deleteMessages` from running, which would orphan the deleted
+       * conversations' messages.
+       */
+      if (deleted && projectIds.size > 0) {
+        await Promise.all(
+          [...projectIds].map((projectId) =>
+            refreshChatProjectStatsForUser(mongoose, user, projectId),
+          ),
+        );
+      }
+
       return { ...deleteConvoResult, messages: deleteMessagesResult };
     } catch (error) {
       logger.error('[deleteConvos] Error deleting conversations and messages', error);
@@ -516,6 +827,7 @@ export function createConversationMethods(
     getConvosByCursor,
     getConvosQueried,
     getConvo,
+    getConvoRetention,
     getConvoTitle,
     deleteConvos,
   };
diff --git a/packages/data-schemas/src/methods/conversationTag.ts b/packages/data-schemas/src/methods/conversationTag.ts
index 085948bab5a..be65f6b4461 100644
--- a/packages/data-schemas/src/methods/conversationTag.ts
+++ b/packages/data-schemas/src/methods/conversationTag.ts
@@ -12,11 +12,159 @@ interface IConversationTag {
   [key: string]: unknown;
 }
 
-export function createConversationTagMethods(mongoose: typeof import('mongoose')) {
+/**
+ * Atomically decrements tag counts for a user. Each entry in `tags` counts as a
+ * single decrement, so callers must dedupe tags per conversation before flattening
+ * to avoid double-decrementing a conversation's duplicate tag entries. Counts are
+ * clamped at zero to tolerate any pre-existing drift.
+ */
+export async function decrementTagCounts(
+  mongoose: typeof import('mongoose'),
+  user: string,
+  tags: string[],
+): Promise<void> {
+  if (!tags.length) {
+    return;
+  }
+
+  const decrementByTag = new Map<string, number>();
+  for (const tag of tags) {
+    if (!tag) {
+      continue;
+    }
+    decrementByTag.set(tag, (decrementByTag.get(tag) ?? 0) + 1);
+  }
+
+  if (decrementByTag.size === 0) {
+    return;
+  }
+
+  try {
+    const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
+    const bulkOps = [...decrementByTag.entries()].map(([tag, amount]) => ({
+      updateOne: {
+        filter: { user, tag },
+        update: [
+          {
+            $set: {
+              count: { $max: [0, { $subtract: [{ $ifNull: ['$count', 0] }, amount] }] },
+            },
+          },
+        ],
+      },
+    }));
+
+    await tenantSafeBulkWrite(ConversationTag, bulkOps);
+  } catch (error) {
+    logger.error('[decrementTagCounts] Error decrementing tag counts', error);
+  }
+}
+
+export function createConversationTagMethods(mongoose: typeof import('mongoose')): {
+  getConversationTags: (user: string) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      user: string;
+      tag: string;
+      description?: string | undefined;
+      position: number;
+      count: number;
+      createdAt?: Date | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+  createConversationTag: (
+    user: string,
+    data: {
+      tag: string;
+      description?: string;
+      addToConversation?: boolean;
+      conversationId?: string;
+    },
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  updateConversationTag: (
+    user: string,
+    oldTag: string,
+    data: { tag?: string; description?: string; position?: number },
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteConversationTag: (
+    user: string,
+    tag: string,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteConversationTags: (filter: Record<string, unknown>) => Promise<number>;
+  bulkIncrementTagCounts: (user: string, tags: string[]) => Promise<void>;
+  updateTagsForConversation: (
+    user: string,
+    conversationId: string,
+    tags: string[],
+  ) => Promise<string[]>;
+} {
   /**
    * Retrieves all conversation tags for a user.
    */
-  async function getConversationTags(user: string) {
+  async function getConversationTags(user: string): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      user: string;
+      tag: string;
+      description?: string | undefined;
+      position: number;
+      count: number;
+      createdAt?: Date | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       return await ConversationTag.find({ user }).sort({ position: 1 }).lean();
@@ -37,7 +185,22 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
       addToConversation?: boolean;
       conversationId?: string;
     },
-  ) {
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -116,7 +279,22 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
     user: string,
     oldTag: string,
     data: { tag?: string; description?: string; position?: number },
-  ) {
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -161,7 +339,25 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Deletes a conversation tag.
    */
-  async function deleteConversationTag(user: string, tag: string) {
+  async function deleteConversationTag(
+    user: string,
+    tag: string,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -188,7 +384,11 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Updates tags for a specific conversation.
    */
-  async function updateTagsForConversation(user: string, conversationId: string, tags: string[]) {
+  async function updateTagsForConversation(
+    user: string,
+    conversationId: string,
+    tags: string[],
+  ): Promise<string[]> {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -255,7 +455,7 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Increments tag counts for existing tags only.
    */
-  async function bulkIncrementTagCounts(user: string, tags: string[]) {
+  async function bulkIncrementTagCounts(user: string, tags: string[]): Promise<void> {
     if (!tags || tags.length === 0) {
       return;
     }
diff --git a/packages/data-schemas/src/methods/file.spec.ts b/packages/data-schemas/src/methods/file.spec.ts
index 9bb3895d27c..0abbdb4e8c7 100644
--- a/packages/data-schemas/src/methods/file.spec.ts
+++ b/packages/data-schemas/src/methods/file.spec.ts
@@ -2,10 +2,10 @@ import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import { EToolResources, FileContext } from 'librechat-data-provider';
+import { _resetStrictCache } from '~/models/plugins/tenantIsolation';
+import { runAsSystem } from '~/config/tenantContext';
 import { createFileMethods } from './file';
 import { createModels } from '~/models';
-import { runAsSystem } from '~/config/tenantContext';
-import { _resetStrictCache } from '~/models/plugins/tenantIsolation';
 
 let File: mongoose.Model<unknown>;
 let fileMethods: ReturnType<typeof createFileMethods>;
@@ -233,6 +233,69 @@ describe('File Methods', () => {
     });
   });
 
+  describe('getExpiredFiles', () => {
+    it('returns only files whose expiredAt date has passed', async () => {
+      const userId = new mongoose.Types.ObjectId();
+      const now = new Date('2030-01-01T00:00:00.000Z');
+      const expiredFileId = uuidv4();
+      const futureFileId = uuidv4();
+      const permanentFileId = uuidv4();
+      const missingExpiryFileId = uuidv4();
+
+      await fileMethods.createFile(
+        {
+          file_id: expiredFileId,
+          user: userId,
+          filename: 'expired.txt',
+          filepath: '/uploads/expired.txt',
+          type: 'text/plain',
+          bytes: 100,
+          expiredAt: new Date('2029-12-31T23:59:59.000Z'),
+        },
+        true,
+      );
+      await fileMethods.createFile(
+        {
+          file_id: futureFileId,
+          user: userId,
+          filename: 'future.txt',
+          filepath: '/uploads/future.txt',
+          type: 'text/plain',
+          bytes: 100,
+          expiredAt: new Date('2030-01-01T00:00:01.000Z'),
+        },
+        true,
+      );
+      await fileMethods.createFile(
+        {
+          file_id: permanentFileId,
+          user: userId,
+          filename: 'permanent.txt',
+          filepath: '/uploads/permanent.txt',
+          type: 'text/plain',
+          bytes: 100,
+          expiredAt: null,
+        },
+        true,
+      );
+      await fileMethods.createFile(
+        {
+          file_id: missingExpiryFileId,
+          user: userId,
+          filename: 'missing-expiry.txt',
+          filepath: '/uploads/missing-expiry.txt',
+          type: 'text/plain',
+          bytes: 100,
+        },
+        true,
+      );
+
+      const files = await fileMethods.getExpiredFiles(100, now);
+
+      expect(files.map((file) => file.file_id)).toEqual([expiredFileId]);
+    });
+  });
+
   describe('getToolFilesByIds', () => {
     it('should retrieve files for file_search tool (embedded files)', async () => {
       const userId = new mongoose.Types.ObjectId();
@@ -316,6 +379,47 @@ describe('File Methods', () => {
 
       expect(files).toHaveLength(0);
     });
+
+    it('owner-scopes historical tool file lookups', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const victimId = new mongoose.Types.ObjectId();
+      const ownerFileId = uuidv4();
+      const victimFileId = uuidv4();
+
+      await runAsSystem(() =>
+        fileMethods.createFile({
+          file_id: ownerFileId,
+          user: ownerId,
+          tenantId: 'tenant-a',
+          filename: 'owner-embedded.txt',
+          filepath: '/uploads/owner-embedded.txt',
+          type: 'text/plain',
+          bytes: 100,
+          embedded: true,
+        }),
+      );
+      await runAsSystem(() =>
+        fileMethods.createFile({
+          file_id: victimFileId,
+          user: victimId,
+          tenantId: 'tenant-a',
+          filename: 'victim-embedded.txt',
+          filepath: '/uploads/victim-embedded.txt',
+          type: 'text/plain',
+          bytes: 100,
+          embedded: true,
+        }),
+      );
+
+      const toolSet = new Set([EToolResources.file_search]);
+      const files = await fileMethods.getToolFilesByIds([ownerFileId, victimFileId], toolSet, {
+        userId: ownerId.toString(),
+        tenantId: 'tenant-a',
+      });
+
+      expect(files).toHaveLength(1);
+      expect(files[0].file_id).toBe(ownerFileId);
+    });
   });
 
   describe('getCodeGeneratedFiles', () => {
@@ -464,6 +568,160 @@ describe('File Methods', () => {
       const files = await fileMethods.getCodeGeneratedFiles(conversationId, [fileId]);
       expect(files).toEqual([]);
     });
+
+    it('owner-scopes code-generated file lookups', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const victimId = new mongoose.Types.ObjectId();
+      const conversationId = uuidv4();
+      const ownerFileId = uuidv4();
+      const victimFileId = uuidv4();
+
+      for (const [fileId, userId, filename] of [
+        [ownerFileId, ownerId, 'owner-output.csv'],
+        [victimFileId, victimId, 'victim-output.csv'],
+      ] as const) {
+        await runAsSystem(() =>
+          fileMethods.createFile({
+            file_id: fileId,
+            user: userId,
+            tenantId: 'tenant-a',
+            conversationId,
+            messageId: `msg-${fileId}`,
+            filename,
+            filepath: `/uploads/${filename}`,
+            type: 'text/csv',
+            bytes: 100,
+            context: FileContext.execute_code,
+            metadata: {
+              codeEnvRef: {
+                kind: 'user',
+                id: userId.toString(),
+                storage_session_id: `sess-${fileId}`,
+                file_id: fileId,
+              },
+            },
+          }),
+        );
+      }
+
+      const files = await fileMethods.getCodeGeneratedFiles(
+        conversationId,
+        [ownerFileId, victimFileId],
+        { userId: ownerId.toString(), tenantId: 'tenant-a' },
+      );
+
+      expect(files).toHaveLength(1);
+      expect(files[0].file_id).toBe(ownerFileId);
+    });
+  });
+
+  describe('getUserCodeFiles', () => {
+    it('returns only authenticated owner code-env uploads', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const victimId = new mongoose.Types.ObjectId();
+      const ownerFileId = uuidv4();
+      const victimFileId = uuidv4();
+
+      await runAsSystem(() =>
+        fileMethods.createFile({
+          file_id: ownerFileId,
+          user: ownerId,
+          tenantId: 'tenant-a',
+          conversationId: 'conversation-owner',
+          filename: 'owner.csv',
+          filepath: '/uploads/owner.csv',
+          source: 'local',
+          type: 'text/csv',
+          bytes: 100,
+          context: FileContext.message_attachment,
+          metadata: {
+            codeEnvRef: {
+              kind: 'user',
+              id: ownerId.toString(),
+              storage_session_id: 'owner-session',
+              file_id: ownerFileId,
+            },
+          },
+        }),
+      );
+      await runAsSystem(() =>
+        fileMethods.createFile({
+          file_id: victimFileId,
+          user: victimId,
+          tenantId: 'tenant-a',
+          conversationId: 'conversation-victim',
+          filename: 'victim.csv',
+          filepath: '/uploads/victim.csv',
+          source: 'local',
+          type: 'text/csv',
+          bytes: 100,
+          context: FileContext.message_attachment,
+          metadata: {
+            codeEnvRef: {
+              kind: 'user',
+              id: victimId.toString(),
+              storage_session_id: 'victim-session',
+              file_id: victimFileId,
+            },
+          },
+        }),
+      );
+
+      const files = await fileMethods.getUserCodeFiles([ownerFileId, victimFileId], {
+        userId: ownerId.toString(),
+        tenantId: 'tenant-a',
+      });
+
+      expect(files).toHaveLength(1);
+      expect(files[0]).toMatchObject({
+        file_id: ownerFileId,
+        filename: 'owner.csv',
+        filepath: '/uploads/owner.csv',
+        source: 'local',
+        metadata: {
+          codeEnvRef: {
+            kind: 'user',
+            id: ownerId.toString(),
+            storage_session_id: 'owner-session',
+            file_id: ownerFileId,
+          },
+        },
+      });
+    });
+
+    it('excludes files outside the authenticated tenant scope', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const fileId = uuidv4();
+
+      await runAsSystem(() =>
+        fileMethods.createFile({
+          file_id: fileId,
+          user: ownerId,
+          tenantId: 'tenant-b',
+          filename: 'tenant-b.csv',
+          filepath: '/uploads/tenant-b.csv',
+          source: 'local',
+          type: 'text/csv',
+          bytes: 100,
+          context: FileContext.message_attachment,
+          metadata: {
+            codeEnvRef: {
+              kind: 'user',
+              id: ownerId.toString(),
+              storage_session_id: 'tenant-b-session',
+              file_id: fileId,
+            },
+          },
+        }),
+      );
+
+      const files = await fileMethods.getUserCodeFiles([fileId], {
+        userId: ownerId.toString(),
+        tenantId: 'tenant-a',
+      });
+
+      expect(files).toEqual([]);
+    });
   });
 
   describe('updateFile', () => {
@@ -597,6 +855,43 @@ describe('File Methods', () => {
       const updated2 = await fileMethods.updateFileUsage({ file_id: fileId, inc: 5 });
       expect(updated2?.usage).toBe(6);
     });
+
+    it('should skip usage and TTL mutation when the owner filter does not match', async () => {
+      const fileId = uuidv4();
+      const ownerId = new mongoose.Types.ObjectId();
+      const otherUserId = new mongoose.Types.ObjectId();
+
+      await fileMethods.createFile({
+        file_id: fileId,
+        temp_file_id: 'tmp-file',
+        user: ownerId,
+        filename: 'owned.txt',
+        filepath: '/uploads/owned.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+      });
+
+      const denied = await fileMethods.updateFileUsage({
+        file_id: fileId,
+        user: otherUserId.toString(),
+      });
+      const unchanged = await fileMethods.findFileById(fileId);
+
+      expect(denied).toBeNull();
+      expect(unchanged?.usage).toBe(0);
+      expect(unchanged?.temp_file_id).toBe('tmp-file');
+      expect(unchanged?.expiresAt).toBeDefined();
+
+      const allowed = await fileMethods.updateFileUsage({
+        file_id: fileId,
+        user: ownerId.toString(),
+      });
+
+      expect(allowed?.usage).toBe(1);
+      expect(allowed?.temp_file_id).toBeUndefined();
+      expect(allowed?.expiresAt).toBeUndefined();
+    });
   });
 
   describe('updateFilesUsage', () => {
@@ -726,6 +1021,48 @@ describe('File Methods', () => {
       expect(updated).toHaveLength(1);
       expect((updated[0] as { usage: number }).usage).toBe(1);
     });
+
+    it('should only return and mutate files owned by the scoped user', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const otherUserId = new mongoose.Types.ObjectId();
+      const ownerFileId = uuidv4();
+      const otherFileId = uuidv4();
+
+      await fileMethods.createFile({
+        file_id: ownerFileId,
+        user: ownerId,
+        filename: 'owner.txt',
+        filepath: '/uploads/owner.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+      });
+      await fileMethods.createFile({
+        file_id: otherFileId,
+        temp_file_id: 'tmp-other',
+        user: otherUserId,
+        filename: 'other.txt',
+        filepath: '/uploads/other.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+        text: 'private extracted text',
+      });
+
+      const updated = await fileMethods.updateFilesUsage(
+        [{ file_id: ownerFileId }, { file_id: otherFileId }],
+        undefined,
+        { user: ownerId.toString() },
+      );
+      const otherFile = await fileMethods.findFileById(otherFileId);
+
+      expect(updated).toHaveLength(1);
+      expect(updated[0].file_id).toBe(ownerFileId);
+      expect(updated[0].usage).toBe(1);
+      expect(otherFile?.usage).toBe(0);
+      expect(otherFile?.temp_file_id).toBe('tmp-other');
+      expect(otherFile?.expiresAt).toBeDefined();
+    });
   });
 
   describe('deleteFile', () => {
diff --git a/packages/data-schemas/src/methods/file.ts b/packages/data-schemas/src/methods/file.ts
index e1b49b2c673..9d384bf7bb2 100644
--- a/packages/data-schemas/src/methods/file.ts
+++ b/packages/data-schemas/src/methods/file.ts
@@ -1,11 +1,88 @@
-import logger from '../config/winston';
 import { EToolResources, FileContext } from 'librechat-data-provider';
 import type { FilterQuery, SortOrder, Model } from 'mongoose';
 import type { IMongoFile } from '~/types/file';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import logger from '../config/winston';
+
+export type FileOwnerScope = {
+  userId: string;
+  tenantId?: string | null;
+};
+
+function withOwnerScope<T extends FilterQuery<IMongoFile>>(
+  filter: T,
+  ownerScope?: FileOwnerScope,
+): T & FilterQuery<IMongoFile> {
+  if (!ownerScope) {
+    return filter;
+  }
+
+  const scopedFilter: T & FilterQuery<IMongoFile> = {
+    ...filter,
+    user: ownerScope.userId,
+  };
+  if (ownerScope.tenantId) {
+    scopedFilter.tenantId = ownerScope.tenantId;
+  }
+  return scopedFilter;
+}
 
 /** Factory function that takes mongoose instance and returns the file methods */
-export function createFileMethods(mongoose: typeof import('mongoose')) {
+export function createFileMethods(mongoose: typeof import('mongoose')): {
+  findFileById: (file_id: string, options?: Record<string, unknown>) => Promise<IMongoFile | null>;
+  getFiles: (
+    filter: FilterQuery<IMongoFile>,
+    _sortOptions?: Record<string, SortOrder> | null,
+    selectFields?: Record<string, 0 | 1> | string | null,
+  ) => Promise<IMongoFile[] | null>;
+  getExpiredFiles: (limit?: number, now?: Date) => Promise<IMongoFile[]>;
+  getToolFilesByIds: (
+    fileIds: string[],
+    toolResourceSet?: Set<EToolResources>,
+    ownerScope?: FileOwnerScope,
+  ) => Promise<IMongoFile[]>;
+  getCodeGeneratedFiles: (
+    conversationId: string,
+    threadFileIds?: string[],
+    ownerScope?: FileOwnerScope,
+  ) => Promise<IMongoFile[]>;
+  getUserCodeFiles: (fileIds: string[], ownerScope: FileOwnerScope) => Promise<IMongoFile[]>;
+  claimCodeFile: (data: {
+    filename: string;
+    conversationId: string;
+    file_id: string;
+    user: string;
+    tenantId?: string | null;
+  }) => Promise<IMongoFile>;
+  createFile: (data: Partial<IMongoFile>, disableTTL?: boolean) => Promise<IMongoFile | null>;
+  updateFile: (
+    data: Partial<IMongoFile> & { file_id: string },
+    extraFilter?: FilterQuery<IMongoFile>,
+  ) => Promise<IMongoFile | null>;
+  updateFileUsage: (data: {
+    file_id: string;
+    inc?: number;
+    user?: string;
+    tenantId?: string | null;
+  }) => Promise<IMongoFile | null>;
+  deleteFile: (file_id: string) => Promise<IMongoFile | null>;
+  deleteFiles: (file_ids: string[], user?: string) => Promise<{ deletedCount?: number }>;
+  deleteFileByFilter: (filter: FilterQuery<IMongoFile>) => Promise<IMongoFile | null>;
+  batchUpdateFiles: (
+    updates: Array<{
+      file_id: string;
+      filepath: string;
+      storageKey?: string;
+      storageRegion?: string;
+    }>,
+  ) => Promise<void>;
+  updateFilesUsage: (
+    files: Array<{ file_id: string }>,
+    fileIds?: string[],
+    options?: { user?: string; tenantId?: string | null },
+  ) => Promise<IMongoFile[]>;
+  sweepOrphanedPreviews: (maxAgeMs?: number) => Promise<number>;
+} {
   /**
    * Finds a file by its file_id with additional query options.
    * @param file_id - The unique identifier of the file
@@ -34,7 +111,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function getFiles(
     filter: FilterQuery<IMongoFile>,
     _sortOptions?: Record<string, SortOrder> | null,
-    selectFields?: SelectProjection | string | null,
+    selectFields?: string | Record<string, 0 | 1> | null | undefined,
   ): Promise<IMongoFile[] | null> {
     const File = mongoose.models.File as Model<IMongoFile>;
     const sortOptions = { updatedAt: -1 as SortOrder, ..._sortOptions };
@@ -47,6 +124,14 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
     return await query.sort(sortOptions).lean<IMongoFile[]>();
   }
 
+  async function getExpiredFiles(limit = 100, now: Date = new Date()): Promise<IMongoFile[]> {
+    const File = mongoose.models.File as Model<IMongoFile>;
+    return await File.find({ expiredAt: { $ne: null, $lte: now } })
+      .sort({ expiredAt: 1 })
+      .limit(limit)
+      .lean<IMongoFile[]>();
+  }
+
   /**
    * Retrieves tool files (files that are embedded or have a fileIdentifier) from an array of file IDs.
    * Note: execute_code files are handled separately by getCodeGeneratedFiles.
@@ -57,6 +142,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function getToolFilesByIds(
     fileIds: string[],
     toolResourceSet?: Set<EToolResources>,
+    ownerScope?: FileOwnerScope,
   ): Promise<IMongoFile[]> {
     if (!fileIds || !fileIds.length || !toolResourceSet?.size) {
       return [];
@@ -77,11 +163,14 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
         return [];
       }
 
-      const filter: FilterQuery<IMongoFile> = {
-        file_id: { $in: fileIds },
-        context: { $ne: FileContext.execute_code },
-        $or: orConditions,
-      };
+      const filter = withOwnerScope(
+        {
+          file_id: { $in: fileIds },
+          context: { $ne: FileContext.execute_code },
+          $or: orConditions,
+        },
+        ownerScope,
+      );
 
       const selectFields: SelectProjection = { text: 0 };
       const sortOptions = { updatedAt: -1 as SortOrder };
@@ -130,6 +219,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function getCodeGeneratedFiles(
     conversationId: string,
     threadFileIds?: string[],
+    ownerScope?: FileOwnerScope,
   ): Promise<IMongoFile[]> {
     if (!conversationId) {
       return [];
@@ -147,12 +237,15 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
     }
 
     try {
-      const filter: FilterQuery<IMongoFile> = {
-        conversationId,
-        context: FileContext.execute_code,
-        file_id: { $in: threadFileIds },
-        'metadata.codeEnvRef': { $exists: true },
-      };
+      const filter = withOwnerScope(
+        {
+          conversationId,
+          context: FileContext.execute_code,
+          file_id: { $in: threadFileIds },
+          'metadata.codeEnvRef': { $exists: true },
+        },
+        ownerScope,
+      );
 
       const selectFields: SelectProjection = { text: 0 };
       const sortOptions = { createdAt: 1 as SortOrder };
@@ -170,19 +263,26 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
    * These are files with fileIdentifier metadata but context is NOT execute_code (e.g., agents or message_attachment).
    * File IDs should be collected from message.files arrays in the current thread.
    * @param fileIds - Array of file IDs to fetch (from message.files in the thread)
+   * @param ownerScope - Authenticated owner scope used to constrain historical refs
    * @returns User-uploaded execute_code files
    */
-  async function getUserCodeFiles(fileIds?: string[]): Promise<IMongoFile[]> {
+  async function getUserCodeFiles(
+    fileIds: string[],
+    ownerScope: FileOwnerScope,
+  ): Promise<IMongoFile[]> {
     if (!fileIds || fileIds.length === 0) {
       return [];
     }
 
     try {
-      const filter: FilterQuery<IMongoFile> = {
-        file_id: { $in: fileIds },
-        context: { $ne: FileContext.execute_code },
-        'metadata.codeEnvRef': { $exists: true },
-      };
+      const filter = withOwnerScope(
+        {
+          file_id: { $in: fileIds },
+          context: { $ne: FileContext.execute_code },
+          'metadata.codeEnvRef': { $exists: true },
+        },
+        ownerScope,
+      );
 
       const selectFields: SelectProjection = { text: 0 };
       const sortOptions = { createdAt: 1 as SortOrder };
@@ -297,14 +397,20 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function updateFileUsage(data: {
     file_id: string;
     inc?: number;
+    user?: string;
+    tenantId?: string | null;
   }): Promise<IMongoFile | null> {
     const File = mongoose.models.File as Model<IMongoFile>;
-    const { file_id, inc = 1 } = data;
+    const { file_id, inc = 1, user, tenantId } = data;
     const updateOperation = {
       $inc: { usage: inc },
       $unset: { expiresAt: '', temp_file_id: '' },
     };
-    return File.findOneAndUpdate({ file_id }, updateOperation, {
+    // Owner scoping is fail-closed: mismatches leave usage and TTL metadata unchanged.
+    const query: FilterQuery<IMongoFile> = user
+      ? withOwnerScope({ file_id }, { userId: user, tenantId })
+      : { file_id };
+    return File.findOneAndUpdate(query, updateOperation, {
       new: true,
     }).lean<IMongoFile>();
   }
@@ -392,9 +498,13 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function updateFilesUsage(
     files: Array<{ file_id: string }>,
     fileIds?: string[],
+    options?: { user?: string; tenantId?: string | null },
   ): Promise<IMongoFile[]> {
     const promises: Promise<IMongoFile | null>[] = [];
     const seen = new Set<string>();
+    // Preserve the same owner scope for every deduped ID in this batch.
+    const user = options?.user;
+    const tenantId = options?.tenantId;
 
     for (const file of files) {
       const { file_id } = file;
@@ -402,7 +512,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
         continue;
       }
       seen.add(file_id);
-      promises.push(updateFileUsage({ file_id }));
+      promises.push(updateFileUsage({ file_id, user, tenantId }));
     }
 
     if (!fileIds) {
@@ -415,7 +525,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
         continue;
       }
       seen.add(file_id);
-      promises.push(updateFileUsage({ file_id }));
+      promises.push(updateFileUsage({ file_id, user, tenantId }));
     }
 
     const results = await Promise.all(promises);
@@ -457,6 +567,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   return {
     findFileById,
     getFiles,
+    getExpiredFiles,
     getToolFilesByIds,
     getCodeGeneratedFiles,
     getUserCodeFiles,
diff --git a/packages/data-schemas/src/methods/index.ts b/packages/data-schemas/src/methods/index.ts
index e10a6731313..b24120fc2e7 100644
--- a/packages/data-schemas/src/methods/index.ts
+++ b/packages/data-schemas/src/methods/index.ts
@@ -1,10 +1,10 @@
+import type { RoleMethods, RoleDeps } from './role';
 import { createSessionMethods, DEFAULT_REFRESH_TOKEN_EXPIRY, type SessionMethods } from './session';
+import { createUserMethods, DEFAULT_SESSION_EXPIRY, type UserMethods } from './user';
+import { createFileMethods, type FileMethods, type FileOwnerScope } from './file';
 import { createTokenMethods, type TokenMethods } from './token';
 import { createRoleMethods, RoleConflictError } from './role';
-import type { RoleMethods, RoleDeps } from './role';
-import { createUserMethods, DEFAULT_SESSION_EXPIRY, type UserMethods } from './user';
 import { createKeyMethods, type KeyMethods } from './key';
-import { createFileMethods, type FileMethods } from './file';
 /* Memories */
 import { createMemoryMethods, type MemoryMethods } from './memory';
 /* Agent Categories */
@@ -21,6 +21,14 @@ import { createUserGroupMethods, type UserGroupMethods } from './userGroup';
 import { createUserStatsMethods, type UserStatsMethods } from './userStats';
 import { createAclEntryMethods, permissionBitSupersets, type AclEntryMethods } from './aclEntry';
 import { createSystemGrantMethods, type SystemGrantMethods } from './systemGrant';
+import {
+  createAuditLogMethods,
+  AUDIT_SCHEMA_VERSION,
+  MAX_AUDIT_EXPORT_ROWS,
+  MAX_AUDIT_LOG_LIMIT,
+  MAX_AUDIT_VERIFY_ROWS,
+  type AuditLogMethods,
+} from './auditLog';
 import { createShareMethods, type ShareMethods } from './share';
 /* Tier 1 — Simple CRUD */
 import { createActionMethods, type ActionMethods } from './action';
@@ -33,6 +41,17 @@ import { createPresetMethods, type PresetMethods } from './preset';
 import { createConversationTagMethods, type ConversationTagMethods } from './conversationTag';
 import { createMessageMethods, type MessageMethods } from './message';
 import { createConversationMethods, type ConversationMethods } from './conversation';
+import { createChatProjectMethods, type ChatProjectMethods } from './chatProject';
+export type {
+  AssignConversationToProjectResult,
+  ChatProjectSortBy,
+  ChatProjectSortDirection,
+  CreateChatProjectInput,
+  DeleteChatProjectResult,
+  ListChatProjectsOptions,
+  ListChatProjectsResult,
+  UpdateChatProjectInput,
+} from './chatProject';
 /* Tier 3 — Complex (heavier injection) */
 import {
   createTxMethods,
@@ -48,6 +67,14 @@ import { createSpendTokensMethods, type SpendTokensMethods } from './spendTokens
 import { createPromptMethods, type PromptMethods, type PromptDeps } from './prompt';
 import {
   createSkillMethods,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+  inferSkillFileCategory,
   type SkillMethods,
   type SkillDeps,
   type CreateSkillInput,
@@ -59,14 +86,31 @@ import {
   type UpdateSkillResult,
   type ValidationIssue,
 } from './skill';
+import { createSkillSyncMethods, type SkillSyncMethods } from './skillSync';
+import type {
+  SkillSyncStatusInput,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+} from './skillSync';
 /* Tier 5 — Agent */
 import { createAgentMethods, type AgentMethods, type AgentDeps } from './agent';
 /* Config */
 import { createConfigMethods, type ConfigMethods } from './config';
 
 export { RoleConflictError, DEFAULT_REFRESH_TOKEN_EXPIRY, DEFAULT_SESSION_EXPIRY };
-export { tokenValues, cacheTokenValues, premiumTokenValues, defaultRate };
+export { tokenValues, cacheTokenValues, premiumTokenValues, defaultRate, createTxMethods };
 export { permissionBitSupersets };
+export {
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+  inferSkillFileCategory,
+};
+export { AUDIT_SCHEMA_VERSION, MAX_AUDIT_EXPORT_ROWS, MAX_AUDIT_LOG_LIMIT, MAX_AUDIT_VERIFY_ROWS };
 
 export type AllMethods = UserMethods &
   UserStatsMethods &
@@ -82,6 +126,7 @@ export type AllMethods = UserMethods &
   UserGroupMethods &
   AclEntryMethods &
   SystemGrantMethods &
+  AuditLogMethods &
   ShareMethods &
   AccessRoleMethods &
   PluginAuthMethods &
@@ -94,11 +139,13 @@ export type AllMethods = UserMethods &
   ConversationTagMethods &
   MessageMethods &
   ConversationMethods &
+  ChatProjectMethods &
   TxMethods &
   TransactionMethods &
   SpendTokensMethods &
   PromptMethods &
   SkillMethods &
+  SkillSyncMethods &
   AgentMethods &
   ConfigMethods;
 
@@ -208,6 +255,7 @@ export function createMethods(
     ...createUserGroupMethods(mongoose),
     ...aclEntryMethods,
     ...systemGrantMethods,
+    ...createAuditLogMethods(mongoose),
     ...createShareMethods(mongoose),
     ...createPluginAuthMethods(mongoose),
     /* Tier 1 */
@@ -221,12 +269,14 @@ export function createMethods(
     ...createConversationTagMethods(mongoose),
     ...messageMethods,
     ...conversationMethods,
+    ...createChatProjectMethods(mongoose),
     /* Tier 3 */
     ...txMethods,
     ...transactionMethods,
     ...spendTokensMethods,
     ...promptMethods,
     ...skillMethods,
+    ...createSkillSyncMethods(mongoose),
     /* Tier 5 */
     ...agentMethods,
     /* Config */
@@ -242,6 +292,7 @@ export type {
   RoleMethods,
   KeyMethods,
   FileMethods,
+  FileOwnerScope,
   MemoryMethods,
   AgentCategoryMethods,
   AgentApiKeyMethods,
@@ -249,6 +300,7 @@ export type {
   UserGroupMethods,
   AclEntryMethods,
   SystemGrantMethods,
+  AuditLogMethods,
   ShareMethods,
   AccessRoleMethods,
   PluginAuthMethods,
@@ -261,6 +313,7 @@ export type {
   ConversationTagMethods,
   MessageMethods,
   ConversationMethods,
+  ChatProjectMethods,
   TxMethods,
   TransactionMethods,
   SpendTokensMethods,
@@ -275,6 +328,10 @@ export type {
   ListSkillsByAccessResult,
   UpdateSkillResult,
   ValidationIssue,
+  SkillSyncStatusInput,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+  SkillSyncMethods,
   AgentMethods,
   ConfigMethods,
 };
diff --git a/packages/data-schemas/src/methods/key.ts b/packages/data-schemas/src/methods/key.ts
index 094b1f9dfcd..8a7c8a337a6 100644
--- a/packages/data-schemas/src/methods/key.ts
+++ b/packages/data-schemas/src/methods/key.ts
@@ -4,7 +4,21 @@ import { encrypt, decrypt } from '~/crypto';
 import logger from '~/config/winston';
 
 /** Factory function that takes mongoose instance and returns the key methods */
-export function createKeyMethods(mongoose: typeof import('mongoose')) {
+export function createKeyMethods(mongoose: typeof import('mongoose')): {
+  getUserKey: (params: { userId: string; name: string }) => Promise<string>;
+  updateUserKey: (params: {
+    userId: string;
+    name: string;
+    value: string;
+    expiresAt?: Date | null;
+  }) => Promise<unknown>;
+  deleteUserKey: (params: { userId: string; name?: string; all?: boolean }) => Promise<unknown>;
+  getUserKeyValues: (params: { userId: string; name: string }) => Promise<Record<string, string>>;
+  getUserKeyExpiry: (params: {
+    userId: string;
+    name: string;
+  }) => Promise<{ expiresAt: Date | 'never' | null }>;
+} {
   /**
    * Retrieves and decrypts the key value for a given user identified by userId and identifier name.
    * @param params - The parameters object
diff --git a/packages/data-schemas/src/methods/mcpServer.spec.ts b/packages/data-schemas/src/methods/mcpServer.spec.ts
index 66f09824382..9d5f915bfde 100644
--- a/packages/data-schemas/src/methods/mcpServer.spec.ts
+++ b/packages/data-schemas/src/methods/mcpServer.spec.ts
@@ -141,6 +141,37 @@ describe('MCPServer Model Tests', () => {
       expect(server.serverName).toBe('test-server-2');
     });
 
+    test('should append suffix when base name is reserved', async () => {
+      const server = await methods.createMCPServer({
+        config: createSSEConfig('Test Server'),
+        author: authorId,
+        reservedServerNames: ['test-server'],
+      });
+
+      expect(server.serverName).toBe('test-server-2');
+    });
+
+    test('should skip both DB and reserved names when finding next suffix', async () => {
+      await MCPServer.create({
+        serverName: 'test-server',
+        config: createSSEConfig('Test Server'),
+        author: authorId,
+      });
+      await MCPServer.create({
+        serverName: 'test-server-2',
+        config: createSSEConfig('Test Server'),
+        author: authorId,
+      });
+
+      const server = await methods.createMCPServer({
+        config: createSSEConfig('Test Server'),
+        author: authorId,
+        reservedServerNames: ['test-server-3'],
+      });
+
+      expect(server.serverName).toBe('test-server-4');
+    });
+
     test('should find next available number in sequence', async () => {
       // Create servers with sequential names
       await MCPServer.create({
diff --git a/packages/data-schemas/src/methods/mcpServer.ts b/packages/data-schemas/src/methods/mcpServer.ts
index 4851e2c5664..f6d8868f62a 100644
--- a/packages/data-schemas/src/methods/mcpServer.ts
+++ b/packages/data-schemas/src/methods/mcpServer.ts
@@ -1,8 +1,8 @@
+import { nanoid } from 'nanoid';
 import type { Model, RootFilterQuery, Types } from 'mongoose';
-import type { MCPServerDocument } from '../types';
 import type { MCPOptions } from 'librechat-data-provider';
+import type { MCPServerDocument } from '../types';
 import logger from '~/config/winston';
-import { nanoid } from 'nanoid';
 
 const NORMALIZED_LIMIT_DEFAULT = 20;
 const MAX_CREATE_RETRIES = 5;
@@ -44,29 +44,72 @@ function generateServerNameFromTitle(title: string): string {
   return slug || 'mcp-server'; // Fallback if empty
 }
 
-export function createMCPServerMethods(mongoose: typeof import('mongoose')) {
+export function createMCPServerMethods(mongoose: typeof import('mongoose')): {
+  createMCPServer: (data: {
+    config: MCPOptions;
+    author: string | Types.ObjectId;
+    reservedServerNames?: Iterable<string>;
+  }) => Promise<MCPServerDocument>;
+  findMCPServerByServerName: (serverName: string) => Promise<MCPServerDocument | null>;
+  findMCPServerByObjectId: (_id: string | Types.ObjectId) => Promise<MCPServerDocument | null>;
+  findMCPServersByAuthor: (authorId: string | Types.ObjectId) => Promise<MCPServerDocument[]>;
+  getListMCPServersByIds: ({
+    ids,
+    otherParams,
+    limit,
+    after,
+  }: {
+    ids?: Types.ObjectId[];
+    otherParams?: RootFilterQuery<MCPServerDocument>;
+    limit?: number | null;
+    after?: string | null;
+  }) => Promise<{
+    data: MCPServerDocument[];
+    has_more: boolean;
+    after: string | null;
+  }>;
+  getListMCPServersByNames: ({ names }: { names: string[] }) => Promise<{
+    data: MCPServerDocument[];
+  }>;
+  updateMCPServer: (
+    serverName: string,
+    updateData: { config?: MCPOptions },
+  ) => Promise<MCPServerDocument | null>;
+  deleteMCPServer: (serverName: string) => Promise<MCPServerDocument | null>;
+} {
   /**
-   * Finds the next available server name by checking for duplicates.
-   * If baseName exists, returns baseName-2, baseName-3, etc.
+   * Finds the next available server name by checking DB and reserved-name collisions.
+   * If baseName is taken or reserved, returns baseName-2, baseName-3, etc.
    */
-  async function findNextAvailableServerName(baseName: string): Promise<string> {
+  async function findNextAvailableServerName(
+    baseName: string,
+    reservedServerNames: Set<string> = new Set(),
+  ): Promise<string> {
     const MCPServer = mongoose.models.MCPServer as Model<MCPServerDocument>;
 
     // Find all servers with matching base name pattern (baseName or baseName-N)
     const escapedBaseName = escapeRegex(baseName);
+    const matchingNamePattern = new RegExp(`^${escapedBaseName}(-\\d+)?$`);
     const existing = await MCPServer.find({
-      serverName: { $regex: `^${escapedBaseName}(-\\d+)?$` },
+      serverName: { $regex: matchingNamePattern },
     })
       .select('serverName')
       .lean<Array<{ serverName: string }>>();
 
-    if (existing.length === 0) {
+    const existingNames = new Set([
+      ...existing.map((server) => server.serverName),
+      ...Array.from(reservedServerNames).filter((serverName) =>
+        matchingNamePattern.test(serverName),
+      ),
+    ]);
+
+    if (existingNames.size === 0) {
       return baseName;
     }
 
     // Extract numbers from existing names
-    const numbers = existing.map((s) => {
-      const match = s.serverName.match(/-(\d+)$/);
+    const numbers = Array.from(existingNames).map((serverName) => {
+      const match = serverName.match(/-(\d+)$/);
       return match ? parseInt(match[1], 10) : 1;
     });
 
@@ -86,9 +129,11 @@ export function createMCPServerMethods(mongoose: typeof import('mongoose')) {
   async function createMCPServer(data: {
     config: MCPOptions;
     author: string | Types.ObjectId;
+    reservedServerNames?: Iterable<string>;
   }): Promise<MCPServerDocument> {
     const MCPServer = mongoose.models.MCPServer as Model<MCPServerDocument>;
     let lastError: unknown;
+    const reservedServerNames = new Set(data.reservedServerNames ?? []);
 
     for (let attempt = 0; attempt < MAX_CREATE_RETRIES; attempt++) {
       try {
@@ -97,7 +142,7 @@ export function createMCPServerMethods(mongoose: typeof import('mongoose')) {
         let serverName: string;
         if (data.config.title) {
           const baseSlug = generateServerNameFromTitle(data.config.title);
-          serverName = await findNextAvailableServerName(baseSlug);
+          serverName = await findNextAvailableServerName(baseSlug, reservedServerNames);
         } else {
           serverName = `mcp-${nanoid(16)}`;
         }
diff --git a/packages/data-schemas/src/methods/memory.ts b/packages/data-schemas/src/methods/memory.ts
index 749fbc9cf12..7c895351982 100644
--- a/packages/data-schemas/src/methods/memory.ts
+++ b/packages/data-schemas/src/methods/memory.ts
@@ -1,6 +1,6 @@
 import { Types } from 'mongoose';
-import logger from '~/config/winston';
 import type * as t from '~/types';
+import logger from '~/config/winston';
 
 /**
  * Formats a date in YYYY-MM-DD format
@@ -10,7 +10,16 @@ const formatDate = (date: Date): string => {
 };
 
 // Factory function that takes mongoose instance and returns the methods
-export function createMemoryMethods(mongoose: typeof import('mongoose')) {
+export function createMemoryMethods(mongoose: typeof import('mongoose')): {
+  setMemory: ({ userId, key, value, tokenCount }: t.SetMemoryParams) => Promise<t.MemoryResult>;
+  createMemory: ({ userId, key, value, tokenCount }: t.SetMemoryParams) => Promise<t.MemoryResult>;
+  deleteMemory: ({ userId, key }: t.DeleteMemoryParams) => Promise<t.MemoryResult>;
+  getAllUserMemories: (userId: string | Types.ObjectId) => Promise<t.IMemoryEntryLean[]>;
+  getFormattedMemories: ({
+    userId,
+  }: t.GetFormattedMemoriesParams) => Promise<t.FormattedMemoriesResult>;
+  deleteAllUserMemories: (userId: string | Types.ObjectId) => Promise<number>;
+} {
   /**
    * Creates a new memory entry for a user
    * Throws an error if a memory with the same key already exists
diff --git a/packages/data-schemas/src/methods/message.spec.ts b/packages/data-schemas/src/methods/message.spec.ts
index 14fe28596d0..7e3747d12cb 100644
--- a/packages/data-schemas/src/methods/message.spec.ts
+++ b/packages/data-schemas/src/methods/message.spec.ts
@@ -1,10 +1,14 @@
 import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
+import { RetentionMode } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import type { IMessage } from '..';
-import { createMessageMethods } from './message';
 import { tenantStorage, runAsSystem } from '~/config/tenantContext';
+import { createMessageMethods } from './message';
 import { createModels } from '../models';
+import logger from '~/config/winston';
+
+const waitForTimestampTick = () => new Promise((resolve) => setTimeout(resolve, 2));
 
 jest.mock('~/config/winston', () => ({
   error: jest.fn(),
@@ -17,6 +21,7 @@ let mongoServer: InstanceType<typeof MongoMemoryServer>;
 let Message: mongoose.Model<IMessage>;
 let saveMessage: ReturnType<typeof createMessageMethods>['saveMessage'];
 let getMessages: ReturnType<typeof createMessageMethods>['getMessages'];
+let getMessageTextStats: ReturnType<typeof createMessageMethods>['getMessageTextStats'];
 let updateMessage: ReturnType<typeof createMessageMethods>['updateMessage'];
 let deleteMessages: ReturnType<typeof createMessageMethods>['deleteMessages'];
 let bulkSaveMessages: ReturnType<typeof createMessageMethods>['bulkSaveMessages'];
@@ -35,6 +40,7 @@ beforeAll(async () => {
   const methods = createMessageMethods(mongoose);
   saveMessage = methods.saveMessage;
   getMessages = methods.getMessages;
+  getMessageTextStats = methods.getMessageTextStats;
   updateMessage = methods.updateMessage;
   deleteMessages = methods.deleteMessages;
   bulkSaveMessages = methods.bulkSaveMessages;
@@ -54,7 +60,7 @@ describe('Message Operations', () => {
   let mockCtx: {
     userId: string;
     isTemporary?: boolean;
-    interfaceConfig?: { temporaryChatRetention?: number };
+    interfaceConfig?: { temporaryChatRetention?: number; retentionMode?: RetentionMode };
   };
   let mockMessageData: Partial<IMessage> = {
     messageId: 'msg123',
@@ -64,6 +70,8 @@ describe('Message Operations', () => {
   };
 
   beforeEach(async () => {
+    jest.clearAllMocks();
+
     // Clear database
     await Message.deleteMany({});
 
@@ -106,6 +114,18 @@ describe('Message Operations', () => {
       const result = await saveMessage(mockCtx, mockMessageData);
       expect(result).toBeUndefined();
     });
+
+    it('should not log message params for invalid conversation IDs', async () => {
+      mockMessageData.conversationId = 'invalid-id';
+      mockMessageData.text = 'Sensitive prompt text';
+
+      await saveMessage(mockCtx, mockMessageData, { context: 'message-save-test' });
+
+      expect(logger.warn).toHaveBeenCalledWith(
+        'Invalid conversation ID: invalid-id (context: message-save-test)',
+      );
+      expect(logger.info).not.toHaveBeenCalled();
+    });
   });
 
   describe('updateMessageText', () => {
@@ -166,6 +186,8 @@ describe('Message Operations', () => {
         user: 'user123',
       });
 
+      await waitForTimestampTick();
+
       await saveMessage(mockCtx, {
         messageId: 'msg3',
         conversationId,
@@ -220,6 +242,62 @@ describe('Message Operations', () => {
       expect(messages[0].text).toBe('First message');
       expect(messages[1].text).toBe('Second message');
     });
+
+    it('should limit retrieved messages when requested', async () => {
+      const conversationId = uuidv4();
+
+      await saveMessage(mockCtx, {
+        messageId: 'msg1',
+        conversationId,
+        text: 'First message',
+        user: 'user123',
+      });
+
+      await saveMessage(mockCtx, {
+        messageId: 'msg2',
+        conversationId,
+        text: 'Second message',
+        user: 'user123',
+      });
+
+      await saveMessage(mockCtx, {
+        messageId: 'msg3',
+        conversationId,
+        text: 'Third message',
+        user: 'user123',
+      });
+
+      const messages = await getMessages({ conversationId }, undefined, { limit: 2 });
+
+      expect(messages).toHaveLength(2);
+      expect(messages[0].text).toBe('First message');
+      expect(messages[1].text).toBe('Second message');
+    });
+
+    it('should retrieve message text stats without returning message bodies', async () => {
+      const conversationId = uuidv4();
+
+      await saveMessage(mockCtx, {
+        messageId: 'msg1',
+        conversationId,
+        text: 'hello',
+        quotes: ['a\nb', ''],
+        user: 'user123',
+      });
+
+      const stats = await getMessageTextStats({ conversationId, user: 'user123' }, { limit: 1 });
+
+      expect(stats).toEqual([
+        {
+          messageId: 'msg1',
+          textBytes: 5,
+          quoteCount: 2,
+          quoteBytes: 3,
+          quoteLineCount: 3,
+          nonStringQuoteCount: 0,
+        },
+      ]);
+    });
   });
 
   describe('deleteMessages', () => {
@@ -403,7 +481,7 @@ describe('Message Operations', () => {
       const result = await saveMessage(mockCtx, mockMessageData);
 
       expect(result?.messageId).toBe('msg123');
-      expect(result?.expiredAt).toBeNull();
+      expect(result?.expiredAt).toBeUndefined();
     });
 
     it('should use custom retention period from config', async () => {
@@ -475,6 +553,61 @@ describe('Message Operations', () => {
       );
     });
 
+    it('should set expiredAt for non-temporary message when retentionMode is ALL', async () => {
+      mockCtx.isTemporary = false;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+      const result = await saveMessage(mockCtx, mockMessageData);
+      expect(result?.expiredAt).toBeDefined();
+      expect(result?.expiredAt).toBeInstanceOf(Date);
+    });
+
+    it('should mark retained message non-temporary when retentionMode is ALL and isTemporary is omitted', async () => {
+      mockCtx.isTemporary = undefined;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+
+      const result = await saveMessage(mockCtx, mockMessageData);
+
+      expect(result?.expiredAt).toBeDefined();
+      expect(result?.isTemporary).toBe(false);
+    });
+
+    it('should preserve existing temporary flag when retentionMode is ALL and isTemporary is omitted', async () => {
+      mockCtx.isTemporary = true;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.ALL,
+      };
+
+      const firstSave = await saveMessage(mockCtx, mockMessageData);
+
+      mockCtx.isTemporary = undefined;
+      const secondSave = await saveMessage(mockCtx, {
+        ...mockMessageData,
+        text: 'Updated text',
+      });
+
+      expect(firstSave?.isTemporary).toBe(true);
+      expect(secondSave?.text).toBe('Updated text');
+      expect(secondSave?.isTemporary).toBe(true);
+      expect(secondSave?.expiredAt).toBeDefined();
+    });
+
+    it('should not set expiredAt when retentionMode is temporary and not isTemporary', async () => {
+      mockCtx.isTemporary = false;
+      mockCtx.interfaceConfig = {
+        temporaryChatRetention: 24,
+        retentionMode: RetentionMode.TEMPORARY,
+      };
+      const result = await saveMessage(mockCtx, mockMessageData);
+      expect(result?.expiredAt).toBeNull();
+    });
+
     it('should handle missing config gracefully', async () => {
       // Simulate missing config - should use default retention period
       delete mockCtx.interfaceConfig;
@@ -571,6 +704,22 @@ describe('Message Operations', () => {
       );
     });
 
+    it('should preserve temporary retention when saving without isTemporary', async () => {
+      mockCtx.interfaceConfig = { temporaryChatRetention: 24 };
+
+      mockCtx.isTemporary = true;
+      const firstSave = await saveMessage(mockCtx, mockMessageData);
+      const originalExpiredAt = firstSave?.expiredAt;
+
+      mockCtx.isTemporary = undefined;
+      const updatedData = { ...mockMessageData, text: 'Updated text' };
+      const secondSave = await saveMessage(mockCtx, updatedData);
+
+      expect(secondSave?.text).toBe('Updated text');
+      expect(secondSave?.isTemporary).toBe(true);
+      expect(secondSave?.expiredAt).toEqual(originalExpiredAt);
+    });
+
     it('should handle bulk operations with temporary messages', async () => {
       // This test verifies bulkSaveMessages doesn't interfere with expiredAt
       const messages = [
diff --git a/packages/data-schemas/src/methods/message.ts b/packages/data-schemas/src/methods/message.ts
index b4b5038ca82..42273cbf5f9 100644
--- a/packages/data-schemas/src/methods/message.ts
+++ b/packages/data-schemas/src/methods/message.ts
@@ -1,12 +1,32 @@
-import type { DeleteResult, FilterQuery, Model } from 'mongoose';
-import logger from '~/config/winston';
+import { RetentionMode } from 'librechat-data-provider';
+import type { DeleteResult, FilterQuery, Model, PipelineStage } from 'mongoose';
+import type { AppConfig, IMessage } from '~/types';
 import { createTempChatExpirationDate } from '~/utils/tempChatRetention';
+import { createFallbackRetentionDate } from '~/utils/retention';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
-import type { AppConfig, IMessage } from '~/types';
+import logger from '~/config/winston';
 
 /** Simple UUID v4 regex to replace zod validation */
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+interface MessageQueryOptions {
+  limit?: number;
+  sort?: Record<string, 1 | -1> | false;
+}
+
+interface MessageTextStatsOptions {
+  limit?: number;
+}
+
+export interface MessageTextStats {
+  messageId: string;
+  textBytes: number;
+  quoteCount: number;
+  quoteBytes: number;
+  quoteLineCount: number;
+  nonStringQuoteCount: number;
+}
+
 export interface MessageMethods {
   saveMessage(
     ctx: { userId: string; isTemporary?: boolean; interfaceConfig?: AppConfig['interfaceConfig'] },
@@ -35,7 +55,15 @@ export interface MessageMethods {
     userId: string,
     params: { messageId: string; conversationId: string },
   ): Promise<DeleteResult>;
-  getMessages(filter: FilterQuery<IMessage>, select?: string): Promise<IMessage[]>;
+  getMessages(
+    filter: FilterQuery<IMessage>,
+    select?: string,
+    options?: MessageQueryOptions,
+  ): Promise<IMessage[]>;
+  getMessageTextStats(
+    filter: FilterQuery<IMessage>,
+    options?: MessageTextStatsOptions,
+  ): Promise<MessageTextStats[]>;
   getMessage(params: { user: string; messageId: string }): Promise<IMessage | null>;
   getMessagesByCursor(
     filter: FilterQuery<IMessage>,
@@ -77,9 +105,9 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
 
     const conversationId = params.conversationId as string | undefined;
     if (!conversationId || !UUID_REGEX.test(conversationId)) {
-      logger.warn(`Invalid conversation ID: ${conversationId}`);
-      logger.info(`---\`saveMessage\` context: ${metadata?.context}`);
-      logger.info(`---Invalid conversation ID Params: ${JSON.stringify(params, null, 2)}`);
+      logger.warn(
+        `Invalid conversation ID: ${conversationId} (context: ${metadata?.context ?? 'n/a'})`,
+      );
       return;
     }
 
@@ -91,15 +119,28 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
         messageId: params.newMessageId || params.messageId,
       };
 
-      if (isTemporary) {
+      if (interfaceConfig?.retentionMode === RetentionMode.ALL) {
+        if (typeof isTemporary === 'boolean') {
+          update.isTemporary = isTemporary;
+        }
+        try {
+          update.expiredAt = createTempChatExpirationDate(interfaceConfig);
+        } catch (err) {
+          logger.error('Error creating temporary chat expiration date:', err);
+          logger.info(`---\`saveMessage\` context: ${metadata?.context}`);
+          update.expiredAt = createFallbackRetentionDate();
+        }
+      } else if (isTemporary === true) {
+        update.isTemporary = true;
         try {
           update.expiredAt = createTempChatExpirationDate(interfaceConfig);
         } catch (err) {
           logger.error('Error creating temporary chat expiration date:', err);
           logger.info(`---\`saveMessage\` context: ${metadata?.context}`);
-          update.expiredAt = null;
+          update.expiredAt = createFallbackRetentionDate();
         }
-      } else {
+      } else if (isTemporary === false) {
+        update.isTemporary = false;
         update.expiredAt = null;
       }
 
@@ -116,6 +157,19 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
         { upsert: true, new: true },
       );
 
+      if (
+        interfaceConfig?.retentionMode === RetentionMode.ALL &&
+        typeof isTemporary !== 'boolean' &&
+        (message.isTemporary == null ||
+          (message.isTemporary === false && message.$isDefault('isTemporary')))
+      ) {
+        await Message.updateOne(
+          { _id: message._id, isTemporary: { $ne: false } },
+          { $set: { isTemporary: false } },
+        );
+        message.isTemporary = false;
+      }
+
       return message.toObject();
     } catch (err: unknown) {
       logger.error('Error saving message:', err);
@@ -257,6 +311,7 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
         isCreatedByUser: updatedMessage.isCreatedByUser,
         tokenCount: updatedMessage.tokenCount,
         feedback: updatedMessage.feedback,
+        endpoint: updatedMessage.endpoint,
       };
     } catch (err) {
       logger.error('Error updating message:', err);
@@ -294,20 +349,118 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
   /**
    * Retrieves messages from the database.
    */
-  async function getMessages(filter: FilterQuery<IMessage>, select?: string) {
+  async function getMessages(
+    filter: FilterQuery<IMessage>,
+    select?: string,
+    options: MessageQueryOptions = {},
+  ) {
     try {
       const Message = mongoose.models.Message as Model<IMessage>;
+      const query = Message.find(filter);
       if (select) {
-        return await Message.find(filter).select(select).sort({ createdAt: 1 }).lean<IMessage[]>();
+        query.select(select);
+      }
+      if (options.sort !== false) {
+        query.sort(options.sort ?? { createdAt: 1 });
+      }
+      if (options.limit != null && options.limit > 0) {
+        query.limit(options.limit);
       }
 
-      return await Message.find(filter).sort({ createdAt: 1 }).lean<IMessage[]>();
+      return await query.lean<IMessage[]>();
     } catch (err) {
       logger.error('Error getting messages:', err);
       throw err;
     }
   }
 
+  async function getMessageTextStats(
+    filter: FilterQuery<IMessage>,
+    options: MessageTextStatsOptions = {},
+  ) {
+    try {
+      const Message = mongoose.models.Message as Model<IMessage>;
+      const pipeline: PipelineStage[] = [{ $match: filter }];
+      if (options.limit != null && options.limit > 0) {
+        pipeline.push({ $limit: options.limit });
+      }
+      pipeline.push({
+        $project: {
+          _id: 0,
+          messageId: 1,
+          textBytes: {
+            $cond: [{ $eq: [{ $type: '$text' }, 'string'] }, { $strLenBytes: '$text' }, 0],
+          },
+          quoteCount: {
+            $cond: [{ $isArray: '$quotes' }, { $size: '$quotes' }, 0],
+          },
+          quoteBytes: {
+            $cond: [
+              { $isArray: '$quotes' },
+              {
+                $sum: {
+                  $map: {
+                    input: '$quotes',
+                    as: 'quote',
+                    in: {
+                      $cond: [
+                        { $eq: [{ $type: '$$quote' }, 'string'] },
+                        { $strLenBytes: '$$quote' },
+                        0,
+                      ],
+                    },
+                  },
+                },
+              },
+              0,
+            ],
+          },
+          quoteLineCount: {
+            $cond: [
+              { $isArray: '$quotes' },
+              {
+                $sum: {
+                  $map: {
+                    input: '$quotes',
+                    as: 'quote',
+                    in: {
+                      $cond: [
+                        { $eq: [{ $type: '$$quote' }, 'string'] },
+                        { $size: { $split: ['$$quote', '\n'] } },
+                        0,
+                      ],
+                    },
+                  },
+                },
+              },
+              0,
+            ],
+          },
+          nonStringQuoteCount: {
+            $cond: [
+              { $isArray: '$quotes' },
+              {
+                $size: {
+                  $filter: {
+                    input: '$quotes',
+                    as: 'quote',
+                    cond: { $ne: [{ $type: '$$quote' }, 'string'] },
+                  },
+                },
+              },
+              0,
+            ],
+          },
+        },
+      });
+
+      return await Message.aggregate<MessageTextStats>(pipeline);
+    } catch (err) {
+      logger.error('Error getting message text stats:', err);
+      throw err;
+    }
+  }
+
   /**
    * Retrieves a single message from the database.
    */
@@ -394,6 +547,7 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
     updateMessage,
     deleteMessagesSince,
     getMessages,
+    getMessageTextStats,
     getMessage,
     getMessagesByCursor,
     searchMessages,
diff --git a/packages/data-schemas/src/methods/pluginAuth.ts b/packages/data-schemas/src/methods/pluginAuth.ts
index e95e3123bec..3aed689ccb3 100644
--- a/packages/data-schemas/src/methods/pluginAuth.ts
+++ b/packages/data-schemas/src/methods/pluginAuth.ts
@@ -8,7 +8,30 @@ import type {
 } from '~/types';
 
 // Factory function that takes mongoose instance and returns the methods
-export function createPluginAuthMethods(mongoose: typeof import('mongoose')) {
+export function createPluginAuthMethods(mongoose: typeof import('mongoose')): {
+  findOnePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+  }: FindPluginAuthParams) => Promise<IPluginAuth | null>;
+  findPluginAuthsByKeys: ({
+    userId,
+    pluginKeys,
+  }: FindPluginAuthsByKeysParams) => Promise<IPluginAuth[]>;
+  updatePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+    value,
+  }: UpdatePluginAuthParams) => Promise<IPluginAuth>;
+  deletePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+    all,
+  }: DeletePluginAuthParams) => Promise<DeleteResult>;
+  deleteAllUserPluginAuths: (userId: string) => Promise<DeleteResult>;
+} {
   /**
    * Finds a single plugin auth entry by userId and authField (and optionally pluginKey)
    */
diff --git a/packages/data-schemas/src/methods/preset.ts b/packages/data-schemas/src/methods/preset.ts
index 11af817cbde..300c96c5e89 100644
--- a/packages/data-schemas/src/methods/preset.ts
+++ b/packages/data-schemas/src/methods/preset.ts
@@ -11,11 +11,120 @@ interface IPreset {
   [key: string]: unknown;
 }
 
-export function createPresetMethods(mongoose: typeof import('mongoose')) {
+export function createPresetMethods(mongoose: typeof import('mongoose')): {
+  getPreset: (
+    user: string,
+    presetId: string,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | {
+        message: string;
+      }
+    | null
+  >;
+  getPresets: (
+    user: string,
+    filter?: Record<string, unknown>,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })[]
+    | {
+        message: string;
+      }
+  >;
+  savePreset: (
+    user: string,
+    {
+      presetId,
+      newPresetId,
+      defaultPreset,
+      ...preset
+    }: {
+      presetId?: string;
+      newPresetId?: string;
+      defaultPreset?: boolean;
+      [key: string]: unknown;
+    },
+  ) => Promise<
+    | IPreset
+    | {
+        message: string;
+      }
+  >;
+  deletePresets: (
+    user: string,
+    filter?: Record<string, unknown>,
+  ) => Promise<import('mongodb').DeleteResult>;
+} {
   /**
    * Retrieves a single preset by user and presetId.
    */
-  async function getPreset(user: string, presetId: string) {
+  async function getPreset(
+    user: string,
+    presetId: string,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | {
+        message: string;
+      }
+    | null
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       return await Preset.findOne({ user, presetId }).lean();
@@ -28,7 +137,34 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
   /**
    * Retrieves all presets for a user, sorted by order then updatedAt.
    */
-  async function getPresets(user: string, filter: Record<string, unknown> = {}) {
+  async function getPresets(
+    user: string,
+    filter: Record<string, unknown> = {},
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })[]
+    | {
+        message: string;
+      }
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       const presets = await Preset.find({ ...filter, user }).lean();
@@ -68,7 +204,12 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
       defaultPreset?: boolean;
       [key: string]: unknown;
     },
-  ) {
+  ): Promise<
+    | IPreset
+    | {
+        message: string;
+      }
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       const setter: Record<string, unknown> = { $set: {} };
@@ -115,7 +256,10 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
   /**
    * Deletes presets matching the given filter for a user.
    */
-  async function deletePresets(user: string, filter: Record<string, unknown> = {}) {
+  async function deletePresets(
+    user: string,
+    filter: Record<string, unknown> = {},
+  ): Promise<import('mongodb').DeleteResult> {
     const Preset = mongoose.models.Preset as Model<IPreset>;
     const deleteCount = await Preset.deleteMany({ ...filter, user });
     return deleteCount;
diff --git a/packages/data-schemas/src/methods/prompt.getPromptGroup.spec.ts b/packages/data-schemas/src/methods/prompt.getPromptGroup.spec.ts
new file mode 100644
index 00000000000..00f04967369
--- /dev/null
+++ b/packages/data-schemas/src/methods/prompt.getPromptGroup.spec.ts
@@ -0,0 +1,231 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { PipelineStage } from 'mongoose';
+import { SYSTEM_TENANT_ID, tenantStorage } from '~/config/tenantContext';
+import { createModels, logger } from '..';
+import { createMethods } from './index';
+
+logger.silent = true;
+
+type PromptModel = mongoose.Model<unknown>;
+type PromptGroupModel = mongoose.Model<unknown>;
+type Methods = ReturnType<typeof createMethods>;
+type MongoExplainStage = Record<string, unknown>;
+
+let mongoServer: MongoMemoryServer;
+let Prompt: PromptModel;
+let PromptGroup: PromptGroupModel;
+let methods: Methods;
+
+const TENANT_A = 'tenant-a';
+const TENANT_B = 'tenant-b';
+
+async function withTenant<T>(tenantId: string | undefined, fn: () => Promise<T>): Promise<T> {
+  return tenantStorage.run({ tenantId }, async () => fn());
+}
+
+async function seedGroupAndPrompt(opts: { tenantId?: string; promptTenantId?: string } = {}) {
+  const author = new mongoose.Types.ObjectId();
+  const prompt = await Prompt.create({
+    groupId: new mongoose.Types.ObjectId(),
+    author,
+    prompt: 'Hello {{name}}',
+    type: 'text',
+    tenantId: opts.promptTenantId ?? opts.tenantId,
+  });
+  const group = await PromptGroup.create({
+    name: 'Repro Group',
+    productionId: prompt._id,
+    author,
+    authorName: 'Test Author',
+    tenantId: opts.tenantId,
+  });
+  return { group, prompt };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function collectRecords(value: unknown, predicate: (record: Record<string, unknown>) => boolean) {
+  const matches: Array<Record<string, unknown>> = [];
+
+  function visit(candidate: unknown) {
+    if (Array.isArray(candidate)) {
+      for (const item of candidate) {
+        visit(item);
+      }
+      return;
+    }
+
+    if (!isRecord(candidate)) return;
+    if (predicate(candidate)) {
+      matches.push(candidate);
+    }
+
+    for (const child of Object.values(candidate)) {
+      visit(child);
+    }
+  }
+
+  visit(value);
+  return matches;
+}
+
+function hasIndexedIdPlan(explain: unknown): boolean {
+  return (
+    collectRecords(explain, (record) => {
+      const stage = record.stage;
+      if (stage === 'IDHACK' || stage === 'EXPRESS_IXSCAN') return true;
+      if (stage !== 'IXSCAN') return false;
+
+      const keyPattern = record.keyPattern;
+      return isRecord(keyPattern) && keyPattern._id === 1;
+    }).length > 0
+  );
+}
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  Prompt = mongoose.models.Prompt;
+  PromptGroup = mongoose.models.PromptGroup;
+  methods = createMethods(mongoose, {
+    removeAllPermissions: async () => {},
+  });
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+afterEach(async () => {
+  await Prompt.deleteMany({});
+  await PromptGroup.deleteMany({});
+});
+
+describe('getPromptGroup', () => {
+  it('returns the group with productionPrompt populated when no tenant context is set', async () => {
+    const { group } = await seedGroupAndPrompt();
+    const result = await methods.getPromptGroup({ _id: group._id });
+
+    expect(result).not.toBeNull();
+    expect(result?.productionPrompt).toBeTruthy();
+    expect((result?.productionPrompt as { prompt: string }).prompt).toBe('Hello {{name}}');
+  });
+
+  it('returns the group with productionPrompt populated when tenant matches', async () => {
+    const { group } = await seedGroupAndPrompt({ tenantId: TENANT_A });
+
+    const result = await withTenant(TENANT_A, () => methods.getPromptGroup({ _id: group._id }));
+
+    expect(result).not.toBeNull();
+    expect(result?.productionPrompt).toBeTruthy();
+    expect((result?.productionPrompt as { prompt: string }).prompt).toBe('Hello {{name}}');
+  });
+
+  it('clears productionPrompt when the joined prompt belongs to a different tenant', async () => {
+    const { group } = await seedGroupAndPrompt({
+      tenantId: TENANT_A,
+      promptTenantId: TENANT_B,
+    });
+
+    const result = await withTenant(TENANT_A, () => methods.getPromptGroup({ _id: group._id }));
+
+    expect(result).not.toBeNull();
+    expect(result?.productionPrompt).toBeNull();
+  });
+
+  it('returns the group with productionPrompt populated under SYSTEM_TENANT_ID context', async () => {
+    const { group } = await seedGroupAndPrompt({
+      tenantId: TENANT_A,
+      promptTenantId: TENANT_B,
+    });
+
+    const result = await withTenant(SYSTEM_TENANT_ID, () =>
+      methods.getPromptGroup({ _id: group._id }),
+    );
+
+    expect(result).not.toBeNull();
+    expect(result?.productionPrompt).toBeTruthy();
+    expect((result?.productionPrompt as { prompt: string }).prompt).toBe('Hello {{name}}');
+  });
+
+  it('returns null when the group does not exist', async () => {
+    const missingId = new mongoose.Types.ObjectId();
+    const result = await methods.getPromptGroup({ _id: missingId });
+    expect(result).toBeNull();
+  });
+
+  it('accepts string _id values (route-handler shape)', async () => {
+    const { group } = await seedGroupAndPrompt();
+    const result = await methods.getPromptGroup({
+      _id: (group._id as mongoose.Types.ObjectId).toString(),
+    });
+    expect(result).not.toBeNull();
+    expect((result?.productionPrompt as { prompt: string }).prompt).toBe('Hello {{name}}');
+  });
+
+  describe('regression: DocumentDB-incompatible aggregation form', () => {
+    it('does not use $lookup with let/pipeline (multi-join form unsupported by DocumentDB)', async () => {
+      const { group } = await seedGroupAndPrompt({ tenantId: TENANT_A });
+      const aggregateSpy = jest.spyOn(PromptGroup, 'aggregate');
+
+      try {
+        await withTenant(TENANT_A, () => methods.getPromptGroup({ _id: group._id }));
+
+        expect(aggregateSpy).toHaveBeenCalledTimes(1);
+        const pipeline: PipelineStage[] = aggregateSpy.mock.calls[0][0];
+
+        for (const stage of pipeline) {
+          if (!('$lookup' in stage)) continue;
+          const lookup = stage.$lookup;
+          expect(lookup.let).toBeUndefined();
+          expect(lookup.pipeline).toBeUndefined();
+          expect(lookup.localField).toBeDefined();
+          expect(lookup.foreignField).toBeDefined();
+        }
+      } finally {
+        aggregateSpy.mockRestore();
+      }
+    });
+
+    it('uses indexed _id execution paths for the group match and production prompt lookup', async () => {
+      const { group } = await seedGroupAndPrompt({ tenantId: TENANT_A });
+      const aggregateSpy = jest.spyOn(PromptGroup, 'aggregate');
+
+      try {
+        await withTenant(TENANT_A, () => methods.getPromptGroup({ _id: group._id }));
+
+        const pipeline: PipelineStage[] = aggregateSpy.mock.calls[0][0];
+        const [matchStage] = pipeline;
+        expect(matchStage).toEqual({ $match: { _id: group._id } });
+
+        const lookupStage = pipeline.find((stage) => '$lookup' in stage);
+        expect(lookupStage).toMatchObject({
+          $lookup: {
+            from: 'prompts',
+            localField: 'productionId',
+            foreignField: '_id',
+            as: 'productionPrompt',
+          },
+        });
+
+        const explain = await PromptGroup.aggregate(pipeline).explain('executionStats');
+        const stages = isRecord(explain) && Array.isArray(explain.stages) ? explain.stages : [];
+        const lookupExplain = stages.find(
+          (stage): stage is MongoExplainStage =>
+            isRecord(stage) && isRecord(stage.$lookup) && stage.$lookup.from === 'prompts',
+        );
+
+        expect(hasIndexedIdPlan(explain)).toBe(true);
+        expect(lookupExplain?.indexesUsed).toContain('_id_');
+        expect(lookupExplain?.totalDocsExamined).toBeLessThanOrEqual(1);
+      } finally {
+        aggregateSpy.mockRestore();
+      }
+    });
+  });
+});
diff --git a/packages/data-schemas/src/methods/prompt.ts b/packages/data-schemas/src/methods/prompt.ts
index 86d830fecdc..10dbd026fbe 100644
--- a/packages/data-schemas/src/methods/prompt.ts
+++ b/packages/data-schemas/src/methods/prompt.ts
@@ -16,7 +16,76 @@ export interface PromptDeps {
   ) => Promise<Types.ObjectId[]>;
 }
 
-export function createPromptMethods(mongoose: typeof import('mongoose'), deps: PromptDeps) {
+export interface PromptMethods {
+  getPromptGroups(filter: Record<string, unknown>): Promise<
+    | {
+        promptGroups: Record<string, unknown>[];
+        pageNumber: string;
+        pageSize: string;
+        pages: string;
+      }
+    | { message: string }
+  >;
+  deletePromptGroup(params: { _id: string }): Promise<{ message: string }>;
+  getAllPromptGroups(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown>[] | { message: string }>;
+  getListPromptGroupsByAccess(params: {
+    accessibleIds?: Types.ObjectId[];
+    otherParams?: Record<string, unknown>;
+    limit?: number | null;
+    after?: string | null;
+  }): Promise<{
+    object: 'list';
+    data: Record<string, unknown>[];
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }>;
+  incrementPromptGroupUsage(groupId: string): Promise<{ numberOfGenerations: number }>;
+  createPromptGroup(saveData: {
+    prompt: Record<string, unknown>;
+    group: Record<string, unknown>;
+    author: string;
+    authorName: string;
+  }): Promise<{ prompt: Record<string, unknown> | null; group: Record<string, unknown> }>;
+  savePrompt(saveData: {
+    prompt: Record<string, unknown>;
+    author: string | Types.ObjectId;
+  }): Promise<{ prompt: IPrompt } | { message: string }>;
+  getPrompts(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown>[] | { message: string }>;
+  getPrompt(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown> | null | { message: string }>;
+  getRandomPromptGroups(filter: {
+    skip: number | string;
+    limit: number | string;
+  }): Promise<{ prompts: unknown[] } | { message: string }>;
+  getPromptGroupsWithPrompts(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown> | null | { message: string }>;
+  getPromptGroup(filter: Record<string, unknown>): Promise<Record<string, unknown> | null>;
+  getOwnedPromptGroupIds(author: string): Promise<Types.ObjectId[]>;
+  deletePrompt(params: {
+    promptId: string | Types.ObjectId;
+    groupId: string | Types.ObjectId;
+  }): Promise<{ prompt: string; promptGroup?: { message: string; id: string | Types.ObjectId } }>;
+  deleteUserPrompts(userId: string): Promise<void>;
+  updatePromptGroup(
+    filter: Record<string, unknown>,
+    data: Record<string, unknown>,
+  ): Promise<IPromptGroupDocument | { message: string }>;
+  makePromptProduction(promptId: string): Promise<{ message: string }>;
+  updatePromptLabels(_id: string, labels: unknown): Promise<{ message: string }>;
+}
+
+export function createPromptMethods(
+  mongoose: typeof import('mongoose'),
+  deps: PromptDeps,
+): PromptMethods {
   const { getSoleOwnedResourceIds } = deps;
   const { ObjectId } = mongoose.Types;
 
@@ -51,7 +120,12 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Get all prompt groups with filters (no pagination).
    */
-  async function getAllPromptGroups(filter: Record<string, unknown>) {
+  async function getAllPromptGroups(filter: Record<string, unknown>): Promise<
+    | Record<string, unknown>[]
+    | {
+        message: string;
+      }
+  > {
     try {
       const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
       const { name, ...query } = filter as {
@@ -89,7 +163,22 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Get prompt groups with pagination and filters.
    */
-  async function getPromptGroups(filter: Record<string, unknown>) {
+  async function getPromptGroups(filter: Record<string, unknown>): Promise<
+    | {
+        promptGroups: Record<string, unknown>[];
+        pageNumber: string;
+        pageSize: string;
+        pages: string;
+        message?: undefined;
+      }
+    | {
+        message: string;
+        promptGroups?: undefined;
+        pageNumber?: undefined;
+        pageSize?: undefined;
+        pages?: undefined;
+      }
+  > {
     try {
       const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
       const {
@@ -159,7 +248,9 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
    * check — it deletes any group by ID. Callers must gate access via
    * `canAccessPromptGroupResource` middleware before invoking this.
    */
-  async function deletePromptGroup({ _id }: { _id: string }) {
+  async function deletePromptGroup({ _id }: { _id: string }): Promise<{
+    message: string;
+  }> {
     const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
     const Prompt = mongoose.models.Prompt as Model<IPrompt>;
 
@@ -199,7 +290,14 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
     otherParams?: Record<string, unknown>;
     limit?: number | null;
     after?: string | null;
-  }) {
+  }): Promise<{
+    object: 'list';
+    data: Record<string, unknown>[];
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }> {
     const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
     const isPaginated = limit !== null && limit !== undefined;
     const normalizedLimit = isPaginated
@@ -305,7 +403,9 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Increment the numberOfGenerations counter for a prompt group.
    */
-  async function incrementPromptGroupUsage(groupId: string) {
+  async function incrementPromptGroupUsage(groupId: string): Promise<{
+    numberOfGenerations: number;
+  }> {
     if (!isValidObjectIdString(groupId)) {
       throw new Error('Invalid groupId');
     }
@@ -512,37 +612,26 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
       const tenantId = getTenantId();
       const useTenantFilter = tenantId && tenantId !== SYSTEM_TENANT_ID;
 
-      const lookupStage = useTenantFilter
-        ? {
-            $lookup: {
-              from: 'prompts',
-              let: { prodId: '$productionId' },
-              pipeline: [
-                {
-                  $match: {
-                    $expr: { $eq: ['$_id', '$$prodId'] },
-                    tenantId,
-                  },
-                },
-              ],
-              as: 'productionPrompt',
-            },
-          }
-        : {
-            $lookup: {
-              from: 'prompts',
-              localField: 'productionId',
-              foreignField: '_id',
-              as: 'productionPrompt',
-            },
-          };
-
       const result = await PromptGroup.aggregate([
         { $match: matchFilter },
-        lookupStage,
+        {
+          $lookup: {
+            from: 'prompts',
+            localField: 'productionId',
+            foreignField: '_id',
+            as: 'productionPrompt',
+          },
+        },
         { $unwind: { path: '$productionPrompt', preserveNullAndEmptyArrays: true } },
       ]);
       const group = result[0] || null;
+      if (
+        group?.productionPrompt &&
+        useTenantFilter &&
+        group.productionPrompt.tenantId !== tenantId
+      ) {
+        group.productionPrompt = null;
+      }
       if (group?.author) {
         group.author = group.author.toString();
       }
@@ -744,7 +833,12 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Update prompt labels.
    */
-  async function updatePromptLabels(_id: string, labels: unknown) {
+  async function updatePromptLabels(
+    _id: string,
+    labels: unknown,
+  ): Promise<{
+    message: string;
+  }> {
     try {
       const Prompt = mongoose.models.Prompt as Model<IPrompt>;
       const response = await Prompt.updateOne({ _id }, { $set: { labels } });
@@ -779,5 +873,3 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
     updatePromptLabels,
   };
 }
-
-export type PromptMethods = ReturnType<typeof createPromptMethods>;
diff --git a/packages/data-schemas/src/methods/role.cache.spec.ts b/packages/data-schemas/src/methods/role.cache.spec.ts
new file mode 100644
index 00000000000..512c47ea880
--- /dev/null
+++ b/packages/data-schemas/src/methods/role.cache.spec.ts
@@ -0,0 +1,141 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { PermissionTypes, Permissions } from 'librechat-data-provider';
+import type { IRole } from '..';
+import { createRoleMethods } from './role';
+import { createModels } from '../models';
+import { tenantStorage } from '../config/tenantContext';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+/**
+ * Real Map-backed cache. A jest.fn mock can only assert which key was passed;
+ * a real store reproduces the actual collision: when two tenants write under the
+ * same key, the second read serves the first tenant's value.
+ */
+function createMapCache() {
+  const store = new Map<string, unknown>();
+  return {
+    store,
+    get: async (k: string): Promise<unknown> => store.get(k),
+    set: async (k: string, v: unknown): Promise<void> => {
+      store.set(k, v);
+    },
+    del: async (k: string): Promise<void> => {
+      store.delete(k);
+    },
+  };
+}
+
+const TENANT_A = 'tenant-aaaaaaaaaaaaaaaaaaaa';
+const TENANT_B = 'tenant-bbbbbbbbbbbbbbbbbbbb';
+const ROLE_NAME = 'EDITOR';
+
+let mongoServer: MongoMemoryServer;
+let Role: mongoose.Model<IRole>;
+let cache: ReturnType<typeof createMapCache>;
+let getRoleByName: ReturnType<typeof createRoleMethods>['getRoleByName'];
+
+function runAs<T>(tenantId: string, fn: () => Promise<T>): Promise<T> {
+  return tenantStorage.run({ tenantId }, fn);
+}
+
+function usePromptsPermission(role: IRole | null | undefined): boolean | undefined {
+  const permissions = (role as unknown as { permissions?: Record<string, Record<string, boolean>> })
+    ?.permissions;
+  return permissions?.[PermissionTypes.PROMPTS]?.[Permissions.USE];
+}
+
+async function seedRole(tenantId: string, useValue: boolean): Promise<void> {
+  await runAs(tenantId, async () => {
+    await new Role({
+      name: ROLE_NAME,
+      permissions: { [PermissionTypes.PROMPTS]: { [Permissions.USE]: useValue } },
+    }).save();
+  });
+}
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  Role = mongoose.models.Role as mongoose.Model<IRole>;
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await Role.deleteMany({});
+  cache = createMapCache();
+  const methods = createRoleMethods(mongoose, { getCache: () => cache });
+  getRoleByName = methods.getRoleByName;
+});
+
+describe('getRoleByName cache is scoped to the active tenant', () => {
+  it('does not serve one tenant a cached role belonging to another tenant', async () => {
+    await seedRole(TENANT_A, true);
+    await seedRole(TENANT_B, false);
+
+    const roleA = await runAs(TENANT_A, () => getRoleByName(ROLE_NAME));
+    expect(usePromptsPermission(roleA)).toBe(true);
+    expect(cache.store.size).toBeGreaterThan(0);
+
+    const roleB = await runAs(TENANT_B, () => getRoleByName(ROLE_NAME));
+    expect(usePromptsPermission(roleB)).toBe(false);
+
+    const roleAAgain = await runAs(TENANT_A, () => getRoleByName(ROLE_NAME));
+    expect(usePromptsPermission(roleAAgain)).toBe(true);
+  });
+
+  it('appends the tenant id to the cache key', async () => {
+    await seedRole(TENANT_A, true);
+    await seedRole(TENANT_B, false);
+
+    await runAs(TENANT_A, () => getRoleByName(ROLE_NAME));
+    await runAs(TENANT_B, () => getRoleByName(ROLE_NAME));
+
+    expect(cache.store.has(`${ROLE_NAME}:${TENANT_A}`)).toBe(true);
+    expect(cache.store.has(`${ROLE_NAME}:${TENANT_B}`)).toBe(true);
+    expect(cache.store.has(ROLE_NAME)).toBe(false);
+  });
+
+  it('serves the cached value within the same tenant without a second DB read', async () => {
+    await seedRole(TENANT_A, true);
+
+    const first = await runAs(TENANT_A, () => getRoleByName(ROLE_NAME));
+    expect(usePromptsPermission(first)).toBe(true);
+
+    const findOneSpy = jest.spyOn(Role, 'findOne');
+    const second = await runAs(TENANT_A, () => getRoleByName(ROLE_NAME));
+    expect(usePromptsPermission(second)).toBe(true);
+    expect(findOneSpy).not.toHaveBeenCalled();
+    findOneSpy.mockRestore();
+  });
+
+  it('uses the unscoped key when no tenant context is active (single-tenant)', async () => {
+    const previousDefault = process.env.DEFAULT_TENANT_ID;
+    delete process.env.DEFAULT_TENANT_ID;
+    try {
+      await seedRole(TENANT_A, true);
+
+      const role = await getRoleByName(ROLE_NAME);
+      expect(usePromptsPermission(role)).toBe(true);
+      expect(cache.store.has(ROLE_NAME)).toBe(true);
+      expect(cache.store.has(`${ROLE_NAME}:${TENANT_A}`)).toBe(false);
+    } finally {
+      if (previousDefault === undefined) {
+        delete process.env.DEFAULT_TENANT_ID;
+      } else {
+        process.env.DEFAULT_TENANT_ID = previousDefault;
+      }
+    }
+  });
+});
diff --git a/packages/data-schemas/src/methods/role.methods.spec.ts b/packages/data-schemas/src/methods/role.methods.spec.ts
index be75be7b6f3..2cd9d152f85 100644
--- a/packages/data-schemas/src/methods/role.methods.spec.ts
+++ b/packages/data-schemas/src/methods/role.methods.spec.ts
@@ -4,6 +4,8 @@ import { SystemRoles, Permissions, roleDefaults, PermissionTypes } from 'librech
 import type { IRole, IUser, RolePermissions } from '..';
 import { createRoleMethods } from './role';
 import { createModels } from '../models';
+import { _resetStrictCache } from '../models/plugins/tenantIsolation';
+import { tenantStorage } from '~/config/tenantContext';
 
 jest.mock('~/config/winston', () => ({
   error: jest.fn(),
@@ -23,6 +25,7 @@ const mockGetCache = jest.fn().mockReturnValue(mockCache);
 let Role: mongoose.Model<IRole>;
 let User: mongoose.Model<IUser>;
 let getRoleByName: ReturnType<typeof createRoleMethods>['getRoleByName'];
+let findRolesByNames: ReturnType<typeof createRoleMethods>['findRolesByNames'];
 let updateAccessPermissions: ReturnType<typeof createRoleMethods>['updateAccessPermissions'];
 let initializeRoles: ReturnType<typeof createRoleMethods>['initializeRoles'];
 let createRoleByName: ReturnType<typeof createRoleMethods>['createRoleByName'];
@@ -44,6 +47,7 @@ beforeAll(async () => {
   User = mongoose.models.User as mongoose.Model<IUser>;
   const methods = createRoleMethods(mongoose, { getCache: mockGetCache });
   getRoleByName = methods.getRoleByName;
+  findRolesByNames = methods.findRolesByNames;
   updateAccessPermissions = methods.updateAccessPermissions;
   initializeRoles = methods.initializeRoles;
   createRoleByName = methods.createRoleByName;
@@ -70,6 +74,90 @@ beforeEach(async () => {
   mockCache.del.mockClear();
 });
 
+describe('findRolesByNames', () => {
+  it('queries storage without reading or writing the role cache', async () => {
+    await Role.create([
+      { name: 'STANDARD-USER', permissions: {} },
+      { name: 'BASIC-USER', permissions: {} },
+    ]);
+
+    await expect(findRolesByNames(['STANDARD-USER', 'BASIC-USER'], 'name')).resolves.toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ name: 'STANDARD-USER' }),
+        expect.objectContaining({ name: 'BASIC-USER' }),
+      ]),
+    );
+    expect(mockGetCache).not.toHaveBeenCalled();
+    expect(mockCache.get).not.toHaveBeenCalled();
+    expect(mockCache.set).not.toHaveBeenCalled();
+  });
+
+  it('matches role names case-insensitively without using pagination', async () => {
+    const roles = Array.from({ length: 75 }, (_value, index) => ({
+      name: `ROLE-${index}`,
+      permissions: {},
+    }));
+    await Role.create([...roles, { name: 'STANDARD-USER', permissions: {} }]);
+
+    await expect(findRolesByNames(['standard-user'], 'name')).resolves.toEqual([
+      expect.objectContaining({ name: 'STANDARD-USER' }),
+    ]);
+  });
+
+  it('uses the active tenant context for matching role names', async () => {
+    await tenantStorage.run({ tenantId: 'tenant-a' }, async () => {
+      await Role.create({ name: 'TENANT-ROLE', permissions: {} });
+    });
+    await tenantStorage.run({ tenantId: 'tenant-b' }, async () => {
+      await Role.create({ name: 'TENANT-ROLE', permissions: {} });
+    });
+
+    const tenantARoles = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+      findRolesByNames(['TENANT-ROLE'], 'name tenantId'),
+    );
+    const tenantBRoles = await tenantStorage.run({ tenantId: 'tenant-b' }, async () =>
+      findRolesByNames(['TENANT-ROLE'], 'name tenantId'),
+    );
+
+    expect(tenantARoles).toEqual([
+      expect.objectContaining({ name: 'TENANT-ROLE', tenantId: 'tenant-a' }),
+    ]);
+    expect(tenantBRoles).toEqual([
+      expect.objectContaining({ name: 'TENANT-ROLE', tenantId: 'tenant-b' }),
+    ]);
+  });
+
+  it('matches only base roles when no tenant context is active', async () => {
+    await Role.create({ name: 'SCOPED-ROLE', permissions: {} });
+    await tenantStorage.run({ tenantId: 'tenant-a' }, async () => {
+      await Role.create({ name: 'TENANT-ONLY-ROLE', permissions: {} });
+    });
+
+    const baseMatches = await findRolesByNames(
+      ['SCOPED-ROLE', 'TENANT-ONLY-ROLE'],
+      'name tenantId',
+    );
+
+    expect(baseMatches).toEqual([expect.objectContaining({ name: 'SCOPED-ROLE' })]);
+    expect(baseMatches).toHaveLength(1);
+  });
+
+  it('matches base roles without a tenant context even under strict isolation', async () => {
+    await Role.create({ name: 'STRICT-BASE-ROLE', permissions: {} });
+    process.env.TENANT_ISOLATION_STRICT = 'true';
+    _resetStrictCache();
+
+    try {
+      await expect(findRolesByNames(['STRICT-BASE-ROLE'], 'name')).resolves.toEqual([
+        expect.objectContaining({ name: 'STRICT-BASE-ROLE' }),
+      ]);
+    } finally {
+      delete process.env.TENANT_ISOLATION_STRICT;
+      _resetStrictCache();
+    }
+  });
+});
+
 describe('updateAccessPermissions', () => {
   it('should update permissions when changes are needed', async () => {
     await new Role({
diff --git a/packages/data-schemas/src/methods/role.ts b/packages/data-schemas/src/methods/role.ts
index f0ffdb1700b..dea9da6fa9d 100644
--- a/packages/data-schemas/src/methods/role.ts
+++ b/packages/data-schemas/src/methods/role.ts
@@ -7,6 +7,8 @@ import {
 } from 'librechat-data-provider';
 import type { Model } from 'mongoose';
 import type { IRole, IUser } from '~/types';
+import { scopedCacheKey, getTenantId, runAsSystem, SYSTEM_TENANT_ID } from '~/config/tenantContext';
+import { escapeRegExp } from '~/utils/string';
 import logger from '~/config/winston';
 
 const systemRoleValues = new Set<string>(Object.values(SystemRoles));
@@ -31,13 +33,45 @@ export interface RoleDeps {
   };
 }
 
-export function createRoleMethods(mongoose: typeof import('mongoose'), deps: RoleDeps = {}) {
+export function createRoleMethods(
+  mongoose: typeof import('mongoose'),
+  deps: RoleDeps = {},
+): {
+  listRoles: (options?: {
+    limit?: number;
+    offset?: number;
+  }) => Promise<Pick<IRole, '_id' | 'name' | 'description'>[]>;
+  countRoles: () => Promise<number>;
+  initializeRoles: () => Promise<void>;
+  getRoleByName: (roleName: string, fieldsToSelect?: string | string[] | null) => Promise<IRole>;
+  findRolesByNames: (
+    roleNames: string[],
+    fieldsToSelect?: string | string[] | null,
+  ) => Promise<IRole[]>;
+  updateRoleByName: (roleName: string, updates: Partial<IRole>) => Promise<IRole>;
+  updateAccessPermissions: (
+    roleName: string,
+    permissionsUpdate: Record<string, Record<string, boolean>>,
+    roleData?: IRole,
+  ) => Promise<void>;
+  migrateRoleSchema: (roleName?: string) => Promise<number>;
+  createRoleByName: (roleData: Partial<IRole>) => Promise<IRole>;
+  deleteRoleByName: (roleName: string) => Promise<IRole | null>;
+  updateUsersByRole: (oldRole: string, newRole: string) => Promise<void>;
+  findUserIdsByRole: (roleName: string) => Promise<string[]>;
+  updateUsersRoleByIds: (userIds: string[], newRole: string) => Promise<void>;
+  listUsersByRole: (
+    roleName: string,
+    options?: { limit?: number; offset?: number },
+  ) => Promise<IUser[]>;
+  countUsersByRole: (roleName: string) => Promise<number>;
+} {
   /**
    * Initialize default roles in the system.
    * Creates the default roles (ADMIN, USER) if they don't exist in the database.
    * Updates existing roles with new permission types if they're missing.
    */
-  async function initializeRoles() {
+  async function initializeRoles(): Promise<void> {
     const Role = mongoose.models.Role;
 
     for (const roleName of [SystemRoles.ADMIN, SystemRoles.USER]) {
@@ -90,11 +124,14 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
    * If the role with the given name doesn't exist and the name is a system defined role,
    * create it and return the lean version.
    */
-  async function getRoleByName(roleName: string, fieldsToSelect: string | string[] | null = null) {
+  async function getRoleByName(
+    roleName: string,
+    fieldsToSelect: string | string[] | null = null,
+  ): Promise<IRole> {
     const cache = deps.getCache?.(CacheKeys.ROLES);
     try {
       if (cache) {
-        const cachedRole = await cache.get(roleName);
+        const cachedRole = await cache.get(scopedCacheKey(roleName));
         if (cachedRole) {
           return cachedRole as IRole;
         }
@@ -109,12 +146,12 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
       if (!role && systemRoleValues.has(roleName)) {
         const newRole = await new Role(roleDefaults[roleName as keyof typeof roleDefaults]).save();
         if (cache) {
-          await cache.set(roleName, newRole);
+          await cache.set(scopedCacheKey(roleName), newRole);
         }
         return newRole.toObject() as IRole;
       }
       if (cache) {
-        await cache.set(roleName, role);
+        await cache.set(scopedCacheKey(roleName), role);
       }
       return role as unknown as IRole;
     } catch (error) {
@@ -122,10 +159,60 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
     }
   }
 
+  /**
+   * Find roles by name without using or populating the shared role-name cache.
+   * Use this for tenant-scoped authorization lookups where the active ALS tenant context must control the query.
+   *
+   * When a non-system tenant context is active, the tenant-isolation plugin scopes the
+   * query to that tenant. When no tenant context is active (base/global users), the lookup
+   * runs under an explicit system context — so strict-mode isolation does not reject the
+   * context-less query — while an explicit base-role filter (`tenantId` unset) ensures a
+   * base user cannot match, and be assigned, a role that only exists within some tenant.
+   */
+  async function findRolesByNames(
+    roleNames: string[],
+    fieldsToSelect: string | string[] | null = null,
+  ): Promise<IRole[]> {
+    try {
+      const uniqueRoleNames = [
+        ...new Set(roleNames.map((roleName) => roleName.trim()).filter(Boolean)),
+      ];
+      if (uniqueRoleNames.length === 0) {
+        return [] as IRole[];
+      }
+
+      const Role = mongoose.models.Role;
+      const nameFilter = {
+        $or: uniqueRoleNames.map((roleName) => ({
+          name: new RegExp(`^${escapeRegExp(roleName)}$`, 'i'),
+        })),
+      };
+
+      const runQuery = (filter: Record<string, unknown>) => {
+        let query = Role.find(filter);
+        if (fieldsToSelect) {
+          query = query.select(fieldsToSelect);
+        }
+        return query.lean<IRole[]>().exec();
+      };
+
+      const tenantId = getTenantId();
+      if (tenantId && tenantId !== SYSTEM_TENANT_ID) {
+        return await runQuery(nameFilter);
+      }
+
+      return await runAsSystem(() =>
+        runQuery({ ...nameFilter, tenantId: { $in: [null, undefined] } }),
+      );
+    } catch (error) {
+      throw new Error(`Failed to retrieve roles: ${(error as Error).message}`);
+    }
+  }
+
   /**
    * Update role values by name.
    */
-  async function updateRoleByName(roleName: string, updates: Partial<IRole>) {
+  async function updateRoleByName(roleName: string, updates: Partial<IRole>): Promise<IRole> {
     const cache = deps.getCache?.(CacheKeys.ROLES);
     try {
       const Role = mongoose.models.Role;
@@ -135,9 +222,12 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
         .exec();
       if (cache) {
         if (updates.name && updates.name !== roleName) {
-          await Promise.all([cache.set(roleName, null), cache.set(updates.name, role)]);
+          await Promise.all([
+            cache.set(scopedCacheKey(roleName), null),
+            cache.set(scopedCacheKey(updates.name), role),
+          ]);
         } else {
-          await cache.set(roleName, role);
+          await cache.set(scopedCacheKey(roleName), role);
         }
       }
       return role as unknown as IRole;
@@ -163,7 +253,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
     roleName: string,
     permissionsUpdate: Record<string, Record<string, boolean>>,
     roleData?: IRole,
-  ) {
+  ): Promise<void> {
     const updates: Record<string, Record<string, boolean>> = {};
     for (const [permissionType, permissions] of Object.entries(permissionsUpdate)) {
       if (
@@ -296,7 +386,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
             const cache = deps.getCache?.(CacheKeys.ROLES);
             const updatedRole = await Role.findOne({ name: roleName }).select('-__v').lean().exec();
             if (cache) {
-              await cache.set(roleName, updatedRole);
+              await cache.set(scopedCacheKey(roleName), updatedRole);
             }
 
             logger.info(`Updated role '${roleName}' and removed old schema fields`);
@@ -366,7 +456,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
             const cache = deps.getCache?.(CacheKeys.ROLES);
             if (cache) {
               const updatedRole = await Role.findById(role._id).lean().exec();
-              await cache.set(role.name, updatedRole);
+              await cache.set(scopedCacheKey(role.name), updatedRole);
             }
 
             migratedCount++;
@@ -418,7 +508,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
     try {
       const cache = deps.getCache?.(CacheKeys.ROLES);
       if (cache) {
-        await cache.set(role.name, role.toObject());
+        await cache.set(scopedCacheKey(role.name), role.toObject());
       }
     } catch (cacheError) {
       logger.error(`[createRoleByName] cache set failed for "${role.name}":`, cacheError);
@@ -454,7 +544,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
         // Setting null evicts the stale document. getRoleByName treats falsy cached
         // values as a miss and falls through to the DB, so this does not provide
         // negative caching — it only prevents serving the pre-deletion document.
-        await cache.set(roleName, null);
+        await cache.set(scopedCacheKey(roleName), null);
       }
     } catch (cacheError) {
       logger.error(`[deleteRoleByName] cache invalidation failed for "${roleName}":`, cacheError);
@@ -506,6 +596,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
     countRoles,
     initializeRoles,
     getRoleByName,
+    findRolesByNames,
     updateRoleByName,
     updateAccessPermissions,
     migrateRoleSchema,
diff --git a/packages/data-schemas/src/methods/session.ts b/packages/data-schemas/src/methods/session.ts
index 68c851414a7..391ef9e39fc 100644
--- a/packages/data-schemas/src/methods/session.ts
+++ b/packages/data-schemas/src/methods/session.ts
@@ -13,10 +13,29 @@ export class SessionError extends Error {
 }
 
 /** Default refresh token expiry: 7 days in milliseconds */
-export const DEFAULT_REFRESH_TOKEN_EXPIRY = 1000 * 60 * 60 * 24 * 7;
+export const DEFAULT_REFRESH_TOKEN_EXPIRY: number = 1000 * 60 * 60 * 24 * 7;
 
 // Factory function that takes mongoose instance and returns the methods
-export function createSessionMethods(mongoose: typeof import('mongoose')) {
+export function createSessionMethods(mongoose: typeof import('mongoose')): {
+  findSession: (
+    params: t.SessionSearchParams,
+    options?: t.SessionQueryOptions,
+  ) => Promise<t.ISession | null>;
+  SessionError: typeof SessionError;
+  deleteSession: (params: t.DeleteSessionParams) => Promise<{ deletedCount?: number }>;
+  createSession: (userId: string, options?: t.CreateSessionOptions) => Promise<t.SessionResult>;
+  updateExpiration: (
+    session: t.ISession | string,
+    newExpiration?: Date,
+    options?: t.UpdateExpirationOptions,
+  ) => Promise<t.ISession>;
+  countActiveSessions: (userId: string) => Promise<number>;
+  generateRefreshToken: (session: t.ISession) => Promise<string>;
+  deleteAllUserSessions: (
+    userId: string | { userId: string },
+    options?: t.DeleteAllSessionsOptions,
+  ) => Promise<{ deletedCount?: number }>;
+} {
   /**
    * Creates a new session for a user
    */
diff --git a/packages/data-schemas/src/methods/share.test.ts b/packages/data-schemas/src/methods/share.test.ts
index 302b16811cb..5f092fc26ac 100644
--- a/packages/data-schemas/src/methods/share.test.ts
+++ b/packages/data-schemas/src/methods/share.test.ts
@@ -2,9 +2,9 @@ import { nanoid } from 'nanoid';
 import mongoose from 'mongoose';
 import { Constants } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
-import { createShareMethods, type ShareMethods } from './share';
 import type { SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 import type * as t from '~/types';
+import { createShareMethods, type ShareMethods } from './share';
 
 describe('Share Methods', () => {
   let mongoServer: MongoMemoryServer;
@@ -12,6 +12,7 @@ describe('Share Methods', () => {
   let SharedLink: mongoose.Model<t.ISharedLink>;
   let Message: mongoose.Model<t.IMessage>;
   let Conversation: SchemaWithMeiliMethods;
+  let File: mongoose.Model<t.IMongoFile>;
 
   beforeAll(async () => {
     mongoServer = await MongoMemoryServer.create();
@@ -26,7 +27,31 @@ describe('Share Methods', () => {
         user: { type: String, index: true },
         messages: [{ type: mongoose.Schema.Types.ObjectId, ref: 'Message' }],
         shareId: { type: String, index: true },
-        isPublic: { type: Boolean, default: true },
+        targetMessageId: { type: String, required: false, index: true },
+        expiredAt: { type: Date },
+        snapshotFiles: { type: Boolean },
+        fileSnapshots: { type: [mongoose.Schema.Types.Mixed], default: undefined },
+      },
+      { timestamps: true },
+    );
+
+    const fileSchema = new mongoose.Schema(
+      {
+        user: { type: String, required: true },
+        file_id: { type: String, required: true, index: true },
+        filename: { type: String, required: true },
+        filepath: { type: String, required: true },
+        storageKey: String,
+        type: String,
+        bytes: Number,
+        source: String,
+        width: Number,
+        height: Number,
+        text: String,
+        textFormat: { type: String, enum: ['html', 'text'] },
+        status: { type: String, enum: ['pending', 'ready', 'failed'] },
+        previewError: String,
+        tenantId: String,
       },
       { timestamps: true },
     );
@@ -39,8 +64,19 @@ describe('Share Methods', () => {
         text: String,
         isCreatedByUser: Boolean,
         model: String,
+        iconURL: String,
+        endpoint: String,
+        conversationSignature: String,
+        clientId: String,
+        plugin: mongoose.Schema.Types.Mixed,
+        metadata: mongoose.Schema.Types.Mixed,
+        feedback: mongoose.Schema.Types.Mixed,
+        manualSkills: [String],
+        alwaysAppliedSkills: [String],
+        quotes: [String],
         parentMessageId: String,
         attachments: [mongoose.Schema.Types.Mixed],
+        files: [mongoose.Schema.Types.Mixed],
         content: [mongoose.Schema.Types.Mixed],
       },
       { timestamps: true },
@@ -64,6 +100,7 @@ describe('Share Methods', () => {
         'Conversation',
         conversationSchema,
       )) as SchemaWithMeiliMethods;
+    File = mongoose.models.File || mongoose.model<t.IMongoFile>('File', fileSchema);
 
     // Create share methods
     shareMethods = createShareMethods(mongoose);
@@ -78,6 +115,7 @@ describe('Share Methods', () => {
     await SharedLink.deleteMany({});
     await Message.deleteMany({});
     await Conversation.deleteMany({});
+    await File.deleteMany({});
   });
 
   describe('createSharedLink', () => {
@@ -114,6 +152,7 @@ describe('Share Methods', () => {
       const result = await shareMethods.createSharedLink(userId, conversationId);
 
       expect(result).toBeDefined();
+      expect(result._id).toBeDefined();
       expect(result.shareId).toBeDefined();
       expect(result.conversationId).toBe(conversationId);
 
@@ -153,6 +192,40 @@ describe('Share Methods', () => {
       );
     });
 
+    test('should ignore expired shares when checking for duplicates', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const expiredShareId = `share_${nanoid()}`;
+
+      await Conversation.create({
+        conversationId,
+        title: 'Test Conversation',
+        user: userId,
+      });
+
+      const message = await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'Test message',
+        isCreatedByUser: true,
+      });
+
+      await SharedLink.create({
+        shareId: expiredShareId,
+        conversationId,
+        user: userId,
+        messages: [message._id],
+        expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+      });
+
+      const result = await shareMethods.createSharedLink(userId, conversationId);
+
+      expect(result.shareId).toBeDefined();
+      expect(result.shareId).not.toBe(expiredShareId);
+      expect(result.conversationId).toBe(conversationId);
+    });
+
     test('should throw error with missing parameters', async () => {
       await expect(shareMethods.createSharedLink('', 'conv123')).rejects.toThrow(
         'Missing required parameters',
@@ -290,7 +363,6 @@ describe('Share Methods', () => {
         user: userId,
         title: 'Test Share',
         messages: messages.map((m) => m._id),
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -305,29 +377,29 @@ describe('Share Methods', () => {
         expect(msg.messageId).toMatch(/^msg_/); // Should be anonymized with msg_ prefix
         expect(msg.messageId).not.toBe(messages[0].messageId); // Should be different from original
         expect(msg.conversationId).toBe(result.conversationId);
-        expect(msg.user).toBeUndefined(); // User should be removed
+        expect((msg as Record<string, unknown>).user).toBeUndefined(); // User should be removed
       });
     });
 
-    test('should return null for non-public share', async () => {
+    test('should return null for non-existent share', async () => {
+      const result = await shareMethods.getSharedMessages('non_existent_share');
+      expect(result).toBeNull();
+    });
+
+    test('should return null for expired share', async () => {
       const shareId = `share_${nanoid()}`;
 
       await SharedLink.create({
         shareId,
         conversationId: 'conv123',
         user: 'user123',
-        isPublic: false,
+        expiredAt: new Date(Date.now() - 60 * 60 * 1000),
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
       expect(result).toBeNull();
     });
 
-    test('should return null for non-existent share', async () => {
-      const result = await shareMethods.getSharedMessages('non_existent_share');
-      expect(result).toBeNull();
-    });
-
     test('should handle messages with attachments', async () => {
       const userId = new mongoose.Types.ObjectId().toString();
       const conversationId = `conv_${nanoid()}`;
@@ -353,7 +425,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -366,6 +437,112 @@ describe('Share Methods', () => {
         (result?.messages[0].attachments?.[0] as unknown as t.IMessage | undefined)?.conversationId,
       ).toBe(result?.conversationId);
     });
+
+    test('strips storage-internal fields while preserving shared render data', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+
+      const message = await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'safe text',
+        isCreatedByUser: false,
+        model: 'gpt-4',
+        iconURL: 'https://cdn.example.com/icon.png',
+        endpoint: 'openAI',
+        conversationSignature: 'signature',
+        clientId: 'client-id',
+        plugin: { latest: 'internal' },
+        metadata: { codeEnvRef: 'internal-ref' },
+        feedback: { rating: 'thumbsDown', tag: { key: 'inaccurate' }, text: 'private note' },
+        manualSkills: ['research'],
+        alwaysAppliedSkills: ['brand-voice'],
+        quotes: ['the quoted excerpt'],
+        files: [
+          {
+            file_id: 'file123',
+            filename: 'upload.png',
+            type: 'image/png',
+            width: 100,
+            height: 100,
+            filepath: '/images/upload.png',
+            conversationId,
+            user: userId,
+            tenantId: 'tenant-a',
+            storageKey: 'private/upload.png',
+            source: 's3',
+          },
+        ],
+        attachments: [
+          {
+            toolCallId: 'call_abc',
+            type: 'web_search',
+            web_search: { results: [{ title: 'Cited source', link: 'https://example.com' }] },
+            filename: 'result.json',
+            filepath: '/images/result.json',
+            storageKey: 'private/result.json',
+            metadata: { codeEnvRef: 'internal-ref' },
+          },
+        ],
+      });
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [message._id],
+      });
+
+      const result = await shareMethods.getSharedMessages(shareId);
+      const shared = result?.messages[0];
+
+      expect(shared?.text).toBe('safe text');
+      // Custom message icon is render metadata and should be preserved.
+      expect(shared?.iconURL).toBe('https://cdn.example.com/icon.png');
+      // Non-assistant model and internal message fields must not be disclosed.
+      expect(shared?.model).toBeUndefined();
+      expect(shared).not.toHaveProperty('endpoint');
+      expect(shared).not.toHaveProperty('conversationSignature');
+      expect(shared).not.toHaveProperty('clientId');
+      expect(shared).not.toHaveProperty('plugin');
+      expect(shared).not.toHaveProperty('metadata');
+      // Private owner feedback is not render data and must not leak publicly.
+      expect(shared).not.toHaveProperty('feedback');
+      // Skill badges are non-sensitive UI metadata and should still render.
+      expect(shared?.manualSkills).toEqual(['research']);
+      expect(shared?.alwaysAppliedSkills).toEqual(['brand-voice']);
+      // Quoted excerpts are non-sensitive UI metadata and should still render in the share view.
+      expect(shared?.quotes).toEqual(['the quoted excerpt']);
+
+      // Render metadata (filename/type/dims) is kept, storage internals dropped. The
+      // file isn't snapshotted (no backing File record), so its original render URL is
+      // neutralized — viewers can only load files through the authorized share route.
+      const file = shared?.files?.[0];
+      expect(file).toMatchObject({ filename: 'upload.png', type: 'image/png' });
+      expect(file).not.toHaveProperty('filepath');
+      expect(file).not.toHaveProperty('preview');
+      expect(file).not.toHaveProperty('storageKey');
+      expect(file).not.toHaveProperty('user');
+      expect(file).not.toHaveProperty('tenantId');
+      expect(file).not.toHaveProperty('source');
+      // The file's conversation id is rewritten to the anonymized id, not the original.
+      expect(file?.conversationId).toBe(shared?.conversationId);
+      expect(file?.conversationId).not.toBe(conversationId);
+
+      // Tool-call attachments keep their correlation id and payload so citations still
+      // render, while storage-only fields AND the original render URL are removed.
+      const attachment = shared?.attachments?.[0];
+      expect(attachment).toMatchObject({
+        toolCallId: 'call_abc',
+        type: 'web_search',
+        web_search: { results: [{ title: 'Cited source', link: 'https://example.com' }] },
+      });
+      expect(attachment).not.toHaveProperty('filepath');
+      expect(attachment).not.toHaveProperty('storageKey');
+      expect(attachment).not.toHaveProperty('metadata');
+    });
   });
 
   describe('getSharedLinks', () => {
@@ -379,7 +556,6 @@ describe('Share Methods', () => {
           conversationId: `conv_${i}`,
           user: userId,
           title: `Share ${i}`,
-          isPublic: true,
           createdAt: new Date(Date.now() - i * 1000 * 60), // Different timestamps
         }),
       );
@@ -397,34 +573,30 @@ describe('Share Methods', () => {
       expect(result.links[9].title).toBe('Share 9');
     });
 
-    test('should filter by isPublic parameter', async () => {
+    test('should exclude expired shares', async () => {
       const userId = new mongoose.Types.ObjectId().toString();
 
       await SharedLink.create([
         {
-          shareId: 'public_share',
+          shareId: 'active_share',
           conversationId: 'conv1',
           user: userId,
-          title: 'Public Share',
-          isPublic: true,
+          title: 'Active Share',
+          expiredAt: new Date(Date.now() + 60 * 60 * 1000),
         },
         {
-          shareId: 'private_share',
+          shareId: 'expired_share',
           conversationId: 'conv2',
           user: userId,
-          title: 'Private Share',
-          isPublic: false,
+          title: 'Expired Share',
+          expiredAt: new Date(Date.now() - 60 * 60 * 1000),
         },
       ]);
 
-      const publicResults = await shareMethods.getSharedLinks(userId, undefined, 10, true);
-      const privateResults = await shareMethods.getSharedLinks(userId, undefined, 10, false);
-
-      expect(publicResults.links).toHaveLength(1);
-      expect(publicResults.links[0].title).toBe('Public Share');
+      const result = await shareMethods.getSharedLinks(userId, undefined, 10);
 
-      expect(privateResults.links).toHaveLength(1);
-      expect(privateResults.links[0].title).toBe('Private Share');
+      expect(result.links).toHaveLength(1);
+      expect(result.links[0].shareId).toBe('active_share');
     });
 
     test('should handle search with mocked meiliSearch and user filter', async () => {
@@ -442,14 +614,12 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId,
           title: 'Matching Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId,
           title: 'Non-matching Share',
-          isPublic: true,
         },
       ]);
 
@@ -457,7 +627,6 @@ describe('Share Methods', () => {
         userId,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -512,21 +681,18 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId1,
           title: 'User 1 Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId2,
           title: 'User 2 Share',
-          isPublic: true,
         },
         {
           shareId: 'share3',
           conversationId: 'conv3',
           user: userId1,
           title: 'Another User 1 Share',
-          isPublic: true,
         },
       ]);
 
@@ -535,7 +701,6 @@ describe('Share Methods', () => {
         userId1,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -555,7 +720,6 @@ describe('Share Methods', () => {
         userId2,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -582,21 +746,18 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId1,
           title: 'User 1 Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId2,
           title: 'User 2 Share',
-          isPublic: true,
         },
         {
           shareId: 'share3',
           conversationId: 'conv3',
           user: userId1,
           title: 'Another User 1 Share',
-          isPublic: true,
         },
       ]);
 
@@ -634,7 +795,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: initialMessages.map((m) => m._id),
-        isPublic: true,
       });
 
       // Add new message
@@ -648,6 +808,7 @@ describe('Share Methods', () => {
 
       const result = await shareMethods.updateSharedLink(userId, oldShareId);
 
+      expect(result._id).toBeDefined();
       expect(result.shareId).not.toBe(oldShareId); // Should generate new shareId
       expect(result.conversationId).toBe(conversationId);
 
@@ -658,6 +819,60 @@ describe('Share Methods', () => {
       expect(updatedShare?.messages).toHaveLength(2);
     });
 
+    test('should preserve stale expiration when updating without an expiration decision', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+      const expiresAt = new Date('2030-01-01T00:00:00.000Z');
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [],
+        expiredAt: expiresAt,
+      });
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'Retained no longer applies',
+        isCreatedByUser: true,
+      });
+
+      const result = await shareMethods.updateSharedLink(userId, shareId);
+      const updatedShare = await SharedLink.findOne({ shareId: result.shareId }).lean();
+
+      expect(updatedShare?.expiredAt?.toISOString()).toBe(expiresAt.toISOString());
+    });
+
+    test('should clear stale expiration when updating with null expiration', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+      const expiresAt = new Date('2030-01-01T00:00:00.000Z');
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [],
+        expiredAt: expiresAt,
+      });
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'Retained no longer applies',
+        isCreatedByUser: true,
+      });
+
+      const result = await shareMethods.updateSharedLink(userId, shareId, undefined, null);
+      const updatedShare = await SharedLink.findOne({ shareId: result.shareId }).lean();
+
+      expect(updatedShare?.expiredAt).toBeUndefined();
+    });
+
     test('should throw error if share not found', async () => {
       await expect(shareMethods.updateSharedLink('user123', 'non_existent')).rejects.toThrow(
         'Share not found',
@@ -682,7 +897,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [],
-        isPublic: true,
       });
 
       // Add messages from different users
@@ -714,6 +928,106 @@ describe('Share Methods', () => {
       );
     });
 
+    test('should update branch target to the latest refreshed message', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+      const rootMessageId = `msg_${nanoid()}`;
+      const oldAnswerId = `msg_${nanoid()}`;
+      const rerunPromptId = `msg_${nanoid()}`;
+      const rerunAnswerId = `msg_${nanoid()}`;
+
+      await Conversation.create({
+        conversationId,
+        title: 'Analysis Conversation',
+        user: userId,
+      });
+
+      const initialMessages = await Message.create([
+        {
+          messageId: rootMessageId,
+          conversationId,
+          user: userId,
+          text: 'Analyze February 2023 to October 2025',
+          isCreatedByUser: true,
+          parentMessageId: Constants.NO_PARENT,
+        },
+        {
+          messageId: oldAnswerId,
+          conversationId,
+          user: userId,
+          text: 'Old analysis result',
+          isCreatedByUser: false,
+          parentMessageId: rootMessageId,
+        },
+      ]);
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: initialMessages.map((message) => message._id),
+        targetMessageId: oldAnswerId,
+      });
+
+      await Message.create([
+        {
+          messageId: rerunPromptId,
+          conversationId,
+          user: userId,
+          text: 'Rerun for March 2023 to January 2026',
+          isCreatedByUser: true,
+          parentMessageId: oldAnswerId,
+        },
+        {
+          messageId: rerunAnswerId,
+          conversationId,
+          user: userId,
+          text: 'Updated analysis result',
+          isCreatedByUser: false,
+          parentMessageId: rerunPromptId,
+        },
+      ]);
+
+      const result = await shareMethods.updateSharedLink(userId, shareId, rerunAnswerId);
+      const updatedShare = await SharedLink.findOne({ shareId: result.shareId }).populate(
+        'messages',
+      );
+      const sharedMessages = await shareMethods.getSharedMessages(result.shareId);
+
+      expect(result.shareId).not.toBe(shareId);
+      expect(result.targetMessageId).toBe(rerunAnswerId);
+      expect(updatedShare?.targetMessageId).toBe(rerunAnswerId);
+      expect(updatedShare?.messages).toHaveLength(4);
+      expect(sharedMessages?.messages.map((message) => message.text)).toEqual([
+        'Analyze February 2023 to October 2025',
+        'Old analysis result',
+        'Rerun for March 2023 to January 2026',
+        'Updated analysis result',
+      ]);
+    });
+
+    test('should preserve existing branch target when refresh has no target override', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+      const targetMessageId = `msg_${nanoid()}`;
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [],
+        targetMessageId,
+      });
+
+      const result = await shareMethods.updateSharedLink(userId, shareId);
+      const updatedShare = await SharedLink.findOne({ shareId: result.shareId });
+
+      expect(result.targetMessageId).toBe(targetMessageId);
+      expect(updatedShare?.targetMessageId).toBe(targetMessageId);
+    });
+
     test('should not allow user to update shared link they do not own', async () => {
       const ownerUserId = new mongoose.Types.ObjectId().toString();
       const otherUserId = new mongoose.Types.ObjectId().toString();
@@ -726,7 +1040,6 @@ describe('Share Methods', () => {
         conversationId,
         user: ownerUserId,
         messages: [],
-        isPublic: true,
       });
 
       // Try to update as a different user
@@ -750,7 +1063,6 @@ describe('Share Methods', () => {
         shareId,
         conversationId: 'conv123',
         user: userId,
-        isPublic: true,
       });
 
       const result = await shareMethods.deleteSharedLink(userId, shareId);
@@ -778,7 +1090,6 @@ describe('Share Methods', () => {
         shareId,
         conversationId: 'conv123',
         user: userId1,
-        isPublic: true,
       });
 
       const result = await shareMethods.deleteSharedLink(userId2, shareId);
@@ -810,11 +1121,11 @@ describe('Share Methods', () => {
         shareId,
         conversationId,
         user: userId,
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedLink(userId, conversationId);
 
+      expect(result._id).toBeDefined();
       expect(result.success).toBe(true);
       expect(result.shareId).toBe(shareId);
     });
@@ -826,6 +1137,23 @@ describe('Share Methods', () => {
       expect(result.shareId).toBeNull();
     });
 
+    test('should return null shareId for expired shares', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+
+      await SharedLink.create({
+        shareId: 'share123',
+        conversationId,
+        user: userId,
+        expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+      });
+
+      const result = await shareMethods.getSharedLink(userId, conversationId);
+
+      expect(result.success).toBe(false);
+      expect(result.shareId).toBeNull();
+    });
+
     test('should not return share from different user', async () => {
       const userId1 = new mongoose.Types.ObjectId().toString();
       const userId2 = new mongoose.Types.ObjectId().toString();
@@ -835,7 +1163,6 @@ describe('Share Methods', () => {
         shareId: 'share123',
         conversationId,
         user: userId1,
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedLink(userId2, conversationId);
@@ -853,25 +1180,6 @@ describe('Share Methods', () => {
         'Missing required parameters',
       );
     });
-
-    test('should only return public shares', async () => {
-      const userId = new mongoose.Types.ObjectId().toString();
-      const conversationId = `conv_${nanoid()}`;
-      const shareId = `share_${nanoid()}`;
-
-      // Create a non-public share
-      await SharedLink.create({
-        shareId,
-        conversationId,
-        user: userId,
-        isPublic: false,
-      });
-
-      const result = await shareMethods.getSharedLink(userId, conversationId);
-
-      expect(result.success).toBe(false);
-      expect(result.shareId).toBeNull();
-    });
   });
 
   describe('deleteAllSharedLinks', () => {
@@ -911,11 +1219,11 @@ describe('Share Methods', () => {
 
       // Create multiple shares for different users
       await SharedLink.create([
-        { shareId: 'share1', conversationId: 'conv1', user: userId1, isPublic: true },
-        { shareId: 'share2', conversationId: 'conv2', user: userId1, isPublic: false },
-        { shareId: 'share3', conversationId: 'conv3', user: userId2, isPublic: true },
-        { shareId: 'share4', conversationId: 'conv4', user: userId2, isPublic: true },
-        { shareId: 'share5', conversationId: 'conv5', user: userId3, isPublic: true },
+        { shareId: 'share1', conversationId: 'conv1', user: userId1 },
+        { shareId: 'share2', conversationId: 'conv2', user: userId1 },
+        { shareId: 'share3', conversationId: 'conv3', user: userId2 },
+        { shareId: 'share4', conversationId: 'conv4', user: userId2 },
+        { shareId: 'share5', conversationId: 'conv5', user: userId3 },
       ]);
 
       // Delete all shares for userId1
@@ -943,9 +1251,9 @@ describe('Share Methods', () => {
       const conversationId2 = 'conv-to-keep';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId: conversationId1, user: userId, isPublic: true },
-        { shareId: 'share2', conversationId: conversationId1, user: userId, isPublic: false },
-        { shareId: 'share3', conversationId: conversationId2, user: userId, isPublic: true },
+        { shareId: 'share1', conversationId: conversationId1, user: userId },
+        { shareId: 'share2', conversationId: conversationId1, user: userId },
+        { shareId: 'share3', conversationId: conversationId2, user: userId },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId, conversationId1);
@@ -964,9 +1272,9 @@ describe('Share Methods', () => {
       const conversationId = 'shared-conv';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId, user: userId1, isPublic: true },
-        { shareId: 'share2', conversationId, user: userId2, isPublic: true },
-        { shareId: 'share3', conversationId: 'other-conv', user: userId1, isPublic: true },
+        { shareId: 'share1', conversationId, user: userId1 },
+        { shareId: 'share2', conversationId, user: userId2 },
+        { shareId: 'share3', conversationId: 'other-conv', user: userId1 },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId1, conversationId);
@@ -1010,22 +1318,20 @@ describe('Share Methods', () => {
       const conversationId = 'conv-with-many-shares';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId, user: userId, isPublic: true },
+        { shareId: 'share1', conversationId, user: userId },
         {
           shareId: 'share2',
           conversationId,
           user: userId,
-          isPublic: true,
           targetMessageId: 'msg1',
         },
         {
           shareId: 'share3',
           conversationId,
           user: userId,
-          isPublic: true,
           targetMessageId: 'msg2',
         },
-        { shareId: 'share4', conversationId, user: userId, isPublic: false },
+        { shareId: 'share4', conversationId, user: userId },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId, conversationId);
@@ -1082,7 +1388,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -1193,7 +1498,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: messages.map((m) => m._id),
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -1229,7 +1533,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -1237,4 +1540,440 @@ describe('Share Methods', () => {
       expect(result?.messages[0].parentMessageId).toBe(Constants.NO_PARENT);
     });
   });
+
+  describe('file snapshots', () => {
+    const seedConversation = async (userId: string, conversationId: string) => {
+      await Conversation.create({ conversationId, title: 'Files Convo', user: userId });
+    };
+
+    const createFile = async (
+      userId: string,
+      overrides: Partial<t.IMongoFile> = {},
+    ): Promise<string> => {
+      const file_id = `file_${nanoid()}`;
+      await File.create({
+        user: userId,
+        file_id,
+        filename: 'report.pdf',
+        filepath: `/uploads/${userId}/${file_id}`,
+        type: 'application/pdf',
+        bytes: 1024,
+        source: 'local',
+        ...overrides,
+      });
+      return file_id;
+    };
+
+    test('createSharedLink captures snapshots from message files and attachments', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+
+      const imageId = await createFile(userId, {
+        type: 'image/png',
+        filename: 'pic.png',
+        filepath: `/images/${userId}/pic.png`,
+        width: 100,
+        height: 80,
+      });
+      const docId = await createFile(userId);
+
+      await Message.create([
+        {
+          messageId: `msg_${nanoid()}`,
+          conversationId,
+          user: userId,
+          text: 'with image',
+          isCreatedByUser: true,
+          files: [{ file_id: imageId, type: 'image/png', filepath: `/images/${userId}/pic.png` }],
+        },
+        {
+          messageId: `msg_${nanoid()}`,
+          conversationId,
+          user: userId,
+          text: 'with attachment',
+          isCreatedByUser: false,
+          attachments: [{ file_id: docId, type: 'application/pdf' }],
+        },
+      ]);
+
+      const result = await shareMethods.createSharedLink(userId, conversationId);
+      const saved = await SharedLink.findOne({ shareId: result.shareId }).lean();
+
+      expect(saved?.fileSnapshots).toHaveLength(2);
+      const byId = new Map(saved?.fileSnapshots?.map((s) => [s.file_id, s]));
+      expect(byId.get(imageId)?.source).toBe('local');
+      expect(byId.get(imageId)?.storageKey).toBeUndefined();
+      expect(byId.get(docId)?.filename).toBe('report.pdf');
+      expect(byId.get(docId)?.filepath).toBe(`/uploads/${userId}/${docId}`);
+    });
+
+    test('createSharedLink with snapshotFiles=false stores no snapshots', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'hi',
+        isCreatedByUser: true,
+        files: [{ file_id: docId }],
+      });
+
+      const result = await shareMethods.createSharedLink(
+        userId,
+        conversationId,
+        undefined,
+        undefined,
+        false,
+      );
+      const saved = await SharedLink.findOne({ shareId: result.shareId }).lean();
+      expect(saved?.fileSnapshots).toBeUndefined();
+    });
+
+    test('snapshots skip non-streamable sources and missing file records', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+
+      const remoteId = await createFile(userId, { source: 'openai' });
+      const ghostId = `file_${nanoid()}`; // referenced but no File doc
+
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'hi',
+        isCreatedByUser: true,
+        files: [{ file_id: remoteId }, { file_id: ghostId }],
+      });
+
+      const result = await shareMethods.createSharedLink(userId, conversationId);
+      const saved = await SharedLink.findOne({ shareId: result.shareId }).lean();
+      expect(saved?.fileSnapshots ?? []).toHaveLength(0);
+    });
+
+    test('getSharedMessages rewrites snapshotted file URLs to the share route', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [
+          { file_id: docId, type: 'application/pdf', filepath: `/uploads/${userId}/${docId}` },
+        ],
+      });
+
+      const { shareId } = await shareMethods.createSharedLink(userId, conversationId);
+      const result = await shareMethods.getSharedMessages(shareId);
+
+      const file = (result?.messages[0].files?.[0] ?? {}) as Record<string, unknown>;
+      expect(file.filepath).toBe(`/api/share/${shareId}/files/${docId}`);
+      // owner storage path must not leak
+      expect(String(file.filepath)).not.toContain(userId);
+    });
+
+    test('getSharedMessages neutralizes URLs for non-snapshotted files', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const remoteId = await createFile(userId, { source: 'openai' });
+      const originalPath = `/uploads/${userId}/${remoteId}`;
+
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: remoteId, filepath: originalPath }],
+      });
+
+      const { shareId } = await shareMethods.createSharedLink(userId, conversationId);
+      const result = await shareMethods.getSharedMessages(shareId);
+      const file = (result?.messages[0].files?.[0] ?? {}) as Record<string, unknown>;
+      // Non-snapshotted (non-streamable source): original URL must not leak.
+      expect(file.filepath).toBeUndefined();
+      expect(file.preview).toBeUndefined();
+    });
+
+    test('updateSharedLink recomputes snapshots from current messages', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'no files yet',
+        isCreatedByUser: true,
+      });
+
+      const created = await shareMethods.createSharedLink(userId, conversationId);
+      let saved = await SharedLink.findOne({ shareId: created.shareId }).lean();
+      expect(saved?.fileSnapshots ?? []).toHaveLength(0);
+
+      const docId = await createFile(userId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'now with a file',
+        isCreatedByUser: false,
+        files: [{ file_id: docId }],
+      });
+
+      const updated = await shareMethods.updateSharedLink(userId, created.shareId);
+      saved = await SharedLink.findOne({ shareId: updated.shareId }).lean();
+      expect(saved?.fileSnapshots).toHaveLength(1);
+      expect(saved?.fileSnapshots?.[0].file_id).toBe(docId);
+    });
+
+    test('getSharedLinkFile returns the entry, null for unknown files', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: docId }],
+      });
+
+      const { shareId } = await shareMethods.createSharedLink(userId, conversationId);
+
+      const found = await shareMethods.getSharedLinkFile(shareId, docId);
+      expect(found.file?.file_id).toBe(docId);
+      expect(found.hasSnapshots).toBe(true);
+
+      const missing = await shareMethods.getSharedLinkFile(shareId, 'file_does_not_exist');
+      expect(missing.file).toBeNull();
+      expect(missing.hasSnapshots).toBe(true);
+    });
+
+    test('backfillSharedLinkFiles populates a legacy share missing snapshots', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      const message = await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: docId }],
+      });
+
+      const shareId = `share_${nanoid()}`;
+      // legacy share: no fileSnapshots
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [message._id],
+      });
+
+      const before = await shareMethods.getSharedLinkFile(shareId, docId);
+      expect(before.file).toBeNull();
+      expect(before.hasSnapshots).toBe(false);
+
+      const backfilled = await shareMethods.backfillSharedLinkFiles(shareId, docId);
+      expect((backfilled as t.SharedFileSnapshot)?.file_id).toBe(docId);
+
+      const saved = await SharedLink.findOne({ shareId }).lean();
+      expect(saved?.fileSnapshots).toHaveLength(1);
+    });
+
+    test('does not snapshot a file owned by another user', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const otherUserId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      // File belongs to another user but is referenced in the sharer's message.
+      const victimId = await createFile(otherUserId);
+
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'borrowed file id',
+        isCreatedByUser: true,
+        files: [{ file_id: victimId }],
+      });
+
+      const result = await shareMethods.createSharedLink(userId, conversationId);
+      const saved = await SharedLink.findOne({ shareId: result.shareId }).lean();
+      expect(saved?.fileSnapshots ?? []).toHaveLength(0);
+    });
+
+    test('getSharedMessages strips files when the admin feature is disabled', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      const originalPath = `/uploads/${userId}/${docId}`;
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: docId, filepath: originalPath }],
+      });
+
+      const { shareId } = await shareMethods.createSharedLink(userId, conversationId);
+      const result = await shareMethods.getSharedMessages(shareId, undefined, {
+        snapshotFiles: false,
+      });
+      // Files are stripped entirely, not just left unrewritten — no owner path leaks.
+      expect(result?.messages[0].files).toBeUndefined();
+    });
+
+    test('createSharedLink with snapshotFiles=false strips files and skips snapshots', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      const originalPath = `/uploads/${userId}/${docId}`;
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc with file',
+        isCreatedByUser: true,
+        files: [{ file_id: docId, type: 'image/png', filepath: originalPath }],
+      });
+
+      // User opts out of sharing files for this link.
+      const { shareId } = await shareMethods.createSharedLink(
+        userId,
+        conversationId,
+        undefined,
+        undefined,
+        false,
+      );
+
+      const saved = await SharedLink.findOne({ shareId }).lean();
+      expect(saved?.snapshotFiles).toBe(false);
+      expect(saved?.fileSnapshots).toBeUndefined();
+
+      // Even with the admin feature on, an opted-out link shows no files and is not
+      // backfilled on read (the prior bug: original paths leaked / snapshots re-created).
+      const result = await shareMethods.getSharedMessages(shareId, undefined, {
+        snapshotFiles: true,
+      });
+      expect(result?.messages[0].files).toBeUndefined();
+
+      const after = await SharedLink.findOne({ shareId }).lean();
+      expect(after?.fileSnapshots).toBeUndefined();
+    });
+
+    test('getSharedLink surfaces the per-link snapshotFiles choice', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'hi',
+        isCreatedByUser: true,
+      });
+
+      await shareMethods.createSharedLink(userId, conversationId, undefined, undefined, false);
+      const link = await shareMethods.getSharedLink(userId, conversationId);
+      expect(link.snapshotFiles).toBe(false);
+    });
+
+    test('getSharedMessages backfills and rewrites a legacy share on read', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      const message = await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: docId, filepath: `/uploads/${userId}/${docId}` }],
+      });
+
+      const shareId = `share_${nanoid()}`;
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [message._id],
+      });
+
+      const result = await shareMethods.getSharedMessages(shareId);
+      const file = (result?.messages[0].files?.[0] ?? {}) as Record<string, unknown>;
+      expect(file.filepath).toBe(`/api/share/${shareId}/files/${docId}`);
+
+      // snapshot persisted by the lazy backfill
+      const saved = await SharedLink.findOne({ shareId }).lean();
+      expect(saved?.fileSnapshots).toHaveLength(1);
+    });
+
+    test('does not snapshot transient text-source files', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const textId = await createFile(userId, { source: 'text' });
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'rag context',
+        isCreatedByUser: true,
+        files: [{ file_id: textId }],
+      });
+
+      const result = await shareMethods.createSharedLink(userId, conversationId);
+      const saved = await SharedLink.findOne({ shareId: result.shareId }).lean();
+      expect(saved?.fileSnapshots ?? []).toHaveLength(0);
+    });
+
+    test('updateSharedLink clears snapshots when snapshotFiles is disabled', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      await seedConversation(userId, conversationId);
+      const docId = await createFile(userId);
+      await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'doc',
+        isCreatedByUser: true,
+        files: [{ file_id: docId }],
+      });
+
+      const created = await shareMethods.createSharedLink(userId, conversationId);
+      let saved = await SharedLink.findOne({ shareId: created.shareId }).lean();
+      expect(saved?.fileSnapshots).toHaveLength(1);
+
+      const updated = await shareMethods.updateSharedLink(
+        userId,
+        created.shareId,
+        undefined,
+        undefined,
+        false,
+      );
+      saved = await SharedLink.findOne({ shareId: updated.shareId }).lean();
+      expect(saved?.fileSnapshots).toBeUndefined();
+    });
+  });
 });
diff --git a/packages/data-schemas/src/methods/share.ts b/packages/data-schemas/src/methods/share.ts
index 2a0d2bc3bd8..f76cc0e29f2 100644
--- a/packages/data-schemas/src/methods/share.ts
+++ b/packages/data-schemas/src/methods/share.ts
@@ -1,8 +1,9 @@
 import { nanoid } from 'nanoid';
-import { Constants } from 'librechat-data-provider';
+import { Constants, FileSources } from 'librechat-data-provider';
 import type { FilterQuery, Model } from 'mongoose';
 import type { SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 import type * as t from '~/types';
+import { activeExpirationFilter } from '~/utils/retention';
 import logger from '~/config/winston';
 
 class ShareServiceError extends Error {
@@ -41,7 +42,204 @@ function anonymizeConvo(conversation: Partial<t.IConversation> & Partial<t.IShar
   return newConvo;
 }
 
-function anonymizeMessages(messages: t.IMessage[], newConvoId: string): t.IMessage[] {
+/**
+ * Storage- and identity-internal fields that must never be exposed through a
+ * public shared link. Everything else on a file/attachment — including the
+ * `filepath`/`preview` render URLs, dimensions, and tool-call payloads such as
+ * `toolCallId` and search results — is render data the shared view needs, so it
+ * is preserved. (`storageKey` is the raw object key and is dropped; `filepath`
+ * is the URL the share renderer actually loads, so it is kept.)
+ */
+const SENSITIVE_SHARED_FILE_FIELDS = new Set([
+  '_id',
+  '__v',
+  'user',
+  'tenantId',
+  'storageRegion',
+  'storageKey',
+  'temp_file_id',
+  'message',
+  'source',
+  'filterSource',
+  'context',
+  'embedded',
+  'usage',
+  'metadata',
+]);
+
+/**
+ * Strip storage/identity-internal fields from a file or attachment while keeping
+ * render-relevant data (including tool-call payloads keyed by tool name).
+ */
+function sanitizeSharedFile(value: unknown): t.SharedFile | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  const result: t.SharedFile = {};
+  for (const [key, fieldValue] of Object.entries(value as Record<string, unknown>)) {
+    if (!SENSITIVE_SHARED_FILE_FIELDS.has(key)) {
+      result[key] = fieldValue;
+    }
+  }
+
+  return Object.keys(result).length > 0 ? result : null;
+}
+
+function sanitizeSharedFiles(files: unknown): t.SharedFile[] | undefined {
+  if (!Array.isArray(files)) {
+    return undefined;
+  }
+
+  const sanitized = files
+    .map(sanitizeSharedFile)
+    .filter((file): file is t.SharedFile => file != null);
+
+  return sanitized.length > 0 ? sanitized : undefined;
+}
+
+/**
+ * Sources backed by a durable stored object that the share-scoped routes can
+ * stream with only `storageKey`/`filepath` + the request. Sources requiring
+ * owner-specific credentials (openai/azure assistants, execute_code, vectordb,
+ * OCR/parser pipelines) are skipped — those files degrade to a 404 in the share
+ * view. `FileSources.text` is intentionally excluded: its `filepath` is a Multer
+ * temp path that the upload route deletes, so there is nothing durable to stream.
+ */
+const SNAPSHOT_STREAMABLE_SOURCES = new Set<string>([
+  FileSources.local,
+  FileSources.s3,
+  FileSources.cloudfront,
+  FileSources.azure_blob,
+  FileSources.firebase,
+]);
+
+/** Collect `file_id`s from a message's `files`/`attachments` array into `target`. */
+function collectFileIds(items: unknown, target: Set<string>): void {
+  if (!Array.isArray(items)) {
+    return;
+  }
+  for (const item of items) {
+    if (item && typeof item === 'object') {
+      const fileId = (item as { file_id?: unknown }).file_id;
+      if (typeof fileId === 'string' && fileId) {
+        target.add(fileId);
+      }
+    }
+  }
+}
+
+/**
+ * Build the per-share file snapshot from the messages being shared. Captures only
+ * the metadata the share-scoped routes need to stream each file; references the
+ * original stored object (no byte copy). The lookup is scoped to the sharing
+ * user's own files so a message referencing another user's `file_id` can never
+ * widen access to it. Preview text/status is intentionally NOT embedded — it is
+ * read live from the file record so snapshots stay small and never go stale.
+ */
+async function buildFileSnapshots(
+  mongoose: typeof import('mongoose'),
+  messages: t.IMessage[],
+  ownerId?: string,
+): Promise<t.SharedFileSnapshot[]> {
+  if (!ownerId) {
+    return [];
+  }
+
+  const fileIds = new Set<string>();
+  for (const message of messages) {
+    collectFileIds(message.files, fileIds);
+    collectFileIds(message.attachments, fileIds);
+  }
+
+  if (fileIds.size === 0) {
+    return [];
+  }
+
+  const File = mongoose.models.File as Model<t.IMongoFile>;
+  const files = await File.find({ file_id: { $in: Array.from(fileIds) }, user: ownerId }).lean();
+
+  const snapshots: t.SharedFileSnapshot[] = [];
+  for (const file of files) {
+    const source = file.source ?? FileSources.local;
+    if (!SNAPSHOT_STREAMABLE_SOURCES.has(source)) {
+      continue;
+    }
+    snapshots.push({
+      file_id: file.file_id,
+      source,
+      storageKey: file.storageKey,
+      filepath: file.filepath,
+      type: file.type,
+      filename: file.filename,
+      bytes: file.bytes,
+      width: file.width,
+      height: file.height,
+      model: file.model,
+      previewRevision: file.previewRevision,
+      tenantId: file.tenantId,
+    });
+  }
+  return snapshots;
+}
+
+/** Share-scoped file route that serves a snapshotted file independent of owner ACL. */
+function shareFileRoute(shareId: string, fileId: string): string {
+  return `/api/share/${shareId}/files/${encodeURIComponent(fileId)}`;
+}
+
+/**
+ * Point a snapshotted file's render URLs at the share-scoped route so viewers load
+ * it through the authorized share path (and the owner's storage path is not leaked).
+ */
+function applyShareFileRoute(
+  file: t.SharedFile,
+  shareId: string,
+  snapshotIds: Set<string>,
+): t.SharedFile {
+  const fileId = file.file_id;
+  if (typeof fileId === 'string' && snapshotIds.has(fileId)) {
+    const route = shareFileRoute(shareId, fileId);
+    const next: t.SharedFile = { ...file, filepath: route };
+    if (file.preview !== undefined) {
+      next.preview = route;
+    }
+    return next;
+  }
+  // Not snapshotted (e.g. a non-streamable source on an included link): neutralize
+  // the render URLs so the owner's original path can't be loaded through the share.
+  const next: t.SharedFile = { ...file };
+  delete next.filepath;
+  delete next.preview;
+  return next;
+}
+
+/**
+ * Only surface a model name when it is an (already-anonymized) assistant id;
+ * otherwise omit it so the underlying provider/model is not disclosed.
+ */
+function anonymizeSharedModel(model?: string): string | undefined {
+  if (!model?.startsWith('asst_')) {
+    return undefined;
+  }
+  return anonymizeAssistantId(model);
+}
+
+/**
+ * Build the public, anonymized view of shared messages. An allowlist of
+ * render-relevant fields keeps internal message fields (endpoint,
+ * conversationSignature, clientId, plugin(s), metadata, etc.) out of the
+ * payload, while user files and tool-call attachments are sanitized field by
+ * field so render data (uploaded files, `toolCallId`, search results, generated
+ * outputs) is preserved without leaking storage internals.
+ */
+function anonymizeMessages(
+  messages: t.IMessage[],
+  newConvoId: string,
+  shareId: string,
+  snapshotIds: Set<string>,
+  includeFiles: boolean,
+): t.SharedMessage[] {
   if (!Array.isArray(messages)) {
     return [];
   }
@@ -51,34 +249,62 @@ function anonymizeMessages(messages: t.IMessage[], newConvoId: string): t.IMessa
     const newMessageId = anonymizeMessageId(message.messageId);
     idMap.set(message.messageId, newMessageId);
 
-    type MessageAttachment = {
-      messageId?: string;
-      conversationId?: string;
-      [key: string]: unknown;
-    };
-
-    const anonymizedAttachments = (message.attachments as MessageAttachment[])?.map(
-      (attachment) => {
-        return {
-          ...attachment,
-          messageId: newMessageId,
-          conversationId: newConvoId,
-        };
-      },
-    );
+    // When files are not shared for this link, omit files/attachments entirely so
+    // viewers can't load them through the owner's original (e.g. static) paths.
+    const attachments = includeFiles
+      ? sanitizeSharedFiles(message.attachments)?.map((attachment) =>
+          applyShareFileRoute(
+            {
+              ...attachment,
+              messageId: newMessageId,
+              conversationId: newConvoId,
+            },
+            shareId,
+            snapshotIds,
+          ),
+        )
+      : undefined;
+    // Persisted file records can carry the original conversation/message ids;
+    // rewrite them to the anonymized ids so shared files don't expose them.
+    const files = includeFiles
+      ? sanitizeSharedFiles(message.files)?.map((file) =>
+          applyShareFileRoute(
+            {
+              ...file,
+              ...(file.conversationId !== undefined && { conversationId: newConvoId }),
+              ...(file.messageId !== undefined && { messageId: newMessageId }),
+            },
+            shareId,
+            snapshotIds,
+          ),
+        )
+      : undefined;
+    const model = anonymizeSharedModel(message.model);
 
     return {
-      ...message,
       messageId: newMessageId,
       parentMessageId:
         idMap.get(message.parentMessageId || '') ||
         anonymizeMessageId(message.parentMessageId || ''),
       conversationId: newConvoId,
-      model: message.model?.startsWith('asst_')
-        ? anonymizeAssistantId(message.model)
-        : message.model,
-      attachments: anonymizedAttachments,
-    } as t.IMessage;
+      sender: message.sender,
+      text: message.text,
+      content: message.content,
+      ...(message.iconURL && { iconURL: message.iconURL }),
+      ...(model && { model }),
+      isCreatedByUser: message.isCreatedByUser,
+      createdAt: message.createdAt,
+      updatedAt: message.updatedAt,
+      tokenCount: message.tokenCount,
+      unfinished: message.unfinished,
+      error: message.error,
+      finish_reason: message.finish_reason,
+      ...(message.manualSkills && { manualSkills: message.manualSkills }),
+      ...(message.alwaysAppliedSkills && { alwaysAppliedSkills: message.alwaysAppliedSkills }),
+      ...(message.quotes && { quotes: message.quotes }),
+      ...(files && { files }),
+      ...(attachments && { attachments }),
+    };
   });
 }
 
@@ -154,22 +380,75 @@ function getMessagesUpToTarget(messages: t.IMessage[], targetMessageId: string):
 }
 
 /** Factory function that takes mongoose instance and returns the methods */
-export function createShareMethods(mongoose: typeof import('mongoose')) {
+export function createShareMethods(mongoose: typeof import('mongoose')): {
+  getSharedLink: (user: string, conversationId: string) => Promise<t.GetShareLinkResult>;
+  getSharedLinks: (
+    user: string,
+    pageParam?: Date,
+    pageSize?: number,
+    sortBy?: string,
+    sortDirection?: string,
+    search?: string,
+  ) => Promise<t.SharedLinksResult>;
+  createSharedLink: (
+    user: string,
+    conversationId: string,
+    targetMessageId?: string,
+    expiredAt?: Date,
+    snapshotFiles?: boolean,
+  ) => Promise<t.CreateShareResult>;
+  updateSharedLink: (
+    user: string,
+    shareId: string,
+    targetMessageId?: string,
+    expiredAt?: Date | null,
+    snapshotFiles?: boolean,
+  ) => Promise<t.UpdateShareResult>;
+  deleteSharedLink: (user: string, shareId: string) => Promise<t.DeleteShareResult | null>;
+  getSharedMessages: (
+    shareId: string,
+    shareObjectId?: string,
+    options?: { snapshotFiles?: boolean },
+  ) => Promise<t.SharedMessagesResult | null>;
+  getSharedLinkFile: (
+    shareId: string,
+    fileId: string,
+  ) => Promise<{ file: t.SharedFileSnapshot | null; hasSnapshots: boolean; optedOut: boolean }>;
+  backfillSharedLinkFiles: (
+    shareId: string,
+    fileId?: string,
+  ) => Promise<t.SharedFileSnapshot | t.SharedFileSnapshot[] | null>;
+  deleteAllSharedLinks: (
+    user: string,
+  ) => Promise<t.DeleteAllSharesResult & { deletedIds: string[] }>;
+  deleteConvoSharedLink: (
+    user: string,
+    conversationId: string,
+  ) => Promise<t.DeleteAllSharesResult & { deletedIds: string[] }>;
+} {
   /**
-   * Get shared messages for a public share link
+   * Get shared messages for a share link
    */
-  async function getSharedMessages(shareId: string): Promise<t.SharedMessagesResult | null> {
+  async function getSharedMessages(
+    shareId: string,
+    shareObjectId?: string,
+    options?: { snapshotFiles?: boolean },
+  ): Promise<t.SharedMessagesResult | null> {
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
-      const share = (await SharedLink.findOne({ shareId, isPublic: true })
+      const query = shareObjectId
+        ? SharedLink.findOne({ _id: shareObjectId, ...activeExpirationFilter<t.ISharedLink>() })
+        : SharedLink.findOne({ shareId, ...activeExpirationFilter<t.ISharedLink>() });
+
+      const share = (await query
         .populate({
           path: 'messages',
           select: '-_id -__v -user',
         })
-        .select('-_id -__v -user')
+        .select('-__v')
         .lean()) as (t.ISharedLink & { messages: t.IMessage[] }) | null;
 
-      if (!share?.conversationId || !share.isPublic) {
+      if (!share?.conversationId) {
         return null;
       }
 
@@ -180,14 +459,39 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       }
 
       const newConvoId = anonymizeConvoId(share.conversationId);
+      const resolvedShareId = share.shareId || shareId;
+
+      /**
+       * Files are included only when the admin feature is enabled (options) AND the
+       * link's own choice wasn't opted out (`snapshotFiles === false`). When
+       * excluded, files/attachments are stripped from the payload so nothing leaks
+       * through the owner's original paths. Legacy links (no per-link choice and no
+       * snapshot yet) are backfilled here so their first view rewrites correctly.
+       */
+      const adminEnabled = options?.snapshotFiles !== false;
+      const perLinkEnabled = share.snapshotFiles !== false;
+      const includeFiles = adminEnabled && perLinkEnabled;
+      let fileSnapshots = share.fileSnapshots;
+      if (includeFiles && fileSnapshots === undefined && share._id) {
+        fileSnapshots = await buildFileSnapshots(mongoose, messagesToShare, share.user);
+        await SharedLink.updateOne({ _id: share._id }, { $set: { fileSnapshots } });
+      }
+      const snapshotIds = includeFiles
+        ? new Set<string>((fileSnapshots ?? []).map((snapshot) => snapshot.file_id))
+        : new Set<string>();
       const result: t.SharedMessagesResult = {
-        shareId: share.shareId || shareId,
+        shareId: resolvedShareId,
         title: share.title,
-        isPublic: share.isPublic,
         createdAt: share.createdAt,
         updatedAt: share.updatedAt,
         conversationId: newConvoId,
-        messages: anonymizeMessages(messagesToShare, newConvoId),
+        messages: anonymizeMessages(
+          messagesToShare,
+          newConvoId,
+          resolvedShareId,
+          snapshotIds,
+          includeFiles,
+        ),
       };
 
       return result;
@@ -207,7 +511,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     user: string,
     pageParam?: Date,
     pageSize: number = 10,
-    isPublic: boolean = true,
     sortBy: string = 'createdAt',
     sortDirection: string = 'desc',
     search?: string,
@@ -215,7 +518,10 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
       const Conversation = mongoose.models.Conversation as SchemaWithMeiliMethods;
-      const query: FilterQuery<t.ISharedLink> = { user, isPublic };
+      const query: FilterQuery<t.ISharedLink> = {
+        user,
+        ...activeExpirationFilter<t.ISharedLink>(),
+      };
 
       if (pageParam) {
         if (sortDirection === 'desc') {
@@ -274,7 +580,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         links: links.map((link) => ({
           shareId: link.shareId || '',
           title: link?.title || 'Untitled',
-          isPublic: link.isPublic,
           createdAt: link.createdAt || new Date(),
           conversationId: link.conversationId,
         })),
@@ -293,13 +598,18 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
   /**
    * Delete all shared links for a user
    */
-  async function deleteAllSharedLinks(user: string): Promise<t.DeleteAllSharesResult> {
+  async function deleteAllSharedLinks(
+    user: string,
+  ): Promise<t.DeleteAllSharesResult & { deletedIds: string[] }> {
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+      const links = await SharedLink.find({ user }).select('_id').lean();
+      const ids = links.map((l) => l._id.toString());
       const result = await SharedLink.deleteMany({ user });
       return {
         message: 'All shared links deleted successfully',
         deletedCount: result.deletedCount,
+        deletedIds: ids,
       };
     } catch (error) {
       logger.error('[deleteAllSharedLinks] Error deleting shared links', {
@@ -316,17 +626,20 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
   async function deleteConvoSharedLink(
     user: string,
     conversationId: string,
-  ): Promise<t.DeleteAllSharesResult> {
+  ): Promise<t.DeleteAllSharesResult & { deletedIds: string[] }> {
     if (!user || !conversationId) {
       throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
     }
 
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+      const links = await SharedLink.find({ user, conversationId }).select('_id').lean();
+      const ids = links.map((l) => l._id.toString());
       const result = await SharedLink.deleteMany({ user, conversationId });
       return {
         message: 'Shared links deleted successfully',
         deletedCount: result.deletedCount,
+        deletedIds: ids,
       };
     } catch (error) {
       logger.error('[deleteConvoSharedLink] Error deleting shared links', {
@@ -345,6 +658,8 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     user: string,
     conversationId: string,
     targetMessageId?: string,
+    expiredAt?: Date,
+    snapshotFiles: boolean = true,
   ): Promise<t.CreateShareResult> {
     if (!user || !conversationId) {
       throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
@@ -358,7 +673,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         SharedLink.findOne({
           conversationId,
           user,
-          isPublic: true,
+          ...activeExpirationFilter<t.ISharedLink>(),
           ...(targetMessageId && { targetMessageId }),
         })
           .select('-_id -__v -user')
@@ -366,19 +681,13 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         Message.find({ conversationId, user }).sort({ createdAt: 1 }).lean(),
       ]);
 
-      if (existingShare && existingShare.isPublic) {
+      if (existingShare) {
         logger.error('[createSharedLink] Share already exists', {
           user,
           conversationId,
           targetMessageId,
         });
         throw new ShareServiceError('Share already exists', 'SHARE_EXISTS');
-      } else if (existingShare) {
-        await SharedLink.deleteOne({
-          conversationId,
-          user,
-          ...(targetMessageId && { targetMessageId }),
-        });
       }
 
       const conversation = (await Conversation.findOne({ conversationId, user }).lean()) as {
@@ -400,17 +709,31 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
 
       const title = conversation.title || 'Untitled';
 
+      const messagesForSnapshot = conversationMessages as unknown as t.IMessage[];
+      const fileSnapshots = snapshotFiles
+        ? await buildFileSnapshots(
+            mongoose,
+            targetMessageId
+              ? getMessagesUpToTarget(messagesForSnapshot, targetMessageId)
+              : messagesForSnapshot,
+            user,
+          )
+        : [];
+
       const shareId = nanoid();
-      await SharedLink.create({
+      const created = await SharedLink.create({
         shareId,
         conversationId,
         messages: conversationMessages,
         title,
         user,
+        snapshotFiles,
         ...(targetMessageId && { targetMessageId }),
+        ...(expiredAt && { expiredAt }),
+        ...(snapshotFiles && { fileSnapshots }),
       });
 
-      return { shareId, conversationId };
+      return { _id: created._id.toString(), shareId, conversationId, targetMessageId };
     } catch (error) {
       if (error instanceof ShareServiceError) {
         throw error;
@@ -438,15 +761,31 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
 
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
-      const share = (await SharedLink.findOne({ conversationId, user, isPublic: true })
-        .select('shareId -_id')
-        .lean()) as { shareId?: string } | null;
+      const share = (await SharedLink.findOne({
+        conversationId,
+        user,
+        ...activeExpirationFilter<t.ISharedLink>(),
+      })
+        .select('shareId targetMessageId snapshotFiles _id')
+        .sort({ updatedAt: -1 })
+        .lean()) as {
+        shareId?: string;
+        targetMessageId?: string;
+        snapshotFiles?: boolean;
+        _id?: import('mongoose').Types.ObjectId;
+      } | null;
 
       if (!share) {
         return { shareId: null, success: false };
       }
 
-      return { shareId: share.shareId || null, success: true };
+      return {
+        _id: share._id?.toString(),
+        shareId: share.shareId || null,
+        targetMessageId: share.targetMessageId,
+        snapshotFiles: share.snapshotFiles,
+        success: true,
+      };
     } catch (error) {
       logger.error('[getSharedLink] Error getting shared link', {
         error: error instanceof Error ? error.message : 'Unknown error',
@@ -460,7 +799,13 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
   /**
    * Update a shared link with new messages
    */
-  async function updateSharedLink(user: string, shareId: string): Promise<t.UpdateShareResult> {
+  async function updateSharedLink(
+    user: string,
+    shareId: string,
+    targetMessageId?: string,
+    expiredAt?: Date | null,
+    snapshotFiles: boolean = true,
+  ): Promise<t.UpdateShareResult> {
     if (!user || !shareId) {
       throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
     }
@@ -481,10 +826,35 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         .lean();
 
       const newShareId = nanoid();
+      const hasNewExpiration = expiredAt instanceof Date;
+      const resolvedTargetMessageId = targetMessageId ?? share.targetMessageId;
+      const messagesForSnapshot = updatedMessages as unknown as t.IMessage[];
+      const fileSnapshots = snapshotFiles
+        ? await buildFileSnapshots(
+            mongoose,
+            resolvedTargetMessageId
+              ? getMessagesUpToTarget(messagesForSnapshot, resolvedTargetMessageId)
+              : messagesForSnapshot,
+            user,
+          )
+        : [];
+      // Clear any prior snapshot when snapshotting is off so a disabled-feature
+      // update can't keep serving stale file ids that the update dropped.
+      const unset = {
+        ...(expiredAt === null ? { expiredAt: 1 } : {}),
+        ...(snapshotFiles ? {} : { fileSnapshots: 1 }),
+      };
       const update = {
-        messages: updatedMessages,
-        user,
-        shareId: newShareId,
+        $set: {
+          messages: updatedMessages,
+          user,
+          shareId: newShareId,
+          snapshotFiles,
+          ...(resolvedTargetMessageId && { targetMessageId: resolvedTargetMessageId }),
+          ...(hasNewExpiration && { expiredAt }),
+          ...(snapshotFiles && { fileSnapshots }),
+        },
+        ...(Object.keys(unset).length > 0 ? { $unset: unset } : {}),
       };
 
       const updatedShare = (await SharedLink.findOneAndUpdate({ shareId, user }, update, {
@@ -499,7 +869,12 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
 
       anonymizeConvo(updatedShare);
 
-      return { shareId: newShareId, conversationId: updatedShare.conversationId };
+      return {
+        _id: updatedShare._id?.toString(),
+        shareId: newShareId,
+        conversationId: updatedShare.conversationId,
+        targetMessageId: updatedShare.targetMessageId,
+      };
     } catch (error) {
       logger.error('[updateSharedLink] Error updating shared link', {
         error: error instanceof Error ? error.message : 'Unknown error',
@@ -533,6 +908,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       }
 
       return {
+        _id: result._id?.toString(),
         success: true,
         shareId,
         message: 'Share deleted successfully',
@@ -547,6 +923,79 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     }
   }
 
+  /**
+   * Resolve a single file snapshot entry for a shared link, used by the
+   * share-scoped file routes to authorize a file without the owner's ACL.
+   * `hasSnapshots` distinguishes a legacy share (field absent → caller may
+   * backfill) from an ordinary miss (field present but file not in it → 404,
+   * no rebuild). `optedOut` is the per-link "share files" choice — when true the
+   * route must 404 and never backfill, so an opted-out link can't expose files.
+   */
+  async function getSharedLinkFile(
+    shareId: string,
+    fileId: string,
+  ): Promise<{ file: t.SharedFileSnapshot | null; hasSnapshots: boolean; optedOut: boolean }> {
+    const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+    const share = (await SharedLink.findOne({
+      shareId,
+      ...activeExpirationFilter<t.ISharedLink>(),
+    })
+      .select('fileSnapshots snapshotFiles')
+      .lean()) as Pick<t.ISharedLink, 'fileSnapshots' | 'snapshotFiles'> | null;
+
+    if (!share) {
+      return { file: null, hasSnapshots: false, optedOut: false };
+    }
+
+    const hasSnapshots = share.fileSnapshots !== undefined;
+    const optedOut = share.snapshotFiles === false;
+    const file = share.fileSnapshots?.find((snapshot) => snapshot.file_id === fileId) ?? null;
+    return { file, hasSnapshots, optedOut };
+  }
+
+  /**
+   * Lazily build and persist the file snapshot for a legacy shared link that
+   * predates the feature. Mirrors the lazy migration done for legacy ACL grants.
+   * Returns the requested entry (or the full snapshot when no fileId is given).
+   */
+  async function backfillSharedLinkFiles(
+    shareId: string,
+    fileId?: string,
+  ): Promise<t.SharedFileSnapshot | t.SharedFileSnapshot[] | null> {
+    try {
+      const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+      const share = (await SharedLink.findOne({
+        shareId,
+        ...activeExpirationFilter<t.ISharedLink>(),
+      })
+        .populate({ path: 'messages', select: '-_id -__v -user' })
+        .lean()) as (t.ISharedLink & { messages: t.IMessage[] }) | null;
+
+      if (!share) {
+        return null;
+      }
+
+      let messages: t.IMessage[] = share.messages ?? [];
+      if (share.targetMessageId) {
+        messages = getMessagesUpToTarget(messages, share.targetMessageId);
+      }
+
+      const fileSnapshots = await buildFileSnapshots(mongoose, messages, share.user);
+      await SharedLink.updateOne({ shareId }, { $set: { fileSnapshots } });
+
+      if (fileId) {
+        return fileSnapshots.find((snapshot) => snapshot.file_id === fileId) ?? null;
+      }
+      return fileSnapshots;
+    } catch (error) {
+      logger.error('[backfillSharedLinkFiles] Error backfilling file snapshots', {
+        error: error instanceof Error ? error.message : 'Unknown error',
+        shareId,
+      });
+      return null;
+    }
+  }
+
   // Return all methods
   return {
     getSharedLink,
@@ -555,6 +1004,8 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     updateSharedLink,
     deleteSharedLink,
     getSharedMessages,
+    getSharedLinkFile,
+    backfillSharedLinkFiles,
     deleteAllSharedLinks,
     deleteConvoSharedLink,
   };
diff --git a/packages/data-schemas/src/methods/skill.spec.ts b/packages/data-schemas/src/methods/skill.spec.ts
index 85ecf41bf81..dab78260a1d 100644
--- a/packages/data-schemas/src/methods/skill.spec.ts
+++ b/packages/data-schemas/src/methods/skill.spec.ts
@@ -1,4 +1,5 @@
 import mongoose from 'mongoose';
+import { logger, createModels } from '..';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import {
   SystemRoles,
@@ -7,7 +8,6 @@ import {
   PrincipalType,
   PermissionBits,
 } from 'librechat-data-provider';
-import { createAclEntryMethods } from './aclEntry';
 import {
   validateSkillName,
   validateSkillDescription,
@@ -15,9 +15,10 @@ import {
   validateAlwaysApply,
   validateRelativePath,
   inferSkillFileCategory,
+  filterExistingSkillIds,
   deriveStructuredFrontmatterFields,
 } from './skill';
-import { logger, createModels } from '..';
+import { createAclEntryMethods } from './aclEntry';
 import { createMethods } from './index';
 
 logger.silent = true;
@@ -107,8 +108,22 @@ afterEach(async () => {
   await Skill.deleteMany({});
   await SkillFile.deleteMany({});
   await AclEntry.deleteMany({});
+  await mongoose.models.Agent.deleteMany({});
 });
 
+function makeAgentDoc(skillIds: string[], overrides: Record<string, unknown> = {}) {
+  return {
+    id: `agent_${new mongoose.Types.ObjectId().toString()}`,
+    name: 'Allowlist Agent',
+    provider: 'openai',
+    model: 'gpt-4',
+    author: owner._id,
+    skills: skillIds,
+    skills_enabled: true,
+    ...overrides,
+  };
+}
+
 async function grantOwner(resourceId: mongoose.Types.ObjectId | string) {
   const role = (await AccessRole.findOne({ accessRoleId: AccessRoleIds.SKILL_OWNER }).lean()) as {
     _id: mongoose.Types.ObjectId;
@@ -139,6 +154,23 @@ function makeSkillInput(overrides: Record<string, unknown> = {}) {
   };
 }
 
+describe('Skill schema indexes', () => {
+  it('supports GitHub sync source metadata lookups', () => {
+    const indexSpecs = Skill.schema.indexes().map(([fields]) => fields);
+
+    expect(indexSpecs).toContainEqual({
+      source: 1,
+      'sourceMetadata.upstreamId': 1,
+      tenantId: 1,
+    });
+    expect(indexSpecs).toContainEqual({
+      source: 1,
+      'sourceMetadata.sourceId': 1,
+      tenantId: 1,
+    });
+  });
+});
+
 describe('skill validation helpers', () => {
   it('rejects names starting with reserved brand prefixes', () => {
     expect(validateSkillName('anthropic-helper').some((i) => i.code === 'RESERVED_PREFIX')).toBe(
@@ -253,7 +285,9 @@ describe('skill validation helpers', () => {
           'user-invocable': true,
           effort: 5,
           version: '1.0.0',
+          license: 'MIT',
           hooks: { 'pre-run': 'echo hi' },
+          metadata: { owner: 'data-team' },
         }),
       ).toEqual([]);
     });
@@ -281,6 +315,8 @@ describe('skill validation helpers', () => {
     it('accepts always-apply as a boolean', () => {
       expect(validateSkillFrontmatter({ 'always-apply': true })).toEqual([]);
       expect(validateSkillFrontmatter({ 'always-apply': false })).toEqual([]);
+      expect(validateSkillFrontmatter({ alwaysApply: true })).toEqual([]);
+      expect(validateSkillFrontmatter({ alwaysApply: false })).toEqual([]);
     });
 
     it('rejects always-apply with non-boolean values', () => {
@@ -292,6 +328,11 @@ describe('skill validation helpers', () => {
       expect(
         validateSkillFrontmatter({ 'always-apply': 1 }).some((i) => i.code === 'INVALID_TYPE'),
       ).toBe(true);
+      expect(
+        validateSkillFrontmatter({ alwaysApply: 'yes' }).some(
+          (i) => i.code === 'INVALID_TYPE' && i.field === 'frontmatter.alwaysApply',
+        ),
+      ).toBe(true);
     });
   });
 
@@ -507,6 +548,121 @@ describe('Skill CRUD methods', () => {
     expect(await SkillFile.countDocuments({ skillId: skill._id })).toBe(0);
   });
 
+  it('filterExistingSkillIds matches uppercase-hex candidates and returns canonical ids', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'case-skill' }));
+    const canonical = skill._id.toString();
+
+    const filtered = await filterExistingSkillIds(mongoose, [canonical.toUpperCase()]);
+    expect(filtered).toEqual([canonical]);
+  });
+
+  it('deleteSkill prunes agent allowlists even when skill file cleanup fails', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'flaky-files' }));
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([skill._id.toString()]));
+
+    const deleteManySpy = jest
+      .spyOn(SkillFile, 'deleteMany')
+      .mockRejectedValueOnce(new Error('transient storage failure'));
+    try {
+      await expect(methods.deleteSkill(skill._id.toString())).rejects.toThrow(
+        'transient storage failure',
+      );
+    } finally {
+      deleteManySpy.mockRestore();
+    }
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
+
+  it('deleteSkill disables skills when the deleted id was the entire allowlist', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'only-skill' }));
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([skill._id.toString()]));
+
+    const res = await methods.deleteSkill(skill._id.toString().toUpperCase());
+    expect(res.deleted).toBe(true);
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
+
+  it('deleteSkill prunes the deleted id from agent skill allowlists', async () => {
+    const { skill: doomed } = await methods.createSkill(makeSkillInput({ name: 'doomed-skill' }));
+    const { skill: kept } = await methods.createSkill(makeSkillInput({ name: 'kept-skill' }));
+    const Agent = mongoose.models.Agent;
+    const scoped = await Agent.create(makeAgentDoc([doomed._id.toString(), kept._id.toString()]));
+    const untouched = await Agent.create(
+      makeAgentDoc([kept._id.toString()], { name: 'Untouched Agent' }),
+    );
+
+    const res = await methods.deleteSkill(doomed._id.toString());
+    expect(res.deleted).toBe(true);
+
+    const scopedAfter = (await Agent.findById(scoped._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(scopedAfter?.skills).toEqual([kept._id.toString()]);
+    expect(scopedAfter?.skills_enabled).toBe(true);
+
+    const untouchedAfter = (await Agent.findById(untouched._id).lean()) as {
+      skills?: string[];
+    } | null;
+    expect(untouchedAfter?.skills).toEqual([kept._id.toString()]);
+  });
+
+  it('findSkillBySourceIdentity searches only the requested tenant bucket', async () => {
+    const upstreamId = 'librechat-skills:skills/research';
+    const sourceMetadata = {
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      upstreamId,
+    };
+    const author = new mongoose.Types.ObjectId();
+    const tenantSkill = await Skill.create({
+      name: 'research',
+      description: 'A tenant-scoped GitHub skill mirror.',
+      body: 'tenant body',
+      author,
+      authorName: 'GitHub Sync',
+      tenantId: 'tenant-a',
+      source: 'github',
+      sourceMetadata,
+    });
+    const ambientSkill = await Skill.create({
+      name: 'research',
+      description: 'An ambient GitHub skill mirror.',
+      body: 'ambient body',
+      author,
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata,
+    });
+
+    const ambientResult = await methods.findSkillBySourceIdentity({
+      source: 'github',
+      upstreamId,
+    });
+    const tenantResult = await methods.findSkillBySourceIdentity({
+      source: 'github',
+      upstreamId,
+      tenantId: 'tenant-a',
+    });
+
+    expect(ambientResult?._id.toString()).toBe(ambientSkill._id.toString());
+    expect(tenantResult?._id.toString()).toBe(tenantSkill._id.toString());
+  });
+
   it('listSkillsByAccess returns only accessible skills and paginates by cursor', async () => {
     const ids: mongoose.Types.ObjectId[] = [];
     for (let i = 0; i < 3; i++) {
@@ -645,6 +801,55 @@ describe('Skill CRUD methods', () => {
     expect(fetched?.allowedTools).toEqual(['execute_code']);
   });
 
+  it('getAuthorSkillByName resolves only the matching author and tenant', async () => {
+    const sharedName = 'author-owned-lookup';
+    const ownerSkill = await Skill.create({
+      name: sharedName,
+      description: 'Owner tenant skill.',
+      body: 'owner body',
+      frontmatter: {},
+      author: owner._id,
+      authorName: owner.name ?? 'Skill Owner',
+      tenantId: 'tenant-a',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+    await Skill.create({
+      name: sharedName,
+      description: 'Other author skill.',
+      body: 'other body',
+      frontmatter: {},
+      author: other._id,
+      authorName: other.name ?? 'Other',
+      tenantId: 'tenant-a',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+    await Skill.create({
+      name: sharedName,
+      description: 'Owner different tenant skill.',
+      body: 'tenant b body',
+      frontmatter: {},
+      author: owner._id,
+      authorName: owner.name ?? 'Skill Owner',
+      tenantId: 'tenant-b',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+
+    const fetched = await methods.getAuthorSkillByName({
+      name: sharedName,
+      author: owner._id,
+      tenantId: 'tenant-a',
+    });
+
+    expect(fetched?._id.toString()).toBe(ownerSkill._id.toString());
+    expect(fetched?.body).toBe('owner body');
+  });
+
   it('preferModelInvocable picks the model-invocable doc on same-name collision (does NOT filter on userInvocable)', async () => {
     /* Same-name collision scenario the model paths must handle: an older
        user-invocable variant and a newer model-only variant
@@ -1025,6 +1230,35 @@ describe('Skill CRUD methods', () => {
     expect(skill.alwaysApply).toBe(true);
   });
 
+  it('createSkill derives alwaysApply from the camel-case frontmatter alias', async () => {
+    const { skill } = await methods.createSkill(
+      makeSkillInput({
+        name: 'frontmatter-alias-on',
+        frontmatter: {
+          name: 'frontmatter-alias-on',
+          description: 'A small demo skill used in tests.',
+          alwaysApply: true,
+        },
+      }),
+    );
+    expect(skill.alwaysApply).toBe(true);
+  });
+
+  it('createSkill lets always-apply win when both frontmatter spellings are present', async () => {
+    const { skill } = await methods.createSkill(
+      makeSkillInput({
+        name: 'frontmatter-canonical-wins',
+        frontmatter: {
+          name: 'frontmatter-canonical-wins',
+          description: 'A small demo skill used in tests.',
+          'always-apply': false,
+          alwaysApply: true,
+        },
+      }),
+    );
+    expect(skill.alwaysApply).toBe(false);
+  });
+
   it('createSkill prefers explicit top-level alwaysApply over frontmatter', async () => {
     const { skill } = await methods.createSkill(
       makeSkillInput({
@@ -1060,6 +1294,26 @@ describe('Skill CRUD methods', () => {
     }
   });
 
+  it('updateSkill syncs alwaysApply column from the camel-case frontmatter alias', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'sync-alias-test' }));
+    expect(skill.alwaysApply).toBe(false);
+    const result = await methods.updateSkill({
+      id: skill._id.toString(),
+      expectedVersion: skill.version,
+      update: {
+        frontmatter: {
+          name: 'sync-alias-test',
+          description: 'A small demo skill used in tests.',
+          alwaysApply: true,
+        },
+      },
+    });
+    expect(result.status).toBe('updated');
+    if (result.status === 'updated') {
+      expect(result.skill.alwaysApply).toBe(true);
+    }
+  });
+
   it('updateSkill keeps alwaysApply column untouched when the frontmatter update omits always-apply', async () => {
     const { skill } = await methods.createSkill(
       makeSkillInput({ name: 'no-flip', alwaysApply: true }),
@@ -1129,6 +1383,21 @@ describe('Skill CRUD methods', () => {
     }
   });
 
+  it('updateSkill derives alwaysApply=true from a body edit that adds `alwaysApply: true` inline', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'body-enable-alias' }));
+    expect(skill.alwaysApply).toBe(false);
+    const newBody = `---\nname: body-enable-alias\ndescription: now opting in.\nalwaysApply: true\n---\n\n# Body`;
+    const result = await methods.updateSkill({
+      id: skill._id.toString(),
+      expectedVersion: skill.version,
+      update: { body: newBody },
+    });
+    expect(result.status).toBe('updated');
+    if (result.status === 'updated') {
+      expect(result.skill.alwaysApply).toBe(true);
+    }
+  });
+
   it('updateSkill flips alwaysApply to false when the body removes the `always-apply:` line', async () => {
     /* Regression for the “durable mismatch” case: a previously-
        always-apply skill whose SKILL.md body no longer declares the
@@ -1339,6 +1608,40 @@ describe('SkillFile methods', () => {
     expect(files[0].storageRegion).toBe('us-east-2');
   });
 
+  it('throws an explicit error when the upsert returns no saved file row', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput());
+    const missingUpsert = {
+      lean: jest.fn().mockResolvedValue({
+        value: null,
+        lastErrorObject: { updatedExisting: false },
+      }),
+    } as unknown as ReturnType<typeof SkillFile.findOneAndUpdate>;
+    const findOneAndUpdateSpy = jest
+      .spyOn(SkillFile, 'findOneAndUpdate')
+      .mockReturnValueOnce(missingUpsert);
+    const bumpSpy = jest.spyOn(Skill, 'findByIdAndUpdate');
+
+    try {
+      await expect(
+        methods.upsertSkillFile({
+          skillId: skill._id,
+          relativePath: 'scripts/parse.sh',
+          file_id: 'file-1',
+          filename: 'parse.sh',
+          filepath: '/tmp/v1',
+          source: 'local',
+          mimeType: 'text/plain',
+          bytes: 10,
+          author: owner._id,
+        }),
+      ).rejects.toMatchObject({ code: 'SKILL_FILE_UPSERT_NOT_FOUND' });
+      expect(bumpSpy).not.toHaveBeenCalled();
+    } finally {
+      findOneAndUpdateSpy.mockRestore();
+      bumpSpy.mockRestore();
+    }
+  });
+
   it('clears codeEnvRef when a skill file is upserted (replacement)', async () => {
     /* A re-upload of a skill file replaces the row's contents — but the
      * cached `codeEnvRef` refers to the OLD bytes living in codeapi.
@@ -1577,4 +1880,21 @@ describe('deleteUserSkills', () => {
     expect(await Skill.countDocuments()).toBe(1);
     expect(await Skill.countDocuments({ _id: sharedId })).toBe(1);
   });
+
+  it('prunes deleted sole-owned skill ids from agent allowlists', async () => {
+    const { skill: mine } = await methods.createSkill(makeSkillInput({ name: 'mine' }));
+    await grantOwner(mine._id);
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([mine._id.toString()]));
+
+    const deleted = await methods.deleteUserSkills(owner._id as mongoose.Types.ObjectId);
+    expect(deleted).toBe(1);
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
 });
diff --git a/packages/data-schemas/src/methods/skill.ts b/packages/data-schemas/src/methods/skill.ts
index bc1d2260c63..764fab4b4ae 100644
--- a/packages/data-schemas/src/methods/skill.ts
+++ b/packages/data-schemas/src/methods/skill.ts
@@ -16,8 +16,9 @@ import type {
   ISkillFileDocument,
   ISkillSummary,
 } from '~/types/skill';
-import { isValidObjectIdString } from '~/utils/objectId';
+import type { IAgent } from '~/types/agent';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import { isValidObjectIdString } from '~/utils/objectId';
 import { stripYamlTrailingComment } from '~/utils/yaml';
 import { escapeRegExp } from '~/utils/string';
 import logger from '~/config/winston';
@@ -42,6 +43,13 @@ export type ValidationIssue = {
   severity?: 'error' | 'warning';
 };
 
+type SkillFileUpsertResult = {
+  value: (ISkillFile & { _id: Types.ObjectId }) | null;
+  lastErrorObject?: {
+    updatedExisting?: boolean;
+  };
+};
+
 /** Partition an issue list into blocking errors and non-blocking warnings. */
 export function partitionIssues(issues: ValidationIssue[]): {
   errors: ValidationIssue[];
@@ -243,6 +251,7 @@ const ALLOWED_FRONTMATTER_KEYS = new Set<string>([
   'user-invocable',
   'disable-model-invocation',
   'always-apply',
+  'alwaysApply',
   'model',
   'effort',
   'context',
@@ -251,6 +260,7 @@ const ALLOWED_FRONTMATTER_KEYS = new Set<string>([
   'shell',
   'hooks',
   'version',
+  'license',
   'metadata',
 ]);
 
@@ -270,6 +280,7 @@ const FRONTMATTER_KIND: Record<string, FrontmatterKind | FrontmatterKind[]> = {
   'user-invocable': 'boolean',
   'disable-model-invocation': 'boolean',
   'always-apply': 'boolean',
+  alwaysApply: 'boolean',
   model: 'string',
   effort: ['string', 'number'],
   context: 'string',
@@ -277,6 +288,7 @@ const FRONTMATTER_KIND: Record<string, FrontmatterKind | FrontmatterKind[]> = {
   paths: ['string', 'stringArray'],
   shell: 'string',
   version: 'string',
+  license: 'string',
 };
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
@@ -487,6 +499,14 @@ export type UpdateSkillInput = {
   frontmatter?: Record<string, unknown>;
   category?: string;
   alwaysApply?: boolean;
+  source?: 'inline' | 'github' | 'notion';
+  sourceMetadata?: Record<string, unknown>;
+};
+
+export type GetAuthorSkillByNameParams = {
+  name: string;
+  author: Types.ObjectId | string;
+  tenantId?: string | null;
 };
 
 /**
@@ -582,6 +602,20 @@ export function backfillDerivedFromFrontmatter<
   return skill;
 }
 
+function getAlwaysApplyFrontmatterValue(
+  frontmatter: Record<string, unknown> | undefined,
+): boolean | undefined {
+  const canonical = frontmatter?.['always-apply'];
+  if (typeof canonical === 'boolean') {
+    return canonical;
+  }
+  const camelAlias = frontmatter?.alwaysApply;
+  if (typeof camelAlias === 'boolean') {
+    return camelAlias;
+  }
+  return undefined;
+}
+
 export type UpsertSkillFileInput = {
   skillId: Types.ObjectId | string;
   relativePath: string;
@@ -591,6 +625,7 @@ export type UpsertSkillFileInput = {
   storageKey?: string;
   storageRegion?: string;
   source: string;
+  sourceMetadata?: Record<string, unknown>;
   mimeType: string;
   bytes: number;
   isExecutable?: boolean;
@@ -664,14 +699,14 @@ type BodyAlwaysApplyResult =
   | { status: 'invalid' };
 
 /**
- * Extractor for the `always-apply` flag sitting inside a SKILL.md body's
+ * Extractor for the `always-apply` / `alwaysApply` flag sitting inside a SKILL.md body's
  * YAML frontmatter block. The REST edit flow lets users rewrite the full
  * SKILL.md text via `update.body` without a structured `frontmatter`
  * object, so this is the only signal we have for "user flipped
- * `always-apply:` inline in their editor".
+ * `always-apply:` or `alwaysApply:` inline in their editor".
  *
  * Returns a discriminated union so callers can tell:
- *  - `absent` — no `always-apply:` key (leave column alone; could be
+ *  - `absent` — no always-apply key (leave column alone; could be
  *    "user removed the flag" or "user hasn't written it yet" — both
  *    resolve to no-op). An empty value (`always-apply:` with nothing
  *    after the colon) is also treated as absent to allow mid-edit
@@ -682,7 +717,8 @@ type BodyAlwaysApplyResult =
  *    recognizable boolean (e.g. `tru`, `yes`, `1`). Validation rejects
  *    this rather than silently ignoring so `always-apply: tru` typos
  *    surface as 400s instead of drifting the column from what the
- *    saved SKILL.md text says.
+ *    saved SKILL.md text says. When both forms are present, the canonical
+ *    `always-apply` form wins because existing files may already rely on it.
  */
 function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyResult {
   if (typeof body !== 'string' || body.length === 0) {
@@ -698,13 +734,15 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     return { status: 'absent' };
   }
   const block = after.slice(0, closingIdx);
+  let aliasResult: BodyAlwaysApplyResult | undefined;
   for (const line of block.split('\n')) {
     const colon = line.indexOf(':');
     if (colon === -1) {
       continue;
     }
-    const key = line.slice(0, colon).trim().toLowerCase();
-    if (key !== 'always-apply') {
+    const key = line.slice(0, colon).trim();
+    const normalizedKey = key.toLowerCase();
+    if (normalizedKey !== 'always-apply' && normalizedKey !== 'alwaysapply') {
       continue;
     }
     // Strip the YAML inline comment BEFORE unquoting — a line like
@@ -713,7 +751,12 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     // the comment-strip would leave `"true"` which parses as invalid.
     let value = stripYamlTrailingComment(line.slice(colon + 1).trim()).trim();
     if (value === '') {
-      return { status: 'absent' };
+      const result: BodyAlwaysApplyResult = { status: 'absent' };
+      if (normalizedKey === 'always-apply') {
+        return result;
+      }
+      aliasResult = result;
+      continue;
     }
     if (
       value.length >= 2 &&
@@ -724,14 +767,28 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     }
     value = value.trim();
     if (value === '') {
-      return { status: 'absent' };
+      const result: BodyAlwaysApplyResult = { status: 'absent' };
+      if (normalizedKey === 'always-apply') {
+        return result;
+      }
+      aliasResult = result;
+      continue;
     }
     const lowered = value.toLowerCase();
-    if (lowered === 'true') return { status: 'valid', value: true };
-    if (lowered === 'false') return { status: 'valid', value: false };
-    return { status: 'invalid' };
+    let result: BodyAlwaysApplyResult;
+    if (lowered === 'true') {
+      result = { status: 'valid', value: true };
+    } else if (lowered === 'false') {
+      result = { status: 'valid', value: false };
+    } else {
+      result = { status: 'invalid' };
+    }
+    if (normalizedKey === 'always-apply') {
+      return result;
+    }
+    aliasResult = result;
   }
-  return { status: 'absent' };
+  return aliasResult ?? { status: 'absent' };
 }
 
 /**
@@ -745,9 +802,9 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
  *
  * Precedence:
  *  1. An explicit top-level `alwaysApply` wins (caller overrides).
- *  2. Otherwise, derive from `frontmatter['always-apply']` when it is
- *     a strict boolean.
- *  3. Otherwise, parse `always-apply:` out of the SKILL.md body
+ *  2. Otherwise, derive from `frontmatter['always-apply']` or the accepted
+ *     alias `frontmatter.alwaysApply` when either is a strict boolean.
+ *  3. Otherwise, parse `always-apply:` / `alwaysApply:` out of the SKILL.md body
  *     frontmatter block (covers the UI edit flow that sends only
  *     `body` without a structured `frontmatter` object).
  *  4. Otherwise, return `fallback` (typically `false` on create, or the
@@ -767,7 +824,7 @@ function resolveAlwaysApplyFromInput(
   if (typeof explicit === 'boolean') {
     return explicit;
   }
-  const fromFrontmatter = frontmatter?.['always-apply'];
+  const fromFrontmatter = getAlwaysApplyFrontmatterValue(frontmatter);
   if (typeof fromFrontmatter === 'boolean') {
     return fromFrontmatter;
   }
@@ -778,6 +835,35 @@ function resolveAlwaysApplyFromInput(
   return fallback;
 }
 
+/**
+ * Narrows candidate skill ids to those backed by an existing Skill doc.
+ * Existence-only check (no ACL) so pruning an agent allowlist never drops
+ * skills the saving user merely can't view. Preserves input order, dedupes,
+ * and drops malformed ids — they can't reference anything. Candidates are
+ * lowercased before comparison: `isValidObjectIdString` accepts uppercase
+ * hex, but `_id.toString()` is always lowercase, and a casing mismatch
+ * would silently drop a valid id (and an emptied allowlist means the full
+ * catalog — the opposite of the configured scope).
+ */
+export async function filterExistingSkillIds(
+  mongoose: typeof import('mongoose'),
+  skillIds: string[],
+): Promise<string[]> {
+  const candidates = [
+    ...new Set(skillIds.filter(isValidObjectIdString).map((id) => id.toLowerCase())),
+  ];
+  if (candidates.length === 0) {
+    return [];
+  }
+  const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+  const docs = await Skill.find(
+    { _id: { $in: candidates.map((id) => new mongoose.Types.ObjectId(id)) } },
+    { _id: 1 },
+  ).lean<Array<{ _id: Types.ObjectId }>>();
+  const existing = new Set(docs.map((doc) => doc._id.toString()));
+  return candidates.filter((id) => existing.has(id));
+}
+
 /**
  * Validate the `always-apply` value that would be derived from the
  * SKILL.md body's inline frontmatter. Only reports an issue when the
@@ -792,16 +878,97 @@ export function validateAlwaysApplyInBody(body: string | undefined): ValidationI
   if (result.status === 'invalid') {
     return [
       {
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       },
     ];
   }
   return [];
 }
 
-export function createSkillMethods(mongoose: typeof import('mongoose'), deps: SkillDeps) {
+export function createSkillMethods(
+  mongoose: typeof import('mongoose'),
+  deps: SkillDeps,
+): {
+  createSkill: (data: CreateSkillInput) => Promise<CreateSkillResult>;
+  getSkillById: (id: string | Types.ObjectId) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  getSkillByName: (
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    options?: {
+      /**
+       * Manual paths (`$` popover, always-apply once Phase 5 lands) set
+       * this so a same-name newer `userInvocable: false` duplicate can't
+       * shadow the older user-invocable doc the popover surfaced.
+       * Disable-model-invocation status is irrelevant here — manually-
+       * primed disabled skills are explicitly supported (iter 4).
+       */
+      preferUserInvocable?: boolean;
+      /**
+       * Model paths (`skill` / `read_file` tool handlers) set this so a
+       * same-name newer `disable-model-invocation: true` duplicate can't
+       * shadow the cataloged model-invocable doc. User-invocability is
+       * irrelevant here — `userInvocable: false` skills are model-only
+       * and remain valid model-invocation targets.
+       *
+       * Both flags fall back to the newest match when no preferred doc
+       * exists, so handlers can still fire their explicit-rejection
+       * error paths (e.g. "cannot be invoked by the model" in the
+       * disabled-only case).
+       */
+      preferModelInvocable?: boolean;
+    },
+  ) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  getAuthorSkillByName: (
+    params: GetAuthorSkillByNameParams,
+  ) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsByAccess: (params: ListSkillsByAccessParams) => Promise<ListSkillsByAccessResult>;
+  listAlwaysApplySkills: (
+    params: ListAlwaysApplySkillsParams,
+  ) => Promise<ListAlwaysApplySkillsResult>;
+  updateSkill: (params: {
+    id: string;
+    expectedVersion: number;
+    update: UpdateSkillInput;
+  }) => Promise<UpdateSkillResult>;
+  deleteSkill: (id: string) => Promise<{ deleted: boolean }>;
+  deleteUserSkills: (userId: Types.ObjectId | string) => Promise<number>;
+  findSkillBySourceIdentity: (params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsBySource: (params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }) => Promise<Array<ISkill & { _id: Types.ObjectId }>>;
+  listSkillFiles: (
+    skillId: Types.ObjectId | string,
+  ) => Promise<Array<ISkillFile & { _id: Types.ObjectId }>>;
+  upsertSkillFile: (row: UpsertSkillFileInput) => Promise<ISkillFile & { _id: Types.ObjectId }>;
+  deleteSkillFile: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+  ) => Promise<{ deleted: boolean }>;
+  getSkillFileByPath: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+  ) => Promise<(ISkillFile & { _id: Types.ObjectId }) | null>;
+  updateSkillFileContent: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+    update: { content?: string; isBinary?: boolean },
+  ) => Promise<void>;
+  updateSkillFileCodeEnvIds: (
+    updates: Array<{
+      skillId: Types.ObjectId | string;
+      relativePath: string;
+      codeEnvRef: CodeEnvRef;
+    }>,
+  ) => Promise<{ matchedCount: number; modifiedCount: number }>;
+} {
   const { ObjectId } = mongoose.Types;
 
   function buildSkillFilter(
@@ -870,18 +1037,19 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
        higher-precedence source won't override it (see
        `resolveAlwaysApplyFromInput` for the cascade). A caller sending
        an explicit top-level `alwaysApply` or a structured
-       `frontmatter['always-apply']` has the body value overridden at
+       an always-apply value in structured `frontmatter` has the body value overridden at
        derivation time, so rejecting them for a typo they aren't relying
        on would be user-hostile. */
     if (
       bodyAlwaysApply?.status === 'invalid' &&
       typeof data.alwaysApply !== 'boolean' &&
-      typeof data.frontmatter?.['always-apply'] !== 'boolean'
+      getAlwaysApplyFrontmatterValue(data.frontmatter) === undefined
     ) {
       issues.push({
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       });
     }
     const { errors, warnings } = partitionIssues(issues);
@@ -1017,6 +1185,22 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     return preferred ?? docs[0];
   }
 
+  async function getAuthorSkillByName(
+    params: GetAuthorSkillByNameParams,
+  ): Promise<(ISkill & { _id: Types.ObjectId }) | null> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const doc = await Skill.findOne({
+      name: params.name,
+      author: params.author,
+      tenantId: params.tenantId ?? null,
+    })
+      .sort({ updatedAt: -1 })
+      .lean();
+    return backfillDerivedFromFrontmatter(
+      (doc as unknown as (ISkill & { _id: Types.ObjectId }) | null) ?? null,
+    );
+  }
+
   async function listSkillsByAccess(
     params: ListSkillsByAccessParams,
   ): Promise<ListSkillsByAccessResult> {
@@ -1183,12 +1367,13 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (
       bodyAlwaysApply?.status === 'invalid' &&
       update.alwaysApply === undefined &&
-      typeof update.frontmatter?.['always-apply'] !== 'boolean'
+      getAlwaysApplyFrontmatterValue(update.frontmatter) === undefined
     ) {
       issues.push({
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       });
     }
     const { errors, warnings } = partitionIssues(issues);
@@ -1206,6 +1391,8 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (update.displayTitle !== undefined) setPayload.displayTitle = update.displayTitle;
     if (update.description !== undefined) setPayload.description = update.description;
     if (update.body !== undefined) setPayload.body = update.body;
+    if (update.source !== undefined) setPayload.source = update.source;
+    if (update.sourceMetadata !== undefined) setPayload.sourceMetadata = update.sourceMetadata;
     if (update.frontmatter !== undefined) {
       setPayload.frontmatter = update.frontmatter;
       /**
@@ -1227,11 +1414,11 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     /**
      * Keep the indexed `alwaysApply` column in sync with whatever the update
      * is carrying: an explicit top-level `alwaysApply` always wins; a
-     * structured `frontmatter` with `always-apply: true/false` is next; and
-     * a `body` update is scanned last for an inline `always-apply:` line
+     * structured `frontmatter` with `always-apply: true/false` or the
+     * accepted `alwaysApply` alias is next; and a `body` update is scanned last for an inline `always-apply:` line
      * inside the SKILL.md frontmatter block. The body path is load-bearing
      * for the REST edit flow — the current UI sends `body` without a
-     * parallel `frontmatter` object, so inline edits to `always-apply:`
+     * parallel `frontmatter` object, so inline edits to `always-apply:` / `alwaysApply:`
      * would otherwise leave the column stale and auto-priming / pin
      * badges would keep using the old value.
      *
@@ -1246,7 +1433,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
      * at each level, not the presence of the parent field. An API caller
      * that sends both `body` and an unrelated `frontmatter` bag (e.g.
      * editing category + rewriting SKILL.md in one PATCH) still gets the
-     * body-inline flag respected because `frontmatter['always-apply']`
+     * body-inline flag respected because no structured always-apply key
      * is absent in that payload.
      */
     let derivedAlwaysApply: boolean | undefined;
@@ -1254,7 +1441,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
       derivedAlwaysApply = update.alwaysApply;
     }
     if (derivedAlwaysApply === undefined && update.frontmatter !== undefined) {
-      const fromFrontmatter = update.frontmatter['always-apply'];
+      const fromFrontmatter = getAlwaysApplyFrontmatterValue(update.frontmatter);
       if (typeof fromFrontmatter === 'boolean') {
         derivedAlwaysApply = fromFrontmatter;
       }
@@ -1312,6 +1499,48 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     };
   }
 
+  /**
+   * Removes deleted skill ids from every agent's `skills` allowlist. A dangling
+   * id is invisible in the builder yet keeps the allowlist non-empty, so the
+   * runtime scopes the catalog to an empty intersection and the agent silently
+   * loses all skills. Direct `updateMany` on purpose: hygiene, not an authored
+   * edit — no version entry, timestamps untouched.
+   *
+   * Ids are lowercased first: allowlists store canonical `_id.toString()`
+   * values, and an uppercase-but-valid id would delete the Skill doc yet
+   * leave the dangling entry behind.
+   *
+   * Agents whose ENTIRE allowlist is being deleted fail closed instead:
+   * an emptied allowlist with `skills_enabled: true` means the full
+   * accessible catalog at runtime, so a plain `$pull` would silently widen
+   * a deliberately restricted agent. Disabling skills preserves the
+   * restriction until an author makes a new explicit choice.
+   */
+  async function removeSkillsFromAgentAllowlists(skillIds: string[]): Promise<void> {
+    if (skillIds.length === 0) {
+      return;
+    }
+    const ids = skillIds.map((id) => id.toLowerCase());
+    const Agent = mongoose.models.Agent as Model<IAgent>;
+    try {
+      await Agent.updateMany(
+        { skills: { $in: ids, $not: { $elemMatch: { $nin: ids } } } },
+        { $set: { skills: [], skills_enabled: false } },
+        { timestamps: false },
+      );
+      await Agent.updateMany(
+        { skills: { $in: ids } },
+        { $pull: { skills: { $in: ids } } },
+        { timestamps: false },
+      );
+    } catch (error) {
+      logger.error(
+        '[removeSkillsFromAgentAllowlists] Error pruning agent skill allowlists:',
+        error,
+      );
+    }
+  }
+
   async function deleteSkill(id: string): Promise<{ deleted: boolean }> {
     if (!isValidObjectIdString(id)) {
       return { deleted: false };
@@ -1323,6 +1552,10 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (!res.deletedCount) {
       return { deleted: false };
     }
+    /** Prune allowlists immediately after the Skill row is gone: if the
+     *  SkillFile cleanup below throws, a retry exits early on
+     *  `deletedCount === 0` and would never reach a later prune. */
+    await removeSkillsFromAgentAllowlists([id]);
     await SkillFile.deleteMany({ skillId: objectId });
     try {
       await deps.removeAllPermissions({ resourceType: ResourceType.SKILL, resourceId: id });
@@ -1342,6 +1575,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     const SkillFile = mongoose.models.SkillFile as Model<ISkillFileDocument>;
     await SkillFile.deleteMany({ skillId: { $in: soleOwned } });
     const res = await Skill.deleteMany({ _id: { $in: soleOwned } });
+    await removeSkillsFromAgentAllowlists(soleOwned.map((rid) => rid.toString()));
     await Promise.allSettled(
       soleOwned.map((rid) =>
         deps
@@ -1357,6 +1591,35 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     return res.deletedCount ?? 0;
   }
 
+  async function findSkillBySourceIdentity(params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }): Promise<(ISkill & { _id: Types.ObjectId }) | null> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const tenantFilter: FilterQuery<ISkillDocument> = params.tenantId
+      ? { tenantId: params.tenantId }
+      : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
+    const doc = await Skill.findOne({
+      source: params.source,
+      'sourceMetadata.upstreamId': params.upstreamId,
+      ...tenantFilter,
+    }).lean();
+    return (doc as unknown as (ISkill & { _id: Types.ObjectId }) | null) ?? null;
+  }
+
+  async function listSkillsBySource(params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }): Promise<Array<ISkill & { _id: Types.ObjectId }>> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const rows = await Skill.find({
+      source: params.source,
+      'sourceMetadata.sourceId': params.sourceId,
+    }).lean();
+    return rows as unknown as Array<ISkill & { _id: Types.ObjectId }>;
+  }
+
   /**
    * Atomically bumps `Skill.version` and adjusts `fileCount` by `delta`.
    * `delta` is `+1` when a new file is inserted, `-1` when one is deleted, and
@@ -1413,12 +1676,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     }
     const SkillFile = mongoose.models.SkillFile as Model<ISkillFileDocument>;
     const category = inferSkillFileCategory(row.relativePath);
-    // Atomic new-vs-replace detection: with `new: false, upsert: true`,
-    // `findOneAndUpdate` returns the pre-update document (or null if the doc
-    // did not exist and was just inserted). Checking the return value replaces
-    // a non-atomic `findOne` + `upsert` pair that could double-count on
-    // concurrent uploads of the same (skillId, relativePath).
-    const previous = await SkillFile.findOneAndUpdate(
+    const result = (await SkillFile.findOneAndUpdate(
       { skillId: row.skillId, relativePath: row.relativePath },
       {
         $set: {
@@ -1430,6 +1688,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
           storageKey: row.storageKey,
           storageRegion: row.storageRegion,
           source: row.source,
+          sourceMetadata: row.sourceMetadata,
           mimeType: row.mimeType,
           bytes: row.bytes,
           category,
@@ -1439,23 +1698,17 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
         },
         $unset: { content: '', isBinary: '', codeEnvRef: '' },
       },
-      { new: false, upsert: true },
-    ).lean();
-    const delta = previous ? 0 : 1;
+      { new: true, upsert: true, includeResultMetadata: true },
+    ).lean()) as unknown as SkillFileUpsertResult;
+    const current = result.value;
+    if (!current) {
+      const error = new Error('Skill file upsert failed to read the saved file row');
+      (error as Error & { code?: string }).code = 'SKILL_FILE_UPSERT_NOT_FOUND';
+      throw error;
+    }
+    const delta = result.lastErrorObject?.updatedExisting === false ? 1 : 0;
     await bumpSkillVersionAndAdjustFileCount(row.skillId, delta);
-
-    // Fetch the current (post-upsert) document for the caller. This second
-    // round-trip is an intentional tradeoff for the TOCTOU-safe detection
-    // above: `new: false` is required to distinguish insert from replace
-    // atomically, which means `findOneAndUpdate` returns the pre-update
-    // document (null on insert). A separate `findOne` is the simplest way
-    // to return the authoritative post-upsert state. Performance impact is
-    // negligible compared to the file upload I/O this sits behind.
-    const current = await SkillFile.findOne({
-      skillId: row.skillId,
-      relativePath: row.relativePath,
-    }).lean();
-    return current as unknown as ISkillFile & { _id: Types.ObjectId };
+    return current;
   }
 
   async function deleteSkillFile(
@@ -1526,11 +1779,14 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     createSkill,
     getSkillById,
     getSkillByName,
+    getAuthorSkillByName,
     listSkillsByAccess,
     listAlwaysApplySkills,
     updateSkill,
     deleteSkill,
     deleteUserSkills,
+    findSkillBySourceIdentity,
+    listSkillsBySource,
     listSkillFiles,
     upsertSkillFile,
     deleteSkillFile,
diff --git a/packages/data-schemas/src/methods/skillSync.spec.ts b/packages/data-schemas/src/methods/skillSync.spec.ts
new file mode 100644
index 00000000000..d384db1d7c7
--- /dev/null
+++ b/packages/data-schemas/src/methods/skillSync.spec.ts
@@ -0,0 +1,194 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { ISkillSyncCredential } from '~/types/skillSync';
+import { createSkillSyncMethods } from './skillSync';
+import { encryptV2, decryptV2 } from '~/crypto';
+import { createModels } from '../models';
+
+jest.mock('~/crypto', () => ({
+  encryptV2: jest.fn(async (value: string) => `encrypted:${value}`),
+  decryptV2: jest.fn(async (value: string) => value.replace(/^encrypted:/, '')),
+}));
+
+let mongoServer: MongoMemoryServer;
+let methods: ReturnType<typeof createSkillSyncMethods>;
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  methods = createSkillSyncMethods(mongoose);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await mongoose.models.SkillSyncCredential.deleteMany({});
+  await mongoose.models.SkillSyncStatus.deleteMany({});
+  jest.clearAllMocks();
+});
+
+describe('createSkillSyncMethods', () => {
+  it('encrypts GitHub tokens and never exposes stored token material in summaries', async () => {
+    const summary = await methods.upsertSkillSyncCredential({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      token: 'ghp_secret',
+    });
+    expect(encryptV2).toHaveBeenCalledWith('ghp_secret');
+    expect(summary).toMatchObject({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      credentialPresent: true,
+    });
+    expect(JSON.stringify(summary)).not.toContain('ghp_secret');
+    expect(JSON.stringify(summary)).not.toContain('encrypted:ghp_secret');
+
+    const raw = (await mongoose.models.SkillSyncCredential.findOne({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+    })
+      .select('+encryptedToken +tokenHash')
+      .lean()) as ISkillSyncCredential | null;
+    if (!raw) {
+      throw new Error('Expected stored skill sync credential');
+    }
+    expect(raw.encryptedToken).toBe('encrypted:ghp_secret');
+    expect(raw.tokenHash).toHaveLength(64);
+  });
+
+  it('decrypts GitHub tokens only through the token accessor', async () => {
+    await methods.upsertSkillSyncCredential({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      token: 'github_pat_secret',
+    });
+    const token = await methods.getSkillSyncCredentialToken('github', 'github-skills-prod');
+    expect(decryptV2).toHaveBeenCalledWith('encrypted:github_pat_secret');
+    expect(token).toBe('github_pat_secret');
+  });
+
+  it('uses the status collection as a Mongo-backed sync lock', async () => {
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+    await expect(
+      methods.refreshSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await methods.releaseSkillSyncLock({ provider: 'github', lockOwner: 'worker-a' });
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it('clears stale source errors after a successful sync status update', async () => {
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      status: 'failed',
+      errorCode: 'SKILL_PARSE_FAILED',
+      errorMessage: 'bad frontmatter',
+    });
+
+    const success = await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+      syncedFileCount: 2,
+    });
+
+    expect(success.status).toBe('succeeded');
+    expect(success.errorCode).toBeUndefined();
+    expect(success.errorMessage).toBeUndefined();
+  });
+
+  it('keeps status rows separate for the same source id in different tenants', async () => {
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'shared-source',
+      tenantId: 'tenant-a',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+    });
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'shared-source',
+      tenantId: 'tenant-b',
+      status: 'failed',
+      errorCode: 'TENANT_B_FAILURE',
+    });
+
+    const tenantA = await methods.getSkillSyncStatus('github', 'shared-source', 'tenant-a');
+    const tenantB = await methods.getSkillSyncStatus('github', 'shared-source', 'tenant-b');
+
+    expect(tenantA).toMatchObject({
+      sourceId: 'shared-source',
+      tenantId: 'tenant-a',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+    });
+    expect(tenantB).toMatchObject({
+      sourceId: 'shared-source',
+      tenantId: 'tenant-b',
+      status: 'failed',
+      errorCode: 'TENANT_B_FAILURE',
+    });
+  });
+
+  it('keeps sync locks separate per tenant', async () => {
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-a',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-b',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-a',
+        lockOwner: 'worker-c',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+  });
+});
diff --git a/packages/data-schemas/src/methods/skillSync.ts b/packages/data-schemas/src/methods/skillSync.ts
new file mode 100644
index 00000000000..87c749f4006
--- /dev/null
+++ b/packages/data-schemas/src/methods/skillSync.ts
@@ -0,0 +1,382 @@
+import { createHash } from 'crypto';
+import type { Model, Types } from 'mongoose';
+import type {
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncRunStatus,
+  ISkillSyncStatusDocument,
+  ISkillSyncCredential,
+  ISkillSyncCredentialDocument,
+} from '~/types/skillSync';
+import { encryptV2, decryptV2 } from '~/crypto';
+
+const LOCK_SOURCE_ID = '__global_lock__';
+
+export type SkillSyncCredentialSummary = {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  credentialPresent: boolean;
+  tokenFingerprint?: string;
+  createdAt?: Date;
+  updatedAt?: Date;
+};
+
+export type UpsertSkillSyncCredentialInput = {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  token: string;
+  userId?: Types.ObjectId;
+};
+
+export type SkillSyncStatusInput = {
+  provider: SkillSyncProvider;
+  sourceId: string;
+  tenantId?: string;
+  status: SkillSyncRunStatus;
+  credentialKey?: string;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: Date;
+  finishedAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount?: number;
+  syncedFileCount?: number;
+  deletedSkillCount?: number;
+  deletedFileCount?: number;
+};
+
+export type SkillSyncLockInput = {
+  provider: SkillSyncProvider;
+  lockOwner: string;
+  leaseMs: number;
+  tenantId?: string;
+};
+
+export type SkillSyncReleaseLockInput = {
+  provider: SkillSyncProvider;
+  lockOwner: string;
+  tenantId?: string;
+};
+
+export type SkillSyncMethods = {
+  upsertSkillSyncCredential: (
+    input: UpsertSkillSyncCredentialInput,
+  ) => Promise<SkillSyncCredentialSummary>;
+  deleteSkillSyncCredential: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<{ deleted: boolean }>;
+  listSkillSyncCredentials: (provider: SkillSyncProvider) => Promise<SkillSyncCredentialSummary[]>;
+  getSkillSyncCredentialToken: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<string | null>;
+  getSkillSyncCredentialSummary: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<SkillSyncCredentialSummary | null>;
+  listSkillSyncStatuses: (provider: SkillSyncProvider) => Promise<ISkillSyncStatus[]>;
+  getSkillSyncStatus: (
+    provider: SkillSyncProvider,
+    sourceId: string,
+    tenantId?: string,
+  ) => Promise<ISkillSyncStatus | null>;
+  upsertSkillSyncStatus: (input: SkillSyncStatusInput) => Promise<ISkillSyncStatus>;
+  tryAcquireSkillSyncLock: (params: SkillSyncLockInput) => Promise<boolean>;
+  refreshSkillSyncLock: (params: SkillSyncLockInput) => Promise<boolean>;
+  releaseSkillSyncLock: (params: SkillSyncReleaseLockInput) => Promise<void>;
+};
+
+function hashToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex');
+}
+
+function tenantStatusCondition(tenantId?: string) {
+  return tenantId ? { tenantId } : { tenantId: { $exists: false } };
+}
+
+function summarizeCredential(
+  credential: Pick<
+    ISkillSyncCredential,
+    'provider' | 'credentialKey' | 'tokenHash' | 'createdAt' | 'updatedAt'
+  >,
+): SkillSyncCredentialSummary {
+  return {
+    provider: credential.provider,
+    credentialKey: credential.credentialKey,
+    credentialPresent: true,
+    tokenFingerprint: credential.tokenHash.slice(0, 12),
+    createdAt: credential.createdAt,
+    updatedAt: credential.updatedAt,
+  };
+}
+
+export function createSkillSyncMethods(mongoose: typeof import('mongoose')): SkillSyncMethods {
+  async function upsertSkillSyncCredential(
+    input: UpsertSkillSyncCredentialInput,
+  ): Promise<SkillSyncCredentialSummary> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const encryptedToken = await encryptV2(input.token);
+    const tokenHash = hashToken(input.token);
+    const update = {
+      $set: {
+        encryptedToken,
+        tokenHash,
+        updatedBy: input.userId,
+      },
+      $setOnInsert: {
+        provider: input.provider,
+        credentialKey: input.credentialKey,
+        createdBy: input.userId,
+      },
+    };
+    const credential = await Credential.findOneAndUpdate(
+      { provider: input.provider, credentialKey: input.credentialKey },
+      update,
+      { upsert: true, new: true, setDefaultsOnInsert: true },
+    )
+      .select('+tokenHash')
+      .lean();
+    return summarizeCredential(credential as ISkillSyncCredential);
+  }
+
+  async function deleteSkillSyncCredential(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<{ deleted: boolean }> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const result = await Credential.deleteOne({ provider, credentialKey });
+    return { deleted: (result.deletedCount ?? 0) > 0 };
+  }
+
+  async function listSkillSyncCredentials(
+    provider: SkillSyncProvider,
+  ): Promise<SkillSyncCredentialSummary[]> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const rows = await Credential.find({ provider })
+      .select('+tokenHash')
+      .sort({ credentialKey: 1 })
+      .lean();
+    return rows.map((row) => summarizeCredential(row as ISkillSyncCredential));
+  }
+
+  async function getSkillSyncCredentialToken(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<string | null> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const credential = await Credential.findOne({ provider, credentialKey })
+      .select('+encryptedToken')
+      .lean();
+    if (!credential) {
+      return null;
+    }
+    return decryptV2((credential as ISkillSyncCredential).encryptedToken);
+  }
+
+  async function getSkillSyncCredentialSummary(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<SkillSyncCredentialSummary | null> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const credential = await Credential.findOne({ provider, credentialKey })
+      .select('+tokenHash')
+      .lean();
+    if (!credential) {
+      return null;
+    }
+    return summarizeCredential(credential as ISkillSyncCredential);
+  }
+
+  async function listSkillSyncStatuses(provider: SkillSyncProvider): Promise<ISkillSyncStatus[]> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const rows = await Status.find({ provider, sourceId: { $ne: LOCK_SOURCE_ID } })
+      .sort({ sourceId: 1 })
+      .lean<ISkillSyncStatus[]>();
+    return rows;
+  }
+
+  async function getSkillSyncStatus(
+    provider: SkillSyncProvider,
+    sourceId: string,
+    tenantId?: string,
+  ): Promise<ISkillSyncStatus | null> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const row = await Status.findOne({
+      provider,
+      sourceId,
+      ...tenantStatusCondition(tenantId),
+    }).lean<ISkillSyncStatus | null>();
+    return row ?? null;
+  }
+
+  async function upsertSkillSyncStatus(input: SkillSyncStatusInput): Promise<ISkillSyncStatus> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const success = input.status === 'succeeded';
+    const failure = input.status === 'failed';
+    const setPayload: Partial<ISkillSyncStatus> = {
+      status: input.status,
+      credentialKey: input.credentialKey,
+      owner: input.owner,
+      repo: input.repo,
+      ref: input.ref,
+      paths: input.paths,
+      startedAt: input.startedAt,
+      finishedAt: input.finishedAt,
+      syncedSkillCount: input.syncedSkillCount ?? 0,
+      syncedFileCount: input.syncedFileCount ?? 0,
+      deletedSkillCount: input.deletedSkillCount ?? 0,
+      deletedFileCount: input.deletedFileCount ?? 0,
+      ...(success ? { lastSuccessAt: input.finishedAt ?? now } : {}),
+      ...(failure ? { lastFailureAt: input.finishedAt ?? now } : {}),
+    };
+    if (failure) {
+      setPayload.errorCode = input.errorCode;
+      setPayload.errorMessage = input.errorMessage;
+    }
+    const unsetPayload = failure ? {} : { errorCode: '', errorMessage: '' };
+    const row = await Status.findOneAndUpdate(
+      {
+        provider: input.provider,
+        sourceId: input.sourceId,
+        ...tenantStatusCondition(input.tenantId),
+      },
+      {
+        $set: setPayload,
+        ...(failure ? {} : { $unset: unsetPayload }),
+        $setOnInsert: {
+          provider: input.provider,
+          sourceId: input.sourceId,
+          ...(input.tenantId ? { tenantId: input.tenantId } : {}),
+        },
+      },
+      { upsert: true, new: true, setDefaultsOnInsert: true },
+    ).lean<ISkillSyncStatus>();
+    return row;
+  }
+
+  async function tryAcquireSkillSyncLock(params: SkillSyncLockInput): Promise<boolean> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const lockExpiresAt = new Date(now.getTime() + params.leaseMs);
+    const existing = await Status.findOne({
+      provider: params.provider,
+      sourceId: LOCK_SOURCE_ID,
+      ...tenantStatusCondition(params.tenantId),
+    }).lean<ISkillSyncStatus | null>();
+    if (existing?.lockOwner && existing.lockExpiresAt && existing.lockExpiresAt > now) {
+      return false;
+    }
+    if (!existing) {
+      try {
+        await Status.create({
+          provider: params.provider,
+          sourceId: LOCK_SOURCE_ID,
+          ...(params.tenantId ? { tenantId: params.tenantId } : {}),
+          status: 'running',
+          lockOwner: params.lockOwner,
+          lockExpiresAt,
+          startedAt: now,
+        });
+        return true;
+      } catch (error) {
+        if ((error as { code?: number }).code === 11000) {
+          return false;
+        }
+        throw error;
+      }
+    }
+    try {
+      const row = await Status.findOneAndUpdate(
+        {
+          provider: params.provider,
+          sourceId: LOCK_SOURCE_ID,
+          ...tenantStatusCondition(params.tenantId),
+          $or: [{ lockExpiresAt: { $exists: false } }, { lockExpiresAt: { $lte: now } }],
+        },
+        {
+          $set: {
+            status: 'running',
+            lockOwner: params.lockOwner,
+            lockExpiresAt,
+            startedAt: now,
+          },
+          $setOnInsert: {
+            provider: params.provider,
+            sourceId: LOCK_SOURCE_ID,
+            ...(params.tenantId ? { tenantId: params.tenantId } : {}),
+          },
+        },
+        { upsert: true, new: true, setDefaultsOnInsert: true },
+      ).lean();
+      return (row as ISkillSyncStatus | null)?.lockOwner === params.lockOwner;
+    } catch (error) {
+      if ((error as { code?: number }).code === 11000) {
+        return false;
+      }
+      throw error;
+    }
+  }
+
+  async function refreshSkillSyncLock(params: SkillSyncLockInput): Promise<boolean> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const row = await Status.findOneAndUpdate(
+      {
+        provider: params.provider,
+        sourceId: LOCK_SOURCE_ID,
+        ...tenantStatusCondition(params.tenantId),
+        lockOwner: params.lockOwner,
+        lockExpiresAt: { $gt: now },
+      },
+      {
+        $set: {
+          status: 'running',
+          lockExpiresAt: new Date(now.getTime() + params.leaseMs),
+        },
+      },
+      { new: true },
+    ).lean<ISkillSyncStatus | null>();
+    return Boolean(row);
+  }
+
+  async function releaseSkillSyncLock(params: SkillSyncReleaseLockInput): Promise<void> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    await Status.updateOne(
+      {
+        provider: params.provider,
+        sourceId: LOCK_SOURCE_ID,
+        ...tenantStatusCondition(params.tenantId),
+        lockOwner: params.lockOwner,
+      },
+      {
+        $set: {
+          status: 'idle',
+          finishedAt: new Date(),
+        },
+        $unset: {
+          lockOwner: '',
+          lockExpiresAt: '',
+        },
+      },
+    );
+  }
+
+  return {
+    upsertSkillSyncCredential,
+    deleteSkillSyncCredential,
+    listSkillSyncCredentials,
+    getSkillSyncCredentialToken,
+    getSkillSyncCredentialSummary,
+    listSkillSyncStatuses,
+    getSkillSyncStatus,
+    upsertSkillSyncStatus,
+    tryAcquireSkillSyncLock,
+    refreshSkillSyncLock,
+    releaseSkillSyncLock,
+  };
+}
diff --git a/packages/data-schemas/src/methods/spendTokens.ts b/packages/data-schemas/src/methods/spendTokens.ts
index 4cb6167b55a..07c6d3818aa 100644
--- a/packages/data-schemas/src/methods/spendTokens.ts
+++ b/packages/data-schemas/src/methods/spendTokens.ts
@@ -1,5 +1,5 @@
-import logger from '~/config/winston';
 import type { TxData, TransactionResult } from './transaction';
+import logger from '~/config/winston';
 
 /** Base transaction context passed by callers — does not include fields added internally */
 export interface SpendTxData {
@@ -19,14 +19,29 @@ export function createSpendTokensMethods(
     createTransaction: (txData: TxData) => Promise<TransactionResult | undefined>;
     createStructuredTransaction: (txData: TxData) => Promise<TransactionResult | undefined>;
   },
-) {
+): {
+  spendTokens: (
+    txData: SpendTxData,
+    tokenUsage: { promptTokens?: number; completionTokens?: number },
+  ) => Promise<void>;
+  spendStructuredTokens: (
+    txData: SpendTxData,
+    tokenUsage: {
+      promptTokens?: { input?: number; write?: number; read?: number };
+      completionTokens?: number;
+    },
+  ) => Promise<{
+    prompt: TransactionResult | undefined;
+    completion: TransactionResult | undefined;
+  }>;
+} {
   /**
    * Creates up to two transactions to record the spending of tokens.
    */
   async function spendTokens(
     txData: SpendTxData,
     tokenUsage: { promptTokens?: number; completionTokens?: number },
-  ) {
+  ): Promise<void> {
     const { promptTokens, completionTokens } = tokenUsage;
     logger.debug(
       `[spendTokens] conversationId: ${txData.conversationId}${
@@ -81,7 +96,10 @@ export function createSpendTokensMethods(
       promptTokens?: { input?: number; write?: number; read?: number };
       completionTokens?: number;
     },
-  ) {
+  ): Promise<{
+    prompt: TransactionResult | undefined;
+    completion: TransactionResult | undefined;
+  }> {
     const { promptTokens, completionTokens } = tokenUsage;
     logger.debug(
       `[spendStructuredTokens] conversationId: ${txData.conversationId}${
diff --git a/packages/data-schemas/src/methods/systemGrant.spec.ts b/packages/data-schemas/src/methods/systemGrant.spec.ts
index 1eef781fa95..b58a9431faa 100644
--- a/packages/data-schemas/src/methods/systemGrant.spec.ts
+++ b/packages/data-schemas/src/methods/systemGrant.spec.ts
@@ -1,8 +1,8 @@
 import mongoose, { Types } from 'mongoose';
-import { PrincipalType, SystemRoles } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
-import type * as t from '~/types';
+import { PrincipalType, SystemRoles } from 'librechat-data-provider';
 import type { SystemCapability } from '~/types/admin';
+import type * as t from '~/types';
 import { SystemCapabilities, CapabilityImplications } from '~/admin/capabilities';
 import { createSystemGrantMethods } from './systemGrant';
 import systemGrantSchema from '~/schema/systemGrant';
@@ -113,13 +113,14 @@ describe('systemGrant methods', () => {
   describe('grantCapability', () => {
     it('creates a grant and returns the document', async () => {
       const userId = new Types.ObjectId();
-      const doc = await methods.grantCapability({
+      const { grant: doc, created } = await methods.grantCapability({
         principalType: PrincipalType.USER,
         principalId: userId,
         capability: SystemCapabilities.READ_USERS,
       });
 
       expect(doc).toBeTruthy();
+      expect(created).toBe(true);
       expect(doc!.principalType).toBe(PrincipalType.USER);
       expect(doc!.capability).toBe(SystemCapabilities.READ_USERS);
       expect(doc!.grantedAt).toBeInstanceOf(Date);
@@ -255,7 +256,7 @@ describe('systemGrant methods', () => {
         capability: SystemCapabilities.READ_USERS as SystemCapability,
       };
 
-      const original = await methods.grantCapability(params);
+      const { grant: original } = await methods.grantCapability(params);
 
       // Simulate a race: findOneAndUpdate upserts but hits a duplicate key
       const model = mongoose.models.SystemGrant;
@@ -265,8 +266,10 @@ describe('systemGrant methods', () => {
           Object.assign(new Error('E11000 duplicate key error'), { code: 11000 }),
         );
 
-      const result = await methods.grantCapability(params);
+      const { grant: result, created } = await methods.grantCapability(params);
       expect(result).toBeTruthy();
+      // a lost upsert race is not a new creation, so it must not be audited
+      expect(created).toBe(false);
       expect(result!.capability).toBe(SystemCapabilities.READ_USERS);
       expect(result!.principalId.toString()).toBe(original!.principalId.toString());
     });
@@ -305,7 +308,7 @@ describe('systemGrant methods', () => {
     });
 
     it('accepts any string for ROLE principal without ObjectId validation', async () => {
-      const doc = await methods.grantCapability({
+      const { grant: doc } = await methods.grantCapability({
         principalType: PrincipalType.ROLE,
         principalId: 'ANY_STRING_HERE',
         capability: SystemCapabilities.READ_CONFIGS,
diff --git a/packages/data-schemas/src/methods/systemGrant.ts b/packages/data-schemas/src/methods/systemGrant.ts
index 2e8eea80cfe..6d82e9cd56f 100644
--- a/packages/data-schemas/src/methods/systemGrant.ts
+++ b/packages/data-schemas/src/methods/systemGrant.ts
@@ -46,7 +46,88 @@ function getParentCapabilities(capability: string): string[] {
   return parents;
 }
 
-export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
+export function createSystemGrantMethods(mongoose: typeof import('mongoose')): {
+  grantCapability: (
+    {
+      principalType,
+      principalId,
+      capability,
+      tenantId,
+      grantedBy,
+    }: {
+      principalType: PrincipalType;
+      principalId: string | Types.ObjectId;
+      capability: SystemCapability;
+      tenantId?: string;
+      grantedBy?: string | Types.ObjectId;
+    },
+    session?: ClientSession,
+  ) => Promise<{ grant: ISystemGrant | null; created: boolean }>;
+  seedSystemGrants: () => Promise<void>;
+  revokeCapability: (
+    {
+      principalType,
+      principalId,
+      capability,
+      tenantId,
+    }: {
+      principalType: PrincipalType;
+      principalId: string | Types.ObjectId;
+      capability: SystemCapability;
+      tenantId?: string;
+    },
+    session?: ClientSession,
+  ) => Promise<{ deletedCount: number }>;
+  hasCapabilityForPrincipals: ({
+    principals,
+    capability,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>;
+    capability: SystemCapability;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  getHeldCapabilities: ({
+    principals,
+    capabilities,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>;
+    capabilities: SystemCapability[];
+    tenantId?: string;
+  }) => Promise<Set<SystemCapability>>;
+  listGrants: (options?: {
+    tenantId?: string;
+    principalTypes?: PrincipalType[];
+    limit?: number;
+    offset?: number;
+  }) => Promise<ISystemGrant[]>;
+  countGrants: (options?: {
+    tenantId?: string;
+    principalTypes?: PrincipalType[];
+  }) => Promise<number>;
+  getCapabilitiesForPrincipal: ({
+    principalType,
+    principalId,
+    tenantId,
+  }: {
+    principalType: PrincipalType;
+    principalId: string | Types.ObjectId;
+    tenantId?: string;
+  }) => Promise<ISystemGrant[]>;
+  getCapabilitiesForPrincipals: ({
+    principals,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId: string | Types.ObjectId }>;
+    tenantId?: string;
+  }) => Promise<ISystemGrant[]>;
+  deleteGrantsForPrincipal: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    options?: { tenantId?: string; session?: ClientSession },
+  ) => Promise<ISystemGrant[]>;
+} {
   function tenantCondition(tenantId?: string): FilterQuery<ISystemGrant> {
     return tenantId != null
       ? { $and: [{ $or: [{ tenantId }, { tenantId: { $exists: false } }] }] }
@@ -184,7 +265,7 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
       grantedBy?: string | Types.ObjectId;
     },
     session?: ClientSession,
-  ): Promise<ISystemGrant | null> {
+  ): Promise<{ grant: ISystemGrant | null; created: boolean }> {
     const SystemGrant = mongoose.models.SystemGrant as Model<ISystemGrant>;
 
     const normalizedPrincipalId = normalizePrincipalId(principalId, principalType);
@@ -196,37 +277,50 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
       tenantId: tenantId != null ? tenantId : { $exists: false },
     };
 
+    /**
+     * Insert-only: re-asserting an existing grant is a true no-op (no field is
+     * mutated), so `created === false` reliably means "nothing changed" and the
+     * caller can safely skip audit emission. `grantedAt`/`grantedBy` therefore
+     * record the original grant, not the last re-assert.
+     */
     const update = {
-      $set: {
-        grantedAt: new Date(),
-        ...(grantedBy != null && { grantedBy }),
-      },
       $setOnInsert: {
         principalType,
         principalId: normalizedPrincipalId,
         capability,
+        grantedAt: new Date(),
+        ...(grantedBy != null && { grantedBy }),
         ...(tenantId != null && { tenantId }),
       },
     };
 
-    const options = {
-      upsert: true,
-      new: true,
-      ...(session ? { session } : {}),
-    };
-
     try {
-      return await SystemGrant.findOneAndUpdate(filter, update, options);
+      /** `includeResultMetadata` surfaces `lastErrorObject.upserted` so callers
+       * (audit emission) can tell a brand-new grant from an idempotent re-assert
+       * atomically, without a racy pre-read. Passed inline so the metadata
+       * overload is selected. */
+      const result = await SystemGrant.findOneAndUpdate(filter, update, {
+        upsert: true,
+        new: true,
+        includeResultMetadata: true,
+        session,
+      });
+      return { grant: result.value, created: result.lastErrorObject?.upserted != null };
     } catch (err) {
       if ((err as { code?: number }).code === 11000) {
-        return (await SystemGrant.findOne(filter).lean()) as ISystemGrant | null;
+        /** A concurrent insert won the race: the row exists and we did not create
+         * it, so this is not an auditable change. */
+        const grant = (await SystemGrant.findOne(filter).lean()) as ISystemGrant | null;
+        return { grant, created: false };
       }
       throw err;
     }
   }
 
   /**
-   * Revoke a capability from a principal.
+   * Revoke a capability from a principal. Returns the deletion result so
+   * callers (e.g. audit emission) can distinguish a real revoke from a
+   * no-op against a grant that didn't exist.
    */
   async function revokeCapability(
     {
@@ -241,7 +335,7 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
       tenantId?: string;
     },
     session?: ClientSession,
-  ): Promise<void> {
+  ): Promise<{ deletedCount: number }> {
     const SystemGrant = mongoose.models.SystemGrant as Model<ISystemGrant>;
 
     const normalizedPrincipalId = normalizePrincipalId(principalId, principalType);
@@ -254,7 +348,8 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
     };
 
     const options = session ? { session } : {};
-    await SystemGrant.deleteOne(filter, options);
+    const result = await SystemGrant.deleteOne(filter, options);
+    return { deletedCount: result.deletedCount ?? 0 };
   }
 
   /**
@@ -417,7 +512,7 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
     options?: { tenantId?: string; session?: ClientSession },
-  ): Promise<void> {
+  ): Promise<ISystemGrant[]> {
     const SystemGrant = mongoose.models.SystemGrant as Model<ISystemGrant>;
     const normalizedPrincipalId = normalizePrincipalId(principalId, principalType);
 
@@ -427,7 +522,11 @@ export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
       ...(options?.tenantId != null && { tenantId: options.tenantId }),
     };
     const queryOptions = options?.session ? { session: options.session } : {};
+    /** Read the matching grants before deleting so cascade callers (e.g. role
+     * deletion) can emit a `grant.removed` audit entry for each one. */
+    const removed = await SystemGrant.find(filter, null, queryOptions).lean<ISystemGrant[]>();
     await SystemGrant.deleteMany(filter, queryOptions);
+    return removed;
   }
 
   return {
diff --git a/packages/data-schemas/src/methods/token.spec.ts b/packages/data-schemas/src/methods/token.spec.ts
index 87c3916bf8a..7e7c44c1855 100644
--- a/packages/data-schemas/src/methods/token.spec.ts
+++ b/packages/data-schemas/src/methods/token.spec.ts
@@ -149,6 +149,35 @@ describe('Token Methods - Detailed Tests', () => {
       expect(found?.userId.toString()).toBe(user2Id.toString());
     });
 
+    test('should find tokens with explicitly absent optional fields', async () => {
+      const legacyUserId = new mongoose.Types.ObjectId();
+      await Token.create([
+        {
+          token: 'legacy-reset-token',
+          userId: legacyUserId,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'legacy-identified-token',
+          userId: legacyUserId,
+          identifier: 'oauth-legacy',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const found = await methods.findToken({
+        userId: legacyUserId.toString(),
+        email: null,
+        identifier: null,
+        type: null,
+      });
+
+      expect(found).toBeDefined();
+      expect(found?.token).toBe('legacy-reset-token');
+    });
+
     test('should find token by identifier', async () => {
       const found = await methods.findToken({ identifier: 'oauth-123' });
 
@@ -551,6 +580,38 @@ describe('Token Methods - Detailed Tests', () => {
       expect(remainingTokens.find((t) => t.identifier === 'oauth-identifier-456')).toBeUndefined();
     });
 
+    test('should delete tokens matching an identifier pattern', async () => {
+      await Token.create([
+        {
+          token: 'action-access-token',
+          userId: oauthUserId,
+          type: 'oauth',
+          identifier: `${oauthUserId.toString()}:action-1`,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'other-action-token',
+          userId: oauthUserId,
+          type: 'oauth',
+          identifier: `${oauthUserId.toString()}:action-2`,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const result = await methods.deleteTokens({
+        type: 'oauth',
+        identifier: /^[^:]+:action-1$/,
+      });
+
+      expect(result.deletedCount).toBe(1);
+
+      const remaining = await Token.find({ userId: oauthUserId, type: 'oauth' });
+      expect(remaining).toHaveLength(1);
+      expect(remaining[0].identifier).toBe(`${oauthUserId.toString()}:action-2`);
+    });
+
     test('should not delete tokens when undefined fields are passed', async () => {
       // This is the critical test case for the bug fix
       const result = await methods.deleteTokens({
@@ -566,6 +627,47 @@ describe('Token Methods - Detailed Tests', () => {
       expect(remainingTokens).toHaveLength(3);
     });
 
+    test('should delete only tokens with explicitly absent optional fields', async () => {
+      const legacyUserId = new mongoose.Types.ObjectId();
+      await Token.create([
+        {
+          token: 'legacy-reset-token',
+          userId: legacyUserId,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'legacy-identified-token',
+          userId: legacyUserId,
+          identifier: 'oauth-legacy',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'typed-reset-token',
+          userId: legacyUserId,
+          type: 'password_reset',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const result = await methods.deleteTokens({
+        userId: legacyUserId.toString(),
+        email: null,
+        identifier: null,
+        type: null,
+      });
+
+      expect(result.deletedCount).toBe(1);
+
+      const remainingTokens = await Token.find({ userId: legacyUserId });
+      expect(remainingTokens).toHaveLength(2);
+      expect(remainingTokens.find((t) => t.token === 'legacy-reset-token')).toBeUndefined();
+      expect(remainingTokens.find((t) => t.token === 'legacy-identified-token')).toBeDefined();
+      expect(remainingTokens.find((t) => t.token === 'typed-reset-token')).toBeDefined();
+    });
+
     test('should only delete tokens matching ALL provided fields (AND semantics)', async () => {
       await Token.create({
         token: 'extra-user2-token',
diff --git a/packages/data-schemas/src/methods/token.ts b/packages/data-schemas/src/methods/token.ts
index a5de3d2a5df..412001cfa36 100644
--- a/packages/data-schemas/src/methods/token.ts
+++ b/packages/data-schemas/src/methods/token.ts
@@ -3,7 +3,12 @@ import { IToken, TokenCreateData, TokenQuery, TokenUpdateData, TokenDeleteResult
 import logger from '~/config/winston';
 
 // Factory function that takes mongoose instance and returns the methods
-export function createTokenMethods(mongoose: typeof import('mongoose')) {
+export function createTokenMethods(mongoose: typeof import('mongoose')): {
+  findToken: (query: TokenQuery, options?: QueryOptions) => Promise<IToken | null>;
+  createToken: (tokenData: TokenCreateData) => Promise<IToken>;
+  updateToken: (query: TokenQuery, updateData: TokenUpdateData) => Promise<IToken | null>;
+  deleteTokens: (query: TokenQuery) => Promise<TokenDeleteResult>;
+} {
   /**
    * Creates a new Token instance.
    */
@@ -61,7 +66,8 @@ export function createTokenMethods(mongoose: typeof import('mongoose')) {
         conditions.push({ token: query.token });
       }
       if (query.email !== undefined) {
-        conditions.push({ email: query.email.trim().toLowerCase() });
+        const email = query.email === null ? null : query.email.trim().toLowerCase();
+        conditions.push({ email });
       }
       if (query.type !== undefined) {
         conditions.push({ type: query.type });
@@ -98,13 +104,14 @@ export function createTokenMethods(mongoose: typeof import('mongoose')) {
       if (query.token) {
         conditions.push({ token: query.token });
       }
-      if (query.email) {
-        conditions.push({ email: query.email.trim().toLowerCase() });
+      if (query.email !== undefined) {
+        const email = query.email === null ? null : query.email.trim().toLowerCase();
+        conditions.push({ email });
       }
-      if (query.type) {
+      if (query.type !== undefined) {
         conditions.push({ type: query.type });
       }
-      if (query.identifier) {
+      if (query.identifier !== undefined) {
         conditions.push({ identifier: query.identifier });
       }
 
diff --git a/packages/data-schemas/src/methods/toolCall.ts b/packages/data-schemas/src/methods/toolCall.ts
index 49dfb627e0f..5faba98a3bf 100644
--- a/packages/data-schemas/src/methods/toolCall.ts
+++ b/packages/data-schemas/src/methods/toolCall.ts
@@ -7,11 +7,76 @@ interface IToolCallData {
   [key: string]: unknown;
 }
 
-export function createToolCallMethods(mongoose: typeof import('mongoose')) {
+export function createToolCallMethods(mongoose: typeof import('mongoose')): {
+  createToolCall: (toolCallData: IToolCallData) => Promise<IToolCallData>;
+  updateToolCall: (
+    id: string,
+    updateData: Partial<IToolCallData>,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteToolCalls: (
+    userId: string,
+    conversationId?: string,
+  ) => Promise<import('mongodb').DeleteResult>;
+  getToolCallById: (id: string) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  getToolCallsByConvo: (
+    conversationId: string,
+    userId: string,
+  ) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+  getToolCallsByMessage: (
+    messageId: string,
+    userId: string,
+  ) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+} {
   /**
    * Create a new tool call
    */
-  async function createToolCall(toolCallData: IToolCallData) {
+  async function createToolCall(toolCallData: IToolCallData): Promise<IToolCallData> {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.create(toolCallData);
@@ -23,7 +88,19 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get a tool call by ID
    */
-  async function getToolCallById(id: string) {
+  async function getToolCallById(id: string): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.findById(id).lean();
@@ -35,7 +112,21 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get tool calls by message ID and user
    */
-  async function getToolCallsByMessage(messageId: string, userId: string) {
+  async function getToolCallsByMessage(
+    messageId: string,
+    userId: string,
+  ): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.find({ messageId, user: userId }).lean();
@@ -47,7 +138,21 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get tool calls by conversation ID and user
    */
-  async function getToolCallsByConvo(conversationId: string, userId: string) {
+  async function getToolCallsByConvo(
+    conversationId: string,
+    userId: string,
+  ): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.find({ conversationId, user: userId }).lean();
@@ -59,7 +164,22 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Update a tool call
    */
-  async function updateToolCall(id: string, updateData: Partial<IToolCallData>) {
+  async function updateToolCall(
+    id: string,
+    updateData: Partial<IToolCallData>,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.findByIdAndUpdate(id, updateData, { new: true }).lean();
@@ -71,7 +191,10 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Delete tool calls by user and optionally conversation
    */
-  async function deleteToolCalls(userId: string, conversationId?: string) {
+  async function deleteToolCalls(
+    userId: string,
+    conversationId?: string,
+  ): Promise<import('mongodb').DeleteResult> {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       const query: Record<string, string> = { user: userId };
diff --git a/packages/data-schemas/src/methods/transaction.spec.ts b/packages/data-schemas/src/methods/transaction.spec.ts
index 176e7faef8e..badfdaf0146 100644
--- a/packages/data-schemas/src/methods/transaction.spec.ts
+++ b/packages/data-schemas/src/methods/transaction.spec.ts
@@ -1,9 +1,9 @@
 import mongoose from 'mongoose';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { IBalance } from '..';
 import type { ITransaction } from '~/schema/transaction';
 import type { TxData } from './transaction';
-import type { IBalance } from '..';
-import { createTxMethods, tokenValues, premiumTokenValues } from './tx';
+import { createTxMethods, tokenValues, premiumTokenValues, defaultRate } from './tx';
 import { matchModelName, findMatchingPattern } from './test-helpers';
 import { createSpendTokensMethods } from './spendTokens';
 import { createTransactionMethods } from './transaction';
@@ -616,6 +616,36 @@ describe('Transactions Config Tests', () => {
   });
 });
 
+describe('Partial endpointTokenConfig fallback', () => {
+  const endpointTokenConfig = {
+    'custom-model': { prompt: 1.5, completion: 4.5, read: 0.3 },
+  };
+
+  test('uses override rates for a listed model', () => {
+    expect(getMultiplier({ model: 'custom-model', tokenType: 'prompt', endpointTokenConfig })).toBe(
+      1.5,
+    );
+    expect(
+      getCacheMultiplier({ model: 'custom-model', cacheType: 'read', endpointTokenConfig }),
+    ).toBe(0.3);
+  });
+
+  test('falls back to standard tables for a model absent from the override', () => {
+    const fallbackPrompt = getMultiplier({ model: 'gpt-4', tokenType: 'prompt' });
+    expect(getMultiplier({ model: 'gpt-4', tokenType: 'prompt', endpointTokenConfig })).toBe(
+      fallbackPrompt,
+    );
+    expect(getMultiplier({ model: 'gpt-4', tokenType: 'prompt', endpointTokenConfig })).not.toBe(
+      defaultRate,
+    );
+
+    const fallbackCacheRead = getCacheMultiplier({ model: 'claude-3-5-sonnet', cacheType: 'read' });
+    expect(
+      getCacheMultiplier({ model: 'claude-3-5-sonnet', cacheType: 'read', endpointTokenConfig }),
+    ).toBe(fallbackCacheRead);
+  });
+});
+
 describe('calculateTokenValue Edge Cases', () => {
   test('should derive multiplier from model when valueKey is not provided', async () => {
     const userId = new mongoose.Types.ObjectId();
diff --git a/packages/data-schemas/src/methods/transaction.ts b/packages/data-schemas/src/methods/transaction.ts
index b71e111a799..bfd5376f713 100644
--- a/packages/data-schemas/src/methods/transaction.ts
+++ b/packages/data-schemas/src/methods/transaction.ts
@@ -1,7 +1,7 @@
-import logger from '~/config/winston';
 import type { FilterQuery, Model, Types } from 'mongoose';
 import type { IBalance, IBalanceUpdate, TransactionData } from '~/types';
 import type { ITransaction } from '~/schema/transaction';
+import logger from '~/config/winston';
 
 const cancelRate = 1.15;
 
@@ -70,7 +70,36 @@ export function createTransactionMethods(
     getMultiplier: (params: MultiplierParams) => number;
     getCacheMultiplier: (params: CacheMultiplierParams) => number | null;
   },
-) {
+): {
+  updateBalance: ({
+    user,
+    incrementValue,
+    setValues,
+  }: {
+    user: string;
+    incrementValue: number;
+    setValues?: IBalanceUpdate;
+  }) => Promise<IBalance>;
+  bulkInsertTransactions: (docs: TransactionData[]) => Promise<void>;
+  findBalanceByUser: (user: string) => Promise<IBalance | null>;
+  upsertBalanceFields: (user: string, fields: IBalanceUpdate) => Promise<IBalance | null>;
+  getTransactions: (filter: FilterQuery<ITransaction>) => Promise<ITransaction[]>;
+  deleteTransactions: (
+    filter: FilterQuery<ITransaction>,
+  ) => Promise<import('mongodb').DeleteResult>;
+  deleteBalances: (filter: FilterQuery<IBalance>) => Promise<import('mongodb').DeleteResult>;
+  createTransaction: (_txData: TxData) => Promise<TransactionResult | undefined>;
+  createAutoRefillTransaction: (txData: TxData) => Promise<
+    | {
+        rate: number;
+        user: string;
+        balance: number;
+        transaction: ITransaction;
+      }
+    | undefined
+  >;
+  createStructuredTransaction: (_txData: TxData) => Promise<TransactionResult | undefined>;
+} {
   /** Calculate and set the tokenValue for a transaction */
   function calculateTokenValue(txn: InternalTxDoc) {
     const { valueKey, tokenType, model, endpointTokenConfig, inputTokenCount } = txn;
@@ -265,7 +294,15 @@ export function createTransactionMethods(
   /**
    * Creates an auto-refill transaction that also updates balance.
    */
-  async function createAutoRefillTransaction(txData: TxData) {
+  async function createAutoRefillTransaction(txData: TxData): Promise<
+    | {
+        rate: number;
+        user: string;
+        balance: number;
+        transaction: ITransaction;
+      }
+    | undefined
+  > {
     if (txData.rawAmount != null && isNaN(txData.rawAmount)) {
       return;
     }
@@ -371,10 +408,10 @@ export function createTransactionMethods(
   /**
    * Queries and retrieves transactions based on a given filter.
    */
-  async function getTransactions(filter: FilterQuery<ITransaction>) {
+  async function getTransactions(filter: FilterQuery<ITransaction>): Promise<ITransaction[]> {
     try {
       const Transaction = mongoose.models.Transaction;
-      return await Transaction.find(filter).lean();
+      return await Transaction.find(filter).lean<ITransaction[]>();
     } catch (error) {
       logger.error('Error querying transactions:', error);
       throw error;
@@ -401,13 +438,17 @@ export function createTransactionMethods(
   }
 
   /** Deletes transactions matching a filter. */
-  async function deleteTransactions(filter: FilterQuery<ITransaction>) {
+  async function deleteTransactions(
+    filter: FilterQuery<ITransaction>,
+  ): Promise<import('mongodb').DeleteResult> {
     const Transaction = mongoose.models.Transaction;
     return Transaction.deleteMany(filter);
   }
 
   /** Deletes balance records matching a filter. */
-  async function deleteBalances(filter: FilterQuery<IBalance>) {
+  async function deleteBalances(
+    filter: FilterQuery<IBalance>,
+  ): Promise<import('mongodb').DeleteResult> {
     const Balance = mongoose.models.Balance as Model<IBalance>;
     return Balance.deleteMany(filter);
   }
diff --git a/packages/data-schemas/src/methods/tx.spec.ts b/packages/data-schemas/src/methods/tx.spec.ts
index 51968b81e76..4c22218a2d4 100644
--- a/packages/data-schemas/src/methods/tx.spec.ts
+++ b/packages/data-schemas/src/methods/tx.spec.ts
@@ -1,5 +1,4 @@
 /** Note: No hard-coded values should be used in this file. */
-import { matchModelName, findMatchingPattern } from './test-helpers';
 import { EModelEndpoint } from 'librechat-data-provider';
 import {
   createTxMethods,
@@ -8,6 +7,7 @@ import {
   premiumTokenValues,
   defaultRate,
 } from './tx';
+import { matchModelName, findMatchingPattern } from './test-helpers';
 
 const { getValueKey, getMultiplier, getPremiumRate, getCacheMultiplier } = createTxMethods(
   {} as typeof import('mongoose'),
@@ -56,11 +56,19 @@ describe('getValueKey', () => {
 
   it('should return "gpt-5.3" for model name containing "gpt-5.3"', () => {
     expect(getValueKey('gpt-5.3')).toBe('gpt-5.3');
-    expect(getValueKey('gpt-5.3-chat-latest')).toBe('gpt-5.3');
     expect(getValueKey('gpt-5.3-codex')).toBe('gpt-5.3');
     expect(getValueKey('openai/gpt-5.3')).toBe('gpt-5.3');
   });
 
+  it('should return explicit keys for chat-latest aliases', () => {
+    expect(getValueKey('chat-latest')).toBe('chat-latest');
+    expect(getValueKey('openai/chat-latest')).toBe('chat-latest');
+    expect(getValueKey('gpt-5-chat-latest')).toBe('gpt-5-chat-latest');
+    expect(getValueKey('gpt-5.1-chat-latest')).toBe('gpt-5.1-chat-latest');
+    expect(getValueKey('gpt-5.2-chat-latest')).toBe('gpt-5.2-chat-latest');
+    expect(getValueKey('gpt-5.3-chat-latest')).toBe('gpt-5.3-chat-latest');
+  });
+
   it('should return "gpt-5.4" for model name containing "gpt-5.4"', () => {
     expect(getValueKey('gpt-5.4')).toBe('gpt-5.4');
     expect(getValueKey('gpt-5.4-thinking')).toBe('gpt-5.4');
@@ -1497,6 +1505,7 @@ describe('Google Model Tests', () => {
     'gemini-3.1-pro-preview',
     'gemini-3.1-pro-preview-customtools',
     'gemini-3.1-flash-lite-preview',
+    'gemini-3.5-flash',
     'gemini-2.5-pro',
     'gemini-2.5-flash',
     'gemini-2.5-flash-lite',
@@ -1544,6 +1553,7 @@ describe('Google Model Tests', () => {
       'gemini-3.1-pro-preview': 'gemini-3.1',
       'gemini-3.1-pro-preview-customtools': 'gemini-3.1',
       'gemini-3.1-flash-lite-preview': 'gemini-3.1-flash-lite',
+      'gemini-3.5-flash': 'gemini-3.5-flash',
       'gemini-2.5-pro': 'gemini-2.5-pro',
       'gemini-2.5-flash': 'gemini-2.5-flash',
       'gemini-2.5-flash-lite': 'gemini-2.5-flash-lite',
@@ -1645,6 +1655,22 @@ describe('Google Model Tests', () => {
       cacheTokenValues['gemini-3.1-flash-lite'].read,
     );
   });
+
+  it('should return correct rates for Gemini 3.5 Flash', () => {
+    const model = 'gemini-3.5-flash';
+    expect(getMultiplier({ model, tokenType: 'prompt', endpoint: EModelEndpoint.google })).toBe(
+      tokenValues['gemini-3.5-flash'].prompt,
+    );
+    expect(getMultiplier({ model, tokenType: 'completion', endpoint: EModelEndpoint.google })).toBe(
+      tokenValues['gemini-3.5-flash'].completion,
+    );
+    expect(getCacheMultiplier({ model, cacheType: 'write' })).toBe(
+      cacheTokenValues['gemini-3.5-flash'].write,
+    );
+    expect(getCacheMultiplier({ model, cacheType: 'read' })).toBe(
+      cacheTokenValues['gemini-3.5-flash'].read,
+    );
+  });
 });
 
 describe('Gemini 3.1 Premium Token Pricing', () => {
@@ -2319,6 +2345,134 @@ describe('Claude Model Tests', () => {
       cacheTokenValues['claude-opus-4-7'].read,
     );
   });
+
+  it('should return correct prompt and completion rates for Claude Opus 4.8', () => {
+    expect(getMultiplier({ model: 'claude-opus-4-8', tokenType: 'prompt' })).toBe(
+      tokenValues['claude-opus-4-8'].prompt,
+    );
+    expect(getMultiplier({ model: 'claude-opus-4-8', tokenType: 'completion' })).toBe(
+      tokenValues['claude-opus-4-8'].completion,
+    );
+  });
+
+  it('should handle Claude Opus 4.8 model name variations', () => {
+    const modelVariations = [
+      'claude-opus-4-8',
+      'claude-opus-4-8-20260528',
+      'claude-opus-4-8-latest',
+      'anthropic/claude-opus-4-8',
+      'claude-opus-4-8/anthropic',
+      'claude-opus-4-8-preview',
+    ];
+
+    modelVariations.forEach((model) => {
+      const valueKey = getValueKey(model);
+      expect(valueKey).toBe('claude-opus-4-8');
+      expect(getMultiplier({ model, tokenType: 'prompt' })).toBe(
+        tokenValues['claude-opus-4-8'].prompt,
+      );
+      expect(getMultiplier({ model, tokenType: 'completion' })).toBe(
+        tokenValues['claude-opus-4-8'].completion,
+      );
+    });
+  });
+
+  it('should return correct cache rates for Claude Opus 4.8', () => {
+    expect(getCacheMultiplier({ model: 'claude-opus-4-8', cacheType: 'write' })).toBe(
+      cacheTokenValues['claude-opus-4-8'].write,
+    );
+    expect(getCacheMultiplier({ model: 'claude-opus-4-8', cacheType: 'read' })).toBe(
+      cacheTokenValues['claude-opus-4-8'].read,
+    );
+  });
+
+  it('should return correct prompt and completion rates for Claude Fable 5', () => {
+    expect(getMultiplier({ model: 'claude-fable-5', tokenType: 'prompt' })).toBe(
+      tokenValues['claude-fable-5'].prompt,
+    );
+    expect(getMultiplier({ model: 'claude-fable-5', tokenType: 'completion' })).toBe(
+      tokenValues['claude-fable-5'].completion,
+    );
+  });
+
+  it('should pin Claude Fable 5 pricing to $10 / $50 per MTok', () => {
+    expect(tokenValues['claude-fable-5']).toEqual({ prompt: 10, completion: 50 });
+  });
+
+  it('should handle Claude Fable 5 model name variations', () => {
+    const modelVariations = [
+      'claude-fable-5',
+      'claude-fable-5-20260609',
+      'claude-fable-5-latest',
+      'anthropic/claude-fable-5',
+      'claude-fable-5/anthropic',
+      'anthropic.claude-fable-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      const valueKey = getValueKey(model);
+      expect(valueKey).toBe('claude-fable-5');
+      expect(getMultiplier({ model, tokenType: 'prompt' })).toBe(
+        tokenValues['claude-fable-5'].prompt,
+      );
+      expect(getMultiplier({ model, tokenType: 'completion' })).toBe(
+        tokenValues['claude-fable-5'].completion,
+      );
+    });
+  });
+
+  it('should return correct cache rates for Claude Fable 5', () => {
+    expect(getCacheMultiplier({ model: 'claude-fable-5', cacheType: 'write' })).toBe(
+      cacheTokenValues['claude-fable-5'].write,
+    );
+    expect(getCacheMultiplier({ model: 'claude-fable-5', cacheType: 'read' })).toBe(
+      cacheTokenValues['claude-fable-5'].read,
+    );
+  });
+
+  it('should return correct prompt and completion rates for Claude Mythos 5', () => {
+    expect(getMultiplier({ model: 'claude-mythos-5', tokenType: 'prompt' })).toBe(
+      tokenValues['claude-mythos-5'].prompt,
+    );
+    expect(getMultiplier({ model: 'claude-mythos-5', tokenType: 'completion' })).toBe(
+      tokenValues['claude-mythos-5'].completion,
+    );
+  });
+
+  it('should pin Claude Mythos 5 pricing to $10 / $50 per MTok', () => {
+    expect(tokenValues['claude-mythos-5']).toEqual({ prompt: 10, completion: 50 });
+  });
+
+  it('should handle Claude Mythos 5 model name variations', () => {
+    const modelVariations = [
+      'claude-mythos-5',
+      'claude-mythos-5-20260609',
+      'claude-mythos-5-latest',
+      'anthropic/claude-mythos-5',
+      'claude-mythos-5/anthropic',
+      'anthropic.claude-mythos-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      const valueKey = getValueKey(model);
+      expect(valueKey).toBe('claude-mythos-5');
+      expect(getMultiplier({ model, tokenType: 'prompt' })).toBe(
+        tokenValues['claude-mythos-5'].prompt,
+      );
+      expect(getMultiplier({ model, tokenType: 'completion' })).toBe(
+        tokenValues['claude-mythos-5'].completion,
+      );
+    });
+  });
+
+  it('should return correct cache rates for Claude Mythos 5', () => {
+    expect(getCacheMultiplier({ model: 'claude-mythos-5', cacheType: 'write' })).toBe(
+      cacheTokenValues['claude-mythos-5'].write,
+    );
+    expect(getCacheMultiplier({ model: 'claude-mythos-5', cacheType: 'read' })).toBe(
+      cacheTokenValues['claude-mythos-5'].read,
+    );
+  });
 });
 
 describe('Premium Token Pricing', () => {
@@ -2339,7 +2493,14 @@ describe('Premium Token Pricing', () => {
   });
 
   it('should not apply premium pricing to Claude 1M GA models', () => {
-    const claudeModels = ['claude-opus-4-6', 'claude-opus-4-7', 'claude-sonnet-4-6'];
+    const claudeModels = [
+      'claude-opus-4-6',
+      'claude-opus-4-7',
+      'claude-opus-4-8',
+      'claude-fable-5',
+      'claude-mythos-5',
+      'claude-sonnet-4-6',
+    ];
     claudeModels.forEach((model) => {
       expect(premiumTokenValues[model]).toBeUndefined();
       expect(getPremiumRate(model, 'prompt', wellAboveThreshold)).toBeNull();
diff --git a/packages/data-schemas/src/methods/tx.ts b/packages/data-schemas/src/methods/tx.ts
index 3a5cd8e11c8..37e519baf4e 100644
--- a/packages/data-schemas/src/methods/tx.ts
+++ b/packages/data-schemas/src/methods/tx.ts
@@ -129,8 +129,16 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'gpt-5.2': { prompt: 1.75, completion: 14 },
     'gpt-5.3': { prompt: 1.75, completion: 14 },
     'gpt-5.4': { prompt: 2.5, completion: 15 },
-    // TODO: gpt-5.4-pro pricing not yet officially published — verify before release
-    'gpt-5.4-pro': { prompt: 5, completion: 30 },
+    'gpt-5.4-pro': { prompt: 30, completion: 180 },
+    'gpt-5.4-mini': { prompt: 0.75, completion: 4.5 },
+    'gpt-5.4-nano': { prompt: 0.2, completion: 1.25 },
+    'gpt-5.5': { prompt: 5, completion: 30 },
+    'gpt-5.5-pro': { prompt: 30, completion: 180 },
+    'chat-latest': { prompt: 5, completion: 30 },
+    'gpt-5-chat-latest': { prompt: 1.25, completion: 10 },
+    'gpt-5.1-chat-latest': { prompt: 1.25, completion: 10 },
+    'gpt-5.2-chat-latest': { prompt: 1.75, completion: 14 },
+    'gpt-5.3-chat-latest': { prompt: 1.75, completion: 14 },
     'gpt-5-nano': { prompt: 0.05, completion: 0.4 },
     'gpt-5-mini': { prompt: 0.25, completion: 2 },
     'gpt-5-pro': { prompt: 15, completion: 120 },
@@ -158,6 +166,9 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'claude-opus-4-5': { prompt: 5, completion: 25 },
     'claude-opus-4-6': { prompt: 5, completion: 25 },
     'claude-opus-4-7': { prompt: 5, completion: 25 },
+    'claude-opus-4-8': { prompt: 5, completion: 25 },
+    'claude-fable-5': { prompt: 10, completion: 50 },
+    'claude-mythos-5': { prompt: 10, completion: 50 },
     'claude-sonnet-4': { prompt: 3, completion: 15 },
     'claude-sonnet-4-5': { prompt: 3, completion: 15 },
     'claude-sonnet-4-6': { prompt: 3, completion: 15 },
@@ -186,6 +197,7 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'gemini-3-pro-image': { prompt: 2, completion: 120 },
     'gemini-3.1': { prompt: 2, completion: 12 },
     'gemini-3.1-flash-lite': { prompt: 0.25, completion: 1.5 },
+    'gemini-3.5-flash': { prompt: 1.5, completion: 9 },
     'gemini-pro-vision': { prompt: 0.5, completion: 1.5 },
     grok: { prompt: 2.0, completion: 10.0 },
     'grok-beta': { prompt: 5.0, completion: 15.0 },
@@ -205,6 +217,10 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'grok-4-1-fast': { prompt: 0.2, completion: 0.5 },
     'grok-code-fast': { prompt: 0.2, completion: 1.5 },
     codestral: { prompt: 0.3, completion: 0.9 },
+    devstral: { prompt: 0.4, completion: 2.0 },
+    'mistral-medium': { prompt: 1.5, completion: 7.5 },
+    voxtral: { prompt: 0.1, completion: 0.4 },
+    holo2: { prompt: 0.3, completion: 0.7 },
     'ministral-3b': { prompt: 0.04, completion: 0.04 },
     'ministral-8b': { prompt: 0.1, completion: 0.1 },
     'mistral-nemo': { prompt: 0.15, completion: 0.15 },
@@ -293,6 +309,9 @@ export const cacheTokenValues: Record<string, { write: number; read: number }> =
   'claude-opus-4-5': { write: 6.25, read: 0.5 },
   'claude-opus-4-6': { write: 6.25, read: 0.5 },
   'claude-opus-4-7': { write: 6.25, read: 0.5 },
+  'claude-opus-4-8': { write: 6.25, read: 0.5 },
+  'claude-fable-5': { write: 12.5, read: 1 },
+  'claude-mythos-5': { write: 12.5, read: 1 },
   'gpt-4o': { write: 2.5, read: 1.25 },
   'gpt-4o-mini': { write: 0.15, read: 0.075 },
   'gpt-4.1': { write: 2, read: 0.5 },
@@ -303,6 +322,14 @@ export const cacheTokenValues: Record<string, { write: number; read: number }> =
   'gpt-5.2': { write: 1.75, read: 0.175 },
   'gpt-5.3': { write: 1.75, read: 0.175 },
   'gpt-5.4': { write: 2.5, read: 0.25 },
+  'gpt-5.4-mini': { write: 0.75, read: 0.075 },
+  'gpt-5.4-nano': { write: 0.2, read: 0.02 },
+  'gpt-5.5': { write: 5, read: 0.5 },
+  'chat-latest': { write: 5, read: 0.5 },
+  'gpt-5-chat-latest': { write: 1.25, read: 0.125 },
+  'gpt-5.1-chat-latest': { write: 1.25, read: 0.125 },
+  'gpt-5.2-chat-latest': { write: 1.75, read: 0.175 },
+  'gpt-5.3-chat-latest': { write: 1.75, read: 0.175 },
   'gpt-5-mini': { write: 0.25, read: 0.025 },
   'gpt-5-nano': { write: 0.05, read: 0.005 },
   o1: { write: 15, read: 7.5 },
@@ -329,6 +356,8 @@ export const cacheTokenValues: Record<string, { write: number; read: number }> =
   'gemini-3.1': { write: 2, read: 0.2 },
   // Gemini 3.1 Flash-Lite - cache write: $0.25/1M, cache read: $0.025/1M
   'gemini-3.1-flash-lite': { write: 0.25, read: 0.025 },
+  // Gemini 3.5 Flash - cache write: $1.50/1M, cache read: $0.15/1M
+  'gemini-3.5-flash': { write: 1.5, read: 0.15 },
 };
 
 /**
@@ -339,9 +368,74 @@ export const premiumTokenValues: Record<
   { threshold: number; prompt: number; completion: number }
 > = {
   'gemini-3.1': { threshold: 200000, prompt: 4, completion: 18 },
+  'gpt-5.4': { threshold: 272000, prompt: 5, completion: 22.5 },
+  'gpt-5.4-pro': { threshold: 272000, prompt: 60, completion: 270 },
+  'gpt-5.5': { threshold: 272000, prompt: 10, completion: 45 },
+  'gpt-5.5-pro': { threshold: 272000, prompt: 60, completion: 270 },
 };
 
-export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: TxDeps) {
+export function createTxMethods(
+  _mongoose: typeof import('mongoose'),
+  txDeps: TxDeps,
+): {
+  tokenValues: Record<
+    string,
+    {
+      prompt: number;
+      completion: number;
+    }
+  >;
+  premiumTokenValues: Record<
+    string,
+    {
+      threshold: number;
+      prompt: number;
+      completion: number;
+    }
+  >;
+  getValueKey: (model: string, endpoint?: string) => string | undefined;
+  getMultiplier: ({
+    model,
+    valueKey,
+    endpoint,
+    tokenType,
+    inputTokenCount,
+    endpointTokenConfig,
+  }: {
+    model?: string;
+    valueKey?: string;
+    endpoint?: string;
+    tokenType?: 'prompt' | 'completion';
+    inputTokenCount?: number;
+    endpointTokenConfig?: Record<string, Record<string, number>>;
+  }) => number;
+  getPremiumRate: (
+    valueKey: string,
+    tokenType: string,
+    inputTokenCount?: number | null,
+  ) => number | null;
+  getCacheMultiplier: ({
+    valueKey,
+    cacheType,
+    model,
+    endpoint,
+    endpointTokenConfig,
+  }: {
+    valueKey?: string;
+    cacheType?: 'write' | 'read';
+    model?: string;
+    endpoint?: string;
+    endpointTokenConfig?: Record<string, Record<string, number>>;
+  }) => number | null;
+  defaultRate: number;
+  cacheTokenValues: Record<
+    string,
+    {
+      write: number;
+      read: number;
+    }
+  >;
+} {
   const { matchModelName, findMatchingPattern } = txDeps;
 
   /**
@@ -420,7 +514,13 @@ export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: Tx
     endpointTokenConfig?: Record<string, Record<string, number>>;
   }): number {
     if (endpointTokenConfig && model) {
-      return endpointTokenConfig?.[model]?.[tokenType as string] ?? defaultRate;
+      const modelConfig = endpointTokenConfig[model];
+      /** A partial override only prices the models it lists; others fall
+       *  through to the standard tables so billing matches the advertised
+       *  token config instead of charging defaultRate */
+      if (modelConfig) {
+        return modelConfig[tokenType as string] ?? defaultRate;
+      }
     }
 
     if (valueKey && tokenType) {
@@ -465,7 +565,12 @@ export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: Tx
     endpointTokenConfig?: Record<string, Record<string, number>>;
   }): number | null {
     if (endpointTokenConfig && model) {
-      return endpointTokenConfig?.[model]?.[cacheType as string] ?? null;
+      const modelConfig = endpointTokenConfig[model];
+      /** Models absent from a partial override fall through to standard
+       *  cache rates rather than reporting no cache pricing */
+      if (modelConfig) {
+        return modelConfig[cacheType as string] ?? null;
+      }
     }
 
     if (valueKey && cacheType) {
diff --git a/packages/data-schemas/src/methods/user.methods.spec.ts b/packages/data-schemas/src/methods/user.methods.spec.ts
index 091cdf4f763..8869b2006e2 100644
--- a/packages/data-schemas/src/methods/user.methods.spec.ts
+++ b/packages/data-schemas/src/methods/user.methods.spec.ts
@@ -38,6 +38,20 @@ beforeEach(async () => {
 });
 
 describe('User schema indexes', () => {
+  test('should define an issuer-bound idOnTheSource lookup index', async () => {
+    await User.syncIndexes();
+
+    const indexes = await User.collection.indexes();
+
+    expect(indexes).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          key: { idOnTheSource: 1, openidIssuer: 1, tenantId: 1 },
+        }),
+      ]),
+    );
+  });
+
   test('should allow the same OpenID subject from different issuers', async () => {
     await User.syncIndexes();
 
@@ -476,6 +490,34 @@ describe('User Methods - Database Tests', () => {
       expect(results).toEqual([]);
     });
 
+    test('should treat regex metacharacters as literal search text', async () => {
+      await User.create({
+        name: 'Literal .* User',
+        email: 'literal-star@test.com',
+        username: 'literal-star',
+        provider: 'local',
+      });
+
+      const results = await methods.searchUsers({ searchPattern: '.*' });
+
+      expect(results).toHaveLength(1);
+      expect((results[0] as unknown as t.IUser).name).toBe('Literal .* User');
+    });
+
+    test('should handle invalid regex syntax as literal search text', async () => {
+      await User.create({
+        name: 'Regex [invalid User',
+        email: 'regex-invalid@test.com',
+        username: 'regex-invalid',
+        provider: 'local',
+      });
+
+      const results = await methods.searchUsers({ searchPattern: '[invalid' });
+
+      expect(results).toHaveLength(1);
+      expect((results[0] as unknown as t.IUser).name).toBe('Regex [invalid User');
+    });
+
     test('should apply field selection', async () => {
       const results = await methods.searchUsers({
         searchPattern: 'john',
diff --git a/packages/data-schemas/src/methods/user.ts b/packages/data-schemas/src/methods/user.ts
index d7aa3f90c90..56ba50fae4e 100644
--- a/packages/data-schemas/src/methods/user.ts
+++ b/packages/data-schemas/src/methods/user.ts
@@ -1,13 +1,112 @@
 import mongoose, { FilterQuery } from 'mongoose';
 import type { RefillIntervalUnit } from 'librechat-data-provider';
 import type { IUser, BalanceConfig, CreateUserRequest, UserDeleteResult } from '~/types';
+import { escapeRegExp } from '~/utils/string';
 import { signPayload } from '~/crypto';
 
 /** Default JWT session expiry: 15 minutes in milliseconds */
-export const DEFAULT_SESSION_EXPIRY = 1000 * 60 * 15;
+export const DEFAULT_SESSION_EXPIRY: number = 1000 * 60 * 15;
 
 /** Factory function that takes mongoose instance and returns the methods */
-export function createUserMethods(mongoose: typeof import('mongoose')) {
+export function createUserMethods(mongoose: typeof import('mongoose')): {
+  findUser: (
+    searchCriteria: FilterQuery<IUser>,
+    fieldsToSelect?: string | string[] | null,
+  ) => Promise<IUser | null>;
+  findUsers: (
+    searchCriteria: FilterQuery<IUser>,
+    fieldsToSelect?: string | string[] | null,
+    options?: { limit?: number; offset?: number; sort?: Record<string, 1 | -1> },
+  ) => Promise<IUser[]>;
+  countUsers: (filter?: FilterQuery<IUser>) => Promise<number>;
+  createUser: (
+    data: CreateUserRequest,
+    balanceConfig?: BalanceConfig,
+    disableTTL?: boolean,
+    returnUser?: boolean,
+  ) => Promise<mongoose.Types.ObjectId | Partial<IUser>>;
+  updateUser: (userId: string, updateData: Partial<IUser>) => Promise<IUser | null>;
+  searchUsers: ({
+    searchPattern,
+    limit,
+    fieldsToSelect,
+  }: {
+    searchPattern: string;
+    limit?: number;
+    fieldsToSelect?: string | string[] | null;
+  }) => Promise<
+    {
+      _id: mongoose.Types.ObjectId;
+      id: string;
+      name?: string;
+      username?: string;
+      email: string;
+      emailVerified: boolean;
+      password?: string;
+      avatar?: string;
+      provider: string;
+      role?: string;
+      googleId?: string;
+      facebookId?: string;
+      openidId?: string;
+      samlId?: string;
+      ldapId?: string;
+      githubId?: string;
+      discordId?: string;
+      appleId?: string;
+      plugins?: string[];
+      openidIssuer?: string;
+      twoFactorEnabled?: boolean;
+      totpSecret?: string;
+      backupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      pendingTotpSecret?: string;
+      pendingBackupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      refreshToken?: Array<{
+        refreshToken: string;
+      }>;
+      expiresAt?: Date;
+      termsAccepted?: boolean;
+      personalization?: {
+        memories?: boolean;
+      };
+      favorites?: import('librechat-data-provider').TUserFavorite[];
+      skillStates?: Record<string, boolean>;
+      createdAt?: Date;
+      updatedAt?: Date;
+      idOnTheSource?: string;
+      tenantId?: string;
+      federatedTokens?: import('~/types').OIDCTokens;
+      openidTokens?: import('~/types').OIDCTokens;
+      $locals: Record<string, unknown>;
+      $op: 'save' | 'validate' | 'remove' | null;
+      $where: Record<string, unknown>;
+      baseModelName?: string;
+      collection: mongoose.Collection;
+      db: mongoose.Connection;
+      errors?: mongoose.Error.ValidationError;
+      isNew: boolean;
+      schema: mongoose.Schema;
+    }[]
+  >;
+  getUserById: (userId: string, fieldsToSelect?: string | string[] | null) => Promise<IUser | null>;
+  generateToken: (user: IUser, expiresIn?: number) => Promise<string>;
+  deleteUserById: (userId: string) => Promise<UserDeleteResult>;
+  updateUserPlugins: (
+    userId: string,
+    plugins: string[] | undefined,
+    pluginKey: string,
+    action: 'install' | 'uninstall',
+  ) => Promise<IUser | null>;
+  toggleUserMemories: (userId: string, memoriesEnabled: boolean) => Promise<IUser | null>;
+} {
   /**
    * Normalizes email fields in search criteria to lowercase and trimmed.
    * Handles both direct email fields and $or arrays containing email conditions.
@@ -254,12 +353,74 @@ export function createUserMethods(mongoose: typeof import('mongoose')) {
     searchPattern: string;
     limit?: number;
     fieldsToSelect?: string | string[] | null;
-  }) {
+  }): Promise<
+    {
+      _id: mongoose.Types.ObjectId;
+      id: string;
+      name?: string;
+      username?: string;
+      email: string;
+      emailVerified: boolean;
+      password?: string;
+      avatar?: string;
+      provider: string;
+      role?: string;
+      googleId?: string;
+      facebookId?: string;
+      openidId?: string;
+      samlId?: string;
+      ldapId?: string;
+      githubId?: string;
+      discordId?: string;
+      appleId?: string;
+      plugins?: string[];
+      openidIssuer?: string;
+      twoFactorEnabled?: boolean;
+      totpSecret?: string;
+      backupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      pendingTotpSecret?: string;
+      pendingBackupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      refreshToken?: Array<{
+        refreshToken: string;
+      }>;
+      expiresAt?: Date;
+      termsAccepted?: boolean;
+      personalization?: {
+        memories?: boolean;
+      };
+      favorites?: import('librechat-data-provider').TUserFavorite[];
+      skillStates?: Record<string, boolean>;
+      createdAt?: Date;
+      updatedAt?: Date;
+      idOnTheSource?: string;
+      tenantId?: string;
+      federatedTokens?: import('~/types').OIDCTokens;
+      openidTokens?: import('~/types').OIDCTokens;
+      $locals: Record<string, unknown>;
+      $op: 'save' | 'validate' | 'remove' | null;
+      $where: Record<string, unknown>;
+      baseModelName?: string;
+      collection: mongoose.Collection;
+      db: mongoose.Connection;
+      errors?: mongoose.Error.ValidationError;
+      isNew: boolean;
+      schema: mongoose.Schema;
+    }[]
+  > {
     if (!searchPattern || searchPattern.trim().length === 0) {
       return [];
     }
 
-    const regex = new RegExp(searchPattern.trim(), 'i');
+    const trimmedPattern = searchPattern.trim();
+    const regex = new RegExp(escapeRegExp(trimmedPattern), 'i');
     const User = mongoose.models.User;
 
     const query = User.find({
@@ -273,8 +434,7 @@ export function createUserMethods(mongoose: typeof import('mongoose')) {
     const users = await query.lean<IUser[]>();
 
     // Score results by relevance
-    const exactRegex = new RegExp(`^${searchPattern.trim()}$`, 'i');
-    const startsWithPattern = searchPattern.trim().toLowerCase();
+    const startsWithPattern = trimmedPattern.toLowerCase();
 
     const scoredUsers = users.map((user) => {
       const searchableFields = [user.name, user.email, user.username].filter(
@@ -287,7 +447,7 @@ export function createUserMethods(mongoose: typeof import('mongoose')) {
         let score = 0;
 
         // Exact match gets highest score
-        if (exactRegex.test(field)) {
+        if (fieldLower === startsWithPattern) {
           score = 100;
         }
         // Starts with query gets high score
@@ -298,7 +458,7 @@ export function createUserMethods(mongoose: typeof import('mongoose')) {
         else if (fieldLower.includes(startsWithPattern)) {
           score = 50;
         }
-        // Default score for regex match
+        // Default score for database match
         else {
           score = 10;
         }
diff --git a/packages/data-schemas/src/methods/userGroup.methods.spec.ts b/packages/data-schemas/src/methods/userGroup.methods.spec.ts
index 51848de091f..abb3a1f9488 100644
--- a/packages/data-schemas/src/methods/userGroup.methods.spec.ts
+++ b/packages/data-schemas/src/methods/userGroup.methods.spec.ts
@@ -716,10 +716,7 @@ describe('UserGroup Methods - Detailed Tests', () => {
         memberIds: ['m1', 'm2', 'm3'],
       });
 
-      const updated = await methods.removeMemberById(
-        group._id as mongoose.Types.ObjectId,
-        'm2',
-      );
+      const updated = await methods.removeMemberById(group._id as mongoose.Types.ObjectId, 'm2');
 
       expect(updated).toBeDefined();
       expect(updated?.memberIds).toEqual(['m1', 'm3']);
diff --git a/packages/data-schemas/src/methods/userGroup.spec.ts b/packages/data-schemas/src/methods/userGroup.spec.ts
index ca83ced7d91..2048fe65a50 100644
--- a/packages/data-schemas/src/methods/userGroup.spec.ts
+++ b/packages/data-schemas/src/methods/userGroup.spec.ts
@@ -100,6 +100,7 @@ describe('userGroup methods', () => {
         { name: 'Engineering', source: 'local', description: 'Eng team' },
         { name: 'Design', source: 'local', email: 'design@co.com' },
         { name: 'Entra Eng', source: 'entra', idOnTheSource: 'ext-1' },
+        { name: 'Literal .* Group', source: 'local' },
       ]);
     });
 
@@ -120,6 +121,12 @@ describe('userGroup methods', () => {
       expect(results[0].name).toBe('Engineering');
     });
 
+    it('treats regex metacharacters as literal text', async () => {
+      const results = await methods.findGroupsByNamePattern('.*');
+      expect(results).toHaveLength(1);
+      expect(results[0].name).toBe('Literal .* Group');
+    });
+
     it('filters by source when provided', async () => {
       const results = await methods.findGroupsByNamePattern('eng', 'entra');
       expect(results).toHaveLength(1);
@@ -525,7 +532,7 @@ describe('userGroup methods', () => {
       expect(score).toBe(50);
     });
 
-    it('returns 10 (default) when no substring or exact match — regex fallback', () => {
+    it('returns 10 (default) when no substring or exact match', () => {
       const score = methods.calculateRelevanceScore(
         { type: PrincipalType.USER, name: 'bob', source: 'local' },
         'zzz',
@@ -573,12 +580,12 @@ describe('userGroup methods', () => {
       expect(score).toBe(80);
     });
 
-    it('returns 100 when regex pattern matches exactly via dot wildcard', () => {
+    it('does not treat regex metacharacters as wildcards', () => {
       const score = methods.calculateRelevanceScore(
         { type: PrincipalType.USER, name: 'xYz', source: 'local' },
         'x.z',
       );
-      expect(score).toBe(100);
+      expect(score).toBe(10);
     });
   });
 
@@ -671,6 +678,36 @@ describe('userGroup methods', () => {
       expect(results).toEqual([]);
     });
 
+    it('treats regex metacharacters as literal search text', async () => {
+      await User.create({
+        name: 'Literal .* User',
+        email: 'literal-star@test.com',
+        username: 'literal-star',
+        password: 'password123',
+        provider: 'local',
+      });
+
+      const results = await methods.searchPrincipals('.*', 10, [PrincipalType.USER]);
+
+      expect(results).toHaveLength(1);
+      expect(results[0].name).toBe('Literal .* User');
+    });
+
+    it('handles invalid regex syntax as literal search text', async () => {
+      await User.create({
+        name: 'Regex [invalid User',
+        email: 'regex-invalid@test.com',
+        username: 'regex-invalid',
+        password: 'password123',
+        provider: 'local',
+      });
+
+      const results = await methods.searchPrincipals('[invalid', 10, [PrincipalType.USER]);
+
+      expect(results).toHaveLength(1);
+      expect(results[0].name).toBe('Regex [invalid User');
+    });
+
     it('finds matching users', async () => {
       const results = await methods.searchPrincipals('alice');
       const userResults = results.filter((r) => r.type === PrincipalType.USER);
diff --git a/packages/data-schemas/src/methods/userGroup.ts b/packages/data-schemas/src/methods/userGroup.ts
index 5e7db57b62c..022f42d2eec 100644
--- a/packages/data-schemas/src/methods/userGroup.ts
+++ b/packages/data-schemas/src/methods/userGroup.ts
@@ -5,7 +5,117 @@ import type { Model, ClientSession, FilterQuery } from 'mongoose';
 import type { IGroup, IRole, IUser } from '~/types';
 import { escapeRegExp } from '~/utils/string';
 
-export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
+export function createUserGroupMethods(mongoose: typeof import('mongoose')): {
+  findGroupById: (
+    groupId: string | Types.ObjectId,
+    projection?: Record<string, 0 | 1>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  findGroupByExternalId: (
+    idOnTheSource: string,
+    source?: 'entra' | 'local',
+    projection?: Record<string, 0 | 1>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  findGroupsByExternalIds: (
+    idsOnTheSource: string[],
+    source?: 'entra' | 'local',
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  findGroupsByNamePattern: (
+    namePattern: string,
+    source?: 'entra' | 'local' | null,
+    limit?: number,
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  findGroupsByMemberId: (
+    userId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  createGroup: (groupData: Partial<IGroup>, session?: ClientSession) => Promise<IGroup>;
+  upsertGroupByExternalId: (
+    idOnTheSource: string,
+    source: 'entra' | 'local',
+    updateData: Partial<IGroup>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  addUserToGroup: (
+    userId: string | Types.ObjectId,
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<{ user: IUser; group: IGroup | null }>;
+  removeUserFromGroup: (
+    userId: string | Types.ObjectId,
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<{ user: IUser; group: IGroup | null }>;
+  removeUserFromAllGroups: (userId: string | Types.ObjectId) => Promise<void>;
+  findGroupByQuery: (
+    filter: Record<string, unknown>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  updateGroupById: (
+    groupId: string | Types.ObjectId,
+    data: Record<string, unknown>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  bulkUpdateGroups: (
+    filter: Record<string, unknown>,
+    update: Record<string, unknown>,
+    options?: { session?: ClientSession },
+  ) => Promise<import('mongoose').UpdateWriteOpResult>;
+  getUserGroups: (userId: string | Types.ObjectId, session?: ClientSession) => Promise<IGroup[]>;
+  getUserPrincipals: (
+    params: {
+      userId: string | Types.ObjectId;
+      role?: string | null;
+    },
+    session?: ClientSession,
+  ) => Promise<Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>>;
+  syncUserEntraGroups: (
+    userId: string | Types.ObjectId,
+    entraGroups: Array<{ id: string; name: string; description?: string; email?: string }>,
+    session?: ClientSession,
+  ) => Promise<{
+    user: IUser;
+    addedGroups: IGroup[];
+    removedGroups: IGroup[];
+  }>;
+  searchPrincipals: (
+    searchPattern: string,
+    limitPerType?: number,
+    typeFilter?: Array<PrincipalType.USER | PrincipalType.GROUP | PrincipalType.ROLE> | null,
+    session?: ClientSession,
+  ) => Promise<TPrincipalSearchResult[]>;
+  calculateRelevanceScore: (item: TPrincipalSearchResult, searchPattern: string) => number;
+  sortPrincipalsByRelevance: <
+    T extends { _searchScore?: number; type: string; name?: string; email?: string },
+  >(
+    results: T[],
+  ) => T[];
+  listGroups: (
+    filter?: {
+      source?: 'local' | 'entra';
+      search?: string;
+      limit?: number;
+      offset?: number;
+    },
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  countGroups: (
+    filter?: { source?: 'local' | 'entra'; search?: string },
+    session?: ClientSession,
+  ) => Promise<number>;
+  deleteGroup: (
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  removeMemberById: (
+    groupId: string | Types.ObjectId,
+    memberId: string,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+} {
   /**
    * Find a group by its ID
    * @param groupId - The group ID
@@ -86,7 +196,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
     session?: ClientSession,
   ): Promise<IGroup[]> {
     const Group = mongoose.models.Group as Model<IGroup>;
-    const regex = new RegExp(namePattern, 'i');
+    const regex = new RegExp(escapeRegExp(namePattern), 'i');
     const query: Record<string, unknown> = {
       $or: [{ name: regex }, { email: regex }, { description: regex }],
     };
@@ -436,8 +546,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
    * @returns Relevance score (0-100)
    */
   function calculateRelevanceScore(item: TPrincipalSearchResult, searchPattern: string): number {
-    const exactRegex = new RegExp(`^${searchPattern}$`, 'i');
-    const startsWithPattern = searchPattern.toLowerCase();
+    const normalizedPattern = searchPattern.toLowerCase();
 
     /** Get searchable text based on type */
     const searchableFields =
@@ -453,16 +562,16 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
       let score = 0;
 
       /** Exact match gets highest score */
-      if (exactRegex.test(field)) {
+      if (fieldLower === normalizedPattern) {
         score = 100;
-      } else if (fieldLower.startsWith(startsWithPattern)) {
+      } else if (fieldLower.startsWith(normalizedPattern)) {
         /** Starts with query gets high score */
         score = 80;
-      } else if (fieldLower.includes(startsWithPattern)) {
+      } else if (fieldLower.includes(normalizedPattern)) {
         /** Contains query gets medium score */
         score = 50;
       } else {
-        /** Default score for regex match */
+        /** Default score for database match */
         score = 10;
       }
 
@@ -551,6 +660,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
     }
 
     const trimmedPattern = searchPattern.trim();
+    const escapedPattern = escapeRegExp(trimmedPattern);
     const promises: Promise<TPrincipalSearchResult[]>[] = [];
 
     if (!typeFilter || typeFilter.includes(PrincipalType.USER)) {
@@ -558,7 +668,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
       const userFields = 'name email username avatar provider idOnTheSource';
       /** For now, we'll use a direct query instead of searchUsers */
       const User = mongoose.models.User as Model<IUser>;
-      const regex = new RegExp(trimmedPattern, 'i');
+      const regex = new RegExp(escapedPattern, 'i');
       const userQuery = User.find({
         $or: [{ name: regex }, { email: regex }, { username: regex }],
       })
@@ -601,7 +711,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
     if (!typeFilter || typeFilter.includes(PrincipalType.ROLE)) {
       const Role = mongoose.models.Role as Model<IRole>;
       if (Role) {
-        const regex = new RegExp(trimmedPattern, 'i');
+        const regex = new RegExp(escapedPattern, 'i');
         const roleQuery = Role.find({ name: regex }).select('name').limit(limitPerType);
 
         if (session) {
@@ -680,7 +790,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
     filter: Record<string, unknown>,
     update: Record<string, unknown>,
     options?: { session?: ClientSession },
-  ) {
+  ): Promise<import('mongoose').UpdateWriteOpResult> {
     const Group = mongoose.models.Group as Model<IGroup>;
     return Group.updateMany(filter, update, options || {});
   }
diff --git a/packages/data-schemas/src/methods/userStats.ts b/packages/data-schemas/src/methods/userStats.ts
index c7254381f2b..95f21392ad4 100644
--- a/packages/data-schemas/src/methods/userStats.ts
+++ b/packages/data-schemas/src/methods/userStats.ts
@@ -4,11 +4,17 @@ import type { IUser } from '~/types';
 
 type ResourceCreatedAtRange = { $gte?: Date; $lte?: Date };
 
-function hasResourceCreatedAtRange(range?: ResourceCreatedAtRange): range is ResourceCreatedAtRange {
+function hasResourceCreatedAtRange(
+  range?: ResourceCreatedAtRange,
+): range is ResourceCreatedAtRange {
   return range != null && (range.$gte != null || range.$lte != null);
 }
 
-export function createUserStatsMethods(mongoose: typeof import('mongoose')) {
+export function createUserStatsMethods(mongoose: typeof import('mongoose')): {
+  getAdminUsersStats: (
+    resourceCreatedAtRange?: ResourceCreatedAtRange,
+  ) => Promise<AdminUserStatsRow[]>;
+} {
   /**
    * User stats: all users with conversation and message counts.
    * When `resourceCreatedAtRange` is set, counts only conversations/messages whose `createdAt` falls in range.
diff --git a/packages/data-schemas/src/migrations/tenantIndexes.spec.ts b/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
index a2fb2fef018..986adb5ab88 100644
--- a/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
+++ b/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
@@ -113,6 +113,11 @@ describe('dropSupersededTenantIndexes', () => {
           { idOnTheSource: 1, source: 1 },
           { unique: true, name: 'idOnTheSource_1_source_1' },
         );
+
+      await db.createCollection('skillsyncstatuses');
+      await db
+        .collection('skillsyncstatuses')
+        .createIndex({ provider: 1, sourceId: 1 }, { unique: true, name: 'provider_1_sourceId_1' });
     });
 
     it('drops all superseded indexes', async () => {
@@ -160,6 +165,13 @@ describe('dropSupersededTenantIndexes', () => {
 
       expect(indexNames).not.toContain('conversationId_1_user_1');
     });
+
+    it('old skill sync status unique index is gone', async () => {
+      const indexes = await mongoose.connection.db!.collection('skillsyncstatuses').indexes();
+      const indexNames = indexes.map((idx) => idx.name);
+
+      expect(indexNames).not.toContain('provider_1_sourceId_1');
+    });
   });
 
   describe('multi-tenant writes after migration', () => {
@@ -287,6 +299,7 @@ describe('dropSupersededTenantIndexes', () => {
         'mcpservers',
         'files',
         'groups',
+        'skillsyncstatuses',
       ];
 
       for (const col of expectedCollections) {
diff --git a/packages/data-schemas/src/migrations/tenantIndexes.ts b/packages/data-schemas/src/migrations/tenantIndexes.ts
index e511bb17364..9a84997c5ca 100644
--- a/packages/data-schemas/src/migrations/tenantIndexes.ts
+++ b/packages/data-schemas/src/migrations/tenantIndexes.ts
@@ -35,6 +35,7 @@ const SUPERSEDED_INDEXES: Record<string, string[]> = {
   mcpservers: ['serverName_1'],
   files: ['filename_1_conversationId_1_context_1'],
   groups: ['idOnTheSource_1_source_1'],
+  skillsyncstatuses: ['provider_1_sourceId_1'],
 };
 
 interface MigrationResult {
diff --git a/packages/data-schemas/src/models/accessRole.ts b/packages/data-schemas/src/models/accessRole.ts
index cd2c8b691cd..2c3264d746a 100644
--- a/packages/data-schemas/src/models/accessRole.ts
+++ b/packages/data-schemas/src/models/accessRole.ts
@@ -1,8 +1,9 @@
-import accessRoleSchema from '~/schema/accessRole';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import accessRoleSchema from '~/schema/accessRole';
 
-export function createAccessRoleModel(mongoose: typeof import('mongoose')) {
+export function createAccessRoleModel(mongoose: typeof import('mongoose')): Model<t.IAccessRole> {
   applyTenantIsolation(accessRoleSchema);
   return (
     mongoose.models.AccessRole || mongoose.model<t.IAccessRole>('AccessRole', accessRoleSchema)
diff --git a/packages/data-schemas/src/models/aclEntry.ts b/packages/data-schemas/src/models/aclEntry.ts
index 195b328438b..225e3862e38 100644
--- a/packages/data-schemas/src/models/aclEntry.ts
+++ b/packages/data-schemas/src/models/aclEntry.ts
@@ -1,8 +1,9 @@
-import aclEntrySchema from '~/schema/aclEntry';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import aclEntrySchema from '~/schema/aclEntry';
 
-export function createAclEntryModel(mongoose: typeof import('mongoose')) {
+export function createAclEntryModel(mongoose: typeof import('mongoose')): Model<t.IAclEntry> {
   applyTenantIsolation(aclEntrySchema);
   return mongoose.models.AclEntry || mongoose.model<t.IAclEntry>('AclEntry', aclEntrySchema);
 }
diff --git a/packages/data-schemas/src/models/action.ts b/packages/data-schemas/src/models/action.ts
index 421610ab739..8be9dd4b1d5 100644
--- a/packages/data-schemas/src/models/action.ts
+++ b/packages/data-schemas/src/models/action.ts
@@ -1,8 +1,9 @@
-import actionSchema from '~/schema/action';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAction } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import actionSchema from '~/schema/action';
 
-export function createActionModel(mongoose: typeof import('mongoose')) {
+export function createActionModel(mongoose: typeof import('mongoose')): Model<IAction> {
   applyTenantIsolation(actionSchema);
   return mongoose.models.Action || mongoose.model<IAction>('Action', actionSchema);
 }
diff --git a/packages/data-schemas/src/models/agent.ts b/packages/data-schemas/src/models/agent.ts
index 595d890f065..7b3327dacad 100644
--- a/packages/data-schemas/src/models/agent.ts
+++ b/packages/data-schemas/src/models/agent.ts
@@ -1,8 +1,9 @@
-import agentSchema from '~/schema/agent';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAgent } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentSchema from '~/schema/agent';
 
-export function createAgentModel(mongoose: typeof import('mongoose')) {
+export function createAgentModel(mongoose: typeof import('mongoose')): Model<IAgent> {
   applyTenantIsolation(agentSchema);
   return mongoose.models.Agent || mongoose.model<IAgent>('Agent', agentSchema);
 }
diff --git a/packages/data-schemas/src/models/agentApiKey.ts b/packages/data-schemas/src/models/agentApiKey.ts
index 8251b3d7cdf..925394084e6 100644
--- a/packages/data-schemas/src/models/agentApiKey.ts
+++ b/packages/data-schemas/src/models/agentApiKey.ts
@@ -1,7 +1,8 @@
-import agentApiKeySchema, { IAgentApiKey } from '~/schema/agentApiKey';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentApiKeySchema, { IAgentApiKey } from '~/schema/agentApiKey';
 
-export function createAgentApiKeyModel(mongoose: typeof import('mongoose')) {
+export function createAgentApiKeyModel(mongoose: typeof import('mongoose')): Model<IAgentApiKey> {
   applyTenantIsolation(agentApiKeySchema);
   return (
     mongoose.models.AgentApiKey || mongoose.model<IAgentApiKey>('AgentApiKey', agentApiKeySchema)
diff --git a/packages/data-schemas/src/models/agentCategory.ts b/packages/data-schemas/src/models/agentCategory.ts
index f0f1f79d2e2..9621ce7830a 100644
--- a/packages/data-schemas/src/models/agentCategory.ts
+++ b/packages/data-schemas/src/models/agentCategory.ts
@@ -1,8 +1,11 @@
-import agentCategorySchema from '~/schema/agentCategory';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentCategorySchema from '~/schema/agentCategory';
 
-export function createAgentCategoryModel(mongoose: typeof import('mongoose')) {
+export function createAgentCategoryModel(
+  mongoose: typeof import('mongoose'),
+): Model<t.IAgentCategory> {
   applyTenantIsolation(agentCategorySchema);
   return (
     mongoose.models.AgentCategory ||
diff --git a/packages/data-schemas/src/models/assistant.ts b/packages/data-schemas/src/models/assistant.ts
index 16c6dc2bc66..03bd52b917c 100644
--- a/packages/data-schemas/src/models/assistant.ts
+++ b/packages/data-schemas/src/models/assistant.ts
@@ -1,8 +1,9 @@
-import assistantSchema from '~/schema/assistant';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAssistant } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import assistantSchema from '~/schema/assistant';
 
-export function createAssistantModel(mongoose: typeof import('mongoose')) {
+export function createAssistantModel(mongoose: typeof import('mongoose')): Model<IAssistant> {
   applyTenantIsolation(assistantSchema);
   return mongoose.models.Assistant || mongoose.model<IAssistant>('Assistant', assistantSchema);
 }
diff --git a/packages/data-schemas/src/models/auditLog.ts b/packages/data-schemas/src/models/auditLog.ts
new file mode 100644
index 00000000000..0efd65391d6
--- /dev/null
+++ b/packages/data-schemas/src/models/auditLog.ts
@@ -0,0 +1,15 @@
+import type { Model } from 'mongoose';
+import type * as t from '~/types';
+import auditLogSchema from '~/schema/auditLog';
+
+/**
+ * AuditLog is an append-only, hash-chained compliance record.
+ *
+ * Like SystemGrant, the tenant-isolation plugin is intentionally not applied:
+ * every query is scoped by `chainKey` (the JWT-resolved tenantId, or the
+ * platform sentinel for admin operations outside any tenant), which is also the
+ * serialization key for the per-tenant hash chain.
+ */
+export function createAuditLogModel(mongoose: typeof import('mongoose')): Model<t.IAuditLog> {
+  return mongoose.models.AuditLog || mongoose.model<t.IAuditLog>('AuditLog', auditLogSchema);
+}
diff --git a/packages/data-schemas/src/models/balance.ts b/packages/data-schemas/src/models/balance.ts
index 7c1fb344780..6a531ab95d5 100644
--- a/packages/data-schemas/src/models/balance.ts
+++ b/packages/data-schemas/src/models/balance.ts
@@ -1,8 +1,9 @@
-import balanceSchema from '~/schema/balance';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import balanceSchema from '~/schema/balance';
 
-export function createBalanceModel(mongoose: typeof import('mongoose')) {
+export function createBalanceModel(mongoose: typeof import('mongoose')): Model<t.IBalance> {
   applyTenantIsolation(balanceSchema);
   return mongoose.models.Balance || mongoose.model<t.IBalance>('Balance', balanceSchema);
 }
diff --git a/packages/data-schemas/src/models/banner.ts b/packages/data-schemas/src/models/banner.ts
index ac18fa72b45..0bf12bac396 100644
--- a/packages/data-schemas/src/models/banner.ts
+++ b/packages/data-schemas/src/models/banner.ts
@@ -1,8 +1,9 @@
-import bannerSchema from '~/schema/banner';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IBanner } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import bannerSchema from '~/schema/banner';
 
-export function createBannerModel(mongoose: typeof import('mongoose')) {
+export function createBannerModel(mongoose: typeof import('mongoose')): Model<IBanner> {
   applyTenantIsolation(bannerSchema);
   return mongoose.models.Banner || mongoose.model<IBanner>('Banner', bannerSchema);
 }
diff --git a/packages/data-schemas/src/models/chatProject.ts b/packages/data-schemas/src/models/chatProject.ts
new file mode 100644
index 00000000000..27134b0a067
--- /dev/null
+++ b/packages/data-schemas/src/models/chatProject.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { IChatProjectDocument } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import chatProjectSchema from '~/schema/chatProject';
+
+export function createChatProjectModel(
+  mongoose: typeof import('mongoose'),
+): Model<IChatProjectDocument> {
+  applyTenantIsolation(chatProjectSchema);
+  return (
+    mongoose.models.ChatProject ||
+    mongoose.model<IChatProjectDocument>('ChatProject', chatProjectSchema, 'chatprojects')
+  );
+}
diff --git a/packages/data-schemas/src/models/config.ts b/packages/data-schemas/src/models/config.ts
index 97c08ce1daa..24a796a50c7 100644
--- a/packages/data-schemas/src/models/config.ts
+++ b/packages/data-schemas/src/models/config.ts
@@ -1,8 +1,9 @@
-import configSchema from '~/schema/config';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import configSchema from '~/schema/config';
 
-export function createConfigModel(mongoose: typeof import('mongoose')) {
+export function createConfigModel(mongoose: typeof import('mongoose')): Model<t.IConfig> {
   applyTenantIsolation(configSchema);
   return mongoose.models.Config || mongoose.model<t.IConfig>('Config', configSchema);
 }
diff --git a/packages/data-schemas/src/models/conversationTag.ts b/packages/data-schemas/src/models/conversationTag.ts
index a2df6459cc2..e4dcb8f50c4 100644
--- a/packages/data-schemas/src/models/conversationTag.ts
+++ b/packages/data-schemas/src/models/conversationTag.ts
@@ -1,7 +1,10 @@
+import { Model } from 'mongoose';
 import conversationTagSchema, { IConversationTag } from '~/schema/conversationTag';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 
-export function createConversationTagModel(mongoose: typeof import('mongoose')) {
+export function createConversationTagModel(
+  mongoose: typeof import('mongoose'),
+): Model<IConversationTag> {
   applyTenantIsolation(conversationTagSchema);
   return (
     mongoose.models.ConversationTag ||
diff --git a/packages/data-schemas/src/models/convo.ts b/packages/data-schemas/src/models/convo.ts
index 7cf504bf48a..d636718373b 100644
--- a/packages/data-schemas/src/models/convo.ts
+++ b/packages/data-schemas/src/models/convo.ts
@@ -1,9 +1,12 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 import mongoMeili from '~/models/plugins/mongoMeili';
 import convoSchema from '~/schema/convo';
 
-export function createConversationModel(mongoose: typeof import('mongoose')) {
+export function createConversationModel(
+  mongoose: typeof import('mongoose'),
+): Model<t.IConversation> {
   applyTenantIsolation(convoSchema);
   if (process.env.MEILI_HOST && process.env.MEILI_MASTER_KEY) {
     convoSchema.plugin(mongoMeili, {
diff --git a/packages/data-schemas/src/models/file.ts b/packages/data-schemas/src/models/file.ts
index da291a13e39..796e896bc5e 100644
--- a/packages/data-schemas/src/models/file.ts
+++ b/packages/data-schemas/src/models/file.ts
@@ -1,8 +1,9 @@
-import fileSchema from '~/schema/file';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IMongoFile } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import fileSchema from '~/schema/file';
 
-export function createFileModel(mongoose: typeof import('mongoose')) {
+export function createFileModel(mongoose: typeof import('mongoose')): Model<IMongoFile> {
   applyTenantIsolation(fileSchema);
   return mongoose.models.File || mongoose.model<IMongoFile>('File', fileSchema);
 }
diff --git a/packages/data-schemas/src/models/group.ts b/packages/data-schemas/src/models/group.ts
index 0396de83f11..46494c9ad66 100644
--- a/packages/data-schemas/src/models/group.ts
+++ b/packages/data-schemas/src/models/group.ts
@@ -1,8 +1,9 @@
-import groupSchema from '~/schema/group';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import groupSchema from '~/schema/group';
 
-export function createGroupModel(mongoose: typeof import('mongoose')) {
+export function createGroupModel(mongoose: typeof import('mongoose')): Model<t.IGroup> {
   applyTenantIsolation(groupSchema);
   return mongoose.models.Group || mongoose.model<t.IGroup>('Group', groupSchema);
 }
diff --git a/packages/data-schemas/src/models/index.ts b/packages/data-schemas/src/models/index.ts
index dcd88f58d28..6493013f2cc 100644
--- a/packages/data-schemas/src/models/index.ts
+++ b/packages/data-schemas/src/models/index.ts
@@ -1,46 +1,88 @@
-import { createUserModel } from './user';
-import { createTokenModel } from './token';
+import { createSkillSyncCredentialModel } from './skillSyncCredential';
+import { createSkillSyncStatusModel } from './skillSyncStatus';
+import { createConversationTagModel } from './conversationTag';
+import { createAgentCategoryModel } from './agentCategory';
+import { createChatProjectModel } from './chatProject';
+import { createAgentApiKeyModel } from './agentApiKey';
+import { createTransactionModel } from './transaction';
+import { createPromptGroupModel } from './promptGroup';
+import { createSystemGrantModel } from './systemGrant';
+import { createPluginAuthModel } from './pluginAuth';
+import { createSharedLinkModel } from './sharedLink';
+import { createAccessRoleModel } from './accessRole';
+import { createMCPServerModel } from './mcpServer';
+import { createAssistantModel } from './assistant';
+import { createSkillFileModel } from './skillFile';
+import { createConversationModel } from './convo';
+import { createToolCallModel } from './toolCall';
+import { createAclEntryModel } from './aclEntry';
+import { createAuditLogModel } from './auditLog';
 import { createSessionModel } from './session';
 import { createBalanceModel } from './balance';
-import { createConversationModel } from './convo';
 import { createMessageModel } from './message';
-import { createAgentModel } from './agent';
-import { createAgentApiKeyModel } from './agentApiKey';
-import { createAgentCategoryModel } from './agentCategory';
-import { createMCPServerModel } from './mcpServer';
-import { createRoleModel } from './role';
 import { createActionModel } from './action';
-import { createAssistantModel } from './assistant';
-import { createFileModel } from './file';
 import { createBannerModel } from './banner';
-import { createKeyModel } from './key';
-import { createPluginAuthModel } from './pluginAuth';
-import { createTransactionModel } from './transaction';
 import { createPresetModel } from './preset';
 import { createPromptModel } from './prompt';
-import { createPromptGroupModel } from './promptGroup';
-import { createSkillModel } from './skill';
-import { createSkillFileModel } from './skillFile';
-import { createConversationTagModel } from './conversationTag';
-import { createSharedLinkModel } from './sharedLink';
-import { createToolCallModel } from './toolCall';
 import { createMemoryModel } from './memory';
-import { createAccessRoleModel } from './accessRole';
-import { createAclEntryModel } from './aclEntry';
-import { createSystemGrantModel } from './systemGrant';
-import { createGroupModel } from './group';
 import { createConfigModel } from './config';
+import { createTokenModel } from './token';
+import { createAgentModel } from './agent';
+import { createSkillModel } from './skill';
+import { createGroupModel } from './group';
+import { createUserModel } from './user';
+import { createRoleModel } from './role';
+import { createFileModel } from './file';
+import { createKeyModel } from './key';
 
 /**
  * Creates all database models for all collections
  */
-export function createModels(mongoose: typeof import('mongoose')) {
+export function createModels(mongoose: typeof import('mongoose')): {
+  User: ReturnType<typeof createUserModel>;
+  Token: ReturnType<typeof createTokenModel>;
+  Session: ReturnType<typeof createSessionModel>;
+  Balance: ReturnType<typeof createBalanceModel>;
+  Conversation: ReturnType<typeof createConversationModel>;
+  ChatProject: ReturnType<typeof createChatProjectModel>;
+  Message: ReturnType<typeof createMessageModel>;
+  Agent: ReturnType<typeof createAgentModel>;
+  AgentApiKey: ReturnType<typeof createAgentApiKeyModel>;
+  AgentCategory: ReturnType<typeof createAgentCategoryModel>;
+  MCPServer: ReturnType<typeof createMCPServerModel>;
+  Role: ReturnType<typeof createRoleModel>;
+  Action: ReturnType<typeof createActionModel>;
+  Assistant: ReturnType<typeof createAssistantModel>;
+  File: ReturnType<typeof createFileModel>;
+  Banner: ReturnType<typeof createBannerModel>;
+  Key: ReturnType<typeof createKeyModel>;
+  PluginAuth: ReturnType<typeof createPluginAuthModel>;
+  Transaction: ReturnType<typeof createTransactionModel>;
+  Preset: ReturnType<typeof createPresetModel>;
+  Prompt: ReturnType<typeof createPromptModel>;
+  PromptGroup: ReturnType<typeof createPromptGroupModel>;
+  Skill: ReturnType<typeof createSkillModel>;
+  SkillFile: ReturnType<typeof createSkillFileModel>;
+  SkillSyncCredential: ReturnType<typeof createSkillSyncCredentialModel>;
+  SkillSyncStatus: ReturnType<typeof createSkillSyncStatusModel>;
+  ConversationTag: ReturnType<typeof createConversationTagModel>;
+  SharedLink: ReturnType<typeof createSharedLinkModel>;
+  ToolCall: ReturnType<typeof createToolCallModel>;
+  MemoryEntry: ReturnType<typeof createMemoryModel>;
+  AccessRole: ReturnType<typeof createAccessRoleModel>;
+  AclEntry: ReturnType<typeof createAclEntryModel>;
+  SystemGrant: ReturnType<typeof createSystemGrantModel>;
+  AuditLog: ReturnType<typeof createAuditLogModel>;
+  Group: ReturnType<typeof createGroupModel>;
+  Config: ReturnType<typeof createConfigModel>;
+} {
   return {
     User: createUserModel(mongoose),
     Token: createTokenModel(mongoose),
     Session: createSessionModel(mongoose),
     Balance: createBalanceModel(mongoose),
     Conversation: createConversationModel(mongoose),
+    ChatProject: createChatProjectModel(mongoose),
     Message: createMessageModel(mongoose),
     Agent: createAgentModel(mongoose),
     AgentApiKey: createAgentApiKeyModel(mongoose),
@@ -59,6 +101,8 @@ export function createModels(mongoose: typeof import('mongoose')) {
     PromptGroup: createPromptGroupModel(mongoose),
     Skill: createSkillModel(mongoose),
     SkillFile: createSkillFileModel(mongoose),
+    SkillSyncCredential: createSkillSyncCredentialModel(mongoose),
+    SkillSyncStatus: createSkillSyncStatusModel(mongoose),
     ConversationTag: createConversationTagModel(mongoose),
     SharedLink: createSharedLinkModel(mongoose),
     ToolCall: createToolCallModel(mongoose),
@@ -66,6 +110,7 @@ export function createModels(mongoose: typeof import('mongoose')) {
     AccessRole: createAccessRoleModel(mongoose),
     AclEntry: createAclEntryModel(mongoose),
     SystemGrant: createSystemGrantModel(mongoose),
+    AuditLog: createAuditLogModel(mongoose),
     Group: createGroupModel(mongoose),
     Config: createConfigModel(mongoose),
   };
diff --git a/packages/data-schemas/src/models/key.ts b/packages/data-schemas/src/models/key.ts
index d6534e870b3..1772a11e6cc 100644
--- a/packages/data-schemas/src/models/key.ts
+++ b/packages/data-schemas/src/models/key.ts
@@ -1,7 +1,8 @@
-import keySchema, { IKey } from '~/schema/key';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import keySchema, { IKey } from '~/schema/key';
 
-export function createKeyModel(mongoose: typeof import('mongoose')) {
+export function createKeyModel(mongoose: typeof import('mongoose')): Model<IKey> {
   applyTenantIsolation(keySchema);
   return mongoose.models.Key || mongoose.model<IKey>('Key', keySchema);
 }
diff --git a/packages/data-schemas/src/models/mcpServer.ts b/packages/data-schemas/src/models/mcpServer.ts
index 6b93754d1c6..03187911ade 100644
--- a/packages/data-schemas/src/models/mcpServer.ts
+++ b/packages/data-schemas/src/models/mcpServer.ts
@@ -1,8 +1,11 @@
-import mcpServerSchema from '~/schema/mcpServer';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { MCPServerDocument } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import mcpServerSchema from '~/schema/mcpServer';
 
-export function createMCPServerModel(mongoose: typeof import('mongoose')) {
+export function createMCPServerModel(
+  mongoose: typeof import('mongoose'),
+): Model<MCPServerDocument> {
   applyTenantIsolation(mcpServerSchema);
   return (
     mongoose.models.MCPServer || mongoose.model<MCPServerDocument>('MCPServer', mcpServerSchema)
diff --git a/packages/data-schemas/src/models/memory.ts b/packages/data-schemas/src/models/memory.ts
index ad2c8cf8dcf..4ae4a7eceb9 100644
--- a/packages/data-schemas/src/models/memory.ts
+++ b/packages/data-schemas/src/models/memory.ts
@@ -1,8 +1,9 @@
-import memorySchema from '~/schema/memory';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IMemoryEntry } from '~/types/memory';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import memorySchema from '~/schema/memory';
 
-export function createMemoryModel(mongoose: typeof import('mongoose')) {
+export function createMemoryModel(mongoose: typeof import('mongoose')): Model<IMemoryEntry> {
   applyTenantIsolation(memorySchema);
   return mongoose.models.MemoryEntry || mongoose.model<IMemoryEntry>('MemoryEntry', memorySchema);
 }
diff --git a/packages/data-schemas/src/models/message.ts b/packages/data-schemas/src/models/message.ts
index b8b26b3e062..2dfcf66fe4f 100644
--- a/packages/data-schemas/src/models/message.ts
+++ b/packages/data-schemas/src/models/message.ts
@@ -1,9 +1,10 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 import mongoMeili from '~/models/plugins/mongoMeili';
 import messageSchema from '~/schema/message';
 
-export function createMessageModel(mongoose: typeof import('mongoose')) {
+export function createMessageModel(mongoose: typeof import('mongoose')): Model<t.IMessage> {
   applyTenantIsolation(messageSchema);
   if (process.env.MEILI_HOST && process.env.MEILI_MASTER_KEY) {
     messageSchema.plugin(mongoMeili, {
diff --git a/packages/data-schemas/src/models/pluginAuth.ts b/packages/data-schemas/src/models/pluginAuth.ts
index 22b46d05a8b..3d879217b38 100644
--- a/packages/data-schemas/src/models/pluginAuth.ts
+++ b/packages/data-schemas/src/models/pluginAuth.ts
@@ -1,8 +1,9 @@
-import pluginAuthSchema from '~/schema/pluginAuth';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPluginAuth } from '~/types/pluginAuth';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import pluginAuthSchema from '~/schema/pluginAuth';
 
-export function createPluginAuthModel(mongoose: typeof import('mongoose')) {
+export function createPluginAuthModel(mongoose: typeof import('mongoose')): Model<IPluginAuth> {
   applyTenantIsolation(pluginAuthSchema);
   return mongoose.models.PluginAuth || mongoose.model<IPluginAuth>('PluginAuth', pluginAuthSchema);
 }
diff --git a/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts b/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
index 1d341a7939e..421c15c14db 100644
--- a/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
+++ b/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
@@ -1,9 +1,57 @@
-import { MongoMemoryServer } from 'mongodb-memory-server';
 import mongoose from 'mongoose';
 import { EModelEndpoint } from 'librechat-data-provider';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import mongoMeili, { type SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 import { createConversationModel } from '~/models/convo';
 import { createMessageModel } from '~/models/message';
-import { SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
+
+interface DynamicMeiliDocument extends mongoose.Document {
+  docId: string;
+  user: string;
+  title: string;
+  isTemporary?: boolean;
+  expiredAt?: Date | null;
+  _meiliIndex?: boolean;
+}
+
+type DynamicMeiliModel = mongoose.Model<DynamicMeiliDocument> & SchemaWithMeiliMethods;
+
+const createDynamicMeiliModel = (modelName: string): DynamicMeiliModel => {
+  const schema = new mongoose.Schema<DynamicMeiliDocument>({
+    docId: {
+      type: String,
+      required: true,
+      meiliIndex: true,
+    },
+    title: {
+      type: String,
+      meiliIndex: true,
+    },
+    user: {
+      type: String,
+      meiliIndex: true,
+    },
+    isTemporary: {
+      type: Boolean,
+      default: false,
+    },
+    expiredAt: {
+      type: Date,
+    },
+  });
+
+  schema.plugin(mongoMeili, {
+    mongoose,
+    host: 'foo',
+    apiKey: 'bar',
+    indexName: modelName.toLowerCase(),
+    primaryKey: 'docId',
+  });
+
+  return mongoose.model<DynamicMeiliDocument>(modelName, schema) as unknown as DynamicMeiliModel;
+};
+
+const wait = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
 
 const mockAddDocuments = jest.fn();
 const mockAddDocumentsInBatches = jest.fn();
@@ -90,12 +138,37 @@ describe('Meilisearch Mongoose plugin', () => {
     expect(mockAddDocuments).toHaveBeenCalled();
   });
 
-  test('saving TTL conversation does NOT index w/ meilisearch', async () => {
+  test('saving retained non-temporary conversation indexes w/ meilisearch', async () => {
     await createConversationModel(mongoose).create({
       conversationId: new mongoose.Types.ObjectId(),
       user: new mongoose.Types.ObjectId(),
       title: 'Test Conversation',
       endpoint: EModelEndpoint.openAI,
+      isTemporary: false,
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+    });
+    expect(mockAddDocuments).toHaveBeenCalled();
+  });
+
+  test('saving expired retained non-temporary conversation does NOT index w/ meilisearch', async () => {
+    await createConversationModel(mongoose).create({
+      conversationId: new mongoose.Types.ObjectId(),
+      user: new mongoose.Types.ObjectId(),
+      title: 'Test Conversation',
+      endpoint: EModelEndpoint.openAI,
+      isTemporary: false,
+      expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+    expect(mockAddDocuments).not.toHaveBeenCalled();
+  });
+
+  test('saving temporary conversation does NOT index w/ meilisearch', async () => {
+    await createConversationModel(mongoose).create({
+      conversationId: new mongoose.Types.ObjectId(),
+      user: new mongoose.Types.ObjectId(),
+      title: 'Test Conversation',
+      endpoint: EModelEndpoint.openAI,
+      isTemporary: true,
       expiredAt: new Date(),
     });
     expect(mockAddDocuments).not.toHaveBeenCalled();
@@ -125,19 +198,46 @@ describe('Meilisearch Mongoose plugin', () => {
     expect(mockAddDocuments).toHaveBeenCalled();
   });
 
-  test('saving TTL messages does NOT index w/ meilisearch', async () => {
+  test('saving retained non-temporary messages indexes w/ meilisearch', async () => {
+    await createMessageModel(mongoose).create({
+      messageId: new mongoose.Types.ObjectId(),
+      conversationId: new mongoose.Types.ObjectId(),
+      user: new mongoose.Types.ObjectId(),
+      isCreatedByUser: true,
+      isTemporary: false,
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+    });
+    expect(mockAddDocuments).toHaveBeenCalled();
+  });
+
+  test('saving expired retained non-temporary message does NOT index w/ meilisearch', async () => {
     await createMessageModel(mongoose).create({
       messageId: new mongoose.Types.ObjectId(),
       conversationId: new mongoose.Types.ObjectId(),
       user: new mongoose.Types.ObjectId(),
       isCreatedByUser: true,
+      isTemporary: false,
+      expiredAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+    expect(mockAddDocuments).not.toHaveBeenCalled();
+  });
+
+  test('saving temporary messages does NOT index w/ meilisearch', async () => {
+    await createMessageModel(mongoose).create({
+      messageId: new mongoose.Types.ObjectId(),
+      conversationId: new mongoose.Types.ObjectId(),
+      user: new mongoose.Types.ObjectId(),
+      isCreatedByUser: true,
+      isTemporary: true,
       expiredAt: new Date(),
     });
     expect(mockAddDocuments).not.toHaveBeenCalled();
   });
 
   test('updating an indexed conversation calls updateDocuments with primaryKey', async () => {
-    const conversationModel = createConversationModel(mongoose);
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     const convo = await conversationModel.create({
       conversationId: new mongoose.Types.ObjectId().toString(),
       user: new mongoose.Types.ObjectId(),
@@ -197,7 +297,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('updateDocuments receives preprocessed data with primaryKey', async () => {
-    const conversationModel = createConversationModel(mongoose);
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     const conversationId = 'abc|def|ghi';
     const convo = await conversationModel.create({
       conversationId,
@@ -218,12 +320,15 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('sync w/ meili does not include TTL documents', async () => {
-    const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     await conversationModel.create({
       conversationId: new mongoose.Types.ObjectId(),
       user: new mongoose.Types.ObjectId(),
       title: 'Test Conversation',
       endpoint: EModelEndpoint.openAI,
+      isTemporary: true,
       expiredAt: new Date(),
     });
 
@@ -232,10 +337,185 @@ describe('Meilisearch Mongoose plugin', () => {
     expect(mockAddDocuments).not.toHaveBeenCalled();
   });
 
+  test('sync w/ meili excludes legacy temporary conversations without isTemporary', async () => {
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
+    await conversationModel.deleteMany({});
+    mockAddDocumentsInBatches.mockClear();
+    const conversationId = new mongoose.Types.ObjectId().toString();
+
+    await conversationModel.collection.insertOne({
+      conversationId,
+      user: new mongoose.Types.ObjectId().toString(),
+      title: 'Legacy Temporary Conversation',
+      endpoint: EModelEndpoint.openAI,
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+      _meiliIndex: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+
+    await conversationModel.syncWithMeili();
+    const storedDoc = await conversationModel.collection.findOne({ conversationId });
+
+    expect(mockAddDocumentsInBatches).not.toHaveBeenCalled();
+    expect(storedDoc?._meiliIndex).toBe(false);
+  });
+
+  test('saving hydrated legacy temporary conversations without isTemporary does NOT index', async () => {
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
+    await conversationModel.deleteMany({});
+    mockAddDocuments.mockClear();
+    mockUpdateDocuments.mockClear();
+    const conversationId = new mongoose.Types.ObjectId().toString();
+
+    await conversationModel.collection.insertOne({
+      conversationId,
+      user: new mongoose.Types.ObjectId().toString(),
+      title: 'Legacy Temporary Conversation',
+      endpoint: EModelEndpoint.openAI,
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+      _meiliIndex: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+
+    const legacyConvo = await conversationModel.findOne({ conversationId });
+    expect(legacyConvo).toBeTruthy();
+
+    legacyConvo!.title = 'Updated Legacy Temporary Conversation';
+    await legacyConvo!.save();
+    const storedDoc = await conversationModel.collection.findOne({ conversationId });
+
+    expect(mockAddDocuments).not.toHaveBeenCalled();
+    expect(mockUpdateDocuments).not.toHaveBeenCalled();
+    expect(storedDoc?._meiliIndex).toBe(false);
+  });
+
+  test('findOneAndUpdate on legacy temporary conversations without isTemporary does NOT index', async () => {
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
+    await conversationModel.deleteMany({});
+    mockAddDocuments.mockClear();
+    mockUpdateDocuments.mockClear();
+    const conversationId = new mongoose.Types.ObjectId().toString();
+
+    await conversationModel.collection.insertOne({
+      conversationId,
+      user: new mongoose.Types.ObjectId().toString(),
+      title: 'Legacy Temporary Conversation',
+      endpoint: EModelEndpoint.openAI,
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+      _meiliIndex: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+
+    await conversationModel.findOneAndUpdate(
+      { conversationId },
+      { $set: { title: 'Updated via findOneAndUpdate' } },
+      { new: true },
+    );
+    const storedDoc = await conversationModel.collection.findOne({ conversationId });
+
+    expect(mockAddDocuments).not.toHaveBeenCalled();
+    expect(mockUpdateDocuments).not.toHaveBeenCalled();
+    expect(storedDoc?._meiliIndex).toBe(false);
+  });
+
+  test('sync w/ meili excludes legacy temporary messages without isTemporary', async () => {
+    const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
+    await messageModel.deleteMany({});
+    mockAddDocumentsInBatches.mockClear();
+    const messageId = new mongoose.Types.ObjectId().toString();
+
+    await messageModel.collection.insertOne({
+      messageId,
+      conversationId: new mongoose.Types.ObjectId().toString(),
+      user: new mongoose.Types.ObjectId().toString(),
+      isCreatedByUser: true,
+      text: 'Legacy temporary message',
+      expiredAt: new Date(Date.now() + 60 * 60 * 1000),
+      _meiliIndex: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+
+    await messageModel.syncWithMeili();
+    const storedDoc = await messageModel.collection.findOne({ messageId });
+
+    expect(mockAddDocumentsInBatches).not.toHaveBeenCalled();
+    expect(storedDoc?._meiliIndex).toBe(false);
+  });
+
+  test('sync w/ meili treats null isTemporary with no expiration like missing legacy fields', async () => {
+    const modelName = `DynamicMeiliNullTemporary${new mongoose.Types.ObjectId().toString()}`;
+    const dynamicModel = createDynamicMeiliModel(modelName);
+    mockAddDocumentsInBatches.mockClear();
+
+    try {
+      await dynamicModel.collection.insertOne({
+        docId: 'legacy-null-temporary',
+        user: 'user-123',
+        title: 'Legacy Null Temporary',
+        isTemporary: null as unknown as boolean,
+        expiredAt: null,
+        _meiliIndex: false,
+      });
+
+      const progress = await dynamicModel.getSyncProgress();
+      await dynamicModel.syncWithMeili();
+      const storedDoc = await dynamicModel.collection.findOne({ docId: 'legacy-null-temporary' });
+
+      expect(progress.totalDocuments).toBe(1);
+      expect(mockAddDocumentsInBatches).toHaveBeenCalled();
+      expect(storedDoc?._meiliIndex).toBe(true);
+    } finally {
+      await mongoose.connection.dropCollection(modelName.toLowerCase()).catch(() => undefined);
+      delete mongoose.models[modelName];
+    }
+  });
+
+  test('sync queries use a fresh expiration cutoff after plugin initialization', async () => {
+    const modelName = `DynamicMeiliCutoff${new mongoose.Types.ObjectId().toString()}`;
+    const dynamicModel = createDynamicMeiliModel(modelName);
+    mockAddDocumentsInBatches.mockClear();
+
+    try {
+      await dynamicModel.collection.insertOne({
+        docId: 'expires-soon',
+        user: 'user-123',
+        title: 'Expires Soon',
+        isTemporary: false,
+        expiredAt: new Date(Date.now() + 25),
+        _meiliIndex: false,
+      });
+
+      await wait(100);
+
+      const progress = await dynamicModel.getSyncProgress();
+      await dynamicModel.syncWithMeili();
+      const storedDoc = await dynamicModel.collection.findOne({ docId: 'expires-soon' });
+
+      expect(progress.totalDocuments).toBe(0);
+      expect(mockAddDocumentsInBatches).not.toHaveBeenCalled();
+      expect(storedDoc?._meiliIndex).toBe(false);
+    } finally {
+      await dynamicModel.deleteMany({});
+      mongoose.deleteModel(modelName);
+    }
+  });
+
   describe('estimatedDocumentCount usage in syncWithMeili', () => {
     test('syncWithMeili completes successfully with estimatedDocumentCount', async () => {
       // Clear any previous documents
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Create test documents
@@ -261,7 +541,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili handles empty collection correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // Verify collection is empty
@@ -273,7 +553,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('estimatedDocumentCount returns count for non-empty collection', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Create documents
@@ -296,7 +578,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('estimatedDocumentCount is available on model', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       // Verify the method exists and is callable
       expect(typeof messageModel.estimatedDocumentCount).toBe('function');
@@ -308,7 +590,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili handles mix of syncable and TTL documents correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocuments.mockClear();
 
@@ -335,6 +617,7 @@ describe('Meilisearch Mongoose plugin', () => {
         conversationId: new mongoose.Types.ObjectId(),
         user: new mongoose.Types.ObjectId(),
         isCreatedByUser: true,
+        isTemporary: true,
         expiredAt: new Date(),
       });
 
@@ -343,6 +626,7 @@ describe('Meilisearch Mongoose plugin', () => {
         conversationId: new mongoose.Types.ObjectId(),
         user: new mongoose.Types.ObjectId(),
         isCreatedByUser: false,
+        isTemporary: true,
         expiredAt: new Date(),
       });
 
@@ -369,7 +653,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('New batch processing and retry functionality', () => {
     test('processSyncBatch uses addDocumentsInBatches', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
       mockAddDocuments.mockClear();
@@ -393,7 +679,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('addObjectToMeili retries on failure', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
 
       // Mock addDocuments to fail twice then succeed
       mockAddDocuments
@@ -417,7 +705,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress returns accurate progress information', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert documents directly to control the _meiliIndex flag
@@ -447,7 +737,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress excludes TTL documents from counts', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert syncable documents (expiredAt: null)
@@ -497,7 +789,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress shows completion when all syncable documents are indexed', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // All syncable documents are indexed
@@ -539,7 +831,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('Error handling in processSyncBatch', () => {
     test('syncWithMeili fails when processSyncBatch encounters addDocumentsInBatches error', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -571,7 +865,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili fails when processSyncBatch encounters updateMany error', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -603,7 +899,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('processSyncBatch logs error and throws when addDocumentsInBatches fails', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       mockAddDocumentsInBatches.mockRejectedValueOnce(new Error('Network timeout'));
@@ -629,7 +925,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('processSyncBatch handles empty document array gracefully', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       const indexMock = mockIndex();
 
       // Should not throw with empty array
@@ -640,7 +938,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili stops processing when batch fails and does not process remaining documents', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -671,7 +971,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('error in processSyncBatch is properly logged before being thrown', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const testError = new Error('Test error for logging');
@@ -694,7 +994,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili properly propagates processSyncBatch errors', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -735,7 +1037,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex deletes orphaned documents from MeiliSearch', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const existingConvoId = new mongoose.Types.ObjectId().toString();
@@ -769,7 +1073,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles offset correctly when documents are deleted', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const existingIds = [
@@ -825,7 +1129,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex preserves existing documents', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const existingId1 = new mongoose.Types.ObjectId().toString();
@@ -864,7 +1170,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles empty MeiliSearch index', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       // Mock empty MeiliSearch index
       mockGetDocuments.mockResolvedValueOnce({
@@ -880,7 +1186,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex stops when results.length < batchSize', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const id1 = new mongoose.Types.ObjectId().toString();
@@ -919,7 +1227,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles multiple batches correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const existingIds = Array.from({ length: 5 }, () => new mongoose.Types.ObjectId().toString());
@@ -975,7 +1283,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles delay between batches', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const id1 = new mongoose.Types.ObjectId().toString();
@@ -1022,7 +1332,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles errors gracefully', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       mockGetDocuments.mockRejectedValueOnce(new Error('MeiliSearch connection error'));
 
@@ -1035,7 +1345,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex with all documents being orphaned', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const orphanedId1 = new mongoose.Types.ObjectId().toString();
@@ -1059,7 +1371,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex adjusts offset to 0 when all batch documents are deleted', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const orphanedIds = Array.from({ length: 3 }, () => new mongoose.Types.ObjectId().toString());
@@ -1107,7 +1419,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('processSyncBatch does not modify updatedAt timestamps', () => {
     test('syncWithMeili preserves original updatedAt on conversations', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1158,7 +1472,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili preserves original updatedAt on messages', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1206,7 +1520,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('Missing _meiliIndex property handling in sync process', () => {
     test('syncWithMeili includes documents with missing _meiliIndex', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1261,7 +1577,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress counts documents with missing _meiliIndex as not indexed', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // Insert documents with different _meiliIndex states
@@ -1303,7 +1619,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('query with _meiliIndex: { $ne: true } includes missing values', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert documents with different _meiliIndex states
@@ -1347,7 +1665,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili processes all documents where _meiliIndex is not true', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1397,7 +1715,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili treats missing _meiliIndex same as false', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
diff --git a/packages/data-schemas/src/models/plugins/mongoMeili.ts b/packages/data-schemas/src/models/plugins/mongoMeili.ts
index 125e7bab712..0594c272b17 100644
--- a/packages/data-schemas/src/models/plugins/mongoMeili.ts
+++ b/packages/data-schemas/src/models/plugins/mongoMeili.ts
@@ -13,6 +13,7 @@ import type {
 } from 'mongoose';
 import type { IConversation, IMessage } from '~/types';
 import logger from '~/config/meiliLogger';
+import { buildRetentionVisibilityFilter, legacyPermanentExpirationFilter } from '~/utils/retention';
 
 interface MongoMeiliOptions {
   host: string;
@@ -38,6 +39,8 @@ interface SyncProgress {
 
 interface _DocumentWithMeiliIndex extends Document {
   _meiliIndex?: boolean;
+  isTemporary?: boolean;
+  expiredAt?: Date | null;
   preprocessObjectForIndex?: () => Record<string, unknown>;
   addObjectToMeili?: (next: CallbackWithoutResultAndOptionalError) => Promise<void>;
   updateObjectToMeili?: (next: CallbackWithoutResultAndOptionalError) => Promise<void>;
@@ -90,6 +93,49 @@ const getSyncConfig = () => ({
   delayMs: parseInt(process.env.MEILI_SYNC_DELAY_MS || '100', 10),
 });
 
+const hasSchemaPath = (schema: Schema, path: string): boolean =>
+  Object.prototype.hasOwnProperty.call(schema.obj, path);
+
+const explicitTemporaryFlagKey = 'meiliExplicitTemporaryFlag';
+
+const buildIndexableQuery = (schema: Schema): FilterQuery<unknown> => {
+  if (!hasSchemaPath(schema, 'isTemporary')) {
+    return hasSchemaPath(schema, 'expiredAt') ? legacyPermanentExpirationFilter() : {};
+  }
+
+  return buildRetentionVisibilityFilter();
+};
+
+const hasActiveExpiration = (expiredAt?: Date | null): boolean =>
+  _.isNil(expiredAt) || new Date(expiredAt).getTime() > Date.now();
+
+/**
+ * `isTemporary` defaults to `false` on the schema, so hydrated legacy documents
+ * can appear non-temporary even when the field is absent from MongoDB. `$isDefault`
+ * lets us distinguish that schema default from an explicit stored flag, and
+ * `$locals` carries the pre-save answer into post hooks after Mongoose mutates
+ * document state.
+ */
+const hasExplicitTemporaryFlag = (doc: DocumentWithMeiliIndex): boolean =>
+  typeof doc.$locals?.[explicitTemporaryFlagKey] === 'boolean'
+    ? (doc.$locals[explicitTemporaryFlagKey] as boolean)
+    : doc.isTemporary != null && !doc.$isDefault('isTemporary');
+
+const captureExplicitTemporaryFlag = (doc: DocumentWithMeiliIndex): void => {
+  doc.$locals[explicitTemporaryFlagKey] = doc.isTemporary != null && !doc.$isDefault('isTemporary');
+};
+
+/**
+ * Index only retained non-temporary records whose flag was explicitly stored,
+ * plus legacy permanent records that have no retention deadline. Legacy records
+ * with an expiration are treated as temporary and stay out of search.
+ */
+const isIndexableDocument = (doc: DocumentWithMeiliIndex): boolean =>
+  (doc.isTemporary === false &&
+    hasExplicitTemporaryFlag(doc) &&
+    hasActiveExpiration(doc.expiredAt)) ||
+  (!hasExplicitTemporaryFlag(doc) && _.isNil(doc.expiredAt));
+
 /**
  * Validates the required options for configuring the mongoMeili plugin.
  */
@@ -136,11 +182,13 @@ const processBatch = async <T>(
  */
 const createMeiliMongooseModel = ({
   index,
+  getIndexableQuery,
   attributesToIndex,
   primaryKey,
   syncOptions,
 }: {
   index: Index<MeiliIndexable>;
+  getIndexableQuery: () => FilterQuery<unknown>;
   attributesToIndex: string[];
   primaryKey: string;
   syncOptions: { batchSize: number; delayMs: number };
@@ -152,8 +200,12 @@ const createMeiliMongooseModel = ({
      * Get the current sync progress
      */
     static async getSyncProgress(this: SchemaWithMeiliMethods): Promise<SyncProgress> {
-      const totalDocuments = await this.countDocuments({ expiredAt: null });
-      const indexedDocuments = await this.countDocuments({ expiredAt: null, _meiliIndex: true });
+      const indexableQuery = getIndexableQuery();
+      const totalDocuments = await this.countDocuments(indexableQuery);
+      const indexedDocuments = await this.countDocuments({
+        ...indexableQuery,
+        _meiliIndex: true,
+      });
 
       return {
         totalProcessed: indexedDocuments,
@@ -164,8 +216,7 @@ const createMeiliMongooseModel = ({
 
     /**
      * Synchronizes data between the MongoDB collection and the MeiliSearch index by
-     * incrementally indexing only documents where `expiredAt` is `null` and `_meiliIndex` is not `true`
-     * (i.e., non-expired documents that have not yet been indexed, including those with missing or null `_meiliIndex`).
+     * incrementally indexing only non-temporary documents where `_meiliIndex` is not `true`.
      * */
     static async syncWithMeili(this: SchemaWithMeiliMethods): Promise<void> {
       const startTime = Date.now();
@@ -196,8 +247,9 @@ const createMeiliMongooseModel = ({
       let hasMore = true;
 
       while (hasMore) {
+        const indexableQuery = getIndexableQuery();
         const query: FilterQuery<unknown> = {
-          expiredAt: null,
+          ...indexableQuery,
           _meiliIndex: { $ne: true },
         };
 
@@ -299,8 +351,9 @@ const createMeiliMongooseModel = ({
           const query: Record<string, unknown> = {};
           query[primaryKey] = { $in: meiliIds };
 
-          // Find which documents exist in MongoDB
-          const existingDocs = await this.find(query).select(primaryKey).lean();
+          const existingDocs = await this.find({ ...query, ...getIndexableQuery() })
+            .select(primaryKey)
+            .lean();
 
           const existingIds = new Set(
             existingDocs.map((doc: Record<string, unknown>) => doc[primaryKey]),
@@ -413,8 +466,7 @@ const createMeiliMongooseModel = ({
       this: DocumentWithMeiliIndex,
       next: CallbackWithoutResultAndOptionalError,
     ): Promise<void> {
-      // If this conversation or message has a TTL, don't index it
-      if (!_.isNil(this.expiredAt)) {
+      if (!isIndexableDocument(this)) {
         return next();
       }
 
@@ -459,6 +511,16 @@ const createMeiliMongooseModel = ({
       next: CallbackWithoutResultAndOptionalError,
     ): Promise<void> {
       try {
+        if (!isIndexableDocument(this)) {
+          await index.deleteDocument(String(this[primaryKey as keyof DocumentWithMeiliIndex]));
+          const model = this.constructor as Model<DocumentWithMeiliIndex>;
+          await model.updateOne(
+            { _id: this._id as Types.ObjectId },
+            { $set: { _meiliIndex: false } },
+          );
+          return next();
+        }
+
         const object = this.preprocessObjectForIndex!();
         await index.updateDocuments([object], { primaryKey });
         next();
@@ -644,9 +706,24 @@ export default function mongoMeili(schema: Schema, options: MongoMeiliOptions):
     logger.debug(`[mongoMeili] Added 'user' field to ${indexName} index attributes`);
   }
 
-  schema.loadClass(createMeiliMongooseModel({ index, attributesToIndex, primaryKey, syncOptions }));
+  schema.loadClass(
+    createMeiliMongooseModel({
+      index,
+      getIndexableQuery: () => buildIndexableQuery(schema),
+      attributesToIndex,
+      primaryKey,
+      syncOptions,
+    }),
+  );
 
   // Register Mongoose hooks
+  schema.pre('save', function (this: DocumentWithMeiliIndex, next) {
+    if (hasSchemaPath(schema, 'isTemporary')) {
+      captureExplicitTemporaryFlag(this);
+    }
+    next();
+  });
+
   schema.post('save', function (doc: DocumentWithMeiliIndex, next) {
     doc.postSaveHook?.(next);
   });
diff --git a/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
new file mode 100644
index 00000000000..6f318abe10a
--- /dev/null
+++ b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
@@ -0,0 +1,56 @@
+import mongoose from 'mongoose';
+import { createModels } from '../index';
+
+/**
+ * Global symbol set by applyTenantIsolation() on every schema it processes.
+ * Recreated here via Symbol.for (the global registry) so the guard can detect
+ * plugin application without the plugin exporting anything.
+ */
+const TENANT_ISOLATION_APPLIED = Symbol.for('librechat:tenantIsolation');
+
+/**
+ * Models that carry a `tenantId` field but intentionally do NOT use the
+ * tenant-isolation plugin. SystemGrant scopes tenancy manually inside its
+ * methods (see models/systemGrant). SkillSyncStatus stores both app-wide YAML
+ * status rows and tenant-scoped override rows, so its methods apply explicit
+ * tenant filters instead of ambient ALS scoping. AuditLog composes its tenant
+ * filter from the JWT-resolved caller and uses `{ tenantId: { $exists: false } }`
+ * for platform-level entries. Adding an entry here must be a deliberate,
+ * reviewed decision — that is the whole point of this guard.
+ */
+const MANUAL_TENANT_SCOPING = new Set<string>(['SystemGrant', 'SkillSyncStatus', 'AuditLog']);
+
+function isPluginApplied(schema: mongoose.Schema): boolean {
+  return (schema as unknown as { [key: symbol]: boolean })[TENANT_ISOLATION_APPLIED] === true;
+}
+
+describe('tenant-isolation plugin coverage', () => {
+  beforeAll(() => {
+    createModels(mongoose);
+  });
+
+  it('applies the tenant-isolation plugin to every model that has a tenantId field', () => {
+    const missing: string[] = [];
+
+    for (const [name, model] of Object.entries(mongoose.models)) {
+      const hasTenantId = Boolean(model.schema.path('tenantId'));
+      if (!hasTenantId || MANUAL_TENANT_SCOPING.has(name)) {
+        continue;
+      }
+      if (!isPluginApplied(model.schema)) {
+        missing.push(name);
+      }
+    }
+
+    expect(missing).toEqual([]);
+  });
+
+  it('keeps the manual-scoping allowlist accurate (tenantId field, no plugin)', () => {
+    for (const name of MANUAL_TENANT_SCOPING) {
+      const model = mongoose.models[name];
+      expect(model).toBeDefined();
+      expect(Boolean(model.schema.path('tenantId'))).toBe(true);
+      expect(isPluginApplied(model.schema)).toBe(false);
+    }
+  });
+});
diff --git a/packages/data-schemas/src/models/plugins/tenantIsolation.spec.ts b/packages/data-schemas/src/models/plugins/tenantIsolation.spec.ts
index 82e74d2ceac..ba65e17be8e 100644
--- a/packages/data-schemas/src/models/plugins/tenantIsolation.spec.ts
+++ b/packages/data-schemas/src/models/plugins/tenantIsolation.spec.ts
@@ -154,6 +154,35 @@ describe('applyTenantIsolation', () => {
       const tenantADoc = await TestModel.findOne({ tenantId: 'tenant-a' }).lean();
       expect(tenantADoc!.name).toBe('updated');
     });
+
+    it('injects tenantId filter into distinct', async () => {
+      const names = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+        TestModel.distinct('name'),
+      );
+
+      expect(names).toEqual(['tenant-a-doc']);
+    });
+
+    it('injects tenantId filter into find().distinct() (op switches to distinct)', async () => {
+      const names = await tenantStorage.run({ tenantId: 'tenant-b' }, async () =>
+        TestModel.find().distinct('name'),
+      );
+
+      expect(names).toEqual(['tenant-b-doc']);
+    });
+
+    it('does not scope distinct when context is absent (non-strict)', async () => {
+      const names = await TestModel.distinct('name');
+      expect(names.sort()).toEqual(['no-tenant-doc', 'tenant-a-doc', 'tenant-b-doc']);
+    });
+
+    it('bypasses distinct filter for SYSTEM_TENANT_ID', async () => {
+      const names = await tenantStorage.run({ tenantId: SYSTEM_TENANT_ID }, async () =>
+        TestModel.distinct('name'),
+      );
+
+      expect(names).toHaveLength(3);
+    });
   });
 
   describe('aggregate filtering', () => {
diff --git a/packages/data-schemas/src/models/plugins/tenantIsolation.ts b/packages/data-schemas/src/models/plugins/tenantIsolation.ts
index 06f8e035fb2..14506103452 100644
--- a/packages/data-schemas/src/models/plugins/tenantIsolation.ts
+++ b/packages/data-schemas/src/models/plugins/tenantIsolation.ts
@@ -137,6 +137,7 @@ export function applyTenantIsolation(schema: Schema): void {
 
   schema.pre('find', queryMiddleware);
   schema.pre('findOne', queryMiddleware);
+  schema.pre('distinct', queryMiddleware);
   schema.pre('findOneAndUpdate', queryMiddleware);
   schema.pre('findOneAndDelete', queryMiddleware);
   schema.pre('findOneAndReplace', queryMiddleware);
diff --git a/packages/data-schemas/src/models/preset.ts b/packages/data-schemas/src/models/preset.ts
index dc61c6d251f..07b979b4381 100644
--- a/packages/data-schemas/src/models/preset.ts
+++ b/packages/data-schemas/src/models/preset.ts
@@ -1,7 +1,8 @@
-import presetSchema, { IPreset } from '~/schema/preset';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import presetSchema, { IPreset } from '~/schema/preset';
 
-export function createPresetModel(mongoose: typeof import('mongoose')) {
+export function createPresetModel(mongoose: typeof import('mongoose')): Model<IPreset> {
   applyTenantIsolation(presetSchema);
   return mongoose.models.Preset || mongoose.model<IPreset>('Preset', presetSchema);
 }
diff --git a/packages/data-schemas/src/models/prompt.ts b/packages/data-schemas/src/models/prompt.ts
index 25ff23e81af..939bd575104 100644
--- a/packages/data-schemas/src/models/prompt.ts
+++ b/packages/data-schemas/src/models/prompt.ts
@@ -1,8 +1,9 @@
-import promptSchema from '~/schema/prompt';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPrompt } from '~/types/prompts';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import promptSchema from '~/schema/prompt';
 
-export function createPromptModel(mongoose: typeof import('mongoose')) {
+export function createPromptModel(mongoose: typeof import('mongoose')): Model<IPrompt> {
   applyTenantIsolation(promptSchema);
   return mongoose.models.Prompt || mongoose.model<IPrompt>('Prompt', promptSchema);
 }
diff --git a/packages/data-schemas/src/models/promptGroup.ts b/packages/data-schemas/src/models/promptGroup.ts
index 2d1d2269888..22d4b5ced0c 100644
--- a/packages/data-schemas/src/models/promptGroup.ts
+++ b/packages/data-schemas/src/models/promptGroup.ts
@@ -1,8 +1,11 @@
-import promptGroupSchema from '~/schema/promptGroup';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPromptGroupDocument } from '~/types/prompts';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import promptGroupSchema from '~/schema/promptGroup';
 
-export function createPromptGroupModel(mongoose: typeof import('mongoose')) {
+export function createPromptGroupModel(
+  mongoose: typeof import('mongoose'),
+): Model<IPromptGroupDocument> {
   applyTenantIsolation(promptGroupSchema);
   return (
     mongoose.models.PromptGroup ||
diff --git a/packages/data-schemas/src/models/role.ts b/packages/data-schemas/src/models/role.ts
index 28600070441..fec17004a34 100644
--- a/packages/data-schemas/src/models/role.ts
+++ b/packages/data-schemas/src/models/role.ts
@@ -1,8 +1,9 @@
-import roleSchema from '~/schema/role';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IRole } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import roleSchema from '~/schema/role';
 
-export function createRoleModel(mongoose: typeof import('mongoose')) {
+export function createRoleModel(mongoose: typeof import('mongoose')): Model<IRole> {
   applyTenantIsolation(roleSchema);
   return mongoose.models.Role || mongoose.model<IRole>('Role', roleSchema);
 }
diff --git a/packages/data-schemas/src/models/session.ts b/packages/data-schemas/src/models/session.ts
index 746f9a74ddc..157a1ef770c 100644
--- a/packages/data-schemas/src/models/session.ts
+++ b/packages/data-schemas/src/models/session.ts
@@ -1,8 +1,9 @@
-import sessionSchema from '~/schema/session';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import sessionSchema from '~/schema/session';
 
-export function createSessionModel(mongoose: typeof import('mongoose')) {
+export function createSessionModel(mongoose: typeof import('mongoose')): Model<t.ISession> {
   applyTenantIsolation(sessionSchema);
   return mongoose.models.Session || mongoose.model<t.ISession>('Session', sessionSchema);
 }
diff --git a/packages/data-schemas/src/models/sharedLink.ts b/packages/data-schemas/src/models/sharedLink.ts
index f379c4605cf..b84327431f7 100644
--- a/packages/data-schemas/src/models/sharedLink.ts
+++ b/packages/data-schemas/src/models/sharedLink.ts
@@ -1,7 +1,8 @@
-import shareSchema, { ISharedLink } from '~/schema/share';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import shareSchema, { ISharedLink } from '~/schema/share';
 
-export function createSharedLinkModel(mongoose: typeof import('mongoose')) {
+export function createSharedLinkModel(mongoose: typeof import('mongoose')): Model<ISharedLink> {
   applyTenantIsolation(shareSchema);
   return mongoose.models.SharedLink || mongoose.model<ISharedLink>('SharedLink', shareSchema);
 }
diff --git a/packages/data-schemas/src/models/skill.ts b/packages/data-schemas/src/models/skill.ts
index 588523f3de0..efe93f08bfa 100644
--- a/packages/data-schemas/src/models/skill.ts
+++ b/packages/data-schemas/src/models/skill.ts
@@ -1,8 +1,9 @@
-import skillSchema from '~/schema/skill';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { ISkillDocument } from '~/types/skill';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import skillSchema from '~/schema/skill';
 
-export function createSkillModel(mongoose: typeof import('mongoose')) {
+export function createSkillModel(mongoose: typeof import('mongoose')): Model<ISkillDocument> {
   applyTenantIsolation(skillSchema);
   return mongoose.models.Skill || mongoose.model<ISkillDocument>('Skill', skillSchema);
 }
diff --git a/packages/data-schemas/src/models/skillFile.ts b/packages/data-schemas/src/models/skillFile.ts
index 230a2449106..94380d86d97 100644
--- a/packages/data-schemas/src/models/skillFile.ts
+++ b/packages/data-schemas/src/models/skillFile.ts
@@ -1,8 +1,11 @@
-import skillFileSchema from '~/schema/skillFile';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { ISkillFileDocument } from '~/types/skill';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import skillFileSchema from '~/schema/skillFile';
 
-export function createSkillFileModel(mongoose: typeof import('mongoose')) {
+export function createSkillFileModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillFileDocument> {
   applyTenantIsolation(skillFileSchema);
   return (
     mongoose.models.SkillFile || mongoose.model<ISkillFileDocument>('SkillFile', skillFileSchema)
diff --git a/packages/data-schemas/src/models/skillSyncCredential.ts b/packages/data-schemas/src/models/skillSyncCredential.ts
new file mode 100644
index 00000000000..4e0e636fb65
--- /dev/null
+++ b/packages/data-schemas/src/models/skillSyncCredential.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { ISkillSyncCredentialDocument } from '~/types/skillSync';
+import skillSyncCredentialSchema from '~/schema/skillSyncCredential';
+
+export function createSkillSyncCredentialModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillSyncCredentialDocument> {
+  // GitHub skill sync is intentionally app-wide in v1; credentials are referenced by
+  // admin-managed config keys and are never returned by tenant-scoped APIs.
+  return (
+    mongoose.models.SkillSyncCredential ||
+    mongoose.model<ISkillSyncCredentialDocument>('SkillSyncCredential', skillSyncCredentialSchema)
+  );
+}
diff --git a/packages/data-schemas/src/models/skillSyncStatus.ts b/packages/data-schemas/src/models/skillSyncStatus.ts
new file mode 100644
index 00000000000..9b15c65ae68
--- /dev/null
+++ b/packages/data-schemas/src/models/skillSyncStatus.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { ISkillSyncStatusDocument } from '~/types/skillSync';
+import skillSyncStatusSchema from '~/schema/skillSyncStatus';
+
+export function createSkillSyncStatusModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillSyncStatusDocument> {
+  // GitHub skill sync status supports app-wide YAML sources and tenant-scoped
+  // resolved config sources from admin overrides.
+  return (
+    mongoose.models.SkillSyncStatus ||
+    mongoose.model<ISkillSyncStatusDocument>('SkillSyncStatus', skillSyncStatusSchema)
+  );
+}
diff --git a/packages/data-schemas/src/models/systemGrant.ts b/packages/data-schemas/src/models/systemGrant.ts
index e30b444c654..057e1cff793 100644
--- a/packages/data-schemas/src/models/systemGrant.ts
+++ b/packages/data-schemas/src/models/systemGrant.ts
@@ -1,3 +1,4 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import systemGrantSchema from '~/schema/systemGrant';
 
@@ -7,7 +8,7 @@ import systemGrantSchema from '~/schema/systemGrant';
  * Do NOT apply tenant isolation plugin here; it would inject a hard tenantId equality
  * filter that conflicts with the $and/$or logic in hasCapabilityForPrincipals.
  */
-export function createSystemGrantModel(mongoose: typeof import('mongoose')) {
+export function createSystemGrantModel(mongoose: typeof import('mongoose')): Model<t.ISystemGrant> {
   return (
     mongoose.models.SystemGrant || mongoose.model<t.ISystemGrant>('SystemGrant', systemGrantSchema)
   );
diff --git a/packages/data-schemas/src/models/token.ts b/packages/data-schemas/src/models/token.ts
index 0cdefab0d92..5e187d2a621 100644
--- a/packages/data-schemas/src/models/token.ts
+++ b/packages/data-schemas/src/models/token.ts
@@ -1,8 +1,9 @@
-import tokenSchema from '~/schema/token';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import tokenSchema from '~/schema/token';
 
-export function createTokenModel(mongoose: typeof import('mongoose')) {
+export function createTokenModel(mongoose: typeof import('mongoose')): Model<t.IToken> {
   applyTenantIsolation(tokenSchema);
   return mongoose.models.Token || mongoose.model<t.IToken>('Token', tokenSchema);
 }
diff --git a/packages/data-schemas/src/models/toolCall.ts b/packages/data-schemas/src/models/toolCall.ts
index 262aade342a..1917f519819 100644
--- a/packages/data-schemas/src/models/toolCall.ts
+++ b/packages/data-schemas/src/models/toolCall.ts
@@ -1,7 +1,8 @@
-import toolCallSchema, { IToolCallData } from '~/schema/toolCall';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import toolCallSchema, { IToolCallData } from '~/schema/toolCall';
 
-export function createToolCallModel(mongoose: typeof import('mongoose')) {
+export function createToolCallModel(mongoose: typeof import('mongoose')): Model<IToolCallData> {
   applyTenantIsolation(toolCallSchema);
   return mongoose.models.ToolCall || mongoose.model<IToolCallData>('ToolCall', toolCallSchema);
 }
diff --git a/packages/data-schemas/src/models/transaction.ts b/packages/data-schemas/src/models/transaction.ts
index 358ead23a72..4e2392e1d81 100644
--- a/packages/data-schemas/src/models/transaction.ts
+++ b/packages/data-schemas/src/models/transaction.ts
@@ -1,7 +1,8 @@
-import transactionSchema, { ITransaction } from '~/schema/transaction';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import transactionSchema, { ITransaction } from '~/schema/transaction';
 
-export function createTransactionModel(mongoose: typeof import('mongoose')) {
+export function createTransactionModel(mongoose: typeof import('mongoose')): Model<ITransaction> {
   applyTenantIsolation(transactionSchema);
   return (
     mongoose.models.Transaction || mongoose.model<ITransaction>('Transaction', transactionSchema)
diff --git a/packages/data-schemas/src/models/user.ts b/packages/data-schemas/src/models/user.ts
index 18a1da2b0ba..5908018299c 100644
--- a/packages/data-schemas/src/models/user.ts
+++ b/packages/data-schemas/src/models/user.ts
@@ -1,8 +1,9 @@
-import userSchema from '~/schema/user';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import userSchema from '~/schema/user';
 
-export function createUserModel(mongoose: typeof import('mongoose')) {
+export function createUserModel(mongoose: typeof import('mongoose')): Model<t.IUser> {
   applyTenantIsolation(userSchema);
   return mongoose.models.User || mongoose.model<t.IUser>('User', userSchema);
 }
diff --git a/packages/data-schemas/src/schema/accessRole.ts b/packages/data-schemas/src/schema/accessRole.ts
index 9b5bd490102..b0a07a7c3e4 100644
--- a/packages/data-schemas/src/schema/accessRole.ts
+++ b/packages/data-schemas/src/schema/accessRole.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAccessRole } from '~/types';
 
-const accessRoleSchema = new Schema<IAccessRole>(
+const accessRoleSchema: Schema<IAccessRole> = new Schema<IAccessRole>(
   {
     accessRoleId: {
       type: String,
@@ -15,7 +15,16 @@ const accessRoleSchema = new Schema<IAccessRole>(
     description: String,
     resourceType: {
       type: String,
-      enum: ['agent', 'project', 'file', 'promptGroup', 'mcpServer', 'remoteAgent', 'skill'],
+      enum: [
+        'agent',
+        'project',
+        'file',
+        'promptGroup',
+        'mcpServer',
+        'remoteAgent',
+        'skill',
+        'sharedLink',
+      ],
       required: true,
       default: 'agent',
     },
diff --git a/packages/data-schemas/src/schema/aclEntry.ts b/packages/data-schemas/src/schema/aclEntry.ts
index c612ee2886d..562d4e5b211 100644
--- a/packages/data-schemas/src/schema/aclEntry.ts
+++ b/packages/data-schemas/src/schema/aclEntry.ts
@@ -3,7 +3,7 @@ import { PrincipalType, PrincipalModel, ResourceType } from 'librechat-data-prov
 import type { IAclEntry } from '~/types';
 import { MAX_PERM_BITS } from '~/common/permissions';
 
-const aclEntrySchema = new Schema<IAclEntry>(
+const aclEntrySchema: Schema<IAclEntry> = new Schema<IAclEntry>(
   {
     principalType: {
       type: String,
@@ -62,6 +62,9 @@ const aclEntrySchema = new Schema<IAclEntry>(
       type: Date,
       default: Date.now,
     },
+    expiredAt: {
+      type: Date,
+    },
     tenantId: {
       type: String,
       index: true,
@@ -79,5 +82,8 @@ aclEntrySchema.index({
 });
 aclEntrySchema.index({ resourceId: 1, principalType: 1, principalId: 1, tenantId: 1 });
 aclEntrySchema.index({ principalId: 1, permBits: 1, resourceType: 1, tenantId: 1 });
+/** Covers `findPublicResourceIds` and the public branch of `findAccessibleResources`. */
+aclEntrySchema.index({ principalType: 1, resourceType: 1, permBits: 1, resourceId: 1 });
+aclEntrySchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 
 export default aclEntrySchema;
diff --git a/packages/data-schemas/src/schema/action.ts b/packages/data-schemas/src/schema/action.ts
index 5cde2ad6fca..771b0301f1b 100644
--- a/packages/data-schemas/src/schema/action.ts
+++ b/packages/data-schemas/src/schema/action.ts
@@ -16,7 +16,7 @@ const AuthSchema = new Schema(
   { _id: false },
 );
 
-const Action = new Schema<IAction>({
+const Action: mongoose.Schema<IAction> = new Schema<IAction>({
   user: {
     type: mongoose.Schema.Types.ObjectId,
     ref: 'User',
diff --git a/packages/data-schemas/src/schema/agent.ts b/packages/data-schemas/src/schema/agent.ts
index 33e1a92d6f5..5ef6a9cf0d7 100644
--- a/packages/data-schemas/src/schema/agent.ts
+++ b/packages/data-schemas/src/schema/agent.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAgent } from '~/types';
 
-const agentSchema = new Schema<IAgent>(
+const agentSchema: Schema<IAgent> = new Schema<IAgent>(
   {
     id: {
       type: String,
diff --git a/packages/data-schemas/src/schema/agentCategory.ts b/packages/data-schemas/src/schema/agentCategory.ts
index 2922042129f..e8d611fb05d 100644
--- a/packages/data-schemas/src/schema/agentCategory.ts
+++ b/packages/data-schemas/src/schema/agentCategory.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAgentCategory } from '~/types';
 
-const agentCategorySchema = new Schema<IAgentCategory>(
+const agentCategorySchema: Schema<IAgentCategory> = new Schema<IAgentCategory>(
   {
     value: {
       type: String,
diff --git a/packages/data-schemas/src/schema/assistant.ts b/packages/data-schemas/src/schema/assistant.ts
index 3fc052d4584..da2c86b7620 100644
--- a/packages/data-schemas/src/schema/assistant.ts
+++ b/packages/data-schemas/src/schema/assistant.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAssistant } from '~/types';
 
-const assistantSchema = new Schema<IAssistant>(
+const assistantSchema: Schema<IAssistant> = new Schema<IAssistant>(
   {
     user: {
       type: Schema.Types.ObjectId,
diff --git a/packages/data-schemas/src/schema/auditLog.ts b/packages/data-schemas/src/schema/auditLog.ts
new file mode 100644
index 00000000000..51a33f7a735
--- /dev/null
+++ b/packages/data-schemas/src/schema/auditLog.ts
@@ -0,0 +1,182 @@
+import { Schema } from 'mongoose';
+import type { IAuditLog } from '~/types';
+import {
+  AUDIT_ACTIONS,
+  AUDIT_ACTOR_TYPES,
+  AUDIT_CATEGORIES,
+  AUDIT_OUTCOMES,
+  AUDIT_SEVERITIES,
+} from '~/types/admin';
+
+/** Sentinel `chainKey` for platform-level (non-tenant) audit entries. */
+export const PLATFORM_CHAIN_KEY = '__platform__';
+
+/** Genesis link: the `prevHash` of the first entry in any chain. */
+export const GENESIS_HASH: string = '0'.repeat(64);
+
+const actorSchema = new Schema(
+  {
+    type: { type: String, enum: [...AUDIT_ACTOR_TYPES], required: true, immutable: true },
+    id: { type: String, required: false, immutable: true },
+    name: { type: String, required: true, immutable: true },
+  },
+  { _id: false },
+);
+
+const targetSchema = new Schema(
+  {
+    type: { type: String, required: true, immutable: true },
+    id: { type: String, required: false, immutable: true },
+    name: { type: String, required: false, immutable: true },
+  },
+  { _id: false },
+);
+
+const contextSchema = new Schema(
+  {
+    requestId: { type: String, required: false, immutable: true },
+    ip: { type: String, required: false, immutable: true },
+    userAgent: { type: String, required: false, immutable: true },
+    sessionId: { type: String, required: false, immutable: true },
+  },
+  { _id: false },
+);
+
+/**
+ * Append-only by schema contract: every field is `immutable`, every
+ * update-style operation is short-circuited in the pre-hooks below, and there
+ * is no `updatedAt` — a mutable timestamp would imply mutation is allowed.
+ * `createdAt` is set explicitly by the writer (not by `timestamps`) so it is
+ * covered by the per-entry hash. Tamper-evidence beyond these app-layer guards
+ * comes from the hash chain (`prevHash`/`hash`/`seq`) maintained in
+ * `~/methods/auditLog`.
+ */
+const auditLogSchema: Schema<IAuditLog> = new Schema<IAuditLog>({
+  schemaVersion: { type: Number, required: true, immutable: true },
+  category: {
+    type: String,
+    enum: [...AUDIT_CATEGORIES],
+    required: true,
+    immutable: true,
+  },
+  action: {
+    type: String,
+    enum: [...AUDIT_ACTIONS],
+    required: true,
+    immutable: true,
+  },
+  outcome: {
+    type: String,
+    enum: [...AUDIT_OUTCOMES],
+    required: true,
+    immutable: true,
+  },
+  severity: {
+    type: String,
+    enum: [...AUDIT_SEVERITIES],
+    required: true,
+    immutable: true,
+  },
+  actor: { type: actorSchema, required: true, immutable: true },
+  target: { type: targetSchema, required: true, immutable: true },
+  /** Event-specific payload (e.g. `{ capability }` for grants). Open by design;
+   * never store raw prompts, secrets, or full tool outputs here. */
+  metadata: { type: Schema.Types.Mixed, required: false, immutable: true },
+  context: { type: contextSchema, required: false, immutable: true },
+  /**
+   * Platform-level entries MUST omit this field entirely — never set it to null.
+   * Tenant-scoped queries derive `chainKey` from `tenantId`; absence here maps
+   * to the platform chain.
+   */
+  tenantId: {
+    type: String,
+    required: false,
+    immutable: true,
+    validate: {
+      validator: (v: unknown) => typeof v === 'string' && v.trim().length > 0,
+      message:
+        'tenantId must be a non-empty string or omitted entirely — never null, empty, or a non-string value',
+    },
+  },
+  chainKey: { type: String, required: true, immutable: true },
+  seq: { type: Number, required: true, immutable: true },
+  prevHash: { type: String, required: true, immutable: true },
+  hash: { type: String, required: true, immutable: true },
+  createdAt: { type: Date, required: true, immutable: true },
+});
+
+const APPEND_ONLY_MESSAGE = 'AuditLog is append-only — updates and deletes are forbidden';
+
+/** Block every query-level update path. */
+auditLogSchema.pre(
+  ['updateOne', 'updateMany', 'findOneAndUpdate', 'findOneAndReplace', 'replaceOne'],
+  function (next) {
+    next(new Error(APPEND_ONLY_MESSAGE));
+  },
+);
+
+/** Block every query-level delete path. */
+auditLogSchema.pre(['deleteOne', 'deleteMany', 'findOneAndDelete'], function (next) {
+  next(new Error(APPEND_ONLY_MESSAGE));
+});
+
+/**
+ * Mongoose registers `deleteOne` / `updateOne` pre-hooks as query middleware
+ * by default, leaving `Document.prototype.deleteOne()` and
+ * `Document.prototype.updateOne()` as escape hatches: a caller holding a loaded
+ * doc could invoke either on the instance and bypass the query-level hooks.
+ * The explicit `{ document: true, query: false }` registrations close both.
+ */
+auditLogSchema.pre('deleteOne', { document: true, query: false }, function (next) {
+  next(new Error(APPEND_ONLY_MESSAGE));
+});
+auditLogSchema.pre('updateOne', { document: true, query: false }, function (next) {
+  next(new Error(APPEND_ONLY_MESSAGE));
+});
+
+/** Document-level `save` is allowed for new docs only; a second save mutates. */
+auditLogSchema.pre('save', function (next) {
+  if (!this.isNew) {
+    next(new Error(APPEND_ONLY_MESSAGE));
+    return;
+  }
+  next();
+});
+
+/**
+ * `Model.bulkWrite()` dispatches update/delete operations through the raw driver
+ * and skips the query/document middleware above. Block it wholesale: audit rows
+ * are only ever written via `recordAuditEntry` (`Model.create`), and a bulk
+ * insert would also break the sequential hash chain, so there is no legitimate
+ * bulkWrite path. The privileged retention purge uses `Model.collection` and is
+ * unaffected by this hook.
+ */
+auditLogSchema.pre('bulkWrite', function (next) {
+  next(new Error(APPEND_ONLY_MESSAGE));
+});
+
+/**
+ * `Model.insertMany()` is another bulk path that skips the document `save`
+ * hook, so it could insert rows with attacker-chosen `seq`/`prevHash`/`hash`
+ * and poison the chain. Entries are only ever written one-at-a-time via
+ * `recordAuditEntry` (`Model.create`), so block bulk inserts outright.
+ */
+auditLogSchema.pre('insertMany', function (next) {
+  next(new Error(APPEND_ONLY_MESSAGE));
+});
+
+/**
+ * Unique per-chain sequence. This is both the keyset-pagination key and the
+ * integrity backstop: concurrent appends race to claim the next `seq`, one wins,
+ * and the losers retry — so the chain can never fork.
+ */
+auditLogSchema.index({ chainKey: 1, seq: 1 }, { unique: true });
+
+/** Primary listing: newest-first within a chain, bounded by a date window. */
+auditLogSchema.index({ chainKey: 1, createdAt: -1, seq: -1 });
+
+/** Faceted reads. */
+auditLogSchema.index({ chainKey: 1, category: 1, createdAt: -1 });
+auditLogSchema.index({ chainKey: 1, 'target.type': 1, 'target.id': 1, createdAt: -1 });
+
+export default auditLogSchema;
diff --git a/packages/data-schemas/src/schema/balance.ts b/packages/data-schemas/src/schema/balance.ts
index 07c94b71f8e..4314d1f2cf9 100644
--- a/packages/data-schemas/src/schema/balance.ts
+++ b/packages/data-schemas/src/schema/balance.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { REFILL_INTERVAL_UNITS } from 'librechat-data-provider';
 import type * as t from '~/types';
 
-const balanceSchema = new Schema<t.IBalance>({
+const balanceSchema: Schema<t.IBalance> = new Schema<t.IBalance>({
   user: {
     type: Schema.Types.ObjectId,
     ref: 'User',
diff --git a/packages/data-schemas/src/schema/banner.ts b/packages/data-schemas/src/schema/banner.ts
index 73baa92b2fe..6c369c199de 100644
--- a/packages/data-schemas/src/schema/banner.ts
+++ b/packages/data-schemas/src/schema/banner.ts
@@ -11,7 +11,7 @@ export interface IBanner extends Document {
   tenantId?: string;
 }
 
-const bannerSchema = new Schema<IBanner>(
+const bannerSchema: Schema<IBanner> = new Schema<IBanner>(
   {
     bannerId: {
       type: String,
diff --git a/packages/data-schemas/src/schema/categories.ts b/packages/data-schemas/src/schema/categories.ts
index 94832b54de8..6fa3ab1e6b0 100644
--- a/packages/data-schemas/src/schema/categories.ts
+++ b/packages/data-schemas/src/schema/categories.ts
@@ -6,7 +6,7 @@ export interface ICategory extends Document {
   tenantId?: string;
 }
 
-const categoriesSchema = new Schema<ICategory>({
+const categoriesSchema: Schema<ICategory> = new Schema<ICategory>({
   label: {
     type: String,
     required: true,
diff --git a/packages/data-schemas/src/schema/chatProject.ts b/packages/data-schemas/src/schema/chatProject.ts
new file mode 100644
index 00000000000..837a68b3e72
--- /dev/null
+++ b/packages/data-schemas/src/schema/chatProject.ts
@@ -0,0 +1,50 @@
+import { Schema } from 'mongoose';
+import type { IChatProjectDocument } from '~/types';
+
+const chatProjectSchema: Schema<IChatProjectDocument> = new Schema<IChatProjectDocument>(
+  {
+    name: {
+      type: String,
+      required: true,
+      trim: true,
+      maxlength: 100,
+      index: true,
+    },
+    description: {
+      type: String,
+      default: '',
+      trim: true,
+      maxlength: 1000,
+    },
+    user: {
+      type: String,
+      required: true,
+      index: true,
+    },
+    conversationCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    lastConversationAt: {
+      type: Date,
+      default: null,
+      index: true,
+    },
+    lastConversationId: {
+      type: String,
+      default: null,
+    },
+    tenantId: {
+      type: String,
+      index: true,
+    },
+  },
+  { timestamps: true },
+);
+
+chatProjectSchema.index({ user: 1, name: 1, _id: 1 });
+chatProjectSchema.index({ user: 1, createdAt: -1, _id: -1 });
+chatProjectSchema.index({ user: 1, lastConversationAt: -1, _id: -1 });
+
+export default chatProjectSchema;
diff --git a/packages/data-schemas/src/schema/config.ts b/packages/data-schemas/src/schema/config.ts
index be3784d55e2..bc8654e9dfe 100644
--- a/packages/data-schemas/src/schema/config.ts
+++ b/packages/data-schemas/src/schema/config.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { PrincipalType, PrincipalModel } from 'librechat-data-provider';
 import type { IConfig } from '~/types';
 
-const configSchema = new Schema<IConfig>(
+const configSchema: Schema<IConfig> = new Schema<IConfig>(
   {
     principalType: {
       type: String,
@@ -30,6 +30,10 @@ const configSchema = new Schema<IConfig>(
       type: Schema.Types.Mixed,
       default: {},
     },
+    tombstones: {
+      type: [String],
+      default: [],
+    },
     isActive: {
       type: Boolean,
       default: true,
diff --git a/packages/data-schemas/src/schema/conversationTag.ts b/packages/data-schemas/src/schema/conversationTag.ts
index 6b37257121b..f3d0c8c0efb 100644
--- a/packages/data-schemas/src/schema/conversationTag.ts
+++ b/packages/data-schemas/src/schema/conversationTag.ts
@@ -9,7 +9,7 @@ export interface IConversationTag extends Document {
   tenantId?: string;
 }
 
-const conversationTag = new Schema<IConversationTag>(
+const conversationTag: Schema<IConversationTag> = new Schema<IConversationTag>(
   {
     tag: {
       type: String,
diff --git a/packages/data-schemas/src/schema/convo.ts b/packages/data-schemas/src/schema/convo.ts
index c8f394935a6..fb49b85ebbb 100644
--- a/packages/data-schemas/src/schema/convo.ts
+++ b/packages/data-schemas/src/schema/convo.ts
@@ -21,6 +21,10 @@ const convoSchema: Schema<IConversation> = new Schema(
       meiliIndex: true,
     },
     messages: [{ type: Schema.Types.ObjectId, ref: 'Message' }],
+    isTemporary: {
+      type: Boolean,
+      default: false,
+    },
     ...conversationPreset,
     agent_id: {
       type: String,
@@ -30,6 +34,11 @@ const convoSchema: Schema<IConversation> = new Schema(
       default: [],
       meiliIndex: true,
     },
+    chatProjectId: {
+      type: String,
+      default: null,
+      index: true,
+    },
     files: {
       type: [String],
     },
@@ -40,6 +49,9 @@ const convoSchema: Schema<IConversation> = new Schema(
       type: String,
       index: true,
     },
+    pinned: {
+      type: Boolean,
+    },
   },
   { timestamps: true },
 );
@@ -47,8 +59,11 @@ const convoSchema: Schema<IConversation> = new Schema(
 convoSchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 convoSchema.index({ createdAt: 1, updatedAt: 1 });
 convoSchema.index({ conversationId: 1, user: 1, tenantId: 1 }, { unique: true });
+convoSchema.index({ user: 1, chatProjectId: 1, updatedAt: -1, _id: -1 });
+convoSchema.index({ user: 1, chatProjectId: 1, createdAt: -1, _id: -1 });
 
+convoSchema.index({ user: 1, isTemporary: 1, expiredAt: 1 });
 // index for MeiliSearch sync operations
-convoSchema.index({ _meiliIndex: 1, expiredAt: 1 });
+convoSchema.index({ _meiliIndex: 1, isTemporary: 1, expiredAt: 1 });
 
 export default convoSchema;
diff --git a/packages/data-schemas/src/schema/defaults.ts b/packages/data-schemas/src/schema/defaults.ts
index 9b50bceb1d9..018dc56c659 100644
--- a/packages/data-schemas/src/schema/defaults.ts
+++ b/packages/data-schemas/src/schema/defaults.ts
@@ -1,7 +1,193 @@
 import { Schema } from 'mongoose';
 
 // @ts-ignore
-export const conversationPreset = {
+export const conversationPreset: {
+  endpoint: {
+    type: StringConstructor;
+    default: null;
+    required: boolean;
+  };
+  endpointType: {
+    type: StringConstructor;
+  };
+  // for azureOpenAI, openAI only
+  model: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for bedrock only
+  region: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for azureOpenAI, openAI only
+  chatGptLabel: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for google only
+  examples: {
+    type: {
+      type: typeof Schema.Types.Mixed;
+    }[];
+    default: undefined;
+  };
+  modelLabel: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  promptPrefix: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  temperature: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  top_p: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  // for google only
+  topP: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  topK: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  maxOutputTokens: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  maxTokens: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  presence_penalty: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  frequency_penalty: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  file_ids: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  // deprecated
+  resendImages: {
+    type: BooleanConstructor;
+  };
+  /* Anthropic only */
+  promptCache: {
+    type: BooleanConstructor;
+  };
+  promptCacheTtl: {
+    type: StringConstructor;
+  };
+  thinking: {
+    type: BooleanConstructor;
+  };
+  thinkingBudget: {
+    type: NumberConstructor;
+  };
+  thinkingLevel: {
+    type: StringConstructor;
+  };
+  effort: {
+    type: StringConstructor;
+  };
+  system: {
+    type: StringConstructor;
+  };
+  // files
+  resendFiles: {
+    type: BooleanConstructor;
+  };
+  imageDetail: {
+    type: StringConstructor;
+  };
+  /* agents */
+  agent_id: {
+    type: StringConstructor;
+  };
+  /* assistants */
+  assistant_id: {
+    type: StringConstructor;
+  };
+  instructions: {
+    type: StringConstructor;
+  };
+  stop: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  isArchived: {
+    type: BooleanConstructor;
+    default: boolean;
+  };
+  /* UI Components */
+  iconURL: {
+    type: StringConstructor;
+  };
+  greeting: {
+    type: StringConstructor;
+  };
+  spec: {
+    type: StringConstructor;
+  };
+  tags: {
+    type: StringConstructor[];
+    default: never[];
+  };
+  tools: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  maxContextTokens: {
+    type: NumberConstructor;
+  };
+  max_tokens: {
+    type: NumberConstructor;
+  };
+  useResponsesApi: {
+    type: BooleanConstructor;
+  };
+  /** OpenAI Responses API / Anthropic API / Google API */
+  web_search: {
+    type: BooleanConstructor;
+  };
+  /** Google API: URL Context tool (+ native YouTube video understanding) */
+  url_context: {
+    type: BooleanConstructor;
+  };
+  disableStreaming: {
+    type: BooleanConstructor;
+  };
+  fileTokenLimit: {
+    type: NumberConstructor;
+  };
+  /** Reasoning models only */
+  reasoning_effort: {
+    type: StringConstructor;
+  };
+  reasoning_summary: {
+    type: StringConstructor;
+  };
+  /** Verbosity control */
+  verbosity: {
+    type: StringConstructor;
+  };
+} = {
   endpoint: {
     type: String,
     default: null,
@@ -77,6 +263,9 @@ export const conversationPreset = {
   promptCache: {
     type: Boolean,
   },
+  promptCacheTtl: {
+    type: String,
+  },
   thinking: {
     type: Boolean,
   },
@@ -143,6 +332,10 @@ export const conversationPreset = {
   web_search: {
     type: Boolean,
   },
+  /** Google API: URL Context tool (+ native YouTube video understanding) */
+  url_context: {
+    type: Boolean,
+  },
   disableStreaming: {
     type: Boolean,
   },
diff --git a/packages/data-schemas/src/schema/file.ts b/packages/data-schemas/src/schema/file.ts
index c8e7c72f522..b1b6eb31699 100644
--- a/packages/data-schemas/src/schema/file.ts
+++ b/packages/data-schemas/src/schema/file.ts
@@ -137,6 +137,9 @@ const file: Schema<IMongoFile> = new Schema(
       },
     },
     expiresAt: {
+      /* Short-lived upload TTL managed by MongoDB. This is separate from
+       * retention-scoped `expiredAt`, which is swept by application code
+       * after storage cleanup succeeds. */
       type: Date,
       expires: 3600, // 1 hour in seconds
     },
@@ -144,12 +147,18 @@ const file: Schema<IMongoFile> = new Schema(
       type: String,
       index: true,
     },
+    expiredAt: {
+      /* Retention deadline for persisted files. The file sweep deletes the
+       * backing storage first, then removes this metadata record. */
+      type: Date,
+    },
   },
   {
     timestamps: true,
   },
 );
 
+file.index({ expiredAt: 1 });
 file.index({ createdAt: 1, updatedAt: 1 });
 file.index(
   { filename: 1, conversationId: 1, context: 1, tenantId: 1 },
diff --git a/packages/data-schemas/src/schema/group.ts b/packages/data-schemas/src/schema/group.ts
index 3cdbd313309..73d8928233e 100644
--- a/packages/data-schemas/src/schema/group.ts
+++ b/packages/data-schemas/src/schema/group.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IGroup } from '~/types';
 
-const groupSchema = new Schema<IGroup>(
+const groupSchema: Schema<IGroup> = new Schema<IGroup>(
   {
     name: {
       type: String,
diff --git a/packages/data-schemas/src/schema/index.ts b/packages/data-schemas/src/schema/index.ts
index 2a5eff658bd..08471bf5c81 100644
--- a/packages/data-schemas/src/schema/index.ts
+++ b/packages/data-schemas/src/schema/index.ts
@@ -6,6 +6,7 @@ export { default as assistantSchema } from './assistant';
 export { default as balanceSchema } from './balance';
 export { default as bannerSchema } from './banner';
 export { default as categoriesSchema } from './categories';
+export { default as chatProjectSchema } from './chatProject';
 export { default as conversationTagSchema } from './conversationTag';
 export { default as convoSchema } from './convo';
 export { default as fileSchema } from './file';
@@ -18,6 +19,8 @@ export { default as promptGroupSchema } from './promptGroup';
 export { default as roleSchema } from './role';
 export { default as sessionSchema } from './session';
 export { default as shareSchema } from './share';
+export { default as skillSyncCredentialSchema } from './skillSyncCredential';
+export { default as skillSyncStatusSchema } from './skillSyncStatus';
 export { default as tokenSchema } from './token';
 export { default as toolCallSchema } from './toolCall';
 export { default as transactionSchema } from './transaction';
@@ -25,4 +28,5 @@ export { default as userSchema } from './user';
 export { default as memorySchema } from './memory';
 export { default as groupSchema } from './group';
 export { default as systemGrantSchema } from './systemGrant';
+export { default as auditLogSchema } from './auditLog';
 export { default as configSchema } from './config';
diff --git a/packages/data-schemas/src/schema/mcpServer.ts b/packages/data-schemas/src/schema/mcpServer.ts
index ac881932da8..9a0d63bff8a 100644
--- a/packages/data-schemas/src/schema/mcpServer.ts
+++ b/packages/data-schemas/src/schema/mcpServer.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { MCPServerDocument } from '~/types';
 
-const mcpServerSchema = new Schema<MCPServerDocument>(
+const mcpServerSchema: Schema<MCPServerDocument> = new Schema<MCPServerDocument>(
   {
     serverName: {
       type: String,
diff --git a/packages/data-schemas/src/schema/message.ts b/packages/data-schemas/src/schema/message.ts
index d68edd0df3a..d7fd3fafb0f 100644
--- a/packages/data-schemas/src/schema/message.ts
+++ b/packages/data-schemas/src/schema/message.ts
@@ -63,6 +63,10 @@ const messageSchema: Schema<IMessage> = new Schema(
       required: true,
       default: false,
     },
+    isTemporary: {
+      type: Boolean,
+      default: false,
+    },
     unfinished: {
       type: Boolean,
       default: false,
@@ -138,6 +142,15 @@ const messageSchema: Schema<IMessage> = new Schema(
      * the user bubble to preserve the audit trail of what actually ran.
      */
     alwaysAppliedSkills: { type: [String], default: undefined },
+    /**
+     * Verbatim excerpts the user quoted (via the "Add to chat" selection
+     * popup) to reference on this turn. UI metadata only — `MessageQuotes`
+     * renders these on the user bubble so the references persist through
+     * reload and history. The excerpts are merged into the user message text
+     * sent to the model at request time (counted in the user message token
+     * count), so they are not duplicated into the stored `text`.
+     */
+    quotes: { type: [String], default: undefined },
     /*
     attachments: {
       type: [
@@ -180,6 +193,6 @@ messageSchema.index({ createdAt: 1 });
 messageSchema.index({ messageId: 1, user: 1, tenantId: 1 }, { unique: true });
 
 // index for MeiliSearch sync operations
-messageSchema.index({ _meiliIndex: 1, expiredAt: 1 });
+messageSchema.index({ _meiliIndex: 1, isTemporary: 1, expiredAt: 1 });
 
 export default messageSchema;
diff --git a/packages/data-schemas/src/schema/preset.ts b/packages/data-schemas/src/schema/preset.ts
index 5af5163fd33..a4d64879b0c 100644
--- a/packages/data-schemas/src/schema/preset.ts
+++ b/packages/data-schemas/src/schema/preset.ts
@@ -28,6 +28,7 @@ export interface IPreset extends Document {
   file_ids?: string[];
   resendImages?: boolean;
   promptCache?: boolean;
+  promptCacheTtl?: '5m' | '1h';
   thinking?: boolean;
   thinkingBudget?: number;
   effort?: string;
@@ -51,6 +52,7 @@ export interface IPreset extends Document {
   verbosity?: string;
   useResponsesApi?: boolean;
   web_search?: boolean;
+  url_context?: boolean;
   disableStreaming?: boolean;
   fileTokenLimit?: number;
   tenantId?: string;
diff --git a/packages/data-schemas/src/schema/promptGroup.ts b/packages/data-schemas/src/schema/promptGroup.ts
index 629942f23bc..99dc8bda69f 100644
--- a/packages/data-schemas/src/schema/promptGroup.ts
+++ b/packages/data-schemas/src/schema/promptGroup.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { Constants } from 'librechat-data-provider';
 import type { IPromptGroupDocument } from '~/types';
 
-const promptGroupSchema = new Schema<IPromptGroupDocument>(
+const promptGroupSchema: Schema<IPromptGroupDocument> = new Schema<IPromptGroupDocument>(
   {
     name: {
       type: String,
diff --git a/packages/data-schemas/src/schema/role.ts b/packages/data-schemas/src/schema/role.ts
index ab1fc582e98..c931179631e 100644
--- a/packages/data-schemas/src/schema/role.ts
+++ b/packages/data-schemas/src/schema/role.ts
@@ -60,6 +60,7 @@ const rolePermissionsSchema = new Schema(
       [Permissions.CREATE]: { type: Boolean },
       [Permissions.SHARE]: { type: Boolean },
       [Permissions.SHARE_PUBLIC]: { type: Boolean },
+      [Permissions.CONFIGURE_OBO]: { type: Boolean },
     },
     [PermissionTypes.REMOTE_AGENTS]: {
       [Permissions.USE]: { type: Boolean },
@@ -73,6 +74,11 @@ const rolePermissionsSchema = new Schema(
       [Permissions.SHARE]: { type: Boolean },
       [Permissions.SHARE_PUBLIC]: { type: Boolean },
     },
+    [PermissionTypes.SHARED_LINKS]: {
+      [Permissions.CREATE]: { type: Boolean },
+      [Permissions.SHARE]: { type: Boolean },
+      [Permissions.SHARE_PUBLIC]: { type: Boolean },
+    },
   },
   { _id: false },
 );
diff --git a/packages/data-schemas/src/schema/share.ts b/packages/data-schemas/src/schema/share.ts
index 3238084889a..ca09857365b 100644
--- a/packages/data-schemas/src/schema/share.ts
+++ b/packages/data-schemas/src/schema/share.ts
@@ -1,4 +1,5 @@
 import mongoose, { Schema, Document, Types } from 'mongoose';
+import type { SharedFileSnapshot } from '~/types';
 
 export interface ISharedLink extends Document {
   conversationId: string;
@@ -7,12 +8,38 @@ export interface ISharedLink extends Document {
   messages?: Types.ObjectId[];
   shareId?: string;
   targetMessageId?: string;
-  isPublic: boolean;
+  expiredAt?: Date;
   createdAt?: Date;
   updatedAt?: Date;
   tenantId?: string;
+  snapshotFiles?: boolean;
+  fileSnapshots?: SharedFileSnapshot[];
 }
 
+/**
+ * Immutable file snapshot embedded on a shared link. Captures the metadata the
+ * share-scoped file routes need to stream/preview each referenced file without
+ * consulting the original owner's live file ACL. References the original stored
+ * object (no byte copy).
+ */
+const fileSnapshotSchema = new Schema<SharedFileSnapshot>(
+  {
+    file_id: { type: String, required: true },
+    source: { type: String },
+    storageKey: { type: String },
+    filepath: { type: String },
+    type: { type: String },
+    filename: { type: String },
+    bytes: { type: Number },
+    width: { type: Number },
+    height: { type: Number },
+    model: { type: String },
+    previewRevision: { type: String },
+    tenantId: { type: String },
+  },
+  { _id: false },
+);
+
 const shareSchema: Schema<ISharedLink> = new Schema(
   {
     conversationId: {
@@ -37,18 +64,25 @@ const shareSchema: Schema<ISharedLink> = new Schema(
       required: false,
       index: true,
     },
-    isPublic: {
-      type: Boolean,
-      default: true,
-    },
     tenantId: {
       type: String,
       index: true,
     },
+    expiredAt: {
+      type: Date,
+    },
+    snapshotFiles: {
+      type: Boolean,
+    },
+    fileSnapshots: {
+      type: [fileSnapshotSchema],
+      default: undefined,
+    },
   },
   { timestamps: true },
 );
 
+shareSchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 shareSchema.index({ conversationId: 1, user: 1, targetMessageId: 1, tenantId: 1 });
 
 export default shareSchema;
diff --git a/packages/data-schemas/src/schema/skill.ts b/packages/data-schemas/src/schema/skill.ts
index c3d30e981ad..9ece6d82cce 100644
--- a/packages/data-schemas/src/schema/skill.ts
+++ b/packages/data-schemas/src/schema/skill.ts
@@ -182,12 +182,9 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
     /**
      * Provenance of this skill's canonical definition.
      *
-     * - `inline` — authored directly inside LibreChat (the only path wired
-     *   up in phase 1).
-     * - `github` / `notion` — **reserved for phase 2+ external sync**. No
-     *   code path currently produces these values. The column exists now so
-     *   a future sync worker can populate `source` + `sourceMetadata` without
-     *   a schema migration.
+     * - `inline` — authored directly inside LibreChat.
+     * - `github` — mirrored from a configured GitHub skill sync source.
+     * - `notion` — reserved for future external sync integrations.
      */
     source: {
       type: String,
@@ -195,10 +192,8 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
       default: 'inline',
     },
     /**
-     * Arbitrary JSON provenance payload keyed by `source`. Phase 2+ sync
-     * workers will use this to store the upstream commit SHA (github),
-     * page id (notion), etc. Unused in phase 1 — kept `Mixed` to avoid
-     * committing to a shape before the sync paths exist.
+     * Arbitrary JSON provenance payload keyed by `source`. GitHub sync stores
+     * source id, upstream path, commit/blob SHAs, and sync status here.
      */
     sourceMetadata: {
       type: Schema.Types.Mixed,
@@ -211,7 +206,7 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
     /**
      * When `true`, the skill's SKILL.md body is auto-primed into every turn
      * without user `$` invocation or model discretion. Mirrors the
-     * `always-apply` YAML frontmatter field and is kept as a first-class
+     * always-apply YAML frontmatter field and is kept as a first-class
      * column so the `listAlwaysApplySkills` query at the top of every
      * request is an indexed lookup, not a frontmatter scan.
      */
@@ -234,5 +229,7 @@ skillSchema.index({ author: 1, tenantId: 1 });
 skillSchema.index({ category: 1, updatedAt: -1 });
 skillSchema.index({ updatedAt: -1, _id: 1 });
 skillSchema.index({ name: 1, author: 1, tenantId: 1 }, { unique: true });
+skillSchema.index({ source: 1, 'sourceMetadata.upstreamId': 1, tenantId: 1 });
+skillSchema.index({ source: 1, 'sourceMetadata.sourceId': 1, tenantId: 1 });
 
 export default skillSchema;
diff --git a/packages/data-schemas/src/schema/skillFile.ts b/packages/data-schemas/src/schema/skillFile.ts
index efb5a29c1db..27f38847b93 100644
--- a/packages/data-schemas/src/schema/skillFile.ts
+++ b/packages/data-schemas/src/schema/skillFile.ts
@@ -69,6 +69,9 @@ const skillFileSchema: Schema<ISkillFileDocument> = new Schema(
       type: String,
       required: true,
     },
+    sourceMetadata: {
+      type: Schema.Types.Mixed,
+    },
     mimeType: {
       type: String,
       required: true,
diff --git a/packages/data-schemas/src/schema/skillSyncCredential.ts b/packages/data-schemas/src/schema/skillSyncCredential.ts
new file mode 100644
index 00000000000..3ff90a1d79d
--- /dev/null
+++ b/packages/data-schemas/src/schema/skillSyncCredential.ts
@@ -0,0 +1,45 @@
+import { Schema } from 'mongoose';
+import type { ISkillSyncCredentialDocument } from '~/types/skillSync';
+
+const skillSyncCredentialSchema: Schema<ISkillSyncCredentialDocument> = new Schema(
+  {
+    provider: {
+      type: String,
+      enum: ['github'],
+      required: true,
+      index: true,
+    },
+    credentialKey: {
+      type: String,
+      required: true,
+      maxlength: 64,
+      match: /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/,
+      index: true,
+    },
+    encryptedToken: {
+      type: String,
+      required: true,
+      select: false,
+    },
+    tokenHash: {
+      type: String,
+      required: true,
+      select: false,
+    },
+    createdBy: {
+      type: Schema.Types.ObjectId,
+      ref: 'User',
+    },
+    updatedBy: {
+      type: Schema.Types.ObjectId,
+      ref: 'User',
+    },
+  },
+  {
+    timestamps: true,
+  },
+);
+
+skillSyncCredentialSchema.index({ provider: 1, credentialKey: 1 }, { unique: true });
+
+export default skillSyncCredentialSchema;
diff --git a/packages/data-schemas/src/schema/skillSyncStatus.ts b/packages/data-schemas/src/schema/skillSyncStatus.ts
new file mode 100644
index 00000000000..0413f9d02e2
--- /dev/null
+++ b/packages/data-schemas/src/schema/skillSyncStatus.ts
@@ -0,0 +1,97 @@
+import { Schema } from 'mongoose';
+import type { ISkillSyncStatusDocument } from '~/types/skillSync';
+
+const skillSyncStatusSchema: Schema<ISkillSyncStatusDocument> = new Schema(
+  {
+    provider: {
+      type: String,
+      enum: ['github'],
+      required: true,
+      index: true,
+    },
+    sourceId: {
+      type: String,
+      required: true,
+      maxlength: 128,
+      index: true,
+    },
+    tenantId: {
+      type: String,
+      index: true,
+    },
+    status: {
+      type: String,
+      enum: ['idle', 'running', 'succeeded', 'failed', 'skipped'],
+      default: 'idle',
+      required: true,
+    },
+    credentialKey: {
+      type: String,
+    },
+    owner: {
+      type: String,
+    },
+    repo: {
+      type: String,
+    },
+    ref: {
+      type: String,
+    },
+    paths: {
+      type: [String],
+      default: undefined,
+    },
+    startedAt: {
+      type: Date,
+    },
+    finishedAt: {
+      type: Date,
+    },
+    lastSuccessAt: {
+      type: Date,
+    },
+    lastFailureAt: {
+      type: Date,
+    },
+    errorCode: {
+      type: String,
+    },
+    errorMessage: {
+      type: String,
+    },
+    syncedSkillCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    syncedFileCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    deletedSkillCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    deletedFileCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    lockOwner: {
+      type: String,
+    },
+    lockExpiresAt: {
+      type: Date,
+      index: true,
+    },
+  },
+  {
+    timestamps: true,
+  },
+);
+
+skillSyncStatusSchema.index({ provider: 1, sourceId: 1, tenantId: 1 }, { unique: true });
+
+export default skillSyncStatusSchema;
diff --git a/packages/data-schemas/src/schema/systemGrant.ts b/packages/data-schemas/src/schema/systemGrant.ts
index 61ba319ba4c..eac8dc6b19c 100644
--- a/packages/data-schemas/src/schema/systemGrant.ts
+++ b/packages/data-schemas/src/schema/systemGrant.ts
@@ -1,9 +1,9 @@
 import { Schema } from 'mongoose';
 import { PrincipalType } from 'librechat-data-provider';
-import { isValidCapability } from '~/admin/capabilities';
 import type { ISystemGrant } from '~/types';
+import { isValidCapability } from '~/admin/capabilities';
 
-const systemGrantSchema = new Schema<ISystemGrant>(
+const systemGrantSchema: Schema<ISystemGrant> = new Schema<ISystemGrant>(
   {
     principalType: {
       type: String,
diff --git a/packages/data-schemas/src/schema/toolCall.ts b/packages/data-schemas/src/schema/toolCall.ts
index d36d6b758ab..cde2163ca3c 100644
--- a/packages/data-schemas/src/schema/toolCall.ts
+++ b/packages/data-schemas/src/schema/toolCall.ts
@@ -10,6 +10,7 @@ export interface IToolCallData extends Document {
   attachments?: TAttachment[];
   blockIndex?: number;
   partIndex?: number;
+  expiredAt?: Date;
   createdAt?: Date;
   updatedAt?: Date;
   tenantId?: string;
@@ -50,10 +51,14 @@ const toolCallSchema: Schema<IToolCallData> = new Schema(
       type: String,
       index: true,
     },
+    expiredAt: {
+      type: Date,
+    },
   },
   { timestamps: true },
 );
 
+toolCallSchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 toolCallSchema.index({ messageId: 1, user: 1, tenantId: 1 });
 toolCallSchema.index({ conversationId: 1, user: 1, tenantId: 1 });
 
diff --git a/packages/data-schemas/src/schema/user.ts b/packages/data-schemas/src/schema/user.ts
index 3e2756c3d40..8c407e3d365 100644
--- a/packages/data-schemas/src/schema/user.ts
+++ b/packages/data-schemas/src/schema/user.ts
@@ -23,7 +23,7 @@ const BackupCodeSchema = new Schema(
   { _id: false },
 );
 
-const userSchema = new Schema<IUser>(
+const userSchema: Schema<IUser> = new Schema<IUser>(
   {
     name: {
       type: String,
@@ -168,6 +168,7 @@ const userSchema = new Schema<IUser>(
 
 userSchema.index({ email: 1, tenantId: 1 }, { unique: true });
 userSchema.index({ role: 1, tenantId: 1 });
+userSchema.index({ idOnTheSource: 1, openidIssuer: 1, tenantId: 1 });
 
 const oAuthIdFields = [
   'googleId',
diff --git a/packages/data-schemas/src/types/aclEntry.ts b/packages/data-schemas/src/types/aclEntry.ts
index ae5860a5998..a2320b5a40e 100644
--- a/packages/data-schemas/src/types/aclEntry.ts
+++ b/packages/data-schemas/src/types/aclEntry.ts
@@ -22,6 +22,8 @@ export type AclEntry = {
   grantedBy?: Types.ObjectId;
   /** When this permission was granted */
   grantedAt?: Date;
+  /** Optional expiration date for permissions tied to expiring resources */
+  expiredAt?: Date;
   tenantId?: string;
 };
 
diff --git a/packages/data-schemas/src/types/admin.ts b/packages/data-schemas/src/types/admin.ts
index acf7969368f..5f08e09b810 100644
--- a/packages/data-schemas/src/types/admin.ts
+++ b/packages/data-schemas/src/types/admin.ts
@@ -65,8 +65,109 @@ export type AdminConfigDeleteResponse = {
   success: boolean;
 };
 
-/** Audit action types for grant changes. */
-export type AuditAction = 'grant_assigned' | 'grant_removed';
+/* ── Audit log taxonomy ─────────────────────────────────────────────── */
+
+/**
+ * High-level domains an audit entry can belong to. The audit log is a
+ * general-purpose, append-only compliance record; new domains (agent runs,
+ * tool/MCP calls, config and permission changes, approvals) are added here as
+ * the surface grows, without reshaping the record.
+ */
+export const AUDIT_CATEGORIES = [
+  'grant',
+  'agent_run',
+  'tool_call',
+  'mcp',
+  'config',
+  'permission',
+  'auth',
+  'approval',
+] as const;
+export type AuditCategory = (typeof AUDIT_CATEGORIES)[number];
+
+/**
+ * Single source of truth for the audit-action enum. Actions are namespaced
+ * `<category>.<verb>` so the registry stays readable as it grows and every
+ * action maps unambiguously to a category. The Mongoose schema enum and the
+ * HTTP handler's whitelist both consume this constant so they cannot drift.
+ */
+export const AUDIT_ACTIONS = ['grant.assigned', 'grant.removed'] as const;
+export type AuditAction = (typeof AUDIT_ACTIONS)[number];
+
+/** Maps each action to its category so writers never pass both. */
+export const AUDIT_ACTION_CATEGORY: Record<AuditAction, AuditCategory> = {
+  'grant.assigned': 'grant',
+  'grant.removed': 'grant',
+};
+
+/** Result of the audited operation. Kept first-class instead of being encoded
+ * into the action so `allowed` vs `denied` vs `failed` is queryable. */
+export const AUDIT_OUTCOMES = ['success', 'failure', 'denied', 'pending'] as const;
+export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
+
+/** Coarse severity for SIEM routing and alerting. */
+export const AUDIT_SEVERITIES = ['info', 'warning', 'critical'] as const;
+export type AuditSeverity = (typeof AUDIT_SEVERITIES)[number];
+
+/**
+ * Who initiated the action. Non-human actors are first-class: a scheduled job,
+ * an agent acting autonomously, an internal service, or a webhook are all
+ * representable without forcing a `User` id.
+ */
+export const AUDIT_ACTOR_TYPES = [
+  'user',
+  'system',
+  'agent',
+  'service',
+  'schedule',
+  'webhook',
+  'api',
+] as const;
+export type AuditActorType = (typeof AUDIT_ACTOR_TYPES)[number];
+
+/** Primitive metadata values; event-specific payload is a flat string-keyed map
+ * (e.g. `{ capability }` for grants, `{ runId, triggerType }` for agent runs). */
+export type AuditMetadataValue = string | number | boolean | null;
+export type AuditMetadata = Record<string, AuditMetadataValue>;
+
+/** Denormalized actor identity captured at write time. */
+export type AuditActor = {
+  type: AuditActorType;
+  /** Stable id (user id, service-account id, agent id); absent for anonymous
+   * system events. */
+  id?: string;
+  /** Display name captured at write time so the record stays readable after the
+   * underlying principal is renamed or deleted. */
+  name: string;
+};
+
+/** Generic target of the action — not principal-locked, so it can describe a
+ * role, agent, MCP server, config section, etc. */
+export type AuditTarget = {
+  type: string;
+  id?: string;
+  name?: string;
+};
+
+/** Request context for forensic joins and SIEM correlation. */
+export type AuditContext = {
+  /** Correlation id (`x-request-id` / `x-correlation-id`). */
+  requestId?: string;
+  ip?: string;
+  userAgent?: string;
+  sessionId?: string;
+};
+
+/** Per-entry tamper-evidence surfaced to readers. The full chain is verifiable
+ * via the verify endpoint. */
+export type AuditIntegrity = {
+  /** Monotonic per-chain sequence number (1-based). */
+  seq: number;
+  /** SHA-256 of this entry's canonical content linked to `prevHash`. */
+  hash: string;
+  /** Hash of the previous entry in the chain (genesis links to a zero hash). */
+  prevHash: string;
+};
 
 /** SystemGrant document as returned by the admin API. */
 export type AdminSystemGrant = {
@@ -79,16 +180,22 @@ export type AdminSystemGrant = {
   expiresAt?: string;
 };
 
-/** Audit log entry for grant changes as returned by the admin API. */
+/** Audit log entry as returned by the admin API. */
 export type AdminAuditLogEntry = {
   id: string;
+  schemaVersion: number;
+  category: AuditCategory;
   action: AuditAction;
-  actorId: string;
-  actorName: string;
-  targetPrincipalType: PrincipalType;
-  targetPrincipalId: string;
-  targetName: string;
-  capability: string;
+  outcome: AuditOutcome;
+  severity: AuditSeverity;
+  actor: AuditActor;
+  target: AuditTarget;
+  metadata?: AuditMetadata;
+  context?: AuditContext;
+  /** Absent = platform-operator entry; present = tenant-scoped entry. */
+  tenantId?: string;
+  integrity: AuditIntegrity;
+  /** `createdAt` as an ISO 8601 string. */
   timestamp: string;
 };
 
diff --git a/packages/data-schemas/src/types/app.ts b/packages/data-schemas/src/types/app.ts
index 4562e588eeb..0eb0f4d60b1 100644
--- a/packages/data-schemas/src/types/app.ts
+++ b/packages/data-schemas/src/types/app.ts
@@ -13,6 +13,7 @@ import type {
   TAssistantEndpoint,
   TAnthropicEndpoint,
   SummarizationConfig,
+  SkillSyncConfig,
 } from 'librechat-data-provider';
 
 export type JsonSchemaType = {
@@ -62,6 +63,10 @@ export interface AppConfig {
   summarization?: SummarizationConfig;
   /** Web search configuration */
   webSearch?: TCustomConfig['webSearch'];
+  /** Message filter configuration (PII and future filter types) */
+  messageFilter?: TCustomConfig['messageFilter'];
+  /** Skill sync configuration */
+  skillSync?: SkillSyncConfig;
   /** File storage strategy ('local', 's3', 'firebase', 'azure_blob', 'cloudfront') */
   fileStrategy: FileStorage;
   /** File strategies configuration */
diff --git a/packages/data-schemas/src/types/auditLog.ts b/packages/data-schemas/src/types/auditLog.ts
new file mode 100644
index 00000000000..0a851fec58f
--- /dev/null
+++ b/packages/data-schemas/src/types/auditLog.ts
@@ -0,0 +1,194 @@
+import type { Document, Types } from 'mongoose';
+import type {
+  AdminAuditLogEntry,
+  AuditAction,
+  AuditActor,
+  AuditActorType,
+  AuditCategory,
+  AuditContext,
+  AuditIntegrity,
+  AuditMetadata,
+  AuditOutcome,
+  AuditSeverity,
+  AuditTarget,
+} from './admin';
+
+/**
+ * AuditLog is an append-only, hash-chained compliance record. Enforcement lives
+ * in `~/schema/auditLog` (immutable fields, pre-update/delete/save hooks) and in
+ * `~/methods/auditLog` (per-chain hash linking + a unique `{ chainKey, seq }`
+ * index that serializes concurrent appends). `createdAt` is set explicitly by
+ * the writer so it is covered by the entry hash.
+ */
+export type AuditLog = {
+  /** Record-format version, so future migrations can interpret older rows. */
+  schemaVersion: number;
+  category: AuditCategory;
+  action: AuditAction;
+  outcome: AuditOutcome;
+  severity: AuditSeverity;
+  actor: AuditActor;
+  target: AuditTarget;
+  metadata?: AuditMetadata;
+  context?: AuditContext;
+  /** Absent = platform-level entry; present = tenant-scoped entry. */
+  tenantId?: string;
+  /**
+   * Always present; equals `tenantId` or the platform sentinel. The hash chain
+   * and keyset pagination are scoped to this key, and `{ chainKey, seq }` is the
+   * unique index that serializes appends.
+   */
+  chainKey: string;
+  /** Monotonic per-chain sequence number (1-based). */
+  seq: number;
+  /** Hash of the previous entry in the chain; genesis links to the zero hash. */
+  prevHash: string;
+  /** SHA-256 over this entry's canonical content (including `seq` and `prevHash`). */
+  hash: string;
+  createdAt: Date;
+};
+
+export type IAuditLog = AuditLog &
+  Document & {
+    _id: Types.ObjectId;
+  };
+
+/** Actor as accepted by writers; `id` may be an ObjectId for convenience. */
+export interface AuditActorInput {
+  type: AuditActorType;
+  id?: string | Types.ObjectId;
+  name: string;
+}
+
+/** Target as accepted by writers; `id` may be an ObjectId for convenience. */
+export interface AuditTargetInput {
+  type: string;
+  id?: string | Types.ObjectId;
+  name?: string;
+}
+
+export interface RecordAuditEntryInput {
+  action: AuditAction;
+  /** Derived from `action` when omitted. */
+  category?: AuditCategory;
+  /** Defaults to `'success'`. */
+  outcome?: AuditOutcome;
+  /** Defaults to `'warning'` for `failure`/`denied`, else `'info'`. */
+  severity?: AuditSeverity;
+  actor: AuditActorInput;
+  target: AuditTargetInput;
+  metadata?: AuditMetadata;
+  context?: AuditContext;
+  tenantId?: string;
+}
+
+/** Options that shape a single audit write. */
+export interface RecordAuditEntryOptions {
+  /**
+   * When true, a failed write throws instead of resolving to `null`. Callers
+   * that must not proceed without a durable audit record opt in here; the
+   * default is fail-open so audit emission never blocks a privileged operation.
+   */
+  failClosed?: boolean;
+}
+
+export interface AuditLogFilters {
+  search?: string;
+  category?: AuditCategory[];
+  action?: AuditAction[];
+  outcome?: AuditOutcome[];
+  severity?: AuditSeverity[];
+  /** Exact match on `actor.type`. */
+  actorType?: AuditActorType;
+  /** Case-insensitive substring match against the denormalized `actor.name`. */
+  actorQuery?: string;
+  /** Exact match on `target.type`. */
+  targetType?: string;
+  /** Case-insensitive substring match against the denormalized `target.name`. */
+  targetQuery?: string;
+  /** Case-insensitive substring match against `metadata.capability`. */
+  capability?: string;
+  from?: Date;
+  to?: Date;
+  /** Offset pagination (legacy / random-access). Prefer `cursor`. */
+  offset?: number;
+  limit?: number;
+  /**
+   * Keyset cursor: the `seq` of the last entry from the previous page. Results
+   * are newest-first, so the next page is `seq < cursor`. Stable under
+   * concurrent appends, unlike `offset`.
+   */
+  cursor?: number;
+}
+
+export interface AuditLogPage {
+  entries: AdminAuditLogEntry[];
+  total: number;
+  /** Pass as `cursor` to fetch the next page; `null` when the page is the last. */
+  nextCursor: number | null;
+}
+
+/** Outcome of verifying a chain's tamper-evidence. */
+export interface AuditChainVerification {
+  ok: boolean;
+  chainKey: string;
+  /** Number of entries inspected. */
+  checked: number;
+  /** First `seq` where the chain broke (gap, broken link, or hash mismatch). */
+  brokenAt?: number;
+  reason?: string;
+  /** Earliest/latest `seq` present. `firstSeq > 1` indicates a purged prefix. */
+  range?: { firstSeq: number; lastSeq: number };
+}
+
+export interface PurgeAuditLogOptions {
+  /** Delete entries strictly older than this instant (a contiguous prefix). */
+  before: Date;
+  /** Required safety latch; the purge is a no-op unless explicitly confirmed. */
+  confirm: boolean;
+}
+
+/** A trusted boundary marker proving a prefix was purged by an authorized
+ * retention run rather than deleted by an attacker. Persisted by the caller
+ * (e.g. alongside retention-job records) and passed back to `verifyAuditChain`. */
+export interface AuditCheckpoint {
+  /** Highest `seq` that was purged; the chain resumes at `throughSeq + 1`. */
+  throughSeq: number;
+  /** Hash of the last purged entry === `prevHash` of the new earliest entry. */
+  prevHash: string;
+}
+
+export interface PurgeAuditLogResult {
+  deletedCount: number;
+  /** The boundary the verifier must be given to accept the now-shorter chain.
+   * Absent when the chain is now empty or nothing was purged. */
+  checkpoint?: AuditCheckpoint;
+}
+
+export interface VerifyAuditChainOptions {
+  /** Stop verification early when the caller has gone away. */
+  isCancelled?: () => boolean;
+  /** Maximum rows to inspect before returning a bounded, non-OK result. */
+  maxRows?: number;
+  /** When the chain no longer starts at `seq: 1` (a prefix was purged), the
+   * verifier requires this boundary to distinguish an authorized retention purge
+   * from an attacker deleting the oldest rows. Without it, a non-genesis start
+   * fails verification rather than being silently trusted. */
+  trustedCheckpoint?: AuditCheckpoint;
+}
+
+/** Re-exported so consumers can import the entry shape and its supporting types
+ * from one module. */
+export type {
+  AdminAuditLogEntry,
+  AuditAction,
+  AuditActor,
+  AuditActorType,
+  AuditCategory,
+  AuditContext,
+  AuditIntegrity,
+  AuditMetadata,
+  AuditOutcome,
+  AuditSeverity,
+  AuditTarget,
+};
diff --git a/packages/data-schemas/src/types/chatProject.ts b/packages/data-schemas/src/types/chatProject.ts
new file mode 100644
index 00000000000..8486ec6f2b1
--- /dev/null
+++ b/packages/data-schemas/src/types/chatProject.ts
@@ -0,0 +1,16 @@
+import type { Document, Types } from 'mongoose';
+
+export interface IChatProject {
+  _id?: Types.ObjectId;
+  name: string;
+  description?: string;
+  user: string;
+  conversationCount: number;
+  lastConversationAt?: Date | null;
+  lastConversationId?: string | null;
+  createdAt?: Date;
+  updatedAt?: Date;
+  tenantId?: string;
+}
+
+export interface IChatProjectDocument extends Omit<IChatProject, '_id'>, Document {}
diff --git a/packages/data-schemas/src/types/config.ts b/packages/data-schemas/src/types/config.ts
index 04e0ca58abd..b980a709939 100644
--- a/packages/data-schemas/src/types/config.ts
+++ b/packages/data-schemas/src/types/config.ts
@@ -18,6 +18,8 @@ export type Config = {
   priority: number;
   /** Configuration overrides matching librechat.yaml structure */
   overrides: Partial<TCustomConfig>;
+  /** Dot-paths that suppress inherited config values during resolution */
+  tombstones?: string[];
   /** Whether this config override is currently active */
   isActive: boolean;
   /** Version number for cache invalidation, auto-increments on overrides change */
diff --git a/packages/data-schemas/src/types/convo.ts b/packages/data-schemas/src/types/convo.ts
index c7888efba2c..1f81948fb3a 100644
--- a/packages/data-schemas/src/types/convo.ts
+++ b/packages/data-schemas/src/types/convo.ts
@@ -6,6 +6,7 @@ export interface IConversation extends Document {
   title?: string;
   user?: string;
   messages?: Types.ObjectId[];
+  isTemporary?: boolean;
   // Fields provided by conversationPreset (adjust types as needed)
   endpoint?: string;
   endpointType?: string;
@@ -26,6 +27,7 @@ export interface IConversation extends Document {
   file_ids?: string[];
   resendImages?: boolean;
   promptCache?: boolean;
+  promptCacheTtl?: '5m' | '1h';
   thinking?: boolean;
   thinkingBudget?: number;
   effort?: string;
@@ -37,10 +39,12 @@ export interface IConversation extends Document {
   instructions?: string;
   stop?: string[];
   isArchived?: boolean;
+  pinned?: boolean;
   iconURL?: string;
   greeting?: string;
   spec?: string;
   tags?: string[];
+  chatProjectId?: string | null;
   tools?: string[];
   maxContextTokens?: number;
   max_tokens?: number;
@@ -49,6 +53,7 @@ export interface IConversation extends Document {
   verbosity?: string;
   useResponsesApi?: boolean;
   web_search?: boolean;
+  url_context?: boolean;
   disableStreaming?: boolean;
   fileTokenLimit?: number;
   // Additional fields
diff --git a/packages/data-schemas/src/types/file.ts b/packages/data-schemas/src/types/file.ts
index b47a18abb64..9ccdf160349 100644
--- a/packages/data-schemas/src/types/file.ts
+++ b/packages/data-schemas/src/types/file.ts
@@ -72,6 +72,7 @@ export interface IMongoFile extends Omit<Document, 'model'> {
     codeEnvRef?: CodeEnvRef;
   };
   expiresAt?: Date;
+  expiredAt?: Date | null;
   createdAt?: Date;
   updatedAt?: Date;
   tenantId?: string;
diff --git a/packages/data-schemas/src/types/index.ts b/packages/data-schemas/src/types/index.ts
index f0b1fee5ec4..3dc52285321 100644
--- a/packages/data-schemas/src/types/index.ts
+++ b/packages/data-schemas/src/types/index.ts
@@ -5,6 +5,7 @@ export * from './app';
 export * from './user';
 export * from './token';
 export * from './convo';
+export * from './chatProject';
 export * from './session';
 export * from './balance';
 export * from './banner';
@@ -25,10 +26,12 @@ export * from './memory';
 export * from './prompts';
 /* Skills */
 export * from './skill';
+export * from './skillSync';
 /* Access Control */
 export * from './accessRole';
 export * from './aclEntry';
 export * from './systemGrant';
+export * from './auditLog';
 export * from './group';
 /* Config */
 export * from './config';
diff --git a/packages/data-schemas/src/types/message.ts b/packages/data-schemas/src/types/message.ts
index cf2213d88b9..96d9c1ff35f 100644
--- a/packages/data-schemas/src/types/message.ts
+++ b/packages/data-schemas/src/types/message.ts
@@ -1,5 +1,5 @@
-import type { Document } from 'mongoose';
 import type { TFeedbackRating, TFeedbackTag } from 'librechat-data-provider';
+import type { Document } from 'mongoose';
 
 // @ts-ignore
 export interface IMessage extends Document {
@@ -18,6 +18,7 @@ export interface IMessage extends Document {
   text?: string;
   summary?: string;
   isCreatedByUser: boolean;
+  isTemporary?: boolean;
   unfinished?: boolean;
   error?: boolean;
   finish_reason?: string;
@@ -53,6 +54,8 @@ export interface IMessage extends Document {
    * the current catalog says.
    */
   alwaysAppliedSkills?: string[];
+  /** Verbatim excerpts the user quoted to reference on this turn. UI-only metadata for `MessageQuotes`. */
+  quotes?: string[];
   expiredAt?: Date | null;
   createdAt?: Date;
   updatedAt?: Date;
diff --git a/packages/data-schemas/src/types/role.ts b/packages/data-schemas/src/types/role.ts
index 7ffa6e88497..2f6b6c813c4 100644
--- a/packages/data-schemas/src/types/role.ts
+++ b/packages/data-schemas/src/types/role.ts
@@ -72,6 +72,11 @@ export interface IRole extends Document {
       [Permissions.SHARE]?: boolean;
       [Permissions.SHARE_PUBLIC]?: boolean;
     };
+    [PermissionTypes.SHARED_LINKS]?: {
+      [Permissions.CREATE]?: boolean;
+      [Permissions.SHARE]?: boolean;
+      [Permissions.SHARE_PUBLIC]?: boolean;
+    };
   };
   tenantId?: string;
 }
diff --git a/packages/data-schemas/src/types/share.ts b/packages/data-schemas/src/types/share.ts
index 8b54990cf49..a7e9f030a8d 100644
--- a/packages/data-schemas/src/types/share.ts
+++ b/packages/data-schemas/src/types/share.ts
@@ -1,6 +1,32 @@
 import type { Types } from 'mongoose';
 import type { IMessage } from './message';
 
+/**
+ * Immutable snapshot of a file referenced by a shared chat snapshot. Captured at
+ * share create/update so shared-link viewers can preview/download the file through
+ * the share-scoped routes without consulting the original owner's live file ACL.
+ * References the original stored object (no byte copy); only the metadata needed to
+ * stream/preview is duplicated.
+ */
+export interface SharedFileSnapshot {
+  file_id: string;
+  source?: string;
+  storageKey?: string;
+  filepath?: string;
+  type?: string;
+  filename?: string;
+  bytes?: number;
+  width?: number;
+  height?: number;
+  model?: string;
+  /** Deferred-preview generation marker captured at share time. The share routes
+   * refuse to serve when the live file's revision no longer matches (the file_id
+   * was reused/overwritten by a later turn), so a link can't surface post-share
+   * content. */
+  previewRevision?: string;
+  tenantId?: string;
+}
+
 export interface ISharedLink {
   _id?: Types.ObjectId;
   conversationId: string;
@@ -9,20 +35,67 @@ export interface ISharedLink {
   messages?: Types.ObjectId[];
   shareId?: string;
   targetMessageId?: string;
-  isPublic: boolean;
+  expiredAt?: Date;
   createdAt?: Date;
   updatedAt?: Date;
+  /** Owning tenant for multi-tenant deployments (read by the shared-link access middleware). */
+  tenantId?: string;
+  /**
+   * Per-link choice of whether the conversation's files are included in the share
+   * (the "share files" checkbox). `false` means the viewer sees no files; absent
+   * means a legacy link (treated as included). Distinct from `fileSnapshots` so an
+   * opt-out is never mistaken for a not-yet-backfilled legacy link.
+   */
+  snapshotFiles?: boolean;
+  /** Per-share file snapshot referenced by the share-scoped file routes. */
+  fileSnapshots?: SharedFileSnapshot[];
 }
 
 export interface ShareServiceError extends Error {
   code: string;
 }
 
+/**
+ * A file or attachment as exposed through a public shared link: storage- and
+ * identity-internal fields are stripped, but render-relevant data (including
+ * dynamic tool-call payloads keyed by tool name) is preserved.
+ */
+export type SharedFile = Record<string, unknown>;
+
+/**
+ * Public, anonymized projection of a message returned by a shared link. Only
+ * render-relevant fields are surfaced; internal fields (user, endpoint,
+ * conversationSignature, clientId, plugin(s), metadata, etc.) are omitted.
+ */
+export type SharedMessage = Pick<
+  IMessage,
+  | 'messageId'
+  | 'parentMessageId'
+  | 'conversationId'
+  | 'sender'
+  | 'text'
+  | 'content'
+  | 'iconURL'
+  | 'isCreatedByUser'
+  | 'createdAt'
+  | 'updatedAt'
+  | 'tokenCount'
+  | 'unfinished'
+  | 'error'
+  | 'finish_reason'
+  | 'manualSkills'
+  | 'alwaysAppliedSkills'
+  | 'quotes'
+> & {
+  model?: string;
+  files?: SharedFile[];
+  attachments?: SharedFile[];
+};
+
 export interface SharedLinksResult {
   links: Array<{
     shareId: string;
     title: string;
-    isPublic: boolean;
     createdAt: Date;
     conversationId: string;
   }>;
@@ -32,32 +105,39 @@ export interface SharedLinksResult {
 
 export interface SharedMessagesResult {
   conversationId: string;
-  messages: Array<IMessage>;
+  messages: Array<SharedMessage>;
   shareId: string;
   title?: string;
-  isPublic: boolean;
   createdAt?: Date;
   updatedAt?: Date;
 }
 
 export interface CreateShareResult {
+  _id?: string;
   shareId: string;
   conversationId: string;
+  targetMessageId?: string;
 }
 
 export interface UpdateShareResult {
+  _id?: string;
   shareId: string;
   conversationId: string;
+  targetMessageId?: string;
 }
 
 export interface DeleteShareResult {
+  _id?: string;
   success: boolean;
   shareId: string;
   message: string;
 }
 
 export interface GetShareLinkResult {
+  _id?: string;
   shareId: string | null;
+  targetMessageId?: string;
+  snapshotFiles?: boolean;
   success: boolean;
 }
 
diff --git a/packages/data-schemas/src/types/skill.ts b/packages/data-schemas/src/types/skill.ts
index a2cba928d19..e10c5bfda76 100644
--- a/packages/data-schemas/src/types/skill.ts
+++ b/packages/data-schemas/src/types/skill.ts
@@ -70,14 +70,14 @@ export interface ISkill {
   version: number;
   /**
    * Provenance of this skill's canonical definition.
-   * - `inline` — authored inside LibreChat (the only value phase 1 produces).
-   * - `github` / `notion` — reserved for phase 2+ external sync. Kept in the
-   *   enum so a future sync worker can populate it without a migration.
+   * - `inline` — authored inside LibreChat.
+   * - `github` — mirrored from a configured GitHub skill sync source.
+   * - `notion` — reserved for future external sync integrations.
    */
   source: 'inline' | 'github' | 'notion';
   /**
-   * Provenance payload keyed by `source`. Phase 2+ sync workers will store
-   * upstream identifiers (commit SHA, page id, etc.) here. Unused in phase 1.
+   * Provenance payload keyed by `source`, including upstream identifiers
+   * such as GitHub source id, path, and commit/blob SHAs.
    */
   sourceMetadata?: Record<string, unknown>;
   /** Denormalized count of associated `SkillFile` rows. Kept in sync by skill methods. */
@@ -120,6 +120,7 @@ export interface ISkillFile {
   storageKey?: string;
   storageRegion?: string;
   source: string;
+  sourceMetadata?: Record<string, unknown>;
   mimeType: string;
   bytes: number;
   category: 'script' | 'reference' | 'asset' | 'other';
diff --git a/packages/data-schemas/src/types/skillSync.ts b/packages/data-schemas/src/types/skillSync.ts
new file mode 100644
index 00000000000..edd3bf5704a
--- /dev/null
+++ b/packages/data-schemas/src/types/skillSync.ts
@@ -0,0 +1,45 @@
+import type { Document, Types } from 'mongoose';
+
+export type SkillSyncProvider = 'github';
+export type SkillSyncRunStatus = 'idle' | 'running' | 'succeeded' | 'failed' | 'skipped';
+
+export interface ISkillSyncCredential {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  encryptedToken: string;
+  tokenHash: string;
+  createdBy?: Types.ObjectId;
+  updatedBy?: Types.ObjectId;
+  createdAt?: Date;
+  updatedAt?: Date;
+}
+
+export interface ISkillSyncCredentialDocument extends ISkillSyncCredential, Document {}
+
+export interface ISkillSyncStatus {
+  provider: SkillSyncProvider;
+  sourceId: string;
+  tenantId?: string;
+  status: SkillSyncRunStatus;
+  credentialKey?: string;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: Date;
+  finishedAt?: Date;
+  lastSuccessAt?: Date;
+  lastFailureAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  lockOwner?: string;
+  lockExpiresAt?: Date;
+  createdAt?: Date;
+  updatedAt?: Date;
+}
+
+export interface ISkillSyncStatusDocument extends ISkillSyncStatus, Document {}
diff --git a/packages/data-schemas/src/types/token.ts b/packages/data-schemas/src/types/token.ts
index fd5bfa3a8a0..560900c4090 100644
--- a/packages/data-schemas/src/types/token.ts
+++ b/packages/data-schemas/src/types/token.ts
@@ -19,15 +19,15 @@ export interface TokenCreateData {
   identifier?: string;
   token: string;
   expiresIn: number;
-  metadata?: Map<string, unknown>;
+  metadata?: Record<string, unknown> | Map<string, unknown>;
 }
 
 export interface TokenQuery {
   userId?: Types.ObjectId | string;
   token?: string;
-  email?: string;
-  type?: string;
-  identifier?: string;
+  email?: string | null;
+  type?: string | null;
+  identifier?: string | RegExp | null;
 }
 
 export interface TokenUpdateData {
@@ -37,7 +37,7 @@ export interface TokenUpdateData {
   token?: string;
   expiresAt?: Date;
   expiresIn?: number;
-  metadata?: Map<string, unknown>;
+  metadata?: Record<string, unknown> | Map<string, unknown>;
 }
 
 export interface TokenDeleteResult {
diff --git a/packages/data-schemas/src/utils/index.ts b/packages/data-schemas/src/utils/index.ts
index cdc69ce6b34..1cdf337be0f 100644
--- a/packages/data-schemas/src/utils/index.ts
+++ b/packages/data-schemas/src/utils/index.ts
@@ -1,6 +1,7 @@
 export * from './principal';
 export * from './string';
 export * from './tempChatRetention';
+export * from './retention';
 export { tenantSafeBulkWrite } from './tenantBulkWrite';
 export * from './transactions';
 export * from './objectId';
diff --git a/packages/data-schemas/src/utils/object-traverse.spec.ts b/packages/data-schemas/src/utils/object-traverse.spec.ts
new file mode 100644
index 00000000000..555d8740c04
--- /dev/null
+++ b/packages/data-schemas/src/utils/object-traverse.spec.ts
@@ -0,0 +1,158 @@
+import type { TraverseContext } from './object-traverse';
+import traverse from './object-traverse';
+
+/** Collects the dotted leaf paths visited during a traversal. */
+function collectLeafPaths(input: unknown): string[] {
+  const paths: string[] = [];
+  traverse(input).forEach(function (this: TraverseContext) {
+    if (this.isLeaf && !this.isRoot) {
+      paths.push(this.path.join('.'));
+    }
+  });
+  return paths;
+}
+
+/** Counts every node (including the root) visited during a traversal. */
+function countVisits(input: unknown, options?: { maxNodes?: number; maxDepth?: number }): number {
+  let count = 0;
+  traverse(input, options).forEach(function () {
+    count++;
+  });
+  return count;
+}
+
+describe('object-traverse', () => {
+  describe('correctness', () => {
+    it('visits every leaf of a plain nested object', () => {
+      const paths = collectLeafPaths({ a: 1, b: { c: 2, d: 3 } });
+      expect(paths).toEqual(expect.arrayContaining(['a', 'b.c', 'b.d']));
+    });
+
+    it('traverses shared (non-circular) references that appear in multiple branches', () => {
+      const shared = { secret: 'value' };
+      const paths = collectLeafPaths({ a: shared, b: shared });
+
+      expect(paths).toContain('a.secret');
+      expect(paths).toContain('b.secret');
+    });
+
+    it('traverses an array containing the same object multiple times', () => {
+      const shared = { value: 42 };
+      expect(collectLeafPaths([shared, shared, shared])).toEqual(['0.value', '1.value', '2.value']);
+    });
+
+    it('invokes the callback for each occurrence of a shared reference', () => {
+      const shared = { name: 'duplicate' };
+      const visited: unknown[] = [];
+      traverse({ first: shared, second: shared }).forEach(function (value: unknown) {
+        visited.push(value);
+      });
+
+      expect(visited.filter((node) => node === shared)).toHaveLength(2);
+    });
+
+    it('does not treat a diamond-shaped (DAG) structure as circular', () => {
+      const leaf = { v: 1 };
+      const paths = collectLeafPaths({ left: { leaf }, right: { leaf } });
+
+      expect(paths).toContain('left.leaf.v');
+      expect(paths).toContain('right.leaf.v');
+    });
+  });
+
+  describe('cycle safety', () => {
+    it('does not infinitely recurse on a self-referential object', () => {
+      const node: Record<string, unknown> = { id: 1 };
+      node.self = node;
+
+      const paths = collectLeafPaths(node);
+
+      expect(paths).toContain('id');
+      expect(paths).not.toContain('self.id');
+    });
+
+    it('does not infinitely recurse on a multi-node cycle', () => {
+      const a: Record<string, unknown> = { name: 'a' };
+      const b: Record<string, unknown> = { name: 'b' };
+      a.next = b;
+      b.prev = a;
+
+      expect(() => countVisits(a)).not.toThrow();
+      const paths = collectLeafPaths(a);
+      expect(paths).toContain('name');
+      expect(paths).toContain('next.name');
+    });
+  });
+
+  describe('bounds', () => {
+    it('caps total work via maxNodes on a fan-out DAG', () => {
+      // A diamond chain has 2^depth root-to-leaf paths; without a bound this
+      // would visit millions of nodes. The cap keeps it finite.
+      let node: Record<string, unknown> = { leaf: 1 };
+      for (let i = 0; i < 24; i++) {
+        const child = node;
+        node = { l: child, r: child };
+      }
+
+      expect(countVisits(node, { maxNodes: 5000 })).toBeLessThanOrEqual(5000);
+    });
+
+    it('stops descending past maxDepth, visiting deep nodes as leaves', () => {
+      const deep = { a: { b: { c: { d: { e: 'too deep' } } } } };
+
+      const leafLevels: number[] = [];
+      traverse(deep, { maxDepth: 2 }).forEach(function (this: TraverseContext) {
+        if (this.isLeaf) {
+          leafLevels.push(this.level);
+        }
+      });
+
+      expect(Math.max(...leafLevels)).toBe(2);
+    });
+
+    it('does not truncate ordinary objects under the default bounds', () => {
+      // root, a, b, b.c, b.d, and the three array elements.
+      expect(countVisits({ a: 1, b: { c: 2, d: [3, 4, 5] } })).toBe(8);
+    });
+
+    it('stops iterating array children once the node budget is exhausted', () => {
+      let indexReads = 0;
+      const big = Array.from({ length: 1000 }, (_, i) => ({ i }));
+      const probed = new Proxy(big, {
+        get(target, prop, receiver) {
+          if (typeof prop === 'string' && /^\d+$/.test(prop)) {
+            indexReads++;
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      });
+
+      // The budget is spent on the root alone, so the child loop must break
+      // before touching all 1000 elements (no O(n) work after the cap).
+      countVisits(probed, { maxNodes: 1 });
+
+      expect(indexReads).toBeLessThan(10);
+    });
+  });
+
+  describe('mutation safety', () => {
+    it('detects an ancestor cycle even when a callback replaces the node via update()', () => {
+      const arr: unknown[] = [];
+      arr.push(arr);
+
+      let selfVisits = 0;
+      traverse(arr, { maxDepth: 50 }).forEach(function (this: TraverseContext, value: unknown) {
+        if (value === arr) {
+          selfVisits++;
+        }
+        // Mimic the debug formatter, which rewrites array nodes in place.
+        if (this.notLeaf && Array.isArray(value)) {
+          this.update('[summary]');
+        }
+      });
+
+      // The self-reference is skipped as a true cycle, not re-expanded per level.
+      expect(selfVisits).toBe(1);
+    });
+  });
+});
diff --git a/packages/data-schemas/src/utils/object-traverse.ts b/packages/data-schemas/src/utils/object-traverse.ts
index 836f59a3451..c61fd5cab27 100644
--- a/packages/data-schemas/src/utils/object-traverse.ts
+++ b/packages/data-schemas/src/utils/object-traverse.ts
@@ -3,6 +3,28 @@
  * Simplified implementation focused on the forEach use case
  */
 
+/**
+ * Defensive bounds for traversal. Cycles are detected via the ancestor chain,
+ * but a shared (non-circular) reference reachable through many paths can still
+ * fan out super-linearly on a DAG. These caps keep traversal off the event loop
+ * floor for pathological inputs (e.g. logging a deeply shared object) without
+ * affecting normal use. Tune via the options argument to `traverse`.
+ */
+export interface TraverseOptions {
+  /** Maximum number of nodes visited before traversal stops. */
+  maxNodes?: number;
+  /** Maximum depth descended; deeper nodes are visited as leaves, not expanded. */
+  maxDepth?: number;
+}
+
+// Tuned for the sole consumer, the debug logger. Measured cost is ~140ns/node
+// with the formatter callback, so ~2.5k nodes keeps one log under ~1ms even on
+// slower prod hardware, while real log objects are ~25-30 nodes at depth 3-4 —
+// ample headroom. maxNodes bounds fan-out (the cost lever); maxDepth bounds
+// recursion/readability. Callers needing more override via the options argument.
+const DEFAULT_MAX_NODES = 2_500;
+const DEFAULT_MAX_DEPTH = 5;
+
 export interface TraverseContext {
   node: unknown;
   path: (string | number)[];
@@ -87,37 +109,60 @@ function deleteProperty(obj: TraversableObject, key: string | number): void {
   }
 }
 
-function forEach(obj: unknown, callback: ForEachCallback): void {
-  const visited = new WeakSet<object>();
+function hasOwnEnumerable(node: TraversableObject): boolean {
+  for (const key in node) {
+    if (Object.prototype.hasOwnProperty.call(node, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function forEach(obj: unknown, callback: ForEachCallback, options?: TraverseOptions): void {
+  const maxNodes = options?.maxNodes ?? DEFAULT_MAX_NODES;
+  const maxDepth = options?.maxDepth ?? DEFAULT_MAX_DEPTH;
+  let visitedCount = 0;
+  // Original (never-mutated) node references for the current DFS path, paired
+  // with their contexts. Cycle detection compares against these rather than
+  // context.node, which a callback's update() can reassign.
+  const ancestors: { node: TraversableObject; context: TraverseContext }[] = [];
+
+  function findAncestorCycle(node: TraversableObject): TraverseContext | null {
+    for (let i = ancestors.length - 1; i >= 0; i--) {
+      if (ancestors[i].node === node) {
+        return ancestors[i].context;
+      }
+    }
+    return null;
+  }
 
   function walk(node: unknown, path: (string | number)[] = [], parent?: TraverseContext): void {
-    // Check for circular references
+    if (visitedCount >= maxNodes) {
+      return; // Bound total work; stop once the node budget is exhausted.
+    }
+
+    // Detect cycles via the current DFS path's original node refs. A shared
+    // (non-circular) reference appearing in multiple branches is traversed
+    // independently; the node/depth caps keep a DAG of shared references from
+    // fanning out unboundedly.
     let circular: TraverseContext | null = null;
     if (isObject(node)) {
-      if (visited.has(node)) {
-        // Find the circular reference in the parent chain
-        let p = parent;
-        while (p) {
-          if (p.node === node) {
-            circular = p;
-            break;
-          }
-          p = p.parent;
-        }
-        return; // Skip circular references
+      circular = findAncestorCycle(node);
+      if (circular) {
+        return; // Skip true cycles to avoid infinite recursion.
       }
-      visited.add(node);
     }
 
     const key = path.length > 0 ? path[path.length - 1] : undefined;
     const isRoot = path.length === 0;
     const level = path.length;
+    const tooDeep = level >= maxDepth;
 
     // Determine if this is a leaf node
     const isLeaf =
+      tooDeep ||
       !isObject(node) ||
-      (Array.isArray(node) && node.length === 0) ||
-      Object.keys(node).length === 0;
+      (Array.isArray(node) ? node.length === 0 : !hasOwnEnumerable(node));
 
     // Create context
     const context: TraverseContext = {
@@ -149,19 +194,32 @@ function forEach(obj: unknown, callback: ForEachCallback): void {
     };
 
     // Call the callback with the context
+    visitedCount++;
     callback.call(context, node);
 
-    // Traverse children if not circular and is an object
-    if (!circular && isObject(node) && !isLeaf) {
+    // Traverse children within bounds, breaking as soon as the budget is spent
+    // so a wide array/object can't incur O(n) work after the cap is reached.
+    if (isObject(node) && !isLeaf) {
+      ancestors.push({ node, context });
       if (Array.isArray(node)) {
         for (let i = 0; i < node.length; i++) {
+          if (visitedCount >= maxNodes) {
+            break;
+          }
           walk(node[i], [...path, i], context);
         }
       } else {
-        for (const [childKey, childValue] of Object.entries(node)) {
-          walk(childValue, [...path, childKey], context);
+        for (const childKey in node) {
+          if (!Object.prototype.hasOwnProperty.call(node, childKey)) {
+            continue;
+          }
+          if (visitedCount >= maxNodes) {
+            break;
+          }
+          walk(node[childKey], [...path, childKey], context);
         }
       }
+      ancestors.pop();
     }
   }
 
@@ -169,10 +227,10 @@ function forEach(obj: unknown, callback: ForEachCallback): void {
 }
 
 // Main traverse function that returns an object with forEach method
-export default function traverse(obj: unknown) {
+export default function traverse(obj: unknown, options?: TraverseOptions) {
   return {
     forEach(callback: ForEachCallback): void {
-      forEach(obj, callback);
+      forEach(obj, callback, options);
     },
   };
 }
diff --git a/packages/data-schemas/src/utils/retention.ts b/packages/data-schemas/src/utils/retention.ts
new file mode 100644
index 00000000000..68188209da0
--- /dev/null
+++ b/packages/data-schemas/src/utils/retention.ts
@@ -0,0 +1,32 @@
+import type { FilterQuery } from 'mongoose';
+import { DEFAULT_RETENTION_HOURS } from './tempChatRetention';
+
+export type RetentionFilterDocument = {
+  isTemporary?: boolean | null;
+  expiredAt?: Date | null;
+};
+
+export const activeExpirationFilter = <
+  T extends RetentionFilterDocument = RetentionFilterDocument,
+>(): FilterQuery<T> =>
+  ({
+    $or: [{ expiredAt: null }, { expiredAt: { $gt: new Date() } }],
+  }) as FilterQuery<T>;
+
+export const legacyPermanentExpirationFilter = <
+  T extends RetentionFilterDocument = RetentionFilterDocument,
+>(): FilterQuery<T> => ({ expiredAt: null }) as FilterQuery<T>;
+
+export const buildRetentionVisibilityFilter = <
+  T extends RetentionFilterDocument = RetentionFilterDocument,
+>(): FilterQuery<T> =>
+  ({
+    $or: [
+      { isTemporary: false, expiredAt: null },
+      { isTemporary: false, expiredAt: { $gt: new Date() } },
+      { isTemporary: null, expiredAt: null },
+    ],
+  }) as FilterQuery<T>;
+
+export const createFallbackRetentionDate = (now: number = Date.now()): Date =>
+  new Date(now + DEFAULT_RETENTION_HOURS * 60 * 60 * 1000);
diff --git a/packages/data-schemas/src/utils/tempChatRetention.ts b/packages/data-schemas/src/utils/tempChatRetention.ts
index 663228c13ec..00122546254 100644
--- a/packages/data-schemas/src/utils/tempChatRetention.ts
+++ b/packages/data-schemas/src/utils/tempChatRetention.ts
@@ -1,10 +1,10 @@
-import logger from '~/config/winston';
 import type { AppConfig } from '~/types';
+import logger from '~/config/winston';
 
 /**
  * Default retention period for temporary chats in hours
  */
-export const DEFAULT_RETENTION_HOURS = 24 * 30; // 30 days
+export const DEFAULT_RETENTION_HOURS: number = 24 * 30; // 30 days
 
 /**
  * Minimum allowed retention period in hours
diff --git a/packages/data-schemas/tsconfig.json b/packages/data-schemas/tsconfig.json
index e5790a6cf88..76597facb6d 100644
--- a/packages/data-schemas/tsconfig.json
+++ b/packages/data-schemas/tsconfig.json
@@ -3,7 +3,8 @@
     "target": "ES2019",
     "module": "ESNext",
     "moduleResolution": "bundler",
-    "declaration": false,
+    "declaration": true,
+    "isolatedDeclarations": true,
     "noEmit": true,
     "strict": true,
     "esModuleInterop": true,
diff --git a/packages/data-schemas/tsdown.config.mjs b/packages/data-schemas/tsdown.config.mjs
new file mode 100644
index 00000000000..1b6923ce667
--- /dev/null
+++ b/packages/data-schemas/tsdown.config.mjs
@@ -0,0 +1,24 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+export default defineConfig({
+  entry: ['src/index.ts', 'src/admin/capabilities.ts'],
+  format: ['esm', 'cjs'],
+  platform: 'node',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Externalize all third-party deps (consumers provide the peers); bundle only `dotenv`
+  // so the package stays self-contained for its env-loading side effect, matching the
+  // prior Rollup build. `neverBundle` is the 0.22 replacement for the deprecated `external`.
+  deps: {
+    neverBundle: (id) =>
+      id !== 'dotenv' &&
+      !id.startsWith('dotenv/') &&
+      !id.startsWith('.') &&
+      !id.startsWith('~') &&
+      !path.isAbsolute(id),
+    // dotenv is bundled on purpose, so silence the "detected dependencies in bundle" hint.
+    onlyBundle: false,
+  },
+});
diff --git a/scripts/sort-imports.mts b/scripts/sort-imports.mts
new file mode 100644
index 00000000000..2d89608f76c
--- /dev/null
+++ b/scripts/sort-imports.mts
@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+/**
+ * Sorts imports across the LibreChat monorepo per project convention
+ * (CLAUDE.md § Import Order):
+ *
+ *   1. Package value imports     — shortest line to longest (`react` always first)
+ *   2. import type from packages — longest line to shortest
+ *   3. import type from local    — longest line to shortest
+ *   4. Local value imports       — longest line to shortest
+ *
+ * "Local" covers relative paths (`./`, `../`) and the workspace path aliases
+ * (`~/`, `src/`, `test/`). Workspace packages such as `librechat-data-provider`
+ * and `@librechat/*` are treated as package imports, not local.
+ *
+ * Runs on Node 24+ via native type-stripping (`.mts` keeps ESM semantics under
+ * the CommonJS repo root):
+ *
+ *   Run:        npm run sort-imports
+ *   Check only: npm run sort-imports:check
+ *   Targeted:   node scripts/sort-imports.mts path/to/file.ts [...]
+ */
+
+import { readFile, writeFile, readdir } from 'node:fs/promises';
+import { join, relative, resolve, sep, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Source roots scanned when no explicit files are passed. */
+const SOURCE_ROOTS = [
+  'api',
+  'client/src',
+  'packages/api/src',
+  'packages/data-provider/src',
+  'packages/data-schemas/src',
+  'packages/client/src',
+];
+
+const SOURCE_DIRS = SOURCE_ROOTS.map((rel) => resolve(ROOT, rel));
+const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'];
+const SKIP_DIR_NAMES = new Set([
+  'node_modules',
+  'dist',
+  'types',
+  'coverage',
+  '.turbo',
+  'data',
+  'demo',
+]);
+
+const args = process.argv.slice(2);
+const CHECK = args.includes('--check');
+const FILE_ARGS = args.filter((arg) => !arg.startsWith('--'));
+
+const LOCAL_PREFIXES = ['~/', 'src/', 'test/', './', '../'];
+
+/** Per-file opt-out for modules where import order is load-bearing. */
+const IGNORE_MARKER = /^\s*\/\/\s*sort-imports-ignore\b/;
+
+function isLocal(spec: string): boolean {
+  return LOCAL_PREFIXES.some((prefix) => spec.startsWith(prefix));
+}
+
+function hasSourceExtension(path: string): boolean {
+  return EXTENSIONS.some((ext) => path.endsWith(ext));
+}
+
+function isUnderSourceDir(abs: string): boolean {
+  return SOURCE_DIRS.some((dir) => abs === dir || abs.startsWith(`${dir}${sep}`));
+}
+
+interface Stmt {
+  raw: string;
+  spec: string;
+  isType: boolean;
+  isLocal: boolean;
+  len: number;
+}
+
+function extractSpec(raw: string): string | null {
+  return raw.match(/from\s+['"]([^'"]+)['"]/)?.[1] ?? null;
+}
+
+/** Applies the CLAUDE.md grouping/length ordering to a run of pure imports. */
+function sortSegment(stmts: Stmt[]): string[] {
+  const g1 = stmts
+    .filter((s) => !s.isType && !s.isLocal)
+    .sort((a, b) => {
+      const aReact = a.spec === 'react' ? 0 : 1;
+      const bReact = b.spec === 'react' ? 0 : 1;
+      if (aReact !== bReact) return aReact - bReact;
+      return a.len - b.len;
+    });
+  const g2 = stmts
+    .filter((s) => s.isType && !s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  const g3 = stmts
+    .filter((s) => s.isType && s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  const g4 = stmts
+    .filter((s) => !s.isType && s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  return [...g1, ...g2, ...g3, ...g4].map((s) => s.raw);
+}
+
+function sortFileImports(content: string): string | null {
+  const lines = content.split('\n');
+
+  if (lines.some((line) => IGNORE_MARKER.test(line))) {
+    return null;
+  }
+
+  let i = 0;
+  while (i < lines.length) {
+    const t = lines[i].trimStart();
+    if (
+      t === '' ||
+      t.startsWith('//') ||
+      t.startsWith('/*') ||
+      t.startsWith('*') ||
+      t.startsWith('*/') ||
+      t.startsWith('\'use ') ||
+      t.startsWith('"use ')
+    ) {
+      i++;
+    } else {
+      break;
+    }
+  }
+
+  const importStart = i;
+  // Side-effect imports (no `from` clause) are treated as immovable barriers:
+  // sorting is confined to each contiguous run of pure imports between them, so
+  // module-evaluation order around anything with side effects (polyfills,
+  // registration, css, etc.) is never changed.
+  const emitted: string[] = [];
+  const originalRaws: string[] = [];
+  let segment: Stmt[] = [];
+  let importEnd = i;
+
+  const flushSegment = (): void => {
+    if (segment.length === 0) return;
+    emitted.push(...sortSegment(segment));
+    segment = [];
+  };
+
+  while (i < lines.length) {
+    const t = lines[i].trimStart();
+    if (!t.startsWith('import ') && !t.startsWith('import{')) break;
+
+    let raw = lines[i];
+    let j = i;
+    while (!raw.includes(';') && j + 1 < lines.length) {
+      j++;
+      raw += '\n' + lines[j];
+    }
+    i = j + 1;
+    importEnd = i;
+    originalRaws.push(raw);
+
+    const spec = extractSpec(raw);
+    if (spec == null || spec === '') {
+      flushSegment();
+      emitted.push(raw);
+      while (i < lines.length && lines[i].trim() === '') i++;
+      continue;
+    }
+
+    segment.push({
+      raw,
+      spec,
+      isType: /^import\s+type[\s{]/.test(raw.trimStart()),
+      isLocal: isLocal(spec),
+      len: raw
+        .split('\n')
+        .map((l) => l.trim())
+        .join(' ').length,
+    });
+
+    while (i < lines.length && lines[i].trim() === '') i++;
+  }
+  flushSegment();
+
+  if (originalRaws.length < 2) return null;
+  if (originalRaws.join('\n') === emitted.join('\n')) return null;
+
+  return [
+    ...lines.slice(0, importStart),
+    ...emitted,
+    ...lines.slice(importEnd),
+  ].join('\n');
+}
+
+/** Recursively yields absolute paths of every source file under `dir`. */
+async function* walkSourceFiles(dir: string): AsyncGenerator<string> {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIR_NAMES.has(entry.name)) continue;
+      yield* walkSourceFiles(join(dir, entry.name));
+    } else if (entry.isFile() && hasSourceExtension(entry.name)) {
+      yield join(dir, entry.name);
+    }
+  }
+}
+
+/**
+ * Resolves the set of files to process. When explicit paths are passed
+ * (e.g. by lint-staged) only those source files under a known root are sorted;
+ * otherwise every source file under each root is scanned.
+ */
+async function collectFiles(): Promise<string[]> {
+  if (FILE_ARGS.length > 0) {
+    return FILE_ARGS.map((file) => resolve(file)).filter(
+      (abs) => hasSourceExtension(abs) && isUnderSourceDir(abs),
+    );
+  }
+
+  const files: string[] = [];
+  for (const dir of SOURCE_DIRS) {
+    try {
+      for await (const abs of walkSourceFiles(dir)) {
+        files.push(abs);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return files;
+}
+
+let changed = 0;
+let total = 0;
+
+for (const filePath of await collectFiles()) {
+  const rel = relative(ROOT, filePath);
+  const content = await readFile(filePath, 'utf8');
+  const result = sortFileImports(content);
+  total++;
+  if (result === null) continue;
+  changed++;
+  if (CHECK) {
+    console.log(`  ✗ ${rel}`);
+  } else {
+    await writeFile(filePath, result);
+    console.log(`  ✓ ${rel}`);
+  }
+}
+
+if (CHECK && changed) {
+  console.log(`\n${changed}/${total} files need sorting. Run: npm run sort-imports`);
+  process.exit(1);
+} else if (changed) {
+  console.log(`\nSorted ${changed}/${total} files.`);
+} else {
+  console.log(`All ${total} files already sorted.`);
+}
diff --git a/skill/README.md b/skill/README.md
new file mode 100644
index 00000000000..42da54931bc
--- /dev/null
+++ b/skill/README.md
@@ -0,0 +1,15 @@
+# Deployment Skills
+
+Place shared deployment skills in this directory. Each skill should live in its own folder with a
+`SKILL.md` file, for example:
+
+```text
+skill/
+  my-shared-skill/
+    SKILL.md
+    references/
+      notes.md
+```
+
+These skills are loaded at server startup, exposed read-only to all users with Skills enabled, and
+are not persisted as Skill documents in MongoDB.
diff --git a/turbo.json b/turbo.json
index 3f79eabbc62..f5c88b1c312 100644
--- a/turbo.json
+++ b/turbo.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://turbo.build/schema.json",
+  "$schema": "https://v2-9-17.turborepo.dev/schema.json",
   "globalDependencies": ["package-lock.json"],
   "tasks": {
     "build": {
@@ -13,6 +13,7 @@
         "scripts/**",
         "rollup.config.js",
         "server-rollup.config.js",
+        "tsdown.config.mjs",
         "tsconfig.json",
         "tsconfig.build.json",
         "vite.config.ts",